Annotation of embedaddon/php/ext/fileinfo/tests/magic, revision 1.1
1.1 ! misho 1: # Magic data for file(1) command.
! 2: # Format is described in magic(5).
! 3: # Don't edit this file, edit /etc/magic or send your suggested inclusions to
! 4: # this file as a wishlist bug against file (using the reportbug utility).
! 5:
! 6:
! 7: #------------------------------------------------------------------------------
! 8: # Localstuff: file(1) magic for locally observed files
! 9: #
! 10: # $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
! 11: # Add any locally observed files here. Remember:
! 12: # text if readable, executable if runnable binary, data if unreadable.
! 13: #------------------------------------------------------------------------------
! 14: # acorn: file(1) magic for files found on Acorn systems
! 15: #
! 16:
! 17: # RISC OS Chunk File Format
! 18: # From RISC OS Programmer's Reference Manual, Appendix D
! 19: # We guess the file type from the type of the first chunk.
! 20: 0 lelong 0xc3cbc6c5 RISC OS Chunk data
! 21: >12 string OBJ_ \b, AOF object
! 22: >12 string LIB_ \b, ALF library
! 23:
! 24: # RISC OS AIF, contains "SWI OS_Exit" at offset 16.
! 25: 16 lelong 0xef000011 RISC OS AIF executable
! 26:
! 27: # RISC OS Draw files
! 28: # From RISC OS Programmer's Reference Manual, Appendix E
! 29: 0 string Draw RISC OS Draw file data
! 30:
! 31: # RISC OS new format font files
! 32: # From RISC OS Programmer's Reference Manual, Appendix E
! 33: 0 string FONT\0 RISC OS outline font data,
! 34: >5 byte x version %d
! 35: 0 string FONT\1 RISC OS 1bpp font data,
! 36: >5 byte x version %d
! 37: 0 string FONT\4 RISC OS 4bpp font data
! 38: >5 byte x version %d
! 39:
! 40: # RISC OS Music files
! 41: # From RISC OS Programmer's Reference Manual, Appendix E
! 42: 0 string Maestro\r RISC OS music file
! 43: >8 byte x version %d
! 44:
! 45: >8 byte x type %d
! 46:
! 47: # Digital Symphony data files
! 48: # From: Bernard Jungen (bern8817@euphonynet.be)
! 49: 0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
! 50: >8 byte x version %d,
! 51: >9 pstring x named "%s",
! 52: >(9.b+19) byte =0 8-bit logarithmic
! 53: >(9.b+19) byte =1 LZW-compressed linear
! 54: >(9.b+19) byte =2 8-bit linear signed
! 55: >(9.b+19) byte =3 16-bit linear signed
! 56: >(9.b+19) byte =4 SigmaDelta-compressed linear
! 57: >(9.b+19) byte =5 SigmaDelta-compressed logarithmic
! 58: >(9.b+19) byte >5 unknown format
! 59:
! 60: 0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
! 61: >8 byte x version %d,
! 62: >9 byte =1 1 voice,
! 63: >9 byte !1 %d voices,
! 64: >10 leshort =1 1 track,
! 65: >10 leshort !1 %d tracks,
! 66: >12 leshort =1 1 pattern
! 67: >12 leshort !1 %d patterns
! 68:
! 69: 0 string \x02\x01\x13\x13\x10\x14\x12\x0e
! 70: >9 byte =0 Digital Symphony sequence (RISC OS),
! 71: >>8 byte x version %d,
! 72: >>10 byte =1 1 line,
! 73: >>10 byte !1 %d lines,
! 74: >>11 leshort =1 1 position
! 75: >>11 leshort !1 %d positions
! 76: >9 byte =1 Digital Symphony pattern data (RISC OS),
! 77: >>8 byte x version %d,
! 78: >>10 leshort =1 1 pattern
! 79: >>10 leshort !1 %d patterns
! 80:
! 81: #------------------------------------------------------------------------------
! 82: # adi: file(1) magic for ADi's objects
! 83: # From Gregory McGarry <g.mcgarry@ieee.org>
! 84: #
! 85: 0 leshort 0x521c COFF DSP21k
! 86: >18 lelong &02 executable,
! 87: >18 lelong ^02
! 88: >>18 lelong &01 static object,
! 89: >>18 lelong ^01 relocatable object,
! 90: >18 lelong &010 stripped
! 91: >18 lelong ^010 not stripped
! 92:
! 93: #------------------------------------------------------------------------------
! 94: # adventure: file(1) magic for Adventure game files
! 95: #
! 96: # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
! 97: # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
! 98: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
! 99: #
! 100: # ALAN
! 101: # I assume there are other, lower versions, but these are the only ones I
! 102: # saw in the archive.
! 103: 0 beshort 0x0206 ALAN game data
! 104: >2 byte <10 version 2.6%d
! 105:
! 106:
! 107: # Infocom (see z-machine)
! 108: #------------------------------------------------------------------------------
! 109: # Z-machine: file(1) magic for Z-machine binaries.
! 110: #
! 111: # This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
! 112: # appears to be a version-0 Z-machine binary.
! 113: #
! 114: # The (false match) message is to correct that behavior. Perhaps it is
! 115: # not needed.
! 116: #
! 117: 16 belong&0xfe00f0f0 0x3030 Infocom game data
! 118: >0 ubyte 0 (false match)
! 119: >0 ubyte >0 (Z-machine %d,
! 120: >>2 ubeshort x Release %d /
! 121: >>18 string >\0 Serial %.6s)
! 122:
! 123: #------------------------------------------------------------------------------
! 124: # Glulx: file(1) magic for Glulx binaries.
! 125: #
! 126: # I haven't checked for false matches yet.
! 127: #
! 128: 0 string Glul Glulx game data
! 129: >4 beshort x (Version %d
! 130: >>6 byte x \b.%d
! 131: >>8 byte x \b.%d)
! 132: >36 string Info Compiled by Inform
! 133:
! 134:
! 135:
! 136: # For Quetzal and blorb magic see iff
! 137:
! 138:
! 139: # TADS (Text Adventure Development System)
! 140: # All files are machine-independent (games compile to byte-code) and are tagged
! 141: # with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
! 142: # on the way).
! 143: # Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
! 144: 0 string TADS2\ bin TADS
! 145: >9 belong !0x0A0D1A00 game data, CORRUPTED
! 146: >9 belong 0x0A0D1A00
! 147: >>13 string >\0 %s game data
! 148: # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
! 149: 0 string TADS2\ rsc TADS
! 150: >9 belong !0x0A0D1A00 resource data, CORRUPTED
! 151: >9 belong 0x0A0D1A00
! 152: >>13 string >\0 %s resource data
! 153: # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
! 154: # 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
! 155: # "TADS2 save\n\r\032\0" and the interpreter version.
! 156: 0 string TADS2\ save/g TADS
! 157: >12 belong !0x0A0D1A00 saved game data, CORRUPTED
! 158: >12 belong 0x0A0D1A00
! 159: >>(16.s+32) string >\0 %s saved game data
! 160: # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
! 161: # version.
! 162: 0 string TADS2\ save TADS
! 163: >10 belong !0x0A0D1A00 saved game data, CORRUPTED
! 164: >10 belong 0x0A0D1A00
! 165: >>14 string >\0 %s saved game data
! 166:
! 167: # Danny Milosavljevic <danny.milo@gmx.net>
! 168: # this are adrift (adventure game standard) game files, extension .taf
! 169: # depending on version magic continues with 0x93453E6139FA (V 4.0)
! 170: # 0x9445376139FA (V 3.90)
! 171: # 0x9445366139FA (V 3.80)
! 172: # this is from source (http://www.adrift.org.uk/) and I have some taf
! 173: # files, and checked them.
! 174: #0 belong 0x3C423FC9
! 175: #>4 belong 0x6A87C2CF Adrift game file
! 176: #!:mime application/x-adrift
! 177: #------------------------------------------------------------------------------
! 178: # allegro: file(1) magic for Allegro datafiles
! 179: # Toby Deshane <hac@shoelace.digivill.net>
! 180: #
! 181: 0 belong 0x736C6821 Allegro datafile (packed)
! 182: 0 belong 0x736C682E Allegro datafile (not packed/autodetect)
! 183: 0 belong 0x736C682B Allegro datafile (appended exe data)
! 184:
! 185: #------------------------------------------------------------------------------
! 186: # alliant: file(1) magic for Alliant FX series a.out files
! 187: #
! 188: # If the FX series is the one that had a processor with a 68K-derived
! 189: # instruction set, the "short" should probably become "beshort" and the
! 190: # "long" should probably become "belong".
! 191: # If it's the i860-based one, they should probably become either the
! 192: # big-endian or little-endian versions, depending on the mode they ran
! 193: # the 860 in....
! 194: #
! 195: 0 short 0420 0420 Alliant virtual executable
! 196: >2 short &0x0020 common library
! 197: >16 long >0 not stripped
! 198: 0 short 0421 0421 Alliant compact executable
! 199: >2 short &0x0020 common library
! 200: >16 long >0 not stripped
! 201: #------------------------------------------------------------------------------
! 202: # alpha architecture description
! 203: #
! 204:
! 205: 0 leshort 0603 COFF format alpha
! 206: >22 leshort&030000 !020000 executable
! 207: >24 leshort 0410 pure
! 208: >24 leshort 0413 paged
! 209: >22 leshort&020000 !0 dynamically linked
! 210: >16 lelong !0 not stripped
! 211: >16 lelong 0 stripped
! 212: >22 leshort&030000 020000 shared library
! 213: >24 leshort 0407 object
! 214: >27 byte x - version %d
! 215: >26 byte x .%d
! 216: >28 byte x -%d
! 217:
! 218: # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
! 219: #
! 220: # The actual magic number is just "Core", followed by a 2-byte version
! 221: # number; however, treating any file that begins with "Core" as a Digital
! 222: # UNIX core dump file may produce too many false hits, so we include one
! 223: # byte of the version number as well; DU 5.0 appears only to be up to
! 224: # version 2.
! 225: #
! 226: 0 string Core\001 Alpha COFF format core dump (Digital UNIX)
! 227: >24 string >\0 \b, from '%s'
! 228: 0 string Core\002 Alpha COFF format core dump (Digital UNIX)
! 229: >24 string >\0 \b, from '%s'
! 230:
! 231: #------------------------------------------------------------------------------
! 232: # amanda: file(1) magic for amanda file format
! 233: #
! 234: 0 string AMANDA:\ AMANDA
! 235: >8 string TAPESTART\ DATE tape header file,
! 236: >>23 string X
! 237: >>>25 string >\ Unused %s
! 238: >>23 string >\ DATE %s
! 239: >8 string FILE\ dump file,
! 240: >>13 string >\ DATE %s
! 241: #------------------------------------------------------------------------------
! 242: # amigaos: file(1) magic for AmigaOS binary formats:
! 243:
! 244: #
! 245: # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
! 246: #
! 247: 0 belong 0x000003fa AmigaOS shared library
! 248: 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
! 249: 0 belong 0x000003e7 AmigaOS object/library data
! 250: #
! 251: 0 beshort 0xe310 Amiga Workbench
! 252: >2 beshort 1
! 253: >>48 byte 1 disk icon
! 254: >>48 byte 2 drawer icon
! 255: >>48 byte 3 tool icon
! 256: >>48 byte 4 project icon
! 257: >>48 byte 5 garbage icon
! 258: >>48 byte 6 device icon
! 259: >>48 byte 7 kickstart icon
! 260: >>48 byte 8 workbench application icon
! 261: >2 beshort >1 icon, vers. %d
! 262: #
! 263: # various sound formats from the Amiga
! 264: # G=F6tz Waschk <waschk@informatik.uni-rostock.de>
! 265: #
! 266: 0 string FC14 Future Composer 1.4 Module sound file
! 267: 0 string SMOD Future Composer 1.3 Module sound file
! 268: 0 string AON4artofnoise Art Of Noise Module sound file
! 269: 1 string MUGICIAN/SOFTEYES Mugician Module sound file
! 270: 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
! 271: 0 string Synth4.0 Synthesis Module sound file
! 272: 0 string ARP. The Holy Noise Module sound file
! 273: 0 string BeEp\0 JamCracker Module sound file
! 274: 0 string COSO\0 Hippel-COSO Module sound file
! 275: # Too simple (short, pure ASCII, deep), MPi
! 276: #26 string V.3 Brian Postma's Soundmon Module sound file v3
! 277: #26 string BPSM Brian Postma's Soundmon Module sound file v3
! 278: #26 string V.2 Brian Postma's Soundmon Module sound file v2
! 279:
! 280: # The following are from: "Stefan A. Haubenthal" <polluks@web.de>
! 281: 0 beshort 0x0f00 AmigaOS bitmap font
! 282: 0 beshort 0x0f03 AmigaOS outline font
! 283: 0 belong 0x80001001 AmigaOS outline tag
! 284: 0 string ##\ version catalog translation
! 285: 0 string EMOD\0 Amiga E module
! 286: 8 string ECXM\0 ECX module
! 287: 0 string/c @database AmigaGuide file
! 288:
! 289: # Amiga disk types
! 290: #
! 291: 0 string RDSK Rigid Disk Block
! 292: >160 string x on %.24s
! 293: 0 string DOS\0 Amiga DOS disk
! 294: 0 string DOS\1 Amiga FFS disk
! 295: 0 string DOS\2 Amiga Inter DOS disk
! 296: 0 string DOS\3 Amiga Inter FFS disk
! 297: 0 string DOS\4 Amiga Fastdir DOS disk
! 298: 0 string DOS\5 Amiga Fastdir FFS disk
! 299: 0 string KICK Kickstart disk
! 300:
! 301: # From: Alex Beregszaszi <alex@fsn.hu>
! 302: 0 string LZX LZX compressed archive (Amiga)
! 303:
! 304:
! 305: #------------------------------------------------------------------------------
! 306: # animation: file(1) magic for animation/movie formats
! 307: #
! 308: # animation formats
! 309: # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
! 310: # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
! 311:
! 312: # SGI and Apple formats
! 313: 0 string MOVI Silicon Graphics movie file
! 314: !:mime video/x-sgi-movie
! 315: 4 string moov Apple QuickTime
! 316: !:mime video/quicktime
! 317: >12 string mvhd \b movie (fast start)
! 318: >12 string mdra \b URL
! 319: >12 string cmov \b movie (fast start, compressed header)
! 320: >12 string rmra \b multiple URLs
! 321: 4 string mdat Apple QuickTime movie (unoptimized)
! 322: !:mime video/quicktime
! 323: #4 string wide Apple QuickTime movie (unoptimized)
! 324: #!:mime video/quicktime
! 325: #4 string skip Apple QuickTime movie (modified)
! 326: #!:mime video/quicktime
! 327: #4 string free Apple QuickTime movie (modified)
! 328: #!:mime video/quicktime
! 329: 4 string idsc Apple QuickTime image (fast start)
! 330: !:mime image/x-quicktime
! 331: #4 string idat Apple QuickTime image (unoptimized)
! 332: #!:mime image/x-quicktime
! 333: 4 string pckg Apple QuickTime compressed archive
! 334: !:mime application/x-quicktime-player
! 335: 4 string/B jP JPEG 2000 image
! 336: !:mime image/jp2
! 337: 4 string ftyp ISO Media
! 338: >8 string isom \b, MPEG v4 system, version 1
! 339: !:mime video/mp4
! 340: >8 string iso2 \b, MPEG v4 system, part 12 revision
! 341: >8 string mp41 \b, MPEG v4 system, version 1
! 342: !:mime video/mp4
! 343: >8 string mp42 \b, MPEG v4 system, version 2
! 344: !:mime video/mp4
! 345: >8 string mp7t \b, MPEG v4 system, MPEG v7 XML
! 346: >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
! 347: >8 string/B jp2 \b, JPEG 2000
! 348: !:mime image/jp2
! 349: >8 string 3gp \b, MPEG v4 system, 3GPP
! 350: !:mime video/3gpp
! 351: >>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
! 352: >>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
! 353: >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
! 354: >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
! 355: !:mime video/mp4
! 356: >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
! 357: !:mime video/3gpp
! 358: >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
! 359: !:mime audio/mp4
! 360: >8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC
! 361: !:mime video/mp4
! 362: >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
! 363: >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
! 364: >8 string/B qt \b, Apple QuickTime movie
! 365: !:mime video/quicktime
! 366:
! 367: # MPEG sequences
! 368: # Scans for all common MPEG header start codes
! 369: 0 belong 0x00000001
! 370: >4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
! 371: >>5 byte 66 \b, baseline
! 372: >>5 byte 77 \b, main
! 373: >>5 byte 88 \b, extended
! 374: >>7 byte x \b @ L %u
! 375: 0 belong&0xFFFFFF00 0x00000100
! 376: >3 byte 0xBA MPEG sequence
! 377: >>4 byte &0x40 \b, v2, program multiplex
! 378: >>4 byte ^0x40 \b, v1, system multiplex
! 379: >3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
! 380: >3 byte&0x1F 0x07 MPEG sequence, H.264 video
! 381: >>4 byte 66 \b, baseline
! 382: >>4 byte 77 \b, main
! 383: >>4 byte 88 \b, extended
! 384: >>6 byte x \b @ L %u
! 385: >3 byte 0xB0 MPEG sequence, v4
! 386: >>5 belong 0x000001B5
! 387: >>>9 byte &0x80
! 388: >>>>10 byte&0xF0 16 \b, video
! 389: >>>>10 byte&0xF0 32 \b, still texture
! 390: >>>>10 byte&0xF0 48 \b, mesh
! 391: >>>>10 byte&0xF0 64 \b, face
! 392: >>>9 byte&0xF8 8 \b, video
! 393: >>>9 byte&0xF8 16 \b, still texture
! 394: >>>9 byte&0xF8 24 \b, mesh
! 395: >>>9 byte&0xF8 32 \b, face
! 396: >>4 byte 1 \b, simple @ L1
! 397: >>4 byte 2 \b, simple @ L2
! 398: >>4 byte 3 \b, simple @ L3
! 399: >>4 byte 4 \b, simple @ L0
! 400: >>4 byte 17 \b, simple scalable @ L1
! 401: >>4 byte 18 \b, simple scalable @ L2
! 402: >>4 byte 33 \b, core @ L1
! 403: >>4 byte 34 \b, core @ L2
! 404: >>4 byte 50 \b, main @ L2
! 405: >>4 byte 51 \b, main @ L3
! 406: >>4 byte 53 \b, main @ L4
! 407: >>4 byte 66 \b, n-bit @ L2
! 408: >>4 byte 81 \b, scalable texture @ L1
! 409: >>4 byte 97 \b, simple face animation @ L1
! 410: >>4 byte 98 \b, simple face animation @ L2
! 411: >>4 byte 99 \b, simple face basic animation @ L1
! 412: >>4 byte 100 \b, simple face basic animation @ L2
! 413: >>4 byte 113 \b, basic animation text @ L1
! 414: >>4 byte 114 \b, basic animation text @ L2
! 415: >>4 byte 129 \b, hybrid @ L1
! 416: >>4 byte 130 \b, hybrid @ L2
! 417: >>4 byte 145 \b, advanced RT simple @ L!
! 418: >>4 byte 146 \b, advanced RT simple @ L2
! 419: >>4 byte 147 \b, advanced RT simple @ L3
! 420: >>4 byte 148 \b, advanced RT simple @ L4
! 421: >>4 byte 161 \b, core scalable @ L1
! 422: >>4 byte 162 \b, core scalable @ L2
! 423: >>4 byte 163 \b, core scalable @ L3
! 424: >>4 byte 177 \b, advanced coding efficiency @ L1
! 425: >>4 byte 178 \b, advanced coding efficiency @ L2
! 426: >>4 byte 179 \b, advanced coding efficiency @ L3
! 427: >>4 byte 180 \b, advanced coding efficiency @ L4
! 428: >>4 byte 193 \b, advanced core @ L1
! 429: >>4 byte 194 \b, advanced core @ L2
! 430: >>4 byte 209 \b, advanced scalable texture @ L1
! 431: >>4 byte 210 \b, advanced scalable texture @ L2
! 432: >>4 byte 211 \b, advanced scalable texture @ L3
! 433: >>4 byte 225 \b, simple studio @ L1
! 434: >>4 byte 226 \b, simple studio @ L2
! 435: >>4 byte 227 \b, simple studio @ L3
! 436: >>4 byte 228 \b, simple studio @ L4
! 437: >>4 byte 229 \b, core studio @ L1
! 438: >>4 byte 230 \b, core studio @ L2
! 439: >>4 byte 231 \b, core studio @ L3
! 440: >>4 byte 232 \b, core studio @ L4
! 441: >>4 byte 240 \b, advanced simple @ L0
! 442: >>4 byte 241 \b, advanced simple @ L1
! 443: >>4 byte 242 \b, advanced simple @ L2
! 444: >>4 byte 243 \b, advanced simple @ L3
! 445: >>4 byte 244 \b, advanced simple @ L4
! 446: >>4 byte 245 \b, advanced simple @ L5
! 447: >>4 byte 247 \b, advanced simple @ L3b
! 448: >>4 byte 248 \b, FGS @ L0
! 449: >>4 byte 249 \b, FGS @ L1
! 450: >>4 byte 250 \b, FGS @ L2
! 451: >>4 byte 251 \b, FGS @ L3
! 452: >>4 byte 252 \b, FGS @ L4
! 453: >>4 byte 253 \b, FGS @ L5
! 454: >3 byte 0xB5 MPEG sequence, v4
! 455: >>4 byte &0x80
! 456: >>>5 byte&0xF0 16 \b, video (missing profile header)
! 457: >>>5 byte&0xF0 32 \b, still texture (missing profile header)
! 458: >>>5 byte&0xF0 48 \b, mesh (missing profile header)
! 459: >>>5 byte&0xF0 64 \b, face (missing profile header)
! 460: >>4 byte&0xF8 8 \b, video (missing profile header)
! 461: >>4 byte&0xF8 16 \b, still texture (missing profile header)
! 462: >>4 byte&0xF8 24 \b, mesh (missing profile header)
! 463: >>4 byte&0xF8 32 \b, face (missing profile header)
! 464: >3 byte 0xB3 MPEG sequence
! 465: >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
! 466: >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
! 467: >>12 belong 0x000001B5 \b, v2,
! 468: >>>16 byte&0x0F 1 \b HP
! 469: >>>16 byte&0x0F 2 \b Spt
! 470: >>>16 byte&0x0F 3 \b SNR
! 471: >>>16 byte&0x0F 4 \b MP
! 472: >>>16 byte&0x0F 5 \b SP
! 473: >>>17 byte&0xF0 64 \b@HL
! 474: >>>17 byte&0xF0 96 \b@H-14
! 475: >>>17 byte&0xF0 128 \b@ML
! 476: >>>17 byte&0xF0 160 \b@LL
! 477: >>>17 byte &0x08 \b progressive
! 478: >>>17 byte ^0x08 \b interlaced
! 479: >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
! 480: >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
! 481: >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
! 482: >>11 byte &0x02
! 483: >>>75 byte &0x01
! 484: >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
! 485: >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
! 486: >>>>140 belong 0x000001B5 \b, v2,
! 487: >>>>>144 byte&0x0F 1 \b HP
! 488: >>>>>144 byte&0x0F 2 \b Spt
! 489: >>>>>144 byte&0x0F 3 \b SNR
! 490: >>>>>144 byte&0x0F 4 \b MP
! 491: >>>>>144 byte&0x0F 5 \b SP
! 492: >>>>>145 byte&0xF0 64 \b@HL
! 493: >>>>>145 byte&0xF0 96 \b@H-14
! 494: >>>>>145 byte&0xF0 128 \b@ML
! 495: >>>>>145 byte&0xF0 160 \b@LL
! 496: >>>>>145 byte &0x08 \b progressive
! 497: >>>>>145 byte ^0x08 \b interlaced
! 498: >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
! 499: >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
! 500: >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
! 501: >>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
! 502: >>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
! 503: >>76 belong 0x000001B5 \b, v2,
! 504: >>>80 byte&0x0F 1 \b HP
! 505: >>>80 byte&0x0F 2 \b Spt
! 506: >>>80 byte&0x0F 3 \b SNR
! 507: >>>80 byte&0x0F 4 \b MP
! 508: >>>80 byte&0x0F 5 \b SP
! 509: >>>81 byte&0xF0 64 \b@HL
! 510: >>>81 byte&0xF0 96 \b@H-14
! 511: >>>81 byte&0xF0 128 \b@ML
! 512: >>>81 byte&0xF0 160 \b@LL
! 513: >>>81 byte &0x08 \b progressive
! 514: >>>81 byte ^0x08 \b interlaced
! 515: >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
! 516: >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
! 517: >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
! 518: >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
! 519: >>>7 byte&0xF0 0x10 \b, 16:9
! 520: >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
! 521: >>>7 byte&0xF0 0x10 \b, 16:9
! 522: >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
! 523: >>>7 byte&0xF0 0x10 \b, 4:3
! 524: >>4 beshort&0xFFF0 0x2C00 \b, 4CIF
! 525: >>>5 beshort&0x0FFF 0x01E0 \b NTSC
! 526: >>>5 beshort&0x0FFF 0x0240 \b PAL
! 527: >>>7 byte&0xF0 0x20 \b, 4:3
! 528: >>>7 byte&0xF0 0x30 \b, 16:9
! 529: >>>7 byte&0xF0 0x40 \b, 11:5
! 530: >>>7 byte&0xF0 0x80 \b, PAL 4:3
! 531: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
! 532: >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
! 533: >>>7 byte&0xF0 0x10 \b, 4:3
! 534: >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
! 535: >>>7 byte&0xF0 0x10 \b, 4:3
! 536: >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
! 537: >>>7 byte&0xF0 0x10 \b, 4:3
! 538: >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
! 539: >>>7 byte&0xF0 0x10 \b, 4:3
! 540: >>4 beshort&0xFFF0 0x1600 \b, CIF
! 541: >>>5 beshort&0x0FFF 0x00F0 \b NTSC
! 542: >>>5 beshort&0x0FFF 0x0120 \b PAL
! 543: >>>7 byte&0xF0 0x20 \b, 4:3
! 544: >>>7 byte&0xF0 0x30 \b, 16:9
! 545: >>>7 byte&0xF0 0x40 \b, 11:5
! 546: >>>7 byte&0xF0 0x80 \b, PAL 4:3
! 547: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
! 548: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
! 549: >>>>7 byte&0xF0 0x20 \b, 4:3
! 550: >>>>7 byte&0xF0 0x30 \b, 16:9
! 551: >>>>7 byte&0xF0 0x40 \b, 11:5
! 552: >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
! 553: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
! 554: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
! 555: >>>7 byte&0xF0 0x20 \b, 4:3
! 556: >>>7 byte&0xF0 0x30 \b, 16:9
! 557: >>>7 byte&0xF0 0x40 \b, 11:5
! 558: >>4 beshort&0xFFF0 0x1E00 \b, SVCD
! 559: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
! 560: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
! 561: >>>7 byte&0xF0 0x20 \b, 4:3
! 562: >>>7 byte&0xF0 0x30 \b, 16:9
! 563: >>>7 byte&0xF0 0x40 \b, 11:5
! 564: >>7 byte&0x0F 1 \b, 23.976 fps
! 565: >>7 byte&0x0F 2 \b, 24 fps
! 566: >>7 byte&0x0F 3 \b, 25 fps
! 567: >>7 byte&0x0F 4 \b, 29.97 fps
! 568: >>7 byte&0x0F 5 \b, 30 fps
! 569: >>7 byte&0x0F 6 \b, 50 fps
! 570: >>7 byte&0x0F 7 \b, 59.94 fps
! 571: >>7 byte&0x0F 8 \b, 60 fps
! 572: >>11 byte &0x04 \b, Constrained
! 573:
! 574: # MPEG ADTS Audio (*.mpx/mxa/aac)
! 575: # from dreesen@math.fu-berlin.de
! 576: # modified to fully support MPEG ADTS
! 577:
! 578: # MP3, M1A
! 579: # modified by Joerg Jenderek
! 580: # GRR the original test are too common for many DOS files
! 581: # so don't accept as MP3 until we've tested the rate
! 582: 0 beshort&0xFFFE 0xFFFA
! 583: # rates
! 584: >2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
! 585: !:mime audio/mpeg
! 586: >2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
! 587: !:mime audio/mpeg
! 588: >2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
! 589: !:mime audio/mpeg
! 590: >2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
! 591: !:mime audio/mpeg
! 592: >2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
! 593: !:mime audio/mpeg
! 594: >2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
! 595: !:mime audio/mpeg
! 596: >2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
! 597: !:mime audio/mpeg
! 598: >2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
! 599: !:mime audio/mpeg
! 600: >2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
! 601: !:mime audio/mpeg
! 602: >2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
! 603: !:mime audio/mpeg
! 604: >2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
! 605: !:mime audio/mpeg
! 606: >2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
! 607: !:mime audio/mpeg
! 608: >2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
! 609: !:mime audio/mpeg
! 610: >2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
! 611: !:mime audio/mpeg
! 612: # timing
! 613: >2 byte&0x0C 0x00 \b, 44.1 kHz
! 614: >2 byte&0x0C 0x04 \b, 48 kHz
! 615: >2 byte&0x0C 0x08 \b, 32 kHz
! 616: # channels/options
! 617: >3 byte&0xC0 0x00 \b, Stereo
! 618: >3 byte&0xC0 0x40 \b, JntStereo
! 619: >3 byte&0xC0 0x80 \b, 2x Monaural
! 620: >3 byte&0xC0 0xC0 \b, Monaural
! 621: #>1 byte ^0x01 \b, Data Verify
! 622: #>2 byte &0x02 \b, Packet Pad
! 623: #>2 byte &0x01 \b, Custom Flag
! 624: #>3 byte &0x08 \b, Copyrighted
! 625: #>3 byte &0x04 \b, Original Source
! 626: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 627: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 628:
! 629: # MP2, M1A
! 630: 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
! 631: # rates
! 632: >2 byte&0xF0 0x10 \b, 32 kbps
! 633: >2 byte&0xF0 0x20 \b, 48 kbps
! 634: >2 byte&0xF0 0x30 \b, 56 kbps
! 635: >2 byte&0xF0 0x40 \b, 64 kbps
! 636: >2 byte&0xF0 0x50 \b, 80 kbps
! 637: >2 byte&0xF0 0x60 \b, 96 kbps
! 638: >2 byte&0xF0 0x70 \b, 112 kbps
! 639: >2 byte&0xF0 0x80 \b, 128 kbps
! 640: >2 byte&0xF0 0x90 \b, 160 kbps
! 641: >2 byte&0xF0 0xA0 \b, 192 kbps
! 642: >2 byte&0xF0 0xB0 \b, 224 kbps
! 643: >2 byte&0xF0 0xC0 \b, 256 kbps
! 644: >2 byte&0xF0 0xD0 \b, 320 kbps
! 645: >2 byte&0xF0 0xE0 \b, 384 kbps
! 646: # timing
! 647: >2 byte&0x0C 0x00 \b, 44.1 kHz
! 648: >2 byte&0x0C 0x04 \b, 48 kHz
! 649: >2 byte&0x0C 0x08 \b, 32 kHz
! 650: # channels/options
! 651: >3 byte&0xC0 0x00 \b, Stereo
! 652: >3 byte&0xC0 0x40 \b, JntStereo
! 653: >3 byte&0xC0 0x80 \b, 2x Monaural
! 654: >3 byte&0xC0 0xC0 \b, Monaural
! 655: #>1 byte ^0x01 \b, Data Verify
! 656: #>2 byte &0x02 \b, Packet Pad
! 657: #>2 byte &0x01 \b, Custom Flag
! 658: #>3 byte &0x08 \b, Copyrighted
! 659: #>3 byte &0x04 \b, Original Source
! 660: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 661: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 662:
! 663: # MPA, M1A
! 664: # updated by Joerg Jenderek
! 665: # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
! 666: # GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
! 667: # FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
! 668: #0 beshort&0xFFFE 0xFFFE
! 669: #>2 ubyte&0xF0 >0x0F
! 670: #>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
! 671: ## rate
! 672: #>>>2 byte&0xF0 0x10 \b, 32 kbps
! 673: #>>>2 byte&0xF0 0x20 \b, 64 kbps
! 674: #>>>2 byte&0xF0 0x30 \b, 96 kbps
! 675: #>>>2 byte&0xF0 0x40 \b, 128 kbps
! 676: #>>>2 byte&0xF0 0x50 \b, 160 kbps
! 677: #>>>2 byte&0xF0 0x60 \b, 192 kbps
! 678: #>>>2 byte&0xF0 0x70 \b, 224 kbps
! 679: #>>>2 byte&0xF0 0x80 \b, 256 kbps
! 680: #>>>2 byte&0xF0 0x90 \b, 288 kbps
! 681: #>>>2 byte&0xF0 0xA0 \b, 320 kbps
! 682: #>>>2 byte&0xF0 0xB0 \b, 352 kbps
! 683: #>>>2 byte&0xF0 0xC0 \b, 384 kbps
! 684: #>>>2 byte&0xF0 0xD0 \b, 416 kbps
! 685: #>>>2 byte&0xF0 0xE0 \b, 448 kbps
! 686: ## timing
! 687: #>>>2 byte&0x0C 0x00 \b, 44.1 kHz
! 688: #>>>2 byte&0x0C 0x04 \b, 48 kHz
! 689: #>>>2 byte&0x0C 0x08 \b, 32 kHz
! 690: ## channels/options
! 691: #>>>3 byte&0xC0 0x00 \b, Stereo
! 692: #>>>3 byte&0xC0 0x40 \b, JntStereo
! 693: #>>>3 byte&0xC0 0x80 \b, 2x Monaural
! 694: #>>>3 byte&0xC0 0xC0 \b, Monaural
! 695: ##>1 byte ^0x01 \b, Data Verify
! 696: ##>2 byte &0x02 \b, Packet Pad
! 697: ##>2 byte &0x01 \b, Custom Flag
! 698: ##>3 byte &0x08 \b, Copyrighted
! 699: ##>3 byte &0x04 \b, Original Source
! 700: ##>3 byte&0x03 1 \b, NR: 50/15 ms
! 701: ##>3 byte&0x03 3 \b, NR: CCIT J.17
! 702:
! 703: # MP3, M2A
! 704: 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
! 705: # rate
! 706: >2 byte&0xF0 0x10 \b, 8 kbps
! 707: >2 byte&0xF0 0x20 \b, 16 kbps
! 708: >2 byte&0xF0 0x30 \b, 24 kbps
! 709: >2 byte&0xF0 0x40 \b, 32 kbps
! 710: >2 byte&0xF0 0x50 \b, 40 kbps
! 711: >2 byte&0xF0 0x60 \b, 48 kbps
! 712: >2 byte&0xF0 0x70 \b, 56 kbps
! 713: >2 byte&0xF0 0x80 \b, 64 kbps
! 714: >2 byte&0xF0 0x90 \b, 80 kbps
! 715: >2 byte&0xF0 0xA0 \b, 96 kbps
! 716: >2 byte&0xF0 0xB0 \b, 112 kbps
! 717: >2 byte&0xF0 0xC0 \b, 128 kbps
! 718: >2 byte&0xF0 0xD0 \b, 144 kbps
! 719: >2 byte&0xF0 0xE0 \b, 160 kbps
! 720: # timing
! 721: >2 byte&0x0C 0x00 \b, 22.05 kHz
! 722: >2 byte&0x0C 0x04 \b, 24 kHz
! 723: >2 byte&0x0C 0x08 \b, 16 kHz
! 724: # channels/options
! 725: >3 byte&0xC0 0x00 \b, Stereo
! 726: >3 byte&0xC0 0x40 \b, JntStereo
! 727: >3 byte&0xC0 0x80 \b, 2x Monaural
! 728: >3 byte&0xC0 0xC0 \b, Monaural
! 729: #>1 byte ^0x01 \b, Data Verify
! 730: #>2 byte &0x02 \b, Packet Pad
! 731: #>2 byte &0x01 \b, Custom Flag
! 732: #>3 byte &0x08 \b, Copyrighted
! 733: #>3 byte &0x04 \b, Original Source
! 734: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 735: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 736:
! 737: # MP2, M2A
! 738: 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
! 739: # rate
! 740: >2 byte&0xF0 0x10 \b, 8 kbps
! 741: >2 byte&0xF0 0x20 \b, 16 kbps
! 742: >2 byte&0xF0 0x30 \b, 24 kbps
! 743: >2 byte&0xF0 0x40 \b, 32 kbps
! 744: >2 byte&0xF0 0x50 \b, 40 kbps
! 745: >2 byte&0xF0 0x60 \b, 48 kbps
! 746: >2 byte&0xF0 0x70 \b, 56 kbps
! 747: >2 byte&0xF0 0x80 \b, 64 kbps
! 748: >2 byte&0xF0 0x90 \b, 80 kbps
! 749: >2 byte&0xF0 0xA0 \b, 96 kbps
! 750: >2 byte&0xF0 0xB0 \b, 112 kbps
! 751: >2 byte&0xF0 0xC0 \b, 128 kbps
! 752: >2 byte&0xF0 0xD0 \b, 144 kbps
! 753: >2 byte&0xF0 0xE0 \b, 160 kbps
! 754: # timing
! 755: >2 byte&0x0C 0x00 \b, 22.05 kHz
! 756: >2 byte&0x0C 0x04 \b, 24 kHz
! 757: >2 byte&0x0C 0x08 \b, 16 kHz
! 758: # channels/options
! 759: >3 byte&0xC0 0x00 \b, Stereo
! 760: >3 byte&0xC0 0x40 \b, JntStereo
! 761: >3 byte&0xC0 0x80 \b, 2x Monaural
! 762: >3 byte&0xC0 0xC0 \b, Monaural
! 763: #>1 byte ^0x01 \b, Data Verify
! 764: #>2 byte &0x02 \b, Packet Pad
! 765: #>2 byte &0x01 \b, Custom Flag
! 766: #>3 byte &0x08 \b, Copyrighted
! 767: #>3 byte &0x04 \b, Original Source
! 768: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 769: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 770:
! 771: # MPA, M2A
! 772: 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
! 773: # rate
! 774: >2 byte&0xF0 0x10 \b, 32 kbps
! 775: >2 byte&0xF0 0x20 \b, 48 kbps
! 776: >2 byte&0xF0 0x30 \b, 56 kbps
! 777: >2 byte&0xF0 0x40 \b, 64 kbps
! 778: >2 byte&0xF0 0x50 \b, 80 kbps
! 779: >2 byte&0xF0 0x60 \b, 96 kbps
! 780: >2 byte&0xF0 0x70 \b, 112 kbps
! 781: >2 byte&0xF0 0x80 \b, 128 kbps
! 782: >2 byte&0xF0 0x90 \b, 144 kbps
! 783: >2 byte&0xF0 0xA0 \b, 160 kbps
! 784: >2 byte&0xF0 0xB0 \b, 176 kbps
! 785: >2 byte&0xF0 0xC0 \b, 192 kbps
! 786: >2 byte&0xF0 0xD0 \b, 224 kbps
! 787: >2 byte&0xF0 0xE0 \b, 256 kbps
! 788: # timing
! 789: >2 byte&0x0C 0x00 \b, 22.05 kHz
! 790: >2 byte&0x0C 0x04 \b, 24 kHz
! 791: >2 byte&0x0C 0x08 \b, 16 kHz
! 792: # channels/options
! 793: >3 byte&0xC0 0x00 \b, Stereo
! 794: >3 byte&0xC0 0x40 \b, JntStereo
! 795: >3 byte&0xC0 0x80 \b, 2x Monaural
! 796: >3 byte&0xC0 0xC0 \b, Monaural
! 797: #>1 byte ^0x01 \b, Data Verify
! 798: #>2 byte &0x02 \b, Packet Pad
! 799: #>2 byte &0x01 \b, Custom Flag
! 800: #>3 byte &0x08 \b, Copyrighted
! 801: #>3 byte &0x04 \b, Original Source
! 802: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 803: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 804:
! 805: # MP3, M25A
! 806: 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
! 807: # rate
! 808: >2 byte&0xF0 0x10 \b, 8 kbps
! 809: >2 byte&0xF0 0x20 \b, 16 kbps
! 810: >2 byte&0xF0 0x30 \b, 24 kbps
! 811: >2 byte&0xF0 0x40 \b, 32 kbps
! 812: >2 byte&0xF0 0x50 \b, 40 kbps
! 813: >2 byte&0xF0 0x60 \b, 48 kbps
! 814: >2 byte&0xF0 0x70 \b, 56 kbps
! 815: >2 byte&0xF0 0x80 \b, 64 kbps
! 816: >2 byte&0xF0 0x90 \b, 80 kbps
! 817: >2 byte&0xF0 0xA0 \b, 96 kbps
! 818: >2 byte&0xF0 0xB0 \b, 112 kbps
! 819: >2 byte&0xF0 0xC0 \b, 128 kbps
! 820: >2 byte&0xF0 0xD0 \b, 144 kbps
! 821: >2 byte&0xF0 0xE0 \b, 160 kbps
! 822: # timing
! 823: >2 byte&0x0C 0x00 \b, 11.025 kHz
! 824: >2 byte&0x0C 0x04 \b, 12 kHz
! 825: >2 byte&0x0C 0x08 \b, 8 kHz
! 826: # channels/options
! 827: >3 byte&0xC0 0x00 \b, Stereo
! 828: >3 byte&0xC0 0x40 \b, JntStereo
! 829: >3 byte&0xC0 0x80 \b, 2x Monaural
! 830: >3 byte&0xC0 0xC0 \b, Monaural
! 831: #>1 byte ^0x01 \b, Data Verify
! 832: #>2 byte &0x02 \b, Packet Pad
! 833: #>2 byte &0x01 \b, Custom Flag
! 834: #>3 byte &0x08 \b, Copyrighted
! 835: #>3 byte &0x04 \b, Original Source
! 836: #>3 byte&0x03 1 \b, NR: 50/15 ms
! 837: #>3 byte&0x03 3 \b, NR: CCIT J.17
! 838:
! 839: # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
! 840:
! 841: # Stored AAC streams (instead of the MP4 format)
! 842: 0 string ADIF MPEG ADIF, AAC
! 843: !:mime audio/x-hx-aac-adif
! 844: >4 byte &0x80
! 845: >>13 byte &0x10 \b, VBR
! 846: >>13 byte ^0x10 \b, CBR
! 847: >>16 byte&0x1E 0x02 \b, single stream
! 848: >>16 byte&0x1E 0x04 \b, 2 streams
! 849: >>16 byte&0x1E 0x06 \b, 3 streams
! 850: >>16 byte &0x08 \b, 4 or more streams
! 851: >>16 byte &0x10 \b, 8 or more streams
! 852: >>4 byte &0x80 \b, Copyrighted
! 853: >>13 byte &0x40 \b, Original Source
! 854: >>13 byte &0x20 \b, Home Flag
! 855: >4 byte ^0x80
! 856: >>4 byte &0x10 \b, VBR
! 857: >>4 byte ^0x10 \b, CBR
! 858: >>7 byte&0x1E 0x02 \b, single stream
! 859: >>7 byte&0x1E 0x04 \b, 2 streams
! 860: >>7 byte&0x1E 0x06 \b, 3 streams
! 861: >>7 byte &0x08 \b, 4 or more streams
! 862: >>7 byte &0x10 \b, 8 or more streams
! 863: >>4 byte &0x40 \b, Original Stream(s)
! 864: >>4 byte &0x20 \b, Home Source
! 865:
! 866: # Live or stored single AAC stream (used with MPEG-2 systems)
! 867: 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
! 868: !:mime audio/x-hx-aac-adts
! 869: >1 byte &0x08 \b, v2
! 870: >1 byte ^0x08 \b, v4
! 871: # profile
! 872: >>2 byte &0xC0 \b LTP
! 873: >2 byte&0xc0 0x00 \b Main
! 874: >2 byte&0xc0 0x40 \b LC
! 875: >2 byte&0xc0 0x80 \b SSR
! 876: # timing
! 877: >2 byte&0x3c 0x00 \b, 96 kHz
! 878: >2 byte&0x3c 0x04 \b, 88.2 kHz
! 879: >2 byte&0x3c 0x08 \b, 64 kHz
! 880: >2 byte&0x3c 0x0c \b, 48 kHz
! 881: >2 byte&0x3c 0x10 \b, 44.1 kHz
! 882: >2 byte&0x3c 0x14 \b, 32 kHz
! 883: >2 byte&0x3c 0x18 \b, 24 kHz
! 884: >2 byte&0x3c 0x1c \b, 22.05 kHz
! 885: >2 byte&0x3c 0x20 \b, 16 kHz
! 886: >2 byte&0x3c 0x24 \b, 12 kHz
! 887: >2 byte&0x3c 0x28 \b, 11.025 kHz
! 888: >2 byte&0x3c 0x2c \b, 8 kHz
! 889: # channels
! 890: >2 beshort&0x01c0 0x0040 \b, monaural
! 891: >2 beshort&0x01c0 0x0080 \b, stereo
! 892: >2 beshort&0x01c0 0x00c0 \b, stereo + center
! 893: >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
! 894: >2 beshort&0x01c0 0x0140 \b, surround
! 895: >2 beshort&0x01c0 0x0180 \b, surround + LFE
! 896: >2 beshort &0x01C0 \b, surround + side
! 897: #>1 byte ^0x01 \b, Data Verify
! 898: #>2 byte &0x02 \b, Custom Flag
! 899: #>3 byte &0x20 \b, Original Stream
! 900: #>3 byte &0x10 \b, Home Source
! 901: #>3 byte &0x08 \b, Copyrighted
! 902:
! 903: # Live MPEG-4 audio streams (instead of RTP FlexMux)
! 904: 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
! 905: !:mime audio/x-mp4a-latm
! 906: #>1 beshort&0x1FFF x \b, %u byte packet
! 907: >3 byte&0xE0 0x40
! 908: >>4 byte&0x3C 0x04 \b, single stream
! 909: >>4 byte&0x3C 0x08 \b, 2 streams
! 910: >>4 byte&0x3C 0x0C \b, 3 streams
! 911: >>4 byte &0x08 \b, 4 or more streams
! 912: >>4 byte &0x20 \b, 8 or more streams
! 913: >3 byte&0xC0 0
! 914: >>4 byte&0x78 0x08 \b, single stream
! 915: >>4 byte&0x78 0x10 \b, 2 streams
! 916: >>4 byte&0x78 0x18 \b, 3 streams
! 917: >>4 byte &0x20 \b, 4 or more streams
! 918: >>4 byte &0x40 \b, 8 or more streams
! 919: # This magic isn't strong enough (matches plausible ISO-8859-1 text)
! 920: #0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
! 921: #!:mime audio/x-mp4a-latm
! 922:
! 923: # Summary: FLI animation format
! 924: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
! 925: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
! 926: 4 leshort 0xAF11
! 927: # standard FLI always has 320x200 resolution and 8 bit color
! 928: >8 leshort 320
! 929: >>10 leshort 200
! 930: >>>12 leshort 8 FLI animation, 320x200x8
! 931: !:mime video/x-fli
! 932: >>>>6 leshort x \b, %d frames
! 933: # frame speed is multiple of 1/70s
! 934: >>>>16 leshort x \b, %d/70s per frame
! 935:
! 936: # Summary: FLC animation format
! 937: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
! 938: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
! 939: 4 leshort 0xAF12
! 940: # standard FLC always use 8 bit color
! 941: >12 leshort 8 FLC animation
! 942: !:mime video/x-flc
! 943: >>8 leshort x \b, %d
! 944: >>10 leshort x \bx%dx8
! 945: >>6 uleshort x \b, %d frames
! 946: >>16 uleshort x \b, %dms per frame
! 947:
! 948: # DL animation format
! 949: # XXX - collision with most `mips' magic
! 950: #
! 951: # I couldn't find a real magic number for these, however, this
! 952: # -appears- to work. Note that it might catch other files, too, so be
! 953: # careful!
! 954: #
! 955: # Note that title and author appear in the two 20-byte chunks
! 956: # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
! 957: # 255 (hex FF)! The DL format is really bad.
! 958: #
! 959: #0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
! 960: #!:mime video/x-unknown
! 961: #>42 byte x - %d screens,
! 962: #>43 byte x %d commands
! 963: #0 byte 2 DL version 2
! 964: #!:mime video/x-unknown
! 965: #>1 byte 1 - large format (320x200,1 image/screen),
! 966: #>1 byte 2 - medium format (160x100,4 images/screen),
! 967: #>1 byte >2 - unknown format,
! 968: #>42 byte x %d screens,
! 969: #>43 byte x %d commands
! 970: # Based on empirical evidence, DL version 3 have several nulls following the
! 971: # \003. Most of them start with non-null values at hex offset 0x34 or so.
! 972: #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
! 973:
! 974: # iso 13818 transport stream
! 975: #
! 976: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
! 977: # (the following is a little bit restrictive and works fine for a stream
! 978: # that starts with PAT properly. it won't work for stream data, that is
! 979: # cut from an input device data right in the middle, but this shouldn't
! 980: # disturb)
! 981: # syncbyte 8 bit 0x47
! 982: # error_ind 1 bit -
! 983: # payload_start 1 bit 1
! 984: # priority 1 bit -
! 985: # PID 13 bit 0x0000
! 986: # scrambling 2 bit -
! 987: # adaptfld_ctrl 2 bit 1 or 3
! 988: # conti_count 4 bit 0
! 989: 0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
! 990: >188 byte !0x47 CORRUPTED
! 991:
! 992: # DIF digital video file format <mpruett@sgi.com>
! 993: 0 belong&0xffffff00 0x1f070000 DIF
! 994: >4 byte &0x01 (DVCPRO) movie file
! 995: >4 byte ^0x01 (DV) movie file
! 996: >3 byte &0x80 (PAL)
! 997: >3 byte ^0x80 (NTSC)
! 998:
! 999: # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
! 1000: 0 belong 0x3026b275 Microsoft ASF
! 1001: !:mime video/x-ms-asf
! 1002:
! 1003: # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
! 1004: 0 string \x8aMNG MNG video data,
! 1005: !:mime video/x-mng
! 1006: >4 belong !0x0d0a1a0a CORRUPTED,
! 1007: >4 belong 0x0d0a1a0a
! 1008: >>16 belong x %ld x
! 1009: >>20 belong x %ld
! 1010:
! 1011: # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
! 1012: 0 string \x8bJNG JNG video data,
! 1013: !:mime video/x-jng
! 1014: >4 belong !0x0d0a1a0a CORRUPTED,
! 1015: >4 belong 0x0d0a1a0a
! 1016: >>16 belong x %ld x
! 1017: >>20 belong x %ld
! 1018:
! 1019: # Vivo video (Wolfram Kleff)
! 1020: 3 string \x0D\x0AVersion:Vivo Vivo video data
! 1021:
! 1022: # VRML (Virtual Reality Modelling Language)
! 1023: 0 string/b #VRML\ V1.0\ ascii VRML 1 file
! 1024: !:mime model/vrml
! 1025: 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
! 1026: !:mime model/vrml
! 1027:
! 1028: # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
! 1029: # From Michel Briand <michelbriand@free.fr>
! 1030: 0 string \<?xml\ version="
! 1031: !:strength +1
! 1032: >20 search/1000/cb \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
! 1033: !:mime model/x3d
! 1034:
! 1035: #---------------------------------------------------------------------------
! 1036: # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
! 1037: # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
! 1038: #
! 1039: 0 string HVQM4 %s
! 1040: >6 string >\0 v%s
! 1041: >0 byte x GameCube movie,
! 1042: >0x34 ubeshort x %d x
! 1043: >0x36 ubeshort x %d,
! 1044: >0x26 ubeshort x %dµs,
! 1045: >0x42 ubeshort 0 no audio
! 1046: >0x42 ubeshort >0 %dHz audio
! 1047:
! 1048: # From: "Stefan A. Haubenthal" <polluks@web.de>
! 1049: 0 string DVDVIDEO-VTS Video title set,
! 1050: >0x21 byte x v%x
! 1051: 0 string DVDVIDEO-VMG Video manager,
! 1052: >0x21 byte x v%x
! 1053:
! 1054: # From: Behan Webster <behanw@websterwood.com>
! 1055: # NuppelVideo used by Mythtv (*.nuv)
! 1056: # Note: there are two identical stanzas here differing only in the
! 1057: # initial string matched. It used to be done with a regex, but we're
! 1058: # trying to get rid of those.
! 1059: 0 string NuppelVideo MythTV NuppelVideo
! 1060: >12 string x v%s
! 1061: >20 lelong x (%d
! 1062: >24 lelong x \bx%d),
! 1063: >36 string P \bprogressive,
! 1064: >36 string I \binterlaced,
! 1065: >40 ledouble x \baspect:%.2f,
! 1066: >48 ledouble x \bfps:%.2f
! 1067: 0 string MythTV MythTV NuppelVideo
! 1068: >12 string x v%s
! 1069: >20 lelong x (%d
! 1070: >24 lelong x \bx%d),
! 1071: >36 string P \bprogressive,
! 1072: >36 string I \binterlaced,
! 1073: >40 ledouble x \baspect:%.2f,
! 1074: >48 ledouble x \bfps:%.2f
! 1075:
! 1076: # MPEG file
! 1077: # MPEG sequences
! 1078: # FIXME: This section is from the old magic.mime file and needs integrating with the rest
! 1079: 0 belong 0x000001BA
! 1080: >4 byte &0x40
! 1081: !:mime video/mp2p
! 1082: >4 byte ^0x40
! 1083: !:mime video/mpeg
! 1084: 0 belong 0x000001BB
! 1085: !:mime video/mpeg
! 1086: 0 belong 0x000001B0
! 1087: !:mime video/mp4v-es
! 1088: 0 belong 0x000001B5
! 1089: !:mime video/mp4v-es
! 1090: 0 belong 0x000001B3
! 1091: !:mime video/mpv
! 1092: 0 belong&0xFF5FFF1F 0x47400010
! 1093: !:mime video/mp2t
! 1094: 0 belong 0x00000001
! 1095: >4 byte&0x1F 0x07
! 1096: !:mime video/h264
! 1097:
! 1098: #------------------------------------------------------------------------------
! 1099: # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
! 1100: # workspaces)
! 1101: #
! 1102: 0 long 0100554 APL workspace (Ken's original?)
! 1103: #------------------------------------------------------------------------------
! 1104: # apple: file(1) magic for Apple file formats
! 1105: #
! 1106: 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text
! 1107: 0 string \x0aGL Binary II (apple ][) data
! 1108: 0 string \x76\xff Squeezed (apple ][) data
! 1109: 0 string NuFile NuFile archive (apple ][) data
! 1110: 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
! 1111: 0 belong 0x00051600 AppleSingle encoded Macintosh file
! 1112: 0 belong 0x00051607 AppleDouble encoded Macintosh file
! 1113:
! 1114: # Type: Apple Emulator 2IMG format
! 1115: # From: Radek Vokal <rvokal@redhat.com>
! 1116: 0 string 2IMG Apple ][ 2IMG Disk Image
! 1117: >4 string XGS! \b, XGS
! 1118: >4 string CTKG \b, Catakig
! 1119: >4 string ShIm \b, Sheppy's ImageMaker
! 1120: >4 string WOOF \b, Sweet 16
! 1121: >4 string B2TR \b, Bernie ][ the Rescue
! 1122: >4 string !nfc \b, ASIMOV2
! 1123: >4 string x \b, Unknown Format
! 1124: >0xc byte 00 \b, DOS 3.3 sector order
! 1125: >>0x10 byte 00 \b, Volume 254
! 1126: >>0x10 byte&0x7f x \b, Volume %u
! 1127: >0xc byte 01 \b, ProDOS sector order
! 1128: >>0x14 short x \b, %u Blocks
! 1129: >0xc byte 02 \b, NIB data
! 1130:
! 1131: # magic for Newton PDA package formats
! 1132: # from Ruda Moura <ruda@helllabs.org>
! 1133: 0 string package0 Newton package, NOS 1.x,
! 1134: >12 belong &0x80000000 AutoRemove,
! 1135: >12 belong &0x40000000 CopyProtect,
! 1136: >12 belong &0x10000000 NoCompression,
! 1137: >12 belong &0x04000000 Relocation,
! 1138: >12 belong &0x02000000 UseFasterCompression,
! 1139: >16 belong x version %d
! 1140:
! 1141: 0 string package1 Newton package, NOS 2.x,
! 1142: >12 belong &0x80000000 AutoRemove,
! 1143: >12 belong &0x40000000 CopyProtect,
! 1144: >12 belong &0x10000000 NoCompression,
! 1145: >12 belong &0x04000000 Relocation,
! 1146: >12 belong &0x02000000 UseFasterCompression,
! 1147: >16 belong x version %d
! 1148:
! 1149: 0 string package4 Newton package,
! 1150: >8 byte 8 NOS 1.x,
! 1151: >8 byte 9 NOS 2.x,
! 1152: >12 belong &0x80000000 AutoRemove,
! 1153: >12 belong &0x40000000 CopyProtect,
! 1154: >12 belong &0x10000000 NoCompression,
! 1155:
! 1156: # The following entries for the Apple II are for files that have
! 1157: # been transferred as raw binary data from an Apple, without having
! 1158: # been encapsulated by any of the above archivers.
! 1159: #
! 1160: # In general, Apple II formats are hard to identify because Apple DOS
! 1161: # and especially Apple ProDOS have strong typing in the file system and
! 1162: # therefore programmers never felt much need to include type information
! 1163: # in the files themselves.
! 1164: #
! 1165: # Eric Fischer <enf@pobox.com>
! 1166:
! 1167: # AppleWorks word processor:
! 1168: #
! 1169: # This matches the standard tab stops for an AppleWorks file, but if
! 1170: # a file has a tab stop set in the first four columns this will fail.
! 1171: #
! 1172: # The "O" is really the magic number, but that's so common that it's
! 1173: # necessary to check the tab stops that follow it to avoid false positives.
! 1174:
! 1175: 4 string O==== AppleWorks word processor data
! 1176: >85 byte&0x01 >0 \b, zoomed
! 1177: >90 byte&0x01 >0 \b, paginated
! 1178: >92 byte&0x01 >0 \b, with mail merge
! 1179: #>91 byte x \b, left margin %d
! 1180:
! 1181: # AppleWorks database:
! 1182: #
! 1183: # This isn't really a magic number, but it's the closest thing to one
! 1184: # that I could find. The 1 and 2 really mean "order in which you defined
! 1185: # categories" and "left to right, top to bottom," respectively; the D and R
! 1186: # mean that the cursor should move either down or right when you press Return.
! 1187:
! 1188: #30 string \x01D AppleWorks database data
! 1189: #30 string \x02D AppleWorks database data
! 1190: #30 string \x01R AppleWorks database data
! 1191: #30 string \x02R AppleWorks database data
! 1192:
! 1193: # AppleWorks spreadsheet:
! 1194: #
! 1195: # Likewise, this isn't really meant as a magic number. The R or C means
! 1196: # row- or column-order recalculation; the A or M means automatic or manual
! 1197: # recalculation.
! 1198:
! 1199: #131 string RA AppleWorks spreadsheet data
! 1200: #131 string RM AppleWorks spreadsheet data
! 1201: #131 string CA AppleWorks spreadsheet data
! 1202: #131 string CM AppleWorks spreadsheet data
! 1203:
! 1204: # Applesoft BASIC:
! 1205: #
! 1206: # This is incredibly sloppy, but will be true if the program was
! 1207: # written at its usual memory location of 2048 and its first line
! 1208: # number is less than 256. Yuck.
! 1209:
! 1210: 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
! 1211: #>2 leshort x \b, first line number %d
! 1212:
! 1213: # ORCA/EZ assembler:
! 1214: #
! 1215: # This will not identify ORCA/M source files, since those have
! 1216: # some sort of date code instead of the two zero bytes at 6 and 7
! 1217: # XXX Conflicts with ELF
! 1218: #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
! 1219: #>5 byte x \b, build number %d
! 1220:
! 1221: # Broderbund Fantavision
! 1222: #
! 1223: # I don't know what these values really mean, but they seem to recur.
! 1224: # Will they cause too many conflicts?
! 1225:
! 1226: # Probably :-)
! 1227: #2 belong&0xFF00FF 0x040008 Fantavision movie data
! 1228:
! 1229: # Some attempts at images.
! 1230: #
! 1231: # These are actually just bit-for-bit dumps of the frame buffer, so
! 1232: # there's really no reasonably way to distinguish them except for their
! 1233: # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
! 1234: # or, occasionally, 8184.
! 1235: #
! 1236: # Nevertheless this will manage to catch a lot of images that happen
! 1237: # to have a solid-colored line at the bottom of the screen.
! 1238:
! 1239: # GRR: Magic too weak
! 1240: #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
! 1241: #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
! 1242: #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
! 1243: #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
! 1244: #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
! 1245:
! 1246: # Beagle Bros. Apple Mechanic fonts
! 1247:
! 1248: 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
! 1249:
! 1250: # Apple Universal Disk Image Format (UDIF) - dmg files.
! 1251: # From Johan Gade.
! 1252: # These entries are disabled for now until we fix the following issues.
! 1253: #
! 1254: # Note there might be some problems with the "VAX COFF executable"
! 1255: # entry. Note this entry should be placed before the mac filesystem section,
! 1256: # particularly the "Apple Partition data" entry.
! 1257: #
! 1258: # The intended meaning of these tests is, that the file is only of the
! 1259: # specified type if both of the lines are correct - i.e. if the first
! 1260: # line matches and the second doesn't then it is not of that type.
! 1261: #
! 1262: #0 long 0x7801730d
! 1263: #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
! 1264: #
! 1265: # Note that this entry is recognized correctly by the "Apple Partition
! 1266: # data" entry - however since this entry is more specific - this
! 1267: # information seems to be more useful.
! 1268: #0 long 0x45520200
! 1269: #>0x410 string disk\ image UDIF read/write image (UDRW)
! 1270:
! 1271: # From: Toby Peterson <toby@apple.com>
! 1272: 0 string bplist00 Apple binary property list
! 1273:
! 1274: # Apple binary property list (bplist)
! 1275: # Assumes version bytes are hex.
! 1276: # Provides content hints for version 0 files. Assumes that the root
! 1277: # object is the first object (true for CoreFoundation implementation).
! 1278: # From: David Remahl <dremahl@apple.com>
! 1279: 0 string bplist
! 1280: >6 byte x \bCoreFoundation binary property list data, version 0x%c
! 1281: >>7 byte x \b%c
! 1282: >6 string 00 \b
! 1283: >>8 byte&0xF0 0x00 \b
! 1284: >>>8 byte&0x0F 0x00 \b, root type: null
! 1285: >>>8 byte&0x0F 0x08 \b, root type: false boolean
! 1286: >>>8 byte&0x0F 0x09 \b, root type: true boolean
! 1287: >>8 byte&0xF0 0x10 \b, root type: integer
! 1288: >>8 byte&0xF0 0x20 \b, root type: real
! 1289: >>8 byte&0xF0 0x30 \b, root type: date
! 1290: >>8 byte&0xF0 0x40 \b, root type: data
! 1291: >>8 byte&0xF0 0x50 \b, root type: ascii string
! 1292: >>8 byte&0xF0 0x60 \b, root type: unicode string
! 1293: >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
! 1294: >>8 byte&0xF0 0xa0 \b, root type: array
! 1295: >>8 byte&0xF0 0xd0 \b, root type: dictionary
! 1296:
! 1297: # Apple/NeXT typedstream data
! 1298: # Serialization format used by NeXT and Apple for various
! 1299: # purposes in YellowStep/Cocoa, including some nib files.
! 1300: # From: David Remahl <dremahl@apple.com>
! 1301: 2 string typedstream NeXT/Apple typedstream data, big endian
! 1302: >0 byte x \b, version %hhd
! 1303: >0 byte <5 \b
! 1304: >>13 byte 0x81 \b
! 1305: >>>14 ubeshort x \b, system %hd
! 1306: 2 string streamtyped NeXT/Apple typedstream data, little endian
! 1307: >0 byte x \b, version %hhd
! 1308: >0 byte <5 \b
! 1309: >>13 byte 0x81 \b
! 1310: >>>14 uleshort x \b, system %hd
! 1311:
! 1312: #------------------------------------------------------------------------------
! 1313: # CAF: Apple CoreAudio File Format
! 1314: #
! 1315: # Container format for high-end audio purposes.
! 1316: # From: David Remahl <dremahl@apple.com>
! 1317: #
! 1318: 0 string caff CoreAudio Format audio file
! 1319: >4 beshort <10 version %d
! 1320: >6 beshort x
! 1321:
! 1322:
! 1323: #------------------------------------------------------------------------------
! 1324: # Keychain database files
! 1325: 0 string kych Mac OS X Keychain File
! 1326:
! 1327: #------------------------------------------------------------------------------
! 1328: # Code Signing related file types
! 1329: 0 belong 0xfade0c00 Mac OS X Code Requirement
! 1330: >8 belong 1 (opExpr)
! 1331: >4 belong x - %d bytes
! 1332:
! 1333: 0 belong 0xfade0c01 Mac OS X Code Requirement Set
! 1334: >8 belong >1 containing %d items
! 1335: >4 belong x - %d bytes
! 1336:
! 1337: 0 belong 0xfade0c02 Mac OS X Code Directory
! 1338: >8 belong x version %x
! 1339: >12 belong >0 flags 0x%x
! 1340: >4 belong x - %d bytes
! 1341:
! 1342: 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
! 1343: >4 belong x - %d bytes
! 1344:
! 1345: 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
! 1346: >8 belong >1 (%d elements)
! 1347: >4 belong x - %d bytes
! 1348:
! 1349: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 1350: # .vdi
! 1351: 4 string innotek\ VirtualBox\ Disk\ Image %s
! 1352:
! 1353: #------------------------------------------------------------------------------
! 1354: # applix: file(1) magic for Applixware
! 1355: # From: Peter Soos <sp@osb.hu>
! 1356: #
! 1357: 0 string *BEGIN Applixware
! 1358: >7 string WORDS Words Document
! 1359: >7 string GRAPHICS Graphic
! 1360: >7 string RASTER Bitmap
! 1361: >7 string SPREADSHEETS Spreadsheet
! 1362: >7 string MACRO Macro
! 1363: >7 string BUILDER Builder Object
! 1364: #------------------------------------------------------------------------------
! 1365: # archive: file(1) magic for archive formats (see also "msdos" for self-
! 1366: # extracting compressed archives)
! 1367: #
! 1368: # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
! 1369: # pre-POSIX "tar" archives are handled in the C code.
! 1370:
! 1371: # POSIX tar archives
! 1372: 257 string ustar\0 POSIX tar archive
! 1373: !:mime application/x-tar # encoding: posix
! 1374: 257 string ustar\040\040\0 GNU tar archive
! 1375: !:mime application/x-tar # encoding: gnu
! 1376:
! 1377: # cpio archives
! 1378: #
! 1379: # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
! 1380: # The idea is to indicate archives produced on machines with the same
! 1381: # byte order as the machine running "file" with "cpio archive", and
! 1382: # to indicate archives produced on machines with the opposite byte order
! 1383: # from the machine running "file" with "byte-swapped cpio archive".
! 1384: #
! 1385: # The SVR4 "cpio(4)" hints that there are additional formats, but they
! 1386: # are defined as "short"s; I think all the new formats are
! 1387: # character-header formats and thus are strings, not numbers.
! 1388: 0 short 070707 cpio archive
! 1389: !:mime application/x-cpio
! 1390: 0 short 0143561 byte-swapped cpio archive
! 1391: !:mime application/x-cpio # encoding: swapped
! 1392: 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
! 1393: 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
! 1394: 0 string 070702 ASCII cpio archive (SVR4 with CRC)
! 1395:
! 1396: # Debian package (needs to go before regular portable archives)
! 1397: #
! 1398: 0 string =!<arch>\ndebian
! 1399: !:mime application/x-debian-package
! 1400: >8 string debian-split part of multipart Debian package
! 1401: >8 string debian-binary Debian binary package
! 1402: >8 string !debian
! 1403: >68 string >\0 (format %s)
! 1404: # These next two lines do not work, because a bzip2 Debian archive
! 1405: # still uses gzip for the control.tar (first in the archive). Only
! 1406: # data.tar varies, and the location of its filename varies too.
! 1407: # file/libmagic does not current have support for ascii-string based
! 1408: # (offsets) as of 2005-09-15.
! 1409: #>81 string bz2 \b, uses bzip2 compression
! 1410: #>84 string gz \b, uses gzip compression
! 1411: #>136 ledate x created: %s
! 1412:
! 1413: # other archives
! 1414: 0 long 0177555 very old archive
! 1415: 0 short 0177555 very old PDP-11 archive
! 1416: 0 long 0177545 old archive
! 1417: 0 short 0177545 old PDP-11 archive
! 1418: 0 long 0100554 apl workspace
! 1419: 0 string =<ar> archive
! 1420: !:mime application/x-archive
! 1421:
! 1422: # MIPS archive (needs to go before regular portable archives)
! 1423: #
! 1424: 0 string =!<arch>\n__________E MIPS archive
! 1425: >20 string U with MIPS Ucode members
! 1426: >21 string L with MIPSEL members
! 1427: >21 string B with MIPSEB members
! 1428: >19 string L and an EL hash table
! 1429: >19 string B and an EB hash table
! 1430: >22 string X -- out of date
! 1431:
! 1432: 0 search/1 -h- Software Tools format archive text
! 1433:
! 1434: #
! 1435: # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
! 1436: # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
! 1437: #
! 1438: # 0 string =!<arch> current ar archive
! 1439: # 0 long 0x213c6172 archive file
! 1440: #
! 1441: # and for SVR1 archives, we have:
! 1442: #
! 1443: # 0 string \<ar> System V Release 1 ar archive
! 1444: # 0 string =<ar> archive
! 1445: #
! 1446: # XXX - did Aegis really store shared libraries, breakpointed modules,
! 1447: # and absolute code program modules in the same format as new-style
! 1448: # "ar" archives?
! 1449: #
! 1450: 0 string =!<arch> current ar archive
! 1451: !:mime application/x-archive
! 1452: >8 string __.SYMDEF random library
! 1453: >0 belong =65538 - pre SR9.5
! 1454: >0 belong =65539 - post SR9.5
! 1455: >0 beshort 2 - object archive
! 1456: >0 beshort 3 - shared library module
! 1457: >0 beshort 4 - debug break-pointed module
! 1458: >0 beshort 5 - absolute code program module
! 1459: 0 string \<ar> System V Release 1 ar archive
! 1460: 0 string =<ar> archive
! 1461: #
! 1462: # XXX - from "vax", which appears to collect a bunch of byte-swapped
! 1463: # thingies, to help you recognize VAX files on big-endian machines;
! 1464: # with "leshort", "lelong", and "string", that's no longer necessary....
! 1465: #
! 1466: 0 belong 0x65ff0000 VAX 3.0 archive
! 1467: 0 belong 0x3c61723e VAX 5.0 archive
! 1468: #
! 1469: 0 long 0x213c6172 archive file
! 1470: 0 lelong 0177555 very old VAX archive
! 1471: 0 leshort 0177555 very old PDP-11 archive
! 1472: #
! 1473: # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
! 1474: # be a random library (it said 0xff65 rather than 0177545).
! 1475: #
! 1476: 0 lelong 0177545 old VAX archive
! 1477: >8 string __.SYMDEF random library
! 1478: 0 leshort 0177545 old PDP-11 archive
! 1479: >8 string __.SYMDEF random library
! 1480: #
! 1481: # From "pdp" (but why a 4-byte quantity?)
! 1482: #
! 1483: 0 lelong 0x39bed PDP-11 old archive
! 1484: 0 lelong 0x39bee PDP-11 4.0 archive
! 1485:
! 1486: # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
! 1487: #
! 1488: # The first byte is the magic (0x1a), byte 2 is the compression type for
! 1489: # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
! 1490: # filename of the first file (null terminated). Since some types collide
! 1491: # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
! 1492: # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
! 1493: 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
! 1494: !:mime application/x-arc
! 1495: 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
! 1496: !:mime application/x-arc
! 1497: 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
! 1498: !:mime application/x-arc
! 1499: 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
! 1500: !:mime application/x-arc
! 1501: 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
! 1502: !:mime application/x-arc
! 1503: 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
! 1504: !:mime application/x-arc
! 1505: # [JW] stuff taken from idarc, obviously ARC successors:
! 1506: 0 lelong&0x8080ffff 0x00000a1a PAK archive data
! 1507: !:mime application/x-arc
! 1508: 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
! 1509: !:mime application/x-arc
! 1510: 0 lelong&0x8080ffff 0x0000481a HYP archive data
! 1511: !:mime application/x-arc
! 1512:
! 1513: # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
! 1514: # I can't create either SPARK or ArcFS archives so I have not tested this stuff
! 1515: # [GRR: the original entries collide with ARC, above; replaced with combined
! 1516: # version (not tested)]
! 1517: #0 byte 0x1a RISC OS archive (spark format)
! 1518: 0 string \032archive RISC OS archive (ArcFS format)
! 1519: 0 string Archive\000 RISC OS archive (ArcFS format)
! 1520:
! 1521: # All these were taken from idarc, many could not be verified. Unfortunately,
! 1522: # there were many low-quality sigs, i.e. easy to trigger false positives.
! 1523: # Please notify me of any real-world fishy/ambiguous signatures and I'll try
! 1524: # to get my hands on the actual archiver and see if I find something better. [JW]
! 1525: # probably many can be enhanced by finding some 0-byte or control char near the start
! 1526:
! 1527: # idarc calls this Crush/Uncompressed... *shrug*
! 1528: 0 string CRUSH Crush archive data
! 1529: # Squeeze It (.sqz)
! 1530: 0 string HLSQZ Squeeze It archive data
! 1531: # SQWEZ
! 1532: 0 string SQWEZ SQWEZ archive data
! 1533: # HPack (.hpk)
! 1534: 0 string HPAK HPack archive data
! 1535: # HAP
! 1536: 0 string \x91\x33HF HAP archive data
! 1537: # MD/MDCD
! 1538: 0 string MDmd MDCD archive data
! 1539: # LIM
! 1540: 0 string LIM\x1a LIM archive data
! 1541: # SAR
! 1542: 3 string LH5 SAR archive data
! 1543: # BSArc/BS2
! 1544: 0 string \212\3SB \0 BSArc/BS2 archive data
! 1545: # MAR
! 1546: 2 string =-ah MAR archive data
! 1547: # ACB
! 1548: 0 belong&0x00f800ff 0x00800000 ACB archive data
! 1549: # CPZ
! 1550: # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
! 1551: # JRC
! 1552: 0 string JRchive JRC archive data
! 1553: # Quantum
! 1554: 0 string DS\0 Quantum archive data
! 1555: # ReSOF
! 1556: 0 string PK\3\6 ReSOF archive data
! 1557: # QuArk
! 1558: 0 string 7\4 QuArk archive data
! 1559: # YAC
! 1560: 14 string YC YAC archive data
! 1561: # X1
! 1562: 0 string X1 X1 archive data
! 1563: 0 string XhDr X1 archive data
! 1564: # CDC Codec (.dqt)
! 1565: 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
! 1566: # AMGC
! 1567: 0 string \xad6" AMGC archive data
! 1568: # NuLIB
! 1569: 0 string NõFélå NuLIB archive data
! 1570: # PakLeo
! 1571: 0 string LEOLZW PAKLeo archive data
! 1572: # ChArc
! 1573: 0 string SChF ChArc archive data
! 1574: # PSA
! 1575: 0 string PSA PSA archive data
! 1576: # CrossePAC
! 1577: 0 string DSIGDCC CrossePAC archive data
! 1578: # Freeze
! 1579: 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
! 1580: # KBoom
! 1581: 0 string ¨MP¨ KBoom archive data
! 1582: # NSQ, must go after CDC Codec
! 1583: 0 string \x76\xff NSQ archive data
! 1584: # DPA
! 1585: 0 string Dirk\ Paehl DPA archive data
! 1586: # BA
! 1587: # TODO: idarc says "bytes 0-2 == bytes 3-5"
! 1588: # TTComp
! 1589: 0 string \0\6 TTComp archive data
! 1590: # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
! 1591: 0 string ESP ESP archive data
! 1592: # ZPack
! 1593: 0 string \1ZPK\1 ZPack archive data
! 1594: # Sky
! 1595: 0 string \xbc\x40 Sky archive data
! 1596: # UFA
! 1597: 0 string UFA UFA archive data
! 1598: # Dry
! 1599: 0 string =-H2O DRY archive data
! 1600: # FoxSQZ
! 1601: 0 string FOXSQZ FoxSQZ archive data
! 1602: # AR7
! 1603: 0 string ,AR7 AR7 archive data
! 1604: # PPMZ
! 1605: 0 string PPMZ PPMZ archive data
! 1606: # MS Compress
! 1607: 4 string \x88\xf0\x27 MS Compress archive data
! 1608: # updated by Joerg Jenderek
! 1609: >9 string \0
! 1610: >>0 string KWAJ
! 1611: >>>7 string \321\003 MS Compress archive data
! 1612: >>>>14 ulong >0 \b, original size: %ld bytes
! 1613: >>>>18 ubyte >0x65
! 1614: >>>>>18 string x \b, was %.8s
! 1615: >>>>>(10.b-4) string x \b.%.3s
! 1616: # MP3 (archiver, not lossy audio compression)
! 1617: 0 string MP3\x1a MP3-Archiver archive data
! 1618: # ZET
! 1619: 0 string OZÃ ZET archive data
! 1620: # TSComp
! 1621: 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
! 1622: # ARQ
! 1623: 0 string gW\4\1 ARQ archive data
! 1624: # Squash
! 1625: 3 string OctSqu Squash archive data
! 1626: # Terse
! 1627: 0 string \5\1\1\0 Terse archive data
! 1628: # PUCrunch
! 1629: 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
! 1630: # UHarc
! 1631: 0 string UHA UHarc archive data
! 1632: # ABComp
! 1633: 0 string \2AB ABComp archive data
! 1634: 0 string \3AB2 ABComp archive data
! 1635: # CMP
! 1636: 0 string CO\0 CMP archive data
! 1637: # Splint
! 1638: 0 string \x93\xb9\x06 Splint archive data
! 1639: # InstallShield
! 1640: 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
! 1641: # Gather
! 1642: 1 string GTH Gather archive data
! 1643: # BOA
! 1644: 0 string BOA BOA archive data
! 1645: # RAX
! 1646: 0 string ULEB\xa RAX archive data
! 1647: # Xtreme
! 1648: 0 string ULEB\0 Xtreme archive data
! 1649: # Pack Magic
! 1650: 0 string @â\1\0 Pack Magic archive data
! 1651: # BTS
! 1652: 0 belong&0xfeffffff 0x1a034465 BTS archive data
! 1653: # ELI 5750
! 1654: 0 string Ora\ ELI 5750 archive data
! 1655: # QFC
! 1656: 0 string \x1aFC\x1a QFC archive data
! 1657: 0 string \x1aQF\x1a QFC archive data
! 1658: # PRO-PACK
! 1659: 0 string RNC PRO-PACK archive data
! 1660: # 777
! 1661: 0 string 777 777 archive data
! 1662: # LZS221
! 1663: 0 string sTaC LZS221 archive data
! 1664: # HPA
! 1665: 0 string HPA HPA archive data
! 1666: # Arhangel
! 1667: 0 string LG Arhangel archive data
! 1668: # EXP1, uses bzip2
! 1669: 0 string 0123456789012345BZh EXP1 archive data
! 1670: # IMP
! 1671: 0 string IMP\xa IMP archive data
! 1672: # NRV
! 1673: 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
! 1674: # Squish
! 1675: 0 string \x73\xb2\x90\xf4 Squish archive data
! 1676: # Par
! 1677: 0 string PHILIPP Par archive data
! 1678: 0 string PAR Par archive data
! 1679: # HIT
! 1680: 0 string UB HIT archive data
! 1681: # SBX
! 1682: 0 belong&0xfffff000 0x53423000 SBX archive data
! 1683: # NaShrink
! 1684: 0 string NSK NaShrink archive data
! 1685: # SAPCAR
! 1686: 0 string #\ CAR\ archive\ header SAPCAR archive data
! 1687: 0 string CAR\ 2.00RG SAPCAR archive data
! 1688: # Disintegrator
! 1689: 0 string DST Disintegrator archive data
! 1690: # ASD
! 1691: 0 string ASD ASD archive data
! 1692: # InstallShield CAB
! 1693: 0 string ISc( InstallShield CAB
! 1694: # TOP4
! 1695: 0 string T4\x1a TOP4 archive data
! 1696: # BatComp left out: sig looks like COM executable
! 1697: # so TODO: get real 4dos batcomp file and find sig
! 1698: # BlakHole
! 1699: 0 string BH\5\7 BlakHole archive data
! 1700: # BIX
! 1701: 0 string BIX0 BIX archive data
! 1702: # ChiefLZA
! 1703: 0 string ChfLZ ChiefLZA archive data
! 1704: # Blink
! 1705: 0 string Blink Blink archive data
! 1706: # Logitech Compress
! 1707: 0 string \xda\xfa Logitech Compress archive data
! 1708: # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
! 1709: 1 string (C)\ STEPANYUK ARS-Sfx archive data
! 1710: # AKT/AKT32
! 1711: 0 string AKT32 AKT32 archive data
! 1712: 0 string AKT AKT archive data
! 1713: # NPack
! 1714: 0 string MSTSM NPack archive data
! 1715: # PFT
! 1716: 0 string \0\x50\0\x14 PFT archive data
! 1717: # SemOne
! 1718: 0 string SEM SemOne archive data
! 1719: # PPMD
! 1720: 0 string \x8f\xaf\xac\x84 PPMD archive data
! 1721: # FIZ
! 1722: 0 string FIZ FIZ archive data
! 1723: # MSXiE
! 1724: 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
! 1725: # DeepFreezer
! 1726: 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
! 1727: # DC
! 1728: 0 string =<DC- DC archive data
! 1729: # TPac
! 1730: 0 string \4TPAC\3 TPac archive data
! 1731: # Ai
! 1732: 0 string Ai\1\1\0 Ai archive data
! 1733: 0 string Ai\1\0\0 Ai archive data
! 1734: # Ai32
! 1735: 0 string Ai\2\0 Ai32 archive data
! 1736: 0 string Ai\2\1 Ai32 archive data
! 1737: # SBC
! 1738: 0 string SBC SBC archive data
! 1739: # Ybs
! 1740: 0 string YBS Ybs archive data
! 1741: # DitPack
! 1742: 0 string \x9e\0\0 DitPack archive data
! 1743: # DMS
! 1744: 0 string DMS! DMS archive data
! 1745: # EPC
! 1746: 0 string \x8f\xaf\xac\x8c EPC archive data
! 1747: # VSARC
! 1748: 0 string VS\x1a VSARC archive data
! 1749: # PDZ
! 1750: 0 string PDZ PDZ archive data
! 1751: # ReDuq
! 1752: 0 string rdqx ReDuq archive data
! 1753: # GCA
! 1754: 0 string GCAX GCA archive data
! 1755: # PPMN
! 1756: 0 string pN PPMN archive data
! 1757: # WinImage
! 1758: 3 string WINIMAGE WinImage archive data
! 1759: # Compressia
! 1760: 0 string CMP0CMP Compressia archive data
! 1761: # UHBC
! 1762: 0 string UHB UHBC archive data
! 1763: # WinHKI
! 1764: 0 string \x61\x5C\x04\x05 WinHKI archive data
! 1765: # WWPack data file
! 1766: 0 string WWP WWPack archive data
! 1767: # BSN (BSA, PTS-DOS)
! 1768: 0 string \xffBSG BSN archive data
! 1769: 1 string \xffBSG BSN archive data
! 1770: 3 string \xffBSG BSN archive data
! 1771: 1 string \0\xae\2 BSN archive data
! 1772: 1 string \0\xae\3 BSN archive data
! 1773: 1 string \0\xae\7 BSN archive data
! 1774: # AIN
! 1775: 0 string \x33\x18 AIN archive data
! 1776: 0 string \x33\x17 AIN archive data
! 1777: # XPA32
! 1778: 0 string xpa\0\1 XPA32 archive data
! 1779: # SZip (TODO: doesn't catch all versions)
! 1780: 0 string SZ\x0a\4 SZip archive data
! 1781: # XPack DiskImage
! 1782: 0 string jm XPack DiskImage archive data
! 1783: # XPack Data
! 1784: 0 string xpa XPack archive data
! 1785: # XPack Single Data
! 1786: 0 string Ã\ jm XPack single archive data
! 1787:
! 1788: # TODO: missing due to unknown magic/magic at end of file:
! 1789: #DWC
! 1790: #ARG
! 1791: #ZAR
! 1792: #PC/3270
! 1793: #InstallIt
! 1794: #RKive
! 1795: #RK
! 1796: #XPack Diskimage
! 1797:
! 1798: # These were inspired by idarc, but actually verified
! 1799: # Dzip archiver (.dz)
! 1800: 0 string DZ Dzip archive data
! 1801: >2 byte x \b, version %i
! 1802: >3 byte x \b.%i
! 1803: # ZZip archiver (.zz)
! 1804: 0 string ZZ\ \0\0 ZZip archive data
! 1805: 0 string ZZ0 ZZip archive data
! 1806: # PAQ archiver (.paq)
! 1807: 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
! 1808: 0 string PAQ PAQ archive data
! 1809: >3 byte&0xf0 0x30
! 1810: >>3 byte x (v%c)
! 1811: # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
! 1812: 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
! 1813: 0 string JARCS JAR (ARJ Software, Inc.) archive data
! 1814:
! 1815: # ARJ archiver (jason@jarthur.Claremont.EDU)
! 1816: 0 leshort 0xea60 ARJ archive data
! 1817: !:mime application/x-arj
! 1818: >5 byte x \b, v%d,
! 1819: >8 byte &0x04 multi-volume,
! 1820: >8 byte &0x10 slash-switched,
! 1821: >8 byte &0x20 backup,
! 1822: >34 string x original name: %s,
! 1823: >7 byte 0 os: MS-DOS
! 1824: >7 byte 1 os: PRIMOS
! 1825: >7 byte 2 os: Unix
! 1826: >7 byte 3 os: Amiga
! 1827: >7 byte 4 os: Macintosh
! 1828: >7 byte 5 os: OS/2
! 1829: >7 byte 6 os: Apple ][ GS
! 1830: >7 byte 7 os: Atari ST
! 1831: >7 byte 8 os: NeXT
! 1832: >7 byte 9 os: VAX/VMS
! 1833: >3 byte >0 %d]
! 1834: # [JW] idarc says this is also possible
! 1835: 2 leshort 0xea60 ARJ archive data
! 1836:
! 1837: # HA archiver (Greg Roelofs, newt@uchicago.edu)
! 1838: # This is a really bad format. A file containing HAWAII will match this...
