Annotation of embedaddon/php/ext/fileinfo/tests/magic, revision 1.1.1.2
1.1 misho 1:
2: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3: # $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $
1.1 misho 4: # acorn: file(1) magic for files found on Acorn systems
5: #
6:
7: # RISC OS Chunk File Format
8: # From RISC OS Programmer's Reference Manual, Appendix D
9: # We guess the file type from the type of the first chunk.
10: 0 lelong 0xc3cbc6c5 RISC OS Chunk data
11: >12 string OBJ_ \b, AOF object
12: >12 string LIB_ \b, ALF library
13:
14: # RISC OS AIF, contains "SWI OS_Exit" at offset 16.
15: 16 lelong 0xef000011 RISC OS AIF executable
16:
17: # RISC OS Draw files
18: # From RISC OS Programmer's Reference Manual, Appendix E
19: 0 string Draw RISC OS Draw file data
20:
21: # RISC OS new format font files
22: # From RISC OS Programmer's Reference Manual, Appendix E
23: 0 string FONT\0 RISC OS outline font data,
24: >5 byte x version %d
25: 0 string FONT\1 RISC OS 1bpp font data,
26: >5 byte x version %d
27: 0 string FONT\4 RISC OS 4bpp font data
28: >5 byte x version %d
29:
30: # RISC OS Music files
31: # From RISC OS Programmer's Reference Manual, Appendix E
32: 0 string Maestro\r RISC OS music file
33: >8 byte x version %d
34:
35: >8 byte x type %d
36:
37: # Digital Symphony data files
38: # From: Bernard Jungen (bern8817@euphonynet.be)
39: 0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
40: >8 byte x version %d,
41: >9 pstring x named "%s",
42: >(9.b+19) byte =0 8-bit logarithmic
43: >(9.b+19) byte =1 LZW-compressed linear
44: >(9.b+19) byte =2 8-bit linear signed
45: >(9.b+19) byte =3 16-bit linear signed
46: >(9.b+19) byte =4 SigmaDelta-compressed linear
47: >(9.b+19) byte =5 SigmaDelta-compressed logarithmic
48: >(9.b+19) byte >5 unknown format
49:
50: 0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
51: >8 byte x version %d,
52: >9 byte =1 1 voice,
53: >9 byte !1 %d voices,
54: >10 leshort =1 1 track,
55: >10 leshort !1 %d tracks,
56: >12 leshort =1 1 pattern
57: >12 leshort !1 %d patterns
58:
59: 0 string \x02\x01\x13\x13\x10\x14\x12\x0e
60: >9 byte =0 Digital Symphony sequence (RISC OS),
61: >>8 byte x version %d,
62: >>10 byte =1 1 line,
63: >>10 byte !1 %d lines,
64: >>11 leshort =1 1 position
65: >>11 leshort !1 %d positions
66: >9 byte =1 Digital Symphony pattern data (RISC OS),
67: >>8 byte x version %d,
68: >>10 leshort =1 1 pattern
69: >>10 leshort !1 %d patterns
70:
71: #------------------------------------------------------------------------------
1.1.1.2 ! misho 72: # $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
1.1 misho 73: # adi: file(1) magic for ADi's objects
74: # From Gregory McGarry <g.mcgarry@ieee.org>
75: #
76: 0 leshort 0x521c COFF DSP21k
77: >18 lelong &02 executable,
78: >18 lelong ^02
79: >>18 lelong &01 static object,
80: >>18 lelong ^01 relocatable object,
81: >18 lelong &010 stripped
82: >18 lelong ^010 not stripped
83:
84: #------------------------------------------------------------------------------
1.1.1.2 ! misho 85: # $File: adventure,v 1.10 2009/09/19 16:28:07 christos Exp $
1.1 misho 86: # adventure: file(1) magic for Adventure game files
87: #
88: # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
89: # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
90: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
91: #
92: # ALAN
93: # I assume there are other, lower versions, but these are the only ones I
94: # saw in the archive.
95: 0 beshort 0x0206 ALAN game data
96: >2 byte <10 version 2.6%d
97:
98:
99: # Infocom (see z-machine)
100: #------------------------------------------------------------------------------
101: # Z-machine: file(1) magic for Z-machine binaries.
102: #
1.1.1.2 ! misho 103: # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
1.1 misho 104: #
1.1.1.2 ! misho 105: # The first byte is the Z-machine revision; it is always between 1 and 8. We
! 106: # had false matches (for instance, inbig5.ocp from the Omega TeX extension as
! 107: # well as an occasional MP3 file), so we sanity-check the version number.
! 108: #
! 109: # It might be possible to sanity-check the release number as well, as it seems
! 110: # (at least in classic Infocom games) to always be a relatively small number,
! 111: # always under 150 or so, but as this isn't rigorous, we'll wait on that until
! 112: # it becomes clear that it's needed.
! 113: #
! 114: 0 ubyte >0
! 115: >0 ubyte <9
! 116: >>16 belong&0xfe00f0f0 0x3030 Infocom game data
! 117: >>>0 ubyte x (Z-machine %d,
! 118: >>>>2 ubeshort x Release %d /
! 119: >>>>18 string >\0 Serial %.6s)
1.1 misho 120:
121: #------------------------------------------------------------------------------
122: # Glulx: file(1) magic for Glulx binaries.
123: #
124: # I haven't checked for false matches yet.
125: #
126: 0 string Glul Glulx game data
127: >4 beshort x (Version %d
128: >>6 byte x \b.%d
129: >>8 byte x \b.%d)
130: >36 string Info Compiled by Inform
131:
132:
133:
134: # For Quetzal and blorb magic see iff
135:
136:
137: # TADS (Text Adventure Development System)
138: # All files are machine-independent (games compile to byte-code) and are tagged
139: # with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
140: # on the way).
141: # Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
142: 0 string TADS2\ bin TADS
143: >9 belong !0x0A0D1A00 game data, CORRUPTED
144: >9 belong 0x0A0D1A00
145: >>13 string >\0 %s game data
146: # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
147: 0 string TADS2\ rsc TADS
148: >9 belong !0x0A0D1A00 resource data, CORRUPTED
149: >9 belong 0x0A0D1A00
150: >>13 string >\0 %s resource data
151: # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
152: # 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
153: # "TADS2 save\n\r\032\0" and the interpreter version.
154: 0 string TADS2\ save/g TADS
155: >12 belong !0x0A0D1A00 saved game data, CORRUPTED
156: >12 belong 0x0A0D1A00
157: >>(16.s+32) string >\0 %s saved game data
158: # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
159: # version.
160: 0 string TADS2\ save TADS
161: >10 belong !0x0A0D1A00 saved game data, CORRUPTED
162: >10 belong 0x0A0D1A00
163: >>14 string >\0 %s saved game data
164:
165: # Danny Milosavljevic <danny.milo@gmx.net>
166: # this are adrift (adventure game standard) game files, extension .taf
167: # depending on version magic continues with 0x93453E6139FA (V 4.0)
168: # 0x9445376139FA (V 3.90)
169: # 0x9445366139FA (V 3.80)
170: # this is from source (http://www.adrift.org.uk/) and I have some taf
171: # files, and checked them.
172: #0 belong 0x3C423FC9
173: #>4 belong 0x6A87C2CF Adrift game file
174: #!:mime application/x-adrift
1.1.1.2 ! misho 175:
1.1 misho 176: #------------------------------------------------------------------------------
1.1.1.2 ! misho 177: # $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
1.1 misho 178: # allegro: file(1) magic for Allegro datafiles
179: # Toby Deshane <hac@shoelace.digivill.net>
180: #
181: 0 belong 0x736C6821 Allegro datafile (packed)
182: 0 belong 0x736C682E Allegro datafile (not packed/autodetect)
183: 0 belong 0x736C682B Allegro datafile (appended exe data)
184:
185: #------------------------------------------------------------------------------
1.1.1.2 ! misho 186: # $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
1.1 misho 187: # alliant: file(1) magic for Alliant FX series a.out files
188: #
189: # If the FX series is the one that had a processor with a 68K-derived
190: # instruction set, the "short" should probably become "beshort" and the
191: # "long" should probably become "belong".
192: # If it's the i860-based one, they should probably become either the
193: # big-endian or little-endian versions, depending on the mode they ran
194: # the 860 in....
195: #
196: 0 short 0420 0420 Alliant virtual executable
197: >2 short &0x0020 common library
198: >16 long >0 not stripped
199: 0 short 0421 0421 Alliant compact executable
200: >2 short &0x0020 common library
201: >16 long >0 not stripped
1.1.1.2 ! misho 202:
1.1 misho 203: #------------------------------------------------------------------------------
1.1.1.2 ! misho 204: # $File: alpha,v 1.7 2009/09/19 16:28:07 christos Exp $
1.1 misho 205: # alpha architecture description
206: #
207:
208: 0 leshort 0603 COFF format alpha
209: >22 leshort&030000 !020000 executable
210: >24 leshort 0410 pure
211: >24 leshort 0413 paged
212: >22 leshort&020000 !0 dynamically linked
213: >16 lelong !0 not stripped
214: >16 lelong 0 stripped
215: >22 leshort&030000 020000 shared library
216: >24 leshort 0407 object
217: >27 byte x - version %d
218: >26 byte x .%d
219: >28 byte x -%d
220:
221: # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
222: #
223: # The actual magic number is just "Core", followed by a 2-byte version
224: # number; however, treating any file that begins with "Core" as a Digital
225: # UNIX core dump file may produce too many false hits, so we include one
226: # byte of the version number as well; DU 5.0 appears only to be up to
227: # version 2.
228: #
229: 0 string Core\001 Alpha COFF format core dump (Digital UNIX)
230: >24 string >\0 \b, from '%s'
231: 0 string Core\002 Alpha COFF format core dump (Digital UNIX)
232: >24 string >\0 \b, from '%s'
233:
1.1.1.2 ! misho 234:
1.1 misho 235: #------------------------------------------------------------------------------
1.1.1.2 ! misho 236: # $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
1.1 misho 237: # amanda: file(1) magic for amanda file format
238: #
239: 0 string AMANDA:\ AMANDA
240: >8 string TAPESTART\ DATE tape header file,
241: >>23 string X
242: >>>25 string >\ Unused %s
243: >>23 string >\ DATE %s
244: >8 string FILE\ dump file,
245: >>13 string >\ DATE %s
1.1.1.2 ! misho 246:
1.1 misho 247: #------------------------------------------------------------------------------
1.1.1.2 ! misho 248: # $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $
1.1 misho 249: # amigaos: file(1) magic for AmigaOS binary formats:
250:
251: #
252: # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
253: #
254: 0 belong 0x000003fa AmigaOS shared library
255: 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
256: 0 belong 0x000003e7 AmigaOS object/library data
257: #
258: 0 beshort 0xe310 Amiga Workbench
259: >2 beshort 1
260: >>48 byte 1 disk icon
261: >>48 byte 2 drawer icon
262: >>48 byte 3 tool icon
263: >>48 byte 4 project icon
264: >>48 byte 5 garbage icon
265: >>48 byte 6 device icon
266: >>48 byte 7 kickstart icon
267: >>48 byte 8 workbench application icon
268: >2 beshort >1 icon, vers. %d
269: #
270: # various sound formats from the Amiga
271: # G=F6tz Waschk <waschk@informatik.uni-rostock.de>
272: #
273: 0 string FC14 Future Composer 1.4 Module sound file
274: 0 string SMOD Future Composer 1.3 Module sound file
275: 0 string AON4artofnoise Art Of Noise Module sound file
276: 1 string MUGICIAN/SOFTEYES Mugician Module sound file
277: 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
278: 0 string Synth4.0 Synthesis Module sound file
279: 0 string ARP. The Holy Noise Module sound file
280: 0 string BeEp\0 JamCracker Module sound file
281: 0 string COSO\0 Hippel-COSO Module sound file
282: # Too simple (short, pure ASCII, deep), MPi
283: #26 string V.3 Brian Postma's Soundmon Module sound file v3
284: #26 string BPSM Brian Postma's Soundmon Module sound file v3
285: #26 string V.2 Brian Postma's Soundmon Module sound file v2
286:
287: # The following are from: "Stefan A. Haubenthal" <polluks@web.de>
288: 0 beshort 0x0f00 AmigaOS bitmap font
289: 0 beshort 0x0f03 AmigaOS outline font
290: 0 belong 0x80001001 AmigaOS outline tag
291: 0 string ##\ version catalog translation
292: 0 string EMOD\0 Amiga E module
293: 8 string ECXM\0 ECX module
294: 0 string/c @database AmigaGuide file
295:
296: # Amiga disk types
297: #
298: 0 string RDSK Rigid Disk Block
299: >160 string x on %.24s
300: 0 string DOS\0 Amiga DOS disk
301: 0 string DOS\1 Amiga FFS disk
302: 0 string DOS\2 Amiga Inter DOS disk
303: 0 string DOS\3 Amiga Inter FFS disk
304: 0 string DOS\4 Amiga Fastdir DOS disk
305: 0 string DOS\5 Amiga Fastdir FFS disk
306: 0 string KICK Kickstart disk
307:
308: # From: Alex Beregszaszi <alex@fsn.hu>
309: 0 string LZX LZX compressed archive (Amiga)
310:
311:
312: #------------------------------------------------------------------------------
1.1.1.2 ! misho 313: # $File: animation,v 1.39 2009/09/27 19:02:12 christos Exp $
1.1 misho 314: # animation: file(1) magic for animation/movie formats
315: #
316: # animation formats
317: # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
318: # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
319:
320: # SGI and Apple formats
321: 0 string MOVI Silicon Graphics movie file
322: !:mime video/x-sgi-movie
323: 4 string moov Apple QuickTime
324: !:mime video/quicktime
325: >12 string mvhd \b movie (fast start)
326: >12 string mdra \b URL
327: >12 string cmov \b movie (fast start, compressed header)
328: >12 string rmra \b multiple URLs
329: 4 string mdat Apple QuickTime movie (unoptimized)
330: !:mime video/quicktime
331: #4 string wide Apple QuickTime movie (unoptimized)
332: #!:mime video/quicktime
333: #4 string skip Apple QuickTime movie (modified)
334: #!:mime video/quicktime
335: #4 string free Apple QuickTime movie (modified)
336: #!:mime video/quicktime
337: 4 string idsc Apple QuickTime image (fast start)
338: !:mime image/x-quicktime
339: #4 string idat Apple QuickTime image (unoptimized)
340: #!:mime image/x-quicktime
341: 4 string pckg Apple QuickTime compressed archive
342: !:mime application/x-quicktime-player
1.1.1.2 ! misho 343: 4 string/W jP JPEG 2000 image
1.1 misho 344: !:mime image/jp2
345: 4 string ftyp ISO Media
346: >8 string isom \b, MPEG v4 system, version 1
347: !:mime video/mp4
348: >8 string iso2 \b, MPEG v4 system, part 12 revision
349: >8 string mp41 \b, MPEG v4 system, version 1
350: !:mime video/mp4
351: >8 string mp42 \b, MPEG v4 system, version 2
352: !:mime video/mp4
353: >8 string mp7t \b, MPEG v4 system, MPEG v7 XML
354: >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
1.1.1.2 ! misho 355: >8 string/W jp2 \b, JPEG 2000
1.1 misho 356: !:mime image/jp2
357: >8 string 3gp \b, MPEG v4 system, 3GPP
358: !:mime video/3gpp
359: >>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
360: >>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
361: >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
362: >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
363: !:mime video/mp4
364: >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
365: !:mime video/3gpp
1.1.1.2 ! misho 366: >8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC
1.1 misho 367: !:mime audio/mp4
1.1.1.2 ! misho 368: >8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC
1.1 misho 369: !:mime video/mp4
1.1.1.2 ! misho 370: >8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted
! 371: >8 string/W M4B \b, MPEG v4 system, iTunes bookmarked
! 372: >8 string/W qt \b, Apple QuickTime movie
1.1 misho 373: !:mime video/quicktime
374:
375: # MPEG sequences
376: # Scans for all common MPEG header start codes
377: 0 belong 0x00000001
378: >4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
379: >>5 byte 66 \b, baseline
380: >>5 byte 77 \b, main
381: >>5 byte 88 \b, extended
382: >>7 byte x \b @ L %u
383: 0 belong&0xFFFFFF00 0x00000100
384: >3 byte 0xBA MPEG sequence
1.1.1.2 ! misho 385: !:mime video/mpeg
1.1 misho 386: >>4 byte &0x40 \b, v2, program multiplex
387: >>4 byte ^0x40 \b, v1, system multiplex
388: >3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
389: >3 byte&0x1F 0x07 MPEG sequence, H.264 video
390: >>4 byte 66 \b, baseline
391: >>4 byte 77 \b, main
392: >>4 byte 88 \b, extended
393: >>6 byte x \b @ L %u
394: >3 byte 0xB0 MPEG sequence, v4
1.1.1.2 ! misho 395: !:mime video/mpeg4-generic
1.1 misho 396: >>5 belong 0x000001B5
397: >>>9 byte &0x80
398: >>>>10 byte&0xF0 16 \b, video
399: >>>>10 byte&0xF0 32 \b, still texture
400: >>>>10 byte&0xF0 48 \b, mesh
401: >>>>10 byte&0xF0 64 \b, face
402: >>>9 byte&0xF8 8 \b, video
403: >>>9 byte&0xF8 16 \b, still texture
404: >>>9 byte&0xF8 24 \b, mesh
405: >>>9 byte&0xF8 32 \b, face
406: >>4 byte 1 \b, simple @ L1
407: >>4 byte 2 \b, simple @ L2
408: >>4 byte 3 \b, simple @ L3
409: >>4 byte 4 \b, simple @ L0
410: >>4 byte 17 \b, simple scalable @ L1
411: >>4 byte 18 \b, simple scalable @ L2
412: >>4 byte 33 \b, core @ L1
413: >>4 byte 34 \b, core @ L2
414: >>4 byte 50 \b, main @ L2
415: >>4 byte 51 \b, main @ L3
416: >>4 byte 53 \b, main @ L4
417: >>4 byte 66 \b, n-bit @ L2
418: >>4 byte 81 \b, scalable texture @ L1
419: >>4 byte 97 \b, simple face animation @ L1
420: >>4 byte 98 \b, simple face animation @ L2
421: >>4 byte 99 \b, simple face basic animation @ L1
422: >>4 byte 100 \b, simple face basic animation @ L2
423: >>4 byte 113 \b, basic animation text @ L1
424: >>4 byte 114 \b, basic animation text @ L2
425: >>4 byte 129 \b, hybrid @ L1
426: >>4 byte 130 \b, hybrid @ L2
427: >>4 byte 145 \b, advanced RT simple @ L!
428: >>4 byte 146 \b, advanced RT simple @ L2
429: >>4 byte 147 \b, advanced RT simple @ L3
430: >>4 byte 148 \b, advanced RT simple @ L4
431: >>4 byte 161 \b, core scalable @ L1
432: >>4 byte 162 \b, core scalable @ L2
433: >>4 byte 163 \b, core scalable @ L3
434: >>4 byte 177 \b, advanced coding efficiency @ L1
435: >>4 byte 178 \b, advanced coding efficiency @ L2
436: >>4 byte 179 \b, advanced coding efficiency @ L3
437: >>4 byte 180 \b, advanced coding efficiency @ L4
438: >>4 byte 193 \b, advanced core @ L1
439: >>4 byte 194 \b, advanced core @ L2
440: >>4 byte 209 \b, advanced scalable texture @ L1
441: >>4 byte 210 \b, advanced scalable texture @ L2
442: >>4 byte 211 \b, advanced scalable texture @ L3
443: >>4 byte 225 \b, simple studio @ L1
444: >>4 byte 226 \b, simple studio @ L2
445: >>4 byte 227 \b, simple studio @ L3
446: >>4 byte 228 \b, simple studio @ L4
447: >>4 byte 229 \b, core studio @ L1
448: >>4 byte 230 \b, core studio @ L2
449: >>4 byte 231 \b, core studio @ L3
450: >>4 byte 232 \b, core studio @ L4
451: >>4 byte 240 \b, advanced simple @ L0
452: >>4 byte 241 \b, advanced simple @ L1
453: >>4 byte 242 \b, advanced simple @ L2
454: >>4 byte 243 \b, advanced simple @ L3
455: >>4 byte 244 \b, advanced simple @ L4
456: >>4 byte 245 \b, advanced simple @ L5
457: >>4 byte 247 \b, advanced simple @ L3b
458: >>4 byte 248 \b, FGS @ L0
459: >>4 byte 249 \b, FGS @ L1
460: >>4 byte 250 \b, FGS @ L2
461: >>4 byte 251 \b, FGS @ L3
462: >>4 byte 252 \b, FGS @ L4
463: >>4 byte 253 \b, FGS @ L5
464: >3 byte 0xB5 MPEG sequence, v4
465: >>4 byte &0x80
466: >>>5 byte&0xF0 16 \b, video (missing profile header)
467: >>>5 byte&0xF0 32 \b, still texture (missing profile header)
468: >>>5 byte&0xF0 48 \b, mesh (missing profile header)
469: >>>5 byte&0xF0 64 \b, face (missing profile header)
470: >>4 byte&0xF8 8 \b, video (missing profile header)
471: >>4 byte&0xF8 16 \b, still texture (missing profile header)
472: >>4 byte&0xF8 24 \b, mesh (missing profile header)
473: >>4 byte&0xF8 32 \b, face (missing profile header)
474: >3 byte 0xB3 MPEG sequence
475: >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
476: >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
477: >>12 belong 0x000001B5 \b, v2,
478: >>>16 byte&0x0F 1 \b HP
479: >>>16 byte&0x0F 2 \b Spt
480: >>>16 byte&0x0F 3 \b SNR
481: >>>16 byte&0x0F 4 \b MP
482: >>>16 byte&0x0F 5 \b SP
483: >>>17 byte&0xF0 64 \b@HL
484: >>>17 byte&0xF0 96 \b@H-14
485: >>>17 byte&0xF0 128 \b@ML
486: >>>17 byte&0xF0 160 \b@LL
487: >>>17 byte &0x08 \b progressive
488: >>>17 byte ^0x08 \b interlaced
489: >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
490: >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
491: >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
492: >>11 byte &0x02
493: >>>75 byte &0x01
494: >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
495: >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
496: >>>>140 belong 0x000001B5 \b, v2,
497: >>>>>144 byte&0x0F 1 \b HP
498: >>>>>144 byte&0x0F 2 \b Spt
499: >>>>>144 byte&0x0F 3 \b SNR
500: >>>>>144 byte&0x0F 4 \b MP
501: >>>>>144 byte&0x0F 5 \b SP
502: >>>>>145 byte&0xF0 64 \b@HL
503: >>>>>145 byte&0xF0 96 \b@H-14
504: >>>>>145 byte&0xF0 128 \b@ML
505: >>>>>145 byte&0xF0 160 \b@LL
506: >>>>>145 byte &0x08 \b progressive
507: >>>>>145 byte ^0x08 \b interlaced
508: >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
509: >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
510: >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
511: >>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
512: >>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
513: >>76 belong 0x000001B5 \b, v2,
514: >>>80 byte&0x0F 1 \b HP
515: >>>80 byte&0x0F 2 \b Spt
516: >>>80 byte&0x0F 3 \b SNR
517: >>>80 byte&0x0F 4 \b MP
518: >>>80 byte&0x0F 5 \b SP
519: >>>81 byte&0xF0 64 \b@HL
520: >>>81 byte&0xF0 96 \b@H-14
521: >>>81 byte&0xF0 128 \b@ML
522: >>>81 byte&0xF0 160 \b@LL
523: >>>81 byte &0x08 \b progressive
524: >>>81 byte ^0x08 \b interlaced
525: >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
526: >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
527: >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
528: >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
529: >>>7 byte&0xF0 0x10 \b, 16:9
530: >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
531: >>>7 byte&0xF0 0x10 \b, 16:9
532: >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
533: >>>7 byte&0xF0 0x10 \b, 4:3
534: >>4 beshort&0xFFF0 0x2C00 \b, 4CIF
535: >>>5 beshort&0x0FFF 0x01E0 \b NTSC
536: >>>5 beshort&0x0FFF 0x0240 \b PAL
537: >>>7 byte&0xF0 0x20 \b, 4:3
538: >>>7 byte&0xF0 0x30 \b, 16:9
539: >>>7 byte&0xF0 0x40 \b, 11:5
540: >>>7 byte&0xF0 0x80 \b, PAL 4:3
541: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
542: >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
543: >>>7 byte&0xF0 0x10 \b, 4:3
544: >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
545: >>>7 byte&0xF0 0x10 \b, 4:3
546: >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
547: >>>7 byte&0xF0 0x10 \b, 4:3
548: >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
549: >>>7 byte&0xF0 0x10 \b, 4:3
550: >>4 beshort&0xFFF0 0x1600 \b, CIF
551: >>>5 beshort&0x0FFF 0x00F0 \b NTSC
552: >>>5 beshort&0x0FFF 0x0120 \b PAL
553: >>>7 byte&0xF0 0x20 \b, 4:3
554: >>>7 byte&0xF0 0x30 \b, 16:9
555: >>>7 byte&0xF0 0x40 \b, 11:5
556: >>>7 byte&0xF0 0x80 \b, PAL 4:3
557: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
558: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
559: >>>>7 byte&0xF0 0x20 \b, 4:3
560: >>>>7 byte&0xF0 0x30 \b, 16:9
561: >>>>7 byte&0xF0 0x40 \b, 11:5
562: >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
563: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
564: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
565: >>>7 byte&0xF0 0x20 \b, 4:3
566: >>>7 byte&0xF0 0x30 \b, 16:9
567: >>>7 byte&0xF0 0x40 \b, 11:5
568: >>4 beshort&0xFFF0 0x1E00 \b, SVCD
569: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
570: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
571: >>>7 byte&0xF0 0x20 \b, 4:3
572: >>>7 byte&0xF0 0x30 \b, 16:9
573: >>>7 byte&0xF0 0x40 \b, 11:5
574: >>7 byte&0x0F 1 \b, 23.976 fps
575: >>7 byte&0x0F 2 \b, 24 fps
576: >>7 byte&0x0F 3 \b, 25 fps
577: >>7 byte&0x0F 4 \b, 29.97 fps
578: >>7 byte&0x0F 5 \b, 30 fps
579: >>7 byte&0x0F 6 \b, 50 fps
580: >>7 byte&0x0F 7 \b, 59.94 fps
581: >>7 byte&0x0F 8 \b, 60 fps
582: >>11 byte &0x04 \b, Constrained
583:
584: # MPEG ADTS Audio (*.mpx/mxa/aac)
585: # from dreesen@math.fu-berlin.de
586: # modified to fully support MPEG ADTS
587:
588: # MP3, M1A
589: # modified by Joerg Jenderek
590: # GRR the original test are too common for many DOS files
591: # so don't accept as MP3 until we've tested the rate
592: 0 beshort&0xFFFE 0xFFFA
593: # rates
594: >2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
595: !:mime audio/mpeg
596: >2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
597: !:mime audio/mpeg
598: >2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
599: !:mime audio/mpeg
600: >2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
601: !:mime audio/mpeg
602: >2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
603: !:mime audio/mpeg
604: >2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
605: !:mime audio/mpeg
606: >2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
607: !:mime audio/mpeg
608: >2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
609: !:mime audio/mpeg
610: >2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
611: !:mime audio/mpeg
612: >2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
613: !:mime audio/mpeg
614: >2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
615: !:mime audio/mpeg
616: >2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
617: !:mime audio/mpeg
618: >2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
619: !:mime audio/mpeg
620: >2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
621: !:mime audio/mpeg
622: # timing
623: >2 byte&0x0C 0x00 \b, 44.1 kHz
624: >2 byte&0x0C 0x04 \b, 48 kHz
625: >2 byte&0x0C 0x08 \b, 32 kHz
626: # channels/options
627: >3 byte&0xC0 0x00 \b, Stereo
628: >3 byte&0xC0 0x40 \b, JntStereo
629: >3 byte&0xC0 0x80 \b, 2x Monaural
630: >3 byte&0xC0 0xC0 \b, Monaural
631: #>1 byte ^0x01 \b, Data Verify
632: #>2 byte &0x02 \b, Packet Pad
633: #>2 byte &0x01 \b, Custom Flag
634: #>3 byte &0x08 \b, Copyrighted
635: #>3 byte &0x04 \b, Original Source
636: #>3 byte&0x03 1 \b, NR: 50/15 ms
637: #>3 byte&0x03 3 \b, NR: CCIT J.17
638:
639: # MP2, M1A
640: 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
1.1.1.2 ! misho 641: !:mime audio/mpeg
1.1 misho 642: # rates
643: >2 byte&0xF0 0x10 \b, 32 kbps
644: >2 byte&0xF0 0x20 \b, 48 kbps
645: >2 byte&0xF0 0x30 \b, 56 kbps
646: >2 byte&0xF0 0x40 \b, 64 kbps
647: >2 byte&0xF0 0x50 \b, 80 kbps
648: >2 byte&0xF0 0x60 \b, 96 kbps
649: >2 byte&0xF0 0x70 \b, 112 kbps
650: >2 byte&0xF0 0x80 \b, 128 kbps
651: >2 byte&0xF0 0x90 \b, 160 kbps
652: >2 byte&0xF0 0xA0 \b, 192 kbps
653: >2 byte&0xF0 0xB0 \b, 224 kbps
654: >2 byte&0xF0 0xC0 \b, 256 kbps
655: >2 byte&0xF0 0xD0 \b, 320 kbps
656: >2 byte&0xF0 0xE0 \b, 384 kbps
657: # timing
658: >2 byte&0x0C 0x00 \b, 44.1 kHz
659: >2 byte&0x0C 0x04 \b, 48 kHz
660: >2 byte&0x0C 0x08 \b, 32 kHz
661: # channels/options
662: >3 byte&0xC0 0x00 \b, Stereo
663: >3 byte&0xC0 0x40 \b, JntStereo
664: >3 byte&0xC0 0x80 \b, 2x Monaural
665: >3 byte&0xC0 0xC0 \b, Monaural
666: #>1 byte ^0x01 \b, Data Verify
667: #>2 byte &0x02 \b, Packet Pad
668: #>2 byte &0x01 \b, Custom Flag
669: #>3 byte &0x08 \b, Copyrighted
670: #>3 byte &0x04 \b, Original Source
671: #>3 byte&0x03 1 \b, NR: 50/15 ms
672: #>3 byte&0x03 3 \b, NR: CCIT J.17
673:
674: # MPA, M1A
675: # updated by Joerg Jenderek
676: # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
677: # GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
678: # FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
679: #0 beshort&0xFFFE 0xFFFE
680: #>2 ubyte&0xF0 >0x0F
681: #>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
682: ## rate
683: #>>>2 byte&0xF0 0x10 \b, 32 kbps
684: #>>>2 byte&0xF0 0x20 \b, 64 kbps
685: #>>>2 byte&0xF0 0x30 \b, 96 kbps
686: #>>>2 byte&0xF0 0x40 \b, 128 kbps
687: #>>>2 byte&0xF0 0x50 \b, 160 kbps
688: #>>>2 byte&0xF0 0x60 \b, 192 kbps
689: #>>>2 byte&0xF0 0x70 \b, 224 kbps
690: #>>>2 byte&0xF0 0x80 \b, 256 kbps
691: #>>>2 byte&0xF0 0x90 \b, 288 kbps
692: #>>>2 byte&0xF0 0xA0 \b, 320 kbps
693: #>>>2 byte&0xF0 0xB0 \b, 352 kbps
694: #>>>2 byte&0xF0 0xC0 \b, 384 kbps
695: #>>>2 byte&0xF0 0xD0 \b, 416 kbps
696: #>>>2 byte&0xF0 0xE0 \b, 448 kbps
697: ## timing
698: #>>>2 byte&0x0C 0x00 \b, 44.1 kHz
699: #>>>2 byte&0x0C 0x04 \b, 48 kHz
700: #>>>2 byte&0x0C 0x08 \b, 32 kHz
701: ## channels/options
702: #>>>3 byte&0xC0 0x00 \b, Stereo
703: #>>>3 byte&0xC0 0x40 \b, JntStereo
704: #>>>3 byte&0xC0 0x80 \b, 2x Monaural
705: #>>>3 byte&0xC0 0xC0 \b, Monaural
706: ##>1 byte ^0x01 \b, Data Verify
707: ##>2 byte &0x02 \b, Packet Pad
708: ##>2 byte &0x01 \b, Custom Flag
709: ##>3 byte &0x08 \b, Copyrighted
710: ##>3 byte &0x04 \b, Original Source
711: ##>3 byte&0x03 1 \b, NR: 50/15 ms
712: ##>3 byte&0x03 3 \b, NR: CCIT J.17
713:
714: # MP3, M2A
715: 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
1.1.1.2 ! misho 716: !:mime audio/mpeg
1.1 misho 717: # rate
718: >2 byte&0xF0 0x10 \b, 8 kbps
719: >2 byte&0xF0 0x20 \b, 16 kbps
720: >2 byte&0xF0 0x30 \b, 24 kbps
721: >2 byte&0xF0 0x40 \b, 32 kbps
722: >2 byte&0xF0 0x50 \b, 40 kbps
723: >2 byte&0xF0 0x60 \b, 48 kbps
724: >2 byte&0xF0 0x70 \b, 56 kbps
725: >2 byte&0xF0 0x80 \b, 64 kbps
726: >2 byte&0xF0 0x90 \b, 80 kbps
727: >2 byte&0xF0 0xA0 \b, 96 kbps
728: >2 byte&0xF0 0xB0 \b, 112 kbps
729: >2 byte&0xF0 0xC0 \b, 128 kbps
730: >2 byte&0xF0 0xD0 \b, 144 kbps
731: >2 byte&0xF0 0xE0 \b, 160 kbps
732: # timing
733: >2 byte&0x0C 0x00 \b, 22.05 kHz
734: >2 byte&0x0C 0x04 \b, 24 kHz
735: >2 byte&0x0C 0x08 \b, 16 kHz
736: # channels/options
737: >3 byte&0xC0 0x00 \b, Stereo
738: >3 byte&0xC0 0x40 \b, JntStereo
739: >3 byte&0xC0 0x80 \b, 2x Monaural
740: >3 byte&0xC0 0xC0 \b, Monaural
741: #>1 byte ^0x01 \b, Data Verify
742: #>2 byte &0x02 \b, Packet Pad
743: #>2 byte &0x01 \b, Custom Flag
744: #>3 byte &0x08 \b, Copyrighted
745: #>3 byte &0x04 \b, Original Source
746: #>3 byte&0x03 1 \b, NR: 50/15 ms
747: #>3 byte&0x03 3 \b, NR: CCIT J.17
748:
749: # MP2, M2A
750: 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
751: # rate
752: >2 byte&0xF0 0x10 \b, 8 kbps
753: >2 byte&0xF0 0x20 \b, 16 kbps
754: >2 byte&0xF0 0x30 \b, 24 kbps
755: >2 byte&0xF0 0x40 \b, 32 kbps
756: >2 byte&0xF0 0x50 \b, 40 kbps
757: >2 byte&0xF0 0x60 \b, 48 kbps
758: >2 byte&0xF0 0x70 \b, 56 kbps
759: >2 byte&0xF0 0x80 \b, 64 kbps
760: >2 byte&0xF0 0x90 \b, 80 kbps
761: >2 byte&0xF0 0xA0 \b, 96 kbps
762: >2 byte&0xF0 0xB0 \b, 112 kbps
763: >2 byte&0xF0 0xC0 \b, 128 kbps
764: >2 byte&0xF0 0xD0 \b, 144 kbps
765: >2 byte&0xF0 0xE0 \b, 160 kbps
766: # timing
767: >2 byte&0x0C 0x00 \b, 22.05 kHz
768: >2 byte&0x0C 0x04 \b, 24 kHz
769: >2 byte&0x0C 0x08 \b, 16 kHz
770: # channels/options
771: >3 byte&0xC0 0x00 \b, Stereo
772: >3 byte&0xC0 0x40 \b, JntStereo
773: >3 byte&0xC0 0x80 \b, 2x Monaural
774: >3 byte&0xC0 0xC0 \b, Monaural
775: #>1 byte ^0x01 \b, Data Verify
776: #>2 byte &0x02 \b, Packet Pad
777: #>2 byte &0x01 \b, Custom Flag
778: #>3 byte &0x08 \b, Copyrighted
779: #>3 byte &0x04 \b, Original Source
780: #>3 byte&0x03 1 \b, NR: 50/15 ms
781: #>3 byte&0x03 3 \b, NR: CCIT J.17
782:
783: # MPA, M2A
784: 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
1.1.1.2 ! misho 785: !:mime audio/mpeg
1.1 misho 786: # rate
787: >2 byte&0xF0 0x10 \b, 32 kbps
788: >2 byte&0xF0 0x20 \b, 48 kbps
789: >2 byte&0xF0 0x30 \b, 56 kbps
790: >2 byte&0xF0 0x40 \b, 64 kbps
791: >2 byte&0xF0 0x50 \b, 80 kbps
792: >2 byte&0xF0 0x60 \b, 96 kbps
793: >2 byte&0xF0 0x70 \b, 112 kbps
794: >2 byte&0xF0 0x80 \b, 128 kbps
795: >2 byte&0xF0 0x90 \b, 144 kbps
796: >2 byte&0xF0 0xA0 \b, 160 kbps
797: >2 byte&0xF0 0xB0 \b, 176 kbps
798: >2 byte&0xF0 0xC0 \b, 192 kbps
799: >2 byte&0xF0 0xD0 \b, 224 kbps
800: >2 byte&0xF0 0xE0 \b, 256 kbps
801: # timing
802: >2 byte&0x0C 0x00 \b, 22.05 kHz
803: >2 byte&0x0C 0x04 \b, 24 kHz
804: >2 byte&0x0C 0x08 \b, 16 kHz
805: # channels/options
806: >3 byte&0xC0 0x00 \b, Stereo
807: >3 byte&0xC0 0x40 \b, JntStereo
808: >3 byte&0xC0 0x80 \b, 2x Monaural
809: >3 byte&0xC0 0xC0 \b, Monaural
810: #>1 byte ^0x01 \b, Data Verify
811: #>2 byte &0x02 \b, Packet Pad
812: #>2 byte &0x01 \b, Custom Flag
813: #>3 byte &0x08 \b, Copyrighted
814: #>3 byte &0x04 \b, Original Source
815: #>3 byte&0x03 1 \b, NR: 50/15 ms
816: #>3 byte&0x03 3 \b, NR: CCIT J.17
817:
818: # MP3, M25A
819: 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
1.1.1.2 ! misho 820: !:mime audio/mpeg
1.1 misho 821: # rate
822: >2 byte&0xF0 0x10 \b, 8 kbps
823: >2 byte&0xF0 0x20 \b, 16 kbps
824: >2 byte&0xF0 0x30 \b, 24 kbps
825: >2 byte&0xF0 0x40 \b, 32 kbps
826: >2 byte&0xF0 0x50 \b, 40 kbps
827: >2 byte&0xF0 0x60 \b, 48 kbps
828: >2 byte&0xF0 0x70 \b, 56 kbps
829: >2 byte&0xF0 0x80 \b, 64 kbps
830: >2 byte&0xF0 0x90 \b, 80 kbps
831: >2 byte&0xF0 0xA0 \b, 96 kbps
832: >2 byte&0xF0 0xB0 \b, 112 kbps
833: >2 byte&0xF0 0xC0 \b, 128 kbps
834: >2 byte&0xF0 0xD0 \b, 144 kbps
835: >2 byte&0xF0 0xE0 \b, 160 kbps
836: # timing
837: >2 byte&0x0C 0x00 \b, 11.025 kHz
838: >2 byte&0x0C 0x04 \b, 12 kHz
839: >2 byte&0x0C 0x08 \b, 8 kHz
840: # channels/options
841: >3 byte&0xC0 0x00 \b, Stereo
842: >3 byte&0xC0 0x40 \b, JntStereo
843: >3 byte&0xC0 0x80 \b, 2x Monaural
844: >3 byte&0xC0 0xC0 \b, Monaural
845: #>1 byte ^0x01 \b, Data Verify
846: #>2 byte &0x02 \b, Packet Pad
847: #>2 byte &0x01 \b, Custom Flag
848: #>3 byte &0x08 \b, Copyrighted
849: #>3 byte &0x04 \b, Original Source
850: #>3 byte&0x03 1 \b, NR: 50/15 ms
851: #>3 byte&0x03 3 \b, NR: CCIT J.17
852:
853: # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
854:
855: # Stored AAC streams (instead of the MP4 format)
856: 0 string ADIF MPEG ADIF, AAC
857: !:mime audio/x-hx-aac-adif
858: >4 byte &0x80
859: >>13 byte &0x10 \b, VBR
860: >>13 byte ^0x10 \b, CBR
861: >>16 byte&0x1E 0x02 \b, single stream
862: >>16 byte&0x1E 0x04 \b, 2 streams
863: >>16 byte&0x1E 0x06 \b, 3 streams
864: >>16 byte &0x08 \b, 4 or more streams
865: >>16 byte &0x10 \b, 8 or more streams
866: >>4 byte &0x80 \b, Copyrighted
867: >>13 byte &0x40 \b, Original Source
868: >>13 byte &0x20 \b, Home Flag
869: >4 byte ^0x80
870: >>4 byte &0x10 \b, VBR
871: >>4 byte ^0x10 \b, CBR
872: >>7 byte&0x1E 0x02 \b, single stream
873: >>7 byte&0x1E 0x04 \b, 2 streams
874: >>7 byte&0x1E 0x06 \b, 3 streams
875: >>7 byte &0x08 \b, 4 or more streams
876: >>7 byte &0x10 \b, 8 or more streams
877: >>4 byte &0x40 \b, Original Stream(s)
878: >>4 byte &0x20 \b, Home Source
879:
880: # Live or stored single AAC stream (used with MPEG-2 systems)
881: 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
882: !:mime audio/x-hx-aac-adts
883: >1 byte &0x08 \b, v2
884: >1 byte ^0x08 \b, v4
885: # profile
886: >>2 byte &0xC0 \b LTP
887: >2 byte&0xc0 0x00 \b Main
888: >2 byte&0xc0 0x40 \b LC
889: >2 byte&0xc0 0x80 \b SSR
890: # timing
891: >2 byte&0x3c 0x00 \b, 96 kHz
892: >2 byte&0x3c 0x04 \b, 88.2 kHz
893: >2 byte&0x3c 0x08 \b, 64 kHz
894: >2 byte&0x3c 0x0c \b, 48 kHz
895: >2 byte&0x3c 0x10 \b, 44.1 kHz
896: >2 byte&0x3c 0x14 \b, 32 kHz
897: >2 byte&0x3c 0x18 \b, 24 kHz
898: >2 byte&0x3c 0x1c \b, 22.05 kHz
899: >2 byte&0x3c 0x20 \b, 16 kHz
900: >2 byte&0x3c 0x24 \b, 12 kHz
901: >2 byte&0x3c 0x28 \b, 11.025 kHz
902: >2 byte&0x3c 0x2c \b, 8 kHz
903: # channels
904: >2 beshort&0x01c0 0x0040 \b, monaural
905: >2 beshort&0x01c0 0x0080 \b, stereo
906: >2 beshort&0x01c0 0x00c0 \b, stereo + center
907: >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
908: >2 beshort&0x01c0 0x0140 \b, surround
909: >2 beshort&0x01c0 0x0180 \b, surround + LFE
910: >2 beshort &0x01C0 \b, surround + side
911: #>1 byte ^0x01 \b, Data Verify
912: #>2 byte &0x02 \b, Custom Flag
913: #>3 byte &0x20 \b, Original Stream
914: #>3 byte &0x10 \b, Home Source
915: #>3 byte &0x08 \b, Copyrighted
916:
917: # Live MPEG-4 audio streams (instead of RTP FlexMux)
918: 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
919: !:mime audio/x-mp4a-latm
920: #>1 beshort&0x1FFF x \b, %u byte packet
921: >3 byte&0xE0 0x40
922: >>4 byte&0x3C 0x04 \b, single stream
923: >>4 byte&0x3C 0x08 \b, 2 streams
924: >>4 byte&0x3C 0x0C \b, 3 streams
925: >>4 byte &0x08 \b, 4 or more streams
926: >>4 byte &0x20 \b, 8 or more streams
927: >3 byte&0xC0 0
928: >>4 byte&0x78 0x08 \b, single stream
929: >>4 byte&0x78 0x10 \b, 2 streams
930: >>4 byte&0x78 0x18 \b, 3 streams
931: >>4 byte &0x20 \b, 4 or more streams
932: >>4 byte &0x40 \b, 8 or more streams
933: # This magic isn't strong enough (matches plausible ISO-8859-1 text)
934: #0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
935: #!:mime audio/x-mp4a-latm
936:
937: # Summary: FLI animation format
938: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
939: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
940: 4 leshort 0xAF11
941: # standard FLI always has 320x200 resolution and 8 bit color
942: >8 leshort 320
943: >>10 leshort 200
944: >>>12 leshort 8 FLI animation, 320x200x8
945: !:mime video/x-fli
946: >>>>6 leshort x \b, %d frames
947: # frame speed is multiple of 1/70s
948: >>>>16 leshort x \b, %d/70s per frame
949:
950: # Summary: FLC animation format
951: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
952: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
953: 4 leshort 0xAF12
954: # standard FLC always use 8 bit color
955: >12 leshort 8 FLC animation
956: !:mime video/x-flc
957: >>8 leshort x \b, %d
958: >>10 leshort x \bx%dx8
959: >>6 uleshort x \b, %d frames
960: >>16 uleshort x \b, %dms per frame
961:
962: # DL animation format
963: # XXX - collision with most `mips' magic
964: #
965: # I couldn't find a real magic number for these, however, this
966: # -appears- to work. Note that it might catch other files, too, so be
967: # careful!
968: #
969: # Note that title and author appear in the two 20-byte chunks
970: # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
971: # 255 (hex FF)! The DL format is really bad.
972: #
973: #0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
974: #!:mime video/x-unknown
975: #>42 byte x - %d screens,
976: #>43 byte x %d commands
977: #0 byte 2 DL version 2
978: #!:mime video/x-unknown
979: #>1 byte 1 - large format (320x200,1 image/screen),
980: #>1 byte 2 - medium format (160x100,4 images/screen),
981: #>1 byte >2 - unknown format,
982: #>42 byte x %d screens,
983: #>43 byte x %d commands
984: # Based on empirical evidence, DL version 3 have several nulls following the
985: # \003. Most of them start with non-null values at hex offset 0x34 or so.
986: #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
987:
988: # iso 13818 transport stream
989: #
990: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
991: # (the following is a little bit restrictive and works fine for a stream
992: # that starts with PAT properly. it won't work for stream data, that is
993: # cut from an input device data right in the middle, but this shouldn't
994: # disturb)
995: # syncbyte 8 bit 0x47
996: # error_ind 1 bit -
997: # payload_start 1 bit 1
998: # priority 1 bit -
999: # PID 13 bit 0x0000
1000: # scrambling 2 bit -
1001: # adaptfld_ctrl 2 bit 1 or 3
1002: # conti_count 4 bit 0
1003: 0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
1004: >188 byte !0x47 CORRUPTED
1005:
1006: # DIF digital video file format <mpruett@sgi.com>
1007: 0 belong&0xffffff00 0x1f070000 DIF
1008: >4 byte &0x01 (DVCPRO) movie file
1009: >4 byte ^0x01 (DV) movie file
1010: >3 byte &0x80 (PAL)
1011: >3 byte ^0x80 (NTSC)
1012:
1013: # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
1014: 0 belong 0x3026b275 Microsoft ASF
1.1.1.2 ! misho 1015: !:mime video/x-ms-asf
1.1 misho 1016:
1017: # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1018: 0 string \x8aMNG MNG video data,
1019: !:mime video/x-mng
1020: >4 belong !0x0d0a1a0a CORRUPTED,
1021: >4 belong 0x0d0a1a0a
1022: >>16 belong x %ld x
1023: >>20 belong x %ld
1024:
1025: # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1026: 0 string \x8bJNG JNG video data,
1027: !:mime video/x-jng
1028: >4 belong !0x0d0a1a0a CORRUPTED,
1029: >4 belong 0x0d0a1a0a
1030: >>16 belong x %ld x
1031: >>20 belong x %ld
1032:
1033: # Vivo video (Wolfram Kleff)
1034: 3 string \x0D\x0AVersion:Vivo Vivo video data
1035:
1036: # VRML (Virtual Reality Modelling Language)
1.1.1.2 ! misho 1037: 0 string/w #VRML\ V1.0\ ascii VRML 1 file
1.1 misho 1038: !:mime model/vrml
1.1.1.2 ! misho 1039: 0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
1.1 misho 1040: !:mime model/vrml
1041:
1042: # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1043: # From Michel Briand <michelbriand@free.fr>
1044: 0 string \<?xml\ version="
1045: !:strength +1
1.1.1.2 ! misho 1046: >20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
1.1 misho 1047: !:mime model/x3d
1048:
1049: #---------------------------------------------------------------------------
1050: # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1051: # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1052: #
1053: 0 string HVQM4 %s
1054: >6 string >\0 v%s
1055: >0 byte x GameCube movie,
1056: >0x34 ubeshort x %d x
1057: >0x36 ubeshort x %d,
1058: >0x26 ubeshort x %dµs,
1059: >0x42 ubeshort 0 no audio
1060: >0x42 ubeshort >0 %dHz audio
1061:
1062: # From: "Stefan A. Haubenthal" <polluks@web.de>
1063: 0 string DVDVIDEO-VTS Video title set,
1064: >0x21 byte x v%x
1065: 0 string DVDVIDEO-VMG Video manager,
1066: >0x21 byte x v%x
1067:
1068: # From: Behan Webster <behanw@websterwood.com>
1069: # NuppelVideo used by Mythtv (*.nuv)
1070: # Note: there are two identical stanzas here differing only in the
1071: # initial string matched. It used to be done with a regex, but we're
1072: # trying to get rid of those.
1073: 0 string NuppelVideo MythTV NuppelVideo
1074: >12 string x v%s
1075: >20 lelong x (%d
1076: >24 lelong x \bx%d),
1077: >36 string P \bprogressive,
1078: >36 string I \binterlaced,
1079: >40 ledouble x \baspect:%.2f,
1080: >48 ledouble x \bfps:%.2f
1081: 0 string MythTV MythTV NuppelVideo
1082: >12 string x v%s
1083: >20 lelong x (%d
1084: >24 lelong x \bx%d),
1085: >36 string P \bprogressive,
1086: >36 string I \binterlaced,
1087: >40 ledouble x \baspect:%.2f,
1088: >48 ledouble x \bfps:%.2f
1089:
1090: # MPEG file
1091: # MPEG sequences
1092: # FIXME: This section is from the old magic.mime file and needs integrating with the rest
1093: 0 belong 0x000001BA
1094: >4 byte &0x40
1095: !:mime video/mp2p
1096: >4 byte ^0x40
1097: !:mime video/mpeg
1098: 0 belong 0x000001BB
1099: !:mime video/mpeg
1100: 0 belong 0x000001B0
1101: !:mime video/mp4v-es
1102: 0 belong 0x000001B5
1103: !:mime video/mp4v-es
1104: 0 belong 0x000001B3
1105: !:mime video/mpv
1106: 0 belong&0xFF5FFF1F 0x47400010
1107: !:mime video/mp2t
1108: 0 belong 0x00000001
1109: >4 byte&0x1F 0x07
1110: !:mime video/h264
1111:
1.1.1.2 ! misho 1112: # Type: Bink Video
! 1113: # URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container
! 1114: # From: <hoehle@users.sourceforge.net> 2008-07-18
! 1115: 0 string BIK Bink Video
! 1116: >3 regex =[a-z] rev.%s
! 1117: #>4 ulelong x size %d
! 1118: >20 ulelong x \b, %d
! 1119: >24 ulelong x \bx%d
! 1120: >8 ulelong x \b, %d frames
! 1121: >32 ulelong x at rate %d/
! 1122: >28 ulelong >1 \b%d
! 1123: >40 ulelong =0 \b, no audio
! 1124: >40 ulelong !0 \b, %d audio track
! 1125: >>40 ulelong !1 \bs
! 1126: # follow properties of the first audio track only
! 1127: >>48 uleshort x %dHz
! 1128: >>51 byte&0x20 0 mono
! 1129: >>51 byte&0x20 !0 stereo
! 1130: #>>51 byte&0x10 0 FFT
! 1131: #>>51 byte&0x10 !0 DCT
! 1132:
! 1133: # Type: NUT Container
! 1134: # URL: http://wiki.multimedia.cx/index.php?title=NUT
! 1135: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 1136: 0 string nut/multimedia\ container\0 NUT multimedia container
! 1137:
1.1 misho 1138: #------------------------------------------------------------------------------
1.1.1.2 ! misho 1139: # $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1.1 misho 1140: # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
1141: # workspaces)
1142: #
1143: 0 long 0100554 APL workspace (Ken's original?)
1.1.1.2 ! misho 1144:
1.1 misho 1145: #------------------------------------------------------------------------------
1.1.1.2 ! misho 1146: # $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $
1.1 misho 1147: # apple: file(1) magic for Apple file formats
1148: #
1149: 0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text
1150: 0 string \x0aGL Binary II (apple ][) data
1151: 0 string \x76\xff Squeezed (apple ][) data
1152: 0 string NuFile NuFile archive (apple ][) data
1153: 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
1154: 0 belong 0x00051600 AppleSingle encoded Macintosh file
1155: 0 belong 0x00051607 AppleDouble encoded Macintosh file
1156:
1157: # Type: Apple Emulator 2IMG format
1158: # From: Radek Vokal <rvokal@redhat.com>
1159: 0 string 2IMG Apple ][ 2IMG Disk Image
1160: >4 string XGS! \b, XGS
1161: >4 string CTKG \b, Catakig
1162: >4 string ShIm \b, Sheppy's ImageMaker
1163: >4 string WOOF \b, Sweet 16
1164: >4 string B2TR \b, Bernie ][ the Rescue
1165: >4 string !nfc \b, ASIMOV2
1166: >4 string x \b, Unknown Format
1167: >0xc byte 00 \b, DOS 3.3 sector order
1168: >>0x10 byte 00 \b, Volume 254
1169: >>0x10 byte&0x7f x \b, Volume %u
1170: >0xc byte 01 \b, ProDOS sector order
1171: >>0x14 short x \b, %u Blocks
1172: >0xc byte 02 \b, NIB data
1173:
1174: # magic for Newton PDA package formats
1175: # from Ruda Moura <ruda@helllabs.org>
1176: 0 string package0 Newton package, NOS 1.x,
1177: >12 belong &0x80000000 AutoRemove,
1178: >12 belong &0x40000000 CopyProtect,
1179: >12 belong &0x10000000 NoCompression,
1180: >12 belong &0x04000000 Relocation,
1181: >12 belong &0x02000000 UseFasterCompression,
1182: >16 belong x version %d
1183:
1184: 0 string package1 Newton package, NOS 2.x,
1185: >12 belong &0x80000000 AutoRemove,
1186: >12 belong &0x40000000 CopyProtect,
1187: >12 belong &0x10000000 NoCompression,
1188: >12 belong &0x04000000 Relocation,
1189: >12 belong &0x02000000 UseFasterCompression,
1190: >16 belong x version %d
1191:
1192: 0 string package4 Newton package,
1193: >8 byte 8 NOS 1.x,
1194: >8 byte 9 NOS 2.x,
1195: >12 belong &0x80000000 AutoRemove,
1196: >12 belong &0x40000000 CopyProtect,
1197: >12 belong &0x10000000 NoCompression,
1198:
1199: # The following entries for the Apple II are for files that have
1200: # been transferred as raw binary data from an Apple, without having
1201: # been encapsulated by any of the above archivers.
1202: #
1203: # In general, Apple II formats are hard to identify because Apple DOS
1204: # and especially Apple ProDOS have strong typing in the file system and
1205: # therefore programmers never felt much need to include type information
1206: # in the files themselves.
1207: #
1208: # Eric Fischer <enf@pobox.com>
1209:
1210: # AppleWorks word processor:
1211: #
1212: # This matches the standard tab stops for an AppleWorks file, but if
1213: # a file has a tab stop set in the first four columns this will fail.
1214: #
1215: # The "O" is really the magic number, but that's so common that it's
1216: # necessary to check the tab stops that follow it to avoid false positives.
1217:
1218: 4 string O==== AppleWorks word processor data
1219: >85 byte&0x01 >0 \b, zoomed
1220: >90 byte&0x01 >0 \b, paginated
1221: >92 byte&0x01 >0 \b, with mail merge
1222: #>91 byte x \b, left margin %d
1223:
1224: # AppleWorks database:
1225: #
1226: # This isn't really a magic number, but it's the closest thing to one
1227: # that I could find. The 1 and 2 really mean "order in which you defined
1228: # categories" and "left to right, top to bottom," respectively; the D and R
1229: # mean that the cursor should move either down or right when you press Return.
1230:
1231: #30 string \x01D AppleWorks database data
1232: #30 string \x02D AppleWorks database data
1233: #30 string \x01R AppleWorks database data
1234: #30 string \x02R AppleWorks database data
1235:
1236: # AppleWorks spreadsheet:
1237: #
1238: # Likewise, this isn't really meant as a magic number. The R or C means
1239: # row- or column-order recalculation; the A or M means automatic or manual
1240: # recalculation.
1241:
1242: #131 string RA AppleWorks spreadsheet data
1243: #131 string RM AppleWorks spreadsheet data
1244: #131 string CA AppleWorks spreadsheet data
1245: #131 string CM AppleWorks spreadsheet data
1246:
1247: # Applesoft BASIC:
1248: #
1249: # This is incredibly sloppy, but will be true if the program was
1250: # written at its usual memory location of 2048 and its first line
1251: # number is less than 256. Yuck.
1252:
1253: 0 belong&0xff00ff 0x80000 Applesoft BASIC program data
1254: #>2 leshort x \b, first line number %d
1255:
1256: # ORCA/EZ assembler:
1257: #
1258: # This will not identify ORCA/M source files, since those have
1259: # some sort of date code instead of the two zero bytes at 6 and 7
1260: # XXX Conflicts with ELF
1261: #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
1262: #>5 byte x \b, build number %d
1263:
1264: # Broderbund Fantavision
1265: #
1266: # I don't know what these values really mean, but they seem to recur.
1267: # Will they cause too many conflicts?
1268:
1269: # Probably :-)
1270: #2 belong&0xFF00FF 0x040008 Fantavision movie data
1271:
1272: # Some attempts at images.
1273: #
1274: # These are actually just bit-for-bit dumps of the frame buffer, so
1275: # there's really no reasonably way to distinguish them except for their
1276: # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1277: # or, occasionally, 8184.
1278: #
1279: # Nevertheless this will manage to catch a lot of images that happen
1280: # to have a solid-colored line at the bottom of the screen.
1281:
1282: # GRR: Magic too weak
1283: #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
1284: #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
1285: #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
1286: #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
1287: #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
1288:
1289: # Beagle Bros. Apple Mechanic fonts
1290:
1291: 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
1292:
1293: # Apple Universal Disk Image Format (UDIF) - dmg files.
1294: # From Johan Gade.
1295: # These entries are disabled for now until we fix the following issues.
1296: #
1297: # Note there might be some problems with the "VAX COFF executable"
1298: # entry. Note this entry should be placed before the mac filesystem section,
1299: # particularly the "Apple Partition data" entry.
1300: #
1301: # The intended meaning of these tests is, that the file is only of the
1302: # specified type if both of the lines are correct - i.e. if the first
1303: # line matches and the second doesn't then it is not of that type.
1304: #
1305: #0 long 0x7801730d
1306: #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
1307: #
1308: # Note that this entry is recognized correctly by the "Apple Partition
1309: # data" entry - however since this entry is more specific - this
1310: # information seems to be more useful.
1311: #0 long 0x45520200
1312: #>0x410 string disk\ image UDIF read/write image (UDRW)
1313:
1314: # From: Toby Peterson <toby@apple.com>
1315: 0 string bplist00 Apple binary property list
1316:
1317: # Apple binary property list (bplist)
1318: # Assumes version bytes are hex.
1319: # Provides content hints for version 0 files. Assumes that the root
1320: # object is the first object (true for CoreFoundation implementation).
1321: # From: David Remahl <dremahl@apple.com>
1322: 0 string bplist
1323: >6 byte x \bCoreFoundation binary property list data, version 0x%c
1324: >>7 byte x \b%c
1325: >6 string 00 \b
1326: >>8 byte&0xF0 0x00 \b
1327: >>>8 byte&0x0F 0x00 \b, root type: null
1328: >>>8 byte&0x0F 0x08 \b, root type: false boolean
1329: >>>8 byte&0x0F 0x09 \b, root type: true boolean
1330: >>8 byte&0xF0 0x10 \b, root type: integer
1331: >>8 byte&0xF0 0x20 \b, root type: real
1332: >>8 byte&0xF0 0x30 \b, root type: date
1333: >>8 byte&0xF0 0x40 \b, root type: data
1334: >>8 byte&0xF0 0x50 \b, root type: ascii string
1335: >>8 byte&0xF0 0x60 \b, root type: unicode string
1336: >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
1337: >>8 byte&0xF0 0xa0 \b, root type: array
1338: >>8 byte&0xF0 0xd0 \b, root type: dictionary
1339:
1340: # Apple/NeXT typedstream data
1341: # Serialization format used by NeXT and Apple for various
1342: # purposes in YellowStep/Cocoa, including some nib files.
1343: # From: David Remahl <dremahl@apple.com>
1344: 2 string typedstream NeXT/Apple typedstream data, big endian
1345: >0 byte x \b, version %hhd
1346: >0 byte <5 \b
1347: >>13 byte 0x81 \b
1348: >>>14 ubeshort x \b, system %hd
1349: 2 string streamtyped NeXT/Apple typedstream data, little endian
1350: >0 byte x \b, version %hhd
1351: >0 byte <5 \b
1352: >>13 byte 0x81 \b
1353: >>>14 uleshort x \b, system %hd
1354:
1355: #------------------------------------------------------------------------------
1356: # CAF: Apple CoreAudio File Format
1357: #
1358: # Container format for high-end audio purposes.
1359: # From: David Remahl <dremahl@apple.com>
1360: #
1361: 0 string caff CoreAudio Format audio file
1362: >4 beshort <10 version %d
1363: >6 beshort x
1364:
1365:
1366: #------------------------------------------------------------------------------
1367: # Keychain database files
1368: 0 string kych Mac OS X Keychain File
1369:
1370: #------------------------------------------------------------------------------
1371: # Code Signing related file types
1372: 0 belong 0xfade0c00 Mac OS X Code Requirement
1373: >8 belong 1 (opExpr)
1374: >4 belong x - %d bytes
1375:
1376: 0 belong 0xfade0c01 Mac OS X Code Requirement Set
1377: >8 belong >1 containing %d items
1378: >4 belong x - %d bytes
1379:
1380: 0 belong 0xfade0c02 Mac OS X Code Directory
1381: >8 belong x version %x
1382: >12 belong >0 flags 0x%x
1383: >4 belong x - %d bytes
1384:
1385: 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
1386: >4 belong x - %d bytes
1387:
1388: 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
1389: >8 belong >1 (%d elements)
1390: >4 belong x - %d bytes
1391:
1392: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1393: # .vdi
1394: 4 string innotek\ VirtualBox\ Disk\ Image %s
1395:
1396: #------------------------------------------------------------------------------
1.1.1.2 ! misho 1397: # $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 1398: # applix: file(1) magic for Applixware
1399: # From: Peter Soos <sp@osb.hu>
1400: #
1401: 0 string *BEGIN Applixware
1402: >7 string WORDS Words Document
1403: >7 string GRAPHICS Graphic
1404: >7 string RASTER Bitmap
1405: >7 string SPREADSHEETS Spreadsheet
1406: >7 string MACRO Macro
1407: >7 string BUILDER Builder Object
1.1.1.2 ! misho 1408:
1.1 misho 1409: #------------------------------------------------------------------------------
1.1.1.2 ! misho 1410: # $File: archive,v 1.55 2009/12/04 15:00:47 christos Exp $
1.1 misho 1411: # archive: file(1) magic for archive formats (see also "msdos" for self-
1412: # extracting compressed archives)
1413: #
1414: # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
1415: # pre-POSIX "tar" archives are handled in the C code.
1416:
1417: # POSIX tar archives
1418: 257 string ustar\0 POSIX tar archive
1419: !:mime application/x-tar # encoding: posix
1420: 257 string ustar\040\040\0 GNU tar archive
1421: !:mime application/x-tar # encoding: gnu
1422:
1423: # cpio archives
1424: #
1425: # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
1426: # The idea is to indicate archives produced on machines with the same
1427: # byte order as the machine running "file" with "cpio archive", and
1428: # to indicate archives produced on machines with the opposite byte order
1429: # from the machine running "file" with "byte-swapped cpio archive".
1430: #
1431: # The SVR4 "cpio(4)" hints that there are additional formats, but they
1432: # are defined as "short"s; I think all the new formats are
1433: # character-header formats and thus are strings, not numbers.
1434: 0 short 070707 cpio archive
1435: !:mime application/x-cpio
1436: 0 short 0143561 byte-swapped cpio archive
1437: !:mime application/x-cpio # encoding: swapped
1438: 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
1439: 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
1440: 0 string 070702 ASCII cpio archive (SVR4 with CRC)
1441:
1442: # Debian package (needs to go before regular portable archives)
1443: #
1444: 0 string =!<arch>\ndebian
1445: !:mime application/x-debian-package
1446: >8 string debian-split part of multipart Debian package
1447: >8 string debian-binary Debian binary package
1448: >8 string !debian
1449: >68 string >\0 (format %s)
1450: # These next two lines do not work, because a bzip2 Debian archive
1451: # still uses gzip for the control.tar (first in the archive). Only
1452: # data.tar varies, and the location of its filename varies too.
1453: # file/libmagic does not current have support for ascii-string based
1454: # (offsets) as of 2005-09-15.
1455: #>81 string bz2 \b, uses bzip2 compression
1456: #>84 string gz \b, uses gzip compression
1457: #>136 ledate x created: %s
1458:
1459: # other archives
1460: 0 long 0177555 very old archive
1461: 0 short 0177555 very old PDP-11 archive
1462: 0 long 0177545 old archive
1463: 0 short 0177545 old PDP-11 archive
1464: 0 long 0100554 apl workspace
1465: 0 string =<ar> archive
1466: !:mime application/x-archive
1467:
1468: # MIPS archive (needs to go before regular portable archives)
1469: #
1470: 0 string =!<arch>\n__________E MIPS archive
1471: >20 string U with MIPS Ucode members
1472: >21 string L with MIPSEL members
1473: >21 string B with MIPSEB members
1474: >19 string L and an EL hash table
1475: >19 string B and an EB hash table
1476: >22 string X -- out of date
1477:
1478: 0 search/1 -h- Software Tools format archive text
1479:
1480: #
1481: # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
1482: # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
1483: #
1484: # 0 string =!<arch> current ar archive
1485: # 0 long 0x213c6172 archive file
1486: #
1487: # and for SVR1 archives, we have:
1488: #
1489: # 0 string \<ar> System V Release 1 ar archive
1490: # 0 string =<ar> archive
1491: #
1492: # XXX - did Aegis really store shared libraries, breakpointed modules,
1493: # and absolute code program modules in the same format as new-style
1494: # "ar" archives?
1495: #
1496: 0 string =!<arch> current ar archive
1497: !:mime application/x-archive
1498: >8 string __.SYMDEF random library
1499: >0 belong =65538 - pre SR9.5
1500: >0 belong =65539 - post SR9.5
1501: >0 beshort 2 - object archive
1502: >0 beshort 3 - shared library module
1503: >0 beshort 4 - debug break-pointed module
1504: >0 beshort 5 - absolute code program module
1505: 0 string \<ar> System V Release 1 ar archive
1506: 0 string =<ar> archive
1507: #
1508: # XXX - from "vax", which appears to collect a bunch of byte-swapped
1509: # thingies, to help you recognize VAX files on big-endian machines;
1510: # with "leshort", "lelong", and "string", that's no longer necessary....
1511: #
1512: 0 belong 0x65ff0000 VAX 3.0 archive
1513: 0 belong 0x3c61723e VAX 5.0 archive
1514: #
1515: 0 long 0x213c6172 archive file
1516: 0 lelong 0177555 very old VAX archive
1517: 0 leshort 0177555 very old PDP-11 archive
1518: #
1519: # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
1520: # be a random library (it said 0xff65 rather than 0177545).
1521: #
1522: 0 lelong 0177545 old VAX archive
1523: >8 string __.SYMDEF random library
1524: 0 leshort 0177545 old PDP-11 archive
1525: >8 string __.SYMDEF random library
1526: #
1527: # From "pdp" (but why a 4-byte quantity?)
1528: #
1529: 0 lelong 0x39bed PDP-11 old archive
1530: 0 lelong 0x39bee PDP-11 4.0 archive
1531:
1532: # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
1533: #
1534: # The first byte is the magic (0x1a), byte 2 is the compression type for
1535: # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
1536: # filename of the first file (null terminated). Since some types collide
1537: # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
1538: # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
1539: 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
1540: !:mime application/x-arc
1541: 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
1542: !:mime application/x-arc
1543: 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
1544: !:mime application/x-arc
1545: 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
1546: !:mime application/x-arc
1547: 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
1548: !:mime application/x-arc
1549: 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
1550: !:mime application/x-arc
1551: # [JW] stuff taken from idarc, obviously ARC successors:
1552: 0 lelong&0x8080ffff 0x00000a1a PAK archive data
1553: !:mime application/x-arc
1554: 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
1555: !:mime application/x-arc
1556: 0 lelong&0x8080ffff 0x0000481a HYP archive data
1557: !:mime application/x-arc
1558:
1559: # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
1560: # I can't create either SPARK or ArcFS archives so I have not tested this stuff
1561: # [GRR: the original entries collide with ARC, above; replaced with combined
1562: # version (not tested)]
1563: #0 byte 0x1a RISC OS archive (spark format)
1564: 0 string \032archive RISC OS archive (ArcFS format)
1565: 0 string Archive\000 RISC OS archive (ArcFS format)
1566:
1567: # All these were taken from idarc, many could not be verified. Unfortunately,
1568: # there were many low-quality sigs, i.e. easy to trigger false positives.
1569: # Please notify me of any real-world fishy/ambiguous signatures and I'll try
1570: # to get my hands on the actual archiver and see if I find something better. [JW]
1571: # probably many can be enhanced by finding some 0-byte or control char near the start
1572:
1573: # idarc calls this Crush/Uncompressed... *shrug*
1574: 0 string CRUSH Crush archive data
1575: # Squeeze It (.sqz)
1576: 0 string HLSQZ Squeeze It archive data
1577: # SQWEZ
1578: 0 string SQWEZ SQWEZ archive data
1579: # HPack (.hpk)
1580: 0 string HPAK HPack archive data
1581: # HAP
1582: 0 string \x91\x33HF HAP archive data
1583: # MD/MDCD
1584: 0 string MDmd MDCD archive data
1585: # LIM
1586: 0 string LIM\x1a LIM archive data
1587: # SAR
1588: 3 string LH5 SAR archive data
1589: # BSArc/BS2
1590: 0 string \212\3SB \0 BSArc/BS2 archive data
1591: # MAR
1592: 2 string =-ah MAR archive data
1593: # ACB
1594: 0 belong&0x00f800ff 0x00800000 ACB archive data
1595: # CPZ
1596: # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
1597: # JRC
1598: 0 string JRchive JRC archive data
1599: # Quantum
1600: 0 string DS\0 Quantum archive data
1601: # ReSOF
1602: 0 string PK\3\6 ReSOF archive data
1603: # QuArk
1604: 0 string 7\4 QuArk archive data
1605: # YAC
1606: 14 string YC YAC archive data
1607: # X1
1608: 0 string X1 X1 archive data
1609: 0 string XhDr X1 archive data
1610: # CDC Codec (.dqt)
1611: 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
1612: # AMGC
1613: 0 string \xad6" AMGC archive data
1614: # NuLIB
1615: 0 string NõFélå NuLIB archive data
1616: # PakLeo
1617: 0 string LEOLZW PAKLeo archive data
1618: # ChArc
1619: 0 string SChF ChArc archive data
1620: # PSA
1621: 0 string PSA PSA archive data
1622: # CrossePAC
1623: 0 string DSIGDCC CrossePAC archive data
1624: # Freeze
1625: 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
1626: # KBoom
1627: 0 string ¨MP¨ KBoom archive data
1628: # NSQ, must go after CDC Codec
1629: 0 string \x76\xff NSQ archive data
1630: # DPA
1631: 0 string Dirk\ Paehl DPA archive data
1632: # BA
1633: # TODO: idarc says "bytes 0-2 == bytes 3-5"
1634: # TTComp
1635: 0 string \0\6 TTComp archive data
1636: # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
1637: 0 string ESP ESP archive data
1638: # ZPack
1639: 0 string \1ZPK\1 ZPack archive data
1640: # Sky
1641: 0 string \xbc\x40 Sky archive data
1642: # UFA
1643: 0 string UFA UFA archive data
1644: # Dry
1645: 0 string =-H2O DRY archive data
1646: # FoxSQZ
1647: 0 string FOXSQZ FoxSQZ archive data
1648: # AR7
1649: 0 string ,AR7 AR7 archive data
1650: # PPMZ
1651: 0 string PPMZ PPMZ archive data
1652: # MS Compress
1653: 4 string \x88\xf0\x27 MS Compress archive data
1654: # updated by Joerg Jenderek
1655: >9 string \0
1656: >>0 string KWAJ
1657: >>>7 string \321\003 MS Compress archive data
1658: >>>>14 ulong >0 \b, original size: %ld bytes
1659: >>>>18 ubyte >0x65
1660: >>>>>18 string x \b, was %.8s
1661: >>>>>(10.b-4) string x \b.%.3s
1662: # MP3 (archiver, not lossy audio compression)
1663: 0 string MP3\x1a MP3-Archiver archive data
1664: # ZET
1665: 0 string OZÃ ZET archive data
1666: # TSComp
1667: 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
1668: # ARQ
1669: 0 string gW\4\1 ARQ archive data
1670: # Squash
1671: 3 string OctSqu Squash archive data
1672: # Terse
1673: 0 string \5\1\1\0 Terse archive data
1674: # PUCrunch
1675: 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
1676: # UHarc
1677: 0 string UHA UHarc archive data
1678: # ABComp
1679: 0 string \2AB ABComp archive data
1680: 0 string \3AB2 ABComp archive data
1681: # CMP
1682: 0 string CO\0 CMP archive data
1683: # Splint
1684: 0 string \x93\xb9\x06 Splint archive data
1685: # InstallShield
1686: 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
1687: # Gather
1688: 1 string GTH Gather archive data
1689: # BOA
1690: 0 string BOA BOA archive data
1691: # RAX
1692: 0 string ULEB\xa RAX archive data
1693: # Xtreme
1694: 0 string ULEB\0 Xtreme archive data
1695: # Pack Magic
1696: 0 string @â\1\0 Pack Magic archive data
1697: # BTS
1698: 0 belong&0xfeffffff 0x1a034465 BTS archive data
1699: # ELI 5750
1700: 0 string Ora\ ELI 5750 archive data
1701: # QFC
1702: 0 string \x1aFC\x1a QFC archive data
1703: 0 string \x1aQF\x1a QFC archive data
1704: # PRO-PACK
1705: 0 string RNC PRO-PACK archive data
1706: # 777
1707: 0 string 777 777 archive data
1708: # LZS221
1709: 0 string sTaC LZS221 archive data
1710: # HPA
1711: 0 string HPA HPA archive data
1712: # Arhangel
1713: 0 string LG Arhangel archive data
1714: # EXP1, uses bzip2
1715: 0 string 0123456789012345BZh EXP1 archive data
1716: # IMP
1717: 0 string IMP\xa IMP archive data
1718: # NRV
1719: 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
1720: # Squish
1721: 0 string \x73\xb2\x90\xf4 Squish archive data
1722: # Par
1723: 0 string PHILIPP Par archive data
1724: 0 string PAR Par archive data
1725: # HIT
1726: 0 string UB HIT archive data
1727: # SBX
1728: 0 belong&0xfffff000 0x53423000 SBX archive data
1729: # NaShrink
1730: 0 string NSK NaShrink archive data
1731: # SAPCAR
1732: 0 string #\ CAR\ archive\ header SAPCAR archive data
1733: 0 string CAR\ 2.00RG SAPCAR archive data
1734: # Disintegrator
1735: 0 string DST Disintegrator archive data
1736: # ASD
1737: 0 string ASD ASD archive data
1738: # InstallShield CAB
1739: 0 string ISc( InstallShield CAB
1740: # TOP4
1741: 0 string T4\x1a TOP4 archive data
1742: # BatComp left out: sig looks like COM executable
1743: # so TODO: get real 4dos batcomp file and find sig
1744: # BlakHole
1745: 0 string BH\5\7 BlakHole archive data
1746: # BIX
1747: 0 string BIX0 BIX archive data
1748: # ChiefLZA
1749: 0 string ChfLZ ChiefLZA archive data
1750: # Blink
1751: 0 string Blink Blink archive data
1752: # Logitech Compress
1753: 0 string \xda\xfa Logitech Compress archive data
1754: # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1755: 1 string (C)\ STEPANYUK ARS-Sfx archive data
1756: # AKT/AKT32
1757: 0 string AKT32 AKT32 archive data
1758: 0 string AKT AKT archive data
1759: # NPack
1760: 0 string MSTSM NPack archive data
1761: # PFT
1762: 0 string \0\x50\0\x14 PFT archive data
1763: # SemOne
1764: 0 string SEM SemOne archive data
1765: # PPMD
1766: 0 string \x8f\xaf\xac\x84 PPMD archive data
1767: # FIZ
1768: 0 string FIZ FIZ archive data
1769: # MSXiE
1770: 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
1771: # DeepFreezer
1772: 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
1773: # DC
1774: 0 string =<DC- DC archive data
1775: # TPac
1776: 0 string \4TPAC\3 TPac archive data
1777: # Ai
1778: 0 string Ai\1\1\0 Ai archive data
1779: 0 string Ai\1\0\0 Ai archive data
1780: # Ai32
1781: 0 string Ai\2\0 Ai32 archive data
1782: 0 string Ai\2\1 Ai32 archive data
1783: # SBC
1784: 0 string SBC SBC archive data
1785: # Ybs
1786: 0 string YBS Ybs archive data
1787: # DitPack
1788: 0 string \x9e\0\0 DitPack archive data
1789: # DMS
1790: 0 string DMS! DMS archive data
1791: # EPC
1792: 0 string \x8f\xaf\xac\x8c EPC archive data
1793: # VSARC
1794: 0 string VS\x1a VSARC archive data
1795: # PDZ
1796: 0 string PDZ PDZ archive data
1797: # ReDuq
1798: 0 string rdqx ReDuq archive data
1799: # GCA
1800: 0 string GCAX GCA archive data
1801: # PPMN
1802: 0 string pN PPMN archive data
1803: # WinImage
1804: 3 string WINIMAGE WinImage archive data
1805: # Compressia
1806: 0 string CMP0CMP Compressia archive data
1807: # UHBC
1808: 0 string UHB UHBC archive data
1809: # WinHKI
1810: 0 string \x61\x5C\x04\x05 WinHKI archive data
1811: # WWPack data file
1812: 0 string WWP WWPack archive data
1813: # BSN (BSA, PTS-DOS)
1814: 0 string \xffBSG BSN archive data
1815: 1 string \xffBSG BSN archive data
1816: 3 string \xffBSG BSN archive data
1817: 1 string \0\xae\2 BSN archive data
1818: 1 string \0\xae\3 BSN archive data
1819: 1 string \0\xae\7 BSN archive data
1820: # AIN
1821: 0 string \x33\x18 AIN archive data
1822: 0 string \x33\x17 AIN archive data
1823: # XPA32
1824: 0 string xpa\0\1 XPA32 archive data
1825: # SZip (TODO: doesn't catch all versions)
1826: 0 string SZ\x0a\4 SZip archive data
1827: # XPack DiskImage
1828: 0 string jm XPack DiskImage archive data
1829: # XPack Data
1830: 0 string xpa XPack archive data
1831: # XPack Single Data
1832: 0 string Ã\ jm XPack single archive data
1833:
1834: # TODO: missing due to unknown magic/magic at end of file:
1835: #DWC
1836: #ARG
1837: #ZAR
1838: #PC/3270
1839: #InstallIt
1840: #RKive
1841: #RK
1842: #XPack Diskimage
1843:
1844: # These were inspired by idarc, but actually verified
1845: # Dzip archiver (.dz)
1846: 0 string DZ Dzip archive data
1847: >2 byte x \b, version %i
1848: >3 byte x \b.%i
1849: # ZZip archiver (.zz)
1850: 0 string ZZ\ \0\0 ZZip archive data
1851: 0 string ZZ0 ZZip archive data
1852: # PAQ archiver (.paq)
1853: 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
1854: 0 string PAQ PAQ archive data
1855: >3 byte&0xf0 0x30
1856: >>3 byte x (v%c)
1857: # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
1858: 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
1859: 0 string JARCS JAR (ARJ Software, Inc.) archive data
1860:
1861: # ARJ archiver (jason@jarthur.Claremont.EDU)
1862: 0 leshort 0xea60 ARJ archive data
1863: !:mime application/x-arj
1864: >5 byte x \b, v%d,
1865: >8 byte &0x04 multi-volume,
1866: >8 byte &0x10 slash-switched,
1867: >8 byte &0x20 backup,
1868: >34 string x original name: %s,
1869: >7 byte 0 os: MS-DOS
1870: >7 byte 1 os: PRIMOS
1871: >7 byte 2 os: Unix
1872: >7 byte 3 os: Amiga
1873: >7 byte 4 os: Macintosh
1874: >7 byte 5 os: OS/2
1875: >7 byte 6 os: Apple ][ GS
1876: >7 byte 7 os: Atari ST
1877: >7 byte 8 os: NeXT
1878: >7 byte 9 os: VAX/VMS
1879: >3 byte >0 %d]
1880: # [JW] idarc says this is also possible
1881: 2 leshort 0xea60 ARJ archive data
1882:
1883: # HA archiver (Greg Roelofs, newt@uchicago.edu)
1884: # This is a really bad format. A file containing HAWAII will match this...
1885: #0 string HA HA archive data,
1886: #>2 leshort =1 1 file,
1887: #>2 leshort >1 %u files,
1888: #>4 byte&0x0f =0 first is type CPY
1889: #>4 byte&0x0f =1 first is type ASC
1890: #>4 byte&0x0f =2 first is type HSC
1891: #>4 byte&0x0f =0x0e first is type DIR
1892: #>4 byte&0x0f =0x0f first is type SPECIAL
1893: # suggestion: at least identify small archives (<1024 files)
1894: 0 belong&0xffff00fc 0x48410000 HA archive data
1895: >2 leshort =1 1 file,
1896: >2 leshort >1 %u files,
1897: >4 byte&0x0f =0 first is type CPY
1898: >4 byte&0x0f =1 first is type ASC
1899: >4 byte&0x0f =2 first is type HSC
1900: >4 byte&0x0f =0x0e first is type DIR
1901: >4 byte&0x0f =0x0f first is type SPECIAL
1902:
1903: # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
1904: 0 string HPAK HPACK archive data
1905:
1906: # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
1907: 0 string \351,\001JAM\ JAM archive,
1908: >7 string >\0 version %.4s
1909: >0x26 byte =0x27 -
1910: >>0x2b string >\0 label %.11s,
1911: >>0x27 lelong x serial %08x,
1912: >>0x36 string >\0 fstype %.8s
1913:
1914: # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
1915: 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
1916: !:mime application/x-lharc
1917: 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
1918: !:mime application/x-lharc
1919: 2 string -lz4- LHarc 1.x archive data [lz4]
1920: !:mime application/x-lharc
1921: 2 string -lz5- LHarc 1.x archive data [lz5]
1922: !:mime application/x-lharc
1923: # [never seen any but the last; -lh4- reported in comp.compression:]
1924: 2 string -lzs- LHa/LZS archive data [lzs]
1925: !:mime application/x-lha
1926: 2 string -lh\40- LHa 2.x? archive data [lh ]
1927: !:mime application/x-lha
1928: 2 string -lhd- LHa 2.x? archive data [lhd]
1929: !:mime application/x-lha
1930: 2 string -lh2- LHa 2.x? archive data [lh2]
1931: !:mime application/x-lha
1932: 2 string -lh3- LHa 2.x? archive data [lh3]
1933: !:mime application/x-lha
1934: 2 string -lh4- LHa (2.x) archive data [lh4]
1935: !:mime application/x-lha
1936: 2 string -lh5- LHa (2.x) archive data [lh5]
1937: !:mime application/x-lha
1938: 2 string -lh6- LHa (2.x) archive data [lh6]
1939: !:mime application/x-lha
1940: 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
1941: !:mime application/x-lha
1942: >20 byte x - header level %d
1943: # taken from idarc [JW]
1944: 2 string -lZ PUT archive data
1945: 2 string -lz LZS archive data
1946: 2 string -sw1- Swag archive data
1947:
1948: # RAR archiver (Greg Roelofs, newt@uchicago.edu)
1949: 0 string Rar! RAR archive data,
1950: !:mime application/x-rar
1951: >44 byte x v%0x,
1952: >10 byte >0 flags:
1953: >>10 byte &0x01 Archive volume,
1954: >>10 byte &0x02 Commented,
1955: >>10 byte &0x04 Locked,
1956: >>10 byte &0x08 Solid,
1957: >>10 byte &0x20 Authenticated,
1958: >35 byte 0 os: MS-DOS
1959: >35 byte 1 os: OS/2
1960: >35 byte 2 os: Win32
1961: >35 byte 3 os: Unix
1962: # some old version? idarc says:
1963: 0 string RE\x7e\x5e RAR archive data
1964:
1965: # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
1966: 0 string SQSH squished archive data (Acorn RISCOS)
1967:
1968: # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
1969: # [JW] see exe section for self-extracting version
1970: 0 string UC2\x1a UC2 archive data
1971:
1.1.1.2 ! misho 1972: # PKZIP multi-volume archive
! 1973: 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
! 1974: !:mime application/zip
! 1975:
1.1 misho 1976: # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
1977: 0 string PK\003\004
1.1.1.2 ! misho 1978: >30 ubelong !0x6d696d65
! 1979: >>4 byte 0x00 Zip archive data
1.1 misho 1980: !:mime application/zip
1.1.1.2 ! misho 1981: >>4 byte 0x09 Zip archive data, at least v0.9 to extract
1.1 misho 1982: !:mime application/zip
1.1.1.2 ! misho 1983: >>4 byte 0x0a Zip archive data, at least v1.0 to extract
1.1 misho 1984: !:mime application/zip
1.1.1.2 ! misho 1985: >>4 byte 0x0b Zip archive data, at least v1.1 to extract
1.1 misho 1986: !:mime application/zip
1.1.1.2 ! misho 1987: >>0x161 string WINZIP Zip archive data, WinZIP self-extracting
1.1 misho 1988: !:mime application/zip
1.1.1.2 ! misho 1989: >>4 byte 0x14 Zip archive data, at least v2.0 to extract
1.1 misho 1990: !:mime application/zip
1991:
1992: # OpenOffice.org / KOffice / StarOffice documents
1993: # Listed here because they ARE zip files
1994: #
1995: # From: Abel Cheung <abel@oaka.org>
1.1.1.2 ! misho 1996: >30 string mimetype
1.1 misho 1997:
1998: # KOffice (1.2 or above) formats
1.1.1.2 ! misho 1999: >>50 string vnd.kde. KOffice (>=1.2)
! 2000: >>>58 string karbon Karbon document
! 2001: >>>58 string kchart KChart document
! 2002: >>>58 string kformula KFormula document
! 2003: >>>58 string kivio Kivio document
! 2004: >>>58 string kontour Kontour document
! 2005: >>>58 string kpresenter KPresenter document
! 2006: >>>58 string kspread KSpread document
! 2007: >>>58 string kword KWord document
1.1 misho 2008:
2009: # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
1.1.1.2 ! misho 2010: >>50 string vnd.sun.xml. OpenOffice.org 1.x
! 2011: >>>62 string writer Writer
! 2012: >>>>68 byte !0x2e document
! 2013: >>>>68 string .template template
! 2014: >>>>68 string .global global document
! 2015: >>>62 string calc Calc
! 2016: >>>>66 byte !0x2e spreadsheet
! 2017: >>>>66 string .template template
! 2018: >>>62 string draw Draw
! 2019: >>>>66 byte !0x2e document
! 2020: >>>>66 string .template template
! 2021: >>>62 string impress Impress
! 2022: >>>>69 byte !0x2e presentation
! 2023: >>>>69 string .template template
! 2024: >>>62 string math Math document
! 2025: >>>62 string base Database file
1.1 misho 2026:
2027: # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
2028: # http://lists.oasis-open.org/archives/office/200505/msg00006.html
1.1.1.2 ! misho 2029: >>50 string vnd.oasis.opendocument. OpenDocument
! 2030: >>>73 string text
! 2031: >>>>77 byte !0x2d Text
1.1 misho 2032: !:mime application/vnd.oasis.opendocument.text
1.1.1.2 ! misho 2033: >>>>77 string -template Text Template
! 2034: !:mime application/vnd.oasis.opendocument.text-template
! 2035: >>>>77 string -web HTML Document Template
! 2036: !:mime application/vnd.oasis.opendocument.text-web
! 2037: >>>>77 string -master Master Document
! 2038: !:mime application/vnd.oasis.opendocument.text-master
! 2039: >>>73 string graphics
! 2040: >>>>81 byte !0x2d Drawing
! 2041: !:mime application/vnd.oasis.opendocument.graphics
! 2042: >>>>81 string -template Template
! 2043: !:mime application/vnd.oasis.opendocument.graphics-template
! 2044: >>>73 string presentation
! 2045: >>>>85 byte !0x2d Presentation
! 2046: !:mime application/vnd.oasis.opendocument.presentation
! 2047: >>>>85 string -template Template
! 2048: !:mime application/vnd.oasis.opendocument.presentation-template
! 2049: >>>73 string spreadsheet
! 2050: >>>>84 byte !0x2d Spreadsheet
! 2051: !:mime application/vnd.oasis.opendocument.spreadsheet
! 2052: >>>>84 string -template Template
! 2053: !:mime application/vnd.oasis.opendocument.spreadsheet-template
! 2054: >>>73 string chart
! 2055: >>>>78 byte !0x2d Chart
! 2056: !:mime application/vnd.oasis.opendocument.chart
! 2057: >>>>78 string -template Template
! 2058: !:mime application/vnd.oasis.opendocument.chart-template
! 2059: >>>73 string formula
! 2060: >>>>80 byte !0x2d Formula
! 2061: !:mime application/vnd.oasis.opendocument.formula
! 2062: >>>>80 string -template Template
! 2063: !:mime application/vnd.oasis.opendocument.formula-template
! 2064: >>>73 string database Database
! 2065: !:mime application/vnd.oasis.opendocument.database
! 2066: >>>73 string image
! 2067: >>>>78 byte !0x2d Image
! 2068: !:mime application/vnd.oasis.opendocument.image
! 2069: >>>>78 string -template Template
! 2070: !:mime application/vnd.oasis.opendocument.image-template
1.1 misho 2071:
2072: # Zoo archiver
2073: 20 lelong 0xfdc4a7dc Zoo archive data
2074: !:mime application/x-zoo
2075: >4 byte >48 \b, v%c.
