Annotation of embedaddon/php/ext/fileinfo/tests/magic, revision 1.1.1.5
1.1.1.3 misho 1: # Magic data for file(1) command.
2: # Format is described in magic(files), where:
3: # files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4: # Don't edit this file, edit /etc/magic or send your magic improvements
5: # to the maintainers, at file@mx.gw.com
6:
7: #------------------------------------------------------------------------------
8: # Localstuff: file(1) magic for locally observed files
9: #
10: # $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11: # Add any locally observed files here. Remember:
12: # text if readable, executable if runnable binary, data if unreadable.
1.1 misho 13:
14: #------------------------------------------------------------------------------
1.1.1.2 misho 15: # $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $
1.1 misho 16: # acorn: file(1) magic for files found on Acorn systems
17: #
18:
19: # RISC OS Chunk File Format
20: # From RISC OS Programmer's Reference Manual, Appendix D
21: # We guess the file type from the type of the first chunk.
22: 0 lelong 0xc3cbc6c5 RISC OS Chunk data
23: >12 string OBJ_ \b, AOF object
24: >12 string LIB_ \b, ALF library
25:
26: # RISC OS AIF, contains "SWI OS_Exit" at offset 16.
27: 16 lelong 0xef000011 RISC OS AIF executable
28:
29: # RISC OS Draw files
30: # From RISC OS Programmer's Reference Manual, Appendix E
31: 0 string Draw RISC OS Draw file data
32:
33: # RISC OS new format font files
34: # From RISC OS Programmer's Reference Manual, Appendix E
35: 0 string FONT\0 RISC OS outline font data,
36: >5 byte x version %d
37: 0 string FONT\1 RISC OS 1bpp font data,
38: >5 byte x version %d
39: 0 string FONT\4 RISC OS 4bpp font data
40: >5 byte x version %d
41:
42: # RISC OS Music files
43: # From RISC OS Programmer's Reference Manual, Appendix E
44: 0 string Maestro\r RISC OS music file
45: >8 byte x version %d
46:
47: >8 byte x type %d
48:
49: # Digital Symphony data files
50: # From: Bernard Jungen (bern8817@euphonynet.be)
51: 0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
52: >8 byte x version %d,
53: >9 pstring x named "%s",
54: >(9.b+19) byte =0 8-bit logarithmic
55: >(9.b+19) byte =1 LZW-compressed linear
56: >(9.b+19) byte =2 8-bit linear signed
57: >(9.b+19) byte =3 16-bit linear signed
58: >(9.b+19) byte =4 SigmaDelta-compressed linear
59: >(9.b+19) byte =5 SigmaDelta-compressed logarithmic
60: >(9.b+19) byte >5 unknown format
61:
62: 0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
63: >8 byte x version %d,
64: >9 byte =1 1 voice,
65: >9 byte !1 %d voices,
66: >10 leshort =1 1 track,
67: >10 leshort !1 %d tracks,
68: >12 leshort =1 1 pattern
69: >12 leshort !1 %d patterns
70:
71: 0 string \x02\x01\x13\x13\x10\x14\x12\x0e
72: >9 byte =0 Digital Symphony sequence (RISC OS),
73: >>8 byte x version %d,
74: >>10 byte =1 1 line,
75: >>10 byte !1 %d lines,
76: >>11 leshort =1 1 position
77: >>11 leshort !1 %d positions
78: >9 byte =1 Digital Symphony pattern data (RISC OS),
79: >>8 byte x version %d,
80: >>10 leshort =1 1 pattern
81: >>10 leshort !1 %d patterns
82:
83: #------------------------------------------------------------------------------
1.1.1.2 misho 84: # $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
1.1 misho 85: # adi: file(1) magic for ADi's objects
86: # From Gregory McGarry <g.mcgarry@ieee.org>
87: #
88: 0 leshort 0x521c COFF DSP21k
89: >18 lelong &02 executable,
90: >18 lelong ^02
91: >>18 lelong &01 static object,
92: >>18 lelong ^01 relocatable object,
93: >18 lelong &010 stripped
94: >18 lelong ^010 not stripped
95:
96: #------------------------------------------------------------------------------
1.1.1.3 misho 97: # $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
1.1 misho 98: # adventure: file(1) magic for Adventure game files
99: #
100: # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
101: # Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
102: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
103: #
104: # ALAN
105: # I assume there are other, lower versions, but these are the only ones I
106: # saw in the archive.