! 1839: #0 string HA HA archive data,
! 1840: #>2 leshort =1 1 file,
! 1841: #>2 leshort >1 %u files,
! 1842: #>4 byte&0x0f =0 first is type CPY
! 1843: #>4 byte&0x0f =1 first is type ASC
! 1844: #>4 byte&0x0f =2 first is type HSC
! 1845: #>4 byte&0x0f =0x0e first is type DIR
! 1846: #>4 byte&0x0f =0x0f first is type SPECIAL
! 1847: # suggestion: at least identify small archives (<1024 files)
! 1848: 0 belong&0xffff00fc 0x48410000 HA archive data
! 1849: >2 leshort =1 1 file,
! 1850: >2 leshort >1 %u files,
! 1851: >4 byte&0x0f =0 first is type CPY
! 1852: >4 byte&0x0f =1 first is type ASC
! 1853: >4 byte&0x0f =2 first is type HSC
! 1854: >4 byte&0x0f =0x0e first is type DIR
! 1855: >4 byte&0x0f =0x0f first is type SPECIAL
! 1856:
! 1857: # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
! 1858: 0 string HPAK HPACK archive data
! 1859:
! 1860: # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
! 1861: 0 string \351,\001JAM\ JAM archive,
! 1862: >7 string >\0 version %.4s
! 1863: >0x26 byte =0x27 -
! 1864: >>0x2b string >\0 label %.11s,
! 1865: >>0x27 lelong x serial %08x,
! 1866: >>0x36 string >\0 fstype %.8s
! 1867:
! 1868: # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
! 1869: 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
! 1870: !:mime application/x-lharc
! 1871: 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
! 1872: !:mime application/x-lharc
! 1873: 2 string -lz4- LHarc 1.x archive data [lz4]
! 1874: !:mime application/x-lharc
! 1875: 2 string -lz5- LHarc 1.x archive data [lz5]
! 1876: !:mime application/x-lharc
! 1877: # [never seen any but the last; -lh4- reported in comp.compression:]
! 1878: 2 string -lzs- LHa/LZS archive data [lzs]
! 1879: !:mime application/x-lha
! 1880: 2 string -lh\40- LHa 2.x? archive data [lh ]
! 1881: !:mime application/x-lha
! 1882: 2 string -lhd- LHa 2.x? archive data [lhd]
! 1883: !:mime application/x-lha
! 1884: 2 string -lh2- LHa 2.x? archive data [lh2]
! 1885: !:mime application/x-lha
! 1886: 2 string -lh3- LHa 2.x? archive data [lh3]
! 1887: !:mime application/x-lha
! 1888: 2 string -lh4- LHa (2.x) archive data [lh4]
! 1889: !:mime application/x-lha
! 1890: 2 string -lh5- LHa (2.x) archive data [lh5]
! 1891: !:mime application/x-lha
! 1892: 2 string -lh6- LHa (2.x) archive data [lh6]
! 1893: !:mime application/x-lha
! 1894: 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
! 1895: !:mime application/x-lha
! 1896: >20 byte x - header level %d
! 1897: # taken from idarc [JW]
! 1898: 2 string -lZ PUT archive data
! 1899: 2 string -lz LZS archive data
! 1900: 2 string -sw1- Swag archive data
! 1901:
! 1902: # RAR archiver (Greg Roelofs, newt@uchicago.edu)
! 1903: 0 string Rar! RAR archive data,
! 1904: !:mime application/x-rar
! 1905: >44 byte x v%0x,
! 1906: >10 byte >0 flags:
! 1907: >>10 byte &0x01 Archive volume,
! 1908: >>10 byte &0x02 Commented,
! 1909: >>10 byte &0x04 Locked,
! 1910: >>10 byte &0x08 Solid,
! 1911: >>10 byte &0x20 Authenticated,
! 1912: >35 byte 0 os: MS-DOS
! 1913: >35 byte 1 os: OS/2
! 1914: >35 byte 2 os: Win32
! 1915: >35 byte 3 os: Unix
! 1916: # some old version? idarc says:
! 1917: 0 string RE\x7e\x5e RAR archive data
! 1918:
! 1919: # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
! 1920: 0 string SQSH squished archive data (Acorn RISCOS)
! 1921:
! 1922: # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
! 1923: # [JW] see exe section for self-extracting version
! 1924: 0 string UC2\x1a UC2 archive data
! 1925:
! 1926: # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
! 1927: 0 string PK\003\004
! 1928: >4 byte 0x00 Zip archive data
! 1929: !:mime application/zip
! 1930: >4 byte 0x09 Zip archive data, at least v0.9 to extract
! 1931: !:mime application/zip
! 1932: >4 byte 0x0a Zip archive data, at least v1.0 to extract
! 1933: !:mime application/zip
! 1934: >4 byte 0x0b Zip archive data, at least v1.1 to extract
! 1935: !:mime application/zip
! 1936: >0x161 string WINZIP Zip archive data, WinZIP self-extracting
! 1937: !:mime application/zip
! 1938: >4 byte 0x14
! 1939: >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
! 1940: !:mime application/zip
! 1941:
! 1942: # OpenOffice.org / KOffice / StarOffice documents
! 1943: # Listed here because they ARE zip files
! 1944: #
! 1945: # From: Abel Cheung <abel@oaka.org>
! 1946: >4 byte 0x14
! 1947: >>30 string mimetype
! 1948:
! 1949: # KOffice (1.2 or above) formats
! 1950: >>>50 string vnd.kde. KOffice (>=1.2)
! 1951: >>>>58 string karbon Karbon document
! 1952: >>>>58 string kchart KChart document
! 1953: >>>>58 string kformula KFormula document
! 1954: >>>>58 string kivio Kivio document
! 1955: >>>>58 string kontour Kontour document
! 1956: >>>>58 string kpresenter KPresenter document
! 1957: >>>>58 string kspread KSpread document
! 1958: >>>>58 string kword KWord document
! 1959:
! 1960: # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
! 1961: >>>50 string vnd.sun.xml. OpenOffice.org 1.x
! 1962: >>>>62 string writer Writer
! 1963: >>>>>68 byte !0x2e document
! 1964: >>>>>68 string .template template
! 1965: >>>>>68 string .global global document
! 1966: >>>>62 string calc Calc
! 1967: >>>>>66 byte !0x2e spreadsheet
! 1968: >>>>>66 string .template template
! 1969: >>>>62 string draw Draw
! 1970: >>>>>66 byte !0x2e document
! 1971: >>>>>66 string .template template
! 1972: >>>>62 string impress Impress
! 1973: >>>>>69 byte !0x2e presentation
! 1974: >>>>>69 string .template template
! 1975: >>>>62 string math Math document
! 1976: >>>>62 string base Database file
! 1977:
! 1978: # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
! 1979: # http://lists.oasis-open.org/archives/office/200505/msg00006.html
! 1980: >>>50 string vnd.oasis.opendocument. OpenDocument
! 1981: >>>>73 string text
! 1982: >>>>>77 byte !0x2d Text
! 1983: !:mime application/vnd.oasis.opendocument.text
! 1984: >>>>>77 string -template Text Template
! 1985: >>>>>77 string -web HTML Document Template
! 1986: >>>>>77 string -master Master Document
! 1987: >>>>73 string graphics Drawing
! 1988: >>>>>81 string -template Template
! 1989: >>>>73 string presentation Presentation
! 1990: >>>>>85 string -template Template
! 1991: >>>>73 string spreadsheet Spreadsheet
! 1992: >>>>>84 string -template Template
! 1993: >>>>73 string chart Chart
! 1994: >>>>>78 string -template Template
! 1995: >>>>73 string formula Formula
! 1996: >>>>>80 string -template Template
! 1997: >>>>73 string database Database
! 1998: >>>>73 string image Image
! 1999:
! 2000: # Zoo archiver
! 2001: 20 lelong 0xfdc4a7dc Zoo archive data
! 2002: !:mime application/x-zoo
! 2003: >4 byte >48 \b, v%c.
! 2004: >>6 byte >47 \b%c
! 2005: >>>7 byte >47 \b%c
! 2006: >32 byte >0 \b, modify: v%d
! 2007: >>33 byte x \b.%d+
! 2008: >42 lelong 0xfdc4a7dc \b,
! 2009: >>70 byte >0 extract: v%d
! 2010: >>>71 byte x \b.%d+
! 2011:
! 2012: # Shell archives
! 2013: 10 string #\ This\ is\ a\ shell\ archive shell archive text
! 2014: !:mime application/octet-stream
! 2015:
! 2016: #
! 2017: # LBR. NB: May conflict with the questionable
! 2018: # "binary Computer Graphics Metafile" format.
! 2019: #
! 2020: 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
! 2021: #
! 2022: # PMA (CP/M derivative of LHA)
! 2023: #
! 2024: 2 string -pm0- PMarc archive data [pm0]
! 2025: 2 string -pm1- PMarc archive data [pm1]
! 2026: 2 string -pm2- PMarc archive data [pm2]
! 2027: 2 string -pms- PMarc SFX archive (CP/M, DOS)
! 2028: 5 string -pc1- PopCom compressed executable (CP/M)
! 2029:
! 2030: # From Rafael Laboissiere <rafael@laboissiere.net>
! 2031: # The Project Revision Control System (see
! 2032: # http://prcs.sourceforge.net) generates a packaged project
! 2033: # file which is recognized by the following entry:
! 2034: 0 leshort 0xeb81 PRCS packaged project
! 2035:
! 2036: # Microsoft cabinets
! 2037: # by David Necas (Yeti) <yeti@physics.muni.cz>
! 2038: #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
! 2039: #>25 byte x v%d
! 2040: #>24 byte x \b.%d
! 2041: # MPi: All CABs have version 1.3, so this is pointless.
! 2042: # Better magic in debian-additions.
! 2043:
! 2044: # GTKtalog catalogs
! 2045: # by David Necas (Yeti) <yeti@physics.muni.cz>
! 2046: 4 string gtktalog\ GTKtalog catalog data,
! 2047: >13 string 3 version 3
! 2048: >>14 beshort 0x677a (gzipped)
! 2049: >>14 beshort !0x677a (not gzipped)
! 2050: >13 string >3 version %s
! 2051:
! 2052: ############################################################################
! 2053: # Parity archive reconstruction file, the 'par' file format now used on Usenet.
! 2054: 0 string PAR\0 PARity archive data
! 2055: >48 leshort =0 - Index file
! 2056: >48 leshort >0 - file number %d
! 2057:
! 2058: # Felix von Leitner <felix-file@fefe.de>
! 2059: 0 string d8:announce BitTorrent file
! 2060: !:mime application/x-bittorrent
! 2061:
! 2062: # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
! 2063: 0 beshort 0x0e0f Atari MSA archive data
! 2064: >2 beshort x \b, %d sectors per track
! 2065: >4 beshort 0 \b, 1 sided
! 2066: >4 beshort 1 \b, 2 sided
! 2067: >6 beshort x \b, starting track: %d
! 2068: >8 beshort x \b, ending track: %d
! 2069:
! 2070: # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
! 2071: 0 string PK00PK\003\004 Zip archive data
! 2072:
! 2073: # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
! 2074: # by Stefan `Sec` Zehl <sec@42.org>
! 2075: 7 string **ACE** ACE archive data
! 2076: >15 byte >0 version %d
! 2077: >16 byte =0x00 \b, from MS-DOS
! 2078: >16 byte =0x01 \b, from OS/2
! 2079: >16 byte =0x02 \b, from Win/32
! 2080: >16 byte =0x03 \b, from Unix
! 2081: >16 byte =0x04 \b, from MacOS
! 2082: >16 byte =0x05 \b, from WinNT
! 2083: >16 byte =0x06 \b, from Primos
! 2084: >16 byte =0x07 \b, from AppleGS
! 2085: >16 byte =0x08 \b, from Atari
! 2086: >16 byte =0x09 \b, from Vax/VMS
! 2087: >16 byte =0x0A \b, from Amiga
! 2088: >16 byte =0x0B \b, from Next
! 2089: >14 byte x \b, version %d to extract
! 2090: >5 leshort &0x0080 \b, multiple volumes,
! 2091: >>17 byte x \b (part %d),
! 2092: >5 leshort &0x0002 \b, contains comment
! 2093: >5 leshort &0x0200 \b, sfx
! 2094: >5 leshort &0x0400 \b, small dictionary
! 2095: >5 leshort &0x0800 \b, multi-volume
! 2096: >5 leshort &0x1000 \b, contains AV-String
! 2097: >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
! 2098: >5 leshort &0x2000 \b, with recovery record
! 2099: >5 leshort &0x4000 \b, locked
! 2100: >5 leshort &0x8000 \b, solid
! 2101: # Date in MS-DOS format (whatever that is)
! 2102: #>18 lelong x Created on
! 2103:
! 2104: # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
! 2105: # <doj@cubic.org>
! 2106: 0x1A string sfArk sfArk compressed Soundfont
! 2107: >0x15 string 2
! 2108: >>0x1 string >\0 Version %s
! 2109: >>0x2A string >\0 : %s
! 2110:
! 2111: # DR-DOS 7.03 Packed File *.??_
! 2112: 0 string Packed\ File\ Personal NetWare Packed File
! 2113: >12 string x \b, was "%.12s"
! 2114:
! 2115: # EET archive
! 2116: # From: Tilman Sauerbeck <tilman@code-monkey.de>
! 2117: 0 belong 0x1ee7ff00 EET archive
! 2118: !:mime application/x-eet
! 2119:
! 2120: # rzip archives
! 2121: 0 string RZIP rzip compressed data
! 2122: >4 byte x - version %d
! 2123: >5 byte x \b.%d
! 2124: >6 belong x (%d bytes)
! 2125:
! 2126: # From: "Robert Dale" <robdale@gmail.com>
! 2127: 0 belong 123 dar archive,
! 2128: >4 belong x label "%.8x
! 2129: >>8 belong x %.8x
! 2130: >>>12 beshort x %.4x"
! 2131: >14 byte 0x54 end slice
! 2132: >14 beshort 0x4e4e multi-part
! 2133: >14 beshort 0x4e53 multi-part, with -S
! 2134:
! 2135: # Symbian installation files
! 2136: # http://www.thouky.co.uk/software/psifs/sis.html
! 2137: # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
! 2138: 8 lelong 0x10000419 Symbian installation file
! 2139: !:mime application/vnd.symbian.install
! 2140: >4 lelong 0x1000006D (EPOC release 3/4/5)
! 2141: >4 lelong 0x10003A12 (EPOC release 6)
! 2142: 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
! 2143: !:mime x-epoc/x-sisx-app
! 2144:
! 2145: # From "Nelson A. de Oliveira" <naoliv@gmail.com>
! 2146: 0 string MPQ\032 MoPaQ (MPQ) archive
! 2147:
! 2148: # From: Dirk Jagdmann <doj@cubic.org>
! 2149: # xar archive format: http://code.google.com/p/xar/
! 2150: 0 string xar! xar archive
! 2151: >6 beshort x - version %ld
! 2152:
! 2153: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 2154: # .kgb
! 2155: 0 string KGB_arch KGB Archiver file
! 2156: >10 string x with compression level %.1s
! 2157:
! 2158: # xar (eXtensible ARchiver) archive
! 2159: # From: "David Remahl" <dremahl@apple.com>
! 2160: 0 string xar! xar archive
! 2161: #>4 beshort x header size %d
! 2162: >6 beshort x version %d,
! 2163: #>8 quad x compressed TOC: %d,
! 2164: #>16 quad x uncompressed TOC: %d,
! 2165: >24 belong 0 no checksum
! 2166: >24 belong 1 SHA-1 checksum
! 2167: >24 belong 2 MD5 checksum
! 2168:
! 2169: # Type: Parity Archive
! 2170: # From: Daniel van Eeden <daniel_e@dds.nl>
! 2171: 0 string PAR2 Parity Archive Volume Set
! 2172:
! 2173: #------------------------------------------------------------------------------
! 2174: # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
! 2175: # strings as "long" - we assume they're just strings:
! 2176: # From: guy@netapp.com (Guy Harris)
! 2177: #
! 2178: 0 string *STA Aster*x
! 2179: >7 string WORD Words Document
! 2180: >7 string GRAP Graphic
! 2181: >7 string SPRE Spreadsheet
! 2182: >7 string MACR Macro
! 2183: 0 string 2278 Aster*x Version 2
! 2184: >29 byte 0x36 Words Document
! 2185: >29 byte 0x35 Graphic
! 2186: >29 byte 0x32 Spreadsheet
! 2187: >29 byte 0x38 Macro
! 2188:
! 2189:
! 2190: #------------------------------------------------------------------------------
! 2191: # att3b: file(1) magic for AT&T 3B machines
! 2192: #
! 2193: # The `versions' should be un-commented if they work for you.
! 2194: # (Was the problem just one of endianness?)
! 2195: #
! 2196: # 3B20
! 2197: #
! 2198: # The 3B20 conflicts with SCCS.
! 2199: #0 beshort 0550 3b20 COFF executable
! 2200: #>12 belong >0 not stripped
! 2201: #>22 beshort >0 - version %ld
! 2202: #0 beshort 0551 3b20 COFF executable (TV)
! 2203: #>12 belong >0 not stripped
! 2204: #>22 beshort >0 - version %ld
! 2205: #
! 2206: # WE32K
! 2207: #
! 2208: 0 beshort 0560 WE32000 COFF
! 2209: >18 beshort ^00000020 object
! 2210: >18 beshort &00000020 executable
! 2211: >12 belong >0 not stripped
! 2212: >18 beshort ^00010000 N/A on 3b2/300 w/paging
! 2213: >18 beshort &00020000 32100 required
! 2214: >18 beshort &00040000 and MAU hardware required
! 2215: >20 beshort 0407 (impure)
! 2216: >20 beshort 0410 (pure)
! 2217: >20 beshort 0413 (demand paged)
! 2218: >20 beshort 0443 (target shared library)
! 2219: >22 beshort >0 - version %ld
! 2220: 0 beshort 0561 WE32000 COFF executable (TV)
! 2221: >12 belong >0 not stripped
! 2222: #>18 beshort &00020000 - 32100 required
! 2223: #>18 beshort &00040000 and MAU hardware required
! 2224: #>22 beshort >0 - version %ld
! 2225: #
! 2226: # core file for 3b2
! 2227: 0 string \000\004\036\212\200 3b2 core file
! 2228: >364 string >\0 of '%s'
! 2229: #------------------------------------------------------------------------------
! 2230: # audio: file(1) magic for sound formats (see also "iff")
! 2231: #
! 2232: # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
! 2233: # and others
! 2234: #
! 2235:
! 2236: # Sun/NeXT audio data
! 2237: 0 string .snd Sun/NeXT audio data:
! 2238: >12 belong 1 8-bit ISDN mu-law,
! 2239: !:mime audio/basic
! 2240: >12 belong 2 8-bit linear PCM [REF-PCM],
! 2241: !:mime audio/basic
! 2242: >12 belong 3 16-bit linear PCM,
! 2243: !:mime audio/basic
! 2244: >12 belong 4 24-bit linear PCM,
! 2245: !:mime audio/basic
! 2246: >12 belong 5 32-bit linear PCM,
! 2247: !:mime audio/basic
! 2248: >12 belong 6 32-bit IEEE floating point,
! 2249: !:mime audio/basic
! 2250: >12 belong 7 64-bit IEEE floating point,
! 2251: !:mime audio/basic
! 2252: >12 belong 8 Fragmented sample data,
! 2253: >12 belong 10 DSP program,
! 2254: >12 belong 11 8-bit fixed point,
! 2255: >12 belong 12 16-bit fixed point,
! 2256: >12 belong 13 24-bit fixed point,
! 2257: >12 belong 14 32-bit fixed point,
! 2258: >12 belong 18 16-bit linear with emphasis,
! 2259: >12 belong 19 16-bit linear compressed,
! 2260: >12 belong 20 16-bit linear with emphasis and compression,
! 2261: >12 belong 21 Music kit DSP commands,
! 2262: >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
! 2263: !:mime audio/x-adpcm
! 2264: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
! 2265: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
! 2266: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
! 2267: >12 belong 27 8-bit A-law (CCITT G.711),
! 2268: >20 belong 1 mono,
! 2269: >20 belong 2 stereo,
! 2270: >20 belong 4 quad,
! 2271: >16 belong >0 %d Hz
! 2272:
! 2273: # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
! 2274: # that uses little-endian encoding and has a different magic number
! 2275: 0 lelong 0x0064732E DEC audio data:
! 2276: >12 lelong 1 8-bit ISDN mu-law,
! 2277: !:mime audio/x-dec-basic
! 2278: >12 lelong 2 8-bit linear PCM [REF-PCM],
! 2279: !:mime audio/x-dec-basic
! 2280: >12 lelong 3 16-bit linear PCM,
! 2281: !:mime audio/x-dec-basic
! 2282: >12 lelong 4 24-bit linear PCM,
! 2283: !:mime audio/x-dec-basic
! 2284: >12 lelong 5 32-bit linear PCM,
! 2285: !:mime audio/x-dec-basic
! 2286: >12 lelong 6 32-bit IEEE floating point,
! 2287: !:mime audio/x-dec-basic
! 2288: >12 lelong 7 64-bit IEEE floating point,
! 2289: !:mime audio/x-dec-basic
! 2290: >12 belong 8 Fragmented sample data,
! 2291: >12 belong 10 DSP program,
! 2292: >12 belong 11 8-bit fixed point,
! 2293: >12 belong 12 16-bit fixed point,
! 2294: >12 belong 13 24-bit fixed point,
! 2295: >12 belong 14 32-bit fixed point,
! 2296: >12 belong 18 16-bit linear with emphasis,
! 2297: >12 belong 19 16-bit linear compressed,
! 2298: >12 belong 20 16-bit linear with emphasis and compression,
! 2299: >12 belong 21 Music kit DSP commands,
! 2300: >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
! 2301: !:mime audio/x-dec-basic
! 2302: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
! 2303: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
! 2304: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
! 2305: >12 belong 27 8-bit A-law (CCITT G.711),
! 2306: >20 lelong 1 mono,
! 2307: >20 lelong 2 stereo,
! 2308: >20 lelong 4 quad,
! 2309: >16 lelong >0 %d Hz
! 2310:
! 2311: # Creative Labs AUDIO stuff
! 2312: 0 string MThd Standard MIDI data
! 2313: !:mime audio/midi
! 2314: >8 beshort x (format %d)
! 2315: >10 beshort x using %d track
! 2316: >10 beshort >1 \bs
! 2317: >12 beshort&0x7fff x at 1/%d
! 2318: >12 beshort&0x8000 >0 SMPTE
! 2319:
! 2320: 0 string CTMF Creative Music (CMF) data
! 2321: !:mime audio/x-unknown
! 2322: 0 string SBI SoundBlaster instrument data
! 2323: !:mime audio/x-unknown
! 2324: 0 string Creative\ Voice\ File Creative Labs voice data
! 2325: !:mime audio/x-unknown
! 2326: # is this next line right? it came this way...
! 2327: >19 byte 0x1A
! 2328: >23 byte >0 - version %d
! 2329: >22 byte >0 \b.%d
! 2330:
! 2331: # first entry is also the string "NTRK"
! 2332: 0 belong 0x4e54524b MultiTrack sound data
! 2333: >4 belong x - version %ld
! 2334:
! 2335: # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
! 2336: # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
! 2337: 0 string EMOD Extended MOD sound data,
! 2338: >4 byte&0xf0 x version %d
! 2339: >4 byte&0x0f x \b.%d,
! 2340: >45 byte x %d instruments
! 2341: >83 byte 0 (module)
! 2342: >83 byte 1 (song)
! 2343:
! 2344: # Real Audio (Magic .ra\0375)
! 2345: 0 belong 0x2e7261fd RealAudio sound file
! 2346: !:mime audio/x-pn-realaudio
! 2347: 0 string .RMF\0\0\0 RealMedia file
! 2348: !:mime application/vnd.rn-realmedia
! 2349: #video/x-pn-realvideo
! 2350: #video/vnd.rn-realvideo
! 2351: #application/vnd.rn-realmedia
! 2352: # sigh, there are many mimes for that but the above are the most common.
! 2353:
! 2354: # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
! 2355: # Oct 31, 1995
! 2356: # fixed by <doj@cubic.org> 2003-06-24
! 2357: # Too short...
! 2358: #0 string MTM MultiTracker Module sound file
! 2359: #0 string if Composer 669 Module sound data
! 2360: #0 string JN Composer 669 Module sound data (extended format)
! 2361: 0 string MAS_U ULT(imate) Module sound data
! 2362:
! 2363: #0 string FAR Module sound data
! 2364: #>4 string >\15 Title: "%s"
! 2365:
! 2366: 0x2c string SCRM ScreamTracker III Module sound data
! 2367: >0 string >\0 Title: "%s"
! 2368:
! 2369: # Gravis UltraSound patches
! 2370: # From <ache@nagual.ru>
! 2371:
! 2372: 0 string GF1PATCH110\0ID#000002\0 GUS patch
! 2373: 0 string GF1PATCH100\0ID#000002\0 Old GUS patch
! 2374:
! 2375: # mime types according to http://www.geocities.com/nevilo/mod.htm:
! 2376: # audio/it .it
! 2377: # audio/x-zipped-it .itz
! 2378: # audio/xm fasttracker modules
! 2379: # audio/x-s3m screamtracker modules
! 2380: # audio/s3m screamtracker modules
! 2381: # audio/x-zipped-mod mdz
! 2382: # audio/mod mod
! 2383: # audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
! 2384:
! 2385: #
! 2386: # Taken from loader code from mikmod version 2.14
! 2387: # by Steve McIntyre (stevem@chiark.greenend.org.uk)
! 2388: # <doj@cubic.org> added title printing on 2003-06-24
! 2389: 0 string MAS_UTrack_V00
! 2390: >14 string >/0 ultratracker V1.%.1s module sound data
! 2391: !:mime audio/x-mod
! 2392: #audio/x-tracker-module
! 2393:
! 2394: 0 string UN05 MikMod UNI format module sound data
! 2395:
! 2396: 0 string Extended\ Module: Fasttracker II module sound data
! 2397: !:mime audio/x-mod
! 2398: #audio/x-tracker-module
! 2399: >17 string >\0 Title: "%s"
! 2400:
! 2401: 21 string/c =!SCREAM! Screamtracker 2 module sound data
! 2402: !:mime audio/x-mod
! 2403: #audio/x-screamtracker-module
! 2404: 21 string BMOD2STM Screamtracker 2 module sound data
! 2405: !:mime audio/x-mod
! 2406: #audio/x-screamtracker-module
! 2407: 1080 string M.K. 4-channel Protracker module sound data
! 2408: !:mime audio/x-mod
! 2409: #audio/x-protracker-module
! 2410: >0 string >\0 Title: "%s"
! 2411: 1080 string M!K! 4-channel Protracker module sound data
! 2412: !:mime audio/x-mod
! 2413: #audio/x-protracker-module
! 2414: >0 string >\0 Title: "%s"
! 2415: 1080 string FLT4 4-channel Startracker module sound data
! 2416: !:mime audio/x-mod
! 2417: #audio/x-startracker-module
! 2418: >0 string >\0 Title: "%s"
! 2419: 1080 string FLT8 8-channel Startracker module sound data
! 2420: !:mime audio/x-mod
! 2421: #audio/x-startracker-module
! 2422: >0 string >\0 Title: "%s"
! 2423: 1080 string 4CHN 4-channel Fasttracker module sound data
! 2424: !:mime audio/x-mod
! 2425: #audio/x-fasttracker-module
! 2426: >0 string >\0 Title: "%s"
! 2427: 1080 string 6CHN 6-channel Fasttracker module sound data
! 2428: !:mime audio/x-mod
! 2429: #audio/x-fasttracker-module
! 2430: >0 string >\0 Title: "%s"
! 2431: 1080 string 8CHN 8-channel Fasttracker module sound data
! 2432: !:mime audio/x-mod
! 2433: #audio/x-fasttracker-module
! 2434: >0 string >\0 Title: "%s"
! 2435: 1080 string CD81 8-channel Octalyser module sound data
! 2436: !:mime audio/x-mod
! 2437: #audio/x-octalysertracker-module
! 2438: >0 string >\0 Title: "%s"
! 2439: 1080 string OKTA 8-channel Octalyzer module sound data
! 2440: !:mime audio/x-mod
! 2441: #audio/x-octalysertracker-module
! 2442: >0 string >\0 Title: "%s"
! 2443: # Not good enough.
! 2444: #1082 string CH
! 2445: #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
! 2446: 1080 string 16CN 16-channel Taketracker module sound data
! 2447: !:mime audio/x-mod
! 2448: #audio/x-taketracker-module
! 2449: >0 string >\0 Title: "%s"
! 2450: 1080 string 32CN 32-channel Taketracker module sound data
! 2451: !:mime audio/x-mod
! 2452: #audio/x-taketracker-module
! 2453: >0 string >\0 Title: "%s"
! 2454:
! 2455: # TOC sound files -Trevor Johnson <trevor@jpj.net>
! 2456: #
! 2457: 0 string TOC TOC sound file
! 2458:
! 2459: # sidfiles <pooka@iki.fi>
! 2460: # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
! 2461: 0 string SIDPLAY\ INFOFILE Sidplay info file
! 2462:
! 2463: 0 string PSID PlaySID v2.2+ (AMIGA) sidtune
! 2464: >4 beshort >0 w/ header v%d,
! 2465: >14 beshort =1 single song,
! 2466: >14 beshort >1 %d songs,
! 2467: >16 beshort >0 default song: %d
! 2468: >0x16 string >\0 name: "%s"
! 2469: >0x36 string >\0 author: "%s"
! 2470: >0x56 string >\0 copyright: "%s"
! 2471:
! 2472: 0 string RSID RSID sidtune PlaySID compatible
! 2473: >4 beshort >0 w/ header v%d,
! 2474: >14 beshort =1 single song,
! 2475: >14 beshort >1 %d songs,
! 2476: >16 beshort >0 default song: %d
! 2477: >0x16 string >\0 name: "%s"
! 2478: >0x36 string >\0 author: "%s"
! 2479: >0x56 string >\0 copyright: "%s"
! 2480:
! 2481: # IRCAM <mpruett@sgi.com>
! 2482: # VAX and MIPS files are little-endian; Sun and NeXT are big-endian
! 2483: 0 belong 0x64a30100 IRCAM file (VAX)
! 2484: 0 belong 0x64a30200 IRCAM file (Sun)
! 2485: 0 belong 0x64a30300 IRCAM file (MIPS little-endian)
! 2486: 0 belong 0x64a30400 IRCAM file (NeXT)
! 2487:
! 2488: # NIST SPHERE <mpruett@sgi.com>
! 2489: 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
! 2490:
! 2491: # Sample Vision <mpruett@sgi.com>
! 2492: 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
! 2493:
! 2494: # Audio Visual Research <tonigonenstein@users.sourceforge.net>
! 2495: 0 string 2BIT Audio Visual Research file,
! 2496: >12 beshort =0 mono,
! 2497: >12 beshort =-1 stereo,
! 2498: >14 beshort x %d bits
! 2499: >16 beshort =0 unsigned,
! 2500: >16 beshort =-1 signed,
! 2501: >22 belong&0x00ffffff x %d Hz,
! 2502: >18 beshort =0 no loop,
! 2503: >18 beshort =-1 loop,
! 2504: >21 ubyte <128 note %d,
! 2505: >22 byte =0 replay 5.485 KHz
! 2506: >22 byte =1 replay 8.084 KHz
! 2507: >22 byte =2 replay 10.971 Khz
! 2508: >22 byte =3 replay 16.168 Khz
! 2509: >22 byte =4 replay 21.942 KHz
! 2510: >22 byte =5 replay 32.336 KHz
! 2511: >22 byte =6 replay 43.885 KHz
! 2512: >22 byte =7 replay 47.261 KHz
! 2513:
! 2514: # SGI SoundTrack <mpruett@sgi.com>
! 2515: 0 string _SGI_SoundTrack SGI SoundTrack project file
! 2516: # ID3 version 2 tags <waschk@informatik.uni-rostock.de>
! 2517: 0 string ID3 Audio file with ID3 version 2.
! 2518: # ??? Normally such a file is an MP3 file, but this will give false positives
! 2519: !:mime audio/mpeg
! 2520: >3 ubyte <0xff \b%d
! 2521: #>4 ubyte <0xff \b%d tag
! 2522: >2584 string fLaC \b, FLAC encoding
! 2523: >>2588 byte&0x7f >0 \b, unknown version
! 2524: >>2588 byte&0x7f 0 \b
! 2525: # some common bits/sample values
! 2526: >>>2600 beshort&0x1f0 0x030 \b, 4 bit
! 2527: >>>2600 beshort&0x1f0 0x050 \b, 6 bit
! 2528: >>>2600 beshort&0x1f0 0x070 \b, 8 bit
! 2529: >>>2600 beshort&0x1f0 0x0b0 \b, 12 bit
! 2530: >>>2600 beshort&0x1f0 0x0f0 \b, 16 bit
! 2531: >>>2600 beshort&0x1f0 0x170 \b, 24 bit
! 2532: >>>2600 byte&0xe 0x0 \b, mono
! 2533: >>>2600 byte&0xe 0x2 \b, stereo
! 2534: >>>2600 byte&0xe 0x4 \b, 3 channels
! 2535: >>>2600 byte&0xe 0x6 \b, 4 channels
! 2536: >>>2600 byte&0xe 0x8 \b, 5 channels
! 2537: >>>2600 byte&0xe 0xa \b, 6 channels
! 2538: >>>2600 byte&0xe 0xc \b, 7 channels
! 2539: >>>2600 byte&0xe 0xe \b, 8 channels
! 2540: # some common sample rates
! 2541: >>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
! 2542: >>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz
! 2543: >>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz
! 2544: >>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz
! 2545: >>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz
! 2546: >>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz
! 2547: >>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz
! 2548: >>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz
! 2549: >>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz
! 2550: >>>2597 belong&0xfffff0 0x177000 \b, 96 kHz
! 2551: >>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz
! 2552: >>>2601 byte&0xf >0 \b, >4G samples
! 2553: >2584 string !fLaC \b, MP3 encoding
! 2554:
! 2555: # NSF (NES sound file) magic
! 2556: 0 string NESM\x1a NES Sound File
! 2557: >14 string >\0 ("%s" by
! 2558: >46 string >\0 %s, copyright
! 2559: >78 string >\0 %s),
! 2560: >5 byte x version %d,
! 2561: >6 byte x %d tracks,
! 2562: >122 byte&0x2 =1 dual PAL/NTSC
! 2563: >122 byte&0x1 =1 PAL
! 2564: >122 byte&0x1 =0 NTSC
! 2565:
! 2566: # Type: SNES SPC700 sound files
! 2567: # From: Josh Triplett <josh@freedesktop.org>
! 2568: 0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
! 2569: >&0 string 0.30 \b, version %s
! 2570: >>0x23 byte 0x1B \b, without ID666 tag
! 2571: >>0x23 byte 0x1A \b, with ID666 tag
! 2572: >>>0x2E string >\0 \b, song "%.32s"
! 2573: >>>0x4E string >\0 \b, game "%.32s"
! 2574:
! 2575: # Impulse tracker module (audio/x-it)
! 2576: 0 string IMPM Impulse Tracker module sound data -
! 2577: !:mime audio/x-mod
! 2578: >4 string >\0 "%s"
! 2579: >40 leshort !0 compatible w/ITv%x
! 2580: >42 leshort !0 created w/ITv%x
! 2581:
! 2582: # Imago Orpheus module (audio/x-imf)
! 2583: 60 string IM10 Imago Orpheus module sound data -
! 2584: >0 string >\0 "%s"
! 2585:
! 2586: # From <collver1@attbi.com>
! 2587: # These are the /etc/magic entries to decode modules, instruments, and
! 2588: # samples in Impulse Tracker's native format.
! 2589:
! 2590: 0 string IMPS Impulse Tracker Sample
! 2591: >18 byte &2 16 bit
! 2592: >18 byte ^2 8 bit
! 2593: >18 byte &4 stereo
! 2594: >18 byte ^4 mono
! 2595: 0 string IMPI Impulse Tracker Instrument
! 2596: >28 leshort !0 ITv%x
! 2597: >30 byte !0 %d samples
! 2598:
! 2599: # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
! 2600: # From <collver1@attbi.com>
! 2601: 0 string LM8953 Yamaha TX Wave
! 2602: >22 byte 0x49 looped
! 2603: >22 byte 0xC9 non-looped
! 2604: >23 byte 1 33kHz
! 2605: >23 byte 2 50kHz
! 2606: >23 byte 3 16kHz
! 2607:
! 2608: # scream tracker: file(1) magic for Scream Tracker sample files
! 2609: #
! 2610: # From <collver1@attbi.com>
! 2611: 76 string SCRS Scream Tracker Sample
! 2612: >0 byte 1 sample
! 2613: >0 byte 2 adlib melody
! 2614: >0 byte >2 adlib drum
! 2615: >31 byte &2 stereo
! 2616: >31 byte ^2 mono
! 2617: >31 byte &4 16bit little endian
! 2618: >31 byte ^4 8bit
! 2619: >30 byte 0 unpacked
! 2620: >30 byte 1 packed
! 2621:
! 2622: # audio
! 2623: # From: Cory Dikkers <cdikkers@swbell.net>
! 2624: 0 string MMD0 MED music file, version 0
! 2625: 0 string MMD1 OctaMED Pro music file, version 1
! 2626: 0 string MMD3 OctaMED Soundstudio music file, version 3
! 2627: 0 string OctaMEDCmpr OctaMED Soundstudio compressed file
! 2628: 0 string MED MED_Song
! 2629: 0 string SymM Symphonie SymMOD music file
! 2630: #
! 2631: 0 string THX AHX version
! 2632: >3 byte =0 1 module data
! 2633: >3 byte =1 2 module data
! 2634: #
! 2635: 0 string OKTASONG Oktalyzer module data
! 2636: #
! 2637: 0 string DIGI\ Booster\ module\0 %s
! 2638: >20 byte >0 %c
! 2639: >>21 byte >0 \b%c
! 2640: >>>22 byte >0 \b%c
! 2641: >>>>23 byte >0 \b%c
! 2642: >610 string >\0 \b, "%s"
! 2643: #
! 2644: 0 string DBM0 DIGI Booster Pro Module
! 2645: >4 byte >0 V%X.
! 2646: >>5 byte x \b%02X
! 2647: >16 string >\0 \b, "%s"
! 2648: #
! 2649: 0 string FTMN FaceTheMusic module
! 2650: >16 string >\0d \b, "%s"
! 2651:
! 2652: # From: <doj@cubic.org> 2003-06-24
! 2653: 0 string AMShdr\32 Velvet Studio AMS Module v2.2
! 2654: 0 string Extreme Extreme Tracker AMS Module v1.3
! 2655: 0 string DDMF Xtracker DMF Module
! 2656: >4 byte x v%i
! 2657: >0xD string >\0 Title: "%s"
! 2658: >0x2B string >\0 Composer: "%s"
! 2659: 0 string DSM\32 Dynamic Studio Module DSM
! 2660: 0 string SONG DigiTrekker DTM Module
! 2661: 0 string DMDL DigiTrakker MDL Module
! 2662: 0 string PSM\32 Protracker Studio PSM Module
! 2663: 44 string PTMF Poly Tracker PTM Module
! 2664: >0 string >\32 Title: "%s"
! 2665: 0 string MT20 MadTracker 2.0 Module MT2
! 2666: 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
! 2667: 0 string RTMM RTM Module
! 2668: 0x426 string MaDoKaN96 XMS Adlib Module
! 2669: >0 string >\0 Composer: "%s"
! 2670: 0 string AMF AMF Module
! 2671: >4 string >\0 Title: "%s"
! 2672: 0 string MODINFO1 Open Cubic Player Module Inforation MDZ
! 2673: 0 string Extended\40Instrument: Fast Tracker II Instrument
! 2674:
! 2675: # From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
! 2676: # NOA Nancy Codec file
! 2677: 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
! 2678: # Yamaha SMAF format
! 2679: 0 string MMMD Yamaha SMAF file
! 2680: # Sharp Jisaku Melody format for PDC
! 2681: 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
! 2682: >20 string Ver01.00 Ver. 1.00
! 2683: >>32 byte x , %d tracks
! 2684:
! 2685: # Free lossless audio codec <http://flac.sourceforge.net>
! 2686: # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
! 2687: 0 string fLaC FLAC audio bitstream data
! 2688: !:mime audio/x-flac
! 2689: >4 byte&0x7f >0 \b, unknown version
! 2690: >4 byte&0x7f 0 \b
! 2691: # some common bits/sample values
! 2692: >>20 beshort&0x1f0 0x030 \b, 4 bit
! 2693: >>20 beshort&0x1f0 0x050 \b, 6 bit
! 2694: >>20 beshort&0x1f0 0x070 \b, 8 bit
! 2695: >>20 beshort&0x1f0 0x0b0 \b, 12 bit
! 2696: >>20 beshort&0x1f0 0x0f0 \b, 16 bit
! 2697: >>20 beshort&0x1f0 0x170 \b, 24 bit
! 2698: >>20 byte&0xe 0x0 \b, mono
! 2699: >>20 byte&0xe 0x2 \b, stereo
! 2700: >>20 byte&0xe 0x4 \b, 3 channels
! 2701: >>20 byte&0xe 0x6 \b, 4 channels
! 2702: >>20 byte&0xe 0x8 \b, 5 channels
! 2703: >>20 byte&0xe 0xa \b, 6 channels
! 2704: >>20 byte&0xe 0xc \b, 7 channels
! 2705: >>20 byte&0xe 0xe \b, 8 channels
! 2706: # some common sample rates
! 2707: >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
! 2708: >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
! 2709: >>17 belong&0xfffff0 0x07d000 \b, 32 kHz
! 2710: >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
! 2711: >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
! 2712: >>17 belong&0xfffff0 0x03e800 \b, 16 kHz
! 2713: >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
! 2714: >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
! 2715: >>17 belong&0xfffff0 0x01f400 \b, 8 kHz
! 2716: >>17 belong&0xfffff0 0x177000 \b, 96 kHz
! 2717: >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
! 2718: >>21 byte&0xf >0 \b, >4G samples
! 2719: >>21 byte&0xf 0 \b
! 2720: >>>22 belong >0 \b, %u samples
! 2721: >>>22 belong 0 \b, length unknown
! 2722:
! 2723: # (ISDN) VBOX voice message file (Wolfram Kleff)
! 2724: 0 string VBOX VBOX voice message data
! 2725:
! 2726: # ReBorn Song Files (.rbs)
! 2727: # David J. Singer <doc@deadvirgins.org.uk>
! 2728: 8 string RB40 RBS Song file
! 2729: >29 string ReBorn created by ReBorn
! 2730: >37 string Propellerhead created by ReBirth
! 2731:
! 2732: # Synthesizer Generator and Kimwitu share their file format
! 2733: 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
! 2734: # Kimwitu++ uses a slightly different magic
! 2735: 0 string A#S#C#S#S#L#HUB Kimwitu++ data
! 2736:
! 2737: # From "Simon Hosie
! 2738: 0 string TFMX-SONG TFMX module sound data
! 2739:
! 2740: # Monkey's Audio compressed audio format (.ape)
! 2741: # From danny.milo@gmx.net (Danny Milosavljevic)
! 2742: # New version from Abel Cheung <abel (@) oaka.org>
! 2743: 0 string MAC\040 Monkey's Audio compressed format
! 2744: >4 uleshort >0x0F8B version %d
! 2745: >>(0x08.l) uleshort =1000 with fast compression
! 2746: >>(0x08.l) uleshort =2000 with normal compression
! 2747: >>(0x08.l) uleshort =3000 with high compression
! 2748: >>(0x08.l) uleshort =4000 with extra high compression
! 2749: >>(0x08.l) uleshort =5000 with insane compression
! 2750: >>(0x08.l+18) uleshort =1 \b, mono
! 2751: >>(0x08.l+18) uleshort =2 \b, stereo
! 2752: >>(0x08.l+20) ulelong x \b, sample rate %d
! 2753: >4 uleshort <0x0F8C version %d
! 2754: >>6 uleshort =1000 with fast compression
! 2755: >>6 uleshort =2000 with normal compression
! 2756: >>6 uleshort =3000 with high compression
! 2757: >>6 uleshort =4000 with extra high compression
! 2758: >>6 uleshort =5000 with insane compression
! 2759: >>10 uleshort =1 \b, mono
! 2760: >>10 uleshort =2 \b, stereo
! 2761: >>12 ulelong x \b, sample rate %d
! 2762:
! 2763: # adlib sound files
! 2764: # From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
! 2765: 0 string RAWADATA RdosPlay RAW
! 2766:
! 2767: 1068 string RoR AMUSIC Adlib Tracker
! 2768:
! 2769: 0 string JCH EdLib
! 2770:
! 2771: 0 string mpu401tr MPU-401 Trakker
! 2772:
! 2773: 0 string SAdT Surprise! Adlib Tracker
! 2774: >4 byte x Version %d
! 2775:
! 2776: 0 string XAD! eXotic ADlib
! 2777:
! 2778: 0 string ofTAZ! eXtra Simple Music
! 2779:
! 2780: # Spectrum 128 tunes (.ay files).
! 2781: # From: Emanuel Haupt <ehaupt@critical.ch>
! 2782: 0 string ZXAYEMUL Spectrum 128 tune
! 2783:
! 2784: 0 string \0BONK BONK,
! 2785: #>5 byte x version %d
! 2786: >14 byte x %d channel(s),
! 2787: >15 byte =1 lossless,
! 2788: >15 byte =0 lossy,
! 2789: >16 byte x mid-side
! 2790:
! 2791: 384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
! 2792:
! 2793: # format VQF (proprietary codec for sound)
! 2794: # some infos on the header file available at :
! 2795: # http://www.twinvq.org/english/technology_format.html
! 2796: 0 string TWIN97012000 VQF data
! 2797: >27 short 0 \b, Mono
! 2798: >27 short 1 \b, Stereo
! 2799: >31 short >0 \b, %d kbit/s
! 2800: >35 short >0 \b, %d kHz
! 2801:
! 2802: # Nelson A. de Oliveira (naoliv@gmail.com)
! 2803: # .eqf
! 2804: 0 string Winamp\ EQ\ library\ file %s
! 2805: # it will match only versions like v<digit>.<digit>
! 2806: # Since I saw only eqf files with version v1.1 I think that it's OK
! 2807: >23 string x \b%.4s
! 2808: # .preset
! 2809: 0 string [Equalizer\ preset] XMMS equalizer preset
! 2810: # .m3u
! 2811: 0 search/1 #EXTM3U M3U playlist text
! 2812: # .pls
! 2813: 0 search/1 [playlist] PLS playlist text
! 2814: # licq.conf
! 2815: 1 string [licq] LICQ configuration file
! 2816:
! 2817: # Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
! 2818: 0 string ICE! SNDH Atari ST music
! 2819: 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
! 2820:
! 2821: # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
! 2822: 0 string MP+ Musepack audio
! 2823: >3 byte 255 \b, SV pre8
! 2824: >3 byte&0xF 0x6 \b, SV 6
! 2825: >3 byte&0xF 0x8 \b, SV 8
! 2826: >3 byte&0xF 0x7 \b, SV 7
! 2827: >>3 byte&0xF0 0x0 \b.0
! 2828: >>3 byte&0xF0 0x10 \b.1
! 2829: >>3 byte&0xF0 240 \b.15
! 2830: >>10 byte&0xF0 0x0 \b, no profile
! 2831: >>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
! 2832: >>10 byte&0xF0 0x50 \b, quality 0
! 2833: >>10 byte&0xF0 0x60 \b, quality 1
! 2834: >>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
! 2835: >>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
! 2836: >>10 byte&0xF0 0x90 \b, quality 4 (Radio)
! 2837: >>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
! 2838: >>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
! 2839: >>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
! 2840: >>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
! 2841: >>10 byte&0xF0 0xE0 \b, quality 9
! 2842: >>10 byte&0xF0 0xF0 \b, quality 10
! 2843: >>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
! 2844: >>27 byte 102 \b, Beta 1.02
! 2845: >>27 byte 104 \b, Beta 1.04
! 2846: >>27 byte 105 \b, Alpha 1.05
! 2847: >>27 byte 106 \b, Beta 1.06
! 2848: >>27 byte 110 \b, Release 1.1
! 2849: >>27 byte 111 \b, Alpha 1.11
! 2850: >>27 byte 112 \b, Beta 1.12
! 2851: >>27 byte 113 \b, Alpha 1.13
! 2852: >>27 byte 114 \b, Beta 1.14
! 2853: >>27 byte 115 \b, Alpha 1.15
! 2854:
! 2855: # IMY
! 2856: # from http://filext.com/detaillist.php?extdetail=IMY
! 2857: # http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
! 2858: # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
! 2859: # http://www.wx800.com/msg/download/irda/iMelody.pdf
! 2860: 0 string BEGIN:IMELODY iMelody Ringtone Format
! 2861:
! 2862: # From: "Mateus Caruccio" <mateus@caruccio.com>
! 2863: # guitar pro v3,4,5 from http://filext.com/file-extension/gp3
! 2864: 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
! 2865:
! 2866: # From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
! 2867: 60 string SONG SoundFX Module sound file
! 2868:
! 2869: # Type: Adaptive Multi-Rate Codec
! 2870: # URL: http://filext.com/detaillist.php?extdetail=AMR
! 2871: # From: Russell Coker <russell@coker.com.au>
! 2872: 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
! 2873:
! 2874: # Type: SuperCollider 3 Synth Definition File Format
! 2875: # From: Mario Lang <mlang@debian.org>
! 2876: 0 string SCgf SuperCollider3 Synth Definition file,
! 2877: >4 belong x version %d
! 2878: #----------------------------------------------------------------
! 2879: # basis: file(1) magic for BBx/Pro5-files
! 2880: # Oliver Dammer <dammer@olida.de> 2005/11/07
! 2881: # http://www.basis.com business-basic-files.
! 2882: #
! 2883: 0 string \074\074bbx\076\076 BBx
! 2884: >7 string \000 indexed file
! 2885: >7 string \001 serial file
! 2886: >7 string \002 keyed file
! 2887: >>13 short 0 (sort)
! 2888: >7 string \004 program
! 2889: >>18 byte x (LEVEL %d)
! 2890: >>>23 string >\000 psaved
! 2891: >7 string \006 mkeyed file
! 2892: >>13 short 0 (sort)
! 2893: >>8 string \000 (mkey)
! 2894: #------------------------------------------------------------------------------
! 2895: # bFLT: file(1) magic for BFLT uclinux binary files
! 2896: #
! 2897: # From Philippe De Muyter <phdm@macqel.be>
! 2898: #
! 2899: 0 string bFLT BFLT executable
! 2900: >4 belong x - version %ld
! 2901: >4 belong 4
! 2902: >>36 belong&0x1 0x1 ram
! 2903: >>36 belong&0x2 0x2 gotpic
! 2904: >>36 belong&0x4 0x4 gzip
! 2905: >>36 belong&0x8 0x8 gzdata
! 2906: #------------------------------------------------------------------------------
! 2907: # blender: file(1) magic for Blender 3D related files
! 2908: #
! 2909: # Native format rule v1.2. For questions use the developers list
! 2910: # http://lists.blender.org/mailman/listinfo/bf-committers
! 2911: # GLOB chunk was moved near start and provides subversion info since 2.42
! 2912:
! 2913: 0 string =BLENDER Blender3D,
! 2914: >7 string =_ saved as 32-bits
! 2915: >>8 string =v little endian
! 2916: >>>9 byte x with version %c.
! 2917: >>>10 byte x \b%c
! 2918: >>>11 byte x \b%c
! 2919: >>>0x40 string =GLOB \b.
! 2920: >>>>0x58 leshort x \b%.4d
! 2921: >>8 string =V big endian
! 2922: >>>9 byte x with version %c.
! 2923: >>>10 byte x \b%c
! 2924: >>>11 byte x \b%c
! 2925: >>>0x40 string =GLOB \b.
! 2926: >>>>0x58 beshort x \b%.4d
! 2927: >7 string =- saved as 64-bits
! 2928: >>8 string =v little endian
! 2929: >>9 byte x with version %c.
! 2930: >>10 byte x \b%c
! 2931: >>11 byte x \b%c
! 2932: >>0x44 string =GLOB \b.
! 2933: >>>0x60 leshort x \b%.4d
! 2934: >>8 string =V big endian
! 2935: >>>9 byte x with version %c.
! 2936: >>>10 byte x \b%c
! 2937: >>>11 byte x \b%c
! 2938: >>>0x44 string =GLOB \b.
! 2939: >>>>0x60 beshort x \b%.4d
! 2940:
! 2941: # Scripts that run in the embeded Python interpreter
! 2942: 0 string #!BPY Blender3D BPython script
! 2943:
! 2944: #------------------------------------------------------------------------------
! 2945: # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
! 2946: #
! 2947: # Note that this 0407 conflicts with several other a.out formats...
! 2948: #
! 2949: # XXX - should this be redone with "be" and "le", so that it works on
! 2950: # little-endian machines as well? If so, what's the deal with
! 2951: # "VAX-order" and "VAX-order2"?
! 2952: #
! 2953: #0 long 0407 68K Blit (standalone) executable
! 2954: #0 short 0407 VAX-order2 68K Blit (standalone) executable
! 2955: 0 short 03401 VAX-order 68K Blit (standalone) executable
! 2956: 0 long 0406 68k Blit mpx/mux executable
! 2957: 0 short 0406 VAX-order2 68k Blit mpx/mux executable
! 2958: 0 short 03001 VAX-order 68k Blit mpx/mux executable
! 2959: # Need more values for WE32 DMD executables.
! 2960: # Note that 0520 is the same as COFF
! 2961: #0 short 0520 tty630 layers executable
! 2962: #
! 2963: # i80960 b.out objects and archives
! 2964: #
! 2965: 0 long 0x10d i960 b.out relocatable object
! 2966: >16 long >0 not stripped
! 2967: #
! 2968: # b.out archive (hp-rt on i960)
! 2969: 0 string =!<bout> b.out archive
! 2970: >8 string __.SYMDEF random library
! 2971: #------------------------------------------------------------------------------
! 2972: # bsdi: file(1) magic for BSD/OS (from BSDI) objects
! 2973: #
! 2974:
! 2975: 0 lelong 0314 386 compact demand paged pure executable
! 2976: >16 lelong >0 not stripped
! 2977: >32 byte 0x6a (uses shared libs)
! 2978:
! 2979: 0 lelong 0407 386 executable
! 2980: >16 lelong >0 not stripped
! 2981: >32 byte 0x6a (uses shared libs)
! 2982:
! 2983: 0 lelong 0410 386 pure executable
! 2984: >16 lelong >0 not stripped
! 2985: >32 byte 0x6a (uses shared libs)
! 2986:
! 2987: 0 lelong 0413 386 demand paged pure executable
! 2988: >16 lelong >0 not stripped
! 2989: >32 byte 0x6a (uses shared libs)
! 2990:
! 2991: # same as in SunOS 4.x, except for static shared libraries
! 2992: 0 belong&077777777 0600413 sparc demand paged
! 2993: >0 byte &0x80
! 2994: >>20 belong <4096 shared library
! 2995: >>20 belong =4096 dynamically linked executable
! 2996: >>20 belong >4096 dynamically linked executable
! 2997: >0 byte ^0x80 executable
! 2998: >16 belong >0 not stripped
! 2999: >36 belong 0xb4100001 (uses shared libs)
! 3000:
! 3001: 0 belong&077777777 0600410 sparc pure
! 3002: >0 byte &0x80 dynamically linked executable
! 3003: >0 byte ^0x80 executable
! 3004: >16 belong >0 not stripped
! 3005: >36 belong 0xb4100001 (uses shared libs)
! 3006:
! 3007: 0 belong&077777777 0600407 sparc
! 3008: >0 byte &0x80 dynamically linked executable
! 3009: >0 byte ^0x80 executable
! 3010: >16 belong >0 not stripped
! 3011: >36 belong 0xb4100001 (uses shared libs)
! 3012: #------------------------------------------------------------------------------
! 3013: # BTSnoop: file(1) magic for BTSnoop files
! 3014: #
! 3015: # From <marcel@holtmann.org>
! 3016: 0 string btsnoop\0 BTSnoop
! 3017: >8 belong x version %d,
! 3018: >12 belong 1001 Unencapsulated HCI
! 3019: >12 belong 1002 HCI UART (H4)
! 3020: >12 belong 1003 HCI BCSP
! 3021: >12 belong 1004 HCI Serial (H5)
! 3022: >>12 belong x type %d
! 3023: #------------------------------------------------------------------------------
! 3024: # c-lang: file(1) magic for C programs (or REXX)
! 3025: #
! 3026:
! 3027: # XPM icons (Greg Roelofs, newt@uchicago.edu)
! 3028: # if you uncomment "/*" for C/REXX below, also uncomment this entry
! 3029: #0 string /*\ XPM\ */ X pixmap image data
! 3030: #!:mime image/x-xpmi
! 3031:
! 3032: # 3DS (3d Studio files) Conflicts with diff output 0x3d '='
! 3033: #16 beshort 0x3d3d image/x-3ds
! 3034:
! 3035: # this first will upset you if you're a PL/1 shop...
! 3036: # in which case rm it; ascmagic will catch real C programs
! 3037: #0 search/1 /* C or REXX program text
! 3038: #0 search/1 // C++ program text
! 3039:
! 3040: # From: Mikhail Teterin <mi@aldan.algebra.com>
! 3041: 0 string cscope cscope reference data
! 3042: >7 string x version %.2s
! 3043: # We skip the path here, because it is often long (so file will
! 3044: # truncate it) and mostly redundant.
! 3045: # The inverted index functionality was added some time betwen
! 3046: # versions 11 and 15, so look for -q if version is above 14:
! 3047: >7 string >14
! 3048: >>10 search/100 \ -q\ with inverted index
! 3049: >10 search/100 \ -c\ text (non-compressed)
! 3050: #------------------------------------------------------------------------------
! 3051: # c64: file(1) magic for various commodore 64 related files
! 3052: #
! 3053: # From: Dirk Jagdmann <doj@cubic.org>
! 3054:
! 3055: 0x16500 belong 0x12014100 D64 Image
! 3056: 0x16500 belong 0x12014180 D71 Image
! 3057: 0x61800 belong 0x28034400 D81 Image
! 3058: 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
! 3059: 0 belong 0x43154164 X64 Image
! 3060:
! 3061: 0 string GCR-1541 GCR Image
! 3062: >8 byte x version: %i
! 3063: >9 byte x tracks: %i
! 3064:
! 3065: 9 string PSUR ARC archive (c64)
! 3066: 2 string -LH1- LHA archive (c64)
! 3067:
! 3068: 0 string C64File PC64 Emulator file
! 3069: >8 string >\0 "%s"
! 3070: 0 string C64Image PC64 Freezer Image
! 3071:
! 3072: 0 beshort 0x38CD C64 PCLink Image
! 3073: 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
! 3074:
! 3075: 0 belong 0xFF424CFF WRAptor packer (c64)
! 3076:
! 3077: 0 string C64S\x20tape\x20file T64 tape Image
! 3078: >32 leshort x Version:0x%x
! 3079: >36 leshort !0 Entries:%i
! 3080: >40 string x Name:%.24s
! 3081:
! 3082: 0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
! 3083: >32 leshort x Version:0x%x
! 3084: >36 leshort !0 Entries:%i
! 3085: >40 string x Name:%.24s
! 3086:
! 3087: 0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
! 3088: >32 leshort x Version:0x%x
! 3089: >36 leshort !0 Entries:%i
! 3090: >40 string x Name:%.24s
! 3091:
! 3092: #------------------------------------------------------------------------------
! 3093: # autocad: file(1) magic for cad files
! 3094: #
! 3095:
! 3096: # AutoCAD DWG versions R13/R14 (www.autodesk.com)
! 3097: # Written December 01, 2003 by Lester Hightower
! 3098: # Based on the DWG File Format Specifications at http://www.opendwg.org/
! 3099: 0 string \101\103\061\060\061 AutoCAD
! 3100: >5 string \062\000\000\000\000 DWG ver. R13
! 3101: >5 string \064\000\000\000\000 DWG ver. R14
! 3102:
! 3103: # Microstation DGN/CIT Files (www.bentley.com)
! 3104: # Last updated July 29, 2005 by Lester Hightower
! 3105: # DGN is the default file extension of Microstation/Intergraph CAD files.
! 3106: # CIT is the proprietary raster format (similar to TIFF) used to attach
! 3107: # raster underlays to Microstation DGN (vector) drawings.
! 3108: #
! 3109: # http://www.wotsit.org/search.asp
! 3110: # http://filext.com/detaillist.php?extdetail=DGN
! 3111: # http://filext.com/detaillist.php?extdetail=CIT
! 3112: #
! 3113: # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
! 3114: # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
! 3115: # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
! 3116: # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
! 3117: 0 string \010\011\376 Microstation
! 3118: >3 string \002
! 3119: >>30 string \026\105 DGNFile
! 3120: >>30 string \034\105 DGNFile
! 3121: >>30 string \073\107 DGNFile
! 3122: >>30 string \073\110 DGNFile
! 3123: >>30 string \106\107 DGNFile
! 3124: >>30 string \110\103 DGNFile
! 3125: >>30 string \120\104 DGNFile
! 3126: >>30 string \172\104 DGNFile
! 3127: >>30 string \172\105 DGNFile
! 3128: >>30 string \172\106 DGNFile
! 3129: >>30 string \234\106 DGNFile
! 3130: >>30 string \273\105 DGNFile
! 3131: >>30 string \306\106 DGNFile
! 3132: >>30 string \310\104 DGNFile
! 3133: >>30 string \341\104 DGNFile
! 3134: >>30 string \372\103 DGNFile
! 3135: >>30 string \372\104 DGNFile
! 3136: >>30 string \372\106 DGNFile
! 3137: >>30 string \376\103 DGNFile
! 3138: >4 string \030\000\000 CITFile
! 3139: >4 string \030\000\003 CITFile
! 3140:
! 3141: # AutoCad, from Nahuel Greco
! 3142: # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
! 3143: 0 string AC1012 AutoCad (release 12)
! 3144: 0 string AC1013 AutoCad (release 13)
! 3145: 0 string AC1014 AutoCad (release 14)
! 3146:
! 3147: # CAD: file(1) magic for computer aided design files
! 3148: # Phillip Griffith <phillip dot griffith at gmail dot com>
! 3149: # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
! 3150: #
! 3151: 0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
! 3152: 0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
! 3153: 0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
! 3154: 0 beshort 0x0809 Bentley/Intergraph MicroStation
! 3155: >0x02 byte 0xfe
! 3156: >>0x04 beshort 0x1800 CIT raster CAD
! 3157: 0 string AC1012 AutoDesk AutoCAD R13
! 3158: 0 string AC1014 AutoDesk AutoCAD R14
! 3159: 0 string AC1015 AutoDesk AutoCAD R2000
! 3160: #------------------------------------------------------------------------------
! 3161: # Cafe Babes unite!
! 3162: #
! 3163: # Since Java bytecode and Mach-O fat-files have the same magic number, the test
! 3164: # must be performed in the same "magic" sequence to get both right. The long
! 3165: # at offset 4 in a mach-O fat file tells the number of architectures; the short at
! 3166: # offset 4 in a Java bytecode file is the JVM minor version and the
! 3167: # short at offset 6 is the JVM major version. Since there are only
! 3168: # only 18 labeled Mach-O architectures at current, and the first released
! 3169: # Java class format was version 43.0, we can safely choose any number
! 3170: # between 18 and 39 to test the number of architectures against
! 3171: # (and use as a hack). Let's not use 18, because the Mach-O people
! 3172: # might add another one or two as time goes by...
! 3173: #
! 3174: 0 beshort 0xcafe
! 3175: >2 beshort 0xbabe
! 3176: !:mime application/x-java-applet
! 3177: >>2 belong >30 compiled Java class data,
! 3178: >>>6 beshort x version %d.
! 3179: >>>4 beshort x \b%d
! 3180: >>4 belong 1 Mach-O fat file with 1 architecture
! 3181: >>4 belong >1
! 3182: >>>4 belong <20 Mach-O fat file with %ld architectures
! 3183: >2 beshort 0xd00d JAR compressed with pack200,
! 3184: >>5 byte x version %d.
! 3185: >>4 byte x \b%d
! 3186: !:mime application/x-java-pack200
! 3187: #------------------------------------------------------------------------------
! 3188: # CDDB: file(1) magic for CDDB(tm) format CD text data files
! 3189: #
! 3190: # From <steve@gracenote.com>
! 3191: #
! 3192: # This is the /etc/magic entry to decode datafiles as used by
! 3193: # CDDB-enabled CD player applications.
! 3194: #
! 3195:
! 3196: 0 search/1/b #\040xmcd CDDB(tm) format CD text data
! 3197:
! 3198: #------------------------------------------------------------------------------
! 3199: # chord: file(1) magic for Chord music sheet typesetting utility input files
! 3200: #
! 3201: # From Philippe De Muyter <phdm@macqel.be>
! 3202: # File format is actually free, but many distributed files begin with `{title'
! 3203: #
! 3204: 0 string {title Chord text file
! 3205:
! 3206: # Type: PowerTab file format
! 3207: # URL: http://www.power-tab.net/
! 3208: # From: Jelmer Vernooij <jelmer@samba.org>
! 3209: 0 string ptab\003\000 Power-Tab v3 Tablature File
! 3210: 0 string ptab\004\000 Power-Tab v4 Tablature File
! 3211: #------------------------------------------------------------------------------
! 3212: # cisco: file(1) magic for cisco Systems routers
! 3213: #
! 3214: # Most cisco file-formats are covered by the generic elf code
! 3215: #
! 3216: # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
! 3217: 0 belong&0xffffff00 0x85011400 cisco IOS microcode
! 3218: >7 string >\0 for '%s'
! 3219: 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
! 3220: >7 string >\0 for '%s'
! 3221: #------------------------------------------------------------------------------
! 3222: # citrus locale declaration
! 3223: #
! 3224:
! 3225: 0 string RuneCT Citrus locale declaration for LC_CTYPE
! 3226:
! 3227:
! 3228: #------------------------------------------------------------------------------
! 3229: # clarion: file(1) magic for # Clarion Personal/Professional Developer
! 3230: # (v2 and above)
! 3231: # From: Julien Blache <jb@jblache.org>
! 3232:
! 3233: # Database files
! 3234: # signature
! 3235: 0 leshort 0x3343 Clarion Developer (v2 and above) data file
! 3236: # attributes
! 3237: >2 leshort &0x0001 \b, locked
! 3238: >2 leshort &0x0004 \b, encrypted
! 3239: >2 leshort &0x0008 \b, memo file exists
! 3240: >2 leshort &0x0010 \b, compressed
! 3241: >2 leshort &0x0040 \b, read only
! 3242: # number of records
! 3243: >5 lelong x \b, %ld records
! 3244:
! 3245: # Memo files
! 3246: 0 leshort 0x334d Clarion Developer (v2 and above) memo data
! 3247:
! 3248: # Key/Index files
! 3249: # No magic? :(
! 3250:
! 3251: # Help files
! 3252: 0 leshort 0x49e0 Clarion Developer (v2 and above) help data
! 3253:
! 3254: #------------------------------------------------------------------------------
! 3255: # claris: file(1) magic for claris
! 3256: # "H. Nanosecond" <aldomel@ix.netcom.com>
! 3257: # Claris Works a word processor, etc.
! 3258: # Version 3.0
! 3259:
! 3260: # .pct claris works clip art files
! 3261: #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
! 3262: #*
! 3263: #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
! 3264: #null to byte 1000 octal
! 3265: 514 string \377\377\377\377\000 Claris clip art?
! 3266: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
! 3267: 514 string \377\377\377\377\001 Claris clip art?
! 3268: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
! 3269:
! 3270: # Claris works files
! 3271: # .cwk
! 3272: 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
! 3273: # .plt
! 3274: 0 string \020\341\000\000\010\010 Claris Works pallete files .plt
! 3275:
! 3276: # .msp a dictionary file I am not sure about this I have only one .msp file
! 3277: 0 string \002\271\262\000\040\002\000\164 Claris works dictionary
! 3278:
! 3279: # .usp are user dictionary bits
! 3280: # I am not sure about a magic header:
! 3281: #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
! 3282: # soh S p f 8 U D sp ^ S cr nl p o d i
! 3283: #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
! 3284: # a t r i s t sp ^ S cr nl d i v sp #
! 3285:
! 3286: # .mth Thesaurus
! 3287: # starts with \0 but no magic header
! 3288:
! 3289: # .chy Hyphenation file
! 3290: # I am not sure: 000 210 034 000 000
! 3291:
! 3292: # other claris files
! 3293: #./windows/claris/useng.ndx: data
! 3294: #./windows/claris/xtndtran.l32: data
! 3295: #./windows/claris/xtndtran.lst: data
! 3296: #./windows/claris/clworks.lbl: data
! 3297: #./windows/claris/clworks.prf: data
! 3298: #./windows/claris/userd.spl: data
! 3299:
! 3300: #------------------------------------------------------------------------------
! 3301: # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
! 3302: #
! 3303: # XXX - what byte order does the Clipper use?
! 3304: #
! 3305: # XXX - what's the "!" stuff:
! 3306: #
! 3307: # >18 short !074000,000000 C1 R1
! 3308: # >18 short !074000,004000 C2 R1
! 3309: # >18 short !074000,010000 C3 R1
! 3310: # >18 short !074000,074000 TEST
! 3311: #
! 3312: # I shall assume it's ANDing the field with the first value and
! 3313: # comparing it with the second, and rewrite it as:
! 3314: #
! 3315: # >18 short&074000 000000 C1 R1
! 3316: # >18 short&074000 004000 C2 R1
! 3317: # >18 short&074000 010000 C3 R1
! 3318: # >18 short&074000 074000 TEST
! 3319: #
! 3320: # as SVR3.1's "file" doesn't support anything of the "!074000,000000"
! 3321: # sort, nor does SunOS 4.x, so either it's something Intergraph added
! 3322: # in CLIX, or something AT&T added in SVR3.2 or later, or something
! 3323: # somebody else thought was a good idea; it's not documented in the
! 3324: # man page for this version of "magic", nor does it appear to be
! 3325: # implemented (at least not after I blew off the bogus code to turn
! 3326: # old-style "&"s into new-style "&"s, which just didn't work at all).
! 3327: #
! 3328: 0 short 0575 CLIPPER COFF executable (VAX #)
! 3329: >20 short 0407 (impure)
! 3330: >20 short 0410 (5.2 compatible)
! 3331: >20 short 0411 (pure)
! 3332: >20 short 0413 (demand paged)
! 3333: >20 short 0443 (target shared library)
! 3334: >12 long >0 not stripped
! 3335: >22 short >0 - version %ld
! 3336: 0 short 0577 CLIPPER COFF executable
! 3337: >18 short&074000 000000 C1 R1
! 3338: >18 short&074000 004000 C2 R1
! 3339: >18 short&074000 010000 C3 R1
! 3340: >18 short&074000 074000 TEST
! 3341: >20 short 0407 (impure)
! 3342: >20 short 0410 (pure)
! 3343: >20 short 0411 (separate I&D)
! 3344: >20 short 0413 (paged)
! 3345: >20 short 0443 (target shared library)
! 3346: >12 long >0 not stripped
! 3347: >22 short >0 - version %ld
! 3348: >48 long&01 01 alignment trap enabled
! 3349: >52 byte 1 -Ctnc
! 3350: >52 byte 2 -Ctsw
! 3351: >52 byte 3 -Ctpw
! 3352: >52 byte 4 -Ctcb
! 3353: >53 byte 1 -Cdnc
! 3354: >53 byte 2 -Cdsw
! 3355: >53 byte 3 -Cdpw
! 3356: >53 byte 4 -Cdcb
! 3357: >54 byte 1 -Csnc
! 3358: >54 byte 2 -Cssw
! 3359: >54 byte 3 -Cspw
! 3360: >54 byte 4 -Cscb
! 3361: 4 string pipe CLIPPER instruction trace
! 3362: 4 string prof CLIPPER instruction profile
! 3363:
! 3364: #------------------------------------------------------------------------------
! 3365: # commands: file(1) magic for various shells and interpreters
! 3366: #
! 3367: #0 string : shell archive or script for antique kernel text
! 3368: 0 string/b #!\ /bin/sh POSIX shell script text executable
! 3369: !:mime text/x-shellscript
! 3370: 0 string/b #!\ /bin/csh C shell script text executable
! 3371: !:mime text/x-shellscript
! 3372: # korn shell magic, sent by George Wu, gwu@clyde.att.com
! 3373: 0 string/b #!\ /bin/ksh Korn shell script text executable
! 3374: !:mime text/x-shellscript
! 3375: 0 string/b #!\ /bin/tcsh Tenex C shell script text executable
! 3376: !:mime text/x-shellscript
! 3377: 0 string/b #!\ /usr/bin/tcsh Tenex C shell script text executable
! 3378: !:mime text/x-shellscript
! 3379: 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable
! 3380: !:mime text/x-shellscript
! 3381: 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable
! 3382: !:mime text/x-shellscript
! 3383:
! 3384: #
! 3385: # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
! 3386: 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable
! 3387: !:mime text/x-shellscript
! 3388: 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
! 3389: !:mime text/x-shellscript
! 3390: 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
! 3391: !:mime text/x-shellscript
! 3392: 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable
! 3393: !:mime text/x-shellscript
! 3394: 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable
! 3395: !:mime text/x-shellscript
! 3396: 0 string/b #!\ /bin/nawk new awk script text executable
! 3397: !:mime text/x-nawk
! 3398: 0 string/b #!\ /usr/bin/nawk new awk script text executable
! 3399: !:mime text/x-nawk
! 3400: 0 string/b #!\ /usr/local/bin/nawk new awk script text executable
! 3401: !:mime text/x-nawk
! 3402: 0 string/b #!\ /bin/gawk GNU awk script text executable
! 3403: !:mime text/x-gawk
! 3404: 0 string/b #!\ /usr/bin/gawk GNU awk script text executable
! 3405: !:mime text/x-gawk
! 3406: 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable
! 3407: !:mime text/x-gawk
! 3408: #
! 3409: 0 string/b #!\ /bin/awk awk script text executable
! 3410: !:mime text/x-awk
! 3411: 0 string/b #!\ /usr/bin/awk awk script text executable
! 3412: !:mime text/x-awk
! 3413: # update to distinguish from *.vcf files
! 3414: # this is broken because postscript has /EBEGIN{ for example.
! 3415: #0 search/Bb BEGIN { awk script text
! 3416: 0 regex =^\\s*BEGIN\\s*[{] awk script text
! 3417:
! 3418: # AT&T Bell Labs' Plan 9 shell
! 3419: 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable
! 3420:
! 3421: # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
! 3422: 0 string/b #!\ /bin/bash Bourne-Again shell script text executable
! 3423: !:mime text/x-shellscript
! 3424: 0 string/b #!\ /usr/bin/bash Bourne-Again shell script text executable
! 3425: !:mime text/x-shellscript
! 3426: 0 string/b #!\ /usr/local/bash Bourne-Again shell script text executable
! 3427: !:mime text/x-shellscript
! 3428: 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable
! 3429: !:mime text/x-shellscript
! 3430:
! 3431: # using env
! 3432: 0 string #!/usr/bin/env a
! 3433: >15 string >\0 %s script text executable
! 3434: 0 string #!\ /usr/bin/env a
! 3435: >16 string >\0 %s script text executable
! 3436:
! 3437: # PHP scripts
! 3438: # Ulf Harnhammar <ulfh@update.uu.se>
! 3439: 0 search/1/c =<?php PHP script text
! 3440: !:mime text/x-php
! 3441: 0 search/1 =<?\n PHP script text
! 3442: !:mime text/x-php
! 3443: 0 search/1 =<?\r PHP script text
! 3444: !:mime text/x-php
! 3445: 0 search/1/b #!\ /usr/local/bin/php PHP script text executable
! 3446: !:mime text/x-php
! 3447: 0 search/1/b #!\ /usr/bin/php PHP script text executable
! 3448: !:mime text/x-php
! 3449:
! 3450: 0 string Zend\x00 PHP script Zend Optimizer data
! 3451:
! 3452: 0 string $! DCL command file
! 3453:
! 3454: # Type: Pdmenu
! 3455: # URL: http://packages.debian.org/pdmenu
! 3456: # From: Edward Betts <edward@debian.org>
! 3457: 0 string #!/usr/bin/pdmenu Pdmenu configuration file text
! 3458:
! 3459: #----------------------------------------------------------------------------
! 3460: # communication
! 3461:
! 3462: # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
! 3463: # It is used for conformance testing of communication protocols.
! 3464: # Added by W. Borgert <debacle@debian.org>.
! 3465: 0 string $Suite TTCN Abstract Test Suite
! 3466: >&1 string $SuiteId
! 3467: >>&1 string >\n %s
! 3468: >&2 string $SuiteId
! 3469: >>&1 string >\n %s
! 3470: >&3 string $SuiteId
! 3471: >>&1 string >\n %s
! 3472:
! 3473: # MSC (message sequence charts) are a formal description technique,
! 3474: # described in ITU-T Z.120, mainly used for communication protocols.
! 3475: # Added by W. Borgert <debacle@debian.org>.
! 3476: 0 string mscdocument Message Sequence Chart (document)
! 3477: 0 string msc Message Sequence Chart (chart)
! 3478: 0 string submsc Message Sequence Chart (subchart)
! 3479:
! 3480: #------------------------------------------------------------------------------
! 3481: # compress: file(1) magic for pure-compression formats (no archives)
! 3482: #
! 3483: # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
! 3484: #
! 3485: # Formats for various forms of compressed data
! 3486: # Formats for "compress" proper have been moved into "compress.c",
! 3487: # because it tries to uncompress it to figure out what's inside.
! 3488:
! 3489: # standard unix compress
! 3490: 0 string \037\235 compress'd data
! 3491: !:mime application/x-compress
! 3492: >2 byte&0x80 >0 block compressed
! 3493: >2 byte&0x1f x %d bits
! 3494:
! 3495: # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
! 3496: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
! 3497: # * Original filename is only at offset 10 if "extra field" absent
! 3498: # * Produce shorter output - notably, only report compression methods
! 3499: # other than 8 ("deflate", the only method defined in RFC 1952).
! 3500: 0 string \037\213 gzip compressed data
! 3501: !:mime application/x-gzip
! 3502: >2 byte <8 \b, reserved method
! 3503: >2 byte >8 \b, unknown method
! 3504: >3 byte &0x01 \b, ASCII
! 3505: >3 byte &0x02 \b, has CRC
! 3506: >3 byte &0x04 \b, extra field
! 3507: >3 byte&0xC =0x08
! 3508: >>10 string x \b, was "%s"
! 3509: >3 byte &0x10 \b, has comment
! 3510: >9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
! 3511: >9 byte =0x01 \b, from Amiga
! 3512: >9 byte =0x02 \b, from VMS
! 3513: >9 byte =0x03 \b, from Unix
! 3514: >9 byte =0x04 \b, from VM/CMS
! 3515: >9 byte =0x05 \b, from Atari
! 3516: >9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
! 3517: >9 byte =0x07 \b, from MacOS
! 3518: >9 byte =0x08 \b, from Z-System
! 3519: >9 byte =0x09 \b, from CP/M
! 3520: >9 byte =0x0A \b, from TOPS/20
! 3521: >9 byte =0x0B \b, from NTFS filesystem (NT)
! 3522: >9 byte =0x0C \b, from QDOS
! 3523: >9 byte =0x0D \b, from Acorn RISCOS
! 3524: >3 byte &0x10 \b, comment
! 3525: >3 byte &0x20 \b, encrypted
! 3526: >4 ledate >0 \b, last modified: %s
! 3527: >8 byte 2 \b, max compression
! 3528: >8 byte 4 \b, max speed
! 3529:
! 3530: # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
! 3531: 0 string \037\036 packed data
! 3532: !:mime application/octet-stream
! 3533: >2 belong >1 \b, %d characters originally
! 3534: >2 belong =1 \b, %d character originally
! 3535: #
! 3536: # This magic number is byte-order-independent.
! 3537: 0 short 0x1f1f old packed data
! 3538: !:mime application/octet-stream
! 3539:
! 3540: # XXX - why *two* entries for "compacted data", one of which is
! 3541: # byte-order independent, and one of which is byte-order dependent?
! 3542: #
! 3543: 0 short 0x1fff compacted data
! 3544: !:mime application/octet-stream
! 3545: # This string is valid for SunOS (BE) and a matching "short" is listed
! 3546: # in the Ultrix (LE) magic file.
! 3547: 0 string \377\037 compacted data
! 3548: !:mime application/octet-stream
! 3549: 0 short 0145405 huf output
! 3550: !:mime application/octet-stream
! 3551:
! 3552: # bzip2
! 3553: 0 string BZh bzip2 compressed data
! 3554: !:mime application/x-bzip2
! 3555: >3 byte >47 \b, block size = %c00k
! 3556:
! 3557: # squeeze and crunch
! 3558: # Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
! 3559: 0 beshort 0x76FF squeezed data,
! 3560: >4 string x original name %s
! 3561: 0 beshort 0x76FE crunched data,
! 3562: >2 string x original name %s
! 3563: 0 beshort 0x76FD LZH compressed data,
! 3564: >2 string x original name %s
! 3565:
! 3566: # Freeze
! 3567: 0 string \037\237 frozen file 2.1
! 3568: 0 string \037\236 frozen file 1.0 (or gzip 0.5)
! 3569:
! 3570: # SCO compress -H (LZH)
! 3571: 0 string \037\240 SCO compress -H (LZH) data
! 3572:
! 3573: # European GSM 06.10 is a provisional standard for full-rate speech
! 3574: # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
! 3575: # excitation/long term prediction) coding at 13 kbit/s.
! 3576: #
! 3577: # There's only a magic nibble (4 bits); that nibble repeats every 33
! 3578: # bytes. This isn't suited for use, but maybe we can use it someday.
! 3579: #
! 3580: # This will cause very short GSM files to be declared as data and
! 3581: # mismatches to be declared as data too!
! 3582: #0 byte&0xF0 0xd0 data
! 3583: #>33 byte&0xF0 0xd0
! 3584: #>66 byte&0xF0 0xd0
! 3585: #>99 byte&0xF0 0xd0
! 3586: #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
! 3587:
! 3588: # bzip a block-sorting file compressor
! 3589: # by Julian Seward <sewardj@cs.man.ac.uk> and others
! 3590: #
! 3591: #0 string BZ bzip compressed data
! 3592: #>2 byte x \b, version: %c
! 3593: #>3 string =1 \b, compression block size 100k
! 3594: #>3 string =2 \b, compression block size 200k
! 3595: #>3 string =3 \b, compression block size 300k
! 3596: #>3 string =4 \b, compression block size 400k
! 3597: #>3 string =5 \b, compression block size 500k
! 3598: #>3 string =6 \b, compression block size 600k
! 3599: #>3 string =7 \b, compression block size 700k
! 3600: #>3 string =8 \b, compression block size 800k
! 3601: #>3 string =9 \b, compression block size 900k
! 3602:
! 3603: # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
! 3604: 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
! 3605: >9 beshort <0x0940
! 3606: >>9 byte&0xf0 =0x00 - version 0.
! 3607: >>9 beshort&0x0fff x \b%03x,
! 3608: >>13 byte 1 LZO1X-1,
! 3609: >>13 byte 2 LZO1X-1(15),
! 3610: >>13 byte 3 LZO1X-999,
! 3611: ## >>22 bedate >0 last modified: %s,
! 3612: >>14 byte =0x00 os: MS-DOS
! 3613: >>14 byte =0x01 os: Amiga
! 3614: >>14 byte =0x02 os: VMS
! 3615: >>14 byte =0x03 os: Unix
! 3616: >>14 byte =0x05 os: Atari
! 3617: >>14 byte =0x06 os: OS/2
! 3618: >>14 byte =0x07 os: MacOS
! 3619: >>14 byte =0x0A os: Tops/20
! 3620: >>14 byte =0x0B os: WinNT
! 3621: >>14 byte =0x0E os: Win32
! 3622: >9 beshort >0x0939
! 3623: >>9 byte&0xf0 =0x00 - version 0.
! 3624: >>9 byte&0xf0 =0x10 - version 1.
! 3625: >>9 byte&0xf0 =0x20 - version 2.
! 3626: >>9 beshort&0x0fff x \b%03x,
! 3627: >>15 byte 1 LZO1X-1,
! 3628: >>15 byte 2 LZO1X-1(15),
! 3629: >>15 byte 3 LZO1X-999,
! 3630: ## >>25 bedate >0 last modified: %s,
! 3631: >>17 byte =0x00 os: MS-DOS
! 3632: >>17 byte =0x01 os: Amiga
! 3633: >>17 byte =0x02 os: VMS
! 3634: >>17 byte =0x03 os: Unix
! 3635: >>17 byte =0x05 os: Atari
! 3636: >>17 byte =0x06 os: OS/2
! 3637: >>17 byte =0x07 os: MacOS
! 3638: >>17 byte =0x0A os: Tops/20
! 3639: >>17 byte =0x0B os: WinNT
! 3640: >>17 byte =0x0E os: Win32
! 3641:
! 3642: # 4.3BSD-Quasijarus Strong Compression
! 3643: # http://minnie.tuhs.org/Quasijarus/compress.html
! 3644: 0 string \037\241 Quasijarus strong compressed data
! 3645:
! 3646: # From: Cory Dikkers <cdikkers@swbell.net>
! 3647: 0 string XPKF Amiga xpkf.library compressed data
! 3648: 0 string PP11 Power Packer 1.1 compressed data
! 3649: 0 string PP20 Power Packer 2.0 compressed data,
! 3650: >4 belong 0x09090909 fast compression
! 3651: >4 belong 0x090A0A0A mediocre compression
! 3652: >4 belong 0x090A0B0B good compression
! 3653: >4 belong 0x090A0C0C very good compression
! 3654: >4 belong 0x090A0C0D best compression
! 3655:
! 3656: # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
! 3657: # http://www.7-zip.org or DOC/7zFormat.txt
! 3658: #
! 3659: 0 string 7z\274\257\047\034 7-zip archive data,
! 3660: >6 byte x version %d
! 3661: >7 byte x \b.%d
! 3662:
! 3663: # Type: LZMA
! 3664: # URL: http://www.7-zip.org/sdk.html
! 3665: # From: Robert Millan <rmh@aybabtu.com> and Reuben Thomas <rrt@sc3d.org>
! 3666: # Commented out because apparently not reliable (according to Debian
! 3667: # bug #364260)
! 3668: #0 string ]\000\000\200\000 LZMA compressed data
! 3669:
! 3670: # AFX compressed files (Wolfram Kleff)
! 3671: 2 string -afx- AFX compressed file data
! 3672:
! 3673: # Supplementary magic data for the file(1) command to support
! 3674: # rzip(1). The format is described in magic(5).
! 3675: #
! 3676: # Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
! 3677: # this file.
! 3678: #
! 3679: 0 string RZIP rzip compressed data
! 3680: >4 byte x - version %d
! 3681: >5 byte x \b.%d
! 3682: >6 belong x (%d bytes)
! 3683: #------------------------------------------------------------------------------
! 3684: # Console game magic
! 3685: # Toby Deshane <hac@shoelace.digivill.net>
! 3686: # ines: file(1) magic for Marat's iNES Nintendo Entertainment System
! 3687: # ROM dump format
! 3688:
! 3689: 0 string NES\032 iNES ROM dump,
! 3690: >4 byte x %dx16k PRG
! 3691: >5 byte x \b, %dx8k CHR
! 3692: >6 byte&0x01 =0x1 \b, [Vert.]
! 3693: >6 byte&0x01 =0x0 \b, [Horiz.]
! 3694: >6 byte&0x02 =0x2 \b, [SRAM]
! 3695: >6 byte&0x04 =0x4 \b, [Trainer]
! 3696: >6 byte&0x04 =0x8 \b, [4-Scr]
! 3697:
! 3698: #------------------------------------------------------------------------------
! 3699: # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
! 3700: #
! 3701: 0x104 belong 0xCEED6666 Gameboy ROM:
! 3702: >0x134 string >\0 "%.16s"
! 3703: >0x146 byte 0x03 \b,[SGB]
! 3704: >0x147 byte 0x00 \b, [ROM ONLY]
! 3705: >0x147 byte 0x01 \b, [ROM+MBC1]
! 3706: >0x147 byte 0x02 \b, [ROM+MBC1+RAM]
! 3707: >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
! 3708: >0x147 byte 0x05 \b, [ROM+MBC2]
! 3709: >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
! 3710: >0x147 byte 0x08 \b, [ROM+RAM]
! 3711: >0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
! 3712: >0x147 byte 0x0B \b, [ROM+MMM01]
! 3713: >0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
! 3714: >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
! 3715: >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
! 3716: >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
! 3717: >0x147 byte 0x11 \b, [ROM+MBC3]
! 3718: >0x147 byte 0x12 \b, [ROM+MBC3+RAM]
! 3719: >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
! 3720: >0x147 byte 0x19 \b, [ROM+MBC5]
! 3721: >0x147 byte 0x1A \b, [ROM+MBC5+RAM]
! 3722: >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
! 3723: >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
! 3724: >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
! 3725: >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
! 3726: >0x147 byte 0x1F \b, [Pocket Camera]
! 3727: >0x147 byte 0xFD \b, [Bandai TAMA5]
! 3728: >0x147 byte 0xFE \b, [Hudson HuC-3]
! 3729: >0x147 byte 0xFF \b, [Hudson HuC-1]
! 3730:
! 3731: >0x148 byte 0 \b, ROM: 256Kbit
! 3732: >0x148 byte 1 \b, ROM: 512Kbit
! 3733: >0x148 byte 2 \b, ROM: 1Mbit
! 3734: >0x148 byte 3 \b, ROM: 2Mbit
! 3735: >0x148 byte 4 \b, ROM: 4Mbit
! 3736: >0x148 byte 5 \b, ROM: 8Mbit
! 3737: >0x148 byte 6 \b, ROM: 16Mbit
! 3738: >0x148 byte 0x52 \b, ROM: 9Mbit
! 3739: >0x148 byte 0x53 \b, ROM: 10Mbit
! 3740: >0x148 byte 0x54 \b, ROM: 12Mbit
! 3741:
! 3742: >0x149 byte 1 \b, RAM: 16Kbit
! 3743: >0x149 byte 2 \b, RAM: 64Kbit
! 3744: >0x149 byte 3 \b, RAM: 128Kbit
! 3745: >0x149 byte 4 \b, RAM: 1Mbit
! 3746:
! 3747: #>0x14e long x \b, CRC: %x
! 3748:
! 3749: #------------------------------------------------------------------------------
! 3750: # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
! 3751: #
! 3752: 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
! 3753: >0x120 string >\0 Name: "%.16s"
! 3754: >0x110 string >\0 %.16s
! 3755: >0x1B0 string RA with SRAM
! 3756:
! 3757: #------------------------------------------------------------------------------
! 3758: # genesis: file(1) magic for the Super MegaDrive ROM dump format
! 3759: #
! 3760: 0x280 string EAGN Super MagicDrive ROM dump
! 3761: >0 byte x %dx16k blocks
! 3762: >2 byte 0 \b, last in series or standalone
! 3763: >2 byte >0 \b, split ROM
! 3764: >8 byte 0xAA
! 3765: >9 byte 0xBB
! 3766:
! 3767: #------------------------------------------------------------------------------
! 3768: # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
! 3769: #
! 3770: 0x280 string EAMG Super MagicDrive ROM dump
! 3771: >0 byte x %dx16k blocks
! 3772: >2 byte x \b, last in series or standalone
! 3773: >8 byte 0xAA
! 3774: >9 byte 0xBB
! 3775:
! 3776: #------------------------------------------------------------------------------
! 3777: # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
! 3778: #
! 3779: # Does not detect all images. Very preliminary guesswork. Need more data
! 3780: # on format.