2076: >>6 byte >47 \b%c
2077: >>>7 byte >47 \b%c
2078: >32 byte >0 \b, modify: v%d
2079: >>33 byte x \b.%d+
2080: >42 lelong 0xfdc4a7dc \b,
2081: >>70 byte >0 extract: v%d
2082: >>>71 byte x \b.%d+
2083:
2084: # Shell archives
2085: 10 string #\ This\ is\ a\ shell\ archive shell archive text
2086: !:mime application/octet-stream
2087:
2088: #
2089: # LBR. NB: May conflict with the questionable
2090: # "binary Computer Graphics Metafile" format.
2091: #
2092: 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
2093: #
2094: # PMA (CP/M derivative of LHA)
2095: #
2096: 2 string -pm0- PMarc archive data [pm0]
2097: 2 string -pm1- PMarc archive data [pm1]
2098: 2 string -pm2- PMarc archive data [pm2]
2099: 2 string -pms- PMarc SFX archive (CP/M, DOS)
2100: 5 string -pc1- PopCom compressed executable (CP/M)
2101:
2102: # From Rafael Laboissiere <rafael@laboissiere.net>
2103: # The Project Revision Control System (see
2104: # http://prcs.sourceforge.net) generates a packaged project
2105: # file which is recognized by the following entry:
2106: 0 leshort 0xeb81 PRCS packaged project
2107:
2108: # Microsoft cabinets
2109: # by David Necas (Yeti) <yeti@physics.muni.cz>
2110: #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
2111: #>25 byte x v%d
2112: #>24 byte x \b.%d
2113: # MPi: All CABs have version 1.3, so this is pointless.
2114: # Better magic in debian-additions.
2115:
2116: # GTKtalog catalogs
2117: # by David Necas (Yeti) <yeti@physics.muni.cz>
2118: 4 string gtktalog\ GTKtalog catalog data,
2119: >13 string 3 version 3
2120: >>14 beshort 0x677a (gzipped)
2121: >>14 beshort !0x677a (not gzipped)
2122: >13 string >3 version %s
2123:
2124: ############################################################################
2125: # Parity archive reconstruction file, the 'par' file format now used on Usenet.
2126: 0 string PAR\0 PARity archive data
2127: >48 leshort =0 - Index file
2128: >48 leshort >0 - file number %d
2129:
2130: # Felix von Leitner <felix-file@fefe.de>
2131: 0 string d8:announce BitTorrent file
2132: !:mime application/x-bittorrent
2133:
2134: # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
2135: 0 beshort 0x0e0f Atari MSA archive data
2136: >2 beshort x \b, %d sectors per track
2137: >4 beshort 0 \b, 1 sided
2138: >4 beshort 1 \b, 2 sided
2139: >6 beshort x \b, starting track: %d
2140: >8 beshort x \b, ending track: %d
2141:
2142: # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
2143: 0 string PK00PK\003\004 Zip archive data
2144:
2145: # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
2146: # by Stefan `Sec` Zehl <sec@42.org>
2147: 7 string **ACE** ACE archive data
2148: >15 byte >0 version %d
2149: >16 byte =0x00 \b, from MS-DOS
2150: >16 byte =0x01 \b, from OS/2
2151: >16 byte =0x02 \b, from Win/32
2152: >16 byte =0x03 \b, from Unix
2153: >16 byte =0x04 \b, from MacOS
2154: >16 byte =0x05 \b, from WinNT
2155: >16 byte =0x06 \b, from Primos
2156: >16 byte =0x07 \b, from AppleGS
2157: >16 byte =0x08 \b, from Atari
2158: >16 byte =0x09 \b, from Vax/VMS
2159: >16 byte =0x0A \b, from Amiga
2160: >16 byte =0x0B \b, from Next
2161: >14 byte x \b, version %d to extract
2162: >5 leshort &0x0080 \b, multiple volumes,
2163: >>17 byte x \b (part %d),
2164: >5 leshort &0x0002 \b, contains comment
2165: >5 leshort &0x0200 \b, sfx
2166: >5 leshort &0x0400 \b, small dictionary
2167: >5 leshort &0x0800 \b, multi-volume
2168: >5 leshort &0x1000 \b, contains AV-String
2169: >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
2170: >5 leshort &0x2000 \b, with recovery record
2171: >5 leshort &0x4000 \b, locked
2172: >5 leshort &0x8000 \b, solid
2173: # Date in MS-DOS format (whatever that is)
2174: #>18 lelong x Created on
2175:
2176: # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
2177: # <doj@cubic.org>
2178: 0x1A string sfArk sfArk compressed Soundfont
2179: >0x15 string 2
2180: >>0x1 string >\0 Version %s
2181: >>0x2A string >\0 : %s
2182:
2183: # DR-DOS 7.03 Packed File *.??_
2184: 0 string Packed\ File\ Personal NetWare Packed File
2185: >12 string x \b, was "%.12s"
2186:
2187: # EET archive
2188: # From: Tilman Sauerbeck <tilman@code-monkey.de>
2189: 0 belong 0x1ee7ff00 EET archive
2190: !:mime application/x-eet
2191:
2192: # rzip archives
2193: 0 string RZIP rzip compressed data
2194: >4 byte x - version %d
2195: >5 byte x \b.%d
2196: >6 belong x (%d bytes)
2197:
2198: # From: "Robert Dale" <robdale@gmail.com>
2199: 0 belong 123 dar archive,
2200: >4 belong x label "%.8x
2201: >>8 belong x %.8x
2202: >>>12 beshort x %.4x"
2203: >14 byte 0x54 end slice
2204: >14 beshort 0x4e4e multi-part
2205: >14 beshort 0x4e53 multi-part, with -S
2206:
2207: # Symbian installation files
2208: # http://www.thouky.co.uk/software/psifs/sis.html
2209: # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
2210: 8 lelong 0x10000419 Symbian installation file
2211: !:mime application/vnd.symbian.install
2212: >4 lelong 0x1000006D (EPOC release 3/4/5)
2213: >4 lelong 0x10003A12 (EPOC release 6)
2214: 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
2215: !:mime x-epoc/x-sisx-app
2216:
2217: # From "Nelson A. de Oliveira" <naoliv@gmail.com>
2218: 0 string MPQ\032 MoPaQ (MPQ) archive
2219:
2220: # From: Dirk Jagdmann <doj@cubic.org>
2221: # xar archive format: http://code.google.com/p/xar/
2222: 0 string xar! xar archive
2223: >6 beshort x - version %ld
2224:
2225: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2226: # .kgb
2227: 0 string KGB_arch KGB Archiver file
2228: >10 string x with compression level %.1s
2229:
2230: # xar (eXtensible ARchiver) archive
2231: # From: "David Remahl" <dremahl@apple.com>
2232: 0 string xar! xar archive
2233: #>4 beshort x header size %d
2234: >6 beshort x version %d,
2235: #>8 quad x compressed TOC: %d,
2236: #>16 quad x uncompressed TOC: %d,
2237: >24 belong 0 no checksum
2238: >24 belong 1 SHA-1 checksum
2239: >24 belong 2 MD5 checksum
2240:
2241: # Type: Parity Archive
2242: # From: Daniel van Eeden <daniel_e@dds.nl>
1.1.1.2 ! misho 2243: 0 string PAR2 Parity Archive Volume Set
! 2244:
! 2245: # Bacula volume format. (Volumes always start with a block header.)
! 2246: # URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
! 2247: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 2248: 12 string BB02 Bacula volume
! 2249: >20 bedate x \b, started %s
1.1 misho 2250:
2251: #------------------------------------------------------------------------------
1.1.1.2 ! misho 2252: # $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 2253: # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
2254: # strings as "long" - we assume they're just strings:
2255: # From: guy@netapp.com (Guy Harris)
2256: #
2257: 0 string *STA Aster*x
2258: >7 string WORD Words Document
2259: >7 string GRAP Graphic
2260: >7 string SPRE Spreadsheet
2261: >7 string MACR Macro
2262: 0 string 2278 Aster*x Version 2
2263: >29 byte 0x36 Words Document
2264: >29 byte 0x35 Graphic
2265: >29 byte 0x32 Spreadsheet
2266: >29 byte 0x38 Macro
2267:
2268:
2269: #------------------------------------------------------------------------------
1.1.1.2 ! misho 2270: # $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 2271: # att3b: file(1) magic for AT&T 3B machines
2272: #
2273: # The `versions' should be un-commented if they work for you.
2274: # (Was the problem just one of endianness?)
2275: #
2276: # 3B20
2277: #
2278: # The 3B20 conflicts with SCCS.
2279: #0 beshort 0550 3b20 COFF executable
2280: #>12 belong >0 not stripped
2281: #>22 beshort >0 - version %ld
2282: #0 beshort 0551 3b20 COFF executable (TV)
2283: #>12 belong >0 not stripped
2284: #>22 beshort >0 - version %ld
2285: #
2286: # WE32K
2287: #
2288: 0 beshort 0560 WE32000 COFF
2289: >18 beshort ^00000020 object
2290: >18 beshort &00000020 executable
2291: >12 belong >0 not stripped
2292: >18 beshort ^00010000 N/A on 3b2/300 w/paging
2293: >18 beshort &00020000 32100 required
2294: >18 beshort &00040000 and MAU hardware required
2295: >20 beshort 0407 (impure)
2296: >20 beshort 0410 (pure)
2297: >20 beshort 0413 (demand paged)
2298: >20 beshort 0443 (target shared library)
2299: >22 beshort >0 - version %ld
2300: 0 beshort 0561 WE32000 COFF executable (TV)
2301: >12 belong >0 not stripped
2302: #>18 beshort &00020000 - 32100 required
2303: #>18 beshort &00040000 and MAU hardware required
2304: #>22 beshort >0 - version %ld
2305: #
2306: # core file for 3b2
2307: 0 string \000\004\036\212\200 3b2 core file
2308: >364 string >\0 of '%s'
1.1.1.2 ! misho 2309:
1.1 misho 2310: #------------------------------------------------------------------------------
1.1.1.2 ! misho 2311: # $File: audio,v 1.59 2009/11/04 17:27:37 christos Exp $
1.1 misho 2312: # audio: file(1) magic for sound formats (see also "iff")
2313: #
2314: # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
2315: # and others
2316: #
2317:
2318: # Sun/NeXT audio data
2319: 0 string .snd Sun/NeXT audio data:
2320: >12 belong 1 8-bit ISDN mu-law,
2321: !:mime audio/basic
2322: >12 belong 2 8-bit linear PCM [REF-PCM],
2323: !:mime audio/basic
2324: >12 belong 3 16-bit linear PCM,
2325: !:mime audio/basic
2326: >12 belong 4 24-bit linear PCM,
2327: !:mime audio/basic
2328: >12 belong 5 32-bit linear PCM,
2329: !:mime audio/basic
2330: >12 belong 6 32-bit IEEE floating point,
2331: !:mime audio/basic
2332: >12 belong 7 64-bit IEEE floating point,
2333: !:mime audio/basic
2334: >12 belong 8 Fragmented sample data,
2335: >12 belong 10 DSP program,
2336: >12 belong 11 8-bit fixed point,
2337: >12 belong 12 16-bit fixed point,
2338: >12 belong 13 24-bit fixed point,
2339: >12 belong 14 32-bit fixed point,
2340: >12 belong 18 16-bit linear with emphasis,
2341: >12 belong 19 16-bit linear compressed,
2342: >12 belong 20 16-bit linear with emphasis and compression,
2343: >12 belong 21 Music kit DSP commands,
2344: >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2345: !:mime audio/x-adpcm
2346: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2347: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2348: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2349: >12 belong 27 8-bit A-law (CCITT G.711),
2350: >20 belong 1 mono,
2351: >20 belong 2 stereo,
2352: >20 belong 4 quad,
2353: >16 belong >0 %d Hz
2354:
2355: # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
2356: # that uses little-endian encoding and has a different magic number
2357: 0 lelong 0x0064732E DEC audio data:
2358: >12 lelong 1 8-bit ISDN mu-law,
2359: !:mime audio/x-dec-basic
2360: >12 lelong 2 8-bit linear PCM [REF-PCM],
2361: !:mime audio/x-dec-basic
2362: >12 lelong 3 16-bit linear PCM,
2363: !:mime audio/x-dec-basic
2364: >12 lelong 4 24-bit linear PCM,
2365: !:mime audio/x-dec-basic
2366: >12 lelong 5 32-bit linear PCM,
2367: !:mime audio/x-dec-basic
2368: >12 lelong 6 32-bit IEEE floating point,
2369: !:mime audio/x-dec-basic
2370: >12 lelong 7 64-bit IEEE floating point,
2371: !:mime audio/x-dec-basic
2372: >12 belong 8 Fragmented sample data,
2373: >12 belong 10 DSP program,
2374: >12 belong 11 8-bit fixed point,
2375: >12 belong 12 16-bit fixed point,
2376: >12 belong 13 24-bit fixed point,
2377: >12 belong 14 32-bit fixed point,
2378: >12 belong 18 16-bit linear with emphasis,
2379: >12 belong 19 16-bit linear compressed,
2380: >12 belong 20 16-bit linear with emphasis and compression,
2381: >12 belong 21 Music kit DSP commands,
2382: >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2383: !:mime audio/x-dec-basic
2384: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2385: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2386: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2387: >12 belong 27 8-bit A-law (CCITT G.711),
2388: >20 lelong 1 mono,
2389: >20 lelong 2 stereo,
2390: >20 lelong 4 quad,
2391: >16 lelong >0 %d Hz
2392:
2393: # Creative Labs AUDIO stuff
2394: 0 string MThd Standard MIDI data
2395: !:mime audio/midi
2396: >8 beshort x (format %d)
2397: >10 beshort x using %d track
2398: >10 beshort >1 \bs
2399: >12 beshort&0x7fff x at 1/%d
2400: >12 beshort&0x8000 >0 SMPTE
2401:
2402: 0 string CTMF Creative Music (CMF) data
2403: !:mime audio/x-unknown
2404: 0 string SBI SoundBlaster instrument data
2405: !:mime audio/x-unknown
2406: 0 string Creative\ Voice\ File Creative Labs voice data
2407: !:mime audio/x-unknown
2408: # is this next line right? it came this way...
2409: >19 byte 0x1A
2410: >23 byte >0 - version %d
2411: >22 byte >0 \b.%d
2412:
2413: # first entry is also the string "NTRK"
2414: 0 belong 0x4e54524b MultiTrack sound data
2415: >4 belong x - version %ld
2416:
2417: # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
2418: # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
2419: 0 string EMOD Extended MOD sound data,
2420: >4 byte&0xf0 x version %d
2421: >4 byte&0x0f x \b.%d,
2422: >45 byte x %d instruments
2423: >83 byte 0 (module)
2424: >83 byte 1 (song)
2425:
2426: # Real Audio (Magic .ra\0375)
2427: 0 belong 0x2e7261fd RealAudio sound file
2428: !:mime audio/x-pn-realaudio
2429: 0 string .RMF\0\0\0 RealMedia file
2430: !:mime application/vnd.rn-realmedia
2431: #video/x-pn-realvideo
2432: #video/vnd.rn-realvideo
2433: #application/vnd.rn-realmedia
2434: # sigh, there are many mimes for that but the above are the most common.
2435:
2436: # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
2437: # Oct 31, 1995
2438: # fixed by <doj@cubic.org> 2003-06-24
2439: # Too short...
2440: #0 string MTM MultiTracker Module sound file
2441: #0 string if Composer 669 Module sound data
2442: #0 string JN Composer 669 Module sound data (extended format)
2443: 0 string MAS_U ULT(imate) Module sound data
2444:
2445: #0 string FAR Module sound data
2446: #>4 string >\15 Title: "%s"
2447:
2448: 0x2c string SCRM ScreamTracker III Module sound data
2449: >0 string >\0 Title: "%s"
2450:
2451: # Gravis UltraSound patches
2452: # From <ache@nagual.ru>
2453:
2454: 0 string GF1PATCH110\0ID#000002\0 GUS patch
2455: 0 string GF1PATCH100\0ID#000002\0 Old GUS patch
2456:
2457: # mime types according to http://www.geocities.com/nevilo/mod.htm:
2458: # audio/it .it
2459: # audio/x-zipped-it .itz
2460: # audio/xm fasttracker modules
2461: # audio/x-s3m screamtracker modules
2462: # audio/s3m screamtracker modules
2463: # audio/x-zipped-mod mdz
2464: # audio/mod mod
2465: # audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
2466:
2467: #
2468: # Taken from loader code from mikmod version 2.14
2469: # by Steve McIntyre (stevem@chiark.greenend.org.uk)
2470: # <doj@cubic.org> added title printing on 2003-06-24
2471: 0 string MAS_UTrack_V00
2472: >14 string >/0 ultratracker V1.%.1s module sound data
2473: !:mime audio/x-mod
2474: #audio/x-tracker-module
2475:
2476: 0 string UN05 MikMod UNI format module sound data
2477:
2478: 0 string Extended\ Module: Fasttracker II module sound data
2479: !:mime audio/x-mod
2480: #audio/x-tracker-module
2481: >17 string >\0 Title: "%s"
2482:
2483: 21 string/c =!SCREAM! Screamtracker 2 module sound data
2484: !:mime audio/x-mod
2485: #audio/x-screamtracker-module
2486: 21 string BMOD2STM Screamtracker 2 module sound data
2487: !:mime audio/x-mod
2488: #audio/x-screamtracker-module
2489: 1080 string M.K. 4-channel Protracker module sound data
2490: !:mime audio/x-mod
2491: #audio/x-protracker-module
2492: >0 string >\0 Title: "%s"
2493: 1080 string M!K! 4-channel Protracker module sound data
2494: !:mime audio/x-mod
2495: #audio/x-protracker-module
2496: >0 string >\0 Title: "%s"
2497: 1080 string FLT4 4-channel Startracker module sound data
2498: !:mime audio/x-mod
2499: #audio/x-startracker-module
2500: >0 string >\0 Title: "%s"
2501: 1080 string FLT8 8-channel Startracker module sound data
2502: !:mime audio/x-mod
2503: #audio/x-startracker-module
2504: >0 string >\0 Title: "%s"
2505: 1080 string 4CHN 4-channel Fasttracker module sound data
2506: !:mime audio/x-mod
2507: #audio/x-fasttracker-module
2508: >0 string >\0 Title: "%s"
2509: 1080 string 6CHN 6-channel Fasttracker module sound data
2510: !:mime audio/x-mod
2511: #audio/x-fasttracker-module
2512: >0 string >\0 Title: "%s"
2513: 1080 string 8CHN 8-channel Fasttracker module sound data
2514: !:mime audio/x-mod
2515: #audio/x-fasttracker-module
2516: >0 string >\0 Title: "%s"
2517: 1080 string CD81 8-channel Octalyser module sound data
2518: !:mime audio/x-mod
2519: #audio/x-octalysertracker-module
2520: >0 string >\0 Title: "%s"
2521: 1080 string OKTA 8-channel Octalyzer module sound data
2522: !:mime audio/x-mod
2523: #audio/x-octalysertracker-module
2524: >0 string >\0 Title: "%s"
2525: # Not good enough.
2526: #1082 string CH
2527: #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
2528: 1080 string 16CN 16-channel Taketracker module sound data
2529: !:mime audio/x-mod
2530: #audio/x-taketracker-module
2531: >0 string >\0 Title: "%s"
2532: 1080 string 32CN 32-channel Taketracker module sound data
2533: !:mime audio/x-mod
2534: #audio/x-taketracker-module
2535: >0 string >\0 Title: "%s"
2536:
2537: # TOC sound files -Trevor Johnson <trevor@jpj.net>
2538: #
2539: 0 string TOC TOC sound file
2540:
2541: # sidfiles <pooka@iki.fi>
2542: # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
2543: 0 string SIDPLAY\ INFOFILE Sidplay info file
2544:
2545: 0 string PSID PlaySID v2.2+ (AMIGA) sidtune
2546: >4 beshort >0 w/ header v%d,
2547: >14 beshort =1 single song,
2548: >14 beshort >1 %d songs,
2549: >16 beshort >0 default song: %d
2550: >0x16 string >\0 name: "%s"
2551: >0x36 string >\0 author: "%s"
2552: >0x56 string >\0 copyright: "%s"
2553:
2554: 0 string RSID RSID sidtune PlaySID compatible
2555: >4 beshort >0 w/ header v%d,
2556: >14 beshort =1 single song,
2557: >14 beshort >1 %d songs,
2558: >16 beshort >0 default song: %d
2559: >0x16 string >\0 name: "%s"
2560: >0x36 string >\0 author: "%s"
2561: >0x56 string >\0 copyright: "%s"
2562:
2563: # IRCAM <mpruett@sgi.com>
2564: # VAX and MIPS files are little-endian; Sun and NeXT are big-endian
2565: 0 belong 0x64a30100 IRCAM file (VAX)
2566: 0 belong 0x64a30200 IRCAM file (Sun)
2567: 0 belong 0x64a30300 IRCAM file (MIPS little-endian)
2568: 0 belong 0x64a30400 IRCAM file (NeXT)
2569:
2570: # NIST SPHERE <mpruett@sgi.com>
2571: 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
2572:
2573: # Sample Vision <mpruett@sgi.com>
2574: 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
2575:
2576: # Audio Visual Research <tonigonenstein@users.sourceforge.net>
2577: 0 string 2BIT Audio Visual Research file,
2578: >12 beshort =0 mono,
2579: >12 beshort =-1 stereo,
2580: >14 beshort x %d bits
2581: >16 beshort =0 unsigned,
2582: >16 beshort =-1 signed,
2583: >22 belong&0x00ffffff x %d Hz,
2584: >18 beshort =0 no loop,
2585: >18 beshort =-1 loop,
2586: >21 ubyte <128 note %d,
2587: >22 byte =0 replay 5.485 KHz
2588: >22 byte =1 replay 8.084 KHz
1.1.1.2 ! misho 2589: >22 byte =2 replay 10.971 KHz
! 2590: >22 byte =3 replay 16.168 KHz
1.1 misho 2591: >22 byte =4 replay 21.942 KHz
2592: >22 byte =5 replay 32.336 KHz
2593: >22 byte =6 replay 43.885 KHz
2594: >22 byte =7 replay 47.261 KHz
2595:
2596: # SGI SoundTrack <mpruett@sgi.com>
2597: 0 string _SGI_SoundTrack SGI SoundTrack project file
2598: # ID3 version 2 tags <waschk@informatik.uni-rostock.de>
1.1.1.2 ! misho 2599: 0 string ID3 Audio file with ID3 version 2
! 2600: >3 byte x \b.%d
! 2601: >4 byte x \b.%d
! 2602: >>5 byte &0x80 \b, unsynchronized frames
! 2603: >>5 byte &0x40 \b, extended header
! 2604: >>5 byte &0x20 \b, experimental
! 2605: >>5 byte &0x10 \b, footer present
! 2606: >(6.I) indirect x \b, contains:
1.1 misho 2607:
2608: # NSF (NES sound file) magic
2609: 0 string NESM\x1a NES Sound File
2610: >14 string >\0 ("%s" by
2611: >46 string >\0 %s, copyright
2612: >78 string >\0 %s),
2613: >5 byte x version %d,
2614: >6 byte x %d tracks,
2615: >122 byte&0x2 =1 dual PAL/NTSC
2616: >122 byte&0x1 =1 PAL
2617: >122 byte&0x1 =0 NTSC
2618:
2619: # Type: SNES SPC700 sound files
2620: # From: Josh Triplett <josh@freedesktop.org>
2621: 0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
2622: >&0 string 0.30 \b, version %s
2623: >>0x23 byte 0x1B \b, without ID666 tag
2624: >>0x23 byte 0x1A \b, with ID666 tag
2625: >>>0x2E string >\0 \b, song "%.32s"
2626: >>>0x4E string >\0 \b, game "%.32s"
2627:
2628: # Impulse tracker module (audio/x-it)
2629: 0 string IMPM Impulse Tracker module sound data -
2630: !:mime audio/x-mod
2631: >4 string >\0 "%s"
2632: >40 leshort !0 compatible w/ITv%x
2633: >42 leshort !0 created w/ITv%x
2634:
2635: # Imago Orpheus module (audio/x-imf)
2636: 60 string IM10 Imago Orpheus module sound data -
2637: >0 string >\0 "%s"
2638:
2639: # From <collver1@attbi.com>
2640: # These are the /etc/magic entries to decode modules, instruments, and
2641: # samples in Impulse Tracker's native format.
2642:
2643: 0 string IMPS Impulse Tracker Sample
2644: >18 byte &2 16 bit
2645: >18 byte ^2 8 bit
2646: >18 byte &4 stereo
2647: >18 byte ^4 mono
2648: 0 string IMPI Impulse Tracker Instrument
2649: >28 leshort !0 ITv%x
2650: >30 byte !0 %d samples
2651:
2652: # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
2653: # From <collver1@attbi.com>
2654: 0 string LM8953 Yamaha TX Wave
2655: >22 byte 0x49 looped
2656: >22 byte 0xC9 non-looped
2657: >23 byte 1 33kHz
2658: >23 byte 2 50kHz
2659: >23 byte 3 16kHz
2660:
2661: # scream tracker: file(1) magic for Scream Tracker sample files
2662: #
2663: # From <collver1@attbi.com>
2664: 76 string SCRS Scream Tracker Sample
2665: >0 byte 1 sample
2666: >0 byte 2 adlib melody
2667: >0 byte >2 adlib drum
2668: >31 byte &2 stereo
2669: >31 byte ^2 mono
2670: >31 byte &4 16bit little endian
2671: >31 byte ^4 8bit
2672: >30 byte 0 unpacked
2673: >30 byte 1 packed
2674:
2675: # audio
2676: # From: Cory Dikkers <cdikkers@swbell.net>
2677: 0 string MMD0 MED music file, version 0
2678: 0 string MMD1 OctaMED Pro music file, version 1
2679: 0 string MMD3 OctaMED Soundstudio music file, version 3
2680: 0 string OctaMEDCmpr OctaMED Soundstudio compressed file
2681: 0 string MED MED_Song
2682: 0 string SymM Symphonie SymMOD music file
2683: #
2684: 0 string THX AHX version
2685: >3 byte =0 1 module data
2686: >3 byte =1 2 module data
2687: #
2688: 0 string OKTASONG Oktalyzer module data
2689: #
2690: 0 string DIGI\ Booster\ module\0 %s
2691: >20 byte >0 %c
2692: >>21 byte >0 \b%c
2693: >>>22 byte >0 \b%c
2694: >>>>23 byte >0 \b%c
2695: >610 string >\0 \b, "%s"
2696: #
2697: 0 string DBM0 DIGI Booster Pro Module
2698: >4 byte >0 V%X.
2699: >>5 byte x \b%02X
2700: >16 string >\0 \b, "%s"
2701: #
2702: 0 string FTMN FaceTheMusic module
2703: >16 string >\0d \b, "%s"
2704:
2705: # From: <doj@cubic.org> 2003-06-24
2706: 0 string AMShdr\32 Velvet Studio AMS Module v2.2
2707: 0 string Extreme Extreme Tracker AMS Module v1.3
2708: 0 string DDMF Xtracker DMF Module
2709: >4 byte x v%i
2710: >0xD string >\0 Title: "%s"
2711: >0x2B string >\0 Composer: "%s"
2712: 0 string DSM\32 Dynamic Studio Module DSM
2713: 0 string SONG DigiTrekker DTM Module
2714: 0 string DMDL DigiTrakker MDL Module
2715: 0 string PSM\32 Protracker Studio PSM Module
2716: 44 string PTMF Poly Tracker PTM Module
2717: >0 string >\32 Title: "%s"
2718: 0 string MT20 MadTracker 2.0 Module MT2
2719: 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
2720: 0 string RTMM RTM Module
2721: 0x426 string MaDoKaN96 XMS Adlib Module
2722: >0 string >\0 Composer: "%s"
2723: 0 string AMF AMF Module
2724: >4 string >\0 Title: "%s"
2725: 0 string MODINFO1 Open Cubic Player Module Inforation MDZ
2726: 0 string Extended\40Instrument: Fast Tracker II Instrument
2727:
2728: # From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
2729: # NOA Nancy Codec file
2730: 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
2731: # Yamaha SMAF format
2732: 0 string MMMD Yamaha SMAF file
2733: # Sharp Jisaku Melody format for PDC
2734: 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
2735: >20 string Ver01.00 Ver. 1.00
2736: >>32 byte x , %d tracks
2737:
2738: # Free lossless audio codec <http://flac.sourceforge.net>
2739: # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
2740: 0 string fLaC FLAC audio bitstream data
2741: !:mime audio/x-flac
2742: >4 byte&0x7f >0 \b, unknown version
2743: >4 byte&0x7f 0 \b
2744: # some common bits/sample values
2745: >>20 beshort&0x1f0 0x030 \b, 4 bit
2746: >>20 beshort&0x1f0 0x050 \b, 6 bit
2747: >>20 beshort&0x1f0 0x070 \b, 8 bit
2748: >>20 beshort&0x1f0 0x0b0 \b, 12 bit
2749: >>20 beshort&0x1f0 0x0f0 \b, 16 bit
2750: >>20 beshort&0x1f0 0x170 \b, 24 bit
2751: >>20 byte&0xe 0x0 \b, mono
2752: >>20 byte&0xe 0x2 \b, stereo
2753: >>20 byte&0xe 0x4 \b, 3 channels
2754: >>20 byte&0xe 0x6 \b, 4 channels
2755: >>20 byte&0xe 0x8 \b, 5 channels
2756: >>20 byte&0xe 0xa \b, 6 channels
2757: >>20 byte&0xe 0xc \b, 7 channels
2758: >>20 byte&0xe 0xe \b, 8 channels
2759: # some common sample rates
2760: >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
2761: >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
2762: >>17 belong&0xfffff0 0x07d000 \b, 32 kHz
2763: >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
2764: >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
2765: >>17 belong&0xfffff0 0x03e800 \b, 16 kHz
2766: >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
2767: >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
2768: >>17 belong&0xfffff0 0x01f400 \b, 8 kHz
2769: >>17 belong&0xfffff0 0x177000 \b, 96 kHz
2770: >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
2771: >>21 byte&0xf >0 \b, >4G samples
2772: >>21 byte&0xf 0 \b
2773: >>>22 belong >0 \b, %u samples
2774: >>>22 belong 0 \b, length unknown
2775:
2776: # (ISDN) VBOX voice message file (Wolfram Kleff)
2777: 0 string VBOX VBOX voice message data
2778:
2779: # ReBorn Song Files (.rbs)
2780: # David J. Singer <doc@deadvirgins.org.uk>
2781: 8 string RB40 RBS Song file
2782: >29 string ReBorn created by ReBorn
2783: >37 string Propellerhead created by ReBirth
2784:
2785: # Synthesizer Generator and Kimwitu share their file format
2786: 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
2787: # Kimwitu++ uses a slightly different magic
2788: 0 string A#S#C#S#S#L#HUB Kimwitu++ data
2789:
2790: # From "Simon Hosie
2791: 0 string TFMX-SONG TFMX module sound data
2792:
2793: # Monkey's Audio compressed audio format (.ape)
2794: # From danny.milo@gmx.net (Danny Milosavljevic)
2795: # New version from Abel Cheung <abel (@) oaka.org>
2796: 0 string MAC\040 Monkey's Audio compressed format
2797: >4 uleshort >0x0F8B version %d
2798: >>(0x08.l) uleshort =1000 with fast compression
2799: >>(0x08.l) uleshort =2000 with normal compression
2800: >>(0x08.l) uleshort =3000 with high compression
2801: >>(0x08.l) uleshort =4000 with extra high compression
2802: >>(0x08.l) uleshort =5000 with insane compression
2803: >>(0x08.l+18) uleshort =1 \b, mono
2804: >>(0x08.l+18) uleshort =2 \b, stereo
2805: >>(0x08.l+20) ulelong x \b, sample rate %d
2806: >4 uleshort <0x0F8C version %d
2807: >>6 uleshort =1000 with fast compression
2808: >>6 uleshort =2000 with normal compression
2809: >>6 uleshort =3000 with high compression
2810: >>6 uleshort =4000 with extra high compression
2811: >>6 uleshort =5000 with insane compression
2812: >>10 uleshort =1 \b, mono
2813: >>10 uleshort =2 \b, stereo
2814: >>12 ulelong x \b, sample rate %d
2815:
2816: # adlib sound files
2817: # From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
2818: 0 string RAWADATA RdosPlay RAW
2819:
2820: 1068 string RoR AMUSIC Adlib Tracker
2821:
2822: 0 string JCH EdLib
2823:
2824: 0 string mpu401tr MPU-401 Trakker
2825:
2826: 0 string SAdT Surprise! Adlib Tracker
2827: >4 byte x Version %d
2828:
2829: 0 string XAD! eXotic ADlib
2830:
2831: 0 string ofTAZ! eXtra Simple Music
2832:
2833: # Spectrum 128 tunes (.ay files).
2834: # From: Emanuel Haupt <ehaupt@critical.ch>
2835: 0 string ZXAYEMUL Spectrum 128 tune
2836:
2837: 0 string \0BONK BONK,
2838: #>5 byte x version %d
2839: >14 byte x %d channel(s),
2840: >15 byte =1 lossless,
2841: >15 byte =0 lossy,
2842: >16 byte x mid-side
2843:
2844: 384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
2845:
2846: # format VQF (proprietary codec for sound)
2847: # some infos on the header file available at :
2848: # http://www.twinvq.org/english/technology_format.html
2849: 0 string TWIN97012000 VQF data
2850: >27 short 0 \b, Mono
2851: >27 short 1 \b, Stereo
2852: >31 short >0 \b, %d kbit/s
2853: >35 short >0 \b, %d kHz
2854:
2855: # Nelson A. de Oliveira (naoliv@gmail.com)
2856: # .eqf
2857: 0 string Winamp\ EQ\ library\ file %s
2858: # it will match only versions like v<digit>.<digit>
2859: # Since I saw only eqf files with version v1.1 I think that it's OK
2860: >23 string x \b%.4s
2861: # .preset
2862: 0 string [Equalizer\ preset] XMMS equalizer preset
2863: # .m3u
2864: 0 search/1 #EXTM3U M3U playlist text
2865: # .pls
2866: 0 search/1 [playlist] PLS playlist text
2867: # licq.conf
2868: 1 string [licq] LICQ configuration file
2869:
2870: # Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
2871: 0 string ICE! SNDH Atari ST music
2872: 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
2873:
2874: # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
2875: 0 string MP+ Musepack audio
2876: >3 byte 255 \b, SV pre8
2877: >3 byte&0xF 0x6 \b, SV 6
2878: >3 byte&0xF 0x8 \b, SV 8
2879: >3 byte&0xF 0x7 \b, SV 7
2880: >>3 byte&0xF0 0x0 \b.0
2881: >>3 byte&0xF0 0x10 \b.1
2882: >>3 byte&0xF0 240 \b.15
2883: >>10 byte&0xF0 0x0 \b, no profile
2884: >>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
2885: >>10 byte&0xF0 0x50 \b, quality 0
2886: >>10 byte&0xF0 0x60 \b, quality 1
2887: >>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
2888: >>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
2889: >>10 byte&0xF0 0x90 \b, quality 4 (Radio)
2890: >>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
2891: >>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
2892: >>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
2893: >>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
2894: >>10 byte&0xF0 0xE0 \b, quality 9
2895: >>10 byte&0xF0 0xF0 \b, quality 10
2896: >>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
2897: >>27 byte 102 \b, Beta 1.02
2898: >>27 byte 104 \b, Beta 1.04
2899: >>27 byte 105 \b, Alpha 1.05
2900: >>27 byte 106 \b, Beta 1.06
2901: >>27 byte 110 \b, Release 1.1
2902: >>27 byte 111 \b, Alpha 1.11
2903: >>27 byte 112 \b, Beta 1.12
2904: >>27 byte 113 \b, Alpha 1.13
2905: >>27 byte 114 \b, Beta 1.14
2906: >>27 byte 115 \b, Alpha 1.15
2907:
2908: # IMY
2909: # from http://filext.com/detaillist.php?extdetail=IMY
2910: # http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
2911: # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
2912: # http://www.wx800.com/msg/download/irda/iMelody.pdf
2913: 0 string BEGIN:IMELODY iMelody Ringtone Format
2914:
2915: # From: "Mateus Caruccio" <mateus@caruccio.com>
2916: # guitar pro v3,4,5 from http://filext.com/file-extension/gp3
2917: 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
2918:
2919: # From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
2920: 60 string SONG SoundFX Module sound file
2921:
2922: # Type: Adaptive Multi-Rate Codec
2923: # URL: http://filext.com/detaillist.php?extdetail=AMR
2924: # From: Russell Coker <russell@coker.com.au>
2925: 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
2926:
2927: # Type: SuperCollider 3 Synth Definition File Format
2928: # From: Mario Lang <mlang@debian.org>
2929: 0 string SCgf SuperCollider3 Synth Definition file,
2930: >4 belong x version %d
1.1.1.2 ! misho 2931:
1.1 misho 2932: #----------------------------------------------------------------
1.1.1.2 ! misho 2933: # $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 2934: # basis: file(1) magic for BBx/Pro5-files
2935: # Oliver Dammer <dammer@olida.de> 2005/11/07
2936: # http://www.basis.com business-basic-files.
2937: #
2938: 0 string \074\074bbx\076\076 BBx
2939: >7 string \000 indexed file
2940: >7 string \001 serial file
2941: >7 string \002 keyed file
2942: >>13 short 0 (sort)
2943: >7 string \004 program
2944: >>18 byte x (LEVEL %d)
2945: >>>23 string >\000 psaved
2946: >7 string \006 mkeyed file
2947: >>13 short 0 (sort)
2948: >>8 string \000 (mkey)
1.1.1.2 ! misho 2949:
1.1 misho 2950: #------------------------------------------------------------------------------
1.1.1.2 ! misho 2951: # $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 2952: # bFLT: file(1) magic for BFLT uclinux binary files
2953: #
2954: # From Philippe De Muyter <phdm@macqel.be>
2955: #
2956: 0 string bFLT BFLT executable
2957: >4 belong x - version %ld
2958: >4 belong 4
2959: >>36 belong&0x1 0x1 ram
2960: >>36 belong&0x2 0x2 gotpic
2961: >>36 belong&0x4 0x4 gzip
2962: >>36 belong&0x8 0x8 gzdata
1.1.1.2 ! misho 2963: # Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
! 2964: # http://ftg.lbl.gov/checkpoint
! 2965: 0 string C\0\0\0R\0\0\0 BLCR
! 2966: >16 lelong 1 x86
! 2967: >16 lelong 3 alpha
! 2968: >16 lelong 5 x86-64
! 2969: >16 lelong 7 ARM
! 2970: >8 lelong x context data (little endian, version %d)
! 2971: # Uncomment the following only of your "file" program supports "search"
! 2972: #>0 search/1024 VMA\06 for kernel
! 2973: #>>&1 byte x %d.
! 2974: #>>&2 byte x %d.
! 2975: #>>&3 byte x %d
! 2976: 0 string \0\0\0C\0\0\0R BLCR
! 2977: >16 belong 2 SPARC
! 2978: >16 belong 4 ppc
! 2979: >16 belong 6 ppc64
! 2980: >16 belong 7 ARMEB
! 2981: >16 belong 8 SPARC64
! 2982: >8 belong x context data (big endian, version %d)
! 2983: # Uncomment the following only of your "file" program supports "search"
! 2984: #>0 search/1024 VMA\06 for kernel
! 2985: #>>&1 byte x %d.
! 2986: #>>&2 byte x %d.
! 2987: #>>&3 byte x %d
! 2988:
1.1 misho 2989: #------------------------------------------------------------------------------
1.1.1.2 ! misho 2990: # $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 2991: # blender: file(1) magic for Blender 3D related files
2992: #
2993: # Native format rule v1.2. For questions use the developers list
2994: # http://lists.blender.org/mailman/listinfo/bf-committers
2995: # GLOB chunk was moved near start and provides subversion info since 2.42
2996:
2997: 0 string =BLENDER Blender3D,
2998: >7 string =_ saved as 32-bits
2999: >>8 string =v little endian
3000: >>>9 byte x with version %c.
3001: >>>10 byte x \b%c
3002: >>>11 byte x \b%c
3003: >>>0x40 string =GLOB \b.
3004: >>>>0x58 leshort x \b%.4d
3005: >>8 string =V big endian
3006: >>>9 byte x with version %c.
3007: >>>10 byte x \b%c
3008: >>>11 byte x \b%c
3009: >>>0x40 string =GLOB \b.
3010: >>>>0x58 beshort x \b%.4d
3011: >7 string =- saved as 64-bits
3012: >>8 string =v little endian
3013: >>9 byte x with version %c.
3014: >>10 byte x \b%c
3015: >>11 byte x \b%c
3016: >>0x44 string =GLOB \b.
3017: >>>0x60 leshort x \b%.4d
3018: >>8 string =V big endian
3019: >>>9 byte x with version %c.
3020: >>>10 byte x \b%c
3021: >>>11 byte x \b%c
3022: >>>0x44 string =GLOB \b.
3023: >>>>0x60 beshort x \b%.4d
3024:
3025: # Scripts that run in the embeded Python interpreter
3026: 0 string #!BPY Blender3D BPython script
3027:
3028: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3029: # $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 3030: # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
3031: #
3032: # Note that this 0407 conflicts with several other a.out formats...
3033: #
3034: # XXX - should this be redone with "be" and "le", so that it works on
3035: # little-endian machines as well? If so, what's the deal with
3036: # "VAX-order" and "VAX-order2"?
3037: #
3038: #0 long 0407 68K Blit (standalone) executable
3039: #0 short 0407 VAX-order2 68K Blit (standalone) executable
3040: 0 short 03401 VAX-order 68K Blit (standalone) executable
3041: 0 long 0406 68k Blit mpx/mux executable
3042: 0 short 0406 VAX-order2 68k Blit mpx/mux executable
3043: 0 short 03001 VAX-order 68k Blit mpx/mux executable
3044: # Need more values for WE32 DMD executables.
3045: # Note that 0520 is the same as COFF
3046: #0 short 0520 tty630 layers executable
1.1.1.2 ! misho 3047:
! 3048: #------------------------------------------------------------------------------
! 3049: # $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3050: # i80960 b.out objects and archives
3051: #
3052: 0 long 0x10d i960 b.out relocatable object
3053: >16 long >0 not stripped
3054: #
3055: # b.out archive (hp-rt on i960)
3056: 0 string =!<bout> b.out archive
3057: >8 string __.SYMDEF random library
1.1.1.2 ! misho 3058:
1.1 misho 3059: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3060: # $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3061: # bsdi: file(1) magic for BSD/OS (from BSDI) objects
3062: #
3063:
3064: 0 lelong 0314 386 compact demand paged pure executable
3065: >16 lelong >0 not stripped
3066: >32 byte 0x6a (uses shared libs)
3067:
3068: 0 lelong 0407 386 executable
3069: >16 lelong >0 not stripped
3070: >32 byte 0x6a (uses shared libs)
3071:
3072: 0 lelong 0410 386 pure executable
3073: >16 lelong >0 not stripped
3074: >32 byte 0x6a (uses shared libs)
3075:
3076: 0 lelong 0413 386 demand paged pure executable
3077: >16 lelong >0 not stripped
3078: >32 byte 0x6a (uses shared libs)
3079:
3080: # same as in SunOS 4.x, except for static shared libraries
3081: 0 belong&077777777 0600413 sparc demand paged
3082: >0 byte &0x80
3083: >>20 belong <4096 shared library
3084: >>20 belong =4096 dynamically linked executable
3085: >>20 belong >4096 dynamically linked executable
3086: >0 byte ^0x80 executable
3087: >16 belong >0 not stripped
3088: >36 belong 0xb4100001 (uses shared libs)
3089:
3090: 0 belong&077777777 0600410 sparc pure
3091: >0 byte &0x80 dynamically linked executable
3092: >0 byte ^0x80 executable
3093: >16 belong >0 not stripped
3094: >36 belong 0xb4100001 (uses shared libs)
3095:
3096: 0 belong&077777777 0600407 sparc
3097: >0 byte &0x80 dynamically linked executable
3098: >0 byte ^0x80 executable
3099: >16 belong >0 not stripped
3100: >36 belong 0xb4100001 (uses shared libs)
1.1.1.2 ! misho 3101: # Chiasmus is a encryption standard developed by the German Federal
! 3102: # Office for Information Security (Bundesamt fuer Sicherheit in der
! 3103: # Informationstechnik).
! 3104:
! 3105: # Extension: .xia
! 3106: 0 string XIA1 Chiasmus encrypted data
! 3107:
! 3108: # Extension: .xis
! 3109: 0 string XIS Chiasmus key
! 3110:
1.1 misho 3111: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3112: # $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3113: # BTSnoop: file(1) magic for BTSnoop files
3114: #
3115: # From <marcel@holtmann.org>
3116: 0 string btsnoop\0 BTSnoop
3117: >8 belong x version %d,
3118: >12 belong 1001 Unencapsulated HCI
3119: >12 belong 1002 HCI UART (H4)
3120: >12 belong 1003 HCI BCSP
3121: >12 belong 1004 HCI Serial (H5)
3122: >>12 belong x type %d
3123:
3124: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3125: # $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3126: # c64: file(1) magic for various commodore 64 related files
3127: #
3128: # From: Dirk Jagdmann <doj@cubic.org>
3129:
3130: 0x16500 belong 0x12014100 D64 Image
3131: 0x16500 belong 0x12014180 D71 Image
3132: 0x61800 belong 0x28034400 D81 Image
3133: 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
3134: 0 belong 0x43154164 X64 Image
3135:
3136: 0 string GCR-1541 GCR Image
3137: >8 byte x version: %i
3138: >9 byte x tracks: %i
3139:
3140: 9 string PSUR ARC archive (c64)
3141: 2 string -LH1- LHA archive (c64)
3142:
3143: 0 string C64File PC64 Emulator file
3144: >8 string >\0 "%s"
3145: 0 string C64Image PC64 Freezer Image
3146:
3147: 0 beshort 0x38CD C64 PCLink Image
3148: 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
3149:
3150: 0 belong 0xFF424CFF WRAptor packer (c64)
3151:
3152: 0 string C64S\x20tape\x20file T64 tape Image
3153: >32 leshort x Version:0x%x
3154: >36 leshort !0 Entries:%i
3155: >40 string x Name:%.24s
3156:
3157: 0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3158: >32 leshort x Version:0x%x
3159: >36 leshort !0 Entries:%i
3160: >40 string x Name:%.24s
3161:
3162: 0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3163: >32 leshort x Version:0x%x
3164: >36 leshort !0 Entries:%i
3165: >40 string x Name:%.24s
3166:
3167: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3168: # $File: cad,v 1.9 2009/09/19 16:28:08 christos Exp $
1.1 misho 3169: # autocad: file(1) magic for cad files
3170: #
3171:
3172: # AutoCAD DWG versions R13/R14 (www.autodesk.com)
3173: # Written December 01, 2003 by Lester Hightower
3174: # Based on the DWG File Format Specifications at http://www.opendwg.org/
3175: 0 string \101\103\061\060\061 AutoCAD
3176: >5 string \062\000\000\000\000 DWG ver. R13
3177: >5 string \064\000\000\000\000 DWG ver. R14
3178:
3179: # Microstation DGN/CIT Files (www.bentley.com)
3180: # Last updated July 29, 2005 by Lester Hightower
3181: # DGN is the default file extension of Microstation/Intergraph CAD files.
3182: # CIT is the proprietary raster format (similar to TIFF) used to attach
3183: # raster underlays to Microstation DGN (vector) drawings.
3184: #
3185: # http://www.wotsit.org/search.asp
3186: # http://filext.com/detaillist.php?extdetail=DGN
3187: # http://filext.com/detaillist.php?extdetail=CIT
3188: #
3189: # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
3190: # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
3191: # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
3192: # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
3193: 0 string \010\011\376 Microstation
3194: >3 string \002
3195: >>30 string \026\105 DGNFile
3196: >>30 string \034\105 DGNFile
3197: >>30 string \073\107 DGNFile
3198: >>30 string \073\110 DGNFile
3199: >>30 string \106\107 DGNFile
3200: >>30 string \110\103 DGNFile
3201: >>30 string \120\104 DGNFile
3202: >>30 string \172\104 DGNFile
3203: >>30 string \172\105 DGNFile
3204: >>30 string \172\106 DGNFile
3205: >>30 string \234\106 DGNFile
3206: >>30 string \273\105 DGNFile
3207: >>30 string \306\106 DGNFile
3208: >>30 string \310\104 DGNFile
3209: >>30 string \341\104 DGNFile
3210: >>30 string \372\103 DGNFile
3211: >>30 string \372\104 DGNFile
3212: >>30 string \372\106 DGNFile
3213: >>30 string \376\103 DGNFile
3214: >4 string \030\000\000 CITFile
3215: >4 string \030\000\003 CITFile
3216:
3217: # AutoCad, from Nahuel Greco
3218: # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
3219: 0 string AC1012 AutoCad (release 12)
3220: 0 string AC1013 AutoCad (release 13)
3221: 0 string AC1014 AutoCad (release 14)
3222:
3223: # CAD: file(1) magic for computer aided design files
3224: # Phillip Griffith <phillip dot griffith at gmail dot com>
3225: # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
3226: #
3227: 0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
3228: 0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3229: 0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3230: 0 beshort 0x0809 Bentley/Intergraph MicroStation
3231: >0x02 byte 0xfe
3232: >>0x04 beshort 0x1800 CIT raster CAD
3233: 0 string AC1012 AutoDesk AutoCAD R13
3234: 0 string AC1014 AutoDesk AutoCAD R14
3235: 0 string AC1015 AutoDesk AutoCAD R2000
1.1.1.2 ! misho 3236:
1.1 misho 3237: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3238: # $File: cafebabe,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 3239: # Cafe Babes unite!
3240: #
3241: # Since Java bytecode and Mach-O fat-files have the same magic number, the test
3242: # must be performed in the same "magic" sequence to get both right. The long
3243: # at offset 4 in a mach-O fat file tells the number of architectures; the short at
3244: # offset 4 in a Java bytecode file is the JVM minor version and the
3245: # short at offset 6 is the JVM major version. Since there are only
3246: # only 18 labeled Mach-O architectures at current, and the first released
3247: # Java class format was version 43.0, we can safely choose any number
3248: # between 18 and 39 to test the number of architectures against
3249: # (and use as a hack). Let's not use 18, because the Mach-O people
3250: # might add another one or two as time goes by...
3251: #
1.1.1.2 ! misho 3252: 0 belong 0xcafebabe
1.1 misho 3253: !:mime application/x-java-applet
1.1.1.2 ! misho 3254: >4 belong >30 compiled Java class data,
! 3255: >>6 beshort x version %d.
! 3256: >>4 beshort x \b%d
! 3257: # Which is which?
! 3258: #>>4 belong 0x032d (Java 1.0)
! 3259: #>>4 belong 0x032d (Java 1.1)
! 3260: >>4 belong 0x002e (Java 1.2)
! 3261: >>4 belong 0x002f (Java 1.3)
! 3262: >>4 belong 0x0030 (Java 1.4)
! 3263: >>4 belong 0x0031 (Java 1.5)
! 3264: >>4 belong 0x0032 (Java 1.6)
! 3265:
! 3266:
! 3267: 0 belong 0xcafebabe
! 3268: >4 belong 1 Mach-O fat file with 1 architecture
! 3269: >4 belong >1
! 3270: >>4 belong <20 Mach-O fat file with %ld architectures
! 3271:
! 3272: 0 belong 0xcafed00d JAR compressed with pack200,
1.1 misho 3273: >>5 byte x version %d.
3274: >>4 byte x \b%d
3275: !:mime application/x-java-pack200
1.1.1.2 ! misho 3276:
1.1 misho 3277: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3278: # $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3279: # CDDB: file(1) magic for CDDB(tm) format CD text data files
3280: #
3281: # From <steve@gracenote.com>
3282: #
3283: # This is the /etc/magic entry to decode datafiles as used by
3284: # CDDB-enabled CD player applications.
3285: #
3286:
1.1.1.2 ! misho 3287: 0 search/1/w #\040xmcd CDDB(tm) format CD text data
1.1 misho 3288:
3289: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3290: # $File: chord,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3291: # chord: file(1) magic for Chord music sheet typesetting utility input files
3292: #
3293: # From Philippe De Muyter <phdm@macqel.be>
3294: # File format is actually free, but many distributed files begin with `{title'
3295: #
3296: 0 string {title Chord text file
3297:
3298: # Type: PowerTab file format
3299: # URL: http://www.power-tab.net/
3300: # From: Jelmer Vernooij <jelmer@samba.org>
3301: 0 string ptab\003\000 Power-Tab v3 Tablature File
3302: 0 string ptab\004\000 Power-Tab v4 Tablature File
1.1.1.2 ! misho 3303:
1.1 misho 3304: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3305: # $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3306: # cisco: file(1) magic for cisco Systems routers
3307: #
3308: # Most cisco file-formats are covered by the generic elf code
3309: #
3310: # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
3311: 0 belong&0xffffff00 0x85011400 cisco IOS microcode
3312: >7 string >\0 for '%s'
3313: 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
3314: >7 string >\0 for '%s'
1.1.1.2 ! misho 3315:
1.1 misho 3316: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3317: # $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3318: # citrus locale declaration
3319: #
3320:
3321: 0 string RuneCT Citrus locale declaration for LC_CTYPE
3322:
3323:
3324: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3325: # $File: c-lang,v 1.14 2009/09/19 16:28:08 christos Exp $
! 3326: # c-lang: file(1) magic for C programs (or REXX)
! 3327: #
! 3328:
! 3329: # XPM icons (Greg Roelofs, newt@uchicago.edu)
! 3330: # if you uncomment "/*" for C/REXX below, also uncomment this entry
! 3331: #0 string /*\ XPM\ */ X pixmap image data
! 3332: #!:mime image/x-xpmi
! 3333:
! 3334: # 3DS (3d Studio files) Conflicts with diff output 0x3d '='
! 3335: #16 beshort 0x3d3d image/x-3ds
! 3336:
! 3337: # this first will upset you if you're a PL/1 shop...
! 3338: # in which case rm it; ascmagic will catch real C programs
! 3339: #0 search/1 /* C or REXX program text
! 3340: #0 search/1 // C++ program text
! 3341:
! 3342: # From: Mikhail Teterin <mi@aldan.algebra.com>
! 3343: 0 string cscope cscope reference data
! 3344: >7 string x version %.2s
! 3345: # We skip the path here, because it is often long (so file will
! 3346: # truncate it) and mostly redundant.
! 3347: # The inverted index functionality was added some time betwen
! 3348: # versions 11 and 15, so look for -q if version is above 14:
! 3349: >7 string >14
! 3350: >>10 search/100 \ -q\ with inverted index
! 3351: >10 search/100 \ -c\ text (non-compressed)
! 3352:
! 3353: #------------------------------------------------------------------------------
! 3354: # $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3355: # clarion: file(1) magic for # Clarion Personal/Professional Developer
3356: # (v2 and above)
3357: # From: Julien Blache <jb@jblache.org>
3358:
3359: # Database files
3360: # signature
3361: 0 leshort 0x3343 Clarion Developer (v2 and above) data file
3362: # attributes
3363: >2 leshort &0x0001 \b, locked
3364: >2 leshort &0x0004 \b, encrypted
3365: >2 leshort &0x0008 \b, memo file exists
3366: >2 leshort &0x0010 \b, compressed
3367: >2 leshort &0x0040 \b, read only
3368: # number of records
3369: >5 lelong x \b, %ld records
3370:
3371: # Memo files
3372: 0 leshort 0x334d Clarion Developer (v2 and above) memo data
3373:
3374: # Key/Index files
3375: # No magic? :(
3376:
3377: # Help files
3378: 0 leshort 0x49e0 Clarion Developer (v2 and above) help data
3379:
3380: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3381: # $File: claris,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3382: # claris: file(1) magic for claris
3383: # "H. Nanosecond" <aldomel@ix.netcom.com>
3384: # Claris Works a word processor, etc.
3385: # Version 3.0
3386:
3387: # .pct claris works clip art files
3388: #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
3389: #*
3390: #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
3391: #null to byte 1000 octal
3392: 514 string \377\377\377\377\000 Claris clip art?
3393: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
3394: 514 string \377\377\377\377\001 Claris clip art?
3395: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
3396:
3397: # Claris works files
3398: # .cwk
3399: 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
3400: # .plt
3401: 0 string \020\341\000\000\010\010 Claris Works pallete files .plt
3402:
3403: # .msp a dictionary file I am not sure about this I have only one .msp file
3404: 0 string \002\271\262\000\040\002\000\164 Claris works dictionary
3405:
3406: # .usp are user dictionary bits
3407: # I am not sure about a magic header:
3408: #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
3409: # soh S p f 8 U D sp ^ S cr nl p o d i
3410: #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
3411: # a t r i s t sp ^ S cr nl d i v sp #
3412:
3413: # .mth Thesaurus
3414: # starts with \0 but no magic header
3415:
3416: # .chy Hyphenation file
3417: # I am not sure: 000 210 034 000 000
3418:
3419: # other claris files
3420: #./windows/claris/useng.ndx: data
3421: #./windows/claris/xtndtran.l32: data
3422: #./windows/claris/xtndtran.lst: data
3423: #./windows/claris/clworks.lbl: data
3424: #./windows/claris/clworks.prf: data
3425: #./windows/claris/userd.spl: data
3426:
3427: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3428: # $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
1.1 misho 3429: # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
3430: #
3431: # XXX - what byte order does the Clipper use?
3432: #
3433: # XXX - what's the "!" stuff:
3434: #
3435: # >18 short !074000,000000 C1 R1
3436: # >18 short !074000,004000 C2 R1
3437: # >18 short !074000,010000 C3 R1
3438: # >18 short !074000,074000 TEST
3439: #
3440: # I shall assume it's ANDing the field with the first value and
3441: # comparing it with the second, and rewrite it as:
3442: #
3443: # >18 short&074000 000000 C1 R1
3444: # >18 short&074000 004000 C2 R1
3445: # >18 short&074000 010000 C3 R1
3446: # >18 short&074000 074000 TEST
3447: #
3448: # as SVR3.1's "file" doesn't support anything of the "!074000,000000"
3449: # sort, nor does SunOS 4.x, so either it's something Intergraph added
3450: # in CLIX, or something AT&T added in SVR3.2 or later, or something
3451: # somebody else thought was a good idea; it's not documented in the
3452: # man page for this version of "magic", nor does it appear to be
3453: # implemented (at least not after I blew off the bogus code to turn
3454: # old-style "&"s into new-style "&"s, which just didn't work at all).
3455: #
3456: 0 short 0575 CLIPPER COFF executable (VAX #)
3457: >20 short 0407 (impure)
3458: >20 short 0410 (5.2 compatible)
3459: >20 short 0411 (pure)
3460: >20 short 0413 (demand paged)
3461: >20 short 0443 (target shared library)
3462: >12 long >0 not stripped
3463: >22 short >0 - version %ld
3464: 0 short 0577 CLIPPER COFF executable
3465: >18 short&074000 000000 C1 R1
3466: >18 short&074000 004000 C2 R1
3467: >18 short&074000 010000 C3 R1
3468: >18 short&074000 074000 TEST
3469: >20 short 0407 (impure)
3470: >20 short 0410 (pure)
3471: >20 short 0411 (separate I&D)
3472: >20 short 0413 (paged)
3473: >20 short 0443 (target shared library)
3474: >12 long >0 not stripped
3475: >22 short >0 - version %ld
3476: >48 long&01 01 alignment trap enabled
3477: >52 byte 1 -Ctnc
3478: >52 byte 2 -Ctsw
3479: >52 byte 3 -Ctpw
3480: >52 byte 4 -Ctcb
3481: >53 byte 1 -Cdnc
3482: >53 byte 2 -Cdsw
3483: >53 byte 3 -Cdpw
3484: >53 byte 4 -Cdcb
3485: >54 byte 1 -Csnc
3486: >54 byte 2 -Cssw
3487: >54 byte 3 -Cspw
3488: >54 byte 4 -Cscb
3489: 4 string pipe CLIPPER instruction trace
3490: 4 string prof CLIPPER instruction profile
3491:
3492: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3493: # $File: commands,v 1.36 2010/01/24 18:41:11 christos Exp $
1.1 misho 3494: # commands: file(1) magic for various shells and interpreters
3495: #
3496: #0 string : shell archive or script for antique kernel text
1.1.1.2 ! misho 3497: 0 string/w #!\ /bin/sh POSIX shell script text executable
1.1 misho 3498: !:mime text/x-shellscript
1.1.1.2 ! misho 3499: 0 string/w #!\ /bin/csh C shell script text executable
1.1 misho 3500: !:mime text/x-shellscript
3501: # korn shell magic, sent by George Wu, gwu@clyde.att.com
1.1.1.2 ! misho 3502: 0 string/w #!\ /bin/ksh Korn shell script text executable
1.1 misho 3503: !:mime text/x-shellscript
1.1.1.2 ! misho 3504: 0 string/w #!\ /bin/tcsh Tenex C shell script text executable
1.1 misho 3505: !:mime text/x-shellscript
1.1.1.2 ! misho 3506: 0 string/w #!\ /usr/bin/tcsh Tenex C shell script text executable
1.1 misho 3507: !:mime text/x-shellscript
1.1.1.2 ! misho 3508: 0 string/w #!\ /usr/local/tcsh Tenex C shell script text executable
1.1 misho 3509: !:mime text/x-shellscript
1.1.1.2 ! misho 3510: 0 string/w #!\ /usr/local/bin/tcsh Tenex C shell script text executable
1.1 misho 3511: !:mime text/x-shellscript
3512:
3513: #
3514: # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
1.1.1.2 ! misho 3515: 0 string/w #!\ /bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3516: !:mime text/x-shellscript
1.1.1.2 ! misho 3517: 0 string/w #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3518: !:mime text/x-shellscript
1.1.1.2 ! misho 3519: 0 string/w #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3520: !:mime text/x-shellscript
1.1.1.2 ! misho 3521: 0 string/w #!\ /usr/local/bin/ash Neil Brown's ash script text executable
1.1 misho 3522: !:mime text/x-shellscript
1.1.1.2 ! misho 3523: 0 string/w #!\ /usr/local/bin/ae Neil Brown's ae script text executable
1.1 misho 3524: !:mime text/x-shellscript
1.1.1.2 ! misho 3525: 0 string/w #!\ /bin/nawk new awk script text executable
1.1 misho 3526: !:mime text/x-nawk
1.1.1.2 ! misho 3527: 0 string/w #!\ /usr/bin/nawk new awk script text executable
1.1 misho 3528: !:mime text/x-nawk
1.1.1.2 ! misho 3529: 0 string/w #!\ /usr/local/bin/nawk new awk script text executable
1.1 misho 3530: !:mime text/x-nawk
1.1.1.2 ! misho 3531: 0 string/w #!\ /bin/gawk GNU awk script text executable
1.1 misho 3532: !:mime text/x-gawk
1.1.1.2 ! misho 3533: 0 string/w #!\ /usr/bin/gawk GNU awk script text executable
1.1 misho 3534: !:mime text/x-gawk
1.1.1.2 ! misho 3535: 0 string/w #!\ /usr/local/bin/gawk GNU awk script text executable
1.1 misho 3536: !:mime text/x-gawk
3537: #
1.1.1.2 ! misho 3538: 0 string/w #!\ /bin/awk awk script text executable
1.1 misho 3539: !:mime text/x-awk
1.1.1.2 ! misho 3540: 0 string/w #!\ /usr/bin/awk awk script text executable
1.1 misho 3541: !:mime text/x-awk
3542: # update to distinguish from *.vcf files
3543: # this is broken because postscript has /EBEGIN{ for example.
1.1.1.2 ! misho 3544: #0 search/Ww BEGIN { awk script text
1.1 misho 3545: 0 regex =^\\s*BEGIN\\s*[{] awk script text
3546:
3547: # AT&T Bell Labs' Plan 9 shell
1.1.1.2 ! misho 3548: 0 string/w #!\ /bin/rc Plan 9 rc shell script text executable
1.1 misho 3549:
3550: # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
1.1.1.2 ! misho 3551: 0 string/w #!\ /bin/bash Bourne-Again shell script text executable
! 3552: !:mime text/x-shellscript
! 3553: 0 string/w #!\ /usr/bin/bash Bourne-Again shell script text executable
! 3554: !:mime text/x-shellscript
! 3555: 0 string/w #!\ /usr/local/bash Bourne-Again shell script text executable
1.1 misho 3556: !:mime text/x-shellscript
1.1.1.2 ! misho 3557: 0 string/w #!\ /usr/local/bin/bash Bourne-Again shell script text executable
1.1 misho 3558: !:mime text/x-shellscript
3559:
3560: # using env
3561: 0 string #!/usr/bin/env a
3562: >15 string >\0 %s script text executable
3563: 0 string #!\ /usr/bin/env a
3564: >16 string >\0 %s script text executable
3565:
3566: # PHP scripts
3567: # Ulf Harnhammar <ulfh@update.uu.se>
3568: 0 search/1/c =<?php PHP script text
3569: !:mime text/x-php
3570: 0 search/1 =<?\n PHP script text
3571: !:mime text/x-php
3572: 0 search/1 =<?\r PHP script text
3573: !:mime text/x-php
1.1.1.2 ! misho 3574: 0 search/1/w #!\ /usr/local/bin/php PHP script text executable
1.1 misho 3575: !:mime text/x-php
1.1.1.2 ! misho 3576: 0 search/1/w #!\ /usr/bin/php PHP script text executable
1.1 misho 3577: !:mime text/x-php
3578:
3579: 0 string Zend\x00 PHP script Zend Optimizer data
3580:
3581: 0 string $! DCL command file
3582:
3583: # Type: Pdmenu
3584: # URL: http://packages.debian.org/pdmenu
3585: # From: Edward Betts <edward@debian.org>
3586: 0 string #!/usr/bin/pdmenu Pdmenu configuration file text
3587:
3588: #----------------------------------------------------------------------------
1.1.1.2 ! misho 3589: # $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3590: # communication
3591:
3592: # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
3593: # It is used for conformance testing of communication protocols.
3594: # Added by W. Borgert <debacle@debian.org>.
3595: 0 string $Suite TTCN Abstract Test Suite
3596: >&1 string $SuiteId
3597: >>&1 string >\n %s
3598: >&2 string $SuiteId
3599: >>&1 string >\n %s
3600: >&3 string $SuiteId
3601: >>&1 string >\n %s
3602:
3603: # MSC (message sequence charts) are a formal description technique,
3604: # described in ITU-T Z.120, mainly used for communication protocols.
3605: # Added by W. Borgert <debacle@debian.org>.
3606: 0 string mscdocument Message Sequence Chart (document)
3607: 0 string msc Message Sequence Chart (chart)
3608: 0 string submsc Message Sequence Chart (subchart)
3609:
3610: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3611: # $File: compress,v 1.42 2009/09/19 16:28:08 christos Exp $
1.1 misho 3612: # compress: file(1) magic for pure-compression formats (no archives)
3613: #
3614: # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
3615: #
3616: # Formats for various forms of compressed data
3617: # Formats for "compress" proper have been moved into "compress.c",
3618: # because it tries to uncompress it to figure out what's inside.
3619:
3620: # standard unix compress
3621: 0 string \037\235 compress'd data
3622: !:mime application/x-compress
1.1.1.2 ! misho 3623: !:apple LZIVZIVU
1.1 misho 3624: >2 byte&0x80 >0 block compressed
3625: >2 byte&0x1f x %d bits
3626:
3627: # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
3628: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
3629: # * Original filename is only at offset 10 if "extra field" absent
3630: # * Produce shorter output - notably, only report compression methods
3631: # other than 8 ("deflate", the only method defined in RFC 1952).
3632: 0 string \037\213 gzip compressed data
3633: !:mime application/x-gzip
3634: >2 byte <8 \b, reserved method
3635: >2 byte >8 \b, unknown method
3636: >3 byte &0x01 \b, ASCII
3637: >3 byte &0x02 \b, has CRC
3638: >3 byte &0x04 \b, extra field
3639: >3 byte&0xC =0x08
3640: >>10 string x \b, was "%s"
3641: >3 byte &0x10 \b, has comment
3642: >9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
3643: >9 byte =0x01 \b, from Amiga
3644: >9 byte =0x02 \b, from VMS
3645: >9 byte =0x03 \b, from Unix
3646: >9 byte =0x04 \b, from VM/CMS
3647: >9 byte =0x05 \b, from Atari
3648: >9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
3649: >9 byte =0x07 \b, from MacOS
3650: >9 byte =0x08 \b, from Z-System
3651: >9 byte =0x09 \b, from CP/M
3652: >9 byte =0x0A \b, from TOPS/20
3653: >9 byte =0x0B \b, from NTFS filesystem (NT)
3654: >9 byte =0x0C \b, from QDOS
3655: >9 byte =0x0D \b, from Acorn RISCOS
3656: >3 byte &0x10 \b, comment
3657: >3 byte &0x20 \b, encrypted
3658: >4 ledate >0 \b, last modified: %s
3659: >8 byte 2 \b, max compression
3660: >8 byte 4 \b, max speed
3661:
3662: # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
3663: 0 string \037\036 packed data
3664: !:mime application/octet-stream
3665: >2 belong >1 \b, %d characters originally
3666: >2 belong =1 \b, %d character originally
3667: #
3668: # This magic number is byte-order-independent.
3669: 0 short 0x1f1f old packed data
3670: !:mime application/octet-stream
3671:
3672: # XXX - why *two* entries for "compacted data", one of which is
3673: # byte-order independent, and one of which is byte-order dependent?
3674: #
3675: 0 short 0x1fff compacted data
3676: !:mime application/octet-stream
3677: # This string is valid for SunOS (BE) and a matching "short" is listed
3678: # in the Ultrix (LE) magic file.
3679: 0 string \377\037 compacted data
3680: !:mime application/octet-stream
3681: 0 short 0145405 huf output
3682: !:mime application/octet-stream
3683:
3684: # bzip2
3685: 0 string BZh bzip2 compressed data
3686: !:mime application/x-bzip2
3687: >3 byte >47 \b, block size = %c00k
3688:
1.1.1.2 ! misho 3689: # lzip
! 3690: 0 string LZIP lzip compressed data
! 3691: !:mime application/x-lzip
! 3692: >4 byte x \b, version: %d
! 3693:
1.1 misho 3694: # squeeze and crunch
3695: # Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
3696: 0 beshort 0x76FF squeezed data,
3697: >4 string x original name %s
3698: 0 beshort 0x76FE crunched data,
3699: >2 string x original name %s
3700: 0 beshort 0x76FD LZH compressed data,
3701: >2 string x original name %s
3702:
3703: # Freeze
3704: 0 string \037\237 frozen file 2.1
3705: 0 string \037\236 frozen file 1.0 (or gzip 0.5)
3706:
3707: # SCO compress -H (LZH)
3708: 0 string \037\240 SCO compress -H (LZH) data
3709:
3710: # European GSM 06.10 is a provisional standard for full-rate speech
3711: # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
3712: # excitation/long term prediction) coding at 13 kbit/s.
3713: #
3714: # There's only a magic nibble (4 bits); that nibble repeats every 33
3715: # bytes. This isn't suited for use, but maybe we can use it someday.
3716: #
3717: # This will cause very short GSM files to be declared as data and
3718: # mismatches to be declared as data too!
3719: #0 byte&0xF0 0xd0 data
3720: #>33 byte&0xF0 0xd0
3721: #>66 byte&0xF0 0xd0
3722: #>99 byte&0xF0 0xd0
3723: #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
3724:
3725: # bzip a block-sorting file compressor
3726: # by Julian Seward <sewardj@cs.man.ac.uk> and others
3727: #
3728: #0 string BZ bzip compressed data
3729: #>2 byte x \b, version: %c
3730: #>3 string =1 \b, compression block size 100k
3731: #>3 string =2 \b, compression block size 200k
3732: #>3 string =3 \b, compression block size 300k
3733: #>3 string =4 \b, compression block size 400k
3734: #>3 string =5 \b, compression block size 500k
3735: #>3 string =6 \b, compression block size 600k
3736: #>3 string =7 \b, compression block size 700k
3737: #>3 string =8 \b, compression block size 800k
3738: #>3 string =9 \b, compression block size 900k
3739:
3740: # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
3741: 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
3742: >9 beshort <0x0940
3743: >>9 byte&0xf0 =0x00 - version 0.
3744: >>9 beshort&0x0fff x \b%03x,
3745: >>13 byte 1 LZO1X-1,
3746: >>13 byte 2 LZO1X-1(15),
3747: >>13 byte 3 LZO1X-999,
3748: ## >>22 bedate >0 last modified: %s,
3749: >>14 byte =0x00 os: MS-DOS
3750: >>14 byte =0x01 os: Amiga
3751: >>14 byte =0x02 os: VMS
3752: >>14 byte =0x03 os: Unix
3753: >>14 byte =0x05 os: Atari
3754: >>14 byte =0x06 os: OS/2
3755: >>14 byte =0x07 os: MacOS
3756: >>14 byte =0x0A os: Tops/20
3757: >>14 byte =0x0B os: WinNT
3758: >>14 byte =0x0E os: Win32
3759: >9 beshort >0x0939
3760: >>9 byte&0xf0 =0x00 - version 0.
3761: >>9 byte&0xf0 =0x10 - version 1.
3762: >>9 byte&0xf0 =0x20 - version 2.
3763: >>9 beshort&0x0fff x \b%03x,
3764: >>15 byte 1 LZO1X-1,
3765: >>15 byte 2 LZO1X-1(15),
3766: >>15 byte 3 LZO1X-999,
3767: ## >>25 bedate >0 last modified: %s,
3768: >>17 byte =0x00 os: MS-DOS
3769: >>17 byte =0x01 os: Amiga
3770: >>17 byte =0x02 os: VMS
3771: >>17 byte =0x03 os: Unix
3772: >>17 byte =0x05 os: Atari
3773: >>17 byte =0x06 os: OS/2
3774: >>17 byte =0x07 os: MacOS
3775: >>17 byte =0x0A os: Tops/20
3776: >>17 byte =0x0B os: WinNT
3777: >>17 byte =0x0E os: Win32
3778:
3779: # 4.3BSD-Quasijarus Strong Compression
3780: # http://minnie.tuhs.org/Quasijarus/compress.html
3781: 0 string \037\241 Quasijarus strong compressed data
3782:
3783: # From: Cory Dikkers <cdikkers@swbell.net>
3784: 0 string XPKF Amiga xpkf.library compressed data
3785: 0 string PP11 Power Packer 1.1 compressed data
3786: 0 string PP20 Power Packer 2.0 compressed data,
3787: >4 belong 0x09090909 fast compression
3788: >4 belong 0x090A0A0A mediocre compression
3789: >4 belong 0x090A0B0B good compression
3790: >4 belong 0x090A0C0C very good compression
3791: >4 belong 0x090A0C0D best compression
3792:
3793: # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
3794: # http://www.7-zip.org or DOC/7zFormat.txt
3795: #
3796: 0 string 7z\274\257\047\034 7-zip archive data,
3797: >6 byte x version %d
3798: >7 byte x \b.%d
1.1.1.2 ! misho 3799: !:mime application/x-7z-compressed
1.1 misho 3800:
3801: # Type: LZMA
1.1.1.2 ! misho 3802: 0 lelong 0x8000005d LZMA compressed data,
! 3803: >5 lequad =0xffffffffffffffff streamed
! 3804: >5 lequad !0xffffffffffffffff non-streamed, size %lld
! 3805:
! 3806: # http://tukaani.org/xz/xz-file-format.txt
! 3807: 0 ustring \xFD7zXZ\x00 XZ compressed data
! 3808: !:mime application/x-xz
1.1 misho 3809:
3810: # AFX compressed files (Wolfram Kleff)
3811: 2 string -afx- AFX compressed file data
3812:
3813: # Supplementary magic data for the file(1) command to support
3814: # rzip(1). The format is described in magic(5).
3815: #
3816: # Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
3817: # this file.
3818: #
3819: 0 string RZIP rzip compressed data
3820: >4 byte x - version %d
3821: >5 byte x \b.%d
3822: >6 belong x (%d bytes)
1.1.1.2 ! misho 3823:
! 3824: # Type: XZ
! 3825: # URL: http://tukaani.org/xz/
! 3826: 0 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data
! 3827: !:mime application/x-xz
! 3828:
! 3829: # Type: DACT compressed files
! 3830: 0 long 0x444354C3 DACT compressed data
! 3831: >4 byte >-1 (version %i.
! 3832: >5 byte >-1 %i.
! 3833: >6 byte >-1 %i)
! 3834: >7 long >0 , original size: %i bytes
! 3835: >15 long >30 , block size: %i bytes
! 3836:
1.1 misho 3837: #------------------------------------------------------------------------------
1.1.1.2 ! misho 3838: # $File: console,v 1.16 2009/09/19 16:28:08 christos Exp $
1.1 misho 3839: # Console game magic
3840: # Toby Deshane <hac@shoelace.digivill.net>
3841: # ines: file(1) magic for Marat's iNES Nintendo Entertainment System
3842: # ROM dump format
3843:
3844: 0 string NES\032 iNES ROM dump,
3845: >4 byte x %dx16k PRG
3846: >5 byte x \b, %dx8k CHR
3847: >6 byte&0x01 =0x1 \b, [Vert.]
3848: >6 byte&0x01 =0x0 \b, [Horiz.]
3849: >6 byte&0x02 =0x2 \b, [SRAM]
3850: >6 byte&0x04 =0x4 \b, [Trainer]
3851: >6 byte&0x04 =0x8 \b, [4-Scr]
3852:
3853: #------------------------------------------------------------------------------
3854: # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
3855: #
3856: 0x104 belong 0xCEED6666 Gameboy ROM:
3857: >0x134 string >\0 "%.16s"
3858: >0x146 byte 0x03 \b,[SGB]
3859: >0x147 byte 0x00 \b, [ROM ONLY]
3860: >0x147 byte 0x01 \b, [ROM+MBC1]
3861: >0x147 byte 0x02 \b, [ROM+MBC1+RAM]
3862: >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
3863: >0x147 byte 0x05 \b, [ROM+MBC2]
3864: >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
3865: >0x147 byte 0x08 \b, [ROM+RAM]
3866: >0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
3867: >0x147 byte 0x0B \b, [ROM+MMM01]
3868: >0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
3869: >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
3870: >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
3871: >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
3872: >0x147 byte 0x11 \b, [ROM+MBC3]
3873: >0x147 byte 0x12 \b, [ROM+MBC3+RAM]
3874: >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
3875: >0x147 byte 0x19 \b, [ROM+MBC5]
3876: >0x147 byte 0x1A \b, [ROM+MBC5+RAM]
3877: >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
3878: >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
3879: >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
3880: >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
3881: >0x147 byte 0x1F \b, [Pocket Camera]
3882: >0x147 byte 0xFD \b, [Bandai TAMA5]
3883: >0x147 byte 0xFE \b, [Hudson HuC-3]
3884: >0x147 byte 0xFF \b, [Hudson HuC-1]
3885:
3886: >0x148 byte 0 \b, ROM: 256Kbit
3887: >0x148 byte 1 \b, ROM: 512Kbit
3888: >0x148 byte 2 \b, ROM: 1Mbit
3889: >0x148 byte 3 \b, ROM: 2Mbit
3890: >0x148 byte 4 \b, ROM: 4Mbit
3891: >0x148 byte 5 \b, ROM: 8Mbit
3892: >0x148 byte 6 \b, ROM: 16Mbit
3893: >0x148 byte 0x52 \b, ROM: 9Mbit
3894: >0x148 byte 0x53 \b, ROM: 10Mbit
3895: >0x148 byte 0x54 \b, ROM: 12Mbit
3896:
3897: >0x149 byte 1 \b, RAM: 16Kbit
3898: >0x149 byte 2 \b, RAM: 64Kbit
3899: >0x149 byte 3 \b, RAM: 128Kbit
3900: >0x149 byte 4 \b, RAM: 1Mbit
3901:
3902: #>0x14e long x \b, CRC: %x
3903:
3904: #------------------------------------------------------------------------------
3905: # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
3906: #
3907: 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
3908: >0x120 string >\0 Name: "%.16s"
3909: >0x110 string >\0 %.16s
3910: >0x1B0 string RA with SRAM
3911:
3912: #------------------------------------------------------------------------------
3913: # genesis: file(1) magic for the Super MegaDrive ROM dump format
3914: #
3915: 0x280 string EAGN Super MagicDrive ROM dump
3916: >0 byte x %dx16k blocks
3917: >2 byte 0 \b, last in series or standalone
3918: >2 byte >0 \b, split ROM
3919: >8 byte 0xAA
3920: >9 byte 0xBB
3921:
3922: #------------------------------------------------------------------------------
3923: # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
3924: #
3925: 0x280 string EAMG Super MagicDrive ROM dump
3926: >0 byte x %dx16k blocks
3927: >2 byte x \b, last in series or standalone
3928: >8 byte 0xAA
3929: >9 byte 0xBB
3930:
3931: #------------------------------------------------------------------------------
3932: # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
3933: #
3934: # Does not detect all images. Very preliminary guesswork. Need more data
3935: # on format.
3936: #
3937: # FIXME: need a little more info...;P
3938: #
3939: #0 byte 0xF3
3940: #>1 byte 0xED Sega Master System/Game Gear ROM dump
3941: #>1 byte 0x31 Sega Master System/Game Gear ROM dump
3942: #>1 byte 0xDB Sega Master System/Game Gear ROM dump
3943: #>1 byte 0xAF Sega Master System/Game Gear ROM dump
3944: #>1 byte 0xC3 Sega Master System/Game Gear ROM dump
3945:
3946: #------------------------------------------------------------------------------
3947: # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
3948: #
3949: 0 belong 0x21068028 Sega Dreamcast VMU game image
3950: 0 string LCDi Dream Animator file
3951:
3952: #------------------------------------------------------------------------------
3953: # v64: file(1) uncertain magic for the V64 format N64 ROM dumps
3954: #
3955: 0 belong 0x37804012 V64 Nintendo 64 ROM dump
3956:
3957: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3958: # Nintendo .nds
3959: 192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
3960: # Nintendo .gba
3961: 0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
3962:
3963: #------------------------------------------------------------------------------
3964: # msx: file(1) magic for MSX game cartridge dumps
3965: # Too simple - MPi
3966: #0 beshort 0x4142 MSX game cartridge dump
3967:
3968: #------------------------------------------------------------------------------
3969: # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
3970: 0 string PS-X\ EXE Sony Playstation executable
3971: # Area:
3972: >113 string x (%s)
3973:
3974: #------------------------------------------------------------------------------
3975: # Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
3976: 0 string XBEH XBE, Microsoft Xbox executable
3977: # probabilistic checks whether signed or not
3978: >0x0004 ulelong =0x0
3979: >>&2 ulelong =0x0
3980: >>>&2 ulelong =0x0 \b, not signed
3981: >0x0004 ulelong >0
3982: >>&2 ulelong >0
3983: >>>&2 ulelong >0 \b, signed
3984: # expect base address of 0x10000
3985: >0x0104 ulelong =0x10000
3986: >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
3987: >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
3988: >>>(0x0118-0x0FF60) ulelong >0 (regions:
3989: >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
3990: >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
3991: >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
3992: >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
3993: >>>(0x0118-0x0FF60) ulelong >0 \b)
3994:
3995: # --------------------------------
3996: # Microsoft Xbox data file formats
3997: 0 string XIP0 XIP, Microsoft Xbox data
3998: 0 string XTF0 XTF, Microsoft Xbox data
3999:
4000: # Atari Lynx cartridge dump (EXE/BLL header)
4001: # From: "Stefan A. Haubenthal" <polluks@web.de>
4002:
4003: 0 beshort 0x8008 Lynx cartridge,
4004: >2 beshort x RAM start $%04x
4005: >6 string BS93
4006:
4007: # Opera file system that is used on the 3DO console
4008: # From: Serge van den Boom <svdb@stack.nl>
4009: 0 string \x01ZZZZZ\x01 3DO "Opera" file system
4010:
4011: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
4012: 0 string GBS Nintendo Gameboy Music/Audio Data
4013: 12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
4014:
4015: # Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
4016: 0 string PPF30 Playstation Patch File version 3.0
4017: >5 byte 0 \b, PPF 1.0 patch
4018: >5 byte 1 \b, PPF 2.0 patch
4019: >5 byte 2 \b, PPF 3.0 patch
4020: >>56 byte 0 \b, Imagetype BIN (any)
4021: >>56 byte 1 \b, Imagetype GI (PrimoDVD)
4022: >>57 byte 0 \b, Blockcheck disabled
4023: >>57 byte 1 \b, Blockcheck enabled
4024: >>58 byte 0 \b, Undo data not available
4025: >>58 byte 1 \b, Undo data available
4026: >6 string x \b, description: %s
4027:
4028: 0 string PPF20 Playstation Patch File version 2.0
4029: >5 byte 0 \b, PPF 1.0 patch
4030: >5 byte 1 \b, PPF 2.0 patch
4031: >>56 lelong >0 \b, size of file to patch %d
4032: >6 string x \b, description: %s
4033:
4034: 0 string PPF10 Playstation Patch File version 1.0
4035: >5 byte 0 \b, Simple Encoding
4036: >6 string x \b, description: %s
4037:
4038: # From: Daniel Dawson <ddawson@icehouse.net>
4039: # SNES9x .smv "movie" file format.