107: 0 beshort 0x0206 ALAN game data
108: >2 byte <10 version 2.6%d
109:
110:
111: # Infocom (see z-machine)
112: #------------------------------------------------------------------------------
113: # Z-machine: file(1) magic for Z-machine binaries.
1.1.1.2 misho 114: # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
1.1 misho 115: #
1.1.1.3 misho 116: #http://www.gnelson.demon.co.uk/zspec/sect11.html
117: #http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
118: #http://en.wikipedia.org/wiki/Z-machine
1.1.1.2 misho 119: # The first byte is the Z-machine revision; it is always between 1 and 8. We
120: # had false matches (for instance, inbig5.ocp from the Omega TeX extension as
121: # well as an occasional MP3 file), so we sanity-check the version number.
122: #
123: # It might be possible to sanity-check the release number as well, as it seems
124: # (at least in classic Infocom games) to always be a relatively small number,
125: # always under 150 or so, but as this isn't rigorous, we'll wait on that until
126: # it becomes clear that it's needed.
127: #
128: 0 ubyte >0
129: >0 ubyte <9
1.1.1.3 misho 130: >>16 belong&0xfe00f0f0 0x3030
131: >>>0 ubyte < 10
132: >>>>2 ubeshort < 10
133: >>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
134: >>>>>>0 ubyte < 10 Infocom (Z-machine %d,
135: >>>>>>>2 ubeshort < 10 Release %d /
136: >>>>>>>>18 string >\0 Serial %.6s)
137: !:strength + 40
1.1 misho 138:
139: #------------------------------------------------------------------------------
140: # Glulx: file(1) magic for Glulx binaries.
141: #
142: # I haven't checked for false matches yet.
143: #
144: 0 string Glul Glulx game data
145: >4 beshort x (Version %d
146: >>6 byte x \b.%d
147: >>8 byte x \b.%d)
148: >36 string Info Compiled by Inform
149:
150:
151:
152: # For Quetzal and blorb magic see iff
153:
154:
1.1.1.3 misho 155: # TADS (Text Adventure Development System) version 2
1.1 misho 156: # All files are machine-independent (games compile to byte-code) and are tagged
1.1.1.3 misho 157: # with a version string of the form "V2.<digit>.<digit>\0".
1.1 misho 158: # Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
159: 0 string TADS2\ bin TADS
160: >9 belong !0x0A0D1A00 game data, CORRUPTED
161: >9 belong 0x0A0D1A00
162: >>13 string >\0 %s game data
163: # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
164: 0 string TADS2\ rsc TADS
165: >9 belong !0x0A0D1A00 resource data, CORRUPTED
166: >9 belong 0x0A0D1A00
167: >>13 string >\0 %s resource data
168: # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
169: # 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
170: # "TADS2 save\n\r\032\0" and the interpreter version.
171: 0 string TADS2\ save/g TADS
172: >12 belong !0x0A0D1A00 saved game data, CORRUPTED
173: >12 belong 0x0A0D1A00
174: >>(16.s+32) string >\0 %s saved game data
175: # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
176: # version.
177: 0 string TADS2\ save TADS
178: >10 belong !0x0A0D1A00 saved game data, CORRUPTED
179: >10 belong 0x0A0D1A00
180: >>14 string >\0 %s saved game data
181:
1.1.1.3 misho 182: # TADS (Text Adventure Development System) version 3
183: # Game files start with "T3-image\015\012\032"
184: 0 string T3-image\015\012\032
185: >11 leshort x TADS 3 game data (format version %d)
186: # Saved game files start with "T3-state-v####\015\012\032"
187: # where #### is a format version number
188: 0 string T3-state-v
189: >14 string \015\012\032 TADS 3 saved game data (format version
190: >>10 byte x %c
191: >>11 byte x \b%c
192: >>12 byte x \b%c
193: >>13 byte x \b%c)
194:
1.1 misho 195: # Danny Milosavljevic <danny.milo@gmx.net>
196: # this are adrift (adventure game standard) game files, extension .taf
197: # depending on version magic continues with 0x93453E6139FA (V 4.0)
198: # 0x9445376139FA (V 3.90)
199: # 0x9445366139FA (V 3.80)
200: # this is from source (http://www.adrift.org.uk/) and I have some taf
201: # files, and checked them.