! 3781: #
! 3782: # FIXME: need a little more info...;P
! 3783: #
! 3784: #0 byte 0xF3
! 3785: #>1 byte 0xED Sega Master System/Game Gear ROM dump
! 3786: #>1 byte 0x31 Sega Master System/Game Gear ROM dump
! 3787: #>1 byte 0xDB Sega Master System/Game Gear ROM dump
! 3788: #>1 byte 0xAF Sega Master System/Game Gear ROM dump
! 3789: #>1 byte 0xC3 Sega Master System/Game Gear ROM dump
! 3790:
! 3791: #------------------------------------------------------------------------------
! 3792: # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
! 3793: #
! 3794: 0 belong 0x21068028 Sega Dreamcast VMU game image
! 3795: 0 string LCDi Dream Animator file
! 3796:
! 3797: #------------------------------------------------------------------------------
! 3798: # v64: file(1) uncertain magic for the V64 format N64 ROM dumps
! 3799: #
! 3800: 0 belong 0x37804012 V64 Nintendo 64 ROM dump
! 3801:
! 3802: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 3803: # Nintendo .nds
! 3804: 192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
! 3805: # Nintendo .gba
! 3806: 0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
! 3807:
! 3808: #------------------------------------------------------------------------------
! 3809: # msx: file(1) magic for MSX game cartridge dumps
! 3810: # Too simple - MPi
! 3811: #0 beshort 0x4142 MSX game cartridge dump
! 3812:
! 3813: #------------------------------------------------------------------------------
! 3814: # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
! 3815: 0 string PS-X\ EXE Sony Playstation executable
! 3816: # Area:
! 3817: >113 string x (%s)
! 3818:
! 3819: #------------------------------------------------------------------------------
! 3820: # Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
! 3821: 0 string XBEH XBE, Microsoft Xbox executable
! 3822: # probabilistic checks whether signed or not
! 3823: >0x0004 ulelong =0x0
! 3824: >>&2 ulelong =0x0
! 3825: >>>&2 ulelong =0x0 \b, not signed
! 3826: >0x0004 ulelong >0
! 3827: >>&2 ulelong >0
! 3828: >>>&2 ulelong >0 \b, signed
! 3829: # expect base address of 0x10000
! 3830: >0x0104 ulelong =0x10000
! 3831: >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
! 3832: >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
! 3833: >>>(0x0118-0x0FF60) ulelong >0 (regions:
! 3834: >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
! 3835: >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
! 3836: >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
! 3837: >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
! 3838: >>>(0x0118-0x0FF60) ulelong >0 \b)
! 3839:
! 3840: # --------------------------------
! 3841: # Microsoft Xbox data file formats
! 3842: 0 string XIP0 XIP, Microsoft Xbox data
! 3843: 0 string XTF0 XTF, Microsoft Xbox data
! 3844:
! 3845: # Atari Lynx cartridge dump (EXE/BLL header)
! 3846: # From: "Stefan A. Haubenthal" <polluks@web.de>
! 3847:
! 3848: 0 beshort 0x8008 Lynx cartridge,
! 3849: >2 beshort x RAM start $%04x
! 3850: >6 string BS93
! 3851:
! 3852: # Opera file system that is used on the 3DO console
! 3853: # From: Serge van den Boom <svdb@stack.nl>
! 3854: 0 string \x01ZZZZZ\x01 3DO "Opera" file system
! 3855:
! 3856: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
! 3857: 0 string GBS Nintendo Gameboy Music/Audio Data
! 3858: 12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
! 3859:
! 3860: # Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
! 3861: 0 string PPF30 Playstation Patch File version 3.0
! 3862: >5 byte 0 \b, PPF 1.0 patch
! 3863: >5 byte 1 \b, PPF 2.0 patch
! 3864: >5 byte 2 \b, PPF 3.0 patch
! 3865: >>56 byte 0 \b, Imagetype BIN (any)
! 3866: >>56 byte 1 \b, Imagetype GI (PrimoDVD)
! 3867: >>57 byte 0 \b, Blockcheck disabled
! 3868: >>57 byte 1 \b, Blockcheck enabled
! 3869: >>58 byte 0 \b, Undo data not available
! 3870: >>58 byte 1 \b, Undo data available
! 3871: >6 string x \b, description: %s
! 3872:
! 3873: 0 string PPF20 Playstation Patch File version 2.0
! 3874: >5 byte 0 \b, PPF 1.0 patch
! 3875: >5 byte 1 \b, PPF 2.0 patch
! 3876: >>56 lelong >0 \b, size of file to patch %d
! 3877: >6 string x \b, description: %s
! 3878:
! 3879: 0 string PPF10 Playstation Patch File version 1.0
! 3880: >5 byte 0 \b, Simple Encoding
! 3881: >6 string x \b, description: %s
! 3882:
! 3883: # From: Daniel Dawson <ddawson@icehouse.net>
! 3884: # SNES9x .smv "movie" file format.
! 3885: 0 string SMV\x1A SNES9x input recording
! 3886: >0x4 lelong x \b, version %d
! 3887: # version 4 is latest so far
! 3888: >0x4 lelong <5
! 3889: >>0x8 ledate x \b, recorded at %s
! 3890: >>0xc lelong >0 \b, rerecorded %d times
! 3891: >>0x10 lelong x \b, %d frames long
! 3892: >>0x14 byte >0 \b, data for controller(s):
! 3893: >>>0x14 byte &0x1 #1
! 3894: >>>0x14 byte &0x2 #2
! 3895: >>>0x14 byte &0x4 #3
! 3896: >>>0x14 byte &0x8 #4
! 3897: >>>0x14 byte &0x10 #5
! 3898: >>0x15 byte ^0x1 \b, begins from snapshot
! 3899: >>0x15 byte &0x1 \b, begins from reset
! 3900: >>0x15 byte ^0x2 \b, NTSC standard
! 3901: >>0x15 byte &0x2 \b, PAL standard
! 3902: >>0x17 byte &0x1 \b, settings:
! 3903: # WIP1Timing not used as of version 4
! 3904: >>>0x4 lelong <4
! 3905: >>>>0x17 byte &0x2 WIP1Timing
! 3906: >>>0x17 byte &0x4 Left+Right
! 3907: >>>0x17 byte &0x8 VolumeEnvX
! 3908: >>>0x17 byte &0x10 FakeMute
! 3909: >>>0x17 byte &0x20 SyncSound
! 3910: # New flag as of version 4
! 3911: >>>0x4 lelong >3
! 3912: >>>>0x17 byte &0x80 NoCPUShutdown
! 3913: >>0x4 lelong <4
! 3914: >>>0x18 lelong >0x23
! 3915: >>>>0x20 leshort !0
! 3916: >>>>>0x20 lestring16 x \b, metadata: "%s"
! 3917: >>0x4 lelong >3
! 3918: >>>0x24 byte >0 \b, port 1:
! 3919: >>>>0x24 byte 1 joypad
! 3920: >>>>0x24 byte 2 mouse
! 3921: >>>>0x24 byte 3 SuperScope
! 3922: >>>>0x24 byte 4 Justifier
! 3923: >>>>0x24 byte 5 multitap
! 3924: >>>0x24 byte >0 \b, port 2:
! 3925: >>>>0x25 byte 1 joypad
! 3926: >>>>0x25 byte 2 mouse
! 3927: >>>>0x25 byte 3 SuperScope
! 3928: >>>>0x25 byte 4 Justifier
! 3929: >>>>0x25 byte 5 multitap
! 3930: >>>0x18 lelong >0x43
! 3931: >>>>0x40 leshort !0
! 3932: >>>>>0x40 lestring16 x \b, metadata: "%s"
! 3933: >>0x17 byte &0x40 \b, ROM:
! 3934: >>>(0x18.l-26) lelong x CRC32 0x%08x
! 3935: >>>(0x18.l-23) string x "%s"
! 3936:
! 3937: # Type: scummVM savegame files
! 3938: # From: Sven Hartge <debian@ds9.argh.org>
! 3939: 0 string SCVM scummVM savegame
! 3940: >12 string >\0 "%s"
! 3941: #------------------------------------------------------------------------------
! 3942: # convex: file(1) magic for Convex boxes
! 3943: #
! 3944: # Convexes are big-endian.
! 3945: #
! 3946: # /*\
! 3947: # * Below are the magic numbers and tests added for Convex.
! 3948: # * Added at beginning, because they are expected to be used most.
! 3949: # \*/
! 3950: 0 belong 0507 Convex old-style object
! 3951: >16 belong >0 not stripped
! 3952: 0 belong 0513 Convex old-style demand paged executable
! 3953: >16 belong >0 not stripped
! 3954: 0 belong 0515 Convex old-style pre-paged executable
! 3955: >16 belong >0 not stripped
! 3956: 0 belong 0517 Convex old-style pre-paged, non-swapped executable
! 3957: >16 belong >0 not stripped
! 3958: 0 belong 0x011257 Core file
! 3959: #
! 3960: # The following are a series of dump format magic numbers. Each one
! 3961: # corresponds to a drastically different dump format. The first on is
! 3962: # the original dump format on a 4.1 BSD or earlier file system. The
! 3963: # second marks the change between the 4.1 file system and the 4.2 file
! 3964: # system. The Third marks the changing of the block size from 1K
! 3965: # to 2K to be compatible with an IDC file system. The fourth indicates
! 3966: # a dump that is dependent on Convex Storage Manager, because data in
! 3967: # secondary storage is not physically contained within the dump.
! 3968: # The restore program uses these number to determine how the data is
! 3969: # to be extracted.
! 3970: #
! 3971: 24 belong =60011 dump format, 4.1 BSD or earlier
! 3972: 24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
! 3973: 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
! 3974: 24 belong =60014 dump format, Convex Storage Manager by-reference dump
! 3975: #
! 3976: # what follows is a bunch of bit-mask checks on the flags field of the opthdr.
! 3977: # If there is no `=' sign, assume just checking for whether the bit is set?
! 3978: #
! 3979: 0 belong 0601 Convex SOFF
! 3980: >88 belong&0x000f0000 =0x00000000 c1
! 3981: >88 belong &0x00010000 c2
! 3982: >88 belong &0x00020000 c2mp
! 3983: >88 belong &0x00040000 parallel
! 3984: >88 belong &0x00080000 intrinsic
! 3985: >88 belong &0x00000001 demand paged
! 3986: >88 belong &0x00000002 pre-paged
! 3987: >88 belong &0x00000004 non-swapped
! 3988: >88 belong &0x00000008 POSIX
! 3989: #
! 3990: >84 belong &0x80000000 executable
! 3991: >84 belong &0x40000000 object
! 3992: >84 belong&0x20000000 =0 not stripped
! 3993: >84 belong&0x18000000 =0x00000000 native fpmode
! 3994: >84 belong&0x18000000 =0x10000000 ieee fpmode
! 3995: >84 belong&0x18000000 =0x18000000 undefined fpmode
! 3996: #
! 3997: 0 belong 0605 Convex SOFF core
! 3998: #
! 3999: 0 belong 0607 Convex SOFF checkpoint
! 4000: >88 belong&0x000f0000 =0x00000000 c1
! 4001: >88 belong &0x00010000 c2
! 4002: >88 belong &0x00020000 c2mp
! 4003: >88 belong &0x00040000 parallel
! 4004: >88 belong &0x00080000 intrinsic
! 4005: >88 belong &0x00000008 POSIX
! 4006: #
! 4007: >84 belong&0x18000000 =0x00000000 native fpmode
! 4008: >84 belong&0x18000000 =0x10000000 ieee fpmode
! 4009: >84 belong&0x18000000 =0x18000000 undefined fpmode
! 4010:
! 4011: #------------------------------------------------------------------------------
! 4012: # cracklib: file (1) magic for cracklib v2.7
! 4013:
! 4014: 0 lelong 0x70775631 Cracklib password index, little endian
! 4015: >4 long >0 (%i words)
! 4016: >4 long 0 ("64-bit")
! 4017: >>8 long >-1 (%i words)
! 4018: 0 belong 0x70775631 Cracklib password index, big endian
! 4019: >4 belong >-1 (%i words)
! 4020: # really bellong 0x0000000070775631
! 4021: 0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
! 4022: >12 belong >0 (%i words)
! 4023: # ----------------------------------------------------------------------------
! 4024: # ctags: file (1) magic for Exuberant Ctags files
! 4025: # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
! 4026: 0 search/1 =!_TAG Exuberant Ctags tag file text
! 4027:
! 4028: #------------------------------------------------------------------------------
! 4029: # dact: file(1) magic for DACT compressed files
! 4030: #
! 4031: 0 long 0x444354C3 DACT compressed data
! 4032: >4 byte >-1 (version %i.
! 4033: >5 byte >-1 $BS%i.
! 4034: >6 byte >-1 $BS%i)
! 4035: >7 long >0 $BS, original size: %i bytes
! 4036: >15 long >30 $BS, block size: %i bytes
! 4037:
! 4038: #------------------------------------------------------------------------------
! 4039: # database: file(1) magic for various databases
! 4040: #
! 4041: # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
! 4042: #
! 4043: #
! 4044: # GDBM magic numbers
! 4045: # Will be maintained as part of the GDBM distribution in the future.
! 4046: # <downsj@teeny.org>
! 4047: 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
! 4048: !:mime application/x-gdbm
! 4049: 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
! 4050: !:mime application/x-gdbm
! 4051: 0 string GDBM GNU dbm 2.x database
! 4052: !:mime application/x-gdbm
! 4053: #
! 4054: # Berkeley DB
! 4055: #
! 4056: # Ian Darwin's file /etc/magic files: big/little-endian version.
! 4057: #
! 4058: # Hash 1.85/1.86 databases store metadata in network byte order.
! 4059: # Btree 1.85/1.86 databases store the metadata in host byte order.
! 4060: # Hash and Btree 2.X and later databases store the metadata in host byte order.
! 4061:
! 4062: 0 long 0x00061561 Berkeley DB
! 4063: !:mime application/x-dbm
! 4064: >8 belong 4321
! 4065: >>4 belong >2 1.86
! 4066: >>4 belong <3 1.85
! 4067: >>4 belong >0 (Hash, version %d, native byte-order)
! 4068: >8 belong 1234
! 4069: >>4 belong >2 1.86
! 4070: >>4 belong <3 1.85
! 4071: >>4 belong >0 (Hash, version %d, little-endian)
! 4072:
! 4073: 0 belong 0x00061561 Berkeley DB
! 4074: >8 belong 4321
! 4075: >>4 belong >2 1.86
! 4076: >>4 belong <3 1.85
! 4077: >>4 belong >0 (Hash, version %d, big-endian)
! 4078: >8 belong 1234
! 4079: >>4 belong >2 1.86
! 4080: >>4 belong <3 1.85
! 4081: >>4 belong >0 (Hash, version %d, native byte-order)
! 4082:
! 4083: 0 long 0x00053162 Berkeley DB 1.85/1.86
! 4084: >4 long >0 (Btree, version %d, native byte-order)
! 4085: 0 belong 0x00053162 Berkeley DB 1.85/1.86
! 4086: >4 belong >0 (Btree, version %d, big-endian)
! 4087: 0 lelong 0x00053162 Berkeley DB 1.85/1.86
! 4088: >4 lelong >0 (Btree, version %d, little-endian)
! 4089:
! 4090: 12 long 0x00061561 Berkeley DB
! 4091: >16 long >0 (Hash, version %d, native byte-order)
! 4092: 12 belong 0x00061561 Berkeley DB
! 4093: >16 belong >0 (Hash, version %d, big-endian)
! 4094: 12 lelong 0x00061561 Berkeley DB
! 4095: >16 lelong >0 (Hash, version %d, little-endian)
! 4096:
! 4097: 12 long 0x00053162 Berkeley DB
! 4098: >16 long >0 (Btree, version %d, native byte-order)
! 4099: 12 belong 0x00053162 Berkeley DB
! 4100: >16 belong >0 (Btree, version %d, big-endian)
! 4101: 12 lelong 0x00053162 Berkeley DB
! 4102: >16 lelong >0 (Btree, version %d, little-endian)
! 4103:
! 4104: 12 long 0x00042253 Berkeley DB
! 4105: >16 long >0 (Queue, version %d, native byte-order)
! 4106: 12 belong 0x00042253 Berkeley DB
! 4107: >16 belong >0 (Queue, version %d, big-endian)
! 4108: 12 lelong 0x00042253 Berkeley DB
! 4109: >16 lelong >0 (Queue, version %d, little-endian)
! 4110:
! 4111: # From Max Bowsher.
! 4112: 12 long 0x00040988 Berkeley DB
! 4113: >16 long >0 (Log, version %d, native byte-order)
! 4114: 12 belong 0x00040988 Berkeley DB
! 4115: >16 belong >0 (Log, version %d, big-endian)
! 4116: 12 lelong 0x00040988 Berkeley DB
! 4117: >16 lelong >0 (Log, version %d, little-endian)
! 4118:
! 4119: #
! 4120: #
! 4121: # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
! 4122: 0 string RRD RRDTool DB
! 4123: >4 string x version %s
! 4124: #----------------------------------------------------------------------
! 4125: # ROOT: file(1) magic for ROOT databases
! 4126: #
! 4127: 0 string root\0 ROOT file
! 4128: >4 belong x Version %d
! 4129: >33 belong x (Compression: %d)
! 4130:
! 4131: # XXX: Weak magic.
! 4132: # Alex Ott <ott@jet.msk.su>
! 4133: ## Paradox file formats
! 4134: #2 leshort 0x0800 Paradox
! 4135: #>0x39 byte 3 v. 3.0
! 4136: #>0x39 byte 4 v. 3.5
! 4137: #>0x39 byte 9 v. 4.x
! 4138: #>0x39 byte 10 v. 5.x
! 4139: #>0x39 byte 11 v. 5.x
! 4140: #>0x39 byte 12 v. 7.x
! 4141: #>>0x04 byte 0 indexed .DB data file
! 4142: #>>0x04 byte 1 primary index .PX file
! 4143: #>>0x04 byte 2 non-indexed .DB data file
! 4144: #>>0x04 byte 3 non-incrementing secondary index .Xnn file
! 4145: #>>0x04 byte 4 secondary index .Ynn file
! 4146: #>>0x04 byte 5 incrementing secondary index .Xnn file
! 4147: #>>0x04 byte 6 non-incrementing secondary index .XGn file
! 4148: #>>0x04 byte 7 secondary index .YGn file
! 4149: #>>>0x04 byte 8 incrementing secondary index .XGn file
! 4150:
! 4151: ## XBase database files
! 4152: #0 byte 0x02
! 4153: #>8 leshort >0
! 4154: #>>12 leshort 0 FoxBase
! 4155: #!:mime application/x-dbf
! 4156: #>>>0x04 lelong 0 (no records)
! 4157: #>>>0x04 lelong >0 (%ld records)
! 4158: #
! 4159: #0 byte 0x03
! 4160: #!:mime application/x-dbf
! 4161: #>8 leshort >0
! 4162: #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
! 4163: #>>>0x04 lelong 0 (no records)
! 4164: #>>>0x04 lelong >0 (%ld records)
! 4165: #
! 4166: #0 byte 0x04
! 4167: #!:mime application/x-dbf
! 4168: #>8 leshort >0
! 4169: #>>12 leshort 0 dBASE IV no memo file
! 4170: #>>>0x04 lelong 0 (no records)
! 4171: #>>>0x04 lelong >0 (%ld records)
! 4172: #
! 4173: #0 byte 0x05
! 4174: #!:mime application/x-dbf
! 4175: #>8 leshort >0
! 4176: #>>12 leshort 0 dBASE V no memo file
! 4177: #>>>0x04 lelong 0 (no records)
! 4178: #>>>0x04 lelong >0 (%ld records)
! 4179: #
! 4180: #0 byte 0x30
! 4181: #!:mime application/x-dbf
! 4182: #>8 leshort >0
! 4183: #>>12 leshort 0 Visual FoxPro
! 4184: #>>>0x04 lelong 0 (no records)
! 4185: #>>>0x04 lelong >0 (%ld records)
! 4186: #
! 4187: #0 byte 0x43
! 4188: #!:mime application/x-dbf
! 4189: #>8 leshort >0
! 4190: #>>12 leshort 0 FlagShip with memo var size
! 4191: #>>>0x04 lelong 0 (no records)
! 4192: #>>>0x04 lelong >0 (%ld records)
! 4193: #
! 4194: #0 byte 0x7b
! 4195: #!:mime application/x-dbf
! 4196: #>8 leshort >0
! 4197: #>>12 leshort 0 dBASEIV with memo
! 4198: #>>>0x04 lelong 0 (no records)
! 4199: #>>>0x04 lelong >0 (%ld records)
! 4200: #
! 4201: #0 byte 0x83
! 4202: #!:mime application/x-dbf
! 4203: #>8 leshort >0
! 4204: #>>12 leshort 0 FoxBase+, dBaseIII+ with memo
! 4205: #>>>0x04 lelong 0 (no records)
! 4206: #>>>0x04 lelong >0 (%ld records)
! 4207: #
! 4208: #0 byte 0x8b
! 4209: #!:mime application/x-dbf
! 4210: #>8 leshort >0
! 4211: #>>12 leshort 0 dBaseIV with memo
! 4212: #>>>0x04 lelong 0 (no records)
! 4213: #>>>0x04 lelong >0 (%ld records)
! 4214: #
! 4215: #0 byte 0x8e
! 4216: #!:mime application/x-dbf
! 4217: #>8 leshort >0
! 4218: #>>12 leshort 0 dBaseIV with SQL Table
! 4219: #>>>0x04 lelong 0 (no records)
! 4220: #>>>0x04 lelong >0 (%ld records)
! 4221: #
! 4222: #0 byte 0xb3
! 4223: #!:mime application/x-dbf
! 4224: #>8 leshort >0
! 4225: #>>12 leshort 0 FlagShip with .dbt memo
! 4226: #>>>0x04 lelong 0 (no records)
! 4227: #>>>0x04 lelong >0 (%ld records)
! 4228: #
! 4229: #0 byte 0xf5
! 4230: #!:mime application/x-dbf
! 4231: #>8 leshort >0
! 4232: #>>12 leshort 0 FoxPro with memo
! 4233: #>>>0x04 lelong 0 (no records)
! 4234: #>>>0x04 lelong >0 (%ld records)
! 4235: #
! 4236: #0 leshort 0x0006 DBase 3 index file
! 4237:
! 4238: # MS Access database
! 4239: 4 string Standard\ Jet\ DB Microsoft Access Database
! 4240: !:mime application/x-msaccess
! 4241:
! 4242: # TDB database from Samba et al - Martin Pool <mbp@samba.org>
! 4243: 0 string TDB\ file TDB database
! 4244: >32 lelong 0x2601196D version 6, little-endian
! 4245: >>36 lelong x hash size %d bytes
! 4246:
! 4247: # SE Linux policy database
! 4248: 0 lelong 0xf97cff8c SE Linux policy
! 4249: >16 lelong x v%d
! 4250: >20 lelong 1 MLS
! 4251: >24 lelong x %d symbols
! 4252: >28 lelong x %d ocons
! 4253:
! 4254: # ICE authority file data (Wolfram Kleff)
! 4255: 2 string ICE ICE authority data
! 4256:
! 4257: # X11 Xauthority file (Wolfram Kleff)
! 4258: 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4259: 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4260: 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4261: 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4262: 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4263: 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4264: 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4265: 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4266: 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
! 4267:
! 4268: # From: Maxime Henrion <mux@FreeBSD.org>
! 4269: # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
! 4270: 0 string PGDMP PostgreSQL custom database dump
! 4271: >5 byte x - v%d
! 4272: >6 byte x \b.%d
! 4273: >5 beshort <0x101 \b-0
! 4274: >5 beshort >0x100
! 4275: >>7 byte x \b-%d
! 4276:
! 4277: # Type: Advanced Data Format (ADF) database
! 4278: # URL: http://www.grc.nasa.gov/WWW/cgns/adf/
! 4279: # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
! 4280: 0 string @(#)ADF\ Database CGNS Advanced Data Format
! 4281:
! 4282: # Type: QDBM Quick Database Manager
! 4283: # From: Benoit Sibaud <bsibaud@april.org>
! 4284: 0 string \\[depot\\]\n\f Quick Database Manager, little endian
! 4285: 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
! 4286:
! 4287: # Type: TokyoCabinet database
! 4288: # URL: http://tokyocabinet.sourceforge.net/
! 4289: # From: Benoit Sibaud <bsibaud@april.org>
! 4290: 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
! 4291: >14 string x (version %s)
! 4292:
! 4293: #------------------------------------------------------------------------------
! 4294: # diamond: file(1) magic for Diamond system
! 4295: #
! 4296: # ... diamond is a multi-media mail and electronic conferencing system....
! 4297: #
! 4298: # XXX - I think it was either renamed Slate, or replaced by Slate....
! 4299: #
! 4300: # The full deal is too long...
! 4301: #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
! 4302: 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
! 4303: #------------------------------------------------------------------------------
! 4304: # diff: file(1) magic for diff(1) output
! 4305: #
! 4306: 0 search/1 diff\ diff output text
! 4307: !:mime text/x-diff
! 4308: 0 search/1 ***\ diff output text
! 4309: !:mime text/x-diff
! 4310: 0 search/1 Only\ in\ diff output text
! 4311: !:mime text/x-diff
! 4312: 0 search/1 Common\ subdirectories:\ diff output text
! 4313: !:mime text/x-diff
! 4314:
! 4315: 0 search/1 Index: RCS/CVS diff output text
! 4316: !:mime text/x-diff
! 4317: # Digital UNIX - Info
! 4318: #
! 4319: 0 string =!<arch>\n________64E Alpha archive
! 4320: >22 string X -- out of date
! 4321: #
! 4322: # Alpha COFF Based Executables
! 4323: # The stripped stuff really needs to be an 8 byte (64 bit) compare,
! 4324: # but this works
! 4325: 0 leshort 0x183 COFF format alpha
! 4326: >22 leshort&020000 &010000 sharable library,
! 4327: >22 leshort&020000 ^010000 dynamically linked,
! 4328: >24 leshort 0410 pure
! 4329: >24 leshort 0413 demand paged
! 4330: >8 lelong >0 executable or object module, not stripped
! 4331: >8 lelong 0
! 4332: >>12 lelong 0 executable or object module, stripped
! 4333: >>12 lelong >0 executable or object module, not stripped
! 4334: >27 byte >0 - version %d.
! 4335: >26 byte >0 %d-
! 4336: >28 leshort >0 %d
! 4337: #
! 4338: # The next is incomplete, we could tell more about this format,
! 4339: # but its not worth it.
! 4340: 0 leshort 0x188 Alpha compressed COFF
! 4341: 0 leshort 0x18f Alpha u-code object
! 4342: #
! 4343: #
! 4344: # Some other interesting Digital formats,
! 4345: 0 string \377\377\177 ddis/ddif
! 4346: 0 string \377\377\174 ddis/dots archive
! 4347: 0 string \377\377\176 ddis/dtif table data
! 4348: 0 string \033c\033 LN03 output
! 4349: 0 long 04553207 X image
! 4350: #
! 4351: 0 string =!<PDF>!\n profiling data file
! 4352: #
! 4353: # Locale data tables (MIPS and Alpha).
! 4354: #
! 4355: 0 short 0x0501 locale data table
! 4356: >6 short 0x24 for MIPS
! 4357: >6 short 0x40 for Alpha
! 4358: # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
! 4359: # from http://www.atsc.org/standards/a_52a.pdf
! 4360: # corrections, additions, etc. are always welcome!
! 4361: #
! 4362: # syncword
! 4363: 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
! 4364: # fscod
! 4365: >4 byte&0xc0 0x00 48 kHz,
! 4366: >4 byte&0xc0 0x40 44.1 kHz,
! 4367: >4 byte&0xc0 0x80 32 kHz,
! 4368: # is this one used for 96 kHz?
! 4369: >4 byte&0xc0 0xc0 reserved frequency,
! 4370: #
! 4371: >5 byte&7 = 0 \b, complete main (CM)
! 4372: >5 byte&7 = 1 \b, music and effects (ME)
! 4373: >5 byte&7 = 2 \b, visually impaired (VI)
! 4374: >5 byte&7 = 3 \b, hearing impaired (HI)
! 4375: >5 byte&7 = 4 \b, dialogue (D)
! 4376: >5 byte&7 = 5 \b, commentary (C)
! 4377: >5 byte&7 = 6 \b, emergency (E)
! 4378: # acmod
! 4379: >6 byte&0xe0 0x00 1+1 front,
! 4380: >6 byte&0xe0 0x20 1 front/0 rear,
! 4381: >6 byte&0xe0 0x40 2 front/0 rear,
! 4382: >6 byte&0xe0 0x60 3 front/0 rear,
! 4383: >6 byte&0xe0 0x80 2 front/1 rear,
! 4384: >6 byte&0xe0 0xa0 3 front/1 rear,
! 4385: >6 byte&0xe0 0xc0 2 front/2 rear,
! 4386: >6 byte&0xe0 0xe0 3 front/2 rear,
! 4387: # lfeon (these may be incorrect)
! 4388: >7 byte&0x40 0x00 LFE off,
! 4389: >7 byte&0x40 0x40 LFE on,
! 4390: #
! 4391: >4 byte&0x3e = 0x00 \b, 32 kbit/s
! 4392: >4 byte&0x3e = 0x02 \b, 40 kbit/s
! 4393: >4 byte&0x3e = 0x04 \b, 48 kbit/s
! 4394: >4 byte&0x3e = 0x06 \b, 56 kbit/s
! 4395: >4 byte&0x3e = 0x08 \b, 64 kbit/s
! 4396: >4 byte&0x3e = 0x0a \b, 80 kbit/s
! 4397: >4 byte&0x3e = 0x0c \b, 96 kbit/s
! 4398: >4 byte&0x3e = 0x0e \b, 112 kbit/s
! 4399: >4 byte&0x3e = 0x10 \b, 128 kbit/s
! 4400: >4 byte&0x3e = 0x12 \b, 160 kbit/s
! 4401: >4 byte&0x3e = 0x14 \b, 192 kbit/s
! 4402: >4 byte&0x3e = 0x16 \b, 224 kbit/s
! 4403: >4 byte&0x3e = 0x18 \b, 256 kbit/s
! 4404: >4 byte&0x3e = 0x1a \b, 320 kbit/s
! 4405: >4 byte&0x3e = 0x1c \b, 384 kbit/s
! 4406: >4 byte&0x3e = 0x1e \b, 448 kbit/s
! 4407: >4 byte&0x3e = 0x20 \b, 512 kbit/s
! 4408: >4 byte&0x3e = 0x22 \b, 576 kbit/s
! 4409: >4 byte&0x3e = 0x24 \b, 640 kbit/s
! 4410: # dsurmod (these may be incorrect)
! 4411: >6 beshort&0x0180 0x0000 Dolby Surround not indicated
! 4412: >6 beshort&0x0180 0x0080 not Dolby Surround encoded
! 4413: >6 beshort&0x0180 0x0100 Dolby Surround encoded
! 4414: >6 beshort&0x0180 0x0180 reserved Dolby Surround mode
! 4415:
! 4416: #------------------------------------------------------------------------------
! 4417: # dump: file(1) magic for dump file format--for new and old dump filesystems
! 4418: #
! 4419: # We specify both byte orders in order to recognize byte-swapped dumps.
! 4420: #
! 4421: 24 belong 60012 new-fs dump file (big endian),
! 4422: >4 bedate x Previous dump %s,
! 4423: >8 bedate x This dump %s,
! 4424: >12 belong >0 Volume %ld,
! 4425: >692 belong 0 Level zero, type:
! 4426: >692 belong >0 Level %d, type:
! 4427: >0 belong 1 tape header,
! 4428: >0 belong 2 beginning of file record,
! 4429: >0 belong 3 map of inodes on tape,
! 4430: >0 belong 4 continuation of file record,
! 4431: >0 belong 5 end of volume,
! 4432: >0 belong 6 map of inodes deleted,
! 4433: >0 belong 7 end of medium (for floppy),
! 4434: >676 string >\0 Label %s,
! 4435: >696 string >\0 Filesystem %s,
! 4436: >760 string >\0 Device %s,
! 4437: >824 string >\0 Host %s,
! 4438: >888 belong >0 Flags %x
! 4439:
! 4440: 24 belong 60011 old-fs dump file (big endian),
! 4441: #>4 bedate x Previous dump %s,
! 4442: #>8 bedate x This dump %s,
! 4443: >12 belong >0 Volume %ld,
! 4444: >692 belong 0 Level zero, type:
! 4445: >692 belong >0 Level %d, type:
! 4446: >0 belong 1 tape header,
! 4447: >0 belong 2 beginning of file record,
! 4448: >0 belong 3 map of inodes on tape,
! 4449: >0 belong 4 continuation of file record,
! 4450: >0 belong 5 end of volume,
! 4451: >0 belong 6 map of inodes deleted,
! 4452: >0 belong 7 end of medium (for floppy),
! 4453: >676 string >\0 Label %s,
! 4454: >696 string >\0 Filesystem %s,
! 4455: >760 string >\0 Device %s,
! 4456: >824 string >\0 Host %s,
! 4457: >888 belong >0 Flags %x
! 4458:
! 4459: 24 lelong 60012 new-fs dump file (little endian),
! 4460: >4 ledate x This dump %s,
! 4461: >8 ledate x Previous dump %s,
! 4462: >12 lelong >0 Volume %ld,
! 4463: >692 lelong 0 Level zero, type:
! 4464: >692 lelong >0 Level %d, type:
! 4465: >0 lelong 1 tape header,
! 4466: >0 lelong 2 beginning of file record,
! 4467: >0 lelong 3 map of inodes on tape,
! 4468: >0 lelong 4 continuation of file record,
! 4469: >0 lelong 5 end of volume,
! 4470: >0 lelong 6 map of inodes deleted,
! 4471: >0 lelong 7 end of medium (for floppy),
! 4472: >676 string >\0 Label %s,
! 4473: >696 string >\0 Filesystem %s,
! 4474: >760 string >\0 Device %s,
! 4475: >824 string >\0 Host %s,
! 4476: >888 lelong >0 Flags %x
! 4477:
! 4478: 24 lelong 60011 old-fs dump file (little endian),
! 4479: #>4 ledate x Previous dump %s,
! 4480: #>8 ledate x This dump %s,
! 4481: >12 lelong >0 Volume %ld,
! 4482: >692 lelong 0 Level zero, type:
! 4483: >692 lelong >0 Level %d, type:
! 4484: >0 lelong 1 tape header,
! 4485: >0 lelong 2 beginning of file record,
! 4486: >0 lelong 3 map of inodes on tape,
! 4487: >0 lelong 4 continuation of file record,
! 4488: >0 lelong 5 end of volume,
! 4489: >0 lelong 6 map of inodes deleted,
! 4490: >0 lelong 7 end of medium (for floppy),
! 4491: >676 string >\0 Label %s,
! 4492: >696 string >\0 Filesystem %s,
! 4493: >760 string >\0 Device %s,
! 4494: >824 string >\0 Host %s,
! 4495: >888 lelong >0 Flags %x
! 4496:
! 4497: 18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
! 4498: >2 medate x Previous dump %s,
! 4499: >6 medate x This dump %s,
! 4500: >10 leshort >0 Volume %ld,
! 4501: >0 leshort 1 tape header.
! 4502: >0 leshort 2 beginning of file record.
! 4503: >0 leshort 3 map of inodes on tape.
! 4504: >0 leshort 4 continuation of file record.
! 4505: >0 leshort 5 end of volume.
! 4506: >0 leshort 6 map of inodes deleted.
! 4507: >0 leshort 7 end of medium (for floppy).
! 4508:
! 4509: 24 belong 0x19540119 new-fs dump file (ufs2, big endian),
! 4510: >896 beqdate x Previous dump %s,
! 4511: >904 beqdate x This dump %s,
! 4512: >12 belong >0 Volume %ld,
! 4513: >692 belong 0 Level zero, type:
! 4514: >692 belong >0 Level %d, type:
! 4515: >0 belong 1 tape header,
! 4516: >0 belong 2 beginning of file record,
! 4517: >0 belong 3 map of inodes on tape,
! 4518: >0 belong 4 continuation of file record,
! 4519: >0 belong 5 end of volume,
! 4520: >0 belong 6 map of inodes deleted,
! 4521: >0 belong 7 end of medium (for floppy),
! 4522: >676 string >\0 Label %s,
! 4523: >696 string >\0 Filesystem %s,
! 4524: >760 string >\0 Device %s,
! 4525: >824 string >\0 Host %s,
! 4526: >888 belong >0 Flags %x
! 4527:
! 4528: 24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
! 4529: >896 leqdate x This dump %s,
! 4530: >904 leqdate x Previous dump %s,
! 4531: >12 lelong >0 Volume %ld,
! 4532: >692 lelong 0 Level zero, type:
! 4533: >692 lelong >0 Level %d, type:
! 4534: >0 lelong 1 tape header,
! 4535: >0 lelong 2 beginning of file record,
! 4536: >0 lelong 3 map of inodes on tape,
! 4537: >0 lelong 4 continuation of file record,
! 4538: >0 lelong 5 end of volume,
! 4539: >0 lelong 6 map of inodes deleted,
! 4540: >0 lelong 7 end of medium (for floppy),
! 4541: >676 string >\0 Label %s,
! 4542: >696 string >\0 Filesystem %s,
! 4543: >760 string >\0 Device %s,
! 4544: >824 string >\0 Host %s,
! 4545: >888 lelong >0 Flags %x
! 4546:
! 4547: #------------------------------------------------------------------------------
! 4548: # Dyadic: file(1) magic for Dyalog APL.
! 4549: #
! 4550: 0 byte 0xaa
! 4551: >1 byte <4 Dyalog APL
! 4552: >>1 byte 0x00 incomplete workspace
! 4553: >>1 byte 0x01 component file
! 4554: >>1 byte 0x02 external variable
! 4555: >>1 byte 0x03 workspace
! 4556: >>2 byte x version %d
! 4557: >>3 byte x .%d
! 4558:
! 4559: #------------------------------------------------------------------------------
! 4560: # T602 editor documents
! 4561: # by David Necas <yeti@physics.muni.cz>
! 4562: 0 string @CT\ T602 document data,
! 4563: >4 string 0 Kamenicky
! 4564: >4 string 1 CP 852
! 4565: >4 string 2 KOI8-CS
! 4566: >4 string >2 unknown encoding
! 4567:
! 4568: # Vi IMproved Encrypted file
! 4569: # by David Necas <yeti@physics.muni.cz>
! 4570: 0 string VimCrypt~ Vim encrypted file data
! 4571: # Vi IMproved Swap file
! 4572: # by Sven Wegener <swegener@gentoo.org>
! 4573: 0 string b0VIM\ Vim swap file
! 4574: >&0 string >\0 \b, version %s
! 4575:
! 4576: #------------------------------------------------------------------------------
! 4577: # efi: file(1) magic for Universal EFI binaries
! 4578:
! 4579: 0 lelong 0x0ef1fab9
! 4580: >4 lelong 1 Universal EFI binary with 1 architecture
! 4581: >>&0 lelong 7 \b, i386
! 4582: >>&0 lelong 0x01000007 \b, x86_64
! 4583: >4 lelong 2 Universal EFI binary with 2 architectures
! 4584: >>&0 lelong 7 \b, i386
! 4585: >>&0 lelong 0x01000007 \b, x86_64
! 4586: >>&20 lelong 7 \b, i386
! 4587: >>&20 lelong 0x01000007 \b, x86_64
! 4588: >4 lelong >2 Universal EFI binary with %ld architectures
! 4589:
! 4590: #------------------------------------------------------------------------------
! 4591: # elf: file(1) magic for ELF executables
! 4592: #
! 4593: # We have to check the byte order flag to see what byte order all the
! 4594: # other stuff in the header is in.
! 4595: #
! 4596: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
! 4597: #
! 4598: # Created by: unknown
! 4599: # Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
! 4600: # Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
! 4601: # Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
! 4602: # Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
! 4603: # Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
! 4604: 0 string \177ELF ELF
! 4605: >4 byte 0 invalid class
! 4606: >4 byte 1 32-bit
! 4607: >4 byte 2 64-bit
! 4608: >5 byte 0 invalid byte order
! 4609: >5 byte 1 LSB
! 4610: >>16 leshort 0 no file type,
! 4611: !:strength *2
! 4612: !:mime application/octet-stream
! 4613: >>16 leshort 1 relocatable,
! 4614: !:mime application/x-object
! 4615: >>16 leshort 2 executable,
! 4616: !:mime application/x-executable
! 4617: >>16 leshort 3 shared object,
! 4618: !:mime application/x-sharedlib
! 4619: >>16 leshort 4 core file
! 4620: !:mime application/x-coredump
! 4621: # Core file detection is not reliable.
! 4622: #>>>(0x38+0xcc) string >\0 of '%s'
! 4623: #>>>(0x38+0x10) lelong >0 (signal %d),
! 4624: >>16 leshort &0xff00 processor-specific,
! 4625: >>18 leshort 0 no machine,
! 4626: >>18 leshort 1 AT&T WE32100 - invalid byte order,
! 4627: >>18 leshort 2 SPARC - invalid byte order,
! 4628: >>18 leshort 3 Intel 80386,
! 4629: >>18 leshort 4 Motorola
! 4630: >>>36 lelong &0x01000000 68000 - invalid byte order,
! 4631: >>>36 lelong &0x00810000 CPU32 - invalid byte order,
! 4632: >>>36 lelong 0 68020 - invalid byte order,
! 4633: >>18 leshort 5 Motorola 88000 - invalid byte order,
! 4634: >>18 leshort 6 Intel 80486,
! 4635: >>18 leshort 7 Intel 80860,
! 4636: # The official e_machine number for MIPS is now #8, regardless of endianness.
! 4637: # The second number (#10) will be deprecated later. For now, we still
! 4638: # say something if #10 is encountered, but only gory details for #8.
! 4639: >>18 leshort 8 MIPS,
! 4640: >>>36 lelong &0x20 N32
! 4641: >>18 leshort 10 MIPS,
! 4642: >>>36 lelong &0x20 N32
! 4643: >>18 leshort 8
! 4644: # only for 32-bit
! 4645: >>>4 byte 1
! 4646: >>>>36 lelong&0xf0000000 0x00000000 MIPS-I
! 4647: >>>>36 lelong&0xf0000000 0x10000000 MIPS-II
! 4648: >>>>36 lelong&0xf0000000 0x20000000 MIPS-III
! 4649: >>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
! 4650: >>>>36 lelong&0xf0000000 0x40000000 MIPS-V
! 4651: >>>>36 lelong&0xf0000000 0x50000000 MIPS32
! 4652: >>>>36 lelong&0xf0000000 0x60000000 MIPS64
! 4653: >>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
! 4654: >>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
! 4655: # only for 64-bit
! 4656: >>>4 byte 2
! 4657: >>>>48 lelong&0xf0000000 0x00000000 MIPS-I
! 4658: >>>>48 lelong&0xf0000000 0x10000000 MIPS-II
! 4659: >>>>48 lelong&0xf0000000 0x20000000 MIPS-III
! 4660: >>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
! 4661: >>>>48 lelong&0xf0000000 0x40000000 MIPS-V
! 4662: >>>>48 lelong&0xf0000000 0x50000000 MIPS32
! 4663: >>>>48 lelong&0xf0000000 0x60000000 MIPS64
! 4664: >>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
! 4665: >>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
! 4666: >>18 leshort 9 Amdahl - invalid byte order,
! 4667: >>18 leshort 10 MIPS (deprecated),
! 4668: >>18 leshort 11 RS6000 - invalid byte order,
! 4669: >>18 leshort 15 PA-RISC - invalid byte order,
! 4670: >>>50 leshort 0x0214 2.0
! 4671: >>>48 leshort &0x0008 (LP64),
! 4672: >>18 leshort 16 nCUBE,
! 4673: >>18 leshort 17 Fujitsu VPP500,
! 4674: >>18 leshort 18 SPARC32PLUS - invalid byte order,
! 4675: >>18 leshort 20 PowerPC,
! 4676: >>18 leshort 22 IBM S/390,
! 4677: >>18 leshort 36 NEC V800,
! 4678: >>18 leshort 37 Fujitsu FR20,
! 4679: >>18 leshort 38 TRW RH-32,
! 4680: >>18 leshort 39 Motorola RCE,
! 4681: >>18 leshort 40 ARM,
! 4682: >>18 leshort 41 Alpha,
! 4683: >>18 leshort 0xa390 IBM S/390 (obsolete),
! 4684: >>18 leshort 42 Renesas SH,
! 4685: >>18 leshort 43 SPARC V9 - invalid byte order,
! 4686: >>18 leshort 44 Siemens Tricore Embedded Processor,
! 4687: >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
! 4688: >>18 leshort 46 Renesas H8/300,
! 4689: >>18 leshort 47 Renesas H8/300H,
! 4690: >>18 leshort 48 Renesas H8S,
! 4691: >>18 leshort 49 Renesas H8/500,
! 4692: >>18 leshort 50 IA-64,
! 4693: >>18 leshort 51 Stanford MIPS-X,
! 4694: >>18 leshort 52 Motorola Coldfire,
! 4695: >>18 leshort 53 Motorola M68HC12,
! 4696: >>18 leshort 54 Fujitsu MMA,
! 4697: >>18 leshort 55 Siemens PCP,
! 4698: >>18 leshort 56 Sony nCPU,
! 4699: >>18 leshort 57 Denso NDR1,
! 4700: >>18 leshort 58 Start*Core,
! 4701: >>18 leshort 59 Toyota ME16,
! 4702: >>18 leshort 60 ST100,
! 4703: >>18 leshort 61 Tinyj emb.,
! 4704: >>18 leshort 62 x86-64,
! 4705: >>18 leshort 63 Sony DSP,
! 4706: >>18 leshort 66 FX66,
! 4707: >>18 leshort 67 ST9+ 8/16 bit,
! 4708: >>18 leshort 68 ST7 8 bit,
! 4709: >>18 leshort 69 MC68HC16,
! 4710: >>18 leshort 70 MC68HC11,
! 4711: >>18 leshort 71 MC68HC08,
! 4712: >>18 leshort 72 MC68HC05,
! 4713: >>18 leshort 73 SGI SVx,
! 4714: >>18 leshort 74 ST19 8 bit,
! 4715: >>18 leshort 75 Digital VAX,
! 4716: >>18 leshort 76 Axis cris,
! 4717: >>18 leshort 77 Infineon 32-bit embedded,
! 4718: >>18 leshort 78 Element 14 64-bit DSP,
! 4719: >>18 leshort 79 LSI Logic 16-bit DSP,
! 4720: >>18 leshort 80 MMIX,
! 4721: >>18 leshort 81 Harvard machine-independent,
! 4722: >>18 leshort 82 SiTera Prism,
! 4723: >>18 leshort 83 Atmel AVR 8-bit,
! 4724: >>18 leshort 84 Fujitsu FR30,
! 4725: >>18 leshort 85 Mitsubishi D10V,
! 4726: >>18 leshort 86 Mitsubishi D30V,
! 4727: >>18 leshort 87 NEC v850,
! 4728: >>18 leshort 88 Renesas M32R,
! 4729: >>18 leshort 89 Matsushita MN10300,
! 4730: >>18 leshort 90 Matsushita MN10200,
! 4731: >>18 leshort 91 picoJava,
! 4732: >>18 leshort 92 OpenRISC,
! 4733: >>18 leshort 93 ARC Cores Tangent-A5,
! 4734: >>18 leshort 0x3426 OpenRISC (obsolete),
! 4735: >>18 leshort 0x8472 OpenRISC (obsolete),
! 4736: >>18 leshort 94 Tensilica Xtensa,
! 4737: >>18 leshort 97 NatSemi 32k,
! 4738: >>18 leshort 106 Analog Devices Blackfin,
! 4739: >>18 leshort 0x9026 Alpha (unofficial),
! 4740: >>20 lelong 0 invalid version
! 4741: >>20 lelong 1 version 1
! 4742: >>36 lelong 1 MathCoPro/FPU/MAU Required
! 4743: >5 byte 2 MSB
! 4744: >>16 beshort 0 no file type,
! 4745: !:mime application/octet-stream
! 4746: >>16 beshort 1 relocatable,
! 4747: !:mime application/x-object
! 4748: >>16 beshort 2 executable,
! 4749: !:mime application/x-executable
! 4750: >>16 beshort 3 shared object,
! 4751: !:mime application/x-sharedlib
! 4752: >>16 beshort 4 core file,
! 4753: !:mime application/x-coredump
! 4754: #>>>(0x38+0xcc) string >\0 of '%s'
! 4755: #>>>(0x38+0x10) belong >0 (signal %d),
! 4756: >>16 beshort &0xff00 processor-specific,
! 4757: >>18 beshort 0 no machine,
! 4758: >>18 beshort 1 AT&T WE32100,
! 4759: >>18 beshort 2 SPARC,
! 4760: >>18 beshort 3 Intel 80386 - invalid byte order,
! 4761: >>18 beshort 4 Motorola
! 4762: >>>36 belong &0x01000000 68000,
! 4763: >>>36 belong &0x00810000 CPU32,
! 4764: >>>36 belong 0 68020,
! 4765: >>18 beshort 5 Motorola 88000,
! 4766: >>18 beshort 6 Intel 80486 - invalid byte order,
! 4767: >>18 beshort 7 Intel 80860,
! 4768: # only for MIPS - see comment in little-endian section above.
! 4769: >>18 beshort 8 MIPS,
! 4770: >>>36 belong &0x20 N32
! 4771: >>18 beshort 10 MIPS,
! 4772: >>>36 belong &0x20 N32
! 4773: >>18 beshort 8
! 4774: # only for 32-bit
! 4775: >>>4 byte 1
! 4776: >>>>36 belong&0xf0000000 0x00000000 MIPS-I
! 4777: >>>>36 belong&0xf0000000 0x10000000 MIPS-II
! 4778: >>>>36 belong&0xf0000000 0x20000000 MIPS-III
! 4779: >>>>36 belong&0xf0000000 0x30000000 MIPS-IV
! 4780: >>>>36 belong&0xf0000000 0x40000000 MIPS-V
! 4781: >>>>36 belong&0xf0000000 0x50000000 MIPS32
! 4782: >>>>36 belong&0xf0000000 0x60000000 MIPS64
! 4783: >>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2
! 4784: >>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2
! 4785: # only for 64-bit
! 4786: >>>4 byte 2
! 4787: >>>>48 belong&0xf0000000 0x00000000 MIPS-I
! 4788: >>>>48 belong&0xf0000000 0x10000000 MIPS-II
! 4789: >>>>48 belong&0xf0000000 0x20000000 MIPS-III
! 4790: >>>>48 belong&0xf0000000 0x30000000 MIPS-IV
! 4791: >>>>48 belong&0xf0000000 0x40000000 MIPS-V
! 4792: >>>>48 belong&0xf0000000 0x50000000 MIPS32
! 4793: >>>>48 belong&0xf0000000 0x60000000 MIPS64
! 4794: >>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2
! 4795: >>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2
! 4796: >>18 beshort 9 Amdahl,
! 4797: >>18 beshort 10 MIPS (deprecated),
! 4798: >>18 beshort 11 RS6000,
! 4799: >>18 beshort 15 PA-RISC
! 4800: >>>50 beshort 0x0214 2.0
! 4801: >>>48 beshort &0x0008 (LP64)
! 4802: >>18 beshort 16 nCUBE,
! 4803: >>18 beshort 17 Fujitsu VPP500,
! 4804: >>18 beshort 18 SPARC32PLUS,
! 4805: >>>36 belong&0xffff00 0x000100 V8+ Required,
! 4806: >>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
! 4807: >>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required,
! 4808: >>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
! 4809: >>18 beshort 20 PowerPC or cisco 4500,
! 4810: >>18 beshort 21 64-bit PowerPC or cisco 7500,
! 4811: >>18 beshort 22 IBM S/390,
! 4812: >>18 beshort 23 Cell SPU,
! 4813: >>18 beshort 24 cisco SVIP,
! 4814: >>18 beshort 25 cisco 7200,
! 4815: >>18 beshort 36 NEC V800 or cisco 12000,
! 4816: >>18 beshort 37 Fujitsu FR20,
! 4817: >>18 beshort 38 TRW RH-32,
! 4818: >>18 beshort 39 Motorola RCE,
! 4819: >>18 beshort 40 ARM,
! 4820: >>18 beshort 41 Alpha,
! 4821: >>18 beshort 42 Renesas SH,
! 4822: >>18 beshort 43 SPARC V9,
! 4823: >>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
! 4824: >>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required,
! 4825: >>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
! 4826: >>>48 belong&0x3 0 total store ordering,
! 4827: >>>48 belong&0x3 1 partial store ordering,
! 4828: >>>48 belong&0x3 2 relaxed memory ordering,
! 4829: >>18 beshort 44 Siemens Tricore Embedded Processor,
! 4830: >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
! 4831: >>18 beshort 46 Renesas H8/300,
! 4832: >>18 beshort 47 Renesas H8/300H,
! 4833: >>18 beshort 48 Renesas H8S,
! 4834: >>18 beshort 49 Renesas H8/500,
! 4835: >>18 beshort 50 IA-64,
! 4836: >>18 beshort 51 Stanford MIPS-X,
! 4837: >>18 beshort 52 Motorola Coldfire,
! 4838: >>18 beshort 53 Motorola M68HC12,
! 4839: >>18 beshort 73 Cray NV1,
! 4840: >>18 beshort 75 Digital VAX,
! 4841: >>18 beshort 88 Renesas M32R,
! 4842: >>18 leshort 92 OpenRISC,
! 4843: >>18 leshort 0x3426 OpenRISC (obsolete),
! 4844: >>18 leshort 0x8472 OpenRISC (obsolete),
! 4845: >>18 beshort 94 Tensilica Xtensa,
! 4846: >>18 beshort 97 NatSemi 32k,
! 4847: >>18 beshort 0x18ad AVR32 (unofficial),
! 4848: >>18 beshort 0x9026 Alpha (unofficial),
! 4849: >>18 beshort 0xa390 IBM S/390 (obsolete),
! 4850: >>20 belong 0 invalid version
! 4851: >>20 belong 1 version 1
! 4852: >>36 belong 1 MathCoPro/FPU/MAU Required
! 4853: # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
! 4854: # like proper ELF, but extracting the string had bad results.
! 4855: >4 byte <0x80
! 4856: >>8 string >\0 (%s)
! 4857: >8 string \0
! 4858: >>7 byte 0 (SYSV)
! 4859: >>7 byte 1 (HP-UX)
! 4860: >>7 byte 2 (NetBSD)
! 4861: >>7 byte 3 (GNU/Linux)
! 4862: >>7 byte 4 (GNU/Hurd)
! 4863: >>7 byte 5 (86Open)
! 4864: >>7 byte 6 (Solaris)
! 4865: >>7 byte 7 (Monterey)
! 4866: >>7 byte 8 (IRIX)
! 4867: >>7 byte 9 (FreeBSD)
! 4868: >>7 byte 10 (Tru64)
! 4869: >>7 byte 11 (Novell Modesto)
! 4870: >>7 byte 12 (OpenBSD)
! 4871: >8 string \2
! 4872: >>7 byte 13 (OpenVMS)
! 4873: >>7 byte 97 (ARM)
! 4874: >>7 byte 255 (embedded)
! 4875:
! 4876: #------------------------------------------------------------------------------
! 4877: # encore: file(1) magic for Encore machines
! 4878: #
! 4879: # XXX - needs to have the byte order specified (NS32K was little-endian,
! 4880: # dunno whether they run the 88K in little-endian mode or not).
! 4881: #
! 4882: 0 short 0x154 Encore
! 4883: >20 short 0x107 executable
! 4884: >20 short 0x108 pure executable
! 4885: >20 short 0x10b demand-paged executable
! 4886: >20 short 0x10f unsupported executable
! 4887: >12 long >0 not stripped
! 4888: >22 short >0 - version %ld
! 4889: >22 short 0 -
! 4890: #>4 date x stamp %s
! 4891: 0 short 0x155 Encore unsupported executable
! 4892: >12 long >0 not stripped
! 4893: >22 short >0 - version %ld
! 4894: >22 short 0 -
! 4895: #>4 date x stamp %s
! 4896:
! 4897: #------------------------------------------------------------------------------
! 4898: # Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
! 4899: # Stefan Praszalowicz (hpicollo@worldnet.fr)
! 4900: #0 lelong 0x10000037 Epoc32
! 4901: >4 lelong 0x1000006D
! 4902: >>8 lelong 0x1000007F Word
! 4903: >>8 lelong 0x10000088 Sheet
! 4904: >>8 lelong 0x1000007D Sketch
! 4905: >>8 lelong 0x10000085 TextEd
! 4906:
! 4907: #------------------------------------------------------------------------------
! 4908: # erlang: file(1) magic for Erlang JAM and BEAM files
! 4909: # URL: http://www.erlang.org/faq/x779.html#AEN812
! 4910:
! 4911: # OTP R3-R4
! 4912: 0 string \0177BEAM! Old Erlang BEAM file
! 4913: >6 short >0 - version %d
! 4914:
! 4915: # OTP R5 and onwards
! 4916: 0 string FOR1
! 4917: >8 string BEAM Erlang BEAM file
! 4918:
! 4919: # 4.2 version may have a copyright notice!
! 4920: 4 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2
! 4921: 79 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2
! 4922:
! 4923: 4 string 1.0 Fri Feb 3 09:55:56 MET 1995 Erlang JAM file - version 4.3
! 4924:
! 4925: #------------------------------------------------------------------------------
! 4926: # ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
! 4927: # Based on info from
! 4928: # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
! 4929: 0 belong 9994 ESRI Shapefile
! 4930: >4 belong =0
! 4931: >8 belong =0
! 4932: >12 belong =0
! 4933: >16 belong =0
! 4934: >20 belong =0
! 4935: >28 lelong x version %d
! 4936: >24 belong x length %d
! 4937: >32 lelong =0 type Null Shape
! 4938: >32 lelong =1 type Point
! 4939: >32 lelong =3 type PolyLine
! 4940: >32 lelong =5 type Polygon
! 4941: >32 lelong =8 type MultiPoint
! 4942: >32 lelong =11 type PointZ
! 4943: >32 lelong =13 type PolyLineZ
! 4944: >32 lelong =15 type PolygonZ
! 4945: >32 lelong =18 type MultiPointZ
! 4946: >32 lelong =21 type PointM
! 4947: >32 lelong =23 type PolyLineM
! 4948: >32 lelong =25 type PolygonM
! 4949: >32 lelong =28 type MultiPointM
! 4950: >32 lelong =31 type MultiPatch
! 4951:
! 4952: #------------------------------------------------------------------------------
! 4953: # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
! 4954: # From Roger Leigh <roger@whinlatter.uklinux.net>
! 4955: 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
! 4956: 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
! 4957: 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
! 4958:
! 4959:
! 4960: #------------------------------------------------------------------------------
! 4961: # filesystems: file(1) magic for different filesystems
! 4962: #
! 4963: 0 string \366\366\366\366 PC formatted floppy with no filesystem
! 4964: # Sun disk labels
! 4965: # From /usr/include/sun/dklabel.h:
! 4966: 0774 beshort 0xdabe
! 4967: # modified by Joerg Jenderek, because original test
! 4968: # succeeds for Cabinet archive dao360.dl_ with negative blocks
! 4969: >0770 long >0 Sun disk label
! 4970: >>0 string x '%s
! 4971: >>>31 string >\0 \b%s
! 4972: >>>>63 string >\0 \b%s
! 4973: >>>>>95 string >\0 \b%s
! 4974: >>0 string x \b'
! 4975: >>0734 short >0 %d rpm,
! 4976: >>0736 short >0 %d phys cys,
! 4977: >>0740 short >0 %d alts/cyl,
! 4978: >>0746 short >0 %d interleave,
! 4979: >>0750 short >0 %d data cyls,
! 4980: >>0752 short >0 %d alt cyls,
! 4981: >>0754 short >0 %d heads/partition,
! 4982: >>0756 short >0 %d sectors/track,
! 4983: >>0764 long >0 start cyl %ld,
! 4984: >>0770 long x %ld blocks
! 4985: # Is there a boot block written 1 sector in?
! 4986: >512 belong&077777777 0600407 \b, boot block present
! 4987: # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
! 4988: # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
! 4989: 0 string SBMBAKUP_ Smart Boot Manager backup file
! 4990: >9 string x \b, version %-5.5s
! 4991: >>14 string =_
! 4992: >>>15 string x %-.1s
! 4993: >>>>16 string =_ \b.
! 4994: >>>>>17 string x \b%-.1s
! 4995: >>>>>>18 string =_ \b.
! 4996: >>>>>>>19 string x \b%-.1s
! 4997: >>>22 ubyte 0
! 4998: >>>>21 ubyte x \b, from drive 0x%x
! 4999: >>>22 ubyte >0
! 5000: >>>>21 string x \b, from drive %s
! 5001:
! 5002: # Joerg Jenderek
! 5003: # DOS Emulator image is 128 byte, null right padded header + harddisc image
! 5004: 0 string DOSEMU\0
! 5005: >0x27E leshort 0xAA55
! 5006: #offset is 128
! 5007: >>19 ubyte 128
! 5008: >>>(19.b-1) ubyte 0x0 DOS Emulator image
! 5009: >>>>7 ulelong >0 \b, %u heads
! 5010: >>>>11 ulelong >0 \b, %d sectors/track
! 5011: >>>>15 ulelong >0 \b, %d cylinders
! 5012:
! 5013: # updated by Joerg Jenderek at Sep 2007
! 5014: # only for sector sizes with 512 or more Bytes
! 5015: 0x1FE leshort 0xAA55 x86 boot sector
! 5016: # to do also for sectors < than 512 Bytes and some other files, GRR
! 5017: #30 search/481 \x55\xAA x86 boot sector
! 5018: # not for BeOS floppy 1440k, MBRs
! 5019: #(11.s-2) uleshort 0xAA55 x86 boot sector
! 5020: >2 string OSBS \b, OS/BS MBR
! 5021: # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
! 5022: >0x8C string Invalid\ partition\ table \b, MS-DOS MBR
! 5023: # dr-dos with some upper-, lowercase variants
! 5024: >0x9D string Invalid\ partition\ table$
! 5025: >>181 string No\ Operating\ System$
! 5026: >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
! 5027: >0x9D string Invalid\ partition\ table$
! 5028: >>181 string No\ operating\ system$
! 5029: >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
! 5030: >342 string Invalid\ partition\ table$
! 5031: >>366 string No\ operating\ system$
! 5032: >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
! 5033: >295 string NEWLDR\0
! 5034: >>302 string Bad\ PT\ $
! 5035: >>>310 string No\ OS\ $
! 5036: >>>>317 string OS\ load\ err$
! 5037: >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
! 5038: >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
! 5039: >>>>>>>387 string Copyright\ (c)\ 1984,1998
! 5040: >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
! 5041: >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
! 5042: >>0x1B8 ubelong >0 \b, Serial 0x%-.4x
! 5043: >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
! 5044: >271 string Invalid\ partition\ table\0
! 5045: >>295 string Error\ loading\ operating\ system\0
! 5046: >>>326 string Missing\ operating\ system\0 \b, mbr
! 5047: #
! 5048: >139 string Invalid\ partition\ table\0
! 5049: >>163 string Error\ loading\ operating\ system\0
! 5050: >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
! 5051: # http://www.heise.de/ct/05/09/006/ page 184
! 5052: #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
! 5053: >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
! 5054: >300 string Invalid\ partition\ table\0
! 5055: >>324 string Error\ loading\ operating\ system\0
! 5056: >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
! 5057: #??>>>389 string Invalid\ system\ disk
! 5058: >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
! 5059: >300 string Ung\201ltige\ Partitionstabelle
! 5060: #split string to avoid error: String too long
! 5061: >>328 string Fehler\ beim\ Laden\
! 5062: >>>346 string des\ Betriebssystems
! 5063: >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
! 5064: >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
! 5065: >0x145 string Default:\ F \b, FREE-DOS MBR
! 5066: >64 string no\ active\ partition\ found
! 5067: >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
! 5068: >271 string Operating\ system\ loading
! 5069: >>296 string error\r \b, SYSLINUX MBR (2.10)
! 5070: # http://www.acronis.de/
! 5071: >362 string MBR\ Error\ \0\r
! 5072: >>376 string ress\ any\ key\ to\
! 5073: >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
! 5074: # added by Joerg Jenderek
! 5075: # http://www.visopsys.org/
! 5076: # http://partitionlogic.org.uk/
! 5077: >309 string No\ bootable\ partition\ found\r
! 5078: >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
! 5079: >349 string No\ bootable\ partition\ found\r
! 5080: >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
! 5081: # bootloader, bootmanager
! 5082: >0x40 string SBML
! 5083: # label with 11 characters of FAT 12 bit filesystem
! 5084: >>43 string SMART\ BTMGR
! 5085: >>>430 string SBMK\ Bad!\r
! 5086: >>>>3 string SBM \b, Smart Boot Manager
! 5087: >>>>>6 string >\0 \b, version %s
! 5088: >382 string XOSLLOADXCF \b, eXtended Operating System Loader
! 5089: >6 string LILO \b, LInux i386 boot LOader
! 5090: >>120 string LILO \b, version 22.3.4 SuSe
! 5091: >>172 string LILO \b, version 22.5.8 Debian
! 5092: # updated by Joerg Jenderek
! 5093: # variables according to grub-0.97/stage1/stage1.S or
! 5094: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
! 5095: # usual values are marked with comments to get only informations of strange GRUB loaders
! 5096: >0 ulelong 0x009048EB
! 5097: >>0x41 ubyte <2
! 5098: >>>0x3E ubyte >2 \b; GRand Unified Bootloader
! 5099: # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
! 5100: >>>>0x3E ubyte x \b, stage1 version 0x%x
! 5101: #If it is 0xFF, use a drive passed by BIOS
! 5102: >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
! 5103: # in most case 0,1,0x2e for GRUB 0.5.95
! 5104: >>>>0x41 ubyte >0 \b, LBA flag 0x%x
! 5105: >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
! 5106: #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
! 5107: >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
! 5108: #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
! 5109: >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
! 5110: >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
! 5111: #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
! 5112: >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
! 5113: >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5114: >>>>>394 string stage1 \b, GRUB version 0.5.95
! 5115: >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5116: >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
! 5117: >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5118: >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
! 5119: >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5120: >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
! 5121: >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5122: >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
! 5123: #unkown version
! 5124: >>>343 string Geom\0Read\0\ Error\0
! 5125: >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
! 5126: >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
! 5127: >>>>374 string GRUB\ \0 \b, GRUB version n.m
! 5128: # http://syslinux.zytor.com/
! 5129: >478 string Boot\ failed\r
! 5130: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
! 5131: >480 string Boot\ failed\r
! 5132: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
! 5133: >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
! 5134: >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
! 5135: # http://www.bcdwb.de/bcdw/index_e.htm
! 5136: >3 string BCDL
! 5137: >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
! 5138: # mbr partion table entries
! 5139: # OEM-ID not Microsoft,SYSLINUX,or MTOOLs
! 5140: >3 string !MS
! 5141: >>3 string !SYSLINUX
! 5142: >>>3 string !MTOOL
! 5143: # not FAT (32 bit)
! 5144: >>>>82 string !FAT32
! 5145: #not IO.SYS
! 5146: >>>>>472 string !IO\ \ \ \ \ \ SYS
! 5147: >>>>>>480 string !IO\ \ \ \ \ \ SYS
! 5148: #not Linux kernel
! 5149: >>>>>>>514 string !HdrS
! 5150: #not BeOS
! 5151: >>>>>>>>422 string !Be\ Boot\ Loader
! 5152: # active flag 0 or 0x80 and type > 0
! 5153: >>>>>>>>>446 ubyte <0x81
! 5154: >>>>>>>>>>446 ubyte&0x7F 0
! 5155: >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
! 5156: >>>>>>>>>>>>446 ubyte 0x80 \b, active
! 5157: >>>>>>>>>>>>447 ubyte x \b, starthead %u
! 5158: #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
! 5159: #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
! 5160: >>>>>>>>>>>>454 ulelong x \b, startsector %u
! 5161: >>>>>>>>>>>>458 ulelong x \b, %u sectors
! 5162: #
! 5163: >>>>>>>>>462 ubyte <0x81
! 5164: >>>>>>>>>>462 ubyte&0x7F 0
! 5165: >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
! 5166: >>>>>>>>>>>>462 ubyte 0x80 \b, active
! 5167: >>>>>>>>>>>>463 ubyte x \b, starthead %u
! 5168: #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
! 5169: #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
! 5170: >>>>>>>>>>>>470 ulelong x \b, startsector %u
! 5171: >>>>>>>>>>>>474 ulelong x \b, %u sectors
! 5172: #
! 5173: >>>>>>>>>478 ubyte <0x81
! 5174: >>>>>>>>>>478 ubyte&0x7F 0
! 5175: >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
! 5176: >>>>>>>>>>>>478 ubyte 0x80 \b, active
! 5177: >>>>>>>>>>>>479 ubyte x \b, starthead %u
! 5178: #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
! 5179: #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
! 5180: #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
! 5181: >>>>>>>>>>>>486 ulelong x \b, startsector %u
! 5182: >>>>>>>>>>>>490 ulelong x \b, %u sectors
! 5183: #
! 5184: >>>>>>>>>494 ubyte <0x81
! 5185: >>>>>>>>>>494 ubyte&0x7F 0
! 5186: >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
! 5187: >>>>>>>>>>>>494 ubyte 0x80 \b, active
! 5188: >>>>>>>>>>>>495 ubyte x \b, starthead %u
! 5189: #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
! 5190: #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
! 5191: >>>>>>>>>>>>502 ulelong x \b, startsector %u
! 5192: >>>>>>>>>>>>506 ulelong x \b, %u sectors
! 5193: # mbr partion table entries end
! 5194: # http://www.acronis.de/
! 5195: #FAT label=ACRONIS\ SZ
! 5196: #OEM-ID=BOOTWIZ0
! 5197: >442 string Non-system\ disk,\
! 5198: >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
! 5199: # DOS names like F11.SYS are 8 right space padded bytes+3 bytes
! 5200: >>>477 ubyte&0xDF >0
! 5201: >>>>477 string x \b %-.3s
! 5202: >>>>>480 ubyte&0xDF >0
! 5203: >>>>>>480 string x \b%-.5s
! 5204: >>>>485 ubyte&0xDF >0
! 5205: >>>>>485 string x \b.%-.3s
! 5206: #
! 5207: >185 string FDBOOT\ Version\
! 5208: >>204 string \rNo\ Systemdisk.\
! 5209: >>>220 string Booting\ from\ harddisk.\n\r
! 5210: >>>245 string Cannot\ load\ from\ harddisk.\n\r
! 5211: >>>>273 string Insert\ Systemdisk\
! 5212: >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
! 5213: >>>>>>200 string >\0 \b, version %-3s
! 5214: >242 string Bootsector\ from\ C.H.\ Hochst\204
! 5215: >>278 string No\ Systemdisk.\
! 5216: >>>293 string Booting\ from\ harddisk.\n\r
! 5217: >>>441 string Cannot\ load\ from\ harddisk.\n\r
! 5218: >>>>469 string Insert\ Systemdisk\
! 5219: >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
! 5220: >>>>>>209 string >\0 \b, version %-4.4s
! 5221: >(1.b+2) ubyte 0xe
! 5222: >>(1.b+3) ubyte 0x1f
! 5223: >>>(1.b+4) ubyte 0xbe
! 5224: >>>>(1.b+5) ubyte 0x77
! 5225: >>>>(1.b+6) ubyte 0x7c
! 5226: >>>>>(1.b+7) ubyte 0xac
! 5227: >>>>>>(1.b+8) ubyte 0x22
! 5228: >>>>>>>(1.b+9) ubyte 0xc0
! 5229: >>>>>>>>(1.b+10) ubyte 0x74
! 5230: >>>>>>>>>(1.b+11) ubyte 0xb
! 5231: >>>>>>>>>>(1.b+12) ubyte 0x56
! 5232: >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
! 5233: >103 string This\ is\ not\ a\ bootable\ disk.\
! 5234: >>132 string Please\ insert\ a\ bootable\
! 5235: >>>157 string floppy\ and\r\n
! 5236: >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
! 5237: #
! 5238: >66 string Solaris\ Boot\ Sector
! 5239: >>99 string Incomplete\ MDBoot\ load.
! 5240: >>>89 string Version \b, Sun Solaris Bootloader
! 5241: >>>>97 byte x version %c
! 5242: #
! 5243: >408 string OS/2\ !!\ SYS01475\r\0
! 5244: >>429 string OS/2\ !!\ SYS02025\r\0
! 5245: >>>450 string OS/2\ !!\ SYS02027\r\0
! 5246: >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
! 5247: #
! 5248: >409 string OS/2\ !!\ SYS01475\r\0
! 5249: >>430 string OS/2\ !!\ SYS02025\r\0
! 5250: >>>451 string OS/2\ !!\ SYS02027\r\0
! 5251: >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
! 5252: >112 string This\ disk\ is\ not\ bootable\r
! 5253: >>142 string If\ you\ wish\ to\ make\ it\ bootable
! 5254: >>>176 string run\ the\ DOS\ program\ SYS\
! 5255: >>>200 string after\ the\r
! 5256: >>>>216 string system\ has\ been\ loaded\r\n
! 5257: >>>>>242 string Please\ insert\ a\ DOS\ diskette\
! 5258: >>>>>271 string into\r\n\ the\ drive\ and\
! 5259: >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
! 5260: # XP
! 5261: >430 string NTLDR\ is\ missing\xFF\r\n
! 5262: >>449 string Disk\ error\xFF\r\n
! 5263: >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
! 5264: # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
! 5265: >>>>417 ubyte&0xDF >0
! 5266: >>>>>417 string x %-.5s
! 5267: >>>>>>422 ubyte&0xDF >0
! 5268: >>>>>>>422 string x \b%-.3s
! 5269: >>>>>425 ubyte&0xDF >0
! 5270: >>>>>>425 string >\ \b.%-.3s
! 5271: #
! 5272: >>>>371 ubyte >0x20
! 5273: >>>>>368 ubyte&0xDF >0
! 5274: >>>>>>368 string x %-.5s
! 5275: >>>>>>>373 ubyte&0xDF >0
! 5276: >>>>>>>>373 string x \b%-.3s
! 5277: >>>>>>376 ubyte&0xDF >0
! 5278: >>>>>>>376 string x \b.%-.3s
! 5279: #
! 5280: >430 string NTLDR\ nicht\ gefunden\xFF\r\n
! 5281: >>453 string Datentr\204gerfehler\xFF\r\n
! 5282: >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
! 5283: >>>>417 ubyte&0xDF >0
! 5284: >>>>>417 string x %-.5s
! 5285: >>>>>>422 ubyte&0xDF >0
! 5286: >>>>>>>422 string x \b%-.3s
! 5287: >>>>>425 ubyte&0xDF >0
! 5288: >>>>>>425 string >\ \b.%-.3s
! 5289: # offset variant
! 5290: >>>>379 string \0
! 5291: >>>>>368 ubyte&0xDF >0
! 5292: >>>>>>368 string x %-.5s
! 5293: >>>>>>>373 ubyte&0xDF >0
! 5294: >>>>>>>>373 string x \b%-.3s
! 5295: #
! 5296: >430 string NTLDR\ fehlt\xFF\r\n
! 5297: >>444 string Datentr\204gerfehler\xFF\r\n
! 5298: >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
! 5299: >>>>417 ubyte&0xDF >0
! 5300: >>>>>417 string x %-.5s
! 5301: >>>>>>422 ubyte&0xDF >0
! 5302: >>>>>>>422 string x \b%-.3s
! 5303: >>>>>425 ubyte&0xDF >0
! 5304: >>>>>>425 string >\ \b.%-.3s
! 5305: # variant
! 5306: >>>>371 ubyte >0x20
! 5307: >>>>>368 ubyte&0xDF >0
! 5308: >>>>>>368 string x %-.5s
! 5309: >>>>>>>373 ubyte&0xDF >0
! 5310: >>>>>>>>373 string x \b%-.3s
! 5311: >>>>>>376 ubyte&0xDF >0
! 5312: >>>>>>>376 string x \b.%-.3s
! 5313: #
! 5314: >430 string NTLDR\ fehlt\xFF\r\n
! 5315: >>444 string Medienfehler\xFF\r\n
! 5316: >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
! 5317: >>>>371 ubyte >0x20
! 5318: >>>>>368 ubyte&0xDF >0
! 5319: >>>>>>368 string x %-.5s
! 5320: >>>>>>>373 ubyte&0xDF >0
! 5321: >>>>>>>>373 string x \b%-.3s
! 5322: >>>>>>376 ubyte&0xDF >0
! 5323: >>>>>>>376 string x \b.%-.3s
! 5324: # variant
! 5325: >>>>417 ubyte&0xDF >0
! 5326: >>>>>417 string x %-.5s
! 5327: >>>>>>422 ubyte&0xDF >0
! 5328: >>>>>>>422 string x \b%-.3s
! 5329: >>>>>425 ubyte&0xDF >0
! 5330: >>>>>>425 string >\ \b.%-.3s
! 5331: #
! 5332: >430 string Datentr\204ger\ entfernen\xFF\r\n
! 5333: >>454 string Medienfehler\xFF\r\n
! 5334: >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
! 5335: >>>>368 ubyte&0xDF >0
! 5336: >>>>>368 string x %-.5s
! 5337: >>>>>>373 ubyte&0xDF >0
! 5338: >>>>>>>373 string x \b%-.3s
! 5339: >>>>>376 ubyte&0xDF >0
! 5340: >>>>>>376 string x \b.%-.3s
! 5341: #>3 string NTFS\ \ \ \
! 5342: >389 string Fehler\ beim\ Lesen\
! 5343: >>407 string des\ Datentr\204gers
! 5344: >>>426 string NTLDR\ fehlt
! 5345: >>>>440 string NTLDR\ ist\ komprimiert
! 5346: >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
! 5347: #>3 string NTFS\ \ \ \
! 5348: >313 string A\ disk\ read\ error\ occurred.\r
! 5349: >>345 string A\ kernel\ file\ is\ missing\
! 5350: >>>370 string from\ the\ disk.\r
! 5351: >>>>484 string NTLDR\ is\ compressed
! 5352: >>>>>429 string Insert\ a\ system\ diskette\
! 5353: >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
! 5354: # DOS loader variants different languages,offsets
! 5355: >472 ubyte&0xDF >0
! 5356: >>389 string Invalid\ system\ disk\xFF\r\n
! 5357: >>>411 string Disk\ I/O\ error
! 5358: >>>>428 string Replace\ the\ disk,\ and\
! 5359: >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
! 5360: #IO.SYS
! 5361: >>>>>>472 ubyte&0xDF >0
! 5362: >>>>>>>472 string x \b %-.2s
! 5363: >>>>>>>>474 ubyte&0xDF >0
! 5364: >>>>>>>>>474 string x \b%-.5s
! 5365: >>>>>>>>>>479 ubyte&0xDF >0
! 5366: >>>>>>>>>>>479 string x \b%-.1s
! 5367: >>>>>>>480 ubyte&0xDF >0
! 5368: >>>>>>>>480 string x \b.%-.3s
! 5369: #MSDOS.SYS
! 5370: >>>>>>>483 ubyte&0xDF >0 \b+
! 5371: >>>>>>>>483 string x \b%-.5s
! 5372: >>>>>>>>>488 ubyte&0xDF >0
! 5373: >>>>>>>>>>488 string x \b%-.3s
! 5374: >>>>>>>>491 ubyte&0xDF >0
! 5375: >>>>>>>>>491 string x \b.%-.3s
! 5376: #
! 5377: >>390 string Invalid\ system\ disk\xFF\r\n
! 5378: >>>412 string Disk\ I/O\ error\xFF\r\n
! 5379: >>>>429 string Replace\ the\ disk,\ and\
! 5380: >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
! 5381: >>388 string Ungueltiges\ System\ \xFF\r\n
! 5382: >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
! 5383: >>>>427 string Datentraeger\ wechseln\ und\
! 5384: >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
! 5385: #WINBOOT.SYS only not spaces (0xDF)
! 5386: >>>>>>497 ubyte&0xDF >0
! 5387: >>>>>>>497 string x %-.5s
! 5388: >>>>>>>>502 ubyte&0xDF >0
! 5389: >>>>>>>>>502 string x \b%-.1s
! 5390: >>>>>>>>>>503 ubyte&0xDF >0
! 5391: >>>>>>>>>>>503 string x \b%-.1s
! 5392: >>>>>>>>>>>>504 ubyte&0xDF >0
! 5393: >>>>>>>>>>>>>504 string x \b%-.1s
! 5394: >>>>>>505 ubyte&0xDF >0
! 5395: >>>>>>>505 string x \b.%-.3s
! 5396: #IO.SYS
! 5397: >>>>>>472 ubyte&0xDF >0 or
! 5398: >>>>>>>472 string x \b %-.2s
! 5399: >>>>>>>>474 ubyte&0xDF >0
! 5400: >>>>>>>>>474 string x \b%-.5s
! 5401: >>>>>>>>>>479 ubyte&0xDF >0
! 5402: >>>>>>>>>>>479 string x \b%-.1s
! 5403: >>>>>>>480 ubyte&0xDF >0
! 5404: >>>>>>>>480 string x \b.%-.3s
! 5405: #MSDOS.SYS
! 5406: >>>>>>>483 ubyte&0xDF >0 \b+
! 5407: >>>>>>>>483 string x \b%-.5s
! 5408: >>>>>>>>>488 ubyte&0xDF >0
! 5409: >>>>>>>>>>488 string x \b%-.3s
! 5410: >>>>>>>>491 ubyte&0xDF >0
! 5411: >>>>>>>>>491 string x \b.%-.3s
! 5412: #
! 5413: >>390 string Ungueltiges\ System\ \xFF\r\n
! 5414: >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
! 5415: >>>>429 string Datentraeger\ wechseln\ und\
! 5416: >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
! 5417: #WINBOOT.SYS only not spaces (0xDF)
! 5418: >>>>>>497 ubyte&0xDF >0
! 5419: >>>>>>>497 string x %-.7s
! 5420: >>>>>>>>504 ubyte&0xDF >0
! 5421: >>>>>>>>>504 string x \b%-.1s
! 5422: >>>>>>505 ubyte&0xDF >0
! 5423: >>>>>>>505 string x \b.%-.3s
! 5424: #IO.SYS
! 5425: >>>>>>472 ubyte&0xDF >0 or
! 5426: >>>>>>>472 string x \b %-.2s
! 5427: >>>>>>>>474 ubyte&0xDF >0
! 5428: >>>>>>>>>474 string x \b%-.6s
! 5429: >>>>>>>480 ubyte&0xDF >0
! 5430: >>>>>>>>480 string x \b.%-.3s
! 5431: #MSDOS.SYS
! 5432: >>>>>>>483 ubyte&0xDF >0 \b+
! 5433: >>>>>>>>483 string x \b%-.5s
! 5434: >>>>>>>>>488 ubyte&0xDF >0
! 5435: >>>>>>>>>>488 string x \b%-.3s
! 5436: >>>>>>>>491 ubyte&0xDF >0
! 5437: >>>>>>>>>491 string x \b.%-.3s
! 5438: #
! 5439: >>389 string Ungueltiges\ System\ \xFF\r\n
! 5440: >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
! 5441: >>>>428 string Datentraeger\ wechseln\ und\
! 5442: >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
! 5443: # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
! 5444: >>>>>>472 string x %-.2s
! 5445: >>>>>>>474 ubyte&0xDF >0
! 5446: >>>>>>>>474 string x \b%-.5s
! 5447: >>>>>>>>479 ubyte&0xDF >0
! 5448: >>>>>>>>>479 string x \b%-.1s
! 5449: >>>>>>480 ubyte&0xDF >0
! 5450: >>>>>>>480 string x \b.%-.3s
! 5451: >>>>>>483 ubyte&0xDF >0 \b+
! 5452: >>>>>>>483 string x \b%-.5s
! 5453: >>>>>>>488 ubyte&0xDF >0
! 5454: >>>>>>>>488 string x \b%-.2s
! 5455: >>>>>>>>490 ubyte&0xDF >0
! 5456: >>>>>>>>>490 string x \b%-.1s
! 5457: >>>>>>>491 ubyte&0xDF >0
! 5458: >>>>>>>>491 string x \b.%-.3s
! 5459: >479 ubyte&0xDF >0
! 5460: >>416 string Kein\ System\ oder\
! 5461: >>>433 string Laufwerksfehler
! 5462: >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
! 5463: #IO.SYS
! 5464: >>>>>479 string x \b %-.2s
! 5465: >>>>>>481 ubyte&0xDF >0
! 5466: >>>>>>>481 string x \b%-.6s
! 5467: >>>>>487 ubyte&0xDF >0
! 5468: >>>>>>487 string x \b.%-.3s
! 5469: #MSDOS.SYS
! 5470: >>>>>>490 ubyte&0xDF >0 \b+
! 5471: >>>>>>>490 string x \b%-.5s
! 5472: >>>>>>>>495 ubyte&0xDF >0
! 5473: >>>>>>>>>495 string x \b%-.3s
! 5474: >>>>>>>498 ubyte&0xDF >0
! 5475: >>>>>>>>498 string x \b.%-.3s
! 5476: #
! 5477: >376 search/41 Non-System\ disk\ or\
! 5478: >>395 search/41 disk\ error\r
! 5479: >>>407 search/41 Replace\ and\
! 5480: >>>>419 search/41 press\ \b,
! 5481: >>>>419 search/41 strike\ \b, old
! 5482: >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
! 5483: #449 Disk\ Boot\ failure\r MS 3.21
! 5484: #466 Boot\ Failure\r MS 3.30
! 5485: >>>>>468 search/18 \0
! 5486: #IO.SYS,IBMBIO.COM
! 5487: >>>>>>&0 string x \b %-.2s
! 5488: >>>>>>>&-20 ubyte&0xDF >0
! 5489: >>>>>>>>&-1 string x \b%-.4s
! 5490: >>>>>>>>>&-16 ubyte&0xDF >0
! 5491: >>>>>>>>>>&-1 string x \b%-.2s
! 5492: >>>>>>&8 ubyte&0xDF >0 \b.
! 5493: >>>>>>>&-1 string x \b%-.3s
! 5494: #MSDOS.SYS,IBMDOS.COM
! 5495: >>>>>>&11 ubyte&0xDF >0 \b+
! 5496: >>>>>>>&-1 string x \b%-.5s
! 5497: >>>>>>>>&-6 ubyte&0xDF >0
! 5498: >>>>>>>>>&-1 string x \b%-.1s
! 5499: >>>>>>>>>>&-5 ubyte&0xDF >0
! 5500: >>>>>>>>>>>&-1 string x \b%-.2s
! 5501: >>>>>>>&7 ubyte&0xDF >0 \b.
