Annotation of embedaddon/php/ext/fileinfo/tests/magic, revision 1.1.1.1
1.1 misho 1: # Magic data for file(1) command.
2: # Format is described in magic(5).
3: # Don't edit this file, edit /etc/magic or send your suggested inclusions to
4: # this file as a wishlist bug against file (using the reportbug utility).
5:
6:
7: #------------------------------------------------------------------------------
8: # Localstuff: file(1) magic for locally observed files
9: #
10: # $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
11: # Add any locally observed files here. Remember:
12: # text if readable, executable if runnable binary, data if unreadable.
13: #------------------------------------------------------------------------------
14: # acorn: file(1) magic for files found on Acorn systems
15: #
16:
17: # RISC OS Chunk File Format
18: # From RISC OS Programmer's Reference Manual, Appendix D
19: # We guess the file type from the type of the first chunk.
20: 0 lelong 0xc3cbc6c5 RISC OS Chunk data
21: >12 string OBJ_ \b, AOF object
22: >12 string LIB_ \b, ALF library
23:
24: # RISC OS AIF, contains "SWI OS_Exit" at offset 16.
25: 16 lelong 0xef000011 RISC OS AIF executable
26:
27: # RISC OS Draw files
28: # From RISC OS Programmer's Reference Manual, Appendix E
29: 0 string Draw RISC OS Draw file data
30:
31: # RISC OS new format font files
32: # From RISC OS Programmer's Reference Manual, Appendix E
33: 0 string FONT\0 RISC OS outline font data,
34: >5 byte x version %d
35: 0 string FONT\1 RISC OS 1bpp font data,
36: >5 byte x version %d
37: 0 string FONT\4 RISC OS 4bpp font data
38: >5 byte x version %d
39:
40: # RISC OS Music files
41: # From RISC OS Programmer's Reference Manual, Appendix E
42: 0 string Maestro\r RISC OS music file
43: >8 byte x version %d
44:
45: >8 byte x type %d
46:
47: # Digital Symphony data files
48: # From: Bernard Jungen (bern8817@euphonynet.be)
49: 0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
50: >8 byte x version %d,
51: >9 pstring x named "%s",
52: >(9.b+19) byte =0 8-bit logarithmic
53: >(9.b+19) byte =1 LZW-compressed linear
54: >(9.b+19) byte =2 8-bit linear signed
55: >(9.b+19) byte =3 16-bit linear signed
56: >(9.b+19) byte =4 SigmaDelta-compressed linear
57: >(9.b+19) byte =5 SigmaDelta-compressed logarithmic
58: >(9.b+19) byte >5 unknown format
59:
60: 0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
61: >8 byte x version %d,
62: >9 byte =1 1 voice,
63: >9 byte !1 %d voices,
64: >10 leshort =1 1 track,
65: >10 leshort !1 %d tracks,
66: >12 leshort =1 1 pattern
67: >12 leshort !1 %d patterns
68:
69: 0 string \x02\x01\x13\x13\x10\x14\x12\x0e
70: >9 byte =0 Digital Symphony sequence (RISC OS),
71: >>8 byte x version %d,
72: >>10 byte =1 1 line,
73: >>10 byte !1 %d lines,
74: >>11 leshort =1 1 position
75: >>11 leshort !1 %d positions
76: >9 byte =1 Digital Symphony pattern data (RISC OS),
77: >>8 byte x version %d,
78: >>10 leshort =1 1 pattern
79: >>10 leshort !1 %d patterns
80:
81: #------------------------------------------------------------------------------
82: # adi: file(1) magic for ADi's objects
83: # From Gregory McGarry <g.mcgarry@ieee.org>
84: #
85: 0 leshort 0x521c COFF DSP21k
86: >18 lelong &02 executable,
87: >18 lelong ^02
88: >>18 lelong &01 static object,
89: >>18 lelong ^01 relocatable object,
90: >18 lelong &010 stripped
91: >18 lelong ^010 not stripped
92:
93: #------------------------------------------------------------------------------
94: # adventure: file(1) magic for Adventure game files
95: #
96: # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
97: # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
98: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
99: #
100: # ALAN
101: # I assume there are other, lower versions, but these are the only ones I
102: # saw in the archive.
103: 0 beshort 0x0206 ALAN game data
104: >2 byte <10 version 2.6%d
105:
106:
107: # Infocom (see z-machine)
108: #------------------------------------------------------------------------------
109: # Z-machine: file(1) magic for Z-machine binaries.
110: #
111: # This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
112: # appears to be a version-0 Z-machine binary.
113: #
114: # The (false match) message is to correct that behavior. Perhaps it is
115: # not needed.
116: #
117: 16 belong&0xfe00f0f0 0x3030 Infocom game data
118: >0 ubyte 0 (false match)
119: >0 ubyte >0 (Z-machine %d,
120: >>2 ubeshort x Release %d /
121: >>18 string >\0 Serial %.6s)
122:
123: #------------------------------------------------------------------------------
124: # Glulx: file(1) magic for Glulx binaries.
125: #
126: # I haven't checked for false matches yet.
127: #
128: 0 string Glul Glulx game data
129: >4 beshort x (Version %d
130: >>6 byte x \b.%d
131: >>8 byte x \b.%d)
132: >36 string Info Compiled by Inform
133:
134:
135:
136: # For Quetzal and blorb magic see iff
137:
138:
139: # TADS (Text Adventure Development System)
140: # All files are machine-independent (games compile to byte-code) and are tagged
141: # with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
142: # on the way).
143: # Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
144: 0 string TADS2\ bin TADS
145: >9 belong !0x0A0D1A00 game data, CORRUPTED
146: >9 belong 0x0A0D1A00
147: >>13 string >\0 %s game data
148: # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
149: 0 string TADS2\ rsc TADS
150: >9 belong !0x0A0D1A00 resource data, CORRUPTED
151: >9 belong 0x0A0D1A00
152: >>13 string >\0 %s resource data
153: # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
154: # 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
155: # "TADS2 save\n\r\032\0" and the interpreter version.
156: 0 string TADS2\ save/g TADS
157: >12 belong !0x0A0D1A00 saved game data, CORRUPTED
158: >12 belong 0x0A0D1A00
159: >>(16.s+32) string >\0 %s saved game data
160: # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
161: # version.
162: 0 string TADS2\ save TADS
163: >10 belong !0x0A0D1A00 saved game data, CORRUPTED
164: >10 belong 0x0A0D1A00
165: >>14 string >\0 %s saved game data
166:
167: # Danny Milosavljevic <danny.milo@gmx.net>
168: # this are adrift (adventure game standard) game files, extension .taf
169: # depending on version magic continues with 0x93453E6139FA (V 4.0)
170: # 0x9445376139FA (V 3.90)
171: # 0x9445366139FA (V 3.80)
172: # this is from source (http://www.adrift.org.uk/) and I have some taf
173: # files, and checked them.
174: #0 belong 0x3C423FC9
175: #>4 belong 0x6A87C2CF Adrift game file
176: #!:mime application/x-adrift
177: #------------------------------------------------------------------------------
178: # allegro: file(1) magic for Allegro datafiles
179: # Toby Deshane <hac@shoelace.digivill.net>
180: #
181: 0 belong 0x736C6821 Allegro datafile (packed)
182: 0 belong 0x736C682E Allegro datafile (not packed/autodetect)
183: 0 belong 0x736C682B Allegro datafile (appended exe data)
184:
185: #------------------------------------------------------------------------------
186: # alliant: file(1) magic for Alliant FX series a.out files
187: #
188: # If the FX series is the one that had a processor with a 68K-derived
189: # instruction set, the "short" should probably become "beshort" and the
190: # "long" should probably become "belong".
191: # If it's the i860-based one, they should probably become either the
192: # big-endian or little-endian versions, depending on the mode they ran
193: # the 860 in....
194: #
195: 0 short 0420 0420 Alliant virtual executable
196: >2 short &0x0020 common library
197: >16 long >0 not stripped
198: 0 short 0421 0421 Alliant compact executable
199: >2 short &0x0020 common library
200: >16 long >0 not stripped
201: #------------------------------------------------------------------------------
202: # alpha architecture description
203: #
204:
205: 0 leshort 0603 COFF format alpha
206: >22 leshort&030000 !020000 executable
207: >24 leshort 0410 pure
208: >24 leshort 0413 paged
209: >22 leshort&020000 !0 dynamically linked
210: >16 lelong !0 not stripped
211: >16 lelong 0 stripped
212: >22 leshort&030000 020000 shared library
213: >24 leshort 0407 object
214: >27 byte x - version %d
215: >26 byte x .%d
216: >28 byte x -%d
217:
218: # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
219: #
220: # The actual magic number is just "Core", followed by a 2-byte version
221: # number; however, treating any file that begins with "Core" as a Digital
222: # UNIX core dump file may produce too many false hits, so we include one
223: # byte of the version number as well; DU 5.0 appears only to be up to
224: # version 2.
225: #
226: 0 string Core\001 Alpha COFF format core dump (Digital UNIX)
227: >24 string >\0 \b, from '%s'
228: 0 string Core\002 Alpha COFF format core dump (Digital UNIX)
229: >24 string >\0 \b, from '%s'
230:
231: #------------------------------------------------------------------------------
232: # amanda: file(1) magic for amanda file format
233: #
234: 0 string AMANDA:\ AMANDA
235: >8 string TAPESTART\ DATE tape header file,
236: >>23 string X
237: >>>25 string >\ Unused %s
238: >>23 string >\ DATE %s
239: >8 string FILE\ dump file,
240: >>13 string >\ DATE %s
241: #------------------------------------------------------------------------------
242: # amigaos: file(1) magic for AmigaOS binary formats:
243:
244: #
245: # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
246: #
247: 0 belong 0x000003fa AmigaOS shared library
248: 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
249: 0 belong 0x000003e7 AmigaOS object/library data
250: #
251: 0 beshort 0xe310 Amiga Workbench
252: >2 beshort 1
253: >>48 byte 1 disk icon
254: >>48 byte 2 drawer icon
255: >>48 byte 3 tool icon
256: >>48 byte 4 project icon
257: >>48 byte 5 garbage icon
258: >>48 byte 6 device icon
259: >>48 byte 7 kickstart icon
260: >>48 byte 8 workbench application icon
261: >2 beshort >1 icon, vers. %d
262: #
263: # various sound formats from the Amiga
264: # G=F6tz Waschk <waschk@informatik.uni-rostock.de>
265: #
266: 0 string FC14 Future Composer 1.4 Module sound file
267: 0 string SMOD Future Composer 1.3 Module sound file
268: 0 string AON4artofnoise Art Of Noise Module sound file
269: 1 string MUGICIAN/SOFTEYES Mugician Module sound file
270: 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
271: 0 string Synth4.0 Synthesis Module sound file
272: 0 string ARP. The Holy Noise Module sound file
273: 0 string BeEp\0 JamCracker Module sound file
274: 0 string COSO\0 Hippel-COSO Module sound file
275: # Too simple (short, pure ASCII, deep), MPi
276: #26 string V.3 Brian Postma's Soundmon Module sound file v3
277: #26 string BPSM Brian Postma's Soundmon Module sound file v3
278: #26 string V.2 Brian Postma's Soundmon Module sound file v2
279:
280: # The following are from: "Stefan A. Haubenthal" <polluks@web.de>
281: 0 beshort 0x0f00 AmigaOS bitmap font
282: 0 beshort 0x0f03 AmigaOS outline font
283: 0 belong 0x80001001 AmigaOS outline tag
284: 0 string ##\ version catalog translation
285: 0 string EMOD\0 Amiga E module
286: 8 string ECXM\0 ECX module
287: 0 string/c @database AmigaGuide file
288:
289: # Amiga disk types
290: #
291: 0 string RDSK Rigid Disk Block
292: >160 string x on %.24s
293: 0 string DOS\0 Amiga DOS disk
294: 0 string DOS\1 Amiga FFS disk
295: 0 string DOS\2 Amiga Inter DOS disk
296: 0 string DOS\3 Amiga Inter FFS disk
297: 0 string DOS\4 Amiga Fastdir DOS disk
298: 0 string DOS\5 Amiga Fastdir FFS disk
299: 0 string KICK Kickstart disk
300:
301: # From: Alex Beregszaszi <alex@fsn.hu>
302: 0 string LZX LZX compressed archive (Amiga)
303:
304:
305: #------------------------------------------------------------------------------
306: # animation: file(1) magic for animation/movie formats
307: #
308: # animation formats
309: # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
310: # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
311:
312: # SGI and Apple formats
313: 0 string MOVI Silicon Graphics movie file
314: !:mime video/x-sgi-movie
315: 4 string moov Apple QuickTime
316: !:mime video/quicktime
317: >12 string mvhd \b movie (fast start)
318: >12 string mdra \b URL
319: >12 string cmov \b movie (fast start, compressed header)
320: >12 string rmra \b multiple URLs
321: 4 string mdat Apple QuickTime movie (unoptimized)
322: !:mime video/quicktime
323: #4 string wide Apple QuickTime movie (unoptimized)
324: #!:mime video/quicktime
325: #4 string skip Apple QuickTime movie (modified)
326: #!:mime video/quicktime
327: #4 string free Apple QuickTime movie (modified)
328: #!:mime video/quicktime
329: 4 string idsc Apple QuickTime image (fast start)
330: !:mime image/x-quicktime
331: #4 string idat Apple QuickTime image (unoptimized)
332: #!:mime image/x-quicktime
333: 4 string pckg Apple QuickTime compressed archive
334: !:mime application/x-quicktime-player
335: 4 string/B jP JPEG 2000 image
336: !:mime image/jp2
337: 4 string ftyp ISO Media
338: >8 string isom \b, MPEG v4 system, version 1
339: !:mime video/mp4
340: >8 string iso2 \b, MPEG v4 system, part 12 revision
341: >8 string mp41 \b, MPEG v4 system, version 1
342: !:mime video/mp4
343: >8 string mp42 \b, MPEG v4 system, version 2
344: !:mime video/mp4
345: >8 string mp7t \b, MPEG v4 system, MPEG v7 XML
346: >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
347: >8 string/B jp2 \b, JPEG 2000
348: !:mime image/jp2
349: >8 string 3gp \b, MPEG v4 system, 3GPP
350: !:mime video/3gpp
351: >>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
352: >>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
353: >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
354: >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
355: !:mime video/mp4
356: >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
357: !:mime video/3gpp
358: >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
359: !:mime audio/mp4
360: >8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC
361: !:mime video/mp4
362: >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
363: >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
364: >8 string/B qt \b, Apple QuickTime movie
365: !:mime video/quicktime
366:
367: # MPEG sequences
368: # Scans for all common MPEG header start codes
369: 0 belong 0x00000001
370: >4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
371: >>5 byte 66 \b, baseline
372: >>5 byte 77 \b, main
373: >>5 byte 88 \b, extended
374: >>7 byte x \b @ L %u
375: 0 belong&0xFFFFFF00 0x00000100
376: >3 byte 0xBA MPEG sequence
377: >>4 byte &0x40 \b, v2, program multiplex
378: >>4 byte ^0x40 \b, v1, system multiplex
379: >3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
380: >3 byte&0x1F 0x07 MPEG sequence, H.264 video
381: >>4 byte 66 \b, baseline
382: >>4 byte 77 \b, main
383: >>4 byte 88 \b, extended
384: >>6 byte x \b @ L %u
385: >3 byte 0xB0 MPEG sequence, v4
386: >>5 belong 0x000001B5
387: >>>9 byte &0x80
388: >>>>10 byte&0xF0 16 \b, video
389: >>>>10 byte&0xF0 32 \b, still texture
390: >>>>10 byte&0xF0 48 \b, mesh
391: >>>>10 byte&0xF0 64 \b, face
392: >>>9 byte&0xF8 8 \b, video
393: >>>9 byte&0xF8 16 \b, still texture
394: >>>9 byte&0xF8 24 \b, mesh
395: >>>9 byte&0xF8 32 \b, face
396: >>4 byte 1 \b, simple @ L1
397: >>4 byte 2 \b, simple @ L2
398: >>4 byte 3 \b, simple @ L3
399: >>4 byte 4 \b, simple @ L0
400: >>4 byte 17 \b, simple scalable @ L1
401: >>4 byte 18 \b, simple scalable @ L2
402: >>4 byte 33 \b, core @ L1
403: >>4 byte 34 \b, core @ L2
404: >>4 byte 50 \b, main @ L2
405: >>4 byte 51 \b, main @ L3
406: >>4 byte 53 \b, main @ L4
407: >>4 byte 66 \b, n-bit @ L2
408: >>4 byte 81 \b, scalable texture @ L1
409: >>4 byte 97 \b, simple face animation @ L1
410: >>4 byte 98 \b, simple face animation @ L2
411: >>4 byte 99 \b, simple face basic animation @ L1
412: >>4 byte 100 \b, simple face basic animation @ L2
413: >>4 byte 113 \b, basic animation text @ L1
414: >>4 byte 114 \b, basic animation text @ L2
415: >>4 byte 129 \b, hybrid @ L1
416: >>4 byte 130 \b, hybrid @ L2
417: >>4 byte 145 \b, advanced RT simple @ L!
418: >>4 byte 146 \b, advanced RT simple @ L2
419: >>4 byte 147 \b, advanced RT simple @ L3
420: >>4 byte 148 \b, advanced RT simple @ L4
421: >>4 byte 161 \b, core scalable @ L1
422: >>4 byte 162 \b, core scalable @ L2
423: >>4 byte 163 \b, core scalable @ L3
424: >>4 byte 177 \b, advanced coding efficiency @ L1
425: >>4 byte 178 \b, advanced coding efficiency @ L2
426: >>4 byte 179 \b, advanced coding efficiency @ L3
427: >>4 byte 180 \b, advanced coding efficiency @ L4
428: >>4 byte 193 \b, advanced core @ L1
429: >>4 byte 194 \b, advanced core @ L2
430: >>4 byte 209 \b, advanced scalable texture @ L1
431: >>4 byte 210 \b, advanced scalable texture @ L2
432: >>4 byte 211 \b, advanced scalable texture @ L3
433: >>4 byte 225 \b, simple studio @ L1
434: >>4 byte 226 \b, simple studio @ L2
435: >>4 byte 227 \b, simple studio @ L3
436: >>4 byte 228 \b, simple studio @ L4
437: >>4 byte 229 \b, core studio @ L1
438: >>4 byte 230 \b, core studio @ L2
439: >>4 byte 231 \b, core studio @ L3
440: >>4 byte 232 \b, core studio @ L4
441: >>4 byte 240 \b, advanced simple @ L0
442: >>4 byte 241 \b, advanced simple @ L1
443: >>4 byte 242 \b, advanced simple @ L2
444: >>4 byte 243 \b, advanced simple @ L3
445: >>4 byte 244 \b, advanced simple @ L4
446: >>4 byte 245 \b, advanced simple @ L5
447: >>4 byte 247 \b, advanced simple @ L3b
448: >>4 byte 248 \b, FGS @ L0
449: >>4 byte 249 \b, FGS @ L1
450: >>4 byte 250 \b, FGS @ L2
451: >>4 byte 251 \b, FGS @ L3
452: >>4 byte 252 \b, FGS @ L4
453: >>4 byte 253 \b, FGS @ L5
454: >3 byte 0xB5 MPEG sequence, v4
455: >>4 byte &0x80
456: >>>5 byte&0xF0 16 \b, video (missing profile header)
457: >>>5 byte&0xF0 32 \b, still texture (missing profile header)
458: >>>5 byte&0xF0 48 \b, mesh (missing profile header)
459: >>>5 byte&0xF0 64 \b, face (missing profile header)
460: >>4 byte&0xF8 8 \b, video (missing profile header)
461: >>4 byte&0xF8 16 \b, still texture (missing profile header)
462: >>4 byte&0xF8 24 \b, mesh (missing profile header)
463: >>4 byte&0xF8 32 \b, face (missing profile header)
464: >3 byte 0xB3 MPEG sequence
465: >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
466: >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
467: >>12 belong 0x000001B5 \b, v2,
468: >>>16 byte&0x0F 1 \b HP
469: >>>16 byte&0x0F 2 \b Spt
470: >>>16 byte&0x0F 3 \b SNR
471: >>>16 byte&0x0F 4 \b MP
472: >>>16 byte&0x0F 5 \b SP
473: >>>17 byte&0xF0 64 \b@HL
474: >>>17 byte&0xF0 96 \b@H-14
475: >>>17 byte&0xF0 128 \b@ML
476: >>>17 byte&0xF0 160 \b@LL
477: >>>17 byte &0x08 \b progressive
478: >>>17 byte ^0x08 \b interlaced
479: >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
480: >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
481: >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
482: >>11 byte &0x02
483: >>>75 byte &0x01
484: >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
485: >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
486: >>>>140 belong 0x000001B5 \b, v2,
487: >>>>>144 byte&0x0F 1 \b HP
488: >>>>>144 byte&0x0F 2 \b Spt
489: >>>>>144 byte&0x0F 3 \b SNR
490: >>>>>144 byte&0x0F 4 \b MP
491: >>>>>144 byte&0x0F 5 \b SP
492: >>>>>145 byte&0xF0 64 \b@HL
493: >>>>>145 byte&0xF0 96 \b@H-14
494: >>>>>145 byte&0xF0 128 \b@ML
495: >>>>>145 byte&0xF0 160 \b@LL
496: >>>>>145 byte &0x08 \b progressive
497: >>>>>145 byte ^0x08 \b interlaced
498: >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
499: >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
500: >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
501: >>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
502: >>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
503: >>76 belong 0x000001B5 \b, v2,
504: >>>80 byte&0x0F 1 \b HP
505: >>>80 byte&0x0F 2 \b Spt
506: >>>80 byte&0x0F 3 \b SNR
507: >>>80 byte&0x0F 4 \b MP
508: >>>80 byte&0x0F 5 \b SP
509: >>>81 byte&0xF0 64 \b@HL
510: >>>81 byte&0xF0 96 \b@H-14
511: >>>81 byte&0xF0 128 \b@ML
512: >>>81 byte&0xF0 160 \b@LL
513: >>>81 byte &0x08 \b progressive
514: >>>81 byte ^0x08 \b interlaced
515: >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
516: >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
517: >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
518: >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
519: >>>7 byte&0xF0 0x10 \b, 16:9
520: >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
521: >>>7 byte&0xF0 0x10 \b, 16:9
522: >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
523: >>>7 byte&0xF0 0x10 \b, 4:3
524: >>4 beshort&0xFFF0 0x2C00 \b, 4CIF
525: >>>5 beshort&0x0FFF 0x01E0 \b NTSC
526: >>>5 beshort&0x0FFF 0x0240 \b PAL
527: >>>7 byte&0xF0 0x20 \b, 4:3
528: >>>7 byte&0xF0 0x30 \b, 16:9
529: >>>7 byte&0xF0 0x40 \b, 11:5
530: >>>7 byte&0xF0 0x80 \b, PAL 4:3
531: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
532: >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
533: >>>7 byte&0xF0 0x10 \b, 4:3
534: >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
535: >>>7 byte&0xF0 0x10 \b, 4:3
536: >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
537: >>>7 byte&0xF0 0x10 \b, 4:3
538: >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
539: >>>7 byte&0xF0 0x10 \b, 4:3
540: >>4 beshort&0xFFF0 0x1600 \b, CIF
541: >>>5 beshort&0x0FFF 0x00F0 \b NTSC
542: >>>5 beshort&0x0FFF 0x0120 \b PAL
543: >>>7 byte&0xF0 0x20 \b, 4:3
544: >>>7 byte&0xF0 0x30 \b, 16:9
545: >>>7 byte&0xF0 0x40 \b, 11:5
546: >>>7 byte&0xF0 0x80 \b, PAL 4:3
547: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
548: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
549: >>>>7 byte&0xF0 0x20 \b, 4:3
550: >>>>7 byte&0xF0 0x30 \b, 16:9
551: >>>>7 byte&0xF0 0x40 \b, 11:5
552: >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
553: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
554: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
555: >>>7 byte&0xF0 0x20 \b, 4:3
556: >>>7 byte&0xF0 0x30 \b, 16:9
557: >>>7 byte&0xF0 0x40 \b, 11:5
558: >>4 beshort&0xFFF0 0x1E00 \b, SVCD
559: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
560: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
561: >>>7 byte&0xF0 0x20 \b, 4:3
562: >>>7 byte&0xF0 0x30 \b, 16:9
563: >>>7 byte&0xF0 0x40 \b, 11:5
564: >>7 byte&0x0F 1 \b, 23.976 fps
565: >>7 byte&0x0F 2 \b, 24 fps
566: >>7 byte&0x0F 3 \b, 25 fps
567: >>7 byte&0x0F 4 \b, 29.97 fps
568: >>7 byte&0x0F 5 \b, 30 fps
569: >>7 byte&0x0F 6 \b, 50 fps
570: >>7 byte&0x0F 7 \b, 59.94 fps
571: >>7 byte&0x0F 8 \b, 60 fps
572: >>11 byte &0x04 \b, Constrained
573:
574: # MPEG ADTS Audio (*.mpx/mxa/aac)
575: # from dreesen@math.fu-berlin.de
576: # modified to fully support MPEG ADTS
577:
578: # MP3, M1A
579: # modified by Joerg Jenderek
580: # GRR the original test are too common for many DOS files
581: # so don't accept as MP3 until we've tested the rate
582: 0 beshort&0xFFFE 0xFFFA
583: # rates
584: >2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
585: !:mime audio/mpeg
586: >2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
587: !:mime audio/mpeg
588: >2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
589: !:mime audio/mpeg
590: >2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
591: !:mime audio/mpeg
592: >2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
593: !:mime audio/mpeg
594: >2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
595: !:mime audio/mpeg
596: >2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
597: !:mime audio/mpeg
598: >2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
599: !:mime audio/mpeg
600: >2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
601: !:mime audio/mpeg
602: >2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
603: !:mime audio/mpeg
604: >2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
605: !:mime audio/mpeg
606: >2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
607: !:mime audio/mpeg
608: >2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
609: !:mime audio/mpeg
610: >2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
611: !:mime audio/mpeg
612: # timing
613: >2 byte&0x0C 0x00 \b, 44.1 kHz
614: >2 byte&0x0C 0x04 \b, 48 kHz
615: >2 byte&0x0C 0x08 \b, 32 kHz
616: # channels/options
617: >3 byte&0xC0 0x00 \b, Stereo
618: >3 byte&0xC0 0x40 \b, JntStereo
619: >3 byte&0xC0 0x80 \b, 2x Monaural
620: >3 byte&0xC0 0xC0 \b, Monaural
621: #>1 byte ^0x01 \b, Data Verify
622: #>2 byte &0x02 \b, Packet Pad
623: #>2 byte &0x01 \b, Custom Flag
624: #>3 byte &0x08 \b, Copyrighted
625: #>3 byte &0x04 \b, Original Source
626: #>3 byte&0x03 1 \b, NR: 50/15 ms
627: #>3 byte&0x03 3 \b, NR: CCIT J.17
628:
629: # MP2, M1A
630: 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
631: # rates
632: >2 byte&0xF0 0x10 \b, 32 kbps
633: >2 byte&0xF0 0x20 \b, 48 kbps
634: >2 byte&0xF0 0x30 \b, 56 kbps
635: >2 byte&0xF0 0x40 \b, 64 kbps
636: >2 byte&0xF0 0x50 \b, 80 kbps
637: >2 byte&0xF0 0x60 \b, 96 kbps
638: >2 byte&0xF0 0x70 \b, 112 kbps
639: >2 byte&0xF0 0x80 \b, 128 kbps
640: >2 byte&0xF0 0x90 \b, 160 kbps
641: >2 byte&0xF0 0xA0 \b, 192 kbps
642: >2 byte&0xF0 0xB0 \b, 224 kbps
643: >2 byte&0xF0 0xC0 \b, 256 kbps
644: >2 byte&0xF0 0xD0 \b, 320 kbps
645: >2 byte&0xF0 0xE0 \b, 384 kbps
646: # timing
647: >2 byte&0x0C 0x00 \b, 44.1 kHz
648: >2 byte&0x0C 0x04 \b, 48 kHz
649: >2 byte&0x0C 0x08 \b, 32 kHz
650: # channels/options
651: >3 byte&0xC0 0x00 \b, Stereo
652: >3 byte&0xC0 0x40 \b, JntStereo
653: >3 byte&0xC0 0x80 \b, 2x Monaural
654: >3 byte&0xC0 0xC0 \b, Monaural
655: #>1 byte ^0x01 \b, Data Verify
656: #>2 byte &0x02 \b, Packet Pad
657: #>2 byte &0x01 \b, Custom Flag
658: #>3 byte &0x08 \b, Copyrighted
659: #>3 byte &0x04 \b, Original Source
660: #>3 byte&0x03 1 \b, NR: 50/15 ms
661: #>3 byte&0x03 3 \b, NR: CCIT J.17
662:
663: # MPA, M1A
664: # updated by Joerg Jenderek
665: # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
666: # GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
667: # FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
668: #0 beshort&0xFFFE 0xFFFE
669: #>2 ubyte&0xF0 >0x0F
670: #>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
671: ## rate
672: #>>>2 byte&0xF0 0x10 \b, 32 kbps
673: #>>>2 byte&0xF0 0x20 \b, 64 kbps
674: #>>>2 byte&0xF0 0x30 \b, 96 kbps
675: #>>>2 byte&0xF0 0x40 \b, 128 kbps
676: #>>>2 byte&0xF0 0x50 \b, 160 kbps
677: #>>>2 byte&0xF0 0x60 \b, 192 kbps
678: #>>>2 byte&0xF0 0x70 \b, 224 kbps
679: #>>>2 byte&0xF0 0x80 \b, 256 kbps
680: #>>>2 byte&0xF0 0x90 \b, 288 kbps
681: #>>>2 byte&0xF0 0xA0 \b, 320 kbps
682: #>>>2 byte&0xF0 0xB0 \b, 352 kbps
683: #>>>2 byte&0xF0 0xC0 \b, 384 kbps
684: #>>>2 byte&0xF0 0xD0 \b, 416 kbps
685: #>>>2 byte&0xF0 0xE0 \b, 448 kbps
686: ## timing
687: #>>>2 byte&0x0C 0x00 \b, 44.1 kHz
688: #>>>2 byte&0x0C 0x04 \b, 48 kHz
689: #>>>2 byte&0x0C 0x08 \b, 32 kHz
690: ## channels/options
691: #>>>3 byte&0xC0 0x00 \b, Stereo
692: #>>>3 byte&0xC0 0x40 \b, JntStereo
693: #>>>3 byte&0xC0 0x80 \b, 2x Monaural
694: #>>>3 byte&0xC0 0xC0 \b, Monaural
695: ##>1 byte ^0x01 \b, Data Verify
696: ##>2 byte &0x02 \b, Packet Pad
697: ##>2 byte &0x01 \b, Custom Flag
698: ##>3 byte &0x08 \b, Copyrighted
699: ##>3 byte &0x04 \b, Original Source
700: ##>3 byte&0x03 1 \b, NR: 50/15 ms
701: ##>3 byte&0x03 3 \b, NR: CCIT J.17
702:
703: # MP3, M2A
704: 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
705: # rate
706: >2 byte&0xF0 0x10 \b, 8 kbps
707: >2 byte&0xF0 0x20 \b, 16 kbps
708: >2 byte&0xF0 0x30 \b, 24 kbps
709: >2 byte&0xF0 0x40 \b, 32 kbps
710: >2 byte&0xF0 0x50 \b, 40 kbps
711: >2 byte&0xF0 0x60 \b, 48 kbps
712: >2 byte&0xF0 0x70 \b, 56 kbps
713: >2 byte&0xF0 0x80 \b, 64 kbps
714: >2 byte&0xF0 0x90 \b, 80 kbps
715: >2 byte&0xF0 0xA0 \b, 96 kbps
716: >2 byte&0xF0 0xB0 \b, 112 kbps
717: >2 byte&0xF0 0xC0 \b, 128 kbps
718: >2 byte&0xF0 0xD0 \b, 144 kbps
719: >2 byte&0xF0 0xE0 \b, 160 kbps
720: # timing
721: >2 byte&0x0C 0x00 \b, 22.05 kHz
722: >2 byte&0x0C 0x04 \b, 24 kHz
723: >2 byte&0x0C 0x08 \b, 16 kHz
724: # channels/options
725: >3 byte&0xC0 0x00 \b, Stereo
726: >3 byte&0xC0 0x40 \b, JntStereo
727: >3 byte&0xC0 0x80 \b, 2x Monaural
728: >3 byte&0xC0 0xC0 \b, Monaural
729: #>1 byte ^0x01 \b, Data Verify
730: #>2 byte &0x02 \b, Packet Pad
731: #>2 byte &0x01 \b, Custom Flag
732: #>3 byte &0x08 \b, Copyrighted
733: #>3 byte &0x04 \b, Original Source
734: #>3 byte&0x03 1 \b, NR: 50/15 ms
735: #>3 byte&0x03 3 \b, NR: CCIT J.17
736:
737: # MP2, M2A
738: 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
739: # rate
740: >2 byte&0xF0 0x10 \b, 8 kbps
741: >2 byte&0xF0 0x20 \b, 16 kbps
742: >2 byte&0xF0 0x30 \b, 24 kbps
743: >2 byte&0xF0 0x40 \b, 32 kbps
744: >2 byte&0xF0 0x50 \b, 40 kbps
745: >2 byte&0xF0 0x60 \b, 48 kbps
746: >2 byte&0xF0 0x70 \b, 56 kbps
747: >2 byte&0xF0 0x80 \b, 64 kbps
748: >2 byte&0xF0 0x90 \b, 80 kbps
749: >2 byte&0xF0 0xA0 \b, 96 kbps
750: >2 byte&0xF0 0xB0 \b, 112 kbps
751: >2 byte&0xF0 0xC0 \b, 128 kbps
752: >2 byte&0xF0 0xD0 \b, 144 kbps
753: >2 byte&0xF0 0xE0 \b, 160 kbps
754: # timing
755: >2 byte&0x0C 0x00 \b, 22.05 kHz
756: >2 byte&0x0C 0x04 \b, 24 kHz
757: >2 byte&0x0C 0x08 \b, 16 kHz
758: # channels/options
759: >3 byte&0xC0 0x00 \b, Stereo
760: >3 byte&0xC0 0x40 \b, JntStereo
761: >3 byte&0xC0 0x80 \b, 2x Monaural
762: >3 byte&0xC0 0xC0 \b, Monaural
763: #>1 byte ^0x01 \b, Data Verify
764: #>2 byte &0x02 \b, Packet Pad
765: #>2 byte &0x01 \b, Custom Flag
766: #>3 byte &0x08 \b, Copyrighted
767: #>3 byte &0x04 \b, Original Source
768: #>3 byte&0x03 1 \b, NR: 50/15 ms
769: #>3 byte&0x03 3 \b, NR: CCIT J.17
770:
771: # MPA, M2A
772: 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
773: # rate
774: >2 byte&0xF0 0x10 \b, 32 kbps
775: >2 byte&0xF0 0x20 \b, 48 kbps
776: >2 byte&0xF0 0x30 \b, 56 kbps
777: >2 byte&0xF0 0x40 \b, 64 kbps
778: >2 byte&0xF0 0x50 \b, 80 kbps
779: >2 byte&0xF0 0x60 \b, 96 kbps
780: >2 byte&0xF0 0x70 \b, 112 kbps
781: >2 byte&0xF0 0x80 \b, 128 kbps
782: >2 byte&0xF0 0x90 \b, 144 kbps
783: >2 byte&0xF0 0xA0 \b, 160 kbps
784: >2 byte&0xF0 0xB0 \b, 176 kbps
785: >2 byte&0xF0 0xC0 \b, 192 kbps
786: >2 byte&0xF0 0xD0 \b, 224 kbps
787: >2 byte&0xF0 0xE0 \b, 256 kbps
788: # timing
789: >2 byte&0x0C 0x00 \b, 22.05 kHz
790: >2 byte&0x0C 0x04 \b, 24 kHz
791: >2 byte&0x0C 0x08 \b, 16 kHz
792: # channels/options
793: >3 byte&0xC0 0x00 \b, Stereo
794: >3 byte&0xC0 0x40 \b, JntStereo
795: >3 byte&0xC0 0x80 \b, 2x Monaural
796: >3 byte&0xC0 0xC0 \b, Monaural
797: #>1 byte ^0x01 \b, Data Verify
798: #>2 byte &0x02 \b, Packet Pad
799: #>2 byte &0x01 \b, Custom Flag
800: #>3 byte &0x08 \b, Copyrighted
801: #>3 byte &0x04 \b, Original Source
802: #>3 byte&0x03 1 \b, NR: 50/15 ms
803: #>3 byte&0x03 3 \b, NR: CCIT J.17
804:
805: # MP3, M25A
806: 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
807: # rate
808: >2 byte&0xF0 0x10 \b, 8 kbps
809: >2 byte&0xF0 0x20 \b, 16 kbps
810: >2 byte&0xF0 0x30 \b, 24 kbps
811: >2 byte&0xF0 0x40 \b, 32 kbps
812: >2 byte&0xF0 0x50 \b, 40 kbps
813: >2 byte&0xF0 0x60 \b, 48 kbps
814: >2 byte&0xF0 0x70 \b, 56 kbps
815: >2 byte&0xF0 0x80 \b, 64 kbps
816: >2 byte&0xF0 0x90 \b, 80 kbps
817: >2 byte&0xF0 0xA0 \b, 96 kbps
818: >2 byte&0xF0 0xB0 \b, 112 kbps
819: >2 byte&0xF0 0xC0 \b, 128 kbps
820: >2 byte&0xF0 0xD0 \b, 144 kbps
821: >2 byte&0xF0 0xE0 \b, 160 kbps
822: # timing
823: >2 byte&0x0C 0x00 \b, 11.025 kHz
824: >2 byte&0x0C 0x04 \b, 12 kHz
825: >2 byte&0x0C 0x08 \b, 8 kHz
826: # channels/options
827: >3 byte&0xC0 0x00 \b, Stereo
828: >3 byte&0xC0 0x40 \b, JntStereo
829: >3 byte&0xC0 0x80 \b, 2x Monaural
830: >3 byte&0xC0 0xC0 \b, Monaural
831: #>1 byte ^0x01 \b, Data Verify
832: #>2 byte &0x02 \b, Packet Pad
833: #>2 byte &0x01 \b, Custom Flag
834: #>3 byte &0x08 \b, Copyrighted
835: #>3 byte &0x04 \b, Original Source
836: #>3 byte&0x03 1 \b, NR: 50/15 ms
837: #>3 byte&0x03 3 \b, NR: CCIT J.17
838:
839: # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
840:
841: # Stored AAC streams (instead of the MP4 format)
842: 0 string ADIF MPEG ADIF, AAC
843: !:mime audio/x-hx-aac-adif
844: >4 byte &0x80
845: >>13 byte &0x10 \b, VBR
846: >>13 byte ^0x10 \b, CBR
847: >>16 byte&0x1E 0x02 \b, single stream
848: >>16 byte&0x1E 0x04 \b, 2 streams
849: >>16 byte&0x1E 0x06 \b, 3 streams
850: >>16 byte &0x08 \b, 4 or more streams
851: >>16 byte &0x10 \b, 8 or more streams
852: >>4 byte &0x80 \b, Copyrighted
853: >>13 byte &0x40 \b, Original Source
854: >>13 byte &0x20 \b, Home Flag
855: >4 byte ^0x80
856: >>4 byte &0x10 \b, VBR
857: >>4 byte ^0x10 \b, CBR
858: >>7 byte&0x1E 0x02 \b, single stream
859: >>7 byte&0x1E 0x04 \b, 2 streams
860: >>7 byte&0x1E 0x06 \b, 3 streams
861: >>7 byte &0x08 \b, 4 or more streams
862: >>7 byte &0x10 \b, 8 or more streams
863: >>4 byte &0x40 \b, Original Stream(s)
864: >>4 byte &0x20 \b, Home Source
865:
866: # Live or stored single AAC stream (used with MPEG-2 systems)
867: 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
868: !:mime audio/x-hx-aac-adts
869: >1 byte &0x08 \b, v2
870: >1 byte ^0x08 \b, v4
871: # profile
872: >>2 byte &0xC0 \b LTP
873: >2 byte&0xc0 0x00 \b Main
874: >2 byte&0xc0 0x40 \b LC
875: >2 byte&0xc0 0x80 \b SSR
876: # timing
877: >2 byte&0x3c 0x00 \b, 96 kHz
878: >2 byte&0x3c 0x04 \b, 88.2 kHz
879: >2 byte&0x3c 0x08 \b, 64 kHz
880: >2 byte&0x3c 0x0c \b, 48 kHz
881: >2 byte&0x3c 0x10 \b, 44.1 kHz
882: >2 byte&0x3c 0x14 \b, 32 kHz
883: >2 byte&0x3c 0x18 \b, 24 kHz
884: >2 byte&0x3c 0x1c \b, 22.05 kHz
885: >2 byte&0x3c 0x20 \b, 16 kHz
886: >2 byte&0x3c 0x24 \b, 12 kHz
887: >2 byte&0x3c 0x28 \b, 11.025 kHz
888: >2 byte&0x3c 0x2c \b, 8 kHz
889: # channels
890: >2 beshort&0x01c0 0x0040 \b, monaural
891: >2 beshort&0x01c0 0x0080 \b, stereo
892: >2 beshort&0x01c0 0x00c0 \b, stereo + center
893: >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
894: >2 beshort&0x01c0 0x0140 \b, surround
895: >2 beshort&0x01c0 0x0180 \b, surround + LFE
896: >2 beshort &0x01C0 \b, surround + side
897: #>1 byte ^0x01 \b, Data Verify
898: #>2 byte &0x02 \b, Custom Flag
899: #>3 byte &0x20 \b, Original Stream
900: #>3 byte &0x10 \b, Home Source
901: #>3 byte &0x08 \b, Copyrighted
902:
903: # Live MPEG-4 audio streams (instead of RTP FlexMux)
904: 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
905: !:mime audio/x-mp4a-latm
906: #>1 beshort&0x1FFF x \b, %u byte packet
907: >3 byte&0xE0 0x40
908: >>4 byte&0x3C 0x04 \b, single stream
909: >>4 byte&0x3C 0x08 \b, 2 streams
910: >>4 byte&0x3C 0x0C \b, 3 streams
911: >>4 byte &0x08 \b, 4 or more streams
912: >>4 byte &0x20 \b, 8 or more streams
913: >3 byte&0xC0 0
914: >>4 byte&0x78 0x08 \b, single stream
915: >>4 byte&0x78 0x10 \b, 2 streams
916: >>4 byte&0x78 0x18 \b, 3 streams
917: >>4 byte &0x20 \b, 4 or more streams
918: >>4 byte &0x40 \b, 8 or more streams
919: # This magic isn't strong enough (matches plausible ISO-8859-1 text)
920: #0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
921: #!:mime audio/x-mp4a-latm
922:
923: # Summary: FLI animation format
924: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
925: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
926: 4 leshort 0xAF11
927: # standard FLI always has 320x200 resolution and 8 bit color
928: >8 leshort 320
929: >>10 leshort 200
930: >>>12 leshort 8 FLI animation, 320x200x8
931: !:mime video/x-fli
932: >>>>6 leshort x \b, %d frames
933: # frame speed is multiple of 1/70s
934: >>>>16 leshort x \b, %d/70s per frame
935:
936: # Summary: FLC animation format
937: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
938: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
939: 4 leshort 0xAF12
940: # standard FLC always use 8 bit color
941: >12 leshort 8 FLC animation
942: !:mime video/x-flc
943: >>8 leshort x \b, %d
944: >>10 leshort x \bx%dx8
945: >>6 uleshort x \b, %d frames
946: >>16 uleshort x \b, %dms per frame
947:
948: # DL animation format
949: # XXX - collision with most `mips' magic
950: #
951: # I couldn't find a real magic number for these, however, this
952: # -appears- to work. Note that it might catch other files, too, so be
953: # careful!
954: #
955: # Note that title and author appear in the two 20-byte chunks
956: # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
957: # 255 (hex FF)! The DL format is really bad.
958: #
959: #0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
960: #!:mime video/x-unknown
961: #>42 byte x - %d screens,
962: #>43 byte x %d commands
963: #0 byte 2 DL version 2
964: #!:mime video/x-unknown
965: #>1 byte 1 - large format (320x200,1 image/screen),
966: #>1 byte 2 - medium format (160x100,4 images/screen),
967: #>1 byte >2 - unknown format,
968: #>42 byte x %d screens,
969: #>43 byte x %d commands
970: # Based on empirical evidence, DL version 3 have several nulls following the
971: # \003. Most of them start with non-null values at hex offset 0x34 or so.
972: #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
973:
974: # iso 13818 transport stream
975: #
976: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
977: # (the following is a little bit restrictive and works fine for a stream
978: # that starts with PAT properly. it won't work for stream data, that is
979: # cut from an input device data right in the middle, but this shouldn't
980: # disturb)
981: # syncbyte 8 bit 0x47
982: # error_ind 1 bit -
983: # payload_start 1 bit 1
984: # priority 1 bit -
985: # PID 13 bit 0x0000
986: # scrambling 2 bit -
987: # adaptfld_ctrl 2 bit 1 or 3
988: # conti_count 4 bit 0
989: 0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
990: >188 byte !0x47 CORRUPTED
991:
992: # DIF digital video file format <mpruett@sgi.com>
993: 0 belong&0xffffff00 0x1f070000 DIF
994: >4 byte &0x01 (DVCPRO) movie file
995: >4 byte ^0x01 (DV) movie file
996: >3 byte &0x80 (PAL)
997: >3 byte ^0x80 (NTSC)
998:
999: # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
1000: 0 belong 0x3026b275 Microsoft ASF
1001: !:mime video/x-ms-asf
1002:
1003: # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1004: 0 string \x8aMNG MNG video data,
1005: !:mime video/x-mng
1006: >4 belong !0x0d0a1a0a CORRUPTED,
1007: >4 belong 0x0d0a1a0a
1008: >>16 belong x %ld x
1009: >>20 belong x %ld
1010:
1011: # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1012: 0 string \x8bJNG JNG video data,
1013: !:mime video/x-jng
1014: >4 belong !0x0d0a1a0a CORRUPTED,
1015: >4 belong 0x0d0a1a0a
1016: >>16 belong x %ld x
1017: >>20 belong x %ld
1018:
1019: # Vivo video (Wolfram Kleff)
1020: 3 string \x0D\x0AVersion:Vivo Vivo video data
1021:
1022: # VRML (Virtual Reality Modelling Language)
1023: 0 string/b #VRML\ V1.0\ ascii VRML 1 file
1024: !:mime model/vrml
1025: 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
1026: !:mime model/vrml
1027:
1028: # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1029: # From Michel Briand <michelbriand@free.fr>
1030: 0 string \<?xml\ version="
1031: !:strength +1
1032: >20 search/1000/cb \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
1033: !:mime model/x3d
1034:
1035: #---------------------------------------------------------------------------
1036: # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1037: # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1038: #
1039: 0 string HVQM4 %s
1040: >6 string >\0 v%s
1041: >0 byte x GameCube movie,
1042: >0x34 ubeshort x %d x
1043: >0x36 ubeshort x %d,
1044: >0x26 ubeshort x %dµs,
1045: >0x42 ubeshort 0 no audio
1046: >0x42 ubeshort >0 %dHz audio
1047:
1048: # From: "Stefan A. Haubenthal" <polluks@web.de>
1049: 0 string DVDVIDEO-VTS Video title set,
1050: >0x21 byte x v%x
1051: 0 string DVDVIDEO-VMG Video manager,
1052: >0x21 byte x v%x
1053:
1054: # From: Behan Webster <behanw@websterwood.com>
1055: # NuppelVideo used by Mythtv (*.nuv)
1056: # Note: there are two identical stanzas here differing only in the
1057: # initial string matched. It used to be done with a regex, but we're
1058: # trying to get rid of those.
1059: 0 string NuppelVideo MythTV NuppelVideo
1060: >12 string x v%s
1061: >20 lelong x (%d
1062: >24 lelong x \bx%d),
1063: >36 string P \bprogressive,
1064: >36 string I \binterlaced,
1065: >40 ledouble x \baspect:%.2f,
1066: >48 ledouble x \bfps:%.2f
1067: 0 string MythTV MythTV NuppelVideo
1068: >12 string x v%s
1069: >20 lelong x (%d
1070: >24 lelong x \bx%d),
1071: >36 string P \bprogressive,
1072: >36 string I \binterlaced,
1073: >40 ledouble x \baspect:%.2f,
1074: >48 ledouble x \bfps:%.2f
1075:
1076: # MPEG file
1077: # MPEG sequences
1078: # FIXME: This section is from the old magic.mime file and needs integrating with the rest
1079: 0 belong 0x000001BA
1080: >4 byte &0x40
1081: !:mime video/mp2p
1082: >4 byte ^0x40
1083: !:mime video/mpeg
1084: 0 belong 0x000001BB
1085: !:mime video/mpeg
1086: 0 belong 0x000001B0
1087: !:mime video/mp4v-es
1088: 0 belong 0x000001B5
1089: !:mime video/mp4v-es
1090: 0 belong 0x000001B3
1091: !:mime video/mpv
1092: 0 belong&0xFF5FFF1F 0x47400010
1093: !:mime video/mp2t
1094: 0 belong 0x00000001
1095: >4 byte&0x1F 0x07
1096: !:mime video/h264
1097:
1098: #------------------------------------------------------------------------------
1099: # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
1100: # workspaces)
1101: #
1102: 0 long 0100554 APL workspace (Ken's original?)
1103: #------------------------------------------------------------------------------
1104: # apple: file(1) magic for Apple file formats
1105: #
1106: 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text
1107: 0 string \x0aGL Binary II (apple ][) data
1108: 0 string \x76\xff Squeezed (apple ][) data
1109: 0 string NuFile NuFile archive (apple ][) data
1110: 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
1111: 0 belong 0x00051600 AppleSingle encoded Macintosh file
1112: 0 belong 0x00051607 AppleDouble encoded Macintosh file
1113:
1114: # Type: Apple Emulator 2IMG format
1115: # From: Radek Vokal <rvokal@redhat.com>
1116: 0 string 2IMG Apple ][ 2IMG Disk Image
1117: >4 string XGS! \b, XGS
1118: >4 string CTKG \b, Catakig
1119: >4 string ShIm \b, Sheppy's ImageMaker
1120: >4 string WOOF \b, Sweet 16
1121: >4 string B2TR \b, Bernie ][ the Rescue
1122: >4 string !nfc \b, ASIMOV2
1123: >4 string x \b, Unknown Format
1124: >0xc byte 00 \b, DOS 3.3 sector order
1125: >>0x10 byte 00 \b, Volume 254
1126: >>0x10 byte&0x7f x \b, Volume %u
1127: >0xc byte 01 \b, ProDOS sector order
1128: >>0x14 short x \b, %u Blocks
1129: >0xc byte 02 \b, NIB data
1130:
1131: # magic for Newton PDA package formats
1132: # from Ruda Moura <ruda@helllabs.org>
1133: 0 string package0 Newton package, NOS 1.x,
1134: >12 belong &0x80000000 AutoRemove,
1135: >12 belong &0x40000000 CopyProtect,
1136: >12 belong &0x10000000 NoCompression,
1137: >12 belong &0x04000000 Relocation,
1138: >12 belong &0x02000000 UseFasterCompression,
1139: >16 belong x version %d
1140:
1141: 0 string package1 Newton package, NOS 2.x,
1142: >12 belong &0x80000000 AutoRemove,
1143: >12 belong &0x40000000 CopyProtect,
1144: >12 belong &0x10000000 NoCompression,
1145: >12 belong &0x04000000 Relocation,
1146: >12 belong &0x02000000 UseFasterCompression,
1147: >16 belong x version %d
1148:
1149: 0 string package4 Newton package,
1150: >8 byte 8 NOS 1.x,
1151: >8 byte 9 NOS 2.x,
1152: >12 belong &0x80000000 AutoRemove,
1153: >12 belong &0x40000000 CopyProtect,
1154: >12 belong &0x10000000 NoCompression,
1155:
1156: # The following entries for the Apple II are for files that have
1157: # been transferred as raw binary data from an Apple, without having
1158: # been encapsulated by any of the above archivers.
1159: #
1160: # In general, Apple II formats are hard to identify because Apple DOS
1161: # and especially Apple ProDOS have strong typing in the file system and
1162: # therefore programmers never felt much need to include type information
1163: # in the files themselves.
1164: #
1165: # Eric Fischer <enf@pobox.com>
1166:
1167: # AppleWorks word processor:
1168: #
1169: # This matches the standard tab stops for an AppleWorks file, but if
1170: # a file has a tab stop set in the first four columns this will fail.
1171: #
1172: # The "O" is really the magic number, but that's so common that it's
1173: # necessary to check the tab stops that follow it to avoid false positives.
1174:
1175: 4 string O==== AppleWorks word processor data
1176: >85 byte&0x01 >0 \b, zoomed
1177: >90 byte&0x01 >0 \b, paginated
1178: >92 byte&0x01 >0 \b, with mail merge
1179: #>91 byte x \b, left margin %d
1180:
1181: # AppleWorks database:
1182: #
1183: # This isn't really a magic number, but it's the closest thing to one
1184: # that I could find. The 1 and 2 really mean "order in which you defined
1185: # categories" and "left to right, top to bottom," respectively; the D and R
1186: # mean that the cursor should move either down or right when you press Return.
1187:
1188: #30 string \x01D AppleWorks database data
1189: #30 string \x02D AppleWorks database data
1190: #30 string \x01R AppleWorks database data
1191: #30 string \x02R AppleWorks database data
1192:
1193: # AppleWorks spreadsheet:
1194: #
1195: # Likewise, this isn't really meant as a magic number. The R or C means
1196: # row- or column-order recalculation; the A or M means automatic or manual
1197: # recalculation.
1198:
1199: #131 string RA AppleWorks spreadsheet data
1200: #131 string RM AppleWorks spreadsheet data
1201: #131 string CA AppleWorks spreadsheet data
1202: #131 string CM AppleWorks spreadsheet data
1203:
1204: # Applesoft BASIC:
1205: #
1206: # This is incredibly sloppy, but will be true if the program was
1207: # written at its usual memory location of 2048 and its first line
1208: # number is less than 256. Yuck.
1209:
1210: 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
1211: #>2 leshort x \b, first line number %d
1212:
1213: # ORCA/EZ assembler:
1214: #
1215: # This will not identify ORCA/M source files, since those have
1216: # some sort of date code instead of the two zero bytes at 6 and 7
1217: # XXX Conflicts with ELF
1218: #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
1219: #>5 byte x \b, build number %d
1220:
1221: # Broderbund Fantavision
1222: #
1223: # I don't know what these values really mean, but they seem to recur.
1224: # Will they cause too many conflicts?
1225:
1226: # Probably :-)
1227: #2 belong&0xFF00FF 0x040008 Fantavision movie data
1228:
1229: # Some attempts at images.
1230: #
1231: # These are actually just bit-for-bit dumps of the frame buffer, so
1232: # there's really no reasonably way to distinguish them except for their
1233: # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1234: # or, occasionally, 8184.
1235: #
1236: # Nevertheless this will manage to catch a lot of images that happen
1237: # to have a solid-colored line at the bottom of the screen.
1238:
1239: # GRR: Magic too weak
1240: #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
1241: #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
1242: #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
1243: #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
1244: #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
1245:
1246: # Beagle Bros. Apple Mechanic fonts
1247:
1248: 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
1249:
1250: # Apple Universal Disk Image Format (UDIF) - dmg files.
1251: # From Johan Gade.
1252: # These entries are disabled for now until we fix the following issues.
1253: #
1254: # Note there might be some problems with the "VAX COFF executable"
1255: # entry. Note this entry should be placed before the mac filesystem section,
1256: # particularly the "Apple Partition data" entry.
1257: #
1258: # The intended meaning of these tests is, that the file is only of the
1259: # specified type if both of the lines are correct - i.e. if the first
1260: # line matches and the second doesn't then it is not of that type.
1261: #
1262: #0 long 0x7801730d
1263: #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
1264: #
1265: # Note that this entry is recognized correctly by the "Apple Partition
1266: # data" entry - however since this entry is more specific - this
1267: # information seems to be more useful.
1268: #0 long 0x45520200
1269: #>0x410 string disk\ image UDIF read/write image (UDRW)
1270:
1271: # From: Toby Peterson <toby@apple.com>
1272: 0 string bplist00 Apple binary property list
1273:
1274: # Apple binary property list (bplist)
1275: # Assumes version bytes are hex.
1276: # Provides content hints for version 0 files. Assumes that the root
1277: # object is the first object (true for CoreFoundation implementation).
1278: # From: David Remahl <dremahl@apple.com>
1279: 0 string bplist
1280: >6 byte x \bCoreFoundation binary property list data, version 0x%c
1281: >>7 byte x \b%c
1282: >6 string 00 \b
1283: >>8 byte&0xF0 0x00 \b
1284: >>>8 byte&0x0F 0x00 \b, root type: null
1285: >>>8 byte&0x0F 0x08 \b, root type: false boolean
1286: >>>8 byte&0x0F 0x09 \b, root type: true boolean
1287: >>8 byte&0xF0 0x10 \b, root type: integer
1288: >>8 byte&0xF0 0x20 \b, root type: real
1289: >>8 byte&0xF0 0x30 \b, root type: date
1290: >>8 byte&0xF0 0x40 \b, root type: data
1291: >>8 byte&0xF0 0x50 \b, root type: ascii string
1292: >>8 byte&0xF0 0x60 \b, root type: unicode string
1293: >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
1294: >>8 byte&0xF0 0xa0 \b, root type: array
1295: >>8 byte&0xF0 0xd0 \b, root type: dictionary
1296:
1297: # Apple/NeXT typedstream data
1298: # Serialization format used by NeXT and Apple for various
1299: # purposes in YellowStep/Cocoa, including some nib files.
1300: # From: David Remahl <dremahl@apple.com>
1301: 2 string typedstream NeXT/Apple typedstream data, big endian
1302: >0 byte x \b, version %hhd
1303: >0 byte <5 \b
1304: >>13 byte 0x81 \b
1305: >>>14 ubeshort x \b, system %hd
1306: 2 string streamtyped NeXT/Apple typedstream data, little endian
1307: >0 byte x \b, version %hhd
1308: >0 byte <5 \b
1309: >>13 byte 0x81 \b
1310: >>>14 uleshort x \b, system %hd
1311:
1312: #------------------------------------------------------------------------------
1313: # CAF: Apple CoreAudio File Format
1314: #
1315: # Container format for high-end audio purposes.
1316: # From: David Remahl <dremahl@apple.com>
1317: #
1318: 0 string caff CoreAudio Format audio file
1319: >4 beshort <10 version %d
1320: >6 beshort x
1321:
1322:
1323: #------------------------------------------------------------------------------
1324: # Keychain database files
1325: 0 string kych Mac OS X Keychain File
1326:
1327: #------------------------------------------------------------------------------
1328: # Code Signing related file types
1329: 0 belong 0xfade0c00 Mac OS X Code Requirement
1330: >8 belong 1 (opExpr)
1331: >4 belong x - %d bytes
1332:
1333: 0 belong 0xfade0c01 Mac OS X Code Requirement Set
1334: >8 belong >1 containing %d items
1335: >4 belong x - %d bytes
1336:
1337: 0 belong 0xfade0c02 Mac OS X Code Directory
1338: >8 belong x version %x
1339: >12 belong >0 flags 0x%x
1340: >4 belong x - %d bytes
1341:
1342: 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
1343: >4 belong x - %d bytes
1344:
1345: 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
1346: >8 belong >1 (%d elements)
1347: >4 belong x - %d bytes
1348:
1349: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1350: # .vdi
1351: 4 string innotek\ VirtualBox\ Disk\ Image %s
1352:
1353: #------------------------------------------------------------------------------
1354: # applix: file(1) magic for Applixware
1355: # From: Peter Soos <sp@osb.hu>
1356: #
1357: 0 string *BEGIN Applixware
1358: >7 string WORDS Words Document
1359: >7 string GRAPHICS Graphic
1360: >7 string RASTER Bitmap
1361: >7 string SPREADSHEETS Spreadsheet
1362: >7 string MACRO Macro
1363: >7 string BUILDER Builder Object
1364: #------------------------------------------------------------------------------
1365: # archive: file(1) magic for archive formats (see also "msdos" for self-
1366: # extracting compressed archives)
1367: #
1368: # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
1369: # pre-POSIX "tar" archives are handled in the C code.
1370:
1371: # POSIX tar archives
1372: 257 string ustar\0 POSIX tar archive
1373: !:mime application/x-tar # encoding: posix
1374: 257 string ustar\040\040\0 GNU tar archive
1375: !:mime application/x-tar # encoding: gnu
1376:
1377: # cpio archives
1378: #
1379: # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
1380: # The idea is to indicate archives produced on machines with the same
1381: # byte order as the machine running "file" with "cpio archive", and
1382: # to indicate archives produced on machines with the opposite byte order
1383: # from the machine running "file" with "byte-swapped cpio archive".
1384: #
1385: # The SVR4 "cpio(4)" hints that there are additional formats, but they
1386: # are defined as "short"s; I think all the new formats are
1387: # character-header formats and thus are strings, not numbers.
1388: 0 short 070707 cpio archive
1389: !:mime application/x-cpio
1390: 0 short 0143561 byte-swapped cpio archive
1391: !:mime application/x-cpio # encoding: swapped
1392: 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
1393: 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
1394: 0 string 070702 ASCII cpio archive (SVR4 with CRC)
1395:
1396: # Debian package (needs to go before regular portable archives)
1397: #
1398: 0 string =!<arch>\ndebian
1399: !:mime application/x-debian-package
1400: >8 string debian-split part of multipart Debian package
1401: >8 string debian-binary Debian binary package
1402: >8 string !debian
1403: >68 string >\0 (format %s)
1404: # These next two lines do not work, because a bzip2 Debian archive
1405: # still uses gzip for the control.tar (first in the archive). Only
1406: # data.tar varies, and the location of its filename varies too.
1407: # file/libmagic does not current have support for ascii-string based
1408: # (offsets) as of 2005-09-15.
1409: #>81 string bz2 \b, uses bzip2 compression
1410: #>84 string gz \b, uses gzip compression
1411: #>136 ledate x created: %s
1412:
1413: # other archives
1414: 0 long 0177555 very old archive
1415: 0 short 0177555 very old PDP-11 archive
1416: 0 long 0177545 old archive
1417: 0 short 0177545 old PDP-11 archive
1418: 0 long 0100554 apl workspace
1419: 0 string =<ar> archive
1420: !:mime application/x-archive
1421:
1422: # MIPS archive (needs to go before regular portable archives)
1423: #
1424: 0 string =!<arch>\n__________E MIPS archive
1425: >20 string U with MIPS Ucode members
1426: >21 string L with MIPSEL members
1427: >21 string B with MIPSEB members
1428: >19 string L and an EL hash table
1429: >19 string B and an EB hash table
1430: >22 string X -- out of date
1431:
1432: 0 search/1 -h- Software Tools format archive text
1433:
1434: #
1435: # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
1436: # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
1437: #
1438: # 0 string =!<arch> current ar archive
1439: # 0 long 0x213c6172 archive file
1440: #
1441: # and for SVR1 archives, we have:
1442: #
1443: # 0 string \<ar> System V Release 1 ar archive
1444: # 0 string =<ar> archive
1445: #
1446: # XXX - did Aegis really store shared libraries, breakpointed modules,
1447: # and absolute code program modules in the same format as new-style
1448: # "ar" archives?
1449: #
1450: 0 string =!<arch> current ar archive
1451: !:mime application/x-archive
1452: >8 string __.SYMDEF random library
1453: >0 belong =65538 - pre SR9.5
1454: >0 belong =65539 - post SR9.5
1455: >0 beshort 2 - object archive
1456: >0 beshort 3 - shared library module
1457: >0 beshort 4 - debug break-pointed module
1458: >0 beshort 5 - absolute code program module
1459: 0 string \<ar> System V Release 1 ar archive
1460: 0 string =<ar> archive
1461: #
1462: # XXX - from "vax", which appears to collect a bunch of byte-swapped
1463: # thingies, to help you recognize VAX files on big-endian machines;
1464: # with "leshort", "lelong", and "string", that's no longer necessary....
1465: #
1466: 0 belong 0x65ff0000 VAX 3.0 archive
1467: 0 belong 0x3c61723e VAX 5.0 archive
1468: #
1469: 0 long 0x213c6172 archive file
1470: 0 lelong 0177555 very old VAX archive
1471: 0 leshort 0177555 very old PDP-11 archive
1472: #
1473: # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
1474: # be a random library (it said 0xff65 rather than 0177545).
1475: #
1476: 0 lelong 0177545 old VAX archive
1477: >8 string __.SYMDEF random library
1478: 0 leshort 0177545 old PDP-11 archive
1479: >8 string __.SYMDEF random library
1480: #
1481: # From "pdp" (but why a 4-byte quantity?)
1482: #
1483: 0 lelong 0x39bed PDP-11 old archive
1484: 0 lelong 0x39bee PDP-11 4.0 archive
1485:
1486: # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
1487: #
1488: # The first byte is the magic (0x1a), byte 2 is the compression type for
1489: # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
1490: # filename of the first file (null terminated). Since some types collide
1491: # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
1492: # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
1493: 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
1494: !:mime application/x-arc
1495: 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
1496: !:mime application/x-arc
1497: 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
1498: !:mime application/x-arc
1499: 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
1500: !:mime application/x-arc
1501: 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
1502: !:mime application/x-arc
1503: 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
1504: !:mime application/x-arc
1505: # [JW] stuff taken from idarc, obviously ARC successors:
1506: 0 lelong&0x8080ffff 0x00000a1a PAK archive data
1507: !:mime application/x-arc
1508: 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
1509: !:mime application/x-arc
1510: 0 lelong&0x8080ffff 0x0000481a HYP archive data
1511: !:mime application/x-arc
1512:
1513: # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
1514: # I can't create either SPARK or ArcFS archives so I have not tested this stuff
1515: # [GRR: the original entries collide with ARC, above; replaced with combined
1516: # version (not tested)]
1517: #0 byte 0x1a RISC OS archive (spark format)
1518: 0 string \032archive RISC OS archive (ArcFS format)
1519: 0 string Archive\000 RISC OS archive (ArcFS format)
1520:
1521: # All these were taken from idarc, many could not be verified. Unfortunately,
1522: # there were many low-quality sigs, i.e. easy to trigger false positives.
1523: # Please notify me of any real-world fishy/ambiguous signatures and I'll try
1524: # to get my hands on the actual archiver and see if I find something better. [JW]
1525: # probably many can be enhanced by finding some 0-byte or control char near the start
1526:
1527: # idarc calls this Crush/Uncompressed... *shrug*
1528: 0 string CRUSH Crush archive data
1529: # Squeeze It (.sqz)
1530: 0 string HLSQZ Squeeze It archive data
1531: # SQWEZ
1532: 0 string SQWEZ SQWEZ archive data
1533: # HPack (.hpk)
1534: 0 string HPAK HPack archive data
1535: # HAP
1536: 0 string \x91\x33HF HAP archive data
1537: # MD/MDCD
1538: 0 string MDmd MDCD archive data
1539: # LIM
1540: 0 string LIM\x1a LIM archive data
1541: # SAR
1542: 3 string LH5 SAR archive data
1543: # BSArc/BS2
1544: 0 string \212\3SB \0 BSArc/BS2 archive data
1545: # MAR
1546: 2 string =-ah MAR archive data
1547: # ACB
1548: 0 belong&0x00f800ff 0x00800000 ACB archive data
1549: # CPZ
1550: # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
1551: # JRC
1552: 0 string JRchive JRC archive data
1553: # Quantum
1554: 0 string DS\0 Quantum archive data
1555: # ReSOF
1556: 0 string PK\3\6 ReSOF archive data
1557: # QuArk
1558: 0 string 7\4 QuArk archive data
1559: # YAC
1560: 14 string YC YAC archive data
1561: # X1
1562: 0 string X1 X1 archive data
1563: 0 string XhDr X1 archive data
1564: # CDC Codec (.dqt)
1565: 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
1566: # AMGC
1567: 0 string \xad6" AMGC archive data
1568: # NuLIB
1569: 0 string NõFélå NuLIB archive data
1570: # PakLeo
1571: 0 string LEOLZW PAKLeo archive data
1572: # ChArc
1573: 0 string SChF ChArc archive data
1574: # PSA
1575: 0 string PSA PSA archive data
1576: # CrossePAC
1577: 0 string DSIGDCC CrossePAC archive data
1578: # Freeze
1579: 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
1580: # KBoom
1581: 0 string ¨MP¨ KBoom archive data
1582: # NSQ, must go after CDC Codec
1583: 0 string \x76\xff NSQ archive data
1584: # DPA
1585: 0 string Dirk\ Paehl DPA archive data
1586: # BA
1587: # TODO: idarc says "bytes 0-2 == bytes 3-5"
1588: # TTComp
1589: 0 string \0\6 TTComp archive data
1590: # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
1591: 0 string ESP ESP archive data
1592: # ZPack
1593: 0 string \1ZPK\1 ZPack archive data
1594: # Sky
1595: 0 string \xbc\x40 Sky archive data
1596: # UFA
1597: 0 string UFA UFA archive data
1598: # Dry
1599: 0 string =-H2O DRY archive data
1600: # FoxSQZ
1601: 0 string FOXSQZ FoxSQZ archive data
1602: # AR7
1603: 0 string ,AR7 AR7 archive data
1604: # PPMZ
1605: 0 string PPMZ PPMZ archive data
1606: # MS Compress
1607: 4 string \x88\xf0\x27 MS Compress archive data
1608: # updated by Joerg Jenderek
1609: >9 string \0
1610: >>0 string KWAJ
1611: >>>7 string \321\003 MS Compress archive data
1612: >>>>14 ulong >0 \b, original size: %ld bytes
1613: >>>>18 ubyte >0x65
1614: >>>>>18 string x \b, was %.8s
1615: >>>>>(10.b-4) string x \b.%.3s
1616: # MP3 (archiver, not lossy audio compression)
1617: 0 string MP3\x1a MP3-Archiver archive data
1618: # ZET
1619: 0 string OZÃ ZET archive data
1620: # TSComp
1621: 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
1622: # ARQ
1623: 0 string gW\4\1 ARQ archive data
1624: # Squash
1625: 3 string OctSqu Squash archive data
1626: # Terse
1627: 0 string \5\1\1\0 Terse archive data
1628: # PUCrunch
1629: 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
1630: # UHarc
1631: 0 string UHA UHarc archive data
1632: # ABComp
1633: 0 string \2AB ABComp archive data
1634: 0 string \3AB2 ABComp archive data
1635: # CMP
1636: 0 string CO\0 CMP archive data
1637: # Splint
1638: 0 string \x93\xb9\x06 Splint archive data
1639: # InstallShield
1640: 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
1641: # Gather
1642: 1 string GTH Gather archive data
1643: # BOA
1644: 0 string BOA BOA archive data
1645: # RAX
1646: 0 string ULEB\xa RAX archive data
1647: # Xtreme
1648: 0 string ULEB\0 Xtreme archive data
1649: # Pack Magic
1650: 0 string @â\1\0 Pack Magic archive data
1651: # BTS
1652: 0 belong&0xfeffffff 0x1a034465 BTS archive data
1653: # ELI 5750
1654: 0 string Ora\ ELI 5750 archive data
1655: # QFC
1656: 0 string \x1aFC\x1a QFC archive data
1657: 0 string \x1aQF\x1a QFC archive data
1658: # PRO-PACK
1659: 0 string RNC PRO-PACK archive data
1660: # 777
1661: 0 string 777 777 archive data
1662: # LZS221
1663: 0 string sTaC LZS221 archive data
1664: # HPA
1665: 0 string HPA HPA archive data
1666: # Arhangel
1667: 0 string LG Arhangel archive data
1668: # EXP1, uses bzip2
1669: 0 string 0123456789012345BZh EXP1 archive data
1670: # IMP
1671: 0 string IMP\xa IMP archive data
1672: # NRV
1673: 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
1674: # Squish
1675: 0 string \x73\xb2\x90\xf4 Squish archive data
1676: # Par
1677: 0 string PHILIPP Par archive data
1678: 0 string PAR Par archive data
1679: # HIT
1680: 0 string UB HIT archive data
1681: # SBX
1682: 0 belong&0xfffff000 0x53423000 SBX archive data
1683: # NaShrink
1684: 0 string NSK NaShrink archive data
1685: # SAPCAR
1686: 0 string #\ CAR\ archive\ header SAPCAR archive data
1687: 0 string CAR\ 2.00RG SAPCAR archive data
1688: # Disintegrator
1689: 0 string DST Disintegrator archive data
1690: # ASD
1691: 0 string ASD ASD archive data
1692: # InstallShield CAB
1693: 0 string ISc( InstallShield CAB
1694: # TOP4
1695: 0 string T4\x1a TOP4 archive data
1696: # BatComp left out: sig looks like COM executable
1697: # so TODO: get real 4dos batcomp file and find sig
1698: # BlakHole
1699: 0 string BH\5\7 BlakHole archive data
1700: # BIX
1701: 0 string BIX0 BIX archive data
1702: # ChiefLZA
1703: 0 string ChfLZ ChiefLZA archive data
1704: # Blink
1705: 0 string Blink Blink archive data
1706: # Logitech Compress
1707: 0 string \xda\xfa Logitech Compress archive data
1708: # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1709: 1 string (C)\ STEPANYUK ARS-Sfx archive data
1710: # AKT/AKT32
1711: 0 string AKT32 AKT32 archive data
1712: 0 string AKT AKT archive data
1713: # NPack
1714: 0 string MSTSM NPack archive data
1715: # PFT
1716: 0 string \0\x50\0\x14 PFT archive data
1717: # SemOne
1718: 0 string SEM SemOne archive data
1719: # PPMD
1720: 0 string \x8f\xaf\xac\x84 PPMD archive data
1721: # FIZ
1722: 0 string FIZ FIZ archive data
1723: # MSXiE
1724: 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
1725: # DeepFreezer
1726: 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
1727: # DC
1728: 0 string =<DC- DC archive data
1729: # TPac
1730: 0 string \4TPAC\3 TPac archive data
1731: # Ai
1732: 0 string Ai\1\1\0 Ai archive data
1733: 0 string Ai\1\0\0 Ai archive data
1734: # Ai32
1735: 0 string Ai\2\0 Ai32 archive data
1736: 0 string Ai\2\1 Ai32 archive data
1737: # SBC
1738: 0 string SBC SBC archive data
1739: # Ybs
1740: 0 string YBS Ybs archive data
1741: # DitPack
1742: 0 string \x9e\0\0 DitPack archive data
1743: # DMS
1744: 0 string DMS! DMS archive data
1745: # EPC
1746: 0 string \x8f\xaf\xac\x8c EPC archive data
1747: # VSARC
1748: 0 string VS\x1a VSARC archive data
1749: # PDZ
1750: 0 string PDZ PDZ archive data
1751: # ReDuq
1752: 0 string rdqx ReDuq archive data
1753: # GCA
1754: 0 string GCAX GCA archive data
1755: # PPMN
1756: 0 string pN PPMN archive data
1757: # WinImage
1758: 3 string WINIMAGE WinImage archive data
1759: # Compressia
1760: 0 string CMP0CMP Compressia archive data
1761: # UHBC
1762: 0 string UHB UHBC archive data
1763: # WinHKI
1764: 0 string \x61\x5C\x04\x05 WinHKI archive data
1765: # WWPack data file
1766: 0 string WWP WWPack archive data
1767: # BSN (BSA, PTS-DOS)
1768: 0 string \xffBSG BSN archive data
1769: 1 string \xffBSG BSN archive data
1770: 3 string \xffBSG BSN archive data
1771: 1 string \0\xae\2 BSN archive data
1772: 1 string \0\xae\3 BSN archive data
1773: 1 string \0\xae\7 BSN archive data
1774: # AIN
1775: 0 string \x33\x18 AIN archive data
1776: 0 string \x33\x17 AIN archive data
1777: # XPA32
1778: 0 string xpa\0\1 XPA32 archive data
1779: # SZip (TODO: doesn't catch all versions)
1780: 0 string SZ\x0a\4 SZip archive data
1781: # XPack DiskImage
1782: 0 string jm XPack DiskImage archive data
1783: # XPack Data
1784: 0 string xpa XPack archive data
1785: # XPack Single Data
1786: 0 string Ã\ jm XPack single archive data
1787:
1788: # TODO: missing due to unknown magic/magic at end of file:
1789: #DWC
1790: #ARG
1791: #ZAR
1792: #PC/3270
1793: #InstallIt
1794: #RKive
1795: #RK
1796: #XPack Diskimage
1797:
1798: # These were inspired by idarc, but actually verified
1799: # Dzip archiver (.dz)
1800: 0 string DZ Dzip archive data
1801: >2 byte x \b, version %i
1802: >3 byte x \b.%i
1803: # ZZip archiver (.zz)
1804: 0 string ZZ\ \0\0 ZZip archive data
1805: 0 string ZZ0 ZZip archive data
1806: # PAQ archiver (.paq)
1807: 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
1808: 0 string PAQ PAQ archive data
1809: >3 byte&0xf0 0x30
1810: >>3 byte x (v%c)
1811: # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
1812: 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
1813: 0 string JARCS JAR (ARJ Software, Inc.) archive data
1814:
1815: # ARJ archiver (jason@jarthur.Claremont.EDU)
1816: 0 leshort 0xea60 ARJ archive data
1817: !:mime application/x-arj
1818: >5 byte x \b, v%d,
1819: >8 byte &0x04 multi-volume,
1820: >8 byte &0x10 slash-switched,
1821: >8 byte &0x20 backup,
1822: >34 string x original name: %s,
1823: >7 byte 0 os: MS-DOS
1824: >7 byte 1 os: PRIMOS
1825: >7 byte 2 os: Unix
1826: >7 byte 3 os: Amiga
1827: >7 byte 4 os: Macintosh
1828: >7 byte 5 os: OS/2
1829: >7 byte 6 os: Apple ][ GS
1830: >7 byte 7 os: Atari ST
1831: >7 byte 8 os: NeXT
1832: >7 byte 9 os: VAX/VMS
1833: >3 byte >0 %d]
1834: # [JW] idarc says this is also possible
1835: 2 leshort 0xea60 ARJ archive data
1836:
1837: # HA archiver (Greg Roelofs, newt@uchicago.edu)
1838: # This is a really bad format. A file containing HAWAII will match this...