202: #0 belong 0x3C423FC9
203: #>4 belong 0x6A87C2CF Adrift game file
204: #!:mime application/x-adrift
1.1.1.2 misho 205:
1.1 misho 206: #------------------------------------------------------------------------------
1.1.1.2 misho 207: # $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
1.1 misho 208: # allegro: file(1) magic for Allegro datafiles
209: # Toby Deshane <hac@shoelace.digivill.net>
210: #
211: 0 belong 0x736C6821 Allegro datafile (packed)
212: 0 belong 0x736C682E Allegro datafile (not packed/autodetect)
213: 0 belong 0x736C682B Allegro datafile (appended exe data)
214:
215: #------------------------------------------------------------------------------
1.1.1.2 misho 216: # $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
1.1 misho 217: # alliant: file(1) magic for Alliant FX series a.out files
218: #
219: # If the FX series is the one that had a processor with a 68K-derived
220: # instruction set, the "short" should probably become "beshort" and the
221: # "long" should probably become "belong".
222: # If it's the i860-based one, they should probably become either the
223: # big-endian or little-endian versions, depending on the mode they ran
224: # the 860 in....
225: #
226: 0 short 0420 0420 Alliant virtual executable
227: >2 short &0x0020 common library
228: >16 long >0 not stripped
229: 0 short 0421 0421 Alliant compact executable
230: >2 short &0x0020 common library
231: >16 long >0 not stripped
1.1.1.2 misho 232:
1.1 misho 233: #------------------------------------------------------------------------------
1.1.1.2 misho 234: # $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
1.1 misho 235: # amanda: file(1) magic for amanda file format
236: #
237: 0 string AMANDA:\ AMANDA
238: >8 string TAPESTART\ DATE tape header file,
239: >>23 string X
240: >>>25 string >\ Unused %s
241: >>23 string >\ DATE %s
242: >8 string FILE\ dump file,
243: >>13 string >\ DATE %s
1.1.1.2 misho 244:
1.1 misho 245: #------------------------------------------------------------------------------
1.1.1.3 misho 246: # $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
1.1 misho 247: # amigaos: file(1) magic for AmigaOS binary formats:
248:
249: #
250: # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
251: #
252: 0 belong 0x000003fa AmigaOS shared library
253: 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
254: 0 belong 0x000003e7 AmigaOS object/library data
255: #
256: 0 beshort 0xe310 Amiga Workbench
257: >2 beshort 1
258: >>48 byte 1 disk icon
259: >>48 byte 2 drawer icon
260: >>48 byte 3 tool icon
261: >>48 byte 4 project icon
262: >>48 byte 5 garbage icon
263: >>48 byte 6 device icon
264: >>48 byte 7 kickstart icon
265: >>48 byte 8 workbench application icon
266: >2 beshort >1 icon, vers. %d
267: #
268: # various sound formats from the Amiga
269: # G=F6tz Waschk <waschk@informatik.uni-rostock.de>
270: #
271: 0 string FC14 Future Composer 1.4 Module sound file
272: 0 string SMOD Future Composer 1.3 Module sound file
273: 0 string AON4artofnoise Art Of Noise Module sound file
274: 1 string MUGICIAN/SOFTEYES Mugician Module sound file
275: 58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
276: 0 string Synth4.0 Synthesis Module sound file
277: 0 string ARP. The Holy Noise Module sound file