! 5502: >>>>>>>>&-1 string x \b%-.3s
! 5503: >441 string Cannot\ load\ from\ harddisk.\n\r
! 5504: >>469 string Insert\ Systemdisk\
! 5505: >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
! 5506: #>43 string \224R-LOADER\ \ SYS =label
! 5507: >54 string SYS
! 5508: >>324 string VASKK
! 5509: >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
! 5510: #
! 5511: >98 string Press\ a\ key\ to\ retry\0\r
! 5512: >>120 string Cannot\ find\ file\ \0\r
! 5513: >>>139 string Disk\ read\ error\0\r
! 5514: >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
! 5515: #DRBIOS.SYS
! 5516: >>>>>44 ubyte&0xDF >0
! 5517: >>>>>>44 string x \b %-.6s
! 5518: >>>>>>>50 ubyte&0xDF >0
! 5519: >>>>>>>>50 string x \b%-.2s
! 5520: >>>>>>52 ubyte&0xDF >0
! 5521: >>>>>>>52 string x \b.%-.3s
! 5522: #
! 5523: >70 string IBMBIO\ \ COM
! 5524: >>472 string Cannot\ load\ DOS!\
! 5525: >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
! 5526: >>471 string Cannot\ load\ DOS\
! 5527: >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
! 5528: >444 string KERNEL\ \ SYS
! 5529: >>314 string BOOT\ error! \b, FREE-DOS Bootloader
! 5530: >499 string KERNEL\ \ SYS
! 5531: >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
! 5532: >449 string KERNEL\ \ SYS
! 5533: >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
! 5534: >125 string Loading\ FreeDOS...\r
! 5535: >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
! 5536: >>>441 ubyte&0xDF >0
! 5537: >>>>441 string x \b %-.6s
! 5538: >>>>>447 ubyte&0xDF >0
! 5539: >>>>>>447 string x \b%-.1s
! 5540: >>>>>>>448 ubyte&0xDF >0
! 5541: >>>>>>>>448 string x \b%-.1s
! 5542: >>>>449 ubyte&0xDF >0
! 5543: >>>>>449 string x \b.%-.3s
! 5544: >124 string FreeDOS\0
! 5545: >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
! 5546: # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
! 5547: >>>497 ubyte&0xDF >0
! 5548: >>>>497 string x \b %-.6s
! 5549: >>>>>503 ubyte&0xDF >0
! 5550: >>>>>>503 string x \b%-.1s
! 5551: >>>>>>>504 ubyte&0xDF >0
! 5552: >>>>>>>>504 string x \b%-.1s
! 5553: >>>>505 ubyte&0xDF >0
! 5554: >>>>>505 string x \b.%-.3s
! 5555: >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
! 5556: >>>497 ubyte&0xDF >0
! 5557: >>>>497 string x \b %-.6s
! 5558: >>>>>503 ubyte&0xDF >0
! 5559: >>>>>>503 string x \b%-.1s
! 5560: >>>>>>>504 ubyte&0xDF >0
! 5561: >>>>>>>>504 string x \b%-.1s
! 5562: >>>>505 ubyte&0xDF >0
! 5563: >>>>>505 string x \b.%-.3s
! 5564: >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
! 5565: >>>497 ubyte&0xDF >0
! 5566: >>>>497 string x \b %-.6s
! 5567: >>>>>503 ubyte&0xDF >0
! 5568: >>>>>>503 string x \b%-.1s
! 5569: >>>>>>>504 ubyte&0xDF >0
! 5570: >>>>>>>>504 string x \b%-.1s
! 5571: >>>>505 ubyte&0xDF >0
! 5572: >>>>>505 string x \b.%-.3s
! 5573: >336 string Error!\
! 5574: >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
! 5575: >>>497 ubyte&0xDF >0
! 5576: >>>>497 string x \b %-.6s
! 5577: >>>>>503 ubyte&0xDF >0
! 5578: >>>>>>503 string x \b%-.1s
! 5579: >>>>>>>504 ubyte&0xDF >0
! 5580: >>>>>>>>504 string x \b%-.1s
! 5581: >>>>505 ubyte&0xDF >0
! 5582: >>>>>505 string x \b.%-.3s
! 5583: # added by Joerg Jenderek
! 5584: # http://www.visopsys.org/
! 5585: # http://partitionlogic.org.uk/
! 5586: # OEM-ID=Visopsys
! 5587: >478 ulelong 0
! 5588: >>(1.b+326) string I/O\ Error\ reading\
! 5589: >>>(1.b+344) string Visopsys\ loader\r
! 5590: >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
! 5591: # http://alexfru.chat.ru/epm.html#bootprog
! 5592: >494 ubyte >0x4D
! 5593: >>495 string >E
! 5594: >>>495 string <S
! 5595: #OEM-ID is not reliable
! 5596: >>>>3 string BootProg
! 5597: # It just looks for a program file name at the root directory
! 5598: # and loads corresponding file with following execution.
! 5599: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
! 5600: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
! 5601: >>>>>499 string x \b %-.1s
! 5602: >>>>>>500 ubyte&0xDF >0
! 5603: >>>>>>>500 string x \b%-.1s
! 5604: >>>>>>>>501 ubyte&0xDF >0
! 5605: >>>>>>>>>501 string x \b%-.1s
! 5606: >>>>>>>>>>502 ubyte&0xDF >0
! 5607: >>>>>>>>>>>502 string x \b%-.1s
! 5608: >>>>>>>>>>>>503 ubyte&0xDF >0
! 5609: >>>>>>>>>>>>>503 string x \b%-.1s
! 5610: >>>>>>>>>>>>>>504 ubyte&0xDF >0
! 5611: >>>>>>>>>>>>>>>504 string x \b%-.1s
! 5612: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
! 5613: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
! 5614: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
! 5615: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
! 5616: #name extension
! 5617: >>>>>507 ubyte&0xDF >0 \b.
! 5618: >>>>>>507 string x \b%-.1s
! 5619: >>>>>>>508 ubyte&0xDF >0
! 5620: >>>>>>>>508 string x \b%-.1s
! 5621: >>>>>>>>>509 ubyte&0xDF >0
! 5622: >>>>>>>>>>509 string x \b%-.1s
! 5623: #If the boot sector fails to read any other sector,
! 5624: #it prints a very short message ("RE") to the screen and hangs the computer.
! 5625: #If the boot sector fails to find needed program in the root directory,
! 5626: #it also hangs with another message ("NF").
! 5627: >>>>>492 string RENF \b, FAT (12 bit)
! 5628: >>>>>495 string RENF \b, FAT (16 bit)
! 5629: # http://alexfru.chat.ru/epm.html#bootprog
! 5630: >494 ubyte >0x4D
! 5631: >>495 string >E
! 5632: >>>495 string <S
! 5633: #OEM-ID is not reliable
! 5634: >>>>3 string BootProg
! 5635: # It just looks for a program file name at the root directory
! 5636: # and loads corresponding file with following execution.
! 5637: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
! 5638: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
! 5639: >>>>>499 string x \b %-.1s
! 5640: >>>>>>500 ubyte&0xDF >0
! 5641: >>>>>>>500 string x \b%-.1s
! 5642: >>>>>>>>501 ubyte&0xDF >0
! 5643: >>>>>>>>>501 string x \b%-.1s
! 5644: >>>>>>>>>>502 ubyte&0xDF >0
! 5645: >>>>>>>>>>>502 string x \b%-.1s
! 5646: >>>>>>>>>>>>503 ubyte&0xDF >0
! 5647: >>>>>>>>>>>>>503 string x \b%-.1s
! 5648: >>>>>>>>>>>>>>504 ubyte&0xDF >0
! 5649: >>>>>>>>>>>>>>>504 string x \b%-.1s
! 5650: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
! 5651: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
! 5652: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
! 5653: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
! 5654: #name extension
! 5655: >>>>>507 ubyte&0xDF >0 \b.
! 5656: >>>>>>507 string x \b%-.1s
! 5657: >>>>>>>508 ubyte&0xDF >0
! 5658: >>>>>>>>508 string x \b%-.1s
! 5659: >>>>>>>>>509 ubyte&0xDF >0
! 5660: >>>>>>>>>>509 string x \b%-.1s
! 5661: #If the boot sector fails to read any other sector,
! 5662: #it prints a very short message ("RE") to the screen and hangs the computer.
! 5663: #If the boot sector fails to find needed program in the root directory,
! 5664: #it also hangs with another message ("NF").
! 5665: >>>>>492 string RENF \b, FAT (12 bit)
! 5666: >>>>>495 string RENF \b, FAT (16 bit)
! 5667: # added by Joerg Jenderek
! 5668: # http://syslinux.zytor.com/iso.php
! 5669: 0 ulelong 0x7c40eafa isolinux Loader
! 5670: # http://syslinux.zytor.com/pxe.php
! 5671: 0 ulelong 0x007c05ea pxelinux Loader
! 5672: 0 ulelong 0x60669c66 pxelinux Loader
! 5673: # loader end
! 5674: # updated by Joerg Jenderek at Sep 2007
! 5675: >3 ubyte 0
! 5676: #no active flag
! 5677: >>446 ubyte 0
! 5678: # partition 1 not empty
! 5679: >>>450 ubyte >0
! 5680: # partitions 3,4 empty
! 5681: >>>>482 ubyte 0
! 5682: >>>>>498 ubyte 0
! 5683: # partition 2 ID=0,5,15
! 5684: >>>>>>466 ubyte <0x10
! 5685: >>>>>>>466 ubyte 0x05 \b, extended partition table
! 5686: >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
! 5687: >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
! 5688: # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
! 5689: # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
! 5690: # older drives may use Near JuMP instruction E9 xx xx
! 5691: >0 lelong&0x009000EB 0x009000EB
! 5692: >0 lelong&0x000000E9 0x000000E9
! 5693: # maximal short forward jump is 07fx
! 5694: >1 ubyte <0xff \b, code offset 0x%x
! 5695: # mtools-3.9.8/msdos.h
! 5696: # usual values are marked with comments to get only informations of strange FAT systems
! 5697: # valid sectorsize must be a power of 2 from 32 to 32768
! 5698: >>11 uleshort&0x000f x
! 5699: >>>11 uleshort <32769
! 5700: >>>>11 uleshort >31
! 5701: >>>>>3 string >\0 \b, OEM-ID "%8.8s"
! 5702: #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
! 5703: >>>>>>8 string IHC \b cached by Windows 9M
! 5704: >>>>>11 uleshort >512 \b, Bytes/sector %u
! 5705: #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
! 5706: >>>>>11 uleshort <512 \b, Bytes/sector %u
! 5707: >>>>>13 ubyte >1 \b, sectors/cluster %u
! 5708: #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
! 5709: >>>>>14 uleshort >32 \b, reserved sectors %u
! 5710: #>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
! 5711: #>>>>>14 uleshort >1 \b, reserved sectors %u
! 5712: #>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
! 5713: >>>>>14 uleshort <1 \b, reserved sectors %u
! 5714: >>>>>16 ubyte >2 \b, FATs %u
! 5715: #>>>>>16 ubyte =2 \b, FATs %u (usual)
! 5716: >>>>>16 ubyte =1 \b, FAT %u
! 5717: >>>>>16 ubyte >0
! 5718: >>>>>17 uleshort >0 \b, root entries %u
! 5719: #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
! 5720: >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
! 5721: #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
! 5722: >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
! 5723: #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
! 5724: >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
! 5725: >>>>>22 uleshort >0 \b, sectors/FAT %u
! 5726: #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
! 5727: >>>>>26 ubyte >2 \b, heads %u
! 5728: #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
! 5729: >>>>>26 ubyte =1 \b, heads %u
! 5730: #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
! 5731: >>>>>38 ubyte !0x70
! 5732: >>>>>>28 ulelong >0 \b, hidden sectors %u
! 5733: #>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
! 5734: >>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
! 5735: #>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
! 5736: # FAT<32 specific
! 5737: >>>>>82 string !FAT32
! 5738: #>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
! 5739: #>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
! 5740: >>>>>>36 ubyte !0x80
! 5741: >>>>>>>36 ubyte !0 \b, physical drive 0x%x
! 5742: >>>>>>37 ubyte >0 \b, reserved 0x%x
! 5743: #>>>>>>37 ubyte =0 \b, reserved 0x%x
! 5744: >>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
! 5745: >>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
! 5746: >>>>>>38 ubyte =0x29
! 5747: >>>>>>>39 ulelong x \b, serial number 0x%x
! 5748: >>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
! 5749: >>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
! 5750: >>>>>>>43 string =NO\ NAME \b, unlabeled
! 5751: >>>>>>54 string FAT \b, FAT
! 5752: >>>>>>>54 string FAT12 \b (12 bit)
! 5753: >>>>>>>54 string FAT16 \b (16 bit)
! 5754: # FAT32 specific
! 5755: >>>>>82 string FAT32 \b, FAT (32 bit)
! 5756: >>>>>>36 ulelong x \b, sectors/FAT %u
! 5757: >>>>>>40 uleshort >0 \b, extension flags %u
! 5758: #>>>>>>40 uleshort =0 \b, extension flags %u
! 5759: >>>>>>42 uleshort >0 \b, fsVersion %u
! 5760: #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
! 5761: >>>>>>44 ulelong >2 \b, rootdir cluster %u
! 5762: #>>>>>>44 ulelong =2 \b, rootdir cluster %u
! 5763: #>>>>>>44 ulelong =1 \b, rootdir cluster %u
! 5764: >>>>>>48 uleshort >1 \b, infoSector %u
! 5765: #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
! 5766: >>>>>>48 uleshort <1 \b, infoSector %u
! 5767: >>>>>>50 uleshort >6 \b, Backup boot sector %u
! 5768: #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
! 5769: >>>>>>50 uleshort <6 \b, Backup boot sector %u
! 5770: >>>>>>54 ulelong >0 \b, reserved1 0x%x
! 5771: >>>>>>58 ulelong >0 \b, reserved2 0x%x
! 5772: >>>>>>62 ulelong >0 \b, reserved3 0x%x
! 5773: # same structure as FAT1X
! 5774: >>>>>>64 ubyte >0x80 \b, physical drive 0x%x
! 5775: #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
! 5776: >>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
! 5777: #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
! 5778: >>>>>>65 ubyte >0 \b, reserved 0x%x
! 5779: >>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
! 5780: >>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
! 5781: >>>>>>66 ubyte =0x29
! 5782: >>>>>>>67 ulelong x \b, serial number 0x%x
! 5783: >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
! 5784: >>>>>>71 string >NO\ NAME \b, label: "%11.11s"
! 5785: >>>>>>71 string =NO\ NAME \b, unlabeled
! 5786: ### FATs end
! 5787: >0x200 lelong 0x82564557 \b, BSD disklabel
! 5788: # FATX
! 5789: 0 string FATX FATX filesystem data
! 5790:
! 5791:
! 5792: # Minix filesystems - Juan Cespedes <cespedes@debian.org>
! 5793: 0x410 leshort 0x137f Minix filesystem
! 5794: 0x410 beshort 0x137f Minix filesystem (big endian)
! 5795: >0x402 beshort !0 \b, %d zones
! 5796: >0x1e string minix \b, bootable
! 5797: 0x410 leshort 0x138f Minix filesystem, 30 char names
! 5798: 0x410 leshort 0x2468 Minix filesystem, version 2
! 5799: 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
! 5800:
! 5801: # romfs filesystems - Juan Cespedes <cespedes@debian.org>
! 5802: 0 string -rom1fs-\0 romfs filesystem, version 1
! 5803: >8 belong x %d bytes,
! 5804: >16 string x named %s.
! 5805:
! 5806: # netboot image - Juan Cespedes <cespedes@debian.org>
! 5807: 0 lelong 0x1b031336L Netboot image,
! 5808: >4 lelong&0xFFFFFF00 0
! 5809: >>4 lelong&0x100 0x000 mode 2
! 5810: >>4 lelong&0x100 0x100 mode 3
! 5811: >4 lelong&0xFFFFFF00 !0 unknown mode
! 5812:
! 5813: 0x18b string OS/2 OS/2 Boot Manager
! 5814:
! 5815: # added by Joerg Jenderek
! 5816: # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
! 5817: # grub-1.94/kern/i386/pc/startup.S
! 5818: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
! 5819: # usual values are marked with comments to get only informations of strange GRUB loaders
! 5820: 0x200 uleshort 0x70EA
! 5821: # found only version 3.{1,2}
! 5822: >0x206 ubeshort >0x0300
! 5823: # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
! 5824: >>0x212 ubyte >0x29
! 5825: >>>0x213 ubyte >0x29
! 5826: # not iso9660_stage1_5
! 5827: #>>>0 ulelong&0x00BE5652 0x00BE5652
! 5828: >>>>0x213 ubyte >0x29 GRand Unified Bootloader
! 5829: # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
! 5830: >>>>0x217 ubyte 0xFF stage1_5
! 5831: >>>>0x217 ubyte <0xFF stage2
! 5832: >>>>0x206 ubyte x \b version %u
! 5833: >>>>0x207 ubyte x \b.%u
! 5834: # module_size for 1.94
! 5835: >>>>0x208 ulelong <0xffffff \b, installed partition %u
! 5836: #>>>>0x208 ulelong =0xffffff \b, %u (default)
! 5837: >>>>0x208 ulelong >0xffffff \b, installed partition %u
! 5838: # GRUB 0.5.95 unofficial
! 5839: >>>>0x20C ulelong&0x2E300000 0x2E300000
! 5840: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
! 5841: >>>>>0x20C ubyte x \b, identifier 0x%x
! 5842: #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
! 5843: >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
! 5844: # GRUB version as string
! 5845: >>>>>0x20E string >\0 \b, GRUB version %-s
! 5846: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
! 5847: >>>>>>0x215 ulong 0xffffffff
! 5848: >>>>>>>0x219 string >\0 \b, configuration file %-s
! 5849: >>>>>>0x215 ulong !0xffffffff
! 5850: >>>>>>>0x215 string >\0 \b, configuration file %-s
! 5851: # newer GRUB versions
! 5852: >>>>0x20C ulelong&0x2E300000 !0x2E300000
! 5853: ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
! 5854: >>>>>0x20C ulelong >0 \b, saved entry %d
! 5855: # for 1.94 contains kernel image size
! 5856: # for 0.93,0.94,0.96,0.97
! 5857: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
! 5858: >>>>>0x210 ubyte x \b, identifier 0x%x
! 5859: # The flag for LBA forcing is in most cases 0
! 5860: #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
! 5861: >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
! 5862: # GRUB version as string
! 5863: >>>>>0x212 string >\0 \b, GRUB version %-s
! 5864: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
! 5865: >>>>>0x217 ulong 0xffffffff
! 5866: >>>>>>0x21b string >\0 \b, configuration file %-s
! 5867: >>>>>0x217 ulong !0xffffffff
! 5868: >>>>>>0x217 string >\0 \b, configuration file %-s
! 5869:
! 5870: 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
! 5871: >8404 string x last mounted on %s,
! 5872: #>9504 ledate x last checked at %s,
! 5873: >8224 ledate x last written at %s,
! 5874: >8401 byte x clean flag %d,
! 5875: >8228 lelong x number of blocks %d,
! 5876: >8232 lelong x number of data blocks %d,
! 5877: >8236 lelong x number of cylinder groups %d,
! 5878: >8240 lelong x block size %d,
! 5879: >8244 lelong x fragment size %d,
! 5880: >8252 lelong x minimum percentage of free blocks %d,
! 5881: >8256 lelong x rotational delay %dms,
! 5882: >8260 lelong x disk rotational speed %drps,
! 5883: >8320 lelong 0 TIME optimization
! 5884: >8320 lelong 1 SPACE optimization
! 5885:
! 5886: 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
! 5887: >&-1164 string x last mounted on %s,
! 5888: >&-696 string >\0 volume name %s,
! 5889: >&-304 leqldate x last written at %s,
! 5890: >&-1167 byte x clean flag %d,
! 5891: >&-1168 byte x readonly flag %d,
! 5892: >&-296 lequad x number of blocks %lld,
! 5893: >&-288 lequad x number of data blocks %lld,
! 5894: >&-1332 lelong x number of cylinder groups %d,
! 5895: >&-1328 lelong x block size %d,
! 5896: >&-1324 lelong x fragment size %d,
! 5897: >&-180 lelong x average file size %d,
! 5898: >&-176 lelong x average number of files in dir %d,
! 5899: >&-272 lequad x pending blocks to free %lld,
! 5900: >&-264 lelong x pending inodes to free %ld,
! 5901: >&-664 lequad x system-wide uuid %0llx,
! 5902: >&-1316 lelong x minimum percentage of free blocks %d,
! 5903: >&-1248 lelong 0 TIME optimization
! 5904: >&-1248 lelong 1 SPACE optimization
! 5905:
! 5906: 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
! 5907: >&-1164 string x last mounted on %s,
! 5908: >&-696 string >\0 volume name %s,
! 5909: >&-304 leqldate x last written at %s,
! 5910: >&-1167 byte x clean flag %d,
! 5911: >&-1168 byte x readonly flag %d,
! 5912: >&-296 lequad x number of blocks %lld,
! 5913: >&-288 lequad x number of data blocks %lld,
! 5914: >&-1332 lelong x number of cylinder groups %d,
! 5915: >&-1328 lelong x block size %d,
! 5916: >&-1324 lelong x fragment size %d,
! 5917: >&-180 lelong x average file size %d,
! 5918: >&-176 lelong x average number of files in dir %d,
! 5919: >&-272 lequad x pending blocks to free %lld,
! 5920: >&-264 lelong x pending inodes to free %ld,
! 5921: >&-664 lequad x system-wide uuid %0llx,
! 5922: >&-1316 lelong x minimum percentage of free blocks %d,
! 5923: >&-1248 lelong 0 TIME optimization
! 5924: >&-1248 lelong 1 SPACE optimization
! 5925:
! 5926: 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
! 5927: >7168 belong 0x4c41424c Apple UFS Volume
! 5928: >>7186 string x named %s,
! 5929: >>7176 belong x volume label version %d,
! 5930: >>7180 bedate x created on %s,
! 5931: >8404 string x last mounted on %s,
! 5932: #>9504 bedate x last checked at %s,
! 5933: >8224 bedate x last written at %s,
! 5934: >8401 byte x clean flag %d,
! 5935: >8228 belong x number of blocks %d,
! 5936: >8232 belong x number of data blocks %d,
! 5937: >8236 belong x number of cylinder groups %d,
! 5938: >8240 belong x block size %d,
! 5939: >8244 belong x fragment size %d,
! 5940: >8252 belong x minimum percentage of free blocks %d,
! 5941: >8256 belong x rotational delay %dms,
! 5942: >8260 belong x disk rotational speed %drps,
! 5943: >8320 belong 0 TIME optimization
! 5944: >8320 belong 1 SPACE optimization
! 5945:
! 5946: 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
! 5947: >&-1164 string x last mounted on %s,
! 5948: >&-696 string >\0 volume name %s,
! 5949: >&-304 beqldate x last written at %s,
! 5950: >&-1167 byte x clean flag %d,
! 5951: >&-1168 byte x readonly flag %d,
! 5952: >&-296 bequad x number of blocks %lld,
! 5953: >&-288 bequad x number of data blocks %lld,
! 5954: >&-1332 belong x number of cylinder groups %d,
! 5955: >&-1328 belong x block size %d,
! 5956: >&-1324 belong x fragment size %d,
! 5957: >&-180 belong x average file size %d,
! 5958: >&-176 belong x average number of files in dir %d,
! 5959: >&-272 bequad x pending blocks to free %lld,
! 5960: >&-264 belong x pending inodes to free %ld,
! 5961: >&-664 bequad x system-wide uuid %0llx,
! 5962: >&-1316 belong x minimum percentage of free blocks %d,
! 5963: >&-1248 belong 0 TIME optimization
! 5964: >&-1248 belong 1 SPACE optimization
! 5965:
! 5966: 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
! 5967: >&-1164 string x last mounted on %s,
! 5968: >&-696 string >\0 volume name %s,
! 5969: >&-304 beqldate x last written at %s,
! 5970: >&-1167 byte x clean flag %d,
! 5971: >&-1168 byte x readonly flag %d,
! 5972: >&-296 bequad x number of blocks %lld,
! 5973: >&-288 bequad x number of data blocks %lld,
! 5974: >&-1332 belong x number of cylinder groups %d,
! 5975: >&-1328 belong x block size %d,
! 5976: >&-1324 belong x fragment size %d,
! 5977: >&-180 belong x average file size %d,
! 5978: >&-176 belong x average number of files in dir %d,
! 5979: >&-272 bequad x pending blocks to free %lld,
! 5980: >&-264 belong x pending inodes to free %ld,
! 5981: >&-664 bequad x system-wide uuid %0llx,
! 5982: >&-1316 belong x minimum percentage of free blocks %d,
! 5983: >&-1248 belong 0 TIME optimization
! 5984: >&-1248 belong 1 SPACE optimization
! 5985:
! 5986: # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
! 5987: # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
! 5988: # volume label and UUID Russell Coker
! 5989: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
! 5990: 0x438 leshort 0xEF53 Linux
! 5991: >0x44c lelong x rev %d
! 5992: >0x43e leshort x \b.%d
! 5993: # No journal? ext2
! 5994: >0x45c lelong ^0x0000004 ext2 filesystem data
! 5995: >>0x43a leshort ^0x0000001 (mounted or unclean)
! 5996: # Has a journal? ext3 or ext4
! 5997: >0x45c lelong &0x0000004
! 5998: # and small INCOMPAT?
! 5999: >>0x460 lelong <0x0000040
! 6000: # and small RO_COMPAT?
! 6001: >>>0x464 lelong <0x0000008 ext3 filesystem data
! 6002: # else large RO_COMPAT?
! 6003: >>>0x464 lelong >0x0000007 ext4 filesystem data
! 6004: # else large INCOMPAT?
! 6005: >>0x460 lelong >0x000003f ext4 filesystem data
! 6006: >0x468 belong x \b, UUID=%x
! 6007: >0x46c beshort x \b-%x
! 6008: >0x46e beshort x \b-%x
! 6009: >0x470 beshort x \b-%x
! 6010: >0x472 belong x \b-%x
! 6011: >0x476 beshort x \b%x
! 6012: >0x478 string >0 \b, volume name "%s"
! 6013: # General flags for any ext* fs
! 6014: >0x460 lelong &0x0000004 (needs journal recovery)
! 6015: >0x43a leshort &0x0000002 (errors)
! 6016: # INCOMPAT flags
! 6017: >0x460 lelong &0x0000001 (compressed)
! 6018: #>0x460 lelong &0x0000002 (filetype)
! 6019: #>0x460 lelong &0x0000010 (meta bg)
! 6020: >0x460 lelong &0x0000040 (extents)
! 6021: >0x460 lelong &0x0000080 (64bit)
! 6022: #>0x460 lelong &0x0000100 (mmp)
! 6023: #>0x460 lelong &0x0000200 (flex bg)
! 6024: # RO_INCOMPAT flags
! 6025: #>0x464 lelong &0x0000001 (sparse super)
! 6026: >0x464 lelong &0x0000002 (large files)
! 6027: >0x464 lelong &0x0000008 (huge files)
! 6028: #>0x464 lelong &0x0000010 (gdt checksum)
! 6029: #>0x464 lelong &0x0000020 (many subdirs)
! 6030: #>0x463 lelong &0x0000040 (extra isize)
! 6031:
! 6032: # SGI disk labels - Nathan Scott <nathans@debian.org>
! 6033: 0 belong 0x0BE5A941 SGI disk label (volume header)
! 6034:
! 6035: # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
! 6036: 0 belong 0x58465342 SGI XFS filesystem data
! 6037: >0x4 belong x (blksz %d,
! 6038: >0x68 beshort x inosz %d,
! 6039: >0x64 beshort ^0x2004 v1 dirs)
! 6040: >0x64 beshort &0x2004 v2 dirs)
! 6041:
! 6042: ############################################################################
! 6043: # Minix-ST kernel floppy
! 6044: 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
! 6045: >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
! 6046: >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
! 6047:
! 6048: ############################################################################
! 6049: # Hmmm, is this a better way of detecting _standard_ floppy images ?
! 6050: 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
! 6051: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
! 6052: 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
! 6053: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
! 6054: 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
! 6055: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
! 6056:
! 6057: 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
! 6058: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
! 6059: 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
! 6060: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
! 6061:
! 6062: 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
! 6063: 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
! 6064:
! 6065: # Valid media descriptor bytes for MS-DOS:
! 6066: #
! 6067: # Byte Capacity Media Size and Type
! 6068: # -------------------------------------------------
! 6069: #
! 6070: # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
! 6071: # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
! 6072: # F9 720K 3.5-inch, 2-sided, 9-sector
! 6073: # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
! 6074: # FD 360K 5.25-inch, 2-sided, 9-sector
! 6075: # FF 320K 5.25-inch, 2-sided, 8-sector
! 6076: # FC 180K 5.25-inch, 1-sided, 9-sector
! 6077: # FE 160K 5.25-inch, 1-sided, 8-sector
! 6078: # FE 250K 8-inch, 1-sided, single-density
! 6079: # FD 500K 8-inch, 2-sided, single-density
! 6080: # FE 1.2 MB 8-inch, 2-sided, double-density
! 6081: # F8 ----- Fixed disk
! 6082: #
! 6083: # FC xxxK Apricot 70x1x9 boot disk.
! 6084: #
! 6085: # Originally a bitmap:
! 6086: # xxxxxxx0 Not two sided
! 6087: # xxxxxxx1 Double sided
! 6088: # xxxxxx0x Not 8 SPT
! 6089: # xxxxxx1x 8 SPT
! 6090: # xxxxx0xx Not Removable drive
! 6091: # xxxxx1xx Removable drive
! 6092: # 11111xxx Must be one.
! 6093: #
! 6094: # But now it's rather random:
! 6095: # 111111xx Low density disk
! 6096: # 00 SS, Not 8 SPT
! 6097: # 01 DS, Not 8 SPT
! 6098: # 10 SS, 8 SPT
! 6099: # 11 DS, 8 SPT
! 6100: #
! 6101: # 11111001 Double density 3½ floppy disk, high density 5¼
! 6102: # 11110000 High density 3½ floppy disk
! 6103: # 11111000 Hard disk any format
! 6104: #
! 6105:
! 6106: # CDROM Filesystems
! 6107: # Modified for UDF by gerardo.cacciari@gmail.com
! 6108: 32769 string CD001
! 6109: !:mime application/x-iso9660-image
! 6110: >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
! 6111: >38913 string NSR0 UDF filesystem data
! 6112: >>38917 string 1 (version 1.0)
! 6113: >>38917 string 2 (version 1.5)
! 6114: >>38917 string 3 (version 2.0)
! 6115: >>38917 byte >0x33 (unknown version, ID 0x%X)
! 6116: >>38917 byte <0x31 (unknown version, ID 0x%X)
! 6117: # "application id" which appears to be used as a volume label
! 6118: >32808 string >\0 '%s'
! 6119: >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
! 6120: 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
! 6121: !:mime application/x-iso9660-image
! 6122: 32776 string CDROM High Sierra CD-ROM filesystem data
! 6123:
! 6124: # cramfs filesystem - russell@coker.com.au
! 6125: 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
! 6126: >4 lelong x size %lu
! 6127: >8 lelong &1 version #2
! 6128: >8 lelong &2 sorted_dirs
! 6129: >8 lelong &4 hole_support
! 6130: >32 lelong x CRC 0x%x,
! 6131: >36 lelong x edition %lu,
! 6132: >40 lelong x %lu blocks,
! 6133: >44 lelong x %lu files
! 6134:
! 6135: 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
! 6136: >4 belong x size %lu
! 6137: >8 belong &1 version #2
! 6138: >8 belong &2 sorted_dirs
! 6139: >8 belong &4 hole_support
! 6140: >32 belong x CRC 0x%x,
! 6141: >36 belong x edition %lu,
! 6142: >40 belong x %lu blocks,
! 6143: >44 belong x %lu files
! 6144:
! 6145: # reiserfs - russell@coker.com.au
! 6146: 0x10034 string ReIsErFs ReiserFS V3.5
! 6147: 0x10034 string ReIsEr2Fs ReiserFS V3.6
! 6148: 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
! 6149: >0x1002c leshort x block size %d
! 6150: >0x10032 leshort &2 (mounted or unclean)
! 6151: >0x10000 lelong x num blocks %d
! 6152: >0x10040 lelong 1 tea hash
! 6153: >0x10040 lelong 2 yura hash
! 6154: >0x10040 lelong 3 r5 hash
! 6155:
! 6156: # JFFS - russell@coker.com.au
! 6157: 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
! 6158: 0 belong 0x34383931 Linux Journalled Flash File system, big endian
! 6159:
! 6160: # EST flat binary format (which isn't, but anyway)
! 6161: # From: Mark Brown <broonie@sirena.org.uk>
! 6162: 0 string ESTFBINR EST flat binary
! 6163:
! 6164: # Aculab VoIP firmware
! 6165: # From: Mark Brown <broonie@sirena.org.uk>
! 6166: 0 string VoIP\ Startup\ and Aculab VoIP firmware
! 6167: >35 string x format %s
! 6168:
! 6169: # u-boot/PPCBoot image file
! 6170: # From: Mark Brown <broonie@sirena.org.uk>
! 6171: 0 belong 0x27051956 u-boot/PPCBoot image
! 6172: >4 string PPCBoot
! 6173: >>12 string x version %s
! 6174:
! 6175: # JFFS2 file system
! 6176: 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
! 6177: 0 leshort 0x1985 Linux jffs2 filesystem data little endian
! 6178:
! 6179: # Squashfs
! 6180: 0 string sqsh Squashfs filesystem, big endian,
! 6181: >28 beshort x version %d.
! 6182: >30 beshort x \b%d,
! 6183: >28 beshort <3
! 6184: >>8 belong x %d bytes,
! 6185: >28 beshort >2
! 6186: >>63 bequad x %lld bytes,
! 6187: #>>67 belong x %d bytes,
! 6188: >4 belong x %d inodes,
! 6189: >28 beshort <2
! 6190: >>32 beshort x blocksize: %d bytes,
! 6191: >28 beshort >1
! 6192: >>51 belong x blocksize: %d bytes,
! 6193: >39 bedate x created: %s
! 6194: 0 string hsqs Squashfs filesystem, little endian,
! 6195: >28 leshort x version %d.
! 6196: >30 leshort x \b%d,
! 6197: >28 leshort <3
! 6198: >>8 lelong x %d bytes,
! 6199: >28 leshort >2
! 6200: >>63 lequad x %lld bytes,
! 6201: #>>63 lelong x %d bytes,
! 6202: >4 lelong x %d inodes,
! 6203: >28 leshort <2
! 6204: >>32 leshort x blocksize: %d bytes,
! 6205: >28 leshort >1
! 6206: >>51 lelong x blocksize: %d bytes,
! 6207: >39 ledate x created: %s
! 6208:
! 6209: 0 string td\000 floppy image data (TeleDisk)
! 6210:
! 6211: # AFS Dump Magic
! 6212: # From: Ty Sarna <tsarna@sarna.org>
! 6213: 0 string \x01\xb3\xa1\x13\x22 AFS Dump
! 6214: >&0 belong x (v%d)
! 6215: >>&0 byte 0x76
! 6216: >>>&0 belong x Vol %d,
! 6217: >>>>&0 byte 0x6e
! 6218: >>>>>&0 string x %s
! 6219: >>>>>>&1 byte 0x74
! 6220: >>>>>>>&0 beshort 2
! 6221: >>>>>>>>&4 bedate x on: %s
! 6222: >>>>>>>>&0 bedate =0 full dump
! 6223: >>>>>>>>&0 bedate !0 incremental since: %s
! 6224:
! 6225: #----------------------------------------------------------
! 6226: # VMS backup savesets - gerardo.cacciari@gmail.com
! 6227: #
! 6228: 4 string \x01\x00\x01\x00\x01\x00
! 6229: >(0.s+16) string \x01\x01
! 6230: >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
! 6231: >>>40 lelong x (block size %d,
! 6232: >>>49 string >\0 original name '%s',
! 6233: >>>2 short 1024 VAX generated)
! 6234: >>>2 short 2048 AXP generated)
! 6235: >>>2 short 4096 I64 generated)
! 6236:
! 6237: # Summary: Oracle Clustered Filesystem
! 6238: # Created by: Aaron Botsis <redhat@digitalmafia.org>
! 6239: 8 string OracleCFS Oracle Clustered Filesystem,
! 6240: >4 long x rev %d
! 6241: >0 long x \b.%d,
! 6242: >560 string x label: %.64s,
! 6243: >136 string x mountpoint: %.128s
! 6244:
! 6245: # Summary: Oracle ASM tagged volume
! 6246: # Created by: Aaron Botsis <redhat@digitalmafia.org>
! 6247: 32 string ORCLDISK Oracle ASM Volume,
! 6248: >40 string x Disk Name: %0.12s
! 6249: 32 string ORCLCLRD Oracle ASM Volume (cleared),
! 6250: >40 string x Disk Name: %0.12s
! 6251:
! 6252: # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
! 6253: 8 string OracleCFS Oracle Clustered Filesystem,
! 6254: >4 long x rev %d
! 6255: >0 long x \b.%d,
! 6256: >560 string x label: %.64s,
! 6257: >136 string x mountpoint: %.128s
! 6258:
! 6259: # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
! 6260: 32 string ORCLDISK Oracle ASM Volume,
! 6261: >40 string x Disk Name: %0.12s
! 6262: 32 string ORCLCLRD Oracle ASM Volume (cleared),
! 6263: >40 string x Disk Name: %0.12s
! 6264:
! 6265: # Compaq/HP RILOE floppy image
! 6266: # From: Dirk Jagdmann <doj@cubic.org>
! 6267: 0 string CPQRFBLO Compaq/HP RILOE floppy image
! 6268:
! 6269: #------------------------------------------------------------------------------
! 6270: # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com
! 6271: # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is
! 6272: # mapped to VBN 2 of [000000]INDEXF.SYS;1
! 6273: #
! 6274: 1008 string DECFILE11B Files-11 On-Disk Structure
! 6275: >525 byte x Level %d
! 6276: >525 byte x (ODS-%d OpenVMS file system),
! 6277: >984 string x volume label is '%-12.12s'
! 6278:
! 6279: # From: Thomas Klausner <wiz@NetBSD.org>
! 6280: # http://filext.com/file-extension/DAA
! 6281: # describes the daa file format. The magic would be:
! 6282: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
! 6283:
! 6284: # From Albert Cahalan <acahalan@gmail.com>
! 6285: # really le32 operation,destination,payloadsize (but quite predictable)
! 6286: # 01 00 00 00 00 00 00 c0 00 02 00 00
! 6287: 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
! 6288:
! 6289: # From Eric Sandeen
! 6290: # GFS2
! 6291: 0x10000 belong 0x01161970 GFS2 Filesystem
! 6292: >0x10024 belong x (blocksize %d,
! 6293: >0x10060 string >\0 lockproto %s)
! 6294:
! 6295: # dvdisaster's .ecc
! 6296: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 6297: 0 string *dvdisaster* dvdisaster error correction file
! 6298:
! 6299: # Type: CROM filesystem
! 6300: # From: Werner Fink <werner@suse.de>
! 6301: 0 string CROMFS CROMFS
! 6302: >6 string >\0 \b version %2.2s,
! 6303: >8 ulequad >0 \b block data at %lld,
! 6304: >16 ulequad >0 \b fblock table at %lld,
! 6305: >24 ulequad >0 \b inode table at %lld,
! 6306: >32 ulequad >0 \b root at %lld,
! 6307: >40 ulelong >0 \b fblock size = %ld,
! 6308: >44 ulelong >0 \b block size = %ld,
! 6309: >48 ulequad >0 \b bytes = %lld
! 6310:
! 6311: #------------------------------------------------------------------------------
! 6312: # flash: file(1) magic for Macromedia Flash file format
! 6313: #
! 6314: # See
! 6315: #
! 6316: # http://www.macromedia.com/software/flash/open/
! 6317: #
! 6318: 0 string FWS Macromedia Flash data,
! 6319: >3 byte x version %d
! 6320: !:mime application/x-shockwave-flash
! 6321: 0 string CWS Macromedia Flash data (compressed),
! 6322: !:mime application/x-shockwave-flash
! 6323: >3 byte x version %d
! 6324: # From: Cal Peake <cp@absolutedigital.net>
! 6325: 0 string FLV Macromedia Flash Video
! 6326: !:mime video/x-flv
! 6327:
! 6328: #
! 6329: # From Dave Wilson
! 6330: 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
! 6331: #------------------------------------------------------------------------------
! 6332: # fonts: file(1) magic for font data
! 6333: #
! 6334: 0 search/1 FONT ASCII vfont text
! 6335: 0 short 0436 Berkeley vfont data
! 6336: 0 short 017001 byte-swapped Berkeley vfont data
! 6337:
! 6338: # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
! 6339: 0 search/1 %!PS-AdobeFont-1. PostScript Type 1 font text
! 6340: >20 search/1 >\0 (%s)
! 6341: 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
! 6342:
! 6343: # X11 font files in SNF (Server Natural Format) format
! 6344: 0 belong 00000004 X11 SNF font data, MSB first
! 6345: 0 lelong 00000004 X11 SNF font data, LSB first
! 6346:
! 6347: # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
! 6348: 0 search/1 STARTFONT\ X11 BDF font text
! 6349:
! 6350: # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
! 6351: # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
! 6352: 0 string \001fcp X11 Portable Compiled Font data
! 6353: >12 byte 0x02 \b, LSB first
! 6354: >12 byte 0x0a \b, MSB first
! 6355: 0 string D1.0\015 X11 Speedo font data
! 6356:
! 6357: #------------------------------------------------------------------------------
! 6358: # FIGlet fonts and controlfiles
! 6359: # From figmagic supplied with Figlet version 2.2
! 6360: # "David E. O'Brien" <obrien@FreeBSD.ORG>
! 6361: 0 string flf FIGlet font
! 6362: >3 string >2a version %-2.2s
! 6363: 0 string flc FIGlet controlfile
! 6364: >3 string >2a version %-2.2s
! 6365:
! 6366: # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
! 6367: # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
! 6368: 0 belong 0x14025919 libGrx font data,
! 6369: >8 leshort x %dx
! 6370: >10 leshort x \b%d
! 6371: >40 string x %s
! 6372: # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
! 6373: 0 belong 0xff464f4e DOS code page font data collection
! 6374: 7 belong 0x00454741 DOS code page font data
! 6375: 7 belong 0x00564944 DOS code page font data (from Linux?)
! 6376: 4098 string DOSFONT DOSFONT2 encrypted font data
! 6377:
! 6378: # downloadable fonts for browser (prints type) anthon@mnt.org
! 6379: 0 string PFR1 PFR1 font
! 6380: >102 string >0 \b: %s
! 6381:
! 6382: # True Type fonts
! 6383: 0 string \000\001\000\000\000 TrueType font data
! 6384:
! 6385: 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
! 6386: 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
! 6387:
! 6388: # Opentype font data from Avi Bercovich
! 6389: 0 string OTTO OpenType font data
! 6390:
! 6391: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
! 6392: 0 string SplineFontDB: Spline Font Database
! 6393: >14 string x version %s
! 6394: # FORTRAN source
! 6395: 0 string/c c\ FORTRAN program
! 6396: !:mime text/x-fortran
! 6397: #------------------------------------------------------------------------------
! 6398: # frame: file(1) magic for FrameMaker files
! 6399: #
! 6400: # This stuff came on a FrameMaker demo tape, most of which is
! 6401: # copyright, but this file is "published" as witness the following:
! 6402: #
! 6403: # Note that this is the Framemaker Maker Interchange Format, not the
! 6404: # Normal format which would be application/vnd.framemaker.
! 6405: #
! 6406: 0 string \<MakerFile FrameMaker document
! 6407: !:mime application/x-mif
! 6408: >11 string 5.5 (5.5
! 6409: >11 string 5.0 (5.0
! 6410: >11 string 4.0 (4.0
! 6411: >11 string 3.0 (3.0
! 6412: >11 string 2.0 (2.0
! 6413: >11 string 1.0 (1.0
! 6414: >14 byte x %c)
! 6415: 0 string \<MIFFile FrameMaker MIF (ASCII) file
! 6416: !:mime application/x-mif
! 6417: >9 string 4.0 (4.0)
! 6418: >9 string 3.0 (3.0)
! 6419: >9 string 2.0 (2.0)
! 6420: >9 string 1.0 (1.x)
! 6421: 0 search/1 \<MakerDictionary FrameMaker Dictionary text
! 6422: !:mime application/x-mif
! 6423: >17 string 3.0 (3.0)
! 6424: >17 string 2.0 (2.0)
! 6425: >17 string 1.0 (1.x)
! 6426: 0 string \<MakerScreenFont FrameMaker Font file
! 6427: !:mime application/x-mif
! 6428: >17 string 1.01 (%s)
! 6429: 0 string \<MML FrameMaker MML file
! 6430: !:mime application/x-mif
! 6431: 0 string \<BookFile FrameMaker Book file
! 6432: !:mime application/x-mif
! 6433: >10 string 3.0 (3.0
! 6434: >10 string 2.0 (2.0
! 6435: >10 string 1.0 (1.0
! 6436: >13 byte x %c)
! 6437: # XXX - this book entry should be verified, if you find one, uncomment this
! 6438: #0 string \<Book\ FrameMaker Book (ASCII) file
! 6439: #!:mime application/x-mif
! 6440: #>6 string 3.0 (3.0)
! 6441: #>6 string 2.0 (2.0)
! 6442: #>6 string 1.0 (1.0)
! 6443: 0 string \<Maker Intermediate Print File FrameMaker IPL file
! 6444: !:mime application/x-mif
! 6445:
! 6446: #------------------------------------------------------------------------------
! 6447: # freebsd: file(1) magic for FreeBSD objects
! 6448: #
! 6449: # All new-style FreeBSD magic numbers are in host byte order (i.e.,
! 6450: # little-endian on x86).
! 6451: #
! 6452: # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
! 6453: # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
! 6454: # schemes for distinguishing between executable images, shared libraries,
! 6455: # and object files.
! 6456: #
! 6457: # FreeBSD says:
! 6458: #
! 6459: # Regardless of whether it's pure, demand-paged, or none of the
! 6460: # above:
! 6461: #
! 6462: # if the entry point is < 4096, then it's a shared library if
! 6463: # the "has run-time loader information" bit is set, and is
! 6464: # position-independent if the "is position-independent" bit
! 6465: # is set;
! 6466: #
! 6467: # if the entry point is >= 4096 (or >4095, same thing), then it's
! 6468: # an executable, and is dynamically-linked if the "has run-time
! 6469: # loader information" bit is set.
! 6470: #
! 6471: # On x86, NetBSD says:
! 6472: #
! 6473: # If it's neither pure nor demand-paged:
! 6474: #
! 6475: # if it has the "has run-time loader information" bit set, it's
! 6476: # a dynamically-linked executable;
! 6477: #
! 6478: # if it doesn't have that bit set, then:
! 6479: #
! 6480: # if it has the "is position-independent" bit set, it's
! 6481: # position-independent;
! 6482: #
! 6483: # if the entry point is non-zero, it's an executable, otherwise
! 6484: # it's an object file.
! 6485: #
! 6486: # If it's pure:
! 6487: #
! 6488: # if it has the "has run-time loader information" bit set, it's
! 6489: # a dynamically-linked executable, otherwise it's just an
! 6490: # executable.
! 6491: #
! 6492: # If it's demand-paged:
! 6493: #
! 6494: # if it has the "has run-time loader information" bit set,
! 6495: # then:
! 6496: #
! 6497: # if the entry point is < 4096, it's a shared library;
! 6498: #
! 6499: # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
! 6500: # it's a dynamically-linked executable);
! 6501: #
! 6502: # if it doesn't have the "has run-time loader information" bit
! 6503: # set, then it's just an executable.
! 6504: #
! 6505: # (On non-x86, NetBSD does much the same thing, except that it uses
! 6506: # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
! 6507: # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
! 6508: # had 8K pages; dunno about MIPS.)
! 6509: #
! 6510: # I suspect the two will differ only in perverse and uninteresting cases
! 6511: # ("shared" libraries that aren't demand-paged and whose pages probably
! 6512: # won't actually be shared, executables with entry points <4096).
! 6513: #
! 6514: # I leave it to those more familiar with FreeBSD and NetBSD to figure out
! 6515: # what the right answer is (although using ">4095", FreeBSD-style, is
! 6516: # probably better than separately checking for "=4096" and ">4096",
! 6517: # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
! 6518: # executables using the NetBSD technique.)
! 6519: #
! 6520: 0 lelong&0377777777 041400407 FreeBSD/i386
! 6521: >20 lelong <4096
! 6522: >>3 byte&0xC0 &0x80 shared library
! 6523: >>3 byte&0xC0 0x40 PIC object
! 6524: >>3 byte&0xC0 0x00 object
! 6525: >20 lelong >4095
! 6526: >>3 byte&0x80 0x80 dynamically linked executable
! 6527: >>3 byte&0x80 0x00 executable
! 6528: >16 lelong >0 not stripped
! 6529:
! 6530: 0 lelong&0377777777 041400410 FreeBSD/i386 pure
! 6531: >20 lelong <4096
! 6532: >>3 byte&0xC0 &0x80 shared library
! 6533: >>3 byte&0xC0 0x40 PIC object
! 6534: >>3 byte&0xC0 0x00 object
! 6535: >20 lelong >4095
! 6536: >>3 byte&0x80 0x80 dynamically linked executable
! 6537: >>3 byte&0x80 0x00 executable
! 6538: >16 lelong >0 not stripped
! 6539:
! 6540: 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
! 6541: >20 lelong <4096
! 6542: >>3 byte&0xC0 &0x80 shared library
! 6543: >>3 byte&0xC0 0x40 PIC object
! 6544: >>3 byte&0xC0 0x00 object
! 6545: >20 lelong >4095
! 6546: >>3 byte&0x80 0x80 dynamically linked executable
! 6547: >>3 byte&0x80 0x00 executable
! 6548: >16 lelong >0 not stripped
! 6549:
! 6550: 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
! 6551: >20 lelong <4096
! 6552: >>3 byte&0xC0 &0x80 shared library
! 6553: >>3 byte&0xC0 0x40 PIC object
! 6554: >>3 byte&0xC0 0x00 object
! 6555: >20 lelong >4095
! 6556: >>3 byte&0x80 0x80 dynamically linked executable
! 6557: >>3 byte&0x80 0x00 executable
! 6558: >16 lelong >0 not stripped
! 6559:
! 6560: # XXX gross hack to identify core files
! 6561: # cores start with a struct tss; we take advantage of the following:
! 6562: # byte 7: highest byte of the kernel stack pointer, always 0xfe
! 6563: # 8/9: kernel (ring 0) ss value, always 0x0010
! 6564: # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
! 6565: # 28: low order byte of the current PTD entry, always 0 since the
! 6566: # PTD is page-aligned
! 6567: #
! 6568: 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
! 6569: >1039 string >\0 from '%s'
! 6570:
! 6571: # /var/run/ld.so.hints
! 6572: # What are you laughing about?
! 6573: 0 lelong 011421044151 ld.so hints file (Little Endian
! 6574: >4 lelong >0 \b, version %d)
! 6575: >4 belong <1 \b)
! 6576: 0 belong 011421044151 ld.so hints file (Big Endian
! 6577: >4 belong >0 \b, version %d)
! 6578: >4 belong <1 \b)
! 6579:
! 6580: #
! 6581: # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
! 6582: #
! 6583: 0 string SCRSHOT_ scrshot(1) screenshot,
! 6584: >8 byte x version %d,
! 6585: >9 byte 2 %d bytes in header,
! 6586: >>10 byte x %d chars wide by
! 6587: >>11 byte x %d chars high
! 6588:
! 6589: #------------------------------------------------------------------------------
! 6590: # fsav: file(1) magic for datafellows fsav virus definition files
! 6591: # Anthon van der Neut (anthon@mnt.org)
! 6592:
! 6593: # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
! 6594: 0 beshort 0x1575 fsav macro virus signatures
! 6595: >8 leshort >0 (%d-
! 6596: >11 byte >0 \b%02d-
! 6597: >10 byte >0 \b%02d)
! 6598: # ftp://ftp.f-prot.com/pub/sign.zip
! 6599: #10 ubyte <12
! 6600: #>9 ubyte <32
! 6601: #>>8 ubyte 0x0a
! 6602: #>>>12 ubyte 0x07
! 6603: #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
! 6604: #>>>>10 byte 0 \b01-
! 6605: #>>>>10 byte 1 \b02-
! 6606: #>>>>10 byte 2 \b03-
! 6607: #>>>>10 byte 3 \b04-
! 6608: #>>>>10 byte 4 \b05-
! 6609: #>>>>10 byte 5 \b06-
! 6610: #>>>>10 byte 6 \b07-
! 6611: #>>>>10 byte 7 \b08-
! 6612: #>>>>10 byte 8 \b09-
! 6613: #>>>>10 byte 9 \b10-
! 6614: #>>>>10 byte 10 \b11-
! 6615: #>>>>10 byte 11 \b12-
! 6616: #>>>>9 ubyte >0 \b%02d)
! 6617: # ftp://ftp.f-prot.com/pub/sign2.zip
! 6618: #0 ubyte 0x62
! 6619: #>1 ubyte 0xF5
! 6620: #>>2 ubyte 0x1
! 6621: #>>>3 ubyte 0x1
! 6622: #>>>>4 ubyte 0x0e
! 6623: #>>>>>13 ubyte >0 fsav virus signatures
! 6624: #>>>>>>11 ubyte x size 0x%02x
! 6625: #>>>>>>12 ubyte x \b%02x
! 6626: #>>>>>>13 ubyte x \b%02x bytes
! 6627:
! 6628: # Joerg Jenderek: joerg dot jenderek at web dot de
! 6629: # http://www.clamav.net/doc/latest/html/node45.html
! 6630: # .cvd files start with a 512 bytes colon separated header
! 6631: # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
! 6632: # + gzipped tarball files
! 6633: 0 string ClamAV-VDB:
! 6634: >11 string >\0 Clam AntiVirus database %-.23s
! 6635: >>34 string :
! 6636: >>>35 string !: \b, version
! 6637: >>>>35 string x \b%-.1s
! 6638: >>>>>36 string !:
! 6639: >>>>>>36 string x \b%-.1s
! 6640: >>>>>>>37 string !:
! 6641: >>>>>>>>37 string x \b%-.1s
! 6642: >>>>>>>>>38 string !:
! 6643: >>>>>>>>>>38 string x \b%-.1s
! 6644: >512 string \037\213 \b, gzipped
! 6645: >769 string ustar\0 \b, tarred
! 6646:
! 6647: # Type: Grisoft AVG AntiVirus
! 6648: # From: David Newgas <david@newgas.net>
! 6649: 0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
! 6650: #------------------------------------------------------------------------------
! 6651: # games: file(1) for games
! 6652:
! 6653: # Fabio Bonelli <fabiobonelli@libero.it>
! 6654: # Quake II - III data files
! 6655: 0 string IDP2 Quake II 3D Model file,
! 6656: >20 long x %lu skin(s),
! 6657: >8 long x (%lu x
! 6658: >12 long x %lu),
! 6659: >40 long x %lu frame(s),
! 6660: >16 long x Frame size %lu bytes,
! 6661: >24 long x %lu vertices/frame,
! 6662: >28 long x %lu texture coordinates,
! 6663: >32 long x %lu triangles/frame
! 6664:
! 6665: 0 string IBSP Quake
! 6666: >4 long 0x26 II Map file (BSP)
! 6667: >4 long 0x2E III Map file (BSP)
! 6668:
! 6669: 0 string IDS2 Quake II SP2 sprite file
! 6670:
! 6671: #---------------------------------------------------------------------------
! 6672: # Doom and Quake
! 6673: # submitted by Nicolas Patrois
! 6674:
! 6675: 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
! 6676: # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
! 6677:
! 6678: 24 string LxD\ 203 Linuxdoom save
! 6679: >0 string x , name=%s
! 6680: >44 string x , world=%s
! 6681:
! 6682: # Quake
! 6683:
! 6684: 0 string PACK Quake I or II world or extension
! 6685:
! 6686: #0 string -1\x0a Quake I demo
! 6687: #>30 string x version %.4s
! 6688: #>61 string x level %s
! 6689:
! 6690: #0 string 5\x0a Quake I save
! 6691:
! 6692: # The levels
! 6693:
! 6694: # Quake 1
! 6695:
! 6696: 0 string 5\x0aIntroduction Quake I save: start Introduction
! 6697: 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
! 6698: 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
! 6699: 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
! 6700: 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
! 6701: 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
! 6702: 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
! 6703: 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
! 6704: 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
! 6705: 0 string 5\x0athe_Installation Quake I save: e2m1 The installation
! 6706: 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
! 6707: 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
! 6708: 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
! 6709: 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
! 6710: 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
! 6711: 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
! 6712: 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
! 6713: 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
! 6714: 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
! 6715: 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
! 6716: 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
! 6717: 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
! 6718: 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
! 6719: 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
! 6720: 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
! 6721: 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
! 6722: 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
! 6723: 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
! 6724: 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
! 6725: 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
! 6726: 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
! 6727: 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
! 6728:
! 6729: # Quake DeathMatch levels
! 6730:
! 6731: 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
! 6732: 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
! 6733: 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
! 6734: 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
! 6735: 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
! 6736: 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
! 6737:
! 6738: # Scourge of Armagon
! 6739:
! 6740: 0 string 5\x0aCommand_HQ Quake I save: start Command HQ
! 6741: 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
! 6742: 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
! 6743: 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
! 6744: 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
! 6745: 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
! 6746: 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
! 6747: 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
! 6748: 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
! 6749: 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
! 6750: 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
! 6751: 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
! 6752: 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
! 6753: 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
! 6754: 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
! 6755: 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
! 6756: 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
! 6757: 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
! 6758:
! 6759: # Malice
! 6760:
! 6761: 0 string 5\x0aThe_Academy Quake I save: start The academy
! 6762: 0 string 5\x0aThe_Lab Quake I save: d1 The lab
! 6763: 0 string 5\x0aArea_33 Quake I save: d1b Area 33
! 6764: 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
! 6765: 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
! 6766: 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
! 6767: 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
! 6768: 0 string 5\x0aArea44 Quake I save: d1c Area 44
! 6769: 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
! 6770: 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
! 6771: 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
! 6772: 0 string 5\x0aThe_Flood Quake I save: d5 The flood
! 6773: 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
! 6774: 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
! 6775: 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
! 6776: 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
! 6777: 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
! 6778: 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
! 6779: 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
! 6780: 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
! 6781: 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
! 6782:
! 6783: # Malice DeathMatch levels
! 6784:
! 6785: 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
! 6786: 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
! 6787: 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
! 6788: 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
! 6789: 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
! 6790: 0 string 5\x0aDOMINO Quake I save: ddm6 Domino
! 6791: 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
! 6792:
! 6793:
! 6794: 0 string MComprHD MAME CHD compressed hard disk image,
! 6795: >12 belong x version %lu
! 6796:
! 6797: # doom - submitted by Jon Dowland
! 6798:
! 6799: 0 string =IWAD doom main IWAD data
! 6800: >4 lelong x containing %d lumps
! 6801: 0 string =PWAD doom patch PWAD data
! 6802: >4 lelong x containing %d lumps
! 6803:
! 6804:
! 6805: # Summary: Warcraft 3 save
! 6806: # Extension: .w3g
! 6807: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 6808: 0 string Warcraft\ III\ recorded\ game %s
! 6809:
! 6810:
! 6811: # Summary: Warcraft 3 map
! 6812: # Extension: .w3m
! 6813: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 6814: 0 string HM3W Warcraft III map file
! 6815:
! 6816:
! 6817: # Summary: SGF Smart Game Format
! 6818: # Extension: .sgf
! 6819: # Reference: http://www.red-bean.com/sgf/
! 6820: # Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
! 6821: # Modified by (1): Abel Cheung (regex, more game format)
! 6822: # FIXME: Some games don't have GM (game type)
! 6823: 0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
! 6824: >2 search/0x200 GM[
! 6825: >>&0 string 1] (Go)
! 6826: >>&0 string 2] (Othello)
! 6827: >>&0 string 3] (chess)
! 6828: >>&0 string 4] (Gomoku+Renju)
! 6829: >>&0 string 5] (Nine Men's Morris)
! 6830: >>&0 string 6] (Backgammon)
! 6831: >>&0 string 7] (Chinese chess)
! 6832: >>&0 string 8] (Shogi)
! 6833: >>&0 string 9] (Lines of Action)
! 6834: >>&0 string 10] (Ataxx)
! 6835: >>&0 string 11] (Hex)
! 6836: >>&0 string 12] (Jungle)
! 6837: >>&0 string 13] (Neutron)
! 6838: >>&0 string 14] (Philosopher's Football)
! 6839: >>&0 string 15] (Quadrature)
! 6840: >>&0 string 16] (Trax)
! 6841: >>&0 string 17] (Tantrix)
! 6842: >>&0 string 18] (Amazons)
! 6843: >>&0 string 19] (Octi)
! 6844: >>&0 string 20] (Gess)
! 6845: >>&0 string 21] (Twixt)
! 6846: >>&0 string 22] (Zertz)
! 6847: >>&0 string 23] (Plateau)
! 6848: >>&0 string 24] (Yinsh)
! 6849: >>&0 string 25] (Punct)
! 6850: >>&0 string 26] (Gobblet)
! 6851: >>&0 string 27] (hive)
! 6852: >>&0 string 28] (Exxit)
! 6853: >>&0 string 29] (Hnefatal)
! 6854: >>&0 string 30] (Kuba)
! 6855: >>&0 string 31] (Tripples)
! 6856: >>&0 string 32] (Chase)
! 6857: >>&0 string 33] (Tumbling Down)
! 6858: >>&0 string 34] (Sahara)
! 6859: >>&0 string 35] (Byte)
! 6860: >>&0 string 36] (Focus)
! 6861: >>&0 string 37] (Dvonn)
! 6862: >>&0 string 38] (Tamsk)
! 6863: >>&0 string 39] (Gipf)
! 6864: >>&0 string 40] (Kropki)
! 6865:
! 6866:
! 6867: # Summary: Civilization 4 video
! 6868: # Extension: .bik
! 6869: # Created by: Abel Cheung <abelcheung@gmail.com>
! 6870: 0 string BIKi Civilization 4 Video
! 6871:
! 6872:
! 6873: ##############################################
! 6874: # NetImmerse/Gamebryo game engine entries
! 6875:
! 6876: # Summary: Gamebryo game engine file
! 6877: # Extension: .nif, .kf
! 6878: # Created by: Abel Cheung <abelcheung@gmail.com>
! 6879: 0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file
! 6880: >&0 regex [0-9a-z.]+ \b, version %s
! 6881:
! 6882: # Summary: Gamebryo game engine file
! 6883: # Extension: .kfm
! 6884: # Created by: Abel Cheung <abelcheung@gmail.com>
! 6885: 0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File
! 6886: >&0 regex [0-9a-z.]+ \b, version %s
! 6887:
! 6888: # Summary: NetImmerse game engine file
! 6889: # Extension .nif
! 6890: # Created by: Abel Cheung <abelcheung@gmail.com>
! 6891: 0 string NetImmerse\ File\ Format,\ Versio
! 6892: >&0 string n\ NetImmerse game engine file
! 6893: >>&0 regex [0-9a-z.]+ \b, version %s
! 6894:
! 6895: # Type: SGF Smart Game Format
! 6896: # URL: http://www.red-bean.com/sgf/
! 6897: # From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
! 6898: 2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
! 6899: >2 regex/c GM\\[1\\] - Go Game
! 6900: >2 regex/c GM\\[6\\] - BackGammon Game
! 6901: >2 regex/c GM\\[11\\] - Hex Game
! 6902: >2 regex/c GM\\[18\\] - Amazons Game
! 6903: >2 regex/c GM\\[19\\] - Octi Game
! 6904: >2 regex/c GM\\[20\\] - Gess Game
! 6905: >2 regex/c GM\\[21\\] - twix Game
! 6906:
! 6907: #------------------------------------------------------------------------------
! 6908: # gcc: file(1) magic for GCC special files
! 6909: #
! 6910: 0 string gpch GCC precompiled header
! 6911:
! 6912: # The version field is annoying. It's 3 characters, not zero-terminated.
! 6913: >5 byte x (version %c
! 6914: >6 byte x \b%c
! 6915: >7 byte x \b%c)
! 6916:
! 6917: # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
! 6918: >4 byte 67 for C
! 6919: >4 byte 111 for Objective C
! 6920: >4 byte 43 for C++
! 6921: >4 byte 79 for Objective C++
! 6922:
! 6923: #------------------------------------------------------------------------------
! 6924: # GEOS files (Vidar Madsen, vidar@gimp.org)
! 6925: # semi-commonly used in embedded and handheld systems.
! 6926: 0 belong 0xc745c153 GEOS
! 6927: >40 byte 1 executable
! 6928: >40 byte 2 VMFile
! 6929: >40 byte 3 binary
! 6930: >40 byte 4 directory label
! 6931: >40 byte <1 unknown
! 6932: >40 byte >4 unknown
! 6933: >4 string >\0 \b, name "%s"
! 6934: #>44 short x \b, version %d
! 6935: #>46 short x \b.%d
! 6936: #>48 short x \b, rev %d
! 6937: #>50 short x \b.%d
! 6938: #>52 short x \b, proto %d
! 6939: #>54 short x \br%d
! 6940: #>168 string >\0 \b, copyright "%s"
! 6941: #------------------------------------------------------------------------------
! 6942: # GIMP Gradient: file(1) magic for the GIMP's gradient data files
! 6943: # by Federico Mena <federico@nuclecu.unam.mx>
! 6944:
! 6945: 0 string GIMP\ Gradient GIMP gradient data
! 6946:
! 6947: #------------------------------------------------------------------------------
! 6948: # XCF: file(1) magic for the XCF image format used in the GIMP developed
! 6949: # by Spencer Kimball and Peter Mattis
! 6950: # ('Bucky' LaDieu, nega@vt.edu)
! 6951:
! 6952: 0 string gimp\ xcf GIMP XCF image data,
! 6953: >9 string file version 0,
! 6954: >9 string v version
! 6955: >>10 string >\0 %s,
! 6956: >14 belong x %lu x
! 6957: >18 belong x %lu,
! 6958: >22 belong 0 RGB Color
! 6959: >22 belong 1 Greyscale
! 6960: >22 belong 2 Indexed Color
! 6961: >22 belong >2 Unknown Image Type.
! 6962:
! 6963: #------------------------------------------------------------------------------
! 6964: # XCF: file(1) magic for the patterns used in the GIMP, developed
! 6965: # by Spencer Kimball and Peter Mattis
! 6966: # ('Bucky' LaDieu, nega@vt.edu)
! 6967:
! 6968: 20 string GPAT GIMP pattern data,
! 6969: >24 string x %s
! 6970:
! 6971: #------------------------------------------------------------------------------
! 6972: # XCF: file(1) magic for the brushes used in the GIMP, developed
! 6973: # by Spencer Kimball and Peter Mattis
! 6974: # ('Bucky' LaDieu, nega@vt.edu)
! 6975:
! 6976: 20 string GIMP GIMP brush data
! 6977:
! 6978: # GIMP Curves File
! 6979: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 6980: 0 string #\040GIMP\040Curves\040File GIMP curve file
! 6981: # GNOME keyring
! 6982: # Contributed by Josh Triplett
! 6983: # FIXME: Could be simplified if pstring supported two-byte counts
! 6984: 0 string GnomeKeyring\n\r\0\n GNOME keyring
! 6985: >&0 ubyte 0 \b, major version 0
! 6986: >>&0 ubyte 0 \b, minor version 0
! 6987: >>>&0 ubyte 0 \b, crypto type 0 (AEL)
! 6988: >>>&0 ubyte >0 \b, crypto type %hhu (unknown)
! 6989: >>>&1 ubyte 0 \b, hash type 0 (MD5)
! 6990: >>>&1 ubyte >0 \b, hash type %hhu (unknown)
! 6991: >>>&2 ubelong 0xFFFFFFFF \b, name NULL
! 6992: >>>&2 ubelong !0xFFFFFFFF
! 6993: >>>>&-4 ubelong >255 \b, name too long for file's pstring type
! 6994: >>>>&-4 ubelong <256
! 6995: >>>>>&-1 pstring x \b, name "%s"
! 6996: >>>>>>&0 ubeqdate x \b, last modified %s
! 6997: >>>>>>&8 ubeqdate x \b, created %s
! 6998: >>>>>>&16 ubelong &1
! 6999: >>>>>>>&0 ubelong x \b, locked if idle for %u seconds
! 7000: >>>>>>&16 ubelong ^1 \b, not locked if idle
! 7001: >>>>>>&24 ubelong x \b, hash iterations %u
! 7002: >>>>>>&28 ubequad x \b, salt %llu
! 7003: >>>>>>&52 ubelong x \b, %u item(s)
! 7004: #------------------------------------------------------------------------------
! 7005: # gnu: file(1) magic for various GNU tools
! 7006: #
! 7007: # GNU nlsutils message catalog file format
! 7008: #
! 7009: 0 string \336\22\4\225 GNU message catalog (little endian),
! 7010: >4 lelong x revision %d,
! 7011: >8 lelong x %d messages
! 7012: 0 string \225\4\22\336 GNU message catalog (big endian),
! 7013: >4 belong x revision %d,
! 7014: >8 belong x %d messages
! 7015: # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
! 7016: 0 string *nazgul* Nazgul style compiled message catalog
! 7017: >8 lelong >0 \b, version %ld
! 7018:
! 7019: # GnuPG
! 7020: # The format is very similar to pgp
! 7021: 0 string \001gpg GPG key trust database
! 7022: >4 byte x version %d
! 7023: # Note: magic.mime had 0x8501 for the next line instead of 0x8502
! 7024: 0 beshort 0x8502 GPG encrypted data
! 7025: !:mime text/PGP # encoding: data
! 7026:
! 7027: # This magic is not particularly good, as the keyrings don't have true
! 7028: # magic. Nevertheless, it covers many keyrings.
! 7029: 0 beshort 0x9901 GPG key public ring
! 7030: !:mime application/x-gnupg-keyring
! 7031:
! 7032: # Gnumeric spreadsheet
! 7033: # This entry is only semi-helpful, as Gnumeric compresses its files, so
! 7034: # they will ordinarily reported as "compressed", but at least -z helps
! 7035: 39 string =<gmr:Workbook Gnumeric spreadsheet
! 7036:
! 7037: # From: James Youngman <jay@gnu.org>
! 7038: # gnu find magic
! 7039: 0 string \0LOCATE GNU findutils locate database data
! 7040: >7 string >\0 \b, format %s
! 7041: >7 string 02 \b (frcode)
! 7042:
! 7043: # Files produced by GNU gettext
! 7044: 0 long 0xDE120495 GNU-format message catalog data
! 7045: 0 long 0x950412DE GNU-format message catalog data
! 7046:
! 7047: #------------------------------------------------------------------------------
! 7048: # gnumeric: file(1) magic for Gnumeric spreadsheet
! 7049: # This entry is only semi-helpful, as Gnumeric compresses its files, so
! 7050: # they will ordinarily reported as "compressed", but at least -z helps
! 7051: 39 string =<gmr:Workbook Gnumeric spreadsheet
! 7052: !:mime application/x-gnumeric
! 7053:
! 7054: #------------------------------------------------------------------------------
! 7055: # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
! 7056: #
! 7057: # ACE/gr binary
! 7058: 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
! 7059: >39 byte >0 - version %c
! 7060: # ACE/gr ascii
! 7061: 0 string #\ xvgr\ parameter\ file ACE/gr ascii file
! 7062: 0 string #\ xmgr\ parameter\ file ACE/gr ascii file
! 7063: 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
! 7064: # Grace projects
! 7065: 0 string #\ Grace\ project\ file Grace project file
! 7066: >23 string @version\ (version
! 7067: >>32 byte >0 %c
! 7068: >>33 string >\0 \b.%.2s
! 7069: >>35 string >\0 \b.%.2s)
! 7070: # ACE/gr fit description files
! 7071: 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
! 7072: # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
! 7073:
! 7074: #------------------------------------------------------------------------------
! 7075: # graphviz: file(1) magic for http://www.graphviz.org/
! 7076: 0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]*.*\\{ graphviz graph text
! 7077: !:mime text/vnd.graphviz
! 7078: 0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]*.*\\{ graphviz digraph text
! 7079: !:mime text/vnd.graphviz
! 7080:
! 7081: #------------------------------------------------------------------------------
! 7082: # gringotts: file(1) magic for Gringotts
! 7083: # http://devel.pluto.linux.it/projects/Gringotts/
! 7084: # author: Germano Rizzo <mano@pluto.linux.it>
! 7085: #GRG3????Y
! 7086: 0 string GRG Gringotts data file
! 7087: #file format 1
! 7088: >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
! 7089: #file format 2
! 7090: >3 string 2 v.2, MCRYPT S2K,
! 7091: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
! 7092: >>8 byte&0x70 0x10 SERPENT crypt,
! 7093: >>8 byte&0x70 0x20 TWOFISH crypt,
! 7094: >>8 byte&0x70 0x30 CAST-256 crypt,
! 7095: >>8 byte&0x70 0x40 SAFER+ crypt,
! 7096: >>8 byte&0x70 0x50 LOKI97 crypt,
! 7097: >>8 byte&0x70 0x60 3DES crypt,
! 7098: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
! 7099: >>8 byte&0x08 0x00 SHA1 hash,
! 7100: >>8 byte&0x08 0x08 RIPEMD-160 hash,
! 7101: >>8 byte&0x04 0x00 ZLib
! 7102: >>8 byte&0x04 0x04 BZip2
! 7103: >>8 byte&0x03 0x00 lvl.0
! 7104: >>8 byte&0x03 0x01 lvl.3
! 7105: >>8 byte&0x03 0x02 lvl.6
! 7106: >>8 byte&0x03 0x03 lvl.9
! 7107: #file format 3
! 7108: >3 string 3 v.3, OpenPGP S2K,
! 7109: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
! 7110: >>8 byte&0x70 0x10 SERPENT crypt,
! 7111: >>8 byte&0x70 0x20 TWOFISH crypt,
! 7112: >>8 byte&0x70 0x30 CAST-256 crypt,
! 7113: >>8 byte&0x70 0x40 SAFER+ crypt,
! 7114: >>8 byte&0x70 0x50 LOKI97 crypt,
! 7115: >>8 byte&0x70 0x60 3DES crypt,
! 7116: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
! 7117: >>8 byte&0x08 0x00 SHA1 hash,
! 7118: >>8 byte&0x08 0x08 RIPEMD-160 hash,
! 7119: >>8 byte&0x04 0x00 ZLib
! 7120: >>8 byte&0x04 0x04 BZip2
! 7121: >>8 byte&0x03 0x00 lvl.0
! 7122: >>8 byte&0x03 0x01 lvl.3
! 7123: >>8 byte&0x03 0x02 lvl.6
! 7124: >>8 byte&0x03 0x03 lvl.9
! 7125: #file format >3
! 7126: >3 string >3 v.%.1s (unknown details)
! 7127:
! 7128: #------------------------------------------------------------------------------
! 7129: # hitach-sh: file(1) magic for Hitachi Super-H
! 7130: #
! 7131: # Super-H COFF
! 7132: #
! 7133: 0 beshort 0x0500 Hitachi SH big-endian COFF
! 7134: >18 beshort&0x0002 =0x0000 object
! 7135: >18 beshort&0x0002 =0x0002 executable
! 7136: >18 beshort&0x0008 =0x0008 \b, stripped
! 7137: >18 beshort&0x0008 =0x0000 \b, not stripped
! 7138: #
! 7139: 0 leshort 0x0550 Hitachi SH little-endian COFF
! 7140: >18 leshort&0x0002 =0x0000 object
! 7141: >18 leshort&0x0002 =0x0002 executable
! 7142: >18 leshort&0x0008 =0x0008 \b, stripped
! 7143: >18 leshort&0x0008 =0x0000 \b, not stripped
! 7144:
! 7145: #------------------------------------------------------------------------------
! 7146: # hp: file(1) magic for Hewlett Packard machines (see also "printer")
! 7147: #
! 7148: # XXX - somebody should figure out whether any byte order needs to be
! 7149: # applied to the "TML" stuff; I'm assuming the Apollo stuff is
! 7150: # big-endian as it was mostly 68K-based.
! 7151: #
! 7152: # I think the 500 series was the old stack-based machines, running a
! 7153: # UNIX environment atop the "SUN kernel"; dunno whether it was
! 7154: # big-endian or little-endian.
! 7155: #
! 7156: # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
! 7157: # hp300 are 68020+68881 based; hp400 are also 68k. The following basic
! 7158: # HP magic is useful for reference, but using "long" magic is a better
! 7159: # practice in order to avoid collisions.
! 7160: #
! 7161: # Guy Harris (guy@netapp.com): some additions to this list came from
! 7162: # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
! 7163: # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
! 7164: # "/etc/magic", though, except for the "archive file relocatable library"
! 7165: # stuff, and the 68030 and 68040 stuff isn't there at all - are they not
! 7166: # used in executables, or have they just not yet updated "/etc/magic"
! 7167: # completely?
! 7168: #
! 7169: # 0 beshort 200 hp200 (68010) BSD binary
! 7170: # 0 beshort 300 hp300 (68020+68881) BSD binary
! 7171: # 0 beshort 0x20c hp200/300 HP-UX binary
! 7172: # 0 beshort 0x20d hp400 (68030) HP-UX binary
! 7173: # 0 beshort 0x20e hp400 (68040?) HP-UX binary
! 7174: # 0 beshort 0x20b PA-RISC1.0 HP-UX binary
! 7175: # 0 beshort 0x210 PA-RISC1.1 HP-UX binary
! 7176: # 0 beshort 0x211 PA-RISC1.2 HP-UX binary
! 7177: # 0 beshort 0x214 PA-RISC2.0 HP-UX binary
! 7178:
! 7179: #
! 7180: # The "misc" stuff needs a byte order; the archives look suspiciously
! 7181: # like the old 177545 archives (0xff65 = 0177545).
! 7182: #
! 7183: #### Old Apollo stuff
! 7184: 0 beshort 0627 Apollo m68k COFF executable
! 7185: >18 beshort ^040000 not stripped
! 7186: >22 beshort >0 - version %ld
! 7187: 0 beshort 0624 apollo a88k COFF executable
! 7188: >18 beshort ^040000 not stripped
! 7189: >22 beshort >0 - version %ld
! 7190: 0 long 01203604016 TML 0123 byte-order format
! 7191: 0 long 01702407010 TML 1032 byte-order format
! 7192: 0 long 01003405017 TML 2301 byte-order format
! 7193: 0 long 01602007412 TML 3210 byte-order format
! 7194: #### PA-RISC 1.1
! 7195: 0 belong 0x02100106 PA-RISC1.1 relocatable object
! 7196: 0 belong 0x02100107 PA-RISC1.1 executable
! 7197: >168 belong &0x00000004 dynamically linked
! 7198: >(144) belong 0x054ef630 dynamically linked
! 7199: >96 belong >0 - not stripped
! 7200:
! 7201: 0 belong 0x02100108 PA-RISC1.1 shared executable
! 7202: >168 belong&0x4 0x4 dynamically linked
! 7203: >(144) belong 0x054ef630 dynamically linked
! 7204: >96 belong >0 - not stripped
! 7205:
! 7206: 0 belong 0x0210010b PA-RISC1.1 demand-load executable
! 7207: >168 belong&0x4 0x4 dynamically linked
! 7208: >(144) belong 0x054ef630 dynamically linked
! 7209: >96 belong >0 - not stripped
! 7210:
! 7211: 0 belong 0x0210010e PA-RISC1.1 shared library
! 7212: >96 belong >0 - not stripped
! 7213:
! 7214: 0 belong 0x0210010d PA-RISC1.1 dynamic load library
! 7215: >96 belong >0 - not stripped
! 7216:
! 7217: #### PA-RISC 2.0
! 7218: 0 belong 0x02140106 PA-RISC2.0 relocatable object
! 7219:
! 7220: 0 belong 0x02140107 PA-RISC2.0 executable
! 7221: >168 belong &0x00000004 dynamically linked
! 7222: >(144) belong 0x054ef630 dynamically linked
! 7223: >96 belong >0 - not stripped
! 7224:
! 7225: 0 belong 0x02140108 PA-RISC2.0 shared executable
! 7226: >168 belong &0x00000004 dynamically linked
! 7227: >(144) belong 0x054ef630 dynamically linked
! 7228: >96 belong >0 - not stripped
! 7229:
! 7230: 0 belong 0x0214010b PA-RISC2.0 demand-load executable
! 7231: >168 belong &0x00000004 dynamically linked
! 7232: >(144) belong 0x054ef630 dynamically linked
! 7233: >96 belong >0 - not stripped
! 7234:
! 7235: 0 belong 0x0214010e PA-RISC2.0 shared library
! 7236: >96 belong >0 - not stripped
! 7237:
! 7238: 0 belong 0x0214010d PA-RISC2.0 dynamic load library
! 7239: >96 belong >0 - not stripped
! 7240:
! 7241: #### 800
! 7242: 0 belong 0x020b0106 PA-RISC1.0 relocatable object
! 7243:
! 7244: 0 belong 0x020b0107 PA-RISC1.0 executable
! 7245: >168 belong&0x4 0x4 dynamically linked
! 7246: >(144) belong 0x054ef630 dynamically linked
! 7247: >96 belong >0 - not stripped
! 7248:
! 7249: 0 belong 0x020b0108 PA-RISC1.0 shared executable
! 7250: >168 belong&0x4 0x4 dynamically linked
! 7251: >(144) belong 0x054ef630 dynamically linked
! 7252: >96 belong >0 - not stripped
! 7253:
! 7254: 0 belong 0x020b010b PA-RISC1.0 demand-load executable
! 7255: >168 belong&0x4 0x4 dynamically linked
! 7256: >(144) belong 0x054ef630 dynamically linked
! 7257: >96 belong >0 - not stripped
! 7258:
! 7259: 0 belong 0x020b010e PA-RISC1.0 shared library
! 7260: >96 belong >0 - not stripped
! 7261:
! 7262: 0 belong 0x020b010d PA-RISC1.0 dynamic load library
! 7263: >96 belong >0 - not stripped
! 7264:
! 7265: 0 belong 0x213c6172 archive file
! 7266: >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
! 7267: >68 belong 0x02100619 - PA-RISC1.1 relocatable library
! 7268: >68 belong 0x02110619 - PA-RISC1.2 relocatable library
! 7269: >68 belong 0x02140619 - PA-RISC2.0 relocatable library
! 7270:
! 7271: #### 500
! 7272: 0 long 0x02080106 HP s500 relocatable executable
! 7273: >16 long >0 - version %ld
! 7274:
! 7275: 0 long 0x02080107 HP s500 executable
! 7276: >16 long >0 - version %ld
! 7277:
! 7278: 0 long 0x02080108 HP s500 pure executable
! 7279: >16 long >0 - version %ld
! 7280:
! 7281: #### 200
! 7282: 0 belong 0x020c0108 HP s200 pure executable
! 7283: >4 beshort >0 - version %ld
! 7284: >8 belong &0x80000000 save fp regs
! 7285: >8 belong &0x40000000 dynamically linked
! 7286: >8 belong &0x20000000 debuggable
! 7287: >36 belong >0 not stripped
! 7288:
! 7289: 0 belong 0x020c0107 HP s200 executable
! 7290: >4 beshort >0 - version %ld
! 7291: >8 belong &0x80000000 save fp regs
! 7292: >8 belong &0x40000000 dynamically linked
! 7293: >8 belong &0x20000000 debuggable
! 7294: >36 belong >0 not stripped
! 7295:
! 7296: 0 belong 0x020c010b HP s200 demand-load executable
! 7297: >4 beshort >0 - version %ld
! 7298: >8 belong &0x80000000 save fp regs
! 7299: >8 belong &0x40000000 dynamically linked
! 7300: >8 belong &0x20000000 debuggable
! 7301: >36 belong >0 not stripped
! 7302:
! 7303: 0 belong 0x020c0106 HP s200 relocatable executable
! 7304: >4 beshort >0 - version %ld
! 7305: >6 beshort >0 - highwater %d
! 7306: >8 belong &0x80000000 save fp regs
! 7307: >8 belong &0x20000000 debuggable
! 7308: >8 belong &0x10000000 PIC
! 7309:
! 7310: 0 belong 0x020a0108 HP s200 (2.x release) pure executable
! 7311: >4 beshort >0 - version %ld
! 7312: >36 belong >0 not stripped
! 7313:
! 7314: 0 belong 0x020a0107 HP s200 (2.x release) executable
! 7315: >4 beshort >0 - version %ld
! 7316: >36 belong >0 not stripped
! 7317:
! 7318: 0 belong 0x020c010e HP s200 shared library
! 7319: >4 beshort >0 - version %ld
! 7320: >6 beshort >0 - highwater %d
! 7321: >36 belong >0 not stripped
! 7322:
! 7323: 0 belong 0x020c010d HP s200 dynamic load library
! 7324: >4 beshort >0 - version %ld
! 7325: >6 beshort >0 - highwater %d
! 7326: >36 belong >0 not stripped
! 7327:
! 7328: #### MISC
! 7329: 0 long 0x0000ff65 HP old archive
! 7330: 0 long 0x020aff65 HP s200 old archive
! 7331: 0 long 0x020cff65 HP s200 old archive
! 7332: 0 long 0x0208ff65 HP s500 old archive
! 7333:
! 7334: 0 long 0x015821a6 HP core file
! 7335:
! 7336: 0 long 0x4da7eee8 HP-WINDOWS font
! 7337: >8 byte >0 - version %ld
! 7338: 0 string Bitmapfile HP Bitmapfile
! 7339:
! 7340: 0 string IMGfile CIS compimg HP Bitmapfile
! 7341: # XXX - see "lif"
! 7342: #0 short 0x8000 lif file
! 7343: 0 long 0x020c010c compiled Lisp
! 7344:
! 7345: 0 string msgcat01 HP NLS message catalog,
! 7346: >8 long >0 %d messages
! 7347:
! 7348: # Summary: HP-48/49 calculator
! 7349: # Created by: phk@data.fls.dk
! 7350: # Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
! 7351: # Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
! 7352: 0 string HPHP HP
! 7353: >4 string 48 48 binary
! 7354: >4 string 49 49 binary
! 7355: >7 byte >64 - Rev %c
! 7356: >8 leshort 0x2911 (ADR)
! 7357: >8 leshort 0x2933 (REAL)
! 7358: >8 leshort 0x2955 (LREAL)
! 7359: >8 leshort 0x2977 (COMPLX)
! 7360: >8 leshort 0x299d (LCOMPLX)
! 7361: >8 leshort 0x29bf (CHAR)
! 7362: >8 leshort 0x29e8 (ARRAY)
! 7363: >8 leshort 0x2a0a (LNKARRAY)
! 7364: >8 leshort 0x2a2c (STRING)
! 7365: >8 leshort 0x2a4e (HXS)
! 7366: >8 leshort 0x2a74 (LIST)
! 7367: >8 leshort 0x2a96 (DIR)
! 7368: >8 leshort 0x2ab8 (ALG)
! 7369: >8 leshort 0x2ada (UNIT)
! 7370: >8 leshort 0x2afc (TAGGED)
! 7371: >8 leshort 0x2b1e (GROB)
! 7372: >8 leshort 0x2b40 (LIB)
! 7373: >8 leshort 0x2b62 (BACKUP)
! 7374: >8 leshort 0x2b88 (LIBDATA)
! 7375: >8 leshort 0x2d9d (PROG)
! 7376: >8 leshort 0x2dcc (CODE)
! 7377: >8 leshort 0x2e48 (GNAME)
! 7378: >8 leshort 0x2e6d (LNAME)
! 7379: >8 leshort 0x2e92 (XLIB)
! 7380:
! 7381: 0 string %%HP: HP text
! 7382: >6 string T(0) - T(0)
! 7383: >6 string T(1) - T(1)
! 7384: >6 string T(2) - T(2)
! 7385: >6 string T(3) - T(3)
! 7386: >10 string A(D) A(D)
! 7387: >10 string A(R) A(R)
! 7388: >10 string A(G) A(G)
! 7389: >14 string F(.) F(.);
! 7390: >14 string F(,) F(,);
! 7391:
! 7392:
! 7393: # Summary: HP-38/39 calculator
! 7394: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
! 7395: 0 string HP3
! 7396: >3 string 8 HP 38
! 7397: >3 string 9 HP 39
! 7398: >4 string Bin binary
! 7399: >4 string Asc ASCII
! 7400: >7 string A (Directory List)
! 7401: >7 string B (Zaplet)
! 7402: >7 string C (Note)
! 7403: >7 string D (Program)
! 7404: >7 string E (Variable)
! 7405: >7 string F (List)
! 7406: >7 string G (Matrix)
! 7407: >7 string H (Library)
! 7408: >7 string I (Target List)
! 7409: >7 string J (ASCII Vector specification)
! 7410: >7 string K (wildcard)
! 7411:
! 7412: # Summary: HP-38/39 calculator
! 7413: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
! 7414: 0 string HP3
! 7415: >3 string 8 HP 38
! 7416: >3 string 9 HP 39
! 7417: >4 string Bin binary
! 7418: >4 string Asc ASCII
! 7419: >7 string A (Directory List)
! 7420: >7 string B (Zaplet)
! 7421: >7 string C (Note)
! 7422: >7 string D (Program)
! 7423: >7 string E (Variable)
! 7424: >7 string F (List)
! 7425: >7 string G (Matrix)
! 7426: >7 string H (Library)
! 7427: >7 string I (Target List)
! 7428: >7 string J (ASCII Vector specification)
! 7429: >7 string K (wildcard)
! 7430:
! 7431: # hpBSD magic numbers
! 7432: 0 beshort 200 hp200 (68010) BSD
! 7433: >2 beshort 0407 impure binary
! 7434: >2 beshort 0410 read-only binary
! 7435: >2 beshort 0413 demand paged binary
! 7436: 0 beshort 300 hp300 (68020+68881) BSD
! 7437: >2 beshort 0407 impure binary
! 7438: >2 beshort 0410 read-only binary
! 7439: >2 beshort 0413 demand paged binary
! 7440: #
! 7441: # From David Gero <dgero@nortelnetworks.com>
! 7442: # HP-UX 10.20 core file format from /usr/include/sys/core.h
! 7443: # Unfortunately, HP-UX uses corehead blocks without specifying the order
! 7444: # There are four we care about:
! 7445: # CORE_KERNEL, which starts with the string "HP-UX"
! 7446: # CORE_EXEC, which contains the name of the command
! 7447: # CORE_PROC, which contains the signal number that caused the core dump
! 7448: # CORE_FORMAT, which contains the version of the core file format (== 1)
! 7449: # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
! 7450: # but we include all 6 variations of the order of the first 3, and
! 7451: # assume that PROC will always be last
! 7452: # Order 1: KERNEL, EXEC, FORMAT, PROC
! 7453: 0x10 string HP-UX
! 7454: >0 belong 2
! 7455: >>0xC belong 0x3C
! 7456: >>>0x4C belong 0x100
! 7457: >>>>0x58 belong 0x44
! 7458: >>>>>0xA0 belong 1
! 7459: >>>>>>0xAC belong 4
! 7460: >>>>>>>0xB0 belong 1
! 7461: >>>>>>>>0xB4 belong 4 core file
! 7462: >>>>>>>>>0x90 string >\0 from '%s'
! 7463: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7464: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7465: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7466: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7467: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7468: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7469: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7470: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7471: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7472: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7473: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7474: # Order 2: KERNEL, FORMAT, EXEC, PROC
! 7475: >>>0x4C belong 1
! 7476: >>>>0x58 belong 4
! 7477: >>>>>0x5C belong 1
! 7478: >>>>>>0x60 belong 0x100
! 7479: >>>>>>>0x6C belong 0x44
! 7480: >>>>>>>>0xB4 belong 4 core file
! 7481: >>>>>>>>>0xA4 string >\0 from '%s'
! 7482: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7483: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7484: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7485: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7486: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7487: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7488: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7489: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7490: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7491: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7492: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7493: # Order 3: FORMAT, KERNEL, EXEC, PROC
! 7494: 0x24 string HP-UX
! 7495: >0 belong 1
! 7496: >>0xC belong 4
! 7497: >>>0x10 belong 1
! 7498: >>>>0x14 belong 2
! 7499: >>>>>0x20 belong 0x3C
! 7500: >>>>>>0x60 belong 0x100
! 7501: >>>>>>>0x6C belong 0x44
! 7502: >>>>>>>>0xB4 belong 4 core file
! 7503: >>>>>>>>>0xA4 string >\0 from '%s'
! 7504: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7505: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7506: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7507: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7508: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7509: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7510: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7511: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7512: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7513: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7514: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7515: # Order 4: EXEC, KERNEL, FORMAT, PROC
! 7516: 0x64 string HP-UX
! 7517: >0 belong 0x100
! 7518: >>0xC belong 0x44
! 7519: >>>0x54 belong 2
! 7520: >>>>0x60 belong 0x3C
! 7521: >>>>>0xA0 belong 1
! 7522: >>>>>>0xAC belong 4
! 7523: >>>>>>>0xB0 belong 1
! 7524: >>>>>>>>0xB4 belong 4 core file
! 7525: >>>>>>>>>0x44 string >\0 from '%s'
! 7526: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7527: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7528: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7529: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7530: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7531: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7532: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7533: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7534: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7535: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7536: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7537: # Order 5: FORMAT, EXEC, KERNEL, PROC
! 7538: 0x78 string HP-UX
! 7539: >0 belong 1
! 7540: >>0xC belong 4
! 7541: >>>0x10 belong 1
! 7542: >>>>0x14 belong 0x100
! 7543: >>>>>0x20 belong 0x44
! 7544: >>>>>>0x68 belong 2
! 7545: >>>>>>>0x74 belong 0x3C
! 7546: >>>>>>>>0xB4 belong 4 core file
! 7547: >>>>>>>>>0x58 string >\0 from '%s'
! 7548: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7549: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7550: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7551: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7552: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7553: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7554: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7555: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7556: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7557: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7558: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7559: # Order 6: EXEC, FORMAT, KERNEL, PROC
! 7560: >0 belong 0x100
! 7561: >>0xC belong 0x44
! 7562: >>>0x54 belong 1
! 7563: >>>>0x60 belong 4
! 7564: >>>>>0x64 belong 1
! 7565: >>>>>>0x68 belong 2
! 7566: >>>>>>>0x74 belong 0x2C
! 7567: >>>>>>>>0xB4 belong 4 core file
! 7568: >>>>>>>>>0x44 string >\0 from '%s'
! 7569: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
! 7570: >>>>>>>>>0xC4 belong 4 - received SIGILL
! 7571: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
! 7572: >>>>>>>>>0xC4 belong 6 - received SIGABRT
! 7573: >>>>>>>>>0xC4 belong 7 - received SIGEMT
! 7574: >>>>>>>>>0xC4 belong 8 - received SIGFPE
! 7575: >>>>>>>>>0xC4 belong 10 - received SIGBUS
! 7576: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
! 7577: >>>>>>>>>0xC4 belong 12 - received SIGSYS
! 7578: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
! 7579: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
! 7580:
! 7581:
! 7582:
! 7583: #------------------------------------------------------------------------------
! 7584: # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
! 7585: # Magic too short!