1839: #0 string HA HA archive data,
1840: #>2 leshort =1 1 file,
1841: #>2 leshort >1 %u files,
1842: #>4 byte&0x0f =0 first is type CPY
1843: #>4 byte&0x0f =1 first is type ASC
1844: #>4 byte&0x0f =2 first is type HSC
1845: #>4 byte&0x0f =0x0e first is type DIR
1846: #>4 byte&0x0f =0x0f first is type SPECIAL
1847: # suggestion: at least identify small archives (<1024 files)
1848: 0 belong&0xffff00fc 0x48410000 HA archive data
1849: >2 leshort =1 1 file,
1850: >2 leshort >1 %u files,
1851: >4 byte&0x0f =0 first is type CPY
1852: >4 byte&0x0f =1 first is type ASC
1853: >4 byte&0x0f =2 first is type HSC
1854: >4 byte&0x0f =0x0e first is type DIR
1855: >4 byte&0x0f =0x0f first is type SPECIAL
1856:
1857: # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
1858: 0 string HPAK HPACK archive data
1859:
1860: # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
1861: 0 string \351,\001JAM\ JAM archive,
1862: >7 string >\0 version %.4s
1863: >0x26 byte =0x27 -
1864: >>0x2b string >\0 label %.11s,
1865: >>0x27 lelong x serial %08x,
1866: >>0x36 string >\0 fstype %.8s
1867:
1868: # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
1869: 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
1870: !:mime application/x-lharc
1871: 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
1872: !:mime application/x-lharc
1873: 2 string -lz4- LHarc 1.x archive data [lz4]
1874: !:mime application/x-lharc
1875: 2 string -lz5- LHarc 1.x archive data [lz5]
1876: !:mime application/x-lharc
1877: # [never seen any but the last; -lh4- reported in comp.compression:]
1878: 2 string -lzs- LHa/LZS archive data [lzs]
1879: !:mime application/x-lha
1880: 2 string -lh\40- LHa 2.x? archive data [lh ]
1881: !:mime application/x-lha
1882: 2 string -lhd- LHa 2.x? archive data [lhd]
1883: !:mime application/x-lha
1884: 2 string -lh2- LHa 2.x? archive data [lh2]
1885: !:mime application/x-lha
1886: 2 string -lh3- LHa 2.x? archive data [lh3]
1887: !:mime application/x-lha
1888: 2 string -lh4- LHa (2.x) archive data [lh4]
1889: !:mime application/x-lha
1890: 2 string -lh5- LHa (2.x) archive data [lh5]
1891: !:mime application/x-lha
1892: 2 string -lh6- LHa (2.x) archive data [lh6]
1893: !:mime application/x-lha
1894: 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
1895: !:mime application/x-lha
1896: >20 byte x - header level %d
1897: # taken from idarc [JW]
1898: 2 string -lZ PUT archive data
1899: 2 string -lz LZS archive data
1900: 2 string -sw1- Swag archive data
1901:
1902: # RAR archiver (Greg Roelofs, newt@uchicago.edu)
1903: 0 string Rar! RAR archive data,
1904: !:mime application/x-rar
1905: >44 byte x v%0x,
1906: >10 byte >0 flags:
1907: >>10 byte &0x01 Archive volume,
1908: >>10 byte &0x02 Commented,
1909: >>10 byte &0x04 Locked,
1910: >>10 byte &0x08 Solid,
1911: >>10 byte &0x20 Authenticated,
1912: >35 byte 0 os: MS-DOS
1913: >35 byte 1 os: OS/2
1914: >35 byte 2 os: Win32
1915: >35 byte 3 os: Unix
1916: # some old version? idarc says:
1917: 0 string RE\x7e\x5e RAR archive data
1918:
1919: # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
1920: 0 string SQSH squished archive data (Acorn RISCOS)
1921:
1922: # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
1923: # [JW] see exe section for self-extracting version
1924: 0 string UC2\x1a UC2 archive data
1925:
1926: # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
1927: 0 string PK\003\004
1928: >4 byte 0x00 Zip archive data
1929: !:mime application/zip
1930: >4 byte 0x09 Zip archive data, at least v0.9 to extract
1931: !:mime application/zip
1932: >4 byte 0x0a Zip archive data, at least v1.0 to extract
1933: !:mime application/zip
1934: >4 byte 0x0b Zip archive data, at least v1.1 to extract
1935: !:mime application/zip
1936: >0x161 string WINZIP Zip archive data, WinZIP self-extracting
1937: !:mime application/zip
1938: >4 byte 0x14
1939: >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
1940: !:mime application/zip
1941:
1942: # OpenOffice.org / KOffice / StarOffice documents
1943: # Listed here because they ARE zip files
1944: #
1945: # From: Abel Cheung <abel@oaka.org>
1946: >4 byte 0x14
1947: >>30 string mimetype
1948:
1949: # KOffice (1.2 or above) formats
1950: >>>50 string vnd.kde. KOffice (>=1.2)
1951: >>>>58 string karbon Karbon document
1952: >>>>58 string kchart KChart document
1953: >>>>58 string kformula KFormula document
1954: >>>>58 string kivio Kivio document
1955: >>>>58 string kontour Kontour document
1956: >>>>58 string kpresenter KPresenter document
1957: >>>>58 string kspread KSpread document
1958: >>>>58 string kword KWord document
1959:
1960: # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
1961: >>>50 string vnd.sun.xml. OpenOffice.org 1.x
1962: >>>>62 string writer Writer
1963: >>>>>68 byte !0x2e document
1964: >>>>>68 string .template template
1965: >>>>>68 string .global global document
1966: >>>>62 string calc Calc
1967: >>>>>66 byte !0x2e spreadsheet
1968: >>>>>66 string .template template
1969: >>>>62 string draw Draw
1970: >>>>>66 byte !0x2e document
1971: >>>>>66 string .template template
1972: >>>>62 string impress Impress
1973: >>>>>69 byte !0x2e presentation
1974: >>>>>69 string .template template
1975: >>>>62 string math Math document
1976: >>>>62 string base Database file
1977:
1978: # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
1979: # http://lists.oasis-open.org/archives/office/200505/msg00006.html
1980: >>>50 string vnd.oasis.opendocument. OpenDocument
1981: >>>>73 string text
1982: >>>>>77 byte !0x2d Text
1983: !:mime application/vnd.oasis.opendocument.text
1984: >>>>>77 string -template Text Template
1985: >>>>>77 string -web HTML Document Template
1986: >>>>>77 string -master Master Document
1987: >>>>73 string graphics Drawing
1988: >>>>>81 string -template Template
1989: >>>>73 string presentation Presentation
1990: >>>>>85 string -template Template
1991: >>>>73 string spreadsheet Spreadsheet
1992: >>>>>84 string -template Template
1993: >>>>73 string chart Chart
1994: >>>>>78 string -template Template
1995: >>>>73 string formula Formula
1996: >>>>>80 string -template Template
1997: >>>>73 string database Database
1998: >>>>73 string image Image
1999:
2000: # Zoo archiver
2001: 20 lelong 0xfdc4a7dc Zoo archive data
2002: !:mime application/x-zoo
2003: >4 byte >48 \b, v%c.
2004: >>6 byte >47 \b%c
2005: >>>7 byte >47 \b%c
2006: >32 byte >0 \b, modify: v%d
2007: >>33 byte x \b.%d+
2008: >42 lelong 0xfdc4a7dc \b,
2009: >>70 byte >0 extract: v%d
2010: >>>71 byte x \b.%d+
2011:
2012: # Shell archives
2013: 10 string #\ This\ is\ a\ shell\ archive shell archive text
2014: !:mime application/octet-stream
2015:
2016: #
2017: # LBR. NB: May conflict with the questionable
2018: # "binary Computer Graphics Metafile" format.
2019: #
2020: 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
2021: #
2022: # PMA (CP/M derivative of LHA)
2023: #
2024: 2 string -pm0- PMarc archive data [pm0]
2025: 2 string -pm1- PMarc archive data [pm1]
2026: 2 string -pm2- PMarc archive data [pm2]
2027: 2 string -pms- PMarc SFX archive (CP/M, DOS)
2028: 5 string -pc1- PopCom compressed executable (CP/M)
2029:
2030: # From Rafael Laboissiere <rafael@laboissiere.net>
2031: # The Project Revision Control System (see
2032: # http://prcs.sourceforge.net) generates a packaged project
2033: # file which is recognized by the following entry:
2034: 0 leshort 0xeb81 PRCS packaged project
2035:
2036: # Microsoft cabinets
2037: # by David Necas (Yeti) <yeti@physics.muni.cz>
2038: #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
2039: #>25 byte x v%d
2040: #>24 byte x \b.%d
2041: # MPi: All CABs have version 1.3, so this is pointless.
2042: # Better magic in debian-additions.
2043:
2044: # GTKtalog catalogs
2045: # by David Necas (Yeti) <yeti@physics.muni.cz>
2046: 4 string gtktalog\ GTKtalog catalog data,
2047: >13 string 3 version 3
2048: >>14 beshort 0x677a (gzipped)
2049: >>14 beshort !0x677a (not gzipped)
2050: >13 string >3 version %s
2051:
2052: ############################################################################
2053: # Parity archive reconstruction file, the 'par' file format now used on Usenet.
2054: 0 string PAR\0 PARity archive data
2055: >48 leshort =0 - Index file
2056: >48 leshort >0 - file number %d
2057:
2058: # Felix von Leitner <felix-file@fefe.de>
2059: 0 string d8:announce BitTorrent file
2060: !:mime application/x-bittorrent
2061:
2062: # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
2063: 0 beshort 0x0e0f Atari MSA archive data
2064: >2 beshort x \b, %d sectors per track
2065: >4 beshort 0 \b, 1 sided
2066: >4 beshort 1 \b, 2 sided
2067: >6 beshort x \b, starting track: %d
2068: >8 beshort x \b, ending track: %d
2069:
2070: # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
2071: 0 string PK00PK\003\004 Zip archive data
2072:
2073: # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
2074: # by Stefan `Sec` Zehl <sec@42.org>
2075: 7 string **ACE** ACE archive data
2076: >15 byte >0 version %d
2077: >16 byte =0x00 \b, from MS-DOS
2078: >16 byte =0x01 \b, from OS/2
2079: >16 byte =0x02 \b, from Win/32
2080: >16 byte =0x03 \b, from Unix
2081: >16 byte =0x04 \b, from MacOS
2082: >16 byte =0x05 \b, from WinNT
2083: >16 byte =0x06 \b, from Primos
2084: >16 byte =0x07 \b, from AppleGS
2085: >16 byte =0x08 \b, from Atari
2086: >16 byte =0x09 \b, from Vax/VMS
2087: >16 byte =0x0A \b, from Amiga
2088: >16 byte =0x0B \b, from Next
2089: >14 byte x \b, version %d to extract
2090: >5 leshort &0x0080 \b, multiple volumes,
2091: >>17 byte x \b (part %d),
2092: >5 leshort &0x0002 \b, contains comment
2093: >5 leshort &0x0200 \b, sfx
2094: >5 leshort &0x0400 \b, small dictionary
2095: >5 leshort &0x0800 \b, multi-volume
2096: >5 leshort &0x1000 \b, contains AV-String
2097: >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
2098: >5 leshort &0x2000 \b, with recovery record
2099: >5 leshort &0x4000 \b, locked
2100: >5 leshort &0x8000 \b, solid
2101: # Date in MS-DOS format (whatever that is)
2102: #>18 lelong x Created on
2103:
2104: # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
2105: # <doj@cubic.org>
2106: 0x1A string sfArk sfArk compressed Soundfont
2107: >0x15 string 2
2108: >>0x1 string >\0 Version %s
2109: >>0x2A string >\0 : %s
2110:
2111: # DR-DOS 7.03 Packed File *.??_
2112: 0 string Packed\ File\ Personal NetWare Packed File
2113: >12 string x \b, was "%.12s"
2114:
2115: # EET archive
2116: # From: Tilman Sauerbeck <tilman@code-monkey.de>
2117: 0 belong 0x1ee7ff00 EET archive
2118: !:mime application/x-eet
2119:
2120: # rzip archives
2121: 0 string RZIP rzip compressed data
2122: >4 byte x - version %d
2123: >5 byte x \b.%d
2124: >6 belong x (%d bytes)
2125:
2126: # From: "Robert Dale" <robdale@gmail.com>
2127: 0 belong 123 dar archive,
2128: >4 belong x label "%.8x
2129: >>8 belong x %.8x
2130: >>>12 beshort x %.4x"
2131: >14 byte 0x54 end slice
2132: >14 beshort 0x4e4e multi-part
2133: >14 beshort 0x4e53 multi-part, with -S
2134:
2135: # Symbian installation files
2136: # http://www.thouky.co.uk/software/psifs/sis.html
2137: # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
2138: 8 lelong 0x10000419 Symbian installation file
2139: !:mime application/vnd.symbian.install
2140: >4 lelong 0x1000006D (EPOC release 3/4/5)
2141: >4 lelong 0x10003A12 (EPOC release 6)
2142: 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
2143: !:mime x-epoc/x-sisx-app
2144:
2145: # From "Nelson A. de Oliveira" <naoliv@gmail.com>
2146: 0 string MPQ\032 MoPaQ (MPQ) archive
2147:
2148: # From: Dirk Jagdmann <doj@cubic.org>
2149: # xar archive format: http://code.google.com/p/xar/
2150: 0 string xar! xar archive
2151: >6 beshort x - version %ld
2152:
2153: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2154: # .kgb
2155: 0 string KGB_arch KGB Archiver file
2156: >10 string x with compression level %.1s
2157:
2158: # xar (eXtensible ARchiver) archive
2159: # From: "David Remahl" <dremahl@apple.com>
2160: 0 string xar! xar archive
2161: #>4 beshort x header size %d
2162: >6 beshort x version %d,
2163: #>8 quad x compressed TOC: %d,
2164: #>16 quad x uncompressed TOC: %d,
2165: >24 belong 0 no checksum
2166: >24 belong 1 SHA-1 checksum
2167: >24 belong 2 MD5 checksum
2168:
2169: # Type: Parity Archive
2170: # From: Daniel van Eeden <daniel_e@dds.nl>
2171: 0 string PAR2 Parity Archive Volume Set
2172:
2173: #------------------------------------------------------------------------------
2174: # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
2175: # strings as "long" - we assume they're just strings:
2176: # From: guy@netapp.com (Guy Harris)
2177: #
2178: 0 string *STA Aster*x
2179: >7 string WORD Words Document
2180: >7 string GRAP Graphic
2181: >7 string SPRE Spreadsheet
2182: >7 string MACR Macro
2183: 0 string 2278 Aster*x Version 2
2184: >29 byte 0x36 Words Document
2185: >29 byte 0x35 Graphic
2186: >29 byte 0x32 Spreadsheet
2187: >29 byte 0x38 Macro
2188:
2189:
2190: #------------------------------------------------------------------------------
2191: # att3b: file(1) magic for AT&T 3B machines
2192: #
2193: # The `versions' should be un-commented if they work for you.
2194: # (Was the problem just one of endianness?)
2195: #
2196: # 3B20
2197: #
2198: # The 3B20 conflicts with SCCS.
2199: #0 beshort 0550 3b20 COFF executable
2200: #>12 belong >0 not stripped
2201: #>22 beshort >0 - version %ld
2202: #0 beshort 0551 3b20 COFF executable (TV)
2203: #>12 belong >0 not stripped
2204: #>22 beshort >0 - version %ld
2205: #
2206: # WE32K
2207: #
2208: 0 beshort 0560 WE32000 COFF
2209: >18 beshort ^00000020 object
2210: >18 beshort &00000020 executable
2211: >12 belong >0 not stripped
2212: >18 beshort ^00010000 N/A on 3b2/300 w/paging
2213: >18 beshort &00020000 32100 required
2214: >18 beshort &00040000 and MAU hardware required
2215: >20 beshort 0407 (impure)
2216: >20 beshort 0410 (pure)
2217: >20 beshort 0413 (demand paged)
2218: >20 beshort 0443 (target shared library)
2219: >22 beshort >0 - version %ld
2220: 0 beshort 0561 WE32000 COFF executable (TV)
2221: >12 belong >0 not stripped
2222: #>18 beshort &00020000 - 32100 required
2223: #>18 beshort &00040000 and MAU hardware required
2224: #>22 beshort >0 - version %ld
2225: #
2226: # core file for 3b2
2227: 0 string \000\004\036\212\200 3b2 core file
2228: >364 string >\0 of '%s'
2229: #------------------------------------------------------------------------------
2230: # audio: file(1) magic for sound formats (see also "iff")
2231: #
2232: # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
2233: # and others
2234: #
2235:
2236: # Sun/NeXT audio data
2237: 0 string .snd Sun/NeXT audio data:
2238: >12 belong 1 8-bit ISDN mu-law,
2239: !:mime audio/basic
2240: >12 belong 2 8-bit linear PCM [REF-PCM],
2241: !:mime audio/basic
2242: >12 belong 3 16-bit linear PCM,
2243: !:mime audio/basic
2244: >12 belong 4 24-bit linear PCM,
2245: !:mime audio/basic
2246: >12 belong 5 32-bit linear PCM,
2247: !:mime audio/basic
2248: >12 belong 6 32-bit IEEE floating point,
2249: !:mime audio/basic
2250: >12 belong 7 64-bit IEEE floating point,
2251: !:mime audio/basic
2252: >12 belong 8 Fragmented sample data,
2253: >12 belong 10 DSP program,
2254: >12 belong 11 8-bit fixed point,
2255: >12 belong 12 16-bit fixed point,
2256: >12 belong 13 24-bit fixed point,
2257: >12 belong 14 32-bit fixed point,
2258: >12 belong 18 16-bit linear with emphasis,
2259: >12 belong 19 16-bit linear compressed,
2260: >12 belong 20 16-bit linear with emphasis and compression,
2261: >12 belong 21 Music kit DSP commands,
2262: >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2263: !:mime audio/x-adpcm
2264: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2265: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2266: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2267: >12 belong 27 8-bit A-law (CCITT G.711),
2268: >20 belong 1 mono,
2269: >20 belong 2 stereo,
2270: >20 belong 4 quad,
2271: >16 belong >0 %d Hz
2272:
2273: # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
2274: # that uses little-endian encoding and has a different magic number
2275: 0 lelong 0x0064732E DEC audio data:
2276: >12 lelong 1 8-bit ISDN mu-law,
2277: !:mime audio/x-dec-basic
2278: >12 lelong 2 8-bit linear PCM [REF-PCM],
2279: !:mime audio/x-dec-basic
2280: >12 lelong 3 16-bit linear PCM,
2281: !:mime audio/x-dec-basic
2282: >12 lelong 4 24-bit linear PCM,
2283: !:mime audio/x-dec-basic
2284: >12 lelong 5 32-bit linear PCM,
2285: !:mime audio/x-dec-basic
2286: >12 lelong 6 32-bit IEEE floating point,
2287: !:mime audio/x-dec-basic
2288: >12 lelong 7 64-bit IEEE floating point,
2289: !:mime audio/x-dec-basic
2290: >12 belong 8 Fragmented sample data,
2291: >12 belong 10 DSP program,
2292: >12 belong 11 8-bit fixed point,
2293: >12 belong 12 16-bit fixed point,
2294: >12 belong 13 24-bit fixed point,
2295: >12 belong 14 32-bit fixed point,
2296: >12 belong 18 16-bit linear with emphasis,
2297: >12 belong 19 16-bit linear compressed,
2298: >12 belong 20 16-bit linear with emphasis and compression,
2299: >12 belong 21 Music kit DSP commands,
2300: >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2301: !:mime audio/x-dec-basic
2302: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2303: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2304: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2305: >12 belong 27 8-bit A-law (CCITT G.711),
2306: >20 lelong 1 mono,
2307: >20 lelong 2 stereo,
2308: >20 lelong 4 quad,
2309: >16 lelong >0 %d Hz
2310:
2311: # Creative Labs AUDIO stuff
2312: 0 string MThd Standard MIDI data
2313: !:mime audio/midi
2314: >8 beshort x (format %d)
2315: >10 beshort x using %d track
2316: >10 beshort >1 \bs
2317: >12 beshort&0x7fff x at 1/%d
2318: >12 beshort&0x8000 >0 SMPTE
2319:
2320: 0 string CTMF Creative Music (CMF) data
2321: !:mime audio/x-unknown
2322: 0 string SBI SoundBlaster instrument data
2323: !:mime audio/x-unknown
2324: 0 string Creative\ Voice\ File Creative Labs voice data
2325: !:mime audio/x-unknown
2326: # is this next line right? it came this way...
2327: >19 byte 0x1A
2328: >23 byte >0 - version %d
2329: >22 byte >0 \b.%d
2330:
2331: # first entry is also the string "NTRK"
2332: 0 belong 0x4e54524b MultiTrack sound data
2333: >4 belong x - version %ld
2334:
2335: # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
2336: # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
2337: 0 string EMOD Extended MOD sound data,
2338: >4 byte&0xf0 x version %d
2339: >4 byte&0x0f x \b.%d,
2340: >45 byte x %d instruments
2341: >83 byte 0 (module)
2342: >83 byte 1 (song)
2343:
2344: # Real Audio (Magic .ra\0375)
2345: 0 belong 0x2e7261fd RealAudio sound file
2346: !:mime audio/x-pn-realaudio
2347: 0 string .RMF\0\0\0 RealMedia file
2348: !:mime application/vnd.rn-realmedia
2349: #video/x-pn-realvideo
2350: #video/vnd.rn-realvideo
2351: #application/vnd.rn-realmedia
2352: # sigh, there are many mimes for that but the above are the most common.
2353:
2354: # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
2355: # Oct 31, 1995
2356: # fixed by <doj@cubic.org> 2003-06-24
2357: # Too short...
2358: #0 string MTM MultiTracker Module sound file
2359: #0 string if Composer 669 Module sound data
2360: #0 string JN Composer 669 Module sound data (extended format)
2361: 0 string MAS_U ULT(imate) Module sound data
2362:
2363: #0 string FAR Module sound data
2364: #>4 string >\15 Title: "%s"
2365:
2366: 0x2c string SCRM ScreamTracker III Module sound data
2367: >0 string >\0 Title: "%s"
2368:
2369: # Gravis UltraSound patches
2370: # From <ache@nagual.ru>
2371:
2372: 0 string GF1PATCH110\0ID#000002\0 GUS patch
2373: 0 string GF1PATCH100\0ID#000002\0 Old GUS patch
2374:
2375: # mime types according to http://www.geocities.com/nevilo/mod.htm:
2376: # audio/it .it
2377: # audio/x-zipped-it .itz
2378: # audio/xm fasttracker modules
2379: # audio/x-s3m screamtracker modules
2380: # audio/s3m screamtracker modules
2381: # audio/x-zipped-mod mdz
2382: # audio/mod mod
2383: # audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
2384:
2385: #
2386: # Taken from loader code from mikmod version 2.14
2387: # by Steve McIntyre (stevem@chiark.greenend.org.uk)
2388: # <doj@cubic.org> added title printing on 2003-06-24
2389: 0 string MAS_UTrack_V00
2390: >14 string >/0 ultratracker V1.%.1s module sound data
2391: !:mime audio/x-mod
2392: #audio/x-tracker-module
2393:
2394: 0 string UN05 MikMod UNI format module sound data
2395:
2396: 0 string Extended\ Module: Fasttracker II module sound data
2397: !:mime audio/x-mod
2398: #audio/x-tracker-module
2399: >17 string >\0 Title: "%s"
2400:
2401: 21 string/c =!SCREAM! Screamtracker 2 module sound data
2402: !:mime audio/x-mod
2403: #audio/x-screamtracker-module
2404: 21 string BMOD2STM Screamtracker 2 module sound data
2405: !:mime audio/x-mod
2406: #audio/x-screamtracker-module
2407: 1080 string M.K. 4-channel Protracker module sound data
2408: !:mime audio/x-mod
2409: #audio/x-protracker-module
2410: >0 string >\0 Title: "%s"
2411: 1080 string M!K! 4-channel Protracker module sound data
2412: !:mime audio/x-mod
2413: #audio/x-protracker-module
2414: >0 string >\0 Title: "%s"
2415: 1080 string FLT4 4-channel Startracker module sound data
2416: !:mime audio/x-mod
2417: #audio/x-startracker-module
2418: >0 string >\0 Title: "%s"
2419: 1080 string FLT8 8-channel Startracker module sound data
2420: !:mime audio/x-mod
2421: #audio/x-startracker-module
2422: >0 string >\0 Title: "%s"
2423: 1080 string 4CHN 4-channel Fasttracker module sound data
2424: !:mime audio/x-mod
2425: #audio/x-fasttracker-module
2426: >0 string >\0 Title: "%s"
2427: 1080 string 6CHN 6-channel Fasttracker module sound data
2428: !:mime audio/x-mod
2429: #audio/x-fasttracker-module
2430: >0 string >\0 Title: "%s"
2431: 1080 string 8CHN 8-channel Fasttracker module sound data
2432: !:mime audio/x-mod
2433: #audio/x-fasttracker-module
2434: >0 string >\0 Title: "%s"
2435: 1080 string CD81 8-channel Octalyser module sound data
2436: !:mime audio/x-mod
2437: #audio/x-octalysertracker-module
2438: >0 string >\0 Title: "%s"
2439: 1080 string OKTA 8-channel Octalyzer module sound data
2440: !:mime audio/x-mod
2441: #audio/x-octalysertracker-module
2442: >0 string >\0 Title: "%s"
2443: # Not good enough.
2444: #1082 string CH
2445: #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
2446: 1080 string 16CN 16-channel Taketracker module sound data
2447: !:mime audio/x-mod
2448: #audio/x-taketracker-module
2449: >0 string >\0 Title: "%s"
2450: 1080 string 32CN 32-channel Taketracker module sound data
2451: !:mime audio/x-mod
2452: #audio/x-taketracker-module
2453: >0 string >\0 Title: "%s"
2454:
2455: # TOC sound files -Trevor Johnson <trevor@jpj.net>
2456: #
2457: 0 string TOC TOC sound file
2458:
2459: # sidfiles <pooka@iki.fi>
2460: # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
2461: 0 string SIDPLAY\ INFOFILE Sidplay info file
2462:
2463: 0 string PSID PlaySID v2.2+ (AMIGA) sidtune
2464: >4 beshort >0 w/ header v%d,
2465: >14 beshort =1 single song,
2466: >14 beshort >1 %d songs,
2467: >16 beshort >0 default song: %d
2468: >0x16 string >\0 name: "%s"
2469: >0x36 string >\0 author: "%s"
2470: >0x56 string >\0 copyright: "%s"
2471:
2472: 0 string RSID RSID sidtune PlaySID compatible
2473: >4 beshort >0 w/ header v%d,
2474: >14 beshort =1 single song,
2475: >14 beshort >1 %d songs,
2476: >16 beshort >0 default song: %d
2477: >0x16 string >\0 name: "%s"
2478: >0x36 string >\0 author: "%s"
2479: >0x56 string >\0 copyright: "%s"
2480:
2481: # IRCAM <mpruett@sgi.com>
2482: # VAX and MIPS files are little-endian; Sun and NeXT are big-endian
2483: 0 belong 0x64a30100 IRCAM file (VAX)
2484: 0 belong 0x64a30200 IRCAM file (Sun)
2485: 0 belong 0x64a30300 IRCAM file (MIPS little-endian)
2486: 0 belong 0x64a30400 IRCAM file (NeXT)
2487:
2488: # NIST SPHERE <mpruett@sgi.com>
2489: 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
2490:
2491: # Sample Vision <mpruett@sgi.com>
2492: 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
2493:
2494: # Audio Visual Research <tonigonenstein@users.sourceforge.net>
2495: 0 string 2BIT Audio Visual Research file,
2496: >12 beshort =0 mono,
2497: >12 beshort =-1 stereo,
2498: >14 beshort x %d bits
2499: >16 beshort =0 unsigned,
2500: >16 beshort =-1 signed,
2501: >22 belong&0x00ffffff x %d Hz,
2502: >18 beshort =0 no loop,
2503: >18 beshort =-1 loop,
2504: >21 ubyte <128 note %d,
2505: >22 byte =0 replay 5.485 KHz
2506: >22 byte =1 replay 8.084 KHz
2507: >22 byte =2 replay 10.971 Khz
2508: >22 byte =3 replay 16.168 Khz
2509: >22 byte =4 replay 21.942 KHz
2510: >22 byte =5 replay 32.336 KHz
2511: >22 byte =6 replay 43.885 KHz
2512: >22 byte =7 replay 47.261 KHz
2513:
2514: # SGI SoundTrack <mpruett@sgi.com>
2515: 0 string _SGI_SoundTrack SGI SoundTrack project file
2516: # ID3 version 2 tags <waschk@informatik.uni-rostock.de>
2517: 0 string ID3 Audio file with ID3 version 2.
2518: # ??? Normally such a file is an MP3 file, but this will give false positives
2519: !:mime audio/mpeg
2520: >3 ubyte <0xff \b%d
2521: #>4 ubyte <0xff \b%d tag
2522: >2584 string fLaC \b, FLAC encoding
2523: >>2588 byte&0x7f >0 \b, unknown version
2524: >>2588 byte&0x7f 0 \b
2525: # some common bits/sample values
2526: >>>2600 beshort&0x1f0 0x030 \b, 4 bit
2527: >>>2600 beshort&0x1f0 0x050 \b, 6 bit
2528: >>>2600 beshort&0x1f0 0x070 \b, 8 bit
2529: >>>2600 beshort&0x1f0 0x0b0 \b, 12 bit
2530: >>>2600 beshort&0x1f0 0x0f0 \b, 16 bit
2531: >>>2600 beshort&0x1f0 0x170 \b, 24 bit
2532: >>>2600 byte&0xe 0x0 \b, mono
2533: >>>2600 byte&0xe 0x2 \b, stereo
2534: >>>2600 byte&0xe 0x4 \b, 3 channels
2535: >>>2600 byte&0xe 0x6 \b, 4 channels
2536: >>>2600 byte&0xe 0x8 \b, 5 channels
2537: >>>2600 byte&0xe 0xa \b, 6 channels
2538: >>>2600 byte&0xe 0xc \b, 7 channels
2539: >>>2600 byte&0xe 0xe \b, 8 channels
2540: # some common sample rates
2541: >>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
2542: >>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz
2543: >>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz
2544: >>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz
2545: >>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz
2546: >>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz
2547: >>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz
2548: >>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz
2549: >>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz
2550: >>>2597 belong&0xfffff0 0x177000 \b, 96 kHz
2551: >>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz
2552: >>>2601 byte&0xf >0 \b, >4G samples
2553: >2584 string !fLaC \b, MP3 encoding
2554:
2555: # NSF (NES sound file) magic
2556: 0 string NESM\x1a NES Sound File
2557: >14 string >\0 ("%s" by
2558: >46 string >\0 %s, copyright
2559: >78 string >\0 %s),
2560: >5 byte x version %d,
2561: >6 byte x %d tracks,
2562: >122 byte&0x2 =1 dual PAL/NTSC
2563: >122 byte&0x1 =1 PAL
2564: >122 byte&0x1 =0 NTSC
2565:
2566: # Type: SNES SPC700 sound files
2567: # From: Josh Triplett <josh@freedesktop.org>
2568: 0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
2569: >&0 string 0.30 \b, version %s
2570: >>0x23 byte 0x1B \b, without ID666 tag
2571: >>0x23 byte 0x1A \b, with ID666 tag
2572: >>>0x2E string >\0 \b, song "%.32s"
2573: >>>0x4E string >\0 \b, game "%.32s"
2574:
2575: # Impulse tracker module (audio/x-it)
2576: 0 string IMPM Impulse Tracker module sound data -
2577: !:mime audio/x-mod
2578: >4 string >\0 "%s"
2579: >40 leshort !0 compatible w/ITv%x
2580: >42 leshort !0 created w/ITv%x
2581:
2582: # Imago Orpheus module (audio/x-imf)
2583: 60 string IM10 Imago Orpheus module sound data -
2584: >0 string >\0 "%s"
2585:
2586: # From <collver1@attbi.com>
2587: # These are the /etc/magic entries to decode modules, instruments, and
2588: # samples in Impulse Tracker's native format.
2589:
2590: 0 string IMPS Impulse Tracker Sample
2591: >18 byte &2 16 bit
2592: >18 byte ^2 8 bit
2593: >18 byte &4 stereo
2594: >18 byte ^4 mono
2595: 0 string IMPI Impulse Tracker Instrument
2596: >28 leshort !0 ITv%x
2597: >30 byte !0 %d samples
2598:
2599: # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
2600: # From <collver1@attbi.com>
2601: 0 string LM8953 Yamaha TX Wave
2602: >22 byte 0x49 looped
2603: >22 byte 0xC9 non-looped
2604: >23 byte 1 33kHz
2605: >23 byte 2 50kHz
2606: >23 byte 3 16kHz
2607:
2608: # scream tracker: file(1) magic for Scream Tracker sample files
2609: #
2610: # From <collver1@attbi.com>
2611: 76 string SCRS Scream Tracker Sample
2612: >0 byte 1 sample
2613: >0 byte 2 adlib melody
2614: >0 byte >2 adlib drum
2615: >31 byte &2 stereo
2616: >31 byte ^2 mono
2617: >31 byte &4 16bit little endian
2618: >31 byte ^4 8bit
2619: >30 byte 0 unpacked
2620: >30 byte 1 packed
2621:
2622: # audio
2623: # From: Cory Dikkers <cdikkers@swbell.net>
2624: 0 string MMD0 MED music file, version 0
2625: 0 string MMD1 OctaMED Pro music file, version 1
2626: 0 string MMD3 OctaMED Soundstudio music file, version 3
2627: 0 string OctaMEDCmpr OctaMED Soundstudio compressed file
2628: 0 string MED MED_Song
2629: 0 string SymM Symphonie SymMOD music file
2630: #
2631: 0 string THX AHX version
2632: >3 byte =0 1 module data
2633: >3 byte =1 2 module data
2634: #
2635: 0 string OKTASONG Oktalyzer module data
2636: #
2637: 0 string DIGI\ Booster\ module\0 %s
2638: >20 byte >0 %c
2639: >>21 byte >0 \b%c
2640: >>>22 byte >0 \b%c
2641: >>>>23 byte >0 \b%c
2642: >610 string >\0 \b, "%s"
2643: #
2644: 0 string DBM0 DIGI Booster Pro Module
2645: >4 byte >0 V%X.
2646: >>5 byte x \b%02X
2647: >16 string >\0 \b, "%s"
2648: #
2649: 0 string FTMN FaceTheMusic module
2650: >16 string >\0d \b, "%s"
2651:
2652: # From: <doj@cubic.org> 2003-06-24
2653: 0 string AMShdr\32 Velvet Studio AMS Module v2.2
2654: 0 string Extreme Extreme Tracker AMS Module v1.3
2655: 0 string DDMF Xtracker DMF Module
2656: >4 byte x v%i
2657: >0xD string >\0 Title: "%s"
2658: >0x2B string >\0 Composer: "%s"
2659: 0 string DSM\32 Dynamic Studio Module DSM
2660: 0 string SONG DigiTrekker DTM Module
2661: 0 string DMDL DigiTrakker MDL Module
2662: 0 string PSM\32 Protracker Studio PSM Module
2663: 44 string PTMF Poly Tracker PTM Module
2664: >0 string >\32 Title: "%s"
2665: 0 string MT20 MadTracker 2.0 Module MT2
2666: 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
2667: 0 string RTMM RTM Module
2668: 0x426 string MaDoKaN96 XMS Adlib Module
2669: >0 string >\0 Composer: "%s"
2670: 0 string AMF AMF Module
2671: >4 string >\0 Title: "%s"
2672: 0 string MODINFO1 Open Cubic Player Module Inforation MDZ
2673: 0 string Extended\40Instrument: Fast Tracker II Instrument
2674:
2675: # From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
2676: # NOA Nancy Codec file
2677: 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
2678: # Yamaha SMAF format
2679: 0 string MMMD Yamaha SMAF file
2680: # Sharp Jisaku Melody format for PDC
2681: 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
2682: >20 string Ver01.00 Ver. 1.00
2683: >>32 byte x , %d tracks
2684:
2685: # Free lossless audio codec <http://flac.sourceforge.net>
2686: # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
2687: 0 string fLaC FLAC audio bitstream data
2688: !:mime audio/x-flac
2689: >4 byte&0x7f >0 \b, unknown version
2690: >4 byte&0x7f 0 \b
2691: # some common bits/sample values
2692: >>20 beshort&0x1f0 0x030 \b, 4 bit
2693: >>20 beshort&0x1f0 0x050 \b, 6 bit
2694: >>20 beshort&0x1f0 0x070 \b, 8 bit
2695: >>20 beshort&0x1f0 0x0b0 \b, 12 bit
2696: >>20 beshort&0x1f0 0x0f0 \b, 16 bit
2697: >>20 beshort&0x1f0 0x170 \b, 24 bit
2698: >>20 byte&0xe 0x0 \b, mono
2699: >>20 byte&0xe 0x2 \b, stereo
2700: >>20 byte&0xe 0x4 \b, 3 channels
2701: >>20 byte&0xe 0x6 \b, 4 channels
2702: >>20 byte&0xe 0x8 \b, 5 channels
2703: >>20 byte&0xe 0xa \b, 6 channels
2704: >>20 byte&0xe 0xc \b, 7 channels
2705: >>20 byte&0xe 0xe \b, 8 channels
2706: # some common sample rates
2707: >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
2708: >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
2709: >>17 belong&0xfffff0 0x07d000 \b, 32 kHz
2710: >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
2711: >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
2712: >>17 belong&0xfffff0 0x03e800 \b, 16 kHz
2713: >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
2714: >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
2715: >>17 belong&0xfffff0 0x01f400 \b, 8 kHz
2716: >>17 belong&0xfffff0 0x177000 \b, 96 kHz
2717: >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
2718: >>21 byte&0xf >0 \b, >4G samples
2719: >>21 byte&0xf 0 \b
2720: >>>22 belong >0 \b, %u samples
2721: >>>22 belong 0 \b, length unknown
2722:
2723: # (ISDN) VBOX voice message file (Wolfram Kleff)
2724: 0 string VBOX VBOX voice message data
2725:
2726: # ReBorn Song Files (.rbs)
2727: # David J. Singer <doc@deadvirgins.org.uk>
2728: 8 string RB40 RBS Song file
2729: >29 string ReBorn created by ReBorn
2730: >37 string Propellerhead created by ReBirth
2731:
2732: # Synthesizer Generator and Kimwitu share their file format
2733: 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
2734: # Kimwitu++ uses a slightly different magic
2735: 0 string A#S#C#S#S#L#HUB Kimwitu++ data
2736:
2737: # From "Simon Hosie
2738: 0 string TFMX-SONG TFMX module sound data
2739:
2740: # Monkey's Audio compressed audio format (.ape)
2741: # From danny.milo@gmx.net (Danny Milosavljevic)
2742: # New version from Abel Cheung <abel (@) oaka.org>
2743: 0 string MAC\040 Monkey's Audio compressed format
2744: >4 uleshort >0x0F8B version %d
2745: >>(0x08.l) uleshort =1000 with fast compression
2746: >>(0x08.l) uleshort =2000 with normal compression
2747: >>(0x08.l) uleshort =3000 with high compression
2748: >>(0x08.l) uleshort =4000 with extra high compression
2749: >>(0x08.l) uleshort =5000 with insane compression
2750: >>(0x08.l+18) uleshort =1 \b, mono
2751: >>(0x08.l+18) uleshort =2 \b, stereo
2752: >>(0x08.l+20) ulelong x \b, sample rate %d
2753: >4 uleshort <0x0F8C version %d
2754: >>6 uleshort =1000 with fast compression
2755: >>6 uleshort =2000 with normal compression
2756: >>6 uleshort =3000 with high compression
2757: >>6 uleshort =4000 with extra high compression
2758: >>6 uleshort =5000 with insane compression
2759: >>10 uleshort =1 \b, mono
2760: >>10 uleshort =2 \b, stereo
2761: >>12 ulelong x \b, sample rate %d
2762:
2763: # adlib sound files
2764: # From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
2765: 0 string RAWADATA RdosPlay RAW
2766:
2767: 1068 string RoR AMUSIC Adlib Tracker
2768:
2769: 0 string JCH EdLib
2770:
2771: 0 string mpu401tr MPU-401 Trakker
2772:
2773: 0 string SAdT Surprise! Adlib Tracker
2774: >4 byte x Version %d
2775:
2776: 0 string XAD! eXotic ADlib
2777:
2778: 0 string ofTAZ! eXtra Simple Music
2779:
2780: # Spectrum 128 tunes (.ay files).
2781: # From: Emanuel Haupt <ehaupt@critical.ch>
2782: 0 string ZXAYEMUL Spectrum 128 tune
2783:
2784: 0 string \0BONK BONK,
2785: #>5 byte x version %d
2786: >14 byte x %d channel(s),
2787: >15 byte =1 lossless,
2788: >15 byte =0 lossy,
2789: >16 byte x mid-side
2790:
2791: 384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
2792:
2793: # format VQF (proprietary codec for sound)
2794: # some infos on the header file available at :
2795: # http://www.twinvq.org/english/technology_format.html
2796: 0 string TWIN97012000 VQF data
2797: >27 short 0 \b, Mono
2798: >27 short 1 \b, Stereo
2799: >31 short >0 \b, %d kbit/s
2800: >35 short >0 \b, %d kHz
2801:
2802: # Nelson A. de Oliveira (naoliv@gmail.com)
2803: # .eqf
2804: 0 string Winamp\ EQ\ library\ file %s
2805: # it will match only versions like v<digit>.<digit>
2806: # Since I saw only eqf files with version v1.1 I think that it's OK
2807: >23 string x \b%.4s
2808: # .preset
2809: 0 string [Equalizer\ preset] XMMS equalizer preset
2810: # .m3u
2811: 0 search/1 #EXTM3U M3U playlist text
2812: # .pls
2813: 0 search/1 [playlist] PLS playlist text
2814: # licq.conf
2815: 1 string [licq] LICQ configuration file
2816:
2817: # Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
2818: 0 string ICE! SNDH Atari ST music
2819: 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
2820:
2821: # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
2822: 0 string MP+ Musepack audio
2823: >3 byte 255 \b, SV pre8
2824: >3 byte&0xF 0x6 \b, SV 6
2825: >3 byte&0xF 0x8 \b, SV 8
2826: >3 byte&0xF 0x7 \b, SV 7
2827: >>3 byte&0xF0 0x0 \b.0
2828: >>3 byte&0xF0 0x10 \b.1
2829: >>3 byte&0xF0 240 \b.15
2830: >>10 byte&0xF0 0x0 \b, no profile
2831: >>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
2832: >>10 byte&0xF0 0x50 \b, quality 0
2833: >>10 byte&0xF0 0x60 \b, quality 1
2834: >>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
2835: >>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
2836: >>10 byte&0xF0 0x90 \b, quality 4 (Radio)
2837: >>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
2838: >>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
2839: >>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
2840: >>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
2841: >>10 byte&0xF0 0xE0 \b, quality 9
2842: >>10 byte&0xF0 0xF0 \b, quality 10
2843: >>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
2844: >>27 byte 102 \b, Beta 1.02
2845: >>27 byte 104 \b, Beta 1.04
2846: >>27 byte 105 \b, Alpha 1.05
2847: >>27 byte 106 \b, Beta 1.06
2848: >>27 byte 110 \b, Release 1.1
2849: >>27 byte 111 \b, Alpha 1.11
2850: >>27 byte 112 \b, Beta 1.12
2851: >>27 byte 113 \b, Alpha 1.13
2852: >>27 byte 114 \b, Beta 1.14
2853: >>27 byte 115 \b, Alpha 1.15
2854:
2855: # IMY
2856: # from http://filext.com/detaillist.php?extdetail=IMY
2857: # http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
2858: # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
2859: # http://www.wx800.com/msg/download/irda/iMelody.pdf
2860: 0 string BEGIN:IMELODY iMelody Ringtone Format
2861:
2862: # From: "Mateus Caruccio" <mateus@caruccio.com>
2863: # guitar pro v3,4,5 from http://filext.com/file-extension/gp3
2864: 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
2865:
2866: # From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
2867: 60 string SONG SoundFX Module sound file
2868:
2869: # Type: Adaptive Multi-Rate Codec
2870: # URL: http://filext.com/detaillist.php?extdetail=AMR
2871: # From: Russell Coker <russell@coker.com.au>
2872: 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
2873:
2874: # Type: SuperCollider 3 Synth Definition File Format
2875: # From: Mario Lang <mlang@debian.org>
2876: 0 string SCgf SuperCollider3 Synth Definition file,
2877: >4 belong x version %d
2878: #----------------------------------------------------------------
2879: # basis: file(1) magic for BBx/Pro5-files
2880: # Oliver Dammer <dammer@olida.de> 2005/11/07
2881: # http://www.basis.com business-basic-files.
2882: #
2883: 0 string \074\074bbx\076\076 BBx
2884: >7 string \000 indexed file
2885: >7 string \001 serial file
2886: >7 string \002 keyed file
2887: >>13 short 0 (sort)
2888: >7 string \004 program
2889: >>18 byte x (LEVEL %d)
2890: >>>23 string >\000 psaved
2891: >7 string \006 mkeyed file
2892: >>13 short 0 (sort)
2893: >>8 string \000 (mkey)
2894: #------------------------------------------------------------------------------
2895: # bFLT: file(1) magic for BFLT uclinux binary files
2896: #
2897: # From Philippe De Muyter <phdm@macqel.be>
2898: #
2899: 0 string bFLT BFLT executable
2900: >4 belong x - version %ld
2901: >4 belong 4
2902: >>36 belong&0x1 0x1 ram
2903: >>36 belong&0x2 0x2 gotpic
2904: >>36 belong&0x4 0x4 gzip
2905: >>36 belong&0x8 0x8 gzdata
2906: #------------------------------------------------------------------------------
2907: # blender: file(1) magic for Blender 3D related files
2908: #
2909: # Native format rule v1.2. For questions use the developers list
2910: # http://lists.blender.org/mailman/listinfo/bf-committers
2911: # GLOB chunk was moved near start and provides subversion info since 2.42
2912:
2913: 0 string =BLENDER Blender3D,
2914: >7 string =_ saved as 32-bits
2915: >>8 string =v little endian
2916: >>>9 byte x with version %c.
2917: >>>10 byte x \b%c
2918: >>>11 byte x \b%c
2919: >>>0x40 string =GLOB \b.
2920: >>>>0x58 leshort x \b%.4d
2921: >>8 string =V big endian
2922: >>>9 byte x with version %c.
2923: >>>10 byte x \b%c
2924: >>>11 byte x \b%c
2925: >>>0x40 string =GLOB \b.
2926: >>>>0x58 beshort x \b%.4d
2927: >7 string =- saved as 64-bits
2928: >>8 string =v little endian
2929: >>9 byte x with version %c.
2930: >>10 byte x \b%c
2931: >>11 byte x \b%c
2932: >>0x44 string =GLOB \b.
2933: >>>0x60 leshort x \b%.4d
2934: >>8 string =V big endian
2935: >>>9 byte x with version %c.
2936: >>>10 byte x \b%c
2937: >>>11 byte x \b%c
2938: >>>0x44 string =GLOB \b.
2939: >>>>0x60 beshort x \b%.4d
2940:
2941: # Scripts that run in the embeded Python interpreter
2942: 0 string #!BPY Blender3D BPython script
2943:
2944: #------------------------------------------------------------------------------
2945: # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
2946: #
2947: # Note that this 0407 conflicts with several other a.out formats...
2948: #
2949: # XXX - should this be redone with "be" and "le", so that it works on
2950: # little-endian machines as well? If so, what's the deal with
2951: # "VAX-order" and "VAX-order2"?
2952: #
2953: #0 long 0407 68K Blit (standalone) executable
2954: #0 short 0407 VAX-order2 68K Blit (standalone) executable
2955: 0 short 03401 VAX-order 68K Blit (standalone) executable
2956: 0 long 0406 68k Blit mpx/mux executable
2957: 0 short 0406 VAX-order2 68k Blit mpx/mux executable
2958: 0 short 03001 VAX-order 68k Blit mpx/mux executable
2959: # Need more values for WE32 DMD executables.
2960: # Note that 0520 is the same as COFF
2961: #0 short 0520 tty630 layers executable
2962: #
2963: # i80960 b.out objects and archives
2964: #
2965: 0 long 0x10d i960 b.out relocatable object
2966: >16 long >0 not stripped
2967: #
2968: # b.out archive (hp-rt on i960)
2969: 0 string =!<bout> b.out archive
2970: >8 string __.SYMDEF random library
2971: #------------------------------------------------------------------------------
2972: # bsdi: file(1) magic for BSD/OS (from BSDI) objects
2973: #
2974:
2975: 0 lelong 0314 386 compact demand paged pure executable
2976: >16 lelong >0 not stripped
2977: >32 byte 0x6a (uses shared libs)
2978:
2979: 0 lelong 0407 386 executable
2980: >16 lelong >0 not stripped
2981: >32 byte 0x6a (uses shared libs)
2982:
2983: 0 lelong 0410 386 pure executable
2984: >16 lelong >0 not stripped
2985: >32 byte 0x6a (uses shared libs)
2986:
2987: 0 lelong 0413 386 demand paged pure executable
2988: >16 lelong >0 not stripped
2989: >32 byte 0x6a (uses shared libs)
2990:
2991: # same as in SunOS 4.x, except for static shared libraries
2992: 0 belong&077777777 0600413 sparc demand paged
2993: >0 byte &0x80
2994: >>20 belong <4096 shared library
2995: >>20 belong =4096 dynamically linked executable
2996: >>20 belong >4096 dynamically linked executable
2997: >0 byte ^0x80 executable
2998: >16 belong >0 not stripped
2999: >36 belong 0xb4100001 (uses shared libs)
3000:
3001: 0 belong&077777777 0600410 sparc pure
3002: >0 byte &0x80 dynamically linked executable
3003: >0 byte ^0x80 executable
3004: >16 belong >0 not stripped
3005: >36 belong 0xb4100001 (uses shared libs)
3006:
3007: 0 belong&077777777 0600407 sparc
3008: >0 byte &0x80 dynamically linked executable
3009: >0 byte ^0x80 executable
3010: >16 belong >0 not stripped
3011: >36 belong 0xb4100001 (uses shared libs)
3012: #------------------------------------------------------------------------------
3013: # BTSnoop: file(1) magic for BTSnoop files
3014: #
3015: # From <marcel@holtmann.org>
3016: 0 string btsnoop\0 BTSnoop
3017: >8 belong x version %d,
3018: >12 belong 1001 Unencapsulated HCI
3019: >12 belong 1002 HCI UART (H4)
3020: >12 belong 1003 HCI BCSP
3021: >12 belong 1004 HCI Serial (H5)
3022: >>12 belong x type %d
3023: #------------------------------------------------------------------------------
3024: # c-lang: file(1) magic for C programs (or REXX)
3025: #
3026:
3027: # XPM icons (Greg Roelofs, newt@uchicago.edu)
3028: # if you uncomment "/*" for C/REXX below, also uncomment this entry
3029: #0 string /*\ XPM\ */ X pixmap image data
3030: #!:mime image/x-xpmi
3031:
3032: # 3DS (3d Studio files) Conflicts with diff output 0x3d '='
3033: #16 beshort 0x3d3d image/x-3ds
3034:
3035: # this first will upset you if you're a PL/1 shop...
3036: # in which case rm it; ascmagic will catch real C programs
3037: #0 search/1 /* C or REXX program text
3038: #0 search/1 // C++ program text
3039:
3040: # From: Mikhail Teterin <mi@aldan.algebra.com>
3041: 0 string cscope cscope reference data
3042: >7 string x version %.2s
3043: # We skip the path here, because it is often long (so file will
3044: # truncate it) and mostly redundant.
3045: # The inverted index functionality was added some time betwen
3046: # versions 11 and 15, so look for -q if version is above 14:
3047: >7 string >14
3048: >>10 search/100 \ -q\ with inverted index
3049: >10 search/100 \ -c\ text (non-compressed)
3050: #------------------------------------------------------------------------------
3051: # c64: file(1) magic for various commodore 64 related files
3052: #
3053: # From: Dirk Jagdmann <doj@cubic.org>
3054:
3055: 0x16500 belong 0x12014100 D64 Image
3056: 0x16500 belong 0x12014180 D71 Image
3057: 0x61800 belong 0x28034400 D81 Image
3058: 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
3059: 0 belong 0x43154164 X64 Image
3060:
3061: 0 string GCR-1541 GCR Image
3062: >8 byte x version: %i
3063: >9 byte x tracks: %i
3064:
3065: 9 string PSUR ARC archive (c64)
3066: 2 string -LH1- LHA archive (c64)
3067:
3068: 0 string C64File PC64 Emulator file
3069: >8 string >\0 "%s"
3070: 0 string C64Image PC64 Freezer Image
3071:
3072: 0 beshort 0x38CD C64 PCLink Image
3073: 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
3074:
3075: 0 belong 0xFF424CFF WRAptor packer (c64)
3076:
3077: 0 string C64S\x20tape\x20file T64 tape Image
3078: >32 leshort x Version:0x%x
3079: >36 leshort !0 Entries:%i
3080: >40 string x Name:%.24s
3081:
3082: 0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3083: >32 leshort x Version:0x%x
3084: >36 leshort !0 Entries:%i
3085: >40 string x Name:%.24s
3086:
3087: 0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3088: >32 leshort x Version:0x%x
3089: >36 leshort !0 Entries:%i
3090: >40 string x Name:%.24s
3091:
3092: #------------------------------------------------------------------------------
3093: # autocad: file(1) magic for cad files
3094: #
3095:
3096: # AutoCAD DWG versions R13/R14 (www.autodesk.com)
3097: # Written December 01, 2003 by Lester Hightower
3098: # Based on the DWG File Format Specifications at http://www.opendwg.org/
3099: 0 string \101\103\061\060\061 AutoCAD
3100: >5 string \062\000\000\000\000 DWG ver. R13
3101: >5 string \064\000\000\000\000 DWG ver. R14
3102:
3103: # Microstation DGN/CIT Files (www.bentley.com)
3104: # Last updated July 29, 2005 by Lester Hightower
3105: # DGN is the default file extension of Microstation/Intergraph CAD files.
3106: # CIT is the proprietary raster format (similar to TIFF) used to attach
3107: # raster underlays to Microstation DGN (vector) drawings.
3108: #
3109: # http://www.wotsit.org/search.asp
3110: # http://filext.com/detaillist.php?extdetail=DGN
3111: # http://filext.com/detaillist.php?extdetail=CIT
3112: #
3113: # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
3114: # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
3115: # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
3116: # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
3117: 0 string \010\011\376 Microstation
3118: >3 string \002
3119: >>30 string \026\105 DGNFile
3120: >>30 string \034\105 DGNFile
3121: >>30 string \073\107 DGNFile
3122: >>30 string \073\110 DGNFile
3123: >>30 string \106\107 DGNFile
3124: >>30 string \110\103 DGNFile
3125: >>30 string \120\104 DGNFile
3126: >>30 string \172\104 DGNFile
3127: >>30 string \172\105 DGNFile
3128: >>30 string \172\106 DGNFile
3129: >>30 string \234\106 DGNFile
3130: >>30 string \273\105 DGNFile
3131: >>30 string \306\106 DGNFile
3132: >>30 string \310\104 DGNFile
3133: >>30 string \341\104 DGNFile
3134: >>30 string \372\103 DGNFile
3135: >>30 string \372\104 DGNFile
3136: >>30 string \372\106 DGNFile
3137: >>30 string \376\103 DGNFile
3138: >4 string \030\000\000 CITFile
3139: >4 string \030\000\003 CITFile
3140:
3141: # AutoCad, from Nahuel Greco
3142: # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
3143: 0 string AC1012 AutoCad (release 12)
3144: 0 string AC1013 AutoCad (release 13)
3145: 0 string AC1014 AutoCad (release 14)
3146:
3147: # CAD: file(1) magic for computer aided design files
3148: # Phillip Griffith <phillip dot griffith at gmail dot com>
3149: # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
3150: #
3151: 0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
3152: 0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3153: 0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3154: 0 beshort 0x0809 Bentley/Intergraph MicroStation
3155: >0x02 byte 0xfe
3156: >>0x04 beshort 0x1800 CIT raster CAD
3157: 0 string AC1012 AutoDesk AutoCAD R13
3158: 0 string AC1014 AutoDesk AutoCAD R14
3159: 0 string AC1015 AutoDesk AutoCAD R2000
3160: #------------------------------------------------------------------------------
3161: # Cafe Babes unite!
3162: #
3163: # Since Java bytecode and Mach-O fat-files have the same magic number, the test
3164: # must be performed in the same "magic" sequence to get both right. The long
3165: # at offset 4 in a mach-O fat file tells the number of architectures; the short at
3166: # offset 4 in a Java bytecode file is the JVM minor version and the
3167: # short at offset 6 is the JVM major version. Since there are only
3168: # only 18 labeled Mach-O architectures at current, and the first released
3169: # Java class format was version 43.0, we can safely choose any number
3170: # between 18 and 39 to test the number of architectures against
3171: # (and use as a hack). Let's not use 18, because the Mach-O people
3172: # might add another one or two as time goes by...
3173: #
3174: 0 beshort 0xcafe
3175: >2 beshort 0xbabe
3176: !:mime application/x-java-applet
3177: >>2 belong >30 compiled Java class data,
3178: >>>6 beshort x version %d.
3179: >>>4 beshort x \b%d
3180: >>4 belong 1 Mach-O fat file with 1 architecture
3181: >>4 belong >1
3182: >>>4 belong <20 Mach-O fat file with %ld architectures
3183: >2 beshort 0xd00d JAR compressed with pack200,
3184: >>5 byte x version %d.
3185: >>4 byte x \b%d
3186: !:mime application/x-java-pack200
3187: #------------------------------------------------------------------------------
3188: # CDDB: file(1) magic for CDDB(tm) format CD text data files
3189: #
3190: # From <steve@gracenote.com>
3191: #
3192: # This is the /etc/magic entry to decode datafiles as used by
3193: # CDDB-enabled CD player applications.
3194: #
3195:
3196: 0 search/1/b #\040xmcd CDDB(tm) format CD text data
3197:
3198: #------------------------------------------------------------------------------
3199: # chord: file(1) magic for Chord music sheet typesetting utility input files
3200: #
3201: # From Philippe De Muyter <phdm@macqel.be>
3202: # File format is actually free, but many distributed files begin with `{title'
3203: #
3204: 0 string {title Chord text file
3205:
3206: # Type: PowerTab file format
3207: # URL: http://www.power-tab.net/
3208: # From: Jelmer Vernooij <jelmer@samba.org>
3209: 0 string ptab\003\000 Power-Tab v3 Tablature File
3210: 0 string ptab\004\000 Power-Tab v4 Tablature File
3211: #------------------------------------------------------------------------------
3212: # cisco: file(1) magic for cisco Systems routers
3213: #
3214: # Most cisco file-formats are covered by the generic elf code
3215: #
3216: # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
3217: 0 belong&0xffffff00 0x85011400 cisco IOS microcode
3218: >7 string >\0 for '%s'
3219: 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
3220: >7 string >\0 for '%s'
3221: #------------------------------------------------------------------------------
3222: # citrus locale declaration
3223: #
3224:
3225: 0 string RuneCT Citrus locale declaration for LC_CTYPE
3226:
3227:
3228: #------------------------------------------------------------------------------
3229: # clarion: file(1) magic for # Clarion Personal/Professional Developer
3230: # (v2 and above)
3231: # From: Julien Blache <jb@jblache.org>
3232:
3233: # Database files
3234: # signature
3235: 0 leshort 0x3343 Clarion Developer (v2 and above) data file
3236: # attributes
3237: >2 leshort &0x0001 \b, locked
3238: >2 leshort &0x0004 \b, encrypted
3239: >2 leshort &0x0008 \b, memo file exists
3240: >2 leshort &0x0010 \b, compressed
3241: >2 leshort &0x0040 \b, read only
3242: # number of records
3243: >5 lelong x \b, %ld records
3244:
3245: # Memo files
3246: 0 leshort 0x334d Clarion Developer (v2 and above) memo data
3247:
3248: # Key/Index files
3249: # No magic? :(
3250:
3251: # Help files
3252: 0 leshort 0x49e0 Clarion Developer (v2 and above) help data
3253:
3254: #------------------------------------------------------------------------------
3255: # claris: file(1) magic for claris
3256: # "H. Nanosecond" <aldomel@ix.netcom.com>
3257: # Claris Works a word processor, etc.
3258: # Version 3.0
3259:
3260: # .pct claris works clip art files
3261: #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
3262: #*
3263: #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
3264: #null to byte 1000 octal
3265: 514 string \377\377\377\377\000 Claris clip art?
3266: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
3267: 514 string \377\377\377\377\001 Claris clip art?
3268: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
3269:
3270: # Claris works files
3271: # .cwk
3272: 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
3273: # .plt
3274: 0 string \020\341\000\000\010\010 Claris Works pallete files .plt
3275:
3276: # .msp a dictionary file I am not sure about this I have only one .msp file
3277: 0 string \002\271\262\000\040\002\000\164 Claris works dictionary
3278:
3279: # .usp are user dictionary bits
3280: # I am not sure about a magic header:
3281: #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
3282: # soh S p f 8 U D sp ^ S cr nl p o d i
3283: #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
3284: # a t r i s t sp ^ S cr nl d i v sp #
3285:
3286: # .mth Thesaurus
3287: # starts with \0 but no magic header
3288:
3289: # .chy Hyphenation file
3290: # I am not sure: 000 210 034 000 000
3291:
3292: # other claris files
3293: #./windows/claris/useng.ndx: data
3294: #./windows/claris/xtndtran.l32: data
3295: #./windows/claris/xtndtran.lst: data
3296: #./windows/claris/clworks.lbl: data
3297: #./windows/claris/clworks.prf: data
3298: #./windows/claris/userd.spl: data
3299:
3300: #------------------------------------------------------------------------------
3301: # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
3302: #
3303: # XXX - what byte order does the Clipper use?
3304: #
3305: # XXX - what's the "!" stuff:
3306: #
3307: # >18 short !074000,000000 C1 R1
3308: # >18 short !074000,004000 C2 R1
3309: # >18 short !074000,010000 C3 R1
3310: # >18 short !074000,074000 TEST
3311: #
3312: # I shall assume it's ANDing the field with the first value and
3313: # comparing it with the second, and rewrite it as:
3314: #
3315: # >18 short&074000 000000 C1 R1
3316: # >18 short&074000 004000 C2 R1
3317: # >18 short&074000 010000 C3 R1
3318: # >18 short&074000 074000 TEST
3319: #
3320: # as SVR3.1's "file" doesn't support anything of the "!074000,000000"
3321: # sort, nor does SunOS 4.x, so either it's something Intergraph added
3322: # in CLIX, or something AT&T added in SVR3.2 or later, or something
3323: # somebody else thought was a good idea; it's not documented in the
3324: # man page for this version of "magic", nor does it appear to be
3325: # implemented (at least not after I blew off the bogus code to turn
3326: # old-style "&"s into new-style "&"s, which just didn't work at all).
3327: #
3328: 0 short 0575 CLIPPER COFF executable (VAX #)
3329: >20 short 0407 (impure)
3330: >20 short 0410 (5.2 compatible)
3331: >20 short 0411 (pure)
3332: >20 short 0413 (demand paged)
3333: >20 short 0443 (target shared library)
3334: >12 long >0 not stripped
3335: >22 short >0 - version %ld
3336: 0 short 0577 CLIPPER COFF executable
3337: >18 short&074000 000000 C1 R1
3338: >18 short&074000 004000 C2 R1
3339: >18 short&074000 010000 C3 R1
3340: >18 short&074000 074000 TEST
3341: >20 short 0407 (impure)
3342: >20 short 0410 (pure)
3343: >20 short 0411 (separate I&D)
3344: >20 short 0413 (paged)
3345: >20 short 0443 (target shared library)
3346: >12 long >0 not stripped
3347: >22 short >0 - version %ld
3348: >48 long&01 01 alignment trap enabled
3349: >52 byte 1 -Ctnc
3350: >52 byte 2 -Ctsw
3351: >52 byte 3 -Ctpw
3352: >52 byte 4 -Ctcb
3353: >53 byte 1 -Cdnc
3354: >53 byte 2 -Cdsw
3355: >53 byte 3 -Cdpw
3356: >53 byte 4 -Cdcb
3357: >54 byte 1 -Csnc
3358: >54 byte 2 -Cssw
3359: >54 byte 3 -Cspw
3360: >54 byte 4 -Cscb
3361: 4 string pipe CLIPPER instruction trace
3362: 4 string prof CLIPPER instruction profile
3363:
3364: #------------------------------------------------------------------------------
3365: # commands: file(1) magic for various shells and interpreters
3366: #
3367: #0 string : shell archive or script for antique kernel text
3368: 0 string/b #!\ /bin/sh POSIX shell script text executable
3369: !:mime text/x-shellscript
3370: 0 string/b #!\ /bin/csh C shell script text executable
3371: !:mime text/x-shellscript
3372: # korn shell magic, sent by George Wu, gwu@clyde.att.com
3373: 0 string/b #!\ /bin/ksh Korn shell script text executable
3374: !:mime text/x-shellscript
3375: 0 string/b #!\ /bin/tcsh Tenex C shell script text executable
3376: !:mime text/x-shellscript
3377: 0 string/b #!\ /usr/bin/tcsh Tenex C shell script text executable
3378: !:mime text/x-shellscript
3379: 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable
3380: !:mime text/x-shellscript
3381: 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable
3382: !:mime text/x-shellscript
3383:
3384: #
3385: # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
3386: 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable
3387: !:mime text/x-shellscript
3388: 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
3389: !:mime text/x-shellscript
3390: 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
3391: !:mime text/x-shellscript
3392: 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable
3393: !:mime text/x-shellscript
3394: 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable
3395: !:mime text/x-shellscript
3396: 0 string/b #!\ /bin/nawk new awk script text executable
3397: !:mime text/x-nawk
3398: 0 string/b #!\ /usr/bin/nawk new awk script text executable
3399: !:mime text/x-nawk
3400: 0 string/b #!\ /usr/local/bin/nawk new awk script text executable
3401: !:mime text/x-nawk
3402: 0 string/b #!\ /bin/gawk GNU awk script text executable
3403: !:mime text/x-gawk
3404: 0 string/b #!\ /usr/bin/gawk GNU awk script text executable
3405: !:mime text/x-gawk
3406: 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable
3407: !:mime text/x-gawk
3408: #
3409: 0 string/b #!\ /bin/awk awk script text executable
3410: !:mime text/x-awk
3411: 0 string/b #!\ /usr/bin/awk awk script text executable
3412: !:mime text/x-awk
3413: # update to distinguish from *.vcf files
3414: # this is broken because postscript has /EBEGIN{ for example.
3415: #0 search/Bb BEGIN { awk script text
3416: 0 regex =^\\s*BEGIN\\s*[{] awk script text
3417:
3418: # AT&T Bell Labs' Plan 9 shell
3419: 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable
3420:
3421: # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
3422: 0 string/b #!\ /bin/bash Bourne-Again shell script text executable
3423: !:mime text/x-shellscript
3424: 0 string/b #!\ /usr/bin/bash Bourne-Again shell script text executable
3425: !:mime text/x-shellscript
3426: 0 string/b #!\ /usr/local/bash Bourne-Again shell script text executable
3427: !:mime text/x-shellscript
3428: 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable
3429: !:mime text/x-shellscript
3430:
3431: # using env
3432: 0 string #!/usr/bin/env a
3433: >15 string >\0 %s script text executable
3434: 0 string #!\ /usr/bin/env a
3435: >16 string >\0 %s script text executable
3436:
3437: # PHP scripts
3438: # Ulf Harnhammar <ulfh@update.uu.se>
3439: 0 search/1/c =<?php PHP script text
3440: !:mime text/x-php
3441: 0 search/1 =<?\n PHP script text
3442: !:mime text/x-php
3443: 0 search/1 =<?\r PHP script text
3444: !:mime text/x-php
3445: 0 search/1/b #!\ /usr/local/bin/php PHP script text executable
3446: !:mime text/x-php
3447: 0 search/1/b #!\ /usr/bin/php PHP script text executable
3448: !:mime text/x-php
3449:
3450: 0 string Zend\x00 PHP script Zend Optimizer data
3451:
3452: 0 string $! DCL command file
3453:
3454: # Type: Pdmenu
3455: # URL: http://packages.debian.org/pdmenu
3456: # From: Edward Betts <edward@debian.org>
3457: 0 string #!/usr/bin/pdmenu Pdmenu configuration file text
3458:
3459: #----------------------------------------------------------------------------
3460: # communication
3461:
3462: # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
3463: # It is used for conformance testing of communication protocols.
3464: # Added by W. Borgert <debacle@debian.org>.
3465: 0 string $Suite TTCN Abstract Test Suite
3466: >&1 string $SuiteId
3467: >>&1 string >\n %s
3468: >&2 string $SuiteId
3469: >>&1 string >\n %s
3470: >&3 string $SuiteId
3471: >>&1 string >\n %s
3472:
3473: # MSC (message sequence charts) are a formal description technique,
3474: # described in ITU-T Z.120, mainly used for communication protocols.
3475: # Added by W. Borgert <debacle@debian.org>.
3476: 0 string mscdocument Message Sequence Chart (document)
3477: 0 string msc Message Sequence Chart (chart)
3478: 0 string submsc Message Sequence Chart (subchart)
3479:
3480: #------------------------------------------------------------------------------
3481: # compress: file(1) magic for pure-compression formats (no archives)
3482: #
3483: # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
3484: #
3485: # Formats for various forms of compressed data
3486: # Formats for "compress" proper have been moved into "compress.c",
3487: # because it tries to uncompress it to figure out what's inside.
3488:
3489: # standard unix compress
3490: 0 string \037\235 compress'd data
3491: !:mime application/x-compress
3492: >2 byte&0x80 >0 block compressed
3493: >2 byte&0x1f x %d bits
3494:
3495: # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
3496: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
3497: # * Original filename is only at offset 10 if "extra field" absent
3498: # * Produce shorter output - notably, only report compression methods
3499: # other than 8 ("deflate", the only method defined in RFC 1952).
3500: 0 string \037\213 gzip compressed data
3501: !:mime application/x-gzip
3502: >2 byte <8 \b, reserved method
3503: >2 byte >8 \b, unknown method
3504: >3 byte &0x01 \b, ASCII
3505: >3 byte &0x02 \b, has CRC
3506: >3 byte &0x04 \b, extra field
3507: >3 byte&0xC =0x08
3508: >>10 string x \b, was "%s"
3509: >3 byte &0x10 \b, has comment
3510: >9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
3511: >9 byte =0x01 \b, from Amiga
3512: >9 byte =0x02 \b, from VMS
3513: >9 byte =0x03 \b, from Unix
3514: >9 byte =0x04 \b, from VM/CMS
3515: >9 byte =0x05 \b, from Atari
3516: >9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
3517: >9 byte =0x07 \b, from MacOS
3518: >9 byte =0x08 \b, from Z-System
3519: >9 byte =0x09 \b, from CP/M
3520: >9 byte =0x0A \b, from TOPS/20
3521: >9 byte =0x0B \b, from NTFS filesystem (NT)
3522: >9 byte =0x0C \b, from QDOS
3523: >9 byte =0x0D \b, from Acorn RISCOS
3524: >3 byte &0x10 \b, comment
3525: >3 byte &0x20 \b, encrypted
3526: >4 ledate >0 \b, last modified: %s
3527: >8 byte 2 \b, max compression
3528: >8 byte 4 \b, max speed
3529:
3530: # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
3531: 0 string \037\036 packed data
3532: !:mime application/octet-stream
3533: >2 belong >1 \b, %d characters originally
3534: >2 belong =1 \b, %d character originally
3535: #
3536: # This magic number is byte-order-independent.
3537: 0 short 0x1f1f old packed data
3538: !:mime application/octet-stream
3539:
3540: # XXX - why *two* entries for "compacted data", one of which is
3541: # byte-order independent, and one of which is byte-order dependent?
3542: #
3543: 0 short 0x1fff compacted data
3544: !:mime application/octet-stream
3545: # This string is valid for SunOS (BE) and a matching "short" is listed
3546: # in the Ultrix (LE) magic file.
3547: 0 string \377\037 compacted data
3548: !:mime application/octet-stream
3549: 0 short 0145405 huf output
3550: !:mime application/octet-stream
3551:
3552: # bzip2
3553: 0 string BZh bzip2 compressed data
3554: !:mime application/x-bzip2
3555: >3 byte >47 \b, block size = %c00k
3556:
3557: # squeeze and crunch
3558: # Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
3559: 0 beshort 0x76FF squeezed data,
3560: >4 string x original name %s
3561: 0 beshort 0x76FE crunched data,
3562: >2 string x original name %s
3563: 0 beshort 0x76FD LZH compressed data,
3564: >2 string x original name %s
3565:
3566: # Freeze
3567: 0 string \037\237 frozen file 2.1
3568: 0 string \037\236 frozen file 1.0 (or gzip 0.5)
3569:
3570: # SCO compress -H (LZH)
3571: 0 string \037\240 SCO compress -H (LZH) data
3572:
3573: # European GSM 06.10 is a provisional standard for full-rate speech
3574: # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
3575: # excitation/long term prediction) coding at 13 kbit/s.
3576: #
3577: # There's only a magic nibble (4 bits); that nibble repeats every 33
3578: # bytes. This isn't suited for use, but maybe we can use it someday.
3579: #
3580: # This will cause very short GSM files to be declared as data and
3581: # mismatches to be declared as data too!
3582: #0 byte&0xF0 0xd0 data
3583: #>33 byte&0xF0 0xd0
3584: #>66 byte&0xF0 0xd0
3585: #>99 byte&0xF0 0xd0
3586: #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
3587:
3588: # bzip a block-sorting file compressor
3589: # by Julian Seward <sewardj@cs.man.ac.uk> and others
3590: #
3591: #0 string BZ bzip compressed data
3592: #>2 byte x \b, version: %c
3593: #>3 string =1 \b, compression block size 100k
3594: #>3 string =2 \b, compression block size 200k
3595: #>3 string =3 \b, compression block size 300k
3596: #>3 string =4 \b, compression block size 400k
3597: #>3 string =5 \b, compression block size 500k
3598: #>3 string =6 \b, compression block size 600k
3599: #>3 string =7 \b, compression block size 700k
3600: #>3 string =8 \b, compression block size 800k
3601: #>3 string =9 \b, compression block size 900k
3602:
3603: # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
3604: 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
3605: >9 beshort <0x0940
3606: >>9 byte&0xf0 =0x00 - version 0.
3607: >>9 beshort&0x0fff x \b%03x,
3608: >>13 byte 1 LZO1X-1,
3609: >>13 byte 2 LZO1X-1(15),
3610: >>13 byte 3 LZO1X-999,
3611: ## >>22 bedate >0 last modified: %s,
3612: >>14 byte =0x00 os: MS-DOS
3613: >>14 byte =0x01 os: Amiga
3614: >>14 byte =0x02 os: VMS
3615: >>14 byte =0x03 os: Unix
3616: >>14 byte =0x05 os: Atari
3617: >>14 byte =0x06 os: OS/2
3618: >>14 byte =0x07 os: MacOS
3619: >>14 byte =0x0A os: Tops/20
3620: >>14 byte =0x0B os: WinNT
3621: >>14 byte =0x0E os: Win32
3622: >9 beshort >0x0939
3623: >>9 byte&0xf0 =0x00 - version 0.
3624: >>9 byte&0xf0 =0x10 - version 1.
3625: >>9 byte&0xf0 =0x20 - version 2.
3626: >>9 beshort&0x0fff x \b%03x,
3627: >>15 byte 1 LZO1X-1,
3628: >>15 byte 2 LZO1X-1(15),
3629: >>15 byte 3 LZO1X-999,
3630: ## >>25 bedate >0 last modified: %s,
3631: >>17 byte =0x00 os: MS-DOS
3632: >>17 byte =0x01 os: Amiga
3633: >>17 byte =0x02 os: VMS
3634: >>17 byte =0x03 os: Unix
3635: >>17 byte =0x05 os: Atari
3636: >>17 byte =0x06 os: OS/2
3637: >>17 byte =0x07 os: MacOS
3638: >>17 byte =0x0A os: Tops/20
3639: >>17 byte =0x0B os: WinNT
3640: >>17 byte =0x0E os: Win32
3641:
3642: # 4.3BSD-Quasijarus Strong Compression
3643: # http://minnie.tuhs.org/Quasijarus/compress.html
3644: 0 string \037\241 Quasijarus strong compressed data
3645:
3646: # From: Cory Dikkers <cdikkers@swbell.net>
3647: 0 string XPKF Amiga xpkf.library compressed data
3648: 0 string PP11 Power Packer 1.1 compressed data
3649: 0 string PP20 Power Packer 2.0 compressed data,
3650: >4 belong 0x09090909 fast compression
3651: >4 belong 0x090A0A0A mediocre compression
3652: >4 belong 0x090A0B0B good compression
3653: >4 belong 0x090A0C0C very good compression
3654: >4 belong 0x090A0C0D best compression
3655:
3656: # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
3657: # http://www.7-zip.org or DOC/7zFormat.txt
3658: #
3659: 0 string 7z\274\257\047\034 7-zip archive data,
3660: >6 byte x version %d
3661: >7 byte x \b.%d
3662:
3663: # Type: LZMA
3664: # URL: http://www.7-zip.org/sdk.html
3665: # From: Robert Millan <rmh@aybabtu.com> and Reuben Thomas <rrt@sc3d.org>
3666: # Commented out because apparently not reliable (according to Debian
3667: # bug #364260)
3668: #0 string ]\000\000\200\000 LZMA compressed data
3669:
3670: # AFX compressed files (Wolfram Kleff)
3671: 2 string -afx- AFX compressed file data
3672:
3673: # Supplementary magic data for the file(1) command to support
3674: # rzip(1). The format is described in magic(5).
3675: #
3676: # Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
3677: # this file.
3678: #
3679: 0 string RZIP rzip compressed data
3680: >4 byte x - version %d
3681: >5 byte x \b.%d
3682: >6 belong x (%d bytes)
3683: #------------------------------------------------------------------------------
3684: # Console game magic
3685: # Toby Deshane <hac@shoelace.digivill.net>
3686: # ines: file(1) magic for Marat's iNES Nintendo Entertainment System
3687: # ROM dump format
3688:
3689: 0 string NES\032 iNES ROM dump,
3690: >4 byte x %dx16k PRG
3691: >5 byte x \b, %dx8k CHR
3692: >6 byte&0x01 =0x1 \b, [Vert.]
3693: >6 byte&0x01 =0x0 \b, [Horiz.]
3694: >6 byte&0x02 =0x2 \b, [SRAM]
3695: >6 byte&0x04 =0x4 \b, [Trainer]
3696: >6 byte&0x04 =0x8 \b, [4-Scr]
3697:
3698: #------------------------------------------------------------------------------
3699: # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
3700: #
3701: 0x104 belong 0xCEED6666 Gameboy ROM:
3702: >0x134 string >\0 "%.16s"
3703: >0x146 byte 0x03 \b,[SGB]
3704: >0x147 byte 0x00 \b, [ROM ONLY]
3705: >0x147 byte 0x01 \b, [ROM+MBC1]
3706: >0x147 byte 0x02 \b, [ROM+MBC1+RAM]
3707: >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
3708: >0x147 byte 0x05 \b, [ROM+MBC2]
3709: >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
3710: >0x147 byte 0x08 \b, [ROM+RAM]
3711: >0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
3712: >0x147 byte 0x0B \b, [ROM+MMM01]
3713: >0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
3714: >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
3715: >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
3716: >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
3717: >0x147 byte 0x11 \b, [ROM+MBC3]
3718: >0x147 byte 0x12 \b, [ROM+MBC3+RAM]
3719: >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
3720: >0x147 byte 0x19 \b, [ROM+MBC5]
3721: >0x147 byte 0x1A \b, [ROM+MBC5+RAM]
3722: >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
3723: >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
3724: >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
3725: >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
3726: >0x147 byte 0x1F \b, [Pocket Camera]
3727: >0x147 byte 0xFD \b, [Bandai TAMA5]
3728: >0x147 byte 0xFE \b, [Hudson HuC-3]
3729: >0x147 byte 0xFF \b, [Hudson HuC-1]
3730:
3731: >0x148 byte 0 \b, ROM: 256Kbit
3732: >0x148 byte 1 \b, ROM: 512Kbit
3733: >0x148 byte 2 \b, ROM: 1Mbit
3734: >0x148 byte 3 \b, ROM: 2Mbit
3735: >0x148 byte 4 \b, ROM: 4Mbit
3736: >0x148 byte 5 \b, ROM: 8Mbit
3737: >0x148 byte 6 \b, ROM: 16Mbit
3738: >0x148 byte 0x52 \b, ROM: 9Mbit
3739: >0x148 byte 0x53 \b, ROM: 10Mbit
3740: >0x148 byte 0x54 \b, ROM: 12Mbit
3741:
3742: >0x149 byte 1 \b, RAM: 16Kbit
3743: >0x149 byte 2 \b, RAM: 64Kbit
3744: >0x149 byte 3 \b, RAM: 128Kbit
3745: >0x149 byte 4 \b, RAM: 1Mbit
3746:
3747: #>0x14e long x \b, CRC: %x
3748:
3749: #------------------------------------------------------------------------------
3750: # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
3751: #
3752: 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
3753: >0x120 string >\0 Name: "%.16s"
3754: >0x110 string >\0 %.16s
3755: >0x1B0 string RA with SRAM
3756:
3757: #------------------------------------------------------------------------------
3758: # genesis: file(1) magic for the Super MegaDrive ROM dump format
3759: #
3760: 0x280 string EAGN Super MagicDrive ROM dump
3761: >0 byte x %dx16k blocks
3762: >2 byte 0 \b, last in series or standalone
3763: >2 byte >0 \b, split ROM
3764: >8 byte 0xAA
3765: >9 byte 0xBB
3766:
3767: #------------------------------------------------------------------------------
3768: # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
3769: #
3770: 0x280 string EAMG Super MagicDrive ROM dump
3771: >0 byte x %dx16k blocks
3772: >2 byte x \b, last in series or standalone
3773: >8 byte 0xAA
3774: >9 byte 0xBB
3775:
3776: #------------------------------------------------------------------------------
3777: # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
3778: #
3779: # Does not detect all images. Very preliminary guesswork. Need more data
3780: # on format.