278: 0 string BeEp\0 JamCracker Module sound file
279: 0 string COSO\0 Hippel-COSO Module sound file
280: # Too simple (short, pure ASCII, deep), MPi
281: #26 string V.3 Brian Postma's Soundmon Module sound file v3
282: #26 string BPSM Brian Postma's Soundmon Module sound file v3
283: #26 string V.2 Brian Postma's Soundmon Module sound file v2
284:
285: # The following are from: "Stefan A. Haubenthal" <polluks@web.de>
286: 0 beshort 0x0f00 AmigaOS bitmap font
287: 0 beshort 0x0f03 AmigaOS outline font
288: 0 belong 0x80001001 AmigaOS outline tag
289: 0 string ##\ version catalog translation
290: 0 string EMOD\0 Amiga E module
291: 8 string ECXM\0 ECX module
292: 0 string/c @database AmigaGuide file
293:
294: # Amiga disk types
295: #
296: 0 string RDSK Rigid Disk Block
297: >160 string x on %.24s
298: 0 string DOS\0 Amiga DOS disk
299: 0 string DOS\1 Amiga FFS disk
300: 0 string DOS\2 Amiga Inter DOS disk
301: 0 string DOS\3 Amiga Inter FFS disk
302: 0 string DOS\4 Amiga Fastdir DOS disk
303: 0 string DOS\5 Amiga Fastdir FFS disk
304: 0 string KICK Kickstart disk
305:
306: # From: Alex Beregszaszi <alex@fsn.hu>
307: 0 string LZX LZX compressed archive (Amiga)
308:
1.1.1.3 misho 309: # From: Przemek Kramarczyk <pkramarczyk@gmail.com>
310: 0 string .KEY AmigaDOS script
311: 0 string .key AmigaDOS script
1.1 misho 312:
313: #------------------------------------------------------------------------------
1.1.1.3 misho 314: # $File: animation,v 1.48 2013/03/09 22:36:00 christos Exp $
1.1 misho 315: # animation: file(1) magic for animation/movie formats
316: #
317: # animation formats
318: # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
319: # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
320:
321: # SGI and Apple formats
322: 0 string MOVI Silicon Graphics movie file
323: !:mime video/x-sgi-movie
324: 4 string moov Apple QuickTime
325: !:mime video/quicktime
326: >12 string mvhd \b movie (fast start)
327: >12 string mdra \b URL
328: >12 string cmov \b movie (fast start, compressed header)
329: >12 string rmra \b multiple URLs
330: 4 string mdat Apple QuickTime movie (unoptimized)
331: !:mime video/quicktime
332: #4 string wide Apple QuickTime movie (unoptimized)
333: #!:mime video/quicktime
334: #4 string skip Apple QuickTime movie (modified)
335: #!:mime video/quicktime
336: #4 string free Apple QuickTime movie (modified)
337: #!:mime video/quicktime
338: 4 string idsc Apple QuickTime image (fast start)
339: !:mime image/x-quicktime
340: #4 string idat Apple QuickTime image (unoptimized)
341: #!:mime image/x-quicktime
342: 4 string pckg Apple QuickTime compressed archive
343: !:mime application/x-quicktime-player
1.1.1.2 misho 344: 4 string/W jP JPEG 2000 image
1.1 misho 345: !:mime image/jp2
346: 4 string ftyp ISO Media
347: >8 string isom \b, MPEG v4 system, version 1
348: !:mime video/mp4
349: >8 string iso2 \b, MPEG v4 system, part 12 revision
350: >8 string mp41 \b, MPEG v4 system, version 1
351: !:mime video/mp4
352: >8 string mp42 \b, MPEG v4 system, version 2
353: !:mime video/mp4
354: >8 string mp7t \b, MPEG v4 system, MPEG v7 XML
355: >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
1.1.1.2 misho 356: >8 string/W jp2 \b, JPEG 2000
1.1 misho 357: !:mime image/jp2
1.1.1.3 misho 358: >8 string 3ge \b, MPEG v4 system, 3GPP