4040: 0 string SMV\x1A SNES9x input recording
4041: >0x4 lelong x \b, version %d
4042: # version 4 is latest so far
4043: >0x4 lelong <5
4044: >>0x8 ledate x \b, recorded at %s
4045: >>0xc lelong >0 \b, rerecorded %d times
4046: >>0x10 lelong x \b, %d frames long
4047: >>0x14 byte >0 \b, data for controller(s):
4048: >>>0x14 byte &0x1 #1
4049: >>>0x14 byte &0x2 #2
4050: >>>0x14 byte &0x4 #3
4051: >>>0x14 byte &0x8 #4
4052: >>>0x14 byte &0x10 #5
4053: >>0x15 byte ^0x1 \b, begins from snapshot
4054: >>0x15 byte &0x1 \b, begins from reset
4055: >>0x15 byte ^0x2 \b, NTSC standard
4056: >>0x15 byte &0x2 \b, PAL standard
4057: >>0x17 byte &0x1 \b, settings:
4058: # WIP1Timing not used as of version 4
4059: >>>0x4 lelong <4
4060: >>>>0x17 byte &0x2 WIP1Timing
4061: >>>0x17 byte &0x4 Left+Right
4062: >>>0x17 byte &0x8 VolumeEnvX
4063: >>>0x17 byte &0x10 FakeMute
4064: >>>0x17 byte &0x20 SyncSound
4065: # New flag as of version 4
4066: >>>0x4 lelong >3
4067: >>>>0x17 byte &0x80 NoCPUShutdown
4068: >>0x4 lelong <4
4069: >>>0x18 lelong >0x23
4070: >>>>0x20 leshort !0
4071: >>>>>0x20 lestring16 x \b, metadata: "%s"
4072: >>0x4 lelong >3
4073: >>>0x24 byte >0 \b, port 1:
4074: >>>>0x24 byte 1 joypad
4075: >>>>0x24 byte 2 mouse
4076: >>>>0x24 byte 3 SuperScope
4077: >>>>0x24 byte 4 Justifier
4078: >>>>0x24 byte 5 multitap
4079: >>>0x24 byte >0 \b, port 2:
4080: >>>>0x25 byte 1 joypad
4081: >>>>0x25 byte 2 mouse
4082: >>>>0x25 byte 3 SuperScope
4083: >>>>0x25 byte 4 Justifier
4084: >>>>0x25 byte 5 multitap
4085: >>>0x18 lelong >0x43
4086: >>>>0x40 leshort !0
4087: >>>>>0x40 lestring16 x \b, metadata: "%s"
4088: >>0x17 byte &0x40 \b, ROM:
4089: >>>(0x18.l-26) lelong x CRC32 0x%08x
4090: >>>(0x18.l-23) string x "%s"
4091:
4092: # Type: scummVM savegame files
4093: # From: Sven Hartge <debian@ds9.argh.org>
1.1.1.2 ! misho 4094: 0 string SCVM ScummVM savegame
1.1 misho 4095: >12 string >\0 "%s"
1.1.1.2 ! misho 4096:
1.1 misho 4097: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4098: # $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $
1.1 misho 4099: # convex: file(1) magic for Convex boxes
4100: #
4101: # Convexes are big-endian.
4102: #
4103: # /*\
4104: # * Below are the magic numbers and tests added for Convex.
4105: # * Added at beginning, because they are expected to be used most.
4106: # \*/
4107: 0 belong 0507 Convex old-style object
4108: >16 belong >0 not stripped
4109: 0 belong 0513 Convex old-style demand paged executable
4110: >16 belong >0 not stripped
4111: 0 belong 0515 Convex old-style pre-paged executable
4112: >16 belong >0 not stripped
4113: 0 belong 0517 Convex old-style pre-paged, non-swapped executable
4114: >16 belong >0 not stripped
4115: 0 belong 0x011257 Core file
4116: #
4117: # The following are a series of dump format magic numbers. Each one
4118: # corresponds to a drastically different dump format. The first on is
4119: # the original dump format on a 4.1 BSD or earlier file system. The
4120: # second marks the change between the 4.1 file system and the 4.2 file
4121: # system. The Third marks the changing of the block size from 1K
4122: # to 2K to be compatible with an IDC file system. The fourth indicates
4123: # a dump that is dependent on Convex Storage Manager, because data in
4124: # secondary storage is not physically contained within the dump.
4125: # The restore program uses these number to determine how the data is
4126: # to be extracted.
4127: #
4128: 24 belong =60011 dump format, 4.1 BSD or earlier
4129: 24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
4130: 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
4131: 24 belong =60014 dump format, Convex Storage Manager by-reference dump
4132: #
4133: # what follows is a bunch of bit-mask checks on the flags field of the opthdr.
4134: # If there is no `=' sign, assume just checking for whether the bit is set?
4135: #
4136: 0 belong 0601 Convex SOFF
4137: >88 belong&0x000f0000 =0x00000000 c1
4138: >88 belong &0x00010000 c2
4139: >88 belong &0x00020000 c2mp
4140: >88 belong &0x00040000 parallel
4141: >88 belong &0x00080000 intrinsic
4142: >88 belong &0x00000001 demand paged
4143: >88 belong &0x00000002 pre-paged
4144: >88 belong &0x00000004 non-swapped
4145: >88 belong &0x00000008 POSIX
4146: #
4147: >84 belong &0x80000000 executable
4148: >84 belong &0x40000000 object
4149: >84 belong&0x20000000 =0 not stripped
4150: >84 belong&0x18000000 =0x00000000 native fpmode
4151: >84 belong&0x18000000 =0x10000000 ieee fpmode
4152: >84 belong&0x18000000 =0x18000000 undefined fpmode
4153: #
4154: 0 belong 0605 Convex SOFF core
4155: #
4156: 0 belong 0607 Convex SOFF checkpoint
4157: >88 belong&0x000f0000 =0x00000000 c1
4158: >88 belong &0x00010000 c2
4159: >88 belong &0x00020000 c2mp
4160: >88 belong &0x00040000 parallel
4161: >88 belong &0x00080000 intrinsic
4162: >88 belong &0x00000008 POSIX
4163: #
4164: >84 belong&0x18000000 =0x00000000 native fpmode
4165: >84 belong&0x18000000 =0x10000000 ieee fpmode
4166: >84 belong&0x18000000 =0x18000000 undefined fpmode
4167:
4168: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4169: # $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
1.1 misho 4170: # cracklib: file (1) magic for cracklib v2.7
4171:
4172: 0 lelong 0x70775631 Cracklib password index, little endian
4173: >4 long >0 (%i words)
4174: >4 long 0 ("64-bit")
4175: >>8 long >-1 (%i words)
4176: 0 belong 0x70775631 Cracklib password index, big endian
4177: >4 belong >-1 (%i words)
4178: # really bellong 0x0000000070775631
4179: 0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
4180: >12 belong >0 (%i words)
1.1.1.2 ! misho 4181:
1.1 misho 4182: # ----------------------------------------------------------------------------
1.1.1.2 ! misho 4183: # $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
1.1 misho 4184: # ctags: file (1) magic for Exuberant Ctags files
4185: # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
4186: 0 search/1 =!_TAG Exuberant Ctags tag file text
4187:
4188: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4189: # $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 4190: # dact: file(1) magic for DACT compressed files
4191: #
4192: 0 long 0x444354C3 DACT compressed data
4193: >4 byte >-1 (version %i.
4194: >5 byte >-1 $BS%i.
4195: >6 byte >-1 $BS%i)
4196: >7 long >0 $BS, original size: %i bytes
4197: >15 long >30 $BS, block size: %i bytes
4198:
4199: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4200: # $File: database,v 1.24 2009/09/19 16:28:08 christos Exp $
1.1 misho 4201: # database: file(1) magic for various databases
4202: #
4203: # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
4204: #
4205: #
4206: # GDBM magic numbers
4207: # Will be maintained as part of the GDBM distribution in the future.
4208: # <downsj@teeny.org>
4209: 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
4210: !:mime application/x-gdbm
4211: 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
4212: !:mime application/x-gdbm
4213: 0 string GDBM GNU dbm 2.x database
4214: !:mime application/x-gdbm
4215: #
4216: # Berkeley DB
4217: #
4218: # Ian Darwin's file /etc/magic files: big/little-endian version.
4219: #
4220: # Hash 1.85/1.86 databases store metadata in network byte order.
4221: # Btree 1.85/1.86 databases store the metadata in host byte order.
4222: # Hash and Btree 2.X and later databases store the metadata in host byte order.
4223:
4224: 0 long 0x00061561 Berkeley DB
4225: !:mime application/x-dbm
4226: >8 belong 4321
4227: >>4 belong >2 1.86
4228: >>4 belong <3 1.85
4229: >>4 belong >0 (Hash, version %d, native byte-order)
4230: >8 belong 1234
4231: >>4 belong >2 1.86
4232: >>4 belong <3 1.85
4233: >>4 belong >0 (Hash, version %d, little-endian)
4234:
4235: 0 belong 0x00061561 Berkeley DB
4236: >8 belong 4321
4237: >>4 belong >2 1.86
4238: >>4 belong <3 1.85
4239: >>4 belong >0 (Hash, version %d, big-endian)
4240: >8 belong 1234
4241: >>4 belong >2 1.86
4242: >>4 belong <3 1.85
4243: >>4 belong >0 (Hash, version %d, native byte-order)
4244:
4245: 0 long 0x00053162 Berkeley DB 1.85/1.86
4246: >4 long >0 (Btree, version %d, native byte-order)
4247: 0 belong 0x00053162 Berkeley DB 1.85/1.86
4248: >4 belong >0 (Btree, version %d, big-endian)
4249: 0 lelong 0x00053162 Berkeley DB 1.85/1.86
4250: >4 lelong >0 (Btree, version %d, little-endian)
4251:
4252: 12 long 0x00061561 Berkeley DB
4253: >16 long >0 (Hash, version %d, native byte-order)
4254: 12 belong 0x00061561 Berkeley DB
4255: >16 belong >0 (Hash, version %d, big-endian)
4256: 12 lelong 0x00061561 Berkeley DB
4257: >16 lelong >0 (Hash, version %d, little-endian)
4258:
4259: 12 long 0x00053162 Berkeley DB
4260: >16 long >0 (Btree, version %d, native byte-order)
4261: 12 belong 0x00053162 Berkeley DB
4262: >16 belong >0 (Btree, version %d, big-endian)
4263: 12 lelong 0x00053162 Berkeley DB
4264: >16 lelong >0 (Btree, version %d, little-endian)
4265:
4266: 12 long 0x00042253 Berkeley DB
4267: >16 long >0 (Queue, version %d, native byte-order)
4268: 12 belong 0x00042253 Berkeley DB
4269: >16 belong >0 (Queue, version %d, big-endian)
4270: 12 lelong 0x00042253 Berkeley DB
4271: >16 lelong >0 (Queue, version %d, little-endian)
4272:
4273: # From Max Bowsher.
4274: 12 long 0x00040988 Berkeley DB
4275: >16 long >0 (Log, version %d, native byte-order)
4276: 12 belong 0x00040988 Berkeley DB
4277: >16 belong >0 (Log, version %d, big-endian)
4278: 12 lelong 0x00040988 Berkeley DB
4279: >16 lelong >0 (Log, version %d, little-endian)
4280:
4281: #
4282: #
4283: # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
4284: 0 string RRD RRDTool DB
4285: >4 string x version %s
4286: #----------------------------------------------------------------------
4287: # ROOT: file(1) magic for ROOT databases
4288: #
4289: 0 string root\0 ROOT file
4290: >4 belong x Version %d
4291: >33 belong x (Compression: %d)
4292:
4293: # XXX: Weak magic.
4294: # Alex Ott <ott@jet.msk.su>
4295: ## Paradox file formats
4296: #2 leshort 0x0800 Paradox
4297: #>0x39 byte 3 v. 3.0
4298: #>0x39 byte 4 v. 3.5
4299: #>0x39 byte 9 v. 4.x
4300: #>0x39 byte 10 v. 5.x
4301: #>0x39 byte 11 v. 5.x
4302: #>0x39 byte 12 v. 7.x
4303: #>>0x04 byte 0 indexed .DB data file
4304: #>>0x04 byte 1 primary index .PX file
4305: #>>0x04 byte 2 non-indexed .DB data file
4306: #>>0x04 byte 3 non-incrementing secondary index .Xnn file
4307: #>>0x04 byte 4 secondary index .Ynn file
4308: #>>0x04 byte 5 incrementing secondary index .Xnn file
4309: #>>0x04 byte 6 non-incrementing secondary index .XGn file
4310: #>>0x04 byte 7 secondary index .YGn file
4311: #>>>0x04 byte 8 incrementing secondary index .XGn file
4312:
4313: ## XBase database files
4314: #0 byte 0x02
4315: #>8 leshort >0
4316: #>>12 leshort 0 FoxBase
4317: #!:mime application/x-dbf
4318: #>>>0x04 lelong 0 (no records)
4319: #>>>0x04 lelong >0 (%ld records)
4320: #
4321: #0 byte 0x03
4322: #!:mime application/x-dbf
4323: #>8 leshort >0
4324: #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
4325: #>>>0x04 lelong 0 (no records)
4326: #>>>0x04 lelong >0 (%ld records)
4327: #
4328: #0 byte 0x04
4329: #!:mime application/x-dbf
4330: #>8 leshort >0
4331: #>>12 leshort 0 dBASE IV no memo file
4332: #>>>0x04 lelong 0 (no records)
4333: #>>>0x04 lelong >0 (%ld records)
4334: #
4335: #0 byte 0x05
4336: #!:mime application/x-dbf
4337: #>8 leshort >0
4338: #>>12 leshort 0 dBASE V no memo file
4339: #>>>0x04 lelong 0 (no records)
4340: #>>>0x04 lelong >0 (%ld records)
4341: #
4342: #0 byte 0x30
4343: #!:mime application/x-dbf
4344: #>8 leshort >0
4345: #>>12 leshort 0 Visual FoxPro
4346: #>>>0x04 lelong 0 (no records)
4347: #>>>0x04 lelong >0 (%ld records)
4348: #
4349: #0 byte 0x43
4350: #!:mime application/x-dbf
4351: #>8 leshort >0
4352: #>>12 leshort 0 FlagShip with memo var size
4353: #>>>0x04 lelong 0 (no records)
4354: #>>>0x04 lelong >0 (%ld records)
4355: #
4356: #0 byte 0x7b
4357: #!:mime application/x-dbf
4358: #>8 leshort >0
4359: #>>12 leshort 0 dBASEIV with memo
4360: #>>>0x04 lelong 0 (no records)
4361: #>>>0x04 lelong >0 (%ld records)
4362: #
4363: #0 byte 0x83
4364: #!:mime application/x-dbf
4365: #>8 leshort >0
4366: #>>12 leshort 0 FoxBase+, dBaseIII+ with memo
4367: #>>>0x04 lelong 0 (no records)
4368: #>>>0x04 lelong >0 (%ld records)
4369: #
4370: #0 byte 0x8b
4371: #!:mime application/x-dbf
4372: #>8 leshort >0
4373: #>>12 leshort 0 dBaseIV with memo
4374: #>>>0x04 lelong 0 (no records)
4375: #>>>0x04 lelong >0 (%ld records)
4376: #
4377: #0 byte 0x8e
4378: #!:mime application/x-dbf
4379: #>8 leshort >0
4380: #>>12 leshort 0 dBaseIV with SQL Table
4381: #>>>0x04 lelong 0 (no records)
4382: #>>>0x04 lelong >0 (%ld records)
4383: #
4384: #0 byte 0xb3
4385: #!:mime application/x-dbf
4386: #>8 leshort >0
4387: #>>12 leshort 0 FlagShip with .dbt memo
4388: #>>>0x04 lelong 0 (no records)
4389: #>>>0x04 lelong >0 (%ld records)
4390: #
4391: #0 byte 0xf5
4392: #!:mime application/x-dbf
4393: #>8 leshort >0
4394: #>>12 leshort 0 FoxPro with memo
4395: #>>>0x04 lelong 0 (no records)
4396: #>>>0x04 lelong >0 (%ld records)
4397: #
4398: #0 leshort 0x0006 DBase 3 index file
4399:
4400: # MS Access database
4401: 4 string Standard\ Jet\ DB Microsoft Access Database
4402: !:mime application/x-msaccess
4403:
4404: # TDB database from Samba et al - Martin Pool <mbp@samba.org>
4405: 0 string TDB\ file TDB database
4406: >32 lelong 0x2601196D version 6, little-endian
4407: >>36 lelong x hash size %d bytes
4408:
4409: # SE Linux policy database
4410: 0 lelong 0xf97cff8c SE Linux policy
4411: >16 lelong x v%d
4412: >20 lelong 1 MLS
4413: >24 lelong x %d symbols
4414: >28 lelong x %d ocons
4415:
4416: # ICE authority file data (Wolfram Kleff)
4417: 2 string ICE ICE authority data
4418:
4419: # X11 Xauthority file (Wolfram Kleff)
4420: 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4421: 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4422: 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4423: 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4424: 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4425: 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4426: 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4427: 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4428: 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
4429:
4430: # From: Maxime Henrion <mux@FreeBSD.org>
4431: # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
4432: 0 string PGDMP PostgreSQL custom database dump
4433: >5 byte x - v%d
4434: >6 byte x \b.%d
4435: >5 beshort <0x101 \b-0
4436: >5 beshort >0x100
4437: >>7 byte x \b-%d
4438:
4439: # Type: Advanced Data Format (ADF) database
4440: # URL: http://www.grc.nasa.gov/WWW/cgns/adf/
4441: # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
4442: 0 string @(#)ADF\ Database CGNS Advanced Data Format
4443:
1.1.1.2 ! misho 4444: # Tokyo Cabinet magic data
! 4445: # http://tokyocabinet.sourceforge.net/index.html
! 4446: 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
! 4447: >14 string x \b (%s)
! 4448: >32 byte 0 \b, Hash
! 4449: !:mime application/x-tokyocabinet-hash
! 4450: >32 byte 1 \b, B+ tree
! 4451: !:mime application/x-tokyocabinet-btree
! 4452: >32 byte 2 \b, Fixed-length
! 4453: !:mime application/x-tokyocabinet-fixed
! 4454: >32 byte 3 \b, Table
! 4455: !:mime application/x-tokyocabinet-table
! 4456: >33 byte &1 \b, [open]
! 4457: >33 byte &2 \b, [fatal]
! 4458: >34 byte x \b, apow=%d
! 4459: >35 byte x \b, fpow=%d
! 4460: >36 byte &0x01 \b, [large]
! 4461: >36 byte &0x02 \b, [deflate]
! 4462: >36 byte &0x04 \b, [bzip]
! 4463: >36 byte &0x08 \b, [tcbs]
! 4464: >36 byte &0x10 \b, [excodec]
! 4465: >40 lequad x \b, bnum=%lld
! 4466: >48 lequad x \b, rnum=%lld
! 4467: >56 lequad x \b, fsiz=%lld
! 4468:
1.1 misho 4469: # Type: QDBM Quick Database Manager
4470: # From: Benoit Sibaud <bsibaud@april.org>
1.1.1.2 ! misho 4471: 0 string \\[depot\\]\n\f Quick Database Manager, little endian
! 4472: 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
1.1 misho 4473:
4474: # Type: TokyoCabinet database
4475: # URL: http://tokyocabinet.sourceforge.net/
4476: # From: Benoit Sibaud <bsibaud@april.org>
1.1.1.2 ! misho 4477: 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
! 4478: >14 string x (version %s)
1.1 misho 4479:
4480: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4481: # $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
1.1 misho 4482: # diamond: file(1) magic for Diamond system
4483: #
4484: # ... diamond is a multi-media mail and electronic conferencing system....
4485: #
4486: # XXX - I think it was either renamed Slate, or replaced by Slate....
4487: #
4488: # The full deal is too long...
4489: #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
4490: 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
1.1.1.2 ! misho 4491:
1.1 misho 4492: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4493: # $File: diff,v 1.10 2009/09/19 16:28:08 christos Exp $
1.1 misho 4494: # diff: file(1) magic for diff(1) output
4495: #
4496: 0 search/1 diff\ diff output text
4497: !:mime text/x-diff
4498: 0 search/1 ***\ diff output text
4499: !:mime text/x-diff
4500: 0 search/1 Only\ in\ diff output text
4501: !:mime text/x-diff
4502: 0 search/1 Common\ subdirectories:\ diff output text
4503: !:mime text/x-diff
4504:
4505: 0 search/1 Index: RCS/CVS diff output text
4506: !:mime text/x-diff
1.1.1.2 ! misho 4507:
! 4508: # bsdiff: file(1) magic for bsdiff(1) output
! 4509: 0 string BSDIFF40 bsdiff(1) patch file
! 4510:
! 4511: #------------------------------------------------------------------------------
! 4512: # $File: digital,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 4513: # Digital UNIX - Info
4514: #
4515: 0 string =!<arch>\n________64E Alpha archive
4516: >22 string X -- out of date
4517: #
4518: # Alpha COFF Based Executables
4519: # The stripped stuff really needs to be an 8 byte (64 bit) compare,
4520: # but this works
4521: 0 leshort 0x183 COFF format alpha
4522: >22 leshort&020000 &010000 sharable library,
4523: >22 leshort&020000 ^010000 dynamically linked,
4524: >24 leshort 0410 pure
4525: >24 leshort 0413 demand paged
4526: >8 lelong >0 executable or object module, not stripped
4527: >8 lelong 0
4528: >>12 lelong 0 executable or object module, stripped
4529: >>12 lelong >0 executable or object module, not stripped
4530: >27 byte >0 - version %d.
4531: >26 byte >0 %d-
4532: >28 leshort >0 %d
4533: #
4534: # The next is incomplete, we could tell more about this format,
4535: # but its not worth it.
4536: 0 leshort 0x188 Alpha compressed COFF
4537: 0 leshort 0x18f Alpha u-code object
4538: #
4539: #
4540: # Some other interesting Digital formats,
4541: 0 string \377\377\177 ddis/ddif
4542: 0 string \377\377\174 ddis/dots archive
4543: 0 string \377\377\176 ddis/dtif table data
4544: 0 string \033c\033 LN03 output
4545: 0 long 04553207 X image
4546: #
4547: 0 string =!<PDF>!\n profiling data file
4548: #
4549: # Locale data tables (MIPS and Alpha).
4550: #
4551: 0 short 0x0501 locale data table
4552: >6 short 0x24 for MIPS
4553: >6 short 0x40 for Alpha
1.1.1.2 ! misho 4554:
! 4555: #------------------------------------------------------------------------------
! 4556: # $File: dolby,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 4557: # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
4558: # from http://www.atsc.org/standards/a_52a.pdf
4559: # corrections, additions, etc. are always welcome!
4560: #
4561: # syncword
4562: 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
4563: # fscod
4564: >4 byte&0xc0 0x00 48 kHz,
4565: >4 byte&0xc0 0x40 44.1 kHz,
4566: >4 byte&0xc0 0x80 32 kHz,
4567: # is this one used for 96 kHz?
4568: >4 byte&0xc0 0xc0 reserved frequency,
4569: #
4570: >5 byte&7 = 0 \b, complete main (CM)
4571: >5 byte&7 = 1 \b, music and effects (ME)
4572: >5 byte&7 = 2 \b, visually impaired (VI)
4573: >5 byte&7 = 3 \b, hearing impaired (HI)
4574: >5 byte&7 = 4 \b, dialogue (D)
4575: >5 byte&7 = 5 \b, commentary (C)
4576: >5 byte&7 = 6 \b, emergency (E)
4577: # acmod
4578: >6 byte&0xe0 0x00 1+1 front,
4579: >6 byte&0xe0 0x20 1 front/0 rear,
4580: >6 byte&0xe0 0x40 2 front/0 rear,
4581: >6 byte&0xe0 0x60 3 front/0 rear,
4582: >6 byte&0xe0 0x80 2 front/1 rear,
4583: >6 byte&0xe0 0xa0 3 front/1 rear,
4584: >6 byte&0xe0 0xc0 2 front/2 rear,
4585: >6 byte&0xe0 0xe0 3 front/2 rear,
4586: # lfeon (these may be incorrect)
4587: >7 byte&0x40 0x00 LFE off,
4588: >7 byte&0x40 0x40 LFE on,
4589: #
4590: >4 byte&0x3e = 0x00 \b, 32 kbit/s
4591: >4 byte&0x3e = 0x02 \b, 40 kbit/s
4592: >4 byte&0x3e = 0x04 \b, 48 kbit/s
4593: >4 byte&0x3e = 0x06 \b, 56 kbit/s
4594: >4 byte&0x3e = 0x08 \b, 64 kbit/s
4595: >4 byte&0x3e = 0x0a \b, 80 kbit/s
4596: >4 byte&0x3e = 0x0c \b, 96 kbit/s
4597: >4 byte&0x3e = 0x0e \b, 112 kbit/s
4598: >4 byte&0x3e = 0x10 \b, 128 kbit/s
4599: >4 byte&0x3e = 0x12 \b, 160 kbit/s
4600: >4 byte&0x3e = 0x14 \b, 192 kbit/s
4601: >4 byte&0x3e = 0x16 \b, 224 kbit/s
4602: >4 byte&0x3e = 0x18 \b, 256 kbit/s
4603: >4 byte&0x3e = 0x1a \b, 320 kbit/s
4604: >4 byte&0x3e = 0x1c \b, 384 kbit/s
4605: >4 byte&0x3e = 0x1e \b, 448 kbit/s
4606: >4 byte&0x3e = 0x20 \b, 512 kbit/s
4607: >4 byte&0x3e = 0x22 \b, 576 kbit/s
4608: >4 byte&0x3e = 0x24 \b, 640 kbit/s
4609: # dsurmod (these may be incorrect)
4610: >6 beshort&0x0180 0x0000 Dolby Surround not indicated
4611: >6 beshort&0x0180 0x0080 not Dolby Surround encoded
4612: >6 beshort&0x0180 0x0100 Dolby Surround encoded
4613: >6 beshort&0x0180 0x0180 reserved Dolby Surround mode
4614:
4615: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4616: # $File: dump,v 1.11 2009/09/19 16:28:09 christos Exp $
1.1 misho 4617: # dump: file(1) magic for dump file format--for new and old dump filesystems
4618: #
4619: # We specify both byte orders in order to recognize byte-swapped dumps.
4620: #
4621: 24 belong 60012 new-fs dump file (big endian),
4622: >4 bedate x Previous dump %s,
4623: >8 bedate x This dump %s,
4624: >12 belong >0 Volume %ld,
4625: >692 belong 0 Level zero, type:
4626: >692 belong >0 Level %d, type:
4627: >0 belong 1 tape header,
4628: >0 belong 2 beginning of file record,
4629: >0 belong 3 map of inodes on tape,
4630: >0 belong 4 continuation of file record,
4631: >0 belong 5 end of volume,
4632: >0 belong 6 map of inodes deleted,
4633: >0 belong 7 end of medium (for floppy),
4634: >676 string >\0 Label %s,
4635: >696 string >\0 Filesystem %s,
4636: >760 string >\0 Device %s,
4637: >824 string >\0 Host %s,
4638: >888 belong >0 Flags %x
4639:
4640: 24 belong 60011 old-fs dump file (big endian),
4641: #>4 bedate x Previous dump %s,
4642: #>8 bedate x This dump %s,
4643: >12 belong >0 Volume %ld,
4644: >692 belong 0 Level zero, type:
4645: >692 belong >0 Level %d, type:
4646: >0 belong 1 tape header,
4647: >0 belong 2 beginning of file record,
4648: >0 belong 3 map of inodes on tape,
4649: >0 belong 4 continuation of file record,
4650: >0 belong 5 end of volume,
4651: >0 belong 6 map of inodes deleted,
4652: >0 belong 7 end of medium (for floppy),
4653: >676 string >\0 Label %s,
4654: >696 string >\0 Filesystem %s,
4655: >760 string >\0 Device %s,
4656: >824 string >\0 Host %s,
4657: >888 belong >0 Flags %x
4658:
4659: 24 lelong 60012 new-fs dump file (little endian),
4660: >4 ledate x This dump %s,
4661: >8 ledate x Previous dump %s,
4662: >12 lelong >0 Volume %ld,
4663: >692 lelong 0 Level zero, type:
4664: >692 lelong >0 Level %d, type:
4665: >0 lelong 1 tape header,
4666: >0 lelong 2 beginning of file record,
4667: >0 lelong 3 map of inodes on tape,
4668: >0 lelong 4 continuation of file record,
4669: >0 lelong 5 end of volume,
4670: >0 lelong 6 map of inodes deleted,
4671: >0 lelong 7 end of medium (for floppy),
4672: >676 string >\0 Label %s,
4673: >696 string >\0 Filesystem %s,
4674: >760 string >\0 Device %s,
4675: >824 string >\0 Host %s,
4676: >888 lelong >0 Flags %x
4677:
4678: 24 lelong 60011 old-fs dump file (little endian),
4679: #>4 ledate x Previous dump %s,
4680: #>8 ledate x This dump %s,
4681: >12 lelong >0 Volume %ld,
4682: >692 lelong 0 Level zero, type:
4683: >692 lelong >0 Level %d, type:
4684: >0 lelong 1 tape header,
4685: >0 lelong 2 beginning of file record,
4686: >0 lelong 3 map of inodes on tape,
4687: >0 lelong 4 continuation of file record,
4688: >0 lelong 5 end of volume,
4689: >0 lelong 6 map of inodes deleted,
4690: >0 lelong 7 end of medium (for floppy),
4691: >676 string >\0 Label %s,
4692: >696 string >\0 Filesystem %s,
4693: >760 string >\0 Device %s,
4694: >824 string >\0 Host %s,
4695: >888 lelong >0 Flags %x
4696:
4697: 18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
4698: >2 medate x Previous dump %s,
4699: >6 medate x This dump %s,
4700: >10 leshort >0 Volume %ld,
4701: >0 leshort 1 tape header.
4702: >0 leshort 2 beginning of file record.
4703: >0 leshort 3 map of inodes on tape.
4704: >0 leshort 4 continuation of file record.
4705: >0 leshort 5 end of volume.
4706: >0 leshort 6 map of inodes deleted.
4707: >0 leshort 7 end of medium (for floppy).
4708:
4709: 24 belong 0x19540119 new-fs dump file (ufs2, big endian),
4710: >896 beqdate x Previous dump %s,
4711: >904 beqdate x This dump %s,
4712: >12 belong >0 Volume %ld,
4713: >692 belong 0 Level zero, type:
4714: >692 belong >0 Level %d, type:
4715: >0 belong 1 tape header,
4716: >0 belong 2 beginning of file record,
4717: >0 belong 3 map of inodes on tape,
4718: >0 belong 4 continuation of file record,
4719: >0 belong 5 end of volume,
4720: >0 belong 6 map of inodes deleted,
4721: >0 belong 7 end of medium (for floppy),
4722: >676 string >\0 Label %s,
4723: >696 string >\0 Filesystem %s,
4724: >760 string >\0 Device %s,
4725: >824 string >\0 Host %s,
4726: >888 belong >0 Flags %x
4727:
4728: 24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
4729: >896 leqdate x This dump %s,
4730: >904 leqdate x Previous dump %s,
4731: >12 lelong >0 Volume %ld,
4732: >692 lelong 0 Level zero, type:
4733: >692 lelong >0 Level %d, type:
4734: >0 lelong 1 tape header,
4735: >0 lelong 2 beginning of file record,
4736: >0 lelong 3 map of inodes on tape,
4737: >0 lelong 4 continuation of file record,
4738: >0 lelong 5 end of volume,
4739: >0 lelong 6 map of inodes deleted,
4740: >0 lelong 7 end of medium (for floppy),
4741: >676 string >\0 Label %s,
4742: >696 string >\0 Filesystem %s,
4743: >760 string >\0 Device %s,
4744: >824 string >\0 Host %s,
4745: >888 lelong >0 Flags %x
4746:
4747: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4748: # $File: dyadic,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 4749: # Dyadic: file(1) magic for Dyalog APL.
4750: #
1.1.1.2 ! misho 4751: 0 byte 0xaa
1.1 misho 4752: >1 byte <4 Dyalog APL
4753: >>1 byte 0x00 incomplete workspace
4754: >>1 byte 0x01 component file
4755: >>1 byte 0x02 external variable
4756: >>1 byte 0x03 workspace
4757: >>2 byte x version %d
4758: >>3 byte x .%d
4759:
1.1.1.2 ! misho 4760: 0 beshort 0xaa03 Dyalog APL
! 4761: >2 byte x workspace type %d
! 4762: >3 byte x subtype %d
! 4763: >7 byte&0x28 0x00 32-bit
! 4764: >7 byte&0x28 0x20 64-bit
! 4765: >7 byte&0x0c 0x00 classic
! 4766: >7 byte&0x0c 0x04 unicode
! 4767: >7 byte&0x88 0x00 big-endian
! 4768: >7 byte&0x88 0x80 little-endian
! 4769:
! 4770: 0 byte 0xaa Dyalog APL
! 4771: >1 byte 0x00 aplcore
! 4772: >1 byte 0x01 component file 32-bit non-journaled non-checksummed
! 4773: >1 byte 0x02 external variable exclusive
! 4774: >1 byte 0x06 external variable shared
! 4775: >1 byte 0x07 session
! 4776: >1 byte 0x08 mapped file 32-bit
! 4777: >1 byte 0x09 component file 64-bit non-journaled non-checksummed
! 4778: >1 byte 0x0a mapped file 64-bit
! 4779: >1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
! 4780: >1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
! 4781: >1 byte 0x0d component file 32-bit level 1 journaled checksummed
! 4782: >1 byte 0x0e component file 64-bit level 1 journaled checksummed
! 4783: >1 byte 0x0f component file 32-bit level 2 journaled checksummed
! 4784: >1 byte 0x10 component file 64-bit level 2 journaled checksummed
! 4785: >1 byte 0x11 component file 32-bit level 3 journaled checksummed
! 4786: >1 byte 0x12 component file 64-bit level 3 journaled checksummed
! 4787: >1 byte 0x13 component file 32-bit non-journaled checksummed
! 4788: >1 byte 0x14 component file 64-bit non-journaled checksummed
! 4789: >1 byte 0x80 DDB
! 4790:
! 4791: 0 short 0x6060 Dyalog APL transfer
! 4792:
1.1 misho 4793: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4794: # $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $
1.1 misho 4795: # T602 editor documents
4796: # by David Necas <yeti@physics.muni.cz>
4797: 0 string @CT\ T602 document data,
4798: >4 string 0 Kamenicky
4799: >4 string 1 CP 852
4800: >4 string 2 KOI8-CS
4801: >4 string >2 unknown encoding
4802:
4803: # Vi IMproved Encrypted file
4804: # by David Necas <yeti@physics.muni.cz>
4805: 0 string VimCrypt~ Vim encrypted file data
4806: # Vi IMproved Swap file
4807: # by Sven Wegener <swegener@gentoo.org>
4808: 0 string b0VIM\ Vim swap file
4809: >&0 string >\0 \b, version %s
4810:
4811: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4812: # $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 4813: # efi: file(1) magic for Universal EFI binaries
4814:
4815: 0 lelong 0x0ef1fab9
4816: >4 lelong 1 Universal EFI binary with 1 architecture
4817: >>&0 lelong 7 \b, i386
4818: >>&0 lelong 0x01000007 \b, x86_64
4819: >4 lelong 2 Universal EFI binary with 2 architectures
4820: >>&0 lelong 7 \b, i386
4821: >>&0 lelong 0x01000007 \b, x86_64
4822: >>&20 lelong 7 \b, i386
4823: >>&20 lelong 0x01000007 \b, x86_64
4824: >4 lelong >2 Universal EFI binary with %ld architectures
4825:
4826: #------------------------------------------------------------------------------
1.1.1.2 ! misho 4827: # $File: elf,v 1.53 2009/09/19 16:28:09 christos Exp $
1.1 misho 4828: # elf: file(1) magic for ELF executables
4829: #
4830: # We have to check the byte order flag to see what byte order all the
4831: # other stuff in the header is in.
4832: #
4833: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
4834: #
4835: # Created by: unknown
4836: # Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
4837: # Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
4838: # Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
4839: # Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
4840: # Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
4841: 0 string \177ELF ELF
4842: >4 byte 0 invalid class
4843: >4 byte 1 32-bit
4844: >4 byte 2 64-bit
4845: >5 byte 0 invalid byte order
4846: >5 byte 1 LSB
4847: >>16 leshort 0 no file type,
4848: !:strength *2
4849: !:mime application/octet-stream
4850: >>16 leshort 1 relocatable,
4851: !:mime application/x-object
4852: >>16 leshort 2 executable,
4853: !:mime application/x-executable
4854: >>16 leshort 3 shared object,
4855: !:mime application/x-sharedlib
4856: >>16 leshort 4 core file
4857: !:mime application/x-coredump
4858: # Core file detection is not reliable.
4859: #>>>(0x38+0xcc) string >\0 of '%s'
4860: #>>>(0x38+0x10) lelong >0 (signal %d),
4861: >>16 leshort &0xff00 processor-specific,
4862: >>18 leshort 0 no machine,
4863: >>18 leshort 1 AT&T WE32100 - invalid byte order,
4864: >>18 leshort 2 SPARC - invalid byte order,
4865: >>18 leshort 3 Intel 80386,
4866: >>18 leshort 4 Motorola
4867: >>>36 lelong &0x01000000 68000 - invalid byte order,
4868: >>>36 lelong &0x00810000 CPU32 - invalid byte order,
4869: >>>36 lelong 0 68020 - invalid byte order,
4870: >>18 leshort 5 Motorola 88000 - invalid byte order,
4871: >>18 leshort 6 Intel 80486,
4872: >>18 leshort 7 Intel 80860,
4873: # The official e_machine number for MIPS is now #8, regardless of endianness.
4874: # The second number (#10) will be deprecated later. For now, we still
4875: # say something if #10 is encountered, but only gory details for #8.
4876: >>18 leshort 8 MIPS,
4877: >>>36 lelong &0x20 N32
4878: >>18 leshort 10 MIPS,
4879: >>>36 lelong &0x20 N32
4880: >>18 leshort 8
4881: # only for 32-bit
4882: >>>4 byte 1
4883: >>>>36 lelong&0xf0000000 0x00000000 MIPS-I
4884: >>>>36 lelong&0xf0000000 0x10000000 MIPS-II
4885: >>>>36 lelong&0xf0000000 0x20000000 MIPS-III
4886: >>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
4887: >>>>36 lelong&0xf0000000 0x40000000 MIPS-V
4888: >>>>36 lelong&0xf0000000 0x50000000 MIPS32
4889: >>>>36 lelong&0xf0000000 0x60000000 MIPS64
4890: >>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
4891: >>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
4892: # only for 64-bit
4893: >>>4 byte 2
4894: >>>>48 lelong&0xf0000000 0x00000000 MIPS-I
4895: >>>>48 lelong&0xf0000000 0x10000000 MIPS-II
4896: >>>>48 lelong&0xf0000000 0x20000000 MIPS-III
4897: >>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
4898: >>>>48 lelong&0xf0000000 0x40000000 MIPS-V
4899: >>>>48 lelong&0xf0000000 0x50000000 MIPS32
4900: >>>>48 lelong&0xf0000000 0x60000000 MIPS64
4901: >>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
4902: >>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
4903: >>18 leshort 9 Amdahl - invalid byte order,
4904: >>18 leshort 10 MIPS (deprecated),
4905: >>18 leshort 11 RS6000 - invalid byte order,
4906: >>18 leshort 15 PA-RISC - invalid byte order,
4907: >>>50 leshort 0x0214 2.0
4908: >>>48 leshort &0x0008 (LP64),
4909: >>18 leshort 16 nCUBE,
4910: >>18 leshort 17 Fujitsu VPP500,
4911: >>18 leshort 18 SPARC32PLUS - invalid byte order,
4912: >>18 leshort 20 PowerPC,
4913: >>18 leshort 22 IBM S/390,
4914: >>18 leshort 36 NEC V800,
4915: >>18 leshort 37 Fujitsu FR20,
4916: >>18 leshort 38 TRW RH-32,
4917: >>18 leshort 39 Motorola RCE,
4918: >>18 leshort 40 ARM,
4919: >>18 leshort 41 Alpha,
4920: >>18 leshort 0xa390 IBM S/390 (obsolete),
4921: >>18 leshort 42 Renesas SH,
4922: >>18 leshort 43 SPARC V9 - invalid byte order,
4923: >>18 leshort 44 Siemens Tricore Embedded Processor,
4924: >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
4925: >>18 leshort 46 Renesas H8/300,
4926: >>18 leshort 47 Renesas H8/300H,
4927: >>18 leshort 48 Renesas H8S,
4928: >>18 leshort 49 Renesas H8/500,
4929: >>18 leshort 50 IA-64,
4930: >>18 leshort 51 Stanford MIPS-X,
4931: >>18 leshort 52 Motorola Coldfire,
4932: >>18 leshort 53 Motorola M68HC12,
4933: >>18 leshort 54 Fujitsu MMA,
4934: >>18 leshort 55 Siemens PCP,
4935: >>18 leshort 56 Sony nCPU,
4936: >>18 leshort 57 Denso NDR1,
4937: >>18 leshort 58 Start*Core,
4938: >>18 leshort 59 Toyota ME16,
4939: >>18 leshort 60 ST100,
4940: >>18 leshort 61 Tinyj emb.,
4941: >>18 leshort 62 x86-64,
4942: >>18 leshort 63 Sony DSP,
4943: >>18 leshort 66 FX66,
4944: >>18 leshort 67 ST9+ 8/16 bit,
4945: >>18 leshort 68 ST7 8 bit,
4946: >>18 leshort 69 MC68HC16,
4947: >>18 leshort 70 MC68HC11,
4948: >>18 leshort 71 MC68HC08,
4949: >>18 leshort 72 MC68HC05,
4950: >>18 leshort 73 SGI SVx,
4951: >>18 leshort 74 ST19 8 bit,
4952: >>18 leshort 75 Digital VAX,
4953: >>18 leshort 76 Axis cris,
4954: >>18 leshort 77 Infineon 32-bit embedded,
4955: >>18 leshort 78 Element 14 64-bit DSP,
4956: >>18 leshort 79 LSI Logic 16-bit DSP,
4957: >>18 leshort 80 MMIX,
4958: >>18 leshort 81 Harvard machine-independent,
4959: >>18 leshort 82 SiTera Prism,
4960: >>18 leshort 83 Atmel AVR 8-bit,
4961: >>18 leshort 84 Fujitsu FR30,
4962: >>18 leshort 85 Mitsubishi D10V,
4963: >>18 leshort 86 Mitsubishi D30V,
4964: >>18 leshort 87 NEC v850,
4965: >>18 leshort 88 Renesas M32R,
4966: >>18 leshort 89 Matsushita MN10300,
4967: >>18 leshort 90 Matsushita MN10200,
4968: >>18 leshort 91 picoJava,
4969: >>18 leshort 92 OpenRISC,
4970: >>18 leshort 93 ARC Cores Tangent-A5,
4971: >>18 leshort 94 Tensilica Xtensa,
4972: >>18 leshort 97 NatSemi 32k,
4973: >>18 leshort 106 Analog Devices Blackfin,
1.1.1.2 ! misho 4974: >>18 leshort 113 Altera Nios II,
! 4975: >>18 leshort 0xae META,
! 4976: >>18 leshort 0x3426 OpenRISC (obsolete),
! 4977: >>18 leshort 0x8472 OpenRISC (obsolete),
1.1 misho 4978: >>18 leshort 0x9026 Alpha (unofficial),
4979: >>20 lelong 0 invalid version
4980: >>20 lelong 1 version 1
4981: >>36 lelong 1 MathCoPro/FPU/MAU Required
4982: >5 byte 2 MSB
4983: >>16 beshort 0 no file type,
4984: !:mime application/octet-stream
4985: >>16 beshort 1 relocatable,
4986: !:mime application/x-object
4987: >>16 beshort 2 executable,
4988: !:mime application/x-executable
4989: >>16 beshort 3 shared object,
4990: !:mime application/x-sharedlib
4991: >>16 beshort 4 core file,
4992: !:mime application/x-coredump
4993: #>>>(0x38+0xcc) string >\0 of '%s'
4994: #>>>(0x38+0x10) belong >0 (signal %d),
4995: >>16 beshort &0xff00 processor-specific,
4996: >>18 beshort 0 no machine,
4997: >>18 beshort 1 AT&T WE32100,
4998: >>18 beshort 2 SPARC,
4999: >>18 beshort 3 Intel 80386 - invalid byte order,
5000: >>18 beshort 4 Motorola
5001: >>>36 belong &0x01000000 68000,
5002: >>>36 belong &0x00810000 CPU32,
5003: >>>36 belong 0 68020,
5004: >>18 beshort 5 Motorola 88000,
5005: >>18 beshort 6 Intel 80486 - invalid byte order,
5006: >>18 beshort 7 Intel 80860,
5007: # only for MIPS - see comment in little-endian section above.
5008: >>18 beshort 8 MIPS,
5009: >>>36 belong &0x20 N32
5010: >>18 beshort 10 MIPS,
5011: >>>36 belong &0x20 N32
5012: >>18 beshort 8
5013: # only for 32-bit
5014: >>>4 byte 1
5015: >>>>36 belong&0xf0000000 0x00000000 MIPS-I
5016: >>>>36 belong&0xf0000000 0x10000000 MIPS-II
5017: >>>>36 belong&0xf0000000 0x20000000 MIPS-III
5018: >>>>36 belong&0xf0000000 0x30000000 MIPS-IV
5019: >>>>36 belong&0xf0000000 0x40000000 MIPS-V
5020: >>>>36 belong&0xf0000000 0x50000000 MIPS32
5021: >>>>36 belong&0xf0000000 0x60000000 MIPS64
5022: >>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2
5023: >>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2
5024: # only for 64-bit
5025: >>>4 byte 2
5026: >>>>48 belong&0xf0000000 0x00000000 MIPS-I
5027: >>>>48 belong&0xf0000000 0x10000000 MIPS-II
5028: >>>>48 belong&0xf0000000 0x20000000 MIPS-III
5029: >>>>48 belong&0xf0000000 0x30000000 MIPS-IV
5030: >>>>48 belong&0xf0000000 0x40000000 MIPS-V
5031: >>>>48 belong&0xf0000000 0x50000000 MIPS32
5032: >>>>48 belong&0xf0000000 0x60000000 MIPS64
5033: >>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2
5034: >>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2
5035: >>18 beshort 9 Amdahl,
5036: >>18 beshort 10 MIPS (deprecated),
5037: >>18 beshort 11 RS6000,
5038: >>18 beshort 15 PA-RISC
5039: >>>50 beshort 0x0214 2.0
5040: >>>48 beshort &0x0008 (LP64)
5041: >>18 beshort 16 nCUBE,
5042: >>18 beshort 17 Fujitsu VPP500,
5043: >>18 beshort 18 SPARC32PLUS,
5044: >>>36 belong&0xffff00 0x000100 V8+ Required,
5045: >>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
5046: >>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required,
5047: >>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
5048: >>18 beshort 20 PowerPC or cisco 4500,
5049: >>18 beshort 21 64-bit PowerPC or cisco 7500,
5050: >>18 beshort 22 IBM S/390,
5051: >>18 beshort 23 Cell SPU,
5052: >>18 beshort 24 cisco SVIP,
5053: >>18 beshort 25 cisco 7200,
5054: >>18 beshort 36 NEC V800 or cisco 12000,
5055: >>18 beshort 37 Fujitsu FR20,
5056: >>18 beshort 38 TRW RH-32,
5057: >>18 beshort 39 Motorola RCE,
5058: >>18 beshort 40 ARM,
5059: >>18 beshort 41 Alpha,
5060: >>18 beshort 42 Renesas SH,
5061: >>18 beshort 43 SPARC V9,
5062: >>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
5063: >>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required,
5064: >>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
5065: >>>48 belong&0x3 0 total store ordering,
5066: >>>48 belong&0x3 1 partial store ordering,
5067: >>>48 belong&0x3 2 relaxed memory ordering,
5068: >>18 beshort 44 Siemens Tricore Embedded Processor,
5069: >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
5070: >>18 beshort 46 Renesas H8/300,
5071: >>18 beshort 47 Renesas H8/300H,
5072: >>18 beshort 48 Renesas H8S,
5073: >>18 beshort 49 Renesas H8/500,
5074: >>18 beshort 50 IA-64,
5075: >>18 beshort 51 Stanford MIPS-X,
5076: >>18 beshort 52 Motorola Coldfire,
5077: >>18 beshort 53 Motorola M68HC12,
5078: >>18 beshort 73 Cray NV1,
5079: >>18 beshort 75 Digital VAX,
5080: >>18 beshort 88 Renesas M32R,
5081: >>18 leshort 92 OpenRISC,
5082: >>18 leshort 0x3426 OpenRISC (obsolete),
5083: >>18 leshort 0x8472 OpenRISC (obsolete),
5084: >>18 beshort 94 Tensilica Xtensa,
5085: >>18 beshort 97 NatSemi 32k,
5086: >>18 beshort 0x18ad AVR32 (unofficial),
5087: >>18 beshort 0x9026 Alpha (unofficial),
5088: >>18 beshort 0xa390 IBM S/390 (obsolete),
5089: >>20 belong 0 invalid version
5090: >>20 belong 1 version 1
5091: >>36 belong 1 MathCoPro/FPU/MAU Required
5092: # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
5093: # like proper ELF, but extracting the string had bad results.
5094: >4 byte <0x80
5095: >>8 string >\0 (%s)
5096: >8 string \0
5097: >>7 byte 0 (SYSV)
5098: >>7 byte 1 (HP-UX)
5099: >>7 byte 2 (NetBSD)
5100: >>7 byte 3 (GNU/Linux)
5101: >>7 byte 4 (GNU/Hurd)
5102: >>7 byte 5 (86Open)
5103: >>7 byte 6 (Solaris)
5104: >>7 byte 7 (Monterey)
5105: >>7 byte 8 (IRIX)
5106: >>7 byte 9 (FreeBSD)
5107: >>7 byte 10 (Tru64)
5108: >>7 byte 11 (Novell Modesto)
5109: >>7 byte 12 (OpenBSD)
5110: >8 string \2
5111: >>7 byte 13 (OpenVMS)
5112: >>7 byte 97 (ARM)
5113: >>7 byte 255 (embedded)
5114:
5115: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5116: # $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
1.1 misho 5117: # encore: file(1) magic for Encore machines
5118: #
5119: # XXX - needs to have the byte order specified (NS32K was little-endian,
5120: # dunno whether they run the 88K in little-endian mode or not).
5121: #
5122: 0 short 0x154 Encore
5123: >20 short 0x107 executable
5124: >20 short 0x108 pure executable
5125: >20 short 0x10b demand-paged executable
5126: >20 short 0x10f unsupported executable
5127: >12 long >0 not stripped
5128: >22 short >0 - version %ld
5129: >22 short 0 -
5130: #>4 date x stamp %s
5131: 0 short 0x155 Encore unsupported executable
5132: >12 long >0 not stripped
5133: >22 short >0 - version %ld
5134: >22 short 0 -
5135: #>4 date x stamp %s
5136:
5137: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5138: # $File: epoc,v 1.7 2009/09/19 16:28:09 christos Exp $
! 5139: # EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
! 5140: # Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
! 5141: # Useful information for improving this file can be found at:
! 5142: # http://software.frodo.looijaard.name/psiconv/formats/Index.html
! 5143: #------------------------------------------------------------------------------
! 5144: 0 lelong 0x10000037 Psion Series 5
! 5145: >4 lelong 0x10000039 font file
! 5146: >4 lelong 0x1000003A printer driver
! 5147: >4 lelong 0x1000003B clipboard
! 5148: >4 lelong 0x10000042 multi-bitmap image
! 5149: !:mime image/x-epoc-mbm
! 5150: >4 lelong 0x1000006A application information file
1.1 misho 5151: >4 lelong 0x1000006D
1.1.1.2 ! misho 5152: >>8 lelong 0x1000007D Sketch image
! 5153: !:mime image/x-epoc-sketch
! 5154: >>8 lelong 0x1000007E voice note
! 5155: >>8 lelong 0x1000007F Word file
! 5156: !:mime application/x-epoc-word
! 5157: >>8 lelong 0x10000085 OPL program (TextEd)
! 5158: !:mime application/x-epoc-opl
! 5159: >>8 lelong 0x10000088 Sheet file
! 5160: !:mime application/x-epoc-sheet
! 5161: >>8 lelong 0x100001C4 EasyFax initialisation file
! 5162: >4 lelong 0x10000073 OPO module
! 5163: !:mime application/x-epoc-opo
! 5164: >4 lelong 0x10000074 OPL application
! 5165: !:mime application/x-epoc-app
! 5166: >4 lelong 0x1000008A exported multi-bitmap image
! 5167:
! 5168: 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
! 5169:
! 5170: 0 lelong 0x10000050 Psion Series 5
! 5171: >4 lelong 0x1000006D database
! 5172: >4 lelong 0x100000E4 ini file
! 5173:
! 5174: 0 lelong 0x10000079 Psion Series 5 binary:
! 5175: >4 lelong 0x00000000 DLL
! 5176: >4 lelong 0x10000049 comms hardware library
! 5177: >4 lelong 0x1000004A comms protocol library
! 5178: >4 lelong 0x1000005D OPX
! 5179: >4 lelong 0x1000006C application
! 5180: >4 lelong 0x1000008D DLL
! 5181: >4 lelong 0x100000AC logical device driver
! 5182: >4 lelong 0x100000AD physical device driver
! 5183: >4 lelong 0x100000E5 file transfer protocol
! 5184: >4 lelong 0x100000E5 file transfer protocol
! 5185: >4 lelong 0x10000140 printer definition
! 5186: >4 lelong 0x10000141 printer definition
! 5187:
! 5188: 0 lelong 0x1000007A Psion Series 5 executable
1.1 misho 5189:
5190: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5191: # $File: erlang,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 5192: # erlang: file(1) magic for Erlang JAM and BEAM files
5193: # URL: http://www.erlang.org/faq/x779.html#AEN812
5194:
5195: # OTP R3-R4
5196: 0 string \0177BEAM! Old Erlang BEAM file
5197: >6 short >0 - version %d
5198:
5199: # OTP R5 and onwards
5200: 0 string FOR1
5201: >8 string BEAM Erlang BEAM file
5202:
5203: # 4.2 version may have a copyright notice!
1.1.1.2 ! misho 5204: 4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
! 5205: 79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
1.1 misho 5206:
1.1.1.2 ! misho 5207: 4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3
! 5208:
! 5209: 0 bequad 0x0000000000ABCDEF Erlang DETS file
1.1 misho 5210:
5211: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5212: # $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 5213: # ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
5214: # Based on info from
5215: # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
5216: 0 belong 9994 ESRI Shapefile
5217: >4 belong =0
5218: >8 belong =0
5219: >12 belong =0
5220: >16 belong =0
5221: >20 belong =0
5222: >28 lelong x version %d
5223: >24 belong x length %d
5224: >32 lelong =0 type Null Shape
5225: >32 lelong =1 type Point
5226: >32 lelong =3 type PolyLine
5227: >32 lelong =5 type Polygon
5228: >32 lelong =8 type MultiPoint
5229: >32 lelong =11 type PointZ
5230: >32 lelong =13 type PolyLineZ
5231: >32 lelong =15 type PolygonZ
5232: >32 lelong =18 type MultiPointZ
5233: >32 lelong =21 type PointM
5234: >32 lelong =23 type PolyLineM
5235: >32 lelong =25 type PolygonM
5236: >32 lelong =28 type MultiPointM
5237: >32 lelong =31 type MultiPatch
5238:
5239: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5240: # $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 5241: # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
5242: # From Roger Leigh <roger@whinlatter.uklinux.net>
5243: 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
5244: 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
5245: 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
5246:
5247:
5248: #------------------------------------------------------------------------------
1.1.1.2 ! misho 5249: # $File: filesystems,v 1.55 2010/01/16 17:45:12 chl Exp $
1.1 misho 5250: # filesystems: file(1) magic for different filesystems
5251: #
5252: 0 string \366\366\366\366 PC formatted floppy with no filesystem
5253: # Sun disk labels
5254: # From /usr/include/sun/dklabel.h:
5255: 0774 beshort 0xdabe
5256: # modified by Joerg Jenderek, because original test
5257: # succeeds for Cabinet archive dao360.dl_ with negative blocks
5258: >0770 long >0 Sun disk label
5259: >>0 string x '%s
5260: >>>31 string >\0 \b%s
5261: >>>>63 string >\0 \b%s
5262: >>>>>95 string >\0 \b%s
5263: >>0 string x \b'
5264: >>0734 short >0 %d rpm,
5265: >>0736 short >0 %d phys cys,
5266: >>0740 short >0 %d alts/cyl,
5267: >>0746 short >0 %d interleave,
5268: >>0750 short >0 %d data cyls,
5269: >>0752 short >0 %d alt cyls,
5270: >>0754 short >0 %d heads/partition,
5271: >>0756 short >0 %d sectors/track,
5272: >>0764 long >0 start cyl %ld,
5273: >>0770 long x %ld blocks
5274: # Is there a boot block written 1 sector in?
5275: >512 belong&077777777 0600407 \b, boot block present
5276: # Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
5277: # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
5278: 0 string SBMBAKUP_ Smart Boot Manager backup file
5279: >9 string x \b, version %-5.5s
5280: >>14 string =_
5281: >>>15 string x %-.1s
5282: >>>>16 string =_ \b.
5283: >>>>>17 string x \b%-.1s
5284: >>>>>>18 string =_ \b.
5285: >>>>>>>19 string x \b%-.1s
5286: >>>22 ubyte 0
5287: >>>>21 ubyte x \b, from drive 0x%x
5288: >>>22 ubyte >0
5289: >>>>21 string x \b, from drive %s
5290:
5291: # Joerg Jenderek
5292: # DOS Emulator image is 128 byte, null right padded header + harddisc image
5293: 0 string DOSEMU\0
5294: >0x27E leshort 0xAA55
5295: #offset is 128
5296: >>19 ubyte 128
5297: >>>(19.b-1) ubyte 0x0 DOS Emulator image
5298: >>>>7 ulelong >0 \b, %u heads
5299: >>>>11 ulelong >0 \b, %d sectors/track
5300: >>>>15 ulelong >0 \b, %d cylinders
5301:
5302: # updated by Joerg Jenderek at Sep 2007
5303: # only for sector sizes with 512 or more Bytes
5304: 0x1FE leshort 0xAA55 x86 boot sector
5305: # to do also for sectors < than 512 Bytes and some other files, GRR
5306: #30 search/481 \x55\xAA x86 boot sector
5307: # not for BeOS floppy 1440k, MBRs
5308: #(11.s-2) uleshort 0xAA55 x86 boot sector
5309: >2 string OSBS \b, OS/BS MBR
5310: # J\xf6rg Jenderek <joerg dot jenderek at web dot de>
5311: >0x8C string Invalid\ partition\ table \b, MS-DOS MBR
5312: # dr-dos with some upper-, lowercase variants
5313: >0x9D string Invalid\ partition\ table$
5314: >>181 string No\ Operating\ System$
5315: >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
5316: >0x9D string Invalid\ partition\ table$
5317: >>181 string No\ operating\ system$
5318: >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
5319: >342 string Invalid\ partition\ table$
5320: >>366 string No\ operating\ system$
5321: >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
5322: >295 string NEWLDR\0
5323: >>302 string Bad\ PT\ $
5324: >>>310 string No\ OS\ $
5325: >>>>317 string OS\ load\ err$
5326: >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
5327: >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
5328: >>>>>>>387 string Copyright\ (c)\ 1984,1998
5329: >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
5330: >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
5331: >>0x1B8 ubelong >0 \b, Serial 0x%-.4x
5332: >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
5333: >271 string Invalid\ partition\ table\0
5334: >>295 string Error\ loading\ operating\ system\0
5335: >>>326 string Missing\ operating\ system\0 \b, mbr
5336: #
5337: >139 string Invalid\ partition\ table\0
5338: >>163 string Error\ loading\ operating\ system\0
5339: >>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
5340: # http://www.heise.de/ct/05/09/006/ page 184
5341: #HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
5342: >>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
5343: >300 string Invalid\ partition\ table\0
5344: >>324 string Error\ loading\ operating\ system\0
5345: >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
5346: #??>>>389 string Invalid\ system\ disk
5347: >>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
5348: >300 string Ung\201ltige\ Partitionstabelle
5349: #split string to avoid error: String too long
5350: >>328 string Fehler\ beim\ Laden\
5351: >>>346 string des\ Betriebssystems
5352: >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
5353: >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
1.1.1.2 ! misho 5354: #>0x145 string Default:\ F \b, FREE-DOS MBR
! 5355: #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
! 5356: >0x145 search/7 Default:\ F \b, FREE-DOS MBR
! 5357: #>>313 string F0\ .\ .\ .
! 5358: #>>>322 string disk\ 1
! 5359: #>>>>382 string FAT3
1.1 misho 5360: >64 string no\ active\ partition\ found
5361: >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
1.1.1.2 ! misho 5362: # Ranish Partition Manager http://www.ranish.com/part/
! 5363: >387 search/4 \0\ Error!\r
! 5364: >>378 search/7 Virus!
! 5365: >>>397 search/4 Booting\
! 5366: >>>>408 search/4 HD1/\0 \b, Ranish MBR (
! 5367: >>>>>416 string Writing\ changes... \b2.37
! 5368: >>>>>>438 ubyte x \b,0x%x dots
! 5369: >>>>>>440 ubyte >0 \b,virus check
! 5370: >>>>>>441 ubyte >0 \b,partition %c
! 5371: #2.38,2.42,2.44
! 5372: >>>>>416 string !Writing\ changes... \b
! 5373: >>>>>>418 ubyte 1 \bvirus check,
! 5374: >>>>>>419 ubyte x \b0x%x seconds
! 5375: >>>>>>420 ubyte&0x0F >0 \b,partition
! 5376: >>>>>>>420 ubyte&0x0F <5 \b %x
! 5377: >>>>>>>420 ubyte&0x0F 0Xf \b ask
! 5378: >>>>>420 ubyte x \b)
! 5379: #
1.1 misho 5380: >271 string Operating\ system\ loading
5381: >>296 string error\r \b, SYSLINUX MBR (2.10)
5382: # http://www.acronis.de/
5383: >362 string MBR\ Error\ \0\r
5384: >>376 string ress\ any\ key\ to\
5385: >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
5386: # added by Joerg Jenderek
5387: # http://www.visopsys.org/
5388: # http://partitionlogic.org.uk/
5389: >309 string No\ bootable\ partition\ found\r
5390: >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
5391: >349 string No\ bootable\ partition\ found\r
5392: >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
5393: # bootloader, bootmanager
5394: >0x40 string SBML
5395: # label with 11 characters of FAT 12 bit filesystem
5396: >>43 string SMART\ BTMGR
1.1.1.2 ! misho 5397: >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
! 5398: # OEM-ID not always "SBM"
! 5399: #>>>>3 strings SBM
! 5400: >>>>6 string >\0 \b, version %s
1.1 misho 5401: >382 string XOSLLOADXCF \b, eXtended Operating System Loader
5402: >6 string LILO \b, LInux i386 boot LOader
5403: >>120 string LILO \b, version 22.3.4 SuSe
5404: >>172 string LILO \b, version 22.5.8 Debian
1.1.1.2 ! misho 5405: # updated by Joerg Jenderek at Oct 2008
1.1 misho 5406: # variables according to grub-0.97/stage1/stage1.S or
5407: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
5408: # usual values are marked with comments to get only informations of strange GRUB loaders
1.1.1.2 ! misho 5409: >342 search/60 \0Geom\0
! 5410: #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
1.1 misho 5411: >>0x41 ubyte <2
5412: >>>0x3E ubyte >2 \b; GRand Unified Bootloader
5413: # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
5414: >>>>0x3E ubyte x \b, stage1 version 0x%x
5415: #If it is 0xFF, use a drive passed by BIOS
5416: >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
5417: # in most case 0,1,0x2e for GRUB 0.5.95
5418: >>>>0x41 ubyte >0 \b, LBA flag 0x%x
5419: >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
5420: #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
5421: >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
5422: #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
5423: >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
5424: >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
5425: #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
5426: >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
5427: >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
5428: >>>>>394 string stage1 \b, GRUB version 0.5.95
5429: >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
5430: >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
5431: >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
5432: >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
5433: >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
5434: >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
5435: >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
5436: >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
5437: #unkown version
5438: >>>343 string Geom\0Read\0\ Error\0
5439: >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
5440: >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
5441: >>>>374 string GRUB\ \0 \b, GRUB version n.m
5442: # http://syslinux.zytor.com/
5443: >478 string Boot\ failed\r
5444: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
5445: >480 string Boot\ failed\r
5446: >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
5447: >484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
5448: >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
5449: # http://www.bcdwb.de/bcdw/index_e.htm
5450: >3 string BCDL
5451: >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
1.1.1.2 ! misho 5452: # mbr partition table entries
! 5453: # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
1.1 misho 5454: >3 string !MS
5455: >>3 string !SYSLINUX
5456: >>>3 string !MTOOL
1.1.1.2 ! misho 5457: >>>>3 string !NEWLDR
! 5458: >>>>>5 string !DOS
1.1 misho 5459: # not FAT (32 bit)
1.1.1.2 ! misho 5460: >>>>>>82 string !FAT32
1.1 misho 5461: #not Linux kernel
5462: >>>>>>>514 string !HdrS
5463: #not BeOS
5464: >>>>>>>>422 string !Be\ Boot\ Loader
5465: # active flag 0 or 0x80 and type > 0
5466: >>>>>>>>>446 ubyte <0x81
5467: >>>>>>>>>>446 ubyte&0x7F 0
5468: >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
5469: >>>>>>>>>>>>446 ubyte 0x80 \b, active
5470: >>>>>>>>>>>>447 ubyte x \b, starthead %u
5471: #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
5472: #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
5473: >>>>>>>>>>>>454 ulelong x \b, startsector %u
5474: >>>>>>>>>>>>458 ulelong x \b, %u sectors
5475: #
5476: >>>>>>>>>462 ubyte <0x81
5477: >>>>>>>>>>462 ubyte&0x7F 0
5478: >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
5479: >>>>>>>>>>>>462 ubyte 0x80 \b, active
5480: >>>>>>>>>>>>463 ubyte x \b, starthead %u
5481: #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
5482: #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
5483: >>>>>>>>>>>>470 ulelong x \b, startsector %u
5484: >>>>>>>>>>>>474 ulelong x \b, %u sectors
5485: #
5486: >>>>>>>>>478 ubyte <0x81
5487: >>>>>>>>>>478 ubyte&0x7F 0
5488: >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
5489: >>>>>>>>>>>>478 ubyte 0x80 \b, active
5490: >>>>>>>>>>>>479 ubyte x \b, starthead %u
5491: #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
5492: #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
5493: #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
5494: >>>>>>>>>>>>486 ulelong x \b, startsector %u
5495: >>>>>>>>>>>>490 ulelong x \b, %u sectors
5496: #
5497: >>>>>>>>>494 ubyte <0x81
5498: >>>>>>>>>>494 ubyte&0x7F 0
5499: >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
5500: >>>>>>>>>>>>494 ubyte 0x80 \b, active
5501: >>>>>>>>>>>>495 ubyte x \b, starthead %u
5502: #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
5503: #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
5504: >>>>>>>>>>>>502 ulelong x \b, startsector %u
5505: >>>>>>>>>>>>506 ulelong x \b, %u sectors
1.1.1.2 ! misho 5506: # mbr partition table entries end
1.1 misho 5507: # http://www.acronis.de/
5508: #FAT label=ACRONIS\ SZ
5509: #OEM-ID=BOOTWIZ0
5510: >442 string Non-system\ disk,\
5511: >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
5512: # DOS names like F11.SYS are 8 right space padded bytes+3 bytes
5513: >>>477 ubyte&0xDF >0
5514: >>>>477 string x \b %-.3s
5515: >>>>>480 ubyte&0xDF >0
5516: >>>>>>480 string x \b%-.5s
5517: >>>>485 ubyte&0xDF >0
5518: >>>>>485 string x \b.%-.3s
5519: #
5520: >185 string FDBOOT\ Version\
5521: >>204 string \rNo\ Systemdisk.\
5522: >>>220 string Booting\ from\ harddisk.\n\r
5523: >>>245 string Cannot\ load\ from\ harddisk.\n\r
5524: >>>>273 string Insert\ Systemdisk\
5525: >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
5526: >>>>>>200 string >\0 \b, version %-3s
5527: >242 string Bootsector\ from\ C.H.\ Hochst\204
5528: >>278 string No\ Systemdisk.\
5529: >>>293 string Booting\ from\ harddisk.\n\r
5530: >>>441 string Cannot\ load\ from\ harddisk.\n\r
5531: >>>>469 string Insert\ Systemdisk\
5532: >>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
5533: >>>>>>209 string >\0 \b, version %-4.4s
5534: >(1.b+2) ubyte 0xe
5535: >>(1.b+3) ubyte 0x1f
5536: >>>(1.b+4) ubyte 0xbe
5537: >>>>(1.b+5) ubyte 0x77
5538: >>>>(1.b+6) ubyte 0x7c
5539: >>>>>(1.b+7) ubyte 0xac
5540: >>>>>>(1.b+8) ubyte 0x22
5541: >>>>>>>(1.b+9) ubyte 0xc0
5542: >>>>>>>>(1.b+10) ubyte 0x74
5543: >>>>>>>>>(1.b+11) ubyte 0xb
5544: >>>>>>>>>>(1.b+12) ubyte 0x56
5545: >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
1.1.1.2 ! misho 5546: >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
! 5547: #>>244 string from\ dosemu-freedos-*-bin.tgz\r
! 5548: #>>>170 string Sorry,\ could\ not\ load\ an\
! 5549: #>>>>195 string operating\ system.\r\n
! 5550: #
1.1 misho 5551: >103 string This\ is\ not\ a\ bootable\ disk.\
5552: >>132 string Please\ insert\ a\ bootable\
5553: >>>157 string floppy\ and\r\n
5554: >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
5555: #
5556: >66 string Solaris\ Boot\ Sector
5557: >>99 string Incomplete\ MDBoot\ load.
5558: >>>89 string Version \b, Sun Solaris Bootloader
5559: >>>>97 byte x version %c
5560: #
5561: >408 string OS/2\ !!\ SYS01475\r\0
5562: >>429 string OS/2\ !!\ SYS02025\r\0
5563: >>>450 string OS/2\ !!\ SYS02027\r\0
5564: >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
5565: #
5566: >409 string OS/2\ !!\ SYS01475\r\0
5567: >>430 string OS/2\ !!\ SYS02025\r\0
5568: >>>451 string OS/2\ !!\ SYS02027\r\0
5569: >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
5570: >112 string This\ disk\ is\ not\ bootable\r
5571: >>142 string If\ you\ wish\ to\ make\ it\ bootable
5572: >>>176 string run\ the\ DOS\ program\ SYS\
5573: >>>200 string after\ the\r
5574: >>>>216 string system\ has\ been\ loaded\r\n
5575: >>>>>242 string Please\ insert\ a\ DOS\ diskette\
5576: >>>>>271 string into\r\n\ the\ drive\ and\
5577: >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
5578: # XP
5579: >430 string NTLDR\ is\ missing\xFF\r\n
5580: >>449 string Disk\ error\xFF\r\n
5581: >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
5582: # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
5583: >>>>417 ubyte&0xDF >0
5584: >>>>>417 string x %-.5s
5585: >>>>>>422 ubyte&0xDF >0
5586: >>>>>>>422 string x \b%-.3s
5587: >>>>>425 ubyte&0xDF >0
5588: >>>>>>425 string >\ \b.%-.3s
5589: #
5590: >>>>371 ubyte >0x20
5591: >>>>>368 ubyte&0xDF >0
5592: >>>>>>368 string x %-.5s
5593: >>>>>>>373 ubyte&0xDF >0
5594: >>>>>>>>373 string x \b%-.3s
5595: >>>>>>376 ubyte&0xDF >0
5596: >>>>>>>376 string x \b.%-.3s
5597: #
5598: >430 string NTLDR\ nicht\ gefunden\xFF\r\n
5599: >>453 string Datentr\204gerfehler\xFF\r\n
5600: >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
5601: >>>>417 ubyte&0xDF >0
5602: >>>>>417 string x %-.5s
5603: >>>>>>422 ubyte&0xDF >0
5604: >>>>>>>422 string x \b%-.3s
5605: >>>>>425 ubyte&0xDF >0
5606: >>>>>>425 string >\ \b.%-.3s
5607: # offset variant
5608: >>>>379 string \0
5609: >>>>>368 ubyte&0xDF >0
5610: >>>>>>368 string x %-.5s
5611: >>>>>>>373 ubyte&0xDF >0
5612: >>>>>>>>373 string x \b%-.3s
5613: #
5614: >430 string NTLDR\ fehlt\xFF\r\n
5615: >>444 string Datentr\204gerfehler\xFF\r\n
5616: >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
5617: >>>>417 ubyte&0xDF >0
5618: >>>>>417 string x %-.5s
5619: >>>>>>422 ubyte&0xDF >0
5620: >>>>>>>422 string x \b%-.3s
5621: >>>>>425 ubyte&0xDF >0
5622: >>>>>>425 string >\ \b.%-.3s
5623: # variant
5624: >>>>371 ubyte >0x20
5625: >>>>>368 ubyte&0xDF >0
5626: >>>>>>368 string x %-.5s
5627: >>>>>>>373 ubyte&0xDF >0
5628: >>>>>>>>373 string x \b%-.3s
5629: >>>>>>376 ubyte&0xDF >0
5630: >>>>>>>376 string x \b.%-.3s
5631: #
5632: >430 string NTLDR\ fehlt\xFF\r\n
5633: >>444 string Medienfehler\xFF\r\n
5634: >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
5635: >>>>371 ubyte >0x20
5636: >>>>>368 ubyte&0xDF >0
5637: >>>>>>368 string x %-.5s
5638: >>>>>>>373 ubyte&0xDF >0
5639: >>>>>>>>373 string x \b%-.3s
5640: >>>>>>376 ubyte&0xDF >0
5641: >>>>>>>376 string x \b.%-.3s
5642: # variant
5643: >>>>417 ubyte&0xDF >0
5644: >>>>>417 string x %-.5s
5645: >>>>>>422 ubyte&0xDF >0
5646: >>>>>>>422 string x \b%-.3s
5647: >>>>>425 ubyte&0xDF >0
5648: >>>>>>425 string >\ \b.%-.3s
5649: #
5650: >430 string Datentr\204ger\ entfernen\xFF\r\n
5651: >>454 string Medienfehler\xFF\r\n
5652: >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
1.1.1.2 ! misho 5653: >>>>379 string \0
! 5654: >>>>>368 ubyte&0xDF >0
! 5655: >>>>>>368 string x %-.5s
! 5656: >>>>>>>373 ubyte&0xDF >0
! 5657: >>>>>>>>373 string x \b%-.3s
! 5658: >>>>>>376 ubyte&0xDF >0
! 5659: >>>>>>>376 string x \b.%-.3s
! 5660: # variant
! 5661: >>>>417 ubyte&0xDF >0
! 5662: >>>>>417 string x %-.5s
! 5663: >>>>>>422 ubyte&0xDF >0
! 5664: >>>>>>>422 string x \b%-.3s
! 5665: >>>>>425 ubyte&0xDF >0
! 5666: >>>>>>425 string >\ \b.%-.3s
! 5667: #
! 5668:
1.1 misho 5669: #>3 string NTFS\ \ \ \
5670: >389 string Fehler\ beim\ Lesen\
5671: >>407 string des\ Datentr\204gers
5672: >>>426 string NTLDR\ fehlt
5673: >>>>440 string NTLDR\ ist\ komprimiert
5674: >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
5675: #>3 string NTFS\ \ \ \
5676: >313 string A\ disk\ read\ error\ occurred.\r
5677: >>345 string A\ kernel\ file\ is\ missing\
5678: >>>370 string from\ the\ disk.\r
5679: >>>>484 string NTLDR\ is\ compressed
5680: >>>>>429 string Insert\ a\ system\ diskette\
5681: >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
5682: # DOS loader variants different languages,offsets
5683: >472 ubyte&0xDF >0
5684: >>389 string Invalid\ system\ disk\xFF\r\n
5685: >>>411 string Disk\ I/O\ error
5686: >>>>428 string Replace\ the\ disk,\ and\
5687: >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
5688: #IO.SYS
5689: >>>>>>472 ubyte&0xDF >0
5690: >>>>>>>472 string x \b %-.2s
5691: >>>>>>>>474 ubyte&0xDF >0
5692: >>>>>>>>>474 string x \b%-.5s
5693: >>>>>>>>>>479 ubyte&0xDF >0
5694: >>>>>>>>>>>479 string x \b%-.1s
5695: >>>>>>>480 ubyte&0xDF >0
5696: >>>>>>>>480 string x \b.%-.3s
5697: #MSDOS.SYS
5698: >>>>>>>483 ubyte&0xDF >0 \b+
5699: >>>>>>>>483 string x \b%-.5s
5700: >>>>>>>>>488 ubyte&0xDF >0
5701: >>>>>>>>>>488 string x \b%-.3s
5702: >>>>>>>>491 ubyte&0xDF >0
5703: >>>>>>>>>491 string x \b.%-.3s
5704: #
5705: >>390 string Invalid\ system\ disk\xFF\r\n
5706: >>>412 string Disk\ I/O\ error\xFF\r\n
5707: >>>>429 string Replace\ the\ disk,\ and\
5708: >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
5709: >>388 string Ungueltiges\ System\ \xFF\r\n
5710: >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
5711: >>>>427 string Datentraeger\ wechseln\ und\
5712: >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
5713: #WINBOOT.SYS only not spaces (0xDF)
5714: >>>>>>497 ubyte&0xDF >0
5715: >>>>>>>497 string x %-.5s
5716: >>>>>>>>502 ubyte&0xDF >0
5717: >>>>>>>>>502 string x \b%-.1s
5718: >>>>>>>>>>503 ubyte&0xDF >0
5719: >>>>>>>>>>>503 string x \b%-.1s
5720: >>>>>>>>>>>>504 ubyte&0xDF >0
5721: >>>>>>>>>>>>>504 string x \b%-.1s
5722: >>>>>>505 ubyte&0xDF >0
5723: >>>>>>>505 string x \b.%-.3s
5724: #IO.SYS
5725: >>>>>>472 ubyte&0xDF >0 or
5726: >>>>>>>472 string x \b %-.2s
5727: >>>>>>>>474 ubyte&0xDF >0
5728: >>>>>>>>>474 string x \b%-.5s
5729: >>>>>>>>>>479 ubyte&0xDF >0
5730: >>>>>>>>>>>479 string x \b%-.1s
5731: >>>>>>>480 ubyte&0xDF >0
5732: >>>>>>>>480 string x \b.%-.3s
5733: #MSDOS.SYS
5734: >>>>>>>483 ubyte&0xDF >0 \b+
5735: >>>>>>>>483 string x \b%-.5s
5736: >>>>>>>>>488 ubyte&0xDF >0
5737: >>>>>>>>>>488 string x \b%-.3s
5738: >>>>>>>>491 ubyte&0xDF >0
5739: >>>>>>>>>491 string x \b.%-.3s
5740: #
5741: >>390 string Ungueltiges\ System\ \xFF\r\n
5742: >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
5743: >>>>429 string Datentraeger\ wechseln\ und\
5744: >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
5745: #WINBOOT.SYS only not spaces (0xDF)
5746: >>>>>>497 ubyte&0xDF >0
5747: >>>>>>>497 string x %-.7s
5748: >>>>>>>>504 ubyte&0xDF >0
5749: >>>>>>>>>504 string x \b%-.1s
5750: >>>>>>505 ubyte&0xDF >0
5751: >>>>>>>505 string x \b.%-.3s
5752: #IO.SYS
5753: >>>>>>472 ubyte&0xDF >0 or
5754: >>>>>>>472 string x \b %-.2s
5755: >>>>>>>>474 ubyte&0xDF >0
5756: >>>>>>>>>474 string x \b%-.6s
5757: >>>>>>>480 ubyte&0xDF >0
5758: >>>>>>>>480 string x \b.%-.3s
5759: #MSDOS.SYS
5760: >>>>>>>483 ubyte&0xDF >0 \b+
5761: >>>>>>>>483 string x \b%-.5s
5762: >>>>>>>>>488 ubyte&0xDF >0
5763: >>>>>>>>>>488 string x \b%-.3s
5764: >>>>>>>>491 ubyte&0xDF >0
5765: >>>>>>>>>491 string x \b.%-.3s
5766: #
5767: >>389 string Ungueltiges\ System\ \xFF\r\n
5768: >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
5769: >>>>428 string Datentraeger\ wechseln\ und\
5770: >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
5771: # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
5772: >>>>>>472 string x %-.2s
5773: >>>>>>>474 ubyte&0xDF >0
5774: >>>>>>>>474 string x \b%-.5s
5775: >>>>>>>>479 ubyte&0xDF >0
5776: >>>>>>>>>479 string x \b%-.1s
5777: >>>>>>480 ubyte&0xDF >0
5778: >>>>>>>480 string x \b.%-.3s
5779: >>>>>>483 ubyte&0xDF >0 \b+
5780: >>>>>>>483 string x \b%-.5s
5781: >>>>>>>488 ubyte&0xDF >0
5782: >>>>>>>>488 string x \b%-.2s
5783: >>>>>>>>490 ubyte&0xDF >0
5784: >>>>>>>>>490 string x \b%-.1s
5785: >>>>>>>491 ubyte&0xDF >0
5786: >>>>>>>>491 string x \b.%-.3s
5787: >479 ubyte&0xDF >0
5788: >>416 string Kein\ System\ oder\
5789: >>>433 string Laufwerksfehler
5790: >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
5791: #IO.SYS
5792: >>>>>479 string x \b %-.2s
5793: >>>>>>481 ubyte&0xDF >0
5794: >>>>>>>481 string x \b%-.6s
5795: >>>>>487 ubyte&0xDF >0
5796: >>>>>>487 string x \b.%-.3s
5797: #MSDOS.SYS
5798: >>>>>>490 ubyte&0xDF >0 \b+
5799: >>>>>>>490 string x \b%-.5s
5800: >>>>>>>>495 ubyte&0xDF >0
5801: >>>>>>>>>495 string x \b%-.3s
5802: >>>>>>>498 ubyte&0xDF >0
5803: >>>>>>>>498 string x \b.%-.3s
5804: #
5805: >376 search/41 Non-System\ disk\ or\
5806: >>395 search/41 disk\ error\r
5807: >>>407 search/41 Replace\ and\
5808: >>>>419 search/41 press\ \b,
5809: >>>>419 search/41 strike\ \b, old
5810: >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
5811: #449 Disk\ Boot\ failure\r MS 3.21
5812: #466 Boot\ Failure\r MS 3.30
5813: >>>>>468 search/18 \0
5814: #IO.SYS,IBMBIO.COM
5815: >>>>>>&0 string x \b %-.2s
5816: >>>>>>>&-20 ubyte&0xDF >0
5817: >>>>>>>>&-1 string x \b%-.4s
5818: >>>>>>>>>&-16 ubyte&0xDF >0
5819: >>>>>>>>>>&-1 string x \b%-.2s
5820: >>>>>>&8 ubyte&0xDF >0 \b.
5821: >>>>>>>&-1 string x \b%-.3s
5822: #MSDOS.SYS,IBMDOS.COM
5823: >>>>>>&11 ubyte&0xDF >0 \b+
5824: >>>>>>>&-1 string x \b%-.5s
5825: >>>>>>>>&-6 ubyte&0xDF >0
5826: >>>>>>>>>&-1 string x \b%-.1s
5827: >>>>>>>>>>&-5 ubyte&0xDF >0
5828: >>>>>>>>>>>&-1 string x \b%-.2s
5829: >>>>>>>&7 ubyte&0xDF >0 \b.
5830: >>>>>>>>&-1 string x \b%-.3s
5831: >441 string Cannot\ load\ from\ harddisk.\n\r
5832: >>469 string Insert\ Systemdisk\
5833: >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
5834: #>43 string \224R-LOADER\ \ SYS =label
5835: >54 string SYS
5836: >>324 string VASKK
5837: >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
5838: #
5839: >98 string Press\ a\ key\ to\ retry\0\r
5840: >>120 string Cannot\ find\ file\ \0\r
5841: >>>139 string Disk\ read\ error\0\r
5842: >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
5843: #DRBIOS.SYS
5844: >>>>>44 ubyte&0xDF >0
5845: >>>>>>44 string x \b %-.6s
5846: >>>>>>>50 ubyte&0xDF >0
5847: >>>>>>>>50 string x \b%-.2s
5848: >>>>>>52 ubyte&0xDF >0
5849: >>>>>>>52 string x \b.%-.3s
5850: #
5851: >70 string IBMBIO\ \ COM
5852: >>472 string Cannot\ load\ DOS!\
5853: >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
5854: >>471 string Cannot\ load\ DOS\
5855: >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
1.1.1.2 ! misho 5856: #??