3781: #
3782: # FIXME: need a little more info...;P
3783: #
3784: #0 byte 0xF3
3785: #>1 byte 0xED Sega Master System/Game Gear ROM dump
3786: #>1 byte 0x31 Sega Master System/Game Gear ROM dump
3787: #>1 byte 0xDB Sega Master System/Game Gear ROM dump
3788: #>1 byte 0xAF Sega Master System/Game Gear ROM dump
3789: #>1 byte 0xC3 Sega Master System/Game Gear ROM dump
3790:
3791: #------------------------------------------------------------------------------
3792: # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
3793: #
3794: 0 belong 0x21068028 Sega Dreamcast VMU game image
3795: 0 string LCDi Dream Animator file
3796:
3797: #------------------------------------------------------------------------------
3798: # v64: file(1) uncertain magic for the V64 format N64 ROM dumps
3799: #
3800: 0 belong 0x37804012 V64 Nintendo 64 ROM dump
3801:
3802: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3803: # Nintendo .nds
3804: 192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
3805: # Nintendo .gba
3806: 0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
3807:
3808: #------------------------------------------------------------------------------
3809: # msx: file(1) magic for MSX game cartridge dumps
3810: # Too simple - MPi
3811: #0 beshort 0x4142 MSX game cartridge dump
3812:
3813: #------------------------------------------------------------------------------
3814: # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
3815: 0 string PS-X\ EXE Sony Playstation executable
3816: # Area:
3817: >113 string x (%s)
3818:
3819: #------------------------------------------------------------------------------
3820: # Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
3821: 0 string XBEH XBE, Microsoft Xbox executable
3822: # probabilistic checks whether signed or not
3823: >0x0004 ulelong =0x0
3824: >>&2 ulelong =0x0
3825: >>>&2 ulelong =0x0 \b, not signed
3826: >0x0004 ulelong >0
3827: >>&2 ulelong >0
3828: >>>&2 ulelong >0 \b, signed
3829: # expect base address of 0x10000
3830: >0x0104 ulelong =0x10000
3831: >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
3832: >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
3833: >>>(0x0118-0x0FF60) ulelong >0 (regions:
3834: >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
3835: >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
3836: >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
3837: >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
3838: >>>(0x0118-0x0FF60) ulelong >0 \b)
3839:
3840: # --------------------------------
3841: # Microsoft Xbox data file formats
3842: 0 string XIP0 XIP, Microsoft Xbox data
3843: 0 string XTF0 XTF, Microsoft Xbox data
3844:
3845: # Atari Lynx cartridge dump (EXE/BLL header)
3846: # From: "Stefan A. Haubenthal" <polluks@web.de>
3847:
3848: 0 beshort 0x8008 Lynx cartridge,
3849: >2 beshort x RAM start $%04x
3850: >6 string BS93
3851:
3852: # Opera file system that is used on the 3DO console
3853: # From: Serge van den Boom <svdb@stack.nl>
3854: 0 string \x01ZZZZZ\x01 3DO "Opera" file system
3855:
3856: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
3857: 0 string GBS Nintendo Gameboy Music/Audio Data
3858: 12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
3859:
3860: # Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
3861: 0 string PPF30 Playstation Patch File version 3.0
3862: >5 byte 0 \b, PPF 1.0 patch
3863: >5 byte 1 \b, PPF 2.0 patch
3864: >5 byte 2 \b, PPF 3.0 patch
3865: >>56 byte 0 \b, Imagetype BIN (any)
3866: >>56 byte 1 \b, Imagetype GI (PrimoDVD)
3867: >>57 byte 0 \b, Blockcheck disabled
3868: >>57 byte 1 \b, Blockcheck enabled
3869: >>58 byte 0 \b, Undo data not available
3870: >>58 byte 1 \b, Undo data available
3871: >6 string x \b, description: %s
3872:
3873: 0 string PPF20 Playstation Patch File version 2.0
3874: >5 byte 0 \b, PPF 1.0 patch
3875: >5 byte 1 \b, PPF 2.0 patch
3876: >>56 lelong >0 \b, size of file to patch %d
3877: >6 string x \b, description: %s
3878:
3879: 0 string PPF10 Playstation Patch File version 1.0
3880: >5 byte 0 \b, Simple Encoding
3881: >6 string x \b, description: %s
3882:
3883: # From: Daniel Dawson <ddawson@icehouse.net>
3884: # SNES9x .smv "movie" file format.
3885: 0 string SMV\x1A SNES9x input recording
3886: >0x4 lelong x \b, version %d
3887: # version 4 is latest so far
3888: >0x4 lelong <5
3889: >>0x8 ledate x \b, recorded at %s
3890: >>0xc lelong >0 \b, rerecorded %d times
3891: >>0x10 lelong x \b, %d frames long
3892: >>0x14 byte >0 \b, data for controller(s):
3893: >>>0x14 byte &0x1 #1
3894: >>>0x14 byte &0x2 #2
3895: >>>0x14 byte &0x4 #3
3896: >>>0x14 byte &0x8 #4
3897: >>>0x14 byte &0x10 #5
3898: >>0x15 byte ^0x1 \b, begins from snapshot
3899: >>0x15 byte &0x1 \b, begins from reset
3900: >>0x15 byte ^0x2 \b, NTSC standard
3901: >>0x15 byte &0x2 \b, PAL standard
3902: >>0x17 byte &0x1 \b, settings:
3903: # WIP1Timing not used as of version 4
3904: >>>0x4 lelong <4
3905: >>>>0x17 byte &0x2 WIP1Timing
3906: >>>0x17 byte &0x4 Left+Right
3907: >>>0x17 byte &0x8 VolumeEnvX
3908: >>>0x17 byte &0x10 FakeMute
3909: >>>0x17 byte &0x20 SyncSound
3910: # New flag as of version 4
3911: >>>0x4 lelong >3
3912: >>>>0x17 byte &0x80 NoCPUShutdown
3913: >>0x4 lelong <4
3914: >>>0x18 lelong >0x23
3915: >>>>0x20 leshort !0
3916: >>>>>0x20 lestring16 x \b, metadata: "%s"
3917: >>0x4 lelong >3
3918: >>>0x24 byte >0 \b, port 1:
3919: >>>>0x24 byte 1 joypad
3920: >>>>0x24 byte 2 mouse
3921: >>>>0x24 byte 3 SuperScope
3922: >>>>0x24 byte 4 Justifier
3923: >>>>0x24 byte 5 multitap
3924: >>>0x24 byte >0 \b, port 2:
3925: >>>>0x25 byte 1 joypad
3926: >>>>0x25 byte 2 mouse
3927: >>>>0x25 byte 3 SuperScope
3928: >>>>0x25 byte 4 Justifier
3929: >>>>0x25 byte 5 multitap
3930: >>>0x18 lelong >0x43
3931: >>>>0x40 leshort !0
3932: >>>>>0x40 lestring16 x \b, metadata: "%s"
3933: >>0x17 byte &0x40 \b, ROM:
3934: >>>(0x18.l-26) lelong x CRC32 0x%08x
3935: >>>(0x18.l-23) string x "%s"
3936:
3937: # Type: scummVM savegame files
3938: # From: Sven Hartge <debian@ds9.argh.org>
3939: 0 string SCVM scummVM savegame
3940: >12 string >\0 "%s"
3941: #------------------------------------------------------------------------------
3942: # convex: file(1) magic for Convex boxes
3943: #
3944: # Convexes are big-endian.
3945: #
3946: # /*\
3947: # * Below are the magic numbers and tests added for Convex.
3948: # * Added at beginning, because they are expected to be used most.
3949: # \*/
3950: 0 belong 0507 Convex old-style object
3951: >16 belong >0 not stripped
3952: 0 belong 0513 Convex old-style demand paged executable
3953: >16 belong >0 not stripped
3954: 0 belong 0515 Convex old-style pre-paged executable
3955: >16 belong >0 not stripped
3956: 0 belong 0517 Convex old-style pre-paged, non-swapped executable
3957: >16 belong >0 not stripped
3958: 0 belong 0x011257 Core file
3959: #
3960: # The following are a series of dump format magic numbers. Each one
3961: # corresponds to a drastically different dump format. The first on is
3962: # the original dump format on a 4.1 BSD or earlier file system. The
3963: # second marks the change between the 4.1 file system and the 4.2 file
3964: # system. The Third marks the changing of the block size from 1K
3965: # to 2K to be compatible with an IDC file system. The fourth indicates
3966: # a dump that is dependent on Convex Storage Manager, because data in
3967: # secondary storage is not physically contained within the dump.
3968: # The restore program uses these number to determine how the data is
3969: # to be extracted.
3970: #
3971: 24 belong =60011 dump format, 4.1 BSD or earlier
3972: 24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
3973: 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
3974: 24 belong =60014 dump format, Convex Storage Manager by-reference dump
3975: #
3976: # what follows is a bunch of bit-mask checks on the flags field of the opthdr.
3977: # If there is no `=' sign, assume just checking for whether the bit is set?
3978: #
3979: 0 belong 0601 Convex SOFF
3980: >88 belong&0x000f0000 =0x00000000 c1
3981: >88 belong &0x00010000 c2
3982: >88 belong &0x00020000 c2mp
3983: >88 belong &0x00040000 parallel
3984: >88 belong &0x00080000 intrinsic
3985: >88 belong &0x00000001 demand paged
3986: >88 belong &0x00000002 pre-paged
3987: >88 belong &0x00000004 non-swapped
3988: >88 belong &0x00000008 POSIX
3989: #
3990: >84 belong &0x80000000 executable
3991: >84 belong &0x40000000 object
3992: >84 belong&0x20000000 =0 not stripped
3993: >84 belong&0x18000000 =0x00000000 native fpmode
3994: >84 belong&0x18000000 =0x10000000 ieee fpmode
3995: >84 belong&0x18000000 =0x18000000 undefined fpmode
3996: #
3997: 0 belong 0605 Convex SOFF core
3998: #
3999: 0 belong 0607 Convex SOFF checkpoint
4000: >88 belong&0x000f0000 =0x00000000 c1
4001: >88 belong &0x00010000 c2
4002: >88 belong &0x00020000 c2mp
4003: >88 belong &0x00040000 parallel
4004: >88 belong &0x00080000 intrinsic
4005: >88 belong &0x00000008 POSIX
4006: #
4007: >84 belong&0x18000000 =0x00000000 native fpmode
4008: >84 belong&0x18000000 =0x10000000 ieee fpmode
4009: >84 belong&0x18000000 =0x18000000 undefined fpmode
4010:
4011: #------------------------------------------------------------------------------
4012: # cracklib: file (1) magic for cracklib v2.7
4013:
4014: 0 lelong 0x70775631 Cracklib password index, little endian
4015: >4 long >0 (%i words)
4016: >4 long 0 ("64-bit")
4017: >>8 long >-1 (%i words)
4018: 0 belong 0x70775631 Cracklib password index, big endian
4019: >4 belong >-1 (%i words)
4020: # really bellong 0x0000000070775631
4021: 0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
4022: >12 belong >0 (%i words)
4023: # ----------------------------------------------------------------------------
4024: # ctags: file (1) magic for Exuberant Ctags files
4025: # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
4026: 0 search/1 =!_TAG Exuberant Ctags tag file text
4027:
4028: #------------------------------------------------------------------------------
4029: # dact: file(1) magic for DACT compressed files
4030: #
4031: 0 long 0x444354C3 DACT compressed data
4032: >4 byte >-1 (version %i.
4033: >5 byte >-1 $BS%i.
4034: >6 byte >-1 $BS%i)
4035: >7 long >0 $BS, original size: %i bytes
4036: >15 long >30 $BS, block size: %i bytes
4037:
4038: #------------------------------------------------------------------------------
4039: # database: file(1) magic for various databases
4040: #
4041: # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
4042: #
4043: #
4044: # GDBM magic numbers
4045: # Will be maintained as part of the GDBM distribution in the future.
4046: # <downsj@teeny.org>
4047: 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
4048: !:mime application/x-gdbm
4049: 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
4050: !:mime application/x-gdbm
4051: 0 string GDBM GNU dbm 2.x database
4052: !:mime application/x-gdbm
4053: #
4054: # Berkeley DB
4055: #
4056: # Ian Darwin's file /etc/magic files: big/little-endian version.
4057: #
4058: # Hash 1.85/1.86 databases store metadata in network byte order.
4059: # Btree 1.85/1.86 databases store the metadata in host byte order.
4060: # Hash and Btree 2.X and later databases store the metadata in host byte order.
4061:
4062: 0 long 0x00061561 Berkeley DB
4063: !:mime application/x-dbm
4064: >8 belong 4321
4065: >>4 belong >2 1.86
4066: >>4 belong <3 1.85
4067: >>4 belong >0 (Hash, version %d, native byte-order)
4068: >8 belong 1234
4069: >>4 belong >2 1.86
4070: >>4 belong <3 1.85
4071: >>4 belong >0 (Hash, version %d, little-endian)
4072:
4073: 0 belong 0x00061561 Berkeley DB
4074: >8 belong 4321
4075: >>4 belong >2 1.86
4076: >>4 belong <3 1.85
4077: >>4 belong >0 (Hash, version %d, big-endian)
4078: >8 belong 1234
4079: >>4 belong >2 1.86
4080: >>4 belong <3 1.85
4081: >>4 belong >0 (Hash, version %d, native byte-order)
4082:
4083: 0 long 0x00053162 Berkeley DB 1.85/1.86
4084: >4 long >0 (Btree, version %d, native byte-order)
4085: 0 belong 0x00053162 Berkeley DB 1.85/1.86
4086: >4 belong >0 (Btree, version %d, big-endian)
4087: 0 lelong 0x00053162 Berkeley DB 1.85/1.86
4088: >4 lelong >0 (Btree, version %d, little-endian)
4089:
4090: 12 long 0x00061561 Berkeley DB
4091: >16 long >0 (Hash, version %d, native byte-order)
4092: 12 belong 0x00061561 Berkeley DB
4093: >16 belong >0 (Hash, version %d, big-endian)
4094: 12 lelong 0x00061561 Berkeley DB
4095: >16 lelong >0 (Hash, version %d, little-endian)
4096:
4097: 12 long 0x00053162 Berkeley DB
4098: >16 long >0 (Btree, version %d, native byte-order)
4099: 12 belong 0x00053162 Berkeley DB
4100: >16 belong >0 (Btree, version %d, big-endian)
4101: 12 lelong 0x00053162 Berkeley DB
4102: >16 lelong >0 (Btree, version %d, little-endian)
4103:
4104: 12 long 0x00042253 Berkeley DB
4105: >16 long >0 (Queue, version %d, native byte-order)
4106: 12 belong 0x00042253 Berkeley DB
4107: >16 belong >0 (Queue, version %d, big-endian)
4108: 12 lelong 0x00042253 Berkeley DB
4109: >16 lelong >0 (Queue, version %d, little-endian)
4110:
4111: # From Max Bowsher.
4112: 12 long 0x00040988 Berkeley DB
4113: >16 long >0 (Log, version %d, native byte-order)
4114: 12 belong 0x00040988 Berkeley DB
4115: >16 belong >0 (Log, version %d, big-endian)
4116: 12 lelong 0x00040988 Berkeley DB
4117: >16 lelong >0 (Log, version %d, little-endian)
4118:
4119: #
4120: #
4121: # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
4122: 0 string RRD RRDTool DB
4123: >4 string x version %s
4124: #----------------------------------------------------------------------
4125: # ROOT: file(1) magic for ROOT databases
4126: #
4127: 0 string root\0 ROOT file
4128: >4 belong x Version %d
4129: >33 belong x (Compression: %d)
4130:
4131: # XXX: Weak magic.
4132: # Alex Ott <ott@jet.msk.su>
4133: ## Paradox file formats
4134: #2 leshort 0x0800 Paradox
4135: #>0x39 byte 3 v. 3.0
4136: #>0x39 byte 4 v. 3.5
4137: #>0x39 byte 9 v. 4.x
4138: #>0x39 byte 10 v. 5.x
4139: #>0x39 byte 11 v. 5.x
4140: #>0x39 byte 12 v. 7.x
4141: #>>0x04 byte 0 indexed .DB data file
4142: #>>0x04 byte 1 primary index .PX file
4143: #>>0x04 byte 2 non-indexed .DB data file
4144: #>>0x04 byte 3 non-incrementing secondary index .Xnn file
4145: #>>0x04 byte 4 secondary index .Ynn file
4146: #>>0x04 byte 5 incrementing secondary index .Xnn file
4147: #>>0x04 byte 6 non-incrementing secondary index .XGn file
4148: #>>0x04 byte 7 secondary index .YGn file
4149: #>>>0x04 byte 8 incrementing secondary index .XGn file
4150:
4151: ## XBase database files
4152: #0 byte 0x02
4153: #>8 leshort >0
4154: #>>12 leshort 0 FoxBase
4155: #!:mime application/x-dbf
4156: #>>>0x04 lelong 0 (no records)
4157: #>>>0x04 lelong >0 (%ld records)
4158: #
4159: #0 byte 0x03
4160: #!:mime application/x-dbf
4161: #>8 leshort >0
4162: #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
4163: #>>>0x04 lelong 0 (no records)
4164: #>>>0x04 lelong >0 (%ld records)
4165: #
4166: #0 byte 0x04
4167: #!:mime application/x-dbf
4168: #>8 leshort >0
4169: #>>12 leshort 0 dBASE IV no memo file
4170: #>>>0x04 lelong 0 (no records)
4171: #>>>0x04 lelong >0 (%ld records)
4172: #
4173: #0 byte 0x05
4174: #!:mime application/x-dbf
4175: #>8 leshort >0
4176: #>>12 leshort 0 dBASE V no memo file
4177: #>>>0x04 lelong 0 (no records)
4178: #>>>0x04 lelong >0 (%ld records)
4179: #
4180: #0 byte 0x30
4181: #!:mime application/x-dbf
4182: #>8 leshort >0
4183: #>>12 leshort 0 Visual FoxPro
4184: #>>>0x04 lelong 0 (no records)
4185: #>>>0x04 lelong >0 (%ld records)
4186: #
4187: #0 byte 0x43
4188: #!:mime application/x-dbf
4189: #>8 leshort >0
4190: #>>12 leshort 0 FlagShip with memo var size
4191: #>>>0x04 lelong 0 (no records)
4192: #>>>0x04 lelong >0 (%ld records)
4193: #
4194: #0 byte 0x7b
4195: #!:mime application/x-dbf
4196: #>8 leshort >0
4197: #>>12 leshort 0 dBASEIV with memo
4198: #>>>0x04 lelong 0 (no records)
4199: #>>>0x04 lelong >0 (%ld records)
4200: #
4201: #0 byte 0x83
4202: #!:mime application/x-dbf
4203: #>8 leshort >0
4204: #>>12 leshort 0 FoxBase+, dBaseIII+ with memo
4205: #>>>0x04 lelong 0 (no records)
4206: #>>>0x04 lelong >0 (%ld records)
4207: #
4208: #0 byte 0x8b
4209: #!:mime application/x-dbf
4210: #>8 leshort >0
4211: #>>12 leshort 0 dBaseIV with memo
4212: #>>>0x04 lelong 0 (no records)
4213: #>>>0x04 lelong >0 (%ld records)
4214: #
4215: #0 byte 0x8e
4216: #!:mime application/x-dbf
4217: #>8 leshort >0
4218: #>>12 leshort 0 dBaseIV with SQL Table
4219: #>>>0x04 lelong 0 (no records)
4220: #>>>0x04 lelong >0 (%ld records)
4221: #
4222: #0 byte 0xb3
4223: #!:mime application/x-dbf
4224: #>8 leshort >0
4225: #>>12 leshort 0 FlagShip with .dbt memo
4226: #>>>0x04 lelong 0 (no records)
4227: #>>>0x04 lelong >0 (%ld records)
4228: #
4229: #0 byte 0xf5
4230: #!:mime application/x-dbf
4231: #>8 leshort >0
4232: #>>12 leshort 0 FoxPro with memo
4233: #>>>0x04 lelong 0 (no records)
4234: #>>>0x04 lelong >0 (%ld records)
4235: #
4236: #0 leshort 0x0006 DBase 3 index file
4237:
4238: # MS Access database
4239: 4 string Standard\ Jet\ DB Microsoft Access Database
4240: !:mime application/x-msaccess
4241:
4242: # TDB database from Samba et al - Martin Pool <mbp@samba.org>
4243: 0 string TDB\ file TDB database
4244: >32 lelong 0x2601196D version 6, little-endian
4245: >>36 lelong x hash size %d bytes
4246:
4247: # SE Linux policy database
4248: 0 lelong 0xf97cff8c SE Linux policy
4249: >16 lelong x v%d
4250: >20 lelong 1 MLS
4251: >24 lelong x %d symbols
4252: >28 lelong x %d ocons
4253:
4254: # ICE authority file data (Wolfram Kleff)
4255: 2 string ICE ICE authority data
4256:
4257: # X11 Xauthority file (Wolfram Kleff)
4258: 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4259: 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4260: 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4261: 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4262: 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4263: 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4264: 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4265: 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4266: 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4267:
4268: # From: Maxime Henrion <mux@FreeBSD.org>
4269: # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
4270: 0 string PGDMP PostgreSQL custom database dump
4271: >5 byte x - v%d
4272: >6 byte x \b.%d
4273: >5 beshort <0x101 \b-0
4274: >5 beshort >0x100
4275: >>7 byte x \b-%d
4276:
4277: # Type: Advanced Data Format (ADF) database
4278: # URL: http://www.grc.nasa.gov/WWW/cgns/adf/
4279: # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
4280: 0 string @(#)ADF\ Database CGNS Advanced Data Format
4281:
4282: # Type: QDBM Quick Database Manager
4283: # From: Benoit Sibaud <bsibaud@april.org>
4284: 0 string \\[depot\\]\n\f Quick Database Manager, little endian
4285: 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
4286:
4287: # Type: TokyoCabinet database
4288: # URL: http://tokyocabinet.sourceforge.net/
4289: # From: Benoit Sibaud <bsibaud@april.org>
4290: 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
4291: >14 string x (version %s)
4292:
4293: #------------------------------------------------------------------------------
4294: # diamond: file(1) magic for Diamond system
4295: #
4296: # ... diamond is a multi-media mail and electronic conferencing system....
4297: #
4298: # XXX - I think it was either renamed Slate, or replaced by Slate....
4299: #
4300: # The full deal is too long...
4301: #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
4302: 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
4303: #------------------------------------------------------------------------------
4304: # diff: file(1) magic for diff(1) output
4305: #
4306: 0 search/1 diff\ diff output text
4307: !:mime text/x-diff
4308: 0 search/1 ***\ diff output text
4309: !:mime text/x-diff
4310: 0 search/1 Only\ in\ diff output text
4311: !:mime text/x-diff
4312: 0 search/1 Common\ subdirectories:\ diff output text
4313: !:mime text/x-diff
4314:
4315: 0 search/1 Index: RCS/CVS diff output text
4316: !:mime text/x-diff
4317: # Digital UNIX - Info
4318: #
4319: 0 string =!<arch>\n________64E Alpha archive
4320: >22 string X -- out of date
4321: #
4322: # Alpha COFF Based Executables
4323: # The stripped stuff really needs to be an 8 byte (64 bit) compare,
4324: # but this works
4325: 0 leshort 0x183 COFF format alpha
4326: >22 leshort&020000 &010000 sharable library,
4327: >22 leshort&020000 ^010000 dynamically linked,
4328: >24 leshort 0410 pure
4329: >24 leshort 0413 demand paged
4330: >8 lelong >0 executable or object module, not stripped
4331: >8 lelong 0
4332: >>12 lelong 0 executable or object module, stripped
4333: >>12 lelong >0 executable or object module, not stripped
4334: >27 byte >0 - version %d.
4335: >26 byte >0 %d-
4336: >28 leshort >0 %d
4337: #
4338: # The next is incomplete, we could tell more about this format,
4339: # but its not worth it.
4340: 0 leshort 0x188 Alpha compressed COFF
4341: 0 leshort 0x18f Alpha u-code object
4342: #
4343: #
4344: # Some other interesting Digital formats,
4345: 0 string \377\377\177 ddis/ddif
4346: 0 string \377\377\174 ddis/dots archive
4347: 0 string \377\377\176 ddis/dtif table data
4348: 0 string \033c\033 LN03 output
4349: 0 long 04553207 X image
4350: #
4351: 0 string =!<PDF>!\n profiling data file
4352: #
4353: # Locale data tables (MIPS and Alpha).
4354: #
4355: 0 short 0x0501 locale data table
4356: >6 short 0x24 for MIPS
4357: >6 short 0x40 for Alpha
4358: # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
4359: # from http://www.atsc.org/standards/a_52a.pdf
4360: # corrections, additions, etc. are always welcome!
4361: #
4362: # syncword
4363: 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
4364: # fscod
4365: >4 byte&0xc0 0x00 48 kHz,
4366: >4 byte&0xc0 0x40 44.1 kHz,
4367: >4 byte&0xc0 0x80 32 kHz,
4368: # is this one used for 96 kHz?
4369: >4 byte&0xc0 0xc0 reserved frequency,
4370: #
4371: >5 byte&7 = 0 \b, complete main (CM)
4372: >5 byte&7 = 1 \b, music and effects (ME)
4373: >5 byte&7 = 2 \b, visually impaired (VI)
4374: >5 byte&7 = 3 \b, hearing impaired (HI)
4375: >5 byte&7 = 4 \b, dialogue (D)
4376: >5 byte&7 = 5 \b, commentary (C)
4377: >5 byte&7 = 6 \b, emergency (E)
4378: # acmod
4379: >6 byte&0xe0 0x00 1+1 front,
4380: >6 byte&0xe0 0x20 1 front/0 rear,
4381: >6 byte&0xe0 0x40 2 front/0 rear,
4382: >6 byte&0xe0 0x60 3 front/0 rear,
4383: >6 byte&0xe0 0x80 2 front/1 rear,
4384: >6 byte&0xe0 0xa0 3 front/1 rear,
4385: >6 byte&0xe0 0xc0 2 front/2 rear,
4386: >6 byte&0xe0 0xe0 3 front/2 rear,
4387: # lfeon (these may be incorrect)
4388: >7 byte&0x40 0x00 LFE off,
4389: >7 byte&0x40 0x40 LFE on,
4390: #
4391: >4 byte&0x3e = 0x00 \b, 32 kbit/s
4392: >4 byte&0x3e = 0x02 \b, 40 kbit/s
4393: >4 byte&0x3e = 0x04 \b, 48 kbit/s
4394: >4 byte&0x3e = 0x06 \b, 56 kbit/s
4395: >4 byte&0x3e = 0x08 \b, 64 kbit/s
4396: >4 byte&0x3e = 0x0a \b, 80 kbit/s
4397: >4 byte&0x3e = 0x0c \b, 96 kbit/s
4398: >4 byte&0x3e = 0x0e \b, 112 kbit/s
4399: >4 byte&0x3e = 0x10 \b, 128 kbit/s
4400: >4 byte&0x3e = 0x12 \b, 160 kbit/s
4401: >4 byte&0x3e = 0x14 \b, 192 kbit/s
4402: >4 byte&0x3e = 0x16 \b, 224 kbit/s
4403: >4 byte&0x3e = 0x18 \b, 256 kbit/s
4404: >4 byte&0x3e = 0x1a \b, 320 kbit/s
4405: >4 byte&0x3e = 0x1c \b, 384 kbit/s
4406: >4 byte&0x3e = 0x1e \b, 448 kbit/s
4407: >4 byte&0x3e = 0x20 \b, 512 kbit/s
4408: >4 byte&0x3e = 0x22 \b, 576 kbit/s
4409: >4 byte&0x3e = 0x24 \b, 640 kbit/s
4410: # dsurmod (these may be incorrect)
4411: >6 beshort&0x0180 0x0000 Dolby Surround not indicated
4412: >6 beshort&0x0180 0x0080 not Dolby Surround encoded
4413: >6 beshort&0x0180 0x0100 Dolby Surround encoded
4414: >6 beshort&0x0180 0x0180 reserved Dolby Surround mode
4415:
4416: #------------------------------------------------------------------------------
4417: # dump: file(1) magic for dump file format--for new and old dump filesystems
4418: #
4419: # We specify both byte orders in order to recognize byte-swapped dumps.
4420: #
4421: 24 belong 60012 new-fs dump file (big endian),
4422: >4 bedate x Previous dump %s,
4423: >8 bedate x This dump %s,
4424: >12 belong >0 Volume %ld,
4425: >692 belong 0 Level zero, type:
4426: >692 belong >0 Level %d, type:
4427: >0 belong 1 tape header,
4428: >0 belong 2 beginning of file record,
4429: >0 belong 3 map of inodes on tape,
4430: >0 belong 4 continuation of file record,
4431: >0 belong 5 end of volume,
4432: >0 belong 6 map of inodes deleted,
4433: >0 belong 7 end of medium (for floppy),
4434: >676 string >\0 Label %s,
4435: >696 string >\0 Filesystem %s,
4436: >760 string >\0 Device %s,
4437: >824 string >\0 Host %s,
4438: >888 belong >0 Flags %x
4439:
4440: 24 belong 60011 old-fs dump file (big endian),
4441: #>4 bedate x Previous dump %s,
4442: #>8 bedate x This dump %s,
4443: >12 belong >0 Volume %ld,
4444: >692 belong 0 Level zero, type:
4445: >692 belong >0 Level %d, type:
4446: >0 belong 1 tape header,
4447: >0 belong 2 beginning of file record,
4448: >0 belong 3 map of inodes on tape,
4449: >0 belong 4 continuation of file record,
4450: >0 belong 5 end of volume,
4451: >0 belong 6 map of inodes deleted,
4452: >0 belong 7 end of medium (for floppy),
4453: >676 string >\0 Label %s,
4454: >696 string >\0 Filesystem %s,
4455: >760 string >\0 Device %s,
4456: >824 string >\0 Host %s,
4457: >888 belong >0 Flags %x
4458:
4459: 24 lelong 60012 new-fs dump file (little endian),
4460: >4 ledate x This dump %s,
4461: >8 ledate x Previous dump %s,
4462: >12 lelong >0 Volume %ld,
4463: >692 lelong 0 Level zero, type:
4464: >692 lelong >0 Level %d, type:
4465: >0 lelong 1 tape header,
4466: >0 lelong 2 beginning of file record,
4467: >0 lelong 3 map of inodes on tape,
4468: >0 lelong 4 continuation of file record,
4469: >0 lelong 5 end of volume,
4470: >0 lelong 6 map of inodes deleted,
4471: >0 lelong 7 end of medium (for floppy),
4472: >676 string >\0 Label %s,
4473: >696 string >\0 Filesystem %s,
4474: >760 string >\0 Device %s,
4475: >824 string >\0 Host %s,
4476: >888 lelong >0 Flags %x
4477:
4478: 24 lelong 60011 old-fs dump file (little endian),
4479: #>4 ledate x Previous dump %s,
4480: #>8 ledate x This dump %s,
4481: >12 lelong >0 Volume %ld,
4482: >692 lelong 0 Level zero, type:
4483: >692 lelong >0 Level %d, type:
4484: >0 lelong 1 tape header,
4485: >0 lelong 2 beginning of file record,
4486: >0 lelong 3 map of inodes on tape,
4487: >0 lelong 4 continuation of file record,
4488: >0 lelong 5 end of volume,
4489: >0 lelong 6 map of inodes deleted,
4490: >0 lelong 7 end of medium (for floppy),
4491: >676 string >\0 Label %s,
4492: >696 string >\0 Filesystem %s,
4493: >760 string >\0 Device %s,
4494: >824 string >\0 Host %s,
4495: >888 lelong >0 Flags %x
4496:
4497: 18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
4498: >2 medate x Previous dump %s,
4499: >6 medate x This dump %s,
4500: >10 leshort >0 Volume %ld,
4501: >0 leshort 1 tape header.
4502: >0 leshort 2 beginning of file record.
4503: >0 leshort 3 map of inodes on tape.
4504: >0 leshort 4 continuation of file record.
4505: >0 leshort 5 end of volume.
4506: >0 leshort 6 map of inodes deleted.
4507: >0 leshort 7 end of medium (for floppy).
4508:
4509: 24 belong 0x19540119 new-fs dump file (ufs2, big endian),
4510: >896 beqdate x Previous dump %s,
4511: >904 beqdate x This dump %s,
4512: >12 belong >0 Volume %ld,
4513: >692 belong 0 Level zero, type:
4514: >692 belong >0 Level %d, type:
4515: >0 belong 1 tape header,
4516: >0 belong 2 beginning of file record,
4517: >0 belong 3 map of inodes on tape,
4518: >0 belong 4 continuation of file record,
4519: >0 belong 5 end of volume,
4520: >0 belong 6 map of inodes deleted,
4521: >0 belong 7 end of medium (for floppy),
4522: >676 string >\0 Label %s,
4523: >696 string >\0 Filesystem %s,
4524: >760 string >\0 Device %s,
4525: >824 string >\0 Host %s,
4526: >888 belong >0 Flags %x
4527:
4528: 24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
4529: >896 leqdate x This dump %s,
4530: >904 leqdate x Previous dump %s,
4531: >12 lelong >0 Volume %ld,
4532: >692 lelong 0 Level zero, type:
4533: >692 lelong >0 Level %d, type:
4534: >0 lelong 1 tape header,
4535: >0 lelong 2 beginning of file record,
4536: >0 lelong 3 map of inodes on tape,
4537: >0 lelong 4 continuation of file record,
4538: >0 lelong 5 end of volume,
4539: >0 lelong 6 map of inodes deleted,
4540: >0 lelong 7 end of medium (for floppy),
4541: >676 string >\0 Label %s,
4542: >696 string >\0 Filesystem %s,
4543: >760 string >\0 Device %s,
4544: >824 string >\0 Host %s,
4545: >888 lelong >0 Flags %x
4546:
4547: #------------------------------------------------------------------------------
4548: # Dyadic: file(1) magic for Dyalog APL.
4549: #
4550: 0 byte 0xaa
4551: >1 byte <4 Dyalog APL
4552: >>1 byte 0x00 incomplete workspace
4553: >>1 byte 0x01 component file
4554: >>1 byte 0x02 external variable
4555: >>1 byte 0x03 workspace
4556: >>2 byte x version %d
4557: >>3 byte x .%d
4558:
4559: #------------------------------------------------------------------------------
4560: # T602 editor documents
4561: # by David Necas <yeti@physics.muni.cz>
4562: 0 string @CT\ T602 document data,
4563: >4 string 0 Kamenicky
4564: >4 string 1 CP 852
4565: >4 string 2 KOI8-CS
4566: >4 string >2 unknown encoding
4567:
4568: # Vi IMproved Encrypted file
4569: # by David Necas <yeti@physics.muni.cz>
4570: 0 string VimCrypt~ Vim encrypted file data
4571: # Vi IMproved Swap file
4572: # by Sven Wegener <swegener@gentoo.org>
4573: 0 string b0VIM\ Vim swap file
4574: >&0 string >\0 \b, version %s
4575:
4576: #------------------------------------------------------------------------------
4577: # efi: file(1) magic for Universal EFI binaries
4578:
4579: 0 lelong 0x0ef1fab9
4580: >4 lelong 1 Universal EFI binary with 1 architecture
4581: >>&0 lelong 7 \b, i386
4582: >>&0 lelong 0x01000007 \b, x86_64
4583: >4 lelong 2 Universal EFI binary with 2 architectures
4584: >>&0 lelong 7 \b, i386
4585: >>&0 lelong 0x01000007 \b, x86_64
4586: >>&20 lelong 7 \b, i386
4587: >>&20 lelong 0x01000007 \b, x86_64
4588: >4 lelong >2 Universal EFI binary with %ld architectures
4589:
4590: #------------------------------------------------------------------------------
4591: # elf: file(1) magic for ELF executables
4592: #
4593: # We have to check the byte order flag to see what byte order all the
4594: # other stuff in the header is in.
4595: #
4596: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
4597: #
4598: # Created by: unknown
4599: # Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
4600: # Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
4601: # Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
4602: # Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
4603: # Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
4604: 0 string \177ELF ELF
4605: >4 byte 0 invalid class
4606: >4 byte 1 32-bit
4607: >4 byte 2 64-bit
4608: >5 byte 0 invalid byte order
4609: >5 byte 1 LSB
4610: >>16 leshort 0 no file type,
4611: !:strength *2
4612: !:mime application/octet-stream
4613: >>16 leshort 1 relocatable,
4614: !:mime application/x-object
4615: >>16 leshort 2 executable,
4616: !:mime application/x-executable
4617: >>16 leshort 3 shared object,
4618: !:mime application/x-sharedlib
4619: >>16 leshort 4 core file
4620: !:mime application/x-coredump
4621: # Core file detection is not reliable.
4622: #>>>(0x38+0xcc) string >\0 of '%s'
4623: #>>>(0x38+0x10) lelong >0 (signal %d),
4624: >>16 leshort &0xff00 processor-specific,
4625: >>18 leshort 0 no machine,
4626: >>18 leshort 1 AT&T WE32100 - invalid byte order,
4627: >>18 leshort 2 SPARC - invalid byte order,
4628: >>18 leshort 3 Intel 80386,
4629: >>18 leshort 4 Motorola
4630: >>>36 lelong &0x01000000 68000 - invalid byte order,
4631: >>>36 lelong &0x00810000 CPU32 - invalid byte order,
4632: >>>36 lelong 0 68020 - invalid byte order,
4633: >>18 leshort 5 Motorola 88000 - invalid byte order,
4634: >>18 leshort 6 Intel 80486,
4635: >>18 leshort 7 Intel 80860,
4636: # The official e_machine number for MIPS is now #8, regardless of endianness.
4637: # The second number (#10) will be deprecated later. For now, we still
4638: # say something if #10 is encountered, but only gory details for #8.
4639: >>18 leshort 8 MIPS,
4640: >>>36 lelong &0x20 N32
4641: >>18 leshort 10 MIPS,
4642: >>>36 lelong &0x20 N32
4643: >>18 leshort 8
4644: # only for 32-bit
4645: >>>4 byte 1
4646: >>>>36 lelong&0xf0000000 0x00000000 MIPS-I
4647: >>>>36 lelong&0xf0000000 0x10000000 MIPS-II
4648: >>>>36 lelong&0xf0000000 0x20000000 MIPS-III
4649: >>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
4650: >>>>36 lelong&0xf0000000 0x40000000 MIPS-V
4651: >>>>36 lelong&0xf0000000 0x50000000 MIPS32
4652: >>>>36 lelong&0xf0000000 0x60000000 MIPS64
4653: >>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
4654: >>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
4655: # only for 64-bit
4656: >>>4 byte 2
4657: >>>>48 lelong&0xf0000000 0x00000000 MIPS-I
4658: >>>>48 lelong&0xf0000000 0x10000000 MIPS-II
4659: >>>>48 lelong&0xf0000000 0x20000000 MIPS-III
4660: >>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
4661: >>>>48 lelong&0xf0000000 0x40000000 MIPS-V
4662: >>>>48 lelong&0xf0000000 0x50000000 MIPS32
4663: >>>>48 lelong&0xf0000000 0x60000000 MIPS64
4664: >>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
4665: >>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
4666: >>18 leshort 9 Amdahl - invalid byte order,
4667: >>18 leshort 10 MIPS (deprecated),
4668: >>18 leshort 11 RS6000 - invalid byte order,
4669: >>18 leshort 15 PA-RISC - invalid byte order,
4670: >>>50 leshort 0x0214 2.0
4671: >>>48 leshort &0x0008 (LP64),
4672: >>18 leshort 16 nCUBE,
4673: >>18 leshort 17 Fujitsu VPP500,
4674: >>18 leshort 18 SPARC32PLUS - invalid byte order,
4675: >>18 leshort 20 PowerPC,
4676: >>18 leshort 22 IBM S/390,
4677: >>18 leshort 36 NEC V800,
4678: >>18 leshort 37 Fujitsu FR20,
4679: >>18 leshort 38 TRW RH-32,
4680: >>18 leshort 39 Motorola RCE,
4681: >>18 leshort 40 ARM,
4682: >>18 leshort 41 Alpha,
4683: >>18 leshort 0xa390 IBM S/390 (obsolete),
4684: >>18 leshort 42 Renesas SH,
4685: >>18 leshort 43 SPARC V9 - invalid byte order,
4686: >>18 leshort 44 Siemens Tricore Embedded Processor,
4687: >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
4688: >>18 leshort 46 Renesas H8/300,
4689: >>18 leshort 47 Renesas H8/300H,
4690: >>18 leshort 48 Renesas H8S,
4691: >>18 leshort 49 Renesas H8/500,
4692: >>18 leshort 50 IA-64,
4693: >>18 leshort 51 Stanford MIPS-X,
4694: >>18 leshort 52 Motorola Coldfire,
4695: >>18 leshort 53 Motorola M68HC12,
4696: >>18 leshort 54 Fujitsu MMA,
4697: >>18 leshort 55 Siemens PCP,
4698: >>18 leshort 56 Sony nCPU,
4699: >>18 leshort 57 Denso NDR1,
4700: >>18 leshort 58 Start*Core,
4701: >>18 leshort 59 Toyota ME16,
4702: >>18 leshort 60 ST100,
4703: >>18 leshort 61 Tinyj emb.,
4704: >>18 leshort 62 x86-64,
4705: >>18 leshort 63 Sony DSP,
4706: >>18 leshort 66 FX66,
4707: >>18 leshort 67 ST9+ 8/16 bit,
4708: >>18 leshort 68 ST7 8 bit,
4709: >>18 leshort 69 MC68HC16,
4710: >>18 leshort 70 MC68HC11,
4711: >>18 leshort 71 MC68HC08,
4712: >>18 leshort 72 MC68HC05,
4713: >>18 leshort 73 SGI SVx,
4714: >>18 leshort 74 ST19 8 bit,
4715: >>18 leshort 75 Digital VAX,
4716: >>18 leshort 76 Axis cris,
4717: >>18 leshort 77 Infineon 32-bit embedded,
4718: >>18 leshort 78 Element 14 64-bit DSP,
4719: >>18 leshort 79 LSI Logic 16-bit DSP,
4720: >>18 leshort 80 MMIX,
4721: >>18 leshort 81 Harvard machine-independent,
4722: >>18 leshort 82 SiTera Prism,
4723: >>18 leshort 83 Atmel AVR 8-bit,
4724: >>18 leshort 84 Fujitsu FR30,
4725: >>18 leshort 85 Mitsubishi D10V,
4726: >>18 leshort 86 Mitsubishi D30V,
4727: >>18 leshort 87 NEC v850,
4728: >>18 leshort 88 Renesas M32R,
4729: >>18 leshort 89 Matsushita MN10300,
4730: >>18 leshort 90 Matsushita MN10200,
4731: >>18 leshort 91 picoJava,
4732: >>18 leshort 92 OpenRISC,
4733: >>18 leshort 93 ARC Cores Tangent-A5,
4734: >>18 leshort 0x3426 OpenRISC (obsolete),
4735: >>18 leshort 0x8472 OpenRISC (obsolete),
4736: >>18 leshort 94 Tensilica Xtensa,
4737: >>18 leshort 97 NatSemi 32k,
4738: >>18 leshort 106 Analog Devices Blackfin,
4739: >>18 leshort 0x9026 Alpha (unofficial),
4740: >>20 lelong 0 invalid version
4741: >>20 lelong 1 version 1
4742: >>36 lelong 1 MathCoPro/FPU/MAU Required
4743: >5 byte 2 MSB
4744: >>16 beshort 0 no file type,
4745: !:mime application/octet-stream
4746: >>16 beshort 1 relocatable,
4747: !:mime application/x-object
4748: >>16 beshort 2 executable,
4749: !:mime application/x-executable
4750: >>16 beshort 3 shared object,
4751: !:mime application/x-sharedlib
4752: >>16 beshort 4 core file,
4753: !:mime application/x-coredump
4754: #>>>(0x38+0xcc) string >\0 of '%s'
4755: #>>>(0x38+0x10) belong >0 (signal %d),
4756: >>16 beshort &0xff00 processor-specific,
4757: >>18 beshort 0 no machine,
4758: >>18 beshort 1 AT&T WE32100,
4759: >>18 beshort 2 SPARC,
4760: >>18 beshort 3 Intel 80386 - invalid byte order,
4761: >>18 beshort 4 Motorola
4762: >>>36 belong &0x01000000 68000,
4763: >>>36 belong &0x00810000 CPU32,
4764: >>>36 belong 0 68020,
4765: >>18 beshort 5 Motorola 88000,
4766: >>18 beshort 6 Intel 80486 - invalid byte order,
4767: >>18 beshort 7 Intel 80860,
4768: # only for MIPS - see comment in little-endian section above.
4769: >>18 beshort 8 MIPS,
4770: >>>36 belong &0x20 N32
4771: >>18 beshort 10 MIPS,
4772: >>>36 belong &0x20 N32
4773: >>18 beshort 8
4774: # only for 32-bit
4775: >>>4 byte 1
4776: >>>>36 belong&0xf0000000 0x00000000 MIPS-I
4777: >>>>36 belong&0xf0000000 0x10000000 MIPS-II
4778: >>>>36 belong&0xf0000000 0x20000000 MIPS-III
4779: >>>>36 belong&0xf0000000 0x30000000 MIPS-IV
4780: >>>>36 belong&0xf0000000 0x40000000 MIPS-V
4781: >>>>36 belong&0xf0000000 0x50000000 MIPS32
4782: >>>>36 belong&0xf0000000 0x60000000 MIPS64
4783: >>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2
4784: >>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2
4785: # only for 64-bit
4786: >>>4 byte 2
4787: >>>>48 belong&0xf0000000 0x00000000 MIPS-I
4788: >>>>48 belong&0xf0000000 0x10000000 MIPS-II
4789: >>>>48 belong&0xf0000000 0x20000000 MIPS-III
4790: >>>>48 belong&0xf0000000 0x30000000 MIPS-IV
4791: >>>>48 belong&0xf0000000 0x40000000 MIPS-V
4792: >>>>48 belong&0xf0000000 0x50000000 MIPS32
4793: >>>>48 belong&0xf0000000 0x60000000 MIPS64
4794: >>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2
4795: >>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2
4796: >>18 beshort 9 Amdahl,
4797: >>18 beshort 10 MIPS (deprecated),
4798: >>18 beshort 11 RS6000,
4799: >>18 beshort 15 PA-RISC
4800: >>>50 beshort 0x0214 2.0
4801: >>>48 beshort &0x0008 (LP64)
4802: >>18 beshort 16 nCUBE,
4803: >>18 beshort 17 Fujitsu VPP500,
4804: >>18 beshort 18 SPARC32PLUS,
4805: >>>36 belong&0xffff00 0x000100 V8+ Required,
4806: >>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
4807: >>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required,
4808: >>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
4809: >>18 beshort 20 PowerPC or cisco 4500,
4810: >>18 beshort 21 64-bit PowerPC or cisco 7500,
4811: >>18 beshort 22 IBM S/390,
4812: >>18 beshort 23 Cell SPU,
4813: >>18 beshort 24 cisco SVIP,
4814: >>18 beshort 25 cisco 7200,
4815: >>18 beshort 36 NEC V800 or cisco 12000,
4816: >>18 beshort 37 Fujitsu FR20,
4817: >>18 beshort 38 TRW RH-32,
4818: >>18 beshort 39 Motorola RCE,
4819: >>18 beshort 40 ARM,
4820: >>18 beshort 41 Alpha,
4821: >>18 beshort 42 Renesas SH,
4822: >>18 beshort 43 SPARC V9,
4823: >>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
4824: >>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required,
4825: >>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
4826: >>>48 belong&0x3 0 total store ordering,
4827: >>>48 belong&0x3 1 partial store ordering,
4828: >>>48 belong&0x3 2 relaxed memory ordering,
4829: >>18 beshort 44 Siemens Tricore Embedded Processor,
4830: >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
4831: >>18 beshort 46 Renesas H8/300,
4832: >>18 beshort 47 Renesas H8/300H,
4833: >>18 beshort 48 Renesas H8S,
4834: >>18 beshort 49 Renesas H8/500,
4835: >>18 beshort 50 IA-64,
4836: >>18 beshort 51 Stanford MIPS-X,
4837: >>18 beshort 52 Motorola Coldfire,
4838: >>18 beshort 53 Motorola M68HC12,
4839: >>18 beshort 73 Cray NV1,
4840: >>18 beshort 75 Digital VAX,
4841: >>18 beshort 88 Renesas M32R,
4842: >>18 leshort 92 OpenRISC,
4843: >>18 leshort 0x3426 OpenRISC (obsolete),
4844: >>18 leshort 0x8472 OpenRISC (obsolete),
4845: >>18 beshort 94 Tensilica Xtensa,
4846: >>18 beshort 97 NatSemi 32k,
4847: >>18 beshort 0x18ad AVR32 (unofficial),
4848: >>18 beshort 0x9026 Alpha (unofficial),
4849: >>18 beshort 0xa390 IBM S/390 (obsolete),
4850: >>20 belong 0 invalid version
4851: >>20 belong 1 version 1
4852: >>36 belong 1 MathCoPro/FPU/MAU Required
4853: # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
4854: # like proper ELF, but extracting the string had bad results.
4855: >4 byte <0x80
4856: >>8 string >\0 (%s)
4857: >8 string \0
4858: >>7 byte 0 (SYSV)
4859: >>7 byte 1 (HP-UX)
4860: >>7 byte 2 (NetBSD)
4861: >>7 byte 3 (GNU/Linux)
4862: >>7 byte 4 (GNU/Hurd)
4863: >>7 byte 5 (86Open)
4864: >>7 byte 6 (Solaris)
4865: >>7 byte 7 (Monterey)
4866: >>7 byte 8 (IRIX)
4867: >>7 byte 9 (FreeBSD)
4868: >>7 byte 10 (Tru64)
4869: >>7 byte 11 (Novell Modesto)
4870: >>7 byte 12 (OpenBSD)
4871: >8 string \2
4872: >>7 byte 13 (OpenVMS)
4873: >>7 byte 97 (ARM)
4874: >>7 byte 255 (embedded)
4875:
4876: #------------------------------------------------------------------------------
4877: # encore: file(1) magic for Encore machines
4878: #
4879: # XXX - needs to have the byte order specified (NS32K was little-endian,
4880: # dunno whether they run the 88K in little-endian mode or not).
4881: #
4882: 0 short 0x154 Encore
4883: >20 short 0x107 executable
4884: >20 short 0x108 pure executable
4885: >20 short 0x10b demand-paged executable
4886: >20 short 0x10f unsupported executable
4887: >12 long >0 not stripped
4888: >22 short >0 - version %ld
4889: >22 short 0 -
4890: #>4 date x stamp %s
4891: 0 short 0x155 Encore unsupported executable
4892: >12 long >0 not stripped
4893: >22 short >0 - version %ld
4894: >22 short 0 -
4895: #>4 date x stamp %s
4896:
4897: #------------------------------------------------------------------------------
4898: # Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
4899: # Stefan Praszalowicz (hpicollo@worldnet.fr)
4900: #0 lelong 0x10000037 Epoc32
4901: >4 lelong 0x1000006D
4902: >>8 lelong 0x1000007F Word
4903: >>8 lelong 0x10000088 Sheet
4904: >>8 lelong 0x1000007D Sketch
4905: >>8 lelong 0x10000085 TextEd
4906:
4907: #------------------------------------------------------------------------------
4908: # erlang: file(1) magic for Erlang JAM and BEAM files
4909: # URL: http://www.erlang.org/faq/x779.html#AEN812
4910:
4911: # OTP R3-R4
4912: 0 string \0177BEAM! Old Erlang BEAM file
4913: >6 short >0 - version %d
4914:
4915: # OTP R5 and onwards
4916: 0 string FOR1
4917: >8 string BEAM Erlang BEAM file
4918:
4919: # 4.2 version may have a copyright notice!
4920: 4 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2
4921: 79 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2
4922:
4923: 4 string 1.0 Fri Feb 3 09:55:56 MET 1995 Erlang JAM file - version 4.3
4924:
4925: #------------------------------------------------------------------------------
4926: # ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
4927: # Based on info from
4928: # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
4929: 0 belong 9994 ESRI Shapefile
4930: >4 belong =0
4931: >8 belong =0
4932: >12 belong =0
4933: >16 belong =0
4934: >20 belong =0
4935: >28 lelong x version %d
4936: >24 belong x length %d
4937: >32 lelong =0 type Null Shape
4938: >32 lelong =1 type Point
4939: >32 lelong =3 type PolyLine
4940: >32 lelong =5 type Polygon
4941: >32 lelong =8 type MultiPoint
4942: >32 lelong =11 type PointZ
4943: >32 lelong =13 type PolyLineZ
4944: >32 lelong =15 type PolygonZ
4945: >32 lelong =18 type MultiPointZ
4946: >32 lelong =21 type PointM
4947: >32 lelong =23 type PolyLineM
4948: >32 lelong =25 type PolygonM
4949: >32 lelong =28 type MultiPointM
4950: >32 lelong =31 type MultiPatch
4951:
4952: #------------------------------------------------------------------------------
4953: # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
4954: # From Roger Leigh <roger@whinlatter.uklinux.net>
4955: 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
4956: 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
4957: 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
4958:
4959:
4960: #------------------------------------------------------------------------------
4961: # filesystems: file(1) magic for different filesystems
4962: #
4963: 0 string \366\366\366\366 PC formatted floppy with no filesystem
4964: # Sun disk labels
4965: # From /usr/include/sun/dklabel.h:
4966: 0774 beshort 0xdabe
4967: # modified by Joerg Jenderek, because original test
4968: # succeeds for Cabinet archive dao360.dl_ with negative blocks
4969: >0770 long >0 Sun disk label
4970: >>0 string x '%s
4971: >>>31 string >\0 \b%s
4972: >>>>63 string >\0 \b%s
4973: >>>>>95 string >\0 \b%s
4974: >>0 string x \b'
4975: >>0734 short >0 %d rpm,
4976: >>0736 short >0 %d phys cys,
4977: >>0740 short >0 %d alts/cyl,
4978: >>0746 short >0 %d interleave,
4979: >>0750 short >0 %d data cyls,
4980: >>0752 short >0 %d alt cyls,
4981: >>0754 short >0 %d heads/partition,
4982: >>0756 short >0 %d sectors/track,
4983: >>0764 long >0 start cyl %ld,
4984: >>0770 long x %ld blocks
4985: # Is there a boot block written 1 sector in?
4986: >512 belong&077777777 0600407 \b, boot block present
4987: # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
4988: # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
4989: 0 string SBMBAKUP_ Smart Boot Manager backup file
4990: >9 string x \b, version %-5.5s
4991: >>14 string =_
4992: >>>15 string x %-.1s
4993: >>>>16 string =_ \b.
4994: >>>>>17 string x \b%-.1s
4995: >>>>>>18 string =_ \b.
4996: >>>>>>>19 string x \b%-.1s
4997: >>>22 ubyte 0
4998: >>>>21 ubyte x \b, from drive 0x%x
4999: >>>22 ubyte >0
5000: >>>>21 string x \b, from drive %s
5001:
5002: # Joerg Jenderek
5003: # DOS Emulator image is 128 byte, null right padded header + harddisc image
5004: 0 string DOSEMU\0
5005: >0x27E leshort 0xAA55
5006: #offset is 128
5007: >>19 ubyte 128
5008: >>>(19.b-1) ubyte 0x0 DOS Emulator image
5009: >>>>7 ulelong >0 \b, %u heads
5010: >>>>11 ulelong >0 \b, %d sectors/track
5011: >>>>15 ulelong >0 \b, %d cylinders
5012:
5013: # updated by Joerg Jenderek at Sep 2007
5014: # only for sector sizes with 512 or more Bytes
5015: 0x1FE leshort 0xAA55 x86 boot sector
5016: # to do also for sectors < than 512 Bytes and some other files, GRR
5017: #30 search/481 \x55\xAA x86 boot sector
5018: # not for BeOS floppy 1440k, MBRs
5019: #(11.s-2) uleshort 0xAA55 x86 boot sector
5020: >2 string OSBS \b, OS/BS MBR
5021: # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
5022: >0x8C string Invalid\ partition\ table \b, MS-DOS MBR
5023: # dr-dos with some upper-, lowercase variants
5024: >0x9D string Invalid\ partition\ table$
5025: >>181 string No\ Operating\ System$
5026: >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
5027: >0x9D string Invalid\ partition\ table$
5028: >>181 string No\ operating\ system$
5029: >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
5030: >342 string Invalid\ partition\ table$
5031: >>366 string No\ operating\ system$
5032: >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
5033: >295 string NEWLDR\0
5034: >>302 string Bad\ PT\ $
5035: >>>310 string No\ OS\ $
5036: >>>>317 string OS\ load\ err$
5037: >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
5038: >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
5039: >>>>>>>387 string Copyright\ (c)\ 1984,1998
5040: >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
5041: >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
5042: >>0x1B8 ubelong >0 \b, Serial 0x%-.4x
5043: >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
5044: >271 string Invalid\ partition\ table\0
5045: >>295 string Error\ loading\ operating\ system\0
5046: >>>326 string Missing\ operating\ system\0 \b, mbr
5047: #
5048: >139 string Invalid\ partition\ table\0
5049: >>163 string Error\ loading\ operating\ system\0
5050: >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
5051: # http://www.heise.de/ct/05/09/006/ page 184
5052: #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
5053: >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
5054: >300 string Invalid\ partition\ table\0
5055: >>324 string Error\ loading\ operating\ system\0
5056: >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
5057: #??>>>389 string Invalid\ system\ disk
5058: >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
5059: >300 string Ung\201ltige\ Partitionstabelle
5060: #split string to avoid error: String too long
5061: >>328 string Fehler\ beim\ Laden\
5062: >>>346 string des\ Betriebssystems
5063: >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
5064: >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
5065: >0x145 string Default:\ F \b, FREE-DOS MBR
5066: >64 string no\ active\ partition\ found
5067: >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
5068: >271 string Operating\ system\ loading
5069: >>296 string error\r \b, SYSLINUX MBR (2.10)
5070: # http://www.acronis.de/
5071: >362 string MBR\ Error\ \0\r
5072: >>376 string ress\ any\ key\ to\
5073: >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
5074: # added by Joerg Jenderek
5075: # http://www.visopsys.org/
5076: # http://partitionlogic.org.uk/
5077: >309 string No\ bootable\ partition\ found\r
5078: >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
5079: >349 string No\ bootable\ partition\ found\r
5080: >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
5081: # bootloader, bootmanager
5082: >0x40 string SBML
5083: # label with 11 characters of FAT 12 bit filesystem
5084: >>43 string SMART\ BTMGR
5085: >>>430 string SBMK\ Bad!\r
5086: >>>>3 string SBM \b, Smart Boot Manager
5087: >>>>>6 string >\0 \b, version %s
5088: >382 string XOSLLOADXCF \b, eXtended Operating System Loader
5089: >6 string LILO \b, LInux i386 boot LOader
5090: >>120 string LILO \b, version 22.3.4 SuSe
5091: >>172 string LILO \b, version 22.5.8 Debian
5092: # updated by Joerg Jenderek
5093: # variables according to grub-0.97/stage1/stage1.S or
5094: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
5095: # usual values are marked with comments to get only informations of strange GRUB loaders
5096: >0 ulelong 0x009048EB
5097: >>0x41 ubyte <2
5098: >>>0x3E ubyte >2 \b; GRand Unified Bootloader
5099: # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
5100: >>>>0x3E ubyte x \b, stage1 version 0x%x
5101: #If it is 0xFF, use a drive passed by BIOS
5102: >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
5103: # in most case 0,1,0x2e for GRUB 0.5.95
5104: >>>>0x41 ubyte >0 \b, LBA flag 0x%x
5105: >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
5106: #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
5107: >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
5108: #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
5109: >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
5110: >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
5111: #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
5112: >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
5113: >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
5114: >>>>>394 string stage1 \b, GRUB version 0.5.95
5115: >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
5116: >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
5117: >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
5118: >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
5119: >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
5120: >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
5121: >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
5122: >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
5123: #unkown version
5124: >>>343 string Geom\0Read\0\ Error\0
5125: >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
5126: >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
5127: >>>>374 string GRUB\ \0 \b, GRUB version n.m
5128: # http://syslinux.zytor.com/
5129: >478 string Boot\ failed\r
5130: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
5131: >480 string Boot\ failed\r
5132: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
5133: >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
5134: >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
5135: # http://www.bcdwb.de/bcdw/index_e.htm
5136: >3 string BCDL
5137: >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
5138: # mbr partion table entries
5139: # OEM-ID not Microsoft,SYSLINUX,or MTOOLs
5140: >3 string !MS
5141: >>3 string !SYSLINUX
5142: >>>3 string !MTOOL
5143: # not FAT (32 bit)
5144: >>>>82 string !FAT32
5145: #not IO.SYS
5146: >>>>>472 string !IO\ \ \ \ \ \ SYS
5147: >>>>>>480 string !IO\ \ \ \ \ \ SYS
5148: #not Linux kernel
5149: >>>>>>>514 string !HdrS
5150: #not BeOS
5151: >>>>>>>>422 string !Be\ Boot\ Loader
5152: # active flag 0 or 0x80 and type > 0
5153: >>>>>>>>>446 ubyte <0x81
5154: >>>>>>>>>>446 ubyte&0x7F 0
5155: >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
5156: >>>>>>>>>>>>446 ubyte 0x80 \b, active
5157: >>>>>>>>>>>>447 ubyte x \b, starthead %u
5158: #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
5159: #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
5160: >>>>>>>>>>>>454 ulelong x \b, startsector %u
5161: >>>>>>>>>>>>458 ulelong x \b, %u sectors
5162: #
5163: >>>>>>>>>462 ubyte <0x81
5164: >>>>>>>>>>462 ubyte&0x7F 0
5165: >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
5166: >>>>>>>>>>>>462 ubyte 0x80 \b, active
5167: >>>>>>>>>>>>463 ubyte x \b, starthead %u
5168: #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
5169: #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
5170: >>>>>>>>>>>>470 ulelong x \b, startsector %u
5171: >>>>>>>>>>>>474 ulelong x \b, %u sectors
5172: #
5173: >>>>>>>>>478 ubyte <0x81
5174: >>>>>>>>>>478 ubyte&0x7F 0
5175: >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
5176: >>>>>>>>>>>>478 ubyte 0x80 \b, active
5177: >>>>>>>>>>>>479 ubyte x \b, starthead %u
5178: #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
5179: #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
5180: #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
5181: >>>>>>>>>>>>486 ulelong x \b, startsector %u
5182: >>>>>>>>>>>>490 ulelong x \b, %u sectors
5183: #
5184: >>>>>>>>>494 ubyte <0x81
5185: >>>>>>>>>>494 ubyte&0x7F 0
5186: >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
5187: >>>>>>>>>>>>494 ubyte 0x80 \b, active
5188: >>>>>>>>>>>>495 ubyte x \b, starthead %u
5189: #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
5190: #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
5191: >>>>>>>>>>>>502 ulelong x \b, startsector %u
5192: >>>>>>>>>>>>506 ulelong x \b, %u sectors
5193: # mbr partion table entries end
5194: # http://www.acronis.de/
5195: #FAT label=ACRONIS\ SZ
5196: #OEM-ID=BOOTWIZ0
5197: >442 string Non-system\ disk,\
5198: >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
5199: # DOS names like F11.SYS are 8 right space padded bytes+3 bytes
5200: >>>477 ubyte&0xDF >0
5201: >>>>477 string x \b %-.3s
5202: >>>>>480 ubyte&0xDF >0
5203: >>>>>>480 string x \b%-.5s
5204: >>>>485 ubyte&0xDF >0
5205: >>>>>485 string x \b.%-.3s
5206: #
5207: >185 string FDBOOT\ Version\
5208: >>204 string \rNo\ Systemdisk.\
5209: >>>220 string Booting\ from\ harddisk.\n\r
5210: >>>245 string Cannot\ load\ from\ harddisk.\n\r
5211: >>>>273 string Insert\ Systemdisk\
5212: >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
5213: >>>>>>200 string >\0 \b, version %-3s
5214: >242 string Bootsector\ from\ C.H.\ Hochst\204
5215: >>278 string No\ Systemdisk.\
5216: >>>293 string Booting\ from\ harddisk.\n\r
5217: >>>441 string Cannot\ load\ from\ harddisk.\n\r
5218: >>>>469 string Insert\ Systemdisk\
5219: >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
5220: >>>>>>209 string >\0 \b, version %-4.4s
5221: >(1.b+2) ubyte 0xe
5222: >>(1.b+3) ubyte 0x1f
5223: >>>(1.b+4) ubyte 0xbe
5224: >>>>(1.b+5) ubyte 0x77
5225: >>>>(1.b+6) ubyte 0x7c
5226: >>>>>(1.b+7) ubyte 0xac
5227: >>>>>>(1.b+8) ubyte 0x22
5228: >>>>>>>(1.b+9) ubyte 0xc0
5229: >>>>>>>>(1.b+10) ubyte 0x74
5230: >>>>>>>>>(1.b+11) ubyte 0xb
5231: >>>>>>>>>>(1.b+12) ubyte 0x56
5232: >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
5233: >103 string This\ is\ not\ a\ bootable\ disk.\
5234: >>132 string Please\ insert\ a\ bootable\
5235: >>>157 string floppy\ and\r\n
5236: >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
5237: #
5238: >66 string Solaris\ Boot\ Sector
5239: >>99 string Incomplete\ MDBoot\ load.
5240: >>>89 string Version \b, Sun Solaris Bootloader
5241: >>>>97 byte x version %c
5242: #
5243: >408 string OS/2\ !!\ SYS01475\r\0
5244: >>429 string OS/2\ !!\ SYS02025\r\0
5245: >>>450 string OS/2\ !!\ SYS02027\r\0
5246: >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
5247: #
5248: >409 string OS/2\ !!\ SYS01475\r\0
5249: >>430 string OS/2\ !!\ SYS02025\r\0
5250: >>>451 string OS/2\ !!\ SYS02027\r\0
5251: >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
5252: >112 string This\ disk\ is\ not\ bootable\r
5253: >>142 string If\ you\ wish\ to\ make\ it\ bootable
5254: >>>176 string run\ the\ DOS\ program\ SYS\
5255: >>>200 string after\ the\r
5256: >>>>216 string system\ has\ been\ loaded\r\n
5257: >>>>>242 string Please\ insert\ a\ DOS\ diskette\
5258: >>>>>271 string into\r\n\ the\ drive\ and\
5259: >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
5260: # XP
5261: >430 string NTLDR\ is\ missing\xFF\r\n
5262: >>449 string Disk\ error\xFF\r\n
5263: >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
5264: # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
5265: >>>>417 ubyte&0xDF >0
5266: >>>>>417 string x %-.5s
5267: >>>>>>422 ubyte&0xDF >0
5268: >>>>>>>422 string x \b%-.3s
5269: >>>>>425 ubyte&0xDF >0
5270: >>>>>>425 string >\ \b.%-.3s
5271: #
5272: >>>>371 ubyte >0x20
5273: >>>>>368 ubyte&0xDF >0
5274: >>>>>>368 string x %-.5s
5275: >>>>>>>373 ubyte&0xDF >0
5276: >>>>>>>>373 string x \b%-.3s
5277: >>>>>>376 ubyte&0xDF >0
5278: >>>>>>>376 string x \b.%-.3s
5279: #
5280: >430 string NTLDR\ nicht\ gefunden\xFF\r\n
5281: >>453 string Datentr\204gerfehler\xFF\r\n
5282: >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
5283: >>>>417 ubyte&0xDF >0
5284: >>>>>417 string x %-.5s
5285: >>>>>>422 ubyte&0xDF >0
5286: >>>>>>>422 string x \b%-.3s
5287: >>>>>425 ubyte&0xDF >0
5288: >>>>>>425 string >\ \b.%-.3s
5289: # offset variant
5290: >>>>379 string \0
5291: >>>>>368 ubyte&0xDF >0
5292: >>>>>>368 string x %-.5s
5293: >>>>>>>373 ubyte&0xDF >0
5294: >>>>>>>>373 string x \b%-.3s
5295: #
5296: >430 string NTLDR\ fehlt\xFF\r\n
5297: >>444 string Datentr\204gerfehler\xFF\r\n
5298: >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
5299: >>>>417 ubyte&0xDF >0
5300: >>>>>417 string x %-.5s
5301: >>>>>>422 ubyte&0xDF >0
5302: >>>>>>>422 string x \b%-.3s
5303: >>>>>425 ubyte&0xDF >0
5304: >>>>>>425 string >\ \b.%-.3s
5305: # variant
5306: >>>>371 ubyte >0x20
5307: >>>>>368 ubyte&0xDF >0
5308: >>>>>>368 string x %-.5s
5309: >>>>>>>373 ubyte&0xDF >0
5310: >>>>>>>>373 string x \b%-.3s
5311: >>>>>>376 ubyte&0xDF >0
5312: >>>>>>>376 string x \b.%-.3s
5313: #
5314: >430 string NTLDR\ fehlt\xFF\r\n
5315: >>444 string Medienfehler\xFF\r\n
5316: >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
5317: >>>>371 ubyte >0x20
5318: >>>>>368 ubyte&0xDF >0
5319: >>>>>>368 string x %-.5s
5320: >>>>>>>373 ubyte&0xDF >0
5321: >>>>>>>>373 string x \b%-.3s
5322: >>>>>>376 ubyte&0xDF >0
5323: >>>>>>>376 string x \b.%-.3s
5324: # variant
5325: >>>>417 ubyte&0xDF >0
5326: >>>>>417 string x %-.5s
5327: >>>>>>422 ubyte&0xDF >0
5328: >>>>>>>422 string x \b%-.3s
5329: >>>>>425 ubyte&0xDF >0
5330: >>>>>>425 string >\ \b.%-.3s
5331: #
5332: >430 string Datentr\204ger\ entfernen\xFF\r\n
5333: >>454 string Medienfehler\xFF\r\n
5334: >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
5335: >>>>368 ubyte&0xDF >0
5336: >>>>>368 string x %-.5s
5337: >>>>>>373 ubyte&0xDF >0
5338: >>>>>>>373 string x \b%-.3s
5339: >>>>>376 ubyte&0xDF >0
5340: >>>>>>376 string x \b.%-.3s
5341: #>3 string NTFS\ \ \ \
5342: >389 string Fehler\ beim\ Lesen\
5343: >>407 string des\ Datentr\204gers
5344: >>>426 string NTLDR\ fehlt
5345: >>>>440 string NTLDR\ ist\ komprimiert
5346: >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
5347: #>3 string NTFS\ \ \ \
5348: >313 string A\ disk\ read\ error\ occurred.\r
5349: >>345 string A\ kernel\ file\ is\ missing\
5350: >>>370 string from\ the\ disk.\r
5351: >>>>484 string NTLDR\ is\ compressed
5352: >>>>>429 string Insert\ a\ system\ diskette\
5353: >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
5354: # DOS loader variants different languages,offsets
5355: >472 ubyte&0xDF >0
5356: >>389 string Invalid\ system\ disk\xFF\r\n
5357: >>>411 string Disk\ I/O\ error
5358: >>>>428 string Replace\ the\ disk,\ and\
5359: >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
5360: #IO.SYS
5361: >>>>>>472 ubyte&0xDF >0
5362: >>>>>>>472 string x \b %-.2s
5363: >>>>>>>>474 ubyte&0xDF >0
5364: >>>>>>>>>474 string x \b%-.5s
5365: >>>>>>>>>>479 ubyte&0xDF >0
5366: >>>>>>>>>>>479 string x \b%-.1s
5367: >>>>>>>480 ubyte&0xDF >0
5368: >>>>>>>>480 string x \b.%-.3s
5369: #MSDOS.SYS
5370: >>>>>>>483 ubyte&0xDF >0 \b+
5371: >>>>>>>>483 string x \b%-.5s
5372: >>>>>>>>>488 ubyte&0xDF >0
5373: >>>>>>>>>>488 string x \b%-.3s
5374: >>>>>>>>491 ubyte&0xDF >0
5375: >>>>>>>>>491 string x \b.%-.3s
5376: #
5377: >>390 string Invalid\ system\ disk\xFF\r\n
5378: >>>412 string Disk\ I/O\ error\xFF\r\n
5379: >>>>429 string Replace\ the\ disk,\ and\
5380: >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
5381: >>388 string Ungueltiges\ System\ \xFF\r\n
5382: >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
5383: >>>>427 string Datentraeger\ wechseln\ und\
5384: >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
5385: #WINBOOT.SYS only not spaces (0xDF)
5386: >>>>>>497 ubyte&0xDF >0
5387: >>>>>>>497 string x %-.5s
5388: >>>>>>>>502 ubyte&0xDF >0
5389: >>>>>>>>>502 string x \b%-.1s
5390: >>>>>>>>>>503 ubyte&0xDF >0
5391: >>>>>>>>>>>503 string x \b%-.1s
5392: >>>>>>>>>>>>504 ubyte&0xDF >0
5393: >>>>>>>>>>>>>504 string x \b%-.1s
5394: >>>>>>505 ubyte&0xDF >0
5395: >>>>>>>505 string x \b.%-.3s
5396: #IO.SYS
5397: >>>>>>472 ubyte&0xDF >0 or
5398: >>>>>>>472 string x \b %-.2s
5399: >>>>>>>>474 ubyte&0xDF >0
5400: >>>>>>>>>474 string x \b%-.5s
5401: >>>>>>>>>>479 ubyte&0xDF >0
5402: >>>>>>>>>>>479 string x \b%-.1s
5403: >>>>>>>480 ubyte&0xDF >0
5404: >>>>>>>>480 string x \b.%-.3s
5405: #MSDOS.SYS
5406: >>>>>>>483 ubyte&0xDF >0 \b+
5407: >>>>>>>>483 string x \b%-.5s
5408: >>>>>>>>>488 ubyte&0xDF >0
5409: >>>>>>>>>>488 string x \b%-.3s
5410: >>>>>>>>491 ubyte&0xDF >0
5411: >>>>>>>>>491 string x \b.%-.3s
5412: #
5413: >>390 string Ungueltiges\ System\ \xFF\r\n
5414: >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
5415: >>>>429 string Datentraeger\ wechseln\ und\
5416: >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
5417: #WINBOOT.SYS only not spaces (0xDF)
5418: >>>>>>497 ubyte&0xDF >0
5419: >>>>>>>497 string x %-.7s
5420: >>>>>>>>504 ubyte&0xDF >0
5421: >>>>>>>>>504 string x \b%-.1s
5422: >>>>>>505 ubyte&0xDF >0
5423: >>>>>>>505 string x \b.%-.3s
5424: #IO.SYS
5425: >>>>>>472 ubyte&0xDF >0 or
5426: >>>>>>>472 string x \b %-.2s
5427: >>>>>>>>474 ubyte&0xDF >0
5428: >>>>>>>>>474 string x \b%-.6s
5429: >>>>>>>480 ubyte&0xDF >0
5430: >>>>>>>>480 string x \b.%-.3s
5431: #MSDOS.SYS
5432: >>>>>>>483 ubyte&0xDF >0 \b+
5433: >>>>>>>>483 string x \b%-.5s
5434: >>>>>>>>>488 ubyte&0xDF >0
5435: >>>>>>>>>>488 string x \b%-.3s
5436: >>>>>>>>491 ubyte&0xDF >0
5437: >>>>>>>>>491 string x \b.%-.3s
5438: #
5439: >>389 string Ungueltiges\ System\ \xFF\r\n
5440: >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
5441: >>>>428 string Datentraeger\ wechseln\ und\
5442: >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
5443: # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
5444: >>>>>>472 string x %-.2s
5445: >>>>>>>474 ubyte&0xDF >0
5446: >>>>>>>>474 string x \b%-.5s
5447: >>>>>>>>479 ubyte&0xDF >0
5448: >>>>>>>>>479 string x \b%-.1s
5449: >>>>>>480 ubyte&0xDF >0
5450: >>>>>>>480 string x \b.%-.3s
5451: >>>>>>483 ubyte&0xDF >0 \b+
5452: >>>>>>>483 string x \b%-.5s
5453: >>>>>>>488 ubyte&0xDF >0
5454: >>>>>>>>488 string x \b%-.2s
5455: >>>>>>>>490 ubyte&0xDF >0
5456: >>>>>>>>>490 string x \b%-.1s
5457: >>>>>>>491 ubyte&0xDF >0
5458: >>>>>>>>491 string x \b.%-.3s
5459: >479 ubyte&0xDF >0
5460: >>416 string Kein\ System\ oder\
5461: >>>433 string Laufwerksfehler
5462: >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
5463: #IO.SYS
5464: >>>>>479 string x \b %-.2s
5465: >>>>>>481 ubyte&0xDF >0
5466: >>>>>>>481 string x \b%-.6s
5467: >>>>>487 ubyte&0xDF >0
5468: >>>>>>487 string x \b.%-.3s
5469: #MSDOS.SYS
5470: >>>>>>490 ubyte&0xDF >0 \b+
5471: >>>>>>>490 string x \b%-.5s
5472: >>>>>>>>495 ubyte&0xDF >0
5473: >>>>>>>>>495 string x \b%-.3s
5474: >>>>>>>498 ubyte&0xDF >0
5475: >>>>>>>>498 string x \b.%-.3s
5476: #
5477: >376 search/41 Non-System\ disk\ or\
5478: >>395 search/41 disk\ error\r
5479: >>>407 search/41 Replace\ and\
5480: >>>>419 search/41 press\ \b,
5481: >>>>419 search/41 strike\ \b, old
5482: >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
5483: #449 Disk\ Boot\ failure\r MS 3.21
5484: #466 Boot\ Failure\r MS 3.30
5485: >>>>>468 search/18 \0
5486: #IO.SYS,IBMBIO.COM
5487: >>>>>>&0 string x \b %-.2s
5488: >>>>>>>&-20 ubyte&0xDF >0
5489: >>>>>>>>&-1 string x \b%-.4s
5490: >>>>>>>>>&-16 ubyte&0xDF >0
5491: >>>>>>>>>>&-1 string x \b%-.2s
5492: >>>>>>&8 ubyte&0xDF >0 \b.
5493: >>>>>>>&-1 string x \b%-.3s
5494: #MSDOS.SYS,IBMDOS.COM
5495: >>>>>>&11 ubyte&0xDF >0 \b+
5496: >>>>>>>&-1 string x \b%-.5s
5497: >>>>>>>>&-6 ubyte&0xDF >0
5498: >>>>>>>>>&-1 string x \b%-.1s
5499: >>>>>>>>>>&-5 ubyte&0xDF >0
5500: >>>>>>>>>>>&-1 string x \b%-.2s
5501: >>>>>>>&7 ubyte&0xDF >0 \b.