! 7586: #0 string HU Human68k
! 7587: #>68 string LZX LZX compressed
! 7588: #>>72 string >\0 (version %s)
! 7589: #>(8.L+74) string LZX LZX compressed
! 7590: #>>(8.L+78) string >\0 (version %s)
! 7591: #>60 belong >0 binded
! 7592: #>(8.L+66) string #HUPAIR hupair
! 7593: #>0 string HU X executable
! 7594: #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
! 7595: #>4 belong >0 - base address 0x%x
! 7596: #>28 belong >0 not stripped
! 7597: #>32 belong >0 with debug information
! 7598: #0 beshort 0x601a Human68k Z executable
! 7599: #0 beshort 0x6000 Human68k object file
! 7600: #0 belong 0xd1000000 Human68k ar binary archive
! 7601: #0 belong 0xd1010000 Human68k ar ascii archive
! 7602: #0 beshort 0x0068 Human68k lib archive
! 7603: #4 string LZX Human68k LZX compressed
! 7604: #>8 string >\0 (version %s)
! 7605: #>4 string LZX R executable
! 7606: #2 string #HUPAIR Human68k hupair R executable
! 7607:
! 7608: #------------------------------------------------------------------------------
! 7609: # ibm370: file(1) magic for IBM 370 and compatibles.
! 7610: #
! 7611: # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
! 7612: # What the heck *is* "USS/370"?
! 7613: # AIX 4.1's "/etc/magic" has
! 7614: #
! 7615: # 0 short 0535 370 sysV executable
! 7616: # >12 long >0 not stripped
! 7617: # >22 short >0 - version %d
! 7618: # >30 long >0 - 5.2 format
! 7619: # 0 short 0530 370 sysV pure executable
! 7620: # >12 long >0 not stripped
! 7621: # >22 short >0 - version %d
! 7622: # >30 long >0 - 5.2 format
! 7623: #
! 7624: # instead of the "USS/370" versions of the same magic numbers.
! 7625: #
! 7626: 0 beshort 0537 370 XA sysV executable
! 7627: >12 belong >0 not stripped
! 7628: >22 beshort >0 - version %d
! 7629: >30 belong >0 - 5.2 format
! 7630: 0 beshort 0532 370 XA sysV pure executable
! 7631: >12 belong >0 not stripped
! 7632: >22 beshort >0 - version %d
! 7633: >30 belong >0 - 5.2 format
! 7634: 0 beshort 054001 370 sysV pure executable
! 7635: >12 belong >0 not stripped
! 7636: 0 beshort 055001 370 XA sysV pure executable
! 7637: >12 belong >0 not stripped
! 7638: 0 beshort 056401 370 sysV executable
! 7639: >12 belong >0 not stripped
! 7640: 0 beshort 057401 370 XA sysV executable
! 7641: >12 belong >0 not stripped
! 7642: 0 beshort 0531 SVR2 executable (Amdahl-UTS)
! 7643: >12 belong >0 not stripped
! 7644: >24 belong >0 - version %ld
! 7645: 0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
! 7646: >12 belong >0 not stripped
! 7647: >24 belong >0 - version %ld
! 7648: 0 beshort 0530 SVR2 pure executable (USS/370)
! 7649: >12 belong >0 not stripped
! 7650: >24 belong >0 - version %ld
! 7651: 0 beshort 0535 SVR2 executable (USS/370)
! 7652: >12 belong >0 not stripped
! 7653: >24 belong >0 - version %ld
! 7654:
! 7655: #------------------------------------------------------------------------------
! 7656: # ibm6000: file(1) magic for RS/6000 and the RT PC.
! 7657: #
! 7658: 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
! 7659: >12 belong >0 not stripped
! 7660: # Breaks sun4 statically linked execs.
! 7661: #0 beshort 0x0103 executable (RT Version 2) or obj module
! 7662: #>2 byte 0x50 pure
! 7663: #>28 belong >0 not stripped
! 7664: #>6 beshort >0 - version %ld
! 7665: 0 beshort 0x0104 shared library
! 7666: 0 beshort 0x0105 ctab data
! 7667: 0 beshort 0xfe04 structured file
! 7668: 0 string 0xabcdef AIX message catalog
! 7669: 0 belong 0x000001f9 AIX compiled message catalog
! 7670: 0 string \<aiaff> archive
! 7671: 0 string \<bigaf> archive (big format)
! 7672:
! 7673:
! 7674: #------------------------------------------------------------------------------
! 7675: # iff: file(1) magic for Interchange File Format (see also "audio" & "images")
! 7676: #
! 7677: # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
! 7678: # Arts for file interchange. It has also been used by Apple, SGI, and
! 7679: # especially Commodore-Amiga.
! 7680: #
! 7681: # IFF files begin with an 8 byte FORM header, followed by a 4 character
! 7682: # FORM type, which is followed by the first chunk in the FORM.
! 7683:
! 7684: 0 string FORM IFF data
! 7685: #>4 belong x \b, FORM is %d bytes long
! 7686: # audio formats
! 7687: >8 string AIFF \b, AIFF audio
! 7688: !:mime audio/x-aiff
! 7689: >8 string AIFC \b, AIFF-C compressed audio
! 7690: !:mime audio/x-aiff
! 7691: >8 string 8SVX \b, 8SVX 8-bit sampled sound voice
! 7692: !:mime audio/x-aiff
! 7693: >8 string 16SV \b, 16SV 16-bit sampled sound voice
! 7694: >8 string SAMP \b, SAMP sampled audio
! 7695: >8 string MAUD \b, MAUD MacroSystem audio
! 7696: >8 string SMUS \b, SMUS simple music
! 7697: >8 string CMUS \b, CMUS complex music
! 7698: # image formats
! 7699: >8 string ILBMBMHD \b, ILBM interleaved image
! 7700: >>20 beshort x \b, %d x
! 7701: >>22 beshort x %d
! 7702: >8 string RGBN \b, RGBN 12-bit RGB image
! 7703: >8 string RGB8 \b, RGB8 24-bit RGB image
! 7704: >8 string DEEP \b, DEEP TVPaint/XiPaint image
! 7705: >8 string DR2D \b, DR2D 2-D object
! 7706: >8 string TDDD \b, TDDD 3-D rendering
! 7707: >8 string LWOB \b, LWOB 3-D object
! 7708: >8 string LWO2 \b, LWO2 3-D object, v2
! 7709: >8 string LWLO \b, LWLO 3-D layered object
! 7710: >8 string REAL \b, REAL Real3D rendering
! 7711: >8 string MC4D \b, MC4D MaxonCinema4D rendering
! 7712: >8 string ANIM \b, ANIM animation
! 7713: >8 string YAFA \b, YAFA animation
! 7714: >8 string SSA\ \b, SSA super smooth animation
! 7715: >8 string ACBM \b, ACBM continuous image
! 7716: >8 string FAXX \b, FAXX fax image
! 7717: # other formats
! 7718: >8 string FTXT \b, FTXT formatted text
! 7719: >8 string CTLG \b, CTLG message catalog
! 7720: >8 string PREF \b, PREF preferences
! 7721: >8 string DTYP \b, DTYP datatype description
! 7722: >8 string PTCH \b, PTCH binary patch
! 7723: >8 string AMFF \b, AMFF AmigaMetaFile format
! 7724: >8 string WZRD \b, WZRD StormWIZARD resource
! 7725: >8 string DOC\ \b, DOC desktop publishing document
! 7726:
! 7727: # These go at the end of the iff rules
! 7728: #
! 7729: # I don't see why these might collide with anything else.
! 7730: #
! 7731: # Interactive Fiction related formats
! 7732: #
! 7733: >8 string IFRS \b, Blorb Interactive Fiction
! 7734: >>24 string Exec with executable chunk
! 7735: >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
! 7736: #------------------------------------------------------------------------------
! 7737: # images: file(1) magic for image formats (see also "iff", and "c-lang" for
! 7738: # XPM bitmaps)
! 7739: #
! 7740: # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
! 7741: # additions by janl@ifi.uio.no as well as others. Jan also suggested
! 7742: # merging several one- and two-line files into here.
! 7743: #
! 7744: # little magic: PCX (first byte is 0x0a)
! 7745:
! 7746: # Targa - matches `povray', `ppmtotga' and `xv' outputs
! 7747: # by Philippe De Muyter <phdm@macqel.be>
! 7748: # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
! 7749: # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
! 7750: # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
! 7751: # `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
! 7752: # `tgatoppm' recognizes a superset (Index may be anything)
! 7753: 1 belong&0xfff7ffff 0x01010000 Targa image data - Map
! 7754: >2 byte&8 8 - RLE
! 7755: >12 leshort >0 %hd x
! 7756: >14 leshort >0 %hd
! 7757: 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
! 7758: >2 byte&8 8 - RLE
! 7759: >12 leshort >0 %hd x
! 7760: >14 leshort >0 %hd
! 7761: 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
! 7762: >2 byte&8 8 - RLE
! 7763: >12 leshort >0 %hd x
! 7764: >14 leshort >0 %hd
! 7765:
! 7766: # PBMPLUS images
! 7767: # The next byte following the magic is always whitespace.
! 7768: 0 search/1 P1 Netpbm PBM image text
! 7769: !:mime image/x-portable-bitmap
! 7770: 0 search/1 P2 Netpbm PGM image text
! 7771: !:mime image/x-portable-greymap
! 7772: 0 search/1 P3 Netpbm PPM image text
! 7773: !:mime image/x-portable-pixmap
! 7774: 0 string P4 Netpbm PBM "rawbits" image data
! 7775: !:mime image/x-portable-bitmap
! 7776: 0 string P5 Netpbm PGM "rawbits" image data
! 7777: !:mime image/x-portable-greymap
! 7778: 0 string P6 Netpbm PPM "rawbits" image data
! 7779: !:mime image/x-portable-pixmap
! 7780: 0 string P7 Netpbm PAM image file
! 7781: !:mime image/x-portable-pixmap
! 7782:
! 7783: # From: bryanh@giraffe-data.com (Bryan Henderson)
! 7784: 0 string \117\072 Solitaire Image Recorder format
! 7785: >4 string \013 MGI Type 11
! 7786: >4 string \021 MGI Type 17
! 7787: 0 string .MDA MicroDesign data
! 7788: >21 byte 48 version 2
! 7789: >21 byte 51 version 3
! 7790: 0 string .MDP MicroDesign page data
! 7791: >21 byte 48 version 2
! 7792: >21 byte 51 version 3
! 7793:
! 7794: # NIFF (Navy Interchange File Format, a modification of TIFF) images
! 7795: # [GRR: this *must* go before TIFF]
! 7796: 0 string IIN1 NIFF image data
! 7797: !:mime image/x-niff
! 7798:
! 7799: # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
! 7800: # The second word of TIFF files is the TIFF version number, 42, which has
! 7801: # never changed. The TIFF specification recommends testing for it.
! 7802: 0 string MM\x00\x2a TIFF image data, big-endian
! 7803: !:mime image/tiff
! 7804: 0 string II\x2a\x00 TIFF image data, little-endian
! 7805: !:mime image/tiff
! 7806:
! 7807: # PNG [Portable Network Graphics, or "PNG's Not GIF"] images
! 7808: # (Greg Roelofs, newt@uchicago.edu)
! 7809: # (Albert Cahalan, acahalan@cs.uml.edu)
! 7810: #
! 7811: # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
! 7812: #
! 7813: 0 string \x89PNG\x0d\x0a\x1a\x0a PNG image
! 7814: !:mime image/png
! 7815: >16 belong x \b, %ld x
! 7816: >20 belong x %ld,
! 7817: >24 byte x %d-bit
! 7818: >25 byte 0 grayscale,
! 7819: >25 byte 2 \b/color RGB,
! 7820: >25 byte 3 colormap,
! 7821: >25 byte 4 gray+alpha,
! 7822: >25 byte 6 \b/color RGBA,
! 7823: #>26 byte 0 deflate/32K,
! 7824: >28 byte 0 non-interlaced
! 7825: >28 byte 1 interlaced
! 7826:
! 7827: # possible GIF replacements; none yet released!
! 7828: # (Greg Roelofs, newt@uchicago.edu)
! 7829: #
! 7830: # GRR 950115: this was mine ("Zip GIF"):
! 7831: 0 string GIF94z ZIF image (GIF+deflate alpha)
! 7832: !:mime image/x-unknown
! 7833: #
! 7834: # GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
! 7835: #
! 7836: 0 string FGF95a FGF image (GIF+deflate beta)
! 7837: !:mime image/x-unknown
! 7838: #
! 7839: # GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
! 7840: # (best; not yet implemented):
! 7841: #
! 7842: 0 string PBF PBF image (deflate compression)
! 7843: !:mime image/x-unknown
! 7844:
! 7845: # GIF
! 7846: 0 string GIF8 GIF image data
! 7847: !:mime image/gif
! 7848: >4 string 7a \b, version 8%s,
! 7849: >4 string 9a \b, version 8%s,
! 7850: >6 leshort >0 %hd x
! 7851: >8 leshort >0 %hd
! 7852: #>10 byte &0x80 color mapped,
! 7853: #>10 byte&0x07 =0x00 2 colors
! 7854: #>10 byte&0x07 =0x01 4 colors
! 7855: #>10 byte&0x07 =0x02 8 colors
! 7856: #>10 byte&0x07 =0x03 16 colors
! 7857: #>10 byte&0x07 =0x04 32 colors
! 7858: #>10 byte&0x07 =0x05 64 colors
! 7859: #>10 byte&0x07 =0x06 128 colors
! 7860: #>10 byte&0x07 =0x07 256 colors
! 7861:
! 7862: # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
! 7863: # 1 plane, no encoding.
! 7864: 0 string \361\0\100\273 CMU window manager raster image data
! 7865: >4 lelong >0 %d x
! 7866: >8 lelong >0 %d,
! 7867: >12 lelong >0 %d-bit
! 7868:
! 7869: # Magick Image File Format
! 7870: 0 string id=ImageMagick MIFF image data
! 7871:
! 7872: # Artisan
! 7873: 0 long 1123028772 Artisan image data
! 7874: >4 long 1 \b, rectangular 24-bit
! 7875: >4 long 2 \b, rectangular 8-bit with colormap
! 7876: >4 long 3 \b, rectangular 32-bit (24-bit with matte)
! 7877:
! 7878: # FIG (Facility for Interactive Generation of figures), an object-based format
! 7879: 0 search/1 #FIG FIG image text
! 7880: >5 string x \b, version %.3s
! 7881:
! 7882: # PHIGS
! 7883: 0 string ARF_BEGARF PHIGS clear text archive
! 7884: 0 string @(#)SunPHIGS SunPHIGS
! 7885: # version number follows, in the form m.n
! 7886: >40 string SunBin binary
! 7887: >32 string archive archive
! 7888:
! 7889: # GKS (Graphics Kernel System)
! 7890: 0 string GKSM GKS Metafile
! 7891: >24 string SunGKS \b, SunGKS
! 7892:
! 7893: # CGM image files
! 7894: 0 string BEGMF clear text Computer Graphics Metafile
! 7895:
! 7896: # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
! 7897: 0 string yz MGR bitmap, modern format, 8-bit aligned
! 7898: 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
! 7899: 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
! 7900: 0 string yx MGR bitmap, modern format, squeezed
! 7901:
! 7902: # Fuzzy Bitmap (FBM) images
! 7903: 0 string %bitmap\0 FBM image data
! 7904: >30 long 0x31 \b, mono
! 7905: >30 long 0x33 \b, color
! 7906:
! 7907: # facsimile data
! 7908: 1 string PC\ Research,\ Inc group 3 fax data
! 7909: >29 byte 0 \b, normal resolution (204x98 DPI)
! 7910: >29 byte 1 \b, fine resolution (204x196 DPI)
! 7911: # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
! 7912: 0 string Sfff structured fax file
! 7913:
! 7914:
! 7915: # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
! 7916: 0 string BM
! 7917: >14 leshort 12 PC bitmap, OS/2 1.x format
! 7918: !:mime image/x-ms-bmp
! 7919: >>18 leshort x \b, %d x
! 7920: >>20 leshort x %d
! 7921: >14 leshort 64 PC bitmap, OS/2 2.x format
! 7922: !:mime image/x-ms-bmp
! 7923: >>18 leshort x \b, %d x
! 7924: >>20 leshort x %d
! 7925: >14 leshort 40 PC bitmap, Windows 3.x format
! 7926: !:mime image/x-ms-bmp
! 7927: >>18 lelong x \b, %d x
! 7928: >>22 lelong x %d x
! 7929: >>28 leshort x %d
! 7930: >14 leshort 128 PC bitmap, Windows NT/2000 format
! 7931: !:mime image/x-ms-bmp
! 7932: >>18 lelong x \b, %d x
! 7933: >>22 lelong x %d x
! 7934: >>28 leshort x %d
! 7935: # Too simple - MPi
! 7936: #0 string IC PC icon data
! 7937: #0 string PI PC pointer image data
! 7938: #0 string CI PC color icon data
! 7939: #0 string CP PC color pointer image data
! 7940: # Conflicts with other entries [BABYL]
! 7941: #0 string BA PC bitmap array data
! 7942:
! 7943: # XPM icons (Greg Roelofs, newt@uchicago.edu)
! 7944: # note possible collision with C/REXX entry in c-lang; currently commented out
! 7945: 0 search/1 /*\ XPM\ */ X pixmap image text
! 7946:
! 7947: # Utah Raster Toolkit RLE images (janl@ifi.uio.no)
! 7948: 0 leshort 0xcc52 RLE image data,
! 7949: >6 leshort x %d x
! 7950: >8 leshort x %d
! 7951: >2 leshort >0 \b, lower left corner: %d
! 7952: >4 leshort >0 \b, lower right corner: %d
! 7953: >10 byte&0x1 =0x1 \b, clear first
! 7954: >10 byte&0x2 =0x2 \b, no background
! 7955: >10 byte&0x4 =0x4 \b, alpha channel
! 7956: >10 byte&0x8 =0x8 \b, comment
! 7957: >11 byte >0 \b, %d color channels
! 7958: >12 byte >0 \b, %d bits per pixel
! 7959: >13 byte >0 \b, %d color map channels
! 7960:
! 7961: # image file format (Robert Potter, potter@cs.rochester.edu)
! 7962: 0 string Imagefile\ version- iff image data
! 7963: # this adds the whole header (inc. version number), informative but longish
! 7964: >10 string >\0 %s
! 7965:
! 7966: # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
! 7967: 0 belong 0x59a66a95 Sun raster image data
! 7968: >4 belong >0 \b, %d x
! 7969: >8 belong >0 %d,
! 7970: >12 belong >0 %d-bit,
! 7971: #>16 belong >0 %d bytes long,
! 7972: >20 belong 0 old format,
! 7973: #>20 belong 1 standard,
! 7974: >20 belong 2 compressed,
! 7975: >20 belong 3 RGB,
! 7976: >20 belong 4 TIFF,
! 7977: >20 belong 5 IFF,
! 7978: >20 belong 0xffff reserved for testing,
! 7979: >24 belong 0 no colormap
! 7980: >24 belong 1 RGB colormap
! 7981: >24 belong 2 raw colormap
! 7982: #>28 belong >0 colormap is %d bytes long
! 7983:
! 7984: # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
! 7985: #
! 7986: # See
! 7987: # http://reality.sgi.com/grafica/sgiimage.html
! 7988: #
! 7989: 0 beshort 474 SGI image data
! 7990: #>2 byte 0 \b, verbatim
! 7991: >2 byte 1 \b, RLE
! 7992: #>3 byte 1 \b, normal precision
! 7993: >3 byte 2 \b, high precision
! 7994: >4 beshort x \b, %d-D
! 7995: >6 beshort x \b, %d x
! 7996: >8 beshort x %d
! 7997: >10 beshort x \b, %d channel
! 7998: >10 beshort !1 \bs
! 7999: >80 string >0 \b, "%s"
! 8000:
! 8001: 0 string IT01 FIT image data
! 8002: >4 belong x \b, %d x
! 8003: >8 belong x %d x
! 8004: >12 belong x %d
! 8005: #
! 8006: 0 string IT02 FIT image data
! 8007: >4 belong x \b, %d x
! 8008: >8 belong x %d x
! 8009: >12 belong x %d
! 8010: #
! 8011: 2048 string PCD_IPI Kodak Photo CD image pack file
! 8012: >0xe02 byte&0x03 0x00 , landscape mode
! 8013: >0xe02 byte&0x03 0x01 , portrait mode
! 8014: >0xe02 byte&0x03 0x02 , landscape mode
! 8015: >0xe02 byte&0x03 0x03 , portrait mode
! 8016: 0 string PCD_OPA Kodak Photo CD overview pack file
! 8017:
! 8018: # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
! 8019: # FITS is the Flexible Image Transport System, the de facto standard for
! 8020: # data and image transfer, storage, etc., for the astronomical community.
! 8021: # (FITS floating point formats are big-endian.)
! 8022: 0 string SIMPLE\ \ = FITS image data
! 8023: >109 string 8 \b, 8-bit, character or unsigned binary integer
! 8024: >108 string 16 \b, 16-bit, two's complement binary integer
! 8025: >107 string \ 32 \b, 32-bit, two's complement binary integer
! 8026: >107 string -32 \b, 32-bit, floating point, single precision
! 8027: >107 string -64 \b, 64-bit, floating point, double precision
! 8028:
! 8029: # other images
! 8030: 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
! 8031:
! 8032: # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
! 8033: # stuff.
! 8034: #
! 8035: 0 beshort 0x1010 PEX Binary Archive
! 8036:
! 8037: # DICOM medical imaging data
! 8038: 128 string DICM DICOM medical imaging data
! 8039: !:mime application/dicom
! 8040:
! 8041: # XWD - X Window Dump file.
! 8042: # As described in /usr/X11R6/include/X11/XWDFile.h
! 8043: # used by the xwd program.
! 8044: # Bradford Castalia, idaeim, 1/01
! 8045: 4 belong 7 XWD X Window Dump image data
! 8046: >100 string >\0 \b, "%s"
! 8047: >16 belong x \b, %dx
! 8048: >20 belong x \b%dx
! 8049: >12 belong x \b%d
! 8050:
! 8051: # PDS - Planetary Data System
! 8052: # These files use Parameter Value Language in the header section.
! 8053: # Unfortunately, there is no certain magic, but the following
! 8054: # strings have been found to be most likely.
! 8055: 0 string NJPL1I00 PDS (JPL) image data
! 8056: 2 string NJPL1I PDS (JPL) image data
! 8057: 0 string CCSD3ZF PDS (CCSD) image data
! 8058: 2 string CCSD3Z PDS (CCSD) image data
! 8059: 0 string PDS_ PDS image data
! 8060: 0 string LBLSIZE= PDS (VICAR) image data
! 8061:
! 8062: # pM8x: ATARI STAD compressed bitmap format
! 8063: #
! 8064: # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
! 8065: # p M 8 5/6 xx yy zz data...
! 8066: # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
! 8067: # bytes either run horizontally (pM85) or vertically (pM86). yy is the
! 8068: # most frequent byte, xx and zz are runlength escape codes, where xx is
! 8069: # used for runs of yy.
! 8070: #
! 8071: 0 string pM85 Atari ST STAD bitmap image data (hor)
! 8072: >5 byte 0x00 (white background)
! 8073: >5 byte 0xFF (black background)
! 8074: 0 string pM86 Atari ST STAD bitmap image data (vert)
! 8075: >5 byte 0x00 (white background)
! 8076: >5 byte 0xFF (black background)
! 8077:
! 8078: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
! 8079: # http://www.atarimax.com/jindroush.atari.org/afmtatr.html
! 8080: 0 leshort 0x0296 Atari ATR image
! 8081:
! 8082: # XXX:
! 8083: # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
! 8084: # magic.
! 8085: # SGI RICE image file <mpruett@sgi.com>
! 8086: #0 beshort 0x5249 RICE image
! 8087: #>2 beshort x v%d
! 8088: #>4 beshort x (%d x
! 8089: #>6 beshort x %d)
! 8090: #>8 beshort 0 8 bit
! 8091: #>8 beshort 1 10 bit
! 8092: #>8 beshort 2 12 bit
! 8093: #>8 beshort 3 13 bit
! 8094: #>10 beshort 0 4:2:2
! 8095: #>10 beshort 1 4:2:2:4
! 8096: #>10 beshort 2 4:4:4
! 8097: #>10 beshort 3 4:4:4:4
! 8098: #>12 beshort 1 RGB
! 8099: #>12 beshort 2 CCIR601
! 8100: #>12 beshort 3 RP175
! 8101: #>12 beshort 4 YUV
! 8102:
! 8103: #------------------------------------------------------------------------------
! 8104: #
! 8105: # Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
! 8106: # for the EPOC operating system, which is used with PDAs like those from Psion
! 8107: #
! 8108: # see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
! 8109: # of various EPOC file formats
! 8110:
! 8111: 0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
! 8112:
! 8113: # PCX image files
! 8114: # From: Dan Fandrich <dan@coneharvesters.com>
! 8115: 0 beshort 0x0a00 PCX ver. 2.5 image data
! 8116: 0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
! 8117: 0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
! 8118: 0 beshort 0x0a04 PCX for Windows image data
! 8119: 0 beshort 0x0a05 PCX ver. 3.0 image data
! 8120: >4 leshort x bounding box [%hd,
! 8121: >6 leshort x %hd] -
! 8122: >8 leshort x [%hd,
! 8123: >10 leshort x %hd],
! 8124: >65 byte >1 %d planes each of
! 8125: >3 byte x %hhd-bit
! 8126: >68 byte 0 image,
! 8127: >68 byte 1 colour,
! 8128: >68 byte 2 grayscale,
! 8129: >68 byte >2 image,
! 8130: >68 byte <0 image,
! 8131: >12 leshort >0 %hd x
! 8132: >>14 leshort x %hd dpi,
! 8133: >2 byte 0 uncompressed
! 8134: >2 byte 1 RLE compressed
! 8135:
! 8136: # Adobe Photoshop
! 8137: 0 string 8BPS Adobe Photoshop Image
! 8138: !:mime image/vnd.adobe.photoshop
! 8139:
! 8140: # XV thumbnail indicator (ThMO)
! 8141: 0 string P7\ 332 XV thumbnail image data
! 8142:
! 8143: # NITF is defined by United States MIL-STD-2500A
! 8144: 0 string NITF National Imagery Transmission Format
! 8145: >25 string >\0 dated %.14s
! 8146:
! 8147: # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
! 8148: 0 belong 0x00010008 GEM Image data
! 8149: >12 beshort x %d x
! 8150: >14 beshort x %d,
! 8151: >4 beshort x %d planes,
! 8152: >8 beshort x %d x
! 8153: >10 beshort x %d pixelsize
! 8154:
! 8155: # GEM Metafile (Wolfram Kleff)
! 8156: 0 lelong 0x0018FFFF GEM Metafile data
! 8157: >4 leshort x version %d
! 8158:
! 8159: #
! 8160: # SMJPEG. A custom Motion JPEG format used by Loki Entertainment
! 8161: # Software Torbjorn Andersson <d91tan@Update.UU.SE>.
! 8162: #
! 8163: 0 string \0\nSMJPEG SMJPEG
! 8164: >8 belong x %d.x data
! 8165: # According to the specification you could find any number of _TXT
! 8166: # headers here, but I can't think of any way of handling that. None of
! 8167: # the SMJPEG files I tried it on used this feature. Even if such a
! 8168: # file is encountered the output should still be reasonable.
! 8169: >16 string _SND \b,
! 8170: >>24 beshort >0 %d Hz
! 8171: >>26 byte 8 8-bit
! 8172: >>26 byte 16 16-bit
! 8173: >>28 string NONE uncompressed
! 8174: # >>28 string APCM ADPCM compressed
! 8175: >>27 byte 1 mono
! 8176: >>28 byte 2 stereo
! 8177: # Help! Isn't there any way to avoid writing this part twice?
! 8178: >>32 string _VID \b,
! 8179: # >>>48 string JFIF JPEG
! 8180: >>>40 belong >0 %d frames
! 8181: >>>44 beshort >0 (%d x
! 8182: >>>46 beshort >0 %d)
! 8183: >16 string _VID \b,
! 8184: # >>32 string JFIF JPEG
! 8185: >>24 belong >0 %d frames
! 8186: >>28 beshort >0 (%d x
! 8187: >>30 beshort >0 %d)
! 8188:
! 8189: 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
! 8190:
! 8191: # "thumbnail file" (icon)
! 8192: # descended from "xv", but in use by other applications as well (Wolfram Kleff)
! 8193: 0 string P7\ 332 XV "thumbnail file" (icon) data
! 8194:
! 8195: # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
! 8196: 0 string KiSS KISS/GS
! 8197: >4 byte 16 color
! 8198: >>5 byte x %d bit
! 8199: >>8 leshort x %d colors
! 8200: >>10 leshort x %d groups
! 8201: >4 byte 32 cell
! 8202: >>5 byte x %d bit
! 8203: >>8 leshort x %d x
! 8204: >>10 leshort x %d
! 8205: >>12 leshort x +%d
! 8206: >>14 leshort x +%d
! 8207:
! 8208: # Webshots (www.webshots.com), by John Harrison
! 8209: 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
! 8210:
! 8211: # Hercules DASD image files
! 8212: # From Jan Jaeger <jj@septa.nl>
! 8213: 0 string CKD_P370 Hercules CKD DASD image file
! 8214: >8 long x \b, %d heads per cylinder
! 8215: >12 long x \b, track size %d bytes
! 8216: >16 byte x \b, device type 33%2.2X
! 8217:
! 8218: 0 string CKD_C370 Hercules compressed CKD DASD image file
! 8219: >8 long x \b, %d heads per cylinder
! 8220: >12 long x \b, track size %d bytes
! 8221: >16 byte x \b, device type 33%2.2X
! 8222:
! 8223: 0 string CKD_S370 Hercules CKD DASD shadow file
! 8224: >8 long x \b, %d heads per cylinder
! 8225: >12 long x \b, track size %d bytes
! 8226: >16 byte x \b, device type 33%2.2X
! 8227:
! 8228: # Squeak images and programs - etoffi@softhome.net
! 8229: 0 string \146\031\0\0 Squeak image data
! 8230: 0 search/1 'From\040Squeak Squeak program text
! 8231:
! 8232: # partimage: file(1) magic for PartImage files (experimental, incomplete)
! 8233: # Author: Hans-Joachim Baader <hjb@pro-linux.de>
! 8234: 0 string PaRtImAgE-VoLuMe PartImage
! 8235: >0x0020 string 0.6.1 file version %s
! 8236: >>0x0060 lelong >-1 volume %ld
! 8237: #>>0x0064 8 byte identifier
! 8238: #>>0x007c reserved
! 8239: >>0x0200 string >\0 type %s
! 8240: >>0x1400 string >\0 device %s,
! 8241: >>0x1600 string >\0 original filename %s,
! 8242: # Some fields omitted
! 8243: >>0x2744 lelong 0 not compressed
! 8244: >>0x2744 lelong 1 gzip compressed
! 8245: >>0x2744 lelong 2 bzip2 compressed
! 8246: >>0x2744 lelong >2 compressed with unknown algorithm
! 8247: >0x0020 string >0.6.1 file version %s
! 8248: >0x0020 string <0.6.1 file version %s
! 8249:
! 8250: # DCX is multi-page PCX, using a simple header of up to 1024
! 8251: # offsets for the respective PCX components.
! 8252: # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
! 8253: 0 lelong 987654321 DCX multi-page PCX image data
! 8254:
! 8255: # Simon Walton <simonw@matteworld.com>
! 8256: # Kodak Cineon format for scanned negatives
! 8257: # http://www.kodak.com/US/en/motion/support/dlad/
! 8258: 0 lelong 0xd75f2a80 Cineon image data
! 8259: >200 belong >0 \b, %ld x
! 8260: >204 belong >0 %ld
! 8261:
! 8262:
! 8263: # Bio-Rad .PIC is an image format used by microscope control systems
! 8264: # and related image processing software used by biologists.
! 8265: # From: Vebjorn Ljosa <vebjorn@ljosa.com>
! 8266: 54 leshort 12345 Bio-Rad .PIC Image File
! 8267: >0 leshort >0 %hd x
! 8268: >2 leshort >0 %hd,
! 8269: >4 leshort =1 1 image in file
! 8270: >4 leshort >1 %hd images in file
! 8271:
! 8272: # From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
! 8273: # The description of *.mrw format can be found at
! 8274: # http://www.dalibor.cz/minolta/raw_file_format.htm
! 8275: 0 string \000MRM Minolta Dimage camera raw image data
! 8276:
! 8277: # Summary: DjVu image / document
! 8278: # Extension: .djvu
! 8279: # Reference: http://djvu.org/docs/DjVu3Spec.djvu
! 8280: # Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
! 8281: # Modified by (1): Abel Cheung <abelcheung@gmail.com>
! 8282: 0 string AT&TFORM
! 8283: !:mime image/vnd.djvu
! 8284: >12 string DJVM DjVu multiple page document
! 8285: >12 string DJVU DjVu image or single page document
! 8286: >12 string DJVI DjVu shared document
! 8287: >12 string THUM DjVu page thumbnails
! 8288:
! 8289:
! 8290: # From Marc Espie
! 8291: 0 lelong 20000630 OpenEXR image data
! 8292:
! 8293: # From: Tom Hilinski <tom.hilinski@comcast.net>
! 8294: # http://www.unidata.ucar.edu/packages/netcdf/
! 8295: 0 string CDF\001 NetCDF Data Format data
! 8296:
! 8297: #-----------------------------------------------------------------------
! 8298: # Hierarchical Data Format, used to facilitate scientific data exchange
! 8299: # specifications at http://hdf.ncsa.uiuc.edu/
! 8300: 0 belong 0x0e031301 Hierarchical Data Format (version 4) data
! 8301: !:mime application/x-hdf
! 8302: 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
! 8303: !:mime application/x-hdf
! 8304:
! 8305: # From: Tobias Burnus <burnus@net-b.de>
! 8306: # Xara (for a while: Corel Xara) is a graphic package, see
! 8307: # http://www.xara.com/ for Windows and as GPL application for Linux
! 8308: 0 string XARA\243\243 Xara graphics file
! 8309:
! 8310: # http://www.cartesianinc.com/Tech/
! 8311: 0 string CPC\262 Cartesian Perceptual Compression image
! 8312: !:mime image/x-cpi
! 8313:
! 8314: # From Albert Cahalan <acahalan@gmail.com>
! 8315: # puredigital used it for the CVS disposable camcorder
! 8316: #8 lelong 4 ZBM bitmap image data
! 8317: #>4 leshort x %u x
! 8318: #>6 leshort x %u
! 8319:
! 8320: # From Albert Cahalan <acahalan@gmail.com>
! 8321: # uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
! 8322: 0 string C565 OLPC firmware icon image data
! 8323: >4 leshort x %u x
! 8324: >6 leshort x %u
! 8325:
! 8326: # Applied Images - Image files from Cytovision
! 8327: # Gustavo Junior Alves <gjalves@gjalves.com.br>
! 8328: 0 string \xce\xda\xde\xfa Cytovision Metaphases file
! 8329: 0 string \xed\xad\xef\xac Cytovision Karyotype file
! 8330: 0 string \x0b\x00\x03\x00 Cytovision FISH Probe file
! 8331: 0 string \xed\xfe\xda\xbe Cytovision FLEX file
! 8332: 0 string \xed\xab\xed\xfe Cytovision FLEX file
! 8333: 0 string \xad\xfd\xea\xad Cytovision RATS file
! 8334:
! 8335: # Wavelet Scalar Quantization format used in gray-scale fingerprint images
! 8336: # From Tano M Fotang <mfotang@quanteq.com>
! 8337: 0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
! 8338:
! 8339: # Type: Ulead Photo Explorer5 (.pe5)
! 8340: # URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
! 8341: # From: Simon Horman <horms@debian.org>
! 8342: 0 string IIO2H Ulead Photo Explorer5
! 8343:
! 8344: # Type: X11 cursor
! 8345: # URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
! 8346: # From: Mathias Brodala <info@noctus.net>
! 8347: 0 string Xcur X11 cursor
! 8348:
! 8349: #------------------------------------------------------------------------------
! 8350: # inform: file(1) magic for Inform interactive fiction language
! 8351:
! 8352: # URL: http://www.inform-fiction.org/
! 8353: # From: Reuben Thomas <rrt@sc3d.org>
! 8354:
! 8355: 0 search/cB/100 constant\ story Inform source text
! 8356:
! 8357: #------------------------------------------------------------------------------
! 8358: # intel: file(1) magic for x86 Unix
! 8359: #
! 8360: # Various flavors of x86 UNIX executable/object (other than Xenix, which
! 8361: # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
! 8362: # Windows as well.
! 8363: #
! 8364: # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
! 8365: # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
! 8366: # as well, if, as, and when IBM makes it portable.
! 8367: #
! 8368: # The `versions' should be un-commented if they work for you.
! 8369: # (Was the problem just one of endianness?)
! 8370: #
! 8371: 0 leshort 0502 basic-16 executable
! 8372: >12 lelong >0 not stripped
! 8373: #>22 leshort >0 - version %ld
! 8374: 0 leshort 0503 basic-16 executable (TV)
! 8375: >12 lelong >0 not stripped
! 8376: #>22 leshort >0 - version %ld
! 8377: 0 leshort 0510 x86 executable
! 8378: >12 lelong >0 not stripped
! 8379: 0 leshort 0511 x86 executable (TV)
! 8380: >12 lelong >0 not stripped
! 8381: 0 leshort =0512 iAPX 286 executable small model (COFF)
! 8382: >12 lelong >0 not stripped
! 8383: #>22 leshort >0 - version %ld
! 8384: 0 leshort =0522 iAPX 286 executable large model (COFF)
! 8385: >12 lelong >0 not stripped
! 8386: #>22 leshort >0 - version %ld
! 8387: # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
! 8388: 0 leshort =0514 80386 COFF executable
! 8389: >12 lelong >0 not stripped
! 8390: >22 leshort >0 - version %ld
! 8391:
! 8392: # rom: file(1) magic for BIOS ROM Extensions found in intel machines
! 8393: # mapped into memory between 0xC0000 and 0xFFFFF
! 8394: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
! 8395: 0 beshort 0x55AA BIOS (ia32) ROM Ext.
! 8396: >5 string USB USB
! 8397: >7 string LDR UNDI image
! 8398: >30 string IBM IBM comp. Video
! 8399: >26 string Adaptec Adaptec
! 8400: >28 string Adaptec Adaptec
! 8401: >42 string PROMISE Promise
! 8402: >2 byte x (%d*512)
! 8403:
! 8404: #------------------------------------------------------------------------------
! 8405: # interleaf: file(1) magic for InterLeaf TPS:
! 8406: #
! 8407: 0 string =\210OPS Interleaf saved data
! 8408: 0 string =<!OPS Interleaf document text
! 8409: >5 string ,\ Version\ = \b, version
! 8410: >>17 string >\0 %.3s
! 8411:
! 8412: #------------------------------------------------------------------------------
! 8413: # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
! 8414: # "/etc/magic":
! 8415: # From: guy@netapp.com (Guy Harris)
! 8416: #
! 8417: 4 string pgscriptver IslandWrite document
! 8418: 13 string DrawFile IslandDraw document
! 8419:
! 8420:
! 8421: #------------------------------------------------------------------------------
! 8422: # ispell: file(1) magic for ispell
! 8423: #
! 8424: # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
! 8425: # will match 0x9600 through 0x9603 in *both* little endian and big endian.
! 8426: # (No other current magic entries collide.)
! 8427: #
! 8428: # Updated by Daniel Quinlan (quinlan@yggdrasil.com)
! 8429: #
! 8430: 0 leshort&0xFFFC 0x9600 little endian ispell
! 8431: >0 byte 0 hash file (?),
! 8432: >0 byte 1 3.0 hash file,
! 8433: >0 byte 2 3.1 hash file,
! 8434: >0 byte 3 hash file (?),
! 8435: >2 leshort 0x00 8-bit, no capitalization, 26 flags
! 8436: >2 leshort 0x01 7-bit, no capitalization, 26 flags
! 8437: >2 leshort 0x02 8-bit, capitalization, 26 flags
! 8438: >2 leshort 0x03 7-bit, capitalization, 26 flags
! 8439: >2 leshort 0x04 8-bit, no capitalization, 52 flags
! 8440: >2 leshort 0x05 7-bit, no capitalization, 52 flags
! 8441: >2 leshort 0x06 8-bit, capitalization, 52 flags
! 8442: >2 leshort 0x07 7-bit, capitalization, 52 flags
! 8443: >2 leshort 0x08 8-bit, no capitalization, 128 flags
! 8444: >2 leshort 0x09 7-bit, no capitalization, 128 flags
! 8445: >2 leshort 0x0A 8-bit, capitalization, 128 flags
! 8446: >2 leshort 0x0B 7-bit, capitalization, 128 flags
! 8447: >2 leshort 0x0C 8-bit, no capitalization, 256 flags
! 8448: >2 leshort 0x0D 7-bit, no capitalization, 256 flags
! 8449: >2 leshort 0x0E 8-bit, capitalization, 256 flags
! 8450: >2 leshort 0x0F 7-bit, capitalization, 256 flags
! 8451: >4 leshort >0 and %d string characters
! 8452: 0 beshort&0xFFFC 0x9600 big endian ispell
! 8453: >1 byte 0 hash file (?),
! 8454: >1 byte 1 3.0 hash file,
! 8455: >1 byte 2 3.1 hash file,
! 8456: >1 byte 3 hash file (?),
! 8457: >2 beshort 0x00 8-bit, no capitalization, 26 flags
! 8458: >2 beshort 0x01 7-bit, no capitalization, 26 flags
! 8459: >2 beshort 0x02 8-bit, capitalization, 26 flags
! 8460: >2 beshort 0x03 7-bit, capitalization, 26 flags
! 8461: >2 beshort 0x04 8-bit, no capitalization, 52 flags
! 8462: >2 beshort 0x05 7-bit, no capitalization, 52 flags
! 8463: >2 beshort 0x06 8-bit, capitalization, 52 flags
! 8464: >2 beshort 0x07 7-bit, capitalization, 52 flags
! 8465: >2 beshort 0x08 8-bit, no capitalization, 128 flags
! 8466: >2 beshort 0x09 7-bit, no capitalization, 128 flags
! 8467: >2 beshort 0x0A 8-bit, capitalization, 128 flags
! 8468: >2 beshort 0x0B 7-bit, capitalization, 128 flags
! 8469: >2 beshort 0x0C 8-bit, no capitalization, 256 flags
! 8470: >2 beshort 0x0D 7-bit, no capitalization, 256 flags
! 8471: >2 beshort 0x0E 8-bit, capitalization, 256 flags
! 8472: >2 beshort 0x0F 7-bit, capitalization, 256 flags
! 8473: >4 beshort >0 and %d string characters
! 8474: # ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
! 8475: # Ispell 4.0
! 8476: 0 string ISPL ispell
! 8477: >4 long x hash file version %d,
! 8478: >8 long x lexletters %d,
! 8479: >12 long x lexsize %d,
! 8480: >16 long x hashsize %d,
! 8481: >20 long x stblsize %d
! 8482: #------------------------------------------------------------
! 8483: # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
! 8484: # same magic number, 0xcafebabe, so they are both handled
! 8485: # in the entry called "cafebabe".
! 8486: #------------------------------------------------------------
! 8487: # Java serialization
! 8488: # From Martin Pool (m.pool@pharos.com.au)
! 8489: 0 beshort 0xaced Java serialization data
! 8490: >2 beshort >0x0004 \b, version %d
! 8491:
! 8492: 0 belong 0xfeedfeed Java KeyStore
! 8493: !:mime application/x-java-keystore
! 8494: 0 belong 0xcececece Java JCE KeyStore
! 8495: !:mime application/x-java-jce-keystore
! 8496:
! 8497: # Dalvik .dex format. http://retrodev.com/android/dexformat.html
! 8498: # From <mkf@google.com> "Mike Fleming"
! 8499: 0 string dex\n
! 8500: >0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
! 8501: >4 string >000 version %s
! 8502: 0 string dey\n
! 8503: >0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
! 8504: >4 string >000 version %s
! 8505:
! 8506:
! 8507: #------------------------------------------------------------------------------
! 8508: # JPEG images
! 8509: # SunOS 5.5.1 had
! 8510: #
! 8511: # 0 string \377\330\377\340 JPEG file
! 8512: # 0 string \377\330\377\356 JPG file
! 8513: #
! 8514: # both of which turn into "JPEG image data" here.
! 8515: #
! 8516: 0 beshort 0xffd8 JPEG image data
! 8517: !:mime image/jpeg
! 8518: !:strength +1
! 8519: >6 string JFIF \b, JFIF standard
! 8520: # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
! 8521: # in a vain attempt to add image size reporting for JFIF. Note that these
! 8522: # tests are not fool-proof since some perfectly valid JPEGs are currently
! 8523: # impossible to specify in magic(4) format.
! 8524: # First, a little JFIF version info:
! 8525: >>11 byte x \b %d.
! 8526: >>12 byte x \b%02d
! 8527: # Next, the resolution or aspect ratio of the image:
! 8528: #>>13 byte 0 \b, aspect ratio
! 8529: #>>13 byte 1 \b, resolution (DPI)
! 8530: #>>13 byte 2 \b, resolution (DPCM)
! 8531: #>>4 beshort x \b, segment length %d
! 8532: # Next, show thumbnail info, if it exists:
! 8533: >>18 byte !0 \b, thumbnail %dx
! 8534: >>>19 byte x \b%d
! 8535:
! 8536: # EXIF moved down here to avoid reporting a bogus version number,
! 8537: # and EXIF version number printing added.
! 8538: # - Patrik R=E5dman <patrik+file-magic@iki.fi>
! 8539: >6 string Exif \b, EXIF standard
! 8540: # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
! 8541: # All possible combinations of entries have to be enumerated, since no looping
! 8542: # is possible. And both endians are possible...
! 8543: # The combinations included below are from real-world JPEGs.
! 8544: # Little-endian
! 8545: >>12 string II
! 8546: # IFD 0 Entry #5:
! 8547: >>>70 leshort 0x8769
! 8548: # EXIF IFD Entry #1:
! 8549: >>>>(78.l+14) leshort 0x9000
! 8550: >>>>>(78.l+23) byte x %c
! 8551: >>>>>(78.l+24) byte x \b.%c
! 8552: >>>>>(78.l+25) byte !0x30 \b%c
! 8553: # IFD 0 Entry #9:
! 8554: >>>118 leshort 0x8769
! 8555: # EXIF IFD Entry #3:
! 8556: >>>>(126.l+38) leshort 0x9000
! 8557: >>>>>(126.l+47) byte x %c
! 8558: >>>>>(126.l+48) byte x \b.%c
! 8559: >>>>>(126.l+49) byte !0x30 \b%c
! 8560: # IFD 0 Entry #10
! 8561: >>>130 leshort 0x8769
! 8562: # EXIF IFD Entry #3:
! 8563: >>>>(138.l+38) leshort 0x9000
! 8564: >>>>>(138.l+47) byte x %c
! 8565: >>>>>(138.l+48) byte x \b.%c
! 8566: >>>>>(138.l+49) byte !0x30 \b%c
! 8567: # EXIF IFD Entry #4:
! 8568: >>>>(138.l+50) leshort 0x9000
! 8569: >>>>>(138.l+59) byte x %c
! 8570: >>>>>(138.l+60) byte x \b.%c
! 8571: >>>>>(138.l+61) byte !0x30 \b%c
! 8572: # EXIF IFD Entry #5:
! 8573: >>>>(138.l+62) leshort 0x9000
! 8574: >>>>>(138.l+71) byte x %c
! 8575: >>>>>(138.l+72) byte x \b.%c
! 8576: >>>>>(138.l+73) byte !0x30 \b%c
! 8577: # IFD 0 Entry #11
! 8578: >>>142 leshort 0x8769
! 8579: # EXIF IFD Entry #3:
! 8580: >>>>(150.l+38) leshort 0x9000
! 8581: >>>>>(150.l+47) byte x %c
! 8582: >>>>>(150.l+48) byte x \b.%c
! 8583: >>>>>(150.l+49) byte !0x30 \b%c
! 8584: # EXIF IFD Entry #4:
! 8585: >>>>(150.l+50) leshort 0x9000
! 8586: >>>>>(150.l+59) byte x %c
! 8587: >>>>>(150.l+60) byte x \b.%c
! 8588: >>>>>(150.l+61) byte !0x30 \b%c
! 8589: # EXIF IFD Entry #5:
! 8590: >>>>(150.l+62) leshort 0x9000
! 8591: >>>>>(150.l+71) byte x %c
! 8592: >>>>>(150.l+72) byte x \b.%c
! 8593: >>>>>(150.l+73) byte !0x30 \b%c
! 8594: # Big-endian
! 8595: >>12 string MM
! 8596: # IFD 0 Entry #9:
! 8597: >>>118 beshort 0x8769
! 8598: # EXIF IFD Entry #1:
! 8599: >>>>(126.L+14) beshort 0x9000
! 8600: >>>>>(126.L+23) byte x %c
! 8601: >>>>>(126.L+24) byte x \b.%c
! 8602: >>>>>(126.L+25) byte !0x30 \b%c
! 8603: # EXIF IFD Entry #3:
! 8604: >>>>(126.L+38) beshort 0x9000
! 8605: >>>>>(126.L+47) byte x %c
! 8606: >>>>>(126.L+48) byte x \b.%c
! 8607: >>>>>(126.L+49) byte !0x30 \b%c
! 8608: # IFD 0 Entry #10
! 8609: >>>130 beshort 0x8769
! 8610: # EXIF IFD Entry #3:
! 8611: >>>>(138.L+38) beshort 0x9000
! 8612: >>>>>(138.L+47) byte x %c
! 8613: >>>>>(138.L+48) byte x \b.%c
! 8614: >>>>>(138.L+49) byte !0x30 \b%c
! 8615: # EXIF IFD Entry #5:
! 8616: >>>>(138.L+62) beshort 0x9000
! 8617: >>>>>(138.L+71) byte x %c
! 8618: >>>>>(138.L+72) byte x \b.%c
! 8619: >>>>>(138.L+73) byte !0x30 \b%c
! 8620: # IFD 0 Entry #11
! 8621: >>>142 beshort 0x8769
! 8622: # EXIF IFD Entry #4:
! 8623: >>>>(150.L+50) beshort 0x9000
! 8624: >>>>>(150.L+59) byte x %c
! 8625: >>>>>(150.L+60) byte x \b.%c
! 8626: >>>>>(150.L+61) byte !0x30 \b%c
! 8627: # Here things get sticky. We can do ONE MORE marker segment with
! 8628: # indirect addressing, and that's all. It would be great if we could
! 8629: # do pointer arithemetic like in an assembler language. Christos?
! 8630: # And if there was some sort of looping construct to do searches, plus a few
! 8631: # named accumulators, it would be even more effective...
! 8632: # At least we can show a comment if no other segments got inserted before:
! 8633: >(4.S+5) byte 0xFE
! 8634: >>(4.S+8) string >\0 \b, comment: "%s"
! 8635: # FIXME: When we can do non-byte counted strings, we can use that to get
! 8636: # the string's count, and fix Debian bug #283760
! 8637: #>(4.S+5) byte 0xFE \b, comment
! 8638: #>>(4.S+6) beshort x \b length=%d
! 8639: #>>(4.S+8) string >\0 \b, "%s"
! 8640: # Or, we can show the encoding type (I've included only the three most common)
! 8641: # and image dimensions if we are lucky and the SOFn (image segment) is here:
! 8642: >(4.S+5) byte 0xC0 \b, baseline
! 8643: >>(4.S+6) byte x \b, precision %d
! 8644: >>(4.S+7) beshort x \b, %dx
! 8645: >>(4.S+9) beshort x \b%d
! 8646: >(4.S+5) byte 0xC1 \b, extended sequential
! 8647: >>(4.S+6) byte x \b, precision %d
! 8648: >>(4.S+7) beshort x \b, %dx
! 8649: >>(4.S+9) beshort x \b%d
! 8650: >(4.S+5) byte 0xC2 \b, progressive
! 8651: >>(4.S+6) byte x \b, precision %d
! 8652: >>(4.S+7) beshort x \b, %dx
! 8653: >>(4.S+9) beshort x \b%d
! 8654: # I've commented-out quantisation table reporting. I doubt anyone cares yet.
! 8655: #>(4.S+5) byte 0xDB \b, quantisation table
! 8656: #>>(4.S+6) beshort x \b length=%d
! 8657: #>14 beshort x \b, %d x
! 8658: #>16 beshort x \b %d
! 8659:
! 8660: # HSI is Handmade Software's proprietary JPEG encoding scheme
! 8661: 0 string hsi1 JPEG image data, HSI proprietary
! 8662:
! 8663: # From: David Santinoli <david@santinoli.com>
! 8664: 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
! 8665:
! 8666: # Type: JPEG 2000 codesream
! 8667: # From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
! 8668: 0 belong 0xff4fff51 JPEG 2000 codestream
! 8669: 45 beshort 0xff52
! 8670:
! 8671: #------------------------------------------------------------------------------
! 8672: # karma: file(1) magic for Karma data files
! 8673: #
! 8674: # From <rgooch@atnf.csiro.au>
! 8675:
! 8676: 0 string KarmaRHD Version Karma Data Structure Version
! 8677: >16 belong x %lu
! 8678:
! 8679: #------------------------------------------------------------------------------
! 8680: # kde: file(1) magic for KDE
! 8681:
! 8682: 0 string [KDE\ Desktop\ Entry] KDE desktop entry
! 8683: !:mime application/x-kdelnk
! 8684: 0 string #\ KDE\ Config\ File KDE config file
! 8685: !:mime application/x-kdelnk
! 8686: 0 string #\ xmcd xmcd database file for kscd
! 8687: !:mime text/x-xmcd
! 8688: #------------------------------------------------------------------------------
! 8689: # DEC SRC Virtual Paper: Lectern files
! 8690: # Karl M. Hegbloom <karlheg@inetarena.com>
! 8691: 0 string lect DEC SRC Virtual Paper Lectern file
! 8692: #------------------------------------------------------------------------------
! 8693: # lex: file(1) magic for lex
! 8694: #
! 8695: # derived empirically, your offsets may vary!
! 8696: 0 search/100 yyprevious C program text (from lex)
! 8697: >3 search/1 >\0 for %s
! 8698: # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
! 8699: 0 search/100 generated\ by\ flex C program text (from flex)
! 8700: # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
! 8701: 0 search/1 %{ lex description text
! 8702:
! 8703: #------------------------------------------------------------------------------
! 8704: # lif: file(1) magic for lif
! 8705: #
! 8706: # (Daniel Quinlan <quinlan@yggdrasil.com>)
! 8707: #
! 8708: 0 beshort 0x8000 lif file
! 8709: #------------------------------------------------------------------------------
! 8710: # linux: file(1) magic for Linux files
! 8711: #
! 8712: # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
! 8713: # The following basic Linux magic is useful for reference, but using
! 8714: # "long" magic is a better practice in order to avoid collisions.
! 8715: #
! 8716: # 2 leshort 100 Linux/i386
! 8717: # >0 leshort 0407 impure executable (OMAGIC)
! 8718: # >0 leshort 0410 pure executable (NMAGIC)
! 8719: # >0 leshort 0413 demand-paged executable (ZMAGIC)
! 8720: # >0 leshort 0314 demand-paged executable (QMAGIC)
! 8721: #
! 8722: 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
! 8723: >16 lelong 0 \b, stripped
! 8724: 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
! 8725: >16 lelong 0 \b, stripped
! 8726: 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
! 8727: >16 lelong 0 \b, stripped
! 8728: 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
! 8729: >16 lelong 0 \b, stripped
! 8730: #
! 8731: 0 string \007\001\000 Linux/i386 object file
! 8732: >20 lelong >0x1020 \b, DLL library
! 8733: # Linux-8086 stuff:
! 8734: 0 string \01\03\020\04 Linux-8086 impure executable
! 8735: >28 long !0 not stripped
! 8736: 0 string \01\03\040\04 Linux-8086 executable
! 8737: >28 long !0 not stripped
! 8738: #
! 8739: 0 string \243\206\001\0 Linux-8086 object file
! 8740: #
! 8741: 0 string \01\03\020\20 Minix-386 impure executable
! 8742: >28 long !0 not stripped
! 8743: 0 string \01\03\040\20 Minix-386 executable
! 8744: >28 long !0 not stripped
! 8745: # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
! 8746: 216 lelong 0421 Linux/i386 core file
! 8747: >220 string >\0 of '%s'
! 8748: >200 lelong >0 (signal %d)
! 8749: #
! 8750: # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
! 8751: # this can be overridden by the DOS executable (COM) entry
! 8752: 2 string LILO Linux/i386 LILO boot/chain loader
! 8753: #
! 8754: # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
! 8755: 0 leshort 0x0436 Linux/i386 PC Screen Font data,
! 8756: >2 byte 0 256 characters, no directory,
! 8757: >2 byte 1 512 characters, no directory,
! 8758: >2 byte 2 256 characters, Unicode directory,
! 8759: >2 byte 3 512 characters, Unicode directory,
! 8760: >3 byte >0 8x%d
! 8761: # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
! 8762: 4086 string SWAP-SPACE Linux/i386 swap file
! 8763: # From: Jeff Bailey <jbailey@ubuntu.com>
! 8764: # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
! 8765: 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
! 8766: # according to man page of mkswap (8) March 1999
! 8767: # volume label and UUID Russell Coker
! 8768: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
! 8769: 4086 string SWAPSPACE2 Linux/i386 swap file (new style),
! 8770: >0x400 long x version %d (4K pages),
! 8771: >0x404 long x size %d pages,
! 8772: >1052 string \0 no label,
! 8773: >1052 string >\0 LABEL=%s,
! 8774: >0x40c belong x UUID=%x
! 8775: >0x410 beshort x \b-%x
! 8776: >0x412 beshort x \b-%x
! 8777: >0x414 beshort x \b-%x
! 8778: >0x416 belong x \b-%x
! 8779: >0x41a beshort x \b%x
! 8780: # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
! 8781: #
! 8782: # from Erik Troan (ewt@redhat.com) examining od dumps, so this
! 8783: # could be wrong
! 8784: # updated by David Mosberger (davidm@azstarnet.com) based on
! 8785: # GNU BFD and MIPS info found below.
! 8786: #
! 8787: 0 leshort 0x0183 ECOFF alpha
! 8788: >24 leshort 0407 executable
! 8789: >24 leshort 0410 pure
! 8790: >24 leshort 0413 demand paged
! 8791: >8 long >0 not stripped
! 8792: >8 long 0 stripped
! 8793: >23 leshort >0 - version %ld.
! 8794: #
! 8795: # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
! 8796: # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
! 8797: # and Nicolás Lichtmaier <nick@debian.org>
! 8798: # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
! 8799: # Linux kernel boot images (i386 arch) (Wolfram Kleff)
! 8800: 514 string HdrS Linux kernel
! 8801: >510 leshort 0xAA55 x86 boot executable
! 8802: >>518 leshort >0x1ff
! 8803: >>529 byte 0 zImage,
! 8804: >>>529 byte 1 bzImage,
! 8805: >>>(526.s+0x200) string >\0 version %s,
! 8806: >>498 leshort 1 RO-rootFS,
! 8807: >>498 leshort 0 RW-rootFS,
! 8808: >>508 leshort >0 root_dev 0x%X,
! 8809: >>502 leshort >0 swap_dev 0x%X,
! 8810: >>504 leshort >0 RAMdisksize %u KB,
! 8811: >>506 leshort 0xFFFF Normal VGA
! 8812: >>506 leshort 0xFFFE Extended VGA
! 8813: >>506 leshort 0xFFFD Prompt for Videomode
! 8814: >>506 leshort >0 Video mode %d
! 8815: # This also matches new kernels, which were caught above by "HdrS".
! 8816: 0 belong 0xb8c0078e Linux kernel
! 8817: >0x1e3 string Loading version 1.3.79 or older
! 8818: >0x1e9 string Loading from prehistoric times
! 8819:
! 8820: # System.map files - Nicolás Lichtmaier <nick@debian.org>
! 8821: 8 search/1 \ A\ _text Linux kernel symbol map text
! 8822:
! 8823: # LSM entries - Nicolás Lichtmaier <nick@debian.org>
! 8824: 0 search/1 Begin3 Linux Software Map entry text
! 8825: 0 search/1 Begin4 Linux Software Map entry text (new format)
! 8826:
! 8827: # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
! 8828: 0 belong 0x4f4f4f4d User-mode Linux COW file
! 8829: >4 belong <3 \b, version %d
! 8830: >>8 string >\0 \b, backing file %s
! 8831: >4 belong >2 \b, version %d
! 8832: >>32 string >\0 \b, backing file %s
! 8833:
! 8834: ############################################################################
! 8835: # Linux kernel versions
! 8836:
! 8837: 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
! 8838: >497 leshort 0 x86 boot sector
! 8839: >>514 belong 0x8e of a kernel from the dawn of time!
! 8840: >>514 belong 0x908ed8b4 version 0.99-1.1.42
! 8841: >>514 belong 0x908ed8b8 for memtest86
! 8842:
! 8843: >497 leshort !0 x86 kernel
! 8844: >>504 leshort >0 RAMdisksize=%u KB
! 8845: >>502 leshort >0 swap=0x%X
! 8846: >>508 leshort >0 root=0x%X
! 8847: >>>498 leshort 1 \b-ro
! 8848: >>>498 leshort 0 \b-rw
! 8849: >>506 leshort 0xFFFF vga=normal
! 8850: >>506 leshort 0xFFFE vga=extended
! 8851: >>506 leshort 0xFFFD vga=ask
! 8852: >>506 leshort >0 vga=%d
! 8853: >>514 belong 0x908ed881 version 1.1.43-1.1.45
! 8854: >>514 belong 0x15b281cd
! 8855: >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
! 8856: >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
! 8857: >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
! 8858: >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
! 8859: >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
! 8860: >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
! 8861: >>514 string HdrS
! 8862: >>>518 leshort >0x1FF
! 8863: >>>>529 byte 0 \b, zImage
! 8864: >>>>529 byte 1 \b, bzImage
! 8865: >>>>(526.s+0x200) string >\0 \b, version %s
! 8866:
! 8867: # Linux boot sector thefts.
! 8868: 0 belong 0xb8c0078e Linux
! 8869: >0x1e6 belong 0x454c4b53 ELKS Kernel
! 8870: >0x1e6 belong !0x454c4b53 style boot sector
! 8871:
! 8872: ############################################################################
! 8873: # Linux 8086 executable
! 8874: 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
! 8875: >5 string .
! 8876: >>4 string >\0 \b, libc version %s
! 8877:
! 8878: 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
! 8879: >2 byte&0x01 !0 \b, unmapped zero page
! 8880: >2 byte&0x20 0 \b, impure
! 8881: >2 byte&0x20 !0
! 8882: >>2 byte&0x10 !0 \b, A_EXEC
! 8883: >2 byte&0x02 !0 \b, A_PAL
! 8884: >2 byte&0x04 !0 \b, A_NSYM
! 8885: >2 byte&0x08 !0 \b, A_STAND
! 8886: >2 byte&0x40 !0 \b, A_PURE
! 8887: >2 byte&0x80 !0 \b, A_TOVLY
! 8888: >28 long !0 \b, not stripped
! 8889: >37 string .
! 8890: >>36 string >\0 \b, libc version %s
! 8891:
! 8892: # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
! 8893: # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
! 8894: # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
! 8895: # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
! 8896:
! 8897: # SYSLINUX boot logo files (from 'ppmtolss16' sources)
! 8898: # http://syslinux.zytor.com/
! 8899: #
! 8900: 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
! 8901: >4 leshort x \b, width %d
! 8902: >6 leshort x \b, height %d
! 8903:
! 8904: 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
! 8905: >4 belong x version %d
! 8906:
! 8907: # SE Linux policy database
! 8908: # From: Mike Frysinger <vapier@gentoo.org>
! 8909: 0 lelong 0xf97cff8c SE Linux policy
! 8910: >16 lelong x v%d
! 8911: >20 lelong 1 MLS
! 8912: >24 lelong x %d symbols
! 8913: >28 lelong x %d ocons
! 8914:
! 8915: # Linux Logical Volume Manager (LVM)
! 8916: # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
! 8917: #
! 8918: # System ID, UUID and volume group name are 128 bytes long
! 8919: # but they should never be full and initialized with zeros...
! 8920: #
! 8921: # LVM1
! 8922: #
! 8923: 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
! 8924: >0x12c string >\0 , System ID: %s
! 8925:
! 8926: 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
! 8927: >0x12c string >\0 , System ID: %s
! 8928:
! 8929: # LVM2
! 8930: #
! 8931: # It seems that the label header can be in one the four first sector
! 8932: # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
! 8933: #
! 8934: # 0x200 seems to be the common case
! 8935:
! 8936: 0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
! 8937: # read the offset to add to the start of the header, and the header
! 8938: # start in 0x200
! 8939: >(0x214.l+0x200) string >\0 , UUID: %s
! 8940:
! 8941: 0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
! 8942: >(0x014.l) string >\0 , UUID: %s
! 8943:
! 8944: 0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
! 8945: >(0x414.l+0x400) string >\0 , UUID: %s
! 8946:
! 8947: 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
! 8948: >(0x614.l+0x600) string >\0 , UUID: %s
! 8949:
! 8950: # LVM snapshot
! 8951: # from Jason Farrel
! 8952: 0 string SnAp LVM Snapshot (CopyOnWrite store)
! 8953: >4 lelong !0 - valid,
! 8954: >4 lelong 0 - invalid,
! 8955: >8 lelong x version %d,
! 8956: >12 lelong x chunk_size %d
! 8957:
! 8958: # SE Linux policy database
! 8959: 0 lelong 0xf97cff8c SE Linux policy
! 8960: >16 lelong x v%d
! 8961: >20 lelong 1 MLS
! 8962: >24 lelong x %d symbols
! 8963: >28 lelong x %d ocons
! 8964:
! 8965: # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
! 8966: # Anthon van der Neut (anthon@mnt.org)
! 8967: 0 string LUKS\xba\xbe LUKS encrypted file,
! 8968: >6 beshort x ver %d
! 8969: >8 string x [%s,
! 8970: >40 string x %s,
! 8971: >72 string x %s]
! 8972: >168 string x UUID: %s
! 8973:
! 8974:
! 8975: # Summary: Xen saved domain file
! 8976: # Created by: Radek Vokal <rvokal@redhat.com>
! 8977: 0 string LinuxGuestRecord Xen saved domain
! 8978: >20 search/256 (name
! 8979: >>&1 string x (name %s)
! 8980:
! 8981: # Type: Xen, the virtual machine monitor
! 8982: # From: Radek Vokal <rvokal@redhat.com>
! 8983: 0 string LinuxGuestRecord Xen saved domain
! 8984: #>2 regex \(name\ [^)]*\) %s
! 8985: >20 search/256 (name (name
! 8986: >>&1 string x %s...)
! 8987: #------------------------------------------------------------------------------
! 8988: # lisp: file(1) magic for lisp programs
! 8989: #
! 8990: # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
! 8991:
! 8992: # updated by Joerg Jenderek
! 8993: # GRR: This lot is too weak
! 8994: #0 string ;;
! 8995: # windows INF files often begin with semicolon and use CRLF as line end
! 8996: # lisp files are mainly created on unix system with LF as line end
! 8997: #>2 search/2048 !\r Lisp/Scheme program text
! 8998: #>2 search/2048 \r Windows INF file
! 8999:
! 9000: 0 search/256 (if\ Lisp/Scheme program text
! 9001: !:mime text/x-lisp
! 9002: 0 search/256 (setq\ Lisp/Scheme program text
! 9003: !:mime text/x-lisp
! 9004: 0 search/256 (defvar\ Lisp/Scheme program text
! 9005: !:mime text/x-lisp
! 9006: 0 search/256 (defparam\ Lisp/Scheme program text
! 9007: !:mime text/x-lisp
! 9008: 0 search/256 (defun\ Lisp/Scheme program text
! 9009: !:mime text/x-lisp
! 9010: 0 search/256 (autoload\ Lisp/Scheme program text
! 9011: !:mime text/x-lisp
! 9012: 0 search/256 (custom-set-variables\ Lisp/Scheme program text
! 9013: !:mime text/x-lisp
! 9014:
! 9015: # Emacs 18 - this is always correct, but not very magical.
! 9016: 0 string \012( Emacs v18 byte-compiled Lisp data
! 9017: !:mime application/x-elc
! 9018: # Emacs 19+ - ver. recognition added by Ian Springer
! 9019: # Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
! 9020: # - Chris Chittleborough <cchittleborough@yahoo.com.au>
! 9021: 0 string ;ELC
! 9022: >4 byte >18
! 9023: >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
! 9024: !:mime application/x-elc
! 9025:
! 9026: # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
! 9027: 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
! 9028: 0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
! 9029:
! 9030: 0 long 0x70768BD2 CLISP memory image data
! 9031: 0 long 0xD28B7670 CLISP memory image data, other endian
! 9032:
! 9033: #.com and .bin for MIT scheme
! 9034: 0 string \372\372\372\372 MIT scheme (library?)
! 9035:
! 9036: # From: David Allouche <david@allouche.net>
! 9037: 0 search/1 \<TeXmacs| TeXmacs document text
! 9038: !:mime text/texmacs
! 9039:
! 9040: #------------------------------------------------------------------------------
! 9041: # llvm: file(1) magic for LLVM byte-codes
! 9042: # URL: http://llvm.cs.uiuc.edu/docs/BytecodeFormat.html#signature
! 9043: # From: Al Stone <ahs3@fc.hp.com>
! 9044:
! 9045: 0 string llvm LLVM byte-codes, uncompressed
! 9046: 0 string llvc0 LLVM byte-codes, null compression
! 9047: 0 string llvc1 LLVM byte-codes, gzip compression
! 9048: 0 string llvc2 LLVM byte-codes, bzip2 compression
! 9049: #------------------------------------------------------------------------------
! 9050: # lua: file(1) magic for Lua scripting language
! 9051: # URL: http://www.lua.org/
! 9052: # From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
! 9053:
! 9054: # Lua scripts
! 9055: 0 search/1/b #!\ /usr/bin/lua Lua script text executable
! 9056: !:mime text/x-lua
! 9057: 0 search/1/b #!\ /usr/local/bin/lua Lua script text executable
! 9058: !:mime text/x-lua
! 9059: 0 search/1 #!/usr/bin/env\ lua Lua script text executable
! 9060: !:mime text/x-lua
! 9061: 0 search/1 #!\ /usr/bin/env\ lua Lua script text executable
! 9062: !:mime text/x-lua
! 9063:
! 9064: # Lua bytecode
! 9065: 0 string \033Lua Lua bytecode,
! 9066: >4 byte 0x50 version 5.0
! 9067: >4 byte 0x51 version 5.1
! 9068:
! 9069: #------------------------------------------------------------------------------
! 9070: # luks: file(1) magic for Linux Unified Key Setup
! 9071: # URL: http://luks.endorphin.org/spec
! 9072: # From: Anthon van der Neut <anthon@mnt.org>
! 9073:
! 9074: 0 string LUKS\xba\xbe LUKS encrypted file,
! 9075: >6 beshort x ver %d
! 9076: >8 string x [%s,
! 9077: >40 string x %s,
! 9078: >72 string x %s]
! 9079: >168 string x UUID: %s
! 9080: #------------------------------------------------------------
! 9081: # Mach has two magic numbers, 0xcafebabe and 0xfeedface.
! 9082: # Unfortunately the first, cafebabe, is shared with
! 9083: # Java ByteCode, so they are both handled in the file "cafebabe".
! 9084: # The "feedface" ones are handled herein.
! 9085: #------------------------------------------------------------
! 9086: 0 lelong&0xfeffffff 0xfeedface Mach-O
! 9087: >0 byte 0xcf 64-bit
! 9088: >12 lelong 1 object
! 9089: >12 lelong 2 executable
! 9090: >12 lelong 3 fixed virtual memory shared library
! 9091: >12 lelong 4 core
! 9092: >12 lelong 5 preload executable
! 9093: >12 lelong 6 dynamically linked shared library
! 9094: >12 lelong 7 dynamic linker
! 9095: >12 lelong 8 bundle
! 9096: >12 lelong 9 dynamically linked shared library stub
! 9097: >12 lelong >9
! 9098: >>12 lelong x filetype=%ld
! 9099: >4 lelong <0
! 9100: >>4 lelong x architecture=%ld
! 9101: >4 lelong 1 vax
! 9102: >4 lelong 2 romp
! 9103: >4 lelong 3 architecture=3
! 9104: >4 lelong 4 ns32032
! 9105: >4 lelong 5 ns32332
! 9106: >4 lelong 6 m68k
! 9107: >4 lelong 7 i386
! 9108: >4 lelong 8 mips
! 9109: >4 lelong 9 ns32532
! 9110: >4 lelong 10 architecture=10
! 9111: >4 lelong 11 hppa
! 9112: >4 lelong 12 acorn
! 9113: >4 lelong 13 m88k
! 9114: >4 lelong 14 sparc
! 9115: >4 lelong 15 i860-big
! 9116: >4 lelong 16 i860
! 9117: >4 lelong 17 rs6000
! 9118: >4 lelong 18 ppc
! 9119: >4 lelong 16777234 ppc64
! 9120: >4 lelong >16777234
! 9121: >>4 lelong x architecture=%ld
! 9122: #
! 9123: 0 belong&0xfffffffe 0xfeedface Mach-O
! 9124: >3 byte 0xcf 64-bit
! 9125: >12 belong 1 object
! 9126: >12 belong 2 executable
! 9127: >12 belong 3 fixed virtual memory shared library
! 9128: >12 belong 4 core
! 9129: >12 belong 5 preload executable
! 9130: >12 belong 6 dynamically linked shared library
! 9131: >12 belong 7 dynamic linker
! 9132: >12 belong 8 bundle
! 9133: >12 belong 9 dynamically linked shared library stub
! 9134: >12 belong >9
! 9135: >>12 belong x filetype=%ld
! 9136: >4 belong <0
! 9137: >>4 belong x architecture=%ld
! 9138: >4 belong 1 vax
! 9139: >4 belong 2 romp
! 9140: >4 belong 3 architecture=3
! 9141: >4 belong 4 ns32032
! 9142: >4 belong 5 ns32332
! 9143: >4 belong 6 for m68k architecture
! 9144: # from NeXTstep 3.0 <mach/machine.h>
! 9145: # i.e. mc680x0_all, ignore
! 9146: # >>8 belong 1 (mc68030)
! 9147: >>8 belong 2 (mc68040)
! 9148: >>8 belong 3 (mc68030 only)
! 9149: >4 belong 7 i386
! 9150: >4 belong 8 mips
! 9151: >4 belong 9 ns32532
! 9152: >4 belong 10 architecture=10
! 9153: >4 belong 11 hppa
! 9154: >4 belong 12 acorn
! 9155: >4 belong 13 m88k
! 9156: >4 belong 14 sparc
! 9157: >4 belong 15 i860-big
! 9158: >4 belong 16 i860
! 9159: >4 belong 17 rs6000
! 9160: >4 belong 18 ppc
! 9161: >4 belong 16777234 ppc64
! 9162: >4 belong >16777234
! 9163: >>4 belong x architecture=%ld
! 9164:
! 9165: #------------------------------------------------------------------------------
! 9166: # macintosh description
! 9167: #
! 9168: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
! 9169: # Daniel Quinlan, quinlan@yggdrasil.com
! 9170: 11 string must\ be\ converted\ with\ BinHex BinHex binary text
! 9171: !:mime application/mac-binhex40
! 9172: >41 string x \b, version %.3s
! 9173:
! 9174: # Stuffit archives are the de facto standard of compression for Macintosh
! 9175: # files obtained from most archives. (franklsm@tuns.ca)
! 9176: 0 string SIT! StuffIt Archive (data)
! 9177: >2 string x : %s
! 9178: 0 string SITD StuffIt Deluxe (data)
! 9179: >2 string x : %s
! 9180: 0 string Seg StuffIt Deluxe Segment (data)
! 9181: >2 string x : %s
! 9182:
! 9183: # Newer StuffIt archives (grant@netbsd.org)
! 9184: 0 string StuffIt StuffIt Archive
! 9185: !:mime application/x-stuffit
! 9186: #>162 string >0 : %s
! 9187:
! 9188: # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
! 9189: # GRR: Too weak
! 9190: #0 string APPL Macintosh Application (data)
! 9191: #>2 string x \b: %s
! 9192:
! 9193: # Macintosh System files (franklsm@tuns.ca)
! 9194: # GRR: Too weak
! 9195: #0 string zsys Macintosh System File (data)
! 9196: #0 string FNDR Macintosh Finder (data)
! 9197: #0 string libr Macintosh Library (data)
! 9198: #>2 string x : %s
! 9199: #0 string shlb Macintosh Shared Library (data)
! 9200: #>2 string x : %s
! 9201: #0 string cdev Macintosh Control Panel (data)
! 9202: #>2 string x : %s
! 9203: #0 string INIT Macintosh Extension (data)
! 9204: #>2 string x : %s
! 9205: #0 string FFIL Macintosh Truetype Font (data)
! 9206: #>2 string x : %s
! 9207: #0 string LWFN Macintosh Postscript Font (data)
! 9208: #>2 string x : %s
! 9209:
! 9210: # Additional Macintosh Files (franklsm@tuns.ca)
! 9211: # GRR: Too weak
! 9212: #0 string PACT Macintosh Compact Pro Archive (data)
! 9213: #>2 string x : %s
! 9214: #0 string ttro Macintosh TeachText File (data)
! 9215: #>2 string x : %s
! 9216: #0 string TEXT Macintosh TeachText File (data)
! 9217: #>2 string x : %s
! 9218: #0 string PDF Macintosh PDF File (data)
! 9219: #>2 string x : %s
! 9220:
! 9221: # MacBinary format (Eric Fischer, enf@pobox.com)
! 9222: #
! 9223: # Unfortunately MacBinary doesn't really have a magic number prior
! 9224: # to the MacBinary III format. The checksum is really the way to
! 9225: # do it, but the magic file format isn't up to the challenge.
! 9226: #
! 9227: # 0 byte 0
! 9228: # 1 byte # filename length
! 9229: # 2 string # filename
! 9230: # 65 string # file type
! 9231: # 69 string # file creator
! 9232: # 73 byte # Finder flags
! 9233: # 74 byte 0
! 9234: # 75 beshort # vertical posn in window
! 9235: # 77 beshort # horiz posn in window
! 9236: # 79 beshort # window or folder ID
! 9237: # 81 byte # protected?
! 9238: # 82 byte 0
! 9239: # 83 belong # length of data segment
! 9240: # 87 belong # length of resource segment
! 9241: # 91 belong # file creation date
! 9242: # 95 belong # file modification date
! 9243: # 99 beshort # length of comment after resource
! 9244: # 101 byte # new Finder flags
! 9245: # 102 string mBIN # (only in MacBinary III)
! 9246: # 106 byte # char. code of file name
! 9247: # 107 byte # still more Finder flags
! 9248: # 116 belong # total file length
! 9249: # 120 beshort # length of add'l header
! 9250: # 122 byte 129 # for MacBinary II
! 9251: # 122 byte 130 # for MacBinary III
! 9252: # 123 byte 129 # minimum version that can read fmt
! 9253: # 124 beshort # checksum
! 9254: #
! 9255: # This attempts to use the version numbers as a magic number, requiring
! 9256: # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
! 9257: # be 0x81. This works for the files I have, but maybe not for everyone's.
! 9258:
! 9259: # Unfortunately, this magic is quite weak - MPi
! 9260: #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
! 9261:
! 9262: # MacBinary I doesn't have the version number field at all, but MacBinary II
! 9263: # has been in use since 1987 so I hope there aren't many really old files
! 9264: # floating around that this will miss. The original spec calls for using
! 9265: # the nulls in 0, 74, and 82 as the magic number.
! 9266: #
! 9267: # Another possibility, that would also work for MacBinary I, is to use
! 9268: # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
! 9269: # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
! 9270: # and that 74 will be 0. So something like
! 9271: #
! 9272: # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
! 9273: #
! 9274: # >73 byte&0x01 0x01 \b, inited
! 9275: # >73 byte&0x02 0x02 \b, changed
! 9276: # >73 byte&0x04 0x04 \b, busy
! 9277: # >73 byte&0x08 0x08 \b, bozo
! 9278: # >73 byte&0x10 0x10 \b, system
! 9279: # >73 byte&0x10 0x20 \b, bundle
! 9280: # >73 byte&0x10 0x40 \b, invisible
! 9281: # >73 byte&0x10 0x80 \b, locked
! 9282:
! 9283: #>65 string x \b, type "%4.4s"
! 9284:
! 9285: #>65 string 8BIM (PhotoShop)
! 9286: #>65 string ALB3 (PageMaker 3)
! 9287: #>65 string ALB4 (PageMaker 4)
! 9288: #>65 string ALT3 (PageMaker 3)
! 9289: #>65 string APPL (application)
! 9290: #>65 string AWWP (AppleWorks word processor)
! 9291: #>65 string CIRC (simulated circuit)
! 9292: #>65 string DRWG (MacDraw)
! 9293: #>65 string EPSF (Encapsulated PostScript)
! 9294: #>65 string FFIL (font suitcase)
! 9295: #>65 string FKEY (function key)
! 9296: #>65 string FNDR (Macintosh Finder)
! 9297: #>65 string GIFf (GIF image)
! 9298: #>65 string Gzip (GNU gzip)
! 9299: #>65 string INIT (system extension)
! 9300: #>65 string LIB\ (library)
! 9301: #>65 string LWFN (PostScript font)
! 9302: #>65 string MSBC (Microsoft BASIC)
! 9303: #>65 string PACT (Compact Pro archive)
! 9304: #>65 string PDF\ (Portable Document Format)
! 9305: #>65 string PICT (picture)
! 9306: #>65 string PNTG (MacPaint picture)
! 9307: #>65 string PREF (preferences)
! 9308: #>65 string PROJ (Think C project)
! 9309: #>65 string QPRJ (Think Pascal project)
! 9310: #>65 string SCFL (Defender scores)
! 9311: #>65 string SCRN (startup screen)
! 9312: #>65 string SITD (StuffIt Deluxe)
! 9313: #>65 string SPn3 (SuperPaint)
! 9314: #>65 string STAK (HyperCard stack)
! 9315: #>65 string Seg\ (StuffIt segment)
! 9316: #>65 string TARF (Unix tar archive)
! 9317: #>65 string TEXT (ASCII)
! 9318: #>65 string TIFF (TIFF image)
! 9319: #>65 string TOVF (Eudora table of contents)
! 9320: #>65 string WDBN (Microsoft Word word processor)
! 9321: #>65 string WORD (MacWrite word processor)
! 9322: #>65 string XLS\ (Microsoft Excel)
! 9323: #>65 string ZIVM (compress (.Z))
! 9324: #>65 string ZSYS (Pre-System 7 system file)
! 9325: #>65 string acf3 (Aldus FreeHand)
! 9326: #>65 string cdev (control panel)
! 9327: #>65 string dfil (Desk Acessory suitcase)
! 9328: #>65 string libr (library)
! 9329: #>65 string nX^d (WriteNow word processor)
! 9330: #>65 string nX^w (WriteNow dictionary)
! 9331: #>65 string rsrc (resource)
! 9332: #>65 string scbk (Scrapbook)
! 9333: #>65 string shlb (shared library)
! 9334: #>65 string ttro (SimpleText read-only)
! 9335: #>65 string zsys (system file)
! 9336:
! 9337: #>69 string x \b, creator "%4.4s"
! 9338:
! 9339: # Somewhere, Apple has a repository of registered Creator IDs. These are
! 9340: # just the ones that I happened to have files from and was able to identify.