1.1 misho 5857: >444 string KERNEL\ \ SYS
5858: >>314 string BOOT\ error! \b, FREE-DOS Bootloader
5859: >499 string KERNEL\ \ SYS
5860: >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
5861: >449 string KERNEL\ \ SYS
5862: >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
1.1.1.2 ! misho 5863: #
! 5864: >449 string Loading\ FreeDOS
! 5865: >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
! 5866: >>>497 ubyte&0xDF >0
! 5867: >>>>497 string x \b %-.6s
! 5868: >>>>>503 ubyte&0xDF >0
! 5869: >>>>>>503 string x \b%-.1s
! 5870: >>>>>>>504 ubyte&0xDF >0
! 5871: >>>>>>>>504 string x \b%-.1s
! 5872: >>>>505 ubyte&0xDF >0
! 5873: >>>>>505 string x \b.%-.3s
! 5874: #
! 5875: >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
! 5876: #
1.1 misho 5877: >125 string Loading\ FreeDOS...\r
5878: >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
5879: >>>441 ubyte&0xDF >0
5880: >>>>441 string x \b %-.6s
5881: >>>>>447 ubyte&0xDF >0
5882: >>>>>>447 string x \b%-.1s
5883: >>>>>>>448 ubyte&0xDF >0
5884: >>>>>>>>448 string x \b%-.1s
5885: >>>>449 ubyte&0xDF >0
5886: >>>>>449 string x \b.%-.3s
5887: >124 string FreeDOS\0
5888: >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
5889: # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
5890: >>>497 ubyte&0xDF >0
5891: >>>>497 string x \b %-.6s
5892: >>>>>503 ubyte&0xDF >0
5893: >>>>>>503 string x \b%-.1s
5894: >>>>>>>504 ubyte&0xDF >0
5895: >>>>>>>>504 string x \b%-.1s
5896: >>>>505 ubyte&0xDF >0
5897: >>>>>505 string x \b.%-.3s
5898: >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
5899: >>>497 ubyte&0xDF >0
5900: >>>>497 string x \b %-.6s
5901: >>>>>503 ubyte&0xDF >0
5902: >>>>>>503 string x \b%-.1s
5903: >>>>>>>504 ubyte&0xDF >0
5904: >>>>>>>>504 string x \b%-.1s
5905: >>>>505 ubyte&0xDF >0
5906: >>>>>505 string x \b.%-.3s
5907: >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
5908: >>>497 ubyte&0xDF >0
5909: >>>>497 string x \b %-.6s
5910: >>>>>503 ubyte&0xDF >0
5911: >>>>>>503 string x \b%-.1s
5912: >>>>>>>504 ubyte&0xDF >0
5913: >>>>>>>>504 string x \b%-.1s
5914: >>>>505 ubyte&0xDF >0
5915: >>>>>505 string x \b.%-.3s
5916: >336 string Error!\
5917: >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
5918: >>>497 ubyte&0xDF >0
5919: >>>>497 string x \b %-.6s
5920: >>>>>503 ubyte&0xDF >0
5921: >>>>>>503 string x \b%-.1s
5922: >>>>>>>504 ubyte&0xDF >0
5923: >>>>>>>>504 string x \b%-.1s
5924: >>>>505 ubyte&0xDF >0
5925: >>>>>505 string x \b.%-.3s
5926: # added by Joerg Jenderek
5927: # http://www.visopsys.org/
5928: # http://partitionlogic.org.uk/
5929: # OEM-ID=Visopsys
5930: >478 ulelong 0
5931: >>(1.b+326) string I/O\ Error\ reading\
5932: >>>(1.b+344) string Visopsys\ loader\r
5933: >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
5934: # http://alexfru.chat.ru/epm.html#bootprog
5935: >494 ubyte >0x4D
5936: >>495 string >E
5937: >>>495 string <S
5938: #OEM-ID is not reliable
5939: >>>>3 string BootProg
5940: # It just looks for a program file name at the root directory
5941: # and loads corresponding file with following execution.
5942: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
5943: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
5944: >>>>>499 string x \b %-.1s
5945: >>>>>>500 ubyte&0xDF >0
5946: >>>>>>>500 string x \b%-.1s
5947: >>>>>>>>501 ubyte&0xDF >0
5948: >>>>>>>>>501 string x \b%-.1s
5949: >>>>>>>>>>502 ubyte&0xDF >0
5950: >>>>>>>>>>>502 string x \b%-.1s
5951: >>>>>>>>>>>>503 ubyte&0xDF >0
5952: >>>>>>>>>>>>>503 string x \b%-.1s
5953: >>>>>>>>>>>>>>504 ubyte&0xDF >0
5954: >>>>>>>>>>>>>>>504 string x \b%-.1s
5955: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
5956: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
5957: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
5958: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
5959: #name extension
5960: >>>>>507 ubyte&0xDF >0 \b.
5961: >>>>>>507 string x \b%-.1s
5962: >>>>>>>508 ubyte&0xDF >0
5963: >>>>>>>>508 string x \b%-.1s
5964: >>>>>>>>>509 ubyte&0xDF >0
5965: >>>>>>>>>>509 string x \b%-.1s
5966: #If the boot sector fails to read any other sector,
5967: #it prints a very short message ("RE") to the screen and hangs the computer.
5968: #If the boot sector fails to find needed program in the root directory,
5969: #it also hangs with another message ("NF").
5970: >>>>>492 string RENF \b, FAT (12 bit)
5971: >>>>>495 string RENF \b, FAT (16 bit)
5972: # http://alexfru.chat.ru/epm.html#bootprog
5973: >494 ubyte >0x4D
5974: >>495 string >E
5975: >>>495 string <S
5976: #OEM-ID is not reliable
5977: >>>>3 string BootProg
5978: # It just looks for a program file name at the root directory
5979: # and loads corresponding file with following execution.
5980: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
5981: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
5982: >>>>>499 string x \b %-.1s
5983: >>>>>>500 ubyte&0xDF >0
5984: >>>>>>>500 string x \b%-.1s
5985: >>>>>>>>501 ubyte&0xDF >0
5986: >>>>>>>>>501 string x \b%-.1s
5987: >>>>>>>>>>502 ubyte&0xDF >0
5988: >>>>>>>>>>>502 string x \b%-.1s
5989: >>>>>>>>>>>>503 ubyte&0xDF >0
5990: >>>>>>>>>>>>>503 string x \b%-.1s
5991: >>>>>>>>>>>>>>504 ubyte&0xDF >0
5992: >>>>>>>>>>>>>>>504 string x \b%-.1s
5993: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
5994: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
5995: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
5996: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
5997: #name extension
5998: >>>>>507 ubyte&0xDF >0 \b.
5999: >>>>>>507 string x \b%-.1s
6000: >>>>>>>508 ubyte&0xDF >0
6001: >>>>>>>>508 string x \b%-.1s
6002: >>>>>>>>>509 ubyte&0xDF >0
6003: >>>>>>>>>>509 string x \b%-.1s
6004: #If the boot sector fails to read any other sector,
6005: #it prints a very short message ("RE") to the screen and hangs the computer.
6006: #If the boot sector fails to find needed program in the root directory,
6007: #it also hangs with another message ("NF").
6008: >>>>>492 string RENF \b, FAT (12 bit)
6009: >>>>>495 string RENF \b, FAT (16 bit)
1.1.1.2 ! misho 6010: # x86 bootloader end
1.1 misho 6011: # updated by Joerg Jenderek at Sep 2007
6012: >3 ubyte 0
6013: #no active flag
6014: >>446 ubyte 0
6015: # partition 1 not empty
6016: >>>450 ubyte >0
6017: # partitions 3,4 empty
6018: >>>>482 ubyte 0
6019: >>>>>498 ubyte 0
6020: # partition 2 ID=0,5,15
6021: >>>>>>466 ubyte <0x10
6022: >>>>>>>466 ubyte 0x05 \b, extended partition table
6023: >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
6024: >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
6025: # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
6026: # http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD
6027: # older drives may use Near JuMP instruction E9 xx xx
6028: >0 lelong&0x009000EB 0x009000EB
6029: >0 lelong&0x000000E9 0x000000E9
1.1.1.2 ! misho 6030: # minimal short forward jump found 03cx??
1.1 misho 6031: # maximal short forward jump is 07fx
6032: >1 ubyte <0xff \b, code offset 0x%x
6033: # mtools-3.9.8/msdos.h
6034: # usual values are marked with comments to get only informations of strange FAT systems
6035: # valid sectorsize must be a power of 2 from 32 to 32768
6036: >>11 uleshort&0x000f x
6037: >>>11 uleshort <32769
6038: >>>>11 uleshort >31
1.1.1.2 ! misho 6039: >>>>>21 ubyte&0xf0 0xF0
! 6040: >>>>>>3 string >\0 \b, OEM-ID "%8.8s"
1.1 misho 6041: #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
1.1.1.2 ! misho 6042: >>>>>>>8 string IHC \b cached by Windows 9M
! 6043: >>>>>>11 uleshort >512 \b, Bytes/sector %u
! 6044: #>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
! 6045: >>>>>>11 uleshort <512 \b, Bytes/sector %u
! 6046: >>>>>>13 ubyte >1 \b, sectors/cluster %u
! 6047: #>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
! 6048: >>>>>>14 uleshort >32 \b, reserved sectors %u
! 6049: #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
! 6050: #>>>>>>14 uleshort >1 \b, reserved sectors %u
! 6051: #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
! 6052: >>>>>>14 uleshort <1 \b, reserved sectors %u
! 6053: >>>>>>16 ubyte >2 \b, FATs %u
! 6054: #>>>>>>16 ubyte =2 \b, FATs %u (usual)
! 6055: >>>>>>16 ubyte =1 \b, FAT %u
! 6056: >>>>>>16 ubyte >0
! 6057: >>>>>>17 uleshort >0 \b, root entries %u
! 6058: #>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
! 6059: >>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
! 6060: #>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
! 6061: >>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
! 6062: #>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
! 6063: >>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
! 6064: >>>>>>22 uleshort >0 \b, sectors/FAT %u
! 6065: #>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
! 6066: >>>>>>26 ubyte >2 \b, heads %u
! 6067: #>>>>>>26 ubyte =2 \b, heads %u (usual floppy)
! 6068: >>>>>>26 ubyte =1 \b, heads %u
1.1 misho 6069: #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
1.1.1.2 ! misho 6070: >>>>>>38 ubyte !0x70
! 6071: >>>>>>>28 ulelong >0 \b, hidden sectors %u
! 6072: #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
! 6073: >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
! 6074: #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
1.1 misho 6075: # FAT<32 specific
1.1.1.2 ! misho 6076: >>>>>>82 string !FAT32
! 6077: #>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
! 6078: #>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
! 6079: >>>>>>>36 ubyte !0x80
! 6080: >>>>>>>>36 ubyte !0 \b, physical drive 0x%x
! 6081: >>>>>>>37 ubyte >0 \b, reserved 0x%x
! 6082: #>>>>>>>37 ubyte =0 \b, reserved 0x%x
! 6083: >>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
! 6084: >>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
! 6085: >>>>>>>38 ubyte =0x29
! 6086: >>>>>>>>39 ulelong x \b, serial number 0x%x
! 6087: >>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
! 6088: >>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
! 6089: >>>>>>>>43 string =NO\ NAME \b, unlabeled
! 6090: >>>>>>>54 string FAT \b, FAT
! 6091: >>>>>>>>54 string FAT12 \b (12 bit)
! 6092: >>>>>>>>54 string FAT16 \b (16 bit)
1.1 misho 6093: # FAT32 specific
1.1.1.2 ! misho 6094: >>>>>>82 string FAT32 \b, FAT (32 bit)
! 6095: >>>>>>>36 ulelong x \b, sectors/FAT %u
! 6096: >>>>>>>40 uleshort >0 \b, extension flags %u
! 6097: #>>>>>>>40 uleshort =0 \b, extension flags %u
! 6098: >>>>>>>42 uleshort >0 \b, fsVersion %u
! 6099: #>>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
! 6100: >>>>>>>44 ulelong >2 \b, rootdir cluster %u
! 6101: #>>>>>>>44 ulelong =2 \b, rootdir cluster %u
! 6102: #>>>>>>>44 ulelong =1 \b, rootdir cluster %u
! 6103: >>>>>>>48 uleshort >1 \b, infoSector %u
! 6104: #>>>>>>>48 uleshort =1 \b, infoSector %u (usual)
! 6105: >>>>>>>48 uleshort <1 \b, infoSector %u
! 6106: >>>>>>>50 uleshort >6 \b, Backup boot sector %u
! 6107: #>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
! 6108: >>>>>>>50 uleshort <6 \b, Backup boot sector %u
! 6109: >>>>>>>54 ulelong >0 \b, reserved1 0x%x
! 6110: >>>>>>>58 ulelong >0 \b, reserved2 0x%x
! 6111: >>>>>>>62 ulelong >0 \b, reserved3 0x%x
1.1 misho 6112: # same structure as FAT1X
1.1.1.2 ! misho 6113: >>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
! 6114: #>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
! 6115: >>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
! 6116: #>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
! 6117: >>>>>>>65 ubyte >0 \b, reserved 0x%x
! 6118: >>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
! 6119: >>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
! 6120: >>>>>>>66 ubyte =0x29
! 6121: >>>>>>>>67 ulelong x \b, serial number 0x%x
! 6122: >>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
! 6123: >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
! 6124: >>>>>>>71 string =NO\ NAME \b, unlabeled
1.1 misho 6125: ### FATs end
6126: >0x200 lelong 0x82564557 \b, BSD disklabel
6127: # FATX
6128: 0 string FATX FATX filesystem data
6129:
6130:
6131: # Minix filesystems - Juan Cespedes <cespedes@debian.org>
1.1.1.2 ! misho 6132: 0x410 leshort 0x137f
! 6133: >0x402 beshort < 100 Minix filesystem, V1, %d zones
! 6134: >0x1e string minix \b, bootable
! 6135: 0x410 beshort 0x137f
! 6136: >0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones
! 6137: >0x1e string minix \b, bootable
! 6138: 0x410 leshort 0x138f
! 6139: >0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones
! 6140: >0x1e string minix \b, bootable
! 6141: 0x410 beshort 0x138f
! 6142: >0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones
! 6143: >0x1e string minix \b, bootable
! 6144: 0x410 leshort 0x2468
! 6145: >0x402 beshort < 100 Minix filesystem, V2, %d zones
! 6146: >0x1e string minix \b, bootable
! 6147: 0x410 beshort 0x2468
! 6148: >0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones
! 6149: >0x1e string minix \b, bootable
! 6150:
! 6151: 0x410 leshort 0x2478
! 6152: >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
! 6153: >0x1e string minix \b, bootable
! 6154: 0x410 leshort 0x2478
! 6155: >0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones
! 6156: >0x1e string minix \b, bootable
! 6157: 0x410 beshort 0x2478
! 6158: >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
! 6159: >0x1e string minix \b, bootable
! 6160: 0x410 leshort 0x4d5a
! 6161: >0x402 beshort !0 Minix filesystem, V3, %d zones
1.1 misho 6162: >0x1e string minix \b, bootable
6163:
6164: # romfs filesystems - Juan Cespedes <cespedes@debian.org>
1.1.1.2 ! misho 6165: 0 string -rom1fs- romfs filesystem, version 1
1.1 misho 6166: >8 belong x %d bytes,
6167: >16 string x named %s.
6168:
6169: # netboot image - Juan Cespedes <cespedes@debian.org>
6170: 0 lelong 0x1b031336L Netboot image,
6171: >4 lelong&0xFFFFFF00 0
6172: >>4 lelong&0x100 0x000 mode 2
6173: >>4 lelong&0x100 0x100 mode 3
6174: >4 lelong&0xFFFFFF00 !0 unknown mode
6175:
6176: 0x18b string OS/2 OS/2 Boot Manager
6177:
1.1.1.2 ! misho 6178: # updated by Joerg Jenderek at Oct 2008!!
! 6179: # http://syslinux.zytor.com/iso.php
! 6180: 0 ulelong 0x7c40eafa isolinux Loader
! 6181: # http://syslinux.zytor.com/pxe.php
! 6182: 0 ulelong 0x007c05ea pxelinux Loader
! 6183: 0 ulelong 0x60669c66 pxelinux Loader
! 6184:
1.1 misho 6185: # added by Joerg Jenderek
6186: # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
6187: # grub-1.94/kern/i386/pc/startup.S
6188: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
6189: # usual values are marked with comments to get only informations of strange GRUB loaders
6190: 0x200 uleshort 0x70EA
6191: # found only version 3.{1,2}
6192: >0x206 ubeshort >0x0300
6193: # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
6194: >>0x212 ubyte >0x29
6195: >>>0x213 ubyte >0x29
6196: # not iso9660_stage1_5
6197: #>>>0 ulelong&0x00BE5652 0x00BE5652
6198: >>>>0x213 ubyte >0x29 GRand Unified Bootloader
6199: # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
6200: >>>>0x217 ubyte 0xFF stage1_5
6201: >>>>0x217 ubyte <0xFF stage2
6202: >>>>0x206 ubyte x \b version %u
6203: >>>>0x207 ubyte x \b.%u
6204: # module_size for 1.94
6205: >>>>0x208 ulelong <0xffffff \b, installed partition %u
6206: #>>>>0x208 ulelong =0xffffff \b, %u (default)
6207: >>>>0x208 ulelong >0xffffff \b, installed partition %u
6208: # GRUB 0.5.95 unofficial
6209: >>>>0x20C ulelong&0x2E300000 0x2E300000
6210: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
6211: >>>>>0x20C ubyte x \b, identifier 0x%x
6212: #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
6213: >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
6214: # GRUB version as string
6215: >>>>>0x20E string >\0 \b, GRUB version %-s
6216: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6217: >>>>>>0x215 ulong 0xffffffff
6218: >>>>>>>0x219 string >\0 \b, configuration file %-s
6219: >>>>>>0x215 ulong !0xffffffff
6220: >>>>>>>0x215 string >\0 \b, configuration file %-s
6221: # newer GRUB versions
6222: >>>>0x20C ulelong&0x2E300000 !0x2E300000
6223: ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
6224: >>>>>0x20C ulelong >0 \b, saved entry %d
6225: # for 1.94 contains kernel image size
6226: # for 0.93,0.94,0.96,0.97
6227: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
6228: >>>>>0x210 ubyte x \b, identifier 0x%x
6229: # The flag for LBA forcing is in most cases 0
6230: #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
6231: >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
6232: # GRUB version as string
6233: >>>>>0x212 string >\0 \b, GRUB version %-s
6234: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6235: >>>>>0x217 ulong 0xffffffff
6236: >>>>>>0x21b string >\0 \b, configuration file %-s
6237: >>>>>0x217 ulong !0xffffffff
6238: >>>>>>0x217 string >\0 \b, configuration file %-s
6239:
6240: 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
6241: >8404 string x last mounted on %s,
6242: #>9504 ledate x last checked at %s,
6243: >8224 ledate x last written at %s,
6244: >8401 byte x clean flag %d,
6245: >8228 lelong x number of blocks %d,
6246: >8232 lelong x number of data blocks %d,
6247: >8236 lelong x number of cylinder groups %d,
6248: >8240 lelong x block size %d,
6249: >8244 lelong x fragment size %d,
6250: >8252 lelong x minimum percentage of free blocks %d,
6251: >8256 lelong x rotational delay %dms,
6252: >8260 lelong x disk rotational speed %drps,
6253: >8320 lelong 0 TIME optimization
6254: >8320 lelong 1 SPACE optimization
6255:
6256: 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
6257: >&-1164 string x last mounted on %s,
6258: >&-696 string >\0 volume name %s,
6259: >&-304 leqldate x last written at %s,
6260: >&-1167 byte x clean flag %d,
6261: >&-1168 byte x readonly flag %d,
6262: >&-296 lequad x number of blocks %lld,
6263: >&-288 lequad x number of data blocks %lld,
6264: >&-1332 lelong x number of cylinder groups %d,
6265: >&-1328 lelong x block size %d,
6266: >&-1324 lelong x fragment size %d,
6267: >&-180 lelong x average file size %d,
6268: >&-176 lelong x average number of files in dir %d,
6269: >&-272 lequad x pending blocks to free %lld,
6270: >&-264 lelong x pending inodes to free %ld,
6271: >&-664 lequad x system-wide uuid %0llx,
6272: >&-1316 lelong x minimum percentage of free blocks %d,
6273: >&-1248 lelong 0 TIME optimization
6274: >&-1248 lelong 1 SPACE optimization
6275:
6276: 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
6277: >&-1164 string x last mounted on %s,
6278: >&-696 string >\0 volume name %s,
6279: >&-304 leqldate x last written at %s,
6280: >&-1167 byte x clean flag %d,
6281: >&-1168 byte x readonly flag %d,
6282: >&-296 lequad x number of blocks %lld,
6283: >&-288 lequad x number of data blocks %lld,
6284: >&-1332 lelong x number of cylinder groups %d,
6285: >&-1328 lelong x block size %d,
6286: >&-1324 lelong x fragment size %d,
6287: >&-180 lelong x average file size %d,
6288: >&-176 lelong x average number of files in dir %d,
6289: >&-272 lequad x pending blocks to free %lld,
6290: >&-264 lelong x pending inodes to free %ld,
6291: >&-664 lequad x system-wide uuid %0llx,
6292: >&-1316 lelong x minimum percentage of free blocks %d,
6293: >&-1248 lelong 0 TIME optimization
6294: >&-1248 lelong 1 SPACE optimization
6295:
6296: 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
6297: >7168 belong 0x4c41424c Apple UFS Volume
6298: >>7186 string x named %s,
6299: >>7176 belong x volume label version %d,
6300: >>7180 bedate x created on %s,
6301: >8404 string x last mounted on %s,
6302: #>9504 bedate x last checked at %s,
6303: >8224 bedate x last written at %s,
6304: >8401 byte x clean flag %d,
6305: >8228 belong x number of blocks %d,
6306: >8232 belong x number of data blocks %d,
6307: >8236 belong x number of cylinder groups %d,
6308: >8240 belong x block size %d,
6309: >8244 belong x fragment size %d,
6310: >8252 belong x minimum percentage of free blocks %d,
6311: >8256 belong x rotational delay %dms,
6312: >8260 belong x disk rotational speed %drps,
6313: >8320 belong 0 TIME optimization
6314: >8320 belong 1 SPACE optimization
6315:
6316: 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
6317: >&-1164 string x last mounted on %s,
6318: >&-696 string >\0 volume name %s,
6319: >&-304 beqldate x last written at %s,
6320: >&-1167 byte x clean flag %d,
6321: >&-1168 byte x readonly flag %d,
6322: >&-296 bequad x number of blocks %lld,
6323: >&-288 bequad x number of data blocks %lld,
6324: >&-1332 belong x number of cylinder groups %d,
6325: >&-1328 belong x block size %d,
6326: >&-1324 belong x fragment size %d,
6327: >&-180 belong x average file size %d,
6328: >&-176 belong x average number of files in dir %d,
6329: >&-272 bequad x pending blocks to free %lld,
6330: >&-264 belong x pending inodes to free %ld,
6331: >&-664 bequad x system-wide uuid %0llx,
6332: >&-1316 belong x minimum percentage of free blocks %d,
6333: >&-1248 belong 0 TIME optimization
6334: >&-1248 belong 1 SPACE optimization
6335:
6336: 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
6337: >&-1164 string x last mounted on %s,
6338: >&-696 string >\0 volume name %s,
6339: >&-304 beqldate x last written at %s,
6340: >&-1167 byte x clean flag %d,
6341: >&-1168 byte x readonly flag %d,
6342: >&-296 bequad x number of blocks %lld,
6343: >&-288 bequad x number of data blocks %lld,
6344: >&-1332 belong x number of cylinder groups %d,
6345: >&-1328 belong x block size %d,
6346: >&-1324 belong x fragment size %d,
6347: >&-180 belong x average file size %d,
6348: >&-176 belong x average number of files in dir %d,
6349: >&-272 bequad x pending blocks to free %lld,
6350: >&-264 belong x pending inodes to free %ld,
6351: >&-664 bequad x system-wide uuid %0llx,
6352: >&-1316 belong x minimum percentage of free blocks %d,
6353: >&-1248 belong 0 TIME optimization
6354: >&-1248 belong 1 SPACE optimization
6355:
6356: # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
6357: # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
6358: # volume label and UUID Russell Coker
6359: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
6360: 0x438 leshort 0xEF53 Linux
6361: >0x44c lelong x rev %d
6362: >0x43e leshort x \b.%d
6363: # No journal? ext2
6364: >0x45c lelong ^0x0000004 ext2 filesystem data
6365: >>0x43a leshort ^0x0000001 (mounted or unclean)
6366: # Has a journal? ext3 or ext4
6367: >0x45c lelong &0x0000004
6368: # and small INCOMPAT?
6369: >>0x460 lelong <0x0000040
6370: # and small RO_COMPAT?
6371: >>>0x464 lelong <0x0000008 ext3 filesystem data
6372: # else large RO_COMPAT?
6373: >>>0x464 lelong >0x0000007 ext4 filesystem data
6374: # else large INCOMPAT?
6375: >>0x460 lelong >0x000003f ext4 filesystem data
1.1.1.2 ! misho 6376: >0x468 belong x \b, UUID=%08x
! 6377: >0x46c beshort x \b-%04x
! 6378: >0x46e beshort x \b-%04x
! 6379: >0x470 beshort x \b-%04x
! 6380: >0x472 belong x \b-%08x
! 6381: >0x476 beshort x \b%04x
1.1 misho 6382: >0x478 string >0 \b, volume name "%s"
6383: # General flags for any ext* fs
6384: >0x460 lelong &0x0000004 (needs journal recovery)
6385: >0x43a leshort &0x0000002 (errors)
6386: # INCOMPAT flags
6387: >0x460 lelong &0x0000001 (compressed)
6388: #>0x460 lelong &0x0000002 (filetype)
6389: #>0x460 lelong &0x0000010 (meta bg)
6390: >0x460 lelong &0x0000040 (extents)
6391: >0x460 lelong &0x0000080 (64bit)
6392: #>0x460 lelong &0x0000100 (mmp)
6393: #>0x460 lelong &0x0000200 (flex bg)
6394: # RO_INCOMPAT flags
6395: #>0x464 lelong &0x0000001 (sparse super)
6396: >0x464 lelong &0x0000002 (large files)
6397: >0x464 lelong &0x0000008 (huge files)
6398: #>0x464 lelong &0x0000010 (gdt checksum)
6399: #>0x464 lelong &0x0000020 (many subdirs)
6400: #>0x463 lelong &0x0000040 (extra isize)
6401:
6402: # SGI disk labels - Nathan Scott <nathans@debian.org>
6403: 0 belong 0x0BE5A941 SGI disk label (volume header)
6404:
6405: # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
6406: 0 belong 0x58465342 SGI XFS filesystem data
6407: >0x4 belong x (blksz %d,
6408: >0x68 beshort x inosz %d,
6409: >0x64 beshort ^0x2004 v1 dirs)
6410: >0x64 beshort &0x2004 v2 dirs)
6411:
6412: ############################################################################
6413: # Minix-ST kernel floppy
6414: 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
6415: >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
6416: >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
6417:
6418: ############################################################################
6419: # Hmmm, is this a better way of detecting _standard_ floppy images ?
6420: 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
6421: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6422: 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
6423: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6424: 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
6425: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6426:
6427: 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
6428: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6429: 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
6430: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
6431:
6432: 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
6433: 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
6434:
6435: # Valid media descriptor bytes for MS-DOS:
6436: #
6437: # Byte Capacity Media Size and Type
6438: # -------------------------------------------------
6439: #
6440: # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
6441: # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
6442: # F9 720K 3.5-inch, 2-sided, 9-sector
6443: # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
6444: # FD 360K 5.25-inch, 2-sided, 9-sector
6445: # FF 320K 5.25-inch, 2-sided, 8-sector
6446: # FC 180K 5.25-inch, 1-sided, 9-sector
6447: # FE 160K 5.25-inch, 1-sided, 8-sector
6448: # FE 250K 8-inch, 1-sided, single-density
6449: # FD 500K 8-inch, 2-sided, single-density
6450: # FE 1.2 MB 8-inch, 2-sided, double-density
6451: # F8 ----- Fixed disk
6452: #
6453: # FC xxxK Apricot 70x1x9 boot disk.
6454: #
6455: # Originally a bitmap:
6456: # xxxxxxx0 Not two sided
6457: # xxxxxxx1 Double sided
6458: # xxxxxx0x Not 8 SPT
6459: # xxxxxx1x 8 SPT
6460: # xxxxx0xx Not Removable drive
6461: # xxxxx1xx Removable drive
6462: # 11111xxx Must be one.
6463: #
6464: # But now it's rather random:
6465: # 111111xx Low density disk
6466: # 00 SS, Not 8 SPT
6467: # 01 DS, Not 8 SPT
6468: # 10 SS, 8 SPT
6469: # 11 DS, 8 SPT
6470: #
6471: # 11111001 Double density 3½ floppy disk, high density 5¼
6472: # 11110000 High density 3½ floppy disk
6473: # 11111000 Hard disk any format
6474: #
6475:
6476: # CDROM Filesystems
6477: # Modified for UDF by gerardo.cacciari@gmail.com
6478: 32769 string CD001
6479: !:mime application/x-iso9660-image
6480: >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
6481: >38913 string NSR0 UDF filesystem data
6482: >>38917 string 1 (version 1.0)
6483: >>38917 string 2 (version 1.5)
6484: >>38917 string 3 (version 2.0)
6485: >>38917 byte >0x33 (unknown version, ID 0x%X)
6486: >>38917 byte <0x31 (unknown version, ID 0x%X)
6487: # "application id" which appears to be used as a volume label
6488: >32808 string >\0 '%s'
6489: >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
6490: 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
6491: !:mime application/x-iso9660-image
6492: 32776 string CDROM High Sierra CD-ROM filesystem data
6493:
1.1.1.2 ! misho 6494: # .cso files
! 6495: 0 string CISO Compressed ISO CD image
! 6496:
1.1 misho 6497: # cramfs filesystem - russell@coker.com.au
6498: 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
6499: >4 lelong x size %lu
6500: >8 lelong &1 version #2
6501: >8 lelong &2 sorted_dirs
6502: >8 lelong &4 hole_support
6503: >32 lelong x CRC 0x%x,
6504: >36 lelong x edition %lu,
6505: >40 lelong x %lu blocks,
6506: >44 lelong x %lu files
6507:
6508: 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
6509: >4 belong x size %lu
6510: >8 belong &1 version #2
6511: >8 belong &2 sorted_dirs
6512: >8 belong &4 hole_support
6513: >32 belong x CRC 0x%x,
6514: >36 belong x edition %lu,
6515: >40 belong x %lu blocks,
6516: >44 belong x %lu files
6517:
6518: # reiserfs - russell@coker.com.au
6519: 0x10034 string ReIsErFs ReiserFS V3.5
6520: 0x10034 string ReIsEr2Fs ReiserFS V3.6
6521: 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
6522: >0x1002c leshort x block size %d
6523: >0x10032 leshort &2 (mounted or unclean)
6524: >0x10000 lelong x num blocks %d
6525: >0x10040 lelong 1 tea hash
6526: >0x10040 lelong 2 yura hash
6527: >0x10040 lelong 3 r5 hash
6528:
6529: # JFFS - russell@coker.com.au
6530: 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
6531: 0 belong 0x34383931 Linux Journalled Flash File system, big endian
6532:
6533: # EST flat binary format (which isn't, but anyway)
6534: # From: Mark Brown <broonie@sirena.org.uk>
6535: 0 string ESTFBINR EST flat binary
6536:
6537: # Aculab VoIP firmware
6538: # From: Mark Brown <broonie@sirena.org.uk>
6539: 0 string VoIP\ Startup\ and Aculab VoIP firmware
6540: >35 string x format %s
6541:
1.1.1.2 ! misho 6542: # From: Mark Brown <broonie@sirena.org.uk> [old]
! 6543: # From: Behan Webster <behanw@websterwood.com>
! 6544: 0 belong 0x27051956 u-boot legacy uImage,
! 6545: >32 string x %s,
! 6546: >28 byte 0 Invalid os/
! 6547: >28 byte 1 OpenBSD/
! 6548: >28 byte 2 NetBSD/
! 6549: >28 byte 3 FreeBSD/
! 6550: >28 byte 4 4.4BSD/
! 6551: >28 byte 5 Linux/
! 6552: >28 byte 6 SVR4/
! 6553: >28 byte 7 Esix/
! 6554: >28 byte 8 Solaris/
! 6555: >28 byte 9 Irix/
! 6556: >28 byte 10 SCO/
! 6557: >28 byte 11 Dell/
! 6558: >28 byte 12 NCR/
! 6559: >28 byte 13 LynxOS/
! 6560: >28 byte 14 VxWorks/
! 6561: >28 byte 15 pSOS/
! 6562: >28 byte 16 QNX/
! 6563: >28 byte 17 Firmware/
! 6564: >28 byte 18 RTEMS/
! 6565: >28 byte 19 ARTOS/
! 6566: >28 byte 20 Unity OS/
! 6567: >28 byte 21 INTEGRITY/
! 6568: >29 byte 0 \bInvalid CPU,
! 6569: >29 byte 1 \bAlpha,
! 6570: >29 byte 2 \bARM,
! 6571: >29 byte 3 \bIntel x86,
! 6572: >29 byte 4 \bIA64,
! 6573: >29 byte 5 \bMIPS,
! 6574: >29 byte 6 \bMIPS 64-bit,
! 6575: >29 byte 7 \bPowerPC,
! 6576: >29 byte 8 \bIBM S390,
! 6577: >29 byte 9 \bSuperH,
! 6578: >29 byte 10 \bSparc,
! 6579: >29 byte 11 \bSparc 64-bit,
! 6580: >29 byte 12 \bM68K,
! 6581: >29 byte 13 \bNios-32,
! 6582: >29 byte 14 \bMicroBlaze,
! 6583: >29 byte 15 \bNios-II,
! 6584: >29 byte 16 \bBlackfin,
! 6585: >29 byte 17 \bAVR32,
! 6586: >29 byte 18 \bSTMicroelectronics ST200,
! 6587: >30 byte 0 Invalid Image
! 6588: >30 byte 1 Standalone Program
! 6589: >30 byte 2 OS Kernel Image
! 6590: >30 byte 3 RAMDisk Image
! 6591: >30 byte 4 Multi-File Image
! 6592: >30 byte 5 Firmware Image
! 6593: >30 byte 6 Script File
! 6594: >30 byte 7 Filesystem Image (any type)
! 6595: >30 byte 8 Binary Flat Device Tree BLOB
! 6596: >31 byte 0 (Not compressed),
! 6597: >31 byte 1 (gzip),
! 6598: >31 byte 2 (bzip2),
! 6599: >31 byte 3 (lzma),
! 6600: >12 belong x %d bytes,
! 6601: >8 bedate x %s,
! 6602: >16 belong x Load Address: 0x%08X,
! 6603: >20 belong x Entry Point: 0x%08X,
! 6604: >4 belong x Header CRC: 0x%08X,
! 6605: >24 belong x Data CRC: 0x%08X
1.1 misho 6606:
6607: # JFFS2 file system
6608: 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
6609: 0 leshort 0x1985 Linux jffs2 filesystem data little endian
6610:
6611: # Squashfs
6612: 0 string sqsh Squashfs filesystem, big endian,
6613: >28 beshort x version %d.
6614: >30 beshort x \b%d,
6615: >28 beshort <3
6616: >>8 belong x %d bytes,
6617: >28 beshort >2
6618: >>63 bequad x %lld bytes,
6619: #>>67 belong x %d bytes,
6620: >4 belong x %d inodes,
6621: >28 beshort <2
6622: >>32 beshort x blocksize: %d bytes,
6623: >28 beshort >1
6624: >>51 belong x blocksize: %d bytes,
6625: >39 bedate x created: %s
6626: 0 string hsqs Squashfs filesystem, little endian,
6627: >28 leshort x version %d.
6628: >30 leshort x \b%d,
6629: >28 leshort <3
6630: >>8 lelong x %d bytes,
6631: >28 leshort >2
6632: >>63 lequad x %lld bytes,
6633: #>>63 lelong x %d bytes,
6634: >4 lelong x %d inodes,
6635: >28 leshort <2
6636: >>32 leshort x blocksize: %d bytes,
6637: >28 leshort >1
6638: >>51 lelong x blocksize: %d bytes,
6639: >39 ledate x created: %s
6640:
6641: 0 string td\000 floppy image data (TeleDisk)
6642:
6643: # AFS Dump Magic
6644: # From: Ty Sarna <tsarna@sarna.org>
6645: 0 string \x01\xb3\xa1\x13\x22 AFS Dump
6646: >&0 belong x (v%d)
6647: >>&0 byte 0x76
6648: >>>&0 belong x Vol %d,
6649: >>>>&0 byte 0x6e
6650: >>>>>&0 string x %s
6651: >>>>>>&1 byte 0x74
6652: >>>>>>>&0 beshort 2
6653: >>>>>>>>&4 bedate x on: %s
6654: >>>>>>>>&0 bedate =0 full dump
6655: >>>>>>>>&0 bedate !0 incremental since: %s
6656:
6657: #----------------------------------------------------------
1.1.1.2 ! misho 6658: #delta ISO Daniel Novotny (dnovotny@redhat.com)
! 6659: 0 string DISO Delta ISO data
! 6660: >4 belong x version %d
! 6661:
1.1 misho 6662: # VMS backup savesets - gerardo.cacciari@gmail.com
6663: #
6664: 4 string \x01\x00\x01\x00\x01\x00
6665: >(0.s+16) string \x01\x01
6666: >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
6667: >>>40 lelong x (block size %d,
6668: >>>49 string >\0 original name '%s',
6669: >>>2 short 1024 VAX generated)
6670: >>>2 short 2048 AXP generated)
6671: >>>2 short 4096 I64 generated)
6672:
6673: # Summary: Oracle Clustered Filesystem
6674: # Created by: Aaron Botsis <redhat@digitalmafia.org>
6675: 8 string OracleCFS Oracle Clustered Filesystem,
6676: >4 long x rev %d
6677: >0 long x \b.%d,
6678: >560 string x label: %.64s,
6679: >136 string x mountpoint: %.128s
6680:
6681: # Summary: Oracle ASM tagged volume
6682: # Created by: Aaron Botsis <redhat@digitalmafia.org>
6683: 32 string ORCLDISK Oracle ASM Volume,
6684: >40 string x Disk Name: %0.12s
6685: 32 string ORCLCLRD Oracle ASM Volume (cleared),
6686: >40 string x Disk Name: %0.12s
6687:
6688: # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
6689: 8 string OracleCFS Oracle Clustered Filesystem,
6690: >4 long x rev %d
6691: >0 long x \b.%d,
6692: >560 string x label: %.64s,
6693: >136 string x mountpoint: %.128s
6694:
6695: # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
6696: 32 string ORCLDISK Oracle ASM Volume,
6697: >40 string x Disk Name: %0.12s
6698: 32 string ORCLCLRD Oracle ASM Volume (cleared),
6699: >40 string x Disk Name: %0.12s
6700:
6701: # Compaq/HP RILOE floppy image
6702: # From: Dirk Jagdmann <doj@cubic.org>
6703: 0 string CPQRFBLO Compaq/HP RILOE floppy image
6704:
6705: #------------------------------------------------------------------------------
6706: # Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com
6707: # These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is
6708: # mapped to VBN 2 of [000000]INDEXF.SYS;1
6709: #
6710: 1008 string DECFILE11B Files-11 On-Disk Structure
6711: >525 byte x Level %d
6712: >525 byte x (ODS-%d OpenVMS file system),
6713: >984 string x volume label is '%-12.12s'
6714:
6715: # From: Thomas Klausner <wiz@NetBSD.org>
6716: # http://filext.com/file-extension/DAA
6717: # describes the daa file format. The magic would be:
6718: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
6719:
6720: # From Albert Cahalan <acahalan@gmail.com>
6721: # really le32 operation,destination,payloadsize (but quite predictable)
6722: # 01 00 00 00 00 00 00 c0 00 02 00 00
6723: 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
6724:
6725: # From Eric Sandeen
6726: # GFS2
6727: 0x10000 belong 0x01161970 GFS2 Filesystem
6728: >0x10024 belong x (blocksize %d,
6729: >0x10060 string >\0 lockproto %s)
6730:
1.1.1.2 ! misho 6731: # BTRFS
! 6732: 0x10040 string _BHRfS_M BTRFS Filesystem
! 6733: >0x1012b string >\0 (label "%s",
! 6734: >0x10090 lelong x sectorsize %d,
! 6735: >0x10094 lelong x nodesize %d,
! 6736: >0x10098 lelong x leafsize %d)
! 6737:
! 6738:
1.1 misho 6739: # dvdisaster's .ecc
6740: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
6741: 0 string *dvdisaster* dvdisaster error correction file
6742:
1.1.1.2 ! misho 6743: # xfs metadump image
! 6744: # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
! 6745: # but can we do the << ? For now it's always 512 (0x200) anyway.
! 6746: 0 string XFSM
! 6747: >0x200 string XFSB XFS filesystem metadump image
! 6748:
1.1 misho 6749: # Type: CROM filesystem
6750: # From: Werner Fink <werner@suse.de>
6751: 0 string CROMFS CROMFS
6752: >6 string >\0 \b version %2.2s,
6753: >8 ulequad >0 \b block data at %lld,
6754: >16 ulequad >0 \b fblock table at %lld,
6755: >24 ulequad >0 \b inode table at %lld,
6756: >32 ulequad >0 \b root at %lld,
6757: >40 ulelong >0 \b fblock size = %ld,
6758: >44 ulelong >0 \b block size = %ld,
6759: >48 ulequad >0 \b bytes = %lld
6760:
1.1.1.2 ! misho 6761: # Type: xfs metadump image
! 6762: # From: Daniel Novotny <dnovotny@redhat.com>
! 6763: # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
! 6764: # but can we do the << ? For now it's always 512 (0x200) anyway.
! 6765: 0 string XFSM
! 6766: >0x200 string XFSB XFS filesystem metadump image
! 6767:
! 6768: # Type: delta ISO
! 6769: # From: Daniel Novotny <dnovotny@redhat.com>
! 6770: 0 string DISO Delta ISO data,
! 6771: >4 belong x version %d
! 6772:
! 6773: # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
! 6774: # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
! 6775: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 6776: 0x8000 string JFS1
! 6777: # Because it's text-only magic, check a binary value (version) to be sure.
! 6778: # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
! 6779: # mountable.
! 6780: >&0 lelong <3 JFS2 filesystem image
! 6781: # Label is followed by a UUID; we have to limit string length to avoid
! 6782: # appending the UUID in the case of a 16-byte label.
! 6783: >>&144 regex [\x20-\x7E]{1,16} (label "%s")
! 6784: >>&0 lequad x \b, %lld blocks
! 6785: >>&8 lelong x \b, blocksize %d
! 6786: >>&32 lelong&0x00000006 >0 (dirty)
! 6787: >>&36 lelong >0 (compressed)
! 6788:
1.1 misho 6789: #------------------------------------------------------------------------------
1.1.1.2 ! misho 6790: # $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $
1.1 misho 6791: # flash: file(1) magic for Macromedia Flash file format
6792: #
6793: # See
6794: #
6795: # http://www.macromedia.com/software/flash/open/
6796: #
6797: 0 string FWS Macromedia Flash data,
6798: >3 byte x version %d
6799: !:mime application/x-shockwave-flash
6800: 0 string CWS Macromedia Flash data (compressed),
6801: !:mime application/x-shockwave-flash
6802: >3 byte x version %d
6803: # From: Cal Peake <cp@absolutedigital.net>
6804: 0 string FLV Macromedia Flash Video
6805: !:mime video/x-flv
6806:
6807: #
1.1.1.2 ! misho 6808: # Yosu Gomez
! 6809: 0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
! 6810: 0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
1.1 misho 6811: # From Dave Wilson
6812: 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
1.1.1.2 ! misho 6813:
1.1 misho 6814: #------------------------------------------------------------------------------
1.1.1.2 ! misho 6815: # $File: fonts,v 1.21 2009/12/06 23:17:52 rrt Exp $
1.1 misho 6816: # fonts: file(1) magic for font data
6817: #
6818: 0 search/1 FONT ASCII vfont text
6819: 0 short 0436 Berkeley vfont data
6820: 0 short 017001 byte-swapped Berkeley vfont data
6821:
6822: # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
1.1.1.2 ! misho 6823: 0 string %!PS-AdobeFont-1. PostScript Type 1 font text
! 6824: >20 string >\0 (%s)
1.1 misho 6825: 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
1.1.1.2 ! misho 6826: 0 string %!FontType1 PostScript Type 1 font program data
! 6827: 6 string %!FontType1 PostScript Type 1 font program data
! 6828: 0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
1.1 misho 6829:
6830: # X11 font files in SNF (Server Natural Format) format
6831: 0 belong 00000004 X11 SNF font data, MSB first
6832: 0 lelong 00000004 X11 SNF font data, LSB first
6833:
6834: # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
6835: 0 search/1 STARTFONT\ X11 BDF font text
6836:
6837: # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
6838: # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
6839: 0 string \001fcp X11 Portable Compiled Font data
6840: >12 byte 0x02 \b, LSB first
6841: >12 byte 0x0a \b, MSB first
6842: 0 string D1.0\015 X11 Speedo font data
6843:
6844: #------------------------------------------------------------------------------
6845: # FIGlet fonts and controlfiles
6846: # From figmagic supplied with Figlet version 2.2
6847: # "David E. O'Brien" <obrien@FreeBSD.ORG>
6848: 0 string flf FIGlet font
6849: >3 string >2a version %-2.2s
6850: 0 string flc FIGlet controlfile
6851: >3 string >2a version %-2.2s
6852:
6853: # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
6854: # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
6855: 0 belong 0x14025919 libGrx font data,
6856: >8 leshort x %dx
6857: >10 leshort x \b%d
6858: >40 string x %s
6859: # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
6860: 0 belong 0xff464f4e DOS code page font data collection
6861: 7 belong 0x00454741 DOS code page font data
6862: 7 belong 0x00564944 DOS code page font data (from Linux?)
6863: 4098 string DOSFONT DOSFONT2 encrypted font data
6864:
6865: # downloadable fonts for browser (prints type) anthon@mnt.org
6866: 0 string PFR1 PFR1 font
6867: >102 string >0 \b: %s
6868:
6869: # True Type fonts
6870: 0 string \000\001\000\000\000 TrueType font data
1.1.1.2 ! misho 6871: !:mime application/x-font-ttf
1.1 misho 6872:
6873: 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
6874: 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
6875:
1.1.1.2 ! misho 6876: # TrueType/OpenType font collections (.ttc)
! 6877: # http://www.microsoft.com/typography/otspec/otff.htm
! 6878: 0 string ttcf TrueType font collection data
! 6879: >4 belong 0x00010000 \b, 1.0
! 6880: >>8 belong >0 \b, %d fonts
! 6881: >4 belong 0x00020000 \b, 2.0
! 6882: >>8 belong >0 \b, %d fonts
! 6883: # 0x44454947 = 'DSIG'
! 6884: >>>16 belong 0x44534947 \b, digitally signed
! 6885:
1.1 misho 6886: # Opentype font data from Avi Bercovich
1.1.1.2 ! misho 6887: 0 string OTTO OpenType font data
! 6888: !:mime application/vnd.ms-opentype
1.1 misho 6889:
6890: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
6891: 0 string SplineFontDB: Spline Font Database
1.1.1.2 ! misho 6892: !:mime application/vnd.font-fontforge-sfd
1.1 misho 6893: >14 string x version %s
1.1.1.2 ! misho 6894:
! 6895: #------------------------------------------------------------------------------
! 6896: # $File: fortran,v 1.6 2009/09/19 16:28:09 christos Exp $
1.1 misho 6897: # FORTRAN source
1.1.1.2 ! misho 6898: 0 regex/100 \^[Cc][\ \t] FORTRAN program
1.1 misho 6899: !:mime text/x-fortran
1.1.1.2 ! misho 6900:
1.1 misho 6901: #------------------------------------------------------------------------------
1.1.1.2 ! misho 6902: # $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
1.1 misho 6903: # frame: file(1) magic for FrameMaker files
6904: #
6905: # This stuff came on a FrameMaker demo tape, most of which is
6906: # copyright, but this file is "published" as witness the following:
6907: #
6908: # Note that this is the Framemaker Maker Interchange Format, not the
6909: # Normal format which would be application/vnd.framemaker.
6910: #
6911: 0 string \<MakerFile FrameMaker document
6912: !:mime application/x-mif
6913: >11 string 5.5 (5.5
6914: >11 string 5.0 (5.0
6915: >11 string 4.0 (4.0
6916: >11 string 3.0 (3.0
6917: >11 string 2.0 (2.0
6918: >11 string 1.0 (1.0
6919: >14 byte x %c)
6920: 0 string \<MIFFile FrameMaker MIF (ASCII) file
6921: !:mime application/x-mif
6922: >9 string 4.0 (4.0)
6923: >9 string 3.0 (3.0)
6924: >9 string 2.0 (2.0)
6925: >9 string 1.0 (1.x)
6926: 0 search/1 \<MakerDictionary FrameMaker Dictionary text
6927: !:mime application/x-mif
6928: >17 string 3.0 (3.0)
6929: >17 string 2.0 (2.0)
6930: >17 string 1.0 (1.x)
6931: 0 string \<MakerScreenFont FrameMaker Font file
6932: !:mime application/x-mif
6933: >17 string 1.01 (%s)
6934: 0 string \<MML FrameMaker MML file
6935: !:mime application/x-mif
6936: 0 string \<BookFile FrameMaker Book file
6937: !:mime application/x-mif
6938: >10 string 3.0 (3.0
6939: >10 string 2.0 (2.0
6940: >10 string 1.0 (1.0
6941: >13 byte x %c)
6942: # XXX - this book entry should be verified, if you find one, uncomment this
6943: #0 string \<Book\ FrameMaker Book (ASCII) file
6944: #!:mime application/x-mif
6945: #>6 string 3.0 (3.0)
6946: #>6 string 2.0 (2.0)
6947: #>6 string 1.0 (1.0)
6948: 0 string \<Maker Intermediate Print File FrameMaker IPL file
6949: !:mime application/x-mif
6950:
6951: #------------------------------------------------------------------------------
1.1.1.2 ! misho 6952: # $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
1.1 misho 6953: # freebsd: file(1) magic for FreeBSD objects
6954: #
6955: # All new-style FreeBSD magic numbers are in host byte order (i.e.,
6956: # little-endian on x86).
6957: #
6958: # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
6959: # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
6960: # schemes for distinguishing between executable images, shared libraries,
6961: # and object files.
6962: #
6963: # FreeBSD says:
6964: #
6965: # Regardless of whether it's pure, demand-paged, or none of the
6966: # above:
6967: #
6968: # if the entry point is < 4096, then it's a shared library if
6969: # the "has run-time loader information" bit is set, and is
6970: # position-independent if the "is position-independent" bit
6971: # is set;
6972: #
6973: # if the entry point is >= 4096 (or >4095, same thing), then it's
6974: # an executable, and is dynamically-linked if the "has run-time
6975: # loader information" bit is set.
6976: #
6977: # On x86, NetBSD says:
6978: #
6979: # If it's neither pure nor demand-paged:
6980: #
6981: # if it has the "has run-time loader information" bit set, it's
6982: # a dynamically-linked executable;
6983: #
6984: # if it doesn't have that bit set, then:
6985: #
6986: # if it has the "is position-independent" bit set, it's
6987: # position-independent;
6988: #
6989: # if the entry point is non-zero, it's an executable, otherwise
6990: # it's an object file.
6991: #
6992: # If it's pure:
6993: #
6994: # if it has the "has run-time loader information" bit set, it's
6995: # a dynamically-linked executable, otherwise it's just an
6996: # executable.
6997: #
6998: # If it's demand-paged:
6999: #
7000: # if it has the "has run-time loader information" bit set,
7001: # then:
7002: #
7003: # if the entry point is < 4096, it's a shared library;
7004: #
7005: # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
7006: # it's a dynamically-linked executable);
7007: #
7008: # if it doesn't have the "has run-time loader information" bit
7009: # set, then it's just an executable.
7010: #
7011: # (On non-x86, NetBSD does much the same thing, except that it uses
7012: # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
7013: # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
7014: # had 8K pages; dunno about MIPS.)
7015: #
7016: # I suspect the two will differ only in perverse and uninteresting cases
7017: # ("shared" libraries that aren't demand-paged and whose pages probably
7018: # won't actually be shared, executables with entry points <4096).
7019: #
7020: # I leave it to those more familiar with FreeBSD and NetBSD to figure out
7021: # what the right answer is (although using ">4095", FreeBSD-style, is
7022: # probably better than separately checking for "=4096" and ">4096",
7023: # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
7024: # executables using the NetBSD technique.)
7025: #
7026: 0 lelong&0377777777 041400407 FreeBSD/i386
7027: >20 lelong <4096
7028: >>3 byte&0xC0 &0x80 shared library
7029: >>3 byte&0xC0 0x40 PIC object
7030: >>3 byte&0xC0 0x00 object
7031: >20 lelong >4095
7032: >>3 byte&0x80 0x80 dynamically linked executable
7033: >>3 byte&0x80 0x00 executable
7034: >16 lelong >0 not stripped
7035:
7036: 0 lelong&0377777777 041400410 FreeBSD/i386 pure
7037: >20 lelong <4096
7038: >>3 byte&0xC0 &0x80 shared library
7039: >>3 byte&0xC0 0x40 PIC object
7040: >>3 byte&0xC0 0x00 object
7041: >20 lelong >4095
7042: >>3 byte&0x80 0x80 dynamically linked executable
7043: >>3 byte&0x80 0x00 executable
7044: >16 lelong >0 not stripped
7045:
7046: 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
7047: >20 lelong <4096
7048: >>3 byte&0xC0 &0x80 shared library
7049: >>3 byte&0xC0 0x40 PIC object
7050: >>3 byte&0xC0 0x00 object
7051: >20 lelong >4095
7052: >>3 byte&0x80 0x80 dynamically linked executable
7053: >>3 byte&0x80 0x00 executable
7054: >16 lelong >0 not stripped
7055:
7056: 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
7057: >20 lelong <4096
7058: >>3 byte&0xC0 &0x80 shared library
7059: >>3 byte&0xC0 0x40 PIC object
7060: >>3 byte&0xC0 0x00 object
7061: >20 lelong >4095
7062: >>3 byte&0x80 0x80 dynamically linked executable
7063: >>3 byte&0x80 0x00 executable
7064: >16 lelong >0 not stripped
7065:
7066: # XXX gross hack to identify core files
7067: # cores start with a struct tss; we take advantage of the following:
7068: # byte 7: highest byte of the kernel stack pointer, always 0xfe
7069: # 8/9: kernel (ring 0) ss value, always 0x0010
7070: # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
7071: # 28: low order byte of the current PTD entry, always 0 since the
7072: # PTD is page-aligned
7073: #
7074: 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
7075: >1039 string >\0 from '%s'
7076:
7077: # /var/run/ld.so.hints
7078: # What are you laughing about?
7079: 0 lelong 011421044151 ld.so hints file (Little Endian
7080: >4 lelong >0 \b, version %d)
7081: >4 belong <1 \b)
7082: 0 belong 011421044151 ld.so hints file (Big Endian
7083: >4 belong >0 \b, version %d)
7084: >4 belong <1 \b)
7085:
7086: #
7087: # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
7088: #
7089: 0 string SCRSHOT_ scrshot(1) screenshot,
7090: >8 byte x version %d,
7091: >9 byte 2 %d bytes in header,
7092: >>10 byte x %d chars wide by
7093: >>11 byte x %d chars high
7094:
7095: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7096: # $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
1.1 misho 7097: # fsav: file(1) magic for datafellows fsav virus definition files
7098: # Anthon van der Neut (anthon@mnt.org)
7099:
7100: # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
7101: 0 beshort 0x1575 fsav macro virus signatures
7102: >8 leshort >0 (%d-
7103: >11 byte >0 \b%02d-
7104: >10 byte >0 \b%02d)
7105: # ftp://ftp.f-prot.com/pub/sign.zip
7106: #10 ubyte <12
7107: #>9 ubyte <32
7108: #>>8 ubyte 0x0a
7109: #>>>12 ubyte 0x07
7110: #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
7111: #>>>>10 byte 0 \b01-
7112: #>>>>10 byte 1 \b02-
7113: #>>>>10 byte 2 \b03-
7114: #>>>>10 byte 3 \b04-
7115: #>>>>10 byte 4 \b05-
7116: #>>>>10 byte 5 \b06-
7117: #>>>>10 byte 6 \b07-
7118: #>>>>10 byte 7 \b08-
7119: #>>>>10 byte 8 \b09-
7120: #>>>>10 byte 9 \b10-
7121: #>>>>10 byte 10 \b11-
7122: #>>>>10 byte 11 \b12-
7123: #>>>>9 ubyte >0 \b%02d)
7124: # ftp://ftp.f-prot.com/pub/sign2.zip
7125: #0 ubyte 0x62
7126: #>1 ubyte 0xF5
7127: #>>2 ubyte 0x1
7128: #>>>3 ubyte 0x1
7129: #>>>>4 ubyte 0x0e
7130: #>>>>>13 ubyte >0 fsav virus signatures
7131: #>>>>>>11 ubyte x size 0x%02x
7132: #>>>>>>12 ubyte x \b%02x
7133: #>>>>>>13 ubyte x \b%02x bytes
7134:
7135: # Joerg Jenderek: joerg dot jenderek at web dot de
7136: # http://www.clamav.net/doc/latest/html/node45.html
7137: # .cvd files start with a 512 bytes colon separated header
7138: # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
7139: # + gzipped tarball files
7140: 0 string ClamAV-VDB:
7141: >11 string >\0 Clam AntiVirus database %-.23s
7142: >>34 string :
7143: >>>35 string !: \b, version
7144: >>>>35 string x \b%-.1s
7145: >>>>>36 string !:
7146: >>>>>>36 string x \b%-.1s
7147: >>>>>>>37 string !:
7148: >>>>>>>>37 string x \b%-.1s
7149: >>>>>>>>>38 string !:
7150: >>>>>>>>>>38 string x \b%-.1s
7151: >512 string \037\213 \b, gzipped
7152: >769 string ustar\0 \b, tarred
7153:
7154: # Type: Grisoft AVG AntiVirus
7155: # From: David Newgas <david@newgas.net>
7156: 0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
1.1.1.2 ! misho 7157:
1.1 misho 7158: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7159: # $File: games,v 1.8 2009/09/19 16:28:09 christos Exp $
1.1 misho 7160: # games: file(1) for games
7161:
7162: # Fabio Bonelli <fabiobonelli@libero.it>
7163: # Quake II - III data files
7164: 0 string IDP2 Quake II 3D Model file,
7165: >20 long x %lu skin(s),
7166: >8 long x (%lu x
7167: >12 long x %lu),
7168: >40 long x %lu frame(s),
7169: >16 long x Frame size %lu bytes,
7170: >24 long x %lu vertices/frame,
7171: >28 long x %lu texture coordinates,
7172: >32 long x %lu triangles/frame
7173:
7174: 0 string IBSP Quake
7175: >4 long 0x26 II Map file (BSP)
7176: >4 long 0x2E III Map file (BSP)
7177:
7178: 0 string IDS2 Quake II SP2 sprite file
7179:
7180: #---------------------------------------------------------------------------
7181: # Doom and Quake
7182: # submitted by Nicolas Patrois
7183:
7184: 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
7185: # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
7186:
7187: 24 string LxD\ 203 Linuxdoom save
7188: >0 string x , name=%s
7189: >44 string x , world=%s
7190:
7191: # Quake
7192:
7193: 0 string PACK Quake I or II world or extension
1.1.1.2 ! misho 7194: >8 lelong >0 \b, %d entries
1.1 misho 7195:
7196: #0 string -1\x0a Quake I demo
7197: #>30 string x version %.4s
7198: #>61 string x level %s
7199:
7200: #0 string 5\x0a Quake I save
7201:
7202: # The levels
7203:
7204: # Quake 1
7205:
7206: 0 string 5\x0aIntroduction Quake I save: start Introduction
7207: 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
7208: 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
7209: 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
7210: 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
7211: 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
7212: 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
7213: 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
7214: 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
7215: 0 string 5\x0athe_Installation Quake I save: e2m1 The installation
7216: 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
7217: 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
7218: 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
7219: 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
7220: 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
7221: 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
7222: 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
7223: 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
7224: 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
7225: 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
7226: 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
7227: 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
7228: 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
7229: 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
7230: 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
7231: 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
7232: 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
7233: 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
7234: 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
7235: 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
7236: 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
7237: 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
7238:
7239: # Quake DeathMatch levels
7240:
7241: 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
7242: 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
7243: 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
7244: 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
7245: 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
7246: 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
7247:
7248: # Scourge of Armagon
7249:
7250: 0 string 5\x0aCommand_HQ Quake I save: start Command HQ
7251: 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
7252: 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
7253: 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
7254: 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
7255: 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
7256: 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
7257: 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
7258: 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
7259: 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
7260: 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
7261: 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
7262: 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
7263: 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
7264: 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
7265: 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
7266: 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
7267: 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
7268:
7269: # Malice
7270:
7271: 0 string 5\x0aThe_Academy Quake I save: start The academy
7272: 0 string 5\x0aThe_Lab Quake I save: d1 The lab
7273: 0 string 5\x0aArea_33 Quake I save: d1b Area 33
7274: 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
7275: 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
7276: 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
7277: 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
7278: 0 string 5\x0aArea44 Quake I save: d1c Area 44
7279: 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
7280: 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
7281: 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
7282: 0 string 5\x0aThe_Flood Quake I save: d5 The flood
7283: 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
7284: 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
7285: 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
7286: 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
7287: 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
7288: 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
7289: 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
7290: 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
7291: 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
7292:
7293: # Malice DeathMatch levels
7294:
7295: 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
7296: 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
7297: 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
7298: 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
7299: 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
7300: 0 string 5\x0aDOMINO Quake I save: ddm6 Domino
7301: 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
7302:
7303:
7304: 0 string MComprHD MAME CHD compressed hard disk image,
7305: >12 belong x version %lu
7306:
7307: # doom - submitted by Jon Dowland
7308:
7309: 0 string =IWAD doom main IWAD data
7310: >4 lelong x containing %d lumps
7311: 0 string =PWAD doom patch PWAD data
7312: >4 lelong x containing %d lumps
7313:
7314:
7315: # Summary: Warcraft 3 save
7316: # Extension: .w3g
7317: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
7318: 0 string Warcraft\ III\ recorded\ game %s
7319:
7320:
7321: # Summary: Warcraft 3 map
7322: # Extension: .w3m
7323: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
7324: 0 string HM3W Warcraft III map file
7325:
7326:
7327: # Summary: SGF Smart Game Format
7328: # Extension: .sgf
7329: # Reference: http://www.red-bean.com/sgf/
7330: # Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
7331: # Modified by (1): Abel Cheung (regex, more game format)
7332: # FIXME: Some games don't have GM (game type)
7333: 0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
7334: >2 search/0x200 GM[
7335: >>&0 string 1] (Go)
7336: >>&0 string 2] (Othello)
7337: >>&0 string 3] (chess)
7338: >>&0 string 4] (Gomoku+Renju)
7339: >>&0 string 5] (Nine Men's Morris)
7340: >>&0 string 6] (Backgammon)
7341: >>&0 string 7] (Chinese chess)
7342: >>&0 string 8] (Shogi)
7343: >>&0 string 9] (Lines of Action)
7344: >>&0 string 10] (Ataxx)
7345: >>&0 string 11] (Hex)
7346: >>&0 string 12] (Jungle)
7347: >>&0 string 13] (Neutron)
7348: >>&0 string 14] (Philosopher's Football)
7349: >>&0 string 15] (Quadrature)
7350: >>&0 string 16] (Trax)
7351: >>&0 string 17] (Tantrix)
7352: >>&0 string 18] (Amazons)
7353: >>&0 string 19] (Octi)
7354: >>&0 string 20] (Gess)
7355: >>&0 string 21] (Twixt)
7356: >>&0 string 22] (Zertz)
7357: >>&0 string 23] (Plateau)
7358: >>&0 string 24] (Yinsh)
7359: >>&0 string 25] (Punct)
7360: >>&0 string 26] (Gobblet)
7361: >>&0 string 27] (hive)
7362: >>&0 string 28] (Exxit)
7363: >>&0 string 29] (Hnefatal)
7364: >>&0 string 30] (Kuba)
7365: >>&0 string 31] (Tripples)
7366: >>&0 string 32] (Chase)
7367: >>&0 string 33] (Tumbling Down)
7368: >>&0 string 34] (Sahara)
7369: >>&0 string 35] (Byte)
7370: >>&0 string 36] (Focus)
7371: >>&0 string 37] (Dvonn)
7372: >>&0 string 38] (Tamsk)
7373: >>&0 string 39] (Gipf)
7374: >>&0 string 40] (Kropki)
7375:
7376:
7377: # Summary: Civilization 4 video
7378: # Extension: .bik
7379: # Created by: Abel Cheung <abelcheung@gmail.com>
7380: 0 string BIKi Civilization 4 Video
7381:
7382:
7383: ##############################################
7384: # NetImmerse/Gamebryo game engine entries
7385:
7386: # Summary: Gamebryo game engine file
7387: # Extension: .nif, .kf
7388: # Created by: Abel Cheung <abelcheung@gmail.com>
7389: 0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file
7390: >&0 regex [0-9a-z.]+ \b, version %s
7391:
7392: # Summary: Gamebryo game engine file
7393: # Extension: .kfm
7394: # Created by: Abel Cheung <abelcheung@gmail.com>
7395: 0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File
7396: >&0 regex [0-9a-z.]+ \b, version %s
7397:
7398: # Summary: NetImmerse game engine file
7399: # Extension .nif
7400: # Created by: Abel Cheung <abelcheung@gmail.com>
7401: 0 string NetImmerse\ File\ Format,\ Versio
7402: >&0 string n\ NetImmerse game engine file
7403: >>&0 regex [0-9a-z.]+ \b, version %s
7404:
7405: # Type: SGF Smart Game Format
7406: # URL: http://www.red-bean.com/sgf/
7407: # From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
7408: 2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
7409: >2 regex/c GM\\[1\\] - Go Game
7410: >2 regex/c GM\\[6\\] - BackGammon Game
7411: >2 regex/c GM\\[11\\] - Hex Game
7412: >2 regex/c GM\\[18\\] - Amazons Game
7413: >2 regex/c GM\\[19\\] - Octi Game
7414: >2 regex/c GM\\[20\\] - Gess Game
7415: >2 regex/c GM\\[21\\] - twix Game
7416:
7417: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7418: # $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 7419: # gcc: file(1) magic for GCC special files
7420: #
7421: 0 string gpch GCC precompiled header
7422:
7423: # The version field is annoying. It's 3 characters, not zero-terminated.
7424: >5 byte x (version %c
7425: >6 byte x \b%c
7426: >7 byte x \b%c)
7427:
7428: # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
7429: >4 byte 67 for C
7430: >4 byte 111 for Objective C
7431: >4 byte 43 for C++
7432: >4 byte 79 for Objective C++
7433:
7434: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7435: # $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 7436: # GEOS files (Vidar Madsen, vidar@gimp.org)
7437: # semi-commonly used in embedded and handheld systems.
7438: 0 belong 0xc745c153 GEOS
7439: >40 byte 1 executable
7440: >40 byte 2 VMFile
7441: >40 byte 3 binary
7442: >40 byte 4 directory label
7443: >40 byte <1 unknown
7444: >40 byte >4 unknown
7445: >4 string >\0 \b, name "%s"
7446: #>44 short x \b, version %d
7447: #>46 short x \b.%d
7448: #>48 short x \b, rev %d
7449: #>50 short x \b.%d
7450: #>52 short x \b, proto %d
7451: #>54 short x \br%d
7452: #>168 string >\0 \b, copyright "%s"
1.1.1.2 ! misho 7453:
1.1 misho 7454: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7455: # $File: gimp,v 1.6 2009/09/19 16:28:09 christos Exp $
1.1 misho 7456: # GIMP Gradient: file(1) magic for the GIMP's gradient data files
7457: # by Federico Mena <federico@nuclecu.unam.mx>
7458:
7459: 0 string GIMP\ Gradient GIMP gradient data
7460:
7461: #------------------------------------------------------------------------------
7462: # XCF: file(1) magic for the XCF image format used in the GIMP developed
7463: # by Spencer Kimball and Peter Mattis
7464: # ('Bucky' LaDieu, nega@vt.edu)
7465:
7466: 0 string gimp\ xcf GIMP XCF image data,
1.1.1.2 ! misho 7467: !:mime image/x-xcf
1.1 misho 7468: >9 string file version 0,
7469: >9 string v version
7470: >>10 string >\0 %s,
7471: >14 belong x %lu x
7472: >18 belong x %lu,
7473: >22 belong 0 RGB Color
7474: >22 belong 1 Greyscale
7475: >22 belong 2 Indexed Color
7476: >22 belong >2 Unknown Image Type.
7477:
7478: #------------------------------------------------------------------------------
7479: # XCF: file(1) magic for the patterns used in the GIMP, developed
7480: # by Spencer Kimball and Peter Mattis
7481: # ('Bucky' LaDieu, nega@vt.edu)
7482:
7483: 20 string GPAT GIMP pattern data,
7484: >24 string x %s
7485:
7486: #------------------------------------------------------------------------------
7487: # XCF: file(1) magic for the brushes used in the GIMP, developed
7488: # by Spencer Kimball and Peter Mattis
7489: # ('Bucky' LaDieu, nega@vt.edu)
7490:
7491: 20 string GIMP GIMP brush data
7492:
7493: # GIMP Curves File
7494: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
7495: 0 string #\040GIMP\040Curves\040File GIMP curve file
1.1.1.2 ! misho 7496:
! 7497: #------------------------------------------------------------------------------
! 7498: # $File: gnome-keyring,v 1.2 2009/09/19 16:28:09 christos Exp $
1.1 misho 7499: # GNOME keyring
7500: # Contributed by Josh Triplett
7501: # FIXME: Could be simplified if pstring supported two-byte counts
7502: 0 string GnomeKeyring\n\r\0\n GNOME keyring
7503: >&0 ubyte 0 \b, major version 0
7504: >>&0 ubyte 0 \b, minor version 0
7505: >>>&0 ubyte 0 \b, crypto type 0 (AEL)
7506: >>>&0 ubyte >0 \b, crypto type %hhu (unknown)
7507: >>>&1 ubyte 0 \b, hash type 0 (MD5)
7508: >>>&1 ubyte >0 \b, hash type %hhu (unknown)
7509: >>>&2 ubelong 0xFFFFFFFF \b, name NULL
7510: >>>&2 ubelong !0xFFFFFFFF
7511: >>>>&-4 ubelong >255 \b, name too long for file's pstring type
7512: >>>>&-4 ubelong <256
7513: >>>>>&-1 pstring x \b, name "%s"
7514: >>>>>>&0 ubeqdate x \b, last modified %s
7515: >>>>>>&8 ubeqdate x \b, created %s
7516: >>>>>>&16 ubelong &1
7517: >>>>>>>&0 ubelong x \b, locked if idle for %u seconds
7518: >>>>>>&16 ubelong ^1 \b, not locked if idle
7519: >>>>>>&24 ubelong x \b, hash iterations %u
7520: >>>>>>&28 ubequad x \b, salt %llu
7521: >>>>>>&52 ubelong x \b, %u item(s)
1.1.1.2 ! misho 7522:
1.1 misho 7523: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7524: # $File: gnu,v 1.11 2009/09/19 16:28:09 christos Exp $
1.1 misho 7525: # gnu: file(1) magic for various GNU tools
7526: #
7527: # GNU nlsutils message catalog file format
7528: #
7529: 0 string \336\22\4\225 GNU message catalog (little endian),
7530: >4 lelong x revision %d,
7531: >8 lelong x %d messages
7532: 0 string \225\4\22\336 GNU message catalog (big endian),
7533: >4 belong x revision %d,
7534: >8 belong x %d messages
7535: # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
7536: 0 string *nazgul* Nazgul style compiled message catalog
7537: >8 lelong >0 \b, version %ld
7538:
7539: # GnuPG
7540: # The format is very similar to pgp
7541: 0 string \001gpg GPG key trust database
7542: >4 byte x version %d
7543: # Note: magic.mime had 0x8501 for the next line instead of 0x8502
7544: 0 beshort 0x8502 GPG encrypted data
7545: !:mime text/PGP # encoding: data
7546:
7547: # This magic is not particularly good, as the keyrings don't have true
7548: # magic. Nevertheless, it covers many keyrings.
7549: 0 beshort 0x9901 GPG key public ring
7550: !:mime application/x-gnupg-keyring
7551:
7552: # Gnumeric spreadsheet
7553: # This entry is only semi-helpful, as Gnumeric compresses its files, so
7554: # they will ordinarily reported as "compressed", but at least -z helps
7555: 39 string =<gmr:Workbook Gnumeric spreadsheet
7556:
7557: # From: James Youngman <jay@gnu.org>
7558: # gnu find magic
7559: 0 string \0LOCATE GNU findutils locate database data
7560: >7 string >\0 \b, format %s
7561: >7 string 02 \b (frcode)
7562:
7563: # Files produced by GNU gettext
7564: 0 long 0xDE120495 GNU-format message catalog data
7565: 0 long 0x950412DE GNU-format message catalog data
7566:
7567: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7568: # $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 7569: # gnumeric: file(1) magic for Gnumeric spreadsheet
7570: # This entry is only semi-helpful, as Gnumeric compresses its files, so
7571: # they will ordinarily reported as "compressed", but at least -z helps
7572: 39 string =<gmr:Workbook Gnumeric spreadsheet
7573: !:mime application/x-gnumeric
7574:
7575: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7576: # $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 7577: # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
7578: #
7579: # ACE/gr binary
7580: 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
7581: >39 byte >0 - version %c
7582: # ACE/gr ascii
7583: 0 string #\ xvgr\ parameter\ file ACE/gr ascii file
7584: 0 string #\ xmgr\ parameter\ file ACE/gr ascii file
7585: 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
7586: # Grace projects
7587: 0 string #\ Grace\ project\ file Grace project file
7588: >23 string @version\ (version
7589: >>32 byte >0 %c
7590: >>33 string >\0 \b.%.2s
7591: >>35 string >\0 \b.%.2s)
7592: # ACE/gr fit description files
7593: 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
7594: # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
7595:
7596: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7597: # $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
1.1 misho 7598: # graphviz: file(1) magic for http://www.graphviz.org/
1.1.1.2 ! misho 7599:
! 7600: # FIXME: These patterns match too generally. For example, the first
! 7601: # line matches a LaTeX file containing the word "graph" (with a {
! 7602: # following later) and the second line matches this file.
! 7603: #0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
! 7604: #!:mime text/vnd.graphviz
! 7605: #0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
! 7606: #!:mime text/vnd.graphviz
1.1 misho 7607:
7608: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7609: # $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 7610: # gringotts: file(1) magic for Gringotts
7611: # http://devel.pluto.linux.it/projects/Gringotts/
7612: # author: Germano Rizzo <mano@pluto.linux.it>
7613: #GRG3????Y
7614: 0 string GRG Gringotts data file
7615: #file format 1
7616: >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
7617: #file format 2
7618: >3 string 2 v.2, MCRYPT S2K,
7619: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
7620: >>8 byte&0x70 0x10 SERPENT crypt,
7621: >>8 byte&0x70 0x20 TWOFISH crypt,
7622: >>8 byte&0x70 0x30 CAST-256 crypt,
7623: >>8 byte&0x70 0x40 SAFER+ crypt,
7624: >>8 byte&0x70 0x50 LOKI97 crypt,
7625: >>8 byte&0x70 0x60 3DES crypt,
7626: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
7627: >>8 byte&0x08 0x00 SHA1 hash,
7628: >>8 byte&0x08 0x08 RIPEMD-160 hash,
7629: >>8 byte&0x04 0x00 ZLib
7630: >>8 byte&0x04 0x04 BZip2
7631: >>8 byte&0x03 0x00 lvl.0
7632: >>8 byte&0x03 0x01 lvl.3
7633: >>8 byte&0x03 0x02 lvl.6
7634: >>8 byte&0x03 0x03 lvl.9
7635: #file format 3
7636: >3 string 3 v.3, OpenPGP S2K,
7637: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
7638: >>8 byte&0x70 0x10 SERPENT crypt,
7639: >>8 byte&0x70 0x20 TWOFISH crypt,
7640: >>8 byte&0x70 0x30 CAST-256 crypt,
7641: >>8 byte&0x70 0x40 SAFER+ crypt,
7642: >>8 byte&0x70 0x50 LOKI97 crypt,
7643: >>8 byte&0x70 0x60 3DES crypt,
7644: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
7645: >>8 byte&0x08 0x00 SHA1 hash,
7646: >>8 byte&0x08 0x08 RIPEMD-160 hash,
7647: >>8 byte&0x04 0x00 ZLib
7648: >>8 byte&0x04 0x04 BZip2
7649: >>8 byte&0x03 0x00 lvl.0
7650: >>8 byte&0x03 0x01 lvl.3
7651: >>8 byte&0x03 0x02 lvl.6
7652: >>8 byte&0x03 0x03 lvl.9
7653: #file format >3
7654: >3 string >3 v.%.1s (unknown details)
7655:
7656: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7657: # $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 7658: # hitach-sh: file(1) magic for Hitachi Super-H
7659: #
7660: # Super-H COFF
7661: #
7662: 0 beshort 0x0500 Hitachi SH big-endian COFF
7663: >18 beshort&0x0002 =0x0000 object
7664: >18 beshort&0x0002 =0x0002 executable
7665: >18 beshort&0x0008 =0x0008 \b, stripped
7666: >18 beshort&0x0008 =0x0000 \b, not stripped
7667: #
7668: 0 leshort 0x0550 Hitachi SH little-endian COFF
7669: >18 leshort&0x0002 =0x0000 object
7670: >18 leshort&0x0002 =0x0002 executable
7671: >18 leshort&0x0008 =0x0008 \b, stripped
7672: >18 leshort&0x0008 =0x0000 \b, not stripped
7673:
1.1.1.2 ! misho 7674:
1.1 misho 7675: #------------------------------------------------------------------------------
1.1.1.2 ! misho 7676: # $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
1.1 misho 7677: # hp: file(1) magic for Hewlett Packard machines (see also "printer")
7678: #
7679: # XXX - somebody should figure out whether any byte order needs to be
7680: # applied to the "TML" stuff; I'm assuming the Apollo stuff is
7681: # big-endian as it was mostly 68K-based.
7682: #
7683: # I think the 500 series was the old stack-based machines, running a
7684: # UNIX environment atop the "SUN kernel"; dunno whether it was
7685: # big-endian or little-endian.
7686: #
7687: # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
7688: # hp300 are 68020+68881 based; hp400 are also 68k. The following basic
7689: # HP magic is useful for reference, but using "long" magic is a better
7690: # practice in order to avoid collisions.
7691: #
7692: # Guy Harris (guy@netapp.com): some additions to this list came from
7693: # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
7694: # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
7695: # "/etc/magic", though, except for the "archive file relocatable library"
7696: # stuff, and the 68030 and 68040 stuff isn't there at all - are they not
7697: # used in executables, or have they just not yet updated "/etc/magic"
7698: # completely?
7699: #
7700: # 0 beshort 200 hp200 (68010) BSD binary
7701: # 0 beshort 300 hp300 (68020+68881) BSD binary
7702: # 0 beshort 0x20c hp200/300 HP-UX binary
7703: # 0 beshort 0x20d hp400 (68030) HP-UX binary
7704: # 0 beshort 0x20e hp400 (68040?) HP-UX binary
7705: # 0 beshort 0x20b PA-RISC1.0 HP-UX binary
7706: # 0 beshort 0x210 PA-RISC1.1 HP-UX binary
7707: # 0 beshort 0x211 PA-RISC1.2 HP-UX binary
7708: # 0 beshort 0x214 PA-RISC2.0 HP-UX binary
7709:
7710: #
7711: # The "misc" stuff needs a byte order; the archives look suspiciously
7712: # like the old 177545 archives (0xff65 = 0177545).