5502: >>>>>>>>&-1 string x \b%-.3s
5503: >441 string Cannot\ load\ from\ harddisk.\n\r
5504: >>469 string Insert\ Systemdisk\
5505: >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
5506: #>43 string \224R-LOADER\ \ SYS =label
5507: >54 string SYS
5508: >>324 string VASKK
5509: >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
5510: #
5511: >98 string Press\ a\ key\ to\ retry\0\r
5512: >>120 string Cannot\ find\ file\ \0\r
5513: >>>139 string Disk\ read\ error\0\r
5514: >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
5515: #DRBIOS.SYS
5516: >>>>>44 ubyte&0xDF >0
5517: >>>>>>44 string x \b %-.6s
5518: >>>>>>>50 ubyte&0xDF >0
5519: >>>>>>>>50 string x \b%-.2s
5520: >>>>>>52 ubyte&0xDF >0
5521: >>>>>>>52 string x \b.%-.3s
5522: #
5523: >70 string IBMBIO\ \ COM
5524: >>472 string Cannot\ load\ DOS!\
5525: >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
5526: >>471 string Cannot\ load\ DOS\
5527: >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
5528: >444 string KERNEL\ \ SYS
5529: >>314 string BOOT\ error! \b, FREE-DOS Bootloader
5530: >499 string KERNEL\ \ SYS
5531: >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
5532: >449 string KERNEL\ \ SYS
5533: >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
5534: >125 string Loading\ FreeDOS...\r
5535: >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
5536: >>>441 ubyte&0xDF >0
5537: >>>>441 string x \b %-.6s
5538: >>>>>447 ubyte&0xDF >0
5539: >>>>>>447 string x \b%-.1s
5540: >>>>>>>448 ubyte&0xDF >0
5541: >>>>>>>>448 string x \b%-.1s
5542: >>>>449 ubyte&0xDF >0
5543: >>>>>449 string x \b.%-.3s
5544: >124 string FreeDOS\0
5545: >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
5546: # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
5547: >>>497 ubyte&0xDF >0
5548: >>>>497 string x \b %-.6s
5549: >>>>>503 ubyte&0xDF >0
5550: >>>>>>503 string x \b%-.1s
5551: >>>>>>>504 ubyte&0xDF >0
5552: >>>>>>>>504 string x \b%-.1s
5553: >>>>505 ubyte&0xDF >0
5554: >>>>>505 string x \b.%-.3s
5555: >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
5556: >>>497 ubyte&0xDF >0
5557: >>>>497 string x \b %-.6s
5558: >>>>>503 ubyte&0xDF >0
5559: >>>>>>503 string x \b%-.1s
5560: >>>>>>>504 ubyte&0xDF >0
5561: >>>>>>>>504 string x \b%-.1s
5562: >>>>505 ubyte&0xDF >0
5563: >>>>>505 string x \b.%-.3s
5564: >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
5565: >>>497 ubyte&0xDF >0
5566: >>>>497 string x \b %-.6s
5567: >>>>>503 ubyte&0xDF >0
5568: >>>>>>503 string x \b%-.1s
5569: >>>>>>>504 ubyte&0xDF >0
5570: >>>>>>>>504 string x \b%-.1s
5571: >>>>505 ubyte&0xDF >0
5572: >>>>>505 string x \b.%-.3s
5573: >336 string Error!\
5574: >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
5575: >>>497 ubyte&0xDF >0
5576: >>>>497 string x \b %-.6s
5577: >>>>>503 ubyte&0xDF >0
5578: >>>>>>503 string x \b%-.1s
5579: >>>>>>>504 ubyte&0xDF >0
5580: >>>>>>>>504 string x \b%-.1s
5581: >>>>505 ubyte&0xDF >0
5582: >>>>>505 string x \b.%-.3s
5583: # added by Joerg Jenderek
5584: # http://www.visopsys.org/
5585: # http://partitionlogic.org.uk/
5586: # OEM-ID=Visopsys
5587: >478 ulelong 0
5588: >>(1.b+326) string I/O\ Error\ reading\
5589: >>>(1.b+344) string Visopsys\ loader\r
5590: >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
5591: # http://alexfru.chat.ru/epm.html#bootprog
5592: >494 ubyte >0x4D
5593: >>495 string >E
5594: >>>495 string <S
5595: #OEM-ID is not reliable
5596: >>>>3 string BootProg
5597: # It just looks for a program file name at the root directory
5598: # and loads corresponding file with following execution.
5599: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
5600: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
5601: >>>>>499 string x \b %-.1s
5602: >>>>>>500 ubyte&0xDF >0
5603: >>>>>>>500 string x \b%-.1s
5604: >>>>>>>>501 ubyte&0xDF >0
5605: >>>>>>>>>501 string x \b%-.1s
5606: >>>>>>>>>>502 ubyte&0xDF >0
5607: >>>>>>>>>>>502 string x \b%-.1s
5608: >>>>>>>>>>>>503 ubyte&0xDF >0
5609: >>>>>>>>>>>>>503 string x \b%-.1s
5610: >>>>>>>>>>>>>>504 ubyte&0xDF >0
5611: >>>>>>>>>>>>>>>504 string x \b%-.1s
5612: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
5613: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
5614: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
5615: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
5616: #name extension
5617: >>>>>507 ubyte&0xDF >0 \b.
5618: >>>>>>507 string x \b%-.1s
5619: >>>>>>>508 ubyte&0xDF >0
5620: >>>>>>>>508 string x \b%-.1s
5621: >>>>>>>>>509 ubyte&0xDF >0
5622: >>>>>>>>>>509 string x \b%-.1s
5623: #If the boot sector fails to read any other sector,
5624: #it prints a very short message ("RE") to the screen and hangs the computer.
5625: #If the boot sector fails to find needed program in the root directory,
5626: #it also hangs with another message ("NF").
5627: >>>>>492 string RENF \b, FAT (12 bit)
5628: >>>>>495 string RENF \b, FAT (16 bit)
5629: # http://alexfru.chat.ru/epm.html#bootprog
5630: >494 ubyte >0x4D
5631: >>495 string >E
5632: >>>495 string <S
5633: #OEM-ID is not reliable
5634: >>>>3 string BootProg
5635: # It just looks for a program file name at the root directory
5636: # and loads corresponding file with following execution.
5637: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
5638: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
5639: >>>>>499 string x \b %-.1s
5640: >>>>>>500 ubyte&0xDF >0
5641: >>>>>>>500 string x \b%-.1s
5642: >>>>>>>>501 ubyte&0xDF >0
5643: >>>>>>>>>501 string x \b%-.1s
5644: >>>>>>>>>>502 ubyte&0xDF >0
5645: >>>>>>>>>>>502 string x \b%-.1s
5646: >>>>>>>>>>>>503 ubyte&0xDF >0
5647: >>>>>>>>>>>>>503 string x \b%-.1s
5648: >>>>>>>>>>>>>>504 ubyte&0xDF >0
5649: >>>>>>>>>>>>>>>504 string x \b%-.1s
5650: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
5651: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
5652: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
5653: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
5654: #name extension
5655: >>>>>507 ubyte&0xDF >0 \b.
5656: >>>>>>507 string x \b%-.1s
5657: >>>>>>>508 ubyte&0xDF >0
5658: >>>>>>>>508 string x \b%-.1s
5659: >>>>>>>>>509 ubyte&0xDF >0
5660: >>>>>>>>>>509 string x \b%-.1s
5661: #If the boot sector fails to read any other sector,
5662: #it prints a very short message ("RE") to the screen and hangs the computer.
5663: #If the boot sector fails to find needed program in the root directory,
5664: #it also hangs with another message ("NF").
5665: >>>>>492 string RENF \b, FAT (12 bit)
5666: >>>>>495 string RENF \b, FAT (16 bit)
5667: # added by Joerg Jenderek
5668: # http://syslinux.zytor.com/iso.php
5669: 0 ulelong 0x7c40eafa isolinux Loader
5670: # http://syslinux.zytor.com/pxe.php
5671: 0 ulelong 0x007c05ea pxelinux Loader
5672: 0 ulelong 0x60669c66 pxelinux Loader
5673: # loader end
5674: # updated by Joerg Jenderek at Sep 2007
5675: >3 ubyte 0
5676: #no active flag
5677: >>446 ubyte 0
5678: # partition 1 not empty
5679: >>>450 ubyte >0
5680: # partitions 3,4 empty
5681: >>>>482 ubyte 0
5682: >>>>>498 ubyte 0
5683: # partition 2 ID=0,5,15
5684: >>>>>>466 ubyte <0x10
5685: >>>>>>>466 ubyte 0x05 \b, extended partition table
5686: >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
5687: >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
5688: # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
5689: # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
5690: # older drives may use Near JuMP instruction E9 xx xx
5691: >0 lelong&0x009000EB 0x009000EB
5692: >0 lelong&0x000000E9 0x000000E9
5693: # maximal short forward jump is 07fx
5694: >1 ubyte <0xff \b, code offset 0x%x
5695: # mtools-3.9.8/msdos.h
5696: # usual values are marked with comments to get only informations of strange FAT systems
5697: # valid sectorsize must be a power of 2 from 32 to 32768
5698: >>11 uleshort&0x000f x
5699: >>>11 uleshort <32769
5700: >>>>11 uleshort >31
5701: >>>>>3 string >\0 \b, OEM-ID "%8.8s"
5702: #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
5703: >>>>>>8 string IHC \b cached by Windows 9M
5704: >>>>>11 uleshort >512 \b, Bytes/sector %u
5705: #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
5706: >>>>>11 uleshort <512 \b, Bytes/sector %u
5707: >>>>>13 ubyte >1 \b, sectors/cluster %u
5708: #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
5709: >>>>>14 uleshort >32 \b, reserved sectors %u
5710: #>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
5711: #>>>>>14 uleshort >1 \b, reserved sectors %u
5712: #>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
5713: >>>>>14 uleshort <1 \b, reserved sectors %u
5714: >>>>>16 ubyte >2 \b, FATs %u
5715: #>>>>>16 ubyte =2 \b, FATs %u (usual)
5716: >>>>>16 ubyte =1 \b, FAT %u
5717: >>>>>16 ubyte >0
5718: >>>>>17 uleshort >0 \b, root entries %u
5719: #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
5720: >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
5721: #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
5722: >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
5723: #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
5724: >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
5725: >>>>>22 uleshort >0 \b, sectors/FAT %u
5726: #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
5727: >>>>>26 ubyte >2 \b, heads %u
5728: #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
5729: >>>>>26 ubyte =1 \b, heads %u
5730: #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
5731: >>>>>38 ubyte !0x70
5732: >>>>>>28 ulelong >0 \b, hidden sectors %u
5733: #>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
5734: >>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
5735: #>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
5736: # FAT<32 specific
5737: >>>>>82 string !FAT32
5738: #>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
5739: #>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
5740: >>>>>>36 ubyte !0x80
5741: >>>>>>>36 ubyte !0 \b, physical drive 0x%x
5742: >>>>>>37 ubyte >0 \b, reserved 0x%x
5743: #>>>>>>37 ubyte =0 \b, reserved 0x%x
5744: >>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
5745: >>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
5746: >>>>>>38 ubyte =0x29
5747: >>>>>>>39 ulelong x \b, serial number 0x%x
5748: >>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
5749: >>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
5750: >>>>>>>43 string =NO\ NAME \b, unlabeled
5751: >>>>>>54 string FAT \b, FAT
5752: >>>>>>>54 string FAT12 \b (12 bit)
5753: >>>>>>>54 string FAT16 \b (16 bit)
5754: # FAT32 specific
5755: >>>>>82 string FAT32 \b, FAT (32 bit)
5756: >>>>>>36 ulelong x \b, sectors/FAT %u
5757: >>>>>>40 uleshort >0 \b, extension flags %u
5758: #>>>>>>40 uleshort =0 \b, extension flags %u
5759: >>>>>>42 uleshort >0 \b, fsVersion %u
5760: #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
5761: >>>>>>44 ulelong >2 \b, rootdir cluster %u
5762: #>>>>>>44 ulelong =2 \b, rootdir cluster %u
5763: #>>>>>>44 ulelong =1 \b, rootdir cluster %u
5764: >>>>>>48 uleshort >1 \b, infoSector %u
5765: #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
5766: >>>>>>48 uleshort <1 \b, infoSector %u
5767: >>>>>>50 uleshort >6 \b, Backup boot sector %u
5768: #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
5769: >>>>>>50 uleshort <6 \b, Backup boot sector %u
5770: >>>>>>54 ulelong >0 \b, reserved1 0x%x
5771: >>>>>>58 ulelong >0 \b, reserved2 0x%x
5772: >>>>>>62 ulelong >0 \b, reserved3 0x%x
5773: # same structure as FAT1X
5774: >>>>>>64 ubyte >0x80 \b, physical drive 0x%x
5775: #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
5776: >>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
5777: #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
5778: >>>>>>65 ubyte >0 \b, reserved 0x%x
5779: >>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
5780: >>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
5781: >>>>>>66 ubyte =0x29
5782: >>>>>>>67 ulelong x \b, serial number 0x%x
5783: >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
5784: >>>>>>71 string >NO\ NAME \b, label: "%11.11s"
5785: >>>>>>71 string =NO\ NAME \b, unlabeled
5786: ### FATs end
5787: >0x200 lelong 0x82564557 \b, BSD disklabel
5788: # FATX
5789: 0 string FATX FATX filesystem data
5790:
5791:
5792: # Minix filesystems - Juan Cespedes <cespedes@debian.org>
5793: 0x410 leshort 0x137f Minix filesystem
5794: 0x410 beshort 0x137f Minix filesystem (big endian)
5795: >0x402 beshort !0 \b, %d zones
5796: >0x1e string minix \b, bootable
5797: 0x410 leshort 0x138f Minix filesystem, 30 char names
5798: 0x410 leshort 0x2468 Minix filesystem, version 2
5799: 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
5800:
5801: # romfs filesystems - Juan Cespedes <cespedes@debian.org>
5802: 0 string -rom1fs-\0 romfs filesystem, version 1
5803: >8 belong x %d bytes,
5804: >16 string x named %s.
5805:
5806: # netboot image - Juan Cespedes <cespedes@debian.org>
5807: 0 lelong 0x1b031336L Netboot image,
5808: >4 lelong&0xFFFFFF00 0
5809: >>4 lelong&0x100 0x000 mode 2
5810: >>4 lelong&0x100 0x100 mode 3
5811: >4 lelong&0xFFFFFF00 !0 unknown mode
5812:
5813: 0x18b string OS/2 OS/2 Boot Manager
5814:
5815: # added by Joerg Jenderek
5816: # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
5817: # grub-1.94/kern/i386/pc/startup.S
5818: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
5819: # usual values are marked with comments to get only informations of strange GRUB loaders
5820: 0x200 uleshort 0x70EA
5821: # found only version 3.{1,2}
5822: >0x206 ubeshort >0x0300
5823: # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
5824: >>0x212 ubyte >0x29
5825: >>>0x213 ubyte >0x29
5826: # not iso9660_stage1_5
5827: #>>>0 ulelong&0x00BE5652 0x00BE5652
5828: >>>>0x213 ubyte >0x29 GRand Unified Bootloader
5829: # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
5830: >>>>0x217 ubyte 0xFF stage1_5
5831: >>>>0x217 ubyte <0xFF stage2
5832: >>>>0x206 ubyte x \b version %u
5833: >>>>0x207 ubyte x \b.%u
5834: # module_size for 1.94
5835: >>>>0x208 ulelong <0xffffff \b, installed partition %u
5836: #>>>>0x208 ulelong =0xffffff \b, %u (default)
5837: >>>>0x208 ulelong >0xffffff \b, installed partition %u
5838: # GRUB 0.5.95 unofficial
5839: >>>>0x20C ulelong&0x2E300000 0x2E300000
5840: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
5841: >>>>>0x20C ubyte x \b, identifier 0x%x
5842: #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
5843: >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
5844: # GRUB version as string
5845: >>>>>0x20E string >\0 \b, GRUB version %-s
5846: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
5847: >>>>>>0x215 ulong 0xffffffff
5848: >>>>>>>0x219 string >\0 \b, configuration file %-s
5849: >>>>>>0x215 ulong !0xffffffff
5850: >>>>>>>0x215 string >\0 \b, configuration file %-s
5851: # newer GRUB versions
5852: >>>>0x20C ulelong&0x2E300000 !0x2E300000
5853: ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
5854: >>>>>0x20C ulelong >0 \b, saved entry %d
5855: # for 1.94 contains kernel image size
5856: # for 0.93,0.94,0.96,0.97
5857: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
5858: >>>>>0x210 ubyte x \b, identifier 0x%x
5859: # The flag for LBA forcing is in most cases 0
5860: #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
5861: >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
5862: # GRUB version as string
5863: >>>>>0x212 string >\0 \b, GRUB version %-s
5864: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
5865: >>>>>0x217 ulong 0xffffffff
5866: >>>>>>0x21b string >\0 \b, configuration file %-s
5867: >>>>>0x217 ulong !0xffffffff
5868: >>>>>>0x217 string >\0 \b, configuration file %-s
5869:
5870: 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
5871: >8404 string x last mounted on %s,
5872: #>9504 ledate x last checked at %s,
5873: >8224 ledate x last written at %s,
5874: >8401 byte x clean flag %d,
5875: >8228 lelong x number of blocks %d,
5876: >8232 lelong x number of data blocks %d,
5877: >8236 lelong x number of cylinder groups %d,
5878: >8240 lelong x block size %d,
5879: >8244 lelong x fragment size %d,
5880: >8252 lelong x minimum percentage of free blocks %d,
5881: >8256 lelong x rotational delay %dms,
5882: >8260 lelong x disk rotational speed %drps,
5883: >8320 lelong 0 TIME optimization
5884: >8320 lelong 1 SPACE optimization
5885:
5886: 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
5887: >&-1164 string x last mounted on %s,
5888: >&-696 string >\0 volume name %s,
5889: >&-304 leqldate x last written at %s,
5890: >&-1167 byte x clean flag %d,
5891: >&-1168 byte x readonly flag %d,
5892: >&-296 lequad x number of blocks %lld,
5893: >&-288 lequad x number of data blocks %lld,
5894: >&-1332 lelong x number of cylinder groups %d,
5895: >&-1328 lelong x block size %d,
5896: >&-1324 lelong x fragment size %d,
5897: >&-180 lelong x average file size %d,
5898: >&-176 lelong x average number of files in dir %d,
5899: >&-272 lequad x pending blocks to free %lld,
5900: >&-264 lelong x pending inodes to free %ld,
5901: >&-664 lequad x system-wide uuid %0llx,
5902: >&-1316 lelong x minimum percentage of free blocks %d,
5903: >&-1248 lelong 0 TIME optimization
5904: >&-1248 lelong 1 SPACE optimization
5905:
5906: 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
5907: >&-1164 string x last mounted on %s,
5908: >&-696 string >\0 volume name %s,
5909: >&-304 leqldate x last written at %s,
5910: >&-1167 byte x clean flag %d,
5911: >&-1168 byte x readonly flag %d,
5912: >&-296 lequad x number of blocks %lld,
5913: >&-288 lequad x number of data blocks %lld,
5914: >&-1332 lelong x number of cylinder groups %d,
5915: >&-1328 lelong x block size %d,
5916: >&-1324 lelong x fragment size %d,
5917: >&-180 lelong x average file size %d,
5918: >&-176 lelong x average number of files in dir %d,
5919: >&-272 lequad x pending blocks to free %lld,
5920: >&-264 lelong x pending inodes to free %ld,
5921: >&-664 lequad x system-wide uuid %0llx,
5922: >&-1316 lelong x minimum percentage of free blocks %d,
5923: >&-1248 lelong 0 TIME optimization
5924: >&-1248 lelong 1 SPACE optimization
5925:
5926: 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
5927: >7168 belong 0x4c41424c Apple UFS Volume
5928: >>7186 string x named %s,
5929: >>7176 belong x volume label version %d,
5930: >>7180 bedate x created on %s,
5931: >8404 string x last mounted on %s,
5932: #>9504 bedate x last checked at %s,
5933: >8224 bedate x last written at %s,
5934: >8401 byte x clean flag %d,
5935: >8228 belong x number of blocks %d,
5936: >8232 belong x number of data blocks %d,
5937: >8236 belong x number of cylinder groups %d,
5938: >8240 belong x block size %d,
5939: >8244 belong x fragment size %d,
5940: >8252 belong x minimum percentage of free blocks %d,
5941: >8256 belong x rotational delay %dms,
5942: >8260 belong x disk rotational speed %drps,
5943: >8320 belong 0 TIME optimization
5944: >8320 belong 1 SPACE optimization
5945:
5946: 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
5947: >&-1164 string x last mounted on %s,
5948: >&-696 string >\0 volume name %s,
5949: >&-304 beqldate x last written at %s,
5950: >&-1167 byte x clean flag %d,
5951: >&-1168 byte x readonly flag %d,
5952: >&-296 bequad x number of blocks %lld,
5953: >&-288 bequad x number of data blocks %lld,
5954: >&-1332 belong x number of cylinder groups %d,
5955: >&-1328 belong x block size %d,
5956: >&-1324 belong x fragment size %d,
5957: >&-180 belong x average file size %d,
5958: >&-176 belong x average number of files in dir %d,
5959: >&-272 bequad x pending blocks to free %lld,
5960: >&-264 belong x pending inodes to free %ld,
5961: >&-664 bequad x system-wide uuid %0llx,
5962: >&-1316 belong x minimum percentage of free blocks %d,
5963: >&-1248 belong 0 TIME optimization
5964: >&-1248 belong 1 SPACE optimization
5965:
5966: 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
5967: >&-1164 string x last mounted on %s,
5968: >&-696 string >\0 volume name %s,
5969: >&-304 beqldate x last written at %s,
5970: >&-1167 byte x clean flag %d,
5971: >&-1168 byte x readonly flag %d,
5972: >&-296 bequad x number of blocks %lld,
5973: >&-288 bequad x number of data blocks %lld,
5974: >&-1332 belong x number of cylinder groups %d,
5975: >&-1328 belong x block size %d,
5976: >&-1324 belong x fragment size %d,
5977: >&-180 belong x average file size %d,
5978: >&-176 belong x average number of files in dir %d,
5979: >&-272 bequad x pending blocks to free %lld,
5980: >&-264 belong x pending inodes to free %ld,
5981: >&-664 bequad x system-wide uuid %0llx,
5982: >&-1316 belong x minimum percentage of free blocks %d,
5983: >&-1248 belong 0 TIME optimization
5984: >&-1248 belong 1 SPACE optimization
5985:
5986: # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
5987: # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
5988: # volume label and UUID Russell Coker
5989: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
5990: 0x438 leshort 0xEF53 Linux
5991: >0x44c lelong x rev %d
5992: >0x43e leshort x \b.%d
5993: # No journal? ext2
5994: >0x45c lelong ^0x0000004 ext2 filesystem data
5995: >>0x43a leshort ^0x0000001 (mounted or unclean)
5996: # Has a journal? ext3 or ext4
5997: >0x45c lelong &0x0000004
5998: # and small INCOMPAT?
5999: >>0x460 lelong <0x0000040
6000: # and small RO_COMPAT?
6001: >>>0x464 lelong <0x0000008 ext3 filesystem data
6002: # else large RO_COMPAT?
6003: >>>0x464 lelong >0x0000007 ext4 filesystem data
6004: # else large INCOMPAT?
6005: >>0x460 lelong >0x000003f ext4 filesystem data
6006: >0x468 belong x \b, UUID=%x
6007: >0x46c beshort x \b-%x
6008: >0x46e beshort x \b-%x
6009: >0x470 beshort x \b-%x
6010: >0x472 belong x \b-%x
6011: >0x476 beshort x \b%x
6012: >0x478 string >0 \b, volume name "%s"
6013: # General flags for any ext* fs
6014: >0x460 lelong &0x0000004 (needs journal recovery)
6015: >0x43a leshort &0x0000002 (errors)
6016: # INCOMPAT flags
6017: >0x460 lelong &0x0000001 (compressed)
6018: #>0x460 lelong &0x0000002 (filetype)
6019: #>0x460 lelong &0x0000010 (meta bg)
6020: >0x460 lelong &0x0000040 (extents)
6021: >0x460 lelong &0x0000080 (64bit)
6022: #>0x460 lelong &0x0000100 (mmp)
6023: #>0x460 lelong &0x0000200 (flex bg)
6024: # RO_INCOMPAT flags
6025: #>0x464 lelong &0x0000001 (sparse super)
6026: >0x464 lelong &0x0000002 (large files)
6027: >0x464 lelong &0x0000008 (huge files)
6028: #>0x464 lelong &0x0000010 (gdt checksum)
6029: #>0x464 lelong &0x0000020 (many subdirs)
6030: #>0x463 lelong &0x0000040 (extra isize)
6031:
6032: # SGI disk labels - Nathan Scott <nathans@debian.org>
6033: 0 belong 0x0BE5A941 SGI disk label (volume header)
6034:
6035: # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
6036: 0 belong 0x58465342 SGI XFS filesystem data
6037: >0x4 belong x (blksz %d,
6038: >0x68 beshort x inosz %d,
6039: >0x64 beshort ^0x2004 v1 dirs)
6040: >0x64 beshort &0x2004 v2 dirs)
6041:
6042: ############################################################################
6043: # Minix-ST kernel floppy
6044: 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
6045: >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
6046: >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
6047:
6048: ############################################################################
6049: # Hmmm, is this a better way of detecting _standard_ floppy images ?
6050: 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
6051: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6052: 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
6053: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6054: 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
6055: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6056:
6057: 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
6058: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6059: 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
6060: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6061:
6062: 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
6063: 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
6064:
6065: # Valid media descriptor bytes for MS-DOS:
6066: #
6067: # Byte Capacity Media Size and Type
6068: # -------------------------------------------------
6069: #
6070: # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
6071: # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
6072: # F9 720K 3.5-inch, 2-sided, 9-sector
6073: # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
6074: # FD 360K 5.25-inch, 2-sided, 9-sector
6075: # FF 320K 5.25-inch, 2-sided, 8-sector
6076: # FC 180K 5.25-inch, 1-sided, 9-sector
6077: # FE 160K 5.25-inch, 1-sided, 8-sector
6078: # FE 250K 8-inch, 1-sided, single-density
6079: # FD 500K 8-inch, 2-sided, single-density
6080: # FE 1.2 MB 8-inch, 2-sided, double-density
6081: # F8 ----- Fixed disk
6082: #
6083: # FC xxxK Apricot 70x1x9 boot disk.
6084: #
6085: # Originally a bitmap:
6086: # xxxxxxx0 Not two sided
6087: # xxxxxxx1 Double sided
6088: # xxxxxx0x Not 8 SPT
6089: # xxxxxx1x 8 SPT
6090: # xxxxx0xx Not Removable drive
6091: # xxxxx1xx Removable drive
6092: # 11111xxx Must be one.
6093: #
6094: # But now it's rather random:
6095: # 111111xx Low density disk
6096: # 00 SS, Not 8 SPT
6097: # 01 DS, Not 8 SPT
6098: # 10 SS, 8 SPT
6099: # 11 DS, 8 SPT
6100: #
6101: # 11111001 Double density 3½ floppy disk, high density 5¼
6102: # 11110000 High density 3½ floppy disk
6103: # 11111000 Hard disk any format
6104: #
6105:
6106: # CDROM Filesystems
6107: # Modified for UDF by gerardo.cacciari@gmail.com
6108: 32769 string CD001
6109: !:mime application/x-iso9660-image
6110: >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
6111: >38913 string NSR0 UDF filesystem data
6112: >>38917 string 1 (version 1.0)
6113: >>38917 string 2 (version 1.5)
6114: >>38917 string 3 (version 2.0)
6115: >>38917 byte >0x33 (unknown version, ID 0x%X)
6116: >>38917 byte <0x31 (unknown version, ID 0x%X)
6117: # "application id" which appears to be used as a volume label
6118: >32808 string >\0 '%s'
6119: >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
6120: 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
6121: !:mime application/x-iso9660-image
6122: 32776 string CDROM High Sierra CD-ROM filesystem data
6123:
6124: # cramfs filesystem - russell@coker.com.au
6125: 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
6126: >4 lelong x size %lu
6127: >8 lelong &1 version #2
6128: >8 lelong &2 sorted_dirs
6129: >8 lelong &4 hole_support
6130: >32 lelong x CRC 0x%x,
6131: >36 lelong x edition %lu,
6132: >40 lelong x %lu blocks,
6133: >44 lelong x %lu files
6134:
6135: 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
6136: >4 belong x size %lu
6137: >8 belong &1 version #2
6138: >8 belong &2 sorted_dirs
6139: >8 belong &4 hole_support
6140: >32 belong x CRC 0x%x,
6141: >36 belong x edition %lu,
6142: >40 belong x %lu blocks,
6143: >44 belong x %lu files
6144:
6145: # reiserfs - russell@coker.com.au
6146: 0x10034 string ReIsErFs ReiserFS V3.5
6147: 0x10034 string ReIsEr2Fs ReiserFS V3.6
6148: 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
6149: >0x1002c leshort x block size %d
6150: >0x10032 leshort &2 (mounted or unclean)
6151: >0x10000 lelong x num blocks %d
6152: >0x10040 lelong 1 tea hash
6153: >0x10040 lelong 2 yura hash
6154: >0x10040 lelong 3 r5 hash
6155:
6156: # JFFS - russell@coker.com.au
6157: 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
6158: 0 belong 0x34383931 Linux Journalled Flash File system, big endian
6159:
6160: # EST flat binary format (which isn't, but anyway)
6161: # From: Mark Brown <broonie@sirena.org.uk>
6162: 0 string ESTFBINR EST flat binary
6163:
6164: # Aculab VoIP firmware
6165: # From: Mark Brown <broonie@sirena.org.uk>
6166: 0 string VoIP\ Startup\ and Aculab VoIP firmware
6167: >35 string x format %s
6168:
6169: # u-boot/PPCBoot image file
6170: # From: Mark Brown <broonie@sirena.org.uk>
6171: 0 belong 0x27051956 u-boot/PPCBoot image
6172: >4 string PPCBoot
6173: >>12 string x version %s
6174:
6175: # JFFS2 file system
6176: 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
6177: 0 leshort 0x1985 Linux jffs2 filesystem data little endian
6178:
6179: # Squashfs
6180: 0 string sqsh Squashfs filesystem, big endian,
6181: >28 beshort x version %d.
6182: >30 beshort x \b%d,
6183: >28 beshort <3
6184: >>8 belong x %d bytes,
6185: >28 beshort >2
6186: >>63 bequad x %lld bytes,
6187: #>>67 belong x %d bytes,
6188: >4 belong x %d inodes,
6189: >28 beshort <2
6190: >>32 beshort x blocksize: %d bytes,
6191: >28 beshort >1
6192: >>51 belong x blocksize: %d bytes,
6193: >39 bedate x created: %s
6194: 0 string hsqs Squashfs filesystem, little endian,
6195: >28 leshort x version %d.
6196: >30 leshort x \b%d,
6197: >28 leshort <3
6198: >>8 lelong x %d bytes,
6199: >28 leshort >2
6200: >>63 lequad x %lld bytes,
6201: #>>63 lelong x %d bytes,
6202: >4 lelong x %d inodes,
6203: >28 leshort <2
6204: >>32 leshort x blocksize: %d bytes,
6205: >28 leshort >1
6206: >>51 lelong x blocksize: %d bytes,
6207: >39 ledate x created: %s
6208:
6209: 0 string td\000 floppy image data (TeleDisk)
6210:
6211: # AFS Dump Magic
6212: # From: Ty Sarna <tsarna@sarna.org>
6213: 0 string \x01\xb3\xa1\x13\x22 AFS Dump
6214: >&0 belong x (v%d)
6215: >>&0 byte 0x76
6216: >>>&0 belong x Vol %d,
6217: >>>>&0 byte 0x6e
6218: >>>>>&0 string x %s
6219: >>>>>>&1 byte 0x74
6220: >>>>>>>&0 beshort 2
6221: >>>>>>>>&4 bedate x on: %s
6222: >>>>>>>>&0 bedate =0 full dump
6223: >>>>>>>>&0 bedate !0 incremental since: %s
6224:
6225: #----------------------------------------------------------
6226: # VMS backup savesets - gerardo.cacciari@gmail.com
6227: #
6228: 4 string \x01\x00\x01\x00\x01\x00
6229: >(0.s+16) string \x01\x01
6230: >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
6231: >>>40 lelong x (block size %d,
6232: >>>49 string >\0 original name '%s',
6233: >>>2 short 1024 VAX generated)
6234: >>>2 short 2048 AXP generated)
6235: >>>2 short 4096 I64 generated)
6236:
6237: # Summary: Oracle Clustered Filesystem
6238: # Created by: Aaron Botsis <redhat@digitalmafia.org>
6239: 8 string OracleCFS Oracle Clustered Filesystem,
6240: >4 long x rev %d
6241: >0 long x \b.%d,
6242: >560 string x label: %.64s,
6243: >136 string x mountpoint: %.128s
6244:
6245: # Summary: Oracle ASM tagged volume
6246: # Created by: Aaron Botsis <redhat@digitalmafia.org>
6247: 32 string ORCLDISK Oracle ASM Volume,
6248: >40 string x Disk Name: %0.12s
6249: 32 string ORCLCLRD Oracle ASM Volume (cleared),
6250: >40 string x Disk Name: %0.12s
6251:
6252: # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
6253: 8 string OracleCFS Oracle Clustered Filesystem,
6254: >4 long x rev %d
6255: >0 long x \b.%d,
6256: >560 string x label: %.64s,
6257: >136 string x mountpoint: %.128s
6258:
6259: # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
6260: 32 string ORCLDISK Oracle ASM Volume,
6261: >40 string x Disk Name: %0.12s
6262: 32 string ORCLCLRD Oracle ASM Volume (cleared),
6263: >40 string x Disk Name: %0.12s
6264:
6265: # Compaq/HP RILOE floppy image
6266: # From: Dirk Jagdmann <doj@cubic.org>
6267: 0 string CPQRFBLO Compaq/HP RILOE floppy image
6268:
6269: #------------------------------------------------------------------------------
6270: # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com
6271: # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is
6272: # mapped to VBN 2 of [000000]INDEXF.SYS;1
6273: #
6274: 1008 string DECFILE11B Files-11 On-Disk Structure
6275: >525 byte x Level %d
6276: >525 byte x (ODS-%d OpenVMS file system),
6277: >984 string x volume label is '%-12.12s'
6278:
6279: # From: Thomas Klausner <wiz@NetBSD.org>
6280: # http://filext.com/file-extension/DAA
6281: # describes the daa file format. The magic would be:
6282: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
6283:
6284: # From Albert Cahalan <acahalan@gmail.com>
6285: # really le32 operation,destination,payloadsize (but quite predictable)
6286: # 01 00 00 00 00 00 00 c0 00 02 00 00
6287: 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
6288:
6289: # From Eric Sandeen
6290: # GFS2
6291: 0x10000 belong 0x01161970 GFS2 Filesystem
6292: >0x10024 belong x (blocksize %d,
6293: >0x10060 string >\0 lockproto %s)
6294:
6295: # dvdisaster's .ecc
6296: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
6297: 0 string *dvdisaster* dvdisaster error correction file
6298:
6299: # Type: CROM filesystem
6300: # From: Werner Fink <werner@suse.de>
6301: 0 string CROMFS CROMFS
6302: >6 string >\0 \b version %2.2s,
6303: >8 ulequad >0 \b block data at %lld,
6304: >16 ulequad >0 \b fblock table at %lld,
6305: >24 ulequad >0 \b inode table at %lld,
6306: >32 ulequad >0 \b root at %lld,
6307: >40 ulelong >0 \b fblock size = %ld,
6308: >44 ulelong >0 \b block size = %ld,
6309: >48 ulequad >0 \b bytes = %lld
6310:
6311: #------------------------------------------------------------------------------
6312: # flash: file(1) magic for Macromedia Flash file format
6313: #
6314: # See
6315: #
6316: # http://www.macromedia.com/software/flash/open/
6317: #
6318: 0 string FWS Macromedia Flash data,
6319: >3 byte x version %d
6320: !:mime application/x-shockwave-flash
6321: 0 string CWS Macromedia Flash data (compressed),
6322: !:mime application/x-shockwave-flash
6323: >3 byte x version %d
6324: # From: Cal Peake <cp@absolutedigital.net>
6325: 0 string FLV Macromedia Flash Video
6326: !:mime video/x-flv
6327:
6328: #
6329: # From Dave Wilson
6330: 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
6331: #------------------------------------------------------------------------------
6332: # fonts: file(1) magic for font data
6333: #
6334: 0 search/1 FONT ASCII vfont text
6335: 0 short 0436 Berkeley vfont data
6336: 0 short 017001 byte-swapped Berkeley vfont data
6337:
6338: # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
6339: 0 search/1 %!PS-AdobeFont-1. PostScript Type 1 font text
6340: >20 search/1 >\0 (%s)
6341: 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
6342:
6343: # X11 font files in SNF (Server Natural Format) format
6344: 0 belong 00000004 X11 SNF font data, MSB first
6345: 0 lelong 00000004 X11 SNF font data, LSB first
6346:
6347: # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
6348: 0 search/1 STARTFONT\ X11 BDF font text
6349:
6350: # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
6351: # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
6352: 0 string \001fcp X11 Portable Compiled Font data
6353: >12 byte 0x02 \b, LSB first
6354: >12 byte 0x0a \b, MSB first
6355: 0 string D1.0\015 X11 Speedo font data
6356:
6357: #------------------------------------------------------------------------------
6358: # FIGlet fonts and controlfiles
6359: # From figmagic supplied with Figlet version 2.2
6360: # "David E. O'Brien" <obrien@FreeBSD.ORG>
6361: 0 string flf FIGlet font
6362: >3 string >2a version %-2.2s
6363: 0 string flc FIGlet controlfile
6364: >3 string >2a version %-2.2s
6365:
6366: # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
6367: # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
6368: 0 belong 0x14025919 libGrx font data,
6369: >8 leshort x %dx
6370: >10 leshort x \b%d
6371: >40 string x %s
6372: # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
6373: 0 belong 0xff464f4e DOS code page font data collection
6374: 7 belong 0x00454741 DOS code page font data
6375: 7 belong 0x00564944 DOS code page font data (from Linux?)
6376: 4098 string DOSFONT DOSFONT2 encrypted font data
6377:
6378: # downloadable fonts for browser (prints type) anthon@mnt.org
6379: 0 string PFR1 PFR1 font
6380: >102 string >0 \b: %s
6381:
6382: # True Type fonts
6383: 0 string \000\001\000\000\000 TrueType font data
6384:
6385: 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
6386: 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
6387:
6388: # Opentype font data from Avi Bercovich
6389: 0 string OTTO OpenType font data
6390:
6391: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
6392: 0 string SplineFontDB: Spline Font Database
6393: >14 string x version %s
6394: # FORTRAN source
6395: 0 string/c c\ FORTRAN program
6396: !:mime text/x-fortran
6397: #------------------------------------------------------------------------------
6398: # frame: file(1) magic for FrameMaker files
6399: #
6400: # This stuff came on a FrameMaker demo tape, most of which is
6401: # copyright, but this file is "published" as witness the following:
6402: #
6403: # Note that this is the Framemaker Maker Interchange Format, not the
6404: # Normal format which would be application/vnd.framemaker.
6405: #
6406: 0 string \<MakerFile FrameMaker document
6407: !:mime application/x-mif
6408: >11 string 5.5 (5.5
6409: >11 string 5.0 (5.0
6410: >11 string 4.0 (4.0
6411: >11 string 3.0 (3.0
6412: >11 string 2.0 (2.0
6413: >11 string 1.0 (1.0
6414: >14 byte x %c)
6415: 0 string \<MIFFile FrameMaker MIF (ASCII) file
6416: !:mime application/x-mif
6417: >9 string 4.0 (4.0)
6418: >9 string 3.0 (3.0)
6419: >9 string 2.0 (2.0)
6420: >9 string 1.0 (1.x)
6421: 0 search/1 \<MakerDictionary FrameMaker Dictionary text
6422: !:mime application/x-mif
6423: >17 string 3.0 (3.0)
6424: >17 string 2.0 (2.0)
6425: >17 string 1.0 (1.x)
6426: 0 string \<MakerScreenFont FrameMaker Font file
6427: !:mime application/x-mif
6428: >17 string 1.01 (%s)
6429: 0 string \<MML FrameMaker MML file
6430: !:mime application/x-mif
6431: 0 string \<BookFile FrameMaker Book file
6432: !:mime application/x-mif
6433: >10 string 3.0 (3.0
6434: >10 string 2.0 (2.0
6435: >10 string 1.0 (1.0
6436: >13 byte x %c)
6437: # XXX - this book entry should be verified, if you find one, uncomment this
6438: #0 string \<Book\ FrameMaker Book (ASCII) file
6439: #!:mime application/x-mif
6440: #>6 string 3.0 (3.0)
6441: #>6 string 2.0 (2.0)
6442: #>6 string 1.0 (1.0)
6443: 0 string \<Maker Intermediate Print File FrameMaker IPL file
6444: !:mime application/x-mif
6445:
6446: #------------------------------------------------------------------------------
6447: # freebsd: file(1) magic for FreeBSD objects
6448: #
6449: # All new-style FreeBSD magic numbers are in host byte order (i.e.,
6450: # little-endian on x86).
6451: #
6452: # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
6453: # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
6454: # schemes for distinguishing between executable images, shared libraries,
6455: # and object files.
6456: #
6457: # FreeBSD says:
6458: #
6459: # Regardless of whether it's pure, demand-paged, or none of the
6460: # above:
6461: #
6462: # if the entry point is < 4096, then it's a shared library if
6463: # the "has run-time loader information" bit is set, and is
6464: # position-independent if the "is position-independent" bit
6465: # is set;
6466: #
6467: # if the entry point is >= 4096 (or >4095, same thing), then it's
6468: # an executable, and is dynamically-linked if the "has run-time
6469: # loader information" bit is set.
6470: #
6471: # On x86, NetBSD says:
6472: #
6473: # If it's neither pure nor demand-paged:
6474: #
6475: # if it has the "has run-time loader information" bit set, it's
6476: # a dynamically-linked executable;
6477: #
6478: # if it doesn't have that bit set, then:
6479: #
6480: # if it has the "is position-independent" bit set, it's
6481: # position-independent;
6482: #
6483: # if the entry point is non-zero, it's an executable, otherwise
6484: # it's an object file.
6485: #
6486: # If it's pure:
6487: #
6488: # if it has the "has run-time loader information" bit set, it's
6489: # a dynamically-linked executable, otherwise it's just an
6490: # executable.
6491: #
6492: # If it's demand-paged:
6493: #
6494: # if it has the "has run-time loader information" bit set,
6495: # then:
6496: #
6497: # if the entry point is < 4096, it's a shared library;
6498: #
6499: # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
6500: # it's a dynamically-linked executable);
6501: #
6502: # if it doesn't have the "has run-time loader information" bit
6503: # set, then it's just an executable.
6504: #
6505: # (On non-x86, NetBSD does much the same thing, except that it uses
6506: # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
6507: # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
6508: # had 8K pages; dunno about MIPS.)
6509: #
6510: # I suspect the two will differ only in perverse and uninteresting cases
6511: # ("shared" libraries that aren't demand-paged and whose pages probably
6512: # won't actually be shared, executables with entry points <4096).
6513: #
6514: # I leave it to those more familiar with FreeBSD and NetBSD to figure out
6515: # what the right answer is (although using ">4095", FreeBSD-style, is
6516: # probably better than separately checking for "=4096" and ">4096",
6517: # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
6518: # executables using the NetBSD technique.)
6519: #
6520: 0 lelong&0377777777 041400407 FreeBSD/i386
6521: >20 lelong <4096
6522: >>3 byte&0xC0 &0x80 shared library
6523: >>3 byte&0xC0 0x40 PIC object
6524: >>3 byte&0xC0 0x00 object
6525: >20 lelong >4095
6526: >>3 byte&0x80 0x80 dynamically linked executable
6527: >>3 byte&0x80 0x00 executable
6528: >16 lelong >0 not stripped
6529:
6530: 0 lelong&0377777777 041400410 FreeBSD/i386 pure
6531: >20 lelong <4096
6532: >>3 byte&0xC0 &0x80 shared library
6533: >>3 byte&0xC0 0x40 PIC object
6534: >>3 byte&0xC0 0x00 object
6535: >20 lelong >4095
6536: >>3 byte&0x80 0x80 dynamically linked executable
6537: >>3 byte&0x80 0x00 executable
6538: >16 lelong >0 not stripped
6539:
6540: 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
6541: >20 lelong <4096
6542: >>3 byte&0xC0 &0x80 shared library
6543: >>3 byte&0xC0 0x40 PIC object
6544: >>3 byte&0xC0 0x00 object
6545: >20 lelong >4095
6546: >>3 byte&0x80 0x80 dynamically linked executable
6547: >>3 byte&0x80 0x00 executable
6548: >16 lelong >0 not stripped
6549:
6550: 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
6551: >20 lelong <4096
6552: >>3 byte&0xC0 &0x80 shared library
6553: >>3 byte&0xC0 0x40 PIC object
6554: >>3 byte&0xC0 0x00 object
6555: >20 lelong >4095
6556: >>3 byte&0x80 0x80 dynamically linked executable
6557: >>3 byte&0x80 0x00 executable
6558: >16 lelong >0 not stripped
6559:
6560: # XXX gross hack to identify core files
6561: # cores start with a struct tss; we take advantage of the following:
6562: # byte 7: highest byte of the kernel stack pointer, always 0xfe
6563: # 8/9: kernel (ring 0) ss value, always 0x0010
6564: # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
6565: # 28: low order byte of the current PTD entry, always 0 since the
6566: # PTD is page-aligned
6567: #
6568: 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
6569: >1039 string >\0 from '%s'
6570:
6571: # /var/run/ld.so.hints
6572: # What are you laughing about?
6573: 0 lelong 011421044151 ld.so hints file (Little Endian
6574: >4 lelong >0 \b, version %d)
6575: >4 belong <1 \b)
6576: 0 belong 011421044151 ld.so hints file (Big Endian
6577: >4 belong >0 \b, version %d)
6578: >4 belong <1 \b)
6579:
6580: #
6581: # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
6582: #
6583: 0 string SCRSHOT_ scrshot(1) screenshot,
6584: >8 byte x version %d,
6585: >9 byte 2 %d bytes in header,
6586: >>10 byte x %d chars wide by
6587: >>11 byte x %d chars high
6588:
6589: #------------------------------------------------------------------------------
6590: # fsav: file(1) magic for datafellows fsav virus definition files
6591: # Anthon van der Neut (anthon@mnt.org)
6592:
6593: # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
6594: 0 beshort 0x1575 fsav macro virus signatures
6595: >8 leshort >0 (%d-
6596: >11 byte >0 \b%02d-
6597: >10 byte >0 \b%02d)
6598: # ftp://ftp.f-prot.com/pub/sign.zip
6599: #10 ubyte <12
6600: #>9 ubyte <32
6601: #>>8 ubyte 0x0a
6602: #>>>12 ubyte 0x07
6603: #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
6604: #>>>>10 byte 0 \b01-
6605: #>>>>10 byte 1 \b02-
6606: #>>>>10 byte 2 \b03-
6607: #>>>>10 byte 3 \b04-
6608: #>>>>10 byte 4 \b05-
6609: #>>>>10 byte 5 \b06-
6610: #>>>>10 byte 6 \b07-
6611: #>>>>10 byte 7 \b08-
6612: #>>>>10 byte 8 \b09-
6613: #>>>>10 byte 9 \b10-
6614: #>>>>10 byte 10 \b11-
6615: #>>>>10 byte 11 \b12-
6616: #>>>>9 ubyte >0 \b%02d)
6617: # ftp://ftp.f-prot.com/pub/sign2.zip
6618: #0 ubyte 0x62
6619: #>1 ubyte 0xF5
6620: #>>2 ubyte 0x1
6621: #>>>3 ubyte 0x1
6622: #>>>>4 ubyte 0x0e
6623: #>>>>>13 ubyte >0 fsav virus signatures
6624: #>>>>>>11 ubyte x size 0x%02x
6625: #>>>>>>12 ubyte x \b%02x
6626: #>>>>>>13 ubyte x \b%02x bytes
6627:
6628: # Joerg Jenderek: joerg dot jenderek at web dot de
6629: # http://www.clamav.net/doc/latest/html/node45.html
6630: # .cvd files start with a 512 bytes colon separated header
6631: # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
6632: # + gzipped tarball files
6633: 0 string ClamAV-VDB:
6634: >11 string >\0 Clam AntiVirus database %-.23s
6635: >>34 string :
6636: >>>35 string !: \b, version
6637: >>>>35 string x \b%-.1s
6638: >>>>>36 string !:
6639: >>>>>>36 string x \b%-.1s
6640: >>>>>>>37 string !:
6641: >>>>>>>>37 string x \b%-.1s
6642: >>>>>>>>>38 string !:
6643: >>>>>>>>>>38 string x \b%-.1s
6644: >512 string \037\213 \b, gzipped
6645: >769 string ustar\0 \b, tarred
6646:
6647: # Type: Grisoft AVG AntiVirus
6648: # From: David Newgas <david@newgas.net>
6649: 0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
6650: #------------------------------------------------------------------------------
6651: # games: file(1) for games
6652:
6653: # Fabio Bonelli <fabiobonelli@libero.it>
6654: # Quake II - III data files
6655: 0 string IDP2 Quake II 3D Model file,
6656: >20 long x %lu skin(s),
6657: >8 long x (%lu x
6658: >12 long x %lu),
6659: >40 long x %lu frame(s),
6660: >16 long x Frame size %lu bytes,
6661: >24 long x %lu vertices/frame,
6662: >28 long x %lu texture coordinates,
6663: >32 long x %lu triangles/frame
6664:
6665: 0 string IBSP Quake
6666: >4 long 0x26 II Map file (BSP)
6667: >4 long 0x2E III Map file (BSP)
6668:
6669: 0 string IDS2 Quake II SP2 sprite file
6670:
6671: #---------------------------------------------------------------------------
6672: # Doom and Quake
6673: # submitted by Nicolas Patrois
6674:
6675: 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
6676: # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
6677:
6678: 24 string LxD\ 203 Linuxdoom save
6679: >0 string x , name=%s
6680: >44 string x , world=%s
6681:
6682: # Quake
6683:
6684: 0 string PACK Quake I or II world or extension
6685:
6686: #0 string -1\x0a Quake I demo
6687: #>30 string x version %.4s
6688: #>61 string x level %s
6689:
6690: #0 string 5\x0a Quake I save
6691:
6692: # The levels
6693:
6694: # Quake 1
6695:
6696: 0 string 5\x0aIntroduction Quake I save: start Introduction
6697: 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
6698: 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
6699: 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
6700: 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
6701: 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
6702: 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
6703: 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
6704: 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
6705: 0 string 5\x0athe_Installation Quake I save: e2m1 The installation
6706: 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
6707: 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
6708: 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
6709: 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
6710: 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
6711: 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
6712: 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
6713: 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
6714: 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
6715: 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
6716: 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
6717: 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
6718: 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
6719: 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
6720: 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
6721: 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
6722: 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
6723: 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
6724: 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
6725: 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
6726: 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
6727: 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
6728:
6729: # Quake DeathMatch levels
6730:
6731: 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
6732: 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
6733: 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
6734: 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
6735: 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
6736: 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
6737:
6738: # Scourge of Armagon
6739:
6740: 0 string 5\x0aCommand_HQ Quake I save: start Command HQ
6741: 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
6742: 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
6743: 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
6744: 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
6745: 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
6746: 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
6747: 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
6748: 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
6749: 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
6750: 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
6751: 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
6752: 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
6753: 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
6754: 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
6755: 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
6756: 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
6757: 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
6758:
6759: # Malice
6760:
6761: 0 string 5\x0aThe_Academy Quake I save: start The academy
6762: 0 string 5\x0aThe_Lab Quake I save: d1 The lab
6763: 0 string 5\x0aArea_33 Quake I save: d1b Area 33
6764: 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
6765: 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
6766: 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
6767: 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
6768: 0 string 5\x0aArea44 Quake I save: d1c Area 44
6769: 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
6770: 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
6771: 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
6772: 0 string 5\x0aThe_Flood Quake I save: d5 The flood
6773: 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
6774: 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
6775: 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
6776: 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
6777: 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
6778: 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
6779: 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
6780: 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
6781: 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
6782:
6783: # Malice DeathMatch levels
6784:
6785: 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
6786: 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
6787: 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
6788: 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
6789: 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
6790: 0 string 5\x0aDOMINO Quake I save: ddm6 Domino
6791: 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
6792:
6793:
6794: 0 string MComprHD MAME CHD compressed hard disk image,
6795: >12 belong x version %lu
6796:
6797: # doom - submitted by Jon Dowland
6798:
6799: 0 string =IWAD doom main IWAD data
6800: >4 lelong x containing %d lumps
6801: 0 string =PWAD doom patch PWAD data
6802: >4 lelong x containing %d lumps
6803:
6804:
6805: # Summary: Warcraft 3 save
6806: # Extension: .w3g
6807: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
6808: 0 string Warcraft\ III\ recorded\ game %s
6809:
6810:
6811: # Summary: Warcraft 3 map
6812: # Extension: .w3m
6813: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
6814: 0 string HM3W Warcraft III map file
6815:
6816:
6817: # Summary: SGF Smart Game Format
6818: # Extension: .sgf
6819: # Reference: http://www.red-bean.com/sgf/
6820: # Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
6821: # Modified by (1): Abel Cheung (regex, more game format)
6822: # FIXME: Some games don't have GM (game type)
6823: 0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
6824: >2 search/0x200 GM[
6825: >>&0 string 1] (Go)
6826: >>&0 string 2] (Othello)
6827: >>&0 string 3] (chess)
6828: >>&0 string 4] (Gomoku+Renju)
6829: >>&0 string 5] (Nine Men's Morris)
6830: >>&0 string 6] (Backgammon)
6831: >>&0 string 7] (Chinese chess)
6832: >>&0 string 8] (Shogi)
6833: >>&0 string 9] (Lines of Action)
6834: >>&0 string 10] (Ataxx)
6835: >>&0 string 11] (Hex)
6836: >>&0 string 12] (Jungle)
6837: >>&0 string 13] (Neutron)
6838: >>&0 string 14] (Philosopher's Football)
6839: >>&0 string 15] (Quadrature)
6840: >>&0 string 16] (Trax)
6841: >>&0 string 17] (Tantrix)
6842: >>&0 string 18] (Amazons)
6843: >>&0 string 19] (Octi)
6844: >>&0 string 20] (Gess)
6845: >>&0 string 21] (Twixt)
6846: >>&0 string 22] (Zertz)
6847: >>&0 string 23] (Plateau)
6848: >>&0 string 24] (Yinsh)
6849: >>&0 string 25] (Punct)
6850: >>&0 string 26] (Gobblet)
6851: >>&0 string 27] (hive)
6852: >>&0 string 28] (Exxit)
6853: >>&0 string 29] (Hnefatal)
6854: >>&0 string 30] (Kuba)
6855: >>&0 string 31] (Tripples)
6856: >>&0 string 32] (Chase)
6857: >>&0 string 33] (Tumbling Down)
6858: >>&0 string 34] (Sahara)
6859: >>&0 string 35] (Byte)
6860: >>&0 string 36] (Focus)
6861: >>&0 string 37] (Dvonn)
6862: >>&0 string 38] (Tamsk)
6863: >>&0 string 39] (Gipf)
6864: >>&0 string 40] (Kropki)
6865:
6866:
6867: # Summary: Civilization 4 video
6868: # Extension: .bik
6869: # Created by: Abel Cheung <abelcheung@gmail.com>
6870: 0 string BIKi Civilization 4 Video
6871:
6872:
6873: ##############################################
6874: # NetImmerse/Gamebryo game engine entries
6875:
6876: # Summary: Gamebryo game engine file
6877: # Extension: .nif, .kf
6878: # Created by: Abel Cheung <abelcheung@gmail.com>
6879: 0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file
6880: >&0 regex [0-9a-z.]+ \b, version %s
6881:
6882: # Summary: Gamebryo game engine file
6883: # Extension: .kfm
6884: # Created by: Abel Cheung <abelcheung@gmail.com>
6885: 0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File
6886: >&0 regex [0-9a-z.]+ \b, version %s
6887:
6888: # Summary: NetImmerse game engine file
6889: # Extension .nif
6890: # Created by: Abel Cheung <abelcheung@gmail.com>
6891: 0 string NetImmerse\ File\ Format,\ Versio
6892: >&0 string n\ NetImmerse game engine file
6893: >>&0 regex [0-9a-z.]+ \b, version %s
6894:
6895: # Type: SGF Smart Game Format
6896: # URL: http://www.red-bean.com/sgf/
6897: # From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
6898: 2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
6899: >2 regex/c GM\\[1\\] - Go Game
6900: >2 regex/c GM\\[6\\] - BackGammon Game
6901: >2 regex/c GM\\[11\\] - Hex Game
6902: >2 regex/c GM\\[18\\] - Amazons Game
6903: >2 regex/c GM\\[19\\] - Octi Game
6904: >2 regex/c GM\\[20\\] - Gess Game
6905: >2 regex/c GM\\[21\\] - twix Game
6906:
6907: #------------------------------------------------------------------------------
6908: # gcc: file(1) magic for GCC special files
6909: #
6910: 0 string gpch GCC precompiled header
6911:
6912: # The version field is annoying. It's 3 characters, not zero-terminated.
6913: >5 byte x (version %c
6914: >6 byte x \b%c
6915: >7 byte x \b%c)
6916:
6917: # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
6918: >4 byte 67 for C
6919: >4 byte 111 for Objective C
6920: >4 byte 43 for C++
6921: >4 byte 79 for Objective C++
6922:
6923: #------------------------------------------------------------------------------
6924: # GEOS files (Vidar Madsen, vidar@gimp.org)
6925: # semi-commonly used in embedded and handheld systems.
6926: 0 belong 0xc745c153 GEOS
6927: >40 byte 1 executable
6928: >40 byte 2 VMFile
6929: >40 byte 3 binary
6930: >40 byte 4 directory label
6931: >40 byte <1 unknown
6932: >40 byte >4 unknown
6933: >4 string >\0 \b, name "%s"
6934: #>44 short x \b, version %d
6935: #>46 short x \b.%d
6936: #>48 short x \b, rev %d
6937: #>50 short x \b.%d
6938: #>52 short x \b, proto %d
6939: #>54 short x \br%d
6940: #>168 string >\0 \b, copyright "%s"
6941: #------------------------------------------------------------------------------
6942: # GIMP Gradient: file(1) magic for the GIMP's gradient data files
6943: # by Federico Mena <federico@nuclecu.unam.mx>
6944:
6945: 0 string GIMP\ Gradient GIMP gradient data
6946:
6947: #------------------------------------------------------------------------------
6948: # XCF: file(1) magic for the XCF image format used in the GIMP developed
6949: # by Spencer Kimball and Peter Mattis
6950: # ('Bucky' LaDieu, nega@vt.edu)
6951:
6952: 0 string gimp\ xcf GIMP XCF image data,
6953: >9 string file version 0,
6954: >9 string v version
6955: >>10 string >\0 %s,
6956: >14 belong x %lu x
6957: >18 belong x %lu,
6958: >22 belong 0 RGB Color
6959: >22 belong 1 Greyscale
6960: >22 belong 2 Indexed Color
6961: >22 belong >2 Unknown Image Type.
6962:
6963: #------------------------------------------------------------------------------
6964: # XCF: file(1) magic for the patterns used in the GIMP, developed
6965: # by Spencer Kimball and Peter Mattis
6966: # ('Bucky' LaDieu, nega@vt.edu)
6967:
6968: 20 string GPAT GIMP pattern data,
6969: >24 string x %s
6970:
6971: #------------------------------------------------------------------------------
6972: # XCF: file(1) magic for the brushes used in the GIMP, developed
6973: # by Spencer Kimball and Peter Mattis
6974: # ('Bucky' LaDieu, nega@vt.edu)
6975:
6976: 20 string GIMP GIMP brush data
6977:
6978: # GIMP Curves File
6979: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
6980: 0 string #\040GIMP\040Curves\040File GIMP curve file
6981: # GNOME keyring
6982: # Contributed by Josh Triplett
6983: # FIXME: Could be simplified if pstring supported two-byte counts
6984: 0 string GnomeKeyring\n\r\0\n GNOME keyring
6985: >&0 ubyte 0 \b, major version 0
6986: >>&0 ubyte 0 \b, minor version 0
6987: >>>&0 ubyte 0 \b, crypto type 0 (AEL)
6988: >>>&0 ubyte >0 \b, crypto type %hhu (unknown)
6989: >>>&1 ubyte 0 \b, hash type 0 (MD5)
6990: >>>&1 ubyte >0 \b, hash type %hhu (unknown)
6991: >>>&2 ubelong 0xFFFFFFFF \b, name NULL
6992: >>>&2 ubelong !0xFFFFFFFF
6993: >>>>&-4 ubelong >255 \b, name too long for file's pstring type
6994: >>>>&-4 ubelong <256
6995: >>>>>&-1 pstring x \b, name "%s"
6996: >>>>>>&0 ubeqdate x \b, last modified %s
6997: >>>>>>&8 ubeqdate x \b, created %s
6998: >>>>>>&16 ubelong &1
6999: >>>>>>>&0 ubelong x \b, locked if idle for %u seconds
7000: >>>>>>&16 ubelong ^1 \b, not locked if idle
7001: >>>>>>&24 ubelong x \b, hash iterations %u
7002: >>>>>>&28 ubequad x \b, salt %llu
7003: >>>>>>&52 ubelong x \b, %u item(s)
7004: #------------------------------------------------------------------------------
7005: # gnu: file(1) magic for various GNU tools
7006: #
7007: # GNU nlsutils message catalog file format
7008: #
7009: 0 string \336\22\4\225 GNU message catalog (little endian),
7010: >4 lelong x revision %d,
7011: >8 lelong x %d messages
7012: 0 string \225\4\22\336 GNU message catalog (big endian),
7013: >4 belong x revision %d,
7014: >8 belong x %d messages
7015: # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
7016: 0 string *nazgul* Nazgul style compiled message catalog
7017: >8 lelong >0 \b, version %ld
7018:
7019: # GnuPG
7020: # The format is very similar to pgp
7021: 0 string \001gpg GPG key trust database
7022: >4 byte x version %d
7023: # Note: magic.mime had 0x8501 for the next line instead of 0x8502
7024: 0 beshort 0x8502 GPG encrypted data
7025: !:mime text/PGP # encoding: data
7026:
7027: # This magic is not particularly good, as the keyrings don't have true
7028: # magic. Nevertheless, it covers many keyrings.
7029: 0 beshort 0x9901 GPG key public ring
7030: !:mime application/x-gnupg-keyring
7031:
7032: # Gnumeric spreadsheet
7033: # This entry is only semi-helpful, as Gnumeric compresses its files, so
7034: # they will ordinarily reported as "compressed", but at least -z helps
7035: 39 string =<gmr:Workbook Gnumeric spreadsheet
7036:
7037: # From: James Youngman <jay@gnu.org>
7038: # gnu find magic
7039: 0 string \0LOCATE GNU findutils locate database data
7040: >7 string >\0 \b, format %s
7041: >7 string 02 \b (frcode)
7042:
7043: # Files produced by GNU gettext
7044: 0 long 0xDE120495 GNU-format message catalog data
7045: 0 long 0x950412DE GNU-format message catalog data
7046:
7047: #------------------------------------------------------------------------------
7048: # gnumeric: file(1) magic for Gnumeric spreadsheet
7049: # This entry is only semi-helpful, as Gnumeric compresses its files, so
7050: # they will ordinarily reported as "compressed", but at least -z helps
7051: 39 string =<gmr:Workbook Gnumeric spreadsheet
7052: !:mime application/x-gnumeric
7053:
7054: #------------------------------------------------------------------------------
7055: # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
7056: #
7057: # ACE/gr binary
7058: 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
7059: >39 byte >0 - version %c
7060: # ACE/gr ascii
7061: 0 string #\ xvgr\ parameter\ file ACE/gr ascii file
7062: 0 string #\ xmgr\ parameter\ file ACE/gr ascii file
7063: 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
7064: # Grace projects
7065: 0 string #\ Grace\ project\ file Grace project file
7066: >23 string @version\ (version
7067: >>32 byte >0 %c
7068: >>33 string >\0 \b.%.2s
7069: >>35 string >\0 \b.%.2s)
7070: # ACE/gr fit description files
7071: 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
7072: # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
7073:
7074: #------------------------------------------------------------------------------
7075: # graphviz: file(1) magic for http://www.graphviz.org/
7076: 0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]*.*\\{ graphviz graph text
7077: !:mime text/vnd.graphviz
7078: 0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]*.*\\{ graphviz digraph text
7079: !:mime text/vnd.graphviz
7080:
7081: #------------------------------------------------------------------------------
7082: # gringotts: file(1) magic for Gringotts
7083: # http://devel.pluto.linux.it/projects/Gringotts/
7084: # author: Germano Rizzo <mano@pluto.linux.it>
7085: #GRG3????Y
7086: 0 string GRG Gringotts data file
7087: #file format 1
7088: >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
7089: #file format 2
7090: >3 string 2 v.2, MCRYPT S2K,
7091: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
7092: >>8 byte&0x70 0x10 SERPENT crypt,
7093: >>8 byte&0x70 0x20 TWOFISH crypt,
7094: >>8 byte&0x70 0x30 CAST-256 crypt,
7095: >>8 byte&0x70 0x40 SAFER+ crypt,
7096: >>8 byte&0x70 0x50 LOKI97 crypt,
7097: >>8 byte&0x70 0x60 3DES crypt,
7098: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
7099: >>8 byte&0x08 0x00 SHA1 hash,
7100: >>8 byte&0x08 0x08 RIPEMD-160 hash,
7101: >>8 byte&0x04 0x00 ZLib
7102: >>8 byte&0x04 0x04 BZip2
7103: >>8 byte&0x03 0x00 lvl.0
7104: >>8 byte&0x03 0x01 lvl.3
7105: >>8 byte&0x03 0x02 lvl.6
7106: >>8 byte&0x03 0x03 lvl.9
7107: #file format 3
7108: >3 string 3 v.3, OpenPGP S2K,
7109: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
7110: >>8 byte&0x70 0x10 SERPENT crypt,
7111: >>8 byte&0x70 0x20 TWOFISH crypt,
7112: >>8 byte&0x70 0x30 CAST-256 crypt,
7113: >>8 byte&0x70 0x40 SAFER+ crypt,
7114: >>8 byte&0x70 0x50 LOKI97 crypt,
7115: >>8 byte&0x70 0x60 3DES crypt,
7116: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
7117: >>8 byte&0x08 0x00 SHA1 hash,
7118: >>8 byte&0x08 0x08 RIPEMD-160 hash,
7119: >>8 byte&0x04 0x00 ZLib
7120: >>8 byte&0x04 0x04 BZip2
7121: >>8 byte&0x03 0x00 lvl.0
7122: >>8 byte&0x03 0x01 lvl.3
7123: >>8 byte&0x03 0x02 lvl.6
7124: >>8 byte&0x03 0x03 lvl.9
7125: #file format >3
7126: >3 string >3 v.%.1s (unknown details)
7127:
7128: #------------------------------------------------------------------------------
7129: # hitach-sh: file(1) magic for Hitachi Super-H
7130: #
7131: # Super-H COFF
7132: #
7133: 0 beshort 0x0500 Hitachi SH big-endian COFF
7134: >18 beshort&0x0002 =0x0000 object
7135: >18 beshort&0x0002 =0x0002 executable
7136: >18 beshort&0x0008 =0x0008 \b, stripped
7137: >18 beshort&0x0008 =0x0000 \b, not stripped
7138: #
7139: 0 leshort 0x0550 Hitachi SH little-endian COFF
7140: >18 leshort&0x0002 =0x0000 object
7141: >18 leshort&0x0002 =0x0002 executable
7142: >18 leshort&0x0008 =0x0008 \b, stripped
7143: >18 leshort&0x0008 =0x0000 \b, not stripped
7144:
7145: #------------------------------------------------------------------------------
7146: # hp: file(1) magic for Hewlett Packard machines (see also "printer")
7147: #
7148: # XXX - somebody should figure out whether any byte order needs to be
7149: # applied to the "TML" stuff; I'm assuming the Apollo stuff is
7150: # big-endian as it was mostly 68K-based.
7151: #
7152: # I think the 500 series was the old stack-based machines, running a
7153: # UNIX environment atop the "SUN kernel"; dunno whether it was
7154: # big-endian or little-endian.
7155: #
7156: # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
7157: # hp300 are 68020+68881 based; hp400 are also 68k. The following basic
7158: # HP magic is useful for reference, but using "long" magic is a better
7159: # practice in order to avoid collisions.
7160: #
7161: # Guy Harris (guy@netapp.com): some additions to this list came from
7162: # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
7163: # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
7164: # "/etc/magic", though, except for the "archive file relocatable library"
7165: # stuff, and the 68030 and 68040 stuff isn't there at all - are they not
7166: # used in executables, or have they just not yet updated "/etc/magic"
7167: # completely?
7168: #
7169: # 0 beshort 200 hp200 (68010) BSD binary
7170: # 0 beshort 300 hp300 (68020+68881) BSD binary
7171: # 0 beshort 0x20c hp200/300 HP-UX binary
7172: # 0 beshort 0x20d hp400 (68030) HP-UX binary
7173: # 0 beshort 0x20e hp400 (68040?) HP-UX binary
7174: # 0 beshort 0x20b PA-RISC1.0 HP-UX binary
7175: # 0 beshort 0x210 PA-RISC1.1 HP-UX binary
7176: # 0 beshort 0x211 PA-RISC1.2 HP-UX binary
7177: # 0 beshort 0x214 PA-RISC2.0 HP-UX binary
7178:
7179: #
7180: # The "misc" stuff needs a byte order; the archives look suspiciously
7181: # like the old 177545 archives (0xff65 = 0177545).
7182: #
7183: #### Old Apollo stuff
7184: 0 beshort 0627 Apollo m68k COFF executable
7185: >18 beshort ^040000 not stripped
7186: >22 beshort >0 - version %ld
7187: 0 beshort 0624 apollo a88k COFF executable
7188: >18 beshort ^040000 not stripped
7189: >22 beshort >0 - version %ld
7190: 0 long 01203604016 TML 0123 byte-order format
7191: 0 long 01702407010 TML 1032 byte-order format
7192: 0 long 01003405017 TML 2301 byte-order format
7193: 0 long 01602007412 TML 3210 byte-order format
7194: #### PA-RISC 1.1
7195: 0 belong 0x02100106 PA-RISC1.1 relocatable object
7196: 0 belong 0x02100107 PA-RISC1.1 executable
7197: >168 belong &0x00000004 dynamically linked
7198: >(144) belong 0x054ef630 dynamically linked
7199: >96 belong >0 - not stripped
7200:
7201: 0 belong 0x02100108 PA-RISC1.1 shared executable
7202: >168 belong&0x4 0x4 dynamically linked
7203: >(144) belong 0x054ef630 dynamically linked
7204: >96 belong >0 - not stripped
7205:
7206: 0 belong 0x0210010b PA-RISC1.1 demand-load executable
7207: >168 belong&0x4 0x4 dynamically linked
7208: >(144) belong 0x054ef630 dynamically linked
7209: >96 belong >0 - not stripped
7210:
7211: 0 belong 0x0210010e PA-RISC1.1 shared library
7212: >96 belong >0 - not stripped
7213:
7214: 0 belong 0x0210010d PA-RISC1.1 dynamic load library
7215: >96 belong >0 - not stripped
7216:
7217: #### PA-RISC 2.0
7218: 0 belong 0x02140106 PA-RISC2.0 relocatable object
7219:
7220: 0 belong 0x02140107 PA-RISC2.0 executable
7221: >168 belong &0x00000004 dynamically linked
7222: >(144) belong 0x054ef630 dynamically linked
7223: >96 belong >0 - not stripped
7224:
7225: 0 belong 0x02140108 PA-RISC2.0 shared executable
7226: >168 belong &0x00000004 dynamically linked
7227: >(144) belong 0x054ef630 dynamically linked
7228: >96 belong >0 - not stripped
7229:
7230: 0 belong 0x0214010b PA-RISC2.0 demand-load executable
7231: >168 belong &0x00000004 dynamically linked
7232: >(144) belong 0x054ef630 dynamically linked
7233: >96 belong >0 - not stripped
7234:
7235: 0 belong 0x0214010e PA-RISC2.0 shared library
7236: >96 belong >0 - not stripped
7237:
7238: 0 belong 0x0214010d PA-RISC2.0 dynamic load library
7239: >96 belong >0 - not stripped
7240:
7241: #### 800
7242: 0 belong 0x020b0106 PA-RISC1.0 relocatable object
7243:
7244: 0 belong 0x020b0107 PA-RISC1.0 executable
7245: >168 belong&0x4 0x4 dynamically linked
7246: >(144) belong 0x054ef630 dynamically linked
7247: >96 belong >0 - not stripped
7248:
7249: 0 belong 0x020b0108 PA-RISC1.0 shared executable
7250: >168 belong&0x4 0x4 dynamically linked
7251: >(144) belong 0x054ef630 dynamically linked
7252: >96 belong >0 - not stripped
7253:
7254: 0 belong 0x020b010b PA-RISC1.0 demand-load executable
7255: >168 belong&0x4 0x4 dynamically linked
7256: >(144) belong 0x054ef630 dynamically linked
7257: >96 belong >0 - not stripped
7258:
7259: 0 belong 0x020b010e PA-RISC1.0 shared library
7260: >96 belong >0 - not stripped
7261:
7262: 0 belong 0x020b010d PA-RISC1.0 dynamic load library
7263: >96 belong >0 - not stripped
7264:
7265: 0 belong 0x213c6172 archive file
7266: >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
7267: >68 belong 0x02100619 - PA-RISC1.1 relocatable library
7268: >68 belong 0x02110619 - PA-RISC1.2 relocatable library
7269: >68 belong 0x02140619 - PA-RISC2.0 relocatable library
7270:
7271: #### 500
7272: 0 long 0x02080106 HP s500 relocatable executable
7273: >16 long >0 - version %ld
7274:
7275: 0 long 0x02080107 HP s500 executable
7276: >16 long >0 - version %ld
7277:
7278: 0 long 0x02080108 HP s500 pure executable
7279: >16 long >0 - version %ld
7280:
7281: #### 200
7282: 0 belong 0x020c0108 HP s200 pure executable
7283: >4 beshort >0 - version %ld
7284: >8 belong &0x80000000 save fp regs
7285: >8 belong &0x40000000 dynamically linked
7286: >8 belong &0x20000000 debuggable
7287: >36 belong >0 not stripped
7288:
7289: 0 belong 0x020c0107 HP s200 executable
7290: >4 beshort >0 - version %ld
7291: >8 belong &0x80000000 save fp regs
7292: >8 belong &0x40000000 dynamically linked
7293: >8 belong &0x20000000 debuggable
7294: >36 belong >0 not stripped
7295:
7296: 0 belong 0x020c010b HP s200 demand-load executable
7297: >4 beshort >0 - version %ld
7298: >8 belong &0x80000000 save fp regs
7299: >8 belong &0x40000000 dynamically linked
7300: >8 belong &0x20000000 debuggable
7301: >36 belong >0 not stripped
7302:
7303: 0 belong 0x020c0106 HP s200 relocatable executable
7304: >4 beshort >0 - version %ld
7305: >6 beshort >0 - highwater %d
7306: >8 belong &0x80000000 save fp regs
7307: >8 belong &0x20000000 debuggable
7308: >8 belong &0x10000000 PIC
7309:
7310: 0 belong 0x020a0108 HP s200 (2.x release) pure executable
7311: >4 beshort >0 - version %ld
7312: >36 belong >0 not stripped
7313:
7314: 0 belong 0x020a0107 HP s200 (2.x release) executable
7315: >4 beshort >0 - version %ld
7316: >36 belong >0 not stripped
7317:
7318: 0 belong 0x020c010e HP s200 shared library
7319: >4 beshort >0 - version %ld
7320: >6 beshort >0 - highwater %d
7321: >36 belong >0 not stripped
7322:
7323: 0 belong 0x020c010d HP s200 dynamic load library
7324: >4 beshort >0 - version %ld
7325: >6 beshort >0 - highwater %d
7326: >36 belong >0 not stripped
7327:
7328: #### MISC
7329: 0 long 0x0000ff65 HP old archive
7330: 0 long 0x020aff65 HP s200 old archive
7331: 0 long 0x020cff65 HP s200 old archive
7332: 0 long 0x0208ff65 HP s500 old archive
7333:
7334: 0 long 0x015821a6 HP core file
7335:
7336: 0 long 0x4da7eee8 HP-WINDOWS font
7337: >8 byte >0 - version %ld
7338: 0 string Bitmapfile HP Bitmapfile
7339:
7340: 0 string IMGfile CIS compimg HP Bitmapfile
7341: # XXX - see "lif"
7342: #0 short 0x8000 lif file
7343: 0 long 0x020c010c compiled Lisp
7344:
7345: 0 string msgcat01 HP NLS message catalog,
7346: >8 long >0 %d messages
7347:
7348: # Summary: HP-48/49 calculator
7349: # Created by: phk@data.fls.dk
7350: # Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
7351: # Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
7352: 0 string HPHP HP
7353: >4 string 48 48 binary
7354: >4 string 49 49 binary
7355: >7 byte >64 - Rev %c
7356: >8 leshort 0x2911 (ADR)
7357: >8 leshort 0x2933 (REAL)
7358: >8 leshort 0x2955 (LREAL)
7359: >8 leshort 0x2977 (COMPLX)
7360: >8 leshort 0x299d (LCOMPLX)
7361: >8 leshort 0x29bf (CHAR)
7362: >8 leshort 0x29e8 (ARRAY)
7363: >8 leshort 0x2a0a (LNKARRAY)
7364: >8 leshort 0x2a2c (STRING)
7365: >8 leshort 0x2a4e (HXS)
7366: >8 leshort 0x2a74 (LIST)
7367: >8 leshort 0x2a96 (DIR)
7368: >8 leshort 0x2ab8 (ALG)
7369: >8 leshort 0x2ada (UNIT)
7370: >8 leshort 0x2afc (TAGGED)
7371: >8 leshort 0x2b1e (GROB)
7372: >8 leshort 0x2b40 (LIB)
7373: >8 leshort 0x2b62 (BACKUP)
7374: >8 leshort 0x2b88 (LIBDATA)
7375: >8 leshort 0x2d9d (PROG)
7376: >8 leshort 0x2dcc (CODE)
7377: >8 leshort 0x2e48 (GNAME)
7378: >8 leshort 0x2e6d (LNAME)
7379: >8 leshort 0x2e92 (XLIB)
7380:
7381: 0 string %%HP: HP text
7382: >6 string T(0) - T(0)
7383: >6 string T(1) - T(1)
7384: >6 string T(2) - T(2)
7385: >6 string T(3) - T(3)
7386: >10 string A(D) A(D)
7387: >10 string A(R) A(R)
7388: >10 string A(G) A(G)
7389: >14 string F(.) F(.);
7390: >14 string F(,) F(,);
7391:
7392:
7393: # Summary: HP-38/39 calculator
7394: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
7395: 0 string HP3
7396: >3 string 8 HP 38
7397: >3 string 9 HP 39
7398: >4 string Bin binary
7399: >4 string Asc ASCII
7400: >7 string A (Directory List)
7401: >7 string B (Zaplet)
7402: >7 string C (Note)
7403: >7 string D (Program)
7404: >7 string E (Variable)
7405: >7 string F (List)
7406: >7 string G (Matrix)
7407: >7 string H (Library)
7408: >7 string I (Target List)
7409: >7 string J (ASCII Vector specification)
7410: >7 string K (wildcard)
7411:
7412: # Summary: HP-38/39 calculator
7413: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
7414: 0 string HP3
7415: >3 string 8 HP 38
7416: >3 string 9 HP 39
7417: >4 string Bin binary
7418: >4 string Asc ASCII
7419: >7 string A (Directory List)
7420: >7 string B (Zaplet)
7421: >7 string C (Note)
7422: >7 string D (Program)
7423: >7 string E (Variable)
7424: >7 string F (List)
7425: >7 string G (Matrix)
7426: >7 string H (Library)
7427: >7 string I (Target List)
7428: >7 string J (ASCII Vector specification)
7429: >7 string K (wildcard)
7430:
7431: # hpBSD magic numbers
7432: 0 beshort 200 hp200 (68010) BSD
7433: >2 beshort 0407 impure binary
7434: >2 beshort 0410 read-only binary
7435: >2 beshort 0413 demand paged binary
7436: 0 beshort 300 hp300 (68020+68881) BSD
7437: >2 beshort 0407 impure binary
7438: >2 beshort 0410 read-only binary
7439: >2 beshort 0413 demand paged binary
7440: #
7441: # From David Gero <dgero@nortelnetworks.com>
7442: # HP-UX 10.20 core file format from /usr/include/sys/core.h
7443: # Unfortunately, HP-UX uses corehead blocks without specifying the order
7444: # There are four we care about:
7445: # CORE_KERNEL, which starts with the string "HP-UX"
7446: # CORE_EXEC, which contains the name of the command
7447: # CORE_PROC, which contains the signal number that caused the core dump
7448: # CORE_FORMAT, which contains the version of the core file format (== 1)
7449: # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
7450: # but we include all 6 variations of the order of the first 3, and
7451: # assume that PROC will always be last
7452: # Order 1: KERNEL, EXEC, FORMAT, PROC
7453: 0x10 string HP-UX
7454: >0 belong 2
7455: >>0xC belong 0x3C
7456: >>>0x4C belong 0x100
7457: >>>>0x58 belong 0x44
7458: >>>>>0xA0 belong 1
7459: >>>>>>0xAC belong 4
7460: >>>>>>>0xB0 belong 1
7461: >>>>>>>>0xB4 belong 4 core file
7462: >>>>>>>>>0x90 string >\0 from '%s'
7463: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7464: >>>>>>>>>0xC4 belong 4 - received SIGILL
7465: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7466: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7467: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7468: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7469: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7470: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7471: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7472: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7473: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7474: # Order 2: KERNEL, FORMAT, EXEC, PROC
7475: >>>0x4C belong 1
7476: >>>>0x58 belong 4
7477: >>>>>0x5C belong 1
7478: >>>>>>0x60 belong 0x100
7479: >>>>>>>0x6C belong 0x44
7480: >>>>>>>>0xB4 belong 4 core file
7481: >>>>>>>>>0xA4 string >\0 from '%s'
7482: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7483: >>>>>>>>>0xC4 belong 4 - received SIGILL
7484: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7485: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7486: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7487: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7488: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7489: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7490: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7491: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7492: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7493: # Order 3: FORMAT, KERNEL, EXEC, PROC
7494: 0x24 string HP-UX
7495: >0 belong 1
7496: >>0xC belong 4
7497: >>>0x10 belong 1
7498: >>>>0x14 belong 2
7499: >>>>>0x20 belong 0x3C
7500: >>>>>>0x60 belong 0x100
7501: >>>>>>>0x6C belong 0x44
7502: >>>>>>>>0xB4 belong 4 core file
7503: >>>>>>>>>0xA4 string >\0 from '%s'
7504: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7505: >>>>>>>>>0xC4 belong 4 - received SIGILL
7506: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7507: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7508: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7509: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7510: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7511: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7512: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7513: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7514: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7515: # Order 4: EXEC, KERNEL, FORMAT, PROC
7516: 0x64 string HP-UX
7517: >0 belong 0x100
7518: >>0xC belong 0x44
7519: >>>0x54 belong 2
7520: >>>>0x60 belong 0x3C
7521: >>>>>0xA0 belong 1
7522: >>>>>>0xAC belong 4
7523: >>>>>>>0xB0 belong 1
7524: >>>>>>>>0xB4 belong 4 core file
7525: >>>>>>>>>0x44 string >\0 from '%s'
7526: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7527: >>>>>>>>>0xC4 belong 4 - received SIGILL
7528: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7529: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7530: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7531: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7532: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7533: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7534: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7535: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7536: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7537: # Order 5: FORMAT, EXEC, KERNEL, PROC
7538: 0x78 string HP-UX
7539: >0 belong 1
7540: >>0xC belong 4
7541: >>>0x10 belong 1
7542: >>>>0x14 belong 0x100
7543: >>>>>0x20 belong 0x44
7544: >>>>>>0x68 belong 2
7545: >>>>>>>0x74 belong 0x3C
7546: >>>>>>>>0xB4 belong 4 core file
7547: >>>>>>>>>0x58 string >\0 from '%s'
7548: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7549: >>>>>>>>>0xC4 belong 4 - received SIGILL
7550: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7551: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7552: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7553: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7554: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7555: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7556: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7557: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7558: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7559: # Order 6: EXEC, FORMAT, KERNEL, PROC
7560: >0 belong 0x100
7561: >>0xC belong 0x44
7562: >>>0x54 belong 1
7563: >>>>0x60 belong 4
7564: >>>>>0x64 belong 1
7565: >>>>>>0x68 belong 2
7566: >>>>>>>0x74 belong 0x2C
7567: >>>>>>>>0xB4 belong 4 core file
7568: >>>>>>>>>0x44 string >\0 from '%s'
7569: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7570: >>>>>>>>>0xC4 belong 4 - received SIGILL
7571: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7572: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7573: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7574: >>>>>>>>>0xC4 belong 8 - received SIGFPE
7575: >>>>>>>>>0xC4 belong 10 - received SIGBUS
7576: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
7577: >>>>>>>>>0xC4 belong 12 - received SIGSYS
7578: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
7579: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
7580:
7581:
7582:
7583: #------------------------------------------------------------------------------
7584: # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
7585: # Magic too short!