! 9341:
! 9342: #>69 string 8BIM (Adobe Photoshop)
! 9343: #>69 string ALD3 (PageMaker 3)
! 9344: #>69 string ALD4 (PageMaker 4)
! 9345: #>69 string ALFA (Alpha editor)
! 9346: #>69 string APLS (Apple Scanner)
! 9347: #>69 string APSC (Apple Scanner)
! 9348: #>69 string BRKL (Brickles)
! 9349: #>69 string BTFT (BitFont)
! 9350: #>69 string CCL2 (Common Lisp 2)
! 9351: #>69 string CCL\ (Common Lisp)
! 9352: #>69 string CDmo (The Talking Moose)
! 9353: #>69 string CPCT (Compact Pro)
! 9354: #>69 string CSOm (Eudora)
! 9355: #>69 string DMOV (Font/DA Mover)
! 9356: #>69 string DSIM (DigSim)
! 9357: #>69 string EDIT (Macintosh Edit)
! 9358: #>69 string ERIK (Macintosh Finder)
! 9359: #>69 string EXTR (self-extracting archive)
! 9360: #>69 string Gzip (GNU gzip)
! 9361: #>69 string KAHL (Think C)
! 9362: #>69 string LWFU (LaserWriter Utility)
! 9363: #>69 string LZIV (compress)
! 9364: #>69 string MACA (MacWrite)
! 9365: #>69 string MACS (Macintosh operating system)
! 9366: #>69 string MAcK (MacKnowledge terminal emulator)
! 9367: #>69 string MLND (Defender)
! 9368: #>69 string MPNT (MacPaint)
! 9369: #>69 string MSBB (Microsoft BASIC (binary))
! 9370: #>69 string MSWD (Microsoft Word)
! 9371: #>69 string NCSA (NCSA Telnet)
! 9372: #>69 string PJMM (Think Pascal)
! 9373: #>69 string PSAL (Hunt the Wumpus)
! 9374: #>69 string PSI2 (Apple File Exchange)
! 9375: #>69 string R*ch (BBEdit)
! 9376: #>69 string RMKR (Resource Maker)
! 9377: #>69 string RSED (Resource Editor)
! 9378: #>69 string Rich (BBEdit)
! 9379: #>69 string SIT! (StuffIt)
! 9380: #>69 string SPNT (SuperPaint)
! 9381: #>69 string Unix (NeXT Mac filesystem)
! 9382: #>69 string VIM! (Vim editor)
! 9383: #>69 string WILD (HyperCard)
! 9384: #>69 string XCEL (Microsoft Excel)
! 9385: #>69 string aCa2 (Fontographer)
! 9386: #>69 string aca3 (Aldus FreeHand)
! 9387: #>69 string dosa (Macintosh MS-DOS file system)
! 9388: #>69 string movr (Font/DA Mover)
! 9389: #>69 string nX^n (WriteNow)
! 9390: #>69 string pdos (Apple ProDOS file system)
! 9391: #>69 string scbk (Scrapbook)
! 9392: #>69 string ttxt (SimpleText)
! 9393: #>69 string ufox (Foreign File Access)
! 9394:
! 9395: # Just in case...
! 9396:
! 9397: 102 string mBIN MacBinary III data with surprising version number
! 9398:
! 9399: # sas magic from Bruce Foster (bef@nwu.edu)
! 9400: #
! 9401: #0 string SAS SAS
! 9402: #>8 string x %s
! 9403: 0 string SAS SAS
! 9404: >24 string DATA data file
! 9405: >24 string CATALOG catalog
! 9406: >24 string INDEX data file index
! 9407: >24 string VIEW data view
! 9408: # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
! 9409: #
! 9410: 0x54 string SAS SAS 7+
! 9411: >0x9C string DATA data file
! 9412: >0x9C string CATALOG catalog
! 9413: >0x9C string INDEX data file index
! 9414: >0x9C string VIEW data view
! 9415:
! 9416: # spss magic for SPSS system and portable files,
! 9417: # from Bruce Foster (bef@nwu.edu).
! 9418:
! 9419: 0 long 0xc1e2c3c9 SPSS Portable File
! 9420: >40 string x %s
! 9421:
! 9422: 0 string $FL2 SPSS System File
! 9423: >24 string x %s
! 9424:
! 9425: # Macintosh filesystem data
! 9426: # From "Tom N Harris" <telliamed@mac.com>
! 9427: # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
! 9428: # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
! 9429: # entries depend on the data arithmetic added after v.35
! 9430: # There's also some Pascal strings in here, ditto...
! 9431:
! 9432: # The boot block signature, according to IM:Files, is
! 9433: # "for HFS volumes, this field always contains the value 0x4C4B."
! 9434: # But if this is true for MFS or HFS+ volumes, I don't know.
! 9435: # Alternatively, the boot block is supposed to be zeroed if it's
! 9436: # unused, so a simply >0 should suffice.
! 9437:
! 9438: 0x400 beshort 0xD2D7 Macintosh MFS data
! 9439: >0 beshort 0x4C4B (bootable)
! 9440: >0x40a beshort &0x8000 (locked)
! 9441: >0x402 beldate-0x7C25B080 x created: %s,
! 9442: >0x406 beldate-0x7C25B080 >0 last backup: %s,
! 9443: >0x414 belong x block size: %d,
! 9444: >0x412 beshort x number of blocks: %d,
! 9445: >0x424 pstring x volume name: %s
! 9446:
! 9447: # "BD" is has many false positives
! 9448: #0x400 beshort 0x4244 Macintosh HFS data
! 9449: #>0 beshort 0x4C4B (bootable)
! 9450: #>0x40a beshort &0x8000 (locked)
! 9451: #>0x40a beshort ^0x0100 (mounted)
! 9452: #>0x40a beshort &0x0200 (spared blocks)
! 9453: #>0x40a beshort &0x0800 (unclean)
! 9454: #>0x47C beshort 0x482B (Embedded HFS+ Volume)
! 9455: #>0x402 beldate-0x7C25B080 x created: %s,
! 9456: #>0x406 beldate-0x7C25B080 x last modified: %s,
! 9457: #>0x440 beldate-0x7C25B080 >0 last backup: %s,
! 9458: #>0x414 belong x block size: %d,
! 9459: #>0x412 beshort x number of blocks: %d,
! 9460: #>0x424 pstring x volume name: %s
! 9461:
! 9462: 0x400 beshort 0x482B Macintosh HFS Extended
! 9463: >&0 beshort x version %d data
! 9464: >0 beshort 0x4C4B (bootable)
! 9465: >0x404 belong ^0x00000100 (mounted)
! 9466: >&2 belong &0x00000200 (spared blocks)
! 9467: >&2 belong &0x00000800 (unclean)
! 9468: >&2 belong &0x00008000 (locked)
! 9469: >&6 string x last mounted by: '%.4s',
! 9470: # really, that should be treated as a belong and we print a string
! 9471: # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
! 9472: >&14 beldate-0x7C25B080 x created: %s,
! 9473: # only the creation date is local time, all other timestamps in HFS+ are UTC.
! 9474: >&18 bedate-0x7C25B080 x last modified: %s,
! 9475: >&22 bedate-0x7C25B080 >0 last backup: %s,
! 9476: >&26 bedate-0x7C25B080 >0 last checked: %s,
! 9477: >&38 belong x block size: %d,
! 9478: >&42 belong x number of blocks: %d,
! 9479: >&46 belong x free blocks: %d
! 9480:
! 9481: # I don't think this is really necessary since it doesn't do much and
! 9482: # anything with a valid driver descriptor will also have a valid
! 9483: # partition map
! 9484: #0 beshort 0x4552 Apple Device Driver data
! 9485: #>&24 beshort =1 \b, MacOS
! 9486:
! 9487: # Is that the partition type a cstring or a pstring? Well, IM says "strings
! 9488: # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
! 9489: # cstring. Of course, partitions can contain more than four entries, but
! 9490: # what're you gonna do?
! 9491: # GRR: This magic is too weak, it is just "PM"
! 9492: #0x200 beshort 0x504D Apple Partition data
! 9493: #>0x2 beshort x (block size: %d):
! 9494: #>0x230 string x first type: %s,
! 9495: #>0x210 string x name: %s,
! 9496: #>0x254 belong x number of blocks: %d,
! 9497: #>0x400 beshort 0x504D
! 9498: #>>0x430 string x second type: %s,
! 9499: #>>0x410 string x name: %s,
! 9500: #>>0x454 belong x number of blocks: %d,
! 9501: #>>0x600 beshort 0x504D
! 9502: #>>>0x630 string x third type: %s,
! 9503: #>>>0x610 string x name: %s,
! 9504: #>>>0x654 belong x number of blocks: %d,
! 9505: #>>0x800 beshort 0x504D
! 9506: #>>>0x830 string x fourth type: %s,
! 9507: #>>>0x810 string x name: %s,
! 9508: #>>>0x854 belong x number of blocks: %d,
! 9509: #>>>0xa00 beshort 0x504D
! 9510: #>>>>0xa30 string x fifth type: %s,
! 9511: #>>>>0xa10 string x name: %s,
! 9512: #>>>>0xa54 belong x number of blocks: %d
! 9513: #>>>0xc00 beshort 0x504D
! 9514: #>>>>0xc30 string x sixth type: %s,
! 9515: #>>>>0xc10 string x name: %s,
! 9516: #>>>>0xc54 belong x number of blocks: %d
! 9517: ## AFAIK, only the signature is different
! 9518: #0x200 beshort 0x5453 Apple Old Partition data
! 9519: #>0x2 beshort x block size: %d,
! 9520: #>0x230 string x first type: %s,
! 9521: #>0x210 string x name: %s,
! 9522: #>0x254 belong x number of blocks: %d,
! 9523: #>0x400 beshort 0x504D
! 9524: #>>0x430 string x second type: %s,
! 9525: #>>0x410 string x name: %s,
! 9526: #>>0x454 belong x number of blocks: %d,
! 9527: #>>0x800 beshort 0x504D
! 9528: #>>>0x830 string x third type: %s,
! 9529: #>>>0x810 string x name: %s,
! 9530: #>>>0x854 belong x number of blocks: %d,
! 9531: #>>>0xa00 beshort 0x504D
! 9532: #>>>>0xa30 string x fourth type: %s,
! 9533: #>>>>0xa10 string x name: %s,
! 9534: #>>>>0xa54 belong x number of blocks: %d
! 9535:
! 9536: # From: Remi Mommsen <mommsen@slac.stanford.edu>
! 9537: 0 string BOMStore Mac OS X bill of materials (BOM) file
! 9538:
! 9539: #------------------------------------------------------------------------------
! 9540: # magic: file(1) magic for magic files
! 9541: #
! 9542: 0 string #\ Magic magic text file for file(1) cmd
! 9543: 0 lelong 0xF11E041C magic binary file for file(1) cmd
! 9544: >4 lelong x (version %d) (little endian)
! 9545: 0 belong 0xF11E041C magic binary file for file(1) cmd
! 9546: >4 belong x (version %d) (big endian)
! 9547: #------------------------------------------------------------------------------
! 9548: # mail.news: file(1) magic for mail and news
! 9549: #
! 9550: # Unfortunately, saved netnews also has From line added in some news software.
! 9551: #0 string From mail text
! 9552: # There are tests to ascmagic.c to cope with mail and news.
! 9553: 0 string Relay-Version: old news text
! 9554: !:mime message/rfc822
! 9555: 0 string #!\ rnews batched news text
! 9556: !:mime message/rfc822
! 9557: 0 string N#!\ rnews mailed, batched news text
! 9558: !:mime message/rfc822
! 9559: 0 string Forward\ to mail forwarding text
! 9560: !:mime message/rfc822
! 9561: 0 string Pipe\ to mail piping text
! 9562: !:mime message/rfc822
! 9563: 0 string Return-Path: smtp mail text
! 9564: !:mime message/rfc822
! 9565: 0 string Path: news text
! 9566: !:mime message/news
! 9567: 0 string Xref: news text
! 9568: !:mime message/news
! 9569: 0 string From: news or mail text
! 9570: !:mime message/rfc822
! 9571: 0 string Article saved news text
! 9572: !:mime message/news
! 9573: 0 string BABYL Emacs RMAIL text
! 9574: 0 string Received: RFC 822 mail text
! 9575: !:mime message/rfc822
! 9576: 0 string MIME-Version: MIME entity text
! 9577: #0 string Content- MIME entity text
! 9578:
! 9579: # TNEF files...
! 9580: 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
! 9581:
! 9582: # From: Kevin Sullivan <ksulliva@psc.edu>
! 9583: 0 string *mbx* MBX mail folder
! 9584:
! 9585: # From: Simon Matter <simon.matter@invoca.ch>
! 9586: 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
! 9587:
! 9588: # JAM(mbp) Fidonet message area databases
! 9589: # JHR file
! 9590: 0 string JAM\0 JAM message area header file
! 9591: >12 leshort >0 (%d messages)
! 9592:
! 9593: # Squish Fidonet message area databases
! 9594: # SQD file (requires at least one message in the area)
! 9595: # XXX: Weak magic
! 9596: #256 leshort 0xAFAE4453 Squish message area data file
! 9597: #>4 leshort >0 (%d messages)
! 9598:
! 9599: #0 string \<!--\ MHonArc text/html; x-type=mhonarc
! 9600:
! 9601: #------------------------------------------------------------------------------
! 9602: # maple: file(1) magic for maple files
! 9603: # "H. Nanosecond" <aldomel@ix.netcom.com>
! 9604: # Maple V release 4, a multi-purpose math program
! 9605: #
! 9606:
! 9607: # maple library .lib
! 9608: 0 string \000MVR4\nI MapleVr4 library
! 9609:
! 9610: # .ind
! 9611: # no magic for these :-(
! 9612: # they are compiled indexes for maple files
! 9613:
! 9614: # .hdb
! 9615: 0 string \000\004\000\000 Maple help database
! 9616:
! 9617: # .mhp
! 9618: # this has the form <PACKAGE=name>
! 9619: 0 string \<PACKAGE= Maple help file
! 9620: 0 string \<HELP\ NAME= Maple help file
! 9621: 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
! 9622: #0 string #\ Newton Maple help file, old style
! 9623: 0 string #\ daub Maple help file, old style
! 9624: #0 string #=========== Maple help file, old style
! 9625:
! 9626: # .mws
! 9627: 0 string \000\000\001\044\000\221 Maple worksheet
! 9628: #this is anomalous
! 9629: 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
! 9630: # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
! 9631: # that is {VERSION major_version miunor_version computer_type version_string}
! 9632: 0 string {VERSION\ Maple worksheet
! 9633: >9 string >\0 version %.1s.
! 9634: >>>11 string >\0 %.1s
! 9635:
! 9636: # .mps
! 9637: 0 string \0\0\001$ Maple something
! 9638: # from byte 4 it is either 'nul E' or 'soh R'
! 9639: # I think 'nul E' means a file that was saved as a different name
! 9640: # a sort of revision marking
! 9641: # 'soh R' means new
! 9642: >4 string \000\105 An old revision
! 9643: >4 string \001\122 The latest save
! 9644:
! 9645: # .mpl
! 9646: # some of these are the same as .mps above
! 9647: #0000000 000 000 001 044 000 105 same as .mps
! 9648: #0000000 000 000 001 044 001 122 same as .mps
! 9649:
! 9650: 0 string #\n##\ <SHAREFILE= Maple something
! 9651: 0 string \n#\n##\ <SHAREFILE= Maple something
! 9652: 0 string ##\ <SHAREFILE= Maple something
! 9653: 0 string #\r##\ <SHAREFILE= Maple something
! 9654: 0 string \r#\r##\ <SHAREFILE= Maple something
! 9655: 0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
! 9656:
! 9657: #------------------------------------------------------------------------------
! 9658: # mathcad: file(1) magic for Mathcad documents
! 9659: # URL: http://www.mathsoft.com/
! 9660: # From: Josh Triplett <josh@freedesktop.org>
! 9661:
! 9662: 0 string .MCAD\t Mathcad document
! 9663: #------------------------------------------------------------------------------
! 9664: # mathematica: file(1) magic for mathematica files
! 9665: # "H. Nanosecond" <aldomel@ix.netcom.com>
! 9666: # Mathematica a multi-purpose math program
! 9667: # versions 2.2 and 3.0
! 9668:
! 9669: #mathematica .mb
! 9670: 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
! 9671: 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
! 9672:
! 9673: # .ma
! 9674: # multiple possibilites:
! 9675:
! 9676: 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
! 9677: #>41 string >\0 %s
! 9678:
! 9679: #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
! 9680:
! 9681: #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
! 9682: #>675 string >\0 %s #doesn't work well
! 9683:
! 9684: # there may be 'cr' instread of 'nl' in some does this matter?
! 9685:
! 9686: # generic:
! 9687: 0 string (*^\r\r::[\011 Mathematica notebook version 2.x
! 9688: 0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
! 9689: 0 string (*^\015 Mathematica notebook version 2.x
! 9690: 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
! 9691: 0 string (*^\r::[\011 Mathematica notebook version 2.x
! 9692: 0 string (*^\r\n::[\011 Mathematica notebook version 2.x
! 9693: 0 string (*^\n\n::[\011 Mathematica notebook version 2.x
! 9694: 0 string (*^\n::[\011 Mathematica notebook version 2.x
! 9695:
! 9696:
! 9697: # Mathematica .mx files
! 9698:
! 9699: #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
! 9700: 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
! 9701: #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
! 9702: # >71... is optional
! 9703: >88 string >\0 from %s
! 9704:
! 9705:
! 9706: # Mathematica files PBF:
! 9707: # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
! 9708: 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
! 9709:
! 9710: # .ml files These are menu resources I think
! 9711: # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
! 9712: # how to put that into a magic rule?
! 9713: 4 string \ A~ MAthematica .ml file
! 9714:
! 9715: # .nb files
! 9716: #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
! 9717: 0 string (*********************** Mathematica 3.0 notebook
! 9718:
! 9719: # other (* matches it is a comment start in these langs
! 9720: # GRR: Too weak; also matches other languages e.g. ML
! 9721: #0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
! 9722:
! 9723: #########################
! 9724: # MatLab v5
! 9725: 0 string MATLAB Matlab v5 mat-file
! 9726: >126 short 0x494d (big endian)
! 9727: >>124 beshort x version 0x%04x
! 9728: >126 short 0x4d49 (little endian)
! 9729: >>124 leshort x version 0x%04x
! 9730:
! 9731:
! 9732: #------------------------------------------------------------------------------
! 9733: # matroska: file(1) magic for Matroska files
! 9734: #
! 9735: # See http://www.matroska.org/
! 9736: #
! 9737:
! 9738: # EBML id:
! 9739: 0 belong 0x1a45dfa3
! 9740: # DocType id:
! 9741: >5 beshort 0x4282
! 9742: # DocType contents:
! 9743: >>8 string matroska Matroska data
! 9744:
! 9745: #------------------------------------------------------------------------------
! 9746: # Mavroyanopoulos Nikos <nmav@hellug.gr>
! 9747: # mcrypt: file(1) magic for mcrypt 2.2.x;
! 9748: 0 string \0m\3 mcrypt 2.5 encrypted data,
! 9749: >4 string >\0 algorithm: %s,
! 9750: >>&1 leshort >0 keysize: %d bytes,
! 9751: >>>&0 string >\0 mode: %s,
! 9752:
! 9753: 0 string \0m\2 mcrypt 2.2 encrypted data,
! 9754: >3 byte 0 algorithm: blowfish-448,
! 9755: >3 byte 1 algorithm: DES,
! 9756: >3 byte 2 algorithm: 3DES,
! 9757: >3 byte 3 algorithm: 3-WAY,
! 9758: >3 byte 4 algorithm: GOST,
! 9759: >3 byte 6 algorithm: SAFER-SK64,
! 9760: >3 byte 7 algorithm: SAFER-SK128,
! 9761: >3 byte 8 algorithm: CAST-128,
! 9762: >3 byte 9 algorithm: xTEA,
! 9763: >3 byte 10 algorithm: TWOFISH-128,
! 9764: >3 byte 11 algorithm: RC2,
! 9765: >3 byte 12 algorithm: TWOFISH-192,
! 9766: >3 byte 13 algorithm: TWOFISH-256,
! 9767: >3 byte 14 algorithm: blowfish-128,
! 9768: >3 byte 15 algorithm: blowfish-192,
! 9769: >3 byte 16 algorithm: blowfish-256,
! 9770: >3 byte 100 algorithm: RC6,
! 9771: >3 byte 101 algorithm: IDEA,
! 9772: >4 byte 0 mode: CBC,
! 9773: >4 byte 1 mode: ECB,
! 9774: >4 byte 2 mode: CFB,
! 9775: >4 byte 3 mode: OFB,
! 9776: >4 byte 4 mode: nOFB,
! 9777: >5 byte 0 keymode: 8bit
! 9778: >5 byte 1 keymode: 4bit
! 9779: >5 byte 2 keymode: SHA-1 hash
! 9780: >5 byte 3 keymode: MD5 hash
! 9781:
! 9782: #------------------------------------------------------------------------------
! 9783: # mercurial: file(1) magic for Mercurial changeset bundles
! 9784: # http://www.selenic.com/mercurial/wiki/
! 9785: #
! 9786: # Jesse Glick (jesse.glick@sun.com)
! 9787: #
! 9788:
! 9789: 0 string HG10 Mercurial changeset bundle
! 9790: >4 string UN (uncompressed)
! 9791: >4 string GZ (gzip compressed)
! 9792: >4 string BZ (bzip2 compressed)
! 9793: #------------------------------------------------------------------------------
! 9794: # mime: file(1) magic for MIME encoded files
! 9795: #
! 9796: 0 string Content-Type:\
! 9797: >14 string >\0 %s
! 9798: 0 string Content-Type:
! 9799: >13 string >\0 %s
! 9800:
! 9801: #------------------------------------------------------------------------------
! 9802: # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
! 9803: # Dec Ultrix (MIPS)
! 9804: # all of SGI's *current* machines and OSes run in big-endian mode on the
! 9805: # MIPS machines, as far as I know.
! 9806: #
! 9807: # XXX - what is the blank "-" line?
! 9808: #
! 9809: # kbd file definitions
! 9810: 0 string kbd!map kbd map file
! 9811: >8 byte >0 Ver %d:
! 9812: >10 short >0 with %d table(s)
! 9813: 0 belong 0407 old SGI 68020 executable
! 9814: 0 belong 0410 old SGI 68020 pure executable
! 9815: 0 beshort 0x8765 disk quotas file
! 9816: 0 beshort 0x0506 IRIS Showcase file
! 9817: >2 byte 0x49 -
! 9818: >3 byte x - version %ld
! 9819: 0 beshort 0x0226 IRIS Showcase template
! 9820: >2 byte 0x63 -
! 9821: >3 byte x - version %ld
! 9822: 0 belong 0x5343464d IRIS Showcase file
! 9823: >4 byte x - version %ld
! 9824: 0 belong 0x5443464d IRIS Showcase template
! 9825: >4 byte x - version %ld
! 9826: 0 belong 0xdeadbabe IRIX Parallel Arena
! 9827: >8 belong >0 - version %ld
! 9828: #
! 9829: 0 beshort 0x0160 MIPSEB ECOFF executable
! 9830: >20 beshort 0407 (impure)
! 9831: >20 beshort 0410 (swapped)
! 9832: >20 beshort 0413 (paged)
! 9833: >8 belong >0 not stripped
! 9834: >8 belong 0 stripped
! 9835: >22 byte x - version %ld
! 9836: >23 byte x .%ld
! 9837: #
! 9838: 0 beshort 0x0162 MIPSEL-BE ECOFF executable
! 9839: >20 beshort 0407 (impure)
! 9840: >20 beshort 0410 (swapped)
! 9841: >20 beshort 0413 (paged)
! 9842: >8 belong >0 not stripped
! 9843: >8 belong 0 stripped
! 9844: >23 byte x - version %d
! 9845: >22 byte x .%ld
! 9846: #
! 9847: 0 beshort 0x6001 MIPSEB-LE ECOFF executable
! 9848: >20 beshort 03401 (impure)
! 9849: >20 beshort 04001 (swapped)
! 9850: >20 beshort 05401 (paged)
! 9851: >8 belong >0 not stripped
! 9852: >8 belong 0 stripped
! 9853: >23 byte x - version %d
! 9854: >22 byte x .%ld
! 9855: #
! 9856: 0 beshort 0x6201 MIPSEL ECOFF executable
! 9857: >20 beshort 03401 (impure)
! 9858: >20 beshort 04001 (swapped)
! 9859: >20 beshort 05401 (paged)
! 9860: >8 belong >0 not stripped
! 9861: >8 belong 0 stripped
! 9862: >23 byte x - version %ld
! 9863: >22 byte x .%ld
! 9864: #
! 9865: # MIPS 2 additions
! 9866: #
! 9867: 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
! 9868: >20 beshort 0407 (impure)
! 9869: >20 beshort 0410 (swapped)
! 9870: >20 beshort 0413 (paged)
! 9871: >8 belong >0 not stripped
! 9872: >8 belong 0 stripped
! 9873: >22 byte x - version %ld
! 9874: >23 byte x .%ld
! 9875: #
! 9876: 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
! 9877: >20 beshort 0407 (impure)
! 9878: >20 beshort 0410 (swapped)
! 9879: >20 beshort 0413 (paged)
! 9880: >8 belong >0 not stripped
! 9881: >8 belong 0 stripped
! 9882: >22 byte x - version %ld
! 9883: >23 byte x .%ld
! 9884: #
! 9885: 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
! 9886: >20 beshort 03401 (impure)
! 9887: >20 beshort 04001 (swapped)
! 9888: >20 beshort 05401 (paged)
! 9889: >8 belong >0 not stripped
! 9890: >8 belong 0 stripped
! 9891: >23 byte x - version %ld
! 9892: >22 byte x .%ld
! 9893: #
! 9894: 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
! 9895: >20 beshort 03401 (impure)
! 9896: >20 beshort 04001 (swapped)
! 9897: >20 beshort 05401 (paged)
! 9898: >8 belong >0 not stripped
! 9899: >8 belong 0 stripped
! 9900: >23 byte x - version %ld
! 9901: >22 byte x .%ld
! 9902: #
! 9903: # MIPS 3 additions
! 9904: #
! 9905: 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
! 9906: >20 beshort 0407 (impure)
! 9907: >20 beshort 0410 (swapped)
! 9908: >20 beshort 0413 (paged)
! 9909: >8 belong >0 not stripped
! 9910: >8 belong 0 stripped
! 9911: >22 byte x - version %ld
! 9912: >23 byte x .%ld
! 9913: #
! 9914: 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
! 9915: >20 beshort 0407 (impure)
! 9916: >20 beshort 0410 (swapped)
! 9917: >20 beshort 0413 (paged)
! 9918: >8 belong >0 not stripped
! 9919: >8 belong 0 stripped
! 9920: >22 byte x - version %ld
! 9921: >23 byte x .%ld
! 9922: #
! 9923: 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
! 9924: >20 beshort 03401 (impure)
! 9925: >20 beshort 04001 (swapped)
! 9926: >20 beshort 05401 (paged)
! 9927: >8 belong >0 not stripped
! 9928: >8 belong 0 stripped
! 9929: >23 byte x - version %ld
! 9930: >22 byte x .%ld
! 9931: #
! 9932: 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
! 9933: >20 beshort 03401 (impure)
! 9934: >20 beshort 04001 (swapped)
! 9935: >20 beshort 05401 (paged)
! 9936: >8 belong >0 not stripped
! 9937: >8 belong 0 stripped
! 9938: >23 byte x - version %ld
! 9939: >22 byte x .%ld
! 9940: #
! 9941: 0 beshort 0x180 MIPSEB Ucode
! 9942: 0 beshort 0x182 MIPSEL-BE Ucode
! 9943: # 32bit core file
! 9944: 0 belong 0xdeadadb0 IRIX core dump
! 9945: >4 belong 1 of
! 9946: >16 string >\0 '%s'
! 9947: # 64bit core file
! 9948: 0 belong 0xdeadad40 IRIX 64-bit core dump
! 9949: >4 belong 1 of
! 9950: >16 string >\0 '%s'
! 9951: # N32bit core file
! 9952: 0 belong 0xbabec0bb IRIX N32 core dump
! 9953: >4 belong 1 of
! 9954: >16 string >\0 '%s'
! 9955: # New style crash dump file
! 9956: 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
! 9957: >36 string >\0 '%s'
! 9958: # Trusted IRIX info
! 9959: 0 string SGIAUDIT SGI Audit file
! 9960: >8 byte x - version %d
! 9961: >9 byte x .%ld
! 9962: #
! 9963: 0 string WNGZWZSC Wingz compiled script
! 9964: 0 string WNGZWZSS Wingz spreadsheet
! 9965: 0 string WNGZWZHP Wingz help file
! 9966: #
! 9967: 0 string #Inventor V IRIS Inventor 1.0 file
! 9968: 0 string #Inventor V2 Open Inventor 2.0 file
! 9969: # GLF is OpenGL stream encoding
! 9970: 0 string glfHeadMagic(); GLF_TEXT
! 9971: 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
! 9972: 4 belong 0x0000007d GLF_BINARY_MSB_FIRST
! 9973: # GLS is OpenGL stream encoding; GLS is the successor of GLF
! 9974: 0 string glsBeginGLS( GLS_TEXT
! 9975: 4 belong 0x10000000 GLS_BINARY_LSB_FIRST
! 9976: 4 belong 0x00000010 GLS_BINARY_MSB_FIRST
! 9977:
! 9978: #------------------------------------------------------------------------------
! 9979: # mirage: file(1) magic for Mirage executables
! 9980: #
! 9981: # XXX - byte order?
! 9982: #
! 9983: 0 long 31415 Mirage Assembler m.out executable
! 9984: #-----------------------------------------------------------------------------
! 9985: # misctools: file(1) magic for miscellaneous UNIX tools.
! 9986: #
! 9987: 0 search/1 %%!! X-Post-It-Note text
! 9988: 0 string/c BEGIN:VCALENDAR vCalendar calendar file
! 9989: 0 string/c BEGIN:VCARD vCard visiting card
! 9990: !:mime text/x-vcard
! 9991:
! 9992: # From: Alex Beregszaszi <alex@fsn.hu>
! 9993: 4 string gtktalog GNOME Catalogue (gtktalog)
! 9994: >13 string >\0 version %s
! 9995:
! 9996: # Summary: Libtool library file
! 9997: # Extension: .la
! 9998: # Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
! 9999: 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
! 10000:
! 10001: # Summary: Libtool object file
! 10002: # Extension: .lo
! 10003: # Submitted by: Abel Cheung <abelcheung@gmail.com>
! 10004: 0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
! 10005:
! 10006: #------------------------------------------------------------------------------
! 10007: # mkid: file(1) magic for mkid(1) databases
! 10008: #
! 10009: # ID is the binary tags database produced by mkid(1).
! 10010: #
! 10011: # XXX - byte order?
! 10012: #
! 10013: 0 string \311\304 ID tags data
! 10014: >2 short >0 version %d
! 10015:
! 10016: #------------------------------------------------------------------------------
! 10017: # mlssa: file(1) magic for MLSSA datafiles
! 10018: #
! 10019: 0 lelong 0xffffabcd MLSSA datafile,
! 10020: >4 leshort x algorithm %d,
! 10021: >10 lelong x %d samples
! 10022:
! 10023: #------------------------------------------------------------------------------
! 10024: # mmdf: file(1) magic for MMDF mail files
! 10025: #
! 10026: 0 string \001\001\001\001 MMDF mailbox
! 10027: #------------------------------------------------------------------------------
! 10028: # modem: file(1) magic for modem programs
! 10029: #
! 10030: # From: Florian La Roche <florian@knorke.saar.de>
! 10031: 1 string PC\ Research,\ Inc Digifax-G3-File
! 10032: >29 byte 1 \b, fine resolution
! 10033: >29 byte 0 \b, normal resolution
! 10034:
! 10035: 0 short 0x0100 raw G3 data, byte-padded
! 10036: 0 short 0x1400 raw G3 data
! 10037: #
! 10038: # Magic data for vgetty voice formats
! 10039: # (Martin Seine & Marc Eberhard)
! 10040:
! 10041: #
! 10042: # raw modem data version 1
! 10043: #
! 10044: 0 string RMD1 raw modem data
! 10045: >4 string >\0 (%s /
! 10046: >20 short >0 compression type 0x%04x)
! 10047:
! 10048: #
! 10049: # portable voice format 1
! 10050: #
! 10051: 0 string PVF1\n portable voice format
! 10052: >5 string >\0 (binary %s)
! 10053:
! 10054: #
! 10055: # portable voice format 2
! 10056: #
! 10057: 0 string PVF2\n portable voice format
! 10058: >5 string >\0 (ascii %s)
! 10059:
! 10060:
! 10061: #------------------------------------------------------------------------------
! 10062: # motorola: file(1) magic for Motorola 68K and 88K binaries
! 10063: #
! 10064: # 68K
! 10065: #
! 10066: 0 beshort 0520 mc68k COFF
! 10067: >18 beshort ^00000020 object
! 10068: >18 beshort &00000020 executable
! 10069: >12 belong >0 not stripped
! 10070: >168 string .lowmem Apple toolbox
! 10071: >20 beshort 0407 (impure)
! 10072: >20 beshort 0410 (pure)
! 10073: >20 beshort 0413 (demand paged)
! 10074: >20 beshort 0421 (standalone)
! 10075: 0 beshort 0521 mc68k executable (shared)
! 10076: >12 belong >0 not stripped
! 10077: 0 beshort 0522 mc68k executable (shared demand paged)
! 10078: >12 belong >0 not stripped
! 10079: #
! 10080: # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
! 10081: #
! 10082: 0 beshort 0554 68K BCS executable
! 10083: #
! 10084: # 88K
! 10085: #
! 10086: # Motorola/88Open BCS
! 10087: #
! 10088: 0 beshort 0555 88K BCS executable
! 10089: #
! 10090: # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
! 10091: 0 string S0 Motorola S-Record; binary data in text format
! 10092:
! 10093: # ATARI ST relocatable PRG
! 10094: #
! 10095: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
! 10096: # (according to Roland Waldi, Oct 21, 1987)
! 10097: # besides the magic 0x601a, the text segment size is checked to be
! 10098: # not larger than 1 MB (which is a lot on ST).
! 10099: # The additional 0x601b distinction I took from Doug Lee's magic.
! 10100: 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
! 10101: >2 belong x (txt=%ld,
! 10102: >6 belong x dat=%ld,
! 10103: >10 belong x bss=%ld,
! 10104: >14 belong x sym=%ld)
! 10105: 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
! 10106: >2 belong x (txt=%ld,
! 10107: >6 belong x dat=%ld,
! 10108: >10 belong x bss=%ld,
! 10109: >14 belong x sym=%ld)
! 10110:
! 10111: # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
! 10112: 0 beshort 0x601A Atari 68xxx executable,
! 10113: >2 belong x text len %lu,
! 10114: >6 belong x data len %lu,
! 10115: >10 belong x BSS len %lu,
! 10116: >14 belong x symboltab len %lu,
! 10117: >18 belong 0
! 10118: >22 belong &0x01 fastload flag,
! 10119: >22 belong &0x02 may be loaded to alternate RAM,
! 10120: >22 belong &0x04 malloc may be from alternate RAM,
! 10121: >22 belong x flags: 0x%lX,
! 10122: >26 beshort 0 no relocation tab
! 10123: >26 beshort !0 + relocation tab
! 10124: >30 string SFX [Self-Extracting LZH SFX archive]
! 10125: >38 string SFX [Self-Extracting LZH SFX archive]
! 10126: >44 string ZIP! [Self-Extracting ZIP SFX archive]
! 10127:
! 10128: 0 beshort 0x0064 Atari 68xxx CPX file
! 10129: >8 beshort x (version %04lx)
! 10130:
! 10131: #------------------------------------------------------------------------------
! 10132: # mozilla: file(1) magic for Mozilla XUL fastload files
! 10133: # (XUL.mfasl and XPC.mfasl)
! 10134: # URL: http://www.mozilla.org/
! 10135: # From: Josh Triplett <josh@freedesktop.org>
! 10136:
! 10137: 0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
! 10138:
! 10139: #------------------------------------------------------------------------------
! 10140: # msdos: file(1) magic for MS-DOS files
! 10141: #
! 10142:
! 10143: # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
! 10144: # updated by Joerg Jenderek
! 10145: 0 string @
! 10146: >1 string/cB \ echo\ off MS-DOS batch file text
! 10147: !:mime text/x-msdos-batch
! 10148: >1 string/cB echo\ off MS-DOS batch file text
! 10149: !:mime text/x-msdos-batch
! 10150: >1 string/cB rem\ MS-DOS batch file text
! 10151: !:mime text/x-msdos-batch
! 10152: >1 string/cB set\ MS-DOS batch file text
! 10153: !:mime text/x-msdos-batch
! 10154:
! 10155:
! 10156: # OS/2 batch files are REXX. the second regex is a bit generic, oh well
! 10157: # the matched commands seem to be common in REXX and uncommon elsewhere
! 10158: 100 search/0xffff rxfuncadd
! 10159: >100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
! 10160: 100 search/0xffff say
! 10161: >100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
! 10162:
! 10163: 0 leshort 0x14c MS Windows COFF Intel 80386 object file
! 10164: #>4 ledate x stamp %s
! 10165: 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
! 10166: #>4 ledate x stamp %s
! 10167: 0 leshort 0x184 MS Windows COFF Alpha object file
! 10168: #>4 ledate x stamp %s
! 10169: 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
! 10170: #>4 ledate x stamp %s
! 10171: 0 leshort 0x1f0 MS Windows COFF PowerPC object file
! 10172: #>4 ledate x stamp %s
! 10173: 0 leshort 0x290 MS Windows COFF PA-RISC object file
! 10174: #>4 ledate x stamp %s
! 10175:
! 10176: # XXX - according to Microsoft's spec, at an offset of 0x3c in a
! 10177: # PE-format executable is the offset in the file of the PE header;
! 10178: # unfortunately, that's a little-endian offset, and there's no way
! 10179: # to specify an indirect offset with a specified byte order.
! 10180: # So, for now, we assume the standard MS-DOS stub, which puts the
! 10181: # PE header at 0x80 = 128.
! 10182: #
! 10183: # Required OS version and subsystem version were 4.0 on some NT 3.51
! 10184: # executables built with Visual C++ 4.0, so it's not clear that
! 10185: # they're interesting. The user version was 0.0, but there's
! 10186: # probably some linker directive to set it. The linker version was
! 10187: # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
! 10188: #
! 10189: # many of the compressed formats were extraced from IDARC 1.23 source code
! 10190: #
! 10191: 0 string MZ
! 10192: !:mime application/x-dosexec
! 10193: >0x18 leshort <0x40 MS-DOS executable
! 10194: >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
! 10195: >>&18 leshort&0x2000 >0 (DLL)
! 10196: >>&88 leshort 0 (unknown subsystem)
! 10197: >>&88 leshort 1 (native)
! 10198: >>&88 leshort 2 (GUI)
! 10199: >>&88 leshort 3 (console)
! 10200: >>&88 leshort 7 (POSIX)
! 10201: >>&0 leshort 0x0 unknown processor
! 10202: >>&0 leshort 0x14c Intel 80386
! 10203: >>&0 leshort 0x166 MIPS R4000
! 10204: >>&0 leshort 0x184 Alpha
! 10205: >>&0 leshort 0x268 Motorola 68000
! 10206: >>&0 leshort 0x1f0 PowerPC
! 10207: >>&0 leshort 0x290 PA-RISC
! 10208: >>&18 leshort&0x0100 >0 32-bit
! 10209: >>&18 leshort&0x1000 >0 system file
! 10210: >>&228 lelong >0 \b, Mono/.Net assembly
! 10211: >>&0xf4 search/0x140 \x0\x40\x1\x0
! 10212: >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
! 10213: >30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
! 10214: !:mime application/zip
! 10215: # Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect.
! 10216: >30 string PKLITE\ Copr. Self-extracting PKZIP archive
! 10217: !:mime application/zip
! 10218:
! 10219: >0x18 leshort >0x3f
! 10220: >>(0x3c.l) string PE\0\0 PE
! 10221: >>>(0x3c.l+25) byte 1 \b32 executable
! 10222: >>>(0x3c.l+25) byte 2 \b32+ executable
! 10223: # hooray, there's a DOS extender using the PE format, with a valid PE
! 10224: # executable inside (which just prints a message and exits if run in win)
! 10225: >>>(0x3c.l+92) leshort <10
! 10226: >>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
! 10227: >>>>(8.s*16) string !32STUB for MS Windows
! 10228: >>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
! 10229: >>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
! 10230: >>>>>(0x3c.l+92) leshort 1 (native)
! 10231: >>>>>(0x3c.l+92) leshort 2 (GUI)
! 10232: >>>>>(0x3c.l+92) leshort 3 (console)
! 10233: >>>>>(0x3c.l+92) leshort 7 (POSIX)
! 10234: >>>(0x3c.l+92) leshort 10 (EFI application)
! 10235: >>>(0x3c.l+92) leshort 11 (EFI boot service driver)
! 10236: >>>(0x3c.l+92) leshort 12 (EFI runtime driver)
! 10237: >>>(0x3c.l+92) leshort 13 (XBOX)
! 10238: >>>(0x3c.l+4) leshort 0x0 unknown processor
! 10239: >>>(0x3c.l+4) leshort 0x14c Intel 80386
! 10240: >>>(0x3c.l+4) leshort 0x166 MIPS R4000
! 10241: >>>(0x3c.l+4) leshort 0x184 Alpha
! 10242: >>>(0x3c.l+4) leshort 0x268 Motorola 68000
! 10243: >>>(0x3c.l+4) leshort 0x1f0 PowerPC
! 10244: >>>(0x3c.l+4) leshort 0x290 PA-RISC
! 10245: >>>(0x3c.l+4) leshort 0x200 Intel Itanium
! 10246: >>>(0x3c.l+22) leshort&0x0100 >0 32-bit
! 10247: >>>(0x3c.l+22) leshort&0x1000 >0 system file
! 10248: >>>(0x3c.l+232) lelong >0 Mono/.Net assembly
! 10249:
! 10250: >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
! 10251: >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
! 10252: >>>>(0x3c.l+0xf8) search/0x140 UPX2
! 10253: >>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
! 10254: >>>>(0x3c.l+0xf8) search/0x140 .idata
! 10255: >>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
! 10256: >>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
! 10257: >>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
! 10258: >>>>(0x3c.l+0xf8) search/0x140 .rsrc
! 10259: >>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
! 10260: >>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
! 10261: >>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
! 10262: >>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
! 10263: >>>>(0x3c.l+0xf8) search/0x140 .data
! 10264: >>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
! 10265: >>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
! 10266: >>>>>(0x3c.l+0xf7) byte x
! 10267: >>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
! 10268: >>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
! 10269: >>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
! 10270: >>>>(0x3c.l+0xf8) search/0x140 .reloc
! 10271: >>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
! 10272:
! 10273: >>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
! 10274: >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
! 10275: >>>>0x30 string Inno \b, InnoSetup self-extracting archive
! 10276:
! 10277: >>(0x3c.l) string !PE\0\0 MS-DOS executable
! 10278:
! 10279: >>(0x3c.l) string NE \b, NE
! 10280: >>>(0x3c.l+0x36) byte 0 (unknown OS)
! 10281: >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
! 10282: >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
! 10283: >>>(0x3c.l+0x36) byte 3 for MS-DOS
! 10284: >>>(0x3c.l+0x36) byte >3 (unknown OS)
! 10285: >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
! 10286: >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
! 10287: >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
! 10288: >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
! 10289: >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
! 10290:
! 10291: >>(0x3c.l) string LX\0\0 \b, LX
! 10292: >>>(0x3c.l+0x0a) leshort <1 (unknown OS)
! 10293: >>>(0x3c.l+0x0a) leshort 1 for OS/2
! 10294: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
! 10295: >>>(0x3c.l+0x0a) leshort 3 for DOS
! 10296: >>>(0x3c.l+0x0a) leshort >3 (unknown OS)
! 10297: >>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
! 10298: >>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
! 10299: >>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
! 10300: >>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
! 10301: >>>(0x3c.l+0x08) leshort 1 i80286
! 10302: >>>(0x3c.l+0x08) leshort 2 i80386
! 10303: >>>(0x3c.l+0x08) leshort 3 i80486
! 10304: >>>(8.s*16) string emx \b, emx
! 10305: >>>>&1 string x %s
! 10306: >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
! 10307:
! 10308: # MS Windows system file, supposedly a collection of LE executables
! 10309: >>(0x3c.l) string W3 \b, W3 for MS Windows
! 10310:
! 10311: >>(0x3c.l) string LE\0\0 \b, LE executable
! 10312: >>>(0x3c.l+0x0a) leshort 1
! 10313: # some DOS extenders use LE files with OS/2 header
! 10314: >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
! 10315: >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
! 10316: >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
! 10317: >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
! 10318: >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
! 10319: >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
! 10320: >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
! 10321: # this is a wild guess; hopefully it is a specific signature
! 10322: >>>>&0x24 lelong <0x50
! 10323: >>>>>(&0x4c.l) string \xfc\xb8WATCOM
! 10324: >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
! 10325: # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
! 10326: #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
! 10327: # fails with DOS-Extenders.
! 10328: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
! 10329: >>>(0x3c.l+0x0a) leshort 3 for DOS
! 10330: >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
! 10331: >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
! 10332: >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
! 10333:
! 10334: # looks like ASCII, probably some embedded copyright message.
! 10335: # and definitely not NE/LE/LX/PE
! 10336: >>0x3c lelong >0x20000000
! 10337: >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
! 10338: # header data too small for extended executable
! 10339: >2 long !0
! 10340: >>0x18 leshort <0x40
! 10341: >>>(4.s*512) leshort !0x014c
! 10342:
! 10343: >>>>&(2.s-514) string !LE
! 10344: >>>>>&-2 string !BW \b, MZ for MS-DOS
! 10345: >>>>&(2.s-514) string LE \b, LE
! 10346: >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
! 10347: # educated guess since indirection is still not capable enough for complex offset
! 10348: # calculations (next embedded executable would be at &(&2*512+&0-2)
! 10349: # I suspect there are only LE executables in these multi-exe files
! 10350: >>>>&(2.s-514) string BW
! 10351: >>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
! 10352: >>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
! 10353:
! 10354: # This sequence skips to the first COFF segment, usually .text
! 10355: >(4.s*512) leshort 0x014c \b, COFF
! 10356: >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
! 10357: >>(8.s*16) string emx
! 10358: >>>&1 string x for DOS, Win or OS/2, emx %s
! 10359: >>&(&0x42.l-3) byte x
! 10360: >>>&0x26 string UPX \b, UPX compressed
! 10361: # and yet another guess: small .text, and after large .data is unusal, could be 32lite
! 10362: >>&0x2c search/0xa0 .text
! 10363: >>>&0x0b lelong <0x2000
! 10364: >>>>&0 lelong >0x6000 \b, 32lite compressed
! 10365:
! 10366: >(8.s*16) string $WdX \b, WDos/X DOS extender
! 10367:
! 10368: # .EXE formats (Greg Roelofs, newt@uchicago.edu)
! 10369: #
! 10370: >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
! 10371: >0xe7 string LH/2\ Self-Extract \b, %s
! 10372: >0x1c string diet \b, diet compressed
! 10373: >0x1c string LZ09 \b, LZEXE v0.90 compressed
! 10374: >0x1c string LZ91 \b, LZEXE v0.91 compressed
! 10375: >0x1c string tz \b, TinyProg compressed
! 10376: >0x1e string PKLITE \b, %s compressed
! 10377: >0x64 string W\ Collis\0\0 \b, Compack compressed
! 10378: >0x24 string LHa's\ SFX \b, LHa self-extracting archive
! 10379: !:mime application/x-lha
! 10380: >0x24 string LHA's\ SFX \b, LHa self-extracting archive
! 10381: !:mime application/x-lha
! 10382: >0x24 string \ $ARX \b, ARX self-extracting archive
! 10383: >0x24 string \ $LHarc \b, LHarc self-extracting archive
! 10384: >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
! 10385: >1638 string -lh5- \b, LHa self-extracting archive v2.13S
! 10386: >0x17888 string Rar! \b, RAR self-extracting archive
! 10387: >0x40 string aPKG \b, aPackage self-extracting archive
! 10388:
! 10389: >32 string AIN
! 10390: >>35 string 2 \b, AIN 2.x compressed
! 10391: >>35 string <2 \b, AIN 1.x compressed
! 10392: >>35 string >2 \b, AIN 1.x compressed
! 10393: >28 string UC2X \b, UCEXE compressed
! 10394: >28 string WWP\ \b, WWPACK compressed
! 10395:
! 10396: # skip to the end of the exe
! 10397: >(4.s*512) long x
! 10398: >>&(2.s-517) byte x
! 10399: >>>&0 string PK\3\4 \b, ZIP self-extracting archive
! 10400: >>>&0 string Rar! \b, RAR self-extracting archive
! 10401: >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
! 10402: >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
! 10403: >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
! 10404: >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
! 10405: >>>&7 search/400 **ACE** \b, ACE self-extracting archive
! 10406: >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
! 10407:
! 10408: >0x1c string RJSX \b, ARJ self-extracting archive
! 10409: # winarj stores a message in the stub instead of the sig in the MZ header
! 10410: >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
! 10411:
! 10412: # a few unknown ZIP sfxes, no idea if they are needed or if they are
! 10413: # already captured by the generic patterns above
! 10414: >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
! 10415: >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
! 10416: # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
! 10417: #
! 10418:
! 10419: # TELVOX Teleinformatica CODEC self-extractor for OS/2:
! 10420: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
! 10421: >>49824 leshort =1 \b, 1 file
! 10422: >>49824 leshort >1 \b, %u files
! 10423:
! 10424: # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
! 10425: # Uncommenting only the first two lines will cover about 2/3 of COM files,
! 10426: # but it isn't feasible to match all COM files since there must be at least
! 10427: # two dozen different one-byte "magics".
! 10428: #0 byte 0xe9 DOS executable (COM)
! 10429: #>0x1FE leshort 0xAA55 \b, boot code
! 10430: >6 string SFX\ of\ LHarc (%s)
! 10431: 0 belong 0xffffffff DOS executable (device driver)
! 10432: #CMD640X2.SYS
! 10433: >10 string >\x23
! 10434: >>10 string !\x2e
! 10435: >>>17 string <\x5B
! 10436: >>>>10 string x \b, name: %.8s
! 10437: #UDMA.SYS KEYB.SYS CMD640X2.SYS
! 10438: >10 string <\x41
! 10439: >>12 string >\x40
! 10440: >>>10 string !$
! 10441: >>>>12 string x \b, name: %.8s
! 10442: #BTCDROM.SYS ASPICD.SYS
! 10443: >22 string >\x40
! 10444: >>22 string <\x5B
! 10445: >>>23 string <\x5B
! 10446: >>>>22 string x \b, name: %.8s
! 10447: #ATAPICD.SYS
! 10448: >76 string \0
! 10449: >>77 string >\x40
! 10450: >>>77 string <\x5B
! 10451: >>>>77 string x \b, name: %.8s
! 10452: #0 byte 0x8c DOS executable (COM)
! 10453: # 0xeb conflicts with "sequent" magic
! 10454: #0 byte 0xeb DOS executable (COM)
! 10455: #>0x1FE leshort 0xAA55 \b, boot code
! 10456: #>85 string UPX \b, UPX compressed
! 10457: #>4 string \ $ARX \b, ARX self-extracting archive
! 10458: #>4 string \ $LHarc \b, LHarc self-extracting archive
! 10459: #>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
! 10460: #0 byte 0xb8 COM executable
! 10461: # modified by Joerg Jenderek
! 10462: >1 lelong !0x21cd4cff for DOS
! 10463: # http://syslinux.zytor.com/comboot.php
! 10464: # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
! 10465: # start with assembler instructions mov eax,21cd4cffh
! 10466: >1 lelong 0x21cd4cff (32-bit COMBOOT)
! 10467: 0 string \x81\xfc
! 10468: >4 string \x77\x02\xcd\x20\xb9
! 10469: >>36 string UPX! FREE-DOS executable (COM), UPX compressed
! 10470: 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
! 10471: # GRR search is not working
! 10472: #2 search/28 \xcd\x21 COM executable for MS-DOS
! 10473: #WHICHFAT.cOM
! 10474: 2 string \xcd\x21 COM executable for DOS
! 10475: #DELTREE.cOM DELTREE2.cOM
! 10476: 4 string \xcd\x21 COM executable for DOS
! 10477: #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
! 10478: 5 string \xcd\x21 COM executable for DOS
! 10479: #DELTMP.COm HASFAT32.cOM
! 10480: 7 string \xcd\x21
! 10481: >0 byte !0xb8 COM executable for DOS
! 10482: #COMP.cOM MORE.COm
! 10483: 10 string \xcd\x21
! 10484: >5 string !\xcd\x21 COM executable for DOS
! 10485: #comecho.com
! 10486: 13 string \xcd\x21 COM executable for DOS
! 10487: #HELP.COm EDIT.coM
! 10488: 18 string \xcd\x21 COM executable for MS-DOS
! 10489: #NWRPLTRM.COm
! 10490: 23 string \xcd\x21 COM executable for MS-DOS
! 10491: #LOADFIX.cOm LOADFIX.cOm
! 10492: 30 string \xcd\x21 COM executable for MS-DOS
! 10493: #syslinux.com 3.11
! 10494: 70 string \xcd\x21 COM executable for DOS
! 10495: # many compressed/converted COMs start with a copy loop instead of a jump
! 10496: 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
! 10497: 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
! 10498: >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
! 10499: 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
! 10500: # FIXME: missing diet .com compression
! 10501:
! 10502: # miscellaneous formats
! 10503: 0 string LZ MS-DOS executable (built-in)
! 10504: #0 byte 0xf0 MS-DOS program library data
! 10505: #
! 10506:
! 10507: # AAF files:
! 10508: # <stuartc@rd.bbc.co.uk> Stuart Cunningham
! 10509: 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
! 10510: >30 byte 9 (512B sectors)
! 10511: >30 byte 12 (4kB sectors)
! 10512: 0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
! 10513: >30 byte 9 (512B sectors)
! 10514: >30 byte 12 (4kB sectors)
! 10515:
! 10516: # Popular applications
! 10517: 2080 string Microsoft\ Word\ 6.0\ Document %s
! 10518: !:mime application/msword
! 10519: 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
! 10520: !:mime application/msword
! 10521: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
! 10522: 2112 string MSWordDoc Microsoft Word document data
! 10523: !:mime application/msword
! 10524: #
! 10525: 0 belong 0x31be0000 Microsoft Word Document
! 10526: !:mime application/msword
! 10527: #
! 10528: 0 string PO^Q` Microsoft Word 6.0 Document
! 10529: !:mime application/msword
! 10530: #
! 10531: 0 string \376\067\0\043 Microsoft Office Document
! 10532: !:mime application/msword
! 10533: 0 string \333\245-\0\0\0 Microsoft Office Document
! 10534: !:mime application/msword
! 10535: 512 string \354\245\301 Microsoft Word Document
! 10536: !:mime application/msword
! 10537: #
! 10538: 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
! 10539: !:mime application/vnd.ms-excel
! 10540:
! 10541: 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
! 10542: !:mime application/vnd.ms-excel
! 10543: #
! 10544: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
! 10545: 2114 string Biff5 Microsoft Excel 5.0 Worksheet
! 10546: !:mime application/vnd.ms-excel
! 10547: # Italian MS-Excel
! 10548: 2121 string Biff5 Microsoft Excel 5.0 Worksheet
! 10549: !:mime application/vnd.ms-excel
! 10550: 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
! 10551: !:mime application/vnd.ms-excel
! 10552: #
! 10553: 0 belong 0x00001a00 Lotus 1-2-3
! 10554: !:mime application/x-123
! 10555: >4 belong 0x00100400 wk3 document data
! 10556: >4 belong 0x02100400 wk4 document data
! 10557: >4 belong 0x07800100 fm3 or fmb document data
! 10558: >4 belong 0x07800000 fm3 or fmb document data
! 10559: #
! 10560: 0 belong 0x00000200 Lotus 1-2-3
! 10561: !:mime application/x-123
! 10562: >4 belong 0x06040600 wk1 document data
! 10563: >4 belong 0x06800200 fmt document data
! 10564: 0 string WordPro\0 Lotus WordPro
! 10565: !:mime application/vnd.lotus-wordpro
! 10566: 0 string WordPro\r\373 Lotus WordPro
! 10567: !:mime application/vnd.lotus-wordpro
! 10568:
! 10569:
! 10570: # Summary: Script used by InstallScield to uninstall applications
! 10571: # Extension: .isu
! 10572: # Submitted by: unknown
! 10573: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
! 10574: 0 string \x71\xa8\x00\x00\x01\x02
! 10575: >12 string Stirling\ Technologies, InstallShield Uninstall Script
! 10576:
! 10577: # Winamp .avs
! 10578: #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
! 10579: 0 string Nullsoft\ AVS\ Preset\ Winamp plug in
! 10580:
! 10581: # Windows Metafont .WMF
! 10582: 0 string \327\315\306\232 ms-windows metafont .wmf
! 10583: 0 string \002\000\011\000 ms-windows metafont .wmf
! 10584: 0 string \001\000\011\000 ms-windows metafont .wmf
! 10585:
! 10586: #tz3 files whatever that is (MS Works files)
! 10587: 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
! 10588: 0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
! 10589: 0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
! 10590:
! 10591: # PGP sig files .sig
! 10592: #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
! 10593: 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
! 10594: 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
! 10595: 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
! 10596: 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
! 10597: 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
! 10598: 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
! 10599:
! 10600: # windows zips files .dmf
! 10601: 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
! 10602:
! 10603:
! 10604: #ico files
! 10605: 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
! 10606:
! 10607: # Windows icons (Ian Springer <ips@fpk.hp.com>)
! 10608: 0 string \000\000\001\000 MS Windows icon resource
! 10609: !:mime image/x-ico
! 10610: >4 byte 1 - 1 icon
! 10611: >4 byte >1 - %d icons
! 10612: >>6 byte >0 \b, %dx
! 10613: >>>7 byte >0 \b%d
! 10614: >>8 byte 0 \b, 256-colors
! 10615: >>8 byte >0 \b, %d-colors
! 10616:
! 10617:
! 10618: # .chr files
! 10619: 0 string PK\010\010BGI Borland font
! 10620: >4 string >\0 %s
! 10621: # then there is a copyright notice
! 10622:
! 10623:
! 10624: # .bgi files
! 10625: 0 string pk\010\010BGI Borland device
! 10626: >4 string >\0 %s
! 10627: # then there is a copyright notice
! 10628:
! 10629:
! 10630: # Windows Recycle Bin record file (named INFO2)
! 10631: # By Abel Cheung (abelcheung AT gmail dot com)
! 10632: # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
! 10633: # Since Vista uses another structure, INFO2 structure probably won't change
! 10634: # anymore. Detailed analysis in:
! 10635: # http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
! 10636: 0 lelong 0x00000004
! 10637: >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
! 10638:
! 10639: 0 lelong 0x00000005
! 10640: >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
! 10641:
! 10642:
! 10643: ##### put in Either Magic/font or Magic/news
! 10644: # Acroread or something files wrongly identified as G3 .pfm
! 10645: # these have the form \000 \001 any? \002 \000 \000
! 10646: # or \000 \001 any? \022 \000 \000
! 10647: 0 belong&0xffff00ff 0x00010012 PFM data
! 10648: >4 string \000\000
! 10649: >6 string >\060 - %s
! 10650:
! 10651: 0 belong&0xffff00ff 0x00010002 PFM data
! 10652: >4 string \000\000
! 10653: >6 string >\060 - %s
! 10654: #0 string \000\001 pfm?
! 10655: #>3 string \022\000\000Copyright\ yes
! 10656: #>3 string \002\000\000Copyright\ yes
! 10657: #>3 string >\0 oops, not a font file. Cancel that.
! 10658: #it clashes with ttf files so put it lower down.
! 10659:
! 10660: # From Doug Lee via a FreeBSD pr
! 10661: 9 string GERBILDOC First Choice document
! 10662: 9 string GERBILDB First Choice database
! 10663: 9 string GERBILCLIP First Choice database
! 10664: 0 string GERBIL First Choice device file
! 10665: 9 string RABBITGRAPH RabbitGraph file
! 10666: 0 string DCU1 Borland Delphi .DCU file
! 10667: 0 string =!<spell> MKS Spell hash list (old format)
! 10668: 0 string =!<spell2> MKS Spell hash list
! 10669: # Too simple - MPi
! 10670: #0 string AH Halo(TM) bitmapped font file
! 10671: 0 lelong 0x08086b70 TurboC BGI file
! 10672: 0 lelong 0x08084b50 TurboC Font file
! 10673:
! 10674: # WARNING: below line conflicts with Infocom game data Z-machine 3
! 10675: 0 byte 0x03 DBase 3 data file
! 10676: >0x04 lelong 0 (no records)
! 10677: >0x04 lelong >0 (%ld records)
! 10678: 0 byte 0x83 DBase 3 data file with memo(s)
! 10679: >0x04 lelong 0 (no records)
! 10680: >0x04 lelong >0 (%ld records)
! 10681: 0 leshort 0x0006 DBase 3 index file
! 10682: 0 string PMCC Windows 3.x .GRP file
! 10683: 1 string RDC-meg MegaDots
! 10684: >8 byte >0x2F version %c
! 10685: >9 byte >0x2F \b.%c file
! 10686: 0 lelong 0x4C
! 10687: >4 lelong 0x00021401 Windows shortcut file
! 10688:
! 10689: # DOS EPS Binary File Header
! 10690: # From: Ed Sznyter <ews@Black.Market.NET>
! 10691: 0 belong 0xC5D0D3C6 DOS EPS Binary File
! 10692: >4 long >0 Postscript starts at byte %d
! 10693: >>8 long >0 length %d
! 10694: >>>12 long >0 Metafile starts at byte %d
! 10695: >>>>16 long >0 length %d
! 10696: >>>20 long >0 TIFF starts at byte %d
! 10697: >>>>24 long >0 length %d
! 10698:
! 10699: # TNEF magic From "Joomy" <joomy@se-ed.net>
! 10700: # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
! 10701: 0 leshort 0x223e9f78 TNEF
! 10702: !:mime application/vnd.ms-tnef
! 10703:
! 10704: # HtmlHelp files (.chm)
! 10705: 0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
! 10706:
! 10707: # GFA-BASIC (Wolfram Kleff)
! 10708: 2 string GFA-BASIC3 GFA-BASIC 3 data
! 10709:
! 10710: #------------------------------------------------------------------------------
! 10711: # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
! 10712: # Microsoft Cabinet files
! 10713: 0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
! 10714: >8 lelong x \b, %u bytes
! 10715: >28 leshort 1 \b, 1 file
! 10716: >28 leshort >1 \b, %u files
! 10717:
! 10718: # InstallShield Cabinet files
! 10719: 0 string ISc( InstallShield Cabinet archive data
! 10720: >5 byte&0xf0 =0x60 version 6,
! 10721: >5 byte&0xf0 !0x60 version 4/5,
! 10722: >(12.l+40) lelong x %u files
! 10723:
! 10724: # Windows CE package files
! 10725: 0 string MSCE\0\0\0\0 Microsoft WinCE install header
! 10726: >20 lelong 0 \b, architecture-independent
! 10727: >20 lelong 103 \b, Hitachi SH3
! 10728: >20 lelong 104 \b, Hitachi SH4
! 10729: >20 lelong 0xA11 \b, StrongARM
! 10730: >20 lelong 4000 \b, MIPS R4000
! 10731: >20 lelong 10003 \b, Hitachi SH3
! 10732: >20 lelong 10004 \b, Hitachi SH3E
! 10733: >20 lelong 10005 \b, Hitachi SH4
! 10734: >20 lelong 70001 \b, ARM 7TDMI
! 10735: >52 leshort 1 \b, 1 file
! 10736: >52 leshort >1 \b, %u files
! 10737: >56 leshort 1 \b, 1 registry entry
! 10738: >56 leshort >1 \b, %u registry entries
! 10739:
! 10740:
! 10741: # Windows Enhanced Metafile (EMF)
! 10742: # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
! 10743: # for further information.
! 10744: 0 ulelong 1
! 10745: >40 string \ EMF Windows Enhanced Metafile (EMF) image data
! 10746: >>44 ulelong x version 0x%x
! 10747:
! 10748: # From: Alex Beregszaszi <alex@fsn.hu>
! 10749: 0 string COWD VMWare3
! 10750: >4 byte 3 disk image
! 10751: >>32 lelong x (%d/
! 10752: >>36 lelong x \b%d/
! 10753: >>40 lelong x \b%d)
! 10754: >4 byte 2 undoable disk image
! 10755: >>32 string >\0 (%s)
! 10756:
! 10757: 0 string VMDK VMware4 disk image
! 10758: 0 string KDMV VMware4 disk image
! 10759:
! 10760: #--------------------------------------------------------------------
! 10761: # Qemu Emulator Images
! 10762: # Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
! 10763: # Made by reading sources and doing trial and error on existing
! 10764: # qcow files
! 10765: 0 string QFI Qemu Image, Format: Qcow
! 10766:
! 10767: # Uncomment the following line to display Magic (only used for debugging
! 10768: # this magic number)
! 10769: #>0 string x , Magic: %s
! 10770:
! 10771: # There are currently 2 Versions: "1" and "2"
! 10772: # I do not use Version 2 and therefor branch here
! 10773: # but can assure: it works (tested on both versions)
! 10774: # Also my Qemu 0.9.0 which uses this Version 2 refuses
! 10775: # to start in its bios
! 10776: >0x04 belong 2 , Version: 2
! 10777: >0x04 belong 1 , Version: 1
! 10778:
! 10779: # Using the existence of the Backing File Offset to Branch or not
! 10780: # to read Backing File Information
! 10781: >>0xc belong >0 , Backing File( Offset: %lu
! 10782: >>>(0xc.L) string >\0 , Path: %s
! 10783:
! 10784: # Didn't get the trick here how qemu stores the "Size" at this Position
! 10785: # There is actually something stored but nothing makes sense
! 10786: # The header in the sources talks about it
! 10787: #>>>16 lelong x , Size: %lu
! 10788:
! 10789: # Modification time of the Backing File
! 10790: # Really useful if you want to know if your backing
! 10791: # file is still usable together with this image
! 10792: >>>20 bedate x , Mtime: %s )
! 10793:
! 10794: # Don't know how to calculate in Magicfiles
! 10795: # Also: this Information is not reliably
! 10796: # stored in image-files
! 10797: >>24 lelong x , Disk Size could be: %d * 256 bytes
! 10798:
! 10799: 0 string QEVM QEMU's suspend to disk image
! 10800:
! 10801: 0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
! 10802: >32 string x type %s,
! 10803: >48 string x subtype %s
! 10804:
! 10805: 0 lelong 0x02468ace Bochs Sparse disk image
! 10806:
! 10807: # from http://filext.com by Derek M Jones <derek@knosof.co.uk>
! 10808: # False positive with PPT (also currently this string is too long)
! 10809: #0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
! 10810: 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
! 10811: #>48 byte 0x1B Excel Document
! 10812: #!:mime application/vnd.ms-excel
! 10813: >546 string bjbj Microsoft Word Document
! 10814: !:mime application/msword
! 10815: >546 string jbjb Microsoft Word Document
! 10816: !:mime application/msword
! 10817:
! 10818: 0 string \224\246\056 Microsoft Word Document
! 10819: !:mime application/msword
! 10820:
! 10821: 512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
! 10822: !:mime application/msword
! 10823:
! 10824: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
! 10825: # Magic type for Dell's BIOS .hdr files
! 10826: # Dell's .hdr
! 10827: 0 string $RBU
! 10828: >23 string Dell %s system BIOS
! 10829: >48 string x version %.3s
! 10830:
! 10831: # Type: Microsoft DirectDraw Surface
! 10832: # URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
! 10833: # From: Morten Hustveit <morten@debian.org>
! 10834: 0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
! 10835: >16 lelong >0 %hd x
! 10836: >12 lelong >0 %hd,
! 10837: >84 string x %.4s
! 10838:
! 10839: # Type: Microsoft Document Imaging Format (.mdi)
! 10840: # URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
! 10841: # From: Daniele Sempione <scrows@oziosi.org>
! 10842: 0 short 0x5045 Microsoft Document Imaging Format
! 10843:
! 10844: # MS eBook format (.lit)
! 10845: 0 string ITOLITLS Microsoft Reader eBook Data
! 10846: >8 lelong x \b, version %u
! 10847: !:mime application/x-ms-reader
! 10848:
! 10849: #------------------------------------------------------------------------------
! 10850: # msvc: file(1) magic for msvc
! 10851: # "H. Nanosecond" <aldomel@ix.netcom.com>
! 10852: # Microsoft visual C
! 10853: #
! 10854: # I have version 1.0
! 10855:
! 10856: # .aps
! 10857: 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
! 10858:
! 10859: # .ide
! 10860: #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
! 10861: 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
! 10862:
! 10863: # .res
! 10864: 0 string \000\000\000\000\040\000\000\000\377 MSVC .res
! 10865: 0 string \377\003\000\377\001\000\020\020\350 MSVC .res
! 10866: 0 string \377\003\000\377\001\000\060\020\350 MSVC .res
! 10867:
! 10868: #.lib
! 10869: 0 string \360\015\000\000 Microsoft Visual C library
! 10870: 0 string \360\075\000\000 Microsoft Visual C library
! 10871: 0 string \360\175\000\000 Microsoft Visual C library
! 10872:
! 10873: #.pch
! 10874: 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
! 10875:
! 10876: # .pdb
! 10877: # too long 0 string Microsoft\ C/C++\ program\ database\
! 10878: 0 string Microsoft\ C/C++\ MSVC program database
! 10879: >18 string program\ database\
! 10880: >33 string >\0 ver %s
! 10881:
! 10882: #.sbr
! 10883: 0 string \000\002\000\007\000 MSVC .sbr
! 10884: >5 string >\0 %s
! 10885:
! 10886: #.bsc
! 10887: 0 string \002\000\002\001 MSVC .bsc
! 10888:
! 10889: #.wsp
! 10890: 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
! 10891: # these seem to start with the version and contain menus
! 10892: # ------------------------------------------------------------------------
! 10893: # mup: file(1) magic for Mup (Music Publisher) input file.
! 10894: #
! 10895: # From: Abel Cheung <abel (@) oaka.org>
! 10896: #
! 10897: # NOTE: This header is mainly proposed in the Arkkra mailing list,
! 10898: # and is not a mandatory header because of old mup input file
! 10899: # compatibility. Noteedit also use mup format, but is not forcing
! 10900: # user to use any header as well.
! 10901: #
! 10902: 0 search/1 //!Mup Mup music publication program input text
! 10903: >6 string -Arkkra (Arkkra)
! 10904: >>13 string -
! 10905: >>>16 string .
! 10906: >>>>14 string x \b, need V%.4s
! 10907: >>>15 string .
! 10908: >>>>14 string x \b, need V%.3s
! 10909: >6 string -
! 10910: >>9 string .
! 10911: >>>7 string x \b, need V%.4s
! 10912: >>8 string .
! 10913: >>>7 string x \b, need V%.3s
! 10914:
! 10915: #-----------------------------------------------------------------------------
! 10916: # natinst: file(1) magic for National Instruments Code Files
! 10917:
! 10918: #
! 10919: # From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
! 10920: # version 1
! 10921: # Many formats still missing, we use, for the moment LabVIEW
! 10922: # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
! 10923: #
! 10924: 0 string RSRC National Instruments,
! 10925: # Check if it's a LabVIEW File
! 10926: >8 string LV LabVIEW File,
! 10927: # Check wich kind of file is
! 10928: >>10 string SB Code Resource File, data
! 10929: >>10 string IN Virtual Instrument Program, data
! 10930: >>10 string AR VI Library, data
! 10931: # This is for Menu Libraries
! 10932: >8 string LMNULBVW Portable File Names, data
! 10933: # This is for General Resources
! 10934: >8 string rsc Resources File, data
! 10935: # This is for VXI Package
! 10936: 0 string VMAP National Instruments, VXI File, data
! 10937:
! 10938: #------------------------------------------------------------------------------
! 10939: # ncr: file(1) magic for NCR Tower objects
! 10940: #
! 10941: # contributed by
! 10942: # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
! 10943: # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
! 10944: #
! 10945: 0 beshort 000610 Tower/XP rel 2 object
! 10946: >12 belong >0 not stripped
! 10947: >20 beshort 0407 executable
! 10948: >20 beshort 0410 pure executable
! 10949: >22 beshort >0 - version %ld
! 10950: 0 beshort 000615 Tower/XP rel 2 object
! 10951: >12 belong >0 not stripped
! 10952: >20 beshort 0407 executable
! 10953: >20 beshort 0410 pure executable
! 10954: >22 beshort >0 - version %ld
! 10955: 0 beshort 000620 Tower/XP rel 3 object
! 10956: >12 belong >0 not stripped
! 10957: >20 beshort 0407 executable
! 10958: >20 beshort 0410 pure executable
! 10959: >22 beshort >0 - version %ld
! 10960: 0 beshort 000625 Tower/XP rel 3 object
! 10961: >12 belong >0 not stripped
! 10962: >20 beshort 0407 executable
! 10963: >20 beshort 0410 pure executable
! 10964: >22 beshort >0 - version %ld
! 10965: 0 beshort 000630 Tower32/600/400 68020 object
! 10966: >12 belong >0 not stripped
! 10967: >20 beshort 0407 executable
! 10968: >20 beshort 0410 pure executable
! 10969: >22 beshort >0 - version %ld
! 10970: 0 beshort 000640 Tower32/800 68020
! 10971: >18 beshort &020000 w/68881 object
! 10972: >18 beshort &040000 compatible object
! 10973: >18 beshort &060000 object
! 10974: >20 beshort 0407 executable
! 10975: >20 beshort 0413 pure executable
! 10976: >12 belong >0 not stripped
! 10977: >22 beshort >0 - version %ld
! 10978: 0 beshort 000645 Tower32/800 68010
! 10979: >18 beshort &040000 compatible object
! 10980: >18 beshort &060000 object
! 10981: >20 beshort 0407 executable
! 10982: >20 beshort 0413 pure executable
! 10983: >12 belong >0 not stripped
! 10984: >22 beshort >0 - version %ld
! 10985:
! 10986: #------------------------------------------------------------------------------
! 10987: # netbsd: file(1) magic for NetBSD objects
! 10988: #
! 10989: # All new-style magic numbers are in network byte order.
! 10990: #
! 10991:
! 10992: 0 lelong 000000407 a.out NetBSD little-endian object file
! 10993: >16 lelong >0 not stripped
! 10994: 0 belong 000000407 a.out NetBSD big-endian object file
! 10995: >16 belong >0 not stripped
! 10996:
! 10997: 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
! 10998: >0 byte &0x80
! 10999: >>20 lelong <4096 shared library
! 11000: >>20 lelong =4096 dynamically linked executable
! 11001: >>20 lelong >4096 dynamically linked executable
! 11002: >0 byte ^0x80 executable
! 11003: >16 lelong >0 not stripped
! 11004: 0 belong&0377777777 041400410 a.out NetBSD/i386 pure
! 11005: >0 byte &0x80 dynamically linked executable
! 11006: >0 byte ^0x80 executable
! 11007: >16 lelong >0 not stripped
! 11008: 0 belong&0377777777 041400407 a.out NetBSD/i386
! 11009: >0 byte &0x80 dynamically linked executable
! 11010: >0 byte ^0x80
! 11011: >>0 byte &0x40 position independent
! 11012: >>20 lelong !0 executable
! 11013: >>20 lelong =0 object file
! 11014: >16 lelong >0 not stripped
! 11015: 0 belong&0377777777 041400507 a.out NetBSD/i386 core
! 11016: >12 string >\0 from '%s'
! 11017: >32 lelong !0 (signal %d)
! 11018:
! 11019: 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
! 11020: >0 byte &0x80
! 11021: >>20 belong <8192 shared library
! 11022: >>20 belong =8192 dynamically linked executable
! 11023: >>20 belong >8192 dynamically linked executable
! 11024: >0 byte ^0x80 executable
! 11025: >16 belong >0 not stripped
! 11026: 0 belong&0377777777 041600410 a.out NetBSD/m68k pure
! 11027: >0 byte &0x80 dynamically linked executable
! 11028: >0 byte ^0x80 executable
! 11029: >16 belong >0 not stripped
! 11030: 0 belong&0377777777 041600407 a.out NetBSD/m68k
! 11031: >0 byte &0x80 dynamically linked executable
! 11032: >0 byte ^0x80
! 11033: >>0 byte &0x40 position independent
! 11034: >>20 belong !0 executable
! 11035: >>20 belong =0 object file
! 11036: >16 belong >0 not stripped
! 11037: 0 belong&0377777777 041600507 a.out NetBSD/m68k core
! 11038: >12 string >\0 from '%s'
! 11039: >32 belong !0 (signal %d)
! 11040:
! 11041: 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
! 11042: >0 byte &0x80
! 11043: >>20 belong <4096 shared library
! 11044: >>20 belong =4096 dynamically linked executable
! 11045: >>20 belong >4096 dynamically linked executable
! 11046: >0 byte ^0x80 executable
! 11047: >16 belong >0 not stripped
! 11048: 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
! 11049: >0 byte &0x80 dynamically linked executable
! 11050: >0 byte ^0x80 executable
! 11051: >16 belong >0 not stripped
! 11052: 0 belong&0377777777 042000407 a.out NetBSD/m68k4k
! 11053: >0 byte &0x80 dynamically linked executable
! 11054: >0 byte ^0x80
! 11055: >>0 byte &0x40 position independent
! 11056: >>20 belong !0 executable
! 11057: >>20 belong =0 object file
! 11058: >16 belong >0 not stripped
! 11059: 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
! 11060: >12 string >\0 from '%s'
! 11061: >32 belong !0 (signal %d)
! 11062:
! 11063: 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
! 11064: >0 byte &0x80
! 11065: >>20 lelong <4096 shared library
! 11066: >>20 lelong =4096 dynamically linked executable
! 11067: >>20 lelong >4096 dynamically linked executable
! 11068: >0 byte ^0x80 executable
! 11069: >16 lelong >0 not stripped
! 11070: 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
! 11071: >0 byte &0x80 dynamically linked executable
! 11072: >0 byte ^0x80 executable
! 11073: >16 lelong >0 not stripped
! 11074: 0 belong&0377777777 042200407 a.out NetBSD/ns32532
! 11075: >0 byte &0x80 dynamically linked executable
! 11076: >0 byte ^0x80
! 11077: >>0 byte &0x40 position independent
! 11078: >>20 lelong !0 executable
! 11079: >>20 lelong =0 object file
! 11080: >16 lelong >0 not stripped
! 11081: 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
! 11082: >12 string >\0 from '%s'
! 11083: >32 lelong !0 (signal %d)
! 11084:
! 11085: 0 belong&0377777777 045200507 a.out NetBSD/powerpc core
! 11086: >12 string >\0 from '%s'
! 11087:
! 11088: 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
! 11089: >0 byte &0x80
! 11090: >>20 belong <8192 shared library
! 11091: >>20 belong =8192 dynamically linked executable
! 11092: >>20 belong >8192 dynamically linked executable
! 11093: >0 byte ^0x80 executable
! 11094: >16 belong >0 not stripped
! 11095: 0 belong&0377777777 042400410 a.out NetBSD/sparc pure
! 11096: >0 byte &0x80 dynamically linked executable
! 11097: >0 byte ^0x80 executable
! 11098: >16 belong >0 not stripped
! 11099: 0 belong&0377777777 042400407 a.out NetBSD/sparc
! 11100: >0 byte &0x80 dynamically linked executable
! 11101: >0 byte ^0x80
! 11102: >>0 byte &0x40 position independent
! 11103: >>20 belong !0 executable
! 11104: >>20 belong =0 object file
! 11105: >16 belong >0 not stripped
! 11106: 0 belong&0377777777 042400507 a.out NetBSD/sparc core
! 11107: >12 string >\0 from '%s'
! 11108: >32 belong !0 (signal %d)
! 11109:
! 11110: 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
! 11111: >0 byte &0x80
! 11112: >>20 lelong <4096 shared library
! 11113: >>20 lelong =4096 dynamically linked executable
! 11114: >>20 lelong >4096 dynamically linked executable
! 11115: >0 byte ^0x80 executable
! 11116: >16 lelong >0 not stripped
! 11117: 0 belong&0377777777 042600410 a.out NetBSD/pmax pure
! 11118: >0 byte &0x80 dynamically linked executable
! 11119: >0 byte ^0x80 executable
! 11120: >16 lelong >0 not stripped
! 11121: 0 belong&0377777777 042600407 a.out NetBSD/pmax
! 11122: >0 byte &0x80 dynamically linked executable
! 11123: >0 byte ^0x80
! 11124: >>0 byte &0x40 position independent
! 11125: >>20 lelong !0 executable
! 11126: >>20 lelong =0 object file
! 11127: >16 lelong >0 not stripped
! 11128: 0 belong&0377777777 042600507 a.out NetBSD/pmax core
! 11129: >12 string >\0 from '%s'
! 11130: >32 lelong !0 (signal %d)
! 11131:
! 11132: 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
! 11133: >0 byte &0x80
! 11134: >>20 lelong <4096 shared library
! 11135: >>20 lelong =4096 dynamically linked executable
! 11136: >>20 lelong >4096 dynamically linked executable
! 11137: >0 byte ^0x80 executable
! 11138: >16 lelong >0 not stripped
! 11139: 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
! 11140: >0 byte &0x80 dynamically linked executable
! 11141: >0 byte ^0x80 executable
! 11142: >16 lelong >0 not stripped
! 11143: 0 belong&0377777777 043000407 a.out NetBSD/vax 1k
! 11144: >0 byte &0x80 dynamically linked executable
! 11145: >0 byte ^0x80
! 11146: >>0 byte &0x40 position independent
! 11147: >>20 lelong !0 executable
! 11148: >>20 lelong =0 object file
! 11149: >16 lelong >0 not stripped
! 11150: 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
! 11151: >12 string >\0 from '%s'
! 11152: >32 lelong !0 (signal %d)
! 11153:
! 11154: 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
! 11155: >0 byte &0x80
! 11156: >>20 lelong <4096 shared library
! 11157: >>20 lelong =4096 dynamically linked executable
! 11158: >>20 lelong >4096 dynamically linked executable
! 11159: >0 byte ^0x80 executable
! 11160: >16 lelong >0 not stripped
! 11161: 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
! 11162: >0 byte &0x80 dynamically linked executable
! 11163: >0 byte ^0x80 executable
! 11164: >16 lelong >0 not stripped
! 11165: 0 belong&0377777777 045400407 a.out NetBSD/vax 4k
! 11166: >0 byte &0x80 dynamically linked executable
! 11167: >0 byte ^0x80
! 11168: >>0 byte &0x40 position independent
! 11169: >>20 lelong !0 executable
! 11170: >>20 lelong =0 object file
! 11171: >16 lelong >0 not stripped
! 11172: 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
! 11173: >12 string >\0 from '%s'
! 11174: >32 lelong !0 (signal %d)
! 11175:
! 11176: # NetBSD/alpha does not support (and has never supported) a.out objects,
! 11177: # so no rules are provided for them. NetBSD/alpha ELF objects are
! 11178: # dealt with in "elf".
! 11179: 0 lelong 0x00070185 ECOFF NetBSD/alpha binary
! 11180: >10 leshort 0x0001 not stripped
! 11181: >10 leshort 0x0000 stripped
! 11182: 0 belong&0377777777 043200507 a.out NetBSD/alpha core
! 11183: >12 string >\0 from '%s'
! 11184: >32 lelong !0 (signal %d)
! 11185:
! 11186: 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
! 11187: >0 byte &0x80
! 11188: >>20 belong <8192 shared library
! 11189: >>20 belong =8192 dynamically linked executable
! 11190: >>20 belong >8192 dynamically linked executable
! 11191: >0 byte ^0x80 executable
! 11192: >16 belong >0 not stripped
! 11193: 0 belong&0377777777 043400410 a.out NetBSD/mips pure
! 11194: >0 byte &0x80 dynamically linked executable
! 11195: >0 byte ^0x80 executable
! 11196: >16 belong >0 not stripped
! 11197: 0 belong&0377777777 043400407 a.out NetBSD/mips
! 11198: >0 byte &0x80 dynamically linked executable
! 11199: >0 byte ^0x80
! 11200: >>0 byte &0x40 position independent
! 11201: >>20 belong !0 executable
! 11202: >>20 belong =0 object file
! 11203: >16 belong >0 not stripped
! 11204: 0 belong&0377777777 043400507 a.out NetBSD/mips core
! 11205: >12 string >\0 from '%s'
! 11206: >32 belong !0 (signal %d)
! 11207:
! 11208: 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
! 11209: >0 byte &0x80
! 11210: >>20 lelong <4096 shared library
! 11211: >>20 lelong =4096 dynamically linked executable
! 11212: >>20 lelong >4096 dynamically linked executable
! 11213: >0 byte ^0x80 executable
! 11214: >16 lelong >0 not stripped
! 11215: 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
! 11216: >0 byte &0x80 dynamically linked executable
! 11217: >0 byte ^0x80 executable
! 11218: >16 lelong >0 not stripped
! 11219: 0 belong&0377777777 043600407 a.out NetBSD/arm32
! 11220: >0 byte &0x80 dynamically linked executable
! 11221: >0 byte ^0x80
! 11222: >>0 byte &0x40 position independent
! 11223: >>20 lelong !0 executable
! 11224: >>20 lelong =0 object file
! 11225: >16 lelong >0 not stripped
! 11226: # NetBSD/arm26 has always used ELF objects, but it shares a core file
! 11227: # format with NetBSD/arm32.
! 11228: 0 belong&0377777777 043600507 a.out NetBSD/arm core
! 11229: >12 string >\0 from '%s'
! 11230: >32 lelong !0 (signal %d)
! 11231:
! 11232: #------------------------------------------------------------------------------
! 11233: # netscape: file(1) magic for Netscape files
! 11234: # "H. Nanosecond" <aldomel@ix.netcom.com>
! 11235: # version 3 and 4 I think
! 11236: #
! 11237:
! 11238: # Netscape Address book .nab
! 11239: 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
! 11240:
! 11241: # Netscape Communicator address book
! 11242: 0 string \000\017\102\111 Netscape Communicator address book
! 11243:
! 11244: # .snm Caches
! 11245: 0 string #\ Netscape\ folder\ cache Netscape folder cache
! 11246: 0 string \000\036\204\220\000 Netscape folder cache
! 11247: # .n2p
! 11248: # Net 2 Phone
! 11249: #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
! 11250: 0 string SX961999 Net2phone
! 11251:
! 11252: #
! 11253: #This is files ending in .art, FIXME add more rules
! 11254: 0 string JG\004\016\0\0\0\0 ART
! 11255:
! 11256: #------------------------------------------------------------------------------
! 11257: # netware: file(1) magic for NetWare Loadable Modules (NLMs)
! 11258: # From: Mads Martin Joergensen <mmj@suse.de>
! 11259:
! 11260: 0 string NetWare\ Loadable\ Module NetWare Loadable Module
! 11261:
! 11262: #------------------------------------------------------------------------------
! 11263: # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
! 11264: #
! 11265: 0 string StartFontMetrics ASCII font metrics
! 11266: 0 string StartFont ASCII font bits
! 11267: 0 belong 0x137A2944 NeWS bitmap font
! 11268: 0 belong 0x137A2947 NeWS font family
! 11269: 0 belong 0x137A2950 scalable OpenFont binary
! 11270: 0 belong 0x137A2951 encrypted scalable OpenFont binary
! 11271: 8 belong 0x137A2B45 X11/NeWS bitmap font
! 11272: 8 belong 0x137A2B48 X11/NeWS font family
! 11273: #------------------------------------------------------------------------------
! 11274: # nitpicker: file(1) magic for Flowfiles.
! 11275: # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
! 11276: 0 string NPFF NItpicker Flow File
! 11277: >4 byte x V%d.
! 11278: >5 byte x %d
! 11279: >6 bedate x started: %s
! 11280: >10 bedate x stopped: %s
! 11281: >14 belong x Bytes: %u
! 11282: >18 belong x Bytes1: %u
! 11283: >22 belong x Flows: %u
! 11284: >26 belong x Pkts: %u
! 11285:
! 11286: #------------------------------------------------------------------------------
! 11287: # ocaml: file(1) magic for Objective Caml files.