7713: #
7714: #### Old Apollo stuff
7715: 0 beshort 0627 Apollo m68k COFF executable
7716: >18 beshort ^040000 not stripped
7717: >22 beshort >0 - version %ld
7718: 0 beshort 0624 apollo a88k COFF executable
7719: >18 beshort ^040000 not stripped
7720: >22 beshort >0 - version %ld
7721: 0 long 01203604016 TML 0123 byte-order format
7722: 0 long 01702407010 TML 1032 byte-order format
7723: 0 long 01003405017 TML 2301 byte-order format
7724: 0 long 01602007412 TML 3210 byte-order format
7725: #### PA-RISC 1.1
7726: 0 belong 0x02100106 PA-RISC1.1 relocatable object
7727: 0 belong 0x02100107 PA-RISC1.1 executable
7728: >168 belong &0x00000004 dynamically linked
7729: >(144) belong 0x054ef630 dynamically linked
7730: >96 belong >0 - not stripped
7731:
7732: 0 belong 0x02100108 PA-RISC1.1 shared executable
7733: >168 belong&0x4 0x4 dynamically linked
7734: >(144) belong 0x054ef630 dynamically linked
7735: >96 belong >0 - not stripped
7736:
7737: 0 belong 0x0210010b PA-RISC1.1 demand-load executable
7738: >168 belong&0x4 0x4 dynamically linked
7739: >(144) belong 0x054ef630 dynamically linked
7740: >96 belong >0 - not stripped
7741:
7742: 0 belong 0x0210010e PA-RISC1.1 shared library
7743: >96 belong >0 - not stripped
7744:
7745: 0 belong 0x0210010d PA-RISC1.1 dynamic load library
7746: >96 belong >0 - not stripped
7747:
7748: #### PA-RISC 2.0
7749: 0 belong 0x02140106 PA-RISC2.0 relocatable object
7750:
7751: 0 belong 0x02140107 PA-RISC2.0 executable
7752: >168 belong &0x00000004 dynamically linked
7753: >(144) belong 0x054ef630 dynamically linked
7754: >96 belong >0 - not stripped
7755:
7756: 0 belong 0x02140108 PA-RISC2.0 shared executable
7757: >168 belong &0x00000004 dynamically linked
7758: >(144) belong 0x054ef630 dynamically linked
7759: >96 belong >0 - not stripped
7760:
7761: 0 belong 0x0214010b PA-RISC2.0 demand-load executable
7762: >168 belong &0x00000004 dynamically linked
7763: >(144) belong 0x054ef630 dynamically linked
7764: >96 belong >0 - not stripped
7765:
7766: 0 belong 0x0214010e PA-RISC2.0 shared library
7767: >96 belong >0 - not stripped
7768:
7769: 0 belong 0x0214010d PA-RISC2.0 dynamic load library
7770: >96 belong >0 - not stripped
7771:
7772: #### 800
7773: 0 belong 0x020b0106 PA-RISC1.0 relocatable object
7774:
7775: 0 belong 0x020b0107 PA-RISC1.0 executable
7776: >168 belong&0x4 0x4 dynamically linked
7777: >(144) belong 0x054ef630 dynamically linked
7778: >96 belong >0 - not stripped
7779:
7780: 0 belong 0x020b0108 PA-RISC1.0 shared executable
7781: >168 belong&0x4 0x4 dynamically linked
7782: >(144) belong 0x054ef630 dynamically linked
7783: >96 belong >0 - not stripped
7784:
7785: 0 belong 0x020b010b PA-RISC1.0 demand-load executable
7786: >168 belong&0x4 0x4 dynamically linked
7787: >(144) belong 0x054ef630 dynamically linked
7788: >96 belong >0 - not stripped
7789:
7790: 0 belong 0x020b010e PA-RISC1.0 shared library
7791: >96 belong >0 - not stripped
7792:
7793: 0 belong 0x020b010d PA-RISC1.0 dynamic load library
7794: >96 belong >0 - not stripped
7795:
7796: 0 belong 0x213c6172 archive file
7797: >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
7798: >68 belong 0x02100619 - PA-RISC1.1 relocatable library
7799: >68 belong 0x02110619 - PA-RISC1.2 relocatable library
7800: >68 belong 0x02140619 - PA-RISC2.0 relocatable library
7801:
7802: #### 500
7803: 0 long 0x02080106 HP s500 relocatable executable
7804: >16 long >0 - version %ld
7805:
7806: 0 long 0x02080107 HP s500 executable
7807: >16 long >0 - version %ld
7808:
7809: 0 long 0x02080108 HP s500 pure executable
7810: >16 long >0 - version %ld
7811:
7812: #### 200
7813: 0 belong 0x020c0108 HP s200 pure executable
7814: >4 beshort >0 - version %ld
7815: >8 belong &0x80000000 save fp regs
7816: >8 belong &0x40000000 dynamically linked
7817: >8 belong &0x20000000 debuggable
7818: >36 belong >0 not stripped
7819:
7820: 0 belong 0x020c0107 HP s200 executable
7821: >4 beshort >0 - version %ld
7822: >8 belong &0x80000000 save fp regs
7823: >8 belong &0x40000000 dynamically linked
7824: >8 belong &0x20000000 debuggable
7825: >36 belong >0 not stripped
7826:
7827: 0 belong 0x020c010b HP s200 demand-load executable
7828: >4 beshort >0 - version %ld
7829: >8 belong &0x80000000 save fp regs
7830: >8 belong &0x40000000 dynamically linked
7831: >8 belong &0x20000000 debuggable
7832: >36 belong >0 not stripped
7833:
7834: 0 belong 0x020c0106 HP s200 relocatable executable
7835: >4 beshort >0 - version %ld
7836: >6 beshort >0 - highwater %d
7837: >8 belong &0x80000000 save fp regs
7838: >8 belong &0x20000000 debuggable
7839: >8 belong &0x10000000 PIC
7840:
7841: 0 belong 0x020a0108 HP s200 (2.x release) pure executable
7842: >4 beshort >0 - version %ld
7843: >36 belong >0 not stripped
7844:
7845: 0 belong 0x020a0107 HP s200 (2.x release) executable
7846: >4 beshort >0 - version %ld
7847: >36 belong >0 not stripped
7848:
7849: 0 belong 0x020c010e HP s200 shared library
7850: >4 beshort >0 - version %ld
7851: >6 beshort >0 - highwater %d
7852: >36 belong >0 not stripped
7853:
7854: 0 belong 0x020c010d HP s200 dynamic load library
7855: >4 beshort >0 - version %ld
7856: >6 beshort >0 - highwater %d
7857: >36 belong >0 not stripped
7858:
7859: #### MISC
7860: 0 long 0x0000ff65 HP old archive
7861: 0 long 0x020aff65 HP s200 old archive
7862: 0 long 0x020cff65 HP s200 old archive
7863: 0 long 0x0208ff65 HP s500 old archive
7864:
7865: 0 long 0x015821a6 HP core file
7866:
7867: 0 long 0x4da7eee8 HP-WINDOWS font
7868: >8 byte >0 - version %ld
7869: 0 string Bitmapfile HP Bitmapfile
7870:
7871: 0 string IMGfile CIS compimg HP Bitmapfile
7872: # XXX - see "lif"
7873: #0 short 0x8000 lif file
7874: 0 long 0x020c010c compiled Lisp
7875:
7876: 0 string msgcat01 HP NLS message catalog,
7877: >8 long >0 %d messages
7878:
7879: # Summary: HP-48/49 calculator
7880: # Created by: phk@data.fls.dk
7881: # Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
7882: # Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
7883: 0 string HPHP HP
7884: >4 string 48 48 binary
7885: >4 string 49 49 binary
7886: >7 byte >64 - Rev %c
7887: >8 leshort 0x2911 (ADR)
7888: >8 leshort 0x2933 (REAL)
7889: >8 leshort 0x2955 (LREAL)
7890: >8 leshort 0x2977 (COMPLX)
7891: >8 leshort 0x299d (LCOMPLX)
7892: >8 leshort 0x29bf (CHAR)
7893: >8 leshort 0x29e8 (ARRAY)
7894: >8 leshort 0x2a0a (LNKARRAY)
7895: >8 leshort 0x2a2c (STRING)
7896: >8 leshort 0x2a4e (HXS)
7897: >8 leshort 0x2a74 (LIST)
7898: >8 leshort 0x2a96 (DIR)
7899: >8 leshort 0x2ab8 (ALG)
7900: >8 leshort 0x2ada (UNIT)
7901: >8 leshort 0x2afc (TAGGED)
7902: >8 leshort 0x2b1e (GROB)
7903: >8 leshort 0x2b40 (LIB)
7904: >8 leshort 0x2b62 (BACKUP)
7905: >8 leshort 0x2b88 (LIBDATA)
7906: >8 leshort 0x2d9d (PROG)
7907: >8 leshort 0x2dcc (CODE)
7908: >8 leshort 0x2e48 (GNAME)
7909: >8 leshort 0x2e6d (LNAME)
7910: >8 leshort 0x2e92 (XLIB)
7911:
7912: 0 string %%HP: HP text
7913: >6 string T(0) - T(0)
7914: >6 string T(1) - T(1)
7915: >6 string T(2) - T(2)
7916: >6 string T(3) - T(3)
7917: >10 string A(D) A(D)
7918: >10 string A(R) A(R)
7919: >10 string A(G) A(G)
7920: >14 string F(.) F(.);
7921: >14 string F(,) F(,);
7922:
7923:
7924: # Summary: HP-38/39 calculator
7925: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
7926: 0 string HP3
7927: >3 string 8 HP 38
7928: >3 string 9 HP 39
7929: >4 string Bin binary
7930: >4 string Asc ASCII
7931: >7 string A (Directory List)
7932: >7 string B (Zaplet)
7933: >7 string C (Note)
7934: >7 string D (Program)
7935: >7 string E (Variable)
7936: >7 string F (List)
7937: >7 string G (Matrix)
7938: >7 string H (Library)
7939: >7 string I (Target List)
7940: >7 string J (ASCII Vector specification)
7941: >7 string K (wildcard)
7942:
7943: # Summary: HP-38/39 calculator
7944: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
7945: 0 string HP3
7946: >3 string 8 HP 38
7947: >3 string 9 HP 39
7948: >4 string Bin binary
7949: >4 string Asc ASCII
7950: >7 string A (Directory List)
7951: >7 string B (Zaplet)
7952: >7 string C (Note)
7953: >7 string D (Program)
7954: >7 string E (Variable)
7955: >7 string F (List)
7956: >7 string G (Matrix)
7957: >7 string H (Library)
7958: >7 string I (Target List)
7959: >7 string J (ASCII Vector specification)
7960: >7 string K (wildcard)
7961:
7962: # hpBSD magic numbers
7963: 0 beshort 200 hp200 (68010) BSD
7964: >2 beshort 0407 impure binary
7965: >2 beshort 0410 read-only binary
7966: >2 beshort 0413 demand paged binary
7967: 0 beshort 300 hp300 (68020+68881) BSD
7968: >2 beshort 0407 impure binary
7969: >2 beshort 0410 read-only binary
7970: >2 beshort 0413 demand paged binary
7971: #
7972: # From David Gero <dgero@nortelnetworks.com>
7973: # HP-UX 10.20 core file format from /usr/include/sys/core.h
7974: # Unfortunately, HP-UX uses corehead blocks without specifying the order
7975: # There are four we care about:
7976: # CORE_KERNEL, which starts with the string "HP-UX"
7977: # CORE_EXEC, which contains the name of the command
7978: # CORE_PROC, which contains the signal number that caused the core dump
7979: # CORE_FORMAT, which contains the version of the core file format (== 1)
7980: # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
7981: # but we include all 6 variations of the order of the first 3, and
7982: # assume that PROC will always be last
7983: # Order 1: KERNEL, EXEC, FORMAT, PROC
7984: 0x10 string HP-UX
7985: >0 belong 2
7986: >>0xC belong 0x3C
7987: >>>0x4C belong 0x100
7988: >>>>0x58 belong 0x44
7989: >>>>>0xA0 belong 1
7990: >>>>>>0xAC belong 4
7991: >>>>>>>0xB0 belong 1
7992: >>>>>>>>0xB4 belong 4 core file
7993: >>>>>>>>>0x90 string >\0 from '%s'
7994: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
7995: >>>>>>>>>0xC4 belong 4 - received SIGILL
7996: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
7997: >>>>>>>>>0xC4 belong 6 - received SIGABRT
7998: >>>>>>>>>0xC4 belong 7 - received SIGEMT
7999: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8000: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8001: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8002: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8003: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8004: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8005: # Order 2: KERNEL, FORMAT, EXEC, PROC
8006: >>>0x4C belong 1
8007: >>>>0x58 belong 4
8008: >>>>>0x5C belong 1
8009: >>>>>>0x60 belong 0x100
8010: >>>>>>>0x6C belong 0x44
8011: >>>>>>>>0xB4 belong 4 core file
8012: >>>>>>>>>0xA4 string >\0 from '%s'
8013: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
8014: >>>>>>>>>0xC4 belong 4 - received SIGILL
8015: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
8016: >>>>>>>>>0xC4 belong 6 - received SIGABRT
8017: >>>>>>>>>0xC4 belong 7 - received SIGEMT
8018: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8019: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8020: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8021: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8022: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8023: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8024: # Order 3: FORMAT, KERNEL, EXEC, PROC
8025: 0x24 string HP-UX
8026: >0 belong 1
8027: >>0xC belong 4
8028: >>>0x10 belong 1
8029: >>>>0x14 belong 2
8030: >>>>>0x20 belong 0x3C
8031: >>>>>>0x60 belong 0x100
8032: >>>>>>>0x6C belong 0x44
8033: >>>>>>>>0xB4 belong 4 core file
8034: >>>>>>>>>0xA4 string >\0 from '%s'
8035: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
8036: >>>>>>>>>0xC4 belong 4 - received SIGILL
8037: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
8038: >>>>>>>>>0xC4 belong 6 - received SIGABRT
8039: >>>>>>>>>0xC4 belong 7 - received SIGEMT
8040: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8041: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8042: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8043: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8044: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8045: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8046: # Order 4: EXEC, KERNEL, FORMAT, PROC
8047: 0x64 string HP-UX
8048: >0 belong 0x100
8049: >>0xC belong 0x44
8050: >>>0x54 belong 2
8051: >>>>0x60 belong 0x3C
8052: >>>>>0xA0 belong 1
8053: >>>>>>0xAC belong 4
8054: >>>>>>>0xB0 belong 1
8055: >>>>>>>>0xB4 belong 4 core file
8056: >>>>>>>>>0x44 string >\0 from '%s'
8057: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
8058: >>>>>>>>>0xC4 belong 4 - received SIGILL
8059: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
8060: >>>>>>>>>0xC4 belong 6 - received SIGABRT
8061: >>>>>>>>>0xC4 belong 7 - received SIGEMT
8062: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8063: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8064: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8065: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8066: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8067: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8068: # Order 5: FORMAT, EXEC, KERNEL, PROC
8069: 0x78 string HP-UX
8070: >0 belong 1
8071: >>0xC belong 4
8072: >>>0x10 belong 1
8073: >>>>0x14 belong 0x100
8074: >>>>>0x20 belong 0x44
8075: >>>>>>0x68 belong 2
8076: >>>>>>>0x74 belong 0x3C
8077: >>>>>>>>0xB4 belong 4 core file
8078: >>>>>>>>>0x58 string >\0 from '%s'
8079: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
8080: >>>>>>>>>0xC4 belong 4 - received SIGILL
8081: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
8082: >>>>>>>>>0xC4 belong 6 - received SIGABRT
8083: >>>>>>>>>0xC4 belong 7 - received SIGEMT
8084: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8085: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8086: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8087: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8088: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8089: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8090: # Order 6: EXEC, FORMAT, KERNEL, PROC
8091: >0 belong 0x100
8092: >>0xC belong 0x44
8093: >>>0x54 belong 1
8094: >>>>0x60 belong 4
8095: >>>>>0x64 belong 1
8096: >>>>>>0x68 belong 2
8097: >>>>>>>0x74 belong 0x2C
8098: >>>>>>>>0xB4 belong 4 core file
8099: >>>>>>>>>0x44 string >\0 from '%s'
8100: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
8101: >>>>>>>>>0xC4 belong 4 - received SIGILL
8102: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
8103: >>>>>>>>>0xC4 belong 6 - received SIGABRT
8104: >>>>>>>>>0xC4 belong 7 - received SIGEMT
8105: >>>>>>>>>0xC4 belong 8 - received SIGFPE
8106: >>>>>>>>>0xC4 belong 10 - received SIGBUS
8107: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
8108: >>>>>>>>>0xC4 belong 12 - received SIGSYS
8109: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
8110: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
8111:
8112:
8113:
8114: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8115: # $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 8116: # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
8117: # Magic too short!
8118: #0 string HU Human68k
8119: #>68 string LZX LZX compressed
8120: #>>72 string >\0 (version %s)
8121: #>(8.L+74) string LZX LZX compressed
8122: #>>(8.L+78) string >\0 (version %s)
8123: #>60 belong >0 binded
8124: #>(8.L+66) string #HUPAIR hupair
8125: #>0 string HU X executable
8126: #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
8127: #>4 belong >0 - base address 0x%x
8128: #>28 belong >0 not stripped
8129: #>32 belong >0 with debug information
8130: #0 beshort 0x601a Human68k Z executable
8131: #0 beshort 0x6000 Human68k object file
8132: #0 belong 0xd1000000 Human68k ar binary archive
8133: #0 belong 0xd1010000 Human68k ar ascii archive
8134: #0 beshort 0x0068 Human68k lib archive
8135: #4 string LZX Human68k LZX compressed
8136: #>8 string >\0 (version %s)
8137: #>4 string LZX R executable
8138: #2 string #HUPAIR Human68k hupair R executable
8139:
8140: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8141: # $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
1.1 misho 8142: # ibm370: file(1) magic for IBM 370 and compatibles.
8143: #
8144: # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
8145: # What the heck *is* "USS/370"?
8146: # AIX 4.1's "/etc/magic" has
8147: #
8148: # 0 short 0535 370 sysV executable
8149: # >12 long >0 not stripped
8150: # >22 short >0 - version %d
8151: # >30 long >0 - 5.2 format
8152: # 0 short 0530 370 sysV pure executable
8153: # >12 long >0 not stripped
8154: # >22 short >0 - version %d
8155: # >30 long >0 - 5.2 format
8156: #
8157: # instead of the "USS/370" versions of the same magic numbers.
8158: #
8159: 0 beshort 0537 370 XA sysV executable
8160: >12 belong >0 not stripped
8161: >22 beshort >0 - version %d
8162: >30 belong >0 - 5.2 format
8163: 0 beshort 0532 370 XA sysV pure executable
8164: >12 belong >0 not stripped
8165: >22 beshort >0 - version %d
8166: >30 belong >0 - 5.2 format
8167: 0 beshort 054001 370 sysV pure executable
8168: >12 belong >0 not stripped
8169: 0 beshort 055001 370 XA sysV pure executable
8170: >12 belong >0 not stripped
8171: 0 beshort 056401 370 sysV executable
8172: >12 belong >0 not stripped
8173: 0 beshort 057401 370 XA sysV executable
8174: >12 belong >0 not stripped
8175: 0 beshort 0531 SVR2 executable (Amdahl-UTS)
8176: >12 belong >0 not stripped
8177: >24 belong >0 - version %ld
8178: 0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
8179: >12 belong >0 not stripped
8180: >24 belong >0 - version %ld
8181: 0 beshort 0530 SVR2 pure executable (USS/370)
8182: >12 belong >0 not stripped
8183: >24 belong >0 - version %ld
8184: 0 beshort 0535 SVR2 executable (USS/370)
8185: >12 belong >0 not stripped
8186: >24 belong >0 - version %ld
8187:
8188: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8189: # $File: ibm6000,v 1.9 2009/09/19 16:28:09 christos Exp $
1.1 misho 8190: # ibm6000: file(1) magic for RS/6000 and the RT PC.
8191: #
8192: 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
8193: >12 belong >0 not stripped
8194: # Breaks sun4 statically linked execs.
8195: #0 beshort 0x0103 executable (RT Version 2) or obj module
8196: #>2 byte 0x50 pure
8197: #>28 belong >0 not stripped
8198: #>6 beshort >0 - version %ld
8199: 0 beshort 0x0104 shared library
8200: 0 beshort 0x0105 ctab data
8201: 0 beshort 0xfe04 structured file
8202: 0 string 0xabcdef AIX message catalog
8203: 0 belong 0x000001f9 AIX compiled message catalog
8204: 0 string \<aiaff> archive
8205: 0 string \<bigaf> archive (big format)
8206:
8207:
8208: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8209: # $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $
1.1 misho 8210: # iff: file(1) magic for Interchange File Format (see also "audio" & "images")
8211: #
8212: # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
8213: # Arts for file interchange. It has also been used by Apple, SGI, and
8214: # especially Commodore-Amiga.
8215: #
8216: # IFF files begin with an 8 byte FORM header, followed by a 4 character
8217: # FORM type, which is followed by the first chunk in the FORM.
8218:
8219: 0 string FORM IFF data
8220: #>4 belong x \b, FORM is %d bytes long
8221: # audio formats
8222: >8 string AIFF \b, AIFF audio
8223: !:mime audio/x-aiff
8224: >8 string AIFC \b, AIFF-C compressed audio
8225: !:mime audio/x-aiff
8226: >8 string 8SVX \b, 8SVX 8-bit sampled sound voice
8227: !:mime audio/x-aiff
8228: >8 string 16SV \b, 16SV 16-bit sampled sound voice
8229: >8 string SAMP \b, SAMP sampled audio
8230: >8 string MAUD \b, MAUD MacroSystem audio
8231: >8 string SMUS \b, SMUS simple music
8232: >8 string CMUS \b, CMUS complex music
8233: # image formats
8234: >8 string ILBMBMHD \b, ILBM interleaved image
8235: >>20 beshort x \b, %d x
8236: >>22 beshort x %d
8237: >8 string RGBN \b, RGBN 12-bit RGB image
8238: >8 string RGB8 \b, RGB8 24-bit RGB image
8239: >8 string DEEP \b, DEEP TVPaint/XiPaint image
8240: >8 string DR2D \b, DR2D 2-D object
8241: >8 string TDDD \b, TDDD 3-D rendering
8242: >8 string LWOB \b, LWOB 3-D object
8243: >8 string LWO2 \b, LWO2 3-D object, v2
8244: >8 string LWLO \b, LWLO 3-D layered object
8245: >8 string REAL \b, REAL Real3D rendering
8246: >8 string MC4D \b, MC4D MaxonCinema4D rendering
8247: >8 string ANIM \b, ANIM animation
8248: >8 string YAFA \b, YAFA animation
8249: >8 string SSA\ \b, SSA super smooth animation
8250: >8 string ACBM \b, ACBM continuous image
8251: >8 string FAXX \b, FAXX fax image
8252: # other formats
8253: >8 string FTXT \b, FTXT formatted text
8254: >8 string CTLG \b, CTLG message catalog
8255: >8 string PREF \b, PREF preferences
8256: >8 string DTYP \b, DTYP datatype description
8257: >8 string PTCH \b, PTCH binary patch
8258: >8 string AMFF \b, AMFF AmigaMetaFile format
8259: >8 string WZRD \b, WZRD StormWIZARD resource
8260: >8 string DOC\ \b, DOC desktop publishing document
8261:
8262: # These go at the end of the iff rules
8263: #
8264: # I don't see why these might collide with anything else.
8265: #
8266: # Interactive Fiction related formats
8267: #
8268: >8 string IFRS \b, Blorb Interactive Fiction
8269: >>24 string Exec with executable chunk
8270: >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
1.1.1.2 ! misho 8271:
1.1 misho 8272: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8273: # $File: images,v 1.64 2009/12/06 00:38:50 christos Exp $
1.1 misho 8274: # images: file(1) magic for image formats (see also "iff", and "c-lang" for
8275: # XPM bitmaps)
8276: #
8277: # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
8278: # additions by janl@ifi.uio.no as well as others. Jan also suggested
8279: # merging several one- and two-line files into here.
8280: #
8281: # little magic: PCX (first byte is 0x0a)
8282:
8283: # Targa - matches `povray', `ppmtotga' and `xv' outputs
8284: # by Philippe De Muyter <phdm@macqel.be>
8285: # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
8286: # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
8287: # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
8288: # `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
8289: # `tgatoppm' recognizes a superset (Index may be anything)
8290: 1 belong&0xfff7ffff 0x01010000 Targa image data - Map
8291: >2 byte&8 8 - RLE
8292: >12 leshort >0 %hd x
8293: >14 leshort >0 %hd
8294: 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
8295: >2 byte&8 8 - RLE
8296: >12 leshort >0 %hd x
8297: >14 leshort >0 %hd
8298: 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
8299: >2 byte&8 8 - RLE
8300: >12 leshort >0 %hd x
8301: >14 leshort >0 %hd
8302:
8303: # PBMPLUS images
8304: # The next byte following the magic is always whitespace.
8305: 0 search/1 P1 Netpbm PBM image text
8306: !:mime image/x-portable-bitmap
8307: 0 search/1 P2 Netpbm PGM image text
8308: !:mime image/x-portable-greymap
8309: 0 search/1 P3 Netpbm PPM image text
8310: !:mime image/x-portable-pixmap
8311: 0 string P4 Netpbm PBM "rawbits" image data
8312: !:mime image/x-portable-bitmap
8313: 0 string P5 Netpbm PGM "rawbits" image data
8314: !:mime image/x-portable-greymap
8315: 0 string P6 Netpbm PPM "rawbits" image data
8316: !:mime image/x-portable-pixmap
8317: 0 string P7 Netpbm PAM image file
8318: !:mime image/x-portable-pixmap
8319:
8320: # From: bryanh@giraffe-data.com (Bryan Henderson)
8321: 0 string \117\072 Solitaire Image Recorder format
8322: >4 string \013 MGI Type 11
8323: >4 string \021 MGI Type 17
8324: 0 string .MDA MicroDesign data
8325: >21 byte 48 version 2
8326: >21 byte 51 version 3
8327: 0 string .MDP MicroDesign page data
8328: >21 byte 48 version 2
8329: >21 byte 51 version 3
8330:
8331: # NIFF (Navy Interchange File Format, a modification of TIFF) images
8332: # [GRR: this *must* go before TIFF]
8333: 0 string IIN1 NIFF image data
8334: !:mime image/x-niff
8335:
1.1.1.2 ! misho 8336: # Canon RAW version 1 (CRW) files are a type of Canon Image File Format
! 8337: # (CIFF) file. These are apparently all little-endian.
! 8338: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8339: # URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
! 8340: 0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data
! 8341: !:mime image/x-canon-crw
! 8342: >16 leshort x \b, version %d.
! 8343: >14 leshort x \b%d
! 8344:
! 8345: # Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
! 8346: # number. Put this above the TIFF test to make sure we detect them.
! 8347: # These are apparently all little-endian.
! 8348: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8349: # URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
! 8350: 0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data
! 8351: !:mime image/x-canon-cr2
! 8352: >10 byte x \b, version %d.
! 8353: >11 byte x \b%d
! 8354:
1.1 misho 8355: # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
8356: # The second word of TIFF files is the TIFF version number, 42, which has
8357: # never changed. The TIFF specification recommends testing for it.
8358: 0 string MM\x00\x2a TIFF image data, big-endian
8359: !:mime image/tiff
8360: 0 string II\x2a\x00 TIFF image data, little-endian
8361: !:mime image/tiff
8362:
8363: # PNG [Portable Network Graphics, or "PNG's Not GIF"] images
8364: # (Greg Roelofs, newt@uchicago.edu)
8365: # (Albert Cahalan, acahalan@cs.uml.edu)
8366: #
8367: # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
8368: #
1.1.1.2 ! misho 8369: 0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
1.1 misho 8370: !:mime image/png
8371: >16 belong x \b, %ld x
8372: >20 belong x %ld,
8373: >24 byte x %d-bit
8374: >25 byte 0 grayscale,
8375: >25 byte 2 \b/color RGB,
8376: >25 byte 3 colormap,
8377: >25 byte 4 gray+alpha,
8378: >25 byte 6 \b/color RGBA,
8379: #>26 byte 0 deflate/32K,
8380: >28 byte 0 non-interlaced
8381: >28 byte 1 interlaced
8382:
8383: # possible GIF replacements; none yet released!
8384: # (Greg Roelofs, newt@uchicago.edu)
8385: #
8386: # GRR 950115: this was mine ("Zip GIF"):
8387: 0 string GIF94z ZIF image (GIF+deflate alpha)
8388: !:mime image/x-unknown
8389: #
8390: # GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
8391: #
8392: 0 string FGF95a FGF image (GIF+deflate beta)
8393: !:mime image/x-unknown
8394: #
8395: # GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
8396: # (best; not yet implemented):
8397: #
8398: 0 string PBF PBF image (deflate compression)
8399: !:mime image/x-unknown
8400:
8401: # GIF
8402: 0 string GIF8 GIF image data
8403: !:mime image/gif
1.1.1.2 ! misho 8404: !:apple 8BIMGIFf
1.1 misho 8405: >4 string 7a \b, version 8%s,
8406: >4 string 9a \b, version 8%s,
8407: >6 leshort >0 %hd x
8408: >8 leshort >0 %hd
8409: #>10 byte &0x80 color mapped,
8410: #>10 byte&0x07 =0x00 2 colors
8411: #>10 byte&0x07 =0x01 4 colors
8412: #>10 byte&0x07 =0x02 8 colors
8413: #>10 byte&0x07 =0x03 16 colors
8414: #>10 byte&0x07 =0x04 32 colors
8415: #>10 byte&0x07 =0x05 64 colors
8416: #>10 byte&0x07 =0x06 128 colors
8417: #>10 byte&0x07 =0x07 256 colors
8418:
8419: # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
8420: # 1 plane, no encoding.
8421: 0 string \361\0\100\273 CMU window manager raster image data
8422: >4 lelong >0 %d x
8423: >8 lelong >0 %d,
8424: >12 lelong >0 %d-bit
8425:
8426: # Magick Image File Format
8427: 0 string id=ImageMagick MIFF image data
8428:
8429: # Artisan
8430: 0 long 1123028772 Artisan image data
8431: >4 long 1 \b, rectangular 24-bit
8432: >4 long 2 \b, rectangular 8-bit with colormap
8433: >4 long 3 \b, rectangular 32-bit (24-bit with matte)
8434:
8435: # FIG (Facility for Interactive Generation of figures), an object-based format
8436: 0 search/1 #FIG FIG image text
8437: >5 string x \b, version %.3s
8438:
8439: # PHIGS
8440: 0 string ARF_BEGARF PHIGS clear text archive
8441: 0 string @(#)SunPHIGS SunPHIGS
8442: # version number follows, in the form m.n
8443: >40 string SunBin binary
8444: >32 string archive archive
8445:
8446: # GKS (Graphics Kernel System)
8447: 0 string GKSM GKS Metafile
8448: >24 string SunGKS \b, SunGKS
8449:
8450: # CGM image files
8451: 0 string BEGMF clear text Computer Graphics Metafile
8452:
8453: # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
8454: 0 string yz MGR bitmap, modern format, 8-bit aligned
8455: 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
8456: 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
8457: 0 string yx MGR bitmap, modern format, squeezed
8458:
8459: # Fuzzy Bitmap (FBM) images
8460: 0 string %bitmap\0 FBM image data
8461: >30 long 0x31 \b, mono
8462: >30 long 0x33 \b, color
8463:
8464: # facsimile data
8465: 1 string PC\ Research,\ Inc group 3 fax data
8466: >29 byte 0 \b, normal resolution (204x98 DPI)
8467: >29 byte 1 \b, fine resolution (204x196 DPI)
8468: # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
8469: 0 string Sfff structured fax file
8470:
8471:
8472: # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
8473: 0 string BM
8474: >14 leshort 12 PC bitmap, OS/2 1.x format
8475: !:mime image/x-ms-bmp
8476: >>18 leshort x \b, %d x
8477: >>20 leshort x %d
8478: >14 leshort 64 PC bitmap, OS/2 2.x format
8479: !:mime image/x-ms-bmp
8480: >>18 leshort x \b, %d x
8481: >>20 leshort x %d
8482: >14 leshort 40 PC bitmap, Windows 3.x format
8483: !:mime image/x-ms-bmp
8484: >>18 lelong x \b, %d x
8485: >>22 lelong x %d x
8486: >>28 leshort x %d
8487: >14 leshort 128 PC bitmap, Windows NT/2000 format
8488: !:mime image/x-ms-bmp
8489: >>18 lelong x \b, %d x
8490: >>22 lelong x %d x
8491: >>28 leshort x %d
8492: # Too simple - MPi
8493: #0 string IC PC icon data
8494: #0 string PI PC pointer image data
8495: #0 string CI PC color icon data
8496: #0 string CP PC color pointer image data
8497: # Conflicts with other entries [BABYL]
8498: #0 string BA PC bitmap array data
8499:
8500: # XPM icons (Greg Roelofs, newt@uchicago.edu)
8501: # note possible collision with C/REXX entry in c-lang; currently commented out
8502: 0 search/1 /*\ XPM\ */ X pixmap image text
8503:
8504: # Utah Raster Toolkit RLE images (janl@ifi.uio.no)
8505: 0 leshort 0xcc52 RLE image data,
8506: >6 leshort x %d x
8507: >8 leshort x %d
8508: >2 leshort >0 \b, lower left corner: %d
8509: >4 leshort >0 \b, lower right corner: %d
8510: >10 byte&0x1 =0x1 \b, clear first
8511: >10 byte&0x2 =0x2 \b, no background
8512: >10 byte&0x4 =0x4 \b, alpha channel
8513: >10 byte&0x8 =0x8 \b, comment
8514: >11 byte >0 \b, %d color channels
8515: >12 byte >0 \b, %d bits per pixel
8516: >13 byte >0 \b, %d color map channels
8517:
8518: # image file format (Robert Potter, potter@cs.rochester.edu)
8519: 0 string Imagefile\ version- iff image data
8520: # this adds the whole header (inc. version number), informative but longish
8521: >10 string >\0 %s
8522:
8523: # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
8524: 0 belong 0x59a66a95 Sun raster image data
8525: >4 belong >0 \b, %d x
8526: >8 belong >0 %d,
8527: >12 belong >0 %d-bit,
8528: #>16 belong >0 %d bytes long,
8529: >20 belong 0 old format,
8530: #>20 belong 1 standard,
8531: >20 belong 2 compressed,
8532: >20 belong 3 RGB,
8533: >20 belong 4 TIFF,
8534: >20 belong 5 IFF,
8535: >20 belong 0xffff reserved for testing,
8536: >24 belong 0 no colormap
8537: >24 belong 1 RGB colormap
8538: >24 belong 2 raw colormap
8539: #>28 belong >0 colormap is %d bytes long
8540:
8541: # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
8542: #
8543: # See
8544: # http://reality.sgi.com/grafica/sgiimage.html
8545: #
8546: 0 beshort 474 SGI image data
8547: #>2 byte 0 \b, verbatim
8548: >2 byte 1 \b, RLE
8549: #>3 byte 1 \b, normal precision
8550: >3 byte 2 \b, high precision
8551: >4 beshort x \b, %d-D
8552: >6 beshort x \b, %d x
8553: >8 beshort x %d
8554: >10 beshort x \b, %d channel
8555: >10 beshort !1 \bs
8556: >80 string >0 \b, "%s"
8557:
8558: 0 string IT01 FIT image data
8559: >4 belong x \b, %d x
8560: >8 belong x %d x
8561: >12 belong x %d
8562: #
8563: 0 string IT02 FIT image data
8564: >4 belong x \b, %d x
8565: >8 belong x %d x
8566: >12 belong x %d
8567: #
8568: 2048 string PCD_IPI Kodak Photo CD image pack file
8569: >0xe02 byte&0x03 0x00 , landscape mode
8570: >0xe02 byte&0x03 0x01 , portrait mode
8571: >0xe02 byte&0x03 0x02 , landscape mode
8572: >0xe02 byte&0x03 0x03 , portrait mode
8573: 0 string PCD_OPA Kodak Photo CD overview pack file
8574:
8575: # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
8576: # FITS is the Flexible Image Transport System, the de facto standard for
8577: # data and image transfer, storage, etc., for the astronomical community.
8578: # (FITS floating point formats are big-endian.)
8579: 0 string SIMPLE\ \ = FITS image data
8580: >109 string 8 \b, 8-bit, character or unsigned binary integer
8581: >108 string 16 \b, 16-bit, two's complement binary integer
8582: >107 string \ 32 \b, 32-bit, two's complement binary integer
8583: >107 string -32 \b, 32-bit, floating point, single precision
8584: >107 string -64 \b, 64-bit, floating point, double precision
8585:
8586: # other images
8587: 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
8588:
8589: # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
8590: # stuff.
8591: #
8592: 0 beshort 0x1010 PEX Binary Archive
8593:
8594: # DICOM medical imaging data
8595: 128 string DICM DICOM medical imaging data
8596: !:mime application/dicom
8597:
8598: # XWD - X Window Dump file.
8599: # As described in /usr/X11R6/include/X11/XWDFile.h
8600: # used by the xwd program.
8601: # Bradford Castalia, idaeim, 1/01
1.1.1.2 ! misho 8602: # updated by Adam Buchbinder, 2/09
! 8603: # The following assumes version 7 of the format; the first long is the length
! 8604: # of the header, which is at least 25 4-byte longs, and the one at offset 8
! 8605: # is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
! 8606: # which is a maximum of 32.
! 8607: 0 belong >100
! 8608: >8 belong <3
! 8609: >>12 belong <33
! 8610: >>>4 belong 7 XWD X Window Dump image data
! 8611: !:mime image/x-xwindowdump
! 8612: >>>>100 string >\0 \b, "%s"
! 8613: >>>>16 belong x \b, %dx
! 8614: >>>>20 belong x \b%dx
! 8615: >>>>12 belong x \b%d
1.1 misho 8616:
8617: # PDS - Planetary Data System
8618: # These files use Parameter Value Language in the header section.
8619: # Unfortunately, there is no certain magic, but the following
8620: # strings have been found to be most likely.
8621: 0 string NJPL1I00 PDS (JPL) image data
8622: 2 string NJPL1I PDS (JPL) image data
8623: 0 string CCSD3ZF PDS (CCSD) image data
8624: 2 string CCSD3Z PDS (CCSD) image data
8625: 0 string PDS_ PDS image data
8626: 0 string LBLSIZE= PDS (VICAR) image data
8627:
8628: # pM8x: ATARI STAD compressed bitmap format
8629: #
8630: # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
8631: # p M 8 5/6 xx yy zz data...
8632: # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
8633: # bytes either run horizontally (pM85) or vertically (pM86). yy is the
8634: # most frequent byte, xx and zz are runlength escape codes, where xx is
8635: # used for runs of yy.
8636: #
8637: 0 string pM85 Atari ST STAD bitmap image data (hor)
8638: >5 byte 0x00 (white background)
8639: >5 byte 0xFF (black background)
8640: 0 string pM86 Atari ST STAD bitmap image data (vert)
8641: >5 byte 0x00 (white background)
8642: >5 byte 0xFF (black background)
8643:
8644: # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
8645: # http://www.atarimax.com/jindroush.atari.org/afmtatr.html
8646: 0 leshort 0x0296 Atari ATR image
8647:
8648: # XXX:
8649: # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
8650: # magic.
8651: # SGI RICE image file <mpruett@sgi.com>
8652: #0 beshort 0x5249 RICE image
8653: #>2 beshort x v%d
8654: #>4 beshort x (%d x
8655: #>6 beshort x %d)
8656: #>8 beshort 0 8 bit
8657: #>8 beshort 1 10 bit
8658: #>8 beshort 2 12 bit
8659: #>8 beshort 3 13 bit
8660: #>10 beshort 0 4:2:2
8661: #>10 beshort 1 4:2:2:4
8662: #>10 beshort 2 4:4:4
8663: #>10 beshort 3 4:4:4:4
8664: #>12 beshort 1 RGB
8665: #>12 beshort 2 CCIR601
8666: #>12 beshort 3 RP175
8667: #>12 beshort 4 YUV
8668:
8669: #------------------------------------------------------------------------------
8670: #
8671: # Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
8672: # for the EPOC operating system, which is used with PDAs like those from Psion
8673: #
8674: # see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
8675: # of various EPOC file formats
8676:
8677: 0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
8678:
8679: # PCX image files
8680: # From: Dan Fandrich <dan@coneharvesters.com>
8681: 0 beshort 0x0a00 PCX ver. 2.5 image data
8682: 0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
8683: 0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
8684: 0 beshort 0x0a04 PCX for Windows image data
8685: 0 beshort 0x0a05 PCX ver. 3.0 image data
8686: >4 leshort x bounding box [%hd,
8687: >6 leshort x %hd] -
8688: >8 leshort x [%hd,
8689: >10 leshort x %hd],
8690: >65 byte >1 %d planes each of
8691: >3 byte x %hhd-bit
8692: >68 byte 0 image,
8693: >68 byte 1 colour,
8694: >68 byte 2 grayscale,
8695: >68 byte >2 image,
8696: >68 byte <0 image,
8697: >12 leshort >0 %hd x
8698: >>14 leshort x %hd dpi,
8699: >2 byte 0 uncompressed
8700: >2 byte 1 RLE compressed
8701:
8702: # Adobe Photoshop
1.1.1.2 ! misho 8703: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
1.1 misho 8704: 0 string 8BPS Adobe Photoshop Image
8705: !:mime image/vnd.adobe.photoshop
1.1.1.2 ! misho 8706: >4 beshort 2 (PSB)
! 8707: >18 belong x \b, %d x
! 8708: >14 belong x %d,
! 8709: >24 beshort 0 bitmap
! 8710: >24 beshort 1 grayscale
! 8711: >>12 beshort 2 with alpha
! 8712: >24 beshort 2 indexed
! 8713: >24 beshort 3 RGB
! 8714: >>12 beshort 4 \bA
! 8715: >24 beshort 4 CMYK
! 8716: >>12 beshort 5 \bA
! 8717: >24 beshort 7 multichannel
! 8718: >24 beshort 8 duotone
! 8719: >24 beshort 9 lab
! 8720: >12 beshort > 1
! 8721: >>12 beshort x \b, %dx
! 8722: >12 beshort 1 \b,
! 8723: >22 beshort x %d-bit channel
! 8724: >12 beshort > 1 \bs
1.1 misho 8725:
8726: # XV thumbnail indicator (ThMO)
8727: 0 string P7\ 332 XV thumbnail image data
8728:
8729: # NITF is defined by United States MIL-STD-2500A
8730: 0 string NITF National Imagery Transmission Format
8731: >25 string >\0 dated %.14s
8732:
8733: # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
8734: 0 belong 0x00010008 GEM Image data
8735: >12 beshort x %d x
8736: >14 beshort x %d,
8737: >4 beshort x %d planes,
8738: >8 beshort x %d x
8739: >10 beshort x %d pixelsize
8740:
8741: # GEM Metafile (Wolfram Kleff)
8742: 0 lelong 0x0018FFFF GEM Metafile data
8743: >4 leshort x version %d
8744:
8745: #
8746: # SMJPEG. A custom Motion JPEG format used by Loki Entertainment
8747: # Software Torbjorn Andersson <d91tan@Update.UU.SE>.
8748: #
8749: 0 string \0\nSMJPEG SMJPEG
8750: >8 belong x %d.x data
8751: # According to the specification you could find any number of _TXT
8752: # headers here, but I can't think of any way of handling that. None of
8753: # the SMJPEG files I tried it on used this feature. Even if such a
8754: # file is encountered the output should still be reasonable.
8755: >16 string _SND \b,
8756: >>24 beshort >0 %d Hz
8757: >>26 byte 8 8-bit
8758: >>26 byte 16 16-bit
8759: >>28 string NONE uncompressed
8760: # >>28 string APCM ADPCM compressed
8761: >>27 byte 1 mono
8762: >>28 byte 2 stereo
8763: # Help! Isn't there any way to avoid writing this part twice?
8764: >>32 string _VID \b,
8765: # >>>48 string JFIF JPEG
8766: >>>40 belong >0 %d frames
8767: >>>44 beshort >0 (%d x
8768: >>>46 beshort >0 %d)
8769: >16 string _VID \b,
8770: # >>32 string JFIF JPEG
8771: >>24 belong >0 %d frames
8772: >>28 beshort >0 (%d x
8773: >>30 beshort >0 %d)
8774:
8775: 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
8776:
8777: # "thumbnail file" (icon)
8778: # descended from "xv", but in use by other applications as well (Wolfram Kleff)
8779: 0 string P7\ 332 XV "thumbnail file" (icon) data
8780:
8781: # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
8782: 0 string KiSS KISS/GS
8783: >4 byte 16 color
8784: >>5 byte x %d bit
8785: >>8 leshort x %d colors
8786: >>10 leshort x %d groups
8787: >4 byte 32 cell
8788: >>5 byte x %d bit
8789: >>8 leshort x %d x
8790: >>10 leshort x %d
8791: >>12 leshort x +%d
8792: >>14 leshort x +%d
8793:
8794: # Webshots (www.webshots.com), by John Harrison
8795: 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
8796:
8797: # Hercules DASD image files
8798: # From Jan Jaeger <jj@septa.nl>
8799: 0 string CKD_P370 Hercules CKD DASD image file
8800: >8 long x \b, %d heads per cylinder
8801: >12 long x \b, track size %d bytes
8802: >16 byte x \b, device type 33%2.2X
8803:
8804: 0 string CKD_C370 Hercules compressed CKD DASD image file
8805: >8 long x \b, %d heads per cylinder
8806: >12 long x \b, track size %d bytes
8807: >16 byte x \b, device type 33%2.2X
8808:
8809: 0 string CKD_S370 Hercules CKD DASD shadow file
8810: >8 long x \b, %d heads per cylinder
8811: >12 long x \b, track size %d bytes
8812: >16 byte x \b, device type 33%2.2X
8813:
8814: # Squeak images and programs - etoffi@softhome.net
8815: 0 string \146\031\0\0 Squeak image data
8816: 0 search/1 'From\040Squeak Squeak program text
8817:
8818: # partimage: file(1) magic for PartImage files (experimental, incomplete)
8819: # Author: Hans-Joachim Baader <hjb@pro-linux.de>
8820: 0 string PaRtImAgE-VoLuMe PartImage
8821: >0x0020 string 0.6.1 file version %s
8822: >>0x0060 lelong >-1 volume %ld
8823: #>>0x0064 8 byte identifier
8824: #>>0x007c reserved
8825: >>0x0200 string >\0 type %s
8826: >>0x1400 string >\0 device %s,
8827: >>0x1600 string >\0 original filename %s,
8828: # Some fields omitted
8829: >>0x2744 lelong 0 not compressed
8830: >>0x2744 lelong 1 gzip compressed
8831: >>0x2744 lelong 2 bzip2 compressed
8832: >>0x2744 lelong >2 compressed with unknown algorithm
8833: >0x0020 string >0.6.1 file version %s
8834: >0x0020 string <0.6.1 file version %s
8835:
8836: # DCX is multi-page PCX, using a simple header of up to 1024
8837: # offsets for the respective PCX components.
8838: # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
8839: 0 lelong 987654321 DCX multi-page PCX image data
8840:
8841: # Simon Walton <simonw@matteworld.com>
8842: # Kodak Cineon format for scanned negatives
8843: # http://www.kodak.com/US/en/motion/support/dlad/
8844: 0 lelong 0xd75f2a80 Cineon image data
8845: >200 belong >0 \b, %ld x
8846: >204 belong >0 %ld
8847:
8848:
8849: # Bio-Rad .PIC is an image format used by microscope control systems
8850: # and related image processing software used by biologists.
8851: # From: Vebjorn Ljosa <vebjorn@ljosa.com>
1.1.1.2 ! misho 8852: # BOOL values are two-byte integers; use them to rule out false positives.
! 8853: # http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
! 8854: # Samples: http://www.loci.wisc.edu/software/sample-data
! 8855: 14 leshort <2
! 8856: >62 leshort <2
! 8857: >>54 leshort 12345 Bio-Rad .PIC Image File
! 8858: >>>0 leshort >0 %hd x
! 8859: >>>2 leshort >0 %hd,
! 8860: >>>4 leshort =1 1 image in file
! 8861: >>>4 leshort >1 %hd images in file
1.1 misho 8862:
8863: # From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
8864: # The description of *.mrw format can be found at
8865: # http://www.dalibor.cz/minolta/raw_file_format.htm
8866: 0 string \000MRM Minolta Dimage camera raw image data
8867:
8868: # Summary: DjVu image / document
8869: # Extension: .djvu
8870: # Reference: http://djvu.org/docs/DjVu3Spec.djvu
8871: # Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
8872: # Modified by (1): Abel Cheung <abelcheung@gmail.com>
8873: 0 string AT&TFORM
8874: >12 string DJVM DjVu multiple page document
1.1.1.2 ! misho 8875: !:mime image/vnd.djvu
1.1 misho 8876: >12 string DJVU DjVu image or single page document
1.1.1.2 ! misho 8877: !:mime image/vnd.djvu
1.1 misho 8878: >12 string DJVI DjVu shared document
1.1.1.2 ! misho 8879: !:mime image/vnd.djvu
1.1 misho 8880: >12 string THUM DjVu page thumbnails
1.1.1.2 ! misho 8881: !:mime image/vnd.djvu
1.1 misho 8882:
8883:
8884: # From Marc Espie
8885: 0 lelong 20000630 OpenEXR image data
8886:
8887: # From: Tom Hilinski <tom.hilinski@comcast.net>
8888: # http://www.unidata.ucar.edu/packages/netcdf/
8889: 0 string CDF\001 NetCDF Data Format data
8890:
8891: #-----------------------------------------------------------------------
8892: # Hierarchical Data Format, used to facilitate scientific data exchange
8893: # specifications at http://hdf.ncsa.uiuc.edu/
8894: 0 belong 0x0e031301 Hierarchical Data Format (version 4) data
8895: !:mime application/x-hdf
8896: 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
8897: !:mime application/x-hdf
8898:
8899: # From: Tobias Burnus <burnus@net-b.de>
8900: # Xara (for a while: Corel Xara) is a graphic package, see
8901: # http://www.xara.com/ for Windows and as GPL application for Linux
8902: 0 string XARA\243\243 Xara graphics file
8903:
8904: # http://www.cartesianinc.com/Tech/
8905: 0 string CPC\262 Cartesian Perceptual Compression image
8906: !:mime image/x-cpi
8907:
8908: # From Albert Cahalan <acahalan@gmail.com>
8909: # puredigital used it for the CVS disposable camcorder
8910: #8 lelong 4 ZBM bitmap image data
8911: #>4 leshort x %u x
8912: #>6 leshort x %u
8913:
8914: # From Albert Cahalan <acahalan@gmail.com>
8915: # uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
8916: 0 string C565 OLPC firmware icon image data
8917: >4 leshort x %u x
8918: >6 leshort x %u
8919:
8920: # Applied Images - Image files from Cytovision
8921: # Gustavo Junior Alves <gjalves@gjalves.com.br>
8922: 0 string \xce\xda\xde\xfa Cytovision Metaphases file
8923: 0 string \xed\xad\xef\xac Cytovision Karyotype file
8924: 0 string \x0b\x00\x03\x00 Cytovision FISH Probe file
8925: 0 string \xed\xfe\xda\xbe Cytovision FLEX file
8926: 0 string \xed\xab\xed\xfe Cytovision FLEX file
8927: 0 string \xad\xfd\xea\xad Cytovision RATS file
8928:
8929: # Wavelet Scalar Quantization format used in gray-scale fingerprint images
8930: # From Tano M Fotang <mfotang@quanteq.com>
8931: 0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
8932:
1.1.1.2 ! misho 8933: # JPEG 2000 Code Stream Bitmap
! 8934: # From Petr Splichal <psplicha@redhat.com>
! 8935: 0 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data
! 8936:
1.1 misho 8937: # Type: Ulead Photo Explorer5 (.pe5)
8938: # URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
8939: # From: Simon Horman <horms@debian.org>
1.1.1.2 ! misho 8940: 0 string IIO2H Ulead Photo Explorer5
1.1 misho 8941:
8942: # Type: X11 cursor
8943: # URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
8944: # From: Mathias Brodala <info@noctus.net>
1.1.1.2 ! misho 8945: 0 string Xcur X11 cursor
! 8946:
! 8947: # Type: Olympus ORF raw images.
! 8948: # URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF
! 8949: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8950: 0 string MMOR Olympus ORF raw image data, big-endian
! 8951: !:mime image/x-olympus-orf
! 8952: 0 string IIRO Olympus ORF raw image data, little-endian
! 8953: !:mime image/x-olympus-orf
! 8954: 0 string IIRS Olympus ORF raw image data, little-endian
! 8955: !:mime image/x-olympus-orf
! 8956:
! 8957: # Type: files used in modern AVCHD camcoders to store clip information
! 8958: # Extension: .cpi
! 8959: # From: Alexander Danilov <alexander.a.danilov@gmail.com>
! 8960: 0 string HDMV0100 AVCHD Clip Information
! 8961:
! 8962: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8963: # URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
! 8964: # Radiance HDR; usually has .pic or .hdr extension.
! 8965: 0 string #?RADIANCE\n Radiance HDR image data
! 8966: #!mime image/vnd.radiance
! 8967:
! 8968: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8969: # URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
! 8970: # Used by the pfstools packages. The regex matches for the image size could
! 8971: # probably use some work. The MIME type is made up; if there's one in
! 8972: # actual common use, it should replace the one below.
! 8973: 0 string PFS1\x0a PFS HDR image data
! 8974: #!mime image/x-pfs
! 8975: >1 regex [0-9]*\ \b, %s
! 8976: >>1 regex \ [0-9]{4} \bx%s
! 8977:
! 8978: # Type: Foveon X3F
! 8979: # URL: http://www.photofo.com/downloads/x3f-raw-format.pdf
! 8980: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 8981: # Note that the MIME type isn't defined anywhere that I can find; if
! 8982: # there's a canonical type for this format, it should replace this one.
! 8983: 0 string FOVb Foveon X3F raw image data
! 8984: !:mime image/x-x3f
! 8985: >6 leshort x \b, version %d.
! 8986: >4 leshort x \b%d
! 8987: >28 lelong x \b, %dx
! 8988: >32 lelong x \b%d
! 8989:
! 8990: # Paint.NET file
! 8991: # From Adam Buchbinder <adam.buchbinder@gmail.com>
! 8992: 0 string PDN3 Paint.NET image data
! 8993: !:mime image/x-paintnet
1.1 misho 8994:
8995: #------------------------------------------------------------------------------
1.1.1.2 ! misho 8996: # $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 8997: # inform: file(1) magic for Inform interactive fiction language
8998:
8999: # URL: http://www.inform-fiction.org/
9000: # From: Reuben Thomas <rrt@sc3d.org>
9001:
1.1.1.2 ! misho 9002: 0 search/100/cW constant\ story Inform source text
1.1 misho 9003:
9004: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9005: # $File: intel,v 1.8 2009/09/19 16:28:10 christos Exp $
1.1 misho 9006: # intel: file(1) magic for x86 Unix
9007: #
9008: # Various flavors of x86 UNIX executable/object (other than Xenix, which
9009: # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
9010: # Windows as well.
9011: #
9012: # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
9013: # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
9014: # as well, if, as, and when IBM makes it portable.
9015: #
9016: # The `versions' should be un-commented if they work for you.
9017: # (Was the problem just one of endianness?)
9018: #
9019: 0 leshort 0502 basic-16 executable
9020: >12 lelong >0 not stripped
9021: #>22 leshort >0 - version %ld
9022: 0 leshort 0503 basic-16 executable (TV)
9023: >12 lelong >0 not stripped
9024: #>22 leshort >0 - version %ld
9025: 0 leshort 0510 x86 executable
9026: >12 lelong >0 not stripped
9027: 0 leshort 0511 x86 executable (TV)
9028: >12 lelong >0 not stripped
9029: 0 leshort =0512 iAPX 286 executable small model (COFF)
9030: >12 lelong >0 not stripped
9031: #>22 leshort >0 - version %ld
9032: 0 leshort =0522 iAPX 286 executable large model (COFF)
9033: >12 lelong >0 not stripped
9034: #>22 leshort >0 - version %ld
9035: # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
9036: 0 leshort =0514 80386 COFF executable
9037: >12 lelong >0 not stripped
9038: >22 leshort >0 - version %ld
9039:
9040: # rom: file(1) magic for BIOS ROM Extensions found in intel machines
9041: # mapped into memory between 0xC0000 and 0xFFFFF
9042: # From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
9043: 0 beshort 0x55AA BIOS (ia32) ROM Ext.
9044: >5 string USB USB
9045: >7 string LDR UNDI image
9046: >30 string IBM IBM comp. Video
9047: >26 string Adaptec Adaptec
9048: >28 string Adaptec Adaptec
9049: >42 string PROMISE Promise
9050: >2 byte x (%d*512)
9051:
9052: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9053: # $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
1.1 misho 9054: # interleaf: file(1) magic for InterLeaf TPS:
9055: #
9056: 0 string =\210OPS Interleaf saved data
9057: 0 string =<!OPS Interleaf document text
9058: >5 string ,\ Version\ = \b, version
9059: >>17 string >\0 %.3s
9060:
9061: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9062: # $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 9063: # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
9064: # "/etc/magic":
9065: # From: guy@netapp.com (Guy Harris)
9066: #
9067: 4 string pgscriptver IslandWrite document
9068: 13 string DrawFile IslandDraw document
9069:
9070:
9071: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9072: # $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
1.1 misho 9073: # ispell: file(1) magic for ispell
9074: #
9075: # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
9076: # will match 0x9600 through 0x9603 in *both* little endian and big endian.
9077: # (No other current magic entries collide.)
9078: #
9079: # Updated by Daniel Quinlan (quinlan@yggdrasil.com)
9080: #
9081: 0 leshort&0xFFFC 0x9600 little endian ispell
9082: >0 byte 0 hash file (?),
9083: >0 byte 1 3.0 hash file,
9084: >0 byte 2 3.1 hash file,
9085: >0 byte 3 hash file (?),
9086: >2 leshort 0x00 8-bit, no capitalization, 26 flags
9087: >2 leshort 0x01 7-bit, no capitalization, 26 flags
9088: >2 leshort 0x02 8-bit, capitalization, 26 flags
9089: >2 leshort 0x03 7-bit, capitalization, 26 flags
9090: >2 leshort 0x04 8-bit, no capitalization, 52 flags
9091: >2 leshort 0x05 7-bit, no capitalization, 52 flags
9092: >2 leshort 0x06 8-bit, capitalization, 52 flags
9093: >2 leshort 0x07 7-bit, capitalization, 52 flags
9094: >2 leshort 0x08 8-bit, no capitalization, 128 flags
9095: >2 leshort 0x09 7-bit, no capitalization, 128 flags
9096: >2 leshort 0x0A 8-bit, capitalization, 128 flags
9097: >2 leshort 0x0B 7-bit, capitalization, 128 flags
9098: >2 leshort 0x0C 8-bit, no capitalization, 256 flags
9099: >2 leshort 0x0D 7-bit, no capitalization, 256 flags
9100: >2 leshort 0x0E 8-bit, capitalization, 256 flags
9101: >2 leshort 0x0F 7-bit, capitalization, 256 flags
9102: >4 leshort >0 and %d string characters
9103: 0 beshort&0xFFFC 0x9600 big endian ispell
9104: >1 byte 0 hash file (?),
9105: >1 byte 1 3.0 hash file,
9106: >1 byte 2 3.1 hash file,
9107: >1 byte 3 hash file (?),
9108: >2 beshort 0x00 8-bit, no capitalization, 26 flags
9109: >2 beshort 0x01 7-bit, no capitalization, 26 flags
9110: >2 beshort 0x02 8-bit, capitalization, 26 flags
9111: >2 beshort 0x03 7-bit, capitalization, 26 flags
9112: >2 beshort 0x04 8-bit, no capitalization, 52 flags
9113: >2 beshort 0x05 7-bit, no capitalization, 52 flags
9114: >2 beshort 0x06 8-bit, capitalization, 52 flags
9115: >2 beshort 0x07 7-bit, capitalization, 52 flags
9116: >2 beshort 0x08 8-bit, no capitalization, 128 flags
9117: >2 beshort 0x09 7-bit, no capitalization, 128 flags
9118: >2 beshort 0x0A 8-bit, capitalization, 128 flags
9119: >2 beshort 0x0B 7-bit, capitalization, 128 flags
9120: >2 beshort 0x0C 8-bit, no capitalization, 256 flags
9121: >2 beshort 0x0D 7-bit, no capitalization, 256 flags
9122: >2 beshort 0x0E 8-bit, capitalization, 256 flags
9123: >2 beshort 0x0F 7-bit, capitalization, 256 flags
9124: >4 beshort >0 and %d string characters
9125: # ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
9126: # Ispell 4.0
9127: 0 string ISPL ispell
9128: >4 long x hash file version %d,
9129: >8 long x lexletters %d,
9130: >12 long x lexsize %d,
9131: >16 long x hashsize %d,
9132: >20 long x stblsize %d
1.1.1.2 ! misho 9133:
1.1 misho 9134: #------------------------------------------------------------
1.1.1.2 ! misho 9135: # $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $
1.1 misho 9136: # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
9137: # same magic number, 0xcafebabe, so they are both handled
9138: # in the entry called "cafebabe".
9139: #------------------------------------------------------------
9140: # Java serialization
9141: # From Martin Pool (m.pool@pharos.com.au)
9142: 0 beshort 0xaced Java serialization data
9143: >2 beshort >0x0004 \b, version %d
9144:
9145: 0 belong 0xfeedfeed Java KeyStore
9146: !:mime application/x-java-keystore
9147: 0 belong 0xcececece Java JCE KeyStore
9148: !:mime application/x-java-jce-keystore
9149:
9150: # Dalvik .dex format. http://retrodev.com/android/dexformat.html
9151: # From <mkf@google.com> "Mike Fleming"
9152: 0 string dex\n
9153: >0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
9154: >4 string >000 version %s
9155: 0 string dey\n
9156: >0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
9157: >4 string >000 version %s
9158:
9159:
9160: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9161: # $File: jpeg,v 1.15 2009/09/19 16:28:10 christos Exp $
1.1 misho 9162: # JPEG images
9163: # SunOS 5.5.1 had
9164: #
9165: # 0 string \377\330\377\340 JPEG file
9166: # 0 string \377\330\377\356 JPG file
9167: #
9168: # both of which turn into "JPEG image data" here.
9169: #
9170: 0 beshort 0xffd8 JPEG image data
9171: !:mime image/jpeg
1.1.1.2 ! misho 9172: !:apple 8BIMJPEG
1.1 misho 9173: !:strength +1
9174: >6 string JFIF \b, JFIF standard
9175: # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
9176: # in a vain attempt to add image size reporting for JFIF. Note that these
9177: # tests are not fool-proof since some perfectly valid JPEGs are currently
9178: # impossible to specify in magic(4) format.
9179: # First, a little JFIF version info:
9180: >>11 byte x \b %d.
9181: >>12 byte x \b%02d
9182: # Next, the resolution or aspect ratio of the image:
9183: #>>13 byte 0 \b, aspect ratio
9184: #>>13 byte 1 \b, resolution (DPI)
9185: #>>13 byte 2 \b, resolution (DPCM)
9186: #>>4 beshort x \b, segment length %d
9187: # Next, show thumbnail info, if it exists:
9188: >>18 byte !0 \b, thumbnail %dx
9189: >>>19 byte x \b%d
9190:
9191: # EXIF moved down here to avoid reporting a bogus version number,
9192: # and EXIF version number printing added.
9193: # - Patrik R=E5dman <patrik+file-magic@iki.fi>
9194: >6 string Exif \b, EXIF standard
9195: # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
9196: # All possible combinations of entries have to be enumerated, since no looping
9197: # is possible. And both endians are possible...
9198: # The combinations included below are from real-world JPEGs.
9199: # Little-endian
9200: >>12 string II
9201: # IFD 0 Entry #5:
9202: >>>70 leshort 0x8769
9203: # EXIF IFD Entry #1:
9204: >>>>(78.l+14) leshort 0x9000
9205: >>>>>(78.l+23) byte x %c
9206: >>>>>(78.l+24) byte x \b.%c
9207: >>>>>(78.l+25) byte !0x30 \b%c
9208: # IFD 0 Entry #9:
9209: >>>118 leshort 0x8769
9210: # EXIF IFD Entry #3:
9211: >>>>(126.l+38) leshort 0x9000
9212: >>>>>(126.l+47) byte x %c
9213: >>>>>(126.l+48) byte x \b.%c
9214: >>>>>(126.l+49) byte !0x30 \b%c
9215: # IFD 0 Entry #10
9216: >>>130 leshort 0x8769
9217: # EXIF IFD Entry #3:
9218: >>>>(138.l+38) leshort 0x9000
9219: >>>>>(138.l+47) byte x %c
9220: >>>>>(138.l+48) byte x \b.%c
9221: >>>>>(138.l+49) byte !0x30 \b%c
9222: # EXIF IFD Entry #4:
9223: >>>>(138.l+50) leshort 0x9000
9224: >>>>>(138.l+59) byte x %c
9225: >>>>>(138.l+60) byte x \b.%c
9226: >>>>>(138.l+61) byte !0x30 \b%c
9227: # EXIF IFD Entry #5:
9228: >>>>(138.l+62) leshort 0x9000
9229: >>>>>(138.l+71) byte x %c
9230: >>>>>(138.l+72) byte x \b.%c
9231: >>>>>(138.l+73) byte !0x30 \b%c
9232: # IFD 0 Entry #11
9233: >>>142 leshort 0x8769
9234: # EXIF IFD Entry #3:
9235: >>>>(150.l+38) leshort 0x9000
9236: >>>>>(150.l+47) byte x %c
9237: >>>>>(150.l+48) byte x \b.%c
9238: >>>>>(150.l+49) byte !0x30 \b%c
9239: # EXIF IFD Entry #4:
9240: >>>>(150.l+50) leshort 0x9000
9241: >>>>>(150.l+59) byte x %c
9242: >>>>>(150.l+60) byte x \b.%c
9243: >>>>>(150.l+61) byte !0x30 \b%c
9244: # EXIF IFD Entry #5:
9245: >>>>(150.l+62) leshort 0x9000
9246: >>>>>(150.l+71) byte x %c
9247: >>>>>(150.l+72) byte x \b.%c
9248: >>>>>(150.l+73) byte !0x30 \b%c
9249: # Big-endian
9250: >>12 string MM
9251: # IFD 0 Entry #9:
9252: >>>118 beshort 0x8769
9253: # EXIF IFD Entry #1:
9254: >>>>(126.L+14) beshort 0x9000
9255: >>>>>(126.L+23) byte x %c
9256: >>>>>(126.L+24) byte x \b.%c
9257: >>>>>(126.L+25) byte !0x30 \b%c
9258: # EXIF IFD Entry #3:
9259: >>>>(126.L+38) beshort 0x9000
9260: >>>>>(126.L+47) byte x %c
9261: >>>>>(126.L+48) byte x \b.%c
9262: >>>>>(126.L+49) byte !0x30 \b%c
9263: # IFD 0 Entry #10
9264: >>>130 beshort 0x8769
9265: # EXIF IFD Entry #3:
9266: >>>>(138.L+38) beshort 0x9000
9267: >>>>>(138.L+47) byte x %c
9268: >>>>>(138.L+48) byte x \b.%c
9269: >>>>>(138.L+49) byte !0x30 \b%c
9270: # EXIF IFD Entry #5:
9271: >>>>(138.L+62) beshort 0x9000
9272: >>>>>(138.L+71) byte x %c
9273: >>>>>(138.L+72) byte x \b.%c
9274: >>>>>(138.L+73) byte !0x30 \b%c
9275: # IFD 0 Entry #11
9276: >>>142 beshort 0x8769
9277: # EXIF IFD Entry #4:
9278: >>>>(150.L+50) beshort 0x9000
9279: >>>>>(150.L+59) byte x %c
9280: >>>>>(150.L+60) byte x \b.%c
9281: >>>>>(150.L+61) byte !0x30 \b%c
9282: # Here things get sticky. We can do ONE MORE marker segment with
9283: # indirect addressing, and that's all. It would be great if we could
9284: # do pointer arithemetic like in an assembler language. Christos?
9285: # And if there was some sort of looping construct to do searches, plus a few
9286: # named accumulators, it would be even more effective...
9287: # At least we can show a comment if no other segments got inserted before:
9288: >(4.S+5) byte 0xFE
9289: >>(4.S+8) string >\0 \b, comment: "%s"
9290: # FIXME: When we can do non-byte counted strings, we can use that to get
9291: # the string's count, and fix Debian bug #283760
9292: #>(4.S+5) byte 0xFE \b, comment
9293: #>>(4.S+6) beshort x \b length=%d
9294: #>>(4.S+8) string >\0 \b, "%s"
9295: # Or, we can show the encoding type (I've included only the three most common)
9296: # and image dimensions if we are lucky and the SOFn (image segment) is here:
9297: >(4.S+5) byte 0xC0 \b, baseline
9298: >>(4.S+6) byte x \b, precision %d
9299: >>(4.S+7) beshort x \b, %dx
9300: >>(4.S+9) beshort x \b%d
9301: >(4.S+5) byte 0xC1 \b, extended sequential
9302: >>(4.S+6) byte x \b, precision %d
9303: >>(4.S+7) beshort x \b, %dx
9304: >>(4.S+9) beshort x \b%d
9305: >(4.S+5) byte 0xC2 \b, progressive
9306: >>(4.S+6) byte x \b, precision %d
9307: >>(4.S+7) beshort x \b, %dx
9308: >>(4.S+9) beshort x \b%d
9309: # I've commented-out quantisation table reporting. I doubt anyone cares yet.
9310: #>(4.S+5) byte 0xDB \b, quantisation table
9311: #>>(4.S+6) beshort x \b length=%d
9312: #>14 beshort x \b, %d x
9313: #>16 beshort x \b %d
9314:
9315: # HSI is Handmade Software's proprietary JPEG encoding scheme
9316: 0 string hsi1 JPEG image data, HSI proprietary
9317:
9318: # From: David Santinoli <david@santinoli.com>
9319: 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
9320:
9321: # Type: JPEG 2000 codesream
9322: # From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
9323: 0 belong 0xff4fff51 JPEG 2000 codestream
9324: 45 beshort 0xff52
9325:
9326: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9327: # $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 9328: # karma: file(1) magic for Karma data files
9329: #
9330: # From <rgooch@atnf.csiro.au>
9331:
9332: 0 string KarmaRHD Version Karma Data Structure Version
9333: >16 belong x %lu
9334:
9335: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9336: # $File: kde,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 9337: # kde: file(1) magic for KDE
9338:
9339: 0 string [KDE\ Desktop\ Entry] KDE desktop entry
9340: !:mime application/x-kdelnk
9341: 0 string #\ KDE\ Config\ File KDE config file
9342: !:mime application/x-kdelnk
9343: 0 string #\ xmcd xmcd database file for kscd
9344: !:mime text/x-xmcd
1.1.1.2 ! misho 9345:
! 9346: #------------------------------------------------------------------------------
! 9347: # $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $
! 9348: # Type: Google KML, formerly Keyhole Markup Language
! 9349: # Future development of this format has been handed
! 9350: # over to the Open Geospatial Consortium.
! 9351: # http://www.opengeospatial.org/standards/kml/
! 9352: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
! 9353: 0 string \<?xml
! 9354: >20 search/400 \ xmlns=
! 9355: >>&0 regex ['"]http://earth.google.com/kml Google KML document
! 9356: !:mime application/vnd.google-earth.kml+xml
! 9357: >>>&1 string 2.0' \b, version 2.0
! 9358: >>>&1 string 2.1' \b, version 2.1
! 9359: >>>&1 string 2.2' \b, version 2.2
! 9360:
! 9361: #------------------------------------------------------------------------------
! 9362: # Type: OpenGIS KML, formerly Keyhole Markup Language
! 9363: # This standard is maintained by the
! 9364: # Open Geospatial Consortium.
! 9365: # http://www.opengeospatial.org/standards/kml/
! 9366: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
! 9367: >>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
! 9368: !:mime application/vnd.google-earth.kml+xml
! 9369: >>>&1 string 2.2 \b, version 2.2
! 9370:
! 9371: #------------------------------------------------------------------------------
! 9372: # Type: Google KML Archive (ZIP based)
! 9373: # http://code.google.com/apis/kml/documentation/kml_tut.html
! 9374: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
! 9375: 0 string PK\003\004
! 9376: >4 byte 0x14
! 9377: >>30 string doc.kml Compressed Google KML Document, including resources.
! 9378: !:mime application/vnd.google-earth.kmz
! 9379:
1.1 misho 9380: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9381: # $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 9382: # DEC SRC Virtual Paper: Lectern files
9383: # Karl M. Hegbloom <karlheg@inetarena.com>
9384: 0 string lect DEC SRC Virtual Paper Lectern file
1.1.1.2 ! misho 9385:
1.1 misho 9386: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9387: # $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 9388: # lex: file(1) magic for lex
9389: #
9390: # derived empirically, your offsets may vary!
9391: 0 search/100 yyprevious C program text (from lex)
9392: >3 search/1 >\0 for %s
9393: # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
9394: 0 search/100 generated\ by\ flex C program text (from flex)
9395: # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
9396: 0 search/1 %{ lex description text
9397:
9398: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9399: # $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
1.1 misho 9400: # lif: file(1) magic for lif
9401: #
9402: # (Daniel Quinlan <quinlan@yggdrasil.com>)
9403: #
9404: 0 beshort 0x8000 lif file
1.1.1.2 ! misho 9405:
1.1 misho 9406: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9407: # $File: linux,v 1.33 2009/10/23 16:44:59 christos Exp $
1.1 misho 9408: # linux: file(1) magic for Linux files
9409: #
9410: # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
9411: # The following basic Linux magic is useful for reference, but using
9412: # "long" magic is a better practice in order to avoid collisions.
9413: #
9414: # 2 leshort 100 Linux/i386
9415: # >0 leshort 0407 impure executable (OMAGIC)
9416: # >0 leshort 0410 pure executable (NMAGIC)
9417: # >0 leshort 0413 demand-paged executable (ZMAGIC)
9418: # >0 leshort 0314 demand-paged executable (QMAGIC)
9419: #
9420: 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
9421: >16 lelong 0 \b, stripped
9422: 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
9423: >16 lelong 0 \b, stripped
9424: 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
9425: >16 lelong 0 \b, stripped
9426: 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
9427: >16 lelong 0 \b, stripped
9428: #
9429: 0 string \007\001\000 Linux/i386 object file
9430: >20 lelong >0x1020 \b, DLL library
9431: # Linux-8086 stuff:
9432: 0 string \01\03\020\04 Linux-8086 impure executable
9433: >28 long !0 not stripped
9434: 0 string \01\03\040\04 Linux-8086 executable
9435: >28 long !0 not stripped
9436: #
9437: 0 string \243\206\001\0 Linux-8086 object file
9438: #
9439: 0 string \01\03\020\20 Minix-386 impure executable
9440: >28 long !0 not stripped
9441: 0 string \01\03\040\20 Minix-386 executable
9442: >28 long !0 not stripped
9443: # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
9444: 216 lelong 0421 Linux/i386 core file
9445: >220 string >\0 of '%s'
9446: >200 lelong >0 (signal %d)
9447: #
9448: # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
9449: # this can be overridden by the DOS executable (COM) entry
9450: 2 string LILO Linux/i386 LILO boot/chain loader
9451: #
9452: # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
1.1.1.2 ! misho 9453: # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
! 9454: # See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
! 9455: 0 leshort 0x0436 Linux/i386 PC Screen Font v1 data,
! 9456: >2 byte&0x01 0 256 characters,
! 9457: >2 byte&0x01 !0 512 characters,
! 9458: >2 byte&0x02 0 no directory,
! 9459: >2 byte&0x02 !0 Unicode directory,
1.1 misho 9460: >3 byte >0 8x%d
1.1.1.2 ! misho 9461: 0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
! 9462: >16 lelong x %d characters,
! 9463: >12 lelong&0x01 0 no directory,
! 9464: >12 lelong&0x01 !0 Unicode directory,
! 9465: >24 lelong x %d
! 9466: >28 lelong x \bx%d
! 9467:
1.1 misho 9468: # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
9469: 4086 string SWAP-SPACE Linux/i386 swap file
9470: # From: Jeff Bailey <jbailey@ubuntu.com>
9471: # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
9472: 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
9473: # according to man page of mkswap (8) March 1999
9474: # volume label and UUID Russell Coker
9475: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
9476: 4086 string SWAPSPACE2 Linux/i386 swap file (new style),
9477: >0x400 long x version %d (4K pages),
9478: >0x404 long x size %d pages,
9479: >1052 string \0 no label,
9480: >1052 string >\0 LABEL=%s,
1.1.1.2 ! misho 9481: >0x40c belong x UUID=%08x
! 9482: >0x410 beshort x \b-%04x
! 9483: >0x412 beshort x \b-%04x
! 9484: >0x414 beshort x \b-%04x
! 9485: >0x416 belong x \b-%08x
! 9486: >0x41a beshort x \b%04x
! 9487: # From Daniel Novotny <dnovotny@redhat.com>
! 9488: # swap file for PowerPC
! 9489: 65526 string SWAPSPACE2 Linux/ppc swap file
1.1 misho 9490: # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
9491: #
9492: # from Erik Troan (ewt@redhat.com) examining od dumps, so this
9493: # could be wrong
9494: # updated by David Mosberger (davidm@azstarnet.com) based on
9495: # GNU BFD and MIPS info found below.
9496: #
9497: 0 leshort 0x0183 ECOFF alpha
9498: >24 leshort 0407 executable
9499: >24 leshort 0410 pure
9500: >24 leshort 0413 demand paged
9501: >8 long >0 not stripped
9502: >8 long 0 stripped
9503: >23 leshort >0 - version %ld.
9504: #
9505: # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
9506: # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
9507: # and Nicolás Lichtmaier <nick@debian.org>
9508: # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
9509: # Linux kernel boot images (i386 arch) (Wolfram Kleff)
9510: 514 string HdrS Linux kernel
9511: >510 leshort 0xAA55 x86 boot executable
9512: >>518 leshort >0x1ff
1.1.1.2 ! misho 9513: >>>529 byte 0 zImage,
1.1 misho 9514: >>>529 byte 1 bzImage,
9515: >>>(526.s+0x200) string >\0 version %s,
9516: >>498 leshort 1 RO-rootFS,
9517: >>498 leshort 0 RW-rootFS,
9518: >>508 leshort >0 root_dev 0x%X,
9519: >>502 leshort >0 swap_dev 0x%X,
9520: >>504 leshort >0 RAMdisksize %u KB,
9521: >>506 leshort 0xFFFF Normal VGA
9522: >>506 leshort 0xFFFE Extended VGA
9523: >>506 leshort 0xFFFD Prompt for Videomode
9524: >>506 leshort >0 Video mode %d
9525: # This also matches new kernels, which were caught above by "HdrS".
9526: 0 belong 0xb8c0078e Linux kernel
9527: >0x1e3 string Loading version 1.3.79 or older
9528: >0x1e9 string Loading from prehistoric times
9529:
9530: # System.map files - Nicolás Lichtmaier <nick@debian.org>
9531: 8 search/1 \ A\ _text Linux kernel symbol map text
9532:
9533: # LSM entries - Nicolás Lichtmaier <nick@debian.org>
9534: 0 search/1 Begin3 Linux Software Map entry text
9535: 0 search/1 Begin4 Linux Software Map entry text (new format)
9536:
9537: # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
9538: 0 belong 0x4f4f4f4d User-mode Linux COW file
9539: >4 belong <3 \b, version %d
9540: >>8 string >\0 \b, backing file %s
9541: >4 belong >2 \b, version %d
9542: >>32 string >\0 \b, backing file %s
9543:
9544: ############################################################################
9545: # Linux kernel versions
9546:
9547: 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
9548: >497 leshort 0 x86 boot sector
9549: >>514 belong 0x8e of a kernel from the dawn of time!
9550: >>514 belong 0x908ed8b4 version 0.99-1.1.42
9551: >>514 belong 0x908ed8b8 for memtest86
9552:
9553: >497 leshort !0 x86 kernel
9554: >>504 leshort >0 RAMdisksize=%u KB
9555: >>502 leshort >0 swap=0x%X
9556: >>508 leshort >0 root=0x%X
9557: >>>498 leshort 1 \b-ro
9558: >>>498 leshort 0 \b-rw
9559: >>506 leshort 0xFFFF vga=normal
9560: >>506 leshort 0xFFFE vga=extended
9561: >>506 leshort 0xFFFD vga=ask
9562: >>506 leshort >0 vga=%d
9563: >>514 belong 0x908ed881 version 1.1.43-1.1.45
9564: >>514 belong 0x15b281cd
9565: >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
9566: >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
9567: >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
9568: >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
9569: >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
9570: >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
9571: >>514 string HdrS
9572: >>>518 leshort >0x1FF
9573: >>>>529 byte 0 \b, zImage
9574: >>>>529 byte 1 \b, bzImage
9575: >>>>(526.s+0x200) string >\0 \b, version %s
9576:
9577: # Linux boot sector thefts.
9578: 0 belong 0xb8c0078e Linux
9579: >0x1e6 belong 0x454c4b53 ELKS Kernel
9580: >0x1e6 belong !0x454c4b53 style boot sector
9581:
9582: ############################################################################
9583: # Linux 8086 executable
9584: 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
9585: >5 string .
9586: >>4 string >\0 \b, libc version %s
9587:
9588: 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
9589: >2 byte&0x01 !0 \b, unmapped zero page
9590: >2 byte&0x20 0 \b, impure
9591: >2 byte&0x20 !0
9592: >>2 byte&0x10 !0 \b, A_EXEC
9593: >2 byte&0x02 !0 \b, A_PAL
9594: >2 byte&0x04 !0 \b, A_NSYM
9595: >2 byte&0x08 !0 \b, A_STAND
9596: >2 byte&0x40 !0 \b, A_PURE
9597: >2 byte&0x80 !0 \b, A_TOVLY
9598: >28 long !0 \b, not stripped
9599: >37 string .
9600: >>36 string >\0 \b, libc version %s
9601:
9602: # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
9603: # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
9604: # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
9605: # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
9606:
9607: # SYSLINUX boot logo files (from 'ppmtolss16' sources)
9608: # http://syslinux.zytor.com/
9609: #
9610: 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
9611: >4 leshort x \b, width %d
9612: >6 leshort x \b, height %d
9613:
9614: 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
9615: >4 belong x version %d
9616:
9617: # SE Linux policy database
9618: # From: Mike Frysinger <vapier@gentoo.org>
9619: 0 lelong 0xf97cff8c SE Linux policy
9620: >16 lelong x v%d
9621: >20 lelong 1 MLS
9622: >24 lelong x %d symbols
9623: >28 lelong x %d ocons
9624:
9625: # Linux Logical Volume Manager (LVM)
9626: # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
9627: #
9628: # System ID, UUID and volume group name are 128 bytes long
9629: # but they should never be full and initialized with zeros...
9630: #
9631: # LVM1
9632: #
9633: 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
9634: >0x12c string >\0 , System ID: %s
9635:
9636: 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
9637: >0x12c string >\0 , System ID: %s
9638:
9639: # LVM2
9640: #
9641: # It seems that the label header can be in one the four first sector
9642: # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
9643: #
9644: # 0x200 seems to be the common case
9645:
9646: 0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
9647: # read the offset to add to the start of the header, and the header
9648: # start in 0x200
9649: >(0x214.l+0x200) string >\0 , UUID: %s
9650:
9651: 0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
9652: >(0x014.l) string >\0 , UUID: %s
9653:
9654: 0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
9655: >(0x414.l+0x400) string >\0 , UUID: %s
9656:
9657: 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
9658: >(0x614.l+0x600) string >\0 , UUID: %s
9659:
9660: # LVM snapshot
9661: # from Jason Farrel
9662: 0 string SnAp LVM Snapshot (CopyOnWrite store)
9663: >4 lelong !0 - valid,
9664: >4 lelong 0 - invalid,
9665: >8 lelong x version %d,
9666: >12 lelong x chunk_size %d
9667:
9668: # SE Linux policy database
9669: 0 lelong 0xf97cff8c SE Linux policy
9670: >16 lelong x v%d
9671: >20 lelong 1 MLS
9672: >24 lelong x %d symbols
9673: >28 lelong x %d ocons
9674:
9675: # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
9676: # Anthon van der Neut (anthon@mnt.org)
9677: 0 string LUKS\xba\xbe LUKS encrypted file,
9678: >6 beshort x ver %d
9679: >8 string x [%s,
9680: >40 string x %s,
9681: >72 string x %s]
9682: >168 string x UUID: %s
9683:
9684:
9685: # Summary: Xen saved domain file
9686: # Created by: Radek Vokal <rvokal@redhat.com>
9687: 0 string LinuxGuestRecord Xen saved domain
9688: >20 search/256 (name
9689: >>&1 string x (name %s)
9690:
9691: # Type: Xen, the virtual machine monitor
9692: # From: Radek Vokal <rvokal@redhat.com>
9693: 0 string LinuxGuestRecord Xen saved domain
9694: #>2 regex \(name\ [^)]*\) %s
9695: >20 search/256 (name (name
9696: >>&1 string x %s...)
1.1.1.2 ! misho 9697:
1.1 misho 9698: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9699: # $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
1.1 misho 9700: # lisp: file(1) magic for lisp programs
9701: #
9702: # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
9703:
9704: # updated by Joerg Jenderek
9705: # GRR: This lot is too weak
9706: #0 string ;;
9707: # windows INF files often begin with semicolon and use CRLF as line end
9708: # lisp files are mainly created on unix system with LF as line end
1.1.1.2 ! misho 9709: #>2 search/4096 !\r Lisp/Scheme program text
! 9710: #>2 search/4096 \r Windows INF file
1.1 misho 9711:
1.1.1.2 ! misho 9712: 0 search/4096 (setq\ Lisp/Scheme program text
1.1 misho 9713: !:mime text/x-lisp
1.1.1.2 ! misho 9714: 0 search/4096 (defvar\ Lisp/Scheme program text
1.1 misho 9715: !:mime text/x-lisp
1.1.1.2 ! misho 9716: 0 search/4096 (defparam\ Lisp/Scheme program text
1.1 misho 9717: !:mime text/x-lisp
1.1.1.2 ! misho 9718: 0 search/4096 (defun\ Lisp/Scheme program text
1.1 misho 9719: !:mime text/x-lisp
1.1.1.2 ! misho 9720: 0 search/4096 (autoload\ Lisp/Scheme program text
1.1 misho 9721: !:mime text/x-lisp
1.1.1.2 ! misho 9722: 0 search/4096 (custom-set-variables\ Lisp/Scheme program text
1.1 misho 9723: !:mime text/x-lisp
9724:
9725: # Emacs 18 - this is always correct, but not very magical.
9726: 0 string \012( Emacs v18 byte-compiled Lisp data
9727: !:mime application/x-elc
9728: # Emacs 19+ - ver. recognition added by Ian Springer
9729: # Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
9730: # - Chris Chittleborough <cchittleborough@yahoo.com.au>
9731: 0 string ;ELC
9732: >4 byte >18
9733: >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
9734: !:mime application/x-elc
9735:
9736: # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
9737: 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
9738: 0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
9739:
9740: 0 long 0x70768BD2 CLISP memory image data
9741: 0 long 0xD28B7670 CLISP memory image data, other endian
9742:
9743: #.com and .bin for MIT scheme
9744: 0 string \372\372\372\372 MIT scheme (library?)
9745:
9746: # From: David Allouche <david@allouche.net>
9747: 0 search/1 \<TeXmacs| TeXmacs document text
9748: !:mime text/texmacs
9749:
9750: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9751: # $File: llvm,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 9752: # llvm: file(1) magic for LLVM byte-codes
1.1.1.2 ! misho 9753: # URL: http://llvm.org/docs/BitCodeFormat.html
1.1 misho 9754: # From: Al Stone <ahs3@fc.hp.com>
9755:
9756: 0 string llvm LLVM byte-codes, uncompressed
9757: 0 string llvc0 LLVM byte-codes, null compression
9758: 0 string llvc1 LLVM byte-codes, gzip compression
9759: 0 string llvc2 LLVM byte-codes, bzip2 compression
1.1.1.2 ! misho 9760: 0 string \xde\xc0\x17\x0b LLVM bitcode, wrapper
! 9761: 0 string BC\xc0\xde LLVM bitcode
! 9762:
1.1 misho 9763: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9764: # $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 9765: # lua: file(1) magic for Lua scripting language
9766: # URL: http://www.lua.org/
9767: # From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
9768:
9769: # Lua scripts
1.1.1.2 ! misho 9770: 0 search/1/w #!\ /usr/bin/lua Lua script text executable
1.1 misho 9771: !:mime text/x-lua
1.1.1.2 ! misho 9772: 0 search/1/w #!\ /usr/local/bin/lua Lua script text executable
1.1 misho 9773: !:mime text/x-lua
9774: 0 search/1 #!/usr/bin/env\ lua Lua script text executable
9775: !:mime text/x-lua
9776: 0 search/1 #!\ /usr/bin/env\ lua Lua script text executable
9777: !:mime text/x-lua
9778:
9779: # Lua bytecode
9780: 0 string \033Lua Lua bytecode,
9781: >4 byte 0x50 version 5.0
9782: >4 byte 0x51 version 5.1
9783:
9784: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9785: # $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 9786: # luks: file(1) magic for Linux Unified Key Setup
9787: # URL: http://luks.endorphin.org/spec
9788: # From: Anthon van der Neut <anthon@mnt.org>
9789:
9790: 0 string LUKS\xba\xbe LUKS encrypted file,
9791: >6 beshort x ver %d
9792: >8 string x [%s,
9793: >40 string x %s,
9794: >72 string x %s]
9795: >168 string x UUID: %s
1.1.1.2 ! misho 9796:
1.1 misho 9797: #------------------------------------------------------------
1.1.1.2 ! misho 9798: # $File: mach,v 1.9 2009/09/19 16:28:10 christos Exp $
1.1 misho 9799: # Mach has two magic numbers, 0xcafebabe and 0xfeedface.
9800: # Unfortunately the first, cafebabe, is shared with
9801: # Java ByteCode, so they are both handled in the file "cafebabe".
9802: # The "feedface" ones are handled herein.
9803: #------------------------------------------------------------
1.1.1.2 ! misho 9804: 0 lelong&0xfffffffe 0xfeedface Mach-O
1.1 misho 9805: >0 byte 0xcf 64-bit
9806: >12 lelong 1 object
9807: >12 lelong 2 executable
9808: >12 lelong 3 fixed virtual memory shared library
9809: >12 lelong 4 core
9810: >12 lelong 5 preload executable
9811: >12 lelong 6 dynamically linked shared library
9812: >12 lelong 7 dynamic linker
9813: >12 lelong 8 bundle
9814: >12 lelong 9 dynamically linked shared library stub
9815: >12 lelong >9
9816: >>12 lelong x filetype=%ld
9817: >4 lelong <0
9818: >>4 lelong x architecture=%ld
9819: >4 lelong 1 vax
9820: >4 lelong 2 romp
9821: >4 lelong 3 architecture=3
9822: >4 lelong 4 ns32032
9823: >4 lelong 5 ns32332
9824: >4 lelong 6 m68k
9825: >4 lelong 7 i386
9826: >4 lelong 8 mips
9827: >4 lelong 9 ns32532
9828: >4 lelong 10 architecture=10
9829: >4 lelong 11 hppa
9830: >4 lelong 12 acorn
9831: >4 lelong 13 m88k
9832: >4 lelong 14 sparc
9833: >4 lelong 15 i860-big
9834: >4 lelong 16 i860
9835: >4 lelong 17 rs6000
9836: >4 lelong 18 ppc
9837: >4 lelong 16777234 ppc64
9838: >4 lelong >16777234
9839: >>4 lelong x architecture=%ld
9840: #
9841: 0 belong&0xfffffffe 0xfeedface Mach-O
9842: >3 byte 0xcf 64-bit
9843: >12 belong 1 object
9844: >12 belong 2 executable
9845: >12 belong 3 fixed virtual memory shared library
9846: >12 belong 4 core
9847: >12 belong 5 preload executable
9848: >12 belong 6 dynamically linked shared library
9849: >12 belong 7 dynamic linker
9850: >12 belong 8 bundle
9851: >12 belong 9 dynamically linked shared library stub
9852: >12 belong >9
9853: >>12 belong x filetype=%ld
9854: >4 belong <0
9855: >>4 belong x architecture=%ld
9856: >4 belong 1 vax
9857: >4 belong 2 romp
9858: >4 belong 3 architecture=3
9859: >4 belong 4 ns32032
9860: >4 belong 5 ns32332
9861: >4 belong 6 for m68k architecture
9862: # from NeXTstep 3.0 <mach/machine.h>
9863: # i.e. mc680x0_all, ignore
9864: # >>8 belong 1 (mc68030)
9865: >>8 belong 2 (mc68040)
9866: >>8 belong 3 (mc68030 only)
9867: >4 belong 7 i386
9868: >4 belong 8 mips
9869: >4 belong 9 ns32532
9870: >4 belong 10 architecture=10
9871: >4 belong 11 hppa
9872: >4 belong 12 acorn
9873: >4 belong 13 m88k
9874: >4 belong 14 sparc
9875: >4 belong 15 i860-big
9876: >4 belong 16 i860
9877: >4 belong 17 rs6000
9878: >4 belong 18 ppc
9879: >4 belong 16777234 ppc64
9880: >4 belong >16777234
9881: >>4 belong x architecture=%ld
9882:
9883: #------------------------------------------------------------------------------
1.1.1.2 ! misho 9884: # $File: macintosh,v 1.20 2009/09/19 16:28:10 christos Exp $
1.1 misho 9885: # macintosh description
9886: #
9887: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
9888: # Daniel Quinlan, quinlan@yggdrasil.com
9889: 11 string must\ be\ converted\ with\ BinHex BinHex binary text
9890: !:mime application/mac-binhex40
9891: >41 string x \b, version %.3s
9892:
9893: # Stuffit archives are the de facto standard of compression for Macintosh
9894: # files obtained from most archives. (franklsm@tuns.ca)
9895: 0 string SIT! StuffIt Archive (data)
1.1.1.2 ! misho 9896: !:mime application/x-stuffit
! 9897: !:apple SIT!SIT!
1.1 misho 9898: >2 string x : %s
9899: 0 string SITD StuffIt Deluxe (data)
9900: >2 string x : %s
9901: 0 string Seg StuffIt Deluxe Segment (data)
9902: >2 string x : %s
9903:
9904: # Newer StuffIt archives (grant@netbsd.org)
9905: 0 string StuffIt StuffIt Archive
9906: !:mime application/x-stuffit
1.1.1.2 ! misho 9907: !:apple SIT!SIT!