7586: #0 string HU Human68k
7587: #>68 string LZX LZX compressed
7588: #>>72 string >\0 (version %s)
7589: #>(8.L+74) string LZX LZX compressed
7590: #>>(8.L+78) string >\0 (version %s)
7591: #>60 belong >0 binded
7592: #>(8.L+66) string #HUPAIR hupair
7593: #>0 string HU X executable
7594: #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
7595: #>4 belong >0 - base address 0x%x
7596: #>28 belong >0 not stripped
7597: #>32 belong >0 with debug information
7598: #0 beshort 0x601a Human68k Z executable
7599: #0 beshort 0x6000 Human68k object file
7600: #0 belong 0xd1000000 Human68k ar binary archive
7601: #0 belong 0xd1010000 Human68k ar ascii archive
7602: #0 beshort 0x0068 Human68k lib archive
7603: #4 string LZX Human68k LZX compressed
7604: #>8 string >\0 (version %s)
7605: #>4 string LZX R executable
7606: #2 string #HUPAIR Human68k hupair R executable
7607:
7608: #------------------------------------------------------------------------------
7609: # ibm370: file(1) magic for IBM 370 and compatibles.
7610: #
7611: # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
7612: # What the heck *is* "USS/370"?
7613: # AIX 4.1's "/etc/magic" has
7614: #
7615: # 0 short 0535 370 sysV executable
7616: # >12 long >0 not stripped
7617: # >22 short >0 - version %d
7618: # >30 long >0 - 5.2 format
7619: # 0 short 0530 370 sysV pure executable
7620: # >12 long >0 not stripped
7621: # >22 short >0 - version %d
7622: # >30 long >0 - 5.2 format
7623: #
7624: # instead of the "USS/370" versions of the same magic numbers.
7625: #
7626: 0 beshort 0537 370 XA sysV executable
7627: >12 belong >0 not stripped
7628: >22 beshort >0 - version %d
7629: >30 belong >0 - 5.2 format
7630: 0 beshort 0532 370 XA sysV pure executable
7631: >12 belong >0 not stripped
7632: >22 beshort >0 - version %d
7633: >30 belong >0 - 5.2 format
7634: 0 beshort 054001 370 sysV pure executable
7635: >12 belong >0 not stripped
7636: 0 beshort 055001 370 XA sysV pure executable
7637: >12 belong >0 not stripped
7638: 0 beshort 056401 370 sysV executable
7639: >12 belong >0 not stripped
7640: 0 beshort 057401 370 XA sysV executable
7641: >12 belong >0 not stripped
7642: 0 beshort 0531 SVR2 executable (Amdahl-UTS)
7643: >12 belong >0 not stripped
7644: >24 belong >0 - version %ld
7645: 0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
7646: >12 belong >0 not stripped
7647: >24 belong >0 - version %ld
7648: 0 beshort 0530 SVR2 pure executable (USS/370)
7649: >12 belong >0 not stripped
7650: >24 belong >0 - version %ld
7651: 0 beshort 0535 SVR2 executable (USS/370)
7652: >12 belong >0 not stripped
7653: >24 belong >0 - version %ld
7654:
7655: #------------------------------------------------------------------------------
7656: # ibm6000: file(1) magic for RS/6000 and the RT PC.
7657: #
7658: 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
7659: >12 belong >0 not stripped
7660: # Breaks sun4 statically linked execs.
7661: #0 beshort 0x0103 executable (RT Version 2) or obj module
7662: #>2 byte 0x50 pure
7663: #>28 belong >0 not stripped
7664: #>6 beshort >0 - version %ld
7665: 0 beshort 0x0104 shared library
7666: 0 beshort 0x0105 ctab data
7667: 0 beshort 0xfe04 structured file
7668: 0 string 0xabcdef AIX message catalog
7669: 0 belong 0x000001f9 AIX compiled message catalog
7670: 0 string \<aiaff> archive
7671: 0 string \<bigaf> archive (big format)
7672:
7673:
7674: #------------------------------------------------------------------------------
7675: # iff: file(1) magic for Interchange File Format (see also "audio" & "images")
7676: #
7677: # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
7678: # Arts for file interchange. It has also been used by Apple, SGI, and
7679: # especially Commodore-Amiga.
7680: #
7681: # IFF files begin with an 8 byte FORM header, followed by a 4 character
7682: # FORM type, which is followed by the first chunk in the FORM.
7683:
7684: 0 string FORM IFF data
7685: #>4 belong x \b, FORM is %d bytes long
7686: # audio formats
7687: >8 string AIFF \b, AIFF audio
7688: !:mime audio/x-aiff
7689: >8 string AIFC \b, AIFF-C compressed audio
7690: !:mime audio/x-aiff
7691: >8 string 8SVX \b, 8SVX 8-bit sampled sound voice
7692: !:mime audio/x-aiff
7693: >8 string 16SV \b, 16SV 16-bit sampled sound voice
7694: >8 string SAMP \b, SAMP sampled audio
7695: >8 string MAUD \b, MAUD MacroSystem audio
7696: >8 string SMUS \b, SMUS simple music
7697: >8 string CMUS \b, CMUS complex music
7698: # image formats
7699: >8 string ILBMBMHD \b, ILBM interleaved image
7700: >>20 beshort x \b, %d x
7701: >>22 beshort x %d
7702: >8 string RGBN \b, RGBN 12-bit RGB image
7703: >8 string RGB8 \b, RGB8 24-bit RGB image
7704: >8 string DEEP \b, DEEP TVPaint/XiPaint image
7705: >8 string DR2D \b, DR2D 2-D object
7706: >8 string TDDD \b, TDDD 3-D rendering
7707: >8 string LWOB \b, LWOB 3-D object
7708: >8 string LWO2 \b, LWO2 3-D object, v2
7709: >8 string LWLO \b, LWLO 3-D layered object
7710: >8 string REAL \b, REAL Real3D rendering
7711: >8 string MC4D \b, MC4D MaxonCinema4D rendering
7712: >8 string ANIM \b, ANIM animation
7713: >8 string YAFA \b, YAFA animation
7714: >8 string SSA\ \b, SSA super smooth animation
7715: >8 string ACBM \b, ACBM continuous image
7716: >8 string FAXX \b, FAXX fax image
7717: # other formats
7718: >8 string FTXT \b, FTXT formatted text
7719: >8 string CTLG \b, CTLG message catalog
7720: >8 string PREF \b, PREF preferences
7721: >8 string DTYP \b, DTYP datatype description
7722: >8 string PTCH \b, PTCH binary patch
7723: >8 string AMFF \b, AMFF AmigaMetaFile format
7724: >8 string WZRD \b, WZRD StormWIZARD resource
7725: >8 string DOC\ \b, DOC desktop publishing document
7726:
7727: # These go at the end of the iff rules
7728: #
7729: # I don't see why these might collide with anything else.
7730: #
7731: # Interactive Fiction related formats
7732: #
7733: >8 string IFRS \b, Blorb Interactive Fiction
7734: >>24 string Exec with executable chunk
7735: >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
7736: #------------------------------------------------------------------------------
7737: # images: file(1) magic for image formats (see also "iff", and "c-lang" for
7738: # XPM bitmaps)
7739: #
7740: # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
7741: # additions by janl@ifi.uio.no as well as others. Jan also suggested
7742: # merging several one- and two-line files into here.
7743: #
7744: # little magic: PCX (first byte is 0x0a)
7745:
7746: # Targa - matches `povray', `ppmtotga' and `xv' outputs
7747: # by Philippe De Muyter <phdm@macqel.be>
7748: # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
7749: # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
7750: # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
7751: # `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
7752: # `tgatoppm' recognizes a superset (Index may be anything)
7753: 1 belong&0xfff7ffff 0x01010000 Targa image data - Map
7754: >2 byte&8 8 - RLE
7755: >12 leshort >0 %hd x
7756: >14 leshort >0 %hd
7757: 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
7758: >2 byte&8 8 - RLE
7759: >12 leshort >0 %hd x
7760: >14 leshort >0 %hd
7761: 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
7762: >2 byte&8 8 - RLE
7763: >12 leshort >0 %hd x
7764: >14 leshort >0 %hd
7765:
7766: # PBMPLUS images
7767: # The next byte following the magic is always whitespace.
7768: 0 search/1 P1 Netpbm PBM image text
7769: !:mime image/x-portable-bitmap
7770: 0 search/1 P2 Netpbm PGM image text
7771: !:mime image/x-portable-greymap
7772: 0 search/1 P3 Netpbm PPM image text
7773: !:mime image/x-portable-pixmap
7774: 0 string P4 Netpbm PBM "rawbits" image data
7775: !:mime image/x-portable-bitmap
7776: 0 string P5 Netpbm PGM "rawbits" image data
7777: !:mime image/x-portable-greymap
7778: 0 string P6 Netpbm PPM "rawbits" image data
7779: !:mime image/x-portable-pixmap
7780: 0 string P7 Netpbm PAM image file
7781: !:mime image/x-portable-pixmap
7782:
7783: # From: bryanh@giraffe-data.com (Bryan Henderson)
7784: 0 string \117\072 Solitaire Image Recorder format
7785: >4 string \013 MGI Type 11
7786: >4 string \021 MGI Type 17
7787: 0 string .MDA MicroDesign data
7788: >21 byte 48 version 2
7789: >21 byte 51 version 3
7790: 0 string .MDP MicroDesign page data
7791: >21 byte 48 version 2
7792: >21 byte 51 version 3
7793:
7794: # NIFF (Navy Interchange File Format, a modification of TIFF) images
7795: # [GRR: this *must* go before TIFF]
7796: 0 string IIN1 NIFF image data
7797: !:mime image/x-niff
7798:
7799: # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
7800: # The second word of TIFF files is the TIFF version number, 42, which has
7801: # never changed. The TIFF specification recommends testing for it.
7802: 0 string MM\x00\x2a TIFF image data, big-endian
7803: !:mime image/tiff
7804: 0 string II\x2a\x00 TIFF image data, little-endian
7805: !:mime image/tiff
7806:
7807: # PNG [Portable Network Graphics, or "PNG's Not GIF"] images
7808: # (Greg Roelofs, newt@uchicago.edu)
7809: # (Albert Cahalan, acahalan@cs.uml.edu)
7810: #
7811: # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
7812: #
7813: 0 string \x89PNG\x0d\x0a\x1a\x0a PNG image
7814: !:mime image/png
7815: >16 belong x \b, %ld x
7816: >20 belong x %ld,
7817: >24 byte x %d-bit
7818: >25 byte 0 grayscale,
7819: >25 byte 2 \b/color RGB,
7820: >25 byte 3 colormap,
7821: >25 byte 4 gray+alpha,
7822: >25 byte 6 \b/color RGBA,
7823: #>26 byte 0 deflate/32K,
7824: >28 byte 0 non-interlaced
7825: >28 byte 1 interlaced
7826:
7827: # possible GIF replacements; none yet released!
7828: # (Greg Roelofs, newt@uchicago.edu)
7829: #
7830: # GRR 950115: this was mine ("Zip GIF"):
7831: 0 string GIF94z ZIF image (GIF+deflate alpha)
7832: !:mime image/x-unknown
7833: #
7834: # GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
7835: #
7836: 0 string FGF95a FGF image (GIF+deflate beta)
7837: !:mime image/x-unknown
7838: #
7839: # GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
7840: # (best; not yet implemented):
7841: #
7842: 0 string PBF PBF image (deflate compression)
7843: !:mime image/x-unknown
7844:
7845: # GIF
7846: 0 string GIF8 GIF image data
7847: !:mime image/gif
7848: >4 string 7a \b, version 8%s,
7849: >4 string 9a \b, version 8%s,
7850: >6 leshort >0 %hd x
7851: >8 leshort >0 %hd
7852: #>10 byte &0x80 color mapped,
7853: #>10 byte&0x07 =0x00 2 colors
7854: #>10 byte&0x07 =0x01 4 colors
7855: #>10 byte&0x07 =0x02 8 colors
7856: #>10 byte&0x07 =0x03 16 colors
7857: #>10 byte&0x07 =0x04 32 colors
7858: #>10 byte&0x07 =0x05 64 colors
7859: #>10 byte&0x07 =0x06 128 colors
7860: #>10 byte&0x07 =0x07 256 colors
7861:
7862: # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
7863: # 1 plane, no encoding.
7864: 0 string \361\0\100\273 CMU window manager raster image data
7865: >4 lelong >0 %d x
7866: >8 lelong >0 %d,
7867: >12 lelong >0 %d-bit
7868:
7869: # Magick Image File Format
7870: 0 string id=ImageMagick MIFF image data
7871:
7872: # Artisan
7873: 0 long 1123028772 Artisan image data
7874: >4 long 1 \b, rectangular 24-bit
7875: >4 long 2 \b, rectangular 8-bit with colormap
7876: >4 long 3 \b, rectangular 32-bit (24-bit with matte)
7877:
7878: # FIG (Facility for Interactive Generation of figures), an object-based format
7879: 0 search/1 #FIG FIG image text
7880: >5 string x \b, version %.3s
7881:
7882: # PHIGS
7883: 0 string ARF_BEGARF PHIGS clear text archive
7884: 0 string @(#)SunPHIGS SunPHIGS
7885: # version number follows, in the form m.n
7886: >40 string SunBin binary
7887: >32 string archive archive
7888:
7889: # GKS (Graphics Kernel System)
7890: 0 string GKSM GKS Metafile
7891: >24 string SunGKS \b, SunGKS
7892:
7893: # CGM image files
7894: 0 string BEGMF clear text Computer Graphics Metafile
7895:
7896: # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
7897: 0 string yz MGR bitmap, modern format, 8-bit aligned
7898: 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
7899: 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
7900: 0 string yx MGR bitmap, modern format, squeezed
7901:
7902: # Fuzzy Bitmap (FBM) images
7903: 0 string %bitmap\0 FBM image data
7904: >30 long 0x31 \b, mono
7905: >30 long 0x33 \b, color
7906:
7907: # facsimile data
7908: 1 string PC\ Research,\ Inc group 3 fax data
7909: >29 byte 0 \b, normal resolution (204x98 DPI)
7910: >29 byte 1 \b, fine resolution (204x196 DPI)
7911: # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
7912: 0 string Sfff structured fax file
7913:
7914:
7915: # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
7916: 0 string BM
7917: >14 leshort 12 PC bitmap, OS/2 1.x format
7918: !:mime image/x-ms-bmp
7919: >>18 leshort x \b, %d x
7920: >>20 leshort x %d
7921: >14 leshort 64 PC bitmap, OS/2 2.x format
7922: !:mime image/x-ms-bmp
7923: >>18 leshort x \b, %d x
7924: >>20 leshort x %d
7925: >14 leshort 40 PC bitmap, Windows 3.x format
7926: !:mime image/x-ms-bmp
7927: >>18 lelong x \b, %d x
7928: >>22 lelong x %d x
7929: >>28 leshort x %d
7930: >14 leshort 128 PC bitmap, Windows NT/2000 format
7931: !:mime image/x-ms-bmp
7932: >>18 lelong x \b, %d x
7933: >>22 lelong x %d x
7934: >>28 leshort x %d
7935: # Too simple - MPi
7936: #0 string IC PC icon data
7937: #0 string PI PC pointer image data
7938: #0 string CI PC color icon data
7939: #0 string CP PC color pointer image data
7940: # Conflicts with other entries [BABYL]
7941: #0 string BA PC bitmap array data
7942:
7943: # XPM icons (Greg Roelofs, newt@uchicago.edu)
7944: # note possible collision with C/REXX entry in c-lang; currently commented out
7945: 0 search/1 /*\ XPM\ */ X pixmap image text
7946:
7947: # Utah Raster Toolkit RLE images (janl@ifi.uio.no)
7948: 0 leshort 0xcc52 RLE image data,
7949: >6 leshort x %d x
7950: >8 leshort x %d
7951: >2 leshort >0 \b, lower left corner: %d
7952: >4 leshort >0 \b, lower right corner: %d
7953: >10 byte&0x1 =0x1 \b, clear first
7954: >10 byte&0x2 =0x2 \b, no background
7955: >10 byte&0x4 =0x4 \b, alpha channel
7956: >10 byte&0x8 =0x8 \b, comment
7957: >11 byte >0 \b, %d color channels
7958: >12 byte >0 \b, %d bits per pixel
7959: >13 byte >0 \b, %d color map channels
7960:
7961: # image file format (Robert Potter, potter@cs.rochester.edu)
7962: 0 string Imagefile\ version- iff image data
7963: # this adds the whole header (inc. version number), informative but longish
7964: >10 string >\0 %s
7965:
7966: # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
7967: 0 belong 0x59a66a95 Sun raster image data
7968: >4 belong >0 \b, %d x
7969: >8 belong >0 %d,
7970: >12 belong >0 %d-bit,
7971: #>16 belong >0 %d bytes long,
7972: >20 belong 0 old format,
7973: #>20 belong 1 standard,
7974: >20 belong 2 compressed,
7975: >20 belong 3 RGB,
7976: >20 belong 4 TIFF,
7977: >20 belong 5 IFF,
7978: >20 belong 0xffff reserved for testing,
7979: >24 belong 0 no colormap
7980: >24 belong 1 RGB colormap
7981: >24 belong 2 raw colormap
7982: #>28 belong >0 colormap is %d bytes long
7983:
7984: # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
7985: #
7986: # See
7987: # http://reality.sgi.com/grafica/sgiimage.html
7988: #
7989: 0 beshort 474 SGI image data
7990: #>2 byte 0 \b, verbatim
7991: >2 byte 1 \b, RLE
7992: #>3 byte 1 \b, normal precision
7993: >3 byte 2 \b, high precision
7994: >4 beshort x \b, %d-D
7995: >6 beshort x \b, %d x
7996: >8 beshort x %d
7997: >10 beshort x \b, %d channel
7998: >10 beshort !1 \bs
7999: >80 string >0 \b, "%s"
8000:
8001: 0 string IT01 FIT image data
8002: >4 belong x \b, %d x
8003: >8 belong x %d x
8004: >12 belong x %d
8005: #
8006: 0 string IT02 FIT image data
8007: >4 belong x \b, %d x
8008: >8 belong x %d x
8009: >12 belong x %d
8010: #
8011: 2048 string PCD_IPI Kodak Photo CD image pack file
8012: >0xe02 byte&0x03 0x00 , landscape mode
8013: >0xe02 byte&0x03 0x01 , portrait mode
8014: >0xe02 byte&0x03 0x02 , landscape mode
8015: >0xe02 byte&0x03 0x03 , portrait mode
8016: 0 string PCD_OPA Kodak Photo CD overview pack file
8017:
8018: # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
8019: # FITS is the Flexible Image Transport System, the de facto standard for
8020: # data and image transfer, storage, etc., for the astronomical community.
8021: # (FITS floating point formats are big-endian.)
8022: 0 string SIMPLE\ \ = FITS image data
8023: >109 string 8 \b, 8-bit, character or unsigned binary integer
8024: >108 string 16 \b, 16-bit, two's complement binary integer
8025: >107 string \ 32 \b, 32-bit, two's complement binary integer
8026: >107 string -32 \b, 32-bit, floating point, single precision
8027: >107 string -64 \b, 64-bit, floating point, double precision
8028:
8029: # other images
8030: 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
8031:
8032: # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
8033: # stuff.
8034: #
8035: 0 beshort 0x1010 PEX Binary Archive
8036:
8037: # DICOM medical imaging data
8038: 128 string DICM DICOM medical imaging data
8039: !:mime application/dicom
8040:
8041: # XWD - X Window Dump file.
8042: # As described in /usr/X11R6/include/X11/XWDFile.h
8043: # used by the xwd program.
8044: # Bradford Castalia, idaeim, 1/01
8045: 4 belong 7 XWD X Window Dump image data
8046: >100 string >\0 \b, "%s"
8047: >16 belong x \b, %dx
8048: >20 belong x \b%dx
8049: >12 belong x \b%d
8050:
8051: # PDS - Planetary Data System
8052: # These files use Parameter Value Language in the header section.
8053: # Unfortunately, there is no certain magic, but the following
8054: # strings have been found to be most likely.
8055: 0 string NJPL1I00 PDS (JPL) image data
8056: 2 string NJPL1I PDS (JPL) image data
8057: 0 string CCSD3ZF PDS (CCSD) image data
8058: 2 string CCSD3Z PDS (CCSD) image data
8059: 0 string PDS_ PDS image data
8060: 0 string LBLSIZE= PDS (VICAR) image data
8061:
8062: # pM8x: ATARI STAD compressed bitmap format
8063: #
8064: # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
8065: # p M 8 5/6 xx yy zz data...
8066: # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
8067: # bytes either run horizontally (pM85) or vertically (pM86). yy is the
8068: # most frequent byte, xx and zz are runlength escape codes, where xx is
8069: # used for runs of yy.
8070: #
8071: 0 string pM85 Atari ST STAD bitmap image data (hor)
8072: >5 byte 0x00 (white background)
8073: >5 byte 0xFF (black background)
8074: 0 string pM86 Atari ST STAD bitmap image data (vert)
8075: >5 byte 0x00 (white background)
8076: >5 byte 0xFF (black background)
8077:
8078: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
8079: # http://www.atarimax.com/jindroush.atari.org/afmtatr.html
8080: 0 leshort 0x0296 Atari ATR image
8081:
8082: # XXX:
8083: # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
8084: # magic.
8085: # SGI RICE image file <mpruett@sgi.com>
8086: #0 beshort 0x5249 RICE image
8087: #>2 beshort x v%d
8088: #>4 beshort x (%d x
8089: #>6 beshort x %d)
8090: #>8 beshort 0 8 bit
8091: #>8 beshort 1 10 bit
8092: #>8 beshort 2 12 bit
8093: #>8 beshort 3 13 bit
8094: #>10 beshort 0 4:2:2
8095: #>10 beshort 1 4:2:2:4
8096: #>10 beshort 2 4:4:4
8097: #>10 beshort 3 4:4:4:4
8098: #>12 beshort 1 RGB
8099: #>12 beshort 2 CCIR601
8100: #>12 beshort 3 RP175
8101: #>12 beshort 4 YUV
8102:
8103: #------------------------------------------------------------------------------
8104: #
8105: # Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
8106: # for the EPOC operating system, which is used with PDAs like those from Psion
8107: #
8108: # see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
8109: # of various EPOC file formats
8110:
8111: 0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
8112:
8113: # PCX image files
8114: # From: Dan Fandrich <dan@coneharvesters.com>
8115: 0 beshort 0x0a00 PCX ver. 2.5 image data
8116: 0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
8117: 0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
8118: 0 beshort 0x0a04 PCX for Windows image data
8119: 0 beshort 0x0a05 PCX ver. 3.0 image data
8120: >4 leshort x bounding box [%hd,
8121: >6 leshort x %hd] -
8122: >8 leshort x [%hd,
8123: >10 leshort x %hd],
8124: >65 byte >1 %d planes each of
8125: >3 byte x %hhd-bit
8126: >68 byte 0 image,
8127: >68 byte 1 colour,
8128: >68 byte 2 grayscale,
8129: >68 byte >2 image,
8130: >68 byte <0 image,
8131: >12 leshort >0 %hd x
8132: >>14 leshort x %hd dpi,
8133: >2 byte 0 uncompressed
8134: >2 byte 1 RLE compressed
8135:
8136: # Adobe Photoshop
8137: 0 string 8BPS Adobe Photoshop Image
8138: !:mime image/vnd.adobe.photoshop
8139:
8140: # XV thumbnail indicator (ThMO)
8141: 0 string P7\ 332 XV thumbnail image data
8142:
8143: # NITF is defined by United States MIL-STD-2500A
8144: 0 string NITF National Imagery Transmission Format
8145: >25 string >\0 dated %.14s
8146:
8147: # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
8148: 0 belong 0x00010008 GEM Image data
8149: >12 beshort x %d x
8150: >14 beshort x %d,
8151: >4 beshort x %d planes,
8152: >8 beshort x %d x
8153: >10 beshort x %d pixelsize
8154:
8155: # GEM Metafile (Wolfram Kleff)
8156: 0 lelong 0x0018FFFF GEM Metafile data
8157: >4 leshort x version %d
8158:
8159: #
8160: # SMJPEG. A custom Motion JPEG format used by Loki Entertainment
8161: # Software Torbjorn Andersson <d91tan@Update.UU.SE>.
8162: #
8163: 0 string \0\nSMJPEG SMJPEG
8164: >8 belong x %d.x data
8165: # According to the specification you could find any number of _TXT
8166: # headers here, but I can't think of any way of handling that. None of
8167: # the SMJPEG files I tried it on used this feature. Even if such a
8168: # file is encountered the output should still be reasonable.
8169: >16 string _SND \b,
8170: >>24 beshort >0 %d Hz
8171: >>26 byte 8 8-bit
8172: >>26 byte 16 16-bit
8173: >>28 string NONE uncompressed
8174: # >>28 string APCM ADPCM compressed
8175: >>27 byte 1 mono
8176: >>28 byte 2 stereo
8177: # Help! Isn't there any way to avoid writing this part twice?
8178: >>32 string _VID \b,
8179: # >>>48 string JFIF JPEG
8180: >>>40 belong >0 %d frames
8181: >>>44 beshort >0 (%d x
8182: >>>46 beshort >0 %d)
8183: >16 string _VID \b,
8184: # >>32 string JFIF JPEG
8185: >>24 belong >0 %d frames
8186: >>28 beshort >0 (%d x
8187: >>30 beshort >0 %d)
8188:
8189: 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
8190:
8191: # "thumbnail file" (icon)
8192: # descended from "xv", but in use by other applications as well (Wolfram Kleff)
8193: 0 string P7\ 332 XV "thumbnail file" (icon) data
8194:
8195: # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
8196: 0 string KiSS KISS/GS
8197: >4 byte 16 color
8198: >>5 byte x %d bit
8199: >>8 leshort x %d colors
8200: >>10 leshort x %d groups
8201: >4 byte 32 cell
8202: >>5 byte x %d bit
8203: >>8 leshort x %d x
8204: >>10 leshort x %d
8205: >>12 leshort x +%d
8206: >>14 leshort x +%d
8207:
8208: # Webshots (www.webshots.com), by John Harrison
8209: 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
8210:
8211: # Hercules DASD image files
8212: # From Jan Jaeger <jj@septa.nl>
8213: 0 string CKD_P370 Hercules CKD DASD image file
8214: >8 long x \b, %d heads per cylinder
8215: >12 long x \b, track size %d bytes
8216: >16 byte x \b, device type 33%2.2X
8217:
8218: 0 string CKD_C370 Hercules compressed CKD DASD image file
8219: >8 long x \b, %d heads per cylinder
8220: >12 long x \b, track size %d bytes
8221: >16 byte x \b, device type 33%2.2X
8222:
8223: 0 string CKD_S370 Hercules CKD DASD shadow file
8224: >8 long x \b, %d heads per cylinder
8225: >12 long x \b, track size %d bytes
8226: >16 byte x \b, device type 33%2.2X
8227:
8228: # Squeak images and programs - etoffi@softhome.net
8229: 0 string \146\031\0\0 Squeak image data
8230: 0 search/1 'From\040Squeak Squeak program text
8231:
8232: # partimage: file(1) magic for PartImage files (experimental, incomplete)
8233: # Author: Hans-Joachim Baader <hjb@pro-linux.de>
8234: 0 string PaRtImAgE-VoLuMe PartImage
8235: >0x0020 string 0.6.1 file version %s
8236: >>0x0060 lelong >-1 volume %ld
8237: #>>0x0064 8 byte identifier
8238: #>>0x007c reserved
8239: >>0x0200 string >\0 type %s
8240: >>0x1400 string >\0 device %s,
8241: >>0x1600 string >\0 original filename %s,
8242: # Some fields omitted
8243: >>0x2744 lelong 0 not compressed
8244: >>0x2744 lelong 1 gzip compressed
8245: >>0x2744 lelong 2 bzip2 compressed
8246: >>0x2744 lelong >2 compressed with unknown algorithm
8247: >0x0020 string >0.6.1 file version %s
8248: >0x0020 string <0.6.1 file version %s
8249:
8250: # DCX is multi-page PCX, using a simple header of up to 1024
8251: # offsets for the respective PCX components.
8252: # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
8253: 0 lelong 987654321 DCX multi-page PCX image data
8254:
8255: # Simon Walton <simonw@matteworld.com>
8256: # Kodak Cineon format for scanned negatives
8257: # http://www.kodak.com/US/en/motion/support/dlad/
8258: 0 lelong 0xd75f2a80 Cineon image data
8259: >200 belong >0 \b, %ld x
8260: >204 belong >0 %ld
8261:
8262:
8263: # Bio-Rad .PIC is an image format used by microscope control systems
8264: # and related image processing software used by biologists.
8265: # From: Vebjorn Ljosa <vebjorn@ljosa.com>
8266: 54 leshort 12345 Bio-Rad .PIC Image File
8267: >0 leshort >0 %hd x
8268: >2 leshort >0 %hd,
8269: >4 leshort =1 1 image in file
8270: >4 leshort >1 %hd images in file
8271:
8272: # From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
8273: # The description of *.mrw format can be found at
8274: # http://www.dalibor.cz/minolta/raw_file_format.htm
8275: 0 string \000MRM Minolta Dimage camera raw image data
8276:
8277: # Summary: DjVu image / document
8278: # Extension: .djvu
8279: # Reference: http://djvu.org/docs/DjVu3Spec.djvu
8280: # Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
8281: # Modified by (1): Abel Cheung <abelcheung@gmail.com>
8282: 0 string AT&TFORM
8283: !:mime image/vnd.djvu
8284: >12 string DJVM DjVu multiple page document
8285: >12 string DJVU DjVu image or single page document
8286: >12 string DJVI DjVu shared document
8287: >12 string THUM DjVu page thumbnails
8288:
8289:
8290: # From Marc Espie
8291: 0 lelong 20000630 OpenEXR image data
8292:
8293: # From: Tom Hilinski <tom.hilinski@comcast.net>
8294: # http://www.unidata.ucar.edu/packages/netcdf/
8295: 0 string CDF\001 NetCDF Data Format data
8296:
8297: #-----------------------------------------------------------------------
8298: # Hierarchical Data Format, used to facilitate scientific data exchange
8299: # specifications at http://hdf.ncsa.uiuc.edu/
8300: 0 belong 0x0e031301 Hierarchical Data Format (version 4) data
8301: !:mime application/x-hdf
8302: 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
8303: !:mime application/x-hdf
8304:
8305: # From: Tobias Burnus <burnus@net-b.de>
8306: # Xara (for a while: Corel Xara) is a graphic package, see
8307: # http://www.xara.com/ for Windows and as GPL application for Linux
8308: 0 string XARA\243\243 Xara graphics file
8309:
8310: # http://www.cartesianinc.com/Tech/
8311: 0 string CPC\262 Cartesian Perceptual Compression image
8312: !:mime image/x-cpi
8313:
8314: # From Albert Cahalan <acahalan@gmail.com>
8315: # puredigital used it for the CVS disposable camcorder
8316: #8 lelong 4 ZBM bitmap image data
8317: #>4 leshort x %u x
8318: #>6 leshort x %u
8319:
8320: # From Albert Cahalan <acahalan@gmail.com>
8321: # uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
8322: 0 string C565 OLPC firmware icon image data
8323: >4 leshort x %u x
8324: >6 leshort x %u
8325:
8326: # Applied Images - Image files from Cytovision
8327: # Gustavo Junior Alves <gjalves@gjalves.com.br>
8328: 0 string \xce\xda\xde\xfa Cytovision Metaphases file
8329: 0 string \xed\xad\xef\xac Cytovision Karyotype file
8330: 0 string \x0b\x00\x03\x00 Cytovision FISH Probe file
8331: 0 string \xed\xfe\xda\xbe Cytovision FLEX file
8332: 0 string \xed\xab\xed\xfe Cytovision FLEX file
8333: 0 string \xad\xfd\xea\xad Cytovision RATS file
8334:
8335: # Wavelet Scalar Quantization format used in gray-scale fingerprint images
8336: # From Tano M Fotang <mfotang@quanteq.com>
8337: 0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
8338:
8339: # Type: Ulead Photo Explorer5 (.pe5)
8340: # URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
8341: # From: Simon Horman <horms@debian.org>
8342: 0 string IIO2H Ulead Photo Explorer5
8343:
8344: # Type: X11 cursor
8345: # URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
8346: # From: Mathias Brodala <info@noctus.net>
8347: 0 string Xcur X11 cursor
8348:
8349: #------------------------------------------------------------------------------
8350: # inform: file(1) magic for Inform interactive fiction language
8351:
8352: # URL: http://www.inform-fiction.org/
8353: # From: Reuben Thomas <rrt@sc3d.org>
8354:
8355: 0 search/cB/100 constant\ story Inform source text
8356:
8357: #------------------------------------------------------------------------------
8358: # intel: file(1) magic for x86 Unix
8359: #
8360: # Various flavors of x86 UNIX executable/object (other than Xenix, which
8361: # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
8362: # Windows as well.
8363: #
8364: # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
8365: # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
8366: # as well, if, as, and when IBM makes it portable.
8367: #
8368: # The `versions' should be un-commented if they work for you.
8369: # (Was the problem just one of endianness?)
8370: #
8371: 0 leshort 0502 basic-16 executable
8372: >12 lelong >0 not stripped
8373: #>22 leshort >0 - version %ld
8374: 0 leshort 0503 basic-16 executable (TV)
8375: >12 lelong >0 not stripped
8376: #>22 leshort >0 - version %ld
8377: 0 leshort 0510 x86 executable
8378: >12 lelong >0 not stripped
8379: 0 leshort 0511 x86 executable (TV)
8380: >12 lelong >0 not stripped
8381: 0 leshort =0512 iAPX 286 executable small model (COFF)
8382: >12 lelong >0 not stripped
8383: #>22 leshort >0 - version %ld
8384: 0 leshort =0522 iAPX 286 executable large model (COFF)
8385: >12 lelong >0 not stripped
8386: #>22 leshort >0 - version %ld
8387: # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
8388: 0 leshort =0514 80386 COFF executable
8389: >12 lelong >0 not stripped
8390: >22 leshort >0 - version %ld
8391:
8392: # rom: file(1) magic for BIOS ROM Extensions found in intel machines
8393: # mapped into memory between 0xC0000 and 0xFFFFF
8394: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
8395: 0 beshort 0x55AA BIOS (ia32) ROM Ext.
8396: >5 string USB USB
8397: >7 string LDR UNDI image
8398: >30 string IBM IBM comp. Video
8399: >26 string Adaptec Adaptec
8400: >28 string Adaptec Adaptec
8401: >42 string PROMISE Promise
8402: >2 byte x (%d*512)
8403:
8404: #------------------------------------------------------------------------------
8405: # interleaf: file(1) magic for InterLeaf TPS:
8406: #
8407: 0 string =\210OPS Interleaf saved data
8408: 0 string =<!OPS Interleaf document text
8409: >5 string ,\ Version\ = \b, version
8410: >>17 string >\0 %.3s
8411:
8412: #------------------------------------------------------------------------------
8413: # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
8414: # "/etc/magic":
8415: # From: guy@netapp.com (Guy Harris)
8416: #
8417: 4 string pgscriptver IslandWrite document
8418: 13 string DrawFile IslandDraw document
8419:
8420:
8421: #------------------------------------------------------------------------------
8422: # ispell: file(1) magic for ispell
8423: #
8424: # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
8425: # will match 0x9600 through 0x9603 in *both* little endian and big endian.
8426: # (No other current magic entries collide.)
8427: #
8428: # Updated by Daniel Quinlan (quinlan@yggdrasil.com)
8429: #
8430: 0 leshort&0xFFFC 0x9600 little endian ispell
8431: >0 byte 0 hash file (?),
8432: >0 byte 1 3.0 hash file,
8433: >0 byte 2 3.1 hash file,
8434: >0 byte 3 hash file (?),
8435: >2 leshort 0x00 8-bit, no capitalization, 26 flags
8436: >2 leshort 0x01 7-bit, no capitalization, 26 flags
8437: >2 leshort 0x02 8-bit, capitalization, 26 flags
8438: >2 leshort 0x03 7-bit, capitalization, 26 flags
8439: >2 leshort 0x04 8-bit, no capitalization, 52 flags
8440: >2 leshort 0x05 7-bit, no capitalization, 52 flags
8441: >2 leshort 0x06 8-bit, capitalization, 52 flags
8442: >2 leshort 0x07 7-bit, capitalization, 52 flags
8443: >2 leshort 0x08 8-bit, no capitalization, 128 flags
8444: >2 leshort 0x09 7-bit, no capitalization, 128 flags
8445: >2 leshort 0x0A 8-bit, capitalization, 128 flags
8446: >2 leshort 0x0B 7-bit, capitalization, 128 flags
8447: >2 leshort 0x0C 8-bit, no capitalization, 256 flags
8448: >2 leshort 0x0D 7-bit, no capitalization, 256 flags
8449: >2 leshort 0x0E 8-bit, capitalization, 256 flags
8450: >2 leshort 0x0F 7-bit, capitalization, 256 flags
8451: >4 leshort >0 and %d string characters
8452: 0 beshort&0xFFFC 0x9600 big endian ispell
8453: >1 byte 0 hash file (?),
8454: >1 byte 1 3.0 hash file,
8455: >1 byte 2 3.1 hash file,
8456: >1 byte 3 hash file (?),
8457: >2 beshort 0x00 8-bit, no capitalization, 26 flags
8458: >2 beshort 0x01 7-bit, no capitalization, 26 flags
8459: >2 beshort 0x02 8-bit, capitalization, 26 flags
8460: >2 beshort 0x03 7-bit, capitalization, 26 flags
8461: >2 beshort 0x04 8-bit, no capitalization, 52 flags
8462: >2 beshort 0x05 7-bit, no capitalization, 52 flags
8463: >2 beshort 0x06 8-bit, capitalization, 52 flags
8464: >2 beshort 0x07 7-bit, capitalization, 52 flags
8465: >2 beshort 0x08 8-bit, no capitalization, 128 flags
8466: >2 beshort 0x09 7-bit, no capitalization, 128 flags
8467: >2 beshort 0x0A 8-bit, capitalization, 128 flags
8468: >2 beshort 0x0B 7-bit, capitalization, 128 flags
8469: >2 beshort 0x0C 8-bit, no capitalization, 256 flags
8470: >2 beshort 0x0D 7-bit, no capitalization, 256 flags
8471: >2 beshort 0x0E 8-bit, capitalization, 256 flags
8472: >2 beshort 0x0F 7-bit, capitalization, 256 flags
8473: >4 beshort >0 and %d string characters
8474: # ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
8475: # Ispell 4.0
8476: 0 string ISPL ispell
8477: >4 long x hash file version %d,
8478: >8 long x lexletters %d,
8479: >12 long x lexsize %d,
8480: >16 long x hashsize %d,
8481: >20 long x stblsize %d
8482: #------------------------------------------------------------
8483: # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
8484: # same magic number, 0xcafebabe, so they are both handled
8485: # in the entry called "cafebabe".
8486: #------------------------------------------------------------
8487: # Java serialization
8488: # From Martin Pool (m.pool@pharos.com.au)
8489: 0 beshort 0xaced Java serialization data
8490: >2 beshort >0x0004 \b, version %d
8491:
8492: 0 belong 0xfeedfeed Java KeyStore
8493: !:mime application/x-java-keystore
8494: 0 belong 0xcececece Java JCE KeyStore
8495: !:mime application/x-java-jce-keystore
8496:
8497: # Dalvik .dex format. http://retrodev.com/android/dexformat.html
8498: # From <mkf@google.com> "Mike Fleming"
8499: 0 string dex\n
8500: >0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
8501: >4 string >000 version %s
8502: 0 string dey\n
8503: >0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
8504: >4 string >000 version %s
8505:
8506:
8507: #------------------------------------------------------------------------------
8508: # JPEG images
8509: # SunOS 5.5.1 had
8510: #
8511: # 0 string \377\330\377\340 JPEG file
8512: # 0 string \377\330\377\356 JPG file
8513: #
8514: # both of which turn into "JPEG image data" here.
8515: #
8516: 0 beshort 0xffd8 JPEG image data
8517: !:mime image/jpeg
8518: !:strength +1
8519: >6 string JFIF \b, JFIF standard
8520: # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
8521: # in a vain attempt to add image size reporting for JFIF. Note that these
8522: # tests are not fool-proof since some perfectly valid JPEGs are currently
8523: # impossible to specify in magic(4) format.
8524: # First, a little JFIF version info:
8525: >>11 byte x \b %d.
8526: >>12 byte x \b%02d
8527: # Next, the resolution or aspect ratio of the image:
8528: #>>13 byte 0 \b, aspect ratio
8529: #>>13 byte 1 \b, resolution (DPI)
8530: #>>13 byte 2 \b, resolution (DPCM)
8531: #>>4 beshort x \b, segment length %d
8532: # Next, show thumbnail info, if it exists:
8533: >>18 byte !0 \b, thumbnail %dx
8534: >>>19 byte x \b%d
8535:
8536: # EXIF moved down here to avoid reporting a bogus version number,
8537: # and EXIF version number printing added.
8538: # - Patrik R=E5dman <patrik+file-magic@iki.fi>
8539: >6 string Exif \b, EXIF standard
8540: # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
8541: # All possible combinations of entries have to be enumerated, since no looping
8542: # is possible. And both endians are possible...
8543: # The combinations included below are from real-world JPEGs.
8544: # Little-endian
8545: >>12 string II
8546: # IFD 0 Entry #5:
8547: >>>70 leshort 0x8769
8548: # EXIF IFD Entry #1:
8549: >>>>(78.l+14) leshort 0x9000
8550: >>>>>(78.l+23) byte x %c
8551: >>>>>(78.l+24) byte x \b.%c
8552: >>>>>(78.l+25) byte !0x30 \b%c
8553: # IFD 0 Entry #9:
8554: >>>118 leshort 0x8769
8555: # EXIF IFD Entry #3:
8556: >>>>(126.l+38) leshort 0x9000
8557: >>>>>(126.l+47) byte x %c
8558: >>>>>(126.l+48) byte x \b.%c
8559: >>>>>(126.l+49) byte !0x30 \b%c
8560: # IFD 0 Entry #10
8561: >>>130 leshort 0x8769
8562: # EXIF IFD Entry #3:
8563: >>>>(138.l+38) leshort 0x9000
8564: >>>>>(138.l+47) byte x %c
8565: >>>>>(138.l+48) byte x \b.%c
8566: >>>>>(138.l+49) byte !0x30 \b%c
8567: # EXIF IFD Entry #4:
8568: >>>>(138.l+50) leshort 0x9000
8569: >>>>>(138.l+59) byte x %c
8570: >>>>>(138.l+60) byte x \b.%c
8571: >>>>>(138.l+61) byte !0x30 \b%c
8572: # EXIF IFD Entry #5:
8573: >>>>(138.l+62) leshort 0x9000
8574: >>>>>(138.l+71) byte x %c
8575: >>>>>(138.l+72) byte x \b.%c
8576: >>>>>(138.l+73) byte !0x30 \b%c
8577: # IFD 0 Entry #11
8578: >>>142 leshort 0x8769
8579: # EXIF IFD Entry #3:
8580: >>>>(150.l+38) leshort 0x9000
8581: >>>>>(150.l+47) byte x %c
8582: >>>>>(150.l+48) byte x \b.%c
8583: >>>>>(150.l+49) byte !0x30 \b%c
8584: # EXIF IFD Entry #4:
8585: >>>>(150.l+50) leshort 0x9000
8586: >>>>>(150.l+59) byte x %c
8587: >>>>>(150.l+60) byte x \b.%c
8588: >>>>>(150.l+61) byte !0x30 \b%c
8589: # EXIF IFD Entry #5:
8590: >>>>(150.l+62) leshort 0x9000
8591: >>>>>(150.l+71) byte x %c
8592: >>>>>(150.l+72) byte x \b.%c
8593: >>>>>(150.l+73) byte !0x30 \b%c
8594: # Big-endian
8595: >>12 string MM
8596: # IFD 0 Entry #9:
8597: >>>118 beshort 0x8769
8598: # EXIF IFD Entry #1:
8599: >>>>(126.L+14) beshort 0x9000
8600: >>>>>(126.L+23) byte x %c
8601: >>>>>(126.L+24) byte x \b.%c
8602: >>>>>(126.L+25) byte !0x30 \b%c
8603: # EXIF IFD Entry #3:
8604: >>>>(126.L+38) beshort 0x9000
8605: >>>>>(126.L+47) byte x %c
8606: >>>>>(126.L+48) byte x \b.%c
8607: >>>>>(126.L+49) byte !0x30 \b%c
8608: # IFD 0 Entry #10
8609: >>>130 beshort 0x8769
8610: # EXIF IFD Entry #3:
8611: >>>>(138.L+38) beshort 0x9000
8612: >>>>>(138.L+47) byte x %c
8613: >>>>>(138.L+48) byte x \b.%c
8614: >>>>>(138.L+49) byte !0x30 \b%c
8615: # EXIF IFD Entry #5:
8616: >>>>(138.L+62) beshort 0x9000
8617: >>>>>(138.L+71) byte x %c
8618: >>>>>(138.L+72) byte x \b.%c
8619: >>>>>(138.L+73) byte !0x30 \b%c
8620: # IFD 0 Entry #11
8621: >>>142 beshort 0x8769
8622: # EXIF IFD Entry #4:
8623: >>>>(150.L+50) beshort 0x9000
8624: >>>>>(150.L+59) byte x %c
8625: >>>>>(150.L+60) byte x \b.%c
8626: >>>>>(150.L+61) byte !0x30 \b%c
8627: # Here things get sticky. We can do ONE MORE marker segment with
8628: # indirect addressing, and that's all. It would be great if we could
8629: # do pointer arithemetic like in an assembler language. Christos?
8630: # And if there was some sort of looping construct to do searches, plus a few
8631: # named accumulators, it would be even more effective...
8632: # At least we can show a comment if no other segments got inserted before:
8633: >(4.S+5) byte 0xFE
8634: >>(4.S+8) string >\0 \b, comment: "%s"
8635: # FIXME: When we can do non-byte counted strings, we can use that to get
8636: # the string's count, and fix Debian bug #283760
8637: #>(4.S+5) byte 0xFE \b, comment
8638: #>>(4.S+6) beshort x \b length=%d
8639: #>>(4.S+8) string >\0 \b, "%s"
8640: # Or, we can show the encoding type (I've included only the three most common)
8641: # and image dimensions if we are lucky and the SOFn (image segment) is here:
8642: >(4.S+5) byte 0xC0 \b, baseline
8643: >>(4.S+6) byte x \b, precision %d
8644: >>(4.S+7) beshort x \b, %dx
8645: >>(4.S+9) beshort x \b%d
8646: >(4.S+5) byte 0xC1 \b, extended sequential
8647: >>(4.S+6) byte x \b, precision %d
8648: >>(4.S+7) beshort x \b, %dx
8649: >>(4.S+9) beshort x \b%d
8650: >(4.S+5) byte 0xC2 \b, progressive
8651: >>(4.S+6) byte x \b, precision %d
8652: >>(4.S+7) beshort x \b, %dx
8653: >>(4.S+9) beshort x \b%d
8654: # I've commented-out quantisation table reporting. I doubt anyone cares yet.
8655: #>(4.S+5) byte 0xDB \b, quantisation table
8656: #>>(4.S+6) beshort x \b length=%d
8657: #>14 beshort x \b, %d x
8658: #>16 beshort x \b %d
8659:
8660: # HSI is Handmade Software's proprietary JPEG encoding scheme
8661: 0 string hsi1 JPEG image data, HSI proprietary
8662:
8663: # From: David Santinoli <david@santinoli.com>
8664: 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
8665:
8666: # Type: JPEG 2000 codesream
8667: # From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
8668: 0 belong 0xff4fff51 JPEG 2000 codestream
8669: 45 beshort 0xff52
8670:
8671: #------------------------------------------------------------------------------
8672: # karma: file(1) magic for Karma data files
8673: #
8674: # From <rgooch@atnf.csiro.au>
8675:
8676: 0 string KarmaRHD Version Karma Data Structure Version
8677: >16 belong x %lu
8678:
8679: #------------------------------------------------------------------------------
8680: # kde: file(1) magic for KDE
8681:
8682: 0 string [KDE\ Desktop\ Entry] KDE desktop entry
8683: !:mime application/x-kdelnk
8684: 0 string #\ KDE\ Config\ File KDE config file
8685: !:mime application/x-kdelnk
8686: 0 string #\ xmcd xmcd database file for kscd
8687: !:mime text/x-xmcd
8688: #------------------------------------------------------------------------------
8689: # DEC SRC Virtual Paper: Lectern files
8690: # Karl M. Hegbloom <karlheg@inetarena.com>
8691: 0 string lect DEC SRC Virtual Paper Lectern file
8692: #------------------------------------------------------------------------------
8693: # lex: file(1) magic for lex
8694: #
8695: # derived empirically, your offsets may vary!
8696: 0 search/100 yyprevious C program text (from lex)
8697: >3 search/1 >\0 for %s
8698: # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
8699: 0 search/100 generated\ by\ flex C program text (from flex)
8700: # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
8701: 0 search/1 %{ lex description text
8702:
8703: #------------------------------------------------------------------------------
8704: # lif: file(1) magic for lif
8705: #
8706: # (Daniel Quinlan <quinlan@yggdrasil.com>)
8707: #
8708: 0 beshort 0x8000 lif file
8709: #------------------------------------------------------------------------------
8710: # linux: file(1) magic for Linux files
8711: #
8712: # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
8713: # The following basic Linux magic is useful for reference, but using
8714: # "long" magic is a better practice in order to avoid collisions.
8715: #
8716: # 2 leshort 100 Linux/i386
8717: # >0 leshort 0407 impure executable (OMAGIC)
8718: # >0 leshort 0410 pure executable (NMAGIC)
8719: # >0 leshort 0413 demand-paged executable (ZMAGIC)
8720: # >0 leshort 0314 demand-paged executable (QMAGIC)
8721: #
8722: 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
8723: >16 lelong 0 \b, stripped
8724: 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
8725: >16 lelong 0 \b, stripped
8726: 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
8727: >16 lelong 0 \b, stripped
8728: 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
8729: >16 lelong 0 \b, stripped
8730: #
8731: 0 string \007\001\000 Linux/i386 object file
8732: >20 lelong >0x1020 \b, DLL library
8733: # Linux-8086 stuff:
8734: 0 string \01\03\020\04 Linux-8086 impure executable
8735: >28 long !0 not stripped
8736: 0 string \01\03\040\04 Linux-8086 executable
8737: >28 long !0 not stripped
8738: #
8739: 0 string \243\206\001\0 Linux-8086 object file
8740: #
8741: 0 string \01\03\020\20 Minix-386 impure executable
8742: >28 long !0 not stripped
8743: 0 string \01\03\040\20 Minix-386 executable
8744: >28 long !0 not stripped
8745: # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
8746: 216 lelong 0421 Linux/i386 core file
8747: >220 string >\0 of '%s'
8748: >200 lelong >0 (signal %d)
8749: #
8750: # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
8751: # this can be overridden by the DOS executable (COM) entry
8752: 2 string LILO Linux/i386 LILO boot/chain loader
8753: #
8754: # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
8755: 0 leshort 0x0436 Linux/i386 PC Screen Font data,
8756: >2 byte 0 256 characters, no directory,
8757: >2 byte 1 512 characters, no directory,
8758: >2 byte 2 256 characters, Unicode directory,
8759: >2 byte 3 512 characters, Unicode directory,
8760: >3 byte >0 8x%d
8761: # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
8762: 4086 string SWAP-SPACE Linux/i386 swap file
8763: # From: Jeff Bailey <jbailey@ubuntu.com>
8764: # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
8765: 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
8766: # according to man page of mkswap (8) March 1999
8767: # volume label and UUID Russell Coker
8768: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
8769: 4086 string SWAPSPACE2 Linux/i386 swap file (new style),
8770: >0x400 long x version %d (4K pages),
8771: >0x404 long x size %d pages,
8772: >1052 string \0 no label,
8773: >1052 string >\0 LABEL=%s,
8774: >0x40c belong x UUID=%x
8775: >0x410 beshort x \b-%x
8776: >0x412 beshort x \b-%x
8777: >0x414 beshort x \b-%x
8778: >0x416 belong x \b-%x
8779: >0x41a beshort x \b%x
8780: # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
8781: #
8782: # from Erik Troan (ewt@redhat.com) examining od dumps, so this
8783: # could be wrong
8784: # updated by David Mosberger (davidm@azstarnet.com) based on
8785: # GNU BFD and MIPS info found below.
8786: #
8787: 0 leshort 0x0183 ECOFF alpha
8788: >24 leshort 0407 executable
8789: >24 leshort 0410 pure
8790: >24 leshort 0413 demand paged
8791: >8 long >0 not stripped
8792: >8 long 0 stripped
8793: >23 leshort >0 - version %ld.
8794: #
8795: # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
8796: # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
8797: # and Nicolás Lichtmaier <nick@debian.org>
8798: # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
8799: # Linux kernel boot images (i386 arch) (Wolfram Kleff)
8800: 514 string HdrS Linux kernel
8801: >510 leshort 0xAA55 x86 boot executable
8802: >>518 leshort >0x1ff
8803: >>529 byte 0 zImage,
8804: >>>529 byte 1 bzImage,
8805: >>>(526.s+0x200) string >\0 version %s,
8806: >>498 leshort 1 RO-rootFS,
8807: >>498 leshort 0 RW-rootFS,
8808: >>508 leshort >0 root_dev 0x%X,
8809: >>502 leshort >0 swap_dev 0x%X,
8810: >>504 leshort >0 RAMdisksize %u KB,
8811: >>506 leshort 0xFFFF Normal VGA
8812: >>506 leshort 0xFFFE Extended VGA
8813: >>506 leshort 0xFFFD Prompt for Videomode
8814: >>506 leshort >0 Video mode %d
8815: # This also matches new kernels, which were caught above by "HdrS".
8816: 0 belong 0xb8c0078e Linux kernel
8817: >0x1e3 string Loading version 1.3.79 or older
8818: >0x1e9 string Loading from prehistoric times
8819:
8820: # System.map files - Nicolás Lichtmaier <nick@debian.org>
8821: 8 search/1 \ A\ _text Linux kernel symbol map text
8822:
8823: # LSM entries - Nicolás Lichtmaier <nick@debian.org>
8824: 0 search/1 Begin3 Linux Software Map entry text
8825: 0 search/1 Begin4 Linux Software Map entry text (new format)
8826:
8827: # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
8828: 0 belong 0x4f4f4f4d User-mode Linux COW file
8829: >4 belong <3 \b, version %d
8830: >>8 string >\0 \b, backing file %s
8831: >4 belong >2 \b, version %d
8832: >>32 string >\0 \b, backing file %s
8833:
8834: ############################################################################
8835: # Linux kernel versions
8836:
8837: 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
8838: >497 leshort 0 x86 boot sector
8839: >>514 belong 0x8e of a kernel from the dawn of time!
8840: >>514 belong 0x908ed8b4 version 0.99-1.1.42
8841: >>514 belong 0x908ed8b8 for memtest86
8842:
8843: >497 leshort !0 x86 kernel
8844: >>504 leshort >0 RAMdisksize=%u KB
8845: >>502 leshort >0 swap=0x%X
8846: >>508 leshort >0 root=0x%X
8847: >>>498 leshort 1 \b-ro
8848: >>>498 leshort 0 \b-rw
8849: >>506 leshort 0xFFFF vga=normal
8850: >>506 leshort 0xFFFE vga=extended
8851: >>506 leshort 0xFFFD vga=ask
8852: >>506 leshort >0 vga=%d
8853: >>514 belong 0x908ed881 version 1.1.43-1.1.45
8854: >>514 belong 0x15b281cd
8855: >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
8856: >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
8857: >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
8858: >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
8859: >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
8860: >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
8861: >>514 string HdrS
8862: >>>518 leshort >0x1FF
8863: >>>>529 byte 0 \b, zImage
8864: >>>>529 byte 1 \b, bzImage
8865: >>>>(526.s+0x200) string >\0 \b, version %s
8866:
8867: # Linux boot sector thefts.
8868: 0 belong 0xb8c0078e Linux
8869: >0x1e6 belong 0x454c4b53 ELKS Kernel
8870: >0x1e6 belong !0x454c4b53 style boot sector
8871:
8872: ############################################################################
8873: # Linux 8086 executable
8874: 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
8875: >5 string .
8876: >>4 string >\0 \b, libc version %s
8877:
8878: 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
8879: >2 byte&0x01 !0 \b, unmapped zero page
8880: >2 byte&0x20 0 \b, impure
8881: >2 byte&0x20 !0
8882: >>2 byte&0x10 !0 \b, A_EXEC
8883: >2 byte&0x02 !0 \b, A_PAL
8884: >2 byte&0x04 !0 \b, A_NSYM
8885: >2 byte&0x08 !0 \b, A_STAND
8886: >2 byte&0x40 !0 \b, A_PURE
8887: >2 byte&0x80 !0 \b, A_TOVLY
8888: >28 long !0 \b, not stripped
8889: >37 string .
8890: >>36 string >\0 \b, libc version %s
8891:
8892: # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
8893: # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
8894: # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
8895: # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
8896:
8897: # SYSLINUX boot logo files (from 'ppmtolss16' sources)
8898: # http://syslinux.zytor.com/
8899: #
8900: 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
8901: >4 leshort x \b, width %d
8902: >6 leshort x \b, height %d
8903:
8904: 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
8905: >4 belong x version %d
8906:
8907: # SE Linux policy database
8908: # From: Mike Frysinger <vapier@gentoo.org>
8909: 0 lelong 0xf97cff8c SE Linux policy
8910: >16 lelong x v%d
8911: >20 lelong 1 MLS
8912: >24 lelong x %d symbols
8913: >28 lelong x %d ocons
8914:
8915: # Linux Logical Volume Manager (LVM)
8916: # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
8917: #
8918: # System ID, UUID and volume group name are 128 bytes long
8919: # but they should never be full and initialized with zeros...
8920: #
8921: # LVM1
8922: #
8923: 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
8924: >0x12c string >\0 , System ID: %s
8925:
8926: 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
8927: >0x12c string >\0 , System ID: %s
8928:
8929: # LVM2
8930: #
8931: # It seems that the label header can be in one the four first sector
8932: # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
8933: #
8934: # 0x200 seems to be the common case
8935:
8936: 0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
8937: # read the offset to add to the start of the header, and the header
8938: # start in 0x200
8939: >(0x214.l+0x200) string >\0 , UUID: %s
8940:
8941: 0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
8942: >(0x014.l) string >\0 , UUID: %s
8943:
8944: 0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
8945: >(0x414.l+0x400) string >\0 , UUID: %s
8946:
8947: 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
8948: >(0x614.l+0x600) string >\0 , UUID: %s
8949:
8950: # LVM snapshot
8951: # from Jason Farrel
8952: 0 string SnAp LVM Snapshot (CopyOnWrite store)
8953: >4 lelong !0 - valid,
8954: >4 lelong 0 - invalid,
8955: >8 lelong x version %d,
8956: >12 lelong x chunk_size %d
8957:
8958: # SE Linux policy database
8959: 0 lelong 0xf97cff8c SE Linux policy
8960: >16 lelong x v%d
8961: >20 lelong 1 MLS
8962: >24 lelong x %d symbols
8963: >28 lelong x %d ocons
8964:
8965: # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
8966: # Anthon van der Neut (anthon@mnt.org)
8967: 0 string LUKS\xba\xbe LUKS encrypted file,
8968: >6 beshort x ver %d
8969: >8 string x [%s,
8970: >40 string x %s,
8971: >72 string x %s]
8972: >168 string x UUID: %s
8973:
8974:
8975: # Summary: Xen saved domain file
8976: # Created by: Radek Vokal <rvokal@redhat.com>
8977: 0 string LinuxGuestRecord Xen saved domain
8978: >20 search/256 (name
8979: >>&1 string x (name %s)
8980:
8981: # Type: Xen, the virtual machine monitor
8982: # From: Radek Vokal <rvokal@redhat.com>
8983: 0 string LinuxGuestRecord Xen saved domain
8984: #>2 regex \(name\ [^)]*\) %s
8985: >20 search/256 (name (name
8986: >>&1 string x %s...)
8987: #------------------------------------------------------------------------------
8988: # lisp: file(1) magic for lisp programs
8989: #
8990: # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
8991:
8992: # updated by Joerg Jenderek
8993: # GRR: This lot is too weak
8994: #0 string ;;
8995: # windows INF files often begin with semicolon and use CRLF as line end
8996: # lisp files are mainly created on unix system with LF as line end
8997: #>2 search/2048 !\r Lisp/Scheme program text
8998: #>2 search/2048 \r Windows INF file
8999:
9000: 0 search/256 (if\ Lisp/Scheme program text
9001: !:mime text/x-lisp
9002: 0 search/256 (setq\ Lisp/Scheme program text
9003: !:mime text/x-lisp
9004: 0 search/256 (defvar\ Lisp/Scheme program text
9005: !:mime text/x-lisp
9006: 0 search/256 (defparam\ Lisp/Scheme program text
9007: !:mime text/x-lisp
9008: 0 search/256 (defun\ Lisp/Scheme program text
9009: !:mime text/x-lisp
9010: 0 search/256 (autoload\ Lisp/Scheme program text
9011: !:mime text/x-lisp
9012: 0 search/256 (custom-set-variables\ Lisp/Scheme program text
9013: !:mime text/x-lisp
9014:
9015: # Emacs 18 - this is always correct, but not very magical.
9016: 0 string \012( Emacs v18 byte-compiled Lisp data
9017: !:mime application/x-elc
9018: # Emacs 19+ - ver. recognition added by Ian Springer
9019: # Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
9020: # - Chris Chittleborough <cchittleborough@yahoo.com.au>
9021: 0 string ;ELC
9022: >4 byte >18
9023: >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
9024: !:mime application/x-elc
9025:
9026: # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
9027: 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
9028: 0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
9029:
9030: 0 long 0x70768BD2 CLISP memory image data
9031: 0 long 0xD28B7670 CLISP memory image data, other endian
9032:
9033: #.com and .bin for MIT scheme
9034: 0 string \372\372\372\372 MIT scheme (library?)
9035:
9036: # From: David Allouche <david@allouche.net>
9037: 0 search/1 \<TeXmacs| TeXmacs document text
9038: !:mime text/texmacs
9039:
9040: #------------------------------------------------------------------------------
9041: # llvm: file(1) magic for LLVM byte-codes
9042: # URL: http://llvm.cs.uiuc.edu/docs/BytecodeFormat.html#signature
9043: # From: Al Stone <ahs3@fc.hp.com>
9044:
9045: 0 string llvm LLVM byte-codes, uncompressed
9046: 0 string llvc0 LLVM byte-codes, null compression
9047: 0 string llvc1 LLVM byte-codes, gzip compression
9048: 0 string llvc2 LLVM byte-codes, bzip2 compression
9049: #------------------------------------------------------------------------------
9050: # lua: file(1) magic for Lua scripting language
9051: # URL: http://www.lua.org/
9052: # From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
9053:
9054: # Lua scripts
9055: 0 search/1/b #!\ /usr/bin/lua Lua script text executable
9056: !:mime text/x-lua
9057: 0 search/1/b #!\ /usr/local/bin/lua Lua script text executable
9058: !:mime text/x-lua
9059: 0 search/1 #!/usr/bin/env\ lua Lua script text executable
9060: !:mime text/x-lua
9061: 0 search/1 #!\ /usr/bin/env\ lua Lua script text executable
9062: !:mime text/x-lua
9063:
9064: # Lua bytecode
9065: 0 string \033Lua Lua bytecode,
9066: >4 byte 0x50 version 5.0
9067: >4 byte 0x51 version 5.1
9068:
9069: #------------------------------------------------------------------------------
9070: # luks: file(1) magic for Linux Unified Key Setup
9071: # URL: http://luks.endorphin.org/spec
9072: # From: Anthon van der Neut <anthon@mnt.org>
9073:
9074: 0 string LUKS\xba\xbe LUKS encrypted file,
9075: >6 beshort x ver %d
9076: >8 string x [%s,
9077: >40 string x %s,
9078: >72 string x %s]
9079: >168 string x UUID: %s
9080: #------------------------------------------------------------
9081: # Mach has two magic numbers, 0xcafebabe and 0xfeedface.
9082: # Unfortunately the first, cafebabe, is shared with
9083: # Java ByteCode, so they are both handled in the file "cafebabe".
9084: # The "feedface" ones are handled herein.
9085: #------------------------------------------------------------
9086: 0 lelong&0xfeffffff 0xfeedface Mach-O
9087: >0 byte 0xcf 64-bit
9088: >12 lelong 1 object
9089: >12 lelong 2 executable
9090: >12 lelong 3 fixed virtual memory shared library
9091: >12 lelong 4 core
9092: >12 lelong 5 preload executable
9093: >12 lelong 6 dynamically linked shared library
9094: >12 lelong 7 dynamic linker
9095: >12 lelong 8 bundle
9096: >12 lelong 9 dynamically linked shared library stub
9097: >12 lelong >9
9098: >>12 lelong x filetype=%ld
9099: >4 lelong <0
9100: >>4 lelong x architecture=%ld
9101: >4 lelong 1 vax
9102: >4 lelong 2 romp
9103: >4 lelong 3 architecture=3
9104: >4 lelong 4 ns32032
9105: >4 lelong 5 ns32332
9106: >4 lelong 6 m68k
9107: >4 lelong 7 i386
9108: >4 lelong 8 mips
9109: >4 lelong 9 ns32532
9110: >4 lelong 10 architecture=10
9111: >4 lelong 11 hppa
9112: >4 lelong 12 acorn
9113: >4 lelong 13 m88k
9114: >4 lelong 14 sparc
9115: >4 lelong 15 i860-big
9116: >4 lelong 16 i860
9117: >4 lelong 17 rs6000
9118: >4 lelong 18 ppc
9119: >4 lelong 16777234 ppc64
9120: >4 lelong >16777234
9121: >>4 lelong x architecture=%ld
9122: #
9123: 0 belong&0xfffffffe 0xfeedface Mach-O
9124: >3 byte 0xcf 64-bit
9125: >12 belong 1 object
9126: >12 belong 2 executable
9127: >12 belong 3 fixed virtual memory shared library
9128: >12 belong 4 core
9129: >12 belong 5 preload executable
9130: >12 belong 6 dynamically linked shared library
9131: >12 belong 7 dynamic linker
9132: >12 belong 8 bundle
9133: >12 belong 9 dynamically linked shared library stub
9134: >12 belong >9
9135: >>12 belong x filetype=%ld
9136: >4 belong <0
9137: >>4 belong x architecture=%ld
9138: >4 belong 1 vax
9139: >4 belong 2 romp
9140: >4 belong 3 architecture=3
9141: >4 belong 4 ns32032
9142: >4 belong 5 ns32332
9143: >4 belong 6 for m68k architecture
9144: # from NeXTstep 3.0 <mach/machine.h>
9145: # i.e. mc680x0_all, ignore
9146: # >>8 belong 1 (mc68030)
9147: >>8 belong 2 (mc68040)
9148: >>8 belong 3 (mc68030 only)
9149: >4 belong 7 i386
9150: >4 belong 8 mips
9151: >4 belong 9 ns32532
9152: >4 belong 10 architecture=10
9153: >4 belong 11 hppa
9154: >4 belong 12 acorn
9155: >4 belong 13 m88k
9156: >4 belong 14 sparc
9157: >4 belong 15 i860-big
9158: >4 belong 16 i860
9159: >4 belong 17 rs6000
9160: >4 belong 18 ppc
9161: >4 belong 16777234 ppc64
9162: >4 belong >16777234
9163: >>4 belong x architecture=%ld
9164:
9165: #------------------------------------------------------------------------------
9166: # macintosh description
9167: #
9168: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
9169: # Daniel Quinlan, quinlan@yggdrasil.com
9170: 11 string must\ be\ converted\ with\ BinHex BinHex binary text
9171: !:mime application/mac-binhex40
9172: >41 string x \b, version %.3s
9173:
9174: # Stuffit archives are the de facto standard of compression for Macintosh
9175: # files obtained from most archives. (franklsm@tuns.ca)
9176: 0 string SIT! StuffIt Archive (data)
9177: >2 string x : %s
9178: 0 string SITD StuffIt Deluxe (data)
9179: >2 string x : %s
9180: 0 string Seg StuffIt Deluxe Segment (data)
9181: >2 string x : %s
9182:
9183: # Newer StuffIt archives (grant@netbsd.org)
9184: 0 string StuffIt StuffIt Archive
9185: !:mime application/x-stuffit
9186: #>162 string >0 : %s
9187:
9188: # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
9189: # GRR: Too weak
9190: #0 string APPL Macintosh Application (data)
9191: #>2 string x \b: %s
9192:
9193: # Macintosh System files (franklsm@tuns.ca)
9194: # GRR: Too weak
9195: #0 string zsys Macintosh System File (data)
9196: #0 string FNDR Macintosh Finder (data)
9197: #0 string libr Macintosh Library (data)
9198: #>2 string x : %s
9199: #0 string shlb Macintosh Shared Library (data)
9200: #>2 string x : %s
9201: #0 string cdev Macintosh Control Panel (data)
9202: #>2 string x : %s
9203: #0 string INIT Macintosh Extension (data)
9204: #>2 string x : %s
9205: #0 string FFIL Macintosh Truetype Font (data)
9206: #>2 string x : %s
9207: #0 string LWFN Macintosh Postscript Font (data)
9208: #>2 string x : %s
9209:
9210: # Additional Macintosh Files (franklsm@tuns.ca)
9211: # GRR: Too weak
9212: #0 string PACT Macintosh Compact Pro Archive (data)
9213: #>2 string x : %s
9214: #0 string ttro Macintosh TeachText File (data)
9215: #>2 string x : %s
9216: #0 string TEXT Macintosh TeachText File (data)
9217: #>2 string x : %s
9218: #0 string PDF Macintosh PDF File (data)
9219: #>2 string x : %s
9220:
9221: # MacBinary format (Eric Fischer, enf@pobox.com)
9222: #
9223: # Unfortunately MacBinary doesn't really have a magic number prior
9224: # to the MacBinary III format. The checksum is really the way to
9225: # do it, but the magic file format isn't up to the challenge.
9226: #
9227: # 0 byte 0
9228: # 1 byte # filename length
9229: # 2 string # filename
9230: # 65 string # file type
9231: # 69 string # file creator
9232: # 73 byte # Finder flags
9233: # 74 byte 0
9234: # 75 beshort # vertical posn in window
9235: # 77 beshort # horiz posn in window
9236: # 79 beshort # window or folder ID
9237: # 81 byte # protected?
9238: # 82 byte 0
9239: # 83 belong # length of data segment
9240: # 87 belong # length of resource segment
9241: # 91 belong # file creation date
9242: # 95 belong # file modification date
9243: # 99 beshort # length of comment after resource
9244: # 101 byte # new Finder flags
9245: # 102 string mBIN # (only in MacBinary III)
9246: # 106 byte # char. code of file name
9247: # 107 byte # still more Finder flags
9248: # 116 belong # total file length
9249: # 120 beshort # length of add'l header
9250: # 122 byte 129 # for MacBinary II
9251: # 122 byte 130 # for MacBinary III
9252: # 123 byte 129 # minimum version that can read fmt
9253: # 124 beshort # checksum
9254: #
9255: # This attempts to use the version numbers as a magic number, requiring
9256: # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
9257: # be 0x81. This works for the files I have, but maybe not for everyone's.
9258:
9259: # Unfortunately, this magic is quite weak - MPi
9260: #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
9261:
9262: # MacBinary I doesn't have the version number field at all, but MacBinary II
9263: # has been in use since 1987 so I hope there aren't many really old files
9264: # floating around that this will miss. The original spec calls for using
9265: # the nulls in 0, 74, and 82 as the magic number.
9266: #
9267: # Another possibility, that would also work for MacBinary I, is to use
9268: # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
9269: # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
9270: # and that 74 will be 0. So something like
9271: #
9272: # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
9273: #
9274: # >73 byte&0x01 0x01 \b, inited
9275: # >73 byte&0x02 0x02 \b, changed
9276: # >73 byte&0x04 0x04 \b, busy
9277: # >73 byte&0x08 0x08 \b, bozo
9278: # >73 byte&0x10 0x10 \b, system
9279: # >73 byte&0x10 0x20 \b, bundle
9280: # >73 byte&0x10 0x40 \b, invisible
9281: # >73 byte&0x10 0x80 \b, locked
9282:
9283: #>65 string x \b, type "%4.4s"
9284:
9285: #>65 string 8BIM (PhotoShop)
9286: #>65 string ALB3 (PageMaker 3)
9287: #>65 string ALB4 (PageMaker 4)
9288: #>65 string ALT3 (PageMaker 3)
9289: #>65 string APPL (application)
9290: #>65 string AWWP (AppleWorks word processor)
9291: #>65 string CIRC (simulated circuit)
9292: #>65 string DRWG (MacDraw)
9293: #>65 string EPSF (Encapsulated PostScript)
9294: #>65 string FFIL (font suitcase)
9295: #>65 string FKEY (function key)
9296: #>65 string FNDR (Macintosh Finder)
9297: #>65 string GIFf (GIF image)
9298: #>65 string Gzip (GNU gzip)
9299: #>65 string INIT (system extension)
9300: #>65 string LIB\ (library)
9301: #>65 string LWFN (PostScript font)
9302: #>65 string MSBC (Microsoft BASIC)
9303: #>65 string PACT (Compact Pro archive)
9304: #>65 string PDF\ (Portable Document Format)
9305: #>65 string PICT (picture)
9306: #>65 string PNTG (MacPaint picture)
9307: #>65 string PREF (preferences)
9308: #>65 string PROJ (Think C project)
9309: #>65 string QPRJ (Think Pascal project)
9310: #>65 string SCFL (Defender scores)
9311: #>65 string SCRN (startup screen)
9312: #>65 string SITD (StuffIt Deluxe)
9313: #>65 string SPn3 (SuperPaint)
9314: #>65 string STAK (HyperCard stack)
9315: #>65 string Seg\ (StuffIt segment)
9316: #>65 string TARF (Unix tar archive)
9317: #>65 string TEXT (ASCII)
9318: #>65 string TIFF (TIFF image)
9319: #>65 string TOVF (Eudora table of contents)
9320: #>65 string WDBN (Microsoft Word word processor)
9321: #>65 string WORD (MacWrite word processor)
9322: #>65 string XLS\ (Microsoft Excel)
9323: #>65 string ZIVM (compress (.Z))
9324: #>65 string ZSYS (Pre-System 7 system file)
9325: #>65 string acf3 (Aldus FreeHand)
9326: #>65 string cdev (control panel)
9327: #>65 string dfil (Desk Acessory suitcase)
9328: #>65 string libr (library)
9329: #>65 string nX^d (WriteNow word processor)
9330: #>65 string nX^w (WriteNow dictionary)
9331: #>65 string rsrc (resource)
9332: #>65 string scbk (Scrapbook)
9333: #>65 string shlb (shared library)
9334: #>65 string ttro (SimpleText read-only)
9335: #>65 string zsys (system file)
9336:
9337: #>69 string x \b, creator "%4.4s"
9338:
9339: # Somewhere, Apple has a repository of registered Creator IDs. These are
9340: # just the ones that I happened to have files from and was able to identify.