359: !:mime video/3gpp
360: >8 string 3gg \b, MPEG v4 system, 3GPP
361: !:mime video/3gpp
1.1 misho 362: >8 string 3gp \b, MPEG v4 system, 3GPP
363: !:mime video/3gpp
1.1.1.3 misho 364: >8 string 3gs \b, MPEG v4 system, 3GPP
365: !:mime video/3gpp
366: >8 string 3g2 \b, MPEG v4 system, 3GPP2
367: !:mime video/3gpp2
1.1 misho 368: >>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
369: >>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
370: >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
371: >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
372: !:mime video/mp4
373: >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
374: !:mime video/3gpp
1.1.1.2 misho 375: >8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC
1.1 misho 376: !:mime audio/mp4
1.1.1.2 misho 377: >8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC
1.1 misho 378: !:mime video/mp4
1.1.1.2 misho 379: >8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted
380: >8 string/W M4B \b, MPEG v4 system, iTunes bookmarked
381: >8 string/W qt \b, Apple QuickTime movie
1.1 misho 382: !:mime video/quicktime
383:
384: # MPEG sequences
385: # Scans for all common MPEG header start codes
386: 0 belong 0x00000001
387: >4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
388: >>5 byte 66 \b, baseline
389: >>5 byte 77 \b, main
390: >>5 byte 88 \b, extended
391: >>7 byte x \b @ L %u
392: 0 belong&0xFFFFFF00 0x00000100
393: >3 byte 0xBA MPEG sequence
1.1.1.2 misho 394: !:mime video/mpeg
1.1 misho 395: >>4 byte &0x40 \b, v2, program multiplex
396: >>4 byte ^0x40 \b, v1, system multiplex
397: >3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
398: >3 byte&0x1F 0x07 MPEG sequence, H.264 video
399: >>4 byte 66 \b, baseline
400: >>4 byte 77 \b, main
401: >>4 byte 88 \b, extended
402: >>6 byte x \b @ L %u
1.1.1.3 misho 403: # GRR too general as it catches also FoxPro Memo example NG.FPT
1.1 misho 404: >3 byte 0xB0 MPEG sequence, v4
1.1.1.3 misho 405: # TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
406: #>>4 byte !0 MPEG sequence, v4
1.1.1.2 misho 407: !:mime video/mpeg4-generic
1.1 misho 408: >>5 belong 0x000001B5
409: >>>9 byte &0x80
410: >>>>10 byte&0xF0 16 \b, video
411: >>>>10 byte&0xF0 32 \b, still texture
412: >>>>10 byte&0xF0 48 \b, mesh
413: >>>>10 byte&0xF0 64 \b, face
414: >>>9 byte&0xF8 8 \b, video
415: >>>9 byte&0xF8 16 \b, still texture
416: >>>9 byte&0xF8 24 \b, mesh
417: >>>9 byte&0xF8 32 \b, face
418: >>4 byte 1 \b, simple @ L1
419: >>4 byte 2 \b, simple @ L2
420: >>4 byte 3 \b, simple @ L3
421: >>4 byte 4 \b, simple @ L0
422: >>4 byte 17 \b, simple scalable @ L1
423: >>4 byte 18 \b, simple scalable @ L2
424: >>4 byte 33 \b, core @ L1
425: >>4 byte 34 \b, core @ L2
426: >>4 byte 50 \b, main @ L2
427: >>4 byte 51 \b, main @ L3
428: >>4 byte 53 \b, main @ L4
429: >>4 byte 66 \b, n-bit @ L2
430: >>4 byte 81 \b, scalable texture @ L1
431: >>4 byte 97 \b, simple face animation @ L1
432: >>4 byte 98 \b, simple face animation @ L2
433: >>4 byte 99 \b, simple face basic animation @ L1
434: >>4 byte 100 \b, simple face basic animation @ L2
435: >>4 byte 113 \b, basic animation text @ L1
436: >>4 byte 114 \b, basic animation text @ L2
437: >>4 byte 129 \b, hybrid @ L1
438: >>4 byte 130 \b, hybrid @ L2
439: >>4 byte 145 \b, advanced RT simple @ L!