1.1 misho 9908: #>162 string >0 : %s
9909:
9910: # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
9911: # GRR: Too weak
9912: #0 string APPL Macintosh Application (data)
9913: #>2 string x \b: %s
9914:
9915: # Macintosh System files (franklsm@tuns.ca)
9916: # GRR: Too weak
9917: #0 string zsys Macintosh System File (data)
9918: #0 string FNDR Macintosh Finder (data)
9919: #0 string libr Macintosh Library (data)
9920: #>2 string x : %s
9921: #0 string shlb Macintosh Shared Library (data)
9922: #>2 string x : %s
9923: #0 string cdev Macintosh Control Panel (data)
9924: #>2 string x : %s
9925: #0 string INIT Macintosh Extension (data)
9926: #>2 string x : %s
9927: #0 string FFIL Macintosh Truetype Font (data)
9928: #>2 string x : %s
9929: #0 string LWFN Macintosh Postscript Font (data)
9930: #>2 string x : %s
9931:
9932: # Additional Macintosh Files (franklsm@tuns.ca)
9933: # GRR: Too weak
9934: #0 string PACT Macintosh Compact Pro Archive (data)
9935: #>2 string x : %s
9936: #0 string ttro Macintosh TeachText File (data)
9937: #>2 string x : %s
9938: #0 string TEXT Macintosh TeachText File (data)
9939: #>2 string x : %s
9940: #0 string PDF Macintosh PDF File (data)
9941: #>2 string x : %s
9942:
9943: # MacBinary format (Eric Fischer, enf@pobox.com)
9944: #
9945: # Unfortunately MacBinary doesn't really have a magic number prior
9946: # to the MacBinary III format. The checksum is really the way to
9947: # do it, but the magic file format isn't up to the challenge.
9948: #
9949: # 0 byte 0
9950: # 1 byte # filename length
9951: # 2 string # filename
9952: # 65 string # file type
9953: # 69 string # file creator
9954: # 73 byte # Finder flags
9955: # 74 byte 0
9956: # 75 beshort # vertical posn in window
9957: # 77 beshort # horiz posn in window
9958: # 79 beshort # window or folder ID
9959: # 81 byte # protected?
9960: # 82 byte 0
9961: # 83 belong # length of data segment
9962: # 87 belong # length of resource segment
9963: # 91 belong # file creation date
9964: # 95 belong # file modification date
9965: # 99 beshort # length of comment after resource
9966: # 101 byte # new Finder flags
9967: # 102 string mBIN # (only in MacBinary III)
9968: # 106 byte # char. code of file name
9969: # 107 byte # still more Finder flags
9970: # 116 belong # total file length
9971: # 120 beshort # length of add'l header
9972: # 122 byte 129 # for MacBinary II
9973: # 122 byte 130 # for MacBinary III
9974: # 123 byte 129 # minimum version that can read fmt
9975: # 124 beshort # checksum
9976: #
9977: # This attempts to use the version numbers as a magic number, requiring
9978: # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
9979: # be 0x81. This works for the files I have, but maybe not for everyone's.
9980:
9981: # Unfortunately, this magic is quite weak - MPi
9982: #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
9983:
9984: # MacBinary I doesn't have the version number field at all, but MacBinary II
9985: # has been in use since 1987 so I hope there aren't many really old files
9986: # floating around that this will miss. The original spec calls for using
9987: # the nulls in 0, 74, and 82 as the magic number.
9988: #
9989: # Another possibility, that would also work for MacBinary I, is to use
9990: # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
9991: # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
9992: # and that 74 will be 0. So something like
9993: #
9994: # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
9995: #
9996: # >73 byte&0x01 0x01 \b, inited
9997: # >73 byte&0x02 0x02 \b, changed
9998: # >73 byte&0x04 0x04 \b, busy
9999: # >73 byte&0x08 0x08 \b, bozo
10000: # >73 byte&0x10 0x10 \b, system
10001: # >73 byte&0x10 0x20 \b, bundle
10002: # >73 byte&0x10 0x40 \b, invisible
10003: # >73 byte&0x10 0x80 \b, locked
10004:
10005: #>65 string x \b, type "%4.4s"
10006:
10007: #>65 string 8BIM (PhotoShop)
10008: #>65 string ALB3 (PageMaker 3)
10009: #>65 string ALB4 (PageMaker 4)
10010: #>65 string ALT3 (PageMaker 3)
10011: #>65 string APPL (application)
10012: #>65 string AWWP (AppleWorks word processor)
10013: #>65 string CIRC (simulated circuit)
10014: #>65 string DRWG (MacDraw)
10015: #>65 string EPSF (Encapsulated PostScript)
10016: #>65 string FFIL (font suitcase)
10017: #>65 string FKEY (function key)
10018: #>65 string FNDR (Macintosh Finder)
10019: #>65 string GIFf (GIF image)
10020: #>65 string Gzip (GNU gzip)
10021: #>65 string INIT (system extension)
10022: #>65 string LIB\ (library)
10023: #>65 string LWFN (PostScript font)
10024: #>65 string MSBC (Microsoft BASIC)
10025: #>65 string PACT (Compact Pro archive)
10026: #>65 string PDF\ (Portable Document Format)
10027: #>65 string PICT (picture)
10028: #>65 string PNTG (MacPaint picture)
10029: #>65 string PREF (preferences)
10030: #>65 string PROJ (Think C project)
10031: #>65 string QPRJ (Think Pascal project)
10032: #>65 string SCFL (Defender scores)
10033: #>65 string SCRN (startup screen)
10034: #>65 string SITD (StuffIt Deluxe)
10035: #>65 string SPn3 (SuperPaint)
10036: #>65 string STAK (HyperCard stack)
10037: #>65 string Seg\ (StuffIt segment)
10038: #>65 string TARF (Unix tar archive)
10039: #>65 string TEXT (ASCII)
10040: #>65 string TIFF (TIFF image)
10041: #>65 string TOVF (Eudora table of contents)
10042: #>65 string WDBN (Microsoft Word word processor)
10043: #>65 string WORD (MacWrite word processor)
10044: #>65 string XLS\ (Microsoft Excel)
10045: #>65 string ZIVM (compress (.Z))
10046: #>65 string ZSYS (Pre-System 7 system file)
10047: #>65 string acf3 (Aldus FreeHand)
10048: #>65 string cdev (control panel)
10049: #>65 string dfil (Desk Acessory suitcase)
10050: #>65 string libr (library)
10051: #>65 string nX^d (WriteNow word processor)
10052: #>65 string nX^w (WriteNow dictionary)
10053: #>65 string rsrc (resource)
10054: #>65 string scbk (Scrapbook)
10055: #>65 string shlb (shared library)
10056: #>65 string ttro (SimpleText read-only)
10057: #>65 string zsys (system file)
10058:
10059: #>69 string x \b, creator "%4.4s"
10060:
10061: # Somewhere, Apple has a repository of registered Creator IDs. These are
10062: # just the ones that I happened to have files from and was able to identify.
10063:
10064: #>69 string 8BIM (Adobe Photoshop)
10065: #>69 string ALD3 (PageMaker 3)
10066: #>69 string ALD4 (PageMaker 4)
10067: #>69 string ALFA (Alpha editor)
10068: #>69 string APLS (Apple Scanner)
10069: #>69 string APSC (Apple Scanner)
10070: #>69 string BRKL (Brickles)
10071: #>69 string BTFT (BitFont)
10072: #>69 string CCL2 (Common Lisp 2)
10073: #>69 string CCL\ (Common Lisp)
10074: #>69 string CDmo (The Talking Moose)
10075: #>69 string CPCT (Compact Pro)
10076: #>69 string CSOm (Eudora)
10077: #>69 string DMOV (Font/DA Mover)
10078: #>69 string DSIM (DigSim)
10079: #>69 string EDIT (Macintosh Edit)
10080: #>69 string ERIK (Macintosh Finder)
10081: #>69 string EXTR (self-extracting archive)
10082: #>69 string Gzip (GNU gzip)
10083: #>69 string KAHL (Think C)
10084: #>69 string LWFU (LaserWriter Utility)
10085: #>69 string LZIV (compress)
10086: #>69 string MACA (MacWrite)
10087: #>69 string MACS (Macintosh operating system)
10088: #>69 string MAcK (MacKnowledge terminal emulator)
10089: #>69 string MLND (Defender)
10090: #>69 string MPNT (MacPaint)
10091: #>69 string MSBB (Microsoft BASIC (binary))
10092: #>69 string MSWD (Microsoft Word)
10093: #>69 string NCSA (NCSA Telnet)
10094: #>69 string PJMM (Think Pascal)
10095: #>69 string PSAL (Hunt the Wumpus)
10096: #>69 string PSI2 (Apple File Exchange)
10097: #>69 string R*ch (BBEdit)
10098: #>69 string RMKR (Resource Maker)
10099: #>69 string RSED (Resource Editor)
10100: #>69 string Rich (BBEdit)
10101: #>69 string SIT! (StuffIt)
10102: #>69 string SPNT (SuperPaint)
10103: #>69 string Unix (NeXT Mac filesystem)
10104: #>69 string VIM! (Vim editor)
10105: #>69 string WILD (HyperCard)
10106: #>69 string XCEL (Microsoft Excel)
10107: #>69 string aCa2 (Fontographer)
10108: #>69 string aca3 (Aldus FreeHand)
10109: #>69 string dosa (Macintosh MS-DOS file system)
10110: #>69 string movr (Font/DA Mover)
10111: #>69 string nX^n (WriteNow)
10112: #>69 string pdos (Apple ProDOS file system)
10113: #>69 string scbk (Scrapbook)
10114: #>69 string ttxt (SimpleText)
10115: #>69 string ufox (Foreign File Access)
10116:
10117: # Just in case...
10118:
10119: 102 string mBIN MacBinary III data with surprising version number
10120:
10121: # sas magic from Bruce Foster (bef@nwu.edu)
10122: #
10123: #0 string SAS SAS
10124: #>8 string x %s
10125: 0 string SAS SAS
10126: >24 string DATA data file
10127: >24 string CATALOG catalog
10128: >24 string INDEX data file index
10129: >24 string VIEW data view
10130: # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
10131: #
10132: 0x54 string SAS SAS 7+
10133: >0x9C string DATA data file
10134: >0x9C string CATALOG catalog
10135: >0x9C string INDEX data file index
10136: >0x9C string VIEW data view
10137:
10138: # spss magic for SPSS system and portable files,
10139: # from Bruce Foster (bef@nwu.edu).
10140:
10141: 0 long 0xc1e2c3c9 SPSS Portable File
10142: >40 string x %s
10143:
10144: 0 string $FL2 SPSS System File
10145: >24 string x %s
10146:
10147: # Macintosh filesystem data
10148: # From "Tom N Harris" <telliamed@mac.com>
10149: # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
10150: # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
10151: # entries depend on the data arithmetic added after v.35
10152: # There's also some Pascal strings in here, ditto...
10153:
10154: # The boot block signature, according to IM:Files, is
10155: # "for HFS volumes, this field always contains the value 0x4C4B."
10156: # But if this is true for MFS or HFS+ volumes, I don't know.
10157: # Alternatively, the boot block is supposed to be zeroed if it's
10158: # unused, so a simply >0 should suffice.
10159:
10160: 0x400 beshort 0xD2D7 Macintosh MFS data
10161: >0 beshort 0x4C4B (bootable)
10162: >0x40a beshort &0x8000 (locked)
10163: >0x402 beldate-0x7C25B080 x created: %s,
10164: >0x406 beldate-0x7C25B080 >0 last backup: %s,
10165: >0x414 belong x block size: %d,
10166: >0x412 beshort x number of blocks: %d,
10167: >0x424 pstring x volume name: %s
10168:
10169: # "BD" is has many false positives
10170: #0x400 beshort 0x4244 Macintosh HFS data
10171: #>0 beshort 0x4C4B (bootable)
10172: #>0x40a beshort &0x8000 (locked)
10173: #>0x40a beshort ^0x0100 (mounted)
10174: #>0x40a beshort &0x0200 (spared blocks)
10175: #>0x40a beshort &0x0800 (unclean)
10176: #>0x47C beshort 0x482B (Embedded HFS+ Volume)
10177: #>0x402 beldate-0x7C25B080 x created: %s,
10178: #>0x406 beldate-0x7C25B080 x last modified: %s,
10179: #>0x440 beldate-0x7C25B080 >0 last backup: %s,
10180: #>0x414 belong x block size: %d,
10181: #>0x412 beshort x number of blocks: %d,
10182: #>0x424 pstring x volume name: %s
10183:
10184: 0x400 beshort 0x482B Macintosh HFS Extended
10185: >&0 beshort x version %d data
10186: >0 beshort 0x4C4B (bootable)
10187: >0x404 belong ^0x00000100 (mounted)
10188: >&2 belong &0x00000200 (spared blocks)
10189: >&2 belong &0x00000800 (unclean)
10190: >&2 belong &0x00008000 (locked)
10191: >&6 string x last mounted by: '%.4s',
10192: # really, that should be treated as a belong and we print a string
10193: # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
10194: >&14 beldate-0x7C25B080 x created: %s,
10195: # only the creation date is local time, all other timestamps in HFS+ are UTC.
10196: >&18 bedate-0x7C25B080 x last modified: %s,
10197: >&22 bedate-0x7C25B080 >0 last backup: %s,
10198: >&26 bedate-0x7C25B080 >0 last checked: %s,
10199: >&38 belong x block size: %d,
10200: >&42 belong x number of blocks: %d,
10201: >&46 belong x free blocks: %d
10202:
10203: # I don't think this is really necessary since it doesn't do much and
10204: # anything with a valid driver descriptor will also have a valid
10205: # partition map
10206: #0 beshort 0x4552 Apple Device Driver data
10207: #>&24 beshort =1 \b, MacOS
10208:
10209: # Is that the partition type a cstring or a pstring? Well, IM says "strings
10210: # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
10211: # cstring. Of course, partitions can contain more than four entries, but
10212: # what're you gonna do?
10213: # GRR: This magic is too weak, it is just "PM"
10214: #0x200 beshort 0x504D Apple Partition data
10215: #>0x2 beshort x (block size: %d):
10216: #>0x230 string x first type: %s,
10217: #>0x210 string x name: %s,
10218: #>0x254 belong x number of blocks: %d,
10219: #>0x400 beshort 0x504D
10220: #>>0x430 string x second type: %s,
10221: #>>0x410 string x name: %s,
10222: #>>0x454 belong x number of blocks: %d,
10223: #>>0x600 beshort 0x504D
10224: #>>>0x630 string x third type: %s,
10225: #>>>0x610 string x name: %s,
10226: #>>>0x654 belong x number of blocks: %d,
10227: #>>0x800 beshort 0x504D
10228: #>>>0x830 string x fourth type: %s,
10229: #>>>0x810 string x name: %s,
10230: #>>>0x854 belong x number of blocks: %d,
10231: #>>>0xa00 beshort 0x504D
10232: #>>>>0xa30 string x fifth type: %s,
10233: #>>>>0xa10 string x name: %s,
10234: #>>>>0xa54 belong x number of blocks: %d
10235: #>>>0xc00 beshort 0x504D
10236: #>>>>0xc30 string x sixth type: %s,
10237: #>>>>0xc10 string x name: %s,
10238: #>>>>0xc54 belong x number of blocks: %d
10239: ## AFAIK, only the signature is different
10240: #0x200 beshort 0x5453 Apple Old Partition data
10241: #>0x2 beshort x block size: %d,
10242: #>0x230 string x first type: %s,
10243: #>0x210 string x name: %s,
10244: #>0x254 belong x number of blocks: %d,
10245: #>0x400 beshort 0x504D
10246: #>>0x430 string x second type: %s,
10247: #>>0x410 string x name: %s,
10248: #>>0x454 belong x number of blocks: %d,
10249: #>>0x800 beshort 0x504D
10250: #>>>0x830 string x third type: %s,
10251: #>>>0x810 string x name: %s,
10252: #>>>0x854 belong x number of blocks: %d,
10253: #>>>0xa00 beshort 0x504D
10254: #>>>>0xa30 string x fourth type: %s,
10255: #>>>>0xa10 string x name: %s,
10256: #>>>>0xa54 belong x number of blocks: %d
10257:
10258: # From: Remi Mommsen <mommsen@slac.stanford.edu>
10259: 0 string BOMStore Mac OS X bill of materials (BOM) file
10260:
1.1.1.2 ! misho 10261: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 10262: # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
! 10263: # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
! 10264: # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
! 10265: # don't know what they mean.
! 10266: 0 belong 0x100
! 10267: >(0x4.L+24) beshort x
! 10268: >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
! 10269: >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
! 10270: >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
! 10271: >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
! 10272:
1.1 misho 10273: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10274: # $File: magic,v 1.9 2009/09/19 16:28:10 christos Exp $
1.1 misho 10275: # magic: file(1) magic for magic files
10276: #
10277: 0 string #\ Magic magic text file for file(1) cmd
10278: 0 lelong 0xF11E041C magic binary file for file(1) cmd
10279: >4 lelong x (version %d) (little endian)
10280: 0 belong 0xF11E041C magic binary file for file(1) cmd
10281: >4 belong x (version %d) (big endian)
1.1.1.2 ! misho 10282:
1.1 misho 10283: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10284: # $File: mail.news,v 1.17 2009/09/19 16:28:10 christos Exp $
1.1 misho 10285: # mail.news: file(1) magic for mail and news
10286: #
10287: # Unfortunately, saved netnews also has From line added in some news software.
10288: #0 string From mail text
10289: # There are tests to ascmagic.c to cope with mail and news.
10290: 0 string Relay-Version: old news text
10291: !:mime message/rfc822
10292: 0 string #!\ rnews batched news text
10293: !:mime message/rfc822
10294: 0 string N#!\ rnews mailed, batched news text
10295: !:mime message/rfc822
10296: 0 string Forward\ to mail forwarding text
10297: !:mime message/rfc822
10298: 0 string Pipe\ to mail piping text
10299: !:mime message/rfc822
10300: 0 string Return-Path: smtp mail text
10301: !:mime message/rfc822
10302: 0 string Path: news text
10303: !:mime message/news
10304: 0 string Xref: news text
10305: !:mime message/news
10306: 0 string From: news or mail text
10307: !:mime message/rfc822
10308: 0 string Article saved news text
10309: !:mime message/news
10310: 0 string BABYL Emacs RMAIL text
10311: 0 string Received: RFC 822 mail text
10312: !:mime message/rfc822
10313: 0 string MIME-Version: MIME entity text
10314: #0 string Content- MIME entity text
10315:
10316: # TNEF files...
10317: 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
10318:
10319: # From: Kevin Sullivan <ksulliva@psc.edu>
10320: 0 string *mbx* MBX mail folder
10321:
10322: # From: Simon Matter <simon.matter@invoca.ch>
10323: 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
10324:
10325: # JAM(mbp) Fidonet message area databases
10326: # JHR file
10327: 0 string JAM\0 JAM message area header file
10328: >12 leshort >0 (%d messages)
10329:
10330: # Squish Fidonet message area databases
10331: # SQD file (requires at least one message in the area)
10332: # XXX: Weak magic
10333: #256 leshort 0xAFAE4453 Squish message area data file
10334: #>4 leshort >0 (%d messages)
10335:
10336: #0 string \<!--\ MHonArc text/html; x-type=mhonarc
10337:
10338: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10339: # $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 10340: # maple: file(1) magic for maple files
10341: # "H. Nanosecond" <aldomel@ix.netcom.com>
10342: # Maple V release 4, a multi-purpose math program
10343: #
10344:
10345: # maple library .lib
10346: 0 string \000MVR4\nI MapleVr4 library
10347:
10348: # .ind
10349: # no magic for these :-(
10350: # they are compiled indexes for maple files
10351:
10352: # .hdb
10353: 0 string \000\004\000\000 Maple help database
10354:
10355: # .mhp
10356: # this has the form <PACKAGE=name>
10357: 0 string \<PACKAGE= Maple help file
10358: 0 string \<HELP\ NAME= Maple help file
10359: 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
10360: #0 string #\ Newton Maple help file, old style
10361: 0 string #\ daub Maple help file, old style
10362: #0 string #=========== Maple help file, old style
10363:
10364: # .mws
10365: 0 string \000\000\001\044\000\221 Maple worksheet
10366: #this is anomalous
10367: 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
10368: # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
10369: # that is {VERSION major_version miunor_version computer_type version_string}
10370: 0 string {VERSION\ Maple worksheet
10371: >9 string >\0 version %.1s.
10372: >>>11 string >\0 %.1s
10373:
10374: # .mps
10375: 0 string \0\0\001$ Maple something
10376: # from byte 4 it is either 'nul E' or 'soh R'
10377: # I think 'nul E' means a file that was saved as a different name
10378: # a sort of revision marking
10379: # 'soh R' means new
10380: >4 string \000\105 An old revision
10381: >4 string \001\122 The latest save
10382:
10383: # .mpl
10384: # some of these are the same as .mps above
10385: #0000000 000 000 001 044 000 105 same as .mps
10386: #0000000 000 000 001 044 001 122 same as .mps
10387:
10388: 0 string #\n##\ <SHAREFILE= Maple something
10389: 0 string \n#\n##\ <SHAREFILE= Maple something
10390: 0 string ##\ <SHAREFILE= Maple something
10391: 0 string #\r##\ <SHAREFILE= Maple something
10392: 0 string \r#\r##\ <SHAREFILE= Maple something
10393: 0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
10394:
10395: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10396: # $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 10397: # mathcad: file(1) magic for Mathcad documents
10398: # URL: http://www.mathsoft.com/
10399: # From: Josh Triplett <josh@freedesktop.org>
10400:
10401: 0 string .MCAD\t Mathcad document
1.1.1.2 ! misho 10402:
1.1 misho 10403: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10404: # $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
1.1 misho 10405: # mathematica: file(1) magic for mathematica files
10406: # "H. Nanosecond" <aldomel@ix.netcom.com>
10407: # Mathematica a multi-purpose math program
10408: # versions 2.2 and 3.0
10409:
10410: #mathematica .mb
10411: 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
10412: 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
10413:
10414: # .ma
10415: # multiple possibilites:
10416:
10417: 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
10418: #>41 string >\0 %s
10419:
10420: #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
10421:
10422: #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
10423: #>675 string >\0 %s #doesn't work well
10424:
10425: # there may be 'cr' instread of 'nl' in some does this matter?
10426:
10427: # generic:
10428: 0 string (*^\r\r::[\011 Mathematica notebook version 2.x
10429: 0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
10430: 0 string (*^\015 Mathematica notebook version 2.x
10431: 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
10432: 0 string (*^\r::[\011 Mathematica notebook version 2.x
10433: 0 string (*^\r\n::[\011 Mathematica notebook version 2.x
10434: 0 string (*^\n\n::[\011 Mathematica notebook version 2.x
10435: 0 string (*^\n::[\011 Mathematica notebook version 2.x
10436:
10437:
10438: # Mathematica .mx files
10439:
10440: #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
10441: 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
10442: #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
10443: # >71... is optional
10444: >88 string >\0 from %s
10445:
10446:
10447: # Mathematica files PBF:
10448: # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
10449: 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
10450:
10451: # .ml files These are menu resources I think
10452: # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
10453: # how to put that into a magic rule?
10454: 4 string \ A~ MAthematica .ml file
10455:
10456: # .nb files
10457: #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
10458: 0 string (*********************** Mathematica 3.0 notebook
10459:
10460: # other (* matches it is a comment start in these langs
10461: # GRR: Too weak; also matches other languages e.g. ML
10462: #0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
10463:
10464: #########################
10465: # MatLab v5
10466: 0 string MATLAB Matlab v5 mat-file
10467: >126 short 0x494d (big endian)
10468: >>124 beshort x version 0x%04x
10469: >126 short 0x4d49 (little endian)
10470: >>124 leshort x version 0x%04x
10471:
10472:
10473: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10474: # $File: matroska,v 1.5 2009/09/27 19:02:12 christos Exp $
1.1 misho 10475: # matroska: file(1) magic for Matroska files
10476: #
10477: # See http://www.matroska.org/
10478: #
10479:
10480: # EBML id:
10481: 0 belong 0x1a45dfa3
10482: # DocType id:
10483: >5 beshort 0x4282
10484: # DocType contents:
10485: >>8 string matroska Matroska data
1.1.1.2 ! misho 10486: !:mime video/x-matroska
1.1 misho 10487:
10488: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10489: # $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 10490: # Mavroyanopoulos Nikos <nmav@hellug.gr>
10491: # mcrypt: file(1) magic for mcrypt 2.2.x;
10492: 0 string \0m\3 mcrypt 2.5 encrypted data,
10493: >4 string >\0 algorithm: %s,
10494: >>&1 leshort >0 keysize: %d bytes,
10495: >>>&0 string >\0 mode: %s,
10496:
10497: 0 string \0m\2 mcrypt 2.2 encrypted data,
10498: >3 byte 0 algorithm: blowfish-448,
10499: >3 byte 1 algorithm: DES,
10500: >3 byte 2 algorithm: 3DES,
10501: >3 byte 3 algorithm: 3-WAY,
10502: >3 byte 4 algorithm: GOST,
10503: >3 byte 6 algorithm: SAFER-SK64,
10504: >3 byte 7 algorithm: SAFER-SK128,
10505: >3 byte 8 algorithm: CAST-128,
10506: >3 byte 9 algorithm: xTEA,
10507: >3 byte 10 algorithm: TWOFISH-128,
10508: >3 byte 11 algorithm: RC2,
10509: >3 byte 12 algorithm: TWOFISH-192,
10510: >3 byte 13 algorithm: TWOFISH-256,
10511: >3 byte 14 algorithm: blowfish-128,
10512: >3 byte 15 algorithm: blowfish-192,
10513: >3 byte 16 algorithm: blowfish-256,
10514: >3 byte 100 algorithm: RC6,
10515: >3 byte 101 algorithm: IDEA,
10516: >4 byte 0 mode: CBC,
10517: >4 byte 1 mode: ECB,
10518: >4 byte 2 mode: CFB,
10519: >4 byte 3 mode: OFB,
10520: >4 byte 4 mode: nOFB,
10521: >5 byte 0 keymode: 8bit
10522: >5 byte 1 keymode: 4bit
10523: >5 byte 2 keymode: SHA-1 hash
10524: >5 byte 3 keymode: MD5 hash
10525:
10526: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10527: # $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 10528: # mercurial: file(1) magic for Mercurial changeset bundles
10529: # http://www.selenic.com/mercurial/wiki/
10530: #
10531: # Jesse Glick (jesse.glick@sun.com)
10532: #
10533:
10534: 0 string HG10 Mercurial changeset bundle
10535: >4 string UN (uncompressed)
10536: >4 string GZ (gzip compressed)
10537: >4 string BZ (bzip2 compressed)
1.1.1.2 ! misho 10538:
1.1 misho 10539: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10540: # $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 10541: # mime: file(1) magic for MIME encoded files
10542: #
10543: 0 string Content-Type:\
10544: >14 string >\0 %s
10545: 0 string Content-Type:
10546: >13 string >\0 %s
10547:
10548: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10549: # $File: mips,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 10550: # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
10551: # Dec Ultrix (MIPS)
10552: # all of SGI's *current* machines and OSes run in big-endian mode on the
10553: # MIPS machines, as far as I know.
10554: #
10555: # XXX - what is the blank "-" line?
10556: #
10557: # kbd file definitions
10558: 0 string kbd!map kbd map file
10559: >8 byte >0 Ver %d:
10560: >10 short >0 with %d table(s)
10561: 0 belong 0407 old SGI 68020 executable
10562: 0 belong 0410 old SGI 68020 pure executable
10563: 0 beshort 0x8765 disk quotas file
10564: 0 beshort 0x0506 IRIS Showcase file
10565: >2 byte 0x49 -
10566: >3 byte x - version %ld
10567: 0 beshort 0x0226 IRIS Showcase template
10568: >2 byte 0x63 -
10569: >3 byte x - version %ld
10570: 0 belong 0x5343464d IRIS Showcase file
10571: >4 byte x - version %ld
10572: 0 belong 0x5443464d IRIS Showcase template
10573: >4 byte x - version %ld
10574: 0 belong 0xdeadbabe IRIX Parallel Arena
10575: >8 belong >0 - version %ld
10576: #
10577: 0 beshort 0x0160 MIPSEB ECOFF executable
10578: >20 beshort 0407 (impure)
10579: >20 beshort 0410 (swapped)
10580: >20 beshort 0413 (paged)
10581: >8 belong >0 not stripped
10582: >8 belong 0 stripped
10583: >22 byte x - version %ld
10584: >23 byte x .%ld
10585: #
10586: 0 beshort 0x0162 MIPSEL-BE ECOFF executable
10587: >20 beshort 0407 (impure)
10588: >20 beshort 0410 (swapped)
10589: >20 beshort 0413 (paged)
10590: >8 belong >0 not stripped
10591: >8 belong 0 stripped
10592: >23 byte x - version %d
10593: >22 byte x .%ld
10594: #
10595: 0 beshort 0x6001 MIPSEB-LE ECOFF executable
10596: >20 beshort 03401 (impure)
10597: >20 beshort 04001 (swapped)
10598: >20 beshort 05401 (paged)
10599: >8 belong >0 not stripped
10600: >8 belong 0 stripped
10601: >23 byte x - version %d
10602: >22 byte x .%ld
10603: #
10604: 0 beshort 0x6201 MIPSEL ECOFF executable
10605: >20 beshort 03401 (impure)
10606: >20 beshort 04001 (swapped)
10607: >20 beshort 05401 (paged)
10608: >8 belong >0 not stripped
10609: >8 belong 0 stripped
10610: >23 byte x - version %ld
10611: >22 byte x .%ld
10612: #
10613: # MIPS 2 additions
10614: #
10615: 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
10616: >20 beshort 0407 (impure)
10617: >20 beshort 0410 (swapped)
10618: >20 beshort 0413 (paged)
10619: >8 belong >0 not stripped
10620: >8 belong 0 stripped
10621: >22 byte x - version %ld
10622: >23 byte x .%ld
10623: #
10624: 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
10625: >20 beshort 0407 (impure)
10626: >20 beshort 0410 (swapped)
10627: >20 beshort 0413 (paged)
10628: >8 belong >0 not stripped
10629: >8 belong 0 stripped
10630: >22 byte x - version %ld
10631: >23 byte x .%ld
10632: #
10633: 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
10634: >20 beshort 03401 (impure)
10635: >20 beshort 04001 (swapped)
10636: >20 beshort 05401 (paged)
10637: >8 belong >0 not stripped
10638: >8 belong 0 stripped
10639: >23 byte x - version %ld
10640: >22 byte x .%ld
10641: #
10642: 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
10643: >20 beshort 03401 (impure)
10644: >20 beshort 04001 (swapped)
10645: >20 beshort 05401 (paged)
10646: >8 belong >0 not stripped
10647: >8 belong 0 stripped
10648: >23 byte x - version %ld
10649: >22 byte x .%ld
10650: #
10651: # MIPS 3 additions
10652: #
10653: 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
10654: >20 beshort 0407 (impure)
10655: >20 beshort 0410 (swapped)
10656: >20 beshort 0413 (paged)
10657: >8 belong >0 not stripped
10658: >8 belong 0 stripped
10659: >22 byte x - version %ld
10660: >23 byte x .%ld
10661: #
10662: 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
10663: >20 beshort 0407 (impure)
10664: >20 beshort 0410 (swapped)
10665: >20 beshort 0413 (paged)
10666: >8 belong >0 not stripped
10667: >8 belong 0 stripped
10668: >22 byte x - version %ld
10669: >23 byte x .%ld
10670: #
10671: 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
10672: >20 beshort 03401 (impure)
10673: >20 beshort 04001 (swapped)
10674: >20 beshort 05401 (paged)
10675: >8 belong >0 not stripped
10676: >8 belong 0 stripped
10677: >23 byte x - version %ld
10678: >22 byte x .%ld
10679: #
10680: 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
10681: >20 beshort 03401 (impure)
10682: >20 beshort 04001 (swapped)
10683: >20 beshort 05401 (paged)
10684: >8 belong >0 not stripped
10685: >8 belong 0 stripped
10686: >23 byte x - version %ld
10687: >22 byte x .%ld
10688: #
10689: 0 beshort 0x180 MIPSEB Ucode
10690: 0 beshort 0x182 MIPSEL-BE Ucode
10691: # 32bit core file
10692: 0 belong 0xdeadadb0 IRIX core dump
10693: >4 belong 1 of
10694: >16 string >\0 '%s'
10695: # 64bit core file
10696: 0 belong 0xdeadad40 IRIX 64-bit core dump
10697: >4 belong 1 of
10698: >16 string >\0 '%s'
10699: # N32bit core file
10700: 0 belong 0xbabec0bb IRIX N32 core dump
10701: >4 belong 1 of
10702: >16 string >\0 '%s'
10703: # New style crash dump file
10704: 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
10705: >36 string >\0 '%s'
10706: # Trusted IRIX info
10707: 0 string SGIAUDIT SGI Audit file
10708: >8 byte x - version %d
10709: >9 byte x .%ld
10710: #
10711: 0 string WNGZWZSC Wingz compiled script
10712: 0 string WNGZWZSS Wingz spreadsheet
10713: 0 string WNGZWZHP Wingz help file
10714: #
10715: 0 string #Inventor V IRIS Inventor 1.0 file
10716: 0 string #Inventor V2 Open Inventor 2.0 file
10717: # GLF is OpenGL stream encoding
10718: 0 string glfHeadMagic(); GLF_TEXT
10719: 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
10720: 4 belong 0x0000007d GLF_BINARY_MSB_FIRST
10721: # GLS is OpenGL stream encoding; GLS is the successor of GLF
10722: 0 string glsBeginGLS( GLS_TEXT
10723: 4 belong 0x10000000 GLS_BINARY_LSB_FIRST
10724: 4 belong 0x00000010 GLS_BINARY_MSB_FIRST
10725:
10726: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10727: # $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
1.1 misho 10728: # mirage: file(1) magic for Mirage executables
10729: #
10730: # XXX - byte order?
10731: #
10732: 0 long 31415 Mirage Assembler m.out executable
1.1.1.2 ! misho 10733:
1.1 misho 10734: #-----------------------------------------------------------------------------
1.1.1.2 ! misho 10735: # $File: misctools,v 1.10 2009/09/19 16:28:10 christos Exp $
1.1 misho 10736: # misctools: file(1) magic for miscellaneous UNIX tools.
10737: #
10738: 0 search/1 %%!! X-Post-It-Note text
10739: 0 string/c BEGIN:VCALENDAR vCalendar calendar file
10740: 0 string/c BEGIN:VCARD vCard visiting card
10741: !:mime text/x-vcard
10742:
10743: # From: Alex Beregszaszi <alex@fsn.hu>
10744: 4 string gtktalog GNOME Catalogue (gtktalog)
10745: >13 string >\0 version %s
10746:
1.1.1.2 ! misho 10747: # Summary: GStreamer binary registry
! 10748: # Extension: .bin
! 10749: # Submitted by: Josh Triplett <josh@joshtriplett.org>
! 10750: 0 belong 0xc0def00d GStreamer binary registry
! 10751: >4 string x \b, version %s
! 10752:
1.1 misho 10753: # Summary: Libtool library file
10754: # Extension: .la
10755: # Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
10756: 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
10757:
10758: # Summary: Libtool object file
10759: # Extension: .lo
10760: # Submitted by: Abel Cheung <abelcheung@gmail.com>
10761: 0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
10762:
1.1.1.2 ! misho 10763: # From: Daniel Novotny <dnovotny@redhat.com>
! 10764: 0 string MDMP\x93\xA7 MDMP crash report data
! 10765:
1.1 misho 10766: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10767: # $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 10768: # mkid: file(1) magic for mkid(1) databases
10769: #
10770: # ID is the binary tags database produced by mkid(1).
10771: #
10772: # XXX - byte order?
10773: #
10774: 0 string \311\304 ID tags data
10775: >2 short >0 version %d
10776:
10777: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10778: # $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 10779: # mlssa: file(1) magic for MLSSA datafiles
10780: #
10781: 0 lelong 0xffffabcd MLSSA datafile,
10782: >4 leshort x algorithm %d,
10783: >10 lelong x %d samples
10784:
10785: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10786: # $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 10787: # mmdf: file(1) magic for MMDF mail files
10788: #
10789: 0 string \001\001\001\001 MMDF mailbox
1.1.1.2 ! misho 10790:
1.1 misho 10791: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10792: # $File: modem,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 10793: # modem: file(1) magic for modem programs
10794: #
10795: # From: Florian La Roche <florian@knorke.saar.de>
10796: 1 string PC\ Research,\ Inc Digifax-G3-File
10797: >29 byte 1 \b, fine resolution
10798: >29 byte 0 \b, normal resolution
10799:
10800: 0 short 0x0100 raw G3 data, byte-padded
10801: 0 short 0x1400 raw G3 data
10802: #
10803: # Magic data for vgetty voice formats
10804: # (Martin Seine & Marc Eberhard)
10805:
10806: #
10807: # raw modem data version 1
10808: #
10809: 0 string RMD1 raw modem data
10810: >4 string >\0 (%s /
10811: >20 short >0 compression type 0x%04x)
10812:
10813: #
10814: # portable voice format 1
10815: #
10816: 0 string PVF1\n portable voice format
10817: >5 string >\0 (binary %s)
10818:
10819: #
10820: # portable voice format 2
10821: #
10822: 0 string PVF2\n portable voice format
10823: >5 string >\0 (ascii %s)
10824:
10825:
10826: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10827: # $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
1.1 misho 10828: # motorola: file(1) magic for Motorola 68K and 88K binaries
10829: #
10830: # 68K
10831: #
10832: 0 beshort 0520 mc68k COFF
10833: >18 beshort ^00000020 object
10834: >18 beshort &00000020 executable
10835: >12 belong >0 not stripped
10836: >168 string .lowmem Apple toolbox
10837: >20 beshort 0407 (impure)
10838: >20 beshort 0410 (pure)
10839: >20 beshort 0413 (demand paged)
10840: >20 beshort 0421 (standalone)
10841: 0 beshort 0521 mc68k executable (shared)
10842: >12 belong >0 not stripped
10843: 0 beshort 0522 mc68k executable (shared demand paged)
10844: >12 belong >0 not stripped
10845: #
10846: # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
10847: #
10848: 0 beshort 0554 68K BCS executable
10849: #
10850: # 88K
10851: #
10852: # Motorola/88Open BCS
10853: #
10854: 0 beshort 0555 88K BCS executable
10855: #
10856: # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
10857: 0 string S0 Motorola S-Record; binary data in text format
10858:
10859: # ATARI ST relocatable PRG
10860: #
10861: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
10862: # (according to Roland Waldi, Oct 21, 1987)
10863: # besides the magic 0x601a, the text segment size is checked to be
10864: # not larger than 1 MB (which is a lot on ST).
10865: # The additional 0x601b distinction I took from Doug Lee's magic.
10866: 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
10867: >2 belong x (txt=%ld,
10868: >6 belong x dat=%ld,
10869: >10 belong x bss=%ld,
10870: >14 belong x sym=%ld)
10871: 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
10872: >2 belong x (txt=%ld,
10873: >6 belong x dat=%ld,
10874: >10 belong x bss=%ld,
10875: >14 belong x sym=%ld)
10876:
10877: # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
10878: 0 beshort 0x601A Atari 68xxx executable,
10879: >2 belong x text len %lu,
10880: >6 belong x data len %lu,
10881: >10 belong x BSS len %lu,
10882: >14 belong x symboltab len %lu,
10883: >18 belong 0
10884: >22 belong &0x01 fastload flag,
10885: >22 belong &0x02 may be loaded to alternate RAM,
10886: >22 belong &0x04 malloc may be from alternate RAM,
10887: >22 belong x flags: 0x%lX,
10888: >26 beshort 0 no relocation tab
10889: >26 beshort !0 + relocation tab
10890: >30 string SFX [Self-Extracting LZH SFX archive]
10891: >38 string SFX [Self-Extracting LZH SFX archive]
10892: >44 string ZIP! [Self-Extracting ZIP SFX archive]
10893:
10894: 0 beshort 0x0064 Atari 68xxx CPX file
10895: >8 beshort x (version %04lx)
10896:
10897: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10898: # $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 10899: # mozilla: file(1) magic for Mozilla XUL fastload files
10900: # (XUL.mfasl and XPC.mfasl)
10901: # URL: http://www.mozilla.org/
10902: # From: Josh Triplett <josh@freedesktop.org>
10903:
10904: 0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
10905:
10906: #------------------------------------------------------------------------------
1.1.1.2 ! misho 10907: # $File: msdos,v 1.65 2009/09/19 16:28:11 christos Exp $
1.1 misho 10908: # msdos: file(1) magic for MS-DOS files
10909: #
10910:
10911: # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
1.1.1.2 ! misho 10912: # updated by Joerg Jenderek at Oct 2008
1.1 misho 10913: 0 string @
1.1.1.2 ! misho 10914: >1 string/cW \ echo\ off DOS batch file text
1.1 misho 10915: !:mime text/x-msdos-batch
1.1.1.2 ! misho 10916: >1 string/cW echo\ off DOS batch file text
1.1 misho 10917: !:mime text/x-msdos-batch
1.1.1.2 ! misho 10918: >1 string/cW rem\ DOS batch file text
1.1 misho 10919: !:mime text/x-msdos-batch
1.1.1.2 ! misho 10920: >1 string/cW set\ DOS batch file text
1.1 misho 10921: !:mime text/x-msdos-batch
10922:
10923:
10924: # OS/2 batch files are REXX. the second regex is a bit generic, oh well
10925: # the matched commands seem to be common in REXX and uncommon elsewhere
10926: 100 search/0xffff rxfuncadd
10927: >100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
10928: 100 search/0xffff say
10929: >100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
10930:
10931: 0 leshort 0x14c MS Windows COFF Intel 80386 object file
10932: #>4 ledate x stamp %s
10933: 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
10934: #>4 ledate x stamp %s
10935: 0 leshort 0x184 MS Windows COFF Alpha object file
10936: #>4 ledate x stamp %s
10937: 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
10938: #>4 ledate x stamp %s
10939: 0 leshort 0x1f0 MS Windows COFF PowerPC object file
10940: #>4 ledate x stamp %s
10941: 0 leshort 0x290 MS Windows COFF PA-RISC object file
10942: #>4 ledate x stamp %s
10943:
10944: # XXX - according to Microsoft's spec, at an offset of 0x3c in a
10945: # PE-format executable is the offset in the file of the PE header;
10946: # unfortunately, that's a little-endian offset, and there's no way
10947: # to specify an indirect offset with a specified byte order.
10948: # So, for now, we assume the standard MS-DOS stub, which puts the
10949: # PE header at 0x80 = 128.
10950: #
10951: # Required OS version and subsystem version were 4.0 on some NT 3.51
10952: # executables built with Visual C++ 4.0, so it's not clear that
10953: # they're interesting. The user version was 0.0, but there's
10954: # probably some linker directive to set it. The linker version was
10955: # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
10956: #
10957: # many of the compressed formats were extraced from IDARC 1.23 source code
10958: #
10959: 0 string MZ
10960: !:mime application/x-dosexec
10961: >0x18 leshort <0x40 MS-DOS executable
10962: >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
10963: >>&18 leshort&0x2000 >0 (DLL)
10964: >>&88 leshort 0 (unknown subsystem)
10965: >>&88 leshort 1 (native)
10966: >>&88 leshort 2 (GUI)
10967: >>&88 leshort 3 (console)
10968: >>&88 leshort 7 (POSIX)
10969: >>&0 leshort 0x0 unknown processor
10970: >>&0 leshort 0x14c Intel 80386
10971: >>&0 leshort 0x166 MIPS R4000
10972: >>&0 leshort 0x184 Alpha
10973: >>&0 leshort 0x268 Motorola 68000
10974: >>&0 leshort 0x1f0 PowerPC
10975: >>&0 leshort 0x290 PA-RISC
10976: >>&18 leshort&0x0100 >0 32-bit
10977: >>&18 leshort&0x1000 >0 system file
10978: >>&228 lelong >0 \b, Mono/.Net assembly
10979: >>&0xf4 search/0x140 \x0\x40\x1\x0
10980: >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
10981: >30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
10982: !:mime application/zip
10983: # Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect.
10984: >30 string PKLITE\ Copr. Self-extracting PKZIP archive
10985: !:mime application/zip
10986:
10987: >0x18 leshort >0x3f
10988: >>(0x3c.l) string PE\0\0 PE
10989: >>>(0x3c.l+25) byte 1 \b32 executable
10990: >>>(0x3c.l+25) byte 2 \b32+ executable
10991: # hooray, there's a DOS extender using the PE format, with a valid PE
10992: # executable inside (which just prints a message and exits if run in win)
10993: >>>(0x3c.l+92) leshort <10
10994: >>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
10995: >>>>(8.s*16) string !32STUB for MS Windows
10996: >>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
10997: >>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
10998: >>>>>(0x3c.l+92) leshort 1 (native)
10999: >>>>>(0x3c.l+92) leshort 2 (GUI)
11000: >>>>>(0x3c.l+92) leshort 3 (console)
11001: >>>>>(0x3c.l+92) leshort 7 (POSIX)
11002: >>>(0x3c.l+92) leshort 10 (EFI application)
11003: >>>(0x3c.l+92) leshort 11 (EFI boot service driver)
11004: >>>(0x3c.l+92) leshort 12 (EFI runtime driver)
11005: >>>(0x3c.l+92) leshort 13 (XBOX)
11006: >>>(0x3c.l+4) leshort 0x0 unknown processor
11007: >>>(0x3c.l+4) leshort 0x14c Intel 80386
11008: >>>(0x3c.l+4) leshort 0x166 MIPS R4000
11009: >>>(0x3c.l+4) leshort 0x184 Alpha
11010: >>>(0x3c.l+4) leshort 0x268 Motorola 68000
11011: >>>(0x3c.l+4) leshort 0x1f0 PowerPC
11012: >>>(0x3c.l+4) leshort 0x290 PA-RISC
11013: >>>(0x3c.l+4) leshort 0x200 Intel Itanium
11014: >>>(0x3c.l+22) leshort&0x0100 >0 32-bit
11015: >>>(0x3c.l+22) leshort&0x1000 >0 system file
11016: >>>(0x3c.l+232) lelong >0 Mono/.Net assembly
11017:
11018: >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
11019: >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
11020: >>>>(0x3c.l+0xf8) search/0x140 UPX2
11021: >>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
11022: >>>>(0x3c.l+0xf8) search/0x140 .idata
11023: >>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
11024: >>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
11025: >>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
11026: >>>>(0x3c.l+0xf8) search/0x140 .rsrc
11027: >>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
11028: >>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
11029: >>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
11030: >>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
11031: >>>>(0x3c.l+0xf8) search/0x140 .data
11032: >>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
11033: >>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
11034: >>>>>(0x3c.l+0xf7) byte x
11035: >>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
11036: >>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
11037: >>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
11038: >>>>(0x3c.l+0xf8) search/0x140 .reloc
11039: >>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
11040:
11041: >>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
11042: >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
11043: >>>>0x30 string Inno \b, InnoSetup self-extracting archive
11044:
11045: >>(0x3c.l) string !PE\0\0 MS-DOS executable
11046:
11047: >>(0x3c.l) string NE \b, NE
11048: >>>(0x3c.l+0x36) byte 0 (unknown OS)
11049: >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
11050: >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
11051: >>>(0x3c.l+0x36) byte 3 for MS-DOS
11052: >>>(0x3c.l+0x36) byte >3 (unknown OS)
11053: >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
11054: >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
11055: >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
11056: >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
11057: >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
11058:
11059: >>(0x3c.l) string LX\0\0 \b, LX
11060: >>>(0x3c.l+0x0a) leshort <1 (unknown OS)
11061: >>>(0x3c.l+0x0a) leshort 1 for OS/2
11062: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
11063: >>>(0x3c.l+0x0a) leshort 3 for DOS
11064: >>>(0x3c.l+0x0a) leshort >3 (unknown OS)
11065: >>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
11066: >>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
11067: >>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
11068: >>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
11069: >>>(0x3c.l+0x08) leshort 1 i80286
11070: >>>(0x3c.l+0x08) leshort 2 i80386
11071: >>>(0x3c.l+0x08) leshort 3 i80486
11072: >>>(8.s*16) string emx \b, emx
11073: >>>>&1 string x %s
11074: >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
11075:
11076: # MS Windows system file, supposedly a collection of LE executables
11077: >>(0x3c.l) string W3 \b, W3 for MS Windows
11078:
11079: >>(0x3c.l) string LE\0\0 \b, LE executable
11080: >>>(0x3c.l+0x0a) leshort 1
11081: # some DOS extenders use LE files with OS/2 header
11082: >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
11083: >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
11084: >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
11085: >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
11086: >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
11087: >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
11088: >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
11089: # this is a wild guess; hopefully it is a specific signature
11090: >>>>&0x24 lelong <0x50
11091: >>>>>(&0x4c.l) string \xfc\xb8WATCOM
11092: >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
11093: # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
11094: #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
11095: # fails with DOS-Extenders.
11096: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
11097: >>>(0x3c.l+0x0a) leshort 3 for DOS
11098: >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
11099: >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
11100: >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
11101:
11102: # looks like ASCII, probably some embedded copyright message.
11103: # and definitely not NE/LE/LX/PE
11104: >>0x3c lelong >0x20000000
11105: >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
11106: # header data too small for extended executable
11107: >2 long !0
11108: >>0x18 leshort <0x40
11109: >>>(4.s*512) leshort !0x014c
11110:
11111: >>>>&(2.s-514) string !LE
11112: >>>>>&-2 string !BW \b, MZ for MS-DOS
11113: >>>>&(2.s-514) string LE \b, LE
11114: >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
11115: # educated guess since indirection is still not capable enough for complex offset
11116: # calculations (next embedded executable would be at &(&2*512+&0-2)
11117: # I suspect there are only LE executables in these multi-exe files
11118: >>>>&(2.s-514) string BW
11119: >>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
11120: >>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
11121:
11122: # This sequence skips to the first COFF segment, usually .text
11123: >(4.s*512) leshort 0x014c \b, COFF
11124: >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
11125: >>(8.s*16) string emx
11126: >>>&1 string x for DOS, Win or OS/2, emx %s
11127: >>&(&0x42.l-3) byte x
11128: >>>&0x26 string UPX \b, UPX compressed
11129: # and yet another guess: small .text, and after large .data is unusal, could be 32lite
11130: >>&0x2c search/0xa0 .text
11131: >>>&0x0b lelong <0x2000
11132: >>>>&0 lelong >0x6000 \b, 32lite compressed
11133:
11134: >(8.s*16) string $WdX \b, WDos/X DOS extender
11135:
11136: # .EXE formats (Greg Roelofs, newt@uchicago.edu)
11137: #
11138: >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
11139: >0xe7 string LH/2\ Self-Extract \b, %s
11140: >0x1c string diet \b, diet compressed
11141: >0x1c string LZ09 \b, LZEXE v0.90 compressed
11142: >0x1c string LZ91 \b, LZEXE v0.91 compressed
11143: >0x1c string tz \b, TinyProg compressed
11144: >0x1e string PKLITE \b, %s compressed
11145: >0x64 string W\ Collis\0\0 \b, Compack compressed
11146: >0x24 string LHa's\ SFX \b, LHa self-extracting archive
11147: !:mime application/x-lha
11148: >0x24 string LHA's\ SFX \b, LHa self-extracting archive
11149: !:mime application/x-lha
11150: >0x24 string \ $ARX \b, ARX self-extracting archive
11151: >0x24 string \ $LHarc \b, LHarc self-extracting archive
11152: >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
11153: >1638 string -lh5- \b, LHa self-extracting archive v2.13S
11154: >0x17888 string Rar! \b, RAR self-extracting archive
11155: >0x40 string aPKG \b, aPackage self-extracting archive
11156:
11157: >32 string AIN
11158: >>35 string 2 \b, AIN 2.x compressed
11159: >>35 string <2 \b, AIN 1.x compressed
11160: >>35 string >2 \b, AIN 1.x compressed
11161: >28 string UC2X \b, UCEXE compressed
11162: >28 string WWP\ \b, WWPACK compressed
11163:
11164: # skip to the end of the exe
11165: >(4.s*512) long x
11166: >>&(2.s-517) byte x
11167: >>>&0 string PK\3\4 \b, ZIP self-extracting archive
11168: >>>&0 string Rar! \b, RAR self-extracting archive
11169: >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
11170: >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
11171: >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
11172: >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
11173: >>>&7 search/400 **ACE** \b, ACE self-extracting archive
11174: >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
11175:
11176: >0x1c string RJSX \b, ARJ self-extracting archive
11177: # winarj stores a message in the stub instead of the sig in the MZ header
11178: >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
11179:
11180: # a few unknown ZIP sfxes, no idea if they are needed or if they are
11181: # already captured by the generic patterns above
11182: >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
11183: >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
11184: # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
11185: #
11186:
11187: # TELVOX Teleinformatica CODEC self-extractor for OS/2:
11188: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
11189: >>49824 leshort =1 \b, 1 file
11190: >>49824 leshort >1 \b, %u files
11191:
11192: # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
11193: # Uncommenting only the first two lines will cover about 2/3 of COM files,
11194: # but it isn't feasible to match all COM files since there must be at least
11195: # two dozen different one-byte "magics".
1.1.1.2 ! misho 11196: # test too generic ?
! 11197: 0 byte 0xe9 DOS executable (COM)
! 11198: >0x1FE leshort 0xAA55 \b, boot code
1.1 misho 11199: >6 string SFX\ of\ LHarc (%s)
11200: 0 belong 0xffffffff DOS executable (device driver)
11201: #CMD640X2.SYS
11202: >10 string >\x23
11203: >>10 string !\x2e
11204: >>>17 string <\x5B
11205: >>>>10 string x \b, name: %.8s
11206: #UDMA.SYS KEYB.SYS CMD640X2.SYS
11207: >10 string <\x41
11208: >>12 string >\x40
11209: >>>10 string !$
11210: >>>>12 string x \b, name: %.8s
11211: #BTCDROM.SYS ASPICD.SYS
11212: >22 string >\x40
11213: >>22 string <\x5B
11214: >>>23 string <\x5B
11215: >>>>22 string x \b, name: %.8s
11216: #ATAPICD.SYS
11217: >76 string \0
11218: >>77 string >\x40
11219: >>>77 string <\x5B
11220: >>>>77 string x \b, name: %.8s
1.1.1.2 ! misho 11221: # test too generic ?
! 11222: 0 byte 0x8c DOS executable (COM)
! 11223: # updated by Joerg Jenderek at Oct 2008
! 11224: 0 ulelong 0xffff10eb DR-DOS executable (COM)
! 11225: # byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
! 11226: 0 ubeshort&0xeb8d >0xeb00
! 11227: # DR-DOS STACKER.COM SCREATE.SYS missed
! 11228: >0 byte 0xeb DOS executable (COM)
! 11229: >>0x1FE leshort 0xAA55 \b, boot code
! 11230: >>85 string UPX \b, UPX compressed
! 11231: >>4 string \ $ARX \b, ARX self-extracting archive
! 11232: >>4 string \ $LHarc \b, LHarc self-extracting archive
! 11233: >>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
! 11234: # updated by Joerg Jenderek at Oct 2008
1.1 misho 11235: #0 byte 0xb8 COM executable
1.1.1.2 ! misho 11236: 0 uleshort&0x80ff 0x00b8
1.1 misho 11237: # modified by Joerg Jenderek
1.1.1.2 ! misho 11238: >1 lelong !0x21cd4cff COM executable for DOS
1.1 misho 11239: # http://syslinux.zytor.com/comboot.php
11240: # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
11241: # start with assembler instructions mov eax,21cd4cffh
1.1.1.2 ! misho 11242: 0 uleshort&0xc0ff 0xc0b8
! 11243: >1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
1.1 misho 11244: 0 string \x81\xfc
11245: >4 string \x77\x02\xcd\x20\xb9
11246: >>36 string UPX! FREE-DOS executable (COM), UPX compressed
11247: 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
1.1.1.2 ! misho 11248: # added by Joerg Jenderek at Oct 2008
! 11249: # GRR search is not working
! 11250: #34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
! 11251: 34 string UPX! FREE-DOS executable (COM), UPX compressed
! 11252: 35 string UPX! FREE-DOS executable (COM), UPX compressed
1.1 misho 11253: # GRR search is not working
11254: #2 search/28 \xcd\x21 COM executable for MS-DOS
11255: #WHICHFAT.cOM
11256: 2 string \xcd\x21 COM executable for DOS
11257: #DELTREE.cOM DELTREE2.cOM
11258: 4 string \xcd\x21 COM executable for DOS
11259: #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
11260: 5 string \xcd\x21 COM executable for DOS
11261: #DELTMP.COm HASFAT32.cOM
11262: 7 string \xcd\x21
11263: >0 byte !0xb8 COM executable for DOS
11264: #COMP.cOM MORE.COm
11265: 10 string \xcd\x21
11266: >5 string !\xcd\x21 COM executable for DOS
11267: #comecho.com
11268: 13 string \xcd\x21 COM executable for DOS
11269: #HELP.COm EDIT.coM
11270: 18 string \xcd\x21 COM executable for MS-DOS
11271: #NWRPLTRM.COm
11272: 23 string \xcd\x21 COM executable for MS-DOS
11273: #LOADFIX.cOm LOADFIX.cOm
11274: 30 string \xcd\x21 COM executable for MS-DOS
11275: #syslinux.com 3.11
11276: 70 string \xcd\x21 COM executable for DOS
11277: # many compressed/converted COMs start with a copy loop instead of a jump
11278: 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
11279: 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
11280: >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
11281: 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
11282: # FIXME: missing diet .com compression
11283:
11284: # miscellaneous formats
11285: 0 string LZ MS-DOS executable (built-in)
11286: #0 byte 0xf0 MS-DOS program library data
11287: #
11288:
11289: # AAF files:
11290: # <stuartc@rd.bbc.co.uk> Stuart Cunningham
11291: 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
11292: >30 byte 9 (512B sectors)
11293: >30 byte 12 (4kB sectors)
11294: 0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
11295: >30 byte 9 (512B sectors)
11296: >30 byte 12 (4kB sectors)
11297:
11298: # Popular applications
11299: 2080 string Microsoft\ Word\ 6.0\ Document %s
11300: !:mime application/msword
11301: 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
11302: !:mime application/msword
11303: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
11304: 2112 string MSWordDoc Microsoft Word document data
11305: !:mime application/msword
11306: #
11307: 0 belong 0x31be0000 Microsoft Word Document
11308: !:mime application/msword
11309: #
11310: 0 string PO^Q` Microsoft Word 6.0 Document
11311: !:mime application/msword
11312: #
11313: 0 string \376\067\0\043 Microsoft Office Document
11314: !:mime application/msword
11315: 0 string \333\245-\0\0\0 Microsoft Office Document
11316: !:mime application/msword
11317: 512 string \354\245\301 Microsoft Word Document
11318: !:mime application/msword
11319: #
11320: 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
11321: !:mime application/vnd.ms-excel
11322:
11323: 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
11324: !:mime application/vnd.ms-excel
11325: #
11326: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
11327: 2114 string Biff5 Microsoft Excel 5.0 Worksheet
11328: !:mime application/vnd.ms-excel
11329: # Italian MS-Excel
11330: 2121 string Biff5 Microsoft Excel 5.0 Worksheet
11331: !:mime application/vnd.ms-excel
11332: 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
11333: !:mime application/vnd.ms-excel
11334: #
11335: 0 belong 0x00001a00 Lotus 1-2-3
11336: !:mime application/x-123
11337: >4 belong 0x00100400 wk3 document data
11338: >4 belong 0x02100400 wk4 document data
11339: >4 belong 0x07800100 fm3 or fmb document data
11340: >4 belong 0x07800000 fm3 or fmb document data
11341: #
11342: 0 belong 0x00000200 Lotus 1-2-3
11343: !:mime application/x-123
11344: >4 belong 0x06040600 wk1 document data
11345: >4 belong 0x06800200 fmt document data
11346: 0 string WordPro\0 Lotus WordPro
11347: !:mime application/vnd.lotus-wordpro
11348: 0 string WordPro\r\373 Lotus WordPro
11349: !:mime application/vnd.lotus-wordpro
11350:
11351:
11352: # Summary: Script used by InstallScield to uninstall applications
11353: # Extension: .isu
11354: # Submitted by: unknown
11355: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
11356: 0 string \x71\xa8\x00\x00\x01\x02
11357: >12 string Stirling\ Technologies, InstallShield Uninstall Script
11358:
11359: # Winamp .avs
11360: #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
11361: 0 string Nullsoft\ AVS\ Preset\ Winamp plug in
11362:
11363: # Windows Metafont .WMF
11364: 0 string \327\315\306\232 ms-windows metafont .wmf
11365: 0 string \002\000\011\000 ms-windows metafont .wmf
11366: 0 string \001\000\011\000 ms-windows metafont .wmf
11367:
11368: #tz3 files whatever that is (MS Works files)
11369: 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
11370: 0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
11371: 0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
11372:
11373: # PGP sig files .sig
11374: #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
11375: 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
11376: 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
11377: 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
11378: 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
11379: 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
11380: 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
11381:
11382: # windows zips files .dmf
11383: 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
11384:
11385:
11386: #ico files
11387: 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
11388:
11389: # Windows icons (Ian Springer <ips@fpk.hp.com>)
11390: 0 string \000\000\001\000 MS Windows icon resource
11391: !:mime image/x-ico
11392: >4 byte 1 - 1 icon
11393: >4 byte >1 - %d icons
11394: >>6 byte >0 \b, %dx
11395: >>>7 byte >0 \b%d
11396: >>8 byte 0 \b, 256-colors
11397: >>8 byte >0 \b, %d-colors
11398:
11399:
11400: # .chr files
11401: 0 string PK\010\010BGI Borland font
11402: >4 string >\0 %s
11403: # then there is a copyright notice
11404:
11405:
11406: # .bgi files
11407: 0 string pk\010\010BGI Borland device
11408: >4 string >\0 %s
11409: # then there is a copyright notice
11410:
11411:
11412: # Windows Recycle Bin record file (named INFO2)
11413: # By Abel Cheung (abelcheung AT gmail dot com)
11414: # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
11415: # Since Vista uses another structure, INFO2 structure probably won't change
11416: # anymore. Detailed analysis in:
11417: # http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
11418: 0 lelong 0x00000004
11419: >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
11420:
11421: 0 lelong 0x00000005
11422: >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
11423:
11424:
11425: ##### put in Either Magic/font or Magic/news
11426: # Acroread or something files wrongly identified as G3 .pfm
11427: # these have the form \000 \001 any? \002 \000 \000
11428: # or \000 \001 any? \022 \000 \000
11429: 0 belong&0xffff00ff 0x00010012 PFM data
11430: >4 string \000\000
11431: >6 string >\060 - %s
11432:
11433: 0 belong&0xffff00ff 0x00010002 PFM data
11434: >4 string \000\000
11435: >6 string >\060 - %s
11436: #0 string \000\001 pfm?
11437: #>3 string \022\000\000Copyright\ yes
11438: #>3 string \002\000\000Copyright\ yes
11439: #>3 string >\0 oops, not a font file. Cancel that.
11440: #it clashes with ttf files so put it lower down.
11441:
11442: # From Doug Lee via a FreeBSD pr
11443: 9 string GERBILDOC First Choice document
11444: 9 string GERBILDB First Choice database
11445: 9 string GERBILCLIP First Choice database
11446: 0 string GERBIL First Choice device file
11447: 9 string RABBITGRAPH RabbitGraph file
11448: 0 string DCU1 Borland Delphi .DCU file
11449: 0 string =!<spell> MKS Spell hash list (old format)
11450: 0 string =!<spell2> MKS Spell hash list
11451: # Too simple - MPi
11452: #0 string AH Halo(TM) bitmapped font file
11453: 0 lelong 0x08086b70 TurboC BGI file
11454: 0 lelong 0x08084b50 TurboC Font file
11455:
11456: # WARNING: below line conflicts with Infocom game data Z-machine 3
11457: 0 byte 0x03 DBase 3 data file
11458: >0x04 lelong 0 (no records)
11459: >0x04 lelong >0 (%ld records)
11460: 0 byte 0x83 DBase 3 data file with memo(s)
11461: >0x04 lelong 0 (no records)
11462: >0x04 lelong >0 (%ld records)
11463: 0 leshort 0x0006 DBase 3 index file
11464: 0 string PMCC Windows 3.x .GRP file
11465: 1 string RDC-meg MegaDots
11466: >8 byte >0x2F version %c
11467: >9 byte >0x2F \b.%c file
11468: 0 lelong 0x4C
11469: >4 lelong 0x00021401 Windows shortcut file
11470:
11471: # DOS EPS Binary File Header
11472: # From: Ed Sznyter <ews@Black.Market.NET>
11473: 0 belong 0xC5D0D3C6 DOS EPS Binary File
11474: >4 long >0 Postscript starts at byte %d
11475: >>8 long >0 length %d
11476: >>>12 long >0 Metafile starts at byte %d
11477: >>>>16 long >0 length %d
11478: >>>20 long >0 TIFF starts at byte %d
11479: >>>>24 long >0 length %d
11480:
11481: # TNEF magic From "Joomy" <joomy@se-ed.net>
11482: # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
11483: 0 leshort 0x223e9f78 TNEF
11484: !:mime application/vnd.ms-tnef
11485:
11486: # HtmlHelp files (.chm)
11487: 0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
11488:
11489: # GFA-BASIC (Wolfram Kleff)
11490: 2 string GFA-BASIC3 GFA-BASIC 3 data
11491:
11492: #------------------------------------------------------------------------------
11493: # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
11494: # Microsoft Cabinet files
11495: 0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
1.1.1.2 ! misho 11496: !:mime application/vnd.ms-cab-compressed
1.1 misho 11497: >8 lelong x \b, %u bytes
11498: >28 leshort 1 \b, 1 file
11499: >28 leshort >1 \b, %u files
11500:
11501: # InstallShield Cabinet files
11502: 0 string ISc( InstallShield Cabinet archive data
11503: >5 byte&0xf0 =0x60 version 6,
11504: >5 byte&0xf0 !0x60 version 4/5,
11505: >(12.l+40) lelong x %u files
11506:
11507: # Windows CE package files
11508: 0 string MSCE\0\0\0\0 Microsoft WinCE install header
11509: >20 lelong 0 \b, architecture-independent
11510: >20 lelong 103 \b, Hitachi SH3
11511: >20 lelong 104 \b, Hitachi SH4
11512: >20 lelong 0xA11 \b, StrongARM
11513: >20 lelong 4000 \b, MIPS R4000
11514: >20 lelong 10003 \b, Hitachi SH3
11515: >20 lelong 10004 \b, Hitachi SH3E
11516: >20 lelong 10005 \b, Hitachi SH4
11517: >20 lelong 70001 \b, ARM 7TDMI
11518: >52 leshort 1 \b, 1 file
11519: >52 leshort >1 \b, %u files
11520: >56 leshort 1 \b, 1 registry entry
11521: >56 leshort >1 \b, %u registry entries
11522:
11523:
11524: # Windows Enhanced Metafile (EMF)
11525: # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
11526: # for further information.
11527: 0 ulelong 1
11528: >40 string \ EMF Windows Enhanced Metafile (EMF) image data
11529: >>44 ulelong x version 0x%x
11530:
11531: # From: Alex Beregszaszi <alex@fsn.hu>
11532: 0 string COWD VMWare3
11533: >4 byte 3 disk image
11534: >>32 lelong x (%d/
11535: >>36 lelong x \b%d/
11536: >>40 lelong x \b%d)
11537: >4 byte 2 undoable disk image
11538: >>32 string >\0 (%s)
11539:
11540: 0 string VMDK VMware4 disk image
11541: 0 string KDMV VMware4 disk image
11542:
11543: #--------------------------------------------------------------------
11544: # Qemu Emulator Images
11545: # Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
1.1.1.2 ! misho 11546: # Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
! 11547: # Made by reading sources, reading documentation, and doing trial and error
! 11548: # on existing QCOW files
! 11549: 0 string QFI\xFB QEMU QCOW Image
1.1 misho 11550:
11551: # Uncomment the following line to display Magic (only used for debugging
11552: # this magic number)
11553: #>0 string x , Magic: %s
11554:
1.1.1.2 ! misho 11555: # There are currently 2 Versions: "1" and "2".
! 11556: # http://www.gnome.org/~markmc/qcow-image-format-version-1.html
! 11557: >4 belong 1 (v1)
1.1 misho 11558:
1.1.1.2 ! misho 11559: # Using the existence of the Backing File Offset to determine whether
1.1 misho 11560: # to read Backing File Information
1.1.1.2 ! misho 11561: >>12 belong >0 \b, has backing file (
! 11562: # Note that this isn't a null-terminated string; the length is actually
! 11563: # (16.L). Assuming a null-terminated string happens to work usually, but it
! 11564: # may spew junk until it reaches a \0 in some cases.
! 11565: >>>(12.L) string >\0 \bpath %s
1.1 misho 11566:
11567: # Modification time of the Backing File
11568: # Really useful if you want to know if your backing
11569: # file is still usable together with this image
1.1.1.2 ! misho 11570: >>>>20 bedate >0 \b, mtime %s)
! 11571: >>>>20 default x \b)
! 11572:
! 11573: # Size is stored in bytes in a big-endian u64.
! 11574: >>24 bequad x \b, %lld bytes
! 11575:
! 11576: # 1 for AES encryption, 0 for none.
! 11577: >>36 belong 1 \b, AES-encrypted
! 11578:
! 11579: # http://www.gnome.org/~markmc/qcow-image-format.html
! 11580: >4 belong 2 (v2)
! 11581: # Using the existence of the Backing File Offset to determine whether
! 11582: # to read Backing File Information
! 11583: >>8 bequad >0 \b, has backing file
! 11584: # Note that this isn't a null-terminated string; the length is actually
! 11585: # (16.L). Assuming a null-terminated string happens to work usually, but it
! 11586: # may spew junk until it reaches a \0 in some cases. Also, since there's no
! 11587: # .Q modifier, we just use the bottom four bytes as an offset. Note that if
! 11588: # the file is over 4G, and the backing file path is stored after the first 4G,
! 11589: # the wrong filename will be printed. (This should be (8.Q), when that syntax
! 11590: # is introduced.)
! 11591: >>>(12.L) string >\0 (path %s)
! 11592: >>24 bequad x \b, %lld bytes
! 11593: >>32 belong 1 \b, AES-encrypted
1.1 misho 11594:
1.1.1.2 ! misho 11595: >4 default x (unknown version)
1.1 misho 11596:
1.1.1.2 ! misho 11597: 0 string QEVM QEMU suspend to disk image
1.1 misho 11598:
11599: 0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
11600: >32 string x type %s,
11601: >48 string x subtype %s
11602:
11603: 0 lelong 0x02468ace Bochs Sparse disk image
11604:
11605: # from http://filext.com by Derek M Jones <derek@knosof.co.uk>
11606: # False positive with PPT (also currently this string is too long)
11607: #0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
11608: 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
11609: #>48 byte 0x1B Excel Document
11610: #!:mime application/vnd.ms-excel
11611: >546 string bjbj Microsoft Word Document
11612: !:mime application/msword
11613: >546 string jbjb Microsoft Word Document
11614: !:mime application/msword
11615:
11616: 0 string \224\246\056 Microsoft Word Document
11617: !:mime application/msword
11618:
11619: 512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
11620: !:mime application/msword
11621:
11622: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
11623: # Magic type for Dell's BIOS .hdr files
11624: # Dell's .hdr
11625: 0 string $RBU
11626: >23 string Dell %s system BIOS
11627: >48 string x version %.3s
11628:
11629: # Type: Microsoft DirectDraw Surface
11630: # URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
11631: # From: Morten Hustveit <morten@debian.org>
11632: 0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
11633: >16 lelong >0 %hd x
11634: >12 lelong >0 %hd,
11635: >84 string x %.4s
11636:
11637: # Type: Microsoft Document Imaging Format (.mdi)
11638: # URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
11639: # From: Daniele Sempione <scrows@oziosi.org>
11640: 0 short 0x5045 Microsoft Document Imaging Format
11641:
11642: # MS eBook format (.lit)
11643: 0 string ITOLITLS Microsoft Reader eBook Data
11644: >8 lelong x \b, version %u
11645: !:mime application/x-ms-reader
11646:
11647: #------------------------------------------------------------------------------
1.1.1.2 ! misho 11648: # $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 11649: # msvc: file(1) magic for msvc
11650: # "H. Nanosecond" <aldomel@ix.netcom.com>
11651: # Microsoft visual C
11652: #
11653: # I have version 1.0
11654:
11655: # .aps
11656: 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
11657:
11658: # .ide
11659: #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
11660: 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
11661:
11662: # .res
11663: 0 string \000\000\000\000\040\000\000\000\377 MSVC .res
11664: 0 string \377\003\000\377\001\000\020\020\350 MSVC .res
11665: 0 string \377\003\000\377\001\000\060\020\350 MSVC .res
11666:
11667: #.lib
11668: 0 string \360\015\000\000 Microsoft Visual C library
11669: 0 string \360\075\000\000 Microsoft Visual C library
11670: 0 string \360\175\000\000 Microsoft Visual C library
11671:
11672: #.pch
11673: 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
11674:
11675: # .pdb
11676: # too long 0 string Microsoft\ C/C++\ program\ database\
11677: 0 string Microsoft\ C/C++\ MSVC program database
11678: >18 string program\ database\
11679: >33 string >\0 ver %s
11680:
11681: #.sbr
11682: 0 string \000\002\000\007\000 MSVC .sbr
11683: >5 string >\0 %s
11684:
11685: #.bsc
11686: 0 string \002\000\002\001 MSVC .bsc
11687:
11688: #.wsp
11689: 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
11690: # these seem to start with the version and contain menus
1.1.1.2 ! misho 11691:
1.1 misho 11692: # ------------------------------------------------------------------------
1.1.1.2 ! misho 11693: # $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 11694: # mup: file(1) magic for Mup (Music Publisher) input file.
11695: #
11696: # From: Abel Cheung <abel (@) oaka.org>
11697: #
11698: # NOTE: This header is mainly proposed in the Arkkra mailing list,
11699: # and is not a mandatory header because of old mup input file
11700: # compatibility. Noteedit also use mup format, but is not forcing
11701: # user to use any header as well.
11702: #
11703: 0 search/1 //!Mup Mup music publication program input text
11704: >6 string -Arkkra (Arkkra)
11705: >>13 string -
11706: >>>16 string .
11707: >>>>14 string x \b, need V%.4s
11708: >>>15 string .
11709: >>>>14 string x \b, need V%.3s
11710: >6 string -
11711: >>9 string .
11712: >>>7 string x \b, need V%.4s
11713: >>8 string .
11714: >>>7 string x \b, need V%.3s
11715:
11716: #-----------------------------------------------------------------------------
1.1.1.2 ! misho 11717: # $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 11718: # natinst: file(1) magic for National Instruments Code Files
11719:
11720: #
11721: # From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
11722: # version 1
11723: # Many formats still missing, we use, for the moment LabVIEW
11724: # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
11725: #
11726: 0 string RSRC National Instruments,
11727: # Check if it's a LabVIEW File
11728: >8 string LV LabVIEW File,
11729: # Check wich kind of file is
11730: >>10 string SB Code Resource File, data
11731: >>10 string IN Virtual Instrument Program, data
11732: >>10 string AR VI Library, data
11733: # This is for Menu Libraries
11734: >8 string LMNULBVW Portable File Names, data
11735: # This is for General Resources
11736: >8 string rsc Resources File, data
11737: # This is for VXI Package
11738: 0 string VMAP National Instruments, VXI File, data
11739:
11740: #------------------------------------------------------------------------------
1.1.1.2 ! misho 11741: # $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 11742: # ncr: file(1) magic for NCR Tower objects
11743: #
11744: # contributed by
11745: # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
11746: # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
11747: #
11748: 0 beshort 000610 Tower/XP rel 2 object
11749: >12 belong >0 not stripped
11750: >20 beshort 0407 executable
11751: >20 beshort 0410 pure executable
11752: >22 beshort >0 - version %ld
11753: 0 beshort 000615 Tower/XP rel 2 object
11754: >12 belong >0 not stripped
11755: >20 beshort 0407 executable
11756: >20 beshort 0410 pure executable
11757: >22 beshort >0 - version %ld
11758: 0 beshort 000620 Tower/XP rel 3 object
11759: >12 belong >0 not stripped
11760: >20 beshort 0407 executable
11761: >20 beshort 0410 pure executable
11762: >22 beshort >0 - version %ld
11763: 0 beshort 000625 Tower/XP rel 3 object
11764: >12 belong >0 not stripped
11765: >20 beshort 0407 executable
11766: >20 beshort 0410 pure executable
11767: >22 beshort >0 - version %ld
11768: 0 beshort 000630 Tower32/600/400 68020 object
11769: >12 belong >0 not stripped
11770: >20 beshort 0407 executable
11771: >20 beshort 0410 pure executable
11772: >22 beshort >0 - version %ld
11773: 0 beshort 000640 Tower32/800 68020
11774: >18 beshort &020000 w/68881 object
11775: >18 beshort &040000 compatible object
11776: >18 beshort &060000 object
11777: >20 beshort 0407 executable
11778: >20 beshort 0413 pure executable
11779: >12 belong >0 not stripped
11780: >22 beshort >0 - version %ld
11781: 0 beshort 000645 Tower32/800 68010
11782: >18 beshort &040000 compatible object
11783: >18 beshort &060000 object
11784: >20 beshort 0407 executable
11785: >20 beshort 0413 pure executable
11786: >12 belong >0 not stripped
11787: >22 beshort >0 - version %ld
11788:
11789: #------------------------------------------------------------------------------
1.1.1.2 ! misho 11790: # $File: netbsd,v 1.18 2009/09/19 16:28:11 christos Exp $
1.1 misho 11791: # netbsd: file(1) magic for NetBSD objects
11792: #
11793: # All new-style magic numbers are in network byte order.
11794: #
11795:
11796: 0 lelong 000000407 a.out NetBSD little-endian object file
11797: >16 lelong >0 not stripped
11798: 0 belong 000000407 a.out NetBSD big-endian object file
11799: >16 belong >0 not stripped
11800:
11801: 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
11802: >0 byte &0x80
11803: >>20 lelong <4096 shared library
11804: >>20 lelong =4096 dynamically linked executable
11805: >>20 lelong >4096 dynamically linked executable
11806: >0 byte ^0x80 executable
11807: >16 lelong >0 not stripped
11808: 0 belong&0377777777 041400410 a.out NetBSD/i386 pure
11809: >0 byte &0x80 dynamically linked executable
11810: >0 byte ^0x80 executable
11811: >16 lelong >0 not stripped
11812: 0 belong&0377777777 041400407 a.out NetBSD/i386
11813: >0 byte &0x80 dynamically linked executable
11814: >0 byte ^0x80
11815: >>0 byte &0x40 position independent
11816: >>20 lelong !0 executable
11817: >>20 lelong =0 object file
11818: >16 lelong >0 not stripped
11819: 0 belong&0377777777 041400507 a.out NetBSD/i386 core
11820: >12 string >\0 from '%s'
11821: >32 lelong !0 (signal %d)
11822:
11823: 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
11824: >0 byte &0x80
11825: >>20 belong <8192 shared library
11826: >>20 belong =8192 dynamically linked executable
11827: >>20 belong >8192 dynamically linked executable
11828: >0 byte ^0x80 executable
11829: >16 belong >0 not stripped
11830: 0 belong&0377777777 041600410 a.out NetBSD/m68k pure
11831: >0 byte &0x80 dynamically linked executable
11832: >0 byte ^0x80 executable
11833: >16 belong >0 not stripped
11834: 0 belong&0377777777 041600407 a.out NetBSD/m68k
11835: >0 byte &0x80 dynamically linked executable
11836: >0 byte ^0x80
11837: >>0 byte &0x40 position independent
11838: >>20 belong !0 executable
11839: >>20 belong =0 object file
11840: >16 belong >0 not stripped
11841: 0 belong&0377777777 041600507 a.out NetBSD/m68k core
11842: >12 string >\0 from '%s'
11843: >32 belong !0 (signal %d)
11844:
11845: 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
11846: >0 byte &0x80
11847: >>20 belong <4096 shared library
11848: >>20 belong =4096 dynamically linked executable
11849: >>20 belong >4096 dynamically linked executable
11850: >0 byte ^0x80 executable
11851: >16 belong >0 not stripped
11852: 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
11853: >0 byte &0x80 dynamically linked executable
11854: >0 byte ^0x80 executable
11855: >16 belong >0 not stripped
11856: 0 belong&0377777777 042000407 a.out NetBSD/m68k4k
11857: >0 byte &0x80 dynamically linked executable
11858: >0 byte ^0x80
11859: >>0 byte &0x40 position independent
11860: >>20 belong !0 executable
11861: >>20 belong =0 object file
11862: >16 belong >0 not stripped
11863: 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
11864: >12 string >\0 from '%s'
11865: >32 belong !0 (signal %d)
11866:
11867: 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
11868: >0 byte &0x80
11869: >>20 lelong <4096 shared library
11870: >>20 lelong =4096 dynamically linked executable
11871: >>20 lelong >4096 dynamically linked executable
11872: >0 byte ^0x80 executable
11873: >16 lelong >0 not stripped
11874: 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
11875: >0 byte &0x80 dynamically linked executable
11876: >0 byte ^0x80 executable
11877: >16 lelong >0 not stripped
11878: 0 belong&0377777777 042200407 a.out NetBSD/ns32532
11879: >0 byte &0x80 dynamically linked executable
11880: >0 byte ^0x80
11881: >>0 byte &0x40 position independent
11882: >>20 lelong !0 executable
11883: >>20 lelong =0 object file
11884: >16 lelong >0 not stripped
11885: 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
11886: >12 string >\0 from '%s'
11887: >32 lelong !0 (signal %d)
11888:
11889: 0 belong&0377777777 045200507 a.out NetBSD/powerpc core
11890: >12 string >\0 from '%s'
11891:
11892: 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
11893: >0 byte &0x80
11894: >>20 belong <8192 shared library
11895: >>20 belong =8192 dynamically linked executable
11896: >>20 belong >8192 dynamically linked executable
11897: >0 byte ^0x80 executable
11898: >16 belong >0 not stripped
11899: 0 belong&0377777777 042400410 a.out NetBSD/sparc pure
11900: >0 byte &0x80 dynamically linked executable
11901: >0 byte ^0x80 executable
11902: >16 belong >0 not stripped
11903: 0 belong&0377777777 042400407 a.out NetBSD/sparc
11904: >0 byte &0x80 dynamically linked executable
11905: >0 byte ^0x80
11906: >>0 byte &0x40 position independent
11907: >>20 belong !0 executable
11908: >>20 belong =0 object file
11909: >16 belong >0 not stripped
11910: 0 belong&0377777777 042400507 a.out NetBSD/sparc core
11911: >12 string >\0 from '%s'
11912: >32 belong !0 (signal %d)
11913:
11914: 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
11915: >0 byte &0x80
11916: >>20 lelong <4096 shared library
11917: >>20 lelong =4096 dynamically linked executable
11918: >>20 lelong >4096 dynamically linked executable
11919: >0 byte ^0x80 executable
11920: >16 lelong >0 not stripped
11921: 0 belong&0377777777 042600410 a.out NetBSD/pmax pure
11922: >0 byte &0x80 dynamically linked executable
11923: >0 byte ^0x80 executable
11924: >16 lelong >0 not stripped
11925: 0 belong&0377777777 042600407 a.out NetBSD/pmax
11926: >0 byte &0x80 dynamically linked executable
11927: >0 byte ^0x80
11928: >>0 byte &0x40 position independent
11929: >>20 lelong !0 executable
11930: >>20 lelong =0 object file
11931: >16 lelong >0 not stripped
11932: 0 belong&0377777777 042600507 a.out NetBSD/pmax core
11933: >12 string >\0 from '%s'
11934: >32 lelong !0 (signal %d)
11935:
11936: 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
11937: >0 byte &0x80
11938: >>20 lelong <4096 shared library
11939: >>20 lelong =4096 dynamically linked executable
11940: >>20 lelong >4096 dynamically linked executable
11941: >0 byte ^0x80 executable
11942: >16 lelong >0 not stripped
11943: 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
11944: >0 byte &0x80 dynamically linked executable
11945: >0 byte ^0x80 executable
11946: >16 lelong >0 not stripped
11947: 0 belong&0377777777 043000407 a.out NetBSD/vax 1k
11948: >0 byte &0x80 dynamically linked executable
11949: >0 byte ^0x80
11950: >>0 byte &0x40 position independent
11951: >>20 lelong !0 executable
11952: >>20 lelong =0 object file
11953: >16 lelong >0 not stripped
11954: 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
11955: >12 string >\0 from '%s'
11956: >32 lelong !0 (signal %d)
11957:
11958: 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
11959: >0 byte &0x80
11960: >>20 lelong <4096 shared library
11961: >>20 lelong =4096 dynamically linked executable
11962: >>20 lelong >4096 dynamically linked executable
11963: >0 byte ^0x80 executable
11964: >16 lelong >0 not stripped
11965: 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
11966: >0 byte &0x80 dynamically linked executable
11967: >0 byte ^0x80 executable
11968: >16 lelong >0 not stripped
11969: 0 belong&0377777777 045400407 a.out NetBSD/vax 4k
11970: >0 byte &0x80 dynamically linked executable
11971: >0 byte ^0x80
11972: >>0 byte &0x40 position independent
11973: >>20 lelong !0 executable
11974: >>20 lelong =0 object file
11975: >16 lelong >0 not stripped
11976: 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
11977: >12 string >\0 from '%s'
11978: >32 lelong !0 (signal %d)
11979:
11980: # NetBSD/alpha does not support (and has never supported) a.out objects,
11981: # so no rules are provided for them. NetBSD/alpha ELF objects are
11982: # dealt with in "elf".
11983: 0 lelong 0x00070185 ECOFF NetBSD/alpha binary
11984: >10 leshort 0x0001 not stripped
11985: >10 leshort 0x0000 stripped
11986: 0 belong&0377777777 043200507 a.out NetBSD/alpha core
11987: >12 string >\0 from '%s'
11988: >32 lelong !0 (signal %d)
11989:
11990: 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
11991: >0 byte &0x80
11992: >>20 belong <8192 shared library
11993: >>20 belong =8192 dynamically linked executable
11994: >>20 belong >8192 dynamically linked executable
11995: >0 byte ^0x80 executable
11996: >16 belong >0 not stripped
11997: 0 belong&0377777777 043400410 a.out NetBSD/mips pure
11998: >0 byte &0x80 dynamically linked executable
11999: >0 byte ^0x80 executable
12000: >16 belong >0 not stripped
12001: 0 belong&0377777777 043400407 a.out NetBSD/mips
12002: >0 byte &0x80 dynamically linked executable
12003: >0 byte ^0x80
12004: >>0 byte &0x40 position independent
12005: >>20 belong !0 executable
12006: >>20 belong =0 object file
12007: >16 belong >0 not stripped
12008: 0 belong&0377777777 043400507 a.out NetBSD/mips core
12009: >12 string >\0 from '%s'
12010: >32 belong !0 (signal %d)
12011:
12012: 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
12013: >0 byte &0x80
12014: >>20 lelong <4096 shared library
12015: >>20 lelong =4096 dynamically linked executable
12016: >>20 lelong >4096 dynamically linked executable
12017: >0 byte ^0x80 executable
12018: >16 lelong >0 not stripped
12019: 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
12020: >0 byte &0x80 dynamically linked executable
12021: >0 byte ^0x80 executable
12022: >16 lelong >0 not stripped
12023: 0 belong&0377777777 043600407 a.out NetBSD/arm32
12024: >0 byte &0x80 dynamically linked executable
12025: >0 byte ^0x80
12026: >>0 byte &0x40 position independent
12027: >>20 lelong !0 executable
12028: >>20 lelong =0 object file
12029: >16 lelong >0 not stripped
12030: # NetBSD/arm26 has always used ELF objects, but it shares a core file
12031: # format with NetBSD/arm32.