! 11288: 0 string Caml1999 OCaml
! 11289: >8 string X exec file
! 11290: >8 string I interface file (.cmi)
! 11291: >8 string O object file (.cmo)
! 11292: >8 string A library file (.cma)
! 11293: >8 string Y native object file (.cmx)
! 11294: >8 string Z native library file (.cmxa)
! 11295: >8 string M abstract syntax tree implementation file
! 11296: >8 string N abstract syntax tree interface file
! 11297: >9 string >\0 (Version %3.3s)
! 11298: #------------------------------------------------------------------------------
! 11299: # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
! 11300: 0 string Octave-1-L Octave binary data (little endian)
! 11301: 0 string Octave-1-B Octave binary data (big endian)
! 11302:
! 11303: #------------------------------------------------------------------------------
! 11304: # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
! 11305: # storage (http://en.wikipedia.org/wiki/Structured_Storage)
! 11306: # Additional tests for OLE 2 Compound Documents should be under this recipe.
! 11307:
! 11308: 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
! 11309: # - Microstation V8 DGN files (www.bentley.com)
! 11310: # Last update on 10/23/2006 by Lester Hightower
! 11311: > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
! 11312: # - Visio documents
! 11313: # Last update on 10/23/2006 by Lester Hightower
! 11314: > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
! 11315:
! 11316: #------------------------------------------------------------------------------
! 11317: # olf: file(1) magic for OLF executables
! 11318: #
! 11319: # We have to check the byte order flag to see what byte order all the
! 11320: # other stuff in the header is in.
! 11321: #
! 11322: # MIPS R3000 may also be for MIPS R2000.
! 11323: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
! 11324: #
! 11325: # Created by Erik Theisen <etheisen@openbsd.org>
! 11326: # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
! 11327: 0 string \177OLF OLF
! 11328: >4 byte 0 invalid class
! 11329: >4 byte 1 32-bit
! 11330: >4 byte 2 64-bit
! 11331: >7 byte 0 invalid os
! 11332: >7 byte 1 OpenBSD
! 11333: >7 byte 2 NetBSD
! 11334: >7 byte 3 FreeBSD
! 11335: >7 byte 4 4.4BSD
! 11336: >7 byte 5 Linux
! 11337: >7 byte 6 SVR4
! 11338: >7 byte 7 esix
! 11339: >7 byte 8 Solaris
! 11340: >7 byte 9 Irix
! 11341: >7 byte 10 SCO
! 11342: >7 byte 11 Dell
! 11343: >7 byte 12 NCR
! 11344: >5 byte 0 invalid byte order
! 11345: >5 byte 1 LSB
! 11346: >>16 leshort 0 no file type,
! 11347: >>16 leshort 1 relocatable,
! 11348: >>16 leshort 2 executable,
! 11349: >>16 leshort 3 shared object,
! 11350: # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
! 11351: # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
! 11352: >>16 leshort 4 core file
! 11353: >>>(0x38+0xcc) string >\0 of '%s'
! 11354: >>>(0x38+0x10) lelong >0 (signal %d),
! 11355: >>16 leshort &0xff00 processor-specific,
! 11356: >>18 leshort 0 no machine,
! 11357: >>18 leshort 1 AT&T WE32100 - invalid byte order,
! 11358: >>18 leshort 2 SPARC - invalid byte order,
! 11359: >>18 leshort 3 Intel 80386,
! 11360: >>18 leshort 4 Motorola 68000 - invalid byte order,
! 11361: >>18 leshort 5 Motorola 88000 - invalid byte order,
! 11362: >>18 leshort 6 Intel 80486,
! 11363: >>18 leshort 7 Intel 80860,
! 11364: >>18 leshort 8 MIPS R3000_BE - invalid byte order,
! 11365: >>18 leshort 9 Amdahl - invalid byte order,
! 11366: >>18 leshort 10 MIPS R3000_LE,
! 11367: >>18 leshort 11 RS6000 - invalid byte order,
! 11368: >>18 leshort 15 PA-RISC - invalid byte order,
! 11369: >>18 leshort 16 nCUBE,
! 11370: >>18 leshort 17 VPP500,
! 11371: >>18 leshort 18 SPARC32PLUS,
! 11372: >>18 leshort 20 PowerPC,
! 11373: >>18 leshort 0x9026 Alpha,
! 11374: >>20 lelong 0 invalid version
! 11375: >>20 lelong 1 version 1
! 11376: >>36 lelong 1 MathCoPro/FPU/MAU Required
! 11377: >8 string >\0 (%s)
! 11378: >5 byte 2 MSB
! 11379: >>16 beshort 0 no file type,
! 11380: >>16 beshort 1 relocatable,
! 11381: >>16 beshort 2 executable,
! 11382: >>16 beshort 3 shared object,
! 11383: >>16 beshort 4 core file,
! 11384: >>>(0x38+0xcc) string >\0 of '%s'
! 11385: >>>(0x38+0x10) belong >0 (signal %d),
! 11386: >>16 beshort &0xff00 processor-specific,
! 11387: >>18 beshort 0 no machine,
! 11388: >>18 beshort 1 AT&T WE32100,
! 11389: >>18 beshort 2 SPARC,
! 11390: >>18 beshort 3 Intel 80386 - invalid byte order,
! 11391: >>18 beshort 4 Motorola 68000,
! 11392: >>18 beshort 5 Motorola 88000,
! 11393: >>18 beshort 6 Intel 80486 - invalid byte order,
! 11394: >>18 beshort 7 Intel 80860,
! 11395: >>18 beshort 8 MIPS R3000_BE,
! 11396: >>18 beshort 9 Amdahl,
! 11397: >>18 beshort 10 MIPS R3000_LE - invalid byte order,
! 11398: >>18 beshort 11 RS6000,
! 11399: >>18 beshort 15 PA-RISC,
! 11400: >>18 beshort 16 nCUBE,
! 11401: >>18 beshort 17 VPP500,
! 11402: >>18 beshort 18 SPARC32PLUS,
! 11403: >>18 beshort 20 PowerPC or cisco 4500,
! 11404: >>18 beshort 21 cisco 7500,
! 11405: >>18 beshort 24 cisco SVIP,
! 11406: >>18 beshort 25 cisco 7200,
! 11407: >>18 beshort 36 cisco 12000,
! 11408: >>18 beshort 0x9026 Alpha,
! 11409: >>20 belong 0 invalid version
! 11410: >>20 belong 1 version 1
! 11411: >>36 belong 1 MathCoPro/FPU/MAU Required
! 11412: #------------------------------------------------------------------------------
! 11413: # os2: file(1) magic for OS/2 files
! 11414: #
! 11415:
! 11416: # Provided 1998/08/22 by
! 11417: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
! 11418: 1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
! 11419: >24 search/1 >\ (URL=<%s>)
! 11420:
! 11421: # OS/2 URL objects
! 11422: # Provided 1998/08/22 by
! 11423: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
! 11424: #0 string http: OS/2 URL object text
! 11425: #>5 string >\ (WWW) <http:%s>
! 11426: #0 string mailto: OS/2 URL object text
! 11427: #>7 string >\ (email) <%s>
! 11428: #0 string news: OS/2 URL object text
! 11429: #>5 string >\ (Usenet) <%s>
! 11430: #0 string ftp: OS/2 URL object text
! 11431: #>4 string >\ (FTP) <ftp:%s>
! 11432: #0 string file: OS/2 URL object text
! 11433: #>5 string >\ (Local file) <%s>
! 11434:
! 11435: # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
! 11436: # Carl Hauser (chauser.parc@xerox.com) and
! 11437: # Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
! 11438: # list the following header format in inf02a.doc:
! 11439: #
! 11440: # int16 ID; // ID magic word (5348h = "HS")
! 11441: # int8 unknown1; // unknown purpose, could be third letter of ID
! 11442: # int8 flags; // probably a flag word...
! 11443: # // bit 0: set if INF style file
! 11444: # // bit 4: set if HLP style file
! 11445: # // patching this byte allows reading HLP files
! 11446: # // using the VIEW command, while help files
! 11447: # // seem to work with INF settings here as well.
! 11448: # int16 hdrsize; // total size of header
! 11449: # int16 unknown2; // unknown purpose
! 11450: #
! 11451: 0 string HSP\x01\x9b\x00 OS/2 INF
! 11452: >107 string >0 (%s)
! 11453: 0 string HSP\x10\x9b\x00 OS/2 HLP
! 11454: >107 string >0 (%s)
! 11455:
! 11456: # OS/2 INI (this is a guess)
! 11457: 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
! 11458: #------------------------------------------------------------------------------
! 11459: # os400: file(1) magic for IBM OS/400 files
! 11460: #
! 11461: # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
! 11462: # In spite of its quite variable format (due to internal memory page
! 11463: # length differences between CISC and RISC versions of the OS) the
! 11464: # SAVF structure hasn't suitable offsets to identify the catalog
! 11465: # header in the first descriptor where there are some useful infos,
! 11466: # so we must search in a somewhat large area for a particular string
! 11467: # that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
! 11468: # descriptor space) preceded by a two byte constant.
! 11469: #
! 11470: 1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
! 11471: >&212 byte 0x01 \b, created with SAVOBJ
! 11472: >&212 byte 0x02 \b, created with SAVLIB
! 11473: >&212 byte 0x07 \b, created with SAVCFG
! 11474: >&212 byte 0x08 \b, created with SAVSECDTA
! 11475: >&212 byte 0x0A \b, created with SAVSECDTA
! 11476: >&212 byte 0x0B \b, created with SAVDLO
! 11477: >&212 byte 0x0D \b, created with SAVLICPGM
! 11478: >&212 byte 0x11 \b, created with SAVCHGOBJ
! 11479: >&213 byte 0x44 \b, at least V5R4 to open
! 11480: >&213 byte 0x43 \b, at least V5R3 to open
! 11481: >&213 byte 0x42 \b, at least V5R2 to open
! 11482: >&213 byte 0x41 \b, at least V5R1 to open
! 11483: >&213 byte 0x40 \b, at least V4R5 to open
! 11484: >&213 byte 0x3F \b, at least V4R4 to open
! 11485: >&213 byte 0x3E \b, at least V4R3 to open
! 11486: >&213 byte 0x3C \b, at least V4R2 to open
! 11487: >&213 byte 0x3D \b, at least V4R1M4 to open
! 11488: >&213 byte 0x3B \b, at least V4R1 to open
! 11489: >&213 byte 0x3A \b, at least V3R7 to open
! 11490: >&213 byte 0x35 \b, at least V3R6 to open
! 11491: >&213 byte 0x36 \b, at least V3R2 to open
! 11492: >&213 byte 0x34 \b, at least V3R1 to open
! 11493: >&213 byte 0x31 \b, at least V3R0M5 to open
! 11494: >&213 byte 0x30 \b, at least V2R3 to open
! 11495: #
! 11496: # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
! 11497: #
! 11498: # Redistribution and use in source and binary forms, with or without
! 11499: # modification, are permitted provided that the following conditions
! 11500: # are met:
! 11501: # 1. Redistributions of source code must retain the above copyright
! 11502: # notice, this list of conditions and the following disclaimer.
! 11503: # 2. Redistributions in binary form must reproduce the above copyright
! 11504: # notice, this list of conditions and the following disclaimer in the
! 11505: # documentation and/or other materials provided with the distribution.
! 11506: # 3. All advertising materials mentioning features or use of this software
! 11507: # must display the following acknowledgement:
! 11508: # This product includes software developed by Ignatios Souvatzis for
! 11509: # the NetBSD project.
! 11510: # 4. The name of the author may not be used to endorse or promote products
! 11511: # derived from this software without specific prior written permission.
! 11512: #
! 11513: #
! 11514: # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 11515: # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 11516: # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 11517: # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
! 11518: # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
! 11519: # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
! 11520: # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
! 11521: # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
! 11522: # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
! 11523: # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 11524: #
! 11525: #
! 11526: #
! 11527: # OS9/6809 module descriptions:
! 11528: #
! 11529: 0 beshort 0x87CD OS9/6809 module:
! 11530: #
! 11531: >6 byte&0x0f 0x00 non-executable
! 11532: >6 byte&0x0f 0x01 machine language
! 11533: >6 byte&0x0f 0x02 BASIC I-code
! 11534: >6 byte&0x0f 0x03 Pascal P-code
! 11535: >6 byte&0x0f 0x04 C I-code
! 11536: >6 byte&0x0f 0x05 COBOL I-code
! 11537: >6 byte&0x0f 0x06 Fortran I-code
! 11538: #
! 11539: >6 byte&0xf0 0x10 program executable
! 11540: >6 byte&0xf0 0x20 subroutine
! 11541: >6 byte&0xf0 0x30 multi-module
! 11542: >6 byte&0xf0 0x40 data module
! 11543: #
! 11544: >6 byte&0xf0 0xC0 system module
! 11545: >6 byte&0xf0 0xD0 file manager
! 11546: >6 byte&0xf0 0xE0 device driver
! 11547: >6 byte&0xf0 0xF0 device descriptor
! 11548: #
! 11549: # OS9/m68k stuff (to be continued)
! 11550: #
! 11551: 0 beshort 0x4AFC OS9/68K module:
! 11552: #
! 11553: # attr
! 11554: >0x14 byte&0x80 0x80 re-entrant
! 11555: >0x14 byte&0x40 0x40 ghost
! 11556: >0x14 byte&0x20 0x20 system-state
! 11557: #
! 11558: # lang:
! 11559: #
! 11560: >0x13 byte 1 machine language
! 11561: >0x13 byte 2 BASIC I-code
! 11562: >0x13 byte 3 Pascal P-code
! 11563: >0x13 byte 4 C I-code
! 11564: >0x13 byte 5 COBOL I-code
! 11565: >0x13 byte 6 Fortran I-code
! 11566: #
! 11567: #
! 11568: # type:
! 11569: #
! 11570: >0x12 byte 1 program executable
! 11571: >0x12 byte 2 subroutine
! 11572: >0x12 byte 3 multi-module
! 11573: >0x12 byte 4 data module
! 11574: >0x12 byte 11 trap library
! 11575: >0x12 byte 12 system module
! 11576: >0x12 byte 13 file manager
! 11577: >0x12 byte 14 device driver
! 11578: >0x12 byte 15 device descriptor
! 11579: #
! 11580: # Mach magic number info
! 11581: #
! 11582: 0 long 0xefbe OSF/Rose object
! 11583: # I386 magic number info
! 11584: #
! 11585: 0 short 0565 i386 COFF object
! 11586:
! 11587: #------------------------------------------------------------------------------
! 11588: # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
! 11589: #
! 11590: # Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
! 11591:
! 11592: # appl
! 11593: 60 belong 0x6170706c PalmOS application
! 11594: >0 string >\0 "%s"
! 11595: # TEXt
! 11596: 60 belong 0x54455874 AportisDoc file
! 11597: >0 string >\0 "%s"
! 11598: # HACK
! 11599: 60 belong 0x4841434b HackMaster hack
! 11600: >0 string >\0 "%s"
! 11601:
! 11602: # Variety of PalmOS document types
! 11603: # Michael-John Turner <mj@debian.org>
! 11604: # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
! 11605: 60 string BVokBDIC BDicty PalmOS document
! 11606: >0 string >\0 "%s"
! 11607: 60 string DB99DBOS DB PalmOS document
! 11608: >0 string >\0 "%s"
! 11609: 60 string vIMGView FireViewer/ImageViewer PalmOS document
! 11610: >0 string >\0 "%s"
! 11611: 60 string PmDBPmDB HanDBase PalmOS document
! 11612: >0 string >\0 "%s"
! 11613: 60 string InfoINDB InfoView PalmOS document
! 11614: >0 string >\0 "%s"
! 11615: 60 string ToGoToGo iSilo PalmOS document
! 11616: >0 string >\0 "%s"
! 11617: 60 string JfDbJBas JFile PalmOS document
! 11618: >0 string >\0 "%s"
! 11619: 60 string JfDbJFil JFile Pro PalmOS document
! 11620: >0 string >\0 "%s"
! 11621: 60 string DATALSdb List PalmOS document
! 11622: >0 string >\0 "%s"
! 11623: 60 string Mdb1Mdb1 MobileDB PalmOS document
! 11624: >0 string >\0 "%s"
! 11625: 60 string PNRdPPrs PeanutPress PalmOS document
! 11626: >0 string >\0 "%s"
! 11627: 60 string DataPlkr Plucker PalmOS document
! 11628: >0 string >\0 "%s"
! 11629: 60 string DataSprd QuickSheet PalmOS document
! 11630: >0 string >\0 "%s"
! 11631: 60 string SM01SMem SuperMemo PalmOS document
! 11632: >0 string >\0 "%s"
! 11633: 60 string TEXtTlDc TealDoc PalmOS document
! 11634: >0 string >\0 "%s"
! 11635: 60 string InfoTlIf TealInfo PalmOS document
! 11636: >0 string >\0 "%s"
! 11637: 60 string DataTlMl TealMeal PalmOS document
! 11638: >0 string >\0 "%s"
! 11639: 60 string DataTlPt TealPaint PalmOS document
! 11640: >0 string >\0 "%s"
! 11641: 60 string dataTDBP ThinkDB PalmOS document
! 11642: >0 string >\0 "%s"
! 11643: 60 string TdatTide Tides PalmOS document
! 11644: >0 string >\0 "%s"
! 11645: 60 string ToRaTRPW TomeRaider PalmOS document
! 11646: >0 string >\0 "%s"
! 11647:
! 11648: # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
! 11649: # For version 1.xx zTXTs, outputs version and numbers of bookmarks and
! 11650: # annotations.
! 11651: # For other versions, just outputs version.
! 11652: #
! 11653: 60 string zTXT A GutenPalm zTXT e-book
! 11654: >0 string >\0 "%s"
! 11655: >(0x4E.L) byte 0
! 11656: >>(0x4E.L+1) byte x (v0.%02d)
! 11657: >(0x4E.L) byte 1
! 11658: >>(0x4E.L+1) byte x (v1.%02d)
! 11659: >>>(0x4E.L+10) beshort >0
! 11660: >>>>(0x4E.L+10) beshort <2 - 1 bookmark
! 11661: >>>>(0x4E.L+10) beshort >1 - %d bookmarks
! 11662: >>>(0x4E.L+14) beshort >0
! 11663: >>>>(0x4E.L+14) beshort <2 - 1 annotation
! 11664: >>>>(0x4E.L+14) beshort >1 - %d annotations
! 11665: >(0x4E.L) byte >1 (v%d.
! 11666: >>(0x4E.L+1) byte x %02d)
! 11667:
! 11668: # Palm OS .prc file types
! 11669: 60 string libr Palm OS dynamic library data
! 11670: >0 string >\0 "%s"
! 11671: 60 string ptch Palm OS operating system patch data
! 11672: >0 string >\0 "%s"
! 11673:
! 11674: # Mobipocket (www.mobipocket.com), donated by Carl Witty
! 11675: 60 string BOOKMOBI Mobipocket E-book
! 11676: >0 string >\0 "%s"
! 11677:
! 11678: #------------------------------------------------------------------------------
! 11679: #
! 11680: # Parix COFF executables
! 11681: # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
! 11682: #
! 11683: 0 beshort&0xfff 0xACE PARIX
! 11684: >0 byte&0xf0 0x80 T800
! 11685: >0 byte&0xf0 0x90 T9000
! 11686: >19 byte&0x02 0x02 executable
! 11687: >19 byte&0x02 0x00 object
! 11688: >19 byte&0x0c 0x00 not stripped
! 11689:
! 11690: #------------------------------------------------------------------------------
! 11691: # pbm: file(1) magic for Portable Bitmap files
! 11692: #
! 11693: # XXX - byte order?
! 11694: #
! 11695: 0 short 0x2a17 "compact bitmap" format (Poskanzer)
! 11696: #------------------------------------------------------------------------------
! 11697: # pdf: file(1) magic for Portable Document Format
! 11698: #
! 11699:
! 11700: 0 string %PDF- PDF document
! 11701: !:mime application/pdf
! 11702: >5 byte x \b, version %c
! 11703: >7 byte x \b.%c
! 11704:
! 11705: # From: Nick Schmalenberger <nick@schmalenberger.us>
! 11706: # Forms Data Format
! 11707: 0 string %FDF- FDF document
! 11708: >5 byte x \b, version %c
! 11709: >7 byte x \b.%c
! 11710:
! 11711: #------------------------------------------------------------------------------
! 11712: # pdp: file(1) magic for PDP-11 executable/object and APL workspace
! 11713: #
! 11714: 0 lelong 0101555 PDP-11 single precision APL workspace
! 11715: 0 lelong 0101554 PDP-11 double precision APL workspace
! 11716: #
! 11717: # PDP-11 a.out
! 11718: #
! 11719: 0 leshort 0407 PDP-11 executable
! 11720: >8 leshort >0 not stripped
! 11721: >15 byte >0 - version %ld
! 11722:
! 11723: 0 leshort 0401 PDP-11 UNIX/RT ldp
! 11724: 0 leshort 0405 PDP-11 old overlay
! 11725:
! 11726: 0 leshort 0410 PDP-11 pure executable
! 11727: >8 leshort >0 not stripped
! 11728: >15 byte >0 - version %ld
! 11729:
! 11730: 0 leshort 0411 PDP-11 separate I&D executable
! 11731: >8 leshort >0 not stripped
! 11732: >15 byte >0 - version %ld
! 11733:
! 11734: 0 leshort 0437 PDP-11 kernel overlay
! 11735:
! 11736: # These last three are derived from 2.11BSD file(1)
! 11737: 0 leshort 0413 PDP-11 demand-paged pure executable
! 11738: >8 leshort >0 not stripped
! 11739:
! 11740: 0 leshort 0430 PDP-11 overlaid pure executable
! 11741: >8 leshort >0 not stripped
! 11742:
! 11743: 0 leshort 0431 PDP-11 overlaid separate executable
! 11744: >8 leshort >0 not stripped
! 11745: #------------------------------------------------------------------------------
! 11746: # perl: file(1) magic for Larry Wall's perl language.
! 11747: #
! 11748: # The `eval' lines recognizes an outrageously clever hack.
! 11749: # Keith Waclena <keith@cerberus.uchicago.edu>
! 11750: # Send additions to <perl5-porters@perl.org>
! 11751: 0 search/1/b #!\ /bin/perl Perl script text executable
! 11752: !:mime text/x-perl
! 11753: 0 search/1 eval\ "exec\ /bin/perl Perl script text
! 11754: !:mime text/x-perl
! 11755: 0 search/1/b #!\ /usr/bin/perl Perl script text executable
! 11756: !:mime text/x-perl
! 11757: 0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
! 11758: !:mime text/x-perl
! 11759: 0 search/1/b #!\ /usr/local/bin/perl Perl script text executable
! 11760: !:mime text/x-perl
! 11761: 0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
! 11762: !:mime text/x-perl
! 11763: 0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
! 11764: !:mime text/x-perl
! 11765:
! 11766:
! 11767: # by Dmitry V. Levin and Alexey Tourbin
! 11768: # check the first line
! 11769: 0 search/1 package
! 11770: 0 regex \^package[\ \t]+[A-Za-z_]
! 11771: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
! 11772: # not 'p', check other lines
! 11773: 0 search/1 !p
! 11774: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
! 11775: >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
! 11776:
! 11777:
! 11778:
! 11779: # Perl POD documents
! 11780: # From: Tom Hukins <tom@eborcom.com>
! 11781: 0 search/1/B \=pod\n Perl POD document text
! 11782: 0 search/1/B \n\=pod\n Perl POD document text
! 11783: 0 search/1/B \=head1\ Perl POD document text
! 11784: 0 search/1/B \n\=head1\ Perl POD document text
! 11785: 0 search/1/B \=head2\ Perl POD document text
! 11786: 0 search/1/B \n\=head2\ Perl POD document text
! 11787:
! 11788: # Perl Storable data files.
! 11789: 0 string perl-store perl Storable (v0.6) data
! 11790: >4 byte >0 (net-order %d)
! 11791: >>4 byte &01 (network-ordered)
! 11792: >>4 byte =3 (major 1)
! 11793: >>4 byte =2 (major 1)
! 11794:
! 11795: 0 string pst0 perl Storable (v0.7) data
! 11796: >4 byte >0
! 11797: >>4 byte &01 (network-ordered)
! 11798: >>4 byte =5 (major 2)
! 11799: >>4 byte =4 (major 2)
! 11800: >>5 byte >0 (minor %d)
! 11801:
! 11802: #------------------------------------------------------------------------------
! 11803: # pgp: file(1) magic for Pretty Good Privacy
! 11804: # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
! 11805: #
! 11806: 0 beshort 0x9900 PGP key public ring
! 11807: !:mime application/x-pgp-keyring
! 11808: 0 beshort 0x9501 PGP key security ring
! 11809: !:mime application/x-pgp-keyring
! 11810: 0 beshort 0x9500 PGP key security ring
! 11811: !:mime application/x-pgp-keyring
! 11812: 0 beshort 0xa600 PGP encrypted data
! 11813: #!:mime application/pgp-encrypted
! 11814: #0 string -----BEGIN\040PGP text/PGP armored data
! 11815: !:mime text/PGP # encoding: armored data
! 11816: #>15 string PUBLIC\040KEY\040BLOCK- public key block
! 11817: #>15 string MESSAGE- message
! 11818: #>15 string SIGNED\040MESSAGE- signed message
! 11819: #>15 string PGP\040SIGNATURE- signature
! 11820:
! 11821: 2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
! 11822: !:mime application/pgp-keys
! 11823: 0 string -----BEGIN\040PGP\40MESSAGE- PGP message
! 11824: !:mime application/pgp
! 11825: 0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
! 11826: !:mime application/pgp-signature
! 11827:
! 11828: #------------------------------------------------------------------------------
! 11829: # pkgadd: file(1) magic for SysV R4 PKG Datastreams
! 11830: #
! 11831: 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
! 11832: !:mime application/x-svr4-package
! 11833:
! 11834: #------------------------------------------------------------------------------
! 11835: # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
! 11836: # From: "Stefan A. Haubenthal" <polluks@web.de>
! 11837: #
! 11838: 0 belong 0x00000107 Plan 9 executable, Motorola 68k
! 11839: 0 belong 0x000001EB Plan 9 executable, Intel 386
! 11840: 0 belong 0x00000247 Plan 9 executable, Intel 960
! 11841: 0 belong 0x000002AB Plan 9 executable, SPARC
! 11842: 0 belong 0x00000407 Plan 9 executable, MIPS R3000
! 11843: 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
! 11844: 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
! 11845: 0 belong 0x000005AB Plan 9 executable, AMD 29000
! 11846: 0 belong 0x00000647 Plan 9 executable, ARM 7-something
! 11847: 0 belong 0x000006EB Plan 9 executable, PowerPC
! 11848: 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
! 11849: 0 belong 0x0000084B Plan 9 executable, DEC Alpha
! 11850:
! 11851: #------------------------------------------------------------------------------
! 11852: # plus5: file(1) magic for Plus Five's UNIX MUMPS
! 11853: #
! 11854: # XXX - byte order? Paging Hokey....
! 11855: #
! 11856: 0 short 0x259 mumps avl global
! 11857: >2 byte >0 (V%d)
! 11858: >6 byte >0 with %d byte name
! 11859: >7 byte >0 and %d byte data cells
! 11860: 0 short 0x25a mumps blt global
! 11861: >2 byte >0 (V%d)
! 11862: >8 short >0 - %d byte blocks
! 11863: >15 byte 0x00 - P/D format
! 11864: >15 byte 0x01 - P/K/D format
! 11865: >15 byte 0x02 - K/D format
! 11866: >15 byte >0x02 - Bad Flags
! 11867:
! 11868: #------------------------------------------------------------------------------
! 11869: # printer: file(1) magic for printer-formatted files
! 11870: #
! 11871:
! 11872: # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
! 11873: 0 string %! PostScript document text
! 11874: !:mime application/postscript
! 11875: >2 string PS-Adobe- conforming
! 11876: >>11 string >\0 DSC level %.3s
! 11877: >>>15 string EPS \b, type %s
! 11878: >>>15 string Query \b, type %s
! 11879: >>>15 string ExitServer \b, type %s
! 11880: >>>15 search/1000 %%LanguageLevel:\
! 11881: >>>>&0 string >\0 \b, Level %s
! 11882: # Some PCs have the annoying habit of adding a ^D as a document separator
! 11883: 0 string \004%! PostScript document text
! 11884: !:mime application/postscript
! 11885: >3 string PS-Adobe- conforming
! 11886: >>12 string >\0 DSC level %.3s
! 11887: >>>16 string EPS \b, type %s
! 11888: >>>16 string Query \b, type %s
! 11889: >>>16 string ExitServer \b, type %s
! 11890: >>>16 search/1000 %%LanguageLevel:\
! 11891: >>>>&0 string >\0 \b, Level %s
! 11892: 0 string \033%-12345X%!PS PostScript document
! 11893:
! 11894: # DOS EPS Binary File Header
! 11895: # From: Ed Sznyter <ews@Black.Market.NET>
! 11896: 0 belong 0xC5D0D3C6 DOS EPS Binary File
! 11897: >4 long >0 Postscript starts at byte %d
! 11898: >>8 long >0 length %d
! 11899: >>>12 long >0 Metafile starts at byte %d
! 11900: >>>>16 long >0 length %d
! 11901: >>>20 long >0 TIFF starts at byte %d
! 11902: >>>>24 long >0 length %d
! 11903:
! 11904: # Summary: Adobe's PostScript Printer Description File
! 11905: # Extension: .ppd
! 11906: # Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
! 11907: # Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
! 11908: #
! 11909: 0 string *PPD-Adobe:\x20 PPD file
! 11910: >&0 string x \b, version %s
! 11911:
! 11912: # HP Printer Job Language
! 11913: 0 string \033%-12345X@PJL HP Printer Job Language data
! 11914: # HP Printer Job Language
! 11915: # The header found on Win95 HP plot files is the "Silliest Thing possible"
! 11916: # (TM)
! 11917: # Every driver puts the language at some random position, with random case
! 11918: # (LANGUAGE and Language)
! 11919: # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
! 11920: # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
! 11921: #
! 11922: 0 string \033%-12345X@PJL HP Printer Job Language data
! 11923: >&0 string >\0 %s
! 11924: >>&0 string >\0 %s
! 11925: >>>&0 string >\0 %s
! 11926: >>>>&0 string >\0 %s
! 11927: #>15 string \ ENTER\ LANGUAGE\ =
! 11928: #>31 string PostScript PostScript
! 11929:
! 11930: # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
! 11931: 0 string \033E\033 HP PCL printer data
! 11932: >3 string \&l0A - default page size
! 11933: >3 string \&l1A - US executive page size
! 11934: >3 string \&l2A - US letter page size
! 11935: >3 string \&l3A - US legal page size
! 11936: >3 string \&l26A - A4 page size
! 11937: >3 string \&l80A - Monarch envelope size
! 11938: >3 string \&l81A - No. 10 envelope size
! 11939: >3 string \&l90A - Intl. DL envelope size
! 11940: >3 string \&l91A - Intl. C5 envelope size
! 11941: >3 string \&l100A - Intl. B5 envelope size
! 11942: >3 string \&l-81A - No. 10 envelope size (landscape)
! 11943: >3 string \&l-90A - Intl. DL envelope size (landscape)
! 11944:
! 11945: # IMAGEN printer-ready files:
! 11946: 0 string @document( Imagen printer
! 11947: # this only works if "language xxx" is first item in Imagen header.
! 11948: >10 string language\ impress (imPRESS data)
! 11949: >10 string language\ daisy (daisywheel text)
! 11950: >10 string language\ diablo (daisywheel text)
! 11951: >10 string language\ printer (line printer emulation)
! 11952: >10 string language\ tektronix (Tektronix 4014 emulation)
! 11953: # Add any other languages that your Imagen uses - remember
! 11954: # to keep the word `text' if the file is human-readable.
! 11955: # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
! 11956: #
! 11957: # Now magic for IMAGEN font files...
! 11958: 0 string Rast RST-format raster font data
! 11959: >45 string >0 face %s
! 11960: # From Jukka Ukkonen
! 11961: 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
! 11962:
! 11963: # From <mike@flyn.org>
! 11964: # These are the /etc/magic entries to decode data sent to an Epson printer.
! 11965: 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
! 11966:
! 11967:
! 11968: #------------------------------------------------------------------------------
! 11969: # zenographics: file(1) magic for Zenographics ZjStream printer data
! 11970: # Rick Richardson rickr@mn.rr.com
! 11971: 0 string JZJZ
! 11972: >0x12 string ZZ Zenographics ZjStream printer data (big-endian)
! 11973: 0 string ZJZJ
! 11974: >0x12 string ZZ Zenographics ZjStream printer data (little-endian)
! 11975:
! 11976:
! 11977: #------------------------------------------------------------------------------
! 11978: # Oak Technologies printer stream
! 11979: # Rick Richardson <rickr@mn.rr.com>
! 11980: 0 string OAK
! 11981: >0x07 byte 0
! 11982: >0x0b byte 0 Oak Technologies printer stream
! 11983:
! 11984: # This would otherwise be recognized as PostScript - nick@debian.org
! 11985: 0 string %!VMF SunClock's Vector Map Format data
! 11986:
! 11987: #------------------------------------------------------------------------------
! 11988: # HP LaserJet 1000 series downloadable firmware file
! 11989: 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
! 11990:
! 11991: # From: Paolo <oopla@users.sf.net>
! 11992: # Epson ESC/Page, ESC/PageColor
! 11993: 0 string \x1b\x01@EJL Epson ESC/Page language printer data
! 11994:
! 11995: #------------------------------------------------------------------------------
! 11996: # project: file(1) magic for Project management
! 11997: #
! 11998: # Magic strings for ftnchek project files. Alexander Mai
! 11999: 0 string FTNCHEK_\ P project file for ftnchek
! 12000: >10 string 1 version 2.7
! 12001: >10 string 2 version 2.8 to 2.10
! 12002: >10 string 3 version 2.11 or later
! 12003:
! 12004: #------------------------------------------------------------------------------
! 12005: # psdbms: file(1) magic for psdatabase
! 12006: #
! 12007: 0 belong&0xff00ffff 0x56000000 ps database
! 12008: >1 string >\0 version %s
! 12009: >4 string >\0 from kernel %s
! 12010: #------------------------------------------------------------------------------
! 12011: # psion: file(1) magic for Psion handhelds data
! 12012: # from: Peter Breitenlohner <peb@mppmu.mpg.de>
! 12013: #
! 12014: 0 lelong 0x10000037 Psion Series 5
! 12015: >4 lelong 0x10000039 font file
! 12016: >4 lelong 0x1000003A printer driver
! 12017: >4 lelong 0x1000003B clipboard
! 12018: >4 lelong 0x10000042 multi-bitmap image
! 12019: >4 lelong 0x1000006A application information file
! 12020: >4 lelong 0x1000006D
! 12021: >>8 lelong 0x1000007D sketch image
! 12022: !:mime image/x-psion-sketch
! 12023: >>8 lelong 0x1000007E voice note
! 12024: >>8 lelong 0x1000007F word file
! 12025: >>8 lelong 0x10000085 OPL program
! 12026: >>8 lelong 0x10000088 sheet file
! 12027: >>8 lelong 0x100001C4 EasyFax initialisation file
! 12028: >4 lelong 0x10000073 OPO module
! 12029: >4 lelong 0x10000074 OPL application
! 12030: >4 lelong 0x1000008A exported multi-bitmap image
! 12031:
! 12032: 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
! 12033:
! 12034: 0 lelong 0x10000050 Psion Series 5
! 12035: >4 lelong 0x1000006D database
! 12036: >4 lelong 0x100000E4 ini file
! 12037:
! 12038: 0 lelong 0x10000079 Psion Series 5 binary:
! 12039: >4 lelong 0x00000000 DLL
! 12040: >4 lelong 0x10000049 comms hardware library
! 12041: >4 lelong 0x1000004A comms protocol library
! 12042: >4 lelong 0x1000005D OPX
! 12043: >4 lelong 0x1000006C application
! 12044: >4 lelong 0x1000008D DLL
! 12045: >4 lelong 0x100000AC logical device driver
! 12046: >4 lelong 0x100000AD physical device driver
! 12047: >4 lelong 0x100000E5 file transfer protocol
! 12048: >4 lelong 0x100000E5 file transfer protocol
! 12049: >4 lelong 0x10000140 printer definition
! 12050: >4 lelong 0x10000141 printer definition
! 12051:
! 12052: 0 lelong 0x1000007A Psion Series 5 executable
! 12053:
! 12054: #------------------------------------------------------------------------------
! 12055: # pulsar: file(1) magic for Pulsar POP3 daemon binary files
! 12056: #
! 12057: # http://pulsar.sourceforge.net
! 12058: # mailto:rok.papez@lugos.si
! 12059: #
! 12060:
! 12061: 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
! 12062: >4 ubelong x Version: %d.
! 12063: >8 ubelong x \b%d
! 12064:
! 12065:
! 12066: #------------------------------------------------------------------------------
! 12067: # pyramid: file(1) magic for Pyramids
! 12068: #
! 12069: # XXX - byte order?
! 12070: #
! 12071: 0 long 0x50900107 Pyramid 90x family executable
! 12072: 0 long 0x50900108 Pyramid 90x family pure executable
! 12073: >16 long >0 not stripped
! 12074: 0 long 0x5090010b Pyramid 90x family demand paged pure executable
! 12075: >16 long >0 not stripped
! 12076:
! 12077: #------------------------------------------------------------------------------
! 12078: # python: file(1) magic for python
! 12079: #
! 12080: # From: David Necas <yeti@physics.muni.cz>
! 12081: # often the module starts with a multiline string
! 12082: 0 string """ a python script text executable
! 12083: # MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
! 12084: # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
! 12085: 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
! 12086: 0 belong 0x87c60d0a python 2.0 byte-compiled
! 12087: 0 belong 0x2aeb0d0a python 2.1 byte-compiled
! 12088: 0 belong 0x2ded0d0a python 2.2 byte-compiled
! 12089: 0 belong 0x3bf20d0a python 2.3 byte-compiled
! 12090: 0 belong 0x6df20d0a python 2.4 byte-compiled
! 12091: 0 belong 0xb3f20d0a python 2.5 byte-compiled
! 12092:
! 12093: 0 string/b #!\ /usr/bin/python python script text executable
! 12094:
! 12095:
! 12096: #------------------------------------------------------------------------------
! 12097: # file(1) magic for revision control files
! 12098: # From Hendrik Scholz <hendrik@scholz.net>
! 12099: 0 string /1\ :pserver: cvs password text file
! 12100:
! 12101: # Conary changesets
! 12102: # From: Jonathan Smith <smithj@rpath.com>
! 12103: 0 belong 0xea3f81bb Conary changeset data
! 12104:
! 12105: # Type: Git bundles (git-bundle)
! 12106: # From: Josh Triplett <josh@freedesktop.org>
! 12107: 0 string #\ v2\ git\ bundle\n Git bundle
! 12108:
! 12109: # Type: Mercurial bundles
! 12110: # From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
! 12111: 0 string HG10 Mercurial bundle,
! 12112: >4 string UN uncompressed
! 12113: >4 string BZ bzip2 compressed
! 12114:
! 12115: # Type: Subversion (SVN) dumps
! 12116: # From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
! 12117: 0 string SVN-fs-dump-format-version: Subversion dumpfile
! 12118: >28 string >\0 (version: %s)
! 12119:
! 12120: # Type: Bazaar revision bundles and merge requests
! 12121: # URL: http://www.bazaar-vcs.org/
! 12122: # From: Jelmer Vernooij <jelmer@samba.org>
! 12123: 0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle
! 12124: 0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
! 12125:
! 12126: #------------------------------------------------------------------------------
! 12127: # riff: file(1) magic for RIFF format
! 12128: # See
! 12129: #
! 12130: # http://www.seanet.com/users/matts/riffmci/riffmci.htm
! 12131: #
! 12132: # AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi>
! 12133: #
! 12134: 0 string RIFF RIFF (little-endian) data
! 12135: # RIFF Palette format
! 12136: >8 string PAL \b, palette
! 12137: >>16 leshort x \b, version %d
! 12138: >>18 leshort x \b, %d entries
! 12139: # RIFF Device Independent Bitmap format
! 12140: >8 string RDIB \b, device-independent bitmap
! 12141: >>16 string BM
! 12142: >>>30 leshort 12 \b, OS/2 1.x format
! 12143: >>>>34 leshort x \b, %d x
! 12144: >>>>36 leshort x %d
! 12145: >>>30 leshort 64 \b, OS/2 2.x format
! 12146: >>>>34 leshort x \b, %d x
! 12147: >>>>36 leshort x %d
! 12148: >>>30 leshort 40 \b, Windows 3.x format
! 12149: >>>>34 lelong x \b, %d x
! 12150: >>>>38 lelong x %d x
! 12151: >>>>44 leshort x %d
! 12152: # RIFF MIDI format
! 12153: >8 string RMID \b, MIDI
! 12154: # RIFF Multimedia Movie File format
! 12155: >8 string RMMP \b, multimedia movie
! 12156: # RIFF wrapper for MP3
! 12157: >8 string RMP3 \b, MPEG Layer 3 audio
! 12158: # Microsoft WAVE format (*.wav)
! 12159: >8 string WAVE \b, WAVE audio
! 12160: !:mime audio/x-wav
! 12161: >>20 leshort 1 \b, Microsoft PCM
! 12162: >>>34 leshort >0 \b, %d bit
! 12163: >>20 leshort 2 \b, Microsoft ADPCM
! 12164: >>20 leshort 6 \b, ITU G.711 A-law
! 12165: >>20 leshort 7 \b, ITU G.711 mu-law
! 12166: >>20 leshort 17 \b, IMA ADPCM
! 12167: >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
! 12168: >>20 leshort 49 \b, GSM 6.10
! 12169: >>20 leshort 64 \b, ITU G.721 ADPCM
! 12170: >>20 leshort 80 \b, MPEG
! 12171: >>20 leshort 85 \b, MPEG Layer 3
! 12172: >>22 leshort =1 \b, mono
! 12173: >>22 leshort =2 \b, stereo
! 12174: >>22 leshort >2 \b, %d channels
! 12175: >>24 lelong >0 %d Hz
! 12176: # Corel Draw Picture
! 12177: >8 string CDRA \b, Corel Draw Picture
! 12178: !:mime image/x-coreldraw
! 12179: # AVI == Audio Video Interleave
! 12180: >8 string AVI\040 \b, AVI
! 12181: !:mime video/x-msvideo
! 12182: >>12 string LIST
! 12183: >>>20 string hdrlavih
! 12184: >>>>&36 lelong x \b, %lu x
! 12185: >>>>&40 lelong x %lu,
! 12186: >>>>&4 lelong >1000000 <1 fps,
! 12187: >>>>&4 lelong 1000000 1.00 fps,
! 12188: >>>>&4 lelong 500000 2.00 fps,
! 12189: >>>>&4 lelong 333333 3.00 fps,
! 12190: >>>>&4 lelong 250000 4.00 fps,
! 12191: >>>>&4 lelong 200000 5.00 fps,
! 12192: >>>>&4 lelong 166667 6.00 fps,
! 12193: >>>>&4 lelong 142857 7.00 fps,
! 12194: >>>>&4 lelong 125000 8.00 fps,
! 12195: >>>>&4 lelong 111111 9.00 fps,
! 12196: >>>>&4 lelong 100000 10.00 fps,
! 12197: # ]9.9,10.1[
! 12198: >>>>&4 lelong <101010
! 12199: >>>>>&-4 lelong >99010
! 12200: >>>>>>&-4 lelong !100000 ~10 fps,
! 12201: >>>>&4 lelong 83333 12.00 fps,
! 12202: # ]11.9,12.1[
! 12203: >>>>&4 lelong <84034
! 12204: >>>>>&-4 lelong >82645
! 12205: >>>>>>&-4 lelong !83333 ~12 fps,
! 12206: >>>>&4 lelong 66667 15.00 fps,
! 12207: # ]14.9,15.1[
! 12208: >>>>&4 lelong <67114
! 12209: >>>>>&-4 lelong >66225
! 12210: >>>>>>&-4 lelong !66667 ~15 fps,
! 12211: >>>>&4 lelong 50000 20.00 fps,
! 12212: >>>>&4 lelong 41708 23.98 fps,
! 12213: >>>>&4 lelong 41667 24.00 fps,
! 12214: # ]23.9,24.1[
! 12215: >>>>&4 lelong <41841
! 12216: >>>>>&-4 lelong >41494
! 12217: >>>>>>&-4 lelong !41708
! 12218: >>>>>>>&-4 lelong !41667 ~24 fps,
! 12219: >>>>&4 lelong 40000 25.00 fps,
! 12220: # ]24.9,25.1[
! 12221: >>>>&4 lelong <40161
! 12222: >>>>>&-4 lelong >39841
! 12223: >>>>>>&-4 lelong !40000 ~25 fps,
! 12224: >>>>&4 lelong 33367 29.97 fps,
! 12225: >>>>&4 lelong 33333 30.00 fps,
! 12226: # ]29.9,30.1[
! 12227: >>>>&4 lelong <33445
! 12228: >>>>>&-4 lelong >33223
! 12229: >>>>>>&-4 lelong !33367
! 12230: >>>>>>>&-4 lelong !33333 ~30 fps,
! 12231: >>>>&4 lelong <32224 >30 fps,
! 12232: ##>>>>&4 lelong x (%lu)
! 12233: ##>>>>&20 lelong x %lu frames,
! 12234: # Note: The tests below assume that the AVI has 1 or 2 streams,
! 12235: # "vids" optionally followed by "auds".
! 12236: # (Should cover 99.9% of all AVIs.)
! 12237: # assuming avih length = 56
! 12238: >>>88 string LIST
! 12239: >>>>96 string strlstrh
! 12240: >>>>>108 string vids video:
! 12241: >>>>>>&0 lelong 0 uncompressed
! 12242: # skip past vids strh
! 12243: >>>>>>(104.l+108) string strf
! 12244: >>>>>>>(104.l+132) lelong 1 RLE 8bpp
! 12245: >>>>>>>(104.l+132) string/c cvid Cinepak
! 12246: >>>>>>>(104.l+132) string/c i263 Intel I.263
! 12247: >>>>>>>(104.l+132) string/c iv32 Indeo 3.2
! 12248: >>>>>>>(104.l+132) string/c iv41 Indeo 4.1
! 12249: >>>>>>>(104.l+132) string/c iv50 Indeo 5.0
! 12250: >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
! 12251: >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
! 12252: >>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
! 12253: >>>>>>>(104.l+132) string/c mjpg Motion JPEG
! 12254: >>>>>>>(104.l+132) string/c div3 DivX 3
! 12255: >>>>>>>>112 string/c div3 Low-Motion
! 12256: >>>>>>>>112 string/c div4 Fast-Motion
! 12257: >>>>>>>(104.l+132) string/c divx DivX 4
! 12258: >>>>>>>(104.l+132) string/c dx50 DivX 5
! 12259: >>>>>>>(104.l+132) string/c xvid XviD
! 12260: >>>>>>>(104.l+132) string/c h264 H.264
! 12261: >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
! 12262: >>>>>>>(104.l+132) string/c h264 X.264 or H.264
! 12263: >>>>>>>(104.l+132) lelong 0
! 12264: ##>>>>>>>(104.l+132) string x (%.4s)
! 12265: # skip past first (video) LIST
! 12266: >>>>(92.l+96) string LIST
! 12267: >>>>>(92.l+104) string strlstrh
! 12268: >>>>>>(92.l+116) string auds \b, audio:
! 12269: # auds strh length = 56:
! 12270: >>>>>>>(92.l+172) string strf
! 12271: >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
! 12272: >>>>>>>>(92.l+180) leshort 0x0002 ADPCM
! 12273: >>>>>>>>(92.l+180) leshort 0x0006 aLaw
! 12274: >>>>>>>>(92.l+180) leshort 0x0007 uLaw
! 12275: >>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
! 12276: >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
! 12277: >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
! 12278: >>>>>>>>(92.l+180) leshort 0x0161 DivX
! 12279: ##>>>>>>>>(92.l+180) leshort x (0x%.4x)
! 12280: >>>>>>>>(92.l+182) leshort 1 (mono,
! 12281: >>>>>>>>(92.l+182) leshort 2 (stereo,
! 12282: >>>>>>>>(92.l+182) leshort >2 (%d channels,
! 12283: >>>>>>>>(92.l+184) lelong x %d Hz)
! 12284: # auds strh length = 64:
! 12285: >>>>>>>(92.l+180) string strf
! 12286: >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
! 12287: >>>>>>>>(92.l+188) leshort 0x0002 ADPCM
! 12288: >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
! 12289: >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
! 12290: >>>>>>>>(92.l+188) leshort 0x0161 DivX
! 12291: ##>>>>>>>>(92.l+188) leshort x (0x%.4x)
! 12292: >>>>>>>>(92.l+190) leshort 1 (mono,
! 12293: >>>>>>>>(92.l+190) leshort 2 (stereo,
! 12294: >>>>>>>>(92.l+190) leshort >2 (%d channels,
! 12295: >>>>>>>>(92.l+192) lelong x %d Hz)
! 12296: # Animated Cursor format
! 12297: >8 string ACON \b, animated cursor
! 12298: # SoundFont 2 <mpruett@sgi.com>
! 12299: >8 string sfbk SoundFont/Bank
! 12300: # MPEG-1 wrapped in a RIFF, apparently
! 12301: >8 string CDXA \b, wrapped MPEG-1 (CDXA)
! 12302: >8 string 4XMV \b, 4X Movie file
! 12303:
! 12304: #
! 12305: # XXX - some of the below may only appear in little-endian form.
! 12306: #
! 12307: # Also "MV93" appears to be for one form of Macromedia Director
! 12308: # files, and "GDMF" appears to be another multimedia format.
! 12309: #
! 12310: 0 string RIFX RIFF (big-endian) data
! 12311: # RIFF Palette format
! 12312: >8 string PAL \b, palette
! 12313: >>16 beshort x \b, version %d
! 12314: >>18 beshort x \b, %d entries
! 12315: # RIFF Device Independent Bitmap format
! 12316: >8 string RDIB \b, device-independent bitmap
! 12317: >>16 string BM
! 12318: >>>30 beshort 12 \b, OS/2 1.x format
! 12319: >>>>34 beshort x \b, %d x
! 12320: >>>>36 beshort x %d
! 12321: >>>30 beshort 64 \b, OS/2 2.x format
! 12322: >>>>34 beshort x \b, %d x
! 12323: >>>>36 beshort x %d
! 12324: >>>30 beshort 40 \b, Windows 3.x format
! 12325: >>>>34 belong x \b, %d x
! 12326: >>>>38 belong x %d x
! 12327: >>>>44 beshort x %d
! 12328: # RIFF MIDI format
! 12329: >8 string RMID \b, MIDI
! 12330: # RIFF Multimedia Movie File format
! 12331: >8 string RMMP \b, multimedia movie
! 12332: # Microsoft WAVE format (*.wav)
! 12333: >8 string WAVE \b, WAVE audio
! 12334: >>20 leshort 1 \b, Microsoft PCM
! 12335: >>>34 leshort >0 \b, %d bit
! 12336: >>22 beshort =1 \b, mono
! 12337: >>22 beshort =2 \b, stereo
! 12338: >>22 beshort >2 \b, %d channels
! 12339: >>24 belong >0 %d Hz
! 12340: # Corel Draw Picture
! 12341: >8 string CDRA \b, Corel Draw Picture
! 12342: # AVI == Audio Video Interleave
! 12343: >8 string AVI\040 \b, AVI
! 12344: # Animated Cursor format
! 12345: >8 string ACON \b, animated cursor
! 12346: # Notation Interchange File Format (big-endian only)
! 12347: >8 string NIFF \b, Notation Interchange File Format
! 12348: # SoundFont 2 <mpruett@sgi.com>
! 12349: >8 string sfbk SoundFont/Bank
! 12350: #------------------------------------------------------------------------------
! 12351: #
! 12352: # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
! 12353: #
! 12354: 0 beshort 0xedab
! 12355: >2 beshort 0xeedb RPM
! 12356: !:mime application/x-rpm
! 12357: >>4 byte x v%d
! 12358: >>6 beshort 0 bin
! 12359: >>6 beshort 1 src
! 12360: >>8 beshort 1 i386
! 12361: >>8 beshort 2 Alpha
! 12362: >>8 beshort 3 Sparc
! 12363: >>8 beshort 4 MIPS
! 12364: >>8 beshort 5 PowerPC
! 12365: >>8 beshort 6 68000
! 12366: >>8 beshort 7 SGI
! 12367: >>8 beshort 8 RS6000
! 12368: >>8 beshort 9 IA64
! 12369: >>8 beshort 10 Sparc64
! 12370: >>8 beshort 11 MIPSel
! 12371: >>8 beshort 12 ARM
! 12372: >>10 string x %s
! 12373:
! 12374: #------------------------------------------------------------------------------
! 12375: # rtf: file(1) magic for Rich Text Format (RTF)
! 12376: #
! 12377: # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
! 12378: #
! 12379: 0 string {\\rtf Rich Text Format data,
! 12380: !:mime text/rtf
! 12381: >5 string 1 version 1,
! 12382: >>6 string \\ansi ANSI
! 12383: >>6 string \\mac Apple Macintosh
! 12384: >>6 string \\pc IBM PC, code page 437
! 12385: >>6 string \\pca IBM PS/2, code page 850
! 12386: >>6 default x unknown character set
! 12387: >5 default x unknown version
! 12388: #------------------------------------------------------------------------------
! 12389: # ruby: file(1) magic for Lua scripting language
! 12390: # URL: http://www.ruby-lang.org/
! 12391: # From: Reuben Thomas <rrt@sc3d.org>
! 12392:
! 12393: # Ruby scripts
! 12394: 0 search/1/b #!\ /usr/bin/ruby Ruby script text executable
! 12395: 0 search/1/b #!\ /usr/local/bin/ruby Ruby script text executable
! 12396: 0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
! 12397: 0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
! 12398:
! 12399: #------------------------------------------------------------------------------
! 12400: # sc: file(1) magic for "sc" spreadsheet
! 12401: #
! 12402: 38 string Spreadsheet sc spreadsheet file
! 12403: !:mime application/x-sc
! 12404:
! 12405: #------------------------------------------------------------------------------
! 12406: # sccs: file(1) magic for SCCS archives
! 12407: #
! 12408: # SCCS archive structure:
! 12409: # \001h01207
! 12410: # \001s 00276/00000/00000
! 12411: # \001d D 1.1 87/09/23 08:09:20 ian 1 0
! 12412: # \001c date and time created 87/09/23 08:09:20 by ian
! 12413: # \001e
! 12414: # \001u
! 12415: # \001U
! 12416: # ... etc.
! 12417: # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
! 12418: # *Sigh*. And these both came from various parts of the USG.
! 12419: # Maybe we should just switch everybody from SCCS to RCS!
! 12420: # Further, you can't just say '\001h0', because the five-digit number
! 12421: # is a checksum that could (presumably) have any leading digit,
! 12422: # and we don't have regular expression matching yet.
! 12423: # Hence the following official kludge:
! 12424: 8 string \001s\ SCCS archive data
! 12425: #------------------------------------------------------------------------------
! 12426: # scientific: file(1) magic for scientific formats
! 12427: #
! 12428: # From: Joe Krahn <krahn@niehs.nih.gov>
! 12429:
! 12430: ########################################################
! 12431: # CCP4 data and plot files:
! 12432: 0 string MTZ\040 MTZ reflection file
! 12433:
! 12434: 92 string PLOT%%84 Plot84 plotting file
! 12435: >52 byte 1 , Little-endian
! 12436: >55 byte 1 , Big-endian
! 12437:
! 12438: ########################################################
! 12439: # Electron density MAP/MASK formats
! 12440:
! 12441: 0 string EZD_MAP NEWEZD Electron Density Map
! 12442: 109 string MAP\040( Old EZD Electron Density Map
! 12443:
! 12444: 0 string/c :-)\040Origin BRIX Electron Density Map
! 12445: >170 string >0 , Sigma:%.12s
! 12446: #>4 string >0 %.178s
! 12447: #>4 addr x %.178s
! 12448:
! 12449: 7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
! 12450: 9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
! 12451:
! 12452: 208 string MAP\040 CCP4 Electron Density Map
! 12453: # Assumes same stamp for float and double (normal case)
! 12454: >212 byte 17 \b, Big-endian
! 12455: >212 byte 34 \b, VAX format
! 12456: >212 byte 68 \b, Little-endian
! 12457: >212 byte 85 \b, Convex native
! 12458:
! 12459: ############################################################
! 12460: # X-Ray Area Detector images
! 12461: 0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
! 12462: >796 lelong <20 Little-endian, IP #%d,
! 12463: >>768 lelong >0 Size=%dx
! 12464: >>772 lelong >0 \b%d
! 12465: >796 belong <20 Big-endian, IP #%d,
! 12466: >>768 belong >0 Size=%dx
! 12467: >>772 belong >0 \b%d
! 12468:
! 12469: 0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
! 12470: >796 lelong <20 Little-endian, IP #%d,
! 12471: >>768 lelong >0 Size=%dx
! 12472: >>772 lelong >0 \b%d
! 12473: >796 belong <20 Big-endian, IP #%d,
! 12474: >>768 belong >0 Size=%dx
! 12475: >>772 belong >0 \b%d
! 12476:
! 12477:
! 12478: 1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
! 12479: >1072 ulong >1 Compressed(%d),
! 12480: >1100 ulong >1 %d headers,
! 12481: >1104 ulong >0 %d x
! 12482: >1108 ulong >0 %d,
! 12483: >1120 ulong >0 %d bits/pixel
! 12484:
! 12485: # Type: GEDCOM genealogical (family history) data
! 12486: # From: Giuseppe Bilotta
! 12487: 0 search/1/c 0\ HEAD GEDCOM genealogy text
! 12488: >&0 search 1\ GEDC
! 12489: >>&0 search 2\ VERS version
! 12490: >>>&1 search/1 >\0 %s
! 12491: # From: Phil Endecott <phil05@chezphil.org>
! 12492: 0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
! 12493: 0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
! 12494: 0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
! 12495: 0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
! 12496: 0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
! 12497: 0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
! 12498: 0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
! 12499: # Type: SE Linux policy modules *.pp reference policy
! 12500: # for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
! 12501: # URL: http://doc.coker.com.au/computers/selinux-magic
! 12502: # From: Russell Coker <russell@coker.com.au>
! 12503:
! 12504: 0 lelong 0xf97cff8f SE Linux modular policy
! 12505: >4 lelong x version %d,
! 12506: >8 lelong x %d sections,
! 12507: >>(12.l) lelong 0xf97cff8d
! 12508: >>>(12.l+27) lelong x mod version %d,
! 12509: >>>(12.l+31) lelong 0 Not MLS,
! 12510: >>>(12.l+31) lelong 1 MLS,
! 12511: >>>(12.l+23) lelong 2
! 12512: >>>>(12.l+47) string >\0 module name %s
! 12513: >>>(12.l+23) lelong 1 base
! 12514:
! 12515: 1 string policy_module( SE Linux policy module source
! 12516: 2 string policy_module( SE Linux policy module source
! 12517:
! 12518: 0 string ##\ <summary> SE Linux policy interface source
! 12519:
! 12520: #0 search gen_context( SE Linux policy file contexts
! 12521:
! 12522: #0 search gen_sens( SE Linux policy MLS constraints source
! 12523:
! 12524: #------------------------------------------------------------------------------
! 12525: # sendmail: file(1) magic for sendmail config files
! 12526: #
! 12527: # XXX - byte order?
! 12528: #
! 12529: 0 byte 046 Sendmail frozen configuration
! 12530: >16 string >\0 - version %s
! 12531: 0 short 0x271c Sendmail frozen configuration
! 12532: >16 string >\0 - version %s
! 12533:
! 12534: #------------------------------------------------------------------------------
! 12535: # sendmail: file(1) magic for sendmail m4(1) files
! 12536: #
! 12537: # From Hendrik Scholz <hendrik@scholz.net>
! 12538: # i.e. files in /usr/share/sendmail/cf/
! 12539: #
! 12540: 0 string divert(-1)\n sendmail m4 text file
! 12541:
! 12542:
! 12543: #------------------------------------------------------------------------------
! 12544: # sequent: file(1) magic for Sequent machines
! 12545: #
! 12546: # Sequent information updated by Don Dwiggins <atsun!dwiggins>.
! 12547: # For Sequent's multiprocessor systems (incomplete).
! 12548: 0 lelong 0x00ea BALANCE NS32000 .o
! 12549: >16 lelong >0 not stripped
! 12550: >124 lelong >0 version %ld
! 12551: 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
! 12552: >16 lelong >0 not stripped
! 12553: >124 lelong >0 version %ld
! 12554: 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
! 12555: >16 lelong >0 not stripped
! 12556: >124 lelong >0 version %ld
! 12557: 0 lelong 0x30ea BALANCE NS32000 standalone executable
! 12558: >16 lelong >0 not stripped
! 12559: >124 lelong >0 version %ld
! 12560: #
! 12561: # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
! 12562: # Symmetry magic nums will not be reached if DOS COM comes before them;
! 12563: # byte 0xeb is matched before these get a chance.
! 12564: 0 leshort 0x12eb SYMMETRY i386 .o
! 12565: >16 lelong >0 not stripped
! 12566: >124 lelong >0 version %ld
! 12567: 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
! 12568: >16 lelong >0 not stripped
! 12569: >124 lelong >0 version %ld
! 12570: 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
! 12571: >16 lelong >0 not stripped
! 12572: >124 lelong >0 version %ld
! 12573: 0 leshort 0x42eb SYMMETRY i386 standalone executable
! 12574: >16 lelong >0 not stripped
! 12575: >124 lelong >0 version %ld
! 12576:
! 12577: #------------------------------------------------------------------------------
! 12578: # sgi: file(1) magic for Silicon Graphics applications
! 12579:
! 12580: #
! 12581: #
! 12582: # Performance Co-Pilot file types
! 12583: 0 string PmNs PCP compiled namespace (V.0)
! 12584: 0 string PmN PCP compiled namespace
! 12585: >3 string >\0 (V.%1.1s)
! 12586: #3 lelong 0x84500526 PCP archive
! 12587: 3 belong 0x84500526 PCP archive
! 12588: >7 byte x (V.%d)
! 12589: #>20 lelong -2 temporal index
! 12590: #>20 lelong -1 metadata
! 12591: #>20 lelong 0 log volume #0
! 12592: #>20 lelong >0 log volume #%ld
! 12593: >20 belong -2 temporal index
! 12594: >20 belong -1 metadata
! 12595: >20 belong 0 log volume #0
! 12596: >20 belong >0 log volume #%ld
! 12597: >24 string >\0 host: %s
! 12598: 0 string PCPFolio PCP
! 12599: >9 string Version: Archive Folio
! 12600: >18 string >\0 (V.%s)
! 12601: 0 string #pmchart PCP pmchart view
! 12602: >9 string Version
! 12603: >17 string >\0 (V%-3.3s)
! 12604: 0 string #kmchart PCP kmchart view
! 12605: >9 string Version
! 12606: >17 string >\0 (V.%s)
! 12607: 0 string pmview PCP pmview config
! 12608: >7 string Version
! 12609: >15 string >\0 (V%-3.3s)
! 12610: 0 string #pmlogger PCP pmlogger config
! 12611: >10 string Version
! 12612: >18 string >\0 (V%1.1s)
! 12613: 0 string #pmdahotproc PCP pmdahotproc config
! 12614: >13 string Version
! 12615: >21 string >\0 (V%-3.3s)
! 12616: 0 string PcPh PCP Help
! 12617: >4 string 1 Index
! 12618: >4 string 2 Text
! 12619: >5 string >\0 (V.%1.1s)
! 12620: 0 string #pmieconf-rules PCP pmieconf rules
! 12621: >16 string >\0 (V.%1.1s)
! 12622: 3 string pmieconf-pmie PCP pmie config
! 12623: >17 string >\0 (V.%1.1s)
! 12624:
! 12625: # SpeedShop data files
! 12626: 0 lelong 0x13130303 SpeedShop data file
! 12627:
! 12628: # mdbm files
! 12629: 0 lelong 0x01023962 mdbm file, version 0 (obsolete)
! 12630: 0 string mdbm mdbm file,
! 12631: >5 byte x version %d,
! 12632: >6 byte x 2^%d pages,
! 12633: >7 byte x pagesize 2^%d,
! 12634: >17 byte x hash %d,
! 12635: >11 byte x dataformat %d
! 12636:
! 12637: # Alias Maya files
! 12638: 0 string //Maya ASCII Alias Maya Ascii File,
! 12639: >13 string >\0 version %s
! 12640: 8 string MAYAFOR4 Alias Maya Binary File,
! 12641: >32 string >\0 version %s scene
! 12642: 8 string MayaFOR4 Alias Maya Binary File,
! 12643: >32 string >\0 version %s scene
! 12644: 8 string CIMG Alias Maya Image File
! 12645: 8 string DEEP Alias Maya Image File
! 12646: #------------------------------------------------------------------------------
! 12647: # Type: SVG Vectorial Graphics
! 12648: # From: Noel Torres <tecnico@ejerciciosresueltos.com>
! 12649: 0 string \<?xml\ version="
! 12650: >15 string >\0
! 12651: >>23 search/400 \<svg SVG Scalable Vector Graphics image
! 12652: !:mime image/svg+xml
! 12653: >>23 search/400 \<gnc-v2 GnuCash file
! 12654: !:mime application/x-gnucash
! 12655:
! 12656: # Sitemap file
! 12657: 0 string \<?xml\ version="
! 12658: >15 string >\0
! 12659: >>23 search/400 \<urlset XML Sitemap document text
! 12660: !:mime application/xml-sitemap
! 12661:
! 12662: #------------------------------------------------------------------------------
! 12663: # sgml: file(1) magic for Standard Generalized Markup Language
! 12664: # HyperText Markup Language (HTML) is an SGML document type,
! 12665: # from Daniel Quinlan (quinlan@yggdrasil.com)
! 12666: # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
! 12667: 0 search/1/cB \<!doctype\ html HTML document text
! 12668: !:mime text/html
! 12669: 0 search/1/cb \<head HTML document text
! 12670: !:mime text/html
! 12671: 0 search/1/cb \<title HTML document text
! 12672: !:mime text/html
! 12673: 0 search/1/cb \<html HTML document text
! 12674: !:mime text/html
! 12675:
! 12676: # Extensible markup language (XML), a subset of SGML
! 12677: # from Marc Prud'hommeaux (marc@apocalypse.org)
! 12678: 0 search/1/cb \<?xml XML document text
! 12679: !:mime application/xml
! 12680: 0 string \<?xml\ version\ " XML
! 12681: !:mime application/xml
! 12682: 0 string \<?xml\ version=" XML
! 12683: !:mime application/xml
! 12684: >15 search/1 >\0 %.3s document text
! 12685: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
! 12686: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
! 12687: 0 string \<?xml\ version=' XML
! 12688: !:mime application/xml
! 12689: >15 search/1 >\0 %.3s document text
! 12690: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
! 12691: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
! 12692: 0 search/1/b \<?xml XML document text
! 12693: !:mime application/xml
! 12694: 0 search/1/b \<?XML broken XML document text
! 12695: !:mime application/xml
! 12696:
! 12697:
! 12698: # SGML, mostly from rph@sq
! 12699: 0 search/1/cb \<!doctype exported SGML document text
! 12700: 0 search/1/cb \<!subdoc exported SGML subdocument text
! 12701: 0 search/1/cb \<!-- exported SGML document text
! 12702:
! 12703: # Web browser cookie files
! 12704: # (Mozilla, Galeon, Netscape 4, Konqueror..)
! 12705: # Ulf Harnhammar <ulfh@update.uu.se>
! 12706: 0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text
! 12707: 0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
! 12708: 0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
! 12709:
! 12710: #------------------------------------------------------------------------
! 12711: # file(1) magic for sharc files
! 12712: #
! 12713: # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
! 12714: # FutureGroove Music (dsp@futuregroove.de)
! 12715:
! 12716: #------------------------------------------------------------------------
! 12717: #0 string Draw RiscOS Drawfile
! 12718: #0 string PACK RiscOS PackdDir archive
! 12719:
! 12720: #------------------------------------------------------------------------
! 12721: # SHARC DSP stuff (based on the FGM SHARC DSP SDK)
! 12722:
! 12723: #0 string =! Assembler source
! 12724: #0 string Analog ADi asm listing file
! 12725: 0 string .SYSTEM SHARC architecture file
! 12726: 0 string .system SHARC architecture file
! 12727:
! 12728: 0 leshort 0x521C SHARC COFF binary
! 12729: >2 leshort >1 , %hd sections
! 12730: >>12 lelong >0 , not stripped
! 12731:
! 12732: #------------------------------------------------------------------------------
! 12733: # sinclair: file(1) sinclair QL
! 12734:
! 12735: # additions to /etc/magic by Thomas M. Ott (ThMO)
! 12736:
! 12737: # Sinclair QL floppy disk formats (ThMO)
! 12738: 0 string =QL5 QL disk dump data,
! 12739: >3 string =A 720 KB,
! 12740: >3 string =B 1.44 MB,
! 12741: >3 string =C 3.2 MB,
! 12742: >4 string >\0 label:%.10s
! 12743:
! 12744: # Sinclair QL OS dump (ThMO)
! 12745: # (NOTE: if `file' would be able to use indirect references in a endian format
! 12746: # differing from the natural host format, this could be written more
! 12747: # reliably and faster...)
! 12748: #
! 12749: # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
! 12750: # than the first 8K of a file... #-(
! 12751: #
! 12752: #0 belong =0x30000
! 12753: #>49124 belong <47104
! 12754: #>>49128 belong <47104
! 12755: #>>>49132 belong <47104
! 12756: #>>>>49136 belong <47104 QL OS dump data,
! 12757: #>>>>>49148 string >\0 type %.3s,
! 12758: #>>>>>49142 string >\0 version %.4s
! 12759:
! 12760: # Sinclair QL firmware executables (ThMO)
! 12761: 0 string NqNqNq`\004 QL firmware executable (BCPL)
! 12762:
! 12763: # Sinclair QL libraries (was ThMO)
! 12764: 0 beshort 0xFB01 QDOS object
! 12765: >2 pstring x '%s'
! 12766:
! 12767: # Sinclair QL executables (was ThMO)
! 12768: 4 belong 0x4AFB QDOS executable
! 12769: >9 pstring x '%s'
! 12770:
! 12771: # Sinclair QL ROM (ThMO)
! 12772: 0 belong =0x4AFB0001 QL plugin-ROM data,
! 12773: >9 pstring =\0 un-named
! 12774: >9 pstring >\0 named: %s
! 12775: # Type: SiSU Markup Language
! 12776: # URL: http://www.sisudoc.org/
! 12777: # From: Ralph Amissah <ralph.amissah@gmail.com>
! 12778:
! 12779: 0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert
! 12780: >5 regex [0-9.]+ %s
! 12781:
! 12782: 0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master
! 12783: >5 regex [0-9.]+ %s
! 12784:
! 12785: 0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text
! 12786: >5 regex [0-9.]+ %s
! 12787:
! 12788: 0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text
! 12789: >5 regex [0-9.]+ %s
! 12790:
! 12791: 0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text
! 12792: >5 regex [0-9.]+ %s
! 12793: #------------------------------------------------------------------------------
! 12794: # Sketch Drawings: http://sketch.sourceforge.net/
! 12795: # From: Edwin Mons <e@ik.nu>
! 12796: 0 search/1 ##Sketch Sketch document text
! 12797:
! 12798: #-----------------------------------------------
! 12799: # GNU Smalltalk image, starting at version 1.6.2
! 12800: # From: catull_us@yahoo.com
! 12801: #
! 12802: 0 string GSTIm\0\0 GNU SmallTalk
! 12803: # little-endian
! 12804: >7 byte&1 =0 LE image version
! 12805: >>10 byte x %d.
! 12806: >>9 byte x \b%d.
! 12807: >>8 byte x \b%d
! 12808: #>>12 lelong x , data: %ld
! 12809: #>>16 lelong x , table: %ld
! 12810: #>>20 lelong x , memory: %ld
! 12811: # big-endian
! 12812: >7 byte&1 =1 BE image version
! 12813: >>8 byte x %d.
! 12814: >>9 byte x \b%d.
! 12815: >>10 byte x \b%d
! 12816: #>>12 belong x , data: %ld
! 12817: #>>16 belong x , table: %ld
! 12818: #>>20 belong x , memory: %ld
! 12819:
! 12820:
! 12821:
! 12822: #------------------------------------------------------------------------------
! 12823: # sniffer: file(1) magic for packet capture files
! 12824: #
! 12825: # From: guy@alum.mit.edu (Guy Harris)
! 12826: #
! 12827:
! 12828: #
! 12829: # Microsoft Network Monitor 1.x capture files.
! 12830: #
! 12831: 0 string RTSS NetMon capture file
! 12832: >5 byte x - version %d
! 12833: >4 byte x \b.%d
! 12834: >6 leshort 0 (Unknown)
! 12835: >6 leshort 1 (Ethernet)
! 12836: >6 leshort 2 (Token Ring)
! 12837: >6 leshort 3 (FDDI)
! 12838: >6 leshort 4 (ATM)
! 12839:
! 12840: #
! 12841: # Microsoft Network Monitor 2.x capture files.
! 12842: #
! 12843: 0 string GMBU NetMon capture file
! 12844: >5 byte x - version %d
! 12845: >4 byte x \b.%d
! 12846: >6 leshort 0 (Unknown)
! 12847: >6 leshort 1 (Ethernet)
! 12848: >6 leshort 2 (Token Ring)
! 12849: >6 leshort 3 (FDDI)
! 12850: >6 leshort 4 (ATM)
! 12851:
! 12852: #
! 12853: # Network General Sniffer capture files.
! 12854: # Sorry, make that "Network Associates Sniffer capture files."
! 12855: # Sorry, make that "Network General old DOS Sniffer capture files."
! 12856: #
! 12857: 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
! 12858: >33 byte 2 (compressed)
! 12859: >23 leshort x - version %d
! 12860: >25 leshort x \b.%d
! 12861: >32 byte 0 (Token Ring)
! 12862: >32 byte 1 (Ethernet)
! 12863: >32 byte 2 (ARCNET)
! 12864: >32 byte 3 (StarLAN)
! 12865: >32 byte 4 (PC Network broadband)
! 12866: >32 byte 5 (LocalTalk)
! 12867: >32 byte 6 (Znet)
! 12868: >32 byte 7 (Internetwork Analyzer)
! 12869: >32 byte 9 (FDDI)
! 12870: >32 byte 10 (ATM)
! 12871:
! 12872: #
! 12873: # Cinco Networks NetXRay capture files.
! 12874: # Sorry, make that "Network General Sniffer Basic capture files."
! 12875: # Sorry, make that "Network Associates Sniffer Basic capture files."
! 12876: # Sorry, make that "Network Associates Sniffer Basic, and Windows
! 12877: # Sniffer Pro", capture files."
! 12878: # Sorry, make that "Network General Sniffer capture files."
! 12879: #
! 12880: 0 string XCP\0 NetXRay capture file
! 12881: >4 string >\0 - version %s
! 12882: >44 leshort 0 (Ethernet)
! 12883: >44 leshort 1 (Token Ring)
! 12884: >44 leshort 2 (FDDI)
! 12885: >44 leshort 3 (WAN)
! 12886: >44 leshort 8 (ATM)
! 12887: >44 leshort 9 (802.11)
! 12888:
! 12889: #
! 12890: # "libpcap" capture files.
! 12891: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
! 12892: # the main program that uses that format, but there are other programs
! 12893: # that use "libpcap", or that use the same capture file format.)
! 12894: #
! 12895: 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
! 12896: >4 beshort x - version %d
! 12897: >6 beshort x \b.%d
! 12898: >20 belong 0 (No link-layer encapsulation
! 12899: >20 belong 1 (Ethernet
! 12900: >20 belong 2 (3Mb Ethernet
! 12901: >20 belong 3 (AX.25
! 12902: >20 belong 4 (ProNET
! 12903: >20 belong 5 (CHAOS
! 12904: >20 belong 6 (Token Ring
! 12905: >20 belong 7 (BSD ARCNET
! 12906: >20 belong 8 (SLIP
! 12907: >20 belong 9 (PPP
! 12908: >20 belong 10 (FDDI
! 12909: >20 belong 11 (RFC 1483 ATM
! 12910: >20 belong 12 (raw IP
! 12911: >20 belong 13 (BSD/OS SLIP
! 12912: >20 belong 14 (BSD/OS PPP
! 12913: >20 belong 19 (Linux ATM Classical IP
! 12914: >20 belong 50 (PPP or Cisco HDLC
! 12915: >20 belong 51 (PPP-over-Ethernet
! 12916: >20 belong 99 (Symantec Enterprise Firewall
! 12917: >20 belong 100 (RFC 1483 ATM
! 12918: >20 belong 101 (raw IP
! 12919: >20 belong 102 (BSD/OS SLIP
! 12920: >20 belong 103 (BSD/OS PPP
! 12921: >20 belong 104 (BSD/OS Cisco HDLC
! 12922: >20 belong 105 (802.11
! 12923: >20 belong 106 (Linux Classical IP over ATM
! 12924: >20 belong 107 (Frame Relay
! 12925: >20 belong 108 (OpenBSD loopback
! 12926: >20 belong 109 (OpenBSD IPsec encrypted
! 12927: >20 belong 112 (Cisco HDLC
! 12928: >20 belong 113 (Linux "cooked"
! 12929: >20 belong 114 (LocalTalk
! 12930: >20 belong 117 (OpenBSD PFLOG
! 12931: >20 belong 119 (802.11 with Prism header
! 12932: >20 belong 122 (RFC 2625 IP over Fibre Channel
! 12933: >20 belong 123 (SunATM
! 12934: >20 belong 127 (802.11 with radiotap header
! 12935: >20 belong 129 (Linux ARCNET
! 12936: >20 belong 138 (Apple IP over IEEE 1394
! 12937: >20 belong 140 (MTP2
! 12938: >20 belong 141 (MTP3
! 12939: >20 belong 143 (DOCSIS
! 12940: >20 belong 144 (IrDA
! 12941: >20 belong 147 (Private use 0
! 12942: >20 belong 148 (Private use 1
! 12943: >20 belong 149 (Private use 2
! 12944: >20 belong 150 (Private use 3
! 12945: >20 belong 151 (Private use 4
! 12946: >20 belong 152 (Private use 5
! 12947: >20 belong 153 (Private use 6
! 12948: >20 belong 154 (Private use 7
! 12949: >20 belong 155 (Private use 8
! 12950: >20 belong 156 (Private use 9
! 12951: >20 belong 157 (Private use 10
! 12952: >20 belong 158 (Private use 11
! 12953: >20 belong 159 (Private use 12
! 12954: >20 belong 160 (Private use 13
! 12955: >20 belong 161 (Private use 14
! 12956: >20 belong 162 (Private use 15
! 12957: >20 belong 163 (802.11 with AVS header
! 12958: >16 belong x \b, capture length %d)
! 12959: 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
! 12960: >4 leshort x - version %d
! 12961: >6 leshort x \b.%d
! 12962: >20 lelong 0 (No link-layer encapsulation
! 12963: >20 lelong 1 (Ethernet
! 12964: >20 lelong 2 (3Mb Ethernet
! 12965: >20 lelong 3 (AX.25
! 12966: >20 lelong 4 (ProNET
! 12967: >20 lelong 5 (CHAOS
! 12968: >20 lelong 6 (Token Ring
! 12969: >20 lelong 7 (ARCNET
! 12970: >20 lelong 8 (SLIP
! 12971: >20 lelong 9 (PPP
! 12972: >20 lelong 10 (FDDI
! 12973: >20 lelong 11 (RFC 1483 ATM
! 12974: >20 lelong 12 (raw IP
! 12975: >20 lelong 13 (BSD/OS SLIP
! 12976: >20 lelong 14 (BSD/OS PPP
! 12977: >20 lelong 19 (Linux ATM Classical IP
! 12978: >20 lelong 50 (PPP or Cisco HDLC
! 12979: >20 lelong 51 (PPP-over-Ethernet
! 12980: >20 lelong 99 (Symantec Enterprise Firewall
! 12981: >20 lelong 100 (RFC 1483 ATM
! 12982: >20 lelong 101 (raw IP
! 12983: >20 lelong 102 (BSD/OS SLIP
! 12984: >20 lelong 103 (BSD/OS PPP
! 12985: >20 lelong 104 (BSD/OS Cisco HDLC
! 12986: >20 lelong 105 (802.11
! 12987: >20 lelong 106 (Linux Classical IP over ATM
! 12988: >20 lelong 107 (Frame Relay
! 12989: >20 lelong 108 (OpenBSD loopback
! 12990: >20 lelong 109 (OpenBSD IPsec encrypted
! 12991: >20 lelong 112 (Cisco HDLC
! 12992: >20 lelong 113 (Linux "cooked"
! 12993: >20 lelong 114 (LocalTalk
! 12994: >20 lelong 117 (OpenBSD PFLOG
! 12995: >20 lelong 119 (802.11 with Prism header
! 12996: >20 lelong 122 (RFC 2625 IP over Fibre Channel
! 12997: >20 lelong 123 (SunATM
! 12998: >20 lelong 127 (802.11 with radiotap header
! 12999: >20 lelong 129 (Linux ARCNET
! 13000: >20 lelong 138 (Apple IP over IEEE 1394
! 13001: >20 lelong 140 (MTP2
! 13002: >20 lelong 141 (MTP3
! 13003: >20 lelong 143 (DOCSIS
! 13004: >20 lelong 144 (IrDA
! 13005: >20 lelong 147 (Private use 0
! 13006: >20 lelong 148 (Private use 1
! 13007: >20 lelong 149 (Private use 2
! 13008: >20 lelong 150 (Private use 3
! 13009: >20 lelong 151 (Private use 4
! 13010: >20 lelong 152 (Private use 5
! 13011: >20 lelong 153 (Private use 6
! 13012: >20 lelong 154 (Private use 7
! 13013: >20 lelong 155 (Private use 8
! 13014: >20 lelong 156 (Private use 9
! 13015: >20 lelong 157 (Private use 10
! 13016: >20 lelong 158 (Private use 11
! 13017: >20 lelong 159 (Private use 12
! 13018: >20 lelong 160 (Private use 13
! 13019: >20 lelong 161 (Private use 14
! 13020: >20 lelong 162 (Private use 15
! 13021: >20 lelong 163 (802.11 with AVS header
! 13022: >16 lelong x \b, capture length %d)
! 13023:
! 13024: #
! 13025: # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
! 13026: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
! 13027: # the main program that uses that format, but there are other programs
! 13028: # that use "libpcap", or that use the same capture file format.)
! 13029: #
! 13030: 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
! 13031: >4 beshort x - version %d
! 13032: >6 beshort x \b.%d
! 13033: >20 belong 0 (No link-layer encapsulation
! 13034: >20 belong 1 (Ethernet
! 13035: >20 belong 2 (3Mb Ethernet
! 13036: >20 belong 3 (AX.25
! 13037: >20 belong 4 (ProNET
! 13038: >20 belong 5 (CHAOS
! 13039: >20 belong 6 (Token Ring
! 13040: >20 belong 7 (ARCNET
! 13041: >20 belong 8 (SLIP
! 13042: >20 belong 9 (PPP
! 13043: >20 belong 10 (FDDI
! 13044: >20 belong 11 (RFC 1483 ATM
! 13045: >20 belong 12 (raw IP
! 13046: >20 belong 13 (BSD/OS SLIP
! 13047: >20 belong 14 (BSD/OS PPP
! 13048: >16 belong x \b, capture length %d)
! 13049: 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
! 13050: >4 leshort x - version %d
! 13051: >6 leshort x \b.%d
! 13052: >20 lelong 0 (No link-layer encapsulation
! 13053: >20 lelong 1 (Ethernet
! 13054: >20 lelong 2 (3Mb Ethernet
! 13055: >20 lelong 3 (AX.25
! 13056: >20 lelong 4 (ProNET
! 13057: >20 lelong 5 (CHAOS
! 13058: >20 lelong 6 (Token Ring
! 13059: >20 lelong 7 (ARCNET
! 13060: >20 lelong 8 (SLIP
! 13061: >20 lelong 9 (PPP
! 13062: >20 lelong 10 (FDDI
! 13063: >20 lelong 11 (RFC 1483 ATM
! 13064: >20 lelong 12 (raw IP
! 13065: >20 lelong 13 (BSD/OS SLIP
! 13066: >20 lelong 14 (BSD/OS PPP
! 13067: >16 lelong x \b, capture length %d)
! 13068:
! 13069: #
! 13070: # AIX "iptrace" capture files.
! 13071: #
! 13072: 0 string iptrace\ 1.0 "iptrace" capture file
! 13073: 0 string iptrace\ 2.0 "iptrace" capture file
! 13074:
! 13075: #
! 13076: # Novell LANalyzer capture files.
! 13077: #
! 13078: 0 leshort 0x1001 LANalyzer capture file
! 13079: 0 leshort 0x1007 LANalyzer capture file
! 13080:
! 13081: #
! 13082: # HP-UX "nettl" capture files.
! 13083: #
! 13084: 0 string \x54\x52\x00\x64\x00 "nettl" capture file
! 13085:
! 13086: #
! 13087: # RADCOM WAN/LAN Analyzer capture files.
! 13088: #
! 13089: 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
! 13090:
! 13091: #
! 13092: # NetStumbler log files. Not really packets, per se, but about as
! 13093: # close as you can get. These are log files from NetStumbler, a
! 13094: # Windows program, that scans for 802.11b networks.
! 13095: #
! 13096: 0 string NetS NetStumbler log file
! 13097: >8 lelong x \b, %d stations found
! 13098:
! 13099: #
! 13100: # EtherPeek/AiroPeek "version 9" capture files.
! 13101: #
! 13102: 0 string \177ver EtherPeek/AiroPeek capture file
! 13103:
! 13104: #
! 13105: # Visual Networks traffic capture files.
! 13106: #
! 13107: 0 string \x05VNF Visual Networks traffic capture file
! 13108:
! 13109: #
! 13110: # Network Instruments Observer capture files.
! 13111: #
! 13112: 0 string ObserverPktBuffe Network Instruments Observer capture file
! 13113:
! 13114: #
! 13115: # Files from Accellent Group's 5View products.
! 13116: #
! 13117: 0 string \xaa\xaa\xaa\xaa 5View capture file
! 13118: #------------------------------------------------------------------------------
! 13119: # softquad: file(1) magic for SoftQuad Publishing Software
! 13120: #
! 13121: # Author/Editor and RulesBuilder
! 13122: #
! 13123: # XXX - byte order?
! 13124: #
! 13125: 0 string \<!SQ\ DTD> Compiled SGML rules file
! 13126: >9 string >\0 Type %s
! 13127: 0 string \<!SQ\ A/E> A/E SGML Document binary
! 13128: >9 string >\0 Type %s
! 13129: 0 string \<!SQ\ STS> A/E SGML binary styles file
! 13130: >9 string >\0 Type %s
! 13131: 0 short 0xc0de Compiled PSI (v1) data
! 13132: 0 short 0xc0da Compiled PSI (v2) data
! 13133: >3 string >\0 (%s)
! 13134: # Binary sqtroff font/desc files...
! 13135: 0 short 0125252 SoftQuad DESC or font file binary
! 13136: >2 short >0 - version %d
! 13137: # Bitmaps...
! 13138: 0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
! 13139: #0 string SQ\ BITMAP2 SoftQuad Raster Format data
! 13140: # sqtroff intermediate language (replacement for ditroff int. lang.)
! 13141: 0 string X\ SoftQuad troff Context intermediate
! 13142: >2 string 495 for AT&T 495 laser printer
! 13143: >2 string hp for Hewlett-Packard LaserJet
! 13144: >2 string impr for IMAGEN imPRESS
! 13145: >2 string ps for PostScript
! 13146:
! 13147: # From: Michael Piefel <piefel@debian.org>
! 13148: # sqtroff intermediate language (replacement for ditroff int. lang.)
! 13149: 0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
! 13150: 0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
! 13151: 0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
! 13152: 0 string X\ ps SoftQuad troff Context intermediate for PostScript
! 13153:
! 13154: #------------------------------------------------------------------------------
! 13155: # spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
! 13156: #
! 13157: # Cloyce D. Spradling <cloyce@headgear.org>
! 13158:
! 13159: 0 string spec SPEC
! 13160: >4 string .cpu CPU
! 13161: >>8 string <: \b%.4s
! 13162: >>12 string . raw result text
! 13163:
! 13164: 17 string version=SPECjbb SPECjbb
! 13165: >32 string <: \b%.4s
! 13166: >>37 string <: v%.4s raw result text
! 13167:
! 13168: 0 string BEGIN\040SPECWEB SPECweb
! 13169: >13 string <: \b%.2s
! 13170: >>15 string _SSL \b_SSL
! 13171: >>>20 string <: v%.4s raw result text
! 13172: >>16 string <: v%.4s raw result text
! 13173:
! 13174: #------------------------------------------------------------------------------
! 13175: # spectrum: file(1) magic for Spectrum emulator files.