440: >>4 byte 146 \b, advanced RT simple @ L2
441: >>4 byte 147 \b, advanced RT simple @ L3
442: >>4 byte 148 \b, advanced RT simple @ L4
443: >>4 byte 161 \b, core scalable @ L1
444: >>4 byte 162 \b, core scalable @ L2
445: >>4 byte 163 \b, core scalable @ L3
446: >>4 byte 177 \b, advanced coding efficiency @ L1
447: >>4 byte 178 \b, advanced coding efficiency @ L2
448: >>4 byte 179 \b, advanced coding efficiency @ L3
449: >>4 byte 180 \b, advanced coding efficiency @ L4
450: >>4 byte 193 \b, advanced core @ L1
451: >>4 byte 194 \b, advanced core @ L2
452: >>4 byte 209 \b, advanced scalable texture @ L1
453: >>4 byte 210 \b, advanced scalable texture @ L2
454: >>4 byte 211 \b, advanced scalable texture @ L3
455: >>4 byte 225 \b, simple studio @ L1
456: >>4 byte 226 \b, simple studio @ L2
457: >>4 byte 227 \b, simple studio @ L3
458: >>4 byte 228 \b, simple studio @ L4
459: >>4 byte 229 \b, core studio @ L1
460: >>4 byte 230 \b, core studio @ L2
461: >>4 byte 231 \b, core studio @ L3
462: >>4 byte 232 \b, core studio @ L4
463: >>4 byte 240 \b, advanced simple @ L0
464: >>4 byte 241 \b, advanced simple @ L1
465: >>4 byte 242 \b, advanced simple @ L2
466: >>4 byte 243 \b, advanced simple @ L3
467: >>4 byte 244 \b, advanced simple @ L4
468: >>4 byte 245 \b, advanced simple @ L5
469: >>4 byte 247 \b, advanced simple @ L3b
470: >>4 byte 248 \b, FGS @ L0
471: >>4 byte 249 \b, FGS @ L1
472: >>4 byte 250 \b, FGS @ L2
473: >>4 byte 251 \b, FGS @ L3
474: >>4 byte 252 \b, FGS @ L4
475: >>4 byte 253 \b, FGS @ L5
476: >3 byte 0xB5 MPEG sequence, v4
1.1.1.3 misho 477: !:mime video/mpeg4-generic
1.1 misho 478: >>4 byte &0x80
479: >>>5 byte&0xF0 16 \b, video (missing profile header)
480: >>>5 byte&0xF0 32 \b, still texture (missing profile header)
481: >>>5 byte&0xF0 48 \b, mesh (missing profile header)
482: >>>5 byte&0xF0 64 \b, face (missing profile header)
483: >>4 byte&0xF8 8 \b, video (missing profile header)
484: >>4 byte&0xF8 16 \b, still texture (missing profile header)
485: >>4 byte&0xF8 24 \b, mesh (missing profile header)
486: >>4 byte&0xF8 32 \b, face (missing profile header)
487: >3 byte 0xB3 MPEG sequence
1.1.1.3 misho 488: !:mime video/mpeg
1.1 misho 489: >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
490: >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
491: >>12 belong 0x000001B5 \b, v2,
492: >>>16 byte&0x0F 1 \b HP
493: >>>16 byte&0x0F 2 \b Spt
494: >>>16 byte&0x0F 3 \b SNR
495: >>>16 byte&0x0F 4 \b MP
496: >>>16 byte&0x0F 5 \b SP
497: >>>17 byte&0xF0 64 \b@HL
498: >>>17 byte&0xF0 96 \b@H-14
499: >>>17 byte&0xF0 128 \b@ML
500: >>>17 byte&0xF0 160 \b@LL
501: >>>17 byte &0x08 \b progressive
502: >>>17 byte ^0x08 \b interlaced
503: >>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
504: >>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
505: >>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
506: >>11 byte &0x02
507: >>>75 byte &0x01
508: >>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
509: >>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
510: >>>>140 belong 0x000001B5 \b, v2,
511: >>>>>144 byte&0x0F 1 \b HP
512: >>>>>144 byte&0x0F 2 \b Spt
513: >>>>>144 byte&0x0F 3 \b SNR
514: >>>>>144 byte&0x0F 4 \b MP
515: >>>>>144 byte&0x0F 5 \b SP
516: >>>>>145 byte&0xF0 64 \b@HL
517: >>>>>145 byte&0xF0 96 \b@H-14
518: >>>>>145 byte&0xF0 128 \b@ML
519: >>>>>145 byte&0xF0 160 \b@LL