12032: 0 belong&0377777777 043600507 a.out NetBSD/arm core
12033: >12 string >\0 from '%s'
12034: >32 lelong !0 (signal %d)
12035:
12036: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12037: # $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12038: # netscape: file(1) magic for Netscape files
12039: # "H. Nanosecond" <aldomel@ix.netcom.com>
12040: # version 3 and 4 I think
12041: #
12042:
12043: # Netscape Address book .nab
12044: 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
12045:
12046: # Netscape Communicator address book
12047: 0 string \000\017\102\111 Netscape Communicator address book
12048:
12049: # .snm Caches
12050: 0 string #\ Netscape\ folder\ cache Netscape folder cache
12051: 0 string \000\036\204\220\000 Netscape folder cache
12052: # .n2p
12053: # Net 2 Phone
12054: #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
12055: 0 string SX961999 Net2phone
12056:
12057: #
12058: #This is files ending in .art, FIXME add more rules
12059: 0 string JG\004\016\0\0\0\0 ART
12060:
12061: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12062: # $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12063: # netware: file(1) magic for NetWare Loadable Modules (NLMs)
12064: # From: Mads Martin Joergensen <mmj@suse.de>
12065:
12066: 0 string NetWare\ Loadable\ Module NetWare Loadable Module
12067:
12068: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12069: # $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12070: # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
12071: #
12072: 0 string StartFontMetrics ASCII font metrics
12073: 0 string StartFont ASCII font bits
12074: 0 belong 0x137A2944 NeWS bitmap font
12075: 0 belong 0x137A2947 NeWS font family
12076: 0 belong 0x137A2950 scalable OpenFont binary
12077: 0 belong 0x137A2951 encrypted scalable OpenFont binary
12078: 8 belong 0x137A2B45 X11/NeWS bitmap font
12079: 8 belong 0x137A2B48 X11/NeWS font family
1.1.1.2 ! misho 12080:
1.1 misho 12081: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12082: # $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12083: # nitpicker: file(1) magic for Flowfiles.
12084: # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
12085: 0 string NPFF NItpicker Flow File
12086: >4 byte x V%d.
12087: >5 byte x %d
12088: >6 bedate x started: %s
12089: >10 bedate x stopped: %s
12090: >14 belong x Bytes: %u
12091: >18 belong x Bytes1: %u
12092: >22 belong x Flows: %u
12093: >26 belong x Pkts: %u
12094:
12095: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12096: # $File: ocaml,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12097: # ocaml: file(1) magic for Objective Caml files.
12098: 0 string Caml1999 OCaml
12099: >8 string X exec file
12100: >8 string I interface file (.cmi)
12101: >8 string O object file (.cmo)
12102: >8 string A library file (.cma)
12103: >8 string Y native object file (.cmx)
12104: >8 string Z native library file (.cmxa)
12105: >8 string M abstract syntax tree implementation file
12106: >8 string N abstract syntax tree interface file
12107: >9 string >\0 (Version %3.3s)
1.1.1.2 ! misho 12108:
1.1 misho 12109: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12110: # $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12111: # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
12112: 0 string Octave-1-L Octave binary data (little endian)
12113: 0 string Octave-1-B Octave binary data (big endian)
12114:
12115: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12116: # $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12117: # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
12118: # storage (http://en.wikipedia.org/wiki/Structured_Storage)
12119: # Additional tests for OLE 2 Compound Documents should be under this recipe.
12120:
12121: 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
12122: # - Microstation V8 DGN files (www.bentley.com)
12123: # Last update on 10/23/2006 by Lester Hightower
12124: > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
12125: # - Visio documents
12126: # Last update on 10/23/2006 by Lester Hightower
12127: > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
12128:
12129: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12130: # $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12131: # olf: file(1) magic for OLF executables
12132: #
12133: # We have to check the byte order flag to see what byte order all the
12134: # other stuff in the header is in.
12135: #
12136: # MIPS R3000 may also be for MIPS R2000.
12137: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
12138: #
12139: # Created by Erik Theisen <etheisen@openbsd.org>
12140: # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
12141: 0 string \177OLF OLF
12142: >4 byte 0 invalid class
12143: >4 byte 1 32-bit
12144: >4 byte 2 64-bit
12145: >7 byte 0 invalid os
12146: >7 byte 1 OpenBSD
12147: >7 byte 2 NetBSD
12148: >7 byte 3 FreeBSD
12149: >7 byte 4 4.4BSD
12150: >7 byte 5 Linux
12151: >7 byte 6 SVR4
12152: >7 byte 7 esix
12153: >7 byte 8 Solaris
12154: >7 byte 9 Irix
12155: >7 byte 10 SCO
12156: >7 byte 11 Dell
12157: >7 byte 12 NCR
12158: >5 byte 0 invalid byte order
12159: >5 byte 1 LSB
12160: >>16 leshort 0 no file type,
12161: >>16 leshort 1 relocatable,
12162: >>16 leshort 2 executable,
12163: >>16 leshort 3 shared object,
12164: # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
12165: # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
12166: >>16 leshort 4 core file
12167: >>>(0x38+0xcc) string >\0 of '%s'
12168: >>>(0x38+0x10) lelong >0 (signal %d),
12169: >>16 leshort &0xff00 processor-specific,
12170: >>18 leshort 0 no machine,
12171: >>18 leshort 1 AT&T WE32100 - invalid byte order,
12172: >>18 leshort 2 SPARC - invalid byte order,
12173: >>18 leshort 3 Intel 80386,
12174: >>18 leshort 4 Motorola 68000 - invalid byte order,
12175: >>18 leshort 5 Motorola 88000 - invalid byte order,
12176: >>18 leshort 6 Intel 80486,
12177: >>18 leshort 7 Intel 80860,
12178: >>18 leshort 8 MIPS R3000_BE - invalid byte order,
12179: >>18 leshort 9 Amdahl - invalid byte order,
12180: >>18 leshort 10 MIPS R3000_LE,
12181: >>18 leshort 11 RS6000 - invalid byte order,
12182: >>18 leshort 15 PA-RISC - invalid byte order,
12183: >>18 leshort 16 nCUBE,
12184: >>18 leshort 17 VPP500,
12185: >>18 leshort 18 SPARC32PLUS,
12186: >>18 leshort 20 PowerPC,
12187: >>18 leshort 0x9026 Alpha,
12188: >>20 lelong 0 invalid version
12189: >>20 lelong 1 version 1
12190: >>36 lelong 1 MathCoPro/FPU/MAU Required
12191: >8 string >\0 (%s)
12192: >5 byte 2 MSB
12193: >>16 beshort 0 no file type,
12194: >>16 beshort 1 relocatable,
12195: >>16 beshort 2 executable,
12196: >>16 beshort 3 shared object,
12197: >>16 beshort 4 core file,
12198: >>>(0x38+0xcc) string >\0 of '%s'
12199: >>>(0x38+0x10) belong >0 (signal %d),
12200: >>16 beshort &0xff00 processor-specific,
12201: >>18 beshort 0 no machine,
12202: >>18 beshort 1 AT&T WE32100,
12203: >>18 beshort 2 SPARC,
12204: >>18 beshort 3 Intel 80386 - invalid byte order,
12205: >>18 beshort 4 Motorola 68000,
12206: >>18 beshort 5 Motorola 88000,
12207: >>18 beshort 6 Intel 80486 - invalid byte order,
12208: >>18 beshort 7 Intel 80860,
12209: >>18 beshort 8 MIPS R3000_BE,
12210: >>18 beshort 9 Amdahl,
12211: >>18 beshort 10 MIPS R3000_LE - invalid byte order,
12212: >>18 beshort 11 RS6000,
12213: >>18 beshort 15 PA-RISC,
12214: >>18 beshort 16 nCUBE,
12215: >>18 beshort 17 VPP500,
12216: >>18 beshort 18 SPARC32PLUS,
12217: >>18 beshort 20 PowerPC or cisco 4500,
12218: >>18 beshort 21 cisco 7500,
12219: >>18 beshort 24 cisco SVIP,
12220: >>18 beshort 25 cisco 7200,
12221: >>18 beshort 36 cisco 12000,
12222: >>18 beshort 0x9026 Alpha,
12223: >>20 belong 0 invalid version
12224: >>20 belong 1 version 1
12225: >>36 belong 1 MathCoPro/FPU/MAU Required
1.1.1.2 ! misho 12226:
1.1 misho 12227: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12228: # $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 12229: # os2: file(1) magic for OS/2 files
12230: #
12231:
12232: # Provided 1998/08/22 by
12233: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
12234: 1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
12235: >24 search/1 >\ (URL=<%s>)
12236:
12237: # OS/2 URL objects
12238: # Provided 1998/08/22 by
12239: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
12240: #0 string http: OS/2 URL object text
12241: #>5 string >\ (WWW) <http:%s>
12242: #0 string mailto: OS/2 URL object text
12243: #>7 string >\ (email) <%s>
12244: #0 string news: OS/2 URL object text
12245: #>5 string >\ (Usenet) <%s>
12246: #0 string ftp: OS/2 URL object text
12247: #>4 string >\ (FTP) <ftp:%s>
12248: #0 string file: OS/2 URL object text
12249: #>5 string >\ (Local file) <%s>
12250:
12251: # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
12252: # Carl Hauser (chauser.parc@xerox.com) and
12253: # Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
12254: # list the following header format in inf02a.doc:
12255: #
12256: # int16 ID; // ID magic word (5348h = "HS")
12257: # int8 unknown1; // unknown purpose, could be third letter of ID
12258: # int8 flags; // probably a flag word...
12259: # // bit 0: set if INF style file
12260: # // bit 4: set if HLP style file
12261: # // patching this byte allows reading HLP files
12262: # // using the VIEW command, while help files
12263: # // seem to work with INF settings here as well.
12264: # int16 hdrsize; // total size of header
12265: # int16 unknown2; // unknown purpose
12266: #
12267: 0 string HSP\x01\x9b\x00 OS/2 INF
12268: >107 string >0 (%s)
12269: 0 string HSP\x10\x9b\x00 OS/2 HLP
12270: >107 string >0 (%s)
12271:
12272: # OS/2 INI (this is a guess)
12273: 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
1.1.1.2 ! misho 12274:
1.1 misho 12275: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12276: # $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 12277: # os400: file(1) magic for IBM OS/400 files
12278: #
12279: # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
12280: # In spite of its quite variable format (due to internal memory page
12281: # length differences between CISC and RISC versions of the OS) the
12282: # SAVF structure hasn't suitable offsets to identify the catalog
12283: # header in the first descriptor where there are some useful infos,
12284: # so we must search in a somewhat large area for a particular string
12285: # that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
12286: # descriptor space) preceded by a two byte constant.
12287: #
12288: 1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
12289: >&212 byte 0x01 \b, created with SAVOBJ
12290: >&212 byte 0x02 \b, created with SAVLIB
12291: >&212 byte 0x07 \b, created with SAVCFG
12292: >&212 byte 0x08 \b, created with SAVSECDTA
12293: >&212 byte 0x0A \b, created with SAVSECDTA
12294: >&212 byte 0x0B \b, created with SAVDLO
12295: >&212 byte 0x0D \b, created with SAVLICPGM
12296: >&212 byte 0x11 \b, created with SAVCHGOBJ
12297: >&213 byte 0x44 \b, at least V5R4 to open
12298: >&213 byte 0x43 \b, at least V5R3 to open
12299: >&213 byte 0x42 \b, at least V5R2 to open
12300: >&213 byte 0x41 \b, at least V5R1 to open
12301: >&213 byte 0x40 \b, at least V4R5 to open
12302: >&213 byte 0x3F \b, at least V4R4 to open
12303: >&213 byte 0x3E \b, at least V4R3 to open
12304: >&213 byte 0x3C \b, at least V4R2 to open
12305: >&213 byte 0x3D \b, at least V4R1M4 to open
12306: >&213 byte 0x3B \b, at least V4R1 to open
12307: >&213 byte 0x3A \b, at least V3R7 to open
12308: >&213 byte 0x35 \b, at least V3R6 to open
12309: >&213 byte 0x36 \b, at least V3R2 to open
12310: >&213 byte 0x34 \b, at least V3R1 to open
12311: >&213 byte 0x31 \b, at least V3R0M5 to open
12312: >&213 byte 0x30 \b, at least V2R3 to open
1.1.1.2 ! misho 12313:
! 12314: #------------------------------------------------------------------------------
! 12315: # $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12316: #
12317: # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
12318: #
12319: # Redistribution and use in source and binary forms, with or without
12320: # modification, are permitted provided that the following conditions
12321: # are met:
12322: # 1. Redistributions of source code must retain the above copyright
12323: # notice, this list of conditions and the following disclaimer.
12324: # 2. Redistributions in binary form must reproduce the above copyright
12325: # notice, this list of conditions and the following disclaimer in the
12326: # documentation and/or other materials provided with the distribution.
12327: # 3. All advertising materials mentioning features or use of this software
12328: # must display the following acknowledgement:
12329: # This product includes software developed by Ignatios Souvatzis for
12330: # the NetBSD project.
12331: # 4. The name of the author may not be used to endorse or promote products
12332: # derived from this software without specific prior written permission.
12333: #
12334: #
12335: # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
12336: # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
12337: # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
12338: # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
12339: # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
12340: # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
12341: # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
12342: # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
12343: # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
12344: # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
12345: #
12346: #
12347: #
12348: # OS9/6809 module descriptions:
12349: #
12350: 0 beshort 0x87CD OS9/6809 module:
12351: #
12352: >6 byte&0x0f 0x00 non-executable
12353: >6 byte&0x0f 0x01 machine language
12354: >6 byte&0x0f 0x02 BASIC I-code
12355: >6 byte&0x0f 0x03 Pascal P-code
12356: >6 byte&0x0f 0x04 C I-code
12357: >6 byte&0x0f 0x05 COBOL I-code
12358: >6 byte&0x0f 0x06 Fortran I-code
12359: #
12360: >6 byte&0xf0 0x10 program executable
12361: >6 byte&0xf0 0x20 subroutine
12362: >6 byte&0xf0 0x30 multi-module
12363: >6 byte&0xf0 0x40 data module
12364: #
12365: >6 byte&0xf0 0xC0 system module
12366: >6 byte&0xf0 0xD0 file manager
12367: >6 byte&0xf0 0xE0 device driver
12368: >6 byte&0xf0 0xF0 device descriptor
12369: #
12370: # OS9/m68k stuff (to be continued)
12371: #
12372: 0 beshort 0x4AFC OS9/68K module:
12373: #
12374: # attr
12375: >0x14 byte&0x80 0x80 re-entrant
12376: >0x14 byte&0x40 0x40 ghost
12377: >0x14 byte&0x20 0x20 system-state
12378: #
12379: # lang:
12380: #
12381: >0x13 byte 1 machine language
12382: >0x13 byte 2 BASIC I-code
12383: >0x13 byte 3 Pascal P-code
12384: >0x13 byte 4 C I-code
12385: >0x13 byte 5 COBOL I-code
12386: >0x13 byte 6 Fortran I-code
12387: #
12388: #
12389: # type:
12390: #
12391: >0x12 byte 1 program executable
12392: >0x12 byte 2 subroutine
12393: >0x12 byte 3 multi-module
12394: >0x12 byte 4 data module
12395: >0x12 byte 11 trap library
12396: >0x12 byte 12 system module
12397: >0x12 byte 13 file manager
12398: >0x12 byte 14 device driver
12399: >0x12 byte 15 device descriptor
1.1.1.2 ! misho 12400:
! 12401: #------------------------------------------------------------------------------
! 12402: # $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 12403: #
12404: # Mach magic number info
12405: #
12406: 0 long 0xefbe OSF/Rose object
12407: # I386 magic number info
12408: #
12409: 0 short 0565 i386 COFF object
12410:
12411: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12412: # $File: palm,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 12413: # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
12414: #
12415: # Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
12416:
12417: # appl
12418: 60 belong 0x6170706c PalmOS application
12419: >0 string >\0 "%s"
12420: # TEXt
12421: 60 belong 0x54455874 AportisDoc file
12422: >0 string >\0 "%s"
12423: # HACK
12424: 60 belong 0x4841434b HackMaster hack
12425: >0 string >\0 "%s"
12426:
12427: # Variety of PalmOS document types
12428: # Michael-John Turner <mj@debian.org>
12429: # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
12430: 60 string BVokBDIC BDicty PalmOS document
12431: >0 string >\0 "%s"
12432: 60 string DB99DBOS DB PalmOS document
12433: >0 string >\0 "%s"
12434: 60 string vIMGView FireViewer/ImageViewer PalmOS document
12435: >0 string >\0 "%s"
12436: 60 string PmDBPmDB HanDBase PalmOS document
12437: >0 string >\0 "%s"
12438: 60 string InfoINDB InfoView PalmOS document
12439: >0 string >\0 "%s"
12440: 60 string ToGoToGo iSilo PalmOS document
12441: >0 string >\0 "%s"
12442: 60 string JfDbJBas JFile PalmOS document
12443: >0 string >\0 "%s"
12444: 60 string JfDbJFil JFile Pro PalmOS document
12445: >0 string >\0 "%s"
12446: 60 string DATALSdb List PalmOS document
12447: >0 string >\0 "%s"
12448: 60 string Mdb1Mdb1 MobileDB PalmOS document
12449: >0 string >\0 "%s"
12450: 60 string PNRdPPrs PeanutPress PalmOS document
12451: >0 string >\0 "%s"
12452: 60 string DataPlkr Plucker PalmOS document
12453: >0 string >\0 "%s"
12454: 60 string DataSprd QuickSheet PalmOS document
12455: >0 string >\0 "%s"
12456: 60 string SM01SMem SuperMemo PalmOS document
12457: >0 string >\0 "%s"
12458: 60 string TEXtTlDc TealDoc PalmOS document
12459: >0 string >\0 "%s"
12460: 60 string InfoTlIf TealInfo PalmOS document
12461: >0 string >\0 "%s"
12462: 60 string DataTlMl TealMeal PalmOS document
12463: >0 string >\0 "%s"
12464: 60 string DataTlPt TealPaint PalmOS document
12465: >0 string >\0 "%s"
12466: 60 string dataTDBP ThinkDB PalmOS document
12467: >0 string >\0 "%s"
12468: 60 string TdatTide Tides PalmOS document
12469: >0 string >\0 "%s"
12470: 60 string ToRaTRPW TomeRaider PalmOS document
12471: >0 string >\0 "%s"
12472:
12473: # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
12474: # For version 1.xx zTXTs, outputs version and numbers of bookmarks and
12475: # annotations.
12476: # For other versions, just outputs version.
12477: #
12478: 60 string zTXT A GutenPalm zTXT e-book
12479: >0 string >\0 "%s"
12480: >(0x4E.L) byte 0
12481: >>(0x4E.L+1) byte x (v0.%02d)
12482: >(0x4E.L) byte 1
12483: >>(0x4E.L+1) byte x (v1.%02d)
12484: >>>(0x4E.L+10) beshort >0
12485: >>>>(0x4E.L+10) beshort <2 - 1 bookmark
12486: >>>>(0x4E.L+10) beshort >1 - %d bookmarks
12487: >>>(0x4E.L+14) beshort >0
12488: >>>>(0x4E.L+14) beshort <2 - 1 annotation
12489: >>>>(0x4E.L+14) beshort >1 - %d annotations
12490: >(0x4E.L) byte >1 (v%d.
12491: >>(0x4E.L+1) byte x %02d)
12492:
12493: # Palm OS .prc file types
12494: 60 string libr Palm OS dynamic library data
12495: >0 string >\0 "%s"
12496: 60 string ptch Palm OS operating system patch data
12497: >0 string >\0 "%s"
12498:
12499: # Mobipocket (www.mobipocket.com), donated by Carl Witty
12500: 60 string BOOKMOBI Mobipocket E-book
12501: >0 string >\0 "%s"
12502:
12503: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12504: # $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12505: #
12506: # Parix COFF executables
12507: # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
12508: #
12509: 0 beshort&0xfff 0xACE PARIX
12510: >0 byte&0xf0 0x80 T800
12511: >0 byte&0xf0 0x90 T9000
12512: >19 byte&0x02 0x02 executable
12513: >19 byte&0x02 0x00 object
12514: >19 byte&0x0c 0x00 not stripped
12515:
12516: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12517: # $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12518: # pbm: file(1) magic for Portable Bitmap files
12519: #
12520: # XXX - byte order?
12521: #
12522: 0 short 0x2a17 "compact bitmap" format (Poskanzer)
1.1.1.2 ! misho 12523:
1.1 misho 12524: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12525: # $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12526: # pdf: file(1) magic for Portable Document Format
12527: #
12528:
12529: 0 string %PDF- PDF document
12530: !:mime application/pdf
12531: >5 byte x \b, version %c
12532: >7 byte x \b.%c
12533:
12534: # From: Nick Schmalenberger <nick@schmalenberger.us>
12535: # Forms Data Format
12536: 0 string %FDF- FDF document
12537: >5 byte x \b, version %c
12538: >7 byte x \b.%c
12539:
12540: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12541: # $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $
1.1 misho 12542: # pdp: file(1) magic for PDP-11 executable/object and APL workspace
12543: #
12544: 0 lelong 0101555 PDP-11 single precision APL workspace
12545: 0 lelong 0101554 PDP-11 double precision APL workspace
12546: #
12547: # PDP-11 a.out
12548: #
12549: 0 leshort 0407 PDP-11 executable
12550: >8 leshort >0 not stripped
12551: >15 byte >0 - version %ld
12552:
12553: 0 leshort 0401 PDP-11 UNIX/RT ldp
12554: 0 leshort 0405 PDP-11 old overlay
12555:
12556: 0 leshort 0410 PDP-11 pure executable
12557: >8 leshort >0 not stripped
12558: >15 byte >0 - version %ld
12559:
12560: 0 leshort 0411 PDP-11 separate I&D executable
12561: >8 leshort >0 not stripped
12562: >15 byte >0 - version %ld
12563:
12564: 0 leshort 0437 PDP-11 kernel overlay
12565:
12566: # These last three are derived from 2.11BSD file(1)
12567: 0 leshort 0413 PDP-11 demand-paged pure executable
12568: >8 leshort >0 not stripped
12569:
12570: 0 leshort 0430 PDP-11 overlaid pure executable
12571: >8 leshort >0 not stripped
12572:
12573: 0 leshort 0431 PDP-11 overlaid separate executable
12574: >8 leshort >0 not stripped
1.1.1.2 ! misho 12575:
1.1 misho 12576: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12577: # $File: perl,v 1.16 2009/09/19 16:28:11 christos Exp $
1.1 misho 12578: # perl: file(1) magic for Larry Wall's perl language.
12579: #
12580: # The `eval' lines recognizes an outrageously clever hack.
12581: # Keith Waclena <keith@cerberus.uchicago.edu>
12582: # Send additions to <perl5-porters@perl.org>
1.1.1.2 ! misho 12583: 0 search/1/w #!\ /bin/perl Perl script text executable
1.1 misho 12584: !:mime text/x-perl
12585: 0 search/1 eval\ "exec\ /bin/perl Perl script text
12586: !:mime text/x-perl
1.1.1.2 ! misho 12587: 0 search/1/w #!\ /usr/bin/perl Perl script text executable
1.1 misho 12588: !:mime text/x-perl
12589: 0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
12590: !:mime text/x-perl
1.1.1.2 ! misho 12591: 0 search/1/w #!\ /usr/local/bin/perl Perl script text executable
1.1 misho 12592: !:mime text/x-perl
12593: 0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
12594: !:mime text/x-perl
12595: 0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
12596: !:mime text/x-perl
12597:
12598:
12599: # by Dmitry V. Levin and Alexey Tourbin
12600: # check the first line
12601: 0 search/1 package
12602: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
12603: # not 'p', check other lines
12604: 0 search/1 !p
12605: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
12606: >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
12607:
12608:
12609:
12610: # Perl POD documents
12611: # From: Tom Hukins <tom@eborcom.com>
1.1.1.2 ! misho 12612: 0 search/1/W \=pod\n Perl POD document text
! 12613: 0 search/1/W \n\=pod\n Perl POD document text
! 12614: 0 search/1/W \=head1\ Perl POD document text
! 12615: 0 search/1/W \n\=head1\ Perl POD document text
! 12616: 0 search/1/W \=head2\ Perl POD document text
! 12617: 0 search/1/W \n\=head2\ Perl POD document text
1.1 misho 12618:
12619: # Perl Storable data files.
12620: 0 string perl-store perl Storable (v0.6) data
12621: >4 byte >0 (net-order %d)
12622: >>4 byte &01 (network-ordered)
12623: >>4 byte =3 (major 1)
12624: >>4 byte =2 (major 1)
12625:
12626: 0 string pst0 perl Storable (v0.7) data
12627: >4 byte >0
12628: >>4 byte &01 (network-ordered)
12629: >>4 byte =5 (major 2)
12630: >>4 byte =4 (major 2)
12631: >>5 byte >0 (minor %d)
12632:
12633: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12634: # $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $
1.1 misho 12635: # pgp: file(1) magic for Pretty Good Privacy
12636: # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
12637: #
12638: 0 beshort 0x9900 PGP key public ring
12639: !:mime application/x-pgp-keyring
12640: 0 beshort 0x9501 PGP key security ring
12641: !:mime application/x-pgp-keyring
12642: 0 beshort 0x9500 PGP key security ring
12643: !:mime application/x-pgp-keyring
12644: 0 beshort 0xa600 PGP encrypted data
12645: #!:mime application/pgp-encrypted
12646: #0 string -----BEGIN\040PGP text/PGP armored data
12647: !:mime text/PGP # encoding: armored data
12648: #>15 string PUBLIC\040KEY\040BLOCK- public key block
12649: #>15 string MESSAGE- message
12650: #>15 string SIGNED\040MESSAGE- signed message
12651: #>15 string PGP\040SIGNATURE- signature
12652:
12653: 2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
12654: !:mime application/pgp-keys
12655: 0 string -----BEGIN\040PGP\40MESSAGE- PGP message
12656: !:mime application/pgp
12657: 0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
12658: !:mime application/pgp-signature
12659:
12660: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12661: # $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12662: # pkgadd: file(1) magic for SysV R4 PKG Datastreams
12663: #
12664: 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
12665: !:mime application/x-svr4-package
12666:
12667: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12668: # $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 12669: # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
12670: # From: "Stefan A. Haubenthal" <polluks@web.de>
12671: #
12672: 0 belong 0x00000107 Plan 9 executable, Motorola 68k
12673: 0 belong 0x000001EB Plan 9 executable, Intel 386
12674: 0 belong 0x00000247 Plan 9 executable, Intel 960
12675: 0 belong 0x000002AB Plan 9 executable, SPARC
12676: 0 belong 0x00000407 Plan 9 executable, MIPS R3000
12677: 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
12678: 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
12679: 0 belong 0x000005AB Plan 9 executable, AMD 29000
12680: 0 belong 0x00000647 Plan 9 executable, ARM 7-something
12681: 0 belong 0x000006EB Plan 9 executable, PowerPC
12682: 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
12683: 0 belong 0x0000084B Plan 9 executable, DEC Alpha
12684:
12685: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12686: # $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12687: # plus5: file(1) magic for Plus Five's UNIX MUMPS
12688: #
12689: # XXX - byte order? Paging Hokey....
12690: #
12691: 0 short 0x259 mumps avl global
12692: >2 byte >0 (V%d)
12693: >6 byte >0 with %d byte name
12694: >7 byte >0 and %d byte data cells
12695: 0 short 0x25a mumps blt global
12696: >2 byte >0 (V%d)
12697: >8 short >0 - %d byte blocks
12698: >15 byte 0x00 - P/D format
12699: >15 byte 0x01 - P/K/D format
12700: >15 byte 0x02 - K/D format
12701: >15 byte >0x02 - Bad Flags
12702:
12703: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12704: # $File: printer,v 1.22 2009/09/19 16:28:11 christos Exp $
1.1 misho 12705: # printer: file(1) magic for printer-formatted files
12706: #
12707:
12708: # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
12709: 0 string %! PostScript document text
12710: !:mime application/postscript
1.1.1.2 ! misho 12711: !:apple ASPSTEXT
1.1 misho 12712: >2 string PS-Adobe- conforming
12713: >>11 string >\0 DSC level %.3s
12714: >>>15 string EPS \b, type %s
12715: >>>15 string Query \b, type %s
12716: >>>15 string ExitServer \b, type %s
12717: >>>15 search/1000 %%LanguageLevel:\
12718: >>>>&0 string >\0 \b, Level %s
12719: # Some PCs have the annoying habit of adding a ^D as a document separator
12720: 0 string \004%! PostScript document text
12721: !:mime application/postscript
1.1.1.2 ! misho 12722: !:apple ASPSTEXT
1.1 misho 12723: >3 string PS-Adobe- conforming
12724: >>12 string >\0 DSC level %.3s
12725: >>>16 string EPS \b, type %s
12726: >>>16 string Query \b, type %s
12727: >>>16 string ExitServer \b, type %s
12728: >>>16 search/1000 %%LanguageLevel:\
12729: >>>>&0 string >\0 \b, Level %s
12730: 0 string \033%-12345X%!PS PostScript document
12731:
12732: # DOS EPS Binary File Header
12733: # From: Ed Sznyter <ews@Black.Market.NET>
12734: 0 belong 0xC5D0D3C6 DOS EPS Binary File
12735: >4 long >0 Postscript starts at byte %d
12736: >>8 long >0 length %d
12737: >>>12 long >0 Metafile starts at byte %d
12738: >>>>16 long >0 length %d
12739: >>>20 long >0 TIFF starts at byte %d
12740: >>>>24 long >0 length %d
12741:
12742: # Summary: Adobe's PostScript Printer Description File
12743: # Extension: .ppd
12744: # Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
12745: # Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
12746: #
12747: 0 string *PPD-Adobe:\x20 PPD file
12748: >&0 string x \b, version %s
12749:
12750: # HP Printer Job Language
12751: 0 string \033%-12345X@PJL HP Printer Job Language data
12752: # HP Printer Job Language
12753: # The header found on Win95 HP plot files is the "Silliest Thing possible"
12754: # (TM)
12755: # Every driver puts the language at some random position, with random case
12756: # (LANGUAGE and Language)
12757: # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
12758: # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
12759: #
12760: 0 string \033%-12345X@PJL HP Printer Job Language data
12761: >&0 string >\0 %s
12762: >>&0 string >\0 %s
12763: >>>&0 string >\0 %s
12764: >>>>&0 string >\0 %s
12765: #>15 string \ ENTER\ LANGUAGE\ =
12766: #>31 string PostScript PostScript
12767:
12768: # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
12769: 0 string \033E\033 HP PCL printer data
12770: >3 string \&l0A - default page size
12771: >3 string \&l1A - US executive page size
12772: >3 string \&l2A - US letter page size
12773: >3 string \&l3A - US legal page size
12774: >3 string \&l26A - A4 page size
12775: >3 string \&l80A - Monarch envelope size
12776: >3 string \&l81A - No. 10 envelope size
12777: >3 string \&l90A - Intl. DL envelope size
12778: >3 string \&l91A - Intl. C5 envelope size
12779: >3 string \&l100A - Intl. B5 envelope size
12780: >3 string \&l-81A - No. 10 envelope size (landscape)
12781: >3 string \&l-90A - Intl. DL envelope size (landscape)
12782:
12783: # IMAGEN printer-ready files:
12784: 0 string @document( Imagen printer
12785: # this only works if "language xxx" is first item in Imagen header.
12786: >10 string language\ impress (imPRESS data)
12787: >10 string language\ daisy (daisywheel text)
12788: >10 string language\ diablo (daisywheel text)
12789: >10 string language\ printer (line printer emulation)
12790: >10 string language\ tektronix (Tektronix 4014 emulation)
12791: # Add any other languages that your Imagen uses - remember
12792: # to keep the word `text' if the file is human-readable.
12793: # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
12794: #
12795: # Now magic for IMAGEN font files...
12796: 0 string Rast RST-format raster font data
12797: >45 string >0 face %s
12798: # From Jukka Ukkonen
12799: 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
12800:
12801: # From <mike@flyn.org>
12802: # These are the /etc/magic entries to decode data sent to an Epson printer.
12803: 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
12804:
12805:
12806: #------------------------------------------------------------------------------
12807: # zenographics: file(1) magic for Zenographics ZjStream printer data
12808: # Rick Richardson rickr@mn.rr.com
12809: 0 string JZJZ
12810: >0x12 string ZZ Zenographics ZjStream printer data (big-endian)
12811: 0 string ZJZJ
12812: >0x12 string ZZ Zenographics ZjStream printer data (little-endian)
12813:
12814:
12815: #------------------------------------------------------------------------------
12816: # Oak Technologies printer stream
12817: # Rick Richardson <rickr@mn.rr.com>
12818: 0 string OAK
12819: >0x07 byte 0
12820: >0x0b byte 0 Oak Technologies printer stream
12821:
12822: # This would otherwise be recognized as PostScript - nick@debian.org
12823: 0 string %!VMF SunClock's Vector Map Format data
12824:
12825: #------------------------------------------------------------------------------
12826: # HP LaserJet 1000 series downloadable firmware file
12827: 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
12828:
12829: # From: Paolo <oopla@users.sf.net>
12830: # Epson ESC/Page, ESC/PageColor
12831: 0 string \x1b\x01@EJL Epson ESC/Page language printer data
12832:
12833: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12834: # $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12835: # project: file(1) magic for Project management
12836: #
12837: # Magic strings for ftnchek project files. Alexander Mai
12838: 0 string FTNCHEK_\ P project file for ftnchek
12839: >10 string 1 version 2.7
12840: >10 string 2 version 2.8 to 2.10
12841: >10 string 3 version 2.11 or later
12842:
12843: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12844: # $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 12845: # psdbms: file(1) magic for psdatabase
12846: #
12847: 0 belong&0xff00ffff 0x56000000 ps database
12848: >1 string >\0 version %s
12849: >4 string >\0 from kernel %s
12850:
12851: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12852: # $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 12853: # pulsar: file(1) magic for Pulsar POP3 daemon binary files
12854: #
12855: # http://pulsar.sourceforge.net
12856: # mailto:rok.papez@lugos.si
12857: #
12858:
12859: 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
12860: >4 ubelong x Version: %d.
12861: >8 ubelong x \b%d
12862:
12863:
12864: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12865: # $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 12866: # pyramid: file(1) magic for Pyramids
12867: #
12868: # XXX - byte order?
12869: #
12870: 0 long 0x50900107 Pyramid 90x family executable
12871: 0 long 0x50900108 Pyramid 90x family pure executable
12872: >16 long >0 not stripped
12873: 0 long 0x5090010b Pyramid 90x family demand paged pure executable
12874: >16 long >0 not stripped
12875:
12876: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12877: # $File: python,v 1.12 2009/10/27 14:49:57 christos Exp $
1.1 misho 12878: # python: file(1) magic for python
12879: #
12880: # From: David Necas <yeti@physics.muni.cz>
12881: # often the module starts with a multiline string
12882: 0 string """ a python script text executable
1.1.1.2 ! misho 12883: # MAGIC as specified in Python/import.c (1.5 to 2.6a1 and 3.1a0, assuming
! 12884: # that Py_UnicodeFlag is off for Python 2)
1.1 misho 12885: # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
12886: 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
12887: 0 belong 0x87c60d0a python 2.0 byte-compiled
12888: 0 belong 0x2aeb0d0a python 2.1 byte-compiled
12889: 0 belong 0x2ded0d0a python 2.2 byte-compiled
12890: 0 belong 0x3bf20d0a python 2.3 byte-compiled
12891: 0 belong 0x6df20d0a python 2.4 byte-compiled
12892: 0 belong 0xb3f20d0a python 2.5 byte-compiled
1.1.1.2 ! misho 12893: 0 belong 0xd1f20d0a python 2.6 byte-compiled
! 12894: 0 belong 0x3b0c0d0a python 3.0 byte-compiled
! 12895: 0 belong 0x4f0c0d0a python 3.1 byte-compiled
! 12896:
! 12897: 0 search/1/w #!\ /usr/bin/python Python script text executable
! 12898: !:mime text/x-python
! 12899: 0 search/1/w #!\ /usr/local/bin/python Python script text executable
! 12900: !:mime text/x-python
! 12901: 0 search/1 #!/usr/bin/env\ python Python script text executable
! 12902: !:mime text/x-python
! 12903: 0 search/1 #!\ /usr/bin/env\ ruby Python script text executable
! 12904: !:mime text/x-python
1.1 misho 12905:
12906: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12907: # $File: revision,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 12908: # file(1) magic for revision control files
12909: # From Hendrik Scholz <hendrik@scholz.net>
12910: 0 string /1\ :pserver: cvs password text file
12911:
12912: # Conary changesets
12913: # From: Jonathan Smith <smithj@rpath.com>
12914: 0 belong 0xea3f81bb Conary changeset data
12915:
12916: # Type: Git bundles (git-bundle)
12917: # From: Josh Triplett <josh@freedesktop.org>
12918: 0 string #\ v2\ git\ bundle\n Git bundle
12919:
1.1.1.2 ! misho 12920: # Type: Git pack
! 12921: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 12922: # The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
! 12923: # those have a little-endian offset immediately following the magic 'PACK',
! 12924: # the first byte of which is never 0, while the first byte of the Git pack
! 12925: # version, since it's a tiny number stored in big-endian format, is always 0.
! 12926: 0 string PACK\0 Git pack
! 12927: >4 belong >0 \b, version %d
! 12928: >>8 belong >0 \b, %d objects
! 12929:
! 12930: # Type: Git pack index
! 12931: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
! 12932: 0 string \377tOc Git pack index
! 12933: >4 belong =2 \b, version 2
! 12934:
! 12935: # Type: Git index file
! 12936: # From: Frédéric Brière <fbriere@fbriere.net>
! 12937: 0 string DIRC Git index
! 12938: >4 belong >0 \b, version %d
! 12939: >>8 belong >0 \b, %d entries
! 12940:
1.1 misho 12941: # Type: Mercurial bundles
12942: # From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
12943: 0 string HG10 Mercurial bundle,
12944: >4 string UN uncompressed
12945: >4 string BZ bzip2 compressed
12946:
12947: # Type: Subversion (SVN) dumps
12948: # From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
12949: 0 string SVN-fs-dump-format-version: Subversion dumpfile
12950: >28 string >\0 (version: %s)
12951:
12952: # Type: Bazaar revision bundles and merge requests
12953: # URL: http://www.bazaar-vcs.org/
12954: # From: Jelmer Vernooij <jelmer@samba.org>
12955: 0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle
12956: 0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
12957:
12958: #------------------------------------------------------------------------------
1.1.1.2 ! misho 12959: # $File: riff,v 1.18 2009/09/19 16:28:12 christos Exp $
1.1 misho 12960: # riff: file(1) magic for RIFF format
12961: # See
12962: #
12963: # http://www.seanet.com/users/matts/riffmci/riffmci.htm
12964: #
12965: # AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi>
12966: #
12967: 0 string RIFF RIFF (little-endian) data
12968: # RIFF Palette format
12969: >8 string PAL \b, palette
12970: >>16 leshort x \b, version %d
12971: >>18 leshort x \b, %d entries
12972: # RIFF Device Independent Bitmap format
12973: >8 string RDIB \b, device-independent bitmap
12974: >>16 string BM
12975: >>>30 leshort 12 \b, OS/2 1.x format
12976: >>>>34 leshort x \b, %d x
12977: >>>>36 leshort x %d
12978: >>>30 leshort 64 \b, OS/2 2.x format
12979: >>>>34 leshort x \b, %d x
12980: >>>>36 leshort x %d
12981: >>>30 leshort 40 \b, Windows 3.x format
12982: >>>>34 lelong x \b, %d x
12983: >>>>38 lelong x %d x
12984: >>>>44 leshort x %d
12985: # RIFF MIDI format
12986: >8 string RMID \b, MIDI
12987: # RIFF Multimedia Movie File format
12988: >8 string RMMP \b, multimedia movie
12989: # RIFF wrapper for MP3
12990: >8 string RMP3 \b, MPEG Layer 3 audio
12991: # Microsoft WAVE format (*.wav)
12992: >8 string WAVE \b, WAVE audio
12993: !:mime audio/x-wav
12994: >>20 leshort 1 \b, Microsoft PCM
12995: >>>34 leshort >0 \b, %d bit
12996: >>20 leshort 2 \b, Microsoft ADPCM
12997: >>20 leshort 6 \b, ITU G.711 A-law
12998: >>20 leshort 7 \b, ITU G.711 mu-law
1.1.1.2 ! misho 12999: >>20 leshort 8 \b, Microsoft DTS
1.1 misho 13000: >>20 leshort 17 \b, IMA ADPCM
13001: >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
13002: >>20 leshort 49 \b, GSM 6.10
13003: >>20 leshort 64 \b, ITU G.721 ADPCM
13004: >>20 leshort 80 \b, MPEG
13005: >>20 leshort 85 \b, MPEG Layer 3
1.1.1.2 ! misho 13006: >>20 leshort 0x2001 \b, DTS
1.1 misho 13007: >>22 leshort =1 \b, mono
13008: >>22 leshort =2 \b, stereo
13009: >>22 leshort >2 \b, %d channels
13010: >>24 lelong >0 %d Hz
13011: # Corel Draw Picture
13012: >8 string CDRA \b, Corel Draw Picture
13013: !:mime image/x-coreldraw
13014: # AVI == Audio Video Interleave
13015: >8 string AVI\040 \b, AVI
13016: !:mime video/x-msvideo
13017: >>12 string LIST
13018: >>>20 string hdrlavih
13019: >>>>&36 lelong x \b, %lu x
13020: >>>>&40 lelong x %lu,
13021: >>>>&4 lelong >1000000 <1 fps,
13022: >>>>&4 lelong 1000000 1.00 fps,
13023: >>>>&4 lelong 500000 2.00 fps,
13024: >>>>&4 lelong 333333 3.00 fps,
13025: >>>>&4 lelong 250000 4.00 fps,
13026: >>>>&4 lelong 200000 5.00 fps,
13027: >>>>&4 lelong 166667 6.00 fps,
13028: >>>>&4 lelong 142857 7.00 fps,
13029: >>>>&4 lelong 125000 8.00 fps,
13030: >>>>&4 lelong 111111 9.00 fps,
13031: >>>>&4 lelong 100000 10.00 fps,
13032: # ]9.9,10.1[
13033: >>>>&4 lelong <101010
13034: >>>>>&-4 lelong >99010
13035: >>>>>>&-4 lelong !100000 ~10 fps,
13036: >>>>&4 lelong 83333 12.00 fps,
13037: # ]11.9,12.1[
13038: >>>>&4 lelong <84034
13039: >>>>>&-4 lelong >82645
13040: >>>>>>&-4 lelong !83333 ~12 fps,
13041: >>>>&4 lelong 66667 15.00 fps,
13042: # ]14.9,15.1[
13043: >>>>&4 lelong <67114
13044: >>>>>&-4 lelong >66225
13045: >>>>>>&-4 lelong !66667 ~15 fps,
13046: >>>>&4 lelong 50000 20.00 fps,
13047: >>>>&4 lelong 41708 23.98 fps,
13048: >>>>&4 lelong 41667 24.00 fps,
13049: # ]23.9,24.1[
13050: >>>>&4 lelong <41841
13051: >>>>>&-4 lelong >41494
13052: >>>>>>&-4 lelong !41708
13053: >>>>>>>&-4 lelong !41667 ~24 fps,
13054: >>>>&4 lelong 40000 25.00 fps,
13055: # ]24.9,25.1[
13056: >>>>&4 lelong <40161
13057: >>>>>&-4 lelong >39841
13058: >>>>>>&-4 lelong !40000 ~25 fps,
13059: >>>>&4 lelong 33367 29.97 fps,
13060: >>>>&4 lelong 33333 30.00 fps,
13061: # ]29.9,30.1[
13062: >>>>&4 lelong <33445
13063: >>>>>&-4 lelong >33223
13064: >>>>>>&-4 lelong !33367
13065: >>>>>>>&-4 lelong !33333 ~30 fps,
13066: >>>>&4 lelong <32224 >30 fps,
13067: ##>>>>&4 lelong x (%lu)
13068: ##>>>>&20 lelong x %lu frames,
13069: # Note: The tests below assume that the AVI has 1 or 2 streams,
13070: # "vids" optionally followed by "auds".
13071: # (Should cover 99.9% of all AVIs.)
13072: # assuming avih length = 56
13073: >>>88 string LIST
13074: >>>>96 string strlstrh
13075: >>>>>108 string vids video:
13076: >>>>>>&0 lelong 0 uncompressed
13077: # skip past vids strh
13078: >>>>>>(104.l+108) string strf
13079: >>>>>>>(104.l+132) lelong 1 RLE 8bpp
13080: >>>>>>>(104.l+132) string/c cvid Cinepak
13081: >>>>>>>(104.l+132) string/c i263 Intel I.263
13082: >>>>>>>(104.l+132) string/c iv32 Indeo 3.2
13083: >>>>>>>(104.l+132) string/c iv41 Indeo 4.1
13084: >>>>>>>(104.l+132) string/c iv50 Indeo 5.0
13085: >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
13086: >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
13087: >>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
13088: >>>>>>>(104.l+132) string/c mjpg Motion JPEG
13089: >>>>>>>(104.l+132) string/c div3 DivX 3
13090: >>>>>>>>112 string/c div3 Low-Motion
13091: >>>>>>>>112 string/c div4 Fast-Motion
13092: >>>>>>>(104.l+132) string/c divx DivX 4
13093: >>>>>>>(104.l+132) string/c dx50 DivX 5
13094: >>>>>>>(104.l+132) string/c xvid XviD
13095: >>>>>>>(104.l+132) string/c h264 H.264
13096: >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
13097: >>>>>>>(104.l+132) string/c h264 X.264 or H.264
13098: >>>>>>>(104.l+132) lelong 0
13099: ##>>>>>>>(104.l+132) string x (%.4s)
13100: # skip past first (video) LIST
13101: >>>>(92.l+96) string LIST
13102: >>>>>(92.l+104) string strlstrh
13103: >>>>>>(92.l+116) string auds \b, audio:
13104: # auds strh length = 56:
13105: >>>>>>>(92.l+172) string strf
13106: >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
13107: >>>>>>>>(92.l+180) leshort 0x0002 ADPCM
13108: >>>>>>>>(92.l+180) leshort 0x0006 aLaw
13109: >>>>>>>>(92.l+180) leshort 0x0007 uLaw
13110: >>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
13111: >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
13112: >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
13113: >>>>>>>>(92.l+180) leshort 0x0161 DivX
13114: ##>>>>>>>>(92.l+180) leshort x (0x%.4x)
13115: >>>>>>>>(92.l+182) leshort 1 (mono,
13116: >>>>>>>>(92.l+182) leshort 2 (stereo,
13117: >>>>>>>>(92.l+182) leshort >2 (%d channels,
13118: >>>>>>>>(92.l+184) lelong x %d Hz)
13119: # auds strh length = 64:
13120: >>>>>>>(92.l+180) string strf
13121: >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
13122: >>>>>>>>(92.l+188) leshort 0x0002 ADPCM
13123: >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
13124: >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
13125: >>>>>>>>(92.l+188) leshort 0x0161 DivX
13126: ##>>>>>>>>(92.l+188) leshort x (0x%.4x)
13127: >>>>>>>>(92.l+190) leshort 1 (mono,
13128: >>>>>>>>(92.l+190) leshort 2 (stereo,
13129: >>>>>>>>(92.l+190) leshort >2 (%d channels,
13130: >>>>>>>>(92.l+192) lelong x %d Hz)
13131: # Animated Cursor format
13132: >8 string ACON \b, animated cursor
13133: # SoundFont 2 <mpruett@sgi.com>
13134: >8 string sfbk SoundFont/Bank
13135: # MPEG-1 wrapped in a RIFF, apparently
13136: >8 string CDXA \b, wrapped MPEG-1 (CDXA)
13137: >8 string 4XMV \b, 4X Movie file
13138:
13139: #
13140: # XXX - some of the below may only appear in little-endian form.
13141: #
13142: # Also "MV93" appears to be for one form of Macromedia Director
13143: # files, and "GDMF" appears to be another multimedia format.
13144: #
13145: 0 string RIFX RIFF (big-endian) data
13146: # RIFF Palette format
13147: >8 string PAL \b, palette
13148: >>16 beshort x \b, version %d
13149: >>18 beshort x \b, %d entries
13150: # RIFF Device Independent Bitmap format
13151: >8 string RDIB \b, device-independent bitmap
13152: >>16 string BM
13153: >>>30 beshort 12 \b, OS/2 1.x format
13154: >>>>34 beshort x \b, %d x
13155: >>>>36 beshort x %d
13156: >>>30 beshort 64 \b, OS/2 2.x format
13157: >>>>34 beshort x \b, %d x
13158: >>>>36 beshort x %d
13159: >>>30 beshort 40 \b, Windows 3.x format
13160: >>>>34 belong x \b, %d x
13161: >>>>38 belong x %d x
13162: >>>>44 beshort x %d
13163: # RIFF MIDI format
13164: >8 string RMID \b, MIDI
13165: # RIFF Multimedia Movie File format
13166: >8 string RMMP \b, multimedia movie
13167: # Microsoft WAVE format (*.wav)
13168: >8 string WAVE \b, WAVE audio
13169: >>20 leshort 1 \b, Microsoft PCM
13170: >>>34 leshort >0 \b, %d bit
13171: >>22 beshort =1 \b, mono
13172: >>22 beshort =2 \b, stereo
13173: >>22 beshort >2 \b, %d channels
13174: >>24 belong >0 %d Hz
13175: # Corel Draw Picture
13176: >8 string CDRA \b, Corel Draw Picture
13177: # AVI == Audio Video Interleave
13178: >8 string AVI\040 \b, AVI
13179: # Animated Cursor format
13180: >8 string ACON \b, animated cursor
13181: # Notation Interchange File Format (big-endian only)
13182: >8 string NIFF \b, Notation Interchange File Format
13183: # SoundFont 2 <mpruett@sgi.com>
13184: >8 string sfbk SoundFont/Bank
1.1.1.2 ! misho 13185:
1.1 misho 13186: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13187: # $File: rpm,v 1.9 2009/11/06 13:53:52 christos Exp $
1.1 misho 13188: #
13189: # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
13190: #
13191: 0 beshort 0xedab
13192: >2 beshort 0xeedb RPM
13193: !:mime application/x-rpm
13194: >>4 byte x v%d
1.1.1.2 ! misho 13195: >>5 byte x \b.%d
1.1 misho 13196: >>6 beshort 1 src
1.1.1.2 ! misho 13197: >>6 beshort 0 bin
! 13198: >>>8 beshort 1 i386/x86_64
! 13199: >>>8 beshort 2 Alpha/Sparc64
! 13200: >>>8 beshort 3 Sparc
! 13201: >>>8 beshort 4 MIPS
! 13202: >>>8 beshort 5 PowerPC
! 13203: >>>8 beshort 6 68000
! 13204: >>>8 beshort 7 SGI
! 13205: >>>8 beshort 8 RS6000
! 13206: >>>8 beshort 9 IA64
! 13207: >>>8 beshort 10 Sparc64
! 13208:
! 13209: #delta RPM Daniel Novotny (dnovotny@redhat.com)
! 13210: 0 string drpm Delta RPM
! 13211: !:mime application/x-rpm
! 13212: >12 string x %s
! 13213:
! 13214: >>>8 beshort 11 MIPSel
! 13215: >>>8 beshort 12 ARM
! 13216: >>>8 beshort 13 MiNT
! 13217: >>>8 beshort 14 S/390
! 13218: >>>8 beshort 15 S/390x
! 13219: >>>8 beshort 16 PowerPC64
! 13220: >>>8 beshort 17 SuperH
! 13221: >>>8 beshort 18 Xtensa
1.1 misho 13222: >>10 string x %s
13223:
1.1.1.2 ! misho 13224: # Type: Delta RPM
! 13225: # From: Daniel Novotny (dnovotny@redhat.com)
! 13226: 0 string drpm Delta RPM
! 13227: !:mime application/x-rpm
! 13228: >12 string x %s
! 13229:
1.1 misho 13230: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13231: # $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 13232: # rtf: file(1) magic for Rich Text Format (RTF)
13233: #
13234: # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
13235: #
13236: 0 string {\\rtf Rich Text Format data,
13237: !:mime text/rtf
13238: >5 string 1 version 1,
13239: >>6 string \\ansi ANSI
13240: >>6 string \\mac Apple Macintosh
13241: >>6 string \\pc IBM PC, code page 437
13242: >>6 string \\pca IBM PS/2, code page 850
13243: >>6 default x unknown character set
13244: >5 default x unknown version
1.1.1.2 ! misho 13245:
1.1 misho 13246: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13247: # $File: ruby,v 1.3 2009/09/19 16:28:12 christos Exp $
! 13248: # ruby: file(1) magic for Ruby scripting language
1.1 misho 13249: # URL: http://www.ruby-lang.org/
13250: # From: Reuben Thomas <rrt@sc3d.org>
13251:
13252: # Ruby scripts
1.1.1.2 ! misho 13253: 0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
! 13254: !:mime text/x-ruby
! 13255: 0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
! 13256: !:mime text/x-ruby
1.1 misho 13257: 0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
1.1.1.2 ! misho 13258: !:mime text/x-ruby
1.1 misho 13259: 0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
1.1.1.2 ! misho 13260: !:mime text/x-ruby
1.1 misho 13261:
13262: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13263: # $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 13264: # sc: file(1) magic for "sc" spreadsheet
13265: #
13266: 38 string Spreadsheet sc spreadsheet file
13267: !:mime application/x-sc
13268:
13269: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13270: # $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 13271: # sccs: file(1) magic for SCCS archives
13272: #
13273: # SCCS archive structure:
13274: # \001h01207
13275: # \001s 00276/00000/00000
13276: # \001d D 1.1 87/09/23 08:09:20 ian 1 0
13277: # \001c date and time created 87/09/23 08:09:20 by ian
13278: # \001e
13279: # \001u
13280: # \001U
13281: # ... etc.
13282: # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
13283: # *Sigh*. And these both came from various parts of the USG.
13284: # Maybe we should just switch everybody from SCCS to RCS!
13285: # Further, you can't just say '\001h0', because the five-digit number
13286: # is a checksum that could (presumably) have any leading digit,
13287: # and we don't have regular expression matching yet.
13288: # Hence the following official kludge:
13289: 8 string \001s\ SCCS archive data
1.1.1.2 ! misho 13290:
1.1 misho 13291: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13292: # $File: scientific,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 13293: # scientific: file(1) magic for scientific formats
13294: #
13295: # From: Joe Krahn <krahn@niehs.nih.gov>
13296:
13297: ########################################################
13298: # CCP4 data and plot files:
13299: 0 string MTZ\040 MTZ reflection file
13300:
13301: 92 string PLOT%%84 Plot84 plotting file
13302: >52 byte 1 , Little-endian
13303: >55 byte 1 , Big-endian
13304:
13305: ########################################################
13306: # Electron density MAP/MASK formats
13307:
13308: 0 string EZD_MAP NEWEZD Electron Density Map
13309: 109 string MAP\040( Old EZD Electron Density Map
13310:
13311: 0 string/c :-)\040Origin BRIX Electron Density Map
13312: >170 string >0 , Sigma:%.12s
13313: #>4 string >0 %.178s
13314: #>4 addr x %.178s
13315:
13316: 7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
13317: 9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
13318:
13319: 208 string MAP\040 CCP4 Electron Density Map
13320: # Assumes same stamp for float and double (normal case)
13321: >212 byte 17 \b, Big-endian
13322: >212 byte 34 \b, VAX format
13323: >212 byte 68 \b, Little-endian
13324: >212 byte 85 \b, Convex native
13325:
13326: ############################################################
13327: # X-Ray Area Detector images
13328: 0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
13329: >796 lelong <20 Little-endian, IP #%d,
13330: >>768 lelong >0 Size=%dx
13331: >>772 lelong >0 \b%d
13332: >796 belong <20 Big-endian, IP #%d,
13333: >>768 belong >0 Size=%dx
13334: >>772 belong >0 \b%d
13335:
13336: 0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
13337: >796 lelong <20 Little-endian, IP #%d,
13338: >>768 lelong >0 Size=%dx
13339: >>772 lelong >0 \b%d
13340: >796 belong <20 Big-endian, IP #%d,
13341: >>768 belong >0 Size=%dx
13342: >>772 belong >0 \b%d
13343:
13344:
13345: 1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
13346: >1072 ulong >1 Compressed(%d),
13347: >1100 ulong >1 %d headers,
13348: >1104 ulong >0 %d x
13349: >1108 ulong >0 %d,
13350: >1120 ulong >0 %d bits/pixel
13351:
13352: # Type: GEDCOM genealogical (family history) data
13353: # From: Giuseppe Bilotta
13354: 0 search/1/c 0\ HEAD GEDCOM genealogy text
13355: >&0 search 1\ GEDC
13356: >>&0 search 2\ VERS version
13357: >>>&1 search/1 >\0 %s
13358: # From: Phil Endecott <phil05@chezphil.org>
13359: 0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
13360: 0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
13361: 0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
13362: 0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
1.1.1.2 ! misho 13363:
! 13364: # PDB: Protein Data Bank files
! 13365: # Adam Buchbinder <adam.buchbinder@gmail.com>
! 13366: #
! 13367: # http://www.wwpdb.org/documentation/format32/sect2.html
! 13368: # http://www.ch.ic.ac.uk/chemime/
! 13369: #
! 13370: # The PDB file format is fixed-field, 80 columns. From the spec:
! 13371: #
! 13372: # COLS DATA
! 13373: # 1 - 6 "HEADER"
! 13374: # 11 - 50 String(40)
! 13375: # 51 - 59 Date
! 13376: # 63 - 66 IDcode
! 13377: #
! 13378: # Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
! 13379: # format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
! 13380: # uppercase letters. However, examples have been seen without the date string,
! 13381: # e.g., the example on the chemime site.
! 13382: 0 string HEADER\ \ \ \
! 13383: >&0 regex/1 \^.{40}
! 13384: >>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
! 13385: >>>&0 regex/1s [A-Z0-9]{4}.{14}$
! 13386: >>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s
! 13387: !:mime chemical/x-pdb
! 13388: >>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
! 13389:
! 13390: # Type: GDSII Stream file
! 13391: 0 belong 0x00060002 GDSII Stream file
! 13392: >4 byte 0x00
! 13393: >>5 byte x version %d.0
! 13394: >4 byte >0x00 version %d
! 13395: >>5 byte x \b.%d
! 13396:
! 13397: #------------------------------------------------------------------------------
! 13398: # $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 13399: 0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
13400: 0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
13401: 0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
13402: # Type: SE Linux policy modules *.pp reference policy
13403: # for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
13404: # URL: http://doc.coker.com.au/computers/selinux-magic
13405: # From: Russell Coker <russell@coker.com.au>
13406:
13407: 0 lelong 0xf97cff8f SE Linux modular policy
13408: >4 lelong x version %d,
13409: >8 lelong x %d sections,
13410: >>(12.l) lelong 0xf97cff8d
13411: >>>(12.l+27) lelong x mod version %d,
13412: >>>(12.l+31) lelong 0 Not MLS,
13413: >>>(12.l+31) lelong 1 MLS,
13414: >>>(12.l+23) lelong 2
13415: >>>>(12.l+47) string >\0 module name %s
13416: >>>(12.l+23) lelong 1 base
13417:
13418: 1 string policy_module( SE Linux policy module source
13419: 2 string policy_module( SE Linux policy module source
13420:
13421: 0 string ##\ <summary> SE Linux policy interface source
13422:
13423: #0 search gen_context( SE Linux policy file contexts
13424:
13425: #0 search gen_sens( SE Linux policy MLS constraints source
13426:
13427: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13428: # $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 13429: # sendmail: file(1) magic for sendmail config files
13430: #
13431: # XXX - byte order?
13432: #
13433: 0 byte 046 Sendmail frozen configuration
13434: >16 string >\0 - version %s
13435: 0 short 0x271c Sendmail frozen configuration
13436: >16 string >\0 - version %s
13437:
13438: #------------------------------------------------------------------------------
13439: # sendmail: file(1) magic for sendmail m4(1) files
13440: #
13441: # From Hendrik Scholz <hendrik@scholz.net>
13442: # i.e. files in /usr/share/sendmail/cf/
13443: #
13444: 0 string divert(-1)\n sendmail m4 text file
13445:
13446:
13447: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13448: # $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
1.1 misho 13449: # sequent: file(1) magic for Sequent machines
13450: #
13451: # Sequent information updated by Don Dwiggins <atsun!dwiggins>.
13452: # For Sequent's multiprocessor systems (incomplete).
13453: 0 lelong 0x00ea BALANCE NS32000 .o
13454: >16 lelong >0 not stripped
13455: >124 lelong >0 version %ld
13456: 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
13457: >16 lelong >0 not stripped
13458: >124 lelong >0 version %ld
13459: 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
13460: >16 lelong >0 not stripped
13461: >124 lelong >0 version %ld
13462: 0 lelong 0x30ea BALANCE NS32000 standalone executable
13463: >16 lelong >0 not stripped
13464: >124 lelong >0 version %ld
13465: #
13466: # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
13467: # Symmetry magic nums will not be reached if DOS COM comes before them;
13468: # byte 0xeb is matched before these get a chance.
13469: 0 leshort 0x12eb SYMMETRY i386 .o
13470: >16 lelong >0 not stripped
13471: >124 lelong >0 version %ld
13472: 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
13473: >16 lelong >0 not stripped
13474: >124 lelong >0 version %ld
13475: 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
13476: >16 lelong >0 not stripped
13477: >124 lelong >0 version %ld
13478: 0 leshort 0x42eb SYMMETRY i386 standalone executable
13479: >16 lelong >0 not stripped
13480: >124 lelong >0 version %ld
13481:
13482: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13483: # $File: sgi,v 1.17 2009/09/19 16:28:12 christos Exp $
1.1 misho 13484: # sgi: file(1) magic for Silicon Graphics applications
13485:
13486: #
13487: #
13488: # Performance Co-Pilot file types
13489: 0 string PmNs PCP compiled namespace (V.0)
13490: 0 string PmN PCP compiled namespace
13491: >3 string >\0 (V.%1.1s)
13492: #3 lelong 0x84500526 PCP archive
13493: 3 belong 0x84500526 PCP archive
13494: >7 byte x (V.%d)
13495: #>20 lelong -2 temporal index
13496: #>20 lelong -1 metadata
13497: #>20 lelong 0 log volume #0
13498: #>20 lelong >0 log volume #%ld
13499: >20 belong -2 temporal index
13500: >20 belong -1 metadata
13501: >20 belong 0 log volume #0
13502: >20 belong >0 log volume #%ld
13503: >24 string >\0 host: %s
13504: 0 string PCPFolio PCP
13505: >9 string Version: Archive Folio
13506: >18 string >\0 (V.%s)
13507: 0 string #pmchart PCP pmchart view
13508: >9 string Version
13509: >17 string >\0 (V%-3.3s)
13510: 0 string #kmchart PCP kmchart view
13511: >9 string Version
13512: >17 string >\0 (V.%s)
13513: 0 string pmview PCP pmview config
13514: >7 string Version
13515: >15 string >\0 (V%-3.3s)
13516: 0 string #pmlogger PCP pmlogger config
13517: >10 string Version
13518: >18 string >\0 (V%1.1s)
13519: 0 string #pmdahotproc PCP pmdahotproc config
13520: >13 string Version
13521: >21 string >\0 (V%-3.3s)
13522: 0 string PcPh PCP Help
13523: >4 string 1 Index
13524: >4 string 2 Text
13525: >5 string >\0 (V.%1.1s)
13526: 0 string #pmieconf-rules PCP pmieconf rules
13527: >16 string >\0 (V.%1.1s)
13528: 3 string pmieconf-pmie PCP pmie config
13529: >17 string >\0 (V.%1.1s)
13530:
13531: # SpeedShop data files
13532: 0 lelong 0x13130303 SpeedShop data file
13533:
13534: # mdbm files
13535: 0 lelong 0x01023962 mdbm file, version 0 (obsolete)
13536: 0 string mdbm mdbm file,
13537: >5 byte x version %d,
13538: >6 byte x 2^%d pages,
13539: >7 byte x pagesize 2^%d,
13540: >17 byte x hash %d,
13541: >11 byte x dataformat %d
13542:
13543: # Alias Maya files
13544: 0 string //Maya ASCII Alias Maya Ascii File,
13545: >13 string >\0 version %s
13546: 8 string MAYAFOR4 Alias Maya Binary File,
13547: >32 string >\0 version %s scene
13548: 8 string MayaFOR4 Alias Maya Binary File,
13549: >32 string >\0 version %s scene
13550: 8 string CIMG Alias Maya Image File
13551: 8 string DEEP Alias Maya Image File
13552: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13553: # $File: sgml,v 1.24 2009/09/19 17:31:35 christos Exp $
1.1 misho 13554: # Type: SVG Vectorial Graphics
13555: # From: Noel Torres <tecnico@ejerciciosresueltos.com>
13556: 0 string \<?xml\ version="
13557: >15 string >\0
1.1.1.2 ! misho 13558: >>19 search/4096 \<svg SVG Scalable Vector Graphics image
1.1 misho 13559: !:mime image/svg+xml
1.1.1.2 ! misho 13560: >>19 search/4096 \<gnc-v2 GnuCash file
1.1 misho 13561: !:mime application/x-gnucash
13562:
13563: # Sitemap file
13564: 0 string \<?xml\ version="
13565: >15 string >\0
1.1.1.2 ! misho 13566: >>19 search/4096 \<urlset XML Sitemap document text
1.1 misho 13567: !:mime application/xml-sitemap
13568:
1.1.1.2 ! misho 13569: # xhtml
! 13570: 0 string \<?xml\ version="
! 13571: >15 string >\0
! 13572: >>19 search/4096/cWbt \<!doctype\ html xHTML document text
! 13573: !:mime text/html
! 13574: 0 string \<?xml\ version='
! 13575: >15 string >\0
! 13576: >>19 search/4096/cWbt \<!doctype\ html xHTML document text
! 13577: !:mime text/html
! 13578: 0 string \<?xml\ version="
! 13579: >15 string >\0
! 13580: >>19 search/4096/cWbt \<html broken xHTML document text
! 13581: !:mime text/html
! 13582:
1.1 misho 13583: #------------------------------------------------------------------------------
13584: # sgml: file(1) magic for Standard Generalized Markup Language
13585: # HyperText Markup Language (HTML) is an SGML document type,
13586: # from Daniel Quinlan (quinlan@yggdrasil.com)
13587: # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
1.1.1.2 ! misho 13588: 0 search/4096/cWbt \<!doctype\ html HTML document text
! 13589: !:mime text/html
! 13590: 0 search/4096/cwbt \<head HTML document text
! 13591: !:mime text/html
! 13592: 0 search/4096/cwbt \<title HTML document text
! 13593: !:mime text/html
! 13594: 0 search/4096/cwbt \<html HTML document text
! 13595: !:mime text/html
! 13596: 0 search/4096/cwbt \<script HTML document text
1.1 misho 13597: !:mime text/html
1.1.1.2 ! misho 13598: 0 search/4096/cwbt \<style HTML document text
1.1 misho 13599: !:mime text/html
1.1.1.2 ! misho 13600: 0 search/4096/cwbt \<table HTML document text
1.1 misho 13601: !:mime text/html
1.1.1.2 ! misho 13602: 0 search/4096/cwbt \<a\ href= HTML document text
1.1 misho 13603: !:mime text/html
13604:
13605: # Extensible markup language (XML), a subset of SGML
13606: # from Marc Prud'hommeaux (marc@apocalypse.org)
1.1.1.2 ! misho 13607: 0 search/1/cwbt \<?xml XML document text
1.1 misho 13608: !:mime application/xml
13609: 0 string \<?xml\ version\ " XML
13610: !:mime application/xml
13611: 0 string \<?xml\ version=" XML
13612: !:mime application/xml
13613: >15 search/1 >\0 %.3s document text
13614: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
13615: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
13616: 0 string \<?xml\ version=' XML
13617: !:mime application/xml
13618: >15 search/1 >\0 %.3s document text
13619: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
13620: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
1.1.1.2 ! misho 13621: 0 search/1/wbt \<?xml XML document text
1.1 misho 13622: !:mime application/xml
1.1.1.2 ! misho 13623: !:strength - 10
! 13624: 0 search/1/wbt \<?XML broken XML document text
1.1 misho 13625: !:mime application/xml
1.1.1.2 ! misho 13626: !:strength - 10
1.1 misho 13627:
13628:
13629: # SGML, mostly from rph@sq
1.1.1.2 ! misho 13630: 0 search/4096/cwbt \<!doctype exported SGML document text
! 13631: 0 search/4096/cwbt \<!subdoc exported SGML subdocument text
! 13632: 0 search/4096/cwbt \<!-- exported SGML document text
! 13633: !:strength - 10
1.1 misho 13634:
13635: # Web browser cookie files
13636: # (Mozilla, Galeon, Netscape 4, Konqueror..)
13637: # Ulf Harnhammar <ulfh@update.uu.se>
13638: 0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text
13639: 0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
13640: 0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
13641:
13642: #------------------------------------------------------------------------
1.1.1.2 ! misho 13643: # $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 13644: # file(1) magic for sharc files
13645: #
13646: # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
13647: # FutureGroove Music (dsp@futuregroove.de)
13648:
13649: #------------------------------------------------------------------------
13650: #0 string Draw RiscOS Drawfile
13651: #0 string PACK RiscOS PackdDir archive
13652:
13653: #------------------------------------------------------------------------
13654: # SHARC DSP stuff (based on the FGM SHARC DSP SDK)
13655:
13656: #0 string =! Assembler source
13657: #0 string Analog ADi asm listing file
13658: 0 string .SYSTEM SHARC architecture file
13659: 0 string .system SHARC architecture file
13660:
13661: 0 leshort 0x521C SHARC COFF binary
13662: >2 leshort >1 , %hd sections
13663: >>12 lelong >0 , not stripped
13664:
13665: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13666: # $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 13667: # sinclair: file(1) sinclair QL
13668:
13669: # additions to /etc/magic by Thomas M. Ott (ThMO)
13670:
13671: # Sinclair QL floppy disk formats (ThMO)
13672: 0 string =QL5 QL disk dump data,
13673: >3 string =A 720 KB,
13674: >3 string =B 1.44 MB,
13675: >3 string =C 3.2 MB,
13676: >4 string >\0 label:%.10s
13677:
13678: # Sinclair QL OS dump (ThMO)
13679: # (NOTE: if `file' would be able to use indirect references in a endian format
13680: # differing from the natural host format, this could be written more
13681: # reliably and faster...)
13682: #
13683: # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
13684: # than the first 8K of a file... #-(
13685: #
13686: #0 belong =0x30000
13687: #>49124 belong <47104
13688: #>>49128 belong <47104
13689: #>>>49132 belong <47104
13690: #>>>>49136 belong <47104 QL OS dump data,
13691: #>>>>>49148 string >\0 type %.3s,
13692: #>>>>>49142 string >\0 version %.4s
13693:
13694: # Sinclair QL firmware executables (ThMO)
13695: 0 string NqNqNq`\004 QL firmware executable (BCPL)
13696:
13697: # Sinclair QL libraries (was ThMO)
13698: 0 beshort 0xFB01 QDOS object
13699: >2 pstring x '%s'
13700:
13701: # Sinclair QL executables (was ThMO)
13702: 4 belong 0x4AFB QDOS executable
13703: >9 pstring x '%s'
13704:
13705: # Sinclair QL ROM (ThMO)
13706: 0 belong =0x4AFB0001 QL plugin-ROM data,
13707: >9 pstring =\0 un-named
13708: >9 pstring >\0 named: %s
13709: # Type: SiSU Markup Language
13710: # URL: http://www.sisudoc.org/
13711: # From: Ralph Amissah <ralph.amissah@gmail.com>
13712:
13713: 0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert
13714: >5 regex [0-9.]+ %s
13715:
13716: 0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master
13717: >5 regex [0-9.]+ %s
13718:
13719: 0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text
13720: >5 regex [0-9.]+ %s
13721:
13722: 0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text
13723: >5 regex [0-9.]+ %s
13724:
13725: 0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text
13726: >5 regex [0-9.]+ %s
1.1.1.2 ! misho 13727:
1.1 misho 13728: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13729: # $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 13730: # Sketch Drawings: http://sketch.sourceforge.net/
13731: # From: Edwin Mons <e@ik.nu>
13732: 0 search/1 ##Sketch Sketch document text
13733:
13734: #-----------------------------------------------
1.1.1.2 ! misho 13735: # $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 13736: # GNU Smalltalk image, starting at version 1.6.2
13737: # From: catull_us@yahoo.com
13738: #
13739: 0 string GSTIm\0\0 GNU SmallTalk
13740: # little-endian
13741: >7 byte&1 =0 LE image version
13742: >>10 byte x %d.
13743: >>9 byte x \b%d.
13744: >>8 byte x \b%d
13745: #>>12 lelong x , data: %ld
13746: #>>16 lelong x , table: %ld
13747: #>>20 lelong x , memory: %ld
13748: # big-endian
13749: >7 byte&1 =1 BE image version
13750: >>8 byte x %d.
13751: >>9 byte x \b%d.
13752: >>10 byte x \b%d
13753: #>>12 belong x , data: %ld
13754: #>>16 belong x , table: %ld
13755: #>>20 belong x , memory: %ld
13756:
13757:
13758:
13759: #------------------------------------------------------------------------------
1.1.1.2 ! misho 13760: # $File: sniffer,v 1.14 2009/09/19 16:28:12 christos Exp $
1.1 misho 13761: # sniffer: file(1) magic for packet capture files
13762: #
13763: # From: guy@alum.mit.edu (Guy Harris)
13764: #
13765:
13766: #
13767: # Microsoft Network Monitor 1.x capture files.
13768: #
13769: 0 string RTSS NetMon capture file
13770: >5 byte x - version %d
13771: >4 byte x \b.%d
13772: >6 leshort 0 (Unknown)
13773: >6 leshort 1 (Ethernet)
13774: >6 leshort 2 (Token Ring)
13775: >6 leshort 3 (FDDI)
13776: >6 leshort 4 (ATM)
13777:
13778: #
13779: # Microsoft Network Monitor 2.x capture files.
13780: #
13781: 0 string GMBU NetMon capture file
13782: >5 byte x - version %d
13783: >4 byte x \b.%d
13784: >6 leshort 0 (Unknown)
13785: >6 leshort 1 (Ethernet)
13786: >6 leshort 2 (Token Ring)
13787: >6 leshort 3 (FDDI)
13788: >6 leshort 4 (ATM)
13789:
13790: #
13791: # Network General Sniffer capture files.
13792: # Sorry, make that "Network Associates Sniffer capture files."
13793: # Sorry, make that "Network General old DOS Sniffer capture files."
13794: #
13795: 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
13796: >33 byte 2 (compressed)
13797: >23 leshort x - version %d
13798: >25 leshort x \b.%d
13799: >32 byte 0 (Token Ring)
13800: >32 byte 1 (Ethernet)
13801: >32 byte 2 (ARCNET)
13802: >32 byte 3 (StarLAN)
13803: >32 byte 4 (PC Network broadband)
13804: >32 byte 5 (LocalTalk)
13805: >32 byte 6 (Znet)
13806: >32 byte 7 (Internetwork Analyzer)
13807: >32 byte 9 (FDDI)
13808: >32 byte 10 (ATM)
13809:
13810: #
13811: # Cinco Networks NetXRay capture files.
13812: # Sorry, make that "Network General Sniffer Basic capture files."
13813: # Sorry, make that "Network Associates Sniffer Basic capture files."
13814: # Sorry, make that "Network Associates Sniffer Basic, and Windows
13815: # Sniffer Pro", capture files."
13816: # Sorry, make that "Network General Sniffer capture files."
13817: #
13818: 0 string XCP\0 NetXRay capture file
13819: >4 string >\0 - version %s
13820: >44 leshort 0 (Ethernet)
13821: >44 leshort 1 (Token Ring)
13822: >44 leshort 2 (FDDI)
13823: >44 leshort 3 (WAN)
13824: >44 leshort 8 (ATM)
13825: >44 leshort 9 (802.11)
13826:
13827: #
13828: # "libpcap" capture files.
13829: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
13830: # the main program that uses that format, but there are other programs
13831: # that use "libpcap", or that use the same capture file format.)
13832: #
13833: 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
13834: >4 beshort x - version %d
13835: >6 beshort x \b.%d
13836: >20 belong 0 (No link-layer encapsulation
13837: >20 belong 1 (Ethernet
13838: >20 belong 2 (3Mb Ethernet
13839: >20 belong 3 (AX.25
13840: >20 belong 4 (ProNET
13841: >20 belong 5 (CHAOS
13842: >20 belong 6 (Token Ring
13843: >20 belong 7 (BSD ARCNET
13844: >20 belong 8 (SLIP
13845: >20 belong 9 (PPP
13846: >20 belong 10 (FDDI
13847: >20 belong 11 (RFC 1483 ATM
13848: >20 belong 12 (raw IP
13849: >20 belong 13 (BSD/OS SLIP
13850: >20 belong 14 (BSD/OS PPP
13851: >20 belong 19 (Linux ATM Classical IP
13852: >20 belong 50 (PPP or Cisco HDLC
13853: >20 belong 51 (PPP-over-Ethernet
13854: >20 belong 99 (Symantec Enterprise Firewall
13855: >20 belong 100 (RFC 1483 ATM
13856: >20 belong 101 (raw IP
13857: >20 belong 102 (BSD/OS SLIP
13858: >20 belong 103 (BSD/OS PPP
13859: >20 belong 104 (BSD/OS Cisco HDLC
13860: >20 belong 105 (802.11
13861: >20 belong 106 (Linux Classical IP over ATM
13862: >20 belong 107 (Frame Relay
13863: >20 belong 108 (OpenBSD loopback
13864: >20 belong 109 (OpenBSD IPsec encrypted
13865: >20 belong 112 (Cisco HDLC
13866: >20 belong 113 (Linux "cooked"
13867: >20 belong 114 (LocalTalk
13868: >20 belong 117 (OpenBSD PFLOG
13869: >20 belong 119 (802.11 with Prism header
13870: >20 belong 122 (RFC 2625 IP over Fibre Channel
13871: >20 belong 123 (SunATM
13872: >20 belong 127 (802.11 with radiotap header
13873: >20 belong 129 (Linux ARCNET
13874: >20 belong 138 (Apple IP over IEEE 1394
13875: >20 belong 140 (MTP2
13876: >20 belong 141 (MTP3
13877: >20 belong 143 (DOCSIS
13878: >20 belong 144 (IrDA
13879: >20 belong 147 (Private use 0
13880: >20 belong 148 (Private use 1
13881: >20 belong 149 (Private use 2
13882: >20 belong 150 (Private use 3
13883: >20 belong 151 (Private use 4
13884: >20 belong 152 (Private use 5
13885: >20 belong 153 (Private use 6
13886: >20 belong 154 (Private use 7
13887: >20 belong 155 (Private use 8
13888: >20 belong 156 (Private use 9
13889: >20 belong 157 (Private use 10
13890: >20 belong 158 (Private use 11
13891: >20 belong 159 (Private use 12
13892: >20 belong 160 (Private use 13
13893: >20 belong 161 (Private use 14
13894: >20 belong 162 (Private use 15
13895: >20 belong 163 (802.11 with AVS header
13896: >16 belong x \b, capture length %d)
13897: 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
13898: >4 leshort x - version %d
13899: >6 leshort x \b.%d
13900: >20 lelong 0 (No link-layer encapsulation
13901: >20 lelong 1 (Ethernet
13902: >20 lelong 2 (3Mb Ethernet
13903: >20 lelong 3 (AX.25
13904: >20 lelong 4 (ProNET
13905: >20 lelong 5 (CHAOS
13906: >20 lelong 6 (Token Ring
13907: >20 lelong 7 (ARCNET
13908: >20 lelong 8 (SLIP
13909: >20 lelong 9 (PPP
13910: >20 lelong 10 (FDDI
13911: >20 lelong 11 (RFC 1483 ATM
13912: >20 lelong 12 (raw IP
13913: >20 lelong 13 (BSD/OS SLIP
13914: >20 lelong 14 (BSD/OS PPP
13915: >20 lelong 19 (Linux ATM Classical IP
13916: >20 lelong 50 (PPP or Cisco HDLC
13917: >20 lelong 51 (PPP-over-Ethernet
13918: >20 lelong 99 (Symantec Enterprise Firewall
13919: >20 lelong 100 (RFC 1483 ATM
13920: >20 lelong 101 (raw IP
13921: >20 lelong 102 (BSD/OS SLIP
13922: >20 lelong 103 (BSD/OS PPP
13923: >20 lelong 104 (BSD/OS Cisco HDLC
13924: >20 lelong 105 (802.11
13925: >20 lelong 106 (Linux Classical IP over ATM
13926: >20 lelong 107 (Frame Relay
13927: >20 lelong 108 (OpenBSD loopback
13928: >20 lelong 109 (OpenBSD IPsec encrypted
13929: >20 lelong 112 (Cisco HDLC
13930: >20 lelong 113 (Linux "cooked"
13931: >20 lelong 114 (LocalTalk
13932: >20 lelong 117 (OpenBSD PFLOG
13933: >20 lelong 119 (802.11 with Prism header
13934: >20 lelong 122 (RFC 2625 IP over Fibre Channel
13935: >20 lelong 123 (SunATM
13936: >20 lelong 127 (802.11 with radiotap header
13937: >20 lelong 129 (Linux ARCNET
13938: >20 lelong 138 (Apple IP over IEEE 1394
13939: >20 lelong 140 (MTP2
13940: >20 lelong 141 (MTP3
13941: >20 lelong 143 (DOCSIS
13942: >20 lelong 144 (IrDA
13943: >20 lelong 147 (Private use 0
13944: >20 lelong 148 (Private use 1
13945: >20 lelong 149 (Private use 2
13946: >20 lelong 150 (Private use 3
13947: >20 lelong 151 (Private use 4
13948: >20 lelong 152 (Private use 5
13949: >20 lelong 153 (Private use 6
13950: >20 lelong 154 (Private use 7
13951: >20 lelong 155 (Private use 8
13952: >20 lelong 156 (Private use 9
13953: >20 lelong 157 (Private use 10
13954: >20 lelong 158 (Private use 11
13955: >20 lelong 159 (Private use 12
13956: >20 lelong 160 (Private use 13
13957: >20 lelong 161 (Private use 14
13958: >20 lelong 162 (Private use 15
13959: >20 lelong 163 (802.11 with AVS header
13960: >16 lelong x \b, capture length %d)
13961:
13962: #
13963: # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
13964: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
13965: # the main program that uses that format, but there are other programs
13966: # that use "libpcap", or that use the same capture file format.)
13967: #
13968: 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
13969: >4 beshort x - version %d
13970: >6 beshort x \b.%d
13971: >20 belong 0 (No link-layer encapsulation
13972: >20 belong 1 (Ethernet
13973: >20 belong 2 (3Mb Ethernet
13974: >20 belong 3 (AX.25
13975: >20 belong 4 (ProNET
13976: >20 belong 5 (CHAOS
13977: >20 belong 6 (Token Ring
13978: >20 belong 7 (ARCNET
13979: >20 belong 8 (SLIP
13980: >20 belong 9 (PPP
13981: >20 belong 10 (FDDI
13982: >20 belong 11 (RFC 1483 ATM
13983: >20 belong 12 (raw IP
13984: >20 belong 13 (BSD/OS SLIP
13985: >20 belong 14 (BSD/OS PPP
13986: >16 belong x \b, capture length %d)
13987: 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
13988: >4 leshort x - version %d
13989: >6 leshort x \b.%d
13990: >20 lelong 0 (No link-layer encapsulation
13991: >20 lelong 1 (Ethernet
13992: >20 lelong 2 (3Mb Ethernet
13993: >20 lelong 3 (AX.25
13994: >20 lelong 4 (ProNET
13995: >20 lelong 5 (CHAOS
13996: >20 lelong 6 (Token Ring
13997: >20 lelong 7 (ARCNET
13998: >20 lelong 8 (SLIP
13999: >20 lelong 9 (PPP
14000: >20 lelong 10 (FDDI
14001: >20 lelong 11 (RFC 1483 ATM
14002: >20 lelong 12 (raw IP
14003: >20 lelong 13 (BSD/OS SLIP
14004: >20 lelong 14 (BSD/OS PPP
14005: >16 lelong x \b, capture length %d)
14006:
14007: #
14008: # AIX "iptrace" capture files.
14009: #
14010: 0 string iptrace\ 1.0 "iptrace" capture file
14011: 0 string iptrace\ 2.0 "iptrace" capture file
14012:
14013: #
14014: # Novell LANalyzer capture files.
14015: #
14016: 0 leshort 0x1001 LANalyzer capture file
14017: 0 leshort 0x1007 LANalyzer capture file
14018:
14019: #
14020: # HP-UX "nettl" capture files.
14021: #
14022: 0 string \x54\x52\x00\x64\x00 "nettl" capture file
14023:
14024: #
14025: # RADCOM WAN/LAN Analyzer capture files.
14026: #
14027: 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
14028:
14029: #
14030: # NetStumbler log files. Not really packets, per se, but about as
14031: # close as you can get. These are log files from NetStumbler, a
14032: # Windows program, that scans for 802.11b networks.
14033: #
14034: 0 string NetS NetStumbler log file
14035: >8 lelong x \b, %d stations found
14036:
14037: #
14038: # EtherPeek/AiroPeek "version 9" capture files.
14039: #
14040: 0 string \177ver EtherPeek/AiroPeek capture file
14041:
14042: #
14043: # Visual Networks traffic capture files.
14044: #
14045: 0 string \x05VNF Visual Networks traffic capture file
14046:
14047: #
14048: # Network Instruments Observer capture files.
14049: #
14050: 0 string ObserverPktBuffe Network Instruments Observer capture file
14051:
14052: #
14053: # Files from Accellent Group's 5View products.
14054: #
14055: 0 string \xaa\xaa\xaa\xaa 5View capture file
1.1.1.2 ! misho 14056:
1.1 misho 14057: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14058: # $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
1.1 misho 14059: # softquad: file(1) magic for SoftQuad Publishing Software
14060: #
14061: # Author/Editor and RulesBuilder
14062: #
14063: # XXX - byte order?