9341:
9342: #>69 string 8BIM (Adobe Photoshop)
9343: #>69 string ALD3 (PageMaker 3)
9344: #>69 string ALD4 (PageMaker 4)
9345: #>69 string ALFA (Alpha editor)
9346: #>69 string APLS (Apple Scanner)
9347: #>69 string APSC (Apple Scanner)
9348: #>69 string BRKL (Brickles)
9349: #>69 string BTFT (BitFont)
9350: #>69 string CCL2 (Common Lisp 2)
9351: #>69 string CCL\ (Common Lisp)
9352: #>69 string CDmo (The Talking Moose)
9353: #>69 string CPCT (Compact Pro)
9354: #>69 string CSOm (Eudora)
9355: #>69 string DMOV (Font/DA Mover)
9356: #>69 string DSIM (DigSim)
9357: #>69 string EDIT (Macintosh Edit)
9358: #>69 string ERIK (Macintosh Finder)
9359: #>69 string EXTR (self-extracting archive)
9360: #>69 string Gzip (GNU gzip)
9361: #>69 string KAHL (Think C)
9362: #>69 string LWFU (LaserWriter Utility)
9363: #>69 string LZIV (compress)
9364: #>69 string MACA (MacWrite)
9365: #>69 string MACS (Macintosh operating system)
9366: #>69 string MAcK (MacKnowledge terminal emulator)
9367: #>69 string MLND (Defender)
9368: #>69 string MPNT (MacPaint)
9369: #>69 string MSBB (Microsoft BASIC (binary))
9370: #>69 string MSWD (Microsoft Word)
9371: #>69 string NCSA (NCSA Telnet)
9372: #>69 string PJMM (Think Pascal)
9373: #>69 string PSAL (Hunt the Wumpus)
9374: #>69 string PSI2 (Apple File Exchange)
9375: #>69 string R*ch (BBEdit)
9376: #>69 string RMKR (Resource Maker)
9377: #>69 string RSED (Resource Editor)
9378: #>69 string Rich (BBEdit)
9379: #>69 string SIT! (StuffIt)
9380: #>69 string SPNT (SuperPaint)
9381: #>69 string Unix (NeXT Mac filesystem)
9382: #>69 string VIM! (Vim editor)
9383: #>69 string WILD (HyperCard)
9384: #>69 string XCEL (Microsoft Excel)
9385: #>69 string aCa2 (Fontographer)
9386: #>69 string aca3 (Aldus FreeHand)
9387: #>69 string dosa (Macintosh MS-DOS file system)
9388: #>69 string movr (Font/DA Mover)
9389: #>69 string nX^n (WriteNow)
9390: #>69 string pdos (Apple ProDOS file system)
9391: #>69 string scbk (Scrapbook)
9392: #>69 string ttxt (SimpleText)
9393: #>69 string ufox (Foreign File Access)
9394:
9395: # Just in case...
9396:
9397: 102 string mBIN MacBinary III data with surprising version number
9398:
9399: # sas magic from Bruce Foster (bef@nwu.edu)
9400: #
9401: #0 string SAS SAS
9402: #>8 string x %s
9403: 0 string SAS SAS
9404: >24 string DATA data file
9405: >24 string CATALOG catalog
9406: >24 string INDEX data file index
9407: >24 string VIEW data view
9408: # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
9409: #
9410: 0x54 string SAS SAS 7+
9411: >0x9C string DATA data file
9412: >0x9C string CATALOG catalog
9413: >0x9C string INDEX data file index
9414: >0x9C string VIEW data view
9415:
9416: # spss magic for SPSS system and portable files,
9417: # from Bruce Foster (bef@nwu.edu).
9418:
9419: 0 long 0xc1e2c3c9 SPSS Portable File
9420: >40 string x %s
9421:
9422: 0 string $FL2 SPSS System File
9423: >24 string x %s
9424:
9425: # Macintosh filesystem data
9426: # From "Tom N Harris" <telliamed@mac.com>
9427: # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
9428: # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
9429: # entries depend on the data arithmetic added after v.35
9430: # There's also some Pascal strings in here, ditto...
9431:
9432: # The boot block signature, according to IM:Files, is
9433: # "for HFS volumes, this field always contains the value 0x4C4B."
9434: # But if this is true for MFS or HFS+ volumes, I don't know.
9435: # Alternatively, the boot block is supposed to be zeroed if it's
9436: # unused, so a simply >0 should suffice.
9437:
9438: 0x400 beshort 0xD2D7 Macintosh MFS data
9439: >0 beshort 0x4C4B (bootable)
9440: >0x40a beshort &0x8000 (locked)
9441: >0x402 beldate-0x7C25B080 x created: %s,
9442: >0x406 beldate-0x7C25B080 >0 last backup: %s,
9443: >0x414 belong x block size: %d,
9444: >0x412 beshort x number of blocks: %d,
9445: >0x424 pstring x volume name: %s
9446:
9447: # "BD" is has many false positives
9448: #0x400 beshort 0x4244 Macintosh HFS data
9449: #>0 beshort 0x4C4B (bootable)
9450: #>0x40a beshort &0x8000 (locked)
9451: #>0x40a beshort ^0x0100 (mounted)
9452: #>0x40a beshort &0x0200 (spared blocks)
9453: #>0x40a beshort &0x0800 (unclean)
9454: #>0x47C beshort 0x482B (Embedded HFS+ Volume)
9455: #>0x402 beldate-0x7C25B080 x created: %s,
9456: #>0x406 beldate-0x7C25B080 x last modified: %s,
9457: #>0x440 beldate-0x7C25B080 >0 last backup: %s,
9458: #>0x414 belong x block size: %d,
9459: #>0x412 beshort x number of blocks: %d,
9460: #>0x424 pstring x volume name: %s
9461:
9462: 0x400 beshort 0x482B Macintosh HFS Extended
9463: >&0 beshort x version %d data
9464: >0 beshort 0x4C4B (bootable)
9465: >0x404 belong ^0x00000100 (mounted)
9466: >&2 belong &0x00000200 (spared blocks)
9467: >&2 belong &0x00000800 (unclean)
9468: >&2 belong &0x00008000 (locked)
9469: >&6 string x last mounted by: '%.4s',
9470: # really, that should be treated as a belong and we print a string
9471: # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
9472: >&14 beldate-0x7C25B080 x created: %s,
9473: # only the creation date is local time, all other timestamps in HFS+ are UTC.
9474: >&18 bedate-0x7C25B080 x last modified: %s,
9475: >&22 bedate-0x7C25B080 >0 last backup: %s,
9476: >&26 bedate-0x7C25B080 >0 last checked: %s,
9477: >&38 belong x block size: %d,
9478: >&42 belong x number of blocks: %d,
9479: >&46 belong x free blocks: %d
9480:
9481: # I don't think this is really necessary since it doesn't do much and
9482: # anything with a valid driver descriptor will also have a valid
9483: # partition map
9484: #0 beshort 0x4552 Apple Device Driver data
9485: #>&24 beshort =1 \b, MacOS
9486:
9487: # Is that the partition type a cstring or a pstring? Well, IM says "strings
9488: # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
9489: # cstring. Of course, partitions can contain more than four entries, but
9490: # what're you gonna do?
9491: # GRR: This magic is too weak, it is just "PM"
9492: #0x200 beshort 0x504D Apple Partition data
9493: #>0x2 beshort x (block size: %d):
9494: #>0x230 string x first type: %s,
9495: #>0x210 string x name: %s,
9496: #>0x254 belong x number of blocks: %d,
9497: #>0x400 beshort 0x504D
9498: #>>0x430 string x second type: %s,
9499: #>>0x410 string x name: %s,
9500: #>>0x454 belong x number of blocks: %d,
9501: #>>0x600 beshort 0x504D
9502: #>>>0x630 string x third type: %s,
9503: #>>>0x610 string x name: %s,
9504: #>>>0x654 belong x number of blocks: %d,
9505: #>>0x800 beshort 0x504D
9506: #>>>0x830 string x fourth type: %s,
9507: #>>>0x810 string x name: %s,
9508: #>>>0x854 belong x number of blocks: %d,
9509: #>>>0xa00 beshort 0x504D
9510: #>>>>0xa30 string x fifth type: %s,
9511: #>>>>0xa10 string x name: %s,
9512: #>>>>0xa54 belong x number of blocks: %d
9513: #>>>0xc00 beshort 0x504D
9514: #>>>>0xc30 string x sixth type: %s,
9515: #>>>>0xc10 string x name: %s,
9516: #>>>>0xc54 belong x number of blocks: %d
9517: ## AFAIK, only the signature is different
9518: #0x200 beshort 0x5453 Apple Old Partition data
9519: #>0x2 beshort x block size: %d,
9520: #>0x230 string x first type: %s,
9521: #>0x210 string x name: %s,
9522: #>0x254 belong x number of blocks: %d,
9523: #>0x400 beshort 0x504D
9524: #>>0x430 string x second type: %s,
9525: #>>0x410 string x name: %s,
9526: #>>0x454 belong x number of blocks: %d,
9527: #>>0x800 beshort 0x504D
9528: #>>>0x830 string x third type: %s,
9529: #>>>0x810 string x name: %s,
9530: #>>>0x854 belong x number of blocks: %d,
9531: #>>>0xa00 beshort 0x504D
9532: #>>>>0xa30 string x fourth type: %s,
9533: #>>>>0xa10 string x name: %s,
9534: #>>>>0xa54 belong x number of blocks: %d
9535:
9536: # From: Remi Mommsen <mommsen@slac.stanford.edu>
9537: 0 string BOMStore Mac OS X bill of materials (BOM) file
9538:
9539: #------------------------------------------------------------------------------
9540: # magic: file(1) magic for magic files
9541: #
9542: 0 string #\ Magic magic text file for file(1) cmd
9543: 0 lelong 0xF11E041C magic binary file for file(1) cmd
9544: >4 lelong x (version %d) (little endian)
9545: 0 belong 0xF11E041C magic binary file for file(1) cmd
9546: >4 belong x (version %d) (big endian)
9547: #------------------------------------------------------------------------------
9548: # mail.news: file(1) magic for mail and news
9549: #
9550: # Unfortunately, saved netnews also has From line added in some news software.
9551: #0 string From mail text
9552: # There are tests to ascmagic.c to cope with mail and news.
9553: 0 string Relay-Version: old news text
9554: !:mime message/rfc822
9555: 0 string #!\ rnews batched news text
9556: !:mime message/rfc822
9557: 0 string N#!\ rnews mailed, batched news text
9558: !:mime message/rfc822
9559: 0 string Forward\ to mail forwarding text
9560: !:mime message/rfc822
9561: 0 string Pipe\ to mail piping text
9562: !:mime message/rfc822
9563: 0 string Return-Path: smtp mail text
9564: !:mime message/rfc822
9565: 0 string Path: news text
9566: !:mime message/news
9567: 0 string Xref: news text
9568: !:mime message/news
9569: 0 string From: news or mail text
9570: !:mime message/rfc822
9571: 0 string Article saved news text
9572: !:mime message/news
9573: 0 string BABYL Emacs RMAIL text
9574: 0 string Received: RFC 822 mail text
9575: !:mime message/rfc822
9576: 0 string MIME-Version: MIME entity text
9577: #0 string Content- MIME entity text
9578:
9579: # TNEF files...
9580: 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
9581:
9582: # From: Kevin Sullivan <ksulliva@psc.edu>
9583: 0 string *mbx* MBX mail folder
9584:
9585: # From: Simon Matter <simon.matter@invoca.ch>
9586: 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
9587:
9588: # JAM(mbp) Fidonet message area databases
9589: # JHR file
9590: 0 string JAM\0 JAM message area header file
9591: >12 leshort >0 (%d messages)
9592:
9593: # Squish Fidonet message area databases
9594: # SQD file (requires at least one message in the area)
9595: # XXX: Weak magic
9596: #256 leshort 0xAFAE4453 Squish message area data file
9597: #>4 leshort >0 (%d messages)
9598:
9599: #0 string \<!--\ MHonArc text/html; x-type=mhonarc
9600:
9601: #------------------------------------------------------------------------------
9602: # maple: file(1) magic for maple files
9603: # "H. Nanosecond" <aldomel@ix.netcom.com>
9604: # Maple V release 4, a multi-purpose math program
9605: #
9606:
9607: # maple library .lib
9608: 0 string \000MVR4\nI MapleVr4 library
9609:
9610: # .ind
9611: # no magic for these :-(
9612: # they are compiled indexes for maple files
9613:
9614: # .hdb
9615: 0 string \000\004\000\000 Maple help database
9616:
9617: # .mhp
9618: # this has the form <PACKAGE=name>
9619: 0 string \<PACKAGE= Maple help file
9620: 0 string \<HELP\ NAME= Maple help file
9621: 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
9622: #0 string #\ Newton Maple help file, old style
9623: 0 string #\ daub Maple help file, old style
9624: #0 string #=========== Maple help file, old style
9625:
9626: # .mws
9627: 0 string \000\000\001\044\000\221 Maple worksheet
9628: #this is anomalous
9629: 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
9630: # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
9631: # that is {VERSION major_version miunor_version computer_type version_string}
9632: 0 string {VERSION\ Maple worksheet
9633: >9 string >\0 version %.1s.
9634: >>>11 string >\0 %.1s
9635:
9636: # .mps
9637: 0 string \0\0\001$ Maple something
9638: # from byte 4 it is either 'nul E' or 'soh R'
9639: # I think 'nul E' means a file that was saved as a different name
9640: # a sort of revision marking
9641: # 'soh R' means new
9642: >4 string \000\105 An old revision
9643: >4 string \001\122 The latest save
9644:
9645: # .mpl
9646: # some of these are the same as .mps above
9647: #0000000 000 000 001 044 000 105 same as .mps
9648: #0000000 000 000 001 044 001 122 same as .mps
9649:
9650: 0 string #\n##\ <SHAREFILE= Maple something
9651: 0 string \n#\n##\ <SHAREFILE= Maple something
9652: 0 string ##\ <SHAREFILE= Maple something
9653: 0 string #\r##\ <SHAREFILE= Maple something
9654: 0 string \r#\r##\ <SHAREFILE= Maple something
9655: 0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
9656:
9657: #------------------------------------------------------------------------------
9658: # mathcad: file(1) magic for Mathcad documents
9659: # URL: http://www.mathsoft.com/
9660: # From: Josh Triplett <josh@freedesktop.org>
9661:
9662: 0 string .MCAD\t Mathcad document
9663: #------------------------------------------------------------------------------
9664: # mathematica: file(1) magic for mathematica files
9665: # "H. Nanosecond" <aldomel@ix.netcom.com>
9666: # Mathematica a multi-purpose math program
9667: # versions 2.2 and 3.0
9668:
9669: #mathematica .mb
9670: 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
9671: 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
9672:
9673: # .ma
9674: # multiple possibilites:
9675:
9676: 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
9677: #>41 string >\0 %s
9678:
9679: #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
9680:
9681: #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
9682: #>675 string >\0 %s #doesn't work well
9683:
9684: # there may be 'cr' instread of 'nl' in some does this matter?
9685:
9686: # generic:
9687: 0 string (*^\r\r::[\011 Mathematica notebook version 2.x
9688: 0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
9689: 0 string (*^\015 Mathematica notebook version 2.x
9690: 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
9691: 0 string (*^\r::[\011 Mathematica notebook version 2.x
9692: 0 string (*^\r\n::[\011 Mathematica notebook version 2.x
9693: 0 string (*^\n\n::[\011 Mathematica notebook version 2.x
9694: 0 string (*^\n::[\011 Mathematica notebook version 2.x
9695:
9696:
9697: # Mathematica .mx files
9698:
9699: #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
9700: 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
9701: #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
9702: # >71... is optional
9703: >88 string >\0 from %s
9704:
9705:
9706: # Mathematica files PBF:
9707: # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
9708: 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
9709:
9710: # .ml files These are menu resources I think
9711: # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
9712: # how to put that into a magic rule?
9713: 4 string \ A~ MAthematica .ml file
9714:
9715: # .nb files
9716: #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
9717: 0 string (*********************** Mathematica 3.0 notebook
9718:
9719: # other (* matches it is a comment start in these langs
9720: # GRR: Too weak; also matches other languages e.g. ML
9721: #0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
9722:
9723: #########################
9724: # MatLab v5
9725: 0 string MATLAB Matlab v5 mat-file
9726: >126 short 0x494d (big endian)
9727: >>124 beshort x version 0x%04x
9728: >126 short 0x4d49 (little endian)
9729: >>124 leshort x version 0x%04x
9730:
9731:
9732: #------------------------------------------------------------------------------
9733: # matroska: file(1) magic for Matroska files
9734: #
9735: # See http://www.matroska.org/
9736: #
9737:
9738: # EBML id:
9739: 0 belong 0x1a45dfa3
9740: # DocType id:
9741: >5 beshort 0x4282
9742: # DocType contents:
9743: >>8 string matroska Matroska data
9744:
9745: #------------------------------------------------------------------------------
9746: # Mavroyanopoulos Nikos <nmav@hellug.gr>
9747: # mcrypt: file(1) magic for mcrypt 2.2.x;
9748: 0 string \0m\3 mcrypt 2.5 encrypted data,
9749: >4 string >\0 algorithm: %s,
9750: >>&1 leshort >0 keysize: %d bytes,
9751: >>>&0 string >\0 mode: %s,
9752:
9753: 0 string \0m\2 mcrypt 2.2 encrypted data,
9754: >3 byte 0 algorithm: blowfish-448,
9755: >3 byte 1 algorithm: DES,
9756: >3 byte 2 algorithm: 3DES,
9757: >3 byte 3 algorithm: 3-WAY,
9758: >3 byte 4 algorithm: GOST,
9759: >3 byte 6 algorithm: SAFER-SK64,
9760: >3 byte 7 algorithm: SAFER-SK128,
9761: >3 byte 8 algorithm: CAST-128,
9762: >3 byte 9 algorithm: xTEA,
9763: >3 byte 10 algorithm: TWOFISH-128,
9764: >3 byte 11 algorithm: RC2,
9765: >3 byte 12 algorithm: TWOFISH-192,
9766: >3 byte 13 algorithm: TWOFISH-256,
9767: >3 byte 14 algorithm: blowfish-128,
9768: >3 byte 15 algorithm: blowfish-192,
9769: >3 byte 16 algorithm: blowfish-256,
9770: >3 byte 100 algorithm: RC6,
9771: >3 byte 101 algorithm: IDEA,
9772: >4 byte 0 mode: CBC,
9773: >4 byte 1 mode: ECB,
9774: >4 byte 2 mode: CFB,
9775: >4 byte 3 mode: OFB,
9776: >4 byte 4 mode: nOFB,
9777: >5 byte 0 keymode: 8bit
9778: >5 byte 1 keymode: 4bit
9779: >5 byte 2 keymode: SHA-1 hash
9780: >5 byte 3 keymode: MD5 hash
9781:
9782: #------------------------------------------------------------------------------
9783: # mercurial: file(1) magic for Mercurial changeset bundles
9784: # http://www.selenic.com/mercurial/wiki/
9785: #
9786: # Jesse Glick (jesse.glick@sun.com)
9787: #
9788:
9789: 0 string HG10 Mercurial changeset bundle
9790: >4 string UN (uncompressed)
9791: >4 string GZ (gzip compressed)
9792: >4 string BZ (bzip2 compressed)
9793: #------------------------------------------------------------------------------
9794: # mime: file(1) magic for MIME encoded files
9795: #
9796: 0 string Content-Type:\
9797: >14 string >\0 %s
9798: 0 string Content-Type:
9799: >13 string >\0 %s
9800:
9801: #------------------------------------------------------------------------------
9802: # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
9803: # Dec Ultrix (MIPS)
9804: # all of SGI's *current* machines and OSes run in big-endian mode on the
9805: # MIPS machines, as far as I know.
9806: #
9807: # XXX - what is the blank "-" line?
9808: #
9809: # kbd file definitions
9810: 0 string kbd!map kbd map file
9811: >8 byte >0 Ver %d:
9812: >10 short >0 with %d table(s)
9813: 0 belong 0407 old SGI 68020 executable
9814: 0 belong 0410 old SGI 68020 pure executable
9815: 0 beshort 0x8765 disk quotas file
9816: 0 beshort 0x0506 IRIS Showcase file
9817: >2 byte 0x49 -
9818: >3 byte x - version %ld
9819: 0 beshort 0x0226 IRIS Showcase template
9820: >2 byte 0x63 -
9821: >3 byte x - version %ld
9822: 0 belong 0x5343464d IRIS Showcase file
9823: >4 byte x - version %ld
9824: 0 belong 0x5443464d IRIS Showcase template
9825: >4 byte x - version %ld
9826: 0 belong 0xdeadbabe IRIX Parallel Arena
9827: >8 belong >0 - version %ld
9828: #
9829: 0 beshort 0x0160 MIPSEB ECOFF executable
9830: >20 beshort 0407 (impure)
9831: >20 beshort 0410 (swapped)
9832: >20 beshort 0413 (paged)
9833: >8 belong >0 not stripped
9834: >8 belong 0 stripped
9835: >22 byte x - version %ld
9836: >23 byte x .%ld
9837: #
9838: 0 beshort 0x0162 MIPSEL-BE ECOFF executable
9839: >20 beshort 0407 (impure)
9840: >20 beshort 0410 (swapped)
9841: >20 beshort 0413 (paged)
9842: >8 belong >0 not stripped
9843: >8 belong 0 stripped
9844: >23 byte x - version %d
9845: >22 byte x .%ld
9846: #
9847: 0 beshort 0x6001 MIPSEB-LE ECOFF executable
9848: >20 beshort 03401 (impure)
9849: >20 beshort 04001 (swapped)
9850: >20 beshort 05401 (paged)
9851: >8 belong >0 not stripped
9852: >8 belong 0 stripped
9853: >23 byte x - version %d
9854: >22 byte x .%ld
9855: #
9856: 0 beshort 0x6201 MIPSEL ECOFF executable
9857: >20 beshort 03401 (impure)
9858: >20 beshort 04001 (swapped)
9859: >20 beshort 05401 (paged)
9860: >8 belong >0 not stripped
9861: >8 belong 0 stripped
9862: >23 byte x - version %ld
9863: >22 byte x .%ld
9864: #
9865: # MIPS 2 additions
9866: #
9867: 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
9868: >20 beshort 0407 (impure)
9869: >20 beshort 0410 (swapped)
9870: >20 beshort 0413 (paged)
9871: >8 belong >0 not stripped
9872: >8 belong 0 stripped
9873: >22 byte x - version %ld
9874: >23 byte x .%ld
9875: #
9876: 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
9877: >20 beshort 0407 (impure)
9878: >20 beshort 0410 (swapped)
9879: >20 beshort 0413 (paged)
9880: >8 belong >0 not stripped
9881: >8 belong 0 stripped
9882: >22 byte x - version %ld
9883: >23 byte x .%ld
9884: #
9885: 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
9886: >20 beshort 03401 (impure)
9887: >20 beshort 04001 (swapped)
9888: >20 beshort 05401 (paged)
9889: >8 belong >0 not stripped
9890: >8 belong 0 stripped
9891: >23 byte x - version %ld
9892: >22 byte x .%ld
9893: #
9894: 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
9895: >20 beshort 03401 (impure)
9896: >20 beshort 04001 (swapped)
9897: >20 beshort 05401 (paged)
9898: >8 belong >0 not stripped
9899: >8 belong 0 stripped
9900: >23 byte x - version %ld
9901: >22 byte x .%ld
9902: #
9903: # MIPS 3 additions
9904: #
9905: 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
9906: >20 beshort 0407 (impure)
9907: >20 beshort 0410 (swapped)
9908: >20 beshort 0413 (paged)
9909: >8 belong >0 not stripped
9910: >8 belong 0 stripped
9911: >22 byte x - version %ld
9912: >23 byte x .%ld
9913: #
9914: 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
9915: >20 beshort 0407 (impure)
9916: >20 beshort 0410 (swapped)
9917: >20 beshort 0413 (paged)
9918: >8 belong >0 not stripped
9919: >8 belong 0 stripped
9920: >22 byte x - version %ld
9921: >23 byte x .%ld
9922: #
9923: 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
9924: >20 beshort 03401 (impure)
9925: >20 beshort 04001 (swapped)
9926: >20 beshort 05401 (paged)
9927: >8 belong >0 not stripped
9928: >8 belong 0 stripped
9929: >23 byte x - version %ld
9930: >22 byte x .%ld
9931: #
9932: 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
9933: >20 beshort 03401 (impure)
9934: >20 beshort 04001 (swapped)
9935: >20 beshort 05401 (paged)
9936: >8 belong >0 not stripped
9937: >8 belong 0 stripped
9938: >23 byte x - version %ld
9939: >22 byte x .%ld
9940: #
9941: 0 beshort 0x180 MIPSEB Ucode
9942: 0 beshort 0x182 MIPSEL-BE Ucode
9943: # 32bit core file
9944: 0 belong 0xdeadadb0 IRIX core dump
9945: >4 belong 1 of
9946: >16 string >\0 '%s'
9947: # 64bit core file
9948: 0 belong 0xdeadad40 IRIX 64-bit core dump
9949: >4 belong 1 of
9950: >16 string >\0 '%s'
9951: # N32bit core file
9952: 0 belong 0xbabec0bb IRIX N32 core dump
9953: >4 belong 1 of
9954: >16 string >\0 '%s'
9955: # New style crash dump file
9956: 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
9957: >36 string >\0 '%s'
9958: # Trusted IRIX info
9959: 0 string SGIAUDIT SGI Audit file
9960: >8 byte x - version %d
9961: >9 byte x .%ld
9962: #
9963: 0 string WNGZWZSC Wingz compiled script
9964: 0 string WNGZWZSS Wingz spreadsheet
9965: 0 string WNGZWZHP Wingz help file
9966: #
9967: 0 string #Inventor V IRIS Inventor 1.0 file
9968: 0 string #Inventor V2 Open Inventor 2.0 file
9969: # GLF is OpenGL stream encoding
9970: 0 string glfHeadMagic(); GLF_TEXT
9971: 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
9972: 4 belong 0x0000007d GLF_BINARY_MSB_FIRST
9973: # GLS is OpenGL stream encoding; GLS is the successor of GLF
9974: 0 string glsBeginGLS( GLS_TEXT
9975: 4 belong 0x10000000 GLS_BINARY_LSB_FIRST
9976: 4 belong 0x00000010 GLS_BINARY_MSB_FIRST
9977:
9978: #------------------------------------------------------------------------------
9979: # mirage: file(1) magic for Mirage executables
9980: #
9981: # XXX - byte order?
9982: #
9983: 0 long 31415 Mirage Assembler m.out executable
9984: #-----------------------------------------------------------------------------
9985: # misctools: file(1) magic for miscellaneous UNIX tools.
9986: #
9987: 0 search/1 %%!! X-Post-It-Note text
9988: 0 string/c BEGIN:VCALENDAR vCalendar calendar file
9989: 0 string/c BEGIN:VCARD vCard visiting card
9990: !:mime text/x-vcard
9991:
9992: # From: Alex Beregszaszi <alex@fsn.hu>
9993: 4 string gtktalog GNOME Catalogue (gtktalog)
9994: >13 string >\0 version %s
9995:
9996: # Summary: Libtool library file
9997: # Extension: .la
9998: # Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
9999: 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
10000:
10001: # Summary: Libtool object file
10002: # Extension: .lo
10003: # Submitted by: Abel Cheung <abelcheung@gmail.com>
10004: 0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
10005:
10006: #------------------------------------------------------------------------------
10007: # mkid: file(1) magic for mkid(1) databases
10008: #
10009: # ID is the binary tags database produced by mkid(1).
10010: #
10011: # XXX - byte order?
10012: #
10013: 0 string \311\304 ID tags data
10014: >2 short >0 version %d
10015:
10016: #------------------------------------------------------------------------------
10017: # mlssa: file(1) magic for MLSSA datafiles
10018: #
10019: 0 lelong 0xffffabcd MLSSA datafile,
10020: >4 leshort x algorithm %d,
10021: >10 lelong x %d samples
10022:
10023: #------------------------------------------------------------------------------
10024: # mmdf: file(1) magic for MMDF mail files
10025: #
10026: 0 string \001\001\001\001 MMDF mailbox
10027: #------------------------------------------------------------------------------
10028: # modem: file(1) magic for modem programs
10029: #
10030: # From: Florian La Roche <florian@knorke.saar.de>
10031: 1 string PC\ Research,\ Inc Digifax-G3-File
10032: >29 byte 1 \b, fine resolution
10033: >29 byte 0 \b, normal resolution
10034:
10035: 0 short 0x0100 raw G3 data, byte-padded
10036: 0 short 0x1400 raw G3 data
10037: #
10038: # Magic data for vgetty voice formats
10039: # (Martin Seine & Marc Eberhard)
10040:
10041: #
10042: # raw modem data version 1
10043: #
10044: 0 string RMD1 raw modem data
10045: >4 string >\0 (%s /
10046: >20 short >0 compression type 0x%04x)
10047:
10048: #
10049: # portable voice format 1
10050: #
10051: 0 string PVF1\n portable voice format
10052: >5 string >\0 (binary %s)
10053:
10054: #
10055: # portable voice format 2
10056: #
10057: 0 string PVF2\n portable voice format
10058: >5 string >\0 (ascii %s)
10059:
10060:
10061: #------------------------------------------------------------------------------
10062: # motorola: file(1) magic for Motorola 68K and 88K binaries
10063: #
10064: # 68K
10065: #
10066: 0 beshort 0520 mc68k COFF
10067: >18 beshort ^00000020 object
10068: >18 beshort &00000020 executable
10069: >12 belong >0 not stripped
10070: >168 string .lowmem Apple toolbox
10071: >20 beshort 0407 (impure)
10072: >20 beshort 0410 (pure)
10073: >20 beshort 0413 (demand paged)
10074: >20 beshort 0421 (standalone)
10075: 0 beshort 0521 mc68k executable (shared)
10076: >12 belong >0 not stripped
10077: 0 beshort 0522 mc68k executable (shared demand paged)
10078: >12 belong >0 not stripped
10079: #
10080: # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
10081: #
10082: 0 beshort 0554 68K BCS executable
10083: #
10084: # 88K
10085: #
10086: # Motorola/88Open BCS
10087: #
10088: 0 beshort 0555 88K BCS executable
10089: #
10090: # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
10091: 0 string S0 Motorola S-Record; binary data in text format
10092:
10093: # ATARI ST relocatable PRG
10094: #
10095: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
10096: # (according to Roland Waldi, Oct 21, 1987)
10097: # besides the magic 0x601a, the text segment size is checked to be
10098: # not larger than 1 MB (which is a lot on ST).
10099: # The additional 0x601b distinction I took from Doug Lee's magic.
10100: 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
10101: >2 belong x (txt=%ld,
10102: >6 belong x dat=%ld,
10103: >10 belong x bss=%ld,
10104: >14 belong x sym=%ld)
10105: 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
10106: >2 belong x (txt=%ld,
10107: >6 belong x dat=%ld,
10108: >10 belong x bss=%ld,
10109: >14 belong x sym=%ld)
10110:
10111: # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
10112: 0 beshort 0x601A Atari 68xxx executable,
10113: >2 belong x text len %lu,
10114: >6 belong x data len %lu,
10115: >10 belong x BSS len %lu,
10116: >14 belong x symboltab len %lu,
10117: >18 belong 0
10118: >22 belong &0x01 fastload flag,
10119: >22 belong &0x02 may be loaded to alternate RAM,
10120: >22 belong &0x04 malloc may be from alternate RAM,
10121: >22 belong x flags: 0x%lX,
10122: >26 beshort 0 no relocation tab
10123: >26 beshort !0 + relocation tab
10124: >30 string SFX [Self-Extracting LZH SFX archive]
10125: >38 string SFX [Self-Extracting LZH SFX archive]
10126: >44 string ZIP! [Self-Extracting ZIP SFX archive]
10127:
10128: 0 beshort 0x0064 Atari 68xxx CPX file
10129: >8 beshort x (version %04lx)
10130:
10131: #------------------------------------------------------------------------------
10132: # mozilla: file(1) magic for Mozilla XUL fastload files
10133: # (XUL.mfasl and XPC.mfasl)
10134: # URL: http://www.mozilla.org/
10135: # From: Josh Triplett <josh@freedesktop.org>
10136:
10137: 0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
10138:
10139: #------------------------------------------------------------------------------
10140: # msdos: file(1) magic for MS-DOS files
10141: #
10142:
10143: # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
10144: # updated by Joerg Jenderek
10145: 0 string @
10146: >1 string/cB \ echo\ off MS-DOS batch file text
10147: !:mime text/x-msdos-batch
10148: >1 string/cB echo\ off MS-DOS batch file text
10149: !:mime text/x-msdos-batch
10150: >1 string/cB rem\ MS-DOS batch file text
10151: !:mime text/x-msdos-batch
10152: >1 string/cB set\ MS-DOS batch file text
10153: !:mime text/x-msdos-batch
10154:
10155:
10156: # OS/2 batch files are REXX. the second regex is a bit generic, oh well
10157: # the matched commands seem to be common in REXX and uncommon elsewhere
10158: 100 search/0xffff rxfuncadd
10159: >100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
10160: 100 search/0xffff say
10161: >100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
10162:
10163: 0 leshort 0x14c MS Windows COFF Intel 80386 object file
10164: #>4 ledate x stamp %s
10165: 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
10166: #>4 ledate x stamp %s
10167: 0 leshort 0x184 MS Windows COFF Alpha object file
10168: #>4 ledate x stamp %s
10169: 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
10170: #>4 ledate x stamp %s
10171: 0 leshort 0x1f0 MS Windows COFF PowerPC object file
10172: #>4 ledate x stamp %s
10173: 0 leshort 0x290 MS Windows COFF PA-RISC object file
10174: #>4 ledate x stamp %s
10175:
10176: # XXX - according to Microsoft's spec, at an offset of 0x3c in a
10177: # PE-format executable is the offset in the file of the PE header;
10178: # unfortunately, that's a little-endian offset, and there's no way
10179: # to specify an indirect offset with a specified byte order.
10180: # So, for now, we assume the standard MS-DOS stub, which puts the
10181: # PE header at 0x80 = 128.
10182: #
10183: # Required OS version and subsystem version were 4.0 on some NT 3.51
10184: # executables built with Visual C++ 4.0, so it's not clear that
10185: # they're interesting. The user version was 0.0, but there's
10186: # probably some linker directive to set it. The linker version was
10187: # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
10188: #
10189: # many of the compressed formats were extraced from IDARC 1.23 source code
10190: #
10191: 0 string MZ
10192: !:mime application/x-dosexec
10193: >0x18 leshort <0x40 MS-DOS executable
10194: >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
10195: >>&18 leshort&0x2000 >0 (DLL)
10196: >>&88 leshort 0 (unknown subsystem)
10197: >>&88 leshort 1 (native)
10198: >>&88 leshort 2 (GUI)
10199: >>&88 leshort 3 (console)
10200: >>&88 leshort 7 (POSIX)
10201: >>&0 leshort 0x0 unknown processor
10202: >>&0 leshort 0x14c Intel 80386
10203: >>&0 leshort 0x166 MIPS R4000
10204: >>&0 leshort 0x184 Alpha
10205: >>&0 leshort 0x268 Motorola 68000
10206: >>&0 leshort 0x1f0 PowerPC
10207: >>&0 leshort 0x290 PA-RISC
10208: >>&18 leshort&0x0100 >0 32-bit
10209: >>&18 leshort&0x1000 >0 system file
10210: >>&228 lelong >0 \b, Mono/.Net assembly
10211: >>&0xf4 search/0x140 \x0\x40\x1\x0
10212: >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
10213: >30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
10214: !:mime application/zip
10215: # Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect.
10216: >30 string PKLITE\ Copr. Self-extracting PKZIP archive
10217: !:mime application/zip
10218:
10219: >0x18 leshort >0x3f
10220: >>(0x3c.l) string PE\0\0 PE
10221: >>>(0x3c.l+25) byte 1 \b32 executable
10222: >>>(0x3c.l+25) byte 2 \b32+ executable
10223: # hooray, there's a DOS extender using the PE format, with a valid PE
10224: # executable inside (which just prints a message and exits if run in win)
10225: >>>(0x3c.l+92) leshort <10
10226: >>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
10227: >>>>(8.s*16) string !32STUB for MS Windows
10228: >>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
10229: >>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
10230: >>>>>(0x3c.l+92) leshort 1 (native)
10231: >>>>>(0x3c.l+92) leshort 2 (GUI)
10232: >>>>>(0x3c.l+92) leshort 3 (console)
10233: >>>>>(0x3c.l+92) leshort 7 (POSIX)
10234: >>>(0x3c.l+92) leshort 10 (EFI application)
10235: >>>(0x3c.l+92) leshort 11 (EFI boot service driver)
10236: >>>(0x3c.l+92) leshort 12 (EFI runtime driver)
10237: >>>(0x3c.l+92) leshort 13 (XBOX)
10238: >>>(0x3c.l+4) leshort 0x0 unknown processor
10239: >>>(0x3c.l+4) leshort 0x14c Intel 80386
10240: >>>(0x3c.l+4) leshort 0x166 MIPS R4000
10241: >>>(0x3c.l+4) leshort 0x184 Alpha
10242: >>>(0x3c.l+4) leshort 0x268 Motorola 68000
10243: >>>(0x3c.l+4) leshort 0x1f0 PowerPC
10244: >>>(0x3c.l+4) leshort 0x290 PA-RISC
10245: >>>(0x3c.l+4) leshort 0x200 Intel Itanium
10246: >>>(0x3c.l+22) leshort&0x0100 >0 32-bit
10247: >>>(0x3c.l+22) leshort&0x1000 >0 system file
10248: >>>(0x3c.l+232) lelong >0 Mono/.Net assembly
10249:
10250: >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
10251: >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
10252: >>>>(0x3c.l+0xf8) search/0x140 UPX2
10253: >>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
10254: >>>>(0x3c.l+0xf8) search/0x140 .idata
10255: >>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
10256: >>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
10257: >>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
10258: >>>>(0x3c.l+0xf8) search/0x140 .rsrc
10259: >>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
10260: >>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
10261: >>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
10262: >>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
10263: >>>>(0x3c.l+0xf8) search/0x140 .data
10264: >>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
10265: >>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
10266: >>>>>(0x3c.l+0xf7) byte x
10267: >>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
10268: >>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
10269: >>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
10270: >>>>(0x3c.l+0xf8) search/0x140 .reloc
10271: >>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
10272:
10273: >>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
10274: >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
10275: >>>>0x30 string Inno \b, InnoSetup self-extracting archive
10276:
10277: >>(0x3c.l) string !PE\0\0 MS-DOS executable
10278:
10279: >>(0x3c.l) string NE \b, NE
10280: >>>(0x3c.l+0x36) byte 0 (unknown OS)
10281: >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
10282: >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
10283: >>>(0x3c.l+0x36) byte 3 for MS-DOS
10284: >>>(0x3c.l+0x36) byte >3 (unknown OS)
10285: >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
10286: >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
10287: >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
10288: >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
10289: >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
10290:
10291: >>(0x3c.l) string LX\0\0 \b, LX
10292: >>>(0x3c.l+0x0a) leshort <1 (unknown OS)
10293: >>>(0x3c.l+0x0a) leshort 1 for OS/2
10294: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
10295: >>>(0x3c.l+0x0a) leshort 3 for DOS
10296: >>>(0x3c.l+0x0a) leshort >3 (unknown OS)
10297: >>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
10298: >>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
10299: >>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
10300: >>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
10301: >>>(0x3c.l+0x08) leshort 1 i80286
10302: >>>(0x3c.l+0x08) leshort 2 i80386
10303: >>>(0x3c.l+0x08) leshort 3 i80486
10304: >>>(8.s*16) string emx \b, emx
10305: >>>>&1 string x %s
10306: >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
10307:
10308: # MS Windows system file, supposedly a collection of LE executables
10309: >>(0x3c.l) string W3 \b, W3 for MS Windows
10310:
10311: >>(0x3c.l) string LE\0\0 \b, LE executable
10312: >>>(0x3c.l+0x0a) leshort 1
10313: # some DOS extenders use LE files with OS/2 header
10314: >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
10315: >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
10316: >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
10317: >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
10318: >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
10319: >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
10320: >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
10321: # this is a wild guess; hopefully it is a specific signature
10322: >>>>&0x24 lelong <0x50
10323: >>>>>(&0x4c.l) string \xfc\xb8WATCOM
10324: >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
10325: # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
10326: #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
10327: # fails with DOS-Extenders.
10328: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
10329: >>>(0x3c.l+0x0a) leshort 3 for DOS
10330: >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
10331: >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
10332: >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
10333:
10334: # looks like ASCII, probably some embedded copyright message.
10335: # and definitely not NE/LE/LX/PE
10336: >>0x3c lelong >0x20000000
10337: >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
10338: # header data too small for extended executable
10339: >2 long !0
10340: >>0x18 leshort <0x40
10341: >>>(4.s*512) leshort !0x014c
10342:
10343: >>>>&(2.s-514) string !LE
10344: >>>>>&-2 string !BW \b, MZ for MS-DOS
10345: >>>>&(2.s-514) string LE \b, LE
10346: >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
10347: # educated guess since indirection is still not capable enough for complex offset
10348: # calculations (next embedded executable would be at &(&2*512+&0-2)
10349: # I suspect there are only LE executables in these multi-exe files
10350: >>>>&(2.s-514) string BW
10351: >>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
10352: >>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
10353:
10354: # This sequence skips to the first COFF segment, usually .text
10355: >(4.s*512) leshort 0x014c \b, COFF
10356: >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
10357: >>(8.s*16) string emx
10358: >>>&1 string x for DOS, Win or OS/2, emx %s
10359: >>&(&0x42.l-3) byte x
10360: >>>&0x26 string UPX \b, UPX compressed
10361: # and yet another guess: small .text, and after large .data is unusal, could be 32lite
10362: >>&0x2c search/0xa0 .text
10363: >>>&0x0b lelong <0x2000
10364: >>>>&0 lelong >0x6000 \b, 32lite compressed
10365:
10366: >(8.s*16) string $WdX \b, WDos/X DOS extender
10367:
10368: # .EXE formats (Greg Roelofs, newt@uchicago.edu)
10369: #
10370: >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
10371: >0xe7 string LH/2\ Self-Extract \b, %s
10372: >0x1c string diet \b, diet compressed
10373: >0x1c string LZ09 \b, LZEXE v0.90 compressed
10374: >0x1c string LZ91 \b, LZEXE v0.91 compressed
10375: >0x1c string tz \b, TinyProg compressed
10376: >0x1e string PKLITE \b, %s compressed
10377: >0x64 string W\ Collis\0\0 \b, Compack compressed
10378: >0x24 string LHa's\ SFX \b, LHa self-extracting archive
10379: !:mime application/x-lha
10380: >0x24 string LHA's\ SFX \b, LHa self-extracting archive
10381: !:mime application/x-lha
10382: >0x24 string \ $ARX \b, ARX self-extracting archive
10383: >0x24 string \ $LHarc \b, LHarc self-extracting archive
10384: >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
10385: >1638 string -lh5- \b, LHa self-extracting archive v2.13S
10386: >0x17888 string Rar! \b, RAR self-extracting archive
10387: >0x40 string aPKG \b, aPackage self-extracting archive
10388:
10389: >32 string AIN
10390: >>35 string 2 \b, AIN 2.x compressed
10391: >>35 string <2 \b, AIN 1.x compressed
10392: >>35 string >2 \b, AIN 1.x compressed
10393: >28 string UC2X \b, UCEXE compressed
10394: >28 string WWP\ \b, WWPACK compressed
10395:
10396: # skip to the end of the exe
10397: >(4.s*512) long x
10398: >>&(2.s-517) byte x
10399: >>>&0 string PK\3\4 \b, ZIP self-extracting archive
10400: >>>&0 string Rar! \b, RAR self-extracting archive
10401: >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
10402: >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
10403: >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
10404: >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
10405: >>>&7 search/400 **ACE** \b, ACE self-extracting archive
10406: >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
10407:
10408: >0x1c string RJSX \b, ARJ self-extracting archive
10409: # winarj stores a message in the stub instead of the sig in the MZ header
10410: >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
10411:
10412: # a few unknown ZIP sfxes, no idea if they are needed or if they are
10413: # already captured by the generic patterns above
10414: >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
10415: >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
10416: # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
10417: #
10418:
10419: # TELVOX Teleinformatica CODEC self-extractor for OS/2:
10420: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
10421: >>49824 leshort =1 \b, 1 file
10422: >>49824 leshort >1 \b, %u files
10423:
10424: # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
10425: # Uncommenting only the first two lines will cover about 2/3 of COM files,
10426: # but it isn't feasible to match all COM files since there must be at least
10427: # two dozen different one-byte "magics".
10428: #0 byte 0xe9 DOS executable (COM)
10429: #>0x1FE leshort 0xAA55 \b, boot code
10430: >6 string SFX\ of\ LHarc (%s)
10431: 0 belong 0xffffffff DOS executable (device driver)
10432: #CMD640X2.SYS
10433: >10 string >\x23
10434: >>10 string !\x2e
10435: >>>17 string <\x5B
10436: >>>>10 string x \b, name: %.8s
10437: #UDMA.SYS KEYB.SYS CMD640X2.SYS
10438: >10 string <\x41
10439: >>12 string >\x40
10440: >>>10 string !$
10441: >>>>12 string x \b, name: %.8s
10442: #BTCDROM.SYS ASPICD.SYS
10443: >22 string >\x40
10444: >>22 string <\x5B
10445: >>>23 string <\x5B
10446: >>>>22 string x \b, name: %.8s
10447: #ATAPICD.SYS
10448: >76 string \0
10449: >>77 string >\x40
10450: >>>77 string <\x5B
10451: >>>>77 string x \b, name: %.8s
10452: #0 byte 0x8c DOS executable (COM)
10453: # 0xeb conflicts with "sequent" magic
10454: #0 byte 0xeb DOS executable (COM)
10455: #>0x1FE leshort 0xAA55 \b, boot code
10456: #>85 string UPX \b, UPX compressed
10457: #>4 string \ $ARX \b, ARX self-extracting archive
10458: #>4 string \ $LHarc \b, LHarc self-extracting archive
10459: #>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
10460: #0 byte 0xb8 COM executable
10461: # modified by Joerg Jenderek
10462: >1 lelong !0x21cd4cff for DOS
10463: # http://syslinux.zytor.com/comboot.php
10464: # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
10465: # start with assembler instructions mov eax,21cd4cffh
10466: >1 lelong 0x21cd4cff (32-bit COMBOOT)
10467: 0 string \x81\xfc
10468: >4 string \x77\x02\xcd\x20\xb9
10469: >>36 string UPX! FREE-DOS executable (COM), UPX compressed
10470: 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
10471: # GRR search is not working
10472: #2 search/28 \xcd\x21 COM executable for MS-DOS
10473: #WHICHFAT.cOM
10474: 2 string \xcd\x21 COM executable for DOS
10475: #DELTREE.cOM DELTREE2.cOM
10476: 4 string \xcd\x21 COM executable for DOS
10477: #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
10478: 5 string \xcd\x21 COM executable for DOS
10479: #DELTMP.COm HASFAT32.cOM
10480: 7 string \xcd\x21
10481: >0 byte !0xb8 COM executable for DOS
10482: #COMP.cOM MORE.COm
10483: 10 string \xcd\x21
10484: >5 string !\xcd\x21 COM executable for DOS
10485: #comecho.com
10486: 13 string \xcd\x21 COM executable for DOS
10487: #HELP.COm EDIT.coM
10488: 18 string \xcd\x21 COM executable for MS-DOS
10489: #NWRPLTRM.COm
10490: 23 string \xcd\x21 COM executable for MS-DOS
10491: #LOADFIX.cOm LOADFIX.cOm
10492: 30 string \xcd\x21 COM executable for MS-DOS
10493: #syslinux.com 3.11
10494: 70 string \xcd\x21 COM executable for DOS
10495: # many compressed/converted COMs start with a copy loop instead of a jump
10496: 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
10497: 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
10498: >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
10499: 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
10500: # FIXME: missing diet .com compression
10501:
10502: # miscellaneous formats
10503: 0 string LZ MS-DOS executable (built-in)
10504: #0 byte 0xf0 MS-DOS program library data
10505: #
10506:
10507: # AAF files:
10508: # <stuartc@rd.bbc.co.uk> Stuart Cunningham
10509: 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
10510: >30 byte 9 (512B sectors)
10511: >30 byte 12 (4kB sectors)
10512: 0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
10513: >30 byte 9 (512B sectors)
10514: >30 byte 12 (4kB sectors)
10515:
10516: # Popular applications
10517: 2080 string Microsoft\ Word\ 6.0\ Document %s
10518: !:mime application/msword
10519: 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
10520: !:mime application/msword
10521: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
10522: 2112 string MSWordDoc Microsoft Word document data
10523: !:mime application/msword
10524: #
10525: 0 belong 0x31be0000 Microsoft Word Document
10526: !:mime application/msword
10527: #
10528: 0 string PO^Q` Microsoft Word 6.0 Document
10529: !:mime application/msword
10530: #
10531: 0 string \376\067\0\043 Microsoft Office Document
10532: !:mime application/msword
10533: 0 string \333\245-\0\0\0 Microsoft Office Document
10534: !:mime application/msword
10535: 512 string \354\245\301 Microsoft Word Document
10536: !:mime application/msword
10537: #
10538: 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
10539: !:mime application/vnd.ms-excel
10540:
10541: 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
10542: !:mime application/vnd.ms-excel
10543: #
10544: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
10545: 2114 string Biff5 Microsoft Excel 5.0 Worksheet
10546: !:mime application/vnd.ms-excel
10547: # Italian MS-Excel
10548: 2121 string Biff5 Microsoft Excel 5.0 Worksheet
10549: !:mime application/vnd.ms-excel
10550: 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
10551: !:mime application/vnd.ms-excel
10552: #
10553: 0 belong 0x00001a00 Lotus 1-2-3
10554: !:mime application/x-123
10555: >4 belong 0x00100400 wk3 document data
10556: >4 belong 0x02100400 wk4 document data
10557: >4 belong 0x07800100 fm3 or fmb document data
10558: >4 belong 0x07800000 fm3 or fmb document data
10559: #
10560: 0 belong 0x00000200 Lotus 1-2-3
10561: !:mime application/x-123
10562: >4 belong 0x06040600 wk1 document data
10563: >4 belong 0x06800200 fmt document data
10564: 0 string WordPro\0 Lotus WordPro
10565: !:mime application/vnd.lotus-wordpro
10566: 0 string WordPro\r\373 Lotus WordPro
10567: !:mime application/vnd.lotus-wordpro
10568:
10569:
10570: # Summary: Script used by InstallScield to uninstall applications
10571: # Extension: .isu
10572: # Submitted by: unknown
10573: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
10574: 0 string \x71\xa8\x00\x00\x01\x02
10575: >12 string Stirling\ Technologies, InstallShield Uninstall Script
10576:
10577: # Winamp .avs
10578: #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
10579: 0 string Nullsoft\ AVS\ Preset\ Winamp plug in
10580:
10581: # Windows Metafont .WMF
10582: 0 string \327\315\306\232 ms-windows metafont .wmf
10583: 0 string \002\000\011\000 ms-windows metafont .wmf
10584: 0 string \001\000\011\000 ms-windows metafont .wmf
10585:
10586: #tz3 files whatever that is (MS Works files)
10587: 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
10588: 0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
10589: 0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
10590:
10591: # PGP sig files .sig
10592: #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
10593: 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
10594: 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
10595: 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
10596: 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
10597: 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
10598: 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
10599:
10600: # windows zips files .dmf
10601: 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
10602:
10603:
10604: #ico files
10605: 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
10606:
10607: # Windows icons (Ian Springer <ips@fpk.hp.com>)
10608: 0 string \000\000\001\000 MS Windows icon resource
10609: !:mime image/x-ico
10610: >4 byte 1 - 1 icon
10611: >4 byte >1 - %d icons
10612: >>6 byte >0 \b, %dx
10613: >>>7 byte >0 \b%d
10614: >>8 byte 0 \b, 256-colors
10615: >>8 byte >0 \b, %d-colors
10616:
10617:
10618: # .chr files
10619: 0 string PK\010\010BGI Borland font
10620: >4 string >\0 %s
10621: # then there is a copyright notice
10622:
10623:
10624: # .bgi files
10625: 0 string pk\010\010BGI Borland device
10626: >4 string >\0 %s
10627: # then there is a copyright notice
10628:
10629:
10630: # Windows Recycle Bin record file (named INFO2)
10631: # By Abel Cheung (abelcheung AT gmail dot com)
10632: # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
10633: # Since Vista uses another structure, INFO2 structure probably won't change
10634: # anymore. Detailed analysis in:
10635: # http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
10636: 0 lelong 0x00000004
10637: >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
10638:
10639: 0 lelong 0x00000005
10640: >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
10641:
10642:
10643: ##### put in Either Magic/font or Magic/news
10644: # Acroread or something files wrongly identified as G3 .pfm
10645: # these have the form \000 \001 any? \002 \000 \000
10646: # or \000 \001 any? \022 \000 \000
10647: 0 belong&0xffff00ff 0x00010012 PFM data
10648: >4 string \000\000
10649: >6 string >\060 - %s
10650:
10651: 0 belong&0xffff00ff 0x00010002 PFM data
10652: >4 string \000\000
10653: >6 string >\060 - %s
10654: #0 string \000\001 pfm?
10655: #>3 string \022\000\000Copyright\ yes
10656: #>3 string \002\000\000Copyright\ yes
10657: #>3 string >\0 oops, not a font file. Cancel that.
10658: #it clashes with ttf files so put it lower down.
10659:
10660: # From Doug Lee via a FreeBSD pr
10661: 9 string GERBILDOC First Choice document
10662: 9 string GERBILDB First Choice database
10663: 9 string GERBILCLIP First Choice database
10664: 0 string GERBIL First Choice device file
10665: 9 string RABBITGRAPH RabbitGraph file
10666: 0 string DCU1 Borland Delphi .DCU file
10667: 0 string =!<spell> MKS Spell hash list (old format)
10668: 0 string =!<spell2> MKS Spell hash list
10669: # Too simple - MPi
10670: #0 string AH Halo(TM) bitmapped font file
10671: 0 lelong 0x08086b70 TurboC BGI file
10672: 0 lelong 0x08084b50 TurboC Font file
10673:
10674: # WARNING: below line conflicts with Infocom game data Z-machine 3
10675: 0 byte 0x03 DBase 3 data file
10676: >0x04 lelong 0 (no records)
10677: >0x04 lelong >0 (%ld records)
10678: 0 byte 0x83 DBase 3 data file with memo(s)
10679: >0x04 lelong 0 (no records)
10680: >0x04 lelong >0 (%ld records)
10681: 0 leshort 0x0006 DBase 3 index file
10682: 0 string PMCC Windows 3.x .GRP file
10683: 1 string RDC-meg MegaDots
10684: >8 byte >0x2F version %c
10685: >9 byte >0x2F \b.%c file
10686: 0 lelong 0x4C
10687: >4 lelong 0x00021401 Windows shortcut file
10688:
10689: # DOS EPS Binary File Header
10690: # From: Ed Sznyter <ews@Black.Market.NET>
10691: 0 belong 0xC5D0D3C6 DOS EPS Binary File
10692: >4 long >0 Postscript starts at byte %d
10693: >>8 long >0 length %d
10694: >>>12 long >0 Metafile starts at byte %d
10695: >>>>16 long >0 length %d
10696: >>>20 long >0 TIFF starts at byte %d
10697: >>>>24 long >0 length %d
10698:
10699: # TNEF magic From "Joomy" <joomy@se-ed.net>
10700: # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
10701: 0 leshort 0x223e9f78 TNEF
10702: !:mime application/vnd.ms-tnef
10703:
10704: # HtmlHelp files (.chm)
10705: 0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
10706:
10707: # GFA-BASIC (Wolfram Kleff)
10708: 2 string GFA-BASIC3 GFA-BASIC 3 data
10709:
10710: #------------------------------------------------------------------------------
10711: # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
10712: # Microsoft Cabinet files
10713: 0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
10714: >8 lelong x \b, %u bytes
10715: >28 leshort 1 \b, 1 file
10716: >28 leshort >1 \b, %u files
10717:
10718: # InstallShield Cabinet files
10719: 0 string ISc( InstallShield Cabinet archive data
10720: >5 byte&0xf0 =0x60 version 6,
10721: >5 byte&0xf0 !0x60 version 4/5,
10722: >(12.l+40) lelong x %u files
10723:
10724: # Windows CE package files
10725: 0 string MSCE\0\0\0\0 Microsoft WinCE install header
10726: >20 lelong 0 \b, architecture-independent
10727: >20 lelong 103 \b, Hitachi SH3
10728: >20 lelong 104 \b, Hitachi SH4
10729: >20 lelong 0xA11 \b, StrongARM
10730: >20 lelong 4000 \b, MIPS R4000
10731: >20 lelong 10003 \b, Hitachi SH3
10732: >20 lelong 10004 \b, Hitachi SH3E
10733: >20 lelong 10005 \b, Hitachi SH4
10734: >20 lelong 70001 \b, ARM 7TDMI
10735: >52 leshort 1 \b, 1 file
10736: >52 leshort >1 \b, %u files
10737: >56 leshort 1 \b, 1 registry entry
10738: >56 leshort >1 \b, %u registry entries
10739:
10740:
10741: # Windows Enhanced Metafile (EMF)
10742: # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
10743: # for further information.
10744: 0 ulelong 1
10745: >40 string \ EMF Windows Enhanced Metafile (EMF) image data
10746: >>44 ulelong x version 0x%x
10747:
10748: # From: Alex Beregszaszi <alex@fsn.hu>
10749: 0 string COWD VMWare3
10750: >4 byte 3 disk image
10751: >>32 lelong x (%d/
10752: >>36 lelong x \b%d/
10753: >>40 lelong x \b%d)
10754: >4 byte 2 undoable disk image
10755: >>32 string >\0 (%s)
10756:
10757: 0 string VMDK VMware4 disk image
10758: 0 string KDMV VMware4 disk image
10759:
10760: #--------------------------------------------------------------------
10761: # Qemu Emulator Images
10762: # Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
10763: # Made by reading sources and doing trial and error on existing
10764: # qcow files
10765: 0 string QFI Qemu Image, Format: Qcow
10766:
10767: # Uncomment the following line to display Magic (only used for debugging
10768: # this magic number)
10769: #>0 string x , Magic: %s
10770:
10771: # There are currently 2 Versions: "1" and "2"
10772: # I do not use Version 2 and therefor branch here
10773: # but can assure: it works (tested on both versions)
10774: # Also my Qemu 0.9.0 which uses this Version 2 refuses
10775: # to start in its bios
10776: >0x04 belong 2 , Version: 2
10777: >0x04 belong 1 , Version: 1
10778:
10779: # Using the existence of the Backing File Offset to Branch or not
10780: # to read Backing File Information
10781: >>0xc belong >0 , Backing File( Offset: %lu
10782: >>>(0xc.L) string >\0 , Path: %s
10783:
10784: # Didn't get the trick here how qemu stores the "Size" at this Position
10785: # There is actually something stored but nothing makes sense
10786: # The header in the sources talks about it
10787: #>>>16 lelong x , Size: %lu
10788:
10789: # Modification time of the Backing File
10790: # Really useful if you want to know if your backing
10791: # file is still usable together with this image
10792: >>>20 bedate x , Mtime: %s )
10793:
10794: # Don't know how to calculate in Magicfiles
10795: # Also: this Information is not reliably
10796: # stored in image-files
10797: >>24 lelong x , Disk Size could be: %d * 256 bytes
10798:
10799: 0 string QEVM QEMU's suspend to disk image
10800:
10801: 0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
10802: >32 string x type %s,
10803: >48 string x subtype %s
10804:
10805: 0 lelong 0x02468ace Bochs Sparse disk image
10806:
10807: # from http://filext.com by Derek M Jones <derek@knosof.co.uk>
10808: # False positive with PPT (also currently this string is too long)
10809: #0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
10810: 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
10811: #>48 byte 0x1B Excel Document
10812: #!:mime application/vnd.ms-excel
10813: >546 string bjbj Microsoft Word Document
10814: !:mime application/msword
10815: >546 string jbjb Microsoft Word Document
10816: !:mime application/msword
10817:
10818: 0 string \224\246\056 Microsoft Word Document
10819: !:mime application/msword
10820:
10821: 512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
10822: !:mime application/msword
10823:
10824: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
10825: # Magic type for Dell's BIOS .hdr files
10826: # Dell's .hdr
10827: 0 string $RBU
10828: >23 string Dell %s system BIOS
10829: >48 string x version %.3s
10830:
10831: # Type: Microsoft DirectDraw Surface
10832: # URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
10833: # From: Morten Hustveit <morten@debian.org>
10834: 0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
10835: >16 lelong >0 %hd x
10836: >12 lelong >0 %hd,
10837: >84 string x %.4s
10838:
10839: # Type: Microsoft Document Imaging Format (.mdi)
10840: # URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
10841: # From: Daniele Sempione <scrows@oziosi.org>
10842: 0 short 0x5045 Microsoft Document Imaging Format
10843:
10844: # MS eBook format (.lit)
10845: 0 string ITOLITLS Microsoft Reader eBook Data
10846: >8 lelong x \b, version %u
10847: !:mime application/x-ms-reader
10848:
10849: #------------------------------------------------------------------------------
10850: # msvc: file(1) magic for msvc
10851: # "H. Nanosecond" <aldomel@ix.netcom.com>
10852: # Microsoft visual C
10853: #
10854: # I have version 1.0
10855:
10856: # .aps
10857: 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
10858:
10859: # .ide
10860: #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
10861: 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
10862:
10863: # .res
10864: 0 string \000\000\000\000\040\000\000\000\377 MSVC .res
10865: 0 string \377\003\000\377\001\000\020\020\350 MSVC .res
10866: 0 string \377\003\000\377\001\000\060\020\350 MSVC .res
10867:
10868: #.lib
10869: 0 string \360\015\000\000 Microsoft Visual C library
10870: 0 string \360\075\000\000 Microsoft Visual C library
10871: 0 string \360\175\000\000 Microsoft Visual C library
10872:
10873: #.pch
10874: 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
10875:
10876: # .pdb
10877: # too long 0 string Microsoft\ C/C++\ program\ database\
10878: 0 string Microsoft\ C/C++\ MSVC program database
10879: >18 string program\ database\
10880: >33 string >\0 ver %s
10881:
10882: #.sbr
10883: 0 string \000\002\000\007\000 MSVC .sbr
10884: >5 string >\0 %s
10885:
10886: #.bsc
10887: 0 string \002\000\002\001 MSVC .bsc
10888:
10889: #.wsp
10890: 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
10891: # these seem to start with the version and contain menus
10892: # ------------------------------------------------------------------------
10893: # mup: file(1) magic for Mup (Music Publisher) input file.
10894: #
10895: # From: Abel Cheung <abel (@) oaka.org>
10896: #
10897: # NOTE: This header is mainly proposed in the Arkkra mailing list,
10898: # and is not a mandatory header because of old mup input file
10899: # compatibility. Noteedit also use mup format, but is not forcing
10900: # user to use any header as well.
10901: #
10902: 0 search/1 //!Mup Mup music publication program input text
10903: >6 string -Arkkra (Arkkra)
10904: >>13 string -
10905: >>>16 string .
10906: >>>>14 string x \b, need V%.4s
10907: >>>15 string .
10908: >>>>14 string x \b, need V%.3s
10909: >6 string -
10910: >>9 string .
10911: >>>7 string x \b, need V%.4s
10912: >>8 string .
10913: >>>7 string x \b, need V%.3s
10914:
10915: #-----------------------------------------------------------------------------
10916: # natinst: file(1) magic for National Instruments Code Files
10917:
10918: #
10919: # From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
10920: # version 1
10921: # Many formats still missing, we use, for the moment LabVIEW
10922: # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
10923: #
10924: 0 string RSRC National Instruments,
10925: # Check if it's a LabVIEW File
10926: >8 string LV LabVIEW File,
10927: # Check wich kind of file is
10928: >>10 string SB Code Resource File, data
10929: >>10 string IN Virtual Instrument Program, data
10930: >>10 string AR VI Library, data
10931: # This is for Menu Libraries
10932: >8 string LMNULBVW Portable File Names, data
10933: # This is for General Resources
10934: >8 string rsc Resources File, data
10935: # This is for VXI Package
10936: 0 string VMAP National Instruments, VXI File, data
10937:
10938: #------------------------------------------------------------------------------
10939: # ncr: file(1) magic for NCR Tower objects
10940: #
10941: # contributed by
10942: # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
10943: # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
10944: #
10945: 0 beshort 000610 Tower/XP rel 2 object
10946: >12 belong >0 not stripped
10947: >20 beshort 0407 executable
10948: >20 beshort 0410 pure executable
10949: >22 beshort >0 - version %ld
10950: 0 beshort 000615 Tower/XP rel 2 object
10951: >12 belong >0 not stripped
10952: >20 beshort 0407 executable
10953: >20 beshort 0410 pure executable
10954: >22 beshort >0 - version %ld
10955: 0 beshort 000620 Tower/XP rel 3 object
10956: >12 belong >0 not stripped
10957: >20 beshort 0407 executable
10958: >20 beshort 0410 pure executable
10959: >22 beshort >0 - version %ld
10960: 0 beshort 000625 Tower/XP rel 3 object
10961: >12 belong >0 not stripped
10962: >20 beshort 0407 executable
10963: >20 beshort 0410 pure executable
10964: >22 beshort >0 - version %ld
10965: 0 beshort 000630 Tower32/600/400 68020 object
10966: >12 belong >0 not stripped
10967: >20 beshort 0407 executable
10968: >20 beshort 0410 pure executable
10969: >22 beshort >0 - version %ld
10970: 0 beshort 000640 Tower32/800 68020
10971: >18 beshort &020000 w/68881 object
10972: >18 beshort &040000 compatible object
10973: >18 beshort &060000 object
10974: >20 beshort 0407 executable
10975: >20 beshort 0413 pure executable
10976: >12 belong >0 not stripped
10977: >22 beshort >0 - version %ld
10978: 0 beshort 000645 Tower32/800 68010
10979: >18 beshort &040000 compatible object
10980: >18 beshort &060000 object
10981: >20 beshort 0407 executable
10982: >20 beshort 0413 pure executable
10983: >12 belong >0 not stripped
10984: >22 beshort >0 - version %ld
10985:
10986: #------------------------------------------------------------------------------
10987: # netbsd: file(1) magic for NetBSD objects
10988: #
10989: # All new-style magic numbers are in network byte order.
10990: #
10991:
10992: 0 lelong 000000407 a.out NetBSD little-endian object file
10993: >16 lelong >0 not stripped
10994: 0 belong 000000407 a.out NetBSD big-endian object file
10995: >16 belong >0 not stripped
10996:
10997: 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
10998: >0 byte &0x80
10999: >>20 lelong <4096 shared library
11000: >>20 lelong =4096 dynamically linked executable
11001: >>20 lelong >4096 dynamically linked executable
11002: >0 byte ^0x80 executable
11003: >16 lelong >0 not stripped
11004: 0 belong&0377777777 041400410 a.out NetBSD/i386 pure
11005: >0 byte &0x80 dynamically linked executable
11006: >0 byte ^0x80 executable
11007: >16 lelong >0 not stripped
11008: 0 belong&0377777777 041400407 a.out NetBSD/i386
11009: >0 byte &0x80 dynamically linked executable
11010: >0 byte ^0x80
11011: >>0 byte &0x40 position independent
11012: >>20 lelong !0 executable
11013: >>20 lelong =0 object file
11014: >16 lelong >0 not stripped
11015: 0 belong&0377777777 041400507 a.out NetBSD/i386 core
11016: >12 string >\0 from '%s'
11017: >32 lelong !0 (signal %d)
11018:
11019: 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
11020: >0 byte &0x80
11021: >>20 belong <8192 shared library
11022: >>20 belong =8192 dynamically linked executable
11023: >>20 belong >8192 dynamically linked executable
11024: >0 byte ^0x80 executable
11025: >16 belong >0 not stripped
11026: 0 belong&0377777777 041600410 a.out NetBSD/m68k pure
11027: >0 byte &0x80 dynamically linked executable
11028: >0 byte ^0x80 executable
11029: >16 belong >0 not stripped
11030: 0 belong&0377777777 041600407 a.out NetBSD/m68k
11031: >0 byte &0x80 dynamically linked executable
11032: >0 byte ^0x80
11033: >>0 byte &0x40 position independent
11034: >>20 belong !0 executable
11035: >>20 belong =0 object file
11036: >16 belong >0 not stripped
11037: 0 belong&0377777777 041600507 a.out NetBSD/m68k core
11038: >12 string >\0 from '%s'
11039: >32 belong !0 (signal %d)
11040:
11041: 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
11042: >0 byte &0x80
11043: >>20 belong <4096 shared library
11044: >>20 belong =4096 dynamically linked executable
11045: >>20 belong >4096 dynamically linked executable
11046: >0 byte ^0x80 executable
11047: >16 belong >0 not stripped
11048: 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
11049: >0 byte &0x80 dynamically linked executable
11050: >0 byte ^0x80 executable
11051: >16 belong >0 not stripped
11052: 0 belong&0377777777 042000407 a.out NetBSD/m68k4k
11053: >0 byte &0x80 dynamically linked executable
11054: >0 byte ^0x80
11055: >>0 byte &0x40 position independent
11056: >>20 belong !0 executable
11057: >>20 belong =0 object file
11058: >16 belong >0 not stripped
11059: 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
11060: >12 string >\0 from '%s'
11061: >32 belong !0 (signal %d)
11062:
11063: 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
11064: >0 byte &0x80
11065: >>20 lelong <4096 shared library
11066: >>20 lelong =4096 dynamically linked executable
11067: >>20 lelong >4096 dynamically linked executable
11068: >0 byte ^0x80 executable
11069: >16 lelong >0 not stripped
11070: 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
11071: >0 byte &0x80 dynamically linked executable
11072: >0 byte ^0x80 executable
11073: >16 lelong >0 not stripped
11074: 0 belong&0377777777 042200407 a.out NetBSD/ns32532
11075: >0 byte &0x80 dynamically linked executable
11076: >0 byte ^0x80
11077: >>0 byte &0x40 position independent
11078: >>20 lelong !0 executable
11079: >>20 lelong =0 object file
11080: >16 lelong >0 not stripped
11081: 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
11082: >12 string >\0 from '%s'
11083: >32 lelong !0 (signal %d)
11084:
11085: 0 belong&0377777777 045200507 a.out NetBSD/powerpc core
11086: >12 string >\0 from '%s'
11087:
11088: 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
11089: >0 byte &0x80
11090: >>20 belong <8192 shared library
11091: >>20 belong =8192 dynamically linked executable
11092: >>20 belong >8192 dynamically linked executable
11093: >0 byte ^0x80 executable
11094: >16 belong >0 not stripped
11095: 0 belong&0377777777 042400410 a.out NetBSD/sparc pure
11096: >0 byte &0x80 dynamically linked executable
11097: >0 byte ^0x80 executable
11098: >16 belong >0 not stripped
11099: 0 belong&0377777777 042400407 a.out NetBSD/sparc
11100: >0 byte &0x80 dynamically linked executable
11101: >0 byte ^0x80
11102: >>0 byte &0x40 position independent
11103: >>20 belong !0 executable
11104: >>20 belong =0 object file
11105: >16 belong >0 not stripped
11106: 0 belong&0377777777 042400507 a.out NetBSD/sparc core
11107: >12 string >\0 from '%s'
11108: >32 belong !0 (signal %d)
11109:
11110: 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
11111: >0 byte &0x80
11112: >>20 lelong <4096 shared library
11113: >>20 lelong =4096 dynamically linked executable
11114: >>20 lelong >4096 dynamically linked executable
11115: >0 byte ^0x80 executable
11116: >16 lelong >0 not stripped
11117: 0 belong&0377777777 042600410 a.out NetBSD/pmax pure
11118: >0 byte &0x80 dynamically linked executable
11119: >0 byte ^0x80 executable
11120: >16 lelong >0 not stripped
11121: 0 belong&0377777777 042600407 a.out NetBSD/pmax
11122: >0 byte &0x80 dynamically linked executable
11123: >0 byte ^0x80
11124: >>0 byte &0x40 position independent
11125: >>20 lelong !0 executable
11126: >>20 lelong =0 object file
11127: >16 lelong >0 not stripped
11128: 0 belong&0377777777 042600507 a.out NetBSD/pmax core
11129: >12 string >\0 from '%s'
11130: >32 lelong !0 (signal %d)
11131:
11132: 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
11133: >0 byte &0x80
11134: >>20 lelong <4096 shared library
11135: >>20 lelong =4096 dynamically linked executable
11136: >>20 lelong >4096 dynamically linked executable
11137: >0 byte ^0x80 executable
11138: >16 lelong >0 not stripped
11139: 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
11140: >0 byte &0x80 dynamically linked executable
11141: >0 byte ^0x80 executable
11142: >16 lelong >0 not stripped
11143: 0 belong&0377777777 043000407 a.out NetBSD/vax 1k
11144: >0 byte &0x80 dynamically linked executable
11145: >0 byte ^0x80
11146: >>0 byte &0x40 position independent
11147: >>20 lelong !0 executable
11148: >>20 lelong =0 object file
11149: >16 lelong >0 not stripped
11150: 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
11151: >12 string >\0 from '%s'
11152: >32 lelong !0 (signal %d)
11153:
11154: 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
11155: >0 byte &0x80
11156: >>20 lelong <4096 shared library
11157: >>20 lelong =4096 dynamically linked executable
11158: >>20 lelong >4096 dynamically linked executable
11159: >0 byte ^0x80 executable
11160: >16 lelong >0 not stripped
11161: 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
11162: >0 byte &0x80 dynamically linked executable
11163: >0 byte ^0x80 executable
11164: >16 lelong >0 not stripped
11165: 0 belong&0377777777 045400407 a.out NetBSD/vax 4k
11166: >0 byte &0x80 dynamically linked executable
11167: >0 byte ^0x80
11168: >>0 byte &0x40 position independent
11169: >>20 lelong !0 executable
11170: >>20 lelong =0 object file
11171: >16 lelong >0 not stripped
11172: 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
11173: >12 string >\0 from '%s'
11174: >32 lelong !0 (signal %d)
11175:
11176: # NetBSD/alpha does not support (and has never supported) a.out objects,
11177: # so no rules are provided for them. NetBSD/alpha ELF objects are
11178: # dealt with in "elf".
11179: 0 lelong 0x00070185 ECOFF NetBSD/alpha binary
11180: >10 leshort 0x0001 not stripped
11181: >10 leshort 0x0000 stripped
11182: 0 belong&0377777777 043200507 a.out NetBSD/alpha core
11183: >12 string >\0 from '%s'
11184: >32 lelong !0 (signal %d)
11185:
11186: 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
11187: >0 byte &0x80
11188: >>20 belong <8192 shared library
11189: >>20 belong =8192 dynamically linked executable
11190: >>20 belong >8192 dynamically linked executable
11191: >0 byte ^0x80 executable
11192: >16 belong >0 not stripped
11193: 0 belong&0377777777 043400410 a.out NetBSD/mips pure
11194: >0 byte &0x80 dynamically linked executable
11195: >0 byte ^0x80 executable
11196: >16 belong >0 not stripped
11197: 0 belong&0377777777 043400407 a.out NetBSD/mips
11198: >0 byte &0x80 dynamically linked executable
11199: >0 byte ^0x80
11200: >>0 byte &0x40 position independent
11201: >>20 belong !0 executable
11202: >>20 belong =0 object file
11203: >16 belong >0 not stripped
11204: 0 belong&0377777777 043400507 a.out NetBSD/mips core
11205: >12 string >\0 from '%s'
11206: >32 belong !0 (signal %d)
11207:
11208: 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
11209: >0 byte &0x80
11210: >>20 lelong <4096 shared library
11211: >>20 lelong =4096 dynamically linked executable
11212: >>20 lelong >4096 dynamically linked executable
11213: >0 byte ^0x80 executable
11214: >16 lelong >0 not stripped
11215: 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
11216: >0 byte &0x80 dynamically linked executable
11217: >0 byte ^0x80 executable
11218: >16 lelong >0 not stripped
11219: 0 belong&0377777777 043600407 a.out NetBSD/arm32
11220: >0 byte &0x80 dynamically linked executable
11221: >0 byte ^0x80
11222: >>0 byte &0x40 position independent
11223: >>20 lelong !0 executable
11224: >>20 lelong =0 object file
11225: >16 lelong >0 not stripped
11226: # NetBSD/arm26 has always used ELF objects, but it shares a core file
11227: # format with NetBSD/arm32.
11228: 0 belong&0377777777 043600507 a.out NetBSD/arm core
11229: >12 string >\0 from '%s'
11230: >32 lelong !0 (signal %d)
11231:
11232: #------------------------------------------------------------------------------
11233: # netscape: file(1) magic for Netscape files
11234: # "H. Nanosecond" <aldomel@ix.netcom.com>
11235: # version 3 and 4 I think
11236: #
11237:
11238: # Netscape Address book .nab
11239: 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
11240:
11241: # Netscape Communicator address book
11242: 0 string \000\017\102\111 Netscape Communicator address book
11243:
11244: # .snm Caches
11245: 0 string #\ Netscape\ folder\ cache Netscape folder cache
11246: 0 string \000\036\204\220\000 Netscape folder cache
11247: # .n2p
11248: # Net 2 Phone
11249: #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
11250: 0 string SX961999 Net2phone
11251:
11252: #
11253: #This is files ending in .art, FIXME add more rules
11254: 0 string JG\004\016\0\0\0\0 ART
11255:
11256: #------------------------------------------------------------------------------
11257: # netware: file(1) magic for NetWare Loadable Modules (NLMs)
11258: # From: Mads Martin Joergensen <mmj@suse.de>
11259:
11260: 0 string NetWare\ Loadable\ Module NetWare Loadable Module
11261:
11262: #------------------------------------------------------------------------------
11263: # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
11264: #
11265: 0 string StartFontMetrics ASCII font metrics
11266: 0 string StartFont ASCII font bits
11267: 0 belong 0x137A2944 NeWS bitmap font
11268: 0 belong 0x137A2947 NeWS font family
11269: 0 belong 0x137A2950 scalable OpenFont binary
11270: 0 belong 0x137A2951 encrypted scalable OpenFont binary
11271: 8 belong 0x137A2B45 X11/NeWS bitmap font
11272: 8 belong 0x137A2B48 X11/NeWS font family
11273: #------------------------------------------------------------------------------
11274: # nitpicker: file(1) magic for Flowfiles.
11275: # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
11276: 0 string NPFF NItpicker Flow File
11277: >4 byte x V%d.
11278: >5 byte x %d
11279: >6 bedate x started: %s
11280: >10 bedate x stopped: %s
11281: >14 belong x Bytes: %u
11282: >18 belong x Bytes1: %u
11283: >22 belong x Flows: %u
11284: >26 belong x Pkts: %u
11285:
11286: #------------------------------------------------------------------------------
11287: # ocaml: file(1) magic for Objective Caml files.