520: >>>>>145 byte &0x08 \b progressive
521: >>>>>145 byte ^0x08 \b interlaced
522: >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
523: >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
524: >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
525: >>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
526: >>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
527: >>76 belong 0x000001B5 \b, v2,
528: >>>80 byte&0x0F 1 \b HP
529: >>>80 byte&0x0F 2 \b Spt
530: >>>80 byte&0x0F 3 \b SNR
531: >>>80 byte&0x0F 4 \b MP
532: >>>80 byte&0x0F 5 \b SP
533: >>>81 byte&0xF0 64 \b@HL
534: >>>81 byte&0xF0 96 \b@H-14
535: >>>81 byte&0xF0 128 \b@ML
536: >>>81 byte&0xF0 160 \b@LL
537: >>>81 byte &0x08 \b progressive
538: >>>81 byte ^0x08 \b interlaced
539: >>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
540: >>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
541: >>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
542: >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
543: >>>7 byte&0xF0 0x10 \b, 16:9
544: >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
545: >>>7 byte&0xF0 0x10 \b, 16:9
546: >>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
547: >>>7 byte&0xF0 0x10 \b, 4:3
548: >>4 beshort&0xFFF0 0x2C00 \b, 4CIF
549: >>>5 beshort&0x0FFF 0x01E0 \b NTSC
550: >>>5 beshort&0x0FFF 0x0240 \b PAL
551: >>>7 byte&0xF0 0x20 \b, 4:3
552: >>>7 byte&0xF0 0x30 \b, 16:9
553: >>>7 byte&0xF0 0x40 \b, 11:5
554: >>>7 byte&0xF0 0x80 \b, PAL 4:3
555: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
556: >>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
557: >>>7 byte&0xF0 0x10 \b, 4:3
558: >>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
559: >>>7 byte&0xF0 0x10 \b, 4:3
560: >>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
561: >>>7 byte&0xF0 0x10 \b, 4:3
562: >>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
563: >>>7 byte&0xF0 0x10 \b, 4:3
564: >>4 beshort&0xFFF0 0x1600 \b, CIF
565: >>>5 beshort&0x0FFF 0x00F0 \b NTSC
566: >>>5 beshort&0x0FFF 0x0120 \b PAL
567: >>>7 byte&0xF0 0x20 \b, 4:3
568: >>>7 byte&0xF0 0x30 \b, 16:9
569: >>>7 byte&0xF0 0x40 \b, 11:5
570: >>>7 byte&0xF0 0x80 \b, PAL 4:3
571: >>>7 byte&0xF0 0xC0 \b, NTSC 4:3
572: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
573: >>>>7 byte&0xF0 0x20 \b, 4:3
574: >>>>7 byte&0xF0 0x30 \b, 16:9
575: >>>>7 byte&0xF0 0x40 \b, 11:5
576: >>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
577: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
578: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
579: >>>7 byte&0xF0 0x20 \b, 4:3
580: >>>7 byte&0xF0 0x30 \b, 16:9
581: >>>7 byte&0xF0 0x40 \b, 11:5
582: >>4 beshort&0xFFF0 0x1E00 \b, SVCD
583: >>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
584: >>>5 beshort&0x0FFF 0x0240 \b PAL 625
585: >>>7 byte&0xF0 0x20 \b, 4:3
586: >>>7 byte&0xF0 0x30 \b, 16:9
587: >>>7 byte&0xF0 0x40 \b, 11:5
588: >>7 byte&0x0F 1 \b, 23.976 fps
589: >>7 byte&0x0F 2 \b, 24 fps
590: >>7 byte&0x0F 3 \b, 25 fps
591: >>7 byte&0x0F 4 \b, 29.97 fps
592: >>7 byte&0x0F 5 \b, 30 fps
593: >>7 byte&0x0F 6 \b, 50 fps
594: >>7 byte&0x0F 7 \b, 59.94 fps
595: >>7 byte&0x0F 8 \b, 60 fps
596: >>11 byte &0x04 \b, Constrained
597:
598: # MPEG ADTS Audio (*.mpx/mxa/aac)
599: # from dreesen@math.fu-berlin.de
600: # modified to fully support MPEG ADTS
601:
602: # MP3, M1A
603: # modified by Joerg Jenderek