! 13176: #
! 13177: # John Elliott <jce@seasip.demon.co.uk>
! 13178:
! 13179: #
! 13180: # Spectrum +3DOS header
! 13181: #
! 13182: 0 string PLUS3DOS\032 Spectrum +3 data
! 13183: >15 byte 0 - BASIC program
! 13184: >15 byte 1 - number array
! 13185: >15 byte 2 - character array
! 13186: >15 byte 3 - memory block
! 13187: >>16 belong 0x001B0040 (screen)
! 13188: >15 byte 4 - Tasword document
! 13189: >15 string TAPEFILE - ZXT tapefile
! 13190: #
! 13191: # Tape file. This assumes the .TAP starts with a Spectrum-format header,
! 13192: # which nearly all will.
! 13193: #
! 13194: 0 string \023\000\000 Spectrum .TAP data
! 13195: >4 string x "%-10.10s"
! 13196: >3 byte 0 - BASIC program
! 13197: >3 byte 1 - number array
! 13198: >3 byte 2 - character array
! 13199: >3 byte 3 - memory block
! 13200: >>14 belong 0x001B0040 (screen)
! 13201:
! 13202: # The following three blocks are from pak21-spectrum@srcf.ucam.org
! 13203: # TZX tape images
! 13204: 0 string ZXTape!\x1a Spectrum .TZX data
! 13205: >8 byte x version %d
! 13206: >9 byte x \b.%d
! 13207:
! 13208: # RZX input recording files
! 13209: 0 string RZX! Spectrum .RZX data
! 13210: >4 byte x version %d
! 13211: >5 byte x \b.%d
! 13212:
! 13213: # Floppy disk images
! 13214: 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
! 13215: 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
! 13216: 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
! 13217: 0 string SINCLAIR Spectrum .SCL Betadisk image
! 13218:
! 13219: # Hard disk images
! 13220: 0 string RS-IDE\x1a Spectrum .HDF hard disk image
! 13221: >7 byte x \b, version 0x%02x
! 13222:
! 13223: #------------------------------------------------------------------------------
! 13224: # sql: file(1) magic for SQL files
! 13225: #
! 13226: # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
! 13227: # Recognize some MySQL files.
! 13228: #
! 13229: 0 beshort 0xfe01 MySQL table definition file
! 13230: >2 byte x Version %d
! 13231: 0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
! 13232: >3 byte x Version %d
! 13233: 0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
! 13234: >3 byte x Version %d
! 13235: 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
! 13236: >3 byte x Version %d
! 13237: 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
! 13238: >3 byte x Version %d
! 13239: 0 string \376bin MySQL replication log
! 13240:
! 13241: #------------------------------------------------------------------------------
! 13242: # iRiver H Series database file
! 13243: # From Ken Guest <ken@linux.ie>
! 13244: # As observed from iRivNavi.iDB and unencoded firmware
! 13245: #
! 13246: 0 string iRivDB iRiver Database file
! 13247: >11 string >\0 Version %s
! 13248: >39 string iHP-100 [H Series]
! 13249:
! 13250: #------------------------------------------------------------------------------
! 13251: # SQLite database files
! 13252: # Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
! 13253: #
! 13254: # Version 1 used GDBM internally; its files cannot be distinguished
! 13255: # from other GDBM files.
! 13256: #
! 13257: # Version 2 used this format:
! 13258: 0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
! 13259:
! 13260: # Version 3 of SQLite allows applications to embed their own "user version"
! 13261: # number in the database. Detect this and distinguish those files.
! 13262:
! 13263: 0 string SQLite\ format\ 3
! 13264: >60 string _MTN Monotone source repository
! 13265: >60 belong !0 SQLite 3.x database, user version %u
! 13266: >60 belong 0 SQLite 3.x database
! 13267:
! 13268: #------------------------------------------------------------------------------
! 13269: # sun: file(1) magic for Sun machines
! 13270: #
! 13271: # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
! 13272: # releases. (5.x uses ELF.)
! 13273: #
! 13274: 0 belong&077777777 0600413 sparc demand paged
! 13275: >0 byte &0x80
! 13276: >>20 belong <4096 shared library
! 13277: >>20 belong =4096 dynamically linked executable
! 13278: >>20 belong >4096 dynamically linked executable
! 13279: >0 byte ^0x80 executable
! 13280: >16 belong >0 not stripped
! 13281:
! 13282: 0 belong&077777777 0600410 sparc pure
! 13283: >0 byte &0x80 dynamically linked executable
! 13284: >0 byte ^0x80 executable
! 13285: >16 belong >0 not stripped
! 13286:
! 13287: 0 belong&077777777 0600407 sparc
! 13288: >0 byte &0x80 dynamically linked executable
! 13289: >0 byte ^0x80 executable
! 13290: >16 belong >0 not stripped
! 13291:
! 13292: 0 belong&077777777 0400413 mc68020 demand paged
! 13293: >0 byte &0x80
! 13294: >>20 belong <4096 shared library
! 13295: >>20 belong =4096 dynamically linked executable
! 13296: >>20 belong >4096 dynamically linked executable
! 13297: >0 byte ^0x80 executable
! 13298: >16 belong >0 not stripped
! 13299:
! 13300: 0 belong&077777777 0400410 mc68020 pure
! 13301: >0 byte &0x80 dynamically linked executable
! 13302: >0 byte ^0x80 executable
! 13303: >16 belong >0 not stripped
! 13304:
! 13305: 0 belong&077777777 0400407 mc68020
! 13306: >0 byte &0x80 dynamically linked executable
! 13307: >0 byte ^0x80 executable
! 13308: >16 belong >0 not stripped
! 13309:
! 13310: 0 belong&077777777 0200413 mc68010 demand paged
! 13311: >0 byte &0x80
! 13312: >>20 belong <4096 shared library
! 13313: >>20 belong =4096 dynamically linked executable
! 13314: >>20 belong >4096 dynamically linked executable
! 13315: >0 byte ^0x80 executable
! 13316: >16 belong >0 not stripped
! 13317:
! 13318: 0 belong&077777777 0200410 mc68010 pure
! 13319: >0 byte &0x80 dynamically linked executable
! 13320: >0 byte ^0x80 executable
! 13321: >16 belong >0 not stripped
! 13322:
! 13323: 0 belong&077777777 0200407 mc68010
! 13324: >0 byte &0x80 dynamically linked executable
! 13325: >0 byte ^0x80 executable
! 13326: >16 belong >0 not stripped
! 13327:
! 13328: # reworked these to avoid anything beginning with zero becoming "old sun-2"
! 13329: 0 belong 0407 old sun-2 executable
! 13330: >16 belong >0 not stripped
! 13331: 0 belong 0410 old sun-2 pure executable
! 13332: >16 belong >0 not stripped
! 13333: 0 belong 0413 old sun-2 demand paged executable
! 13334: >16 belong >0 not stripped
! 13335:
! 13336: #
! 13337: # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
! 13338: # binary executed in compatibility mode under SunOS 5.x".
! 13339: #
! 13340: 0 belong 0x080456 SunOS core file
! 13341: >4 belong 432 (SPARC)
! 13342: >>132 string >\0 from '%s'
! 13343: >>116 belong =3 (quit)
! 13344: >>116 belong =4 (illegal instruction)
! 13345: >>116 belong =5 (trace trap)
! 13346: >>116 belong =6 (abort)
! 13347: >>116 belong =7 (emulator trap)
! 13348: >>116 belong =8 (arithmetic exception)
! 13349: >>116 belong =9 (kill)
! 13350: >>116 belong =10 (bus error)
! 13351: >>116 belong =11 (segmentation violation)
! 13352: >>116 belong =12 (bad argument to system call)
! 13353: >>116 belong =29 (resource lost)
! 13354: >>120 belong x (T=%dK,
! 13355: >>124 belong x D=%dK,
! 13356: >>128 belong x S=%dK)
! 13357: >4 belong 826 (68K)
! 13358: >>128 string >\0 from '%s'
! 13359: >4 belong 456 (SPARC 4.x BCP)
! 13360: >>152 string >\0 from '%s'
! 13361: # Sun SunPC
! 13362: 0 long 0xfa33c08e SunPC 4.0 Hard Disk
! 13363: 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
! 13364: # Sun snoop (see RFC 1761, which describes the capture file format).
! 13365: #
! 13366: 0 string snoop Snoop capture file
! 13367: >8 belong >0 - version %ld
! 13368: >12 belong 0 (IEEE 802.3)
! 13369: >12 belong 1 (IEEE 802.4)
! 13370: >12 belong 2 (IEEE 802.5)
! 13371: >12 belong 3 (IEEE 802.6)
! 13372: >12 belong 4 (Ethernet)
! 13373: >12 belong 5 (HDLC)
! 13374: >12 belong 6 (Character synchronous)
! 13375: >12 belong 7 (IBM channel-to-channel adapter)
! 13376: >12 belong 8 (FDDI)
! 13377: >12 belong 9 (Unknown)
! 13378:
! 13379: # Microsoft ICM color profile
! 13380: 36 string acspMSFT Microsoft ICM Color Profile
! 13381: # Sun KCMS
! 13382: 36 string acsp Kodak Color Management System, ICC Profile
! 13383:
! 13384: #---------------------------------------------------------------------------
! 13385: # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
! 13386: # lead Sun/Cobalt developer) who agrees that they are good and worthy of
! 13387: # inclusion.
! 13388:
! 13389: # Boot ROM images for Sun/Cobalt Linux server appliances
! 13390: 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
! 13391: >38 string x V%.4s
! 13392:
! 13393: # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
! 13394: # at the very end where file(1) can't get it.
! 13395: 0 string CRfs COBALT boot rom data (Flat boot rom or file system)
! 13396:
! 13397:
! 13398: #------------------------------------------------------------------------
! 13399: # sysex: file(1) magic for MIDI sysex files
! 13400: #
! 13401: #
! 13402: 0 byte 0xF0 SysEx File -
! 13403:
! 13404: # North American Group
! 13405: >1 byte 0x01 Sequential
! 13406: >1 byte 0x02 IDP
! 13407: >1 byte 0x03 OctavePlateau
! 13408: >1 byte 0x04 Moog
! 13409: >1 byte 0x05 Passport
! 13410: >1 byte 0x06 Lexicon
! 13411: >1 byte 0x07 Kurzweil/Future Retro
! 13412: >>3 byte 0x77 777
! 13413: >>4 byte 0x00 Bank
! 13414: >>4 byte 0x01 Song
! 13415: >>5 byte 0x0f 16
! 13416: >>5 byte 0x0e 15
! 13417: >>5 byte 0x0d 14
! 13418: >>5 byte 0x0c 13
! 13419: >>5 byte 0x0b 12
! 13420: >>5 byte 0x0a 11
! 13421: >>5 byte 0x09 10
! 13422: >>5 byte 0x08 9
! 13423: >>5 byte 0x07 8
! 13424: >>5 byte 0x06 7
! 13425: >>5 byte 0x05 6
! 13426: >>5 byte 0x04 5
! 13427: >>5 byte 0x03 4
! 13428: >>5 byte 0x02 3
! 13429: >>5 byte 0x01 2
! 13430: >>5 byte 0x00 1
! 13431: >>5 byte 0x10 (ALL)
! 13432: >>2 byte x \b, Channel %d
! 13433: >1 byte 0x08 Fender
! 13434: >1 byte 0x09 Gulbransen
! 13435: >1 byte 0x0a AKG
! 13436: >1 byte 0x0b Voyce
! 13437: >1 byte 0x0c Waveframe
! 13438: >1 byte 0x0d ADA
! 13439: >1 byte 0x0e Garfield
! 13440: >1 byte 0x0f Ensoniq
! 13441: >1 byte 0x10 Oberheim
! 13442: >>2 byte 0x06 Matrix 6 series
! 13443: >>3 byte 0x0A Dump (All)
! 13444: >>3 byte 0x01 Dump (Bank)
! 13445: >>4 belong 0x0002040E Matrix 1000
! 13446: >>>11 byte <2 User bank %d
! 13447: >>>11 byte >1 Preset bank %d
! 13448: >1 byte 0x11 Apple
! 13449: >1 byte 0x12 GreyMatter
! 13450: >1 byte 0x14 PalmTree
! 13451: >1 byte 0x15 JLCooper
! 13452: >1 byte 0x16 Lowrey
! 13453: >1 byte 0x17 AdamsSmith
! 13454: >1 byte 0x18 E-mu
! 13455: >1 byte 0x19 Harmony
! 13456: >1 byte 0x1a ART
! 13457: >1 byte 0x1b Baldwin
! 13458: >1 byte 0x1c Eventide
! 13459: >1 byte 0x1d Inventronics
! 13460: >1 byte 0x1f Clarity
! 13461:
! 13462: # European Group
! 13463: >1 byte 0x21 SIEL
! 13464: >1 byte 0x22 Synthaxe
! 13465: >1 byte 0x24 Hohner
! 13466: >1 byte 0x25 Twister
! 13467: >1 byte 0x26 Solton
! 13468: >1 byte 0x27 Jellinghaus
! 13469: >1 byte 0x28 Southworth
! 13470: >1 byte 0x29 PPG
! 13471: >1 byte 0x2a JEN
! 13472: >1 byte 0x2b SSL
! 13473: >1 byte 0x2c AudioVertrieb
! 13474:
! 13475: >1 byte 0x2f ELKA
! 13476: >>3 byte 0x09 EK-44
! 13477:
! 13478: >1 byte 0x30 Dynacord
! 13479: >1 byte 0x31 Jomox
! 13480: >1 byte 0x33 Clavia
! 13481: >1 byte 0x39 Soundcraft
! 13482: # Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
! 13483: >1 byte 0x3e Waldorf
! 13484: >>2 byte 0x00 microWave
! 13485: >>2 byte 0x0E microwave2 / XT
! 13486: >>2 byte 0x0F Q / Q+
! 13487: >>3 byte =0 (default id)
! 13488: >>3 byte >0 (
! 13489: >>>3 byte <0x7F \bdevice %d)
! 13490: >>>3 byte =0x7F \bbroadcast id)
! 13491: >>3 byte 0x7f Microwave I
! 13492: >>>4 byte 0x00 SNDR (Sound Request)
! 13493: >>>4 byte 0x10 SNDD (Sound Dump)
! 13494: >>>4 byte 0x20 SNDP (Sound Parameter Change)
! 13495: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
! 13496: >>>4 byte 0x70 BOOT (Sound Reserved)
! 13497: >>>4 byte 0x01 MULR (Multi Request)
! 13498: >>>4 byte 0x11 MULD (Multi Dump)
! 13499: >>>4 byte 0x21 MULP (Multi Parameter Change)
! 13500: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
! 13501: >>>4 byte 0x71 OS (Multi Reserved)
! 13502: >>>4 byte 0x02 DRMR (Drum Map Request)
! 13503: >>>4 byte 0x12 DRMD (Drum Map Dump)
! 13504: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
! 13505: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
! 13506: >>>4 byte 0x72 BIN (Drum Map Reserved)
! 13507: >>>4 byte 0x03 PATR (Sequencer Pattern Request)
! 13508: >>>4 byte 0x13 PATD (Sequencer Pattern Dump)
! 13509: >>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
! 13510: >>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
! 13511: >>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
! 13512: >>>4 byte 0x04 GLBR (Global Parameter Request)
! 13513: >>>4 byte 0x14 GLBD (Global Parameter Dump)
! 13514: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
! 13515: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
! 13516: >>>4 byte 0x07 MODR (Mode Parameter Request)
! 13517: >>>4 byte 0x17 MODD (Mode Parameter Dump)
! 13518: >>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
! 13519: >>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
! 13520: >>2 byte 0x10 microQ
! 13521: >>>4 byte 0x00 SNDR (Sound Request)
! 13522: >>>4 byte 0x10 SNDD (Sound Dump)
! 13523: >>>4 byte 0x20 SNDP (Sound Parameter Change)
! 13524: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
! 13525: >>>4 byte 0x70 (Sound Reserved)
! 13526: >>>4 byte 0x01 MULR (Multi Request)
! 13527: >>>4 byte 0x11 MULD (Multi Dump)
! 13528: >>>4 byte 0x21 MULP (Multi Parameter Change)
! 13529: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
! 13530: >>>4 byte 0x71 OS (Multi Reserved)
! 13531: >>>4 byte 0x02 DRMR (Drum Map Request)
! 13532: >>>4 byte 0x12 DRMD (Drum Map Dump)
! 13533: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
! 13534: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
! 13535: >>>4 byte 0x72 BIN (Drum Map Reserved)
! 13536: >>>4 byte 0x04 GLBR (Global Parameter Request)
! 13537: >>>4 byte 0x14 GLBD (Global Parameter Dump)
! 13538: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
! 13539: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
! 13540: >>2 byte 0x11 rackAttack
! 13541: >>>4 byte 0x00 SNDR (Sound Parameter Request)
! 13542: >>>4 byte 0x10 SNDD (Sound Parameter Dump)
! 13543: >>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
! 13544: >>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
! 13545: >>>4 byte 0x01 PRGR (Program Parameter Request)
! 13546: >>>4 byte 0x11 PRGD (Program Parameter Dump)
! 13547: >>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
! 13548: >>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
! 13549: >>>4 byte 0x71 OS (Program Parameter Reserved)
! 13550: >>>4 byte 0x03 PATR (Pattern Parameter Request)
! 13551: >>>4 byte 0x13 PATD (Pattern Parameter Dump)
! 13552: >>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
! 13553: >>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
! 13554: >>>4 byte 0x04 GLBR (Global Parameter Request)
! 13555: >>>4 byte 0x14 GLBD (Global Parameter Dump)
! 13556: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
! 13557: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
! 13558: >>>4 byte 0x05 EFXR (FX Parameter Request)
! 13559: >>>4 byte 0x15 EFXD (FX Parameter Dump)
! 13560: >>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
! 13561: >>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
! 13562: >>>4 byte 0x07 MODR (Mode Command Request)
! 13563: >>>4 byte 0x17 MODD (Mode Command Dump)
! 13564: >>>4 byte 0x27 MODP (Mode Command Parameter Change)
! 13565: >>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
! 13566: >>2 byte 0x03 Wave
! 13567: >>>4 byte 0x00 SBPR (Soundprogram)
! 13568: >>>4 byte 0x01 SAPR (Performance)
! 13569: >>>4 byte 0x02 SWAVE (Wave)
! 13570: >>>4 byte 0x03 SWTBL (Wave control table)
! 13571: >>>4 byte 0x04 SVT (Velocity Curve)
! 13572: >>>4 byte 0x05 STT (Tuning Table)
! 13573: >>>4 byte 0x06 SGLB (Global Parameters)
! 13574: >>>4 byte 0x07 SARRMAP (Performance Program Change Map)
! 13575: >>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
! 13576: >>>4 byte 0x09 SBPRPAR (Sound Parameter)
! 13577: >>>4 byte 0x0A SARRPAR (Performance Parameter)
! 13578: >>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
! 13579: >>>4 byte 0x0F SBULK (Bulk Switch on/off)
! 13580:
! 13581: # Japanese Group
! 13582: >1 byte 0x40 Kawai
! 13583: >>3 byte 0x20 K1
! 13584: >>3 byte 0x22 K4
! 13585:
! 13586: >1 byte 0x41 Roland
! 13587: >>3 byte 0x14 D-50
! 13588: >>3 byte 0x2b U-220
! 13589: >>3 byte 0x02 TR-707
! 13590:
! 13591: >1 byte 0x42 Korg
! 13592: >>3 byte 0x19 M1
! 13593:
! 13594: >1 byte 0x43 Yamaha
! 13595: >1 byte 0x44 Casio
! 13596: >1 byte 0x46 Kamiya
! 13597: >1 byte 0x47 Akai
! 13598: >1 byte 0x48 Victor
! 13599: >1 byte 0x49 Mesosha
! 13600: >1 byte 0x4b Fujitsu
! 13601: >1 byte 0x4c Sony
! 13602: >1 byte 0x4e Teac
! 13603: >1 byte 0x50 Matsushita
! 13604: >1 byte 0x51 Fostex
! 13605: >1 byte 0x52 Zoom
! 13606: >1 byte 0x54 Matsushita
! 13607: >1 byte 0x57 Acoustic tech. lab.
! 13608:
! 13609: >1 belong&0xffffff00 0x00007400 Ta Horng
! 13610: >1 belong&0xffffff00 0x00007500 e-Tek
! 13611: >1 belong&0xffffff00 0x00007600 E-Voice
! 13612: >1 belong&0xffffff00 0x00007700 Midisoft
! 13613: >1 belong&0xffffff00 0x00007800 Q-Sound
! 13614: >1 belong&0xffffff00 0x00007900 Westrex
! 13615: >1 belong&0xffffff00 0x00007a00 Nvidia*
! 13616: >1 belong&0xffffff00 0x00007b00 ESS
! 13617: >1 belong&0xffffff00 0x00007c00 Mediatrix
! 13618: >1 belong&0xffffff00 0x00007d00 Brooktree
! 13619: >1 belong&0xffffff00 0x00007e00 Otari
! 13620: >1 belong&0xffffff00 0x00007f00 Key Electronics
! 13621: >1 belong&0xffffff00 0x00010000 Shure
! 13622: >1 belong&0xffffff00 0x00010100 AuraSound
! 13623: >1 belong&0xffffff00 0x00010200 Crystal
! 13624: >1 belong&0xffffff00 0x00010300 Rockwell
! 13625: >1 belong&0xffffff00 0x00010400 Silicon Graphics
! 13626: >1 belong&0xffffff00 0x00010500 Midiman
! 13627: >1 belong&0xffffff00 0x00010600 PreSonus
! 13628: >1 belong&0xffffff00 0x00010800 Topaz
! 13629: >1 belong&0xffffff00 0x00010900 Cast Lightning
! 13630: >1 belong&0xffffff00 0x00010a00 Microsoft
! 13631: >1 belong&0xffffff00 0x00010b00 Sonic Foundry
! 13632: >1 belong&0xffffff00 0x00010c00 Line 6
! 13633: >1 belong&0xffffff00 0x00010d00 Beatnik Inc.
! 13634: >1 belong&0xffffff00 0x00010e00 Van Koerving
! 13635: >1 belong&0xffffff00 0x00010f00 Altech Systems
! 13636: >1 belong&0xffffff00 0x00011000 S & S Research
! 13637: >1 belong&0xffffff00 0x00011100 VLSI Technology
! 13638: >1 belong&0xffffff00 0x00011200 Chromatic
! 13639: >1 belong&0xffffff00 0x00011300 Sapphire
! 13640: >1 belong&0xffffff00 0x00011400 IDRC
! 13641: >1 belong&0xffffff00 0x00011500 Justonic Tuning
! 13642: >1 belong&0xffffff00 0x00011600 TorComp
! 13643: >1 belong&0xffffff00 0x00011700 Newtek Inc.
! 13644: >1 belong&0xffffff00 0x00011800 Sound Sculpture
! 13645: >1 belong&0xffffff00 0x00011900 Walker Technical
! 13646: >1 belong&0xffffff00 0x00011a00 Digital Harmony
! 13647: >1 belong&0xffffff00 0x00011b00 InVision
! 13648: >1 belong&0xffffff00 0x00011c00 T-Square
! 13649: >1 belong&0xffffff00 0x00011d00 Nemesys
! 13650: >1 belong&0xffffff00 0x00011e00 DBX
! 13651: >1 belong&0xffffff00 0x00011f00 Syndyne
! 13652: >1 belong&0xffffff00 0x00012000 Bitheadz
! 13653: >1 belong&0xffffff00 0x00012100 Cakewalk
! 13654: >1 belong&0xffffff00 0x00012200 Staccato
! 13655: >1 belong&0xffffff00 0x00012300 National Semicon.
! 13656: >1 belong&0xffffff00 0x00012400 Boom Theory
! 13657: >1 belong&0xffffff00 0x00012500 Virtual DSP Corp
! 13658: >1 belong&0xffffff00 0x00012600 Antares
! 13659: >1 belong&0xffffff00 0x00012700 Angel Software
! 13660: >1 belong&0xffffff00 0x00012800 St Louis Music
! 13661: >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
! 13662: >1 belong&0xffffff00 0x00012a00 Ashley Audio
! 13663: >1 belong&0xffffff00 0x00012b00 Vari-Lite
! 13664: >1 belong&0xffffff00 0x00012c00 Summit Audio
! 13665: >1 belong&0xffffff00 0x00012d00 Aureal Semicon.
! 13666: >1 belong&0xffffff00 0x00012e00 SeaSound
! 13667: >1 belong&0xffffff00 0x00012f00 U.S. Robotics
! 13668: >1 belong&0xffffff00 0x00013000 Aurisis
! 13669: >1 belong&0xffffff00 0x00013100 Nearfield Multimedia
! 13670: >1 belong&0xffffff00 0x00013200 FM7 Inc.
! 13671: >1 belong&0xffffff00 0x00013300 Swivel Systems
! 13672: >1 belong&0xffffff00 0x00013400 Hyperactive
! 13673: >1 belong&0xffffff00 0x00013500 MidiLite
! 13674: >1 belong&0xffffff00 0x00013600 Radical
! 13675: >1 belong&0xffffff00 0x00013700 Roger Linn
! 13676: >1 belong&0xffffff00 0x00013800 Helicon
! 13677: >1 belong&0xffffff00 0x00013900 Event
! 13678: >1 belong&0xffffff00 0x00013a00 Sonic Network
! 13679: >1 belong&0xffffff00 0x00013b00 Realtime Music
! 13680: >1 belong&0xffffff00 0x00013c00 Apogee Digital
! 13681:
! 13682: >1 belong&0xffffff00 0x00202b00 Medeli Electronics
! 13683: >1 belong&0xffffff00 0x00202c00 Charlie Lab
! 13684: >1 belong&0xffffff00 0x00202d00 Blue Chip Music
! 13685: >1 belong&0xffffff00 0x00202e00 BEE OH Corp
! 13686: >1 belong&0xffffff00 0x00202f00 LG Semicon America
! 13687: >1 belong&0xffffff00 0x00203000 TESI
! 13688: >1 belong&0xffffff00 0x00203100 EMAGIC
! 13689: >1 belong&0xffffff00 0x00203200 Behringer
! 13690: >1 belong&0xffffff00 0x00203300 Access Music
! 13691: >1 belong&0xffffff00 0x00203400 Synoptic
! 13692: >1 belong&0xffffff00 0x00203500 Hanmesoft Corp
! 13693: >1 belong&0xffffff00 0x00203600 Terratec
! 13694: >1 belong&0xffffff00 0x00203700 Proel SpA
! 13695: >1 belong&0xffffff00 0x00203800 IBK MIDI
! 13696: >1 belong&0xffffff00 0x00203900 IRCAM
! 13697: >1 belong&0xffffff00 0x00203a00 Propellerhead Software
! 13698: >1 belong&0xffffff00 0x00203b00 Red Sound Systems
! 13699: >1 belong&0xffffff00 0x00203c00 Electron ESI AB
! 13700: >1 belong&0xffffff00 0x00203d00 Sintefex Audio
! 13701: >1 belong&0xffffff00 0x00203e00 Music and More
! 13702: >1 belong&0xffffff00 0x00203f00 Amsaro
! 13703: >1 belong&0xffffff00 0x00204000 CDS Advanced Technology
! 13704: >1 belong&0xffffff00 0x00204100 Touched by Sound
! 13705: >1 belong&0xffffff00 0x00204200 DSP Arts
! 13706: >1 belong&0xffffff00 0x00204300 Phil Rees Music
! 13707: >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
! 13708: >1 belong&0xffffff00 0x00204500 Soundart
! 13709: >1 belong&0xffffff00 0x00204600 C-Mexx Software
! 13710: >1 belong&0xffffff00 0x00204700 Klavis Tech.
! 13711: >1 belong&0xffffff00 0x00204800 Noteheads AB
! 13712:
! 13713: 0 string T707 Roland TR-707 Data
! 13714: #------------------------------------------------------------------------------
! 13715: # teapot: file(1) magic for "teapot" spreadsheet
! 13716: #
! 13717: 0 string #!teapot\012xdr teapot work sheet (XDR format)
! 13718:
! 13719: #------------------------------------------------------------------------------
! 13720: # terminfo: file(1) magic for terminfo
! 13721: #
! 13722: # XXX - byte order for screen images?
! 13723: #
! 13724: 0 string \032\001 Compiled terminfo entry
! 13725: 0 short 0433 Curses screen image
! 13726: 0 short 0434 Curses screen image
! 13727: #------------------------------------------------------------------------------
! 13728: # tex: file(1) magic for TeX files
! 13729: #
! 13730: # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
! 13731: #
! 13732: # From <conklin@talisman.kaleida.com>
! 13733:
! 13734: # Although we may know the offset of certain text fields in TeX DVI
! 13735: # and font files, we can't use them reliably because they are not
! 13736: # zero terminated. [but we do anyway, christos]
! 13737: 0 string \367\002 TeX DVI file
! 13738: !:mime application/x-dvi
! 13739: >16 string >\0 (%s)
! 13740: 0 string \367\203 TeX generic font data
! 13741: 0 string \367\131 TeX packed font data
! 13742: >3 string >\0 (%s)
! 13743: 0 string \367\312 TeX virtual font data
! 13744: 0 search/1 This\ is\ TeX, TeX transcript text
! 13745: 0 search/1 This\ is\ METAFONT, METAFONT transcript text
! 13746:
! 13747: # There is no way to detect TeX Font Metric (*.tfm) files without
! 13748: # breaking them apart and reading the data. The following patterns
! 13749: # match most *.tfm files generated by METAFONT or afm2tfm.
! 13750: 2 string \000\021 TeX font metric data
! 13751: !:mime application/x-tex-tfm
! 13752: >33 string >\0 (%s)
! 13753: 2 string \000\022 TeX font metric data
! 13754: !:mime application/x-tex-tfm
! 13755: >33 string >\0 (%s)
! 13756:
! 13757: # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
! 13758: 0 search/1 \\input\ texinfo Texinfo source text
! 13759: !:mime text/x-texinfo
! 13760: 0 search/1 This\ is\ Info\ file GNU Info text
! 13761: !:mime text/x-info
! 13762:
! 13763: # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
! 13764: 0 search/400 \\input TeX document text
! 13765: !:mime text/x-tex
! 13766: 0 search/400 \\section LaTeX document text
! 13767: !:mime text/x-tex
! 13768: 0 search/400 \\setlength LaTeX document text
! 13769: !:mime text/x-tex
! 13770: 0 search/400 \\documentstyle LaTeX document text
! 13771: !:mime text/x-tex
! 13772: 0 search/400 \\chapter LaTeX document text
! 13773: !:mime text/x-tex
! 13774: 0 search/400 \\documentclass LaTeX 2e document text
! 13775: !:mime text/x-tex
! 13776: 0 search/400 \\relax LaTeX auxiliary file
! 13777: !:mime text/x-tex
! 13778: 0 search/400 \\contentsline LaTeX table of contents
! 13779: !:mime text/x-tex
! 13780: 0 search/400 %\ -*-latex-*- LaTeX document text
! 13781: !:mime text/x-tex
! 13782:
! 13783: # Tex document, from Hendrik Scholz <hendrik@scholz.net>
! 13784: 0 search/1 \\ifx TeX document text
! 13785:
! 13786: # Index and glossary files
! 13787: 0 search/400 \\indexentry LaTeX raw index file
! 13788: 0 search/400 \\begin{theindex} LaTeX sorted index
! 13789: 0 search/400 \\glossaryentry LaTeX raw glossary
! 13790: 0 search/400 \\begin{theglossary} LaTeX sorted glossary
! 13791: 0 search/400 This\ is\ makeindex Makeindex log file
! 13792:
! 13793: # End of TeX
! 13794:
! 13795: #------------------------------------------------------------------------------
! 13796: # file(1) magic for BibTex text files
! 13797: # From Hendrik Scholz <hendrik@scholz.net>
! 13798:
! 13799: 0 search/1/c @article{ BibTeX text file
! 13800: 0 search/1/c @book{ BibTeX text file
! 13801: 0 search/1/c @inbook{ BibTeX text file
! 13802: 0 search/1/c @incollection{ BibTeX text file
! 13803: 0 search/1/c @inproceedings{ BibTeX text file
! 13804: 0 search/1/c @manual{ BibTeX text file
! 13805: 0 search/1/c @misc{ BibTeX text file
! 13806: 0 search/1/c @preamble{ BibTeX text file
! 13807: 0 search/1/c @phdthesis{ BibTeX text file
! 13808: 0 search/1/c @techreport{ BibTeX text file
! 13809: 0 search/1/c @unpublished{ BibTeX text file
! 13810:
! 13811: 73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header)
! 13812:
! 13813: 73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
! 13814:
! 13815: 0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
! 13816:
! 13817: 0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file
! 13818:
! 13819: 0 search/1 @c\ @mapfile{ TeX font aliases text file
! 13820: #------------------------------------------------------------------------------
! 13821: # file(1) magic for tgif(1) files
! 13822: # From Hendrik Scholz <hendrik@scholz.net>
! 13823:
! 13824: 0 string %TGIF\ x Tgif file version %s
! 13825:
! 13826: # ------------------------------------------------------------------------
! 13827: # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
! 13828: #
! 13829: # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
! 13830: #
! 13831: # Update: Romain Lievin (roms@lpg.ticalc.org).
! 13832: #
! 13833: # NOTE: This list is not complete.
! 13834: # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
! 13835: # program/group magic numbers in here because I cannot find any.
! 13836: 0 string **TI80** TI-80 Graphing Calculator File.
! 13837: 0 string **TI81** TI-81 Graphing Calculator File.
! 13838: #
! 13839: # Magic Numbers for the TI-73
! 13840: #
! 13841: 0 string **TI73** TI-73 Graphing Calculator
! 13842: >0x00003B byte 0x00 (real number)
! 13843: >0x00003B byte 0x01 (list)
! 13844: >0x00003B byte 0x02 (matrix)
! 13845: >0x00003B byte 0x03 (equation)
! 13846: >0x00003B byte 0x04 (string)
! 13847: >0x00003B byte 0x05 (program)
! 13848: >0x00003B byte 0x06 (assembly program)
! 13849: >0x00003B byte 0x07 (picture)
! 13850: >0x00003B byte 0x08 (gdb)
! 13851: >0x00003B byte 0x0C (complex number)
! 13852: >0x00003B byte 0x0F (window settings)
! 13853: >0x00003B byte 0x10 (zoom)
! 13854: >0x00003B byte 0x11 (table setup)
! 13855: >0x00003B byte 0x13 (backup)
! 13856:
! 13857: # Magic Numbers for the TI-82
! 13858: #
! 13859: 0 string **TI82** TI-82 Graphing Calculator
! 13860: >0x00003B byte 0x00 (real)
! 13861: >0x00003B byte 0x01 (list)
! 13862: >0x00003B byte 0x02 (matrix)
! 13863: >0x00003B byte 0x03 (Y-variable)
! 13864: >0x00003B byte 0x05 (program)
! 13865: >0x00003B byte 0x06 (protected prgm)
! 13866: >0x00003B byte 0x07 (picture)
! 13867: >0x00003B byte 0x08 (gdb)
! 13868: >0x00003B byte 0x0B (window settings)
! 13869: >0x00003B byte 0x0C (window settings)
! 13870: >0x00003B byte 0x0D (table setup)
! 13871: >0x00003B byte 0x0E (screenshot)
! 13872: >0x00003B byte 0x0F (backup)
! 13873: #
! 13874: # Magic Numbers for the TI-83
! 13875: #
! 13876: 0 string **TI83** TI-83 Graphing Calculator
! 13877: >0x00003B byte 0x00 (real)
! 13878: >0x00003B byte 0x01 (list)
! 13879: >0x00003B byte 0x02 (matrix)
! 13880: >0x00003B byte 0x03 (Y-variable)
! 13881: >0x00003B byte 0x04 (string)
! 13882: >0x00003B byte 0x05 (program)
! 13883: >0x00003B byte 0x06 (protected prgm)
! 13884: >0x00003B byte 0x07 (picture)
! 13885: >0x00003B byte 0x08 (gdb)
! 13886: >0x00003B byte 0x0B (window settings)
! 13887: >0x00003B byte 0x0C (window settings)
! 13888: >0x00003B byte 0x0D (table setup)
! 13889: >0x00003B byte 0x0E (screenshot)
! 13890: >0x00003B byte 0x13 (backup)
! 13891: #
! 13892: # Magic Numbers for the TI-83+
! 13893: #
! 13894: 0 string **TI83F* TI-83+ Graphing Calculator
! 13895: >0x00003B byte 0x00 (real number)
! 13896: >0x00003B byte 0x01 (list)
! 13897: >0x00003B byte 0x02 (matrix)
! 13898: >0x00003B byte 0x03 (equation)
! 13899: >0x00003B byte 0x04 (string)
! 13900: >0x00003B byte 0x05 (program)
! 13901: >0x00003B byte 0x06 (assembly program)
! 13902: >0x00003B byte 0x07 (picture)
! 13903: >0x00003B byte 0x08 (gdb)
! 13904: >0x00003B byte 0x0C (complex number)
! 13905: >0x00003B byte 0x0F (window settings)
! 13906: >0x00003B byte 0x10 (zoom)
! 13907: >0x00003B byte 0x11 (table setup)
! 13908: >0x00003B byte 0x13 (backup)
! 13909: >0x00003B byte 0x15 (application variable)
! 13910: >0x00003B byte 0x17 (group of variable)
! 13911:
! 13912: #
! 13913: # Magic Numbers for the TI-85
! 13914: #
! 13915: 0 string **TI85** TI-85 Graphing Calculator
! 13916: >0x00003B byte 0x00 (real number)
! 13917: >0x00003B byte 0x01 (complex number)
! 13918: >0x00003B byte 0x02 (real vector)
! 13919: >0x00003B byte 0x03 (complex vector)
! 13920: >0x00003B byte 0x04 (real list)
! 13921: >0x00003B byte 0x05 (complex list)
! 13922: >0x00003B byte 0x06 (real matrix)
! 13923: >0x00003B byte 0x07 (complex matrix)
! 13924: >0x00003B byte 0x08 (real constant)
! 13925: >0x00003B byte 0x09 (complex constant)
! 13926: >0x00003B byte 0x0A (equation)
! 13927: >0x00003B byte 0x0C (string)
! 13928: >0x00003B byte 0x0D (function GDB)
! 13929: >0x00003B byte 0x0E (polar GDB)
! 13930: >0x00003B byte 0x0F (parametric GDB)
! 13931: >0x00003B byte 0x10 (diffeq GDB)
! 13932: >0x00003B byte 0x11 (picture)
! 13933: >0x00003B byte 0x12 (program)
! 13934: >0x00003B byte 0x13 (range)
! 13935: >0x00003B byte 0x17 (window settings)
! 13936: >0x00003B byte 0x18 (window settings)
! 13937: >0x00003B byte 0x19 (window settings)
! 13938: >0x00003B byte 0x1A (window settings)
! 13939: >0x00003B byte 0x1B (zoom)
! 13940: >0x00003B byte 0x1D (backup)
! 13941: >0x00003B byte 0x1E (unknown)
! 13942: >0x00003B byte 0x2A (equation)
! 13943: >0x000032 string ZS4 - ZShell Version 4 File.
! 13944: >0x000032 string ZS3 - ZShell Version 3 File.
! 13945: #
! 13946: # Magic Numbers for the TI-86
! 13947: #
! 13948: 0 string **TI86** TI-86 Graphing Calculator
! 13949: >0x00003B byte 0x00 (real number)
! 13950: >0x00003B byte 0x01 (complex number)
! 13951: >0x00003B byte 0x02 (real vector)
! 13952: >0x00003B byte 0x03 (complex vector)
! 13953: >0x00003B byte 0x04 (real list)
! 13954: >0x00003B byte 0x05 (complex list)
! 13955: >0x00003B byte 0x06 (real matrix)
! 13956: >0x00003B byte 0x07 (complex matrix)
! 13957: >0x00003B byte 0x08 (real constant)
! 13958: >0x00003B byte 0x09 (complex constant)
! 13959: >0x00003B byte 0x0A (equation)
! 13960: >0x00003B byte 0x0C (string)
! 13961: >0x00003B byte 0x0D (function GDB)
! 13962: >0x00003B byte 0x0E (polar GDB)
! 13963: >0x00003B byte 0x0F (parametric GDB)
! 13964: >0x00003B byte 0x10 (diffeq GDB)
! 13965: >0x00003B byte 0x11 (picture)
! 13966: >0x00003B byte 0x12 (program)
! 13967: >0x00003B byte 0x13 (range)
! 13968: >0x00003B byte 0x17 (window settings)
! 13969: >0x00003B byte 0x18 (window settings)
! 13970: >0x00003B byte 0x19 (window settings)
! 13971: >0x00003B byte 0x1A (window settings)
! 13972: >0x00003B byte 0x1B (zoom)
! 13973: >0x00003B byte 0x1D (backup)
! 13974: >0x00003B byte 0x1E (unknown)
! 13975: >0x00003B byte 0x2A (equation)
! 13976: #
! 13977: # Magic Numbers for the TI-89
! 13978: #
! 13979: 0 string **TI89** TI-89 Graphing Calculator
! 13980: >0x000048 byte 0x00 (expression)
! 13981: >0x000048 byte 0x04 (list)
! 13982: >0x000048 byte 0x06 (matrix)
! 13983: >0x000048 byte 0x0A (data)
! 13984: >0x000048 byte 0x0B (text)
! 13985: >0x000048 byte 0x0C (string)
! 13986: >0x000048 byte 0x0D (graphic data base)
! 13987: >0x000048 byte 0x0E (figure)
! 13988: >0x000048 byte 0x10 (picture)
! 13989: >0x000048 byte 0x12 (program)
! 13990: >0x000048 byte 0x13 (function)
! 13991: >0x000048 byte 0x14 (macro)
! 13992: >0x000048 byte 0x1C (zipped)
! 13993: >0x000048 byte 0x21 (assembler)
! 13994: #
! 13995: # Magic Numbers for the TI-92
! 13996: #
! 13997: 0 string **TI92** TI-92 Graphing Calculator
! 13998: >0x000048 byte 0x00 (expression)
! 13999: >0x000048 byte 0x04 (list)
! 14000: >0x000048 byte 0x06 (matrix)
! 14001: >0x000048 byte 0x0A (data)
! 14002: >0x000048 byte 0x0B (text)
! 14003: >0x000048 byte 0x0C (string)
! 14004: >0x000048 byte 0x0D (graphic data base)
! 14005: >0x000048 byte 0x0E (figure)
! 14006: >0x000048 byte 0x10 (picture)
! 14007: >0x000048 byte 0x12 (program)
! 14008: >0x000048 byte 0x13 (function)
! 14009: >0x000048 byte 0x14 (macro)
! 14010: >0x000048 byte 0x1D (backup)
! 14011: #
! 14012: # Magic Numbers for the TI-92+/V200
! 14013: #
! 14014: 0 string **TI92P* TI-92+/V200 Graphing Calculator
! 14015: >0x000048 byte 0x00 (expression)
! 14016: >0x000048 byte 0x04 (list)
! 14017: >0x000048 byte 0x06 (matrix)
! 14018: >0x000048 byte 0x0A (data)
! 14019: >0x000048 byte 0x0B (text)
! 14020: >0x000048 byte 0x0C (string)
! 14021: >0x000048 byte 0x0D (graphic data base)
! 14022: >0x000048 byte 0x0E (figure)
! 14023: >0x000048 byte 0x10 (picture)
! 14024: >0x000048 byte 0x12 (program)
! 14025: >0x000048 byte 0x13 (function)
! 14026: >0x000048 byte 0x14 (macro)
! 14027: >0x000048 byte 0x1C (zipped)
! 14028: >0x000048 byte 0x21 (assembler)
! 14029: #
! 14030: # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
! 14031: #
! 14032: 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
! 14033: 0 string **TIFL** TI-XX Graphing Calculator (FLASH)
! 14034: >8 byte >0 - Revision %d
! 14035: >>9 byte x \b.%d,
! 14036: >12 byte >0 Revision date %02x
! 14037: >>13 byte x \b/%02x
! 14038: >>14 beshort x \b/%04x,
! 14039: >17 string >/0 name: '%s',
! 14040: >48 byte 0x74 device: TI-73,
! 14041: >48 byte 0x73 device: TI-83+,
! 14042: >48 byte 0x98 device: TI-89,
! 14043: >48 byte 0x88 device: TI-92+,
! 14044: >49 byte 0x23 type: OS upgrade,
! 14045: >49 byte 0x24 type: application,
! 14046: >49 byte 0x25 type: certificate,
! 14047: >49 byte 0x3e type: license,
! 14048: >74 lelong >0 size: %ld bytes
! 14049:
! 14050: # VTi & TiEmu skins (TI Graphing Calculators).
! 14051: # From: Romain Lievin (roms@lpg.ticalc.org).
! 14052: # Magic Numbers for the VTi skins
! 14053: 0 string VTI Virtual TI skin
! 14054: >3 string v - Version
! 14055: >>4 byte >0 \b %c
! 14056: >>6 byte x \b.%c
! 14057: # Magic Numbers for the TiEmu skins
! 14058: 0 string TiEmu TiEmu skin
! 14059: >6 string v - Version
! 14060: >>7 byte >0 \b %c
! 14061: >>9 byte x \b.%c
! 14062: >>10 byte x \b%c
! 14063:
! 14064: #------------------------------------------------------------------------------
! 14065: # timezone: file(1) magic for timezone data
! 14066: #
! 14067: # from Daniel Quinlan (quinlan@yggdrasil.com)
! 14068: # this should work on Linux, SunOS, and maybe others
! 14069: # Added new official magic number for recent versions of the Olson code
! 14070: 0 string TZif timezone data
! 14071: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
! 14072: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
! 14073: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
! 14074: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
! 14075: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
! 14076: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
! 14077: #------------------------------------------------------------------------------
! 14078: # troff: file(1) magic for *roff
! 14079: #
! 14080: # updated by Daniel Quinlan (quinlan@yggdrasil.com)
! 14081:
! 14082: # troff input
! 14083: 0 search/1 .\\" troff or preprocessor input text
! 14084: !:mime text/troff
! 14085: 0 search/1 '\\" troff or preprocessor input text
! 14086: !:mime text/troff
! 14087: 0 search/1 '.\\" troff or preprocessor input text
! 14088: !:mime text/troff
! 14089: 0 search/1 \\" troff or preprocessor input text
! 14090: !:mime text/troff
! 14091: 0 search/1 ''' troff or preprocessor input text
! 14092: !:mime text/troff
! 14093:
! 14094: # ditroff intermediate output text
! 14095: 0 search/1 x\ T ditroff output text
! 14096: >4 search/1 cat for the C/A/T phototypesetter
! 14097: >4 search/1 ps for PostScript
! 14098: >4 search/1 dvi for DVI
! 14099: >4 search/1 ascii for ASCII
! 14100: >4 search/1 lj4 for LaserJet 4
! 14101: >4 search/1 latin1 for ISO 8859-1 (Latin 1)
! 14102: >4 search/1 X75 for xditview at 75dpi
! 14103: >>7 search/1 -12 (12pt)
! 14104: >4 search/1 X100 for xditview at 100dpi
! 14105: >>8 search/1 -12 (12pt)
! 14106:
! 14107: # output data formats
! 14108: 0 string \100\357 very old (C/A/T) troff output data
! 14109: #
! 14110: #------------------------------------------------------------------------------
! 14111: # tuxedo: file(1) magic for BEA TUXEDO data files
! 14112: #
! 14113: # from Ian Springer <ispringer@hotmail.com>
! 14114: #
! 14115: 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
! 14116:
! 14117: #------------------------------------------------------------------------------
! 14118: # typeset: file(1) magic for other typesetting
! 14119: #
! 14120: 0 string Interpress/Xerox Xerox InterPress data
! 14121: >16 string / (version
! 14122: >>17 string >\0 %s)
! 14123: #---------------------------------------------------------------------------
! 14124: # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
! 14125: # GRR: These types should be recognised in file_ascmagic so these
! 14126: # encodings can be treated by text patterns.
! 14127: # Missing types are already dealt with internally.
! 14128: #
! 14129: 0 string +/v8 Unicode text, UTF-7
! 14130: 0 string +/v9 Unicode text, UTF-7
! 14131: 0 string +/v+ Unicode text, UTF-7
! 14132: 0 string +/v/ Unicode text, UTF-7
! 14133: 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
! 14134: 0 string \376\377\000\000 Unicode text, UTF-32, big-endian
! 14135: 0 string \377\376\000\000 Unicode text, UTF-32, little-endian
! 14136: 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
! 14137:
! 14138: #------------------------------------------------------------------------------
! 14139: # unknown: file(1) magic for unknown machines
! 14140: #
! 14141: # XXX - this probably should be pruned, as it'll match PDP-11 and
! 14142: # VAX image formats.
! 14143: #
! 14144: # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
! 14145: # respectively).
! 14146: #
! 14147: # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
! 14148: # have the "version %ld", which may be a bogus COFFism (I don't think
! 14149: # there ever was COFF for the PDP-11).
! 14150: #
! 14151: # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
! 14152: # long, as it would be on a VAX.
! 14153: #
! 14154: # 0x10C is 0414 and 0x10E is 416; those *are* unknown.
! 14155: #
! 14156: 0 short 0x107 unknown machine executable
! 14157: >8 short >0 not stripped
! 14158: >15 byte >0 - version %ld
! 14159: 0 short 0x108 unknown pure executable
! 14160: >8 short >0 not stripped
! 14161: >15 byte >0 - version %ld
! 14162: 0 short 0x109 PDP-11 separate I&D
! 14163: >8 short >0 not stripped
! 14164: >15 byte >0 - version %ld
! 14165: 0 short 0x10b unknown pure executable
! 14166: >8 short >0 not stripped
! 14167: >15 byte >0 - version %ld
! 14168: 0 long 0x10c unknown demand paged pure executable
! 14169: >16 long >0 not stripped
! 14170: 0 long 0x10e unknown readable demand paged pure executable
! 14171: #------------------------------------------------------------------------------
! 14172: # uuencode: file(1) magic for ASCII-encoded files
! 14173: #
! 14174:
! 14175: # GRR: the first line of xxencoded files is identical to that in uuencoded
! 14176: # files, but the first character in most subsequent lines is 'h' instead of
! 14177: # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
! 14178: # punctuation and survives BITNET gateways better.) If regular expressions
! 14179: # were supported, this entry could possibly be split into two with
! 14180: # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
! 14181: 0 search/1 begin\ uuencoded or xxencoded text
! 14182:
! 14183: # btoa(1) is an alternative to uuencode that requires less space.
! 14184: 0 search/1 xbtoa\ Begin btoa'd text
! 14185:
! 14186: # ship(1) is another, much cooler alternative to uuencode.
! 14187: # Greg Roelofs, newt@uchicago.edu
! 14188: 0 search/1 $\012ship ship'd binary text
! 14189:
! 14190: # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
! 14191: # Greg Roelofs, newt@uchicago.edu
! 14192: 0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
! 14193:
! 14194: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
! 14195: # Daniel Quinlan, quinlan@yggdrasil.com
! 14196: 11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
! 14197: >41 search/1 x \b, version %.3s
! 14198:
! 14199: # GRR: handle BASE64
! 14200:
! 14201: #------------------------------------------------------------------------------
! 14202: # varied.out: file(1) magic for various USG systems
! 14203: #
! 14204: # Herewith many of the object file formats used by USG systems.
! 14205: # Most have been moved to files for a particular processor,
! 14206: # and deleted if they duplicate other entries.
! 14207: #
! 14208: 0 short 0610 Perkin-Elmer executable
! 14209: # AMD 29K
! 14210: 0 beshort 0572 amd 29k coff noprebar executable
! 14211: 0 beshort 01572 amd 29k coff prebar executable
! 14212: 0 beshort 0160007 amd 29k coff archive
! 14213: # Cray
! 14214: 6 beshort 0407 unicos (cray) executable
! 14215: # Ultrix 4.3
! 14216: 596 string \130\337\377\377 Ultrix core file
! 14217: >600 string >\0 from '%s'
! 14218: # BeOS and MAcOS PEF executables
! 14219: # From: hplus@zilker.net (Jon Watte)
! 14220: 0 string Joy!peffpwpc header for PowerPC PEF executable
! 14221: #
! 14222: # ava assembler/linker Uros Platise <uros.platise@ijs.si>
! 14223: 0 string avaobj AVR assembler object code
! 14224: >7 string >\0 version '%s'
! 14225: # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
! 14226: 0 string gmon GNU prof performance data
! 14227: >4 long x - version %ld
! 14228: # From: Dave Pearson <davep@davep.org>
! 14229: # Harbour <URL:http://www.harbour-project.org/> HRB files.
! 14230: 0 string \xc0HRB Harbour HRB file
! 14231: >4 short x version %d
! 14232:
! 14233: # From: Alex Beregszaszi <alex@fsn.hu>
! 14234: # 0 string exec BugOS executable
! 14235: # 0 string pack BugOS archive
! 14236:
! 14237: # From: Jason Spence <jspence@lightconsulting.com>
! 14238: # Generated by the "examples" in STM's ST40 devkit, and derived code.
! 14239: 0 lelong 0x13a9f17e ST40 component image format
! 14240: >4 string >\0 \b, name '%s'
! 14241:
! 14242: #------------------------------------------------------------------------------
! 14243: # varied.script: file(1) magic for various interpreter scripts
! 14244:
! 14245: 0 string #!\ / a
! 14246: >3 string >\0 %s script text executable
! 14247: 0 string #!\t/ a
! 14248: >3 string >\0 %s script text executable
! 14249: 0 string #!/ a
! 14250: >2 string >\0 %s script text executable
! 14251: 0 string #!\ script text executable
! 14252: >3 string >\0 for %s
! 14253:
! 14254: # From: arno <arenevier@fdn.fr>
! 14255: # mozilla xpconnect typelib
! 14256: # see http://www.mozilla.org/scriptable/typelib_file.html
! 14257: 0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
! 14258: >0x10 byte x version %d
! 14259: >>0x11 byte x \b.%d
! 14260:
! 14261: #------------------------------------------------------------------------------
! 14262: # vax: file(1) magic for VAX executable/object and APL workspace
! 14263: #
! 14264: 0 lelong 0101557 VAX single precision APL workspace
! 14265: 0 lelong 0101556 VAX double precision APL workspace
! 14266:
! 14267: #
! 14268: # VAX a.out (32V, BSD)
! 14269: #
! 14270: 0 lelong 0407 VAX executable
! 14271: >16 lelong >0 not stripped
! 14272:
! 14273: 0 lelong 0410 VAX pure executable
! 14274: >16 lelong >0 not stripped
! 14275:
! 14276: 0 lelong 0413 VAX demand paged pure executable
! 14277: >16 lelong >0 not stripped
! 14278:
! 14279: 0 lelong 0420 VAX demand paged (first page unmapped) pure executable
! 14280: >16 lelong >0 not stripped
! 14281:
! 14282: #
! 14283: # VAX COFF
! 14284: #
! 14285: # The `versions' should be un-commented if they work for you.
! 14286: # (Was the problem just one of endianness?)
! 14287: #
! 14288: 0 leshort 0570 VAX COFF executable
! 14289: >12 lelong >0 not stripped
! 14290: >22 leshort >0 - version %ld
! 14291: 0 leshort 0575 VAX COFF pure executable
! 14292: >12 lelong >0 not stripped
! 14293: >22 leshort >0 - version %ld
! 14294:
! 14295: #------------------------------------------------------------------------------
! 14296: # vicar: file(1) magic for VICAR files.
! 14297: #
! 14298: # From: Ossama Othman <othman@astrosun.tn.cornell.edu
! 14299: # VICAR is JPL's in-house spacecraft image processing program
! 14300: # VICAR image
! 14301: 0 string LBLSIZE= VICAR image data
! 14302: >32 string BYTE \b, 8 bits = VAX byte
! 14303: >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
! 14304: >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
! 14305: >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
! 14306: >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
! 14307: >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
! 14308: # VICAR label file
! 14309: 43 string SFDU_LABEL VICAR label file
! 14310: #------------------------------------------------------------------------------
! 14311: # Virtutech Compressed Random Access File Format
! 14312: #
! 14313: # From <gustav@virtutech.com>
! 14314: 0 string \211\277\036\203 Virtutech CRAFF
! 14315: >4 belong x v%d
! 14316: >20 belong 0 uncompressed
! 14317: >20 belong 1 bzipp2ed
! 14318: >20 belong 2 gzipped
! 14319: >24 belong 0 not clean
! 14320:
! 14321: #------------------------------------------------------------------------------
! 14322: # visx: file(1) magic for Visx format files
! 14323: #
! 14324: 0 short 0x5555 VISX image file
! 14325: >2 byte 0 (zero)
! 14326: >2 byte 1 (unsigned char)
! 14327: >2 byte 2 (short integer)
! 14328: >2 byte 3 (float 32)
! 14329: >2 byte 4 (float 64)
! 14330: >2 byte 5 (signed char)
! 14331: >2 byte 6 (bit-plane)
! 14332: >2 byte 7 (classes)
! 14333: >2 byte 8 (statistics)
! 14334: >2 byte 10 (ascii text)
! 14335: >2 byte 15 (image segments)
! 14336: >2 byte 100 (image set)
! 14337: >2 byte 101 (unsigned char vector)
! 14338: >2 byte 102 (short integer vector)
! 14339: >2 byte 103 (float 32 vector)
! 14340: >2 byte 104 (float 64 vector)
! 14341: >2 byte 105 (signed char vector)
! 14342: >2 byte 106 (bit plane vector)
! 14343: >2 byte 121 (feature vector)
! 14344: >2 byte 122 (feature vector library)
! 14345: >2 byte 124 (chain code)
! 14346: >2 byte 126 (bit vector)
! 14347: >2 byte 130 (graph)
! 14348: >2 byte 131 (adjacency graph)
! 14349: >2 byte 132 (adjacency graph library)
! 14350: >2 string .VISIX (ascii text)
! 14351:
! 14352: #------------------------------------------------------------------------------
! 14353: # vms: file(1) magic for VMS executables (experimental)
! 14354: #
! 14355: # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
! 14356:
! 14357: # GRR 950122: I'm just guessing on these, based on inspection of the headers
! 14358: # of three executables each for Alpha and VAX architectures. The VAX files
! 14359: # all had headers similar to this:
! 14360: #
! 14361: # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
! 14362: # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
! 14363: #
! 14364: 0 string \xb0\0\x30\0 VMS VAX executable
! 14365: >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
! 14366: #
! 14367: # The AXP files all looked like this, except that the byte at offset 0x22
! 14368: # was 06 in some of them and 07 in others:
! 14369: #
! 14370: # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
! 14371: # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
! 14372: # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
! 14373: # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
! 14374: # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
! 14375: #
! 14376: 0 belong 0x03000000 VMS Alpha executable
! 14377: >75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
! 14378:
! 14379: # -----------------------------------------------------------
! 14380: # VMware specific files (deducted from version 1.1 and log file entries)
! 14381: # Anthon van der Neut (anthon@mnt.org)
! 14382: 0 belong 0x4d52564e VMware nvram
! 14383:
! 14384: #------------------------------------------------------------------------------
! 14385: # vorbis: file(1) magic for Ogg/Vorbis files
! 14386: #
! 14387: # From Felix von Leitner <leitner@fefe.de>
! 14388: # Extended by Beni Cherniavsky <cben@crosswinds.net>
! 14389: # Further extended by Greg Wooledge <greg@wooledge.org>
! 14390: #
! 14391: # Most (everything but the number of channels and bitrate) is commented
! 14392: # out with `##' as it's not interesting to the average user. The most
! 14393: # probable things advanced users would want to uncomment are probably
! 14394: # the number of comments and the encoder version.
! 14395: #
! 14396: # FIXME: The first match has been made a search, so that it can skip
! 14397: # over prepended ID3 tags. This will work for MIME type detection, but
! 14398: # won't work for detecting other properties of the file (they all need
! 14399: # to be made relative to the search). In any case, if the file has ID3
! 14400: # tags, the ID3 information will be printed, not the Ogg information,
! 14401: # so until that's fixed, this doesn't matter.
! 14402: # FIXME[2]: Disable the above for now, since search assumes text mode.
! 14403: #
! 14404: # --- Ogg Framing ---
! 14405: #0 search/1000 OggS Ogg data
! 14406: 0 string OggS Ogg data
! 14407: !:mime application/ogg
! 14408: >4 byte !0 UNKNOWN REVISION %u
! 14409: ##>4 byte 0 revision 0
! 14410: >4 byte 0
! 14411: ##>>14 lelong x (Serial %lX)
! 14412: # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
! 14413: >>28 string \x7fFLAC \b, FLAC audio
! 14414: # non-Vorbis content: Theora
! 14415: >>28 string \x80theora \b, Theora video
! 14416: # non-Vorbis content: Kate
! 14417: >>28 string \x80kate\0\0\0\0 \b, Kate
! 14418: >>>37 ubyte x v%u
! 14419: >>>38 ubyte x \b.%u,
! 14420: >>>40 byte 0 utf8 encoding,
! 14421: >>>40 byte !0 unknown character encoding,
! 14422: >>>60 string >\0 language %s,
! 14423: >>>60 string \0 no language set,
! 14424: >>>76 string >\0 category %s
! 14425: >>>76 string \0 no category set
! 14426: # non-Vorbis content: Skeleton
! 14427: >>28 string fishead\0 \b, Skeleton
! 14428: >>>36 short x v%u
! 14429: >>>40 short x \b.%u
! 14430: # non-Vorbis content: Speex
! 14431: >>28 string Speex\ \ \ \b, Speex audio
! 14432: # non-Vorbis content: OGM
! 14433: >>28 string \x01video\0\0\0 \b, OGM video
! 14434: >>>37 string/c div3 (DivX 3)
! 14435: >>>37 string/c divx (DivX 4)
! 14436: >>>37 string/c dx50 (DivX 5)
! 14437: >>>37 string/c xvid (XviD)
! 14438: # --- First vorbis packet - general header ---
! 14439: >>28 string \x01vorbis \b, Vorbis audio,
! 14440: >>>35 lelong !0 UNKNOWN VERSION %lu,
! 14441: ##>>>35 lelong 0 version 0,
! 14442: >>>35 lelong 0
! 14443: >>>>39 ubyte 1 mono,
! 14444: >>>>39 ubyte 2 stereo,
! 14445: >>>>39 ubyte >2 %u channels,
! 14446: >>>>40 lelong x %lu Hz
! 14447: # Minimal, nominal and maximal bitrates specified when encoding
! 14448: >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
! 14449: # The above tests if at least one of these is specified:
! 14450: >>>>>52 lelong !-1
! 14451: # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
! 14452: # instead of -1.
! 14453: # Vorbis 1.0 uses 0 instead of -1.
! 14454: >>>>>>52 lelong !0
! 14455: >>>>>>>52 lelong !-1000
! 14456: >>>>>>>>52 lelong x <%lu
! 14457: >>>>>48 lelong !-1
! 14458: >>>>>>48 lelong x ~%lu
! 14459: >>>>>44 lelong !-1
! 14460: >>>>>>44 lelong !-1000
! 14461: >>>>>>>44 lelong !0
! 14462: >>>>>>>>44 lelong x >%lu
! 14463: >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
! 14464: # -- Second vorbis header packet - the comments
! 14465: # A kludge to read the vendor string. It's a counted string, not a
! 14466: # zero-terminated one, so file(1) can't read it in a generic way.
! 14467: # libVorbis is the only one existing currently, so I detect specifically
! 14468: # it. The interesting value is the cvs date (8 digits decimal).
! 14469: # Post-RC1 Ogg files have the second header packet (and thus the version)
! 14470: # in a different place, so we must use an indirect offset.
! 14471: >>>(84.b+85) string \x03vorbis
! 14472: >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
! 14473: >>>>>(84.b+120) string >00000000
! 14474: # Map to beta version numbers:
! 14475: >>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
! 14476: >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
! 14477: >>>>>>(84.b+120) string >20000508
! 14478: >>>>>>>(84.b+120) string <20001031 (beta2-3)
! 14479: >>>>>>(84.b+120) string 20001031 (1.0 beta 3)
! 14480: >>>>>>(84.b+120) string >20001031
! 14481: >>>>>>>(84.b+120) string <20010225 (beta3-4)
! 14482: >>>>>>(84.b+120) string 20010225 (1.0 beta 4)
! 14483: >>>>>>(84.b+120) string >20010225
! 14484: >>>>>>>(84.b+120) string <20010615 (beta4-RC1)
! 14485: >>>>>>(84.b+120) string 20010615 (1.0 RC1)
! 14486: >>>>>>(84.b+120) string 20010813 (1.0 RC2)
! 14487: >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
! 14488: >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
! 14489: >>>>>>(84.b+120) string 20011217 (1.0 RC3)
! 14490: >>>>>>(84.b+120) string 20011231 (1.0 RC3)
! 14491: # Some pre-1.0 CVS snapshots still had "Xiphphorus"...
! 14492: >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
! 14493: # For the 1.0 release, Xiphophorus is replaced by Xiph.Org
! 14494: >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
! 14495: >>>>>(84.b+117) string >00000000
! 14496: >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
! 14497: >>>>>>(84.b+117) string 20020717 (1.0)
! 14498: >>>>>>(84.b+117) string 20030909 (1.0.1)
! 14499: >>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
! 14500:
! 14501: #------------------------------------------------------------------------------
! 14502: # VXL: file(1) magic for VXL binary IO data files
! 14503: #
! 14504: # from Ian Scott <scottim@sf.net>
! 14505: #
! 14506: # VXL is a collection of C++ libraries for Computer Vision.
! 14507: # See the vsl chapter in the VXL Book for more info
! 14508: # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
! 14509: # http:/vxl.sf.net
! 14510:
! 14511: 2 lelong 0x472b2c4e VXL data file,
! 14512: >0 leshort >0 schema version no %d
! 14513:
! 14514: #------------------------------------------------------------------------------
! 14515: # warc: file(1) magic for WARC files
! 14516:
! 14517: 0 string WARC/ WARC Archive
! 14518: >5 string x version %.4s
! 14519: #------------------------------------------------------------------------------
! 14520: # weak: file(1) magic for very weak magic entries, disabled by default
! 14521: #
! 14522: # These entries are so weak that they might interfere identification of
! 14523: # other formats. Example include:
! 14524: # - Only identify for 1 or 2 bytes
! 14525: # - Match against very wide range of values
! 14526: # - Match against generic word in some spoken languages (e.g. English)
! 14527:
! 14528: # Summary: Computer Graphics Metafile
! 14529: # Extension: .cgm
! 14530: #0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
! 14531: #0 beshort 0x3020 character Computer Graphics Metafile
! 14532:
! 14533: #0 string =!! Bennet Yee's "face" format
! 14534:
! 14535: #------------------------------------------------------------------------------
! 14536: # windows: file(1) magic for Microsoft Windows
! 14537: #
! 14538: # This file is mainly reserved for files where programs
! 14539: # using them are run almost always on MS Windows 3.x or
! 14540: # above, or files only used exclusively in Windows OS,
! 14541: # where there is no better category to allocate for.
! 14542: # For example, even though WinZIP almost run on Windows
! 14543: # only, it is better to treat them as "archive" instead.
! 14544: # For format usable in DOS, such as generic executable
! 14545: # format, please specify under "msdos" file.
! 14546: #
! 14547:
! 14548:
! 14549: # Summary: Outlook Express DBX file
! 14550: # Extension: .dbx
! 14551: # Created by: Christophe Monniez
! 14552: 0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
! 14553: >4 byte =0xC5 \b, message database
! 14554: >4 byte =0xC6 \b, folder database
! 14555: >4 byte =0xC7 \b, account information
! 14556: >4 byte =0x30 \b, offline database
! 14557:
! 14558:
! 14559: # Summary: Windows crash dump
! 14560: # Extension: .dmp
! 14561: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
! 14562: # Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
! 14563: # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
! 14564: 0 string PAGE
! 14565: >4 string DUMP MS Windows 32bit crash dump
! 14566: >>0x05c byte 0 \b, no PAE
! 14567: >>0x05c byte 1 \b, PAE
! 14568: >>0xf88 lelong 1 \b, full dump
! 14569: >>0xf88 lelong 2 \b, kernel dump
! 14570: >>0xf88 lelong 3 \b, small dump
! 14571: >>0x068 lelong x \b, %ld pages
! 14572: >4 string DU64 MS Windows 64bit crash dump
! 14573: >>0xf98 lelong 1 \b, full dump
! 14574: >>0xf98 lelong 2 \b, kernel dump
! 14575: >>0xf98 lelong 3 \b, small dump
! 14576: >>0x090 lequad x \b, %lld pages
! 14577:
! 14578:
! 14579: # Summary: Vista Event Log
! 14580: # Extension: .evtx
! 14581: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
! 14582: # Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
! 14583: 0 string ElfFile\0 MS Windows Vista Event Log
! 14584: >0x2a leshort x \b, %d chunks
! 14585: >>0x10 lelong x \b (no. %d in use)
! 14586: >0x18 lelong >1 \b, next record no. %d
! 14587: >0x18 lelong =1 \b, empty
! 14588: >0x78 lelong &1 \b, DIRTY
! 14589: >0x78 lelong &2 \b, FULL
! 14590:
! 14591:
! 14592: # Summary: Windows 3.1 group files
! 14593: # Extension: .grp
! 14594: # Created by: unknown
! 14595: 0 string \120\115\103\103 MS Windows 3.1 group files
! 14596:
! 14597:
! 14598: # Summary: Old format help files
! 14599: # Extension: .hlp
! 14600: # Created by: Dirk Jagdmann <doj@cubic.org>
! 14601: 0 lelong 0x00035f3f MS Windows 3.x help file
! 14602:
! 14603:
! 14604: # Summary: Hyper terminal
! 14605: # Extension: .ht
! 14606: # Created by: unknown
! 14607: 0 string HyperTerminal\
! 14608: >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
! 14609:
! 14610:
! 14611: # Summary: Windows shortcut
! 14612: # Extension: .lnk
! 14613: # Created by: unknown
! 14614: 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
! 14615:
! 14616:
! 14617: # Summary: Outlook Personal Folders
! 14618: # Created by: unknown
! 14619: 0 lelong 0x4E444221 Microsoft Outlook email folder
! 14620: >10 leshort 0x0e (<=2002)
! 14621: >10 leshort 0x17 (>=2003)
! 14622:
! 14623:
! 14624: # Summary: Windows help cache
! 14625: # Created by: unknown
! 14626: 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
! 14627:
! 14628:
! 14629: # Summary: IE cache file
! 14630: # Created by: Christophe Monniez
! 14631: 0 string Client\ UrlCache\ MMF Internet Explorer cache file
! 14632: >20 string >\0 version %s
! 14633:
! 14634:
! 14635: # Summary: Registry files
! 14636: # Created by: unknown
! 14637: # Modified by (1): Joerg Jenderek
! 14638: 0 string regf MS Windows registry file, NT/2000 or above
! 14639: 0 string CREG MS Windows 95/98/ME registry file
! 14640: 0 string SHCC3 MS Windows 3.1 registry file
! 14641:
! 14642:
! 14643: # Summary: Windows Registry text
! 14644: # Extension: .reg
! 14645: # Submitted by: Abel Cheung <abelcheung@gmail.com>
! 14646: 0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
! 14647: 0 string Windows\ Registry\ Editor\
! 14648: >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
! 14649: #------------------------------------------------------------------------------
! 14650: # wordprocessors: file(1) magic fo word processors.
! 14651: #
! 14652: ####### PWP file format used on Smith Corona Personal Word Processors:
! 14653: 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
! 14654: >24 byte 2 \b, single spaced
! 14655: >24 byte 3 \b, 1.5 spaced
! 14656: >24 byte 4 \b, double spaced
! 14657: >25 byte 0x42 \b, letter
! 14658: >25 byte 0x54 \b, legal
! 14659: >26 byte 0x46 \b, A4
! 14660:
! 14661: #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
! 14662: 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
! 14663: >15 byte 0 Optimized for Intel
! 14664: >15 byte 1 Optimized for Non-Intel
! 14665: 1 string WPC (Corel/WP)
! 14666: >8 short 257 WordPerfect macro
! 14667: >8 short 258 WordPerfect help file
! 14668: >8 short 259 WordPerfect keyboard file
! 14669: >8 short 266 WordPerfect document
! 14670: >8 short 267 WordPerfect dictionary
! 14671: >8 short 268 WordPerfect thesaurus
! 14672: >8 short 269 WordPerfect block
! 14673: >8 short 270 WordPerfect rectangular block
! 14674: >8 short 271 WordPerfect column block
! 14675: >8 short 272 WordPerfect printer data
! 14676: >8 short 275 WordPerfect printer data
! 14677: >8 short 276 WordPerfect driver resource data
! 14678: >8 short 279 WordPerfect hyphenation code
! 14679: >8 short 280 WordPerfect hyphenation data
! 14680: >8 short 281 WordPerfect macro resource data
! 14681: >8 short 283 WordPerfect hyphenation lex
! 14682: >8 short 285 WordPerfect wordlist
! 14683: >8 short 286 WordPerfect equation resource data
! 14684: >8 short 289 WordPerfect spell rules
! 14685: >8 short 290 WordPerfect dictionary rules
! 14686: >8 short 295 WordPerfect spell rules (Microlytics)
! 14687: >8 short 299 WordPerfect settings file
! 14688: >8 short 301 WordPerfect 4.2 document
! 14689: >8 short 325 WordPerfect dialog file
! 14690: >8 short 332 WordPerfect button bar
! 14691: >8 short 513 Shell macro
! 14692: >8 short 522 Shell definition
! 14693: >8 short 769 Notebook macro
! 14694: >8 short 770 Notebook help file
! 14695: >8 short 771 Notebook keyboard file
! 14696: >8 short 778 Notebook definition
! 14697: >8 short 1026 Calculator help file
! 14698: >8 short 1538 Calendar help file
! 14699: >8 short 1546 Calendar data file
! 14700: >8 short 1793 Editor macro
! 14701: >8 short 1794 Editor help file
! 14702: >8 short 1795 Editor keyboard file
! 14703: >8 short 1817 Editor macro resource file
! 14704: >8 short 2049 Macro editor macro
! 14705: >8 short 2050 Macro editor help file
! 14706: >8 short 2051 Macro editor keyboard file
! 14707: >8 short 2305 PlanPerfect macro
! 14708: >8 short 2306 PlanPerfect help file
! 14709: >8 short 2307 PlanPerfect keyboard file
! 14710: >8 short 2314 PlanPerfect worksheet
! 14711: >8 short 2319 PlanPerfect printer definition
! 14712: >8 short 2322 PlanPerfect graphic definition
! 14713: >8 short 2323 PlanPerfect data
! 14714: >8 short 2324 PlanPerfect temporary printer
! 14715: >8 short 2329 PlanPerfect macro resource data
! 14716: >8 byte 11 Mail
! 14717: >8 short 2818 help file
! 14718: >8 short 2821 distribution list
! 14719: >8 short 2826 out box
! 14720: >8 short 2827 in box
! 14721: >8 short 2836 users archived mailbox
! 14722: >8 short 2837 archived message database
! 14723: >8 short 2838 archived attachments
! 14724: >8 short 3083 Printer temporary file
! 14725: >8 short 3330 Scheduler help file
! 14726: >8 short 3338 Scheduler in file
! 14727: >8 short 3339 Scheduler out file
! 14728: >8 short 3594 GroupWise settings file
! 14729: >8 short 3601 GroupWise directory services
! 14730: >8 short 3627 GroupWise settings file
! 14731: >8 short 4362 Terminal resource data
! 14732: >8 short 4363 Terminal resource data
! 14733: >8 short 4395 Terminal resource data
! 14734: >8 short 4619 GUI loadable text
! 14735: >8 short 4620 graphics resource data
! 14736: >8 short 4621 printer settings file
! 14737: >8 short 4622 port definition file
! 14738: >8 short 4623 print queue parameters
! 14739: >8 short 4624 compressed file
! 14740: >8 short 5130 Network service msg file
! 14741: >8 short 5131 Network service msg file
! 14742: >8 short 5132 Async gateway login msg
! 14743: >8 short 5134 GroupWise message file
! 14744: >8 short 7956 GroupWise admin domain database
! 14745: >8 short 7957 GroupWise admin host database
! 14746: >8 short 7959 GroupWise admin remote host database
! 14747: >8 short 7960 GroupWise admin ADS deferment data file
! 14748: >8 short 8458 IntelliTAG (SGML) compiled DTD
! 14749: >8 long 18219264 WordPerfect graphic image (1.0)
! 14750: >8 long 18219520 WordPerfect graphic image (2.0)
! 14751: #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
! 14752:
! 14753: # Hangul (Korean) Word Processor File
! 14754: 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
! 14755: # From: Won-Kyu Park <wkpark@kldp.org>
! 14756: 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
! 14757: !:mime application/x-hwp
! 14758:
! 14759: # CosmicBook, from Benoît Rouits
! 14760: 0 string CSBK Ted Neslson's CosmicBook hypertext file
! 14761:
! 14762: 2 string EYWR AmigaWriter file
! 14763:
! 14764: # chi: file(1) magic for ChiWriter files
! 14765: 0 string \\1cw\ ChiWriter file
! 14766: >5 string >\0 version %s
! 14767: 0 string \\1cw ChiWriter file
! 14768:
! 14769: # Quark Express from http://www.garykessler.net/library/file_sigs.html
! 14770: 2 string IIXPR3 Intel Quark Express Document (English)
! 14771: 2 string IIXPRa Intel Quark Express Document (Korean)
! 14772: 2 string MMXPR3 Motorola Quark Express Document (English)
! 14773: !:mime application/x-quark-xpress-3
! 14774: 2 string MMXPRa Motorola Quark Express Document (Korean)
! 14775:
! 14776: # adobe indesign (document, whatever...) from querkan
! 14777: 0 belong 0x0606edf5 Adobe InDesign
! 14778: >16 string DOCUMENT Document
! 14779:
! 14780: #------------------------------------------------------------------------------
! 14781: # ichitaro456: file(1) magic for Just System Word Processor Ichitaro
! 14782: #
! 14783: # Contributor kenzo-:
! 14784: # Reversed-engineered JS Ichitaro magic numbers
! 14785: #
! 14786:
! 14787: 0 string DOC
! 14788: >43 byte 0x14 Just System Word Processor Ichitaro v4
! 14789: !:mime application/x-ichitaro4
! 14790: >144 string JDASH application/x-ichitaro4
! 14791:
! 14792: 0 string DOC
! 14793: >43 byte 0x15 Just System Word Processor Ichitaro v5
! 14794: !:mime application/x-ichitaro5
! 14795:
! 14796: 0 string DOC
! 14797: >43 byte 0x16 Just System Word Processor Ichitaro v6
! 14798: !:mime application/x-ichitaro6
! 14799:
! 14800: # Type: Freemind mindmap documents
! 14801: # From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
! 14802: 0 string/cB \<map\ version Freemind document
! 14803: !:mime application/x-freemind
! 14804:
! 14805: # Type: Scribus
! 14806: # From: Werner Fink <werner@suse.de>
! 14807: 0 string \<SCRIBUSUTF8\ Version Scribus Document
! 14808: 0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
! 14809: !:mime application/x-scribus
! 14810:
! 14811: #------------------------------------------------------------------------------
! 14812: # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
! 14813: #
! 14814: 0 string %XDELTA% XDelta binary patch file 0.14
! 14815: 0 string %XDZ000% XDelta binary patch file 0.18
! 14816: 0 string %XDZ001% XDelta binary patch file 0.20
! 14817: 0 string %XDZ002% XDelta binary patch file 1.0
! 14818: 0 string %XDZ003% XDelta binary patch file 1.0.4
! 14819: 0 string %XDZ004% XDelta binary patch file 1.1
! 14820:
! 14821: #------------------------------------------------------------------------------
! 14822: # xenix: file(1) magic for Microsoft Xenix
! 14823: #
! 14824: # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
! 14825: # model" lifted from "magic.xenix", with comment "derived empirically;
! 14826: # treat as folklore until proven"
! 14827: #
! 14828: # "small model", "large model", "huge model" stuff lifted from XXX
! 14829: #
! 14830: # XXX - "x.out" collides with PDP-11 archives
! 14831: #
! 14832: 0 string core core file (Xenix)
! 14833: 0 byte 0x80 8086 relocatable (Microsoft)
! 14834: 0 leshort 0xff65 x.out
! 14835: >2 string __.SYMDEF randomized
! 14836: >0 byte x archive
! 14837: 0 leshort 0x206 Microsoft a.out
! 14838: >8 leshort 1 Middle model
! 14839: >0x1e leshort &0x10 overlay
! 14840: >0x1e leshort &0x2 separate
! 14841: >0x1e leshort &0x4 pure
! 14842: >0x1e leshort &0x800 segmented
! 14843: >0x1e leshort &0x400 standalone
! 14844: >0x1e leshort &0x8 fixed-stack
! 14845: >0x1c byte &0x80 byte-swapped
! 14846: >0x1c byte &0x40 word-swapped
! 14847: >0x10 lelong >0 not-stripped
! 14848: >0x1e leshort ^0xc000 pre-SysV
! 14849: >0x1e leshort &0x4000 V2.3
! 14850: >0x1e leshort &0x8000 V3.0
! 14851: >0x1c byte &0x4 86
! 14852: >0x1c byte &0xb 186
! 14853: >0x1c byte &0x9 286
! 14854: >0x1c byte &0xa 386
! 14855: >0x1f byte <0x040 small model
! 14856: >0x1f byte =0x048 large model
! 14857: >0x1f byte =0x049 huge model
! 14858: >0x1e leshort &0x1 executable
! 14859: >0x1e leshort ^0x1 object file
! 14860: >0x1e leshort &0x40 Large Text
! 14861: >0x1e leshort &0x20 Large Data
! 14862: >0x1e leshort &0x120 Huge Objects Enabled
! 14863: >0x10 lelong >0 not stripped
! 14864:
! 14865: 0 leshort 0x140 old Microsoft 8086 x.out
! 14866: >0x3 byte &0x4 separate
! 14867: >0x3 byte &0x2 pure
! 14868: >0 byte &0x1 executable
! 14869: >0 byte ^0x1 relocatable
! 14870: >0x14 lelong >0 not stripped
! 14871:
! 14872: 0 lelong 0x206 b.out
! 14873: >0x1e leshort &0x10 overlay
! 14874: >0x1e leshort &0x2 separate
! 14875: >0x1e leshort &0x4 pure
! 14876: >0x1e leshort &0x800 segmented
! 14877: >0x1e leshort &0x400 standalone
! 14878: >0x1e leshort &0x1 executable
! 14879: >0x1e leshort ^0x1 object file
! 14880: >0x1e leshort &0x4000 V2.3
! 14881: >0x1e leshort &0x8000 V3.0
! 14882: >0x1c byte &0x4 86
! 14883: >0x1c byte &0xb 186
! 14884: >0x1c byte &0x9 286
! 14885: >0x1c byte &0x29 286
! 14886: >0x1c byte &0xa 386
! 14887: >0x1e leshort &0x4 Large Text
! 14888: >0x1e leshort &0x2 Large Data
! 14889: >0x1e leshort &0x102 Huge Objects Enabled
! 14890:
! 14891: 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
! 14892:
! 14893: #------------------------------------------------------------------------------
! 14894: # This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
! 14895: # Xilinx-Magic@RevRagnarok.com
! 14896: # Got the info from FPGA-FAQ 0026
! 14897: #
! 14898: # First there is the sync header and its length
! 14899: 0 beshort 0x0009
! 14900: >2 belong =0x0ff00ff0
! 14901: >>&0 belong =0x0ff00ff0
! 14902: >>>&0 beshort =0x0000
! 14903: >>>>&0 pstring a Xilinx BIT data
! 14904: # Next is a Pascal-style string with the NCD name. We want to capture that.
! 14905: >>>>0x0F pstring x - from %s
! 14906: # It is followed by a NUL
! 14907: >>>>>&1 byte 0x00
! 14908: # And then 'b'
! 14909: >>>>>&2 string b
! 14910: # With the part number:
! 14911: #>>>>>&5 string 4v (Virtex4)
! 14912: #>>>>>&5 string 2v (Virtex II
! 14913: #>>>>>>&0 string !p \b)
! 14914: #>>>>>>&0 string p Pro)
! 14915: >>>>>&4 pstring x - for %s
! 14916: # And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
! 14917: >>>>>>&1 byte 0x00
! 14918: >>>>>>&2 string c
! 14919: >>>>>>&4 pstring x - built %s
! 14920: >>>>>>>&1 byte 0x00
! 14921: >>>>>>>&2 string d
! 14922: >>>>>>>&4 pstring x \b(%s)
! 14923: >>>>>>>>&1 byte 0x00
! 14924: >>>>>>>>&2 string e
! 14925: >>>>>>>>&4 belong x - data length 0x%lx
! 14926:
! 14927: #------------------------------------------------------------------------------
! 14928: # xo65 object files
! 14929: # From: "Ullrich von Bassewitz" <uz@cc65.org>
! 14930: #
! 14931: 0 string \x55\x7A\x6E\x61 xo65 object,
! 14932: >4 leshort x version %d,
! 14933: >6 leshort&0x0001 =0x0001 with debug info
! 14934: >6 leshort&0x0001 =0x0000 no debug info
! 14935:
! 14936: # xo65 library files
! 14937: 0 string \x6E\x61\x55\x7A xo65 library,
! 14938: >4 leshort x version %d
! 14939:
! 14940: # o65 object files
! 14941: 0 string \x01\x00\x6F\x36\x35 o65
! 14942: >6 leshort&0x1000 =0x0000 executable,
! 14943: >6 leshort&0x1000 =0x1000 object,
! 14944: >5 byte x version %d,
! 14945: >6 leshort&0x8000 =0x8000 65816,
! 14946: >6 leshort&0x8000 =0x0000 6502,
! 14947: >6 leshort&0x2000 =0x2000 32 bit,
! 14948: >6 leshort&0x2000 =0x0000 16 bit,
! 14949: >6 leshort&0x4000 =0x4000 page reloc,
! 14950: >6 leshort&0x4000 =0x0000 byte reloc,
! 14951: >6 leshort&0x0003 =0x0000 alignment 1
! 14952: >6 leshort&0x0003 =0x0001 alignment 2
! 14953: >6 leshort&0x0003 =0x0002 alignment 4
! 14954: >6 leshort&0x0003 =0x0003 alignment 256
! 14955:
! 14956: #------------------------------------------------------------------------------
! 14957: # xwindows: file(1) magic for various X/Window system file formats.
! 14958:
! 14959: # Compiled X Keymap
! 14960: # XKM (compiled X keymap) files (including version and byte ordering)
! 14961: 1 string mkx Compiled XKB Keymap: lsb,
! 14962: >0 byte >0 version %d
! 14963: >0 byte =0 obsolete
! 14964: 0 string xkm Compiled XKB Keymap: msb,
! 14965: >3 byte >0 version %d
! 14966: >0 byte =0 obsolete
! 14967:
! 14968: # xfsdump archive
! 14969: 0 string xFSdump0 xfsdump archive
! 14970: >8 belong x (version %d)
! 14971:
! 14972: # Jaleo XFS files
! 14973: 0 long 395726 Jaleo XFS file
! 14974: >4 long x - version %ld
! 14975: >8 long x - [%ld -
! 14976: >20 long x %ldx
! 14977: >24 long x %ldx
! 14978: >28 long 1008 YUV422]
! 14979: >28 long 1000 RGB24]
! 14980:
! 14981: #------------------------------------------------------------------------------
! 14982: # zilog: file(1) magic for Zilog Z8000.
! 14983: #
! 14984: # Was it big-endian or little-endian? My Product Specification doesn't
! 14985: # say.
! 14986: #
! 14987: 0 long 0xe807 object file (z8000 a.out)
! 14988: 0 long 0xe808 pure object file (z8000 a.out)
! 14989: 0 long 0xe809 separate object file (z8000 a.out)
! 14990: 0 long 0xe805 overlay object file (z8000 a.out)
! 14991:
! 14992: #------------------------------------------------------------------------------
! 14993: # zyxel: file(1) magic for ZyXEL modems
! 14994: #
! 14995: # From <rob@pe1chl.ampr.org>
! 14996: # These are the /etc/magic entries to decode datafiles as used for the
! 14997: # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
! 14998: # ZyXEL-defined standard)
! 14999:
! 15000: 0 string ZyXEL\002 ZyXEL voice data
! 15001: >10 byte 0 - CELP encoding
! 15002: >10 byte&0x0B 1 - ADPCM2 encoding
! 15003: >10 byte&0x0B 2 - ADPCM3 encoding
! 15004: >10 byte&0x0B 3 - ADPCM4 encoding
! 15005: >10 byte&0x0B 8 - New ADPCM3 encoding
! 15006: >10 byte&0x04 4 with resync
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to magic CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / ext / fileinfo / tests