14064: #
14065: 0 string \<!SQ\ DTD> Compiled SGML rules file
14066: >9 string >\0 Type %s
14067: 0 string \<!SQ\ A/E> A/E SGML Document binary
14068: >9 string >\0 Type %s
14069: 0 string \<!SQ\ STS> A/E SGML binary styles file
14070: >9 string >\0 Type %s
14071: 0 short 0xc0de Compiled PSI (v1) data
14072: 0 short 0xc0da Compiled PSI (v2) data
14073: >3 string >\0 (%s)
14074: # Binary sqtroff font/desc files...
14075: 0 short 0125252 SoftQuad DESC or font file binary
14076: >2 short >0 - version %d
14077: # Bitmaps...
14078: 0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
14079: #0 string SQ\ BITMAP2 SoftQuad Raster Format data
14080: # sqtroff intermediate language (replacement for ditroff int. lang.)
14081: 0 string X\ SoftQuad troff Context intermediate
14082: >2 string 495 for AT&T 495 laser printer
14083: >2 string hp for Hewlett-Packard LaserJet
14084: >2 string impr for IMAGEN imPRESS
14085: >2 string ps for PostScript
14086:
14087: # From: Michael Piefel <piefel@debian.org>
14088: # sqtroff intermediate language (replacement for ditroff int. lang.)
14089: 0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
14090: 0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
14091: 0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
14092: 0 string X\ ps SoftQuad troff Context intermediate for PostScript
14093:
14094: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14095: # $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 14096: # spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
14097: #
14098: # Cloyce D. Spradling <cloyce@headgear.org>
14099:
14100: 0 string spec SPEC
14101: >4 string .cpu CPU
14102: >>8 string <: \b%.4s
14103: >>12 string . raw result text
14104:
14105: 17 string version=SPECjbb SPECjbb
14106: >32 string <: \b%.4s
14107: >>37 string <: v%.4s raw result text
14108:
14109: 0 string BEGIN\040SPECWEB SPECweb
14110: >13 string <: \b%.2s
14111: >>15 string _SSL \b_SSL
14112: >>>20 string <: v%.4s raw result text
14113: >>16 string <: v%.4s raw result text
14114:
14115: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14116: # $File: spectrum,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 14117: # spectrum: file(1) magic for Spectrum emulator files.
14118: #
14119: # John Elliott <jce@seasip.demon.co.uk>
14120:
14121: #
14122: # Spectrum +3DOS header
14123: #
14124: 0 string PLUS3DOS\032 Spectrum +3 data
14125: >15 byte 0 - BASIC program
14126: >15 byte 1 - number array
14127: >15 byte 2 - character array
14128: >15 byte 3 - memory block
14129: >>16 belong 0x001B0040 (screen)
14130: >15 byte 4 - Tasword document
14131: >15 string TAPEFILE - ZXT tapefile
14132: #
14133: # Tape file. This assumes the .TAP starts with a Spectrum-format header,
14134: # which nearly all will.
14135: #
1.1.1.2 ! misho 14136: # Update: Sanity-check string contents to be printable.
! 14137: # -Adam Buchbinder <adam.buchbinder@gmail.com>
! 14138: #
! 14139: 0 string \023\000\000
! 14140: >4 string >\0
! 14141: >>4 string <\177 Spectrum .TAP data "%-10.10s"
! 14142: >>>3 byte 0 - BASIC program
! 14143: >>>3 byte 1 - number array
! 14144: >>>3 byte 2 - character array
! 14145: >>>3 byte 3 - memory block
! 14146: >>>>14 belong 0x001B0040 (screen)
1.1 misho 14147:
14148: # The following three blocks are from pak21-spectrum@srcf.ucam.org
14149: # TZX tape images
14150: 0 string ZXTape!\x1a Spectrum .TZX data
14151: >8 byte x version %d
14152: >9 byte x \b.%d
14153:
14154: # RZX input recording files
14155: 0 string RZX! Spectrum .RZX data
14156: >4 byte x version %d
14157: >5 byte x \b.%d
14158:
14159: # Floppy disk images
14160: 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
14161: 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
14162: 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
14163: 0 string SINCLAIR Spectrum .SCL Betadisk image
14164:
14165: # Hard disk images
14166: 0 string RS-IDE\x1a Spectrum .HDF hard disk image
14167: >7 byte x \b, version 0x%02x
14168:
14169: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14170: # $File: sql,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 14171: # sql: file(1) magic for SQL files
14172: #
14173: # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
14174: # Recognize some MySQL files.
14175: #
14176: 0 beshort 0xfe01 MySQL table definition file
14177: >2 byte x Version %d
14178: 0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
14179: >3 byte x Version %d
14180: 0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
14181: >3 byte x Version %d
14182: 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
14183: >3 byte x Version %d
14184: 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
14185: >3 byte x Version %d
14186: 0 string \376bin MySQL replication log
14187:
14188: #------------------------------------------------------------------------------
14189: # iRiver H Series database file
14190: # From Ken Guest <ken@linux.ie>
14191: # As observed from iRivNavi.iDB and unencoded firmware
14192: #
14193: 0 string iRivDB iRiver Database file
14194: >11 string >\0 Version %s
14195: >39 string iHP-100 [H Series]
14196:
14197: #------------------------------------------------------------------------------
14198: # SQLite database files
14199: # Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
14200: #
14201: # Version 1 used GDBM internally; its files cannot be distinguished
14202: # from other GDBM files.
14203: #
14204: # Version 2 used this format:
14205: 0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
14206:
14207: # Version 3 of SQLite allows applications to embed their own "user version"
14208: # number in the database. Detect this and distinguish those files.
14209:
14210: 0 string SQLite\ format\ 3
14211: >60 string _MTN Monotone source repository
14212: >60 belong !0 SQLite 3.x database, user version %u
14213: >60 belong 0 SQLite 3.x database
1.1.1.2 ! misho 14214: # Type: OpenSSH key files
! 14215: # From: Nicolas Collignon <tsointsoin@gmail.com>
! 14216:
! 14217: 0 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key,
! 14218: >28 string >\0 version %s
! 14219:
! 14220: 0 string ssh-dss\ OpenSSH DSA public key
! 14221: 0 string ssh-rsa\ OpenSSH RSA public key
! 14222: # Type: OpenSSL certificates/key files
! 14223: # From: Nicolas Collignon <tsointsoin@gmail.com>
! 14224:
! 14225: 0 string -----BEGIN\ CERTIFICATE----- PEM certificate
! 14226: 0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request
! 14227: 0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key
! 14228: 0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key
1.1 misho 14229:
14230: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14231: # $File: sun,v 1.20 2009/09/19 16:28:12 christos Exp $
1.1 misho 14232: # sun: file(1) magic for Sun machines
14233: #
14234: # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
14235: # releases. (5.x uses ELF.)
14236: #
14237: 0 belong&077777777 0600413 sparc demand paged
14238: >0 byte &0x80
14239: >>20 belong <4096 shared library
14240: >>20 belong =4096 dynamically linked executable
14241: >>20 belong >4096 dynamically linked executable
14242: >0 byte ^0x80 executable
14243: >16 belong >0 not stripped
14244:
14245: 0 belong&077777777 0600410 sparc pure
14246: >0 byte &0x80 dynamically linked executable
14247: >0 byte ^0x80 executable
14248: >16 belong >0 not stripped
14249:
14250: 0 belong&077777777 0600407 sparc
14251: >0 byte &0x80 dynamically linked executable
14252: >0 byte ^0x80 executable
14253: >16 belong >0 not stripped
14254:
14255: 0 belong&077777777 0400413 mc68020 demand paged
14256: >0 byte &0x80
14257: >>20 belong <4096 shared library
14258: >>20 belong =4096 dynamically linked executable
14259: >>20 belong >4096 dynamically linked executable
14260: >0 byte ^0x80 executable
14261: >16 belong >0 not stripped
14262:
14263: 0 belong&077777777 0400410 mc68020 pure
14264: >0 byte &0x80 dynamically linked executable
14265: >0 byte ^0x80 executable
14266: >16 belong >0 not stripped
14267:
14268: 0 belong&077777777 0400407 mc68020
14269: >0 byte &0x80 dynamically linked executable
14270: >0 byte ^0x80 executable
14271: >16 belong >0 not stripped
14272:
14273: 0 belong&077777777 0200413 mc68010 demand paged
14274: >0 byte &0x80
14275: >>20 belong <4096 shared library
14276: >>20 belong =4096 dynamically linked executable
14277: >>20 belong >4096 dynamically linked executable
14278: >0 byte ^0x80 executable
14279: >16 belong >0 not stripped
14280:
14281: 0 belong&077777777 0200410 mc68010 pure
14282: >0 byte &0x80 dynamically linked executable
14283: >0 byte ^0x80 executable
14284: >16 belong >0 not stripped
14285:
14286: 0 belong&077777777 0200407 mc68010
14287: >0 byte &0x80 dynamically linked executable
14288: >0 byte ^0x80 executable
14289: >16 belong >0 not stripped
14290:
14291: # reworked these to avoid anything beginning with zero becoming "old sun-2"
14292: 0 belong 0407 old sun-2 executable
14293: >16 belong >0 not stripped
14294: 0 belong 0410 old sun-2 pure executable
14295: >16 belong >0 not stripped
14296: 0 belong 0413 old sun-2 demand paged executable
14297: >16 belong >0 not stripped
14298:
14299: #
14300: # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
14301: # binary executed in compatibility mode under SunOS 5.x".
14302: #
14303: 0 belong 0x080456 SunOS core file
14304: >4 belong 432 (SPARC)
14305: >>132 string >\0 from '%s'
14306: >>116 belong =3 (quit)
14307: >>116 belong =4 (illegal instruction)
14308: >>116 belong =5 (trace trap)
14309: >>116 belong =6 (abort)
14310: >>116 belong =7 (emulator trap)
14311: >>116 belong =8 (arithmetic exception)
14312: >>116 belong =9 (kill)
14313: >>116 belong =10 (bus error)
14314: >>116 belong =11 (segmentation violation)
14315: >>116 belong =12 (bad argument to system call)
14316: >>116 belong =29 (resource lost)
14317: >>120 belong x (T=%dK,
14318: >>124 belong x D=%dK,
14319: >>128 belong x S=%dK)
14320: >4 belong 826 (68K)
14321: >>128 string >\0 from '%s'
14322: >4 belong 456 (SPARC 4.x BCP)
14323: >>152 string >\0 from '%s'
14324: # Sun SunPC
14325: 0 long 0xfa33c08e SunPC 4.0 Hard Disk
14326: 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
14327: # Sun snoop (see RFC 1761, which describes the capture file format).
14328: #
14329: 0 string snoop Snoop capture file
14330: >8 belong >0 - version %ld
14331: >12 belong 0 (IEEE 802.3)
14332: >12 belong 1 (IEEE 802.4)
14333: >12 belong 2 (IEEE 802.5)
14334: >12 belong 3 (IEEE 802.6)
14335: >12 belong 4 (Ethernet)
14336: >12 belong 5 (HDLC)
14337: >12 belong 6 (Character synchronous)
14338: >12 belong 7 (IBM channel-to-channel adapter)
14339: >12 belong 8 (FDDI)
14340: >12 belong 9 (Unknown)
14341:
14342: # Microsoft ICM color profile
14343: 36 string acspMSFT Microsoft ICM Color Profile
14344: # Sun KCMS
14345: 36 string acsp Kodak Color Management System, ICC Profile
14346:
14347: #---------------------------------------------------------------------------
14348: # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
14349: # lead Sun/Cobalt developer) who agrees that they are good and worthy of
14350: # inclusion.
14351:
14352: # Boot ROM images for Sun/Cobalt Linux server appliances
14353: 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
14354: >38 string x V%.4s
14355:
14356: # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
14357: # at the very end where file(1) can't get it.
14358: 0 string CRfs COBALT boot rom data (Flat boot rom or file system)
14359:
14360:
1.1.1.2 ! misho 14361:
1.1 misho 14362: #------------------------------------------------------------------------
1.1.1.2 ! misho 14363: # $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 14364: # sysex: file(1) magic for MIDI sysex files
14365: #
14366: #
14367: 0 byte 0xF0 SysEx File -
14368:
14369: # North American Group
14370: >1 byte 0x01 Sequential
14371: >1 byte 0x02 IDP
14372: >1 byte 0x03 OctavePlateau
14373: >1 byte 0x04 Moog
14374: >1 byte 0x05 Passport
14375: >1 byte 0x06 Lexicon
14376: >1 byte 0x07 Kurzweil/Future Retro
14377: >>3 byte 0x77 777
14378: >>4 byte 0x00 Bank
14379: >>4 byte 0x01 Song
14380: >>5 byte 0x0f 16
14381: >>5 byte 0x0e 15
14382: >>5 byte 0x0d 14
14383: >>5 byte 0x0c 13
14384: >>5 byte 0x0b 12
14385: >>5 byte 0x0a 11
14386: >>5 byte 0x09 10
14387: >>5 byte 0x08 9
14388: >>5 byte 0x07 8
14389: >>5 byte 0x06 7
14390: >>5 byte 0x05 6
14391: >>5 byte 0x04 5
14392: >>5 byte 0x03 4
14393: >>5 byte 0x02 3
14394: >>5 byte 0x01 2
14395: >>5 byte 0x00 1
14396: >>5 byte 0x10 (ALL)
14397: >>2 byte x \b, Channel %d
14398: >1 byte 0x08 Fender
14399: >1 byte 0x09 Gulbransen
14400: >1 byte 0x0a AKG
14401: >1 byte 0x0b Voyce
14402: >1 byte 0x0c Waveframe
14403: >1 byte 0x0d ADA
14404: >1 byte 0x0e Garfield
14405: >1 byte 0x0f Ensoniq
14406: >1 byte 0x10 Oberheim
14407: >>2 byte 0x06 Matrix 6 series
14408: >>3 byte 0x0A Dump (All)
14409: >>3 byte 0x01 Dump (Bank)
14410: >>4 belong 0x0002040E Matrix 1000
14411: >>>11 byte <2 User bank %d
14412: >>>11 byte >1 Preset bank %d
14413: >1 byte 0x11 Apple
14414: >1 byte 0x12 GreyMatter
14415: >1 byte 0x14 PalmTree
14416: >1 byte 0x15 JLCooper
14417: >1 byte 0x16 Lowrey
14418: >1 byte 0x17 AdamsSmith
14419: >1 byte 0x18 E-mu
14420: >1 byte 0x19 Harmony
14421: >1 byte 0x1a ART
14422: >1 byte 0x1b Baldwin
14423: >1 byte 0x1c Eventide
14424: >1 byte 0x1d Inventronics
14425: >1 byte 0x1f Clarity
14426:
14427: # European Group
14428: >1 byte 0x21 SIEL
14429: >1 byte 0x22 Synthaxe
14430: >1 byte 0x24 Hohner
14431: >1 byte 0x25 Twister
14432: >1 byte 0x26 Solton
14433: >1 byte 0x27 Jellinghaus
14434: >1 byte 0x28 Southworth
14435: >1 byte 0x29 PPG
14436: >1 byte 0x2a JEN
14437: >1 byte 0x2b SSL
14438: >1 byte 0x2c AudioVertrieb
14439:
14440: >1 byte 0x2f ELKA
14441: >>3 byte 0x09 EK-44
14442:
14443: >1 byte 0x30 Dynacord
14444: >1 byte 0x31 Jomox
14445: >1 byte 0x33 Clavia
14446: >1 byte 0x39 Soundcraft
14447: # Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
14448: >1 byte 0x3e Waldorf
14449: >>2 byte 0x00 microWave
14450: >>2 byte 0x0E microwave2 / XT
14451: >>2 byte 0x0F Q / Q+
14452: >>3 byte =0 (default id)
14453: >>3 byte >0 (
14454: >>>3 byte <0x7F \bdevice %d)
14455: >>>3 byte =0x7F \bbroadcast id)
14456: >>3 byte 0x7f Microwave I
14457: >>>4 byte 0x00 SNDR (Sound Request)
14458: >>>4 byte 0x10 SNDD (Sound Dump)
14459: >>>4 byte 0x20 SNDP (Sound Parameter Change)
14460: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
14461: >>>4 byte 0x70 BOOT (Sound Reserved)
14462: >>>4 byte 0x01 MULR (Multi Request)
14463: >>>4 byte 0x11 MULD (Multi Dump)
14464: >>>4 byte 0x21 MULP (Multi Parameter Change)
14465: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
14466: >>>4 byte 0x71 OS (Multi Reserved)
14467: >>>4 byte 0x02 DRMR (Drum Map Request)
14468: >>>4 byte 0x12 DRMD (Drum Map Dump)
14469: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
14470: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
14471: >>>4 byte 0x72 BIN (Drum Map Reserved)
14472: >>>4 byte 0x03 PATR (Sequencer Pattern Request)
14473: >>>4 byte 0x13 PATD (Sequencer Pattern Dump)
14474: >>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
14475: >>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
14476: >>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
14477: >>>4 byte 0x04 GLBR (Global Parameter Request)
14478: >>>4 byte 0x14 GLBD (Global Parameter Dump)
14479: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
14480: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
14481: >>>4 byte 0x07 MODR (Mode Parameter Request)
14482: >>>4 byte 0x17 MODD (Mode Parameter Dump)
14483: >>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
14484: >>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
14485: >>2 byte 0x10 microQ
14486: >>>4 byte 0x00 SNDR (Sound Request)
14487: >>>4 byte 0x10 SNDD (Sound Dump)
14488: >>>4 byte 0x20 SNDP (Sound Parameter Change)
14489: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
14490: >>>4 byte 0x70 (Sound Reserved)
14491: >>>4 byte 0x01 MULR (Multi Request)
14492: >>>4 byte 0x11 MULD (Multi Dump)
14493: >>>4 byte 0x21 MULP (Multi Parameter Change)
14494: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
14495: >>>4 byte 0x71 OS (Multi Reserved)
14496: >>>4 byte 0x02 DRMR (Drum Map Request)
14497: >>>4 byte 0x12 DRMD (Drum Map Dump)
14498: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
14499: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
14500: >>>4 byte 0x72 BIN (Drum Map Reserved)
14501: >>>4 byte 0x04 GLBR (Global Parameter Request)
14502: >>>4 byte 0x14 GLBD (Global Parameter Dump)
14503: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
14504: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
14505: >>2 byte 0x11 rackAttack
14506: >>>4 byte 0x00 SNDR (Sound Parameter Request)
14507: >>>4 byte 0x10 SNDD (Sound Parameter Dump)
14508: >>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
14509: >>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
14510: >>>4 byte 0x01 PRGR (Program Parameter Request)
14511: >>>4 byte 0x11 PRGD (Program Parameter Dump)
14512: >>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
14513: >>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
14514: >>>4 byte 0x71 OS (Program Parameter Reserved)
14515: >>>4 byte 0x03 PATR (Pattern Parameter Request)
14516: >>>4 byte 0x13 PATD (Pattern Parameter Dump)
14517: >>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
14518: >>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
14519: >>>4 byte 0x04 GLBR (Global Parameter Request)
14520: >>>4 byte 0x14 GLBD (Global Parameter Dump)
14521: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
14522: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
14523: >>>4 byte 0x05 EFXR (FX Parameter Request)
14524: >>>4 byte 0x15 EFXD (FX Parameter Dump)
14525: >>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
14526: >>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
14527: >>>4 byte 0x07 MODR (Mode Command Request)
14528: >>>4 byte 0x17 MODD (Mode Command Dump)
14529: >>>4 byte 0x27 MODP (Mode Command Parameter Change)
14530: >>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
14531: >>2 byte 0x03 Wave
14532: >>>4 byte 0x00 SBPR (Soundprogram)
14533: >>>4 byte 0x01 SAPR (Performance)
14534: >>>4 byte 0x02 SWAVE (Wave)
14535: >>>4 byte 0x03 SWTBL (Wave control table)
14536: >>>4 byte 0x04 SVT (Velocity Curve)
14537: >>>4 byte 0x05 STT (Tuning Table)
14538: >>>4 byte 0x06 SGLB (Global Parameters)
14539: >>>4 byte 0x07 SARRMAP (Performance Program Change Map)
14540: >>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
14541: >>>4 byte 0x09 SBPRPAR (Sound Parameter)
14542: >>>4 byte 0x0A SARRPAR (Performance Parameter)
14543: >>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
14544: >>>4 byte 0x0F SBULK (Bulk Switch on/off)
14545:
14546: # Japanese Group
14547: >1 byte 0x40 Kawai
14548: >>3 byte 0x20 K1
14549: >>3 byte 0x22 K4
14550:
14551: >1 byte 0x41 Roland
14552: >>3 byte 0x14 D-50
14553: >>3 byte 0x2b U-220
14554: >>3 byte 0x02 TR-707
14555:
14556: >1 byte 0x42 Korg
14557: >>3 byte 0x19 M1
14558:
14559: >1 byte 0x43 Yamaha
14560: >1 byte 0x44 Casio
14561: >1 byte 0x46 Kamiya
14562: >1 byte 0x47 Akai
14563: >1 byte 0x48 Victor
14564: >1 byte 0x49 Mesosha
14565: >1 byte 0x4b Fujitsu
14566: >1 byte 0x4c Sony
14567: >1 byte 0x4e Teac
14568: >1 byte 0x50 Matsushita
14569: >1 byte 0x51 Fostex
14570: >1 byte 0x52 Zoom
14571: >1 byte 0x54 Matsushita
14572: >1 byte 0x57 Acoustic tech. lab.
14573:
14574: >1 belong&0xffffff00 0x00007400 Ta Horng
14575: >1 belong&0xffffff00 0x00007500 e-Tek
14576: >1 belong&0xffffff00 0x00007600 E-Voice
14577: >1 belong&0xffffff00 0x00007700 Midisoft
14578: >1 belong&0xffffff00 0x00007800 Q-Sound
14579: >1 belong&0xffffff00 0x00007900 Westrex
14580: >1 belong&0xffffff00 0x00007a00 Nvidia*
14581: >1 belong&0xffffff00 0x00007b00 ESS
14582: >1 belong&0xffffff00 0x00007c00 Mediatrix
14583: >1 belong&0xffffff00 0x00007d00 Brooktree
14584: >1 belong&0xffffff00 0x00007e00 Otari
14585: >1 belong&0xffffff00 0x00007f00 Key Electronics
14586: >1 belong&0xffffff00 0x00010000 Shure
14587: >1 belong&0xffffff00 0x00010100 AuraSound
14588: >1 belong&0xffffff00 0x00010200 Crystal
14589: >1 belong&0xffffff00 0x00010300 Rockwell
14590: >1 belong&0xffffff00 0x00010400 Silicon Graphics
14591: >1 belong&0xffffff00 0x00010500 Midiman
14592: >1 belong&0xffffff00 0x00010600 PreSonus
14593: >1 belong&0xffffff00 0x00010800 Topaz
14594: >1 belong&0xffffff00 0x00010900 Cast Lightning
14595: >1 belong&0xffffff00 0x00010a00 Microsoft
14596: >1 belong&0xffffff00 0x00010b00 Sonic Foundry
14597: >1 belong&0xffffff00 0x00010c00 Line 6
14598: >1 belong&0xffffff00 0x00010d00 Beatnik Inc.
14599: >1 belong&0xffffff00 0x00010e00 Van Koerving
14600: >1 belong&0xffffff00 0x00010f00 Altech Systems
14601: >1 belong&0xffffff00 0x00011000 S & S Research
14602: >1 belong&0xffffff00 0x00011100 VLSI Technology
14603: >1 belong&0xffffff00 0x00011200 Chromatic
14604: >1 belong&0xffffff00 0x00011300 Sapphire
14605: >1 belong&0xffffff00 0x00011400 IDRC
14606: >1 belong&0xffffff00 0x00011500 Justonic Tuning
14607: >1 belong&0xffffff00 0x00011600 TorComp
14608: >1 belong&0xffffff00 0x00011700 Newtek Inc.
14609: >1 belong&0xffffff00 0x00011800 Sound Sculpture
14610: >1 belong&0xffffff00 0x00011900 Walker Technical
14611: >1 belong&0xffffff00 0x00011a00 Digital Harmony
14612: >1 belong&0xffffff00 0x00011b00 InVision
14613: >1 belong&0xffffff00 0x00011c00 T-Square
14614: >1 belong&0xffffff00 0x00011d00 Nemesys
14615: >1 belong&0xffffff00 0x00011e00 DBX
14616: >1 belong&0xffffff00 0x00011f00 Syndyne
14617: >1 belong&0xffffff00 0x00012000 Bitheadz
14618: >1 belong&0xffffff00 0x00012100 Cakewalk
14619: >1 belong&0xffffff00 0x00012200 Staccato
14620: >1 belong&0xffffff00 0x00012300 National Semicon.
14621: >1 belong&0xffffff00 0x00012400 Boom Theory
14622: >1 belong&0xffffff00 0x00012500 Virtual DSP Corp
14623: >1 belong&0xffffff00 0x00012600 Antares
14624: >1 belong&0xffffff00 0x00012700 Angel Software
14625: >1 belong&0xffffff00 0x00012800 St Louis Music
14626: >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
14627: >1 belong&0xffffff00 0x00012a00 Ashley Audio
14628: >1 belong&0xffffff00 0x00012b00 Vari-Lite
14629: >1 belong&0xffffff00 0x00012c00 Summit Audio
14630: >1 belong&0xffffff00 0x00012d00 Aureal Semicon.
14631: >1 belong&0xffffff00 0x00012e00 SeaSound
14632: >1 belong&0xffffff00 0x00012f00 U.S. Robotics
14633: >1 belong&0xffffff00 0x00013000 Aurisis
14634: >1 belong&0xffffff00 0x00013100 Nearfield Multimedia
14635: >1 belong&0xffffff00 0x00013200 FM7 Inc.
14636: >1 belong&0xffffff00 0x00013300 Swivel Systems
14637: >1 belong&0xffffff00 0x00013400 Hyperactive
14638: >1 belong&0xffffff00 0x00013500 MidiLite
14639: >1 belong&0xffffff00 0x00013600 Radical
14640: >1 belong&0xffffff00 0x00013700 Roger Linn
14641: >1 belong&0xffffff00 0x00013800 Helicon
14642: >1 belong&0xffffff00 0x00013900 Event
14643: >1 belong&0xffffff00 0x00013a00 Sonic Network
14644: >1 belong&0xffffff00 0x00013b00 Realtime Music
14645: >1 belong&0xffffff00 0x00013c00 Apogee Digital
14646:
14647: >1 belong&0xffffff00 0x00202b00 Medeli Electronics
14648: >1 belong&0xffffff00 0x00202c00 Charlie Lab
14649: >1 belong&0xffffff00 0x00202d00 Blue Chip Music
14650: >1 belong&0xffffff00 0x00202e00 BEE OH Corp
14651: >1 belong&0xffffff00 0x00202f00 LG Semicon America
14652: >1 belong&0xffffff00 0x00203000 TESI
14653: >1 belong&0xffffff00 0x00203100 EMAGIC
14654: >1 belong&0xffffff00 0x00203200 Behringer
14655: >1 belong&0xffffff00 0x00203300 Access Music
14656: >1 belong&0xffffff00 0x00203400 Synoptic
14657: >1 belong&0xffffff00 0x00203500 Hanmesoft Corp
14658: >1 belong&0xffffff00 0x00203600 Terratec
14659: >1 belong&0xffffff00 0x00203700 Proel SpA
14660: >1 belong&0xffffff00 0x00203800 IBK MIDI
14661: >1 belong&0xffffff00 0x00203900 IRCAM
14662: >1 belong&0xffffff00 0x00203a00 Propellerhead Software
14663: >1 belong&0xffffff00 0x00203b00 Red Sound Systems
14664: >1 belong&0xffffff00 0x00203c00 Electron ESI AB
14665: >1 belong&0xffffff00 0x00203d00 Sintefex Audio
14666: >1 belong&0xffffff00 0x00203e00 Music and More
14667: >1 belong&0xffffff00 0x00203f00 Amsaro
14668: >1 belong&0xffffff00 0x00204000 CDS Advanced Technology
14669: >1 belong&0xffffff00 0x00204100 Touched by Sound
14670: >1 belong&0xffffff00 0x00204200 DSP Arts
14671: >1 belong&0xffffff00 0x00204300 Phil Rees Music
14672: >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
14673: >1 belong&0xffffff00 0x00204500 Soundart
14674: >1 belong&0xffffff00 0x00204600 C-Mexx Software
14675: >1 belong&0xffffff00 0x00204700 Klavis Tech.
14676: >1 belong&0xffffff00 0x00204800 Noteheads AB
14677:
14678: 0 string T707 Roland TR-707 Data
1.1.1.2 ! misho 14679:
1.1 misho 14680: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14681: # $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 14682: # teapot: file(1) magic for "teapot" spreadsheet
14683: #
14684: 0 string #!teapot\012xdr teapot work sheet (XDR format)
14685:
14686: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14687: # $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 14688: # terminfo: file(1) magic for terminfo
14689: #
14690: # XXX - byte order for screen images?
14691: #
14692: 0 string \032\001 Compiled terminfo entry
14693: 0 short 0433 Curses screen image
14694: 0 short 0434 Curses screen image
1.1.1.2 ! misho 14695:
1.1 misho 14696: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14697: # $File: tex,v 1.16 2009/09/19 16:28:12 christos Exp $
1.1 misho 14698: # tex: file(1) magic for TeX files
14699: #
14700: # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
14701: #
14702: # From <conklin@talisman.kaleida.com>
14703:
14704: # Although we may know the offset of certain text fields in TeX DVI
14705: # and font files, we can't use them reliably because they are not
14706: # zero terminated. [but we do anyway, christos]
14707: 0 string \367\002 TeX DVI file
14708: !:mime application/x-dvi
14709: >16 string >\0 (%s)
14710: 0 string \367\203 TeX generic font data
14711: 0 string \367\131 TeX packed font data
14712: >3 string >\0 (%s)
14713: 0 string \367\312 TeX virtual font data
14714: 0 search/1 This\ is\ TeX, TeX transcript text
14715: 0 search/1 This\ is\ METAFONT, METAFONT transcript text
14716:
14717: # There is no way to detect TeX Font Metric (*.tfm) files without
14718: # breaking them apart and reading the data. The following patterns
14719: # match most *.tfm files generated by METAFONT or afm2tfm.
14720: 2 string \000\021 TeX font metric data
14721: !:mime application/x-tex-tfm
14722: >33 string >\0 (%s)
14723: 2 string \000\022 TeX font metric data
14724: !:mime application/x-tex-tfm
14725: >33 string >\0 (%s)
14726:
14727: # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
14728: 0 search/1 \\input\ texinfo Texinfo source text
14729: !:mime text/x-texinfo
14730: 0 search/1 This\ is\ Info\ file GNU Info text
14731: !:mime text/x-info
14732:
14733: # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
14734: 0 search/400 \\input TeX document text
14735: !:mime text/x-tex
14736: 0 search/400 \\section LaTeX document text
14737: !:mime text/x-tex
14738: 0 search/400 \\setlength LaTeX document text
14739: !:mime text/x-tex
14740: 0 search/400 \\documentstyle LaTeX document text
14741: !:mime text/x-tex
14742: 0 search/400 \\chapter LaTeX document text
14743: !:mime text/x-tex
14744: 0 search/400 \\documentclass LaTeX 2e document text
14745: !:mime text/x-tex
14746: 0 search/400 \\relax LaTeX auxiliary file
14747: !:mime text/x-tex
14748: 0 search/400 \\contentsline LaTeX table of contents
14749: !:mime text/x-tex
14750: 0 search/400 %\ -*-latex-*- LaTeX document text
14751: !:mime text/x-tex
14752:
14753: # Tex document, from Hendrik Scholz <hendrik@scholz.net>
14754: 0 search/1 \\ifx TeX document text
14755:
14756: # Index and glossary files
14757: 0 search/400 \\indexentry LaTeX raw index file
14758: 0 search/400 \\begin{theindex} LaTeX sorted index
14759: 0 search/400 \\glossaryentry LaTeX raw glossary
14760: 0 search/400 \\begin{theglossary} LaTeX sorted glossary
14761: 0 search/400 This\ is\ makeindex Makeindex log file
14762:
14763: # End of TeX
14764:
14765: #------------------------------------------------------------------------------
14766: # file(1) magic for BibTex text files
14767: # From Hendrik Scholz <hendrik@scholz.net>
14768:
14769: 0 search/1/c @article{ BibTeX text file
14770: 0 search/1/c @book{ BibTeX text file
14771: 0 search/1/c @inbook{ BibTeX text file
14772: 0 search/1/c @incollection{ BibTeX text file
14773: 0 search/1/c @inproceedings{ BibTeX text file
14774: 0 search/1/c @manual{ BibTeX text file
14775: 0 search/1/c @misc{ BibTeX text file
14776: 0 search/1/c @preamble{ BibTeX text file
14777: 0 search/1/c @phdthesis{ BibTeX text file
14778: 0 search/1/c @techreport{ BibTeX text file
14779: 0 search/1/c @unpublished{ BibTeX text file
14780:
14781: 73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header)
14782:
14783: 73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
14784:
14785: 0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
14786:
14787: 0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file
14788:
14789: 0 search/1 @c\ @mapfile{ TeX font aliases text file
1.1.1.2 ! misho 14790:
! 14791: 0 string \#LyX LyX document text
! 14792:
1.1 misho 14793: #------------------------------------------------------------------------------
1.1.1.2 ! misho 14794: # $File: tgif,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 14795: # file(1) magic for tgif(1) files
14796: # From Hendrik Scholz <hendrik@scholz.net>
1.1.1.2 ! misho 14797: 0 string %TGIF\ Tgif file version
! 14798: >6 string x %s
1.1 misho 14799:
1.1.1.2 ! misho 14800: #------------------------------------------------------------------------------
! 14801: # $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 14802: # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
14803: #
14804: # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
14805: #
14806: # Update: Romain Lievin (roms@lpg.ticalc.org).
14807: #
14808: # NOTE: This list is not complete.
14809: # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
14810: # program/group magic numbers in here because I cannot find any.
14811: 0 string **TI80** TI-80 Graphing Calculator File.
14812: 0 string **TI81** TI-81 Graphing Calculator File.
14813: #
14814: # Magic Numbers for the TI-73
14815: #
14816: 0 string **TI73** TI-73 Graphing Calculator
14817: >0x00003B byte 0x00 (real number)
14818: >0x00003B byte 0x01 (list)
14819: >0x00003B byte 0x02 (matrix)
14820: >0x00003B byte 0x03 (equation)
14821: >0x00003B byte 0x04 (string)
14822: >0x00003B byte 0x05 (program)
14823: >0x00003B byte 0x06 (assembly program)
14824: >0x00003B byte 0x07 (picture)
14825: >0x00003B byte 0x08 (gdb)
14826: >0x00003B byte 0x0C (complex number)
14827: >0x00003B byte 0x0F (window settings)
14828: >0x00003B byte 0x10 (zoom)
14829: >0x00003B byte 0x11 (table setup)
14830: >0x00003B byte 0x13 (backup)
14831:
14832: # Magic Numbers for the TI-82
14833: #
14834: 0 string **TI82** TI-82 Graphing Calculator
14835: >0x00003B byte 0x00 (real)
14836: >0x00003B byte 0x01 (list)
14837: >0x00003B byte 0x02 (matrix)
14838: >0x00003B byte 0x03 (Y-variable)
14839: >0x00003B byte 0x05 (program)
14840: >0x00003B byte 0x06 (protected prgm)
14841: >0x00003B byte 0x07 (picture)
14842: >0x00003B byte 0x08 (gdb)
14843: >0x00003B byte 0x0B (window settings)
14844: >0x00003B byte 0x0C (window settings)
14845: >0x00003B byte 0x0D (table setup)
14846: >0x00003B byte 0x0E (screenshot)
14847: >0x00003B byte 0x0F (backup)
14848: #
14849: # Magic Numbers for the TI-83
14850: #
14851: 0 string **TI83** TI-83 Graphing Calculator
14852: >0x00003B byte 0x00 (real)
14853: >0x00003B byte 0x01 (list)
14854: >0x00003B byte 0x02 (matrix)
14855: >0x00003B byte 0x03 (Y-variable)
14856: >0x00003B byte 0x04 (string)
14857: >0x00003B byte 0x05 (program)
14858: >0x00003B byte 0x06 (protected prgm)
14859: >0x00003B byte 0x07 (picture)
14860: >0x00003B byte 0x08 (gdb)
14861: >0x00003B byte 0x0B (window settings)
14862: >0x00003B byte 0x0C (window settings)
14863: >0x00003B byte 0x0D (table setup)
14864: >0x00003B byte 0x0E (screenshot)
14865: >0x00003B byte 0x13 (backup)
14866: #
14867: # Magic Numbers for the TI-83+
14868: #
14869: 0 string **TI83F* TI-83+ Graphing Calculator
14870: >0x00003B byte 0x00 (real number)
14871: >0x00003B byte 0x01 (list)
14872: >0x00003B byte 0x02 (matrix)
14873: >0x00003B byte 0x03 (equation)
14874: >0x00003B byte 0x04 (string)
14875: >0x00003B byte 0x05 (program)
14876: >0x00003B byte 0x06 (assembly program)
14877: >0x00003B byte 0x07 (picture)
14878: >0x00003B byte 0x08 (gdb)
14879: >0x00003B byte 0x0C (complex number)
14880: >0x00003B byte 0x0F (window settings)
14881: >0x00003B byte 0x10 (zoom)
14882: >0x00003B byte 0x11 (table setup)
14883: >0x00003B byte 0x13 (backup)
14884: >0x00003B byte 0x15 (application variable)
14885: >0x00003B byte 0x17 (group of variable)
14886:
14887: #
14888: # Magic Numbers for the TI-85
14889: #
14890: 0 string **TI85** TI-85 Graphing Calculator
14891: >0x00003B byte 0x00 (real number)
14892: >0x00003B byte 0x01 (complex number)
14893: >0x00003B byte 0x02 (real vector)
14894: >0x00003B byte 0x03 (complex vector)
14895: >0x00003B byte 0x04 (real list)
14896: >0x00003B byte 0x05 (complex list)
14897: >0x00003B byte 0x06 (real matrix)
14898: >0x00003B byte 0x07 (complex matrix)
14899: >0x00003B byte 0x08 (real constant)
14900: >0x00003B byte 0x09 (complex constant)
14901: >0x00003B byte 0x0A (equation)
14902: >0x00003B byte 0x0C (string)
14903: >0x00003B byte 0x0D (function GDB)
14904: >0x00003B byte 0x0E (polar GDB)
14905: >0x00003B byte 0x0F (parametric GDB)
14906: >0x00003B byte 0x10 (diffeq GDB)
14907: >0x00003B byte 0x11 (picture)
14908: >0x00003B byte 0x12 (program)
14909: >0x00003B byte 0x13 (range)
14910: >0x00003B byte 0x17 (window settings)
14911: >0x00003B byte 0x18 (window settings)
14912: >0x00003B byte 0x19 (window settings)
14913: >0x00003B byte 0x1A (window settings)
14914: >0x00003B byte 0x1B (zoom)
14915: >0x00003B byte 0x1D (backup)
14916: >0x00003B byte 0x1E (unknown)
14917: >0x00003B byte 0x2A (equation)
14918: >0x000032 string ZS4 - ZShell Version 4 File.
14919: >0x000032 string ZS3 - ZShell Version 3 File.
14920: #
14921: # Magic Numbers for the TI-86
14922: #
14923: 0 string **TI86** TI-86 Graphing Calculator
14924: >0x00003B byte 0x00 (real number)
14925: >0x00003B byte 0x01 (complex number)
14926: >0x00003B byte 0x02 (real vector)
14927: >0x00003B byte 0x03 (complex vector)
14928: >0x00003B byte 0x04 (real list)
14929: >0x00003B byte 0x05 (complex list)
14930: >0x00003B byte 0x06 (real matrix)
14931: >0x00003B byte 0x07 (complex matrix)
14932: >0x00003B byte 0x08 (real constant)
14933: >0x00003B byte 0x09 (complex constant)
14934: >0x00003B byte 0x0A (equation)
14935: >0x00003B byte 0x0C (string)
14936: >0x00003B byte 0x0D (function GDB)
14937: >0x00003B byte 0x0E (polar GDB)
14938: >0x00003B byte 0x0F (parametric GDB)
14939: >0x00003B byte 0x10 (diffeq GDB)
14940: >0x00003B byte 0x11 (picture)
14941: >0x00003B byte 0x12 (program)
14942: >0x00003B byte 0x13 (range)
14943: >0x00003B byte 0x17 (window settings)
14944: >0x00003B byte 0x18 (window settings)
14945: >0x00003B byte 0x19 (window settings)
14946: >0x00003B byte 0x1A (window settings)
14947: >0x00003B byte 0x1B (zoom)
14948: >0x00003B byte 0x1D (backup)
14949: >0x00003B byte 0x1E (unknown)
14950: >0x00003B byte 0x2A (equation)
14951: #
14952: # Magic Numbers for the TI-89
14953: #
14954: 0 string **TI89** TI-89 Graphing Calculator
14955: >0x000048 byte 0x00 (expression)
14956: >0x000048 byte 0x04 (list)
14957: >0x000048 byte 0x06 (matrix)
14958: >0x000048 byte 0x0A (data)
14959: >0x000048 byte 0x0B (text)
14960: >0x000048 byte 0x0C (string)
14961: >0x000048 byte 0x0D (graphic data base)
14962: >0x000048 byte 0x0E (figure)
14963: >0x000048 byte 0x10 (picture)
14964: >0x000048 byte 0x12 (program)
14965: >0x000048 byte 0x13 (function)
14966: >0x000048 byte 0x14 (macro)
14967: >0x000048 byte 0x1C (zipped)
14968: >0x000048 byte 0x21 (assembler)
14969: #
14970: # Magic Numbers for the TI-92
14971: #
14972: 0 string **TI92** TI-92 Graphing Calculator
14973: >0x000048 byte 0x00 (expression)
14974: >0x000048 byte 0x04 (list)
14975: >0x000048 byte 0x06 (matrix)
14976: >0x000048 byte 0x0A (data)
14977: >0x000048 byte 0x0B (text)
14978: >0x000048 byte 0x0C (string)
14979: >0x000048 byte 0x0D (graphic data base)
14980: >0x000048 byte 0x0E (figure)
14981: >0x000048 byte 0x10 (picture)
14982: >0x000048 byte 0x12 (program)
14983: >0x000048 byte 0x13 (function)
14984: >0x000048 byte 0x14 (macro)
14985: >0x000048 byte 0x1D (backup)
14986: #
14987: # Magic Numbers for the TI-92+/V200
14988: #
14989: 0 string **TI92P* TI-92+/V200 Graphing Calculator
14990: >0x000048 byte 0x00 (expression)
14991: >0x000048 byte 0x04 (list)
14992: >0x000048 byte 0x06 (matrix)
14993: >0x000048 byte 0x0A (data)
14994: >0x000048 byte 0x0B (text)
14995: >0x000048 byte 0x0C (string)
14996: >0x000048 byte 0x0D (graphic data base)
14997: >0x000048 byte 0x0E (figure)
14998: >0x000048 byte 0x10 (picture)
14999: >0x000048 byte 0x12 (program)
15000: >0x000048 byte 0x13 (function)
15001: >0x000048 byte 0x14 (macro)
15002: >0x000048 byte 0x1C (zipped)
15003: >0x000048 byte 0x21 (assembler)
15004: #
15005: # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
15006: #
15007: 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
15008: 0 string **TIFL** TI-XX Graphing Calculator (FLASH)
15009: >8 byte >0 - Revision %d
15010: >>9 byte x \b.%d,
15011: >12 byte >0 Revision date %02x
15012: >>13 byte x \b/%02x
15013: >>14 beshort x \b/%04x,
15014: >17 string >/0 name: '%s',
15015: >48 byte 0x74 device: TI-73,
15016: >48 byte 0x73 device: TI-83+,
15017: >48 byte 0x98 device: TI-89,
15018: >48 byte 0x88 device: TI-92+,
15019: >49 byte 0x23 type: OS upgrade,
15020: >49 byte 0x24 type: application,
15021: >49 byte 0x25 type: certificate,
15022: >49 byte 0x3e type: license,
15023: >74 lelong >0 size: %ld bytes
15024:
15025: # VTi & TiEmu skins (TI Graphing Calculators).
15026: # From: Romain Lievin (roms@lpg.ticalc.org).
15027: # Magic Numbers for the VTi skins
15028: 0 string VTI Virtual TI skin
15029: >3 string v - Version
15030: >>4 byte >0 \b %c
15031: >>6 byte x \b.%c
15032: # Magic Numbers for the TiEmu skins
15033: 0 string TiEmu TiEmu skin
15034: >6 string v - Version
15035: >>7 byte >0 \b %c
15036: >>9 byte x \b.%c
15037: >>10 byte x \b%c
15038:
15039: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15040: # $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
1.1 misho 15041: # timezone: file(1) magic for timezone data
15042: #
15043: # from Daniel Quinlan (quinlan@yggdrasil.com)
15044: # this should work on Linux, SunOS, and maybe others
15045: # Added new official magic number for recent versions of the Olson code
15046: 0 string TZif timezone data
1.1.1.2 ! misho 15047: >4 byte 0 \b, old version
! 15048: >4 byte >0 \b, version %c
! 15049: >20 belong 0 \b, no gmt time flags
! 15050: >20 belong 1 \b, 1 gmt time flag
! 15051: >20 belong >1 \b, %d gmt time flags
! 15052: >24 belong 0 \b, no std time flags
! 15053: >20 belong 1 \b, 1 std time flag
! 15054: >24 belong >1 \b, %d std time flags
! 15055: >28 belong 0 \b, no leap seconds
! 15056: >28 belong 1 \b, 1 leap second
! 15057: >28 belong >1 \b, %d leap seconds
! 15058: >32 belong 0 \b, no transition times
! 15059: >32 belong 1 \b, 1 transition time
! 15060: >32 belong >1 \b, %d transition times
! 15061: >36 belong 0 \b, no abbreviation chars
! 15062: >36 belong 1 \b, 1 abbreviation char
! 15063: >36 belong >1 \b, %d abbreviation chars
1.1 misho 15064: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
15065: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
15066: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
15067: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
15068: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
15069: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
1.1.1.2 ! misho 15070:
1.1 misho 15071: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15072: # $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
1.1 misho 15073: # troff: file(1) magic for *roff
15074: #
15075: # updated by Daniel Quinlan (quinlan@yggdrasil.com)
15076:
15077: # troff input
15078: 0 search/1 .\\" troff or preprocessor input text
15079: !:mime text/troff
15080: 0 search/1 '\\" troff or preprocessor input text
15081: !:mime text/troff
15082: 0 search/1 '.\\" troff or preprocessor input text
15083: !:mime text/troff
15084: 0 search/1 \\" troff or preprocessor input text
15085: !:mime text/troff
15086: 0 search/1 ''' troff or preprocessor input text
15087: !:mime text/troff
1.1.1.2 ! misho 15088: 0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
! 15089: !:mime text/troff
! 15090: 0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
! 15091: !:mime text/troff
1.1 misho 15092:
15093: # ditroff intermediate output text
15094: 0 search/1 x\ T ditroff output text
15095: >4 search/1 cat for the C/A/T phototypesetter
15096: >4 search/1 ps for PostScript
15097: >4 search/1 dvi for DVI
15098: >4 search/1 ascii for ASCII
15099: >4 search/1 lj4 for LaserJet 4
15100: >4 search/1 latin1 for ISO 8859-1 (Latin 1)
15101: >4 search/1 X75 for xditview at 75dpi
15102: >>7 search/1 -12 (12pt)
15103: >4 search/1 X100 for xditview at 100dpi
15104: >>8 search/1 -12 (12pt)
15105:
15106: # output data formats
15107: 0 string \100\357 very old (C/A/T) troff output data
1.1.1.2 ! misho 15108:
1.1 misho 15109: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15110: # $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15111: # tuxedo: file(1) magic for BEA TUXEDO data files
15112: #
15113: # from Ian Springer <ispringer@hotmail.com>
15114: #
15115: 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
15116:
15117: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15118: # $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
1.1 misho 15119: # typeset: file(1) magic for other typesetting
15120: #
15121: 0 string Interpress/Xerox Xerox InterPress data
15122: >16 string / (version
15123: >>17 string >\0 %s)
1.1.1.2 ! misho 15124:
! 15125: #------------------------------------------------------------------------------
! 15126: # $File: unicode,v 1.5 2009/09/19 16:28:13 christos Exp $
1.1 misho 15127: # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
15128: # GRR: These types should be recognised in file_ascmagic so these
15129: # encodings can be treated by text patterns.
15130: # Missing types are already dealt with internally.
15131: #
15132: 0 string +/v8 Unicode text, UTF-7
15133: 0 string +/v9 Unicode text, UTF-7
15134: 0 string +/v+ Unicode text, UTF-7
15135: 0 string +/v/ Unicode text, UTF-7
15136: 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
1.1.1.2 ! misho 15137: 0 string \000\000\376\377 Unicode text, UTF-32, big-endian
1.1 misho 15138: 0 string \377\376\000\000 Unicode text, UTF-32, little-endian
15139: 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
15140:
15141: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15142: # $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 15143: # unknown: file(1) magic for unknown machines
15144: #
15145: # XXX - this probably should be pruned, as it'll match PDP-11 and
15146: # VAX image formats.
15147: #
15148: # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
15149: # respectively).
15150: #
15151: # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
15152: # have the "version %ld", which may be a bogus COFFism (I don't think
15153: # there ever was COFF for the PDP-11).
15154: #
15155: # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
15156: # long, as it would be on a VAX.
15157: #
15158: # 0x10C is 0414 and 0x10E is 416; those *are* unknown.
15159: #
15160: 0 short 0x107 unknown machine executable
15161: >8 short >0 not stripped
15162: >15 byte >0 - version %ld
15163: 0 short 0x108 unknown pure executable
15164: >8 short >0 not stripped
15165: >15 byte >0 - version %ld
15166: 0 short 0x109 PDP-11 separate I&D
15167: >8 short >0 not stripped
15168: >15 byte >0 - version %ld
15169: 0 short 0x10b unknown pure executable
15170: >8 short >0 not stripped
15171: >15 byte >0 - version %ld
15172: 0 long 0x10c unknown demand paged pure executable
15173: >16 long >0 not stripped
15174: 0 long 0x10e unknown readable demand paged pure executable
1.1.1.2 ! misho 15175:
1.1 misho 15176: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15177: # $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 15178: # uuencode: file(1) magic for ASCII-encoded files
15179: #
15180:
15181: # GRR: the first line of xxencoded files is identical to that in uuencoded
15182: # files, but the first character in most subsequent lines is 'h' instead of
15183: # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
15184: # punctuation and survives BITNET gateways better.) If regular expressions
15185: # were supported, this entry could possibly be split into two with
15186: # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
15187: 0 search/1 begin\ uuencoded or xxencoded text
15188:
15189: # btoa(1) is an alternative to uuencode that requires less space.
15190: 0 search/1 xbtoa\ Begin btoa'd text
15191:
15192: # ship(1) is another, much cooler alternative to uuencode.
15193: # Greg Roelofs, newt@uchicago.edu
15194: 0 search/1 $\012ship ship'd binary text
15195:
15196: # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
15197: # Greg Roelofs, newt@uchicago.edu
15198: 0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
15199:
15200: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
15201: # Daniel Quinlan, quinlan@yggdrasil.com
15202: 11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
15203: >41 search/1 x \b, version %.3s
15204:
15205: # GRR: handle BASE64
15206:
15207: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15208: # $File: varied.out,v 1.21 2009/09/19 16:28:13 christos Exp $
1.1 misho 15209: # varied.out: file(1) magic for various USG systems
15210: #
15211: # Herewith many of the object file formats used by USG systems.
15212: # Most have been moved to files for a particular processor,
15213: # and deleted if they duplicate other entries.
15214: #
15215: 0 short 0610 Perkin-Elmer executable
15216: # AMD 29K
15217: 0 beshort 0572 amd 29k coff noprebar executable
15218: 0 beshort 01572 amd 29k coff prebar executable
15219: 0 beshort 0160007 amd 29k coff archive
15220: # Cray
15221: 6 beshort 0407 unicos (cray) executable
15222: # Ultrix 4.3
15223: 596 string \130\337\377\377 Ultrix core file
15224: >600 string >\0 from '%s'
15225: # BeOS and MAcOS PEF executables
15226: # From: hplus@zilker.net (Jon Watte)
15227: 0 string Joy!peffpwpc header for PowerPC PEF executable
15228: #
15229: # ava assembler/linker Uros Platise <uros.platise@ijs.si>
15230: 0 string avaobj AVR assembler object code
15231: >7 string >\0 version '%s'
15232: # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
15233: 0 string gmon GNU prof performance data
15234: >4 long x - version %ld
15235: # From: Dave Pearson <davep@davep.org>
15236: # Harbour <URL:http://www.harbour-project.org/> HRB files.
15237: 0 string \xc0HRB Harbour HRB file
15238: >4 short x version %d
15239:
15240: # From: Alex Beregszaszi <alex@fsn.hu>
15241: # 0 string exec BugOS executable
15242: # 0 string pack BugOS archive
15243:
15244: # From: Jason Spence <jspence@lightconsulting.com>
15245: # Generated by the "examples" in STM's ST40 devkit, and derived code.
15246: 0 lelong 0x13a9f17e ST40 component image format
15247: >4 string >\0 \b, name '%s'
15248:
1.1.1.2 ! misho 15249:
1.1 misho 15250: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15251: # $File: varied.script,v 1.6 2009/09/19 16:28:13 christos Exp $
1.1 misho 15252: # varied.script: file(1) magic for various interpreter scripts
15253:
15254: 0 string #!\ / a
15255: >3 string >\0 %s script text executable
15256: 0 string #!\t/ a
15257: >3 string >\0 %s script text executable
15258: 0 string #!/ a
15259: >2 string >\0 %s script text executable
15260: 0 string #!\ script text executable
15261: >3 string >\0 for %s
15262:
15263: # From: arno <arenevier@fdn.fr>
15264: # mozilla xpconnect typelib
15265: # see http://www.mozilla.org/scriptable/typelib_file.html
15266: 0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
15267: >0x10 byte x version %d
15268: >>0x11 byte x \b.%d
15269:
15270: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15271: # $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 15272: # vax: file(1) magic for VAX executable/object and APL workspace
15273: #
15274: 0 lelong 0101557 VAX single precision APL workspace
15275: 0 lelong 0101556 VAX double precision APL workspace
15276:
15277: #
15278: # VAX a.out (32V, BSD)
15279: #
15280: 0 lelong 0407 VAX executable
15281: >16 lelong >0 not stripped
15282:
15283: 0 lelong 0410 VAX pure executable
15284: >16 lelong >0 not stripped
15285:
15286: 0 lelong 0413 VAX demand paged pure executable
15287: >16 lelong >0 not stripped
15288:
15289: 0 lelong 0420 VAX demand paged (first page unmapped) pure executable
15290: >16 lelong >0 not stripped
15291:
15292: #
15293: # VAX COFF
15294: #
15295: # The `versions' should be un-commented if they work for you.
15296: # (Was the problem just one of endianness?)
15297: #
15298: 0 leshort 0570 VAX COFF executable
15299: >12 lelong >0 not stripped
15300: >22 leshort >0 - version %ld
15301: 0 leshort 0575 VAX COFF pure executable
15302: >12 lelong >0 not stripped
15303: >22 leshort >0 - version %ld
15304:
15305: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15306: # $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15307: # vicar: file(1) magic for VICAR files.
15308: #
15309: # From: Ossama Othman <othman@astrosun.tn.cornell.edu
15310: # VICAR is JPL's in-house spacecraft image processing program
15311: # VICAR image
15312: 0 string LBLSIZE= VICAR image data
15313: >32 string BYTE \b, 8 bits = VAX byte
15314: >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
15315: >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
15316: >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
15317: >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
15318: >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
15319: # VICAR label file
15320: 43 string SFDU_LABEL VICAR label file
1.1.1.2 ! misho 15321:
1.1 misho 15322: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15323: # $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $
! 15324: # From: James Nobis <quel@quelrod.net>
! 15325: # Microsoft hard disk images for:
! 15326: # Virtual Server
! 15327: # Virtual PC
! 15328: # http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
! 15329: # .vhd
! 15330: 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
! 15331:
! 15332: # Sun xVM VirtualBox Disk Image
! 15333: # string <<< Sun xVM VirtualBox Disk Image >>>
! 15334: # .vdi
! 15335: 0 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image
! 15336:
! 15337:
! 15338:
! 15339: #------------------------------------------------------------------------------
! 15340: # $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15341: # Virtutech Compressed Random Access File Format
15342: #
15343: # From <gustav@virtutech.com>
15344: 0 string \211\277\036\203 Virtutech CRAFF
15345: >4 belong x v%d
15346: >20 belong 0 uncompressed
15347: >20 belong 1 bzipp2ed
15348: >20 belong 2 gzipped
15349: >24 belong 0 not clean
15350:
15351: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15352: # $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
1.1 misho 15353: # visx: file(1) magic for Visx format files
15354: #
15355: 0 short 0x5555 VISX image file
15356: >2 byte 0 (zero)
15357: >2 byte 1 (unsigned char)
15358: >2 byte 2 (short integer)
15359: >2 byte 3 (float 32)
15360: >2 byte 4 (float 64)
15361: >2 byte 5 (signed char)
15362: >2 byte 6 (bit-plane)
15363: >2 byte 7 (classes)
15364: >2 byte 8 (statistics)
15365: >2 byte 10 (ascii text)
15366: >2 byte 15 (image segments)
15367: >2 byte 100 (image set)
15368: >2 byte 101 (unsigned char vector)
15369: >2 byte 102 (short integer vector)
15370: >2 byte 103 (float 32 vector)
15371: >2 byte 104 (float 64 vector)
15372: >2 byte 105 (signed char vector)
15373: >2 byte 106 (bit plane vector)
15374: >2 byte 121 (feature vector)
15375: >2 byte 122 (feature vector library)
15376: >2 byte 124 (chain code)
15377: >2 byte 126 (bit vector)
15378: >2 byte 130 (graph)
15379: >2 byte 131 (adjacency graph)
15380: >2 byte 132 (adjacency graph library)
15381: >2 string .VISIX (ascii text)
15382:
15383: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15384: # $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $
1.1 misho 15385: # vms: file(1) magic for VMS executables (experimental)
15386: #
15387: # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
15388:
15389: # GRR 950122: I'm just guessing on these, based on inspection of the headers
15390: # of three executables each for Alpha and VAX architectures. The VAX files
15391: # all had headers similar to this:
15392: #
15393: # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
15394: # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
15395: #
15396: 0 string \xb0\0\x30\0 VMS VAX executable
15397: >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
15398: #
15399: # The AXP files all looked like this, except that the byte at offset 0x22
15400: # was 06 in some of them and 07 in others:
15401: #
15402: # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
15403: # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
15404: # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
15405: # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
15406: # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
15407: #
15408: 0 belong 0x03000000 VMS Alpha executable
15409: >75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
15410:
1.1.1.2 ! misho 15411: #------------------------------------------------------------------------------
! 15412: # $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 15413: # VMware specific files (deducted from version 1.1 and log file entries)
15414: # Anthon van der Neut (anthon@mnt.org)
15415: 0 belong 0x4d52564e VMware nvram
15416:
15417: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15418: # $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
1.1 misho 15419: # vorbis: file(1) magic for Ogg/Vorbis files
15420: #
15421: # From Felix von Leitner <leitner@fefe.de>
15422: # Extended by Beni Cherniavsky <cben@crosswinds.net>
15423: # Further extended by Greg Wooledge <greg@wooledge.org>
15424: #
15425: # Most (everything but the number of channels and bitrate) is commented
15426: # out with `##' as it's not interesting to the average user. The most
15427: # probable things advanced users would want to uncomment are probably
15428: # the number of comments and the encoder version.
15429: #
15430: # FIXME: The first match has been made a search, so that it can skip
15431: # over prepended ID3 tags. This will work for MIME type detection, but
15432: # won't work for detecting other properties of the file (they all need
15433: # to be made relative to the search). In any case, if the file has ID3
15434: # tags, the ID3 information will be printed, not the Ogg information,
15435: # so until that's fixed, this doesn't matter.
15436: # FIXME[2]: Disable the above for now, since search assumes text mode.
15437: #
15438: # --- Ogg Framing ---
15439: #0 search/1000 OggS Ogg data
15440: 0 string OggS Ogg data
15441: !:mime application/ogg
15442: >4 byte !0 UNKNOWN REVISION %u
15443: ##>4 byte 0 revision 0
15444: >4 byte 0
15445: ##>>14 lelong x (Serial %lX)
15446: # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
15447: >>28 string \x7fFLAC \b, FLAC audio
15448: # non-Vorbis content: Theora
15449: >>28 string \x80theora \b, Theora video
15450: # non-Vorbis content: Kate
15451: >>28 string \x80kate\0\0\0\0 \b, Kate
15452: >>>37 ubyte x v%u
15453: >>>38 ubyte x \b.%u,
15454: >>>40 byte 0 utf8 encoding,
15455: >>>40 byte !0 unknown character encoding,
15456: >>>60 string >\0 language %s,
15457: >>>60 string \0 no language set,
15458: >>>76 string >\0 category %s
15459: >>>76 string \0 no category set
15460: # non-Vorbis content: Skeleton
15461: >>28 string fishead\0 \b, Skeleton
15462: >>>36 short x v%u
15463: >>>40 short x \b.%u
15464: # non-Vorbis content: Speex
15465: >>28 string Speex\ \ \ \b, Speex audio
15466: # non-Vorbis content: OGM
15467: >>28 string \x01video\0\0\0 \b, OGM video
15468: >>>37 string/c div3 (DivX 3)
15469: >>>37 string/c divx (DivX 4)
15470: >>>37 string/c dx50 (DivX 5)
15471: >>>37 string/c xvid (XviD)
15472: # --- First vorbis packet - general header ---
15473: >>28 string \x01vorbis \b, Vorbis audio,
15474: >>>35 lelong !0 UNKNOWN VERSION %lu,
15475: ##>>>35 lelong 0 version 0,
15476: >>>35 lelong 0
15477: >>>>39 ubyte 1 mono,
15478: >>>>39 ubyte 2 stereo,
15479: >>>>39 ubyte >2 %u channels,
15480: >>>>40 lelong x %lu Hz
15481: # Minimal, nominal and maximal bitrates specified when encoding
15482: >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
15483: # The above tests if at least one of these is specified:
15484: >>>>>52 lelong !-1
15485: # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
15486: # instead of -1.
15487: # Vorbis 1.0 uses 0 instead of -1.
15488: >>>>>>52 lelong !0
15489: >>>>>>>52 lelong !-1000
15490: >>>>>>>>52 lelong x <%lu
15491: >>>>>48 lelong !-1
15492: >>>>>>48 lelong x ~%lu
15493: >>>>>44 lelong !-1
15494: >>>>>>44 lelong !-1000
15495: >>>>>>>44 lelong !0
15496: >>>>>>>>44 lelong x >%lu
15497: >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
15498: # -- Second vorbis header packet - the comments
15499: # A kludge to read the vendor string. It's a counted string, not a
15500: # zero-terminated one, so file(1) can't read it in a generic way.
15501: # libVorbis is the only one existing currently, so I detect specifically
15502: # it. The interesting value is the cvs date (8 digits decimal).
15503: # Post-RC1 Ogg files have the second header packet (and thus the version)
15504: # in a different place, so we must use an indirect offset.
15505: >>>(84.b+85) string \x03vorbis
15506: >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
15507: >>>>>(84.b+120) string >00000000
15508: # Map to beta version numbers:
15509: >>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
15510: >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
15511: >>>>>>(84.b+120) string >20000508
15512: >>>>>>>(84.b+120) string <20001031 (beta2-3)
15513: >>>>>>(84.b+120) string 20001031 (1.0 beta 3)
15514: >>>>>>(84.b+120) string >20001031
15515: >>>>>>>(84.b+120) string <20010225 (beta3-4)
15516: >>>>>>(84.b+120) string 20010225 (1.0 beta 4)
15517: >>>>>>(84.b+120) string >20010225
15518: >>>>>>>(84.b+120) string <20010615 (beta4-RC1)
15519: >>>>>>(84.b+120) string 20010615 (1.0 RC1)
15520: >>>>>>(84.b+120) string 20010813 (1.0 RC2)
15521: >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
15522: >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
15523: >>>>>>(84.b+120) string 20011217 (1.0 RC3)
15524: >>>>>>(84.b+120) string 20011231 (1.0 RC3)
15525: # Some pre-1.0 CVS snapshots still had "Xiphphorus"...
15526: >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
15527: # For the 1.0 release, Xiphophorus is replaced by Xiph.Org
15528: >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
15529: >>>>>(84.b+117) string >00000000
15530: >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
15531: >>>>>>(84.b+117) string 20020717 (1.0)
15532: >>>>>>(84.b+117) string 20030909 (1.0.1)
15533: >>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
15534:
15535: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15536: # $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15537: # VXL: file(1) magic for VXL binary IO data files
15538: #
15539: # from Ian Scott <scottim@sf.net>
15540: #
15541: # VXL is a collection of C++ libraries for Computer Vision.
15542: # See the vsl chapter in the VXL Book for more info
15543: # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
15544: # http:/vxl.sf.net
15545:
15546: 2 lelong 0x472b2c4e VXL data file,
15547: >0 leshort >0 schema version no %d
15548:
15549: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15550: # $File: warc,v 1.2 2009/09/19 16:28:13 christos Exp $
1.1 misho 15551: # warc: file(1) magic for WARC files
15552:
15553: 0 string WARC/ WARC Archive
15554: >5 string x version %.4s
1.1.1.2 ! misho 15555:
1.1 misho 15556: #------------------------------------------------------------------------------
15557: # weak: file(1) magic for very weak magic entries, disabled by default
15558: #
15559: # These entries are so weak that they might interfere identification of
15560: # other formats. Example include:
15561: # - Only identify for 1 or 2 bytes
15562: # - Match against very wide range of values
15563: # - Match against generic word in some spoken languages (e.g. English)
15564:
15565: # Summary: Computer Graphics Metafile
15566: # Extension: .cgm
15567: #0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
15568: #0 beshort 0x3020 character Computer Graphics Metafile
15569:
15570: #0 string =!! Bennet Yee's "face" format
15571:
15572: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15573: # $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15574: # windows: file(1) magic for Microsoft Windows
15575: #
15576: # This file is mainly reserved for files where programs
15577: # using them are run almost always on MS Windows 3.x or
15578: # above, or files only used exclusively in Windows OS,
15579: # where there is no better category to allocate for.
15580: # For example, even though WinZIP almost run on Windows
15581: # only, it is better to treat them as "archive" instead.
15582: # For format usable in DOS, such as generic executable
15583: # format, please specify under "msdos" file.
15584: #
15585:
15586:
15587: # Summary: Outlook Express DBX file
15588: # Extension: .dbx
15589: # Created by: Christophe Monniez
15590: 0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
15591: >4 byte =0xC5 \b, message database
15592: >4 byte =0xC6 \b, folder database
15593: >4 byte =0xC7 \b, account information
15594: >4 byte =0x30 \b, offline database
15595:
15596:
15597: # Summary: Windows crash dump
15598: # Extension: .dmp
15599: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
15600: # Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
15601: # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
15602: 0 string PAGE
15603: >4 string DUMP MS Windows 32bit crash dump
15604: >>0x05c byte 0 \b, no PAE
15605: >>0x05c byte 1 \b, PAE
15606: >>0xf88 lelong 1 \b, full dump
15607: >>0xf88 lelong 2 \b, kernel dump
15608: >>0xf88 lelong 3 \b, small dump
15609: >>0x068 lelong x \b, %ld pages
15610: >4 string DU64 MS Windows 64bit crash dump
15611: >>0xf98 lelong 1 \b, full dump
15612: >>0xf98 lelong 2 \b, kernel dump
15613: >>0xf98 lelong 3 \b, small dump
15614: >>0x090 lequad x \b, %lld pages
15615:
15616:
15617: # Summary: Vista Event Log
15618: # Extension: .evtx
15619: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
15620: # Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
15621: 0 string ElfFile\0 MS Windows Vista Event Log
15622: >0x2a leshort x \b, %d chunks
15623: >>0x10 lelong x \b (no. %d in use)
15624: >0x18 lelong >1 \b, next record no. %d
15625: >0x18 lelong =1 \b, empty
15626: >0x78 lelong &1 \b, DIRTY
15627: >0x78 lelong &2 \b, FULL
15628:
15629:
15630: # Summary: Windows 3.1 group files
15631: # Extension: .grp
15632: # Created by: unknown
15633: 0 string \120\115\103\103 MS Windows 3.1 group files
15634:
15635:
15636: # Summary: Old format help files
15637: # Extension: .hlp
15638: # Created by: Dirk Jagdmann <doj@cubic.org>
15639: 0 lelong 0x00035f3f MS Windows 3.x help file
15640:
15641:
15642: # Summary: Hyper terminal
15643: # Extension: .ht
15644: # Created by: unknown
15645: 0 string HyperTerminal\
15646: >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
15647:
15648:
15649: # Summary: Windows shortcut
15650: # Extension: .lnk
15651: # Created by: unknown
15652: 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
15653:
15654:
15655: # Summary: Outlook Personal Folders
15656: # Created by: unknown
15657: 0 lelong 0x4E444221 Microsoft Outlook email folder
15658: >10 leshort 0x0e (<=2002)
15659: >10 leshort 0x17 (>=2003)
15660:
15661:
15662: # Summary: Windows help cache
15663: # Created by: unknown
15664: 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
15665:
15666:
15667: # Summary: IE cache file
15668: # Created by: Christophe Monniez
15669: 0 string Client\ UrlCache\ MMF Internet Explorer cache file
15670: >20 string >\0 version %s
15671:
15672:
15673: # Summary: Registry files
15674: # Created by: unknown
15675: # Modified by (1): Joerg Jenderek
15676: 0 string regf MS Windows registry file, NT/2000 or above
15677: 0 string CREG MS Windows 95/98/ME registry file
15678: 0 string SHCC3 MS Windows 3.1 registry file
15679:
15680:
15681: # Summary: Windows Registry text
15682: # Extension: .reg
15683: # Submitted by: Abel Cheung <abelcheung@gmail.com>
15684: 0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
15685: 0 string Windows\ Registry\ Editor\
15686: >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
1.1.1.2 ! misho 15687:
! 15688:
! 15689: # From: Pal Tamas <folti@balabit.hu>
! 15690: # Autorun File
! 15691: 0 string/c [autorun]\r\n Microsoft Windows Autorun file.
! 15692: !:mime application/x-setupscript.
! 15693:
1.1 misho 15694: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15695: # $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
! 15696: # wireless-regdb: file(1) magic for CRDA wireless-regdb file format
! 15697: #
! 15698: 0 string RGDB CRDA wireless regulatory database file
! 15699: >4 belong 19 (Version 1)
! 15700:
! 15701: #------------------------------------------------------------------------------
! 15702: # $File: wordprocessors,v 1.14 2009/09/19 16:28:13 christos Exp $
1.1 misho 15703: # wordprocessors: file(1) magic fo word processors.
15704: #
15705: ####### PWP file format used on Smith Corona Personal Word Processors:
15706: 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
15707: >24 byte 2 \b, single spaced
15708: >24 byte 3 \b, 1.5 spaced
15709: >24 byte 4 \b, double spaced
15710: >25 byte 0x42 \b, letter
15711: >25 byte 0x54 \b, legal
15712: >26 byte 0x46 \b, A4
15713:
15714: #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
15715: 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
15716: >15 byte 0 Optimized for Intel
15717: >15 byte 1 Optimized for Non-Intel
15718: 1 string WPC (Corel/WP)
15719: >8 short 257 WordPerfect macro
15720: >8 short 258 WordPerfect help file
15721: >8 short 259 WordPerfect keyboard file
15722: >8 short 266 WordPerfect document
15723: >8 short 267 WordPerfect dictionary
15724: >8 short 268 WordPerfect thesaurus
15725: >8 short 269 WordPerfect block
15726: >8 short 270 WordPerfect rectangular block
15727: >8 short 271 WordPerfect column block
15728: >8 short 272 WordPerfect printer data
15729: >8 short 275 WordPerfect printer data
15730: >8 short 276 WordPerfect driver resource data
15731: >8 short 279 WordPerfect hyphenation code
15732: >8 short 280 WordPerfect hyphenation data
15733: >8 short 281 WordPerfect macro resource data
15734: >8 short 283 WordPerfect hyphenation lex
15735: >8 short 285 WordPerfect wordlist
15736: >8 short 286 WordPerfect equation resource data
15737: >8 short 289 WordPerfect spell rules
15738: >8 short 290 WordPerfect dictionary rules
15739: >8 short 295 WordPerfect spell rules (Microlytics)
15740: >8 short 299 WordPerfect settings file
15741: >8 short 301 WordPerfect 4.2 document
15742: >8 short 325 WordPerfect dialog file
15743: >8 short 332 WordPerfect button bar
15744: >8 short 513 Shell macro
15745: >8 short 522 Shell definition
15746: >8 short 769 Notebook macro
15747: >8 short 770 Notebook help file
15748: >8 short 771 Notebook keyboard file
15749: >8 short 778 Notebook definition
15750: >8 short 1026 Calculator help file
15751: >8 short 1538 Calendar help file
15752: >8 short 1546 Calendar data file
15753: >8 short 1793 Editor macro
15754: >8 short 1794 Editor help file
15755: >8 short 1795 Editor keyboard file
15756: >8 short 1817 Editor macro resource file
15757: >8 short 2049 Macro editor macro
15758: >8 short 2050 Macro editor help file
15759: >8 short 2051 Macro editor keyboard file
15760: >8 short 2305 PlanPerfect macro
15761: >8 short 2306 PlanPerfect help file
15762: >8 short 2307 PlanPerfect keyboard file
15763: >8 short 2314 PlanPerfect worksheet
15764: >8 short 2319 PlanPerfect printer definition
15765: >8 short 2322 PlanPerfect graphic definition
15766: >8 short 2323 PlanPerfect data
15767: >8 short 2324 PlanPerfect temporary printer
15768: >8 short 2329 PlanPerfect macro resource data
15769: >8 byte 11 Mail
15770: >8 short 2818 help file
15771: >8 short 2821 distribution list
15772: >8 short 2826 out box
15773: >8 short 2827 in box
15774: >8 short 2836 users archived mailbox
15775: >8 short 2837 archived message database
15776: >8 short 2838 archived attachments
15777: >8 short 3083 Printer temporary file
15778: >8 short 3330 Scheduler help file
15779: >8 short 3338 Scheduler in file
15780: >8 short 3339 Scheduler out file
15781: >8 short 3594 GroupWise settings file
15782: >8 short 3601 GroupWise directory services
15783: >8 short 3627 GroupWise settings file
15784: >8 short 4362 Terminal resource data
15785: >8 short 4363 Terminal resource data
15786: >8 short 4395 Terminal resource data
15787: >8 short 4619 GUI loadable text
15788: >8 short 4620 graphics resource data
15789: >8 short 4621 printer settings file
15790: >8 short 4622 port definition file
15791: >8 short 4623 print queue parameters
15792: >8 short 4624 compressed file
15793: >8 short 5130 Network service msg file
15794: >8 short 5131 Network service msg file
15795: >8 short 5132 Async gateway login msg
15796: >8 short 5134 GroupWise message file
15797: >8 short 7956 GroupWise admin domain database
15798: >8 short 7957 GroupWise admin host database
15799: >8 short 7959 GroupWise admin remote host database
15800: >8 short 7960 GroupWise admin ADS deferment data file
15801: >8 short 8458 IntelliTAG (SGML) compiled DTD
15802: >8 long 18219264 WordPerfect graphic image (1.0)
15803: >8 long 18219520 WordPerfect graphic image (2.0)
15804: #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
15805:
15806: # Hangul (Korean) Word Processor File
15807: 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
15808: # From: Won-Kyu Park <wkpark@kldp.org>
15809: 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
15810: !:mime application/x-hwp
15811:
15812: # CosmicBook, from Benoît Rouits
15813: 0 string CSBK Ted Neslson's CosmicBook hypertext file
15814:
15815: 2 string EYWR AmigaWriter file
15816:
15817: # chi: file(1) magic for ChiWriter files
15818: 0 string \\1cw\ ChiWriter file
15819: >5 string >\0 version %s
15820: 0 string \\1cw ChiWriter file
15821:
15822: # Quark Express from http://www.garykessler.net/library/file_sigs.html
15823: 2 string IIXPR3 Intel Quark Express Document (English)
15824: 2 string IIXPRa Intel Quark Express Document (Korean)
15825: 2 string MMXPR3 Motorola Quark Express Document (English)
15826: !:mime application/x-quark-xpress-3
15827: 2 string MMXPRa Motorola Quark Express Document (Korean)
15828:
15829: # adobe indesign (document, whatever...) from querkan
15830: 0 belong 0x0606edf5 Adobe InDesign
15831: >16 string DOCUMENT Document
15832:
15833: #------------------------------------------------------------------------------
15834: # ichitaro456: file(1) magic for Just System Word Processor Ichitaro
15835: #
15836: # Contributor kenzo-:
15837: # Reversed-engineered JS Ichitaro magic numbers
15838: #
15839:
15840: 0 string DOC
15841: >43 byte 0x14 Just System Word Processor Ichitaro v4
15842: !:mime application/x-ichitaro4
15843: >144 string JDASH application/x-ichitaro4
15844:
15845: 0 string DOC
15846: >43 byte 0x15 Just System Word Processor Ichitaro v5
15847: !:mime application/x-ichitaro5
15848:
15849: 0 string DOC
15850: >43 byte 0x16 Just System Word Processor Ichitaro v6
15851: !:mime application/x-ichitaro6
15852:
15853: # Type: Freemind mindmap documents
15854: # From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
1.1.1.2 ! misho 15855: 0 string/w \<map\ version Freemind document
1.1 misho 15856: !:mime application/x-freemind
15857:
15858: # Type: Scribus
15859: # From: Werner Fink <werner@suse.de>
15860: 0 string \<SCRIBUSUTF8\ Version Scribus Document
15861: 0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
15862: !:mime application/x-scribus
15863:
15864: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15865: # $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15866: # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
15867: #
15868: 0 string %XDELTA% XDelta binary patch file 0.14
15869: 0 string %XDZ000% XDelta binary patch file 0.18
15870: 0 string %XDZ001% XDelta binary patch file 0.20
15871: 0 string %XDZ002% XDelta binary patch file 1.0
15872: 0 string %XDZ003% XDelta binary patch file 1.0.4
15873: 0 string %XDZ004% XDelta binary patch file 1.1
15874:
15875: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15876: # $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
1.1 misho 15877: # xenix: file(1) magic for Microsoft Xenix
15878: #
15879: # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
15880: # model" lifted from "magic.xenix", with comment "derived empirically;
15881: # treat as folklore until proven"
15882: #
15883: # "small model", "large model", "huge model" stuff lifted from XXX
15884: #
15885: # XXX - "x.out" collides with PDP-11 archives
15886: #
15887: 0 string core core file (Xenix)
15888: 0 byte 0x80 8086 relocatable (Microsoft)
15889: 0 leshort 0xff65 x.out
15890: >2 string __.SYMDEF randomized
15891: >0 byte x archive
15892: 0 leshort 0x206 Microsoft a.out
15893: >8 leshort 1 Middle model
15894: >0x1e leshort &0x10 overlay
15895: >0x1e leshort &0x2 separate
15896: >0x1e leshort &0x4 pure
15897: >0x1e leshort &0x800 segmented
15898: >0x1e leshort &0x400 standalone
15899: >0x1e leshort &0x8 fixed-stack
15900: >0x1c byte &0x80 byte-swapped
15901: >0x1c byte &0x40 word-swapped
15902: >0x10 lelong >0 not-stripped
15903: >0x1e leshort ^0xc000 pre-SysV
15904: >0x1e leshort &0x4000 V2.3
15905: >0x1e leshort &0x8000 V3.0
15906: >0x1c byte &0x4 86
15907: >0x1c byte &0xb 186
15908: >0x1c byte &0x9 286
15909: >0x1c byte &0xa 386
15910: >0x1f byte <0x040 small model
15911: >0x1f byte =0x048 large model
15912: >0x1f byte =0x049 huge model
15913: >0x1e leshort &0x1 executable
15914: >0x1e leshort ^0x1 object file
15915: >0x1e leshort &0x40 Large Text
15916: >0x1e leshort &0x20 Large Data
15917: >0x1e leshort &0x120 Huge Objects Enabled
15918: >0x10 lelong >0 not stripped
15919:
15920: 0 leshort 0x140 old Microsoft 8086 x.out
15921: >0x3 byte &0x4 separate
15922: >0x3 byte &0x2 pure
15923: >0 byte &0x1 executable
15924: >0 byte ^0x1 relocatable
15925: >0x14 lelong >0 not stripped
15926:
15927: 0 lelong 0x206 b.out
15928: >0x1e leshort &0x10 overlay
15929: >0x1e leshort &0x2 separate
15930: >0x1e leshort &0x4 pure
15931: >0x1e leshort &0x800 segmented
15932: >0x1e leshort &0x400 standalone
15933: >0x1e leshort &0x1 executable
15934: >0x1e leshort ^0x1 object file
15935: >0x1e leshort &0x4000 V2.3
15936: >0x1e leshort &0x8000 V3.0
15937: >0x1c byte &0x4 86
15938: >0x1c byte &0xb 186
15939: >0x1c byte &0x9 286
15940: >0x1c byte &0x29 286
15941: >0x1c byte &0xa 386
15942: >0x1e leshort &0x4 Large Text
15943: >0x1e leshort &0x2 Large Data
15944: >0x1e leshort &0x102 Huge Objects Enabled
15945:
15946: 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
15947:
15948: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15949: # $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15950: # This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
15951: # Xilinx-Magic@RevRagnarok.com
15952: # Got the info from FPGA-FAQ 0026
15953: #
15954: # First there is the sync header and its length
15955: 0 beshort 0x0009
15956: >2 belong =0x0ff00ff0
15957: >>&0 belong =0x0ff00ff0
15958: >>>&0 beshort =0x0000
15959: >>>>&0 pstring a Xilinx BIT data
15960: # Next is a Pascal-style string with the NCD name. We want to capture that.
15961: >>>>0x0F pstring x - from %s
15962: # It is followed by a NUL
15963: >>>>>&1 byte 0x00
15964: # And then 'b'
15965: >>>>>&2 string b
15966: # With the part number:
15967: #>>>>>&5 string 4v (Virtex4)
15968: #>>>>>&5 string 2v (Virtex II
15969: #>>>>>>&0 string !p \b)
15970: #>>>>>>&0 string p Pro)
15971: >>>>>&4 pstring x - for %s
15972: # And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
15973: >>>>>>&1 byte 0x00
15974: >>>>>>&2 string c
15975: >>>>>>&4 pstring x - built %s
15976: >>>>>>>&1 byte 0x00
15977: >>>>>>>&2 string d
15978: >>>>>>>&4 pstring x \b(%s)
15979: >>>>>>>>&1 byte 0x00
15980: >>>>>>>>&2 string e
15981: >>>>>>>>&4 belong x - data length 0x%lx
15982:
15983: #------------------------------------------------------------------------------
1.1.1.2 ! misho 15984: # $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 15985: # xo65 object files
15986: # From: "Ullrich von Bassewitz" <uz@cc65.org>
15987: #
15988: 0 string \x55\x7A\x6E\x61 xo65 object,
15989: >4 leshort x version %d,
15990: >6 leshort&0x0001 =0x0001 with debug info
15991: >6 leshort&0x0001 =0x0000 no debug info
15992:
15993: # xo65 library files
15994: 0 string \x6E\x61\x55\x7A xo65 library,
15995: >4 leshort x version %d
15996:
15997: # o65 object files
15998: 0 string \x01\x00\x6F\x36\x35 o65
15999: >6 leshort&0x1000 =0x0000 executable,
16000: >6 leshort&0x1000 =0x1000 object,
16001: >5 byte x version %d,
16002: >6 leshort&0x8000 =0x8000 65816,
16003: >6 leshort&0x8000 =0x0000 6502,
16004: >6 leshort&0x2000 =0x2000 32 bit,
16005: >6 leshort&0x2000 =0x0000 16 bit,
16006: >6 leshort&0x4000 =0x4000 page reloc,
16007: >6 leshort&0x4000 =0x0000 byte reloc,
16008: >6 leshort&0x0003 =0x0000 alignment 1
16009: >6 leshort&0x0003 =0x0001 alignment 2
16010: >6 leshort&0x0003 =0x0002 alignment 4
16011: >6 leshort&0x0003 =0x0003 alignment 256
16012:
16013: #------------------------------------------------------------------------------
1.1.1.2 ! misho 16014: # $File: xwindows,v 1.6 2009/09/19 16:28:13 christos Exp $
1.1 misho 16015: # xwindows: file(1) magic for various X/Window system file formats.
16016:
16017: # Compiled X Keymap
16018: # XKM (compiled X keymap) files (including version and byte ordering)
16019: 1 string mkx Compiled XKB Keymap: lsb,
16020: >0 byte >0 version %d
16021: >0 byte =0 obsolete
16022: 0 string xkm Compiled XKB Keymap: msb,
16023: >3 byte >0 version %d
16024: >0 byte =0 obsolete
16025:
16026: # xfsdump archive
16027: 0 string xFSdump0 xfsdump archive
16028: >8 belong x (version %d)
16029:
16030: # Jaleo XFS files
16031: 0 long 395726 Jaleo XFS file
16032: >4 long x - version %ld
16033: >8 long x - [%ld -
16034: >20 long x %ldx
16035: >24 long x %ldx
16036: >28 long 1008 YUV422]
16037: >28 long 1000 RGB24]
16038:
1.1.1.2 ! misho 16039: # Xcursor data
! 16040: # X11 mouse cursor format defined in libXcursor, see
! 16041: # http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
! 16042: # http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
! 16043: 0 string Xcur Xcursor data
! 16044: !:mime image/x-xcursor
! 16045: >10 leshort x version %hd
! 16046: >>8 leshort x \b.%hd
! 16047:
1.1 misho 16048: #------------------------------------------------------------------------------
1.1.1.2 ! misho 16049: # $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 16050: # zilog: file(1) magic for Zilog Z8000.
16051: #
16052: # Was it big-endian or little-endian? My Product Specification doesn't
16053: # say.
16054: #
16055: 0 long 0xe807 object file (z8000 a.out)
16056: 0 long 0xe808 pure object file (z8000 a.out)
16057: 0 long 0xe809 separate object file (z8000 a.out)
16058: 0 long 0xe805 overlay object file (z8000 a.out)
16059:
16060: #------------------------------------------------------------------------------
1.1.1.2 ! misho 16061: # $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
1.1 misho 16062: # zyxel: file(1) magic for ZyXEL modems
16063: #
16064: # From <rob@pe1chl.ampr.org>
16065: # These are the /etc/magic entries to decode datafiles as used for the
16066: # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
16067: # ZyXEL-defined standard)
16068:
16069: 0 string ZyXEL\002 ZyXEL voice data
16070: >10 byte 0 - CELP encoding
16071: >10 byte&0x0B 1 - ADPCM2 encoding
16072: >10 byte&0x0B 2 - ADPCM3 encoding
16073: >10 byte&0x0B 3 - ADPCM4 encoding
16074: >10 byte&0x0B 8 - New ADPCM3 encoding
16075: >10 byte&0x04 4 with resync
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to magic CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / ext / fileinfo / tests