11288: 0 string Caml1999 OCaml
11289: >8 string X exec file
11290: >8 string I interface file (.cmi)
11291: >8 string O object file (.cmo)
11292: >8 string A library file (.cma)
11293: >8 string Y native object file (.cmx)
11294: >8 string Z native library file (.cmxa)
11295: >8 string M abstract syntax tree implementation file
11296: >8 string N abstract syntax tree interface file
11297: >9 string >\0 (Version %3.3s)
11298: #------------------------------------------------------------------------------
11299: # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
11300: 0 string Octave-1-L Octave binary data (little endian)
11301: 0 string Octave-1-B Octave binary data (big endian)
11302:
11303: #------------------------------------------------------------------------------
11304: # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
11305: # storage (http://en.wikipedia.org/wiki/Structured_Storage)
11306: # Additional tests for OLE 2 Compound Documents should be under this recipe.
11307:
11308: 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
11309: # - Microstation V8 DGN files (www.bentley.com)
11310: # Last update on 10/23/2006 by Lester Hightower
11311: > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
11312: # - Visio documents
11313: # Last update on 10/23/2006 by Lester Hightower
11314: > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
11315:
11316: #------------------------------------------------------------------------------
11317: # olf: file(1) magic for OLF executables
11318: #
11319: # We have to check the byte order flag to see what byte order all the
11320: # other stuff in the header is in.
11321: #
11322: # MIPS R3000 may also be for MIPS R2000.
11323: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
11324: #
11325: # Created by Erik Theisen <etheisen@openbsd.org>
11326: # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
11327: 0 string \177OLF OLF
11328: >4 byte 0 invalid class
11329: >4 byte 1 32-bit
11330: >4 byte 2 64-bit
11331: >7 byte 0 invalid os
11332: >7 byte 1 OpenBSD
11333: >7 byte 2 NetBSD
11334: >7 byte 3 FreeBSD
11335: >7 byte 4 4.4BSD
11336: >7 byte 5 Linux
11337: >7 byte 6 SVR4
11338: >7 byte 7 esix
11339: >7 byte 8 Solaris
11340: >7 byte 9 Irix
11341: >7 byte 10 SCO
11342: >7 byte 11 Dell
11343: >7 byte 12 NCR
11344: >5 byte 0 invalid byte order
11345: >5 byte 1 LSB
11346: >>16 leshort 0 no file type,
11347: >>16 leshort 1 relocatable,
11348: >>16 leshort 2 executable,
11349: >>16 leshort 3 shared object,
11350: # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
11351: # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
11352: >>16 leshort 4 core file
11353: >>>(0x38+0xcc) string >\0 of '%s'
11354: >>>(0x38+0x10) lelong >0 (signal %d),
11355: >>16 leshort &0xff00 processor-specific,
11356: >>18 leshort 0 no machine,
11357: >>18 leshort 1 AT&T WE32100 - invalid byte order,
11358: >>18 leshort 2 SPARC - invalid byte order,
11359: >>18 leshort 3 Intel 80386,
11360: >>18 leshort 4 Motorola 68000 - invalid byte order,
11361: >>18 leshort 5 Motorola 88000 - invalid byte order,
11362: >>18 leshort 6 Intel 80486,
11363: >>18 leshort 7 Intel 80860,
11364: >>18 leshort 8 MIPS R3000_BE - invalid byte order,
11365: >>18 leshort 9 Amdahl - invalid byte order,
11366: >>18 leshort 10 MIPS R3000_LE,
11367: >>18 leshort 11 RS6000 - invalid byte order,
11368: >>18 leshort 15 PA-RISC - invalid byte order,
11369: >>18 leshort 16 nCUBE,
11370: >>18 leshort 17 VPP500,
11371: >>18 leshort 18 SPARC32PLUS,
11372: >>18 leshort 20 PowerPC,
11373: >>18 leshort 0x9026 Alpha,
11374: >>20 lelong 0 invalid version
11375: >>20 lelong 1 version 1
11376: >>36 lelong 1 MathCoPro/FPU/MAU Required
11377: >8 string >\0 (%s)
11378: >5 byte 2 MSB
11379: >>16 beshort 0 no file type,
11380: >>16 beshort 1 relocatable,
11381: >>16 beshort 2 executable,
11382: >>16 beshort 3 shared object,
11383: >>16 beshort 4 core file,
11384: >>>(0x38+0xcc) string >\0 of '%s'
11385: >>>(0x38+0x10) belong >0 (signal %d),
11386: >>16 beshort &0xff00 processor-specific,
11387: >>18 beshort 0 no machine,
11388: >>18 beshort 1 AT&T WE32100,
11389: >>18 beshort 2 SPARC,
11390: >>18 beshort 3 Intel 80386 - invalid byte order,
11391: >>18 beshort 4 Motorola 68000,
11392: >>18 beshort 5 Motorola 88000,
11393: >>18 beshort 6 Intel 80486 - invalid byte order,
11394: >>18 beshort 7 Intel 80860,
11395: >>18 beshort 8 MIPS R3000_BE,
11396: >>18 beshort 9 Amdahl,
11397: >>18 beshort 10 MIPS R3000_LE - invalid byte order,
11398: >>18 beshort 11 RS6000,
11399: >>18 beshort 15 PA-RISC,
11400: >>18 beshort 16 nCUBE,
11401: >>18 beshort 17 VPP500,
11402: >>18 beshort 18 SPARC32PLUS,
11403: >>18 beshort 20 PowerPC or cisco 4500,
11404: >>18 beshort 21 cisco 7500,
11405: >>18 beshort 24 cisco SVIP,
11406: >>18 beshort 25 cisco 7200,
11407: >>18 beshort 36 cisco 12000,
11408: >>18 beshort 0x9026 Alpha,
11409: >>20 belong 0 invalid version
11410: >>20 belong 1 version 1
11411: >>36 belong 1 MathCoPro/FPU/MAU Required
11412: #------------------------------------------------------------------------------
11413: # os2: file(1) magic for OS/2 files
11414: #
11415:
11416: # Provided 1998/08/22 by
11417: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
11418: 1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
11419: >24 search/1 >\ (URL=<%s>)
11420:
11421: # OS/2 URL objects
11422: # Provided 1998/08/22 by
11423: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
11424: #0 string http: OS/2 URL object text
11425: #>5 string >\ (WWW) <http:%s>
11426: #0 string mailto: OS/2 URL object text
11427: #>7 string >\ (email) <%s>
11428: #0 string news: OS/2 URL object text
11429: #>5 string >\ (Usenet) <%s>
11430: #0 string ftp: OS/2 URL object text
11431: #>4 string >\ (FTP) <ftp:%s>
11432: #0 string file: OS/2 URL object text
11433: #>5 string >\ (Local file) <%s>
11434:
11435: # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
11436: # Carl Hauser (chauser.parc@xerox.com) and
11437: # Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
11438: # list the following header format in inf02a.doc:
11439: #
11440: # int16 ID; // ID magic word (5348h = "HS")
11441: # int8 unknown1; // unknown purpose, could be third letter of ID
11442: # int8 flags; // probably a flag word...
11443: # // bit 0: set if INF style file
11444: # // bit 4: set if HLP style file
11445: # // patching this byte allows reading HLP files
11446: # // using the VIEW command, while help files
11447: # // seem to work with INF settings here as well.
11448: # int16 hdrsize; // total size of header
11449: # int16 unknown2; // unknown purpose
11450: #
11451: 0 string HSP\x01\x9b\x00 OS/2 INF
11452: >107 string >0 (%s)
11453: 0 string HSP\x10\x9b\x00 OS/2 HLP
11454: >107 string >0 (%s)
11455:
11456: # OS/2 INI (this is a guess)
11457: 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
11458: #------------------------------------------------------------------------------
11459: # os400: file(1) magic for IBM OS/400 files
11460: #
11461: # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
11462: # In spite of its quite variable format (due to internal memory page
11463: # length differences between CISC and RISC versions of the OS) the
11464: # SAVF structure hasn't suitable offsets to identify the catalog
11465: # header in the first descriptor where there are some useful infos,
11466: # so we must search in a somewhat large area for a particular string
11467: # that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
11468: # descriptor space) preceded by a two byte constant.
11469: #
11470: 1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
11471: >&212 byte 0x01 \b, created with SAVOBJ
11472: >&212 byte 0x02 \b, created with SAVLIB
11473: >&212 byte 0x07 \b, created with SAVCFG
11474: >&212 byte 0x08 \b, created with SAVSECDTA
11475: >&212 byte 0x0A \b, created with SAVSECDTA
11476: >&212 byte 0x0B \b, created with SAVDLO
11477: >&212 byte 0x0D \b, created with SAVLICPGM
11478: >&212 byte 0x11 \b, created with SAVCHGOBJ
11479: >&213 byte 0x44 \b, at least V5R4 to open
11480: >&213 byte 0x43 \b, at least V5R3 to open
11481: >&213 byte 0x42 \b, at least V5R2 to open
11482: >&213 byte 0x41 \b, at least V5R1 to open
11483: >&213 byte 0x40 \b, at least V4R5 to open
11484: >&213 byte 0x3F \b, at least V4R4 to open
11485: >&213 byte 0x3E \b, at least V4R3 to open
11486: >&213 byte 0x3C \b, at least V4R2 to open
11487: >&213 byte 0x3D \b, at least V4R1M4 to open
11488: >&213 byte 0x3B \b, at least V4R1 to open
11489: >&213 byte 0x3A \b, at least V3R7 to open
11490: >&213 byte 0x35 \b, at least V3R6 to open
11491: >&213 byte 0x36 \b, at least V3R2 to open
11492: >&213 byte 0x34 \b, at least V3R1 to open
11493: >&213 byte 0x31 \b, at least V3R0M5 to open
11494: >&213 byte 0x30 \b, at least V2R3 to open
11495: #
11496: # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
11497: #
11498: # Redistribution and use in source and binary forms, with or without
11499: # modification, are permitted provided that the following conditions
11500: # are met:
11501: # 1. Redistributions of source code must retain the above copyright
11502: # notice, this list of conditions and the following disclaimer.
11503: # 2. Redistributions in binary form must reproduce the above copyright
11504: # notice, this list of conditions and the following disclaimer in the
11505: # documentation and/or other materials provided with the distribution.
11506: # 3. All advertising materials mentioning features or use of this software
11507: # must display the following acknowledgement:
11508: # This product includes software developed by Ignatios Souvatzis for
11509: # the NetBSD project.
11510: # 4. The name of the author may not be used to endorse or promote products
11511: # derived from this software without specific prior written permission.
11512: #
11513: #
11514: # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
11515: # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
11516: # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
11517: # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
11518: # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
11519: # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
11520: # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
11521: # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
11522: # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
11523: # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
11524: #
11525: #
11526: #
11527: # OS9/6809 module descriptions:
11528: #
11529: 0 beshort 0x87CD OS9/6809 module:
11530: #
11531: >6 byte&0x0f 0x00 non-executable
11532: >6 byte&0x0f 0x01 machine language
11533: >6 byte&0x0f 0x02 BASIC I-code
11534: >6 byte&0x0f 0x03 Pascal P-code
11535: >6 byte&0x0f 0x04 C I-code
11536: >6 byte&0x0f 0x05 COBOL I-code
11537: >6 byte&0x0f 0x06 Fortran I-code
11538: #
11539: >6 byte&0xf0 0x10 program executable
11540: >6 byte&0xf0 0x20 subroutine
11541: >6 byte&0xf0 0x30 multi-module
11542: >6 byte&0xf0 0x40 data module
11543: #
11544: >6 byte&0xf0 0xC0 system module
11545: >6 byte&0xf0 0xD0 file manager
11546: >6 byte&0xf0 0xE0 device driver
11547: >6 byte&0xf0 0xF0 device descriptor
11548: #
11549: # OS9/m68k stuff (to be continued)
11550: #
11551: 0 beshort 0x4AFC OS9/68K module:
11552: #
11553: # attr
11554: >0x14 byte&0x80 0x80 re-entrant
11555: >0x14 byte&0x40 0x40 ghost
11556: >0x14 byte&0x20 0x20 system-state
11557: #
11558: # lang:
11559: #
11560: >0x13 byte 1 machine language
11561: >0x13 byte 2 BASIC I-code
11562: >0x13 byte 3 Pascal P-code
11563: >0x13 byte 4 C I-code
11564: >0x13 byte 5 COBOL I-code
11565: >0x13 byte 6 Fortran I-code
11566: #
11567: #
11568: # type:
11569: #
11570: >0x12 byte 1 program executable
11571: >0x12 byte 2 subroutine
11572: >0x12 byte 3 multi-module
11573: >0x12 byte 4 data module
11574: >0x12 byte 11 trap library
11575: >0x12 byte 12 system module
11576: >0x12 byte 13 file manager
11577: >0x12 byte 14 device driver
11578: >0x12 byte 15 device descriptor
11579: #
11580: # Mach magic number info
11581: #
11582: 0 long 0xefbe OSF/Rose object
11583: # I386 magic number info
11584: #
11585: 0 short 0565 i386 COFF object
11586:
11587: #------------------------------------------------------------------------------
11588: # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
11589: #
11590: # Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
11591:
11592: # appl
11593: 60 belong 0x6170706c PalmOS application
11594: >0 string >\0 "%s"
11595: # TEXt
11596: 60 belong 0x54455874 AportisDoc file
11597: >0 string >\0 "%s"
11598: # HACK
11599: 60 belong 0x4841434b HackMaster hack
11600: >0 string >\0 "%s"
11601:
11602: # Variety of PalmOS document types
11603: # Michael-John Turner <mj@debian.org>
11604: # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
11605: 60 string BVokBDIC BDicty PalmOS document
11606: >0 string >\0 "%s"
11607: 60 string DB99DBOS DB PalmOS document
11608: >0 string >\0 "%s"
11609: 60 string vIMGView FireViewer/ImageViewer PalmOS document
11610: >0 string >\0 "%s"
11611: 60 string PmDBPmDB HanDBase PalmOS document
11612: >0 string >\0 "%s"
11613: 60 string InfoINDB InfoView PalmOS document
11614: >0 string >\0 "%s"
11615: 60 string ToGoToGo iSilo PalmOS document
11616: >0 string >\0 "%s"
11617: 60 string JfDbJBas JFile PalmOS document
11618: >0 string >\0 "%s"
11619: 60 string JfDbJFil JFile Pro PalmOS document
11620: >0 string >\0 "%s"
11621: 60 string DATALSdb List PalmOS document
11622: >0 string >\0 "%s"
11623: 60 string Mdb1Mdb1 MobileDB PalmOS document
11624: >0 string >\0 "%s"
11625: 60 string PNRdPPrs PeanutPress PalmOS document
11626: >0 string >\0 "%s"
11627: 60 string DataPlkr Plucker PalmOS document
11628: >0 string >\0 "%s"
11629: 60 string DataSprd QuickSheet PalmOS document
11630: >0 string >\0 "%s"
11631: 60 string SM01SMem SuperMemo PalmOS document
11632: >0 string >\0 "%s"
11633: 60 string TEXtTlDc TealDoc PalmOS document
11634: >0 string >\0 "%s"
11635: 60 string InfoTlIf TealInfo PalmOS document
11636: >0 string >\0 "%s"
11637: 60 string DataTlMl TealMeal PalmOS document
11638: >0 string >\0 "%s"
11639: 60 string DataTlPt TealPaint PalmOS document
11640: >0 string >\0 "%s"
11641: 60 string dataTDBP ThinkDB PalmOS document
11642: >0 string >\0 "%s"
11643: 60 string TdatTide Tides PalmOS document
11644: >0 string >\0 "%s"
11645: 60 string ToRaTRPW TomeRaider PalmOS document
11646: >0 string >\0 "%s"
11647:
11648: # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
11649: # For version 1.xx zTXTs, outputs version and numbers of bookmarks and
11650: # annotations.
11651: # For other versions, just outputs version.
11652: #
11653: 60 string zTXT A GutenPalm zTXT e-book
11654: >0 string >\0 "%s"
11655: >(0x4E.L) byte 0
11656: >>(0x4E.L+1) byte x (v0.%02d)
11657: >(0x4E.L) byte 1
11658: >>(0x4E.L+1) byte x (v1.%02d)
11659: >>>(0x4E.L+10) beshort >0
11660: >>>>(0x4E.L+10) beshort <2 - 1 bookmark
11661: >>>>(0x4E.L+10) beshort >1 - %d bookmarks
11662: >>>(0x4E.L+14) beshort >0
11663: >>>>(0x4E.L+14) beshort <2 - 1 annotation
11664: >>>>(0x4E.L+14) beshort >1 - %d annotations
11665: >(0x4E.L) byte >1 (v%d.
11666: >>(0x4E.L+1) byte x %02d)
11667:
11668: # Palm OS .prc file types
11669: 60 string libr Palm OS dynamic library data
11670: >0 string >\0 "%s"
11671: 60 string ptch Palm OS operating system patch data
11672: >0 string >\0 "%s"
11673:
11674: # Mobipocket (www.mobipocket.com), donated by Carl Witty
11675: 60 string BOOKMOBI Mobipocket E-book
11676: >0 string >\0 "%s"
11677:
11678: #------------------------------------------------------------------------------
11679: #
11680: # Parix COFF executables
11681: # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
11682: #
11683: 0 beshort&0xfff 0xACE PARIX
11684: >0 byte&0xf0 0x80 T800
11685: >0 byte&0xf0 0x90 T9000
11686: >19 byte&0x02 0x02 executable
11687: >19 byte&0x02 0x00 object
11688: >19 byte&0x0c 0x00 not stripped
11689:
11690: #------------------------------------------------------------------------------
11691: # pbm: file(1) magic for Portable Bitmap files
11692: #
11693: # XXX - byte order?
11694: #
11695: 0 short 0x2a17 "compact bitmap" format (Poskanzer)
11696: #------------------------------------------------------------------------------
11697: # pdf: file(1) magic for Portable Document Format
11698: #
11699:
11700: 0 string %PDF- PDF document
11701: !:mime application/pdf
11702: >5 byte x \b, version %c
11703: >7 byte x \b.%c
11704:
11705: # From: Nick Schmalenberger <nick@schmalenberger.us>
11706: # Forms Data Format
11707: 0 string %FDF- FDF document
11708: >5 byte x \b, version %c
11709: >7 byte x \b.%c
11710:
11711: #------------------------------------------------------------------------------
11712: # pdp: file(1) magic for PDP-11 executable/object and APL workspace
11713: #
11714: 0 lelong 0101555 PDP-11 single precision APL workspace
11715: 0 lelong 0101554 PDP-11 double precision APL workspace
11716: #
11717: # PDP-11 a.out
11718: #
11719: 0 leshort 0407 PDP-11 executable
11720: >8 leshort >0 not stripped
11721: >15 byte >0 - version %ld
11722:
11723: 0 leshort 0401 PDP-11 UNIX/RT ldp
11724: 0 leshort 0405 PDP-11 old overlay
11725:
11726: 0 leshort 0410 PDP-11 pure executable
11727: >8 leshort >0 not stripped
11728: >15 byte >0 - version %ld
11729:
11730: 0 leshort 0411 PDP-11 separate I&D executable
11731: >8 leshort >0 not stripped
11732: >15 byte >0 - version %ld
11733:
11734: 0 leshort 0437 PDP-11 kernel overlay
11735:
11736: # These last three are derived from 2.11BSD file(1)
11737: 0 leshort 0413 PDP-11 demand-paged pure executable
11738: >8 leshort >0 not stripped
11739:
11740: 0 leshort 0430 PDP-11 overlaid pure executable
11741: >8 leshort >0 not stripped
11742:
11743: 0 leshort 0431 PDP-11 overlaid separate executable
11744: >8 leshort >0 not stripped
11745: #------------------------------------------------------------------------------
11746: # perl: file(1) magic for Larry Wall's perl language.
11747: #
11748: # The `eval' lines recognizes an outrageously clever hack.
11749: # Keith Waclena <keith@cerberus.uchicago.edu>
11750: # Send additions to <perl5-porters@perl.org>
11751: 0 search/1/b #!\ /bin/perl Perl script text executable
11752: !:mime text/x-perl
11753: 0 search/1 eval\ "exec\ /bin/perl Perl script text
11754: !:mime text/x-perl
11755: 0 search/1/b #!\ /usr/bin/perl Perl script text executable
11756: !:mime text/x-perl
11757: 0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
11758: !:mime text/x-perl
11759: 0 search/1/b #!\ /usr/local/bin/perl Perl script text executable
11760: !:mime text/x-perl
11761: 0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
11762: !:mime text/x-perl
11763: 0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
11764: !:mime text/x-perl
11765:
11766:
11767: # by Dmitry V. Levin and Alexey Tourbin
11768: # check the first line
11769: 0 search/1 package
11770: 0 regex \^package[\ \t]+[A-Za-z_]
11771: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
11772: # not 'p', check other lines
11773: 0 search/1 !p
11774: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
11775: >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
11776:
11777:
11778:
11779: # Perl POD documents
11780: # From: Tom Hukins <tom@eborcom.com>
11781: 0 search/1/B \=pod\n Perl POD document text
11782: 0 search/1/B \n\=pod\n Perl POD document text
11783: 0 search/1/B \=head1\ Perl POD document text
11784: 0 search/1/B \n\=head1\ Perl POD document text
11785: 0 search/1/B \=head2\ Perl POD document text
11786: 0 search/1/B \n\=head2\ Perl POD document text
11787:
11788: # Perl Storable data files.
11789: 0 string perl-store perl Storable (v0.6) data
11790: >4 byte >0 (net-order %d)
11791: >>4 byte &01 (network-ordered)
11792: >>4 byte =3 (major 1)
11793: >>4 byte =2 (major 1)
11794:
11795: 0 string pst0 perl Storable (v0.7) data
11796: >4 byte >0
11797: >>4 byte &01 (network-ordered)
11798: >>4 byte =5 (major 2)
11799: >>4 byte =4 (major 2)
11800: >>5 byte >0 (minor %d)
11801:
11802: #------------------------------------------------------------------------------
11803: # pgp: file(1) magic for Pretty Good Privacy
11804: # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
11805: #
11806: 0 beshort 0x9900 PGP key public ring
11807: !:mime application/x-pgp-keyring
11808: 0 beshort 0x9501 PGP key security ring
11809: !:mime application/x-pgp-keyring
11810: 0 beshort 0x9500 PGP key security ring
11811: !:mime application/x-pgp-keyring
11812: 0 beshort 0xa600 PGP encrypted data
11813: #!:mime application/pgp-encrypted
11814: #0 string -----BEGIN\040PGP text/PGP armored data
11815: !:mime text/PGP # encoding: armored data
11816: #>15 string PUBLIC\040KEY\040BLOCK- public key block
11817: #>15 string MESSAGE- message
11818: #>15 string SIGNED\040MESSAGE- signed message
11819: #>15 string PGP\040SIGNATURE- signature
11820:
11821: 2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
11822: !:mime application/pgp-keys
11823: 0 string -----BEGIN\040PGP\40MESSAGE- PGP message
11824: !:mime application/pgp
11825: 0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
11826: !:mime application/pgp-signature
11827:
11828: #------------------------------------------------------------------------------
11829: # pkgadd: file(1) magic for SysV R4 PKG Datastreams
11830: #
11831: 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
11832: !:mime application/x-svr4-package
11833:
11834: #------------------------------------------------------------------------------
11835: # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
11836: # From: "Stefan A. Haubenthal" <polluks@web.de>
11837: #
11838: 0 belong 0x00000107 Plan 9 executable, Motorola 68k
11839: 0 belong 0x000001EB Plan 9 executable, Intel 386
11840: 0 belong 0x00000247 Plan 9 executable, Intel 960
11841: 0 belong 0x000002AB Plan 9 executable, SPARC
11842: 0 belong 0x00000407 Plan 9 executable, MIPS R3000
11843: 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
11844: 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
11845: 0 belong 0x000005AB Plan 9 executable, AMD 29000
11846: 0 belong 0x00000647 Plan 9 executable, ARM 7-something
11847: 0 belong 0x000006EB Plan 9 executable, PowerPC
11848: 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
11849: 0 belong 0x0000084B Plan 9 executable, DEC Alpha
11850:
11851: #------------------------------------------------------------------------------
11852: # plus5: file(1) magic for Plus Five's UNIX MUMPS
11853: #
11854: # XXX - byte order? Paging Hokey....
11855: #
11856: 0 short 0x259 mumps avl global
11857: >2 byte >0 (V%d)
11858: >6 byte >0 with %d byte name
11859: >7 byte >0 and %d byte data cells
11860: 0 short 0x25a mumps blt global
11861: >2 byte >0 (V%d)
11862: >8 short >0 - %d byte blocks
11863: >15 byte 0x00 - P/D format
11864: >15 byte 0x01 - P/K/D format
11865: >15 byte 0x02 - K/D format
11866: >15 byte >0x02 - Bad Flags
11867:
11868: #------------------------------------------------------------------------------
11869: # printer: file(1) magic for printer-formatted files
11870: #
11871:
11872: # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
11873: 0 string %! PostScript document text
11874: !:mime application/postscript
11875: >2 string PS-Adobe- conforming
11876: >>11 string >\0 DSC level %.3s
11877: >>>15 string EPS \b, type %s
11878: >>>15 string Query \b, type %s
11879: >>>15 string ExitServer \b, type %s
11880: >>>15 search/1000 %%LanguageLevel:\
11881: >>>>&0 string >\0 \b, Level %s
11882: # Some PCs have the annoying habit of adding a ^D as a document separator
11883: 0 string \004%! PostScript document text
11884: !:mime application/postscript
11885: >3 string PS-Adobe- conforming
11886: >>12 string >\0 DSC level %.3s
11887: >>>16 string EPS \b, type %s
11888: >>>16 string Query \b, type %s
11889: >>>16 string ExitServer \b, type %s
11890: >>>16 search/1000 %%LanguageLevel:\
11891: >>>>&0 string >\0 \b, Level %s
11892: 0 string \033%-12345X%!PS PostScript document
11893:
11894: # DOS EPS Binary File Header
11895: # From: Ed Sznyter <ews@Black.Market.NET>
11896: 0 belong 0xC5D0D3C6 DOS EPS Binary File
11897: >4 long >0 Postscript starts at byte %d
11898: >>8 long >0 length %d
11899: >>>12 long >0 Metafile starts at byte %d
11900: >>>>16 long >0 length %d
11901: >>>20 long >0 TIFF starts at byte %d
11902: >>>>24 long >0 length %d
11903:
11904: # Summary: Adobe's PostScript Printer Description File
11905: # Extension: .ppd
11906: # Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
11907: # Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
11908: #
11909: 0 string *PPD-Adobe:\x20 PPD file
11910: >&0 string x \b, version %s
11911:
11912: # HP Printer Job Language
11913: 0 string \033%-12345X@PJL HP Printer Job Language data
11914: # HP Printer Job Language
11915: # The header found on Win95 HP plot files is the "Silliest Thing possible"
11916: # (TM)
11917: # Every driver puts the language at some random position, with random case
11918: # (LANGUAGE and Language)
11919: # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
11920: # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
11921: #
11922: 0 string \033%-12345X@PJL HP Printer Job Language data
11923: >&0 string >\0 %s
11924: >>&0 string >\0 %s
11925: >>>&0 string >\0 %s
11926: >>>>&0 string >\0 %s
11927: #>15 string \ ENTER\ LANGUAGE\ =
11928: #>31 string PostScript PostScript
11929:
11930: # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
11931: 0 string \033E\033 HP PCL printer data
11932: >3 string \&l0A - default page size
11933: >3 string \&l1A - US executive page size
11934: >3 string \&l2A - US letter page size
11935: >3 string \&l3A - US legal page size
11936: >3 string \&l26A - A4 page size
11937: >3 string \&l80A - Monarch envelope size
11938: >3 string \&l81A - No. 10 envelope size
11939: >3 string \&l90A - Intl. DL envelope size
11940: >3 string \&l91A - Intl. C5 envelope size
11941: >3 string \&l100A - Intl. B5 envelope size
11942: >3 string \&l-81A - No. 10 envelope size (landscape)
11943: >3 string \&l-90A - Intl. DL envelope size (landscape)
11944:
11945: # IMAGEN printer-ready files:
11946: 0 string @document( Imagen printer
11947: # this only works if "language xxx" is first item in Imagen header.
11948: >10 string language\ impress (imPRESS data)
11949: >10 string language\ daisy (daisywheel text)
11950: >10 string language\ diablo (daisywheel text)
11951: >10 string language\ printer (line printer emulation)
11952: >10 string language\ tektronix (Tektronix 4014 emulation)
11953: # Add any other languages that your Imagen uses - remember
11954: # to keep the word `text' if the file is human-readable.
11955: # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
11956: #
11957: # Now magic for IMAGEN font files...
11958: 0 string Rast RST-format raster font data
11959: >45 string >0 face %s
11960: # From Jukka Ukkonen
11961: 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
11962:
11963: # From <mike@flyn.org>
11964: # These are the /etc/magic entries to decode data sent to an Epson printer.
11965: 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
11966:
11967:
11968: #------------------------------------------------------------------------------
11969: # zenographics: file(1) magic for Zenographics ZjStream printer data
11970: # Rick Richardson rickr@mn.rr.com
11971: 0 string JZJZ
11972: >0x12 string ZZ Zenographics ZjStream printer data (big-endian)
11973: 0 string ZJZJ
11974: >0x12 string ZZ Zenographics ZjStream printer data (little-endian)
11975:
11976:
11977: #------------------------------------------------------------------------------
11978: # Oak Technologies printer stream
11979: # Rick Richardson <rickr@mn.rr.com>
11980: 0 string OAK
11981: >0x07 byte 0
11982: >0x0b byte 0 Oak Technologies printer stream
11983:
11984: # This would otherwise be recognized as PostScript - nick@debian.org
11985: 0 string %!VMF SunClock's Vector Map Format data
11986:
11987: #------------------------------------------------------------------------------
11988: # HP LaserJet 1000 series downloadable firmware file
11989: 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
11990:
11991: # From: Paolo <oopla@users.sf.net>
11992: # Epson ESC/Page, ESC/PageColor
11993: 0 string \x1b\x01@EJL Epson ESC/Page language printer data
11994:
11995: #------------------------------------------------------------------------------
11996: # project: file(1) magic for Project management
11997: #
11998: # Magic strings for ftnchek project files. Alexander Mai
11999: 0 string FTNCHEK_\ P project file for ftnchek
12000: >10 string 1 version 2.7
12001: >10 string 2 version 2.8 to 2.10
12002: >10 string 3 version 2.11 or later
12003:
12004: #------------------------------------------------------------------------------
12005: # psdbms: file(1) magic for psdatabase
12006: #
12007: 0 belong&0xff00ffff 0x56000000 ps database
12008: >1 string >\0 version %s
12009: >4 string >\0 from kernel %s
12010: #------------------------------------------------------------------------------
12011: # psion: file(1) magic for Psion handhelds data
12012: # from: Peter Breitenlohner <peb@mppmu.mpg.de>
12013: #
12014: 0 lelong 0x10000037 Psion Series 5
12015: >4 lelong 0x10000039 font file
12016: >4 lelong 0x1000003A printer driver
12017: >4 lelong 0x1000003B clipboard
12018: >4 lelong 0x10000042 multi-bitmap image
12019: >4 lelong 0x1000006A application information file
12020: >4 lelong 0x1000006D
12021: >>8 lelong 0x1000007D sketch image
12022: !:mime image/x-psion-sketch
12023: >>8 lelong 0x1000007E voice note
12024: >>8 lelong 0x1000007F word file
12025: >>8 lelong 0x10000085 OPL program
12026: >>8 lelong 0x10000088 sheet file
12027: >>8 lelong 0x100001C4 EasyFax initialisation file
12028: >4 lelong 0x10000073 OPO module
12029: >4 lelong 0x10000074 OPL application
12030: >4 lelong 0x1000008A exported multi-bitmap image
12031:
12032: 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
12033:
12034: 0 lelong 0x10000050 Psion Series 5
12035: >4 lelong 0x1000006D database
12036: >4 lelong 0x100000E4 ini file
12037:
12038: 0 lelong 0x10000079 Psion Series 5 binary:
12039: >4 lelong 0x00000000 DLL
12040: >4 lelong 0x10000049 comms hardware library
12041: >4 lelong 0x1000004A comms protocol library
12042: >4 lelong 0x1000005D OPX
12043: >4 lelong 0x1000006C application
12044: >4 lelong 0x1000008D DLL
12045: >4 lelong 0x100000AC logical device driver
12046: >4 lelong 0x100000AD physical device driver
12047: >4 lelong 0x100000E5 file transfer protocol
12048: >4 lelong 0x100000E5 file transfer protocol
12049: >4 lelong 0x10000140 printer definition
12050: >4 lelong 0x10000141 printer definition
12051:
12052: 0 lelong 0x1000007A Psion Series 5 executable
12053:
12054: #------------------------------------------------------------------------------
12055: # pulsar: file(1) magic for Pulsar POP3 daemon binary files
12056: #
12057: # http://pulsar.sourceforge.net
12058: # mailto:rok.papez@lugos.si
12059: #
12060:
12061: 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
12062: >4 ubelong x Version: %d.
12063: >8 ubelong x \b%d
12064:
12065:
12066: #------------------------------------------------------------------------------
12067: # pyramid: file(1) magic for Pyramids
12068: #
12069: # XXX - byte order?
12070: #
12071: 0 long 0x50900107 Pyramid 90x family executable
12072: 0 long 0x50900108 Pyramid 90x family pure executable
12073: >16 long >0 not stripped
12074: 0 long 0x5090010b Pyramid 90x family demand paged pure executable
12075: >16 long >0 not stripped
12076:
12077: #------------------------------------------------------------------------------
12078: # python: file(1) magic for python
12079: #
12080: # From: David Necas <yeti@physics.muni.cz>
12081: # often the module starts with a multiline string
12082: 0 string """ a python script text executable
12083: # MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
12084: # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
12085: 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
12086: 0 belong 0x87c60d0a python 2.0 byte-compiled
12087: 0 belong 0x2aeb0d0a python 2.1 byte-compiled
12088: 0 belong 0x2ded0d0a python 2.2 byte-compiled
12089: 0 belong 0x3bf20d0a python 2.3 byte-compiled
12090: 0 belong 0x6df20d0a python 2.4 byte-compiled
12091: 0 belong 0xb3f20d0a python 2.5 byte-compiled
12092:
12093: 0 string/b #!\ /usr/bin/python python script text executable
12094:
12095:
12096: #------------------------------------------------------------------------------
12097: # file(1) magic for revision control files
12098: # From Hendrik Scholz <hendrik@scholz.net>
12099: 0 string /1\ :pserver: cvs password text file
12100:
12101: # Conary changesets
12102: # From: Jonathan Smith <smithj@rpath.com>
12103: 0 belong 0xea3f81bb Conary changeset data
12104:
12105: # Type: Git bundles (git-bundle)
12106: # From: Josh Triplett <josh@freedesktop.org>
12107: 0 string #\ v2\ git\ bundle\n Git bundle
12108:
12109: # Type: Mercurial bundles
12110: # From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
12111: 0 string HG10 Mercurial bundle,
12112: >4 string UN uncompressed
12113: >4 string BZ bzip2 compressed
12114:
12115: # Type: Subversion (SVN) dumps
12116: # From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
12117: 0 string SVN-fs-dump-format-version: Subversion dumpfile
12118: >28 string >\0 (version: %s)
12119:
12120: # Type: Bazaar revision bundles and merge requests
12121: # URL: http://www.bazaar-vcs.org/
12122: # From: Jelmer Vernooij <jelmer@samba.org>
12123: 0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle
12124: 0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
12125:
12126: #------------------------------------------------------------------------------
12127: # riff: file(1) magic for RIFF format
12128: # See
12129: #
12130: # http://www.seanet.com/users/matts/riffmci/riffmci.htm
12131: #
12132: # AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi>
12133: #
12134: 0 string RIFF RIFF (little-endian) data
12135: # RIFF Palette format
12136: >8 string PAL \b, palette
12137: >>16 leshort x \b, version %d
12138: >>18 leshort x \b, %d entries
12139: # RIFF Device Independent Bitmap format
12140: >8 string RDIB \b, device-independent bitmap
12141: >>16 string BM
12142: >>>30 leshort 12 \b, OS/2 1.x format
12143: >>>>34 leshort x \b, %d x
12144: >>>>36 leshort x %d
12145: >>>30 leshort 64 \b, OS/2 2.x format
12146: >>>>34 leshort x \b, %d x
12147: >>>>36 leshort x %d
12148: >>>30 leshort 40 \b, Windows 3.x format
12149: >>>>34 lelong x \b, %d x
12150: >>>>38 lelong x %d x
12151: >>>>44 leshort x %d
12152: # RIFF MIDI format
12153: >8 string RMID \b, MIDI
12154: # RIFF Multimedia Movie File format
12155: >8 string RMMP \b, multimedia movie
12156: # RIFF wrapper for MP3
12157: >8 string RMP3 \b, MPEG Layer 3 audio
12158: # Microsoft WAVE format (*.wav)
12159: >8 string WAVE \b, WAVE audio
12160: !:mime audio/x-wav
12161: >>20 leshort 1 \b, Microsoft PCM
12162: >>>34 leshort >0 \b, %d bit
12163: >>20 leshort 2 \b, Microsoft ADPCM
12164: >>20 leshort 6 \b, ITU G.711 A-law
12165: >>20 leshort 7 \b, ITU G.711 mu-law
12166: >>20 leshort 17 \b, IMA ADPCM
12167: >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
12168: >>20 leshort 49 \b, GSM 6.10
12169: >>20 leshort 64 \b, ITU G.721 ADPCM
12170: >>20 leshort 80 \b, MPEG
12171: >>20 leshort 85 \b, MPEG Layer 3
12172: >>22 leshort =1 \b, mono
12173: >>22 leshort =2 \b, stereo
12174: >>22 leshort >2 \b, %d channels
12175: >>24 lelong >0 %d Hz
12176: # Corel Draw Picture
12177: >8 string CDRA \b, Corel Draw Picture
12178: !:mime image/x-coreldraw
12179: # AVI == Audio Video Interleave
12180: >8 string AVI\040 \b, AVI
12181: !:mime video/x-msvideo
12182: >>12 string LIST
12183: >>>20 string hdrlavih
12184: >>>>&36 lelong x \b, %lu x
12185: >>>>&40 lelong x %lu,
12186: >>>>&4 lelong >1000000 <1 fps,
12187: >>>>&4 lelong 1000000 1.00 fps,
12188: >>>>&4 lelong 500000 2.00 fps,
12189: >>>>&4 lelong 333333 3.00 fps,
12190: >>>>&4 lelong 250000 4.00 fps,
12191: >>>>&4 lelong 200000 5.00 fps,
12192: >>>>&4 lelong 166667 6.00 fps,
12193: >>>>&4 lelong 142857 7.00 fps,
12194: >>>>&4 lelong 125000 8.00 fps,
12195: >>>>&4 lelong 111111 9.00 fps,
12196: >>>>&4 lelong 100000 10.00 fps,
12197: # ]9.9,10.1[
12198: >>>>&4 lelong <101010
12199: >>>>>&-4 lelong >99010
12200: >>>>>>&-4 lelong !100000 ~10 fps,
12201: >>>>&4 lelong 83333 12.00 fps,
12202: # ]11.9,12.1[
12203: >>>>&4 lelong <84034
12204: >>>>>&-4 lelong >82645
12205: >>>>>>&-4 lelong !83333 ~12 fps,
12206: >>>>&4 lelong 66667 15.00 fps,
12207: # ]14.9,15.1[
12208: >>>>&4 lelong <67114
12209: >>>>>&-4 lelong >66225
12210: >>>>>>&-4 lelong !66667 ~15 fps,
12211: >>>>&4 lelong 50000 20.00 fps,
12212: >>>>&4 lelong 41708 23.98 fps,
12213: >>>>&4 lelong 41667 24.00 fps,
12214: # ]23.9,24.1[
12215: >>>>&4 lelong <41841
12216: >>>>>&-4 lelong >41494
12217: >>>>>>&-4 lelong !41708
12218: >>>>>>>&-4 lelong !41667 ~24 fps,
12219: >>>>&4 lelong 40000 25.00 fps,
12220: # ]24.9,25.1[
12221: >>>>&4 lelong <40161
12222: >>>>>&-4 lelong >39841
12223: >>>>>>&-4 lelong !40000 ~25 fps,
12224: >>>>&4 lelong 33367 29.97 fps,
12225: >>>>&4 lelong 33333 30.00 fps,
12226: # ]29.9,30.1[
12227: >>>>&4 lelong <33445
12228: >>>>>&-4 lelong >33223
12229: >>>>>>&-4 lelong !33367
12230: >>>>>>>&-4 lelong !33333 ~30 fps,
12231: >>>>&4 lelong <32224 >30 fps,
12232: ##>>>>&4 lelong x (%lu)
12233: ##>>>>&20 lelong x %lu frames,
12234: # Note: The tests below assume that the AVI has 1 or 2 streams,
12235: # "vids" optionally followed by "auds".
12236: # (Should cover 99.9% of all AVIs.)
12237: # assuming avih length = 56
12238: >>>88 string LIST
12239: >>>>96 string strlstrh
12240: >>>>>108 string vids video:
12241: >>>>>>&0 lelong 0 uncompressed
12242: # skip past vids strh
12243: >>>>>>(104.l+108) string strf
12244: >>>>>>>(104.l+132) lelong 1 RLE 8bpp
12245: >>>>>>>(104.l+132) string/c cvid Cinepak
12246: >>>>>>>(104.l+132) string/c i263 Intel I.263
12247: >>>>>>>(104.l+132) string/c iv32 Indeo 3.2
12248: >>>>>>>(104.l+132) string/c iv41 Indeo 4.1
12249: >>>>>>>(104.l+132) string/c iv50 Indeo 5.0
12250: >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
12251: >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
12252: >>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
12253: >>>>>>>(104.l+132) string/c mjpg Motion JPEG
12254: >>>>>>>(104.l+132) string/c div3 DivX 3
12255: >>>>>>>>112 string/c div3 Low-Motion
12256: >>>>>>>>112 string/c div4 Fast-Motion
12257: >>>>>>>(104.l+132) string/c divx DivX 4
12258: >>>>>>>(104.l+132) string/c dx50 DivX 5
12259: >>>>>>>(104.l+132) string/c xvid XviD
12260: >>>>>>>(104.l+132) string/c h264 H.264
12261: >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
12262: >>>>>>>(104.l+132) string/c h264 X.264 or H.264
12263: >>>>>>>(104.l+132) lelong 0
12264: ##>>>>>>>(104.l+132) string x (%.4s)
12265: # skip past first (video) LIST
12266: >>>>(92.l+96) string LIST
12267: >>>>>(92.l+104) string strlstrh
12268: >>>>>>(92.l+116) string auds \b, audio:
12269: # auds strh length = 56:
12270: >>>>>>>(92.l+172) string strf
12271: >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
12272: >>>>>>>>(92.l+180) leshort 0x0002 ADPCM
12273: >>>>>>>>(92.l+180) leshort 0x0006 aLaw
12274: >>>>>>>>(92.l+180) leshort 0x0007 uLaw
12275: >>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
12276: >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
12277: >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
12278: >>>>>>>>(92.l+180) leshort 0x0161 DivX
12279: ##>>>>>>>>(92.l+180) leshort x (0x%.4x)
12280: >>>>>>>>(92.l+182) leshort 1 (mono,
12281: >>>>>>>>(92.l+182) leshort 2 (stereo,
12282: >>>>>>>>(92.l+182) leshort >2 (%d channels,
12283: >>>>>>>>(92.l+184) lelong x %d Hz)
12284: # auds strh length = 64:
12285: >>>>>>>(92.l+180) string strf
12286: >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
12287: >>>>>>>>(92.l+188) leshort 0x0002 ADPCM
12288: >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
12289: >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
12290: >>>>>>>>(92.l+188) leshort 0x0161 DivX
12291: ##>>>>>>>>(92.l+188) leshort x (0x%.4x)
12292: >>>>>>>>(92.l+190) leshort 1 (mono,
12293: >>>>>>>>(92.l+190) leshort 2 (stereo,
12294: >>>>>>>>(92.l+190) leshort >2 (%d channels,
12295: >>>>>>>>(92.l+192) lelong x %d Hz)
12296: # Animated Cursor format
12297: >8 string ACON \b, animated cursor
12298: # SoundFont 2 <mpruett@sgi.com>
12299: >8 string sfbk SoundFont/Bank
12300: # MPEG-1 wrapped in a RIFF, apparently
12301: >8 string CDXA \b, wrapped MPEG-1 (CDXA)
12302: >8 string 4XMV \b, 4X Movie file
12303:
12304: #
12305: # XXX - some of the below may only appear in little-endian form.
12306: #
12307: # Also "MV93" appears to be for one form of Macromedia Director
12308: # files, and "GDMF" appears to be another multimedia format.
12309: #
12310: 0 string RIFX RIFF (big-endian) data
12311: # RIFF Palette format
12312: >8 string PAL \b, palette
12313: >>16 beshort x \b, version %d
12314: >>18 beshort x \b, %d entries
12315: # RIFF Device Independent Bitmap format
12316: >8 string RDIB \b, device-independent bitmap
12317: >>16 string BM
12318: >>>30 beshort 12 \b, OS/2 1.x format
12319: >>>>34 beshort x \b, %d x
12320: >>>>36 beshort x %d
12321: >>>30 beshort 64 \b, OS/2 2.x format
12322: >>>>34 beshort x \b, %d x
12323: >>>>36 beshort x %d
12324: >>>30 beshort 40 \b, Windows 3.x format
12325: >>>>34 belong x \b, %d x
12326: >>>>38 belong x %d x
12327: >>>>44 beshort x %d
12328: # RIFF MIDI format
12329: >8 string RMID \b, MIDI
12330: # RIFF Multimedia Movie File format
12331: >8 string RMMP \b, multimedia movie
12332: # Microsoft WAVE format (*.wav)
12333: >8 string WAVE \b, WAVE audio
12334: >>20 leshort 1 \b, Microsoft PCM
12335: >>>34 leshort >0 \b, %d bit
12336: >>22 beshort =1 \b, mono
12337: >>22 beshort =2 \b, stereo
12338: >>22 beshort >2 \b, %d channels
12339: >>24 belong >0 %d Hz
12340: # Corel Draw Picture
12341: >8 string CDRA \b, Corel Draw Picture
12342: # AVI == Audio Video Interleave
12343: >8 string AVI\040 \b, AVI
12344: # Animated Cursor format
12345: >8 string ACON \b, animated cursor
12346: # Notation Interchange File Format (big-endian only)
12347: >8 string NIFF \b, Notation Interchange File Format
12348: # SoundFont 2 <mpruett@sgi.com>
12349: >8 string sfbk SoundFont/Bank
12350: #------------------------------------------------------------------------------
12351: #
12352: # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
12353: #
12354: 0 beshort 0xedab
12355: >2 beshort 0xeedb RPM
12356: !:mime application/x-rpm
12357: >>4 byte x v%d
12358: >>6 beshort 0 bin
12359: >>6 beshort 1 src
12360: >>8 beshort 1 i386
12361: >>8 beshort 2 Alpha
12362: >>8 beshort 3 Sparc
12363: >>8 beshort 4 MIPS
12364: >>8 beshort 5 PowerPC
12365: >>8 beshort 6 68000
12366: >>8 beshort 7 SGI
12367: >>8 beshort 8 RS6000
12368: >>8 beshort 9 IA64
12369: >>8 beshort 10 Sparc64
12370: >>8 beshort 11 MIPSel
12371: >>8 beshort 12 ARM
12372: >>10 string x %s
12373:
12374: #------------------------------------------------------------------------------
12375: # rtf: file(1) magic for Rich Text Format (RTF)
12376: #
12377: # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
12378: #
12379: 0 string {\\rtf Rich Text Format data,
12380: !:mime text/rtf
12381: >5 string 1 version 1,
12382: >>6 string \\ansi ANSI
12383: >>6 string \\mac Apple Macintosh
12384: >>6 string \\pc IBM PC, code page 437
12385: >>6 string \\pca IBM PS/2, code page 850
12386: >>6 default x unknown character set
12387: >5 default x unknown version
12388: #------------------------------------------------------------------------------
12389: # ruby: file(1) magic for Lua scripting language
12390: # URL: http://www.ruby-lang.org/
12391: # From: Reuben Thomas <rrt@sc3d.org>
12392:
12393: # Ruby scripts
12394: 0 search/1/b #!\ /usr/bin/ruby Ruby script text executable
12395: 0 search/1/b #!\ /usr/local/bin/ruby Ruby script text executable
12396: 0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
12397: 0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
12398:
12399: #------------------------------------------------------------------------------
12400: # sc: file(1) magic for "sc" spreadsheet
12401: #
12402: 38 string Spreadsheet sc spreadsheet file
12403: !:mime application/x-sc
12404:
12405: #------------------------------------------------------------------------------
12406: # sccs: file(1) magic for SCCS archives
12407: #
12408: # SCCS archive structure:
12409: # \001h01207
12410: # \001s 00276/00000/00000
12411: # \001d D 1.1 87/09/23 08:09:20 ian 1 0
12412: # \001c date and time created 87/09/23 08:09:20 by ian
12413: # \001e
12414: # \001u
12415: # \001U
12416: # ... etc.
12417: # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
12418: # *Sigh*. And these both came from various parts of the USG.
12419: # Maybe we should just switch everybody from SCCS to RCS!
12420: # Further, you can't just say '\001h0', because the five-digit number
12421: # is a checksum that could (presumably) have any leading digit,
12422: # and we don't have regular expression matching yet.
12423: # Hence the following official kludge:
12424: 8 string \001s\ SCCS archive data
12425: #------------------------------------------------------------------------------
12426: # scientific: file(1) magic for scientific formats
12427: #
12428: # From: Joe Krahn <krahn@niehs.nih.gov>
12429:
12430: ########################################################
12431: # CCP4 data and plot files:
12432: 0 string MTZ\040 MTZ reflection file
12433:
12434: 92 string PLOT%%84 Plot84 plotting file
12435: >52 byte 1 , Little-endian
12436: >55 byte 1 , Big-endian
12437:
12438: ########################################################
12439: # Electron density MAP/MASK formats
12440:
12441: 0 string EZD_MAP NEWEZD Electron Density Map
12442: 109 string MAP\040( Old EZD Electron Density Map
12443:
12444: 0 string/c :-)\040Origin BRIX Electron Density Map
12445: >170 string >0 , Sigma:%.12s
12446: #>4 string >0 %.178s
12447: #>4 addr x %.178s
12448:
12449: 7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
12450: 9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
12451:
12452: 208 string MAP\040 CCP4 Electron Density Map
12453: # Assumes same stamp for float and double (normal case)
12454: >212 byte 17 \b, Big-endian
12455: >212 byte 34 \b, VAX format
12456: >212 byte 68 \b, Little-endian
12457: >212 byte 85 \b, Convex native
12458:
12459: ############################################################
12460: # X-Ray Area Detector images
12461: 0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
12462: >796 lelong <20 Little-endian, IP #%d,
12463: >>768 lelong >0 Size=%dx
12464: >>772 lelong >0 \b%d
12465: >796 belong <20 Big-endian, IP #%d,
12466: >>768 belong >0 Size=%dx
12467: >>772 belong >0 \b%d
12468:
12469: 0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
12470: >796 lelong <20 Little-endian, IP #%d,
12471: >>768 lelong >0 Size=%dx
12472: >>772 lelong >0 \b%d
12473: >796 belong <20 Big-endian, IP #%d,
12474: >>768 belong >0 Size=%dx
12475: >>772 belong >0 \b%d
12476:
12477:
12478: 1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
12479: >1072 ulong >1 Compressed(%d),
12480: >1100 ulong >1 %d headers,
12481: >1104 ulong >0 %d x
12482: >1108 ulong >0 %d,
12483: >1120 ulong >0 %d bits/pixel
12484:
12485: # Type: GEDCOM genealogical (family history) data
12486: # From: Giuseppe Bilotta
12487: 0 search/1/c 0\ HEAD GEDCOM genealogy text
12488: >&0 search 1\ GEDC
12489: >>&0 search 2\ VERS version
12490: >>>&1 search/1 >\0 %s
12491: # From: Phil Endecott <phil05@chezphil.org>
12492: 0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
12493: 0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
12494: 0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
12495: 0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
12496: 0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
12497: 0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
12498: 0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
12499: # Type: SE Linux policy modules *.pp reference policy
12500: # for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
12501: # URL: http://doc.coker.com.au/computers/selinux-magic
12502: # From: Russell Coker <russell@coker.com.au>
12503:
12504: 0 lelong 0xf97cff8f SE Linux modular policy
12505: >4 lelong x version %d,
12506: >8 lelong x %d sections,
12507: >>(12.l) lelong 0xf97cff8d
12508: >>>(12.l+27) lelong x mod version %d,
12509: >>>(12.l+31) lelong 0 Not MLS,
12510: >>>(12.l+31) lelong 1 MLS,
12511: >>>(12.l+23) lelong 2
12512: >>>>(12.l+47) string >\0 module name %s
12513: >>>(12.l+23) lelong 1 base
12514:
12515: 1 string policy_module( SE Linux policy module source
12516: 2 string policy_module( SE Linux policy module source
12517:
12518: 0 string ##\ <summary> SE Linux policy interface source
12519:
12520: #0 search gen_context( SE Linux policy file contexts
12521:
12522: #0 search gen_sens( SE Linux policy MLS constraints source
12523:
12524: #------------------------------------------------------------------------------
12525: # sendmail: file(1) magic for sendmail config files
12526: #
12527: # XXX - byte order?
12528: #
12529: 0 byte 046 Sendmail frozen configuration
12530: >16 string >\0 - version %s
12531: 0 short 0x271c Sendmail frozen configuration
12532: >16 string >\0 - version %s
12533:
12534: #------------------------------------------------------------------------------
12535: # sendmail: file(1) magic for sendmail m4(1) files
12536: #
12537: # From Hendrik Scholz <hendrik@scholz.net>
12538: # i.e. files in /usr/share/sendmail/cf/
12539: #
12540: 0 string divert(-1)\n sendmail m4 text file
12541:
12542:
12543: #------------------------------------------------------------------------------
12544: # sequent: file(1) magic for Sequent machines
12545: #
12546: # Sequent information updated by Don Dwiggins <atsun!dwiggins>.
12547: # For Sequent's multiprocessor systems (incomplete).
12548: 0 lelong 0x00ea BALANCE NS32000 .o
12549: >16 lelong >0 not stripped
12550: >124 lelong >0 version %ld
12551: 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
12552: >16 lelong >0 not stripped
12553: >124 lelong >0 version %ld
12554: 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
12555: >16 lelong >0 not stripped
12556: >124 lelong >0 version %ld
12557: 0 lelong 0x30ea BALANCE NS32000 standalone executable
12558: >16 lelong >0 not stripped
12559: >124 lelong >0 version %ld
12560: #
12561: # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
12562: # Symmetry magic nums will not be reached if DOS COM comes before them;
12563: # byte 0xeb is matched before these get a chance.
12564: 0 leshort 0x12eb SYMMETRY i386 .o
12565: >16 lelong >0 not stripped
12566: >124 lelong >0 version %ld
12567: 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
12568: >16 lelong >0 not stripped
12569: >124 lelong >0 version %ld
12570: 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
12571: >16 lelong >0 not stripped
12572: >124 lelong >0 version %ld
12573: 0 leshort 0x42eb SYMMETRY i386 standalone executable
12574: >16 lelong >0 not stripped
12575: >124 lelong >0 version %ld
12576:
12577: #------------------------------------------------------------------------------
12578: # sgi: file(1) magic for Silicon Graphics applications
12579:
12580: #
12581: #
12582: # Performance Co-Pilot file types
12583: 0 string PmNs PCP compiled namespace (V.0)
12584: 0 string PmN PCP compiled namespace
12585: >3 string >\0 (V.%1.1s)
12586: #3 lelong 0x84500526 PCP archive
12587: 3 belong 0x84500526 PCP archive
12588: >7 byte x (V.%d)
12589: #>20 lelong -2 temporal index
12590: #>20 lelong -1 metadata
12591: #>20 lelong 0 log volume #0
12592: #>20 lelong >0 log volume #%ld
12593: >20 belong -2 temporal index
12594: >20 belong -1 metadata
12595: >20 belong 0 log volume #0
12596: >20 belong >0 log volume #%ld
12597: >24 string >\0 host: %s
12598: 0 string PCPFolio PCP
12599: >9 string Version: Archive Folio
12600: >18 string >\0 (V.%s)
12601: 0 string #pmchart PCP pmchart view
12602: >9 string Version
12603: >17 string >\0 (V%-3.3s)
12604: 0 string #kmchart PCP kmchart view
12605: >9 string Version
12606: >17 string >\0 (V.%s)
12607: 0 string pmview PCP pmview config
12608: >7 string Version
12609: >15 string >\0 (V%-3.3s)
12610: 0 string #pmlogger PCP pmlogger config
12611: >10 string Version
12612: >18 string >\0 (V%1.1s)
12613: 0 string #pmdahotproc PCP pmdahotproc config
12614: >13 string Version
12615: >21 string >\0 (V%-3.3s)
12616: 0 string PcPh PCP Help
12617: >4 string 1 Index
12618: >4 string 2 Text
12619: >5 string >\0 (V.%1.1s)
12620: 0 string #pmieconf-rules PCP pmieconf rules
12621: >16 string >\0 (V.%1.1s)
12622: 3 string pmieconf-pmie PCP pmie config
12623: >17 string >\0 (V.%1.1s)
12624:
12625: # SpeedShop data files
12626: 0 lelong 0x13130303 SpeedShop data file
12627:
12628: # mdbm files
12629: 0 lelong 0x01023962 mdbm file, version 0 (obsolete)
12630: 0 string mdbm mdbm file,
12631: >5 byte x version %d,
12632: >6 byte x 2^%d pages,
12633: >7 byte x pagesize 2^%d,
12634: >17 byte x hash %d,
12635: >11 byte x dataformat %d
12636:
12637: # Alias Maya files
12638: 0 string //Maya ASCII Alias Maya Ascii File,
12639: >13 string >\0 version %s
12640: 8 string MAYAFOR4 Alias Maya Binary File,
12641: >32 string >\0 version %s scene
12642: 8 string MayaFOR4 Alias Maya Binary File,
12643: >32 string >\0 version %s scene
12644: 8 string CIMG Alias Maya Image File
12645: 8 string DEEP Alias Maya Image File
12646: #------------------------------------------------------------------------------
12647: # Type: SVG Vectorial Graphics
12648: # From: Noel Torres <tecnico@ejerciciosresueltos.com>
12649: 0 string \<?xml\ version="
12650: >15 string >\0
12651: >>23 search/400 \<svg SVG Scalable Vector Graphics image
12652: !:mime image/svg+xml
12653: >>23 search/400 \<gnc-v2 GnuCash file
12654: !:mime application/x-gnucash
12655:
12656: # Sitemap file
12657: 0 string \<?xml\ version="
12658: >15 string >\0
12659: >>23 search/400 \<urlset XML Sitemap document text
12660: !:mime application/xml-sitemap
12661:
12662: #------------------------------------------------------------------------------
12663: # sgml: file(1) magic for Standard Generalized Markup Language
12664: # HyperText Markup Language (HTML) is an SGML document type,
12665: # from Daniel Quinlan (quinlan@yggdrasil.com)
12666: # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
12667: 0 search/1/cB \<!doctype\ html HTML document text
12668: !:mime text/html
12669: 0 search/1/cb \<head HTML document text
12670: !:mime text/html
12671: 0 search/1/cb \<title HTML document text
12672: !:mime text/html
12673: 0 search/1/cb \<html HTML document text
12674: !:mime text/html
12675:
12676: # Extensible markup language (XML), a subset of SGML
12677: # from Marc Prud'hommeaux (marc@apocalypse.org)
12678: 0 search/1/cb \<?xml XML document text
12679: !:mime application/xml
12680: 0 string \<?xml\ version\ " XML
12681: !:mime application/xml
12682: 0 string \<?xml\ version=" XML
12683: !:mime application/xml
12684: >15 search/1 >\0 %.3s document text
12685: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
12686: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
12687: 0 string \<?xml\ version=' XML
12688: !:mime application/xml
12689: >15 search/1 >\0 %.3s document text
12690: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
12691: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
12692: 0 search/1/b \<?xml XML document text
12693: !:mime application/xml
12694: 0 search/1/b \<?XML broken XML document text
12695: !:mime application/xml
12696:
12697:
12698: # SGML, mostly from rph@sq
12699: 0 search/1/cb \<!doctype exported SGML document text
12700: 0 search/1/cb \<!subdoc exported SGML subdocument text
12701: 0 search/1/cb \<!-- exported SGML document text
12702:
12703: # Web browser cookie files
12704: # (Mozilla, Galeon, Netscape 4, Konqueror..)
12705: # Ulf Harnhammar <ulfh@update.uu.se>
12706: 0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text
12707: 0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
12708: 0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
12709:
12710: #------------------------------------------------------------------------
12711: # file(1) magic for sharc files
12712: #
12713: # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
12714: # FutureGroove Music (dsp@futuregroove.de)
12715:
12716: #------------------------------------------------------------------------
12717: #0 string Draw RiscOS Drawfile
12718: #0 string PACK RiscOS PackdDir archive
12719:
12720: #------------------------------------------------------------------------
12721: # SHARC DSP stuff (based on the FGM SHARC DSP SDK)
12722:
12723: #0 string =! Assembler source
12724: #0 string Analog ADi asm listing file
12725: 0 string .SYSTEM SHARC architecture file
12726: 0 string .system SHARC architecture file
12727:
12728: 0 leshort 0x521C SHARC COFF binary
12729: >2 leshort >1 , %hd sections
12730: >>12 lelong >0 , not stripped
12731:
12732: #------------------------------------------------------------------------------
12733: # sinclair: file(1) sinclair QL
12734:
12735: # additions to /etc/magic by Thomas M. Ott (ThMO)
12736:
12737: # Sinclair QL floppy disk formats (ThMO)
12738: 0 string =QL5 QL disk dump data,
12739: >3 string =A 720 KB,
12740: >3 string =B 1.44 MB,
12741: >3 string =C 3.2 MB,
12742: >4 string >\0 label:%.10s
12743:
12744: # Sinclair QL OS dump (ThMO)
12745: # (NOTE: if `file' would be able to use indirect references in a endian format
12746: # differing from the natural host format, this could be written more
12747: # reliably and faster...)
12748: #
12749: # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
12750: # than the first 8K of a file... #-(
12751: #
12752: #0 belong =0x30000
12753: #>49124 belong <47104
12754: #>>49128 belong <47104
12755: #>>>49132 belong <47104
12756: #>>>>49136 belong <47104 QL OS dump data,
12757: #>>>>>49148 string >\0 type %.3s,
12758: #>>>>>49142 string >\0 version %.4s
12759:
12760: # Sinclair QL firmware executables (ThMO)
12761: 0 string NqNqNq`\004 QL firmware executable (BCPL)
12762:
12763: # Sinclair QL libraries (was ThMO)
12764: 0 beshort 0xFB01 QDOS object
12765: >2 pstring x '%s'
12766:
12767: # Sinclair QL executables (was ThMO)
12768: 4 belong 0x4AFB QDOS executable
12769: >9 pstring x '%s'
12770:
12771: # Sinclair QL ROM (ThMO)
12772: 0 belong =0x4AFB0001 QL plugin-ROM data,
12773: >9 pstring =\0 un-named
12774: >9 pstring >\0 named: %s
12775: # Type: SiSU Markup Language
12776: # URL: http://www.sisudoc.org/
12777: # From: Ralph Amissah <ralph.amissah@gmail.com>
12778:
12779: 0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert
12780: >5 regex [0-9.]+ %s
12781:
12782: 0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master
12783: >5 regex [0-9.]+ %s
12784:
12785: 0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text
12786: >5 regex [0-9.]+ %s
12787:
12788: 0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text
12789: >5 regex [0-9.]+ %s
12790:
12791: 0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text
12792: >5 regex [0-9.]+ %s
12793: #------------------------------------------------------------------------------
12794: # Sketch Drawings: http://sketch.sourceforge.net/
12795: # From: Edwin Mons <e@ik.nu>
12796: 0 search/1 ##Sketch Sketch document text
12797:
12798: #-----------------------------------------------
12799: # GNU Smalltalk image, starting at version 1.6.2
12800: # From: catull_us@yahoo.com
12801: #
12802: 0 string GSTIm\0\0 GNU SmallTalk
12803: # little-endian
12804: >7 byte&1 =0 LE image version
12805: >>10 byte x %d.
12806: >>9 byte x \b%d.
12807: >>8 byte x \b%d
12808: #>>12 lelong x , data: %ld
12809: #>>16 lelong x , table: %ld
12810: #>>20 lelong x , memory: %ld
12811: # big-endian
12812: >7 byte&1 =1 BE image version
12813: >>8 byte x %d.
12814: >>9 byte x \b%d.
12815: >>10 byte x \b%d
12816: #>>12 belong x , data: %ld
12817: #>>16 belong x , table: %ld
12818: #>>20 belong x , memory: %ld
12819:
12820:
12821:
12822: #------------------------------------------------------------------------------
12823: # sniffer: file(1) magic for packet capture files
12824: #
12825: # From: guy@alum.mit.edu (Guy Harris)
12826: #
12827:
12828: #
12829: # Microsoft Network Monitor 1.x capture files.
12830: #
12831: 0 string RTSS NetMon capture file
12832: >5 byte x - version %d
12833: >4 byte x \b.%d
12834: >6 leshort 0 (Unknown)
12835: >6 leshort 1 (Ethernet)
12836: >6 leshort 2 (Token Ring)
12837: >6 leshort 3 (FDDI)
12838: >6 leshort 4 (ATM)
12839:
12840: #
12841: # Microsoft Network Monitor 2.x capture files.
12842: #
12843: 0 string GMBU NetMon capture file
12844: >5 byte x - version %d
12845: >4 byte x \b.%d
12846: >6 leshort 0 (Unknown)
12847: >6 leshort 1 (Ethernet)
12848: >6 leshort 2 (Token Ring)
12849: >6 leshort 3 (FDDI)
12850: >6 leshort 4 (ATM)
12851:
12852: #
12853: # Network General Sniffer capture files.
12854: # Sorry, make that "Network Associates Sniffer capture files."
12855: # Sorry, make that "Network General old DOS Sniffer capture files."
12856: #
12857: 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
12858: >33 byte 2 (compressed)
12859: >23 leshort x - version %d
12860: >25 leshort x \b.%d
12861: >32 byte 0 (Token Ring)
12862: >32 byte 1 (Ethernet)
12863: >32 byte 2 (ARCNET)
12864: >32 byte 3 (StarLAN)
12865: >32 byte 4 (PC Network broadband)
12866: >32 byte 5 (LocalTalk)
12867: >32 byte 6 (Znet)
12868: >32 byte 7 (Internetwork Analyzer)
12869: >32 byte 9 (FDDI)
12870: >32 byte 10 (ATM)
12871:
12872: #
12873: # Cinco Networks NetXRay capture files.
12874: # Sorry, make that "Network General Sniffer Basic capture files."
12875: # Sorry, make that "Network Associates Sniffer Basic capture files."
12876: # Sorry, make that "Network Associates Sniffer Basic, and Windows
12877: # Sniffer Pro", capture files."
12878: # Sorry, make that "Network General Sniffer capture files."
12879: #
12880: 0 string XCP\0 NetXRay capture file
12881: >4 string >\0 - version %s
12882: >44 leshort 0 (Ethernet)
12883: >44 leshort 1 (Token Ring)
12884: >44 leshort 2 (FDDI)
12885: >44 leshort 3 (WAN)
12886: >44 leshort 8 (ATM)
12887: >44 leshort 9 (802.11)
12888:
12889: #
12890: # "libpcap" capture files.
12891: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
12892: # the main program that uses that format, but there are other programs
12893: # that use "libpcap", or that use the same capture file format.)
12894: #
12895: 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
12896: >4 beshort x - version %d
12897: >6 beshort x \b.%d
12898: >20 belong 0 (No link-layer encapsulation
12899: >20 belong 1 (Ethernet
12900: >20 belong 2 (3Mb Ethernet
12901: >20 belong 3 (AX.25
12902: >20 belong 4 (ProNET
12903: >20 belong 5 (CHAOS
12904: >20 belong 6 (Token Ring
12905: >20 belong 7 (BSD ARCNET
12906: >20 belong 8 (SLIP
12907: >20 belong 9 (PPP
12908: >20 belong 10 (FDDI
12909: >20 belong 11 (RFC 1483 ATM
12910: >20 belong 12 (raw IP
12911: >20 belong 13 (BSD/OS SLIP
12912: >20 belong 14 (BSD/OS PPP
12913: >20 belong 19 (Linux ATM Classical IP
12914: >20 belong 50 (PPP or Cisco HDLC
12915: >20 belong 51 (PPP-over-Ethernet
12916: >20 belong 99 (Symantec Enterprise Firewall
12917: >20 belong 100 (RFC 1483 ATM
12918: >20 belong 101 (raw IP
12919: >20 belong 102 (BSD/OS SLIP
12920: >20 belong 103 (BSD/OS PPP
12921: >20 belong 104 (BSD/OS Cisco HDLC
12922: >20 belong 105 (802.11
12923: >20 belong 106 (Linux Classical IP over ATM
12924: >20 belong 107 (Frame Relay
12925: >20 belong 108 (OpenBSD loopback
12926: >20 belong 109 (OpenBSD IPsec encrypted
12927: >20 belong 112 (Cisco HDLC
12928: >20 belong 113 (Linux "cooked"
12929: >20 belong 114 (LocalTalk
12930: >20 belong 117 (OpenBSD PFLOG
12931: >20 belong 119 (802.11 with Prism header
12932: >20 belong 122 (RFC 2625 IP over Fibre Channel
12933: >20 belong 123 (SunATM
12934: >20 belong 127 (802.11 with radiotap header
12935: >20 belong 129 (Linux ARCNET
12936: >20 belong 138 (Apple IP over IEEE 1394
12937: >20 belong 140 (MTP2
12938: >20 belong 141 (MTP3
12939: >20 belong 143 (DOCSIS
12940: >20 belong 144 (IrDA
12941: >20 belong 147 (Private use 0
12942: >20 belong 148 (Private use 1
12943: >20 belong 149 (Private use 2
12944: >20 belong 150 (Private use 3
12945: >20 belong 151 (Private use 4
12946: >20 belong 152 (Private use 5
12947: >20 belong 153 (Private use 6
12948: >20 belong 154 (Private use 7
12949: >20 belong 155 (Private use 8
12950: >20 belong 156 (Private use 9
12951: >20 belong 157 (Private use 10
12952: >20 belong 158 (Private use 11
12953: >20 belong 159 (Private use 12
12954: >20 belong 160 (Private use 13
12955: >20 belong 161 (Private use 14
12956: >20 belong 162 (Private use 15
12957: >20 belong 163 (802.11 with AVS header
12958: >16 belong x \b, capture length %d)
12959: 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
12960: >4 leshort x - version %d
12961: >6 leshort x \b.%d
12962: >20 lelong 0 (No link-layer encapsulation
12963: >20 lelong 1 (Ethernet
12964: >20 lelong 2 (3Mb Ethernet
12965: >20 lelong 3 (AX.25
12966: >20 lelong 4 (ProNET
12967: >20 lelong 5 (CHAOS
12968: >20 lelong 6 (Token Ring
12969: >20 lelong 7 (ARCNET
12970: >20 lelong 8 (SLIP
12971: >20 lelong 9 (PPP
12972: >20 lelong 10 (FDDI
12973: >20 lelong 11 (RFC 1483 ATM
12974: >20 lelong 12 (raw IP
12975: >20 lelong 13 (BSD/OS SLIP
12976: >20 lelong 14 (BSD/OS PPP
12977: >20 lelong 19 (Linux ATM Classical IP
12978: >20 lelong 50 (PPP or Cisco HDLC
12979: >20 lelong 51 (PPP-over-Ethernet
12980: >20 lelong 99 (Symantec Enterprise Firewall
12981: >20 lelong 100 (RFC 1483 ATM
12982: >20 lelong 101 (raw IP
12983: >20 lelong 102 (BSD/OS SLIP
12984: >20 lelong 103 (BSD/OS PPP
12985: >20 lelong 104 (BSD/OS Cisco HDLC
12986: >20 lelong 105 (802.11
12987: >20 lelong 106 (Linux Classical IP over ATM
12988: >20 lelong 107 (Frame Relay
12989: >20 lelong 108 (OpenBSD loopback
12990: >20 lelong 109 (OpenBSD IPsec encrypted
12991: >20 lelong 112 (Cisco HDLC
12992: >20 lelong 113 (Linux "cooked"
12993: >20 lelong 114 (LocalTalk
12994: >20 lelong 117 (OpenBSD PFLOG
12995: >20 lelong 119 (802.11 with Prism header
12996: >20 lelong 122 (RFC 2625 IP over Fibre Channel
12997: >20 lelong 123 (SunATM
12998: >20 lelong 127 (802.11 with radiotap header
12999: >20 lelong 129 (Linux ARCNET
13000: >20 lelong 138 (Apple IP over IEEE 1394
13001: >20 lelong 140 (MTP2
13002: >20 lelong 141 (MTP3
13003: >20 lelong 143 (DOCSIS
13004: >20 lelong 144 (IrDA
13005: >20 lelong 147 (Private use 0
13006: >20 lelong 148 (Private use 1
13007: >20 lelong 149 (Private use 2
13008: >20 lelong 150 (Private use 3
13009: >20 lelong 151 (Private use 4
13010: >20 lelong 152 (Private use 5
13011: >20 lelong 153 (Private use 6
13012: >20 lelong 154 (Private use 7
13013: >20 lelong 155 (Private use 8
13014: >20 lelong 156 (Private use 9
13015: >20 lelong 157 (Private use 10
13016: >20 lelong 158 (Private use 11
13017: >20 lelong 159 (Private use 12
13018: >20 lelong 160 (Private use 13
13019: >20 lelong 161 (Private use 14
13020: >20 lelong 162 (Private use 15
13021: >20 lelong 163 (802.11 with AVS header
13022: >16 lelong x \b, capture length %d)
13023:
13024: #
13025: # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
13026: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
13027: # the main program that uses that format, but there are other programs
13028: # that use "libpcap", or that use the same capture file format.)
13029: #
13030: 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
13031: >4 beshort x - version %d
13032: >6 beshort x \b.%d
13033: >20 belong 0 (No link-layer encapsulation
13034: >20 belong 1 (Ethernet
13035: >20 belong 2 (3Mb Ethernet
13036: >20 belong 3 (AX.25
13037: >20 belong 4 (ProNET
13038: >20 belong 5 (CHAOS
13039: >20 belong 6 (Token Ring
13040: >20 belong 7 (ARCNET
13041: >20 belong 8 (SLIP
13042: >20 belong 9 (PPP
13043: >20 belong 10 (FDDI
13044: >20 belong 11 (RFC 1483 ATM
13045: >20 belong 12 (raw IP
13046: >20 belong 13 (BSD/OS SLIP
13047: >20 belong 14 (BSD/OS PPP
13048: >16 belong x \b, capture length %d)
13049: 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
13050: >4 leshort x - version %d
13051: >6 leshort x \b.%d
13052: >20 lelong 0 (No link-layer encapsulation
13053: >20 lelong 1 (Ethernet
13054: >20 lelong 2 (3Mb Ethernet
13055: >20 lelong 3 (AX.25
13056: >20 lelong 4 (ProNET
13057: >20 lelong 5 (CHAOS
13058: >20 lelong 6 (Token Ring
13059: >20 lelong 7 (ARCNET
13060: >20 lelong 8 (SLIP
13061: >20 lelong 9 (PPP
13062: >20 lelong 10 (FDDI
13063: >20 lelong 11 (RFC 1483 ATM
13064: >20 lelong 12 (raw IP
13065: >20 lelong 13 (BSD/OS SLIP
13066: >20 lelong 14 (BSD/OS PPP
13067: >16 lelong x \b, capture length %d)
13068:
13069: #
13070: # AIX "iptrace" capture files.
13071: #
13072: 0 string iptrace\ 1.0 "iptrace" capture file
13073: 0 string iptrace\ 2.0 "iptrace" capture file
13074:
13075: #
13076: # Novell LANalyzer capture files.
13077: #
13078: 0 leshort 0x1001 LANalyzer capture file
13079: 0 leshort 0x1007 LANalyzer capture file
13080:
13081: #
13082: # HP-UX "nettl" capture files.
13083: #
13084: 0 string \x54\x52\x00\x64\x00 "nettl" capture file
13085:
13086: #
13087: # RADCOM WAN/LAN Analyzer capture files.
13088: #
13089: 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
13090:
13091: #
13092: # NetStumbler log files. Not really packets, per se, but about as
13093: # close as you can get. These are log files from NetStumbler, a
13094: # Windows program, that scans for 802.11b networks.
13095: #
13096: 0 string NetS NetStumbler log file
13097: >8 lelong x \b, %d stations found
13098:
13099: #
13100: # EtherPeek/AiroPeek "version 9" capture files.
13101: #
13102: 0 string \177ver EtherPeek/AiroPeek capture file
13103:
13104: #
13105: # Visual Networks traffic capture files.
13106: #
13107: 0 string \x05VNF Visual Networks traffic capture file
13108:
13109: #
13110: # Network Instruments Observer capture files.
13111: #
13112: 0 string ObserverPktBuffe Network Instruments Observer capture file
13113:
13114: #
13115: # Files from Accellent Group's 5View products.
13116: #
13117: 0 string \xaa\xaa\xaa\xaa 5View capture file
13118: #------------------------------------------------------------------------------
13119: # softquad: file(1) magic for SoftQuad Publishing Software
13120: #
13121: # Author/Editor and RulesBuilder
13122: #
13123: # XXX - byte order?
13124: #
13125: 0 string \<!SQ\ DTD> Compiled SGML rules file
13126: >9 string >\0 Type %s
13127: 0 string \<!SQ\ A/E> A/E SGML Document binary
13128: >9 string >\0 Type %s
13129: 0 string \<!SQ\ STS> A/E SGML binary styles file
13130: >9 string >\0 Type %s
13131: 0 short 0xc0de Compiled PSI (v1) data
13132: 0 short 0xc0da Compiled PSI (v2) data
13133: >3 string >\0 (%s)
13134: # Binary sqtroff font/desc files...
13135: 0 short 0125252 SoftQuad DESC or font file binary
13136: >2 short >0 - version %d
13137: # Bitmaps...
13138: 0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
13139: #0 string SQ\ BITMAP2 SoftQuad Raster Format data
13140: # sqtroff intermediate language (replacement for ditroff int. lang.)
13141: 0 string X\ SoftQuad troff Context intermediate
13142: >2 string 495 for AT&T 495 laser printer
13143: >2 string hp for Hewlett-Packard LaserJet
13144: >2 string impr for IMAGEN imPRESS
13145: >2 string ps for PostScript
13146:
13147: # From: Michael Piefel <piefel@debian.org>
13148: # sqtroff intermediate language (replacement for ditroff int. lang.)
13149: 0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
13150: 0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
13151: 0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
13152: 0 string X\ ps SoftQuad troff Context intermediate for PostScript
13153:
13154: #------------------------------------------------------------------------------
13155: # spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
13156: #
13157: # Cloyce D. Spradling <cloyce@headgear.org>
13158:
13159: 0 string spec SPEC
13160: >4 string .cpu CPU
13161: >>8 string <: \b%.4s
13162: >>12 string . raw result text
13163:
13164: 17 string version=SPECjbb SPECjbb
13165: >32 string <: \b%.4s
13166: >>37 string <: v%.4s raw result text
13167:
13168: 0 string BEGIN\040SPECWEB SPECweb
13169: >13 string <: \b%.2s
13170: >>15 string _SSL \b_SSL
13171: >>>20 string <: v%.4s raw result text
13172: >>16 string <: v%.4s raw result text
13173:
13174: #------------------------------------------------------------------------------
13175: # spectrum: file(1) magic for Spectrum emulator files.
13176: #
13177: # John Elliott <jce@seasip.demon.co.uk>
13178:
13179: #
13180: # Spectrum +3DOS header
13181: #
13182: 0 string PLUS3DOS\032 Spectrum +3 data
13183: >15 byte 0 - BASIC program
13184: >15 byte 1 - number array
13185: >15 byte 2 - character array
13186: >15 byte 3 - memory block
13187: >>16 belong 0x001B0040 (screen)
13188: >15 byte 4 - Tasword document
13189: >15 string TAPEFILE - ZXT tapefile
13190: #
13191: # Tape file. This assumes the .TAP starts with a Spectrum-format header,
13192: # which nearly all will.
13193: #
13194: 0 string \023\000\000 Spectrum .TAP data
13195: >4 string x "%-10.10s"
13196: >3 byte 0 - BASIC program
13197: >3 byte 1 - number array
13198: >3 byte 2 - character array
13199: >3 byte 3 - memory block
13200: >>14 belong 0x001B0040 (screen)
13201:
13202: # The following three blocks are from pak21-spectrum@srcf.ucam.org
13203: # TZX tape images
13204: 0 string ZXTape!\x1a Spectrum .TZX data
13205: >8 byte x version %d
13206: >9 byte x \b.%d
13207:
13208: # RZX input recording files
13209: 0 string RZX! Spectrum .RZX data
13210: >4 byte x version %d
13211: >5 byte x \b.%d
13212:
13213: # Floppy disk images
13214: 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
13215: 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
13216: 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
13217: 0 string SINCLAIR Spectrum .SCL Betadisk image
13218:
13219: # Hard disk images
13220: 0 string RS-IDE\x1a Spectrum .HDF hard disk image
13221: >7 byte x \b, version 0x%02x
13222:
13223: #------------------------------------------------------------------------------
13224: # sql: file(1) magic for SQL files
13225: #
13226: # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
13227: # Recognize some MySQL files.
13228: #
13229: 0 beshort 0xfe01 MySQL table definition file
13230: >2 byte x Version %d
13231: 0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
13232: >3 byte x Version %d
13233: 0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
13234: >3 byte x Version %d
13235: 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
13236: >3 byte x Version %d
13237: 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
13238: >3 byte x Version %d
13239: 0 string \376bin MySQL replication log
13240:
13241: #------------------------------------------------------------------------------
13242: # iRiver H Series database file
13243: # From Ken Guest <ken@linux.ie>
13244: # As observed from iRivNavi.iDB and unencoded firmware
13245: #
13246: 0 string iRivDB iRiver Database file
13247: >11 string >\0 Version %s
13248: >39 string iHP-100 [H Series]
13249:
13250: #------------------------------------------------------------------------------
13251: # SQLite database files
13252: # Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
13253: #
13254: # Version 1 used GDBM internally; its files cannot be distinguished
13255: # from other GDBM files.
13256: #
13257: # Version 2 used this format:
13258: 0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
13259:
13260: # Version 3 of SQLite allows applications to embed their own "user version"
13261: # number in the database. Detect this and distinguish those files.
13262:
13263: 0 string SQLite\ format\ 3
13264: >60 string _MTN Monotone source repository
13265: >60 belong !0 SQLite 3.x database, user version %u
13266: >60 belong 0 SQLite 3.x database
13267:
13268: #------------------------------------------------------------------------------
13269: # sun: file(1) magic for Sun machines
13270: #
13271: # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
13272: # releases. (5.x uses ELF.)
13273: #
13274: 0 belong&077777777 0600413 sparc demand paged
13275: >0 byte &0x80
13276: >>20 belong <4096 shared library
13277: >>20 belong =4096 dynamically linked executable
13278: >>20 belong >4096 dynamically linked executable
13279: >0 byte ^0x80 executable
13280: >16 belong >0 not stripped
13281:
13282: 0 belong&077777777 0600410 sparc pure
13283: >0 byte &0x80 dynamically linked executable
13284: >0 byte ^0x80 executable
13285: >16 belong >0 not stripped
13286:
13287: 0 belong&077777777 0600407 sparc
13288: >0 byte &0x80 dynamically linked executable
13289: >0 byte ^0x80 executable
13290: >16 belong >0 not stripped
13291:
13292: 0 belong&077777777 0400413 mc68020 demand paged
13293: >0 byte &0x80
13294: >>20 belong <4096 shared library
13295: >>20 belong =4096 dynamically linked executable
13296: >>20 belong >4096 dynamically linked executable
13297: >0 byte ^0x80 executable
13298: >16 belong >0 not stripped
13299:
13300: 0 belong&077777777 0400410 mc68020 pure
13301: >0 byte &0x80 dynamically linked executable
13302: >0 byte ^0x80 executable
13303: >16 belong >0 not stripped
13304:
13305: 0 belong&077777777 0400407 mc68020
13306: >0 byte &0x80 dynamically linked executable
13307: >0 byte ^0x80 executable
13308: >16 belong >0 not stripped
13309:
13310: 0 belong&077777777 0200413 mc68010 demand paged
13311: >0 byte &0x80
13312: >>20 belong <4096 shared library
13313: >>20 belong =4096 dynamically linked executable
13314: >>20 belong >4096 dynamically linked executable
13315: >0 byte ^0x80 executable
13316: >16 belong >0 not stripped
13317:
13318: 0 belong&077777777 0200410 mc68010 pure
13319: >0 byte &0x80 dynamically linked executable
13320: >0 byte ^0x80 executable
13321: >16 belong >0 not stripped
13322:
13323: 0 belong&077777777 0200407 mc68010
13324: >0 byte &0x80 dynamically linked executable
13325: >0 byte ^0x80 executable
13326: >16 belong >0 not stripped
13327:
13328: # reworked these to avoid anything beginning with zero becoming "old sun-2"
13329: 0 belong 0407 old sun-2 executable
13330: >16 belong >0 not stripped
13331: 0 belong 0410 old sun-2 pure executable
13332: >16 belong >0 not stripped
13333: 0 belong 0413 old sun-2 demand paged executable
13334: >16 belong >0 not stripped
13335:
13336: #
13337: # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
13338: # binary executed in compatibility mode under SunOS 5.x".
13339: #
13340: 0 belong 0x080456 SunOS core file
13341: >4 belong 432 (SPARC)
13342: >>132 string >\0 from '%s'
13343: >>116 belong =3 (quit)
13344: >>116 belong =4 (illegal instruction)
13345: >>116 belong =5 (trace trap)
13346: >>116 belong =6 (abort)
13347: >>116 belong =7 (emulator trap)
13348: >>116 belong =8 (arithmetic exception)
13349: >>116 belong =9 (kill)
13350: >>116 belong =10 (bus error)
13351: >>116 belong =11 (segmentation violation)
13352: >>116 belong =12 (bad argument to system call)
13353: >>116 belong =29 (resource lost)
13354: >>120 belong x (T=%dK,
13355: >>124 belong x D=%dK,
13356: >>128 belong x S=%dK)
13357: >4 belong 826 (68K)
13358: >>128 string >\0 from '%s'
13359: >4 belong 456 (SPARC 4.x BCP)
13360: >>152 string >\0 from '%s'
13361: # Sun SunPC
13362: 0 long 0xfa33c08e SunPC 4.0 Hard Disk
13363: 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
13364: # Sun snoop (see RFC 1761, which describes the capture file format).
13365: #
13366: 0 string snoop Snoop capture file
13367: >8 belong >0 - version %ld
13368: >12 belong 0 (IEEE 802.3)
13369: >12 belong 1 (IEEE 802.4)
13370: >12 belong 2 (IEEE 802.5)
13371: >12 belong 3 (IEEE 802.6)
13372: >12 belong 4 (Ethernet)
13373: >12 belong 5 (HDLC)
13374: >12 belong 6 (Character synchronous)
13375: >12 belong 7 (IBM channel-to-channel adapter)
13376: >12 belong 8 (FDDI)
13377: >12 belong 9 (Unknown)
13378:
13379: # Microsoft ICM color profile
13380: 36 string acspMSFT Microsoft ICM Color Profile
13381: # Sun KCMS
13382: 36 string acsp Kodak Color Management System, ICC Profile
13383:
13384: #---------------------------------------------------------------------------
13385: # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
13386: # lead Sun/Cobalt developer) who agrees that they are good and worthy of
13387: # inclusion.
13388:
13389: # Boot ROM images for Sun/Cobalt Linux server appliances
13390: 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
13391: >38 string x V%.4s
13392:
13393: # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
13394: # at the very end where file(1) can't get it.
13395: 0 string CRfs COBALT boot rom data (Flat boot rom or file system)
13396:
13397:
13398: #------------------------------------------------------------------------
13399: # sysex: file(1) magic for MIDI sysex files
13400: #
13401: #
13402: 0 byte 0xF0 SysEx File -
13403:
13404: # North American Group
13405: >1 byte 0x01 Sequential
13406: >1 byte 0x02 IDP
13407: >1 byte 0x03 OctavePlateau
13408: >1 byte 0x04 Moog
13409: >1 byte 0x05 Passport
13410: >1 byte 0x06 Lexicon
13411: >1 byte 0x07 Kurzweil/Future Retro
13412: >>3 byte 0x77 777
13413: >>4 byte 0x00 Bank
13414: >>4 byte 0x01 Song
13415: >>5 byte 0x0f 16
13416: >>5 byte 0x0e 15
13417: >>5 byte 0x0d 14
13418: >>5 byte 0x0c 13
13419: >>5 byte 0x0b 12
13420: >>5 byte 0x0a 11
13421: >>5 byte 0x09 10
13422: >>5 byte 0x08 9
13423: >>5 byte 0x07 8
13424: >>5 byte 0x06 7
13425: >>5 byte 0x05 6
13426: >>5 byte 0x04 5
13427: >>5 byte 0x03 4
13428: >>5 byte 0x02 3
13429: >>5 byte 0x01 2
13430: >>5 byte 0x00 1
13431: >>5 byte 0x10 (ALL)
13432: >>2 byte x \b, Channel %d
13433: >1 byte 0x08 Fender
13434: >1 byte 0x09 Gulbransen
13435: >1 byte 0x0a AKG
13436: >1 byte 0x0b Voyce
13437: >1 byte 0x0c Waveframe
13438: >1 byte 0x0d ADA
13439: >1 byte 0x0e Garfield
13440: >1 byte 0x0f Ensoniq
13441: >1 byte 0x10 Oberheim
13442: >>2 byte 0x06 Matrix 6 series
13443: >>3 byte 0x0A Dump (All)
13444: >>3 byte 0x01 Dump (Bank)
13445: >>4 belong 0x0002040E Matrix 1000
13446: >>>11 byte <2 User bank %d
13447: >>>11 byte >1 Preset bank %d
13448: >1 byte 0x11 Apple
13449: >1 byte 0x12 GreyMatter
13450: >1 byte 0x14 PalmTree
13451: >1 byte 0x15 JLCooper
13452: >1 byte 0x16 Lowrey
13453: >1 byte 0x17 AdamsSmith
13454: >1 byte 0x18 E-mu
13455: >1 byte 0x19 Harmony
13456: >1 byte 0x1a ART
13457: >1 byte 0x1b Baldwin
13458: >1 byte 0x1c Eventide
13459: >1 byte 0x1d Inventronics
13460: >1 byte 0x1f Clarity
13461:
13462: # European Group
13463: >1 byte 0x21 SIEL
13464: >1 byte 0x22 Synthaxe
13465: >1 byte 0x24 Hohner
13466: >1 byte 0x25 Twister
13467: >1 byte 0x26 Solton
13468: >1 byte 0x27 Jellinghaus
13469: >1 byte 0x28 Southworth
13470: >1 byte 0x29 PPG
13471: >1 byte 0x2a JEN
13472: >1 byte 0x2b SSL
13473: >1 byte 0x2c AudioVertrieb
13474:
13475: >1 byte 0x2f ELKA
13476: >>3 byte 0x09 EK-44
13477:
13478: >1 byte 0x30 Dynacord
13479: >1 byte 0x31 Jomox
13480: >1 byte 0x33 Clavia
13481: >1 byte 0x39 Soundcraft
13482: # Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
13483: >1 byte 0x3e Waldorf
13484: >>2 byte 0x00 microWave
13485: >>2 byte 0x0E microwave2 / XT
13486: >>2 byte 0x0F Q / Q+
13487: >>3 byte =0 (default id)
13488: >>3 byte >0 (
13489: >>>3 byte <0x7F \bdevice %d)
13490: >>>3 byte =0x7F \bbroadcast id)
13491: >>3 byte 0x7f Microwave I
13492: >>>4 byte 0x00 SNDR (Sound Request)
13493: >>>4 byte 0x10 SNDD (Sound Dump)
13494: >>>4 byte 0x20 SNDP (Sound Parameter Change)
13495: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
13496: >>>4 byte 0x70 BOOT (Sound Reserved)
13497: >>>4 byte 0x01 MULR (Multi Request)
13498: >>>4 byte 0x11 MULD (Multi Dump)
13499: >>>4 byte 0x21 MULP (Multi Parameter Change)
13500: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
13501: >>>4 byte 0x71 OS (Multi Reserved)
13502: >>>4 byte 0x02 DRMR (Drum Map Request)
13503: >>>4 byte 0x12 DRMD (Drum Map Dump)
13504: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
13505: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
13506: >>>4 byte 0x72 BIN (Drum Map Reserved)
13507: >>>4 byte 0x03 PATR (Sequencer Pattern Request)
13508: >>>4 byte 0x13 PATD (Sequencer Pattern Dump)
13509: >>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
13510: >>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
13511: >>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
13512: >>>4 byte 0x04 GLBR (Global Parameter Request)
13513: >>>4 byte 0x14 GLBD (Global Parameter Dump)
13514: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
13515: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
13516: >>>4 byte 0x07 MODR (Mode Parameter Request)
13517: >>>4 byte 0x17 MODD (Mode Parameter Dump)
13518: >>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
13519: >>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
13520: >>2 byte 0x10 microQ
13521: >>>4 byte 0x00 SNDR (Sound Request)
13522: >>>4 byte 0x10 SNDD (Sound Dump)
13523: >>>4 byte 0x20 SNDP (Sound Parameter Change)
13524: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
13525: >>>4 byte 0x70 (Sound Reserved)
13526: >>>4 byte 0x01 MULR (Multi Request)
13527: >>>4 byte 0x11 MULD (Multi Dump)
13528: >>>4 byte 0x21 MULP (Multi Parameter Change)
13529: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
13530: >>>4 byte 0x71 OS (Multi Reserved)
13531: >>>4 byte 0x02 DRMR (Drum Map Request)
13532: >>>4 byte 0x12 DRMD (Drum Map Dump)
13533: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
13534: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
13535: >>>4 byte 0x72 BIN (Drum Map Reserved)
13536: >>>4 byte 0x04 GLBR (Global Parameter Request)
13537: >>>4 byte 0x14 GLBD (Global Parameter Dump)
13538: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
13539: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
13540: >>2 byte 0x11 rackAttack
13541: >>>4 byte 0x00 SNDR (Sound Parameter Request)
13542: >>>4 byte 0x10 SNDD (Sound Parameter Dump)
13543: >>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
13544: >>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
13545: >>>4 byte 0x01 PRGR (Program Parameter Request)
13546: >>>4 byte 0x11 PRGD (Program Parameter Dump)
13547: >>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
13548: >>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
13549: >>>4 byte 0x71 OS (Program Parameter Reserved)
13550: >>>4 byte 0x03 PATR (Pattern Parameter Request)
13551: >>>4 byte 0x13 PATD (Pattern Parameter Dump)
13552: >>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
13553: >>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
13554: >>>4 byte 0x04 GLBR (Global Parameter Request)
13555: >>>4 byte 0x14 GLBD (Global Parameter Dump)
13556: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
13557: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
13558: >>>4 byte 0x05 EFXR (FX Parameter Request)
13559: >>>4 byte 0x15 EFXD (FX Parameter Dump)
13560: >>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
13561: >>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
13562: >>>4 byte 0x07 MODR (Mode Command Request)
13563: >>>4 byte 0x17 MODD (Mode Command Dump)
13564: >>>4 byte 0x27 MODP (Mode Command Parameter Change)
13565: >>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
13566: >>2 byte 0x03 Wave
13567: >>>4 byte 0x00 SBPR (Soundprogram)
13568: >>>4 byte 0x01 SAPR (Performance)
13569: >>>4 byte 0x02 SWAVE (Wave)
13570: >>>4 byte 0x03 SWTBL (Wave control table)
13571: >>>4 byte 0x04 SVT (Velocity Curve)
13572: >>>4 byte 0x05 STT (Tuning Table)
13573: >>>4 byte 0x06 SGLB (Global Parameters)
13574: >>>4 byte 0x07 SARRMAP (Performance Program Change Map)
13575: >>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
13576: >>>4 byte 0x09 SBPRPAR (Sound Parameter)
13577: >>>4 byte 0x0A SARRPAR (Performance Parameter)
13578: >>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
13579: >>>4 byte 0x0F SBULK (Bulk Switch on/off)
13580:
13581: # Japanese Group
13582: >1 byte 0x40 Kawai
13583: >>3 byte 0x20 K1
13584: >>3 byte 0x22 K4
13585:
13586: >1 byte 0x41 Roland
13587: >>3 byte 0x14 D-50
13588: >>3 byte 0x2b U-220
13589: >>3 byte 0x02 TR-707
13590:
13591: >1 byte 0x42 Korg
13592: >>3 byte 0x19 M1
13593:
13594: >1 byte 0x43 Yamaha
13595: >1 byte 0x44 Casio
13596: >1 byte 0x46 Kamiya
13597: >1 byte 0x47 Akai
13598: >1 byte 0x48 Victor
13599: >1 byte 0x49 Mesosha
13600: >1 byte 0x4b Fujitsu
13601: >1 byte 0x4c Sony
13602: >1 byte 0x4e Teac
13603: >1 byte 0x50 Matsushita
13604: >1 byte 0x51 Fostex
13605: >1 byte 0x52 Zoom
13606: >1 byte 0x54 Matsushita
13607: >1 byte 0x57 Acoustic tech. lab.
13608:
13609: >1 belong&0xffffff00 0x00007400 Ta Horng
13610: >1 belong&0xffffff00 0x00007500 e-Tek
13611: >1 belong&0xffffff00 0x00007600 E-Voice
13612: >1 belong&0xffffff00 0x00007700 Midisoft
13613: >1 belong&0xffffff00 0x00007800 Q-Sound
13614: >1 belong&0xffffff00 0x00007900 Westrex
13615: >1 belong&0xffffff00 0x00007a00 Nvidia*
13616: >1 belong&0xffffff00 0x00007b00 ESS
13617: >1 belong&0xffffff00 0x00007c00 Mediatrix
13618: >1 belong&0xffffff00 0x00007d00 Brooktree
13619: >1 belong&0xffffff00 0x00007e00 Otari
13620: >1 belong&0xffffff00 0x00007f00 Key Electronics
13621: >1 belong&0xffffff00 0x00010000 Shure
13622: >1 belong&0xffffff00 0x00010100 AuraSound
13623: >1 belong&0xffffff00 0x00010200 Crystal
13624: >1 belong&0xffffff00 0x00010300 Rockwell
13625: >1 belong&0xffffff00 0x00010400 Silicon Graphics
13626: >1 belong&0xffffff00 0x00010500 Midiman
13627: >1 belong&0xffffff00 0x00010600 PreSonus
13628: >1 belong&0xffffff00 0x00010800 Topaz
13629: >1 belong&0xffffff00 0x00010900 Cast Lightning
13630: >1 belong&0xffffff00 0x00010a00 Microsoft
13631: >1 belong&0xffffff00 0x00010b00 Sonic Foundry
13632: >1 belong&0xffffff00 0x00010c00 Line 6
13633: >1 belong&0xffffff00 0x00010d00 Beatnik Inc.
13634: >1 belong&0xffffff00 0x00010e00 Van Koerving
13635: >1 belong&0xffffff00 0x00010f00 Altech Systems
13636: >1 belong&0xffffff00 0x00011000 S & S Research
13637: >1 belong&0xffffff00 0x00011100 VLSI Technology
13638: >1 belong&0xffffff00 0x00011200 Chromatic
13639: >1 belong&0xffffff00 0x00011300 Sapphire
13640: >1 belong&0xffffff00 0x00011400 IDRC
13641: >1 belong&0xffffff00 0x00011500 Justonic Tuning
13642: >1 belong&0xffffff00 0x00011600 TorComp
13643: >1 belong&0xffffff00 0x00011700 Newtek Inc.
13644: >1 belong&0xffffff00 0x00011800 Sound Sculpture
13645: >1 belong&0xffffff00 0x00011900 Walker Technical
13646: >1 belong&0xffffff00 0x00011a00 Digital Harmony
13647: >1 belong&0xffffff00 0x00011b00 InVision
13648: >1 belong&0xffffff00 0x00011c00 T-Square
13649: >1 belong&0xffffff00 0x00011d00 Nemesys
13650: >1 belong&0xffffff00 0x00011e00 DBX
13651: >1 belong&0xffffff00 0x00011f00 Syndyne
13652: >1 belong&0xffffff00 0x00012000 Bitheadz
13653: >1 belong&0xffffff00 0x00012100 Cakewalk
13654: >1 belong&0xffffff00 0x00012200 Staccato
13655: >1 belong&0xffffff00 0x00012300 National Semicon.
13656: >1 belong&0xffffff00 0x00012400 Boom Theory
13657: >1 belong&0xffffff00 0x00012500 Virtual DSP Corp
13658: >1 belong&0xffffff00 0x00012600 Antares
13659: >1 belong&0xffffff00 0x00012700 Angel Software
13660: >1 belong&0xffffff00 0x00012800 St Louis Music
13661: >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
13662: >1 belong&0xffffff00 0x00012a00 Ashley Audio
13663: >1 belong&0xffffff00 0x00012b00 Vari-Lite
13664: >1 belong&0xffffff00 0x00012c00 Summit Audio
13665: >1 belong&0xffffff00 0x00012d00 Aureal Semicon.
13666: >1 belong&0xffffff00 0x00012e00 SeaSound
13667: >1 belong&0xffffff00 0x00012f00 U.S. Robotics
13668: >1 belong&0xffffff00 0x00013000 Aurisis
13669: >1 belong&0xffffff00 0x00013100 Nearfield Multimedia
13670: >1 belong&0xffffff00 0x00013200 FM7 Inc.
13671: >1 belong&0xffffff00 0x00013300 Swivel Systems
13672: >1 belong&0xffffff00 0x00013400 Hyperactive
13673: >1 belong&0xffffff00 0x00013500 MidiLite
13674: >1 belong&0xffffff00 0x00013600 Radical
13675: >1 belong&0xffffff00 0x00013700 Roger Linn
13676: >1 belong&0xffffff00 0x00013800 Helicon
13677: >1 belong&0xffffff00 0x00013900 Event
13678: >1 belong&0xffffff00 0x00013a00 Sonic Network
13679: >1 belong&0xffffff00 0x00013b00 Realtime Music
13680: >1 belong&0xffffff00 0x00013c00 Apogee Digital
13681:
13682: >1 belong&0xffffff00 0x00202b00 Medeli Electronics
13683: >1 belong&0xffffff00 0x00202c00 Charlie Lab
13684: >1 belong&0xffffff00 0x00202d00 Blue Chip Music
13685: >1 belong&0xffffff00 0x00202e00 BEE OH Corp
13686: >1 belong&0xffffff00 0x00202f00 LG Semicon America
13687: >1 belong&0xffffff00 0x00203000 TESI
13688: >1 belong&0xffffff00 0x00203100 EMAGIC
13689: >1 belong&0xffffff00 0x00203200 Behringer
13690: >1 belong&0xffffff00 0x00203300 Access Music
13691: >1 belong&0xffffff00 0x00203400 Synoptic
13692: >1 belong&0xffffff00 0x00203500 Hanmesoft Corp
13693: >1 belong&0xffffff00 0x00203600 Terratec
13694: >1 belong&0xffffff00 0x00203700 Proel SpA
13695: >1 belong&0xffffff00 0x00203800 IBK MIDI
13696: >1 belong&0xffffff00 0x00203900 IRCAM
13697: >1 belong&0xffffff00 0x00203a00 Propellerhead Software
13698: >1 belong&0xffffff00 0x00203b00 Red Sound Systems
13699: >1 belong&0xffffff00 0x00203c00 Electron ESI AB
13700: >1 belong&0xffffff00 0x00203d00 Sintefex Audio
13701: >1 belong&0xffffff00 0x00203e00 Music and More
13702: >1 belong&0xffffff00 0x00203f00 Amsaro
13703: >1 belong&0xffffff00 0x00204000 CDS Advanced Technology
13704: >1 belong&0xffffff00 0x00204100 Touched by Sound
13705: >1 belong&0xffffff00 0x00204200 DSP Arts
13706: >1 belong&0xffffff00 0x00204300 Phil Rees Music
13707: >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
13708: >1 belong&0xffffff00 0x00204500 Soundart
13709: >1 belong&0xffffff00 0x00204600 C-Mexx Software
13710: >1 belong&0xffffff00 0x00204700 Klavis Tech.
13711: >1 belong&0xffffff00 0x00204800 Noteheads AB
13712:
13713: 0 string T707 Roland TR-707 Data
13714: #------------------------------------------------------------------------------
13715: # teapot: file(1) magic for "teapot" spreadsheet
13716: #
13717: 0 string #!teapot\012xdr teapot work sheet (XDR format)
13718:
13719: #------------------------------------------------------------------------------
13720: # terminfo: file(1) magic for terminfo
13721: #
13722: # XXX - byte order for screen images?
13723: #
13724: 0 string \032\001 Compiled terminfo entry
13725: 0 short 0433 Curses screen image
13726: 0 short 0434 Curses screen image
13727: #------------------------------------------------------------------------------
13728: # tex: file(1) magic for TeX files
13729: #
13730: # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
13731: #
13732: # From <conklin@talisman.kaleida.com>
13733:
13734: # Although we may know the offset of certain text fields in TeX DVI
13735: # and font files, we can't use them reliably because they are not
13736: # zero terminated. [but we do anyway, christos]
13737: 0 string \367\002 TeX DVI file
13738: !:mime application/x-dvi
13739: >16 string >\0 (%s)
13740: 0 string \367\203 TeX generic font data
13741: 0 string \367\131 TeX packed font data
13742: >3 string >\0 (%s)
13743: 0 string \367\312 TeX virtual font data
13744: 0 search/1 This\ is\ TeX, TeX transcript text
13745: 0 search/1 This\ is\ METAFONT, METAFONT transcript text
13746:
13747: # There is no way to detect TeX Font Metric (*.tfm) files without
13748: # breaking them apart and reading the data. The following patterns
13749: # match most *.tfm files generated by METAFONT or afm2tfm.
13750: 2 string \000\021 TeX font metric data
13751: !:mime application/x-tex-tfm
13752: >33 string >\0 (%s)
13753: 2 string \000\022 TeX font metric data
13754: !:mime application/x-tex-tfm
13755: >33 string >\0 (%s)
13756:
13757: # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
13758: 0 search/1 \\input\ texinfo Texinfo source text
13759: !:mime text/x-texinfo
13760: 0 search/1 This\ is\ Info\ file GNU Info text
13761: !:mime text/x-info
13762:
13763: # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
13764: 0 search/400 \\input TeX document text
13765: !:mime text/x-tex
13766: 0 search/400 \\section LaTeX document text
13767: !:mime text/x-tex
13768: 0 search/400 \\setlength LaTeX document text
13769: !:mime text/x-tex
13770: 0 search/400 \\documentstyle LaTeX document text
13771: !:mime text/x-tex
13772: 0 search/400 \\chapter LaTeX document text
13773: !:mime text/x-tex
13774: 0 search/400 \\documentclass LaTeX 2e document text
13775: !:mime text/x-tex
13776: 0 search/400 \\relax LaTeX auxiliary file
13777: !:mime text/x-tex
13778: 0 search/400 \\contentsline LaTeX table of contents
13779: !:mime text/x-tex
13780: 0 search/400 %\ -*-latex-*- LaTeX document text
13781: !:mime text/x-tex
13782:
13783: # Tex document, from Hendrik Scholz <hendrik@scholz.net>
13784: 0 search/1 \\ifx TeX document text
13785:
13786: # Index and glossary files
13787: 0 search/400 \\indexentry LaTeX raw index file
13788: 0 search/400 \\begin{theindex} LaTeX sorted index
13789: 0 search/400 \\glossaryentry LaTeX raw glossary
13790: 0 search/400 \\begin{theglossary} LaTeX sorted glossary
13791: 0 search/400 This\ is\ makeindex Makeindex log file
13792:
13793: # End of TeX
13794:
13795: #------------------------------------------------------------------------------
13796: # file(1) magic for BibTex text files
13797: # From Hendrik Scholz <hendrik@scholz.net>
13798:
13799: 0 search/1/c @article{ BibTeX text file
13800: 0 search/1/c @book{ BibTeX text file
13801: 0 search/1/c @inbook{ BibTeX text file
13802: 0 search/1/c @incollection{ BibTeX text file
13803: 0 search/1/c @inproceedings{ BibTeX text file
13804: 0 search/1/c @manual{ BibTeX text file
13805: 0 search/1/c @misc{ BibTeX text file
13806: 0 search/1/c @preamble{ BibTeX text file
13807: 0 search/1/c @phdthesis{ BibTeX text file
13808: 0 search/1/c @techreport{ BibTeX text file
13809: 0 search/1/c @unpublished{ BibTeX text file
13810:
13811: 73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header)
13812:
13813: 73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
13814:
13815: 0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
13816:
13817: 0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file
13818:
13819: 0 search/1 @c\ @mapfile{ TeX font aliases text file
13820: #------------------------------------------------------------------------------
13821: # file(1) magic for tgif(1) files
13822: # From Hendrik Scholz <hendrik@scholz.net>
13823:
13824: 0 string %TGIF\ x Tgif file version %s
13825:
13826: # ------------------------------------------------------------------------
13827: # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
13828: #
13829: # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
13830: #
13831: # Update: Romain Lievin (roms@lpg.ticalc.org).
13832: #
13833: # NOTE: This list is not complete.
13834: # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
13835: # program/group magic numbers in here because I cannot find any.
13836: 0 string **TI80** TI-80 Graphing Calculator File.
13837: 0 string **TI81** TI-81 Graphing Calculator File.
13838: #
13839: # Magic Numbers for the TI-73
13840: #
13841: 0 string **TI73** TI-73 Graphing Calculator
13842: >0x00003B byte 0x00 (real number)
13843: >0x00003B byte 0x01 (list)
13844: >0x00003B byte 0x02 (matrix)
13845: >0x00003B byte 0x03 (equation)
13846: >0x00003B byte 0x04 (string)
13847: >0x00003B byte 0x05 (program)
13848: >0x00003B byte 0x06 (assembly program)
13849: >0x00003B byte 0x07 (picture)
13850: >0x00003B byte 0x08 (gdb)
13851: >0x00003B byte 0x0C (complex number)
13852: >0x00003B byte 0x0F (window settings)
13853: >0x00003B byte 0x10 (zoom)
13854: >0x00003B byte 0x11 (table setup)
13855: >0x00003B byte 0x13 (backup)
13856:
13857: # Magic Numbers for the TI-82
13858: #
13859: 0 string **TI82** TI-82 Graphing Calculator
13860: >0x00003B byte 0x00 (real)
13861: >0x00003B byte 0x01 (list)
13862: >0x00003B byte 0x02 (matrix)
13863: >0x00003B byte 0x03 (Y-variable)
13864: >0x00003B byte 0x05 (program)
13865: >0x00003B byte 0x06 (protected prgm)
13866: >0x00003B byte 0x07 (picture)
13867: >0x00003B byte 0x08 (gdb)
13868: >0x00003B byte 0x0B (window settings)
13869: >0x00003B byte 0x0C (window settings)
13870: >0x00003B byte 0x0D (table setup)
13871: >0x00003B byte 0x0E (screenshot)
13872: >0x00003B byte 0x0F (backup)
13873: #
13874: # Magic Numbers for the TI-83
13875: #
13876: 0 string **TI83** TI-83 Graphing Calculator
13877: >0x00003B byte 0x00 (real)
13878: >0x00003B byte 0x01 (list)
13879: >0x00003B byte 0x02 (matrix)
13880: >0x00003B byte 0x03 (Y-variable)
13881: >0x00003B byte 0x04 (string)
13882: >0x00003B byte 0x05 (program)
13883: >0x00003B byte 0x06 (protected prgm)
13884: >0x00003B byte 0x07 (picture)
13885: >0x00003B byte 0x08 (gdb)
13886: >0x00003B byte 0x0B (window settings)
13887: >0x00003B byte 0x0C (window settings)
13888: >0x00003B byte 0x0D (table setup)
13889: >0x00003B byte 0x0E (screenshot)
13890: >0x00003B byte 0x13 (backup)
13891: #
13892: # Magic Numbers for the TI-83+
13893: #
13894: 0 string **TI83F* TI-83+ Graphing Calculator
13895: >0x00003B byte 0x00 (real number)
13896: >0x00003B byte 0x01 (list)
13897: >0x00003B byte 0x02 (matrix)
13898: >0x00003B byte 0x03 (equation)
13899: >0x00003B byte 0x04 (string)
13900: >0x00003B byte 0x05 (program)
13901: >0x00003B byte 0x06 (assembly program)
13902: >0x00003B byte 0x07 (picture)
13903: >0x00003B byte 0x08 (gdb)
13904: >0x00003B byte 0x0C (complex number)
13905: >0x00003B byte 0x0F (window settings)
13906: >0x00003B byte 0x10 (zoom)
13907: >0x00003B byte 0x11 (table setup)
13908: >0x00003B byte 0x13 (backup)
13909: >0x00003B byte 0x15 (application variable)
13910: >0x00003B byte 0x17 (group of variable)
13911:
13912: #
13913: # Magic Numbers for the TI-85
13914: #
13915: 0 string **TI85** TI-85 Graphing Calculator
13916: >0x00003B byte 0x00 (real number)
13917: >0x00003B byte 0x01 (complex number)
13918: >0x00003B byte 0x02 (real vector)
13919: >0x00003B byte 0x03 (complex vector)
13920: >0x00003B byte 0x04 (real list)
13921: >0x00003B byte 0x05 (complex list)
13922: >0x00003B byte 0x06 (real matrix)
13923: >0x00003B byte 0x07 (complex matrix)
13924: >0x00003B byte 0x08 (real constant)
13925: >0x00003B byte 0x09 (complex constant)
13926: >0x00003B byte 0x0A (equation)
13927: >0x00003B byte 0x0C (string)
13928: >0x00003B byte 0x0D (function GDB)
13929: >0x00003B byte 0x0E (polar GDB)
13930: >0x00003B byte 0x0F (parametric GDB)
13931: >0x00003B byte 0x10 (diffeq GDB)
13932: >0x00003B byte 0x11 (picture)
13933: >0x00003B byte 0x12 (program)
13934: >0x00003B byte 0x13 (range)
13935: >0x00003B byte 0x17 (window settings)
13936: >0x00003B byte 0x18 (window settings)
13937: >0x00003B byte 0x19 (window settings)
13938: >0x00003B byte 0x1A (window settings)
13939: >0x00003B byte 0x1B (zoom)
13940: >0x00003B byte 0x1D (backup)
13941: >0x00003B byte 0x1E (unknown)
13942: >0x00003B byte 0x2A (equation)
13943: >0x000032 string ZS4 - ZShell Version 4 File.
13944: >0x000032 string ZS3 - ZShell Version 3 File.
13945: #
13946: # Magic Numbers for the TI-86
13947: #
13948: 0 string **TI86** TI-86 Graphing Calculator
13949: >0x00003B byte 0x00 (real number)
13950: >0x00003B byte 0x01 (complex number)
13951: >0x00003B byte 0x02 (real vector)
13952: >0x00003B byte 0x03 (complex vector)
13953: >0x00003B byte 0x04 (real list)
13954: >0x00003B byte 0x05 (complex list)
13955: >0x00003B byte 0x06 (real matrix)
13956: >0x00003B byte 0x07 (complex matrix)
13957: >0x00003B byte 0x08 (real constant)
13958: >0x00003B byte 0x09 (complex constant)
13959: >0x00003B byte 0x0A (equation)
13960: >0x00003B byte 0x0C (string)
13961: >0x00003B byte 0x0D (function GDB)
13962: >0x00003B byte 0x0E (polar GDB)
13963: >0x00003B byte 0x0F (parametric GDB)
13964: >0x00003B byte 0x10 (diffeq GDB)
13965: >0x00003B byte 0x11 (picture)
13966: >0x00003B byte 0x12 (program)
13967: >0x00003B byte 0x13 (range)
13968: >0x00003B byte 0x17 (window settings)
13969: >0x00003B byte 0x18 (window settings)
13970: >0x00003B byte 0x19 (window settings)
13971: >0x00003B byte 0x1A (window settings)
13972: >0x00003B byte 0x1B (zoom)
13973: >0x00003B byte 0x1D (backup)
13974: >0x00003B byte 0x1E (unknown)
13975: >0x00003B byte 0x2A (equation)
13976: #
13977: # Magic Numbers for the TI-89
13978: #
13979: 0 string **TI89** TI-89 Graphing Calculator
13980: >0x000048 byte 0x00 (expression)
13981: >0x000048 byte 0x04 (list)
13982: >0x000048 byte 0x06 (matrix)
13983: >0x000048 byte 0x0A (data)
13984: >0x000048 byte 0x0B (text)
13985: >0x000048 byte 0x0C (string)
13986: >0x000048 byte 0x0D (graphic data base)
13987: >0x000048 byte 0x0E (figure)
13988: >0x000048 byte 0x10 (picture)
13989: >0x000048 byte 0x12 (program)
13990: >0x000048 byte 0x13 (function)
13991: >0x000048 byte 0x14 (macro)
13992: >0x000048 byte 0x1C (zipped)
13993: >0x000048 byte 0x21 (assembler)
13994: #
13995: # Magic Numbers for the TI-92
13996: #
13997: 0 string **TI92** TI-92 Graphing Calculator
13998: >0x000048 byte 0x00 (expression)
13999: >0x000048 byte 0x04 (list)
14000: >0x000048 byte 0x06 (matrix)
14001: >0x000048 byte 0x0A (data)
14002: >0x000048 byte 0x0B (text)
14003: >0x000048 byte 0x0C (string)
14004: >0x000048 byte 0x0D (graphic data base)
14005: >0x000048 byte 0x0E (figure)
14006: >0x000048 byte 0x10 (picture)
14007: >0x000048 byte 0x12 (program)
14008: >0x000048 byte 0x13 (function)
14009: >0x000048 byte 0x14 (macro)
14010: >0x000048 byte 0x1D (backup)
14011: #
14012: # Magic Numbers for the TI-92+/V200
14013: #
14014: 0 string **TI92P* TI-92+/V200 Graphing Calculator
14015: >0x000048 byte 0x00 (expression)
14016: >0x000048 byte 0x04 (list)
14017: >0x000048 byte 0x06 (matrix)
14018: >0x000048 byte 0x0A (data)
14019: >0x000048 byte 0x0B (text)
14020: >0x000048 byte 0x0C (string)
14021: >0x000048 byte 0x0D (graphic data base)
14022: >0x000048 byte 0x0E (figure)
14023: >0x000048 byte 0x10 (picture)
14024: >0x000048 byte 0x12 (program)
14025: >0x000048 byte 0x13 (function)
14026: >0x000048 byte 0x14 (macro)
14027: >0x000048 byte 0x1C (zipped)
14028: >0x000048 byte 0x21 (assembler)
14029: #
14030: # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
14031: #
14032: 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
14033: 0 string **TIFL** TI-XX Graphing Calculator (FLASH)
14034: >8 byte >0 - Revision %d
14035: >>9 byte x \b.%d,
14036: >12 byte >0 Revision date %02x
14037: >>13 byte x \b/%02x
14038: >>14 beshort x \b/%04x,
14039: >17 string >/0 name: '%s',
14040: >48 byte 0x74 device: TI-73,
14041: >48 byte 0x73 device: TI-83+,
14042: >48 byte 0x98 device: TI-89,
14043: >48 byte 0x88 device: TI-92+,
14044: >49 byte 0x23 type: OS upgrade,
14045: >49 byte 0x24 type: application,
14046: >49 byte 0x25 type: certificate,
14047: >49 byte 0x3e type: license,
14048: >74 lelong >0 size: %ld bytes
14049:
14050: # VTi & TiEmu skins (TI Graphing Calculators).
14051: # From: Romain Lievin (roms@lpg.ticalc.org).
14052: # Magic Numbers for the VTi skins
14053: 0 string VTI Virtual TI skin
14054: >3 string v - Version
14055: >>4 byte >0 \b %c
14056: >>6 byte x \b.%c
14057: # Magic Numbers for the TiEmu skins
14058: 0 string TiEmu TiEmu skin
14059: >6 string v - Version
14060: >>7 byte >0 \b %c
14061: >>9 byte x \b.%c
14062: >>10 byte x \b%c
14063:
14064: #------------------------------------------------------------------------------
14065: # timezone: file(1) magic for timezone data
14066: #
14067: # from Daniel Quinlan (quinlan@yggdrasil.com)
14068: # this should work on Linux, SunOS, and maybe others
14069: # Added new official magic number for recent versions of the Olson code
14070: 0 string TZif timezone data
14071: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
14072: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
14073: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
14074: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
14075: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
14076: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
14077: #------------------------------------------------------------------------------
14078: # troff: file(1) magic for *roff
14079: #
14080: # updated by Daniel Quinlan (quinlan@yggdrasil.com)
14081:
14082: # troff input
14083: 0 search/1 .\\" troff or preprocessor input text
14084: !:mime text/troff
14085: 0 search/1 '\\" troff or preprocessor input text
14086: !:mime text/troff
14087: 0 search/1 '.\\" troff or preprocessor input text
14088: !:mime text/troff
14089: 0 search/1 \\" troff or preprocessor input text
14090: !:mime text/troff
14091: 0 search/1 ''' troff or preprocessor input text
14092: !:mime text/troff
14093:
14094: # ditroff intermediate output text
14095: 0 search/1 x\ T ditroff output text
14096: >4 search/1 cat for the C/A/T phototypesetter
14097: >4 search/1 ps for PostScript
14098: >4 search/1 dvi for DVI
14099: >4 search/1 ascii for ASCII
14100: >4 search/1 lj4 for LaserJet 4
14101: >4 search/1 latin1 for ISO 8859-1 (Latin 1)
14102: >4 search/1 X75 for xditview at 75dpi
14103: >>7 search/1 -12 (12pt)
14104: >4 search/1 X100 for xditview at 100dpi
14105: >>8 search/1 -12 (12pt)
14106:
14107: # output data formats
14108: 0 string \100\357 very old (C/A/T) troff output data
14109: #
14110: #------------------------------------------------------------------------------
14111: # tuxedo: file(1) magic for BEA TUXEDO data files
14112: #
14113: # from Ian Springer <ispringer@hotmail.com>
14114: #
14115: 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
14116:
14117: #------------------------------------------------------------------------------
14118: # typeset: file(1) magic for other typesetting
14119: #
14120: 0 string Interpress/Xerox Xerox InterPress data
14121: >16 string / (version
14122: >>17 string >\0 %s)
14123: #---------------------------------------------------------------------------
14124: # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
14125: # GRR: These types should be recognised in file_ascmagic so these
14126: # encodings can be treated by text patterns.
14127: # Missing types are already dealt with internally.
14128: #
14129: 0 string +/v8 Unicode text, UTF-7
14130: 0 string +/v9 Unicode text, UTF-7
14131: 0 string +/v+ Unicode text, UTF-7
14132: 0 string +/v/ Unicode text, UTF-7
14133: 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
14134: 0 string \376\377\000\000 Unicode text, UTF-32, big-endian
14135: 0 string \377\376\000\000 Unicode text, UTF-32, little-endian
14136: 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
14137:
14138: #------------------------------------------------------------------------------
14139: # unknown: file(1) magic for unknown machines
14140: #
14141: # XXX - this probably should be pruned, as it'll match PDP-11 and
14142: # VAX image formats.
14143: #
14144: # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
14145: # respectively).
14146: #
14147: # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
14148: # have the "version %ld", which may be a bogus COFFism (I don't think
14149: # there ever was COFF for the PDP-11).
14150: #
14151: # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
14152: # long, as it would be on a VAX.
14153: #
14154: # 0x10C is 0414 and 0x10E is 416; those *are* unknown.
14155: #
14156: 0 short 0x107 unknown machine executable
14157: >8 short >0 not stripped
14158: >15 byte >0 - version %ld
14159: 0 short 0x108 unknown pure executable
14160: >8 short >0 not stripped
14161: >15 byte >0 - version %ld
14162: 0 short 0x109 PDP-11 separate I&D
14163: >8 short >0 not stripped
14164: >15 byte >0 - version %ld
14165: 0 short 0x10b unknown pure executable
14166: >8 short >0 not stripped
14167: >15 byte >0 - version %ld
14168: 0 long 0x10c unknown demand paged pure executable
14169: >16 long >0 not stripped
14170: 0 long 0x10e unknown readable demand paged pure executable
14171: #------------------------------------------------------------------------------
14172: # uuencode: file(1) magic for ASCII-encoded files
14173: #
14174:
14175: # GRR: the first line of xxencoded files is identical to that in uuencoded
14176: # files, but the first character in most subsequent lines is 'h' instead of
14177: # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
14178: # punctuation and survives BITNET gateways better.) If regular expressions
14179: # were supported, this entry could possibly be split into two with
14180: # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
14181: 0 search/1 begin\ uuencoded or xxencoded text
14182:
14183: # btoa(1) is an alternative to uuencode that requires less space.
14184: 0 search/1 xbtoa\ Begin btoa'd text
14185:
14186: # ship(1) is another, much cooler alternative to uuencode.
14187: # Greg Roelofs, newt@uchicago.edu
14188: 0 search/1 $\012ship ship'd binary text
14189:
14190: # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
14191: # Greg Roelofs, newt@uchicago.edu
14192: 0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
14193:
14194: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
14195: # Daniel Quinlan, quinlan@yggdrasil.com
14196: 11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
14197: >41 search/1 x \b, version %.3s
14198:
14199: # GRR: handle BASE64
14200:
14201: #------------------------------------------------------------------------------
14202: # varied.out: file(1) magic for various USG systems
14203: #
14204: # Herewith many of the object file formats used by USG systems.
14205: # Most have been moved to files for a particular processor,
14206: # and deleted if they duplicate other entries.
14207: #
14208: 0 short 0610 Perkin-Elmer executable
14209: # AMD 29K
14210: 0 beshort 0572 amd 29k coff noprebar executable
14211: 0 beshort 01572 amd 29k coff prebar executable
14212: 0 beshort 0160007 amd 29k coff archive
14213: # Cray
14214: 6 beshort 0407 unicos (cray) executable
14215: # Ultrix 4.3
14216: 596 string \130\337\377\377 Ultrix core file
14217: >600 string >\0 from '%s'
14218: # BeOS and MAcOS PEF executables
14219: # From: hplus@zilker.net (Jon Watte)
14220: 0 string Joy!peffpwpc header for PowerPC PEF executable
14221: #
14222: # ava assembler/linker Uros Platise <uros.platise@ijs.si>
14223: 0 string avaobj AVR assembler object code
14224: >7 string >\0 version '%s'
14225: # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
14226: 0 string gmon GNU prof performance data
14227: >4 long x - version %ld
14228: # From: Dave Pearson <davep@davep.org>
14229: # Harbour <URL:http://www.harbour-project.org/> HRB files.
14230: 0 string \xc0HRB Harbour HRB file
14231: >4 short x version %d
14232:
14233: # From: Alex Beregszaszi <alex@fsn.hu>
14234: # 0 string exec BugOS executable
14235: # 0 string pack BugOS archive
14236:
14237: # From: Jason Spence <jspence@lightconsulting.com>
14238: # Generated by the "examples" in STM's ST40 devkit, and derived code.
14239: 0 lelong 0x13a9f17e ST40 component image format
14240: >4 string >\0 \b, name '%s'
14241:
14242: #------------------------------------------------------------------------------
14243: # varied.script: file(1) magic for various interpreter scripts
14244:
14245: 0 string #!\ / a
14246: >3 string >\0 %s script text executable
14247: 0 string #!\t/ a
14248: >3 string >\0 %s script text executable
14249: 0 string #!/ a
14250: >2 string >\0 %s script text executable
14251: 0 string #!\ script text executable
14252: >3 string >\0 for %s
14253:
14254: # From: arno <arenevier@fdn.fr>
14255: # mozilla xpconnect typelib
14256: # see http://www.mozilla.org/scriptable/typelib_file.html
14257: 0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
14258: >0x10 byte x version %d
14259: >>0x11 byte x \b.%d
14260:
14261: #------------------------------------------------------------------------------
14262: # vax: file(1) magic for VAX executable/object and APL workspace
14263: #
14264: 0 lelong 0101557 VAX single precision APL workspace
14265: 0 lelong 0101556 VAX double precision APL workspace
14266:
14267: #
14268: # VAX a.out (32V, BSD)
14269: #
14270: 0 lelong 0407 VAX executable
14271: >16 lelong >0 not stripped
14272:
14273: 0 lelong 0410 VAX pure executable
14274: >16 lelong >0 not stripped
14275:
14276: 0 lelong 0413 VAX demand paged pure executable
14277: >16 lelong >0 not stripped
14278:
14279: 0 lelong 0420 VAX demand paged (first page unmapped) pure executable
14280: >16 lelong >0 not stripped
14281:
14282: #
14283: # VAX COFF
14284: #
14285: # The `versions' should be un-commented if they work for you.
14286: # (Was the problem just one of endianness?)
14287: #
14288: 0 leshort 0570 VAX COFF executable
14289: >12 lelong >0 not stripped
14290: >22 leshort >0 - version %ld
14291: 0 leshort 0575 VAX COFF pure executable
14292: >12 lelong >0 not stripped
14293: >22 leshort >0 - version %ld
14294:
14295: #------------------------------------------------------------------------------
14296: # vicar: file(1) magic for VICAR files.
14297: #
14298: # From: Ossama Othman <othman@astrosun.tn.cornell.edu
14299: # VICAR is JPL's in-house spacecraft image processing program
14300: # VICAR image
14301: 0 string LBLSIZE= VICAR image data
14302: >32 string BYTE \b, 8 bits = VAX byte
14303: >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
14304: >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
14305: >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
14306: >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
14307: >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
14308: # VICAR label file
14309: 43 string SFDU_LABEL VICAR label file
14310: #------------------------------------------------------------------------------
14311: # Virtutech Compressed Random Access File Format
14312: #
14313: # From <gustav@virtutech.com>
14314: 0 string \211\277\036\203 Virtutech CRAFF
14315: >4 belong x v%d
14316: >20 belong 0 uncompressed
14317: >20 belong 1 bzipp2ed
14318: >20 belong 2 gzipped
14319: >24 belong 0 not clean
14320:
14321: #------------------------------------------------------------------------------
14322: # visx: file(1) magic for Visx format files
14323: #
14324: 0 short 0x5555 VISX image file
14325: >2 byte 0 (zero)
14326: >2 byte 1 (unsigned char)
14327: >2 byte 2 (short integer)
14328: >2 byte 3 (float 32)
14329: >2 byte 4 (float 64)
14330: >2 byte 5 (signed char)
14331: >2 byte 6 (bit-plane)
14332: >2 byte 7 (classes)
14333: >2 byte 8 (statistics)
14334: >2 byte 10 (ascii text)
14335: >2 byte 15 (image segments)
14336: >2 byte 100 (image set)
14337: >2 byte 101 (unsigned char vector)
14338: >2 byte 102 (short integer vector)
14339: >2 byte 103 (float 32 vector)
14340: >2 byte 104 (float 64 vector)
14341: >2 byte 105 (signed char vector)
14342: >2 byte 106 (bit plane vector)
14343: >2 byte 121 (feature vector)
14344: >2 byte 122 (feature vector library)
14345: >2 byte 124 (chain code)
14346: >2 byte 126 (bit vector)
14347: >2 byte 130 (graph)
14348: >2 byte 131 (adjacency graph)
14349: >2 byte 132 (adjacency graph library)
14350: >2 string .VISIX (ascii text)
14351:
14352: #------------------------------------------------------------------------------
14353: # vms: file(1) magic for VMS executables (experimental)
14354: #
14355: # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
14356:
14357: # GRR 950122: I'm just guessing on these, based on inspection of the headers
14358: # of three executables each for Alpha and VAX architectures. The VAX files
14359: # all had headers similar to this:
14360: #
14361: # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
14362: # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
14363: #
14364: 0 string \xb0\0\x30\0 VMS VAX executable
14365: >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
14366: #
14367: # The AXP files all looked like this, except that the byte at offset 0x22
14368: # was 06 in some of them and 07 in others:
14369: #
14370: # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
14371: # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
14372: # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14373: # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
14374: # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
14375: #
14376: 0 belong 0x03000000 VMS Alpha executable
14377: >75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
14378:
14379: # -----------------------------------------------------------
14380: # VMware specific files (deducted from version 1.1 and log file entries)
14381: # Anthon van der Neut (anthon@mnt.org)
14382: 0 belong 0x4d52564e VMware nvram
14383:
14384: #------------------------------------------------------------------------------
14385: # vorbis: file(1) magic for Ogg/Vorbis files
14386: #
14387: # From Felix von Leitner <leitner@fefe.de>
14388: # Extended by Beni Cherniavsky <cben@crosswinds.net>
14389: # Further extended by Greg Wooledge <greg@wooledge.org>
14390: #
14391: # Most (everything but the number of channels and bitrate) is commented
14392: # out with `##' as it's not interesting to the average user. The most
14393: # probable things advanced users would want to uncomment are probably
14394: # the number of comments and the encoder version.
14395: #
14396: # FIXME: The first match has been made a search, so that it can skip
14397: # over prepended ID3 tags. This will work for MIME type detection, but
14398: # won't work for detecting other properties of the file (they all need
14399: # to be made relative to the search). In any case, if the file has ID3
14400: # tags, the ID3 information will be printed, not the Ogg information,
14401: # so until that's fixed, this doesn't matter.
14402: # FIXME[2]: Disable the above for now, since search assumes text mode.
14403: #
14404: # --- Ogg Framing ---
14405: #0 search/1000 OggS Ogg data
14406: 0 string OggS Ogg data
14407: !:mime application/ogg
14408: >4 byte !0 UNKNOWN REVISION %u
14409: ##>4 byte 0 revision 0
14410: >4 byte 0
14411: ##>>14 lelong x (Serial %lX)
14412: # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
14413: >>28 string \x7fFLAC \b, FLAC audio
14414: # non-Vorbis content: Theora
14415: >>28 string \x80theora \b, Theora video
14416: # non-Vorbis content: Kate
14417: >>28 string \x80kate\0\0\0\0 \b, Kate
14418: >>>37 ubyte x v%u
14419: >>>38 ubyte x \b.%u,
14420: >>>40 byte 0 utf8 encoding,
14421: >>>40 byte !0 unknown character encoding,
14422: >>>60 string >\0 language %s,
14423: >>>60 string \0 no language set,
14424: >>>76 string >\0 category %s
14425: >>>76 string \0 no category set
14426: # non-Vorbis content: Skeleton
14427: >>28 string fishead\0 \b, Skeleton
14428: >>>36 short x v%u
14429: >>>40 short x \b.%u
14430: # non-Vorbis content: Speex
14431: >>28 string Speex\ \ \ \b, Speex audio
14432: # non-Vorbis content: OGM
14433: >>28 string \x01video\0\0\0 \b, OGM video
14434: >>>37 string/c div3 (DivX 3)
14435: >>>37 string/c divx (DivX 4)
14436: >>>37 string/c dx50 (DivX 5)
14437: >>>37 string/c xvid (XviD)
14438: # --- First vorbis packet - general header ---
14439: >>28 string \x01vorbis \b, Vorbis audio,
14440: >>>35 lelong !0 UNKNOWN VERSION %lu,
14441: ##>>>35 lelong 0 version 0,
14442: >>>35 lelong 0
14443: >>>>39 ubyte 1 mono,
14444: >>>>39 ubyte 2 stereo,
14445: >>>>39 ubyte >2 %u channels,
14446: >>>>40 lelong x %lu Hz
14447: # Minimal, nominal and maximal bitrates specified when encoding
14448: >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
14449: # The above tests if at least one of these is specified:
14450: >>>>>52 lelong !-1
14451: # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
14452: # instead of -1.
14453: # Vorbis 1.0 uses 0 instead of -1.
14454: >>>>>>52 lelong !0
14455: >>>>>>>52 lelong !-1000
14456: >>>>>>>>52 lelong x <%lu
14457: >>>>>48 lelong !-1
14458: >>>>>>48 lelong x ~%lu
14459: >>>>>44 lelong !-1
14460: >>>>>>44 lelong !-1000
14461: >>>>>>>44 lelong !0
14462: >>>>>>>>44 lelong x >%lu
14463: >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
14464: # -- Second vorbis header packet - the comments
14465: # A kludge to read the vendor string. It's a counted string, not a
14466: # zero-terminated one, so file(1) can't read it in a generic way.
14467: # libVorbis is the only one existing currently, so I detect specifically
14468: # it. The interesting value is the cvs date (8 digits decimal).
14469: # Post-RC1 Ogg files have the second header packet (and thus the version)
14470: # in a different place, so we must use an indirect offset.
14471: >>>(84.b+85) string \x03vorbis
14472: >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
14473: >>>>>(84.b+120) string >00000000
14474: # Map to beta version numbers:
14475: >>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
14476: >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
14477: >>>>>>(84.b+120) string >20000508
14478: >>>>>>>(84.b+120) string <20001031 (beta2-3)
14479: >>>>>>(84.b+120) string 20001031 (1.0 beta 3)
14480: >>>>>>(84.b+120) string >20001031
14481: >>>>>>>(84.b+120) string <20010225 (beta3-4)
14482: >>>>>>(84.b+120) string 20010225 (1.0 beta 4)
14483: >>>>>>(84.b+120) string >20010225
14484: >>>>>>>(84.b+120) string <20010615 (beta4-RC1)
14485: >>>>>>(84.b+120) string 20010615 (1.0 RC1)
14486: >>>>>>(84.b+120) string 20010813 (1.0 RC2)
14487: >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
14488: >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
14489: >>>>>>(84.b+120) string 20011217 (1.0 RC3)
14490: >>>>>>(84.b+120) string 20011231 (1.0 RC3)
14491: # Some pre-1.0 CVS snapshots still had "Xiphphorus"...
14492: >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
14493: # For the 1.0 release, Xiphophorus is replaced by Xiph.Org
14494: >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
14495: >>>>>(84.b+117) string >00000000
14496: >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
14497: >>>>>>(84.b+117) string 20020717 (1.0)
14498: >>>>>>(84.b+117) string 20030909 (1.0.1)
14499: >>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
14500:
14501: #------------------------------------------------------------------------------
14502: # VXL: file(1) magic for VXL binary IO data files
14503: #
14504: # from Ian Scott <scottim@sf.net>
14505: #
14506: # VXL is a collection of C++ libraries for Computer Vision.
14507: # See the vsl chapter in the VXL Book for more info
14508: # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
14509: # http:/vxl.sf.net
14510:
14511: 2 lelong 0x472b2c4e VXL data file,
14512: >0 leshort >0 schema version no %d
14513:
14514: #------------------------------------------------------------------------------
14515: # warc: file(1) magic for WARC files
14516:
14517: 0 string WARC/ WARC Archive
14518: >5 string x version %.4s
14519: #------------------------------------------------------------------------------
14520: # weak: file(1) magic for very weak magic entries, disabled by default
14521: #
14522: # These entries are so weak that they might interfere identification of
14523: # other formats. Example include:
14524: # - Only identify for 1 or 2 bytes
14525: # - Match against very wide range of values
14526: # - Match against generic word in some spoken languages (e.g. English)
14527:
14528: # Summary: Computer Graphics Metafile
14529: # Extension: .cgm
14530: #0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
14531: #0 beshort 0x3020 character Computer Graphics Metafile
14532:
14533: #0 string =!! Bennet Yee's "face" format
14534:
14535: #------------------------------------------------------------------------------
14536: # windows: file(1) magic for Microsoft Windows
14537: #
14538: # This file is mainly reserved for files where programs
14539: # using them are run almost always on MS Windows 3.x or
14540: # above, or files only used exclusively in Windows OS,
14541: # where there is no better category to allocate for.
14542: # For example, even though WinZIP almost run on Windows
14543: # only, it is better to treat them as "archive" instead.
14544: # For format usable in DOS, such as generic executable
14545: # format, please specify under "msdos" file.
14546: #
14547:
14548:
14549: # Summary: Outlook Express DBX file
14550: # Extension: .dbx
14551: # Created by: Christophe Monniez
14552: 0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
14553: >4 byte =0xC5 \b, message database
14554: >4 byte =0xC6 \b, folder database
14555: >4 byte =0xC7 \b, account information
14556: >4 byte =0x30 \b, offline database
14557:
14558:
14559: # Summary: Windows crash dump
14560: # Extension: .dmp
14561: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
14562: # Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
14563: # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
14564: 0 string PAGE
14565: >4 string DUMP MS Windows 32bit crash dump
14566: >>0x05c byte 0 \b, no PAE
14567: >>0x05c byte 1 \b, PAE
14568: >>0xf88 lelong 1 \b, full dump
14569: >>0xf88 lelong 2 \b, kernel dump
14570: >>0xf88 lelong 3 \b, small dump
14571: >>0x068 lelong x \b, %ld pages
14572: >4 string DU64 MS Windows 64bit crash dump
14573: >>0xf98 lelong 1 \b, full dump
14574: >>0xf98 lelong 2 \b, kernel dump
14575: >>0xf98 lelong 3 \b, small dump
14576: >>0x090 lequad x \b, %lld pages
14577:
14578:
14579: # Summary: Vista Event Log
14580: # Extension: .evtx
14581: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
14582: # Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
14583: 0 string ElfFile\0 MS Windows Vista Event Log
14584: >0x2a leshort x \b, %d chunks
14585: >>0x10 lelong x \b (no. %d in use)
14586: >0x18 lelong >1 \b, next record no. %d
14587: >0x18 lelong =1 \b, empty
14588: >0x78 lelong &1 \b, DIRTY
14589: >0x78 lelong &2 \b, FULL
14590:
14591:
14592: # Summary: Windows 3.1 group files
14593: # Extension: .grp
14594: # Created by: unknown
14595: 0 string \120\115\103\103 MS Windows 3.1 group files
14596:
14597:
14598: # Summary: Old format help files
14599: # Extension: .hlp
14600: # Created by: Dirk Jagdmann <doj@cubic.org>
14601: 0 lelong 0x00035f3f MS Windows 3.x help file
14602:
14603:
14604: # Summary: Hyper terminal
14605: # Extension: .ht
14606: # Created by: unknown
14607: 0 string HyperTerminal\
14608: >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
14609:
14610:
14611: # Summary: Windows shortcut
14612: # Extension: .lnk
14613: # Created by: unknown
14614: 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
14615:
14616:
14617: # Summary: Outlook Personal Folders
14618: # Created by: unknown
14619: 0 lelong 0x4E444221 Microsoft Outlook email folder
14620: >10 leshort 0x0e (<=2002)
14621: >10 leshort 0x17 (>=2003)
14622:
14623:
14624: # Summary: Windows help cache
14625: # Created by: unknown
14626: 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
14627:
14628:
14629: # Summary: IE cache file
14630: # Created by: Christophe Monniez
14631: 0 string Client\ UrlCache\ MMF Internet Explorer cache file
14632: >20 string >\0 version %s
14633:
14634:
14635: # Summary: Registry files
14636: # Created by: unknown
14637: # Modified by (1): Joerg Jenderek
14638: 0 string regf MS Windows registry file, NT/2000 or above
14639: 0 string CREG MS Windows 95/98/ME registry file
14640: 0 string SHCC3 MS Windows 3.1 registry file
14641:
14642:
14643: # Summary: Windows Registry text
14644: # Extension: .reg
14645: # Submitted by: Abel Cheung <abelcheung@gmail.com>
14646: 0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
14647: 0 string Windows\ Registry\ Editor\
14648: >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
14649: #------------------------------------------------------------------------------
14650: # wordprocessors: file(1) magic fo word processors.
14651: #
14652: ####### PWP file format used on Smith Corona Personal Word Processors:
14653: 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
14654: >24 byte 2 \b, single spaced
14655: >24 byte 3 \b, 1.5 spaced
14656: >24 byte 4 \b, double spaced
14657: >25 byte 0x42 \b, letter
14658: >25 byte 0x54 \b, legal
14659: >26 byte 0x46 \b, A4
14660:
14661: #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
14662: 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
14663: >15 byte 0 Optimized for Intel
14664: >15 byte 1 Optimized for Non-Intel
14665: 1 string WPC (Corel/WP)
14666: >8 short 257 WordPerfect macro
14667: >8 short 258 WordPerfect help file
14668: >8 short 259 WordPerfect keyboard file
14669: >8 short 266 WordPerfect document
14670: >8 short 267 WordPerfect dictionary
14671: >8 short 268 WordPerfect thesaurus
14672: >8 short 269 WordPerfect block
14673: >8 short 270 WordPerfect rectangular block
14674: >8 short 271 WordPerfect column block
14675: >8 short 272 WordPerfect printer data
14676: >8 short 275 WordPerfect printer data
14677: >8 short 276 WordPerfect driver resource data
14678: >8 short 279 WordPerfect hyphenation code
14679: >8 short 280 WordPerfect hyphenation data
14680: >8 short 281 WordPerfect macro resource data
14681: >8 short 283 WordPerfect hyphenation lex
14682: >8 short 285 WordPerfect wordlist
14683: >8 short 286 WordPerfect equation resource data
14684: >8 short 289 WordPerfect spell rules
14685: >8 short 290 WordPerfect dictionary rules
14686: >8 short 295 WordPerfect spell rules (Microlytics)
14687: >8 short 299 WordPerfect settings file
14688: >8 short 301 WordPerfect 4.2 document
14689: >8 short 325 WordPerfect dialog file
14690: >8 short 332 WordPerfect button bar
14691: >8 short 513 Shell macro
14692: >8 short 522 Shell definition
14693: >8 short 769 Notebook macro
14694: >8 short 770 Notebook help file
14695: >8 short 771 Notebook keyboard file
14696: >8 short 778 Notebook definition
14697: >8 short 1026 Calculator help file
14698: >8 short 1538 Calendar help file
14699: >8 short 1546 Calendar data file
14700: >8 short 1793 Editor macro
14701: >8 short 1794 Editor help file
14702: >8 short 1795 Editor keyboard file
14703: >8 short 1817 Editor macro resource file
14704: >8 short 2049 Macro editor macro
14705: >8 short 2050 Macro editor help file
14706: >8 short 2051 Macro editor keyboard file
14707: >8 short 2305 PlanPerfect macro
14708: >8 short 2306 PlanPerfect help file
14709: >8 short 2307 PlanPerfect keyboard file
14710: >8 short 2314 PlanPerfect worksheet
14711: >8 short 2319 PlanPerfect printer definition
14712: >8 short 2322 PlanPerfect graphic definition
14713: >8 short 2323 PlanPerfect data
14714: >8 short 2324 PlanPerfect temporary printer
14715: >8 short 2329 PlanPerfect macro resource data
14716: >8 byte 11 Mail
14717: >8 short 2818 help file
14718: >8 short 2821 distribution list
14719: >8 short 2826 out box
14720: >8 short 2827 in box
14721: >8 short 2836 users archived mailbox
14722: >8 short 2837 archived message database
14723: >8 short 2838 archived attachments
14724: >8 short 3083 Printer temporary file
14725: >8 short 3330 Scheduler help file
14726: >8 short 3338 Scheduler in file
14727: >8 short 3339 Scheduler out file
14728: >8 short 3594 GroupWise settings file
14729: >8 short 3601 GroupWise directory services
14730: >8 short 3627 GroupWise settings file
14731: >8 short 4362 Terminal resource data
14732: >8 short 4363 Terminal resource data
14733: >8 short 4395 Terminal resource data
14734: >8 short 4619 GUI loadable text
14735: >8 short 4620 graphics resource data
14736: >8 short 4621 printer settings file
14737: >8 short 4622 port definition file
14738: >8 short 4623 print queue parameters
14739: >8 short 4624 compressed file
14740: >8 short 5130 Network service msg file
14741: >8 short 5131 Network service msg file
14742: >8 short 5132 Async gateway login msg
14743: >8 short 5134 GroupWise message file
14744: >8 short 7956 GroupWise admin domain database
14745: >8 short 7957 GroupWise admin host database
14746: >8 short 7959 GroupWise admin remote host database
14747: >8 short 7960 GroupWise admin ADS deferment data file
14748: >8 short 8458 IntelliTAG (SGML) compiled DTD
14749: >8 long 18219264 WordPerfect graphic image (1.0)
14750: >8 long 18219520 WordPerfect graphic image (2.0)
14751: #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
14752:
14753: # Hangul (Korean) Word Processor File
14754: 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
14755: # From: Won-Kyu Park <wkpark@kldp.org>
14756: 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
14757: !:mime application/x-hwp
14758:
14759: # CosmicBook, from Benoît Rouits
14760: 0 string CSBK Ted Neslson's CosmicBook hypertext file
14761:
14762: 2 string EYWR AmigaWriter file
14763:
14764: # chi: file(1) magic for ChiWriter files
14765: 0 string \\1cw\ ChiWriter file
14766: >5 string >\0 version %s
14767: 0 string \\1cw ChiWriter file
14768:
14769: # Quark Express from http://www.garykessler.net/library/file_sigs.html
14770: 2 string IIXPR3 Intel Quark Express Document (English)
14771: 2 string IIXPRa Intel Quark Express Document (Korean)
14772: 2 string MMXPR3 Motorola Quark Express Document (English)
14773: !:mime application/x-quark-xpress-3
14774: 2 string MMXPRa Motorola Quark Express Document (Korean)
14775:
14776: # adobe indesign (document, whatever...) from querkan
14777: 0 belong 0x0606edf5 Adobe InDesign
14778: >16 string DOCUMENT Document
14779:
14780: #------------------------------------------------------------------------------
14781: # ichitaro456: file(1) magic for Just System Word Processor Ichitaro
14782: #
14783: # Contributor kenzo-:
14784: # Reversed-engineered JS Ichitaro magic numbers
14785: #
14786:
14787: 0 string DOC
14788: >43 byte 0x14 Just System Word Processor Ichitaro v4
14789: !:mime application/x-ichitaro4
14790: >144 string JDASH application/x-ichitaro4
14791:
14792: 0 string DOC
14793: >43 byte 0x15 Just System Word Processor Ichitaro v5
14794: !:mime application/x-ichitaro5
14795:
14796: 0 string DOC
14797: >43 byte 0x16 Just System Word Processor Ichitaro v6
14798: !:mime application/x-ichitaro6
14799:
14800: # Type: Freemind mindmap documents
14801: # From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
14802: 0 string/cB \<map\ version Freemind document
14803: !:mime application/x-freemind
14804:
14805: # Type: Scribus
14806: # From: Werner Fink <werner@suse.de>
14807: 0 string \<SCRIBUSUTF8\ Version Scribus Document
14808: 0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
14809: !:mime application/x-scribus
14810:
14811: #------------------------------------------------------------------------------
14812: # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
14813: #
14814: 0 string %XDELTA% XDelta binary patch file 0.14
14815: 0 string %XDZ000% XDelta binary patch file 0.18
14816: 0 string %XDZ001% XDelta binary patch file 0.20
14817: 0 string %XDZ002% XDelta binary patch file 1.0
14818: 0 string %XDZ003% XDelta binary patch file 1.0.4
14819: 0 string %XDZ004% XDelta binary patch file 1.1
14820:
14821: #------------------------------------------------------------------------------
14822: # xenix: file(1) magic for Microsoft Xenix
14823: #
14824: # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
14825: # model" lifted from "magic.xenix", with comment "derived empirically;
14826: # treat as folklore until proven"
14827: #
14828: # "small model", "large model", "huge model" stuff lifted from XXX
14829: #
14830: # XXX - "x.out" collides with PDP-11 archives
14831: #
14832: 0 string core core file (Xenix)
14833: 0 byte 0x80 8086 relocatable (Microsoft)
14834: 0 leshort 0xff65 x.out
14835: >2 string __.SYMDEF randomized
14836: >0 byte x archive
14837: 0 leshort 0x206 Microsoft a.out
14838: >8 leshort 1 Middle model
14839: >0x1e leshort &0x10 overlay
14840: >0x1e leshort &0x2 separate
14841: >0x1e leshort &0x4 pure
14842: >0x1e leshort &0x800 segmented
14843: >0x1e leshort &0x400 standalone
14844: >0x1e leshort &0x8 fixed-stack
14845: >0x1c byte &0x80 byte-swapped
14846: >0x1c byte &0x40 word-swapped
14847: >0x10 lelong >0 not-stripped
14848: >0x1e leshort ^0xc000 pre-SysV
14849: >0x1e leshort &0x4000 V2.3
14850: >0x1e leshort &0x8000 V3.0
14851: >0x1c byte &0x4 86
14852: >0x1c byte &0xb 186
14853: >0x1c byte &0x9 286
14854: >0x1c byte &0xa 386
14855: >0x1f byte <0x040 small model
14856: >0x1f byte =0x048 large model
14857: >0x1f byte =0x049 huge model
14858: >0x1e leshort &0x1 executable
14859: >0x1e leshort ^0x1 object file
14860: >0x1e leshort &0x40 Large Text
14861: >0x1e leshort &0x20 Large Data
14862: >0x1e leshort &0x120 Huge Objects Enabled
14863: >0x10 lelong >0 not stripped
14864:
14865: 0 leshort 0x140 old Microsoft 8086 x.out
14866: >0x3 byte &0x4 separate
14867: >0x3 byte &0x2 pure
14868: >0 byte &0x1 executable
14869: >0 byte ^0x1 relocatable
14870: >0x14 lelong >0 not stripped
14871:
14872: 0 lelong 0x206 b.out
14873: >0x1e leshort &0x10 overlay
14874: >0x1e leshort &0x2 separate
14875: >0x1e leshort &0x4 pure
14876: >0x1e leshort &0x800 segmented
14877: >0x1e leshort &0x400 standalone
14878: >0x1e leshort &0x1 executable
14879: >0x1e leshort ^0x1 object file
14880: >0x1e leshort &0x4000 V2.3
14881: >0x1e leshort &0x8000 V3.0
14882: >0x1c byte &0x4 86
14883: >0x1c byte &0xb 186
14884: >0x1c byte &0x9 286
14885: >0x1c byte &0x29 286
14886: >0x1c byte &0xa 386
14887: >0x1e leshort &0x4 Large Text
14888: >0x1e leshort &0x2 Large Data
14889: >0x1e leshort &0x102 Huge Objects Enabled
14890:
14891: 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
14892:
14893: #------------------------------------------------------------------------------
14894: # This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
14895: # Xilinx-Magic@RevRagnarok.com
14896: # Got the info from FPGA-FAQ 0026
14897: #
14898: # First there is the sync header and its length
14899: 0 beshort 0x0009
14900: >2 belong =0x0ff00ff0
14901: >>&0 belong =0x0ff00ff0
14902: >>>&0 beshort =0x0000
14903: >>>>&0 pstring a Xilinx BIT data
14904: # Next is a Pascal-style string with the NCD name. We want to capture that.
14905: >>>>0x0F pstring x - from %s
14906: # It is followed by a NUL
14907: >>>>>&1 byte 0x00
14908: # And then 'b'
14909: >>>>>&2 string b
14910: # With the part number:
14911: #>>>>>&5 string 4v (Virtex4)
14912: #>>>>>&5 string 2v (Virtex II
14913: #>>>>>>&0 string !p \b)
14914: #>>>>>>&0 string p Pro)
14915: >>>>>&4 pstring x - for %s
14916: # And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
14917: >>>>>>&1 byte 0x00
14918: >>>>>>&2 string c
14919: >>>>>>&4 pstring x - built %s
14920: >>>>>>>&1 byte 0x00
14921: >>>>>>>&2 string d
14922: >>>>>>>&4 pstring x \b(%s)
14923: >>>>>>>>&1 byte 0x00
14924: >>>>>>>>&2 string e
14925: >>>>>>>>&4 belong x - data length 0x%lx
14926:
14927: #------------------------------------------------------------------------------
14928: # xo65 object files
14929: # From: "Ullrich von Bassewitz" <uz@cc65.org>
14930: #
14931: 0 string \x55\x7A\x6E\x61 xo65 object,
14932: >4 leshort x version %d,
14933: >6 leshort&0x0001 =0x0001 with debug info
14934: >6 leshort&0x0001 =0x0000 no debug info
14935:
14936: # xo65 library files
14937: 0 string \x6E\x61\x55\x7A xo65 library,
14938: >4 leshort x version %d
14939:
14940: # o65 object files
14941: 0 string \x01\x00\x6F\x36\x35 o65
14942: >6 leshort&0x1000 =0x0000 executable,
14943: >6 leshort&0x1000 =0x1000 object,
14944: >5 byte x version %d,
14945: >6 leshort&0x8000 =0x8000 65816,
14946: >6 leshort&0x8000 =0x0000 6502,
14947: >6 leshort&0x2000 =0x2000 32 bit,
14948: >6 leshort&0x2000 =0x0000 16 bit,
14949: >6 leshort&0x4000 =0x4000 page reloc,
14950: >6 leshort&0x4000 =0x0000 byte reloc,
14951: >6 leshort&0x0003 =0x0000 alignment 1
14952: >6 leshort&0x0003 =0x0001 alignment 2
14953: >6 leshort&0x0003 =0x0002 alignment 4
14954: >6 leshort&0x0003 =0x0003 alignment 256
14955:
14956: #------------------------------------------------------------------------------
14957: # xwindows: file(1) magic for various X/Window system file formats.
14958:
14959: # Compiled X Keymap
14960: # XKM (compiled X keymap) files (including version and byte ordering)
14961: 1 string mkx Compiled XKB Keymap: lsb,
14962: >0 byte >0 version %d
14963: >0 byte =0 obsolete
14964: 0 string xkm Compiled XKB Keymap: msb,
14965: >3 byte >0 version %d
14966: >0 byte =0 obsolete
14967:
14968: # xfsdump archive
14969: 0 string xFSdump0 xfsdump archive
14970: >8 belong x (version %d)
14971:
14972: # Jaleo XFS files
14973: 0 long 395726 Jaleo XFS file
14974: >4 long x - version %ld
14975: >8 long x - [%ld -
14976: >20 long x %ldx
14977: >24 long x %ldx
14978: >28 long 1008 YUV422]
14979: >28 long 1000 RGB24]
14980:
14981: #------------------------------------------------------------------------------
14982: # zilog: file(1) magic for Zilog Z8000.
14983: #
14984: # Was it big-endian or little-endian? My Product Specification doesn't
14985: # say.
14986: #
14987: 0 long 0xe807 object file (z8000 a.out)
14988: 0 long 0xe808 pure object file (z8000 a.out)
14989: 0 long 0xe809 separate object file (z8000 a.out)
14990: 0 long 0xe805 overlay object file (z8000 a.out)
14991:
14992: #------------------------------------------------------------------------------
14993: # zyxel: file(1) magic for ZyXEL modems
14994: #
14995: # From <rob@pe1chl.ampr.org>
14996: # These are the /etc/magic entries to decode datafiles as used for the
14997: # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
14998: # ZyXEL-defined standard)
14999:
15000: 0 string ZyXEL\002 ZyXEL voice data
15001: >10 byte 0 - CELP encoding
15002: >10 byte&0x0B 1 - ADPCM2 encoding
15003: >10 byte&0x0B 2 - ADPCM3 encoding
15004: >10 byte&0x0B 3 - ADPCM4 encoding
15005: >10 byte&0x0B 8 - New ADPCM3 encoding
15006: >10 byte&0x04 4 with resync
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to magic CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / ext / fileinfo / tests