604: # GRR the original test are too common for many DOS files
605: # so don't accept as MP3 until we've tested the rate
606: 0 beshort&0xFFFE 0xFFFA
607: # rates
608: >2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
609: !:mime audio/mpeg
610: >2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
611: !:mime audio/mpeg
612: >2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
613: !:mime audio/mpeg
614: >2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
615: !:mime audio/mpeg
616: >2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
617: !:mime audio/mpeg
618: >2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
619: !:mime audio/mpeg
620: >2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
621: !:mime audio/mpeg
622: >2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
623: !:mime audio/mpeg
624: >2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
625: !:mime audio/mpeg
626: >2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
627: !:mime audio/mpeg
628: >2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
629: !:mime audio/mpeg
630: >2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
631: !:mime audio/mpeg
632: >2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
633: !:mime audio/mpeg
634: >2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
635: !:mime audio/mpeg
636: # timing
637: >2 byte&0x0C 0x00 \b, 44.1 kHz
638: >2 byte&0x0C 0x04 \b, 48 kHz
639: >2 byte&0x0C 0x08 \b, 32 kHz
640: # channels/options
641: >3 byte&0xC0 0x00 \b, Stereo
642: >3 byte&0xC0 0x40 \b, JntStereo
643: >3 byte&0xC0 0x80 \b, 2x Monaural
644: >3 byte&0xC0 0xC0 \b, Monaural
645: #>1 byte ^0x01 \b, Data Verify
646: #>2 byte &0x02 \b, Packet Pad
647: #>2 byte &0x01 \b, Custom Flag
648: #>3 byte &0x08 \b, Copyrighted
649: #>3 byte &0x04 \b, Original Source
650: #>3 byte&0x03 1 \b, NR: 50/15 ms
651: #>3 byte&0x03 3 \b, NR: CCIT J.17
652:
653: # MP2, M1A
654: 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
1.1.1.2 misho 655: !:mime audio/mpeg
1.1 misho 656: # rates
657: >2 byte&0xF0 0x10 \b, 32 kbps
658: >2 byte&0xF0 0x20 \b, 48 kbps
659: >2 byte&0xF0 0x30 \b, 56 kbps
660: >2 byte&0xF0 0x40 \b, 64 kbps
661: >2 byte&0xF0 0x50 \b, 80 kbps
662: >2 byte&0xF0 0x60 \b, 96 kbps
663: >2 byte&0xF0 0x70 \b, 112 kbps
664: >2 byte&0xF0 0x80 \b, 128 kbps
665: >2 byte&0xF0 0x90 \b, 160 kbps
666: >2 byte&0xF0 0xA0 \b, 192 kbps
667: >2 byte&0xF0 0xB0 \b, 224 kbps
668: >2 byte&0xF0 0xC0 \b, 256 kbps
669: >2 byte&0xF0 0xD0 \b, 320 kbps
670: >2 byte&0xF0 0xE0 \b, 384 kbps
671: # timing
672: >2 byte&0x0C 0x00 \b, 44.1 kHz
673: >2 byte&0x0C 0x04 \b, 48 kHz
674: >2 byte&0x0C 0x08 \b, 32 kHz
675: # channels/options
676: >3 byte&0xC0 0x00 \b, Stereo
677: >3 byte&0xC0 0x40 \b, JntStereo
678: >3 byte&0xC0 0x80 \b, 2x Monaural
679: >3 byte&0xC0 0xC0 \b, Monaural
680: #>1 byte ^0x01 \b, Data Verify
681: #>2 byte &0x02 \b, Packet Pad
682: #>2 byte &0x01 \b, Custom Flag
683: #>3 byte &0x08 \b, Copyrighted
684: #>3 byte &0x04 \b, Original Source
685: #>3 byte&0x03 1 \b, NR: 50/15 ms
686: #>3 byte&0x03 3 \b, NR: CCIT J.17
687:
688: # MPA, M1A
689: # updated by Joerg Jenderek
690: # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
691: # GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
692: # FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
693: #0 beshort&0xFFFE 0xFFFE
694: #>2 ubyte&0xF0 >0x0F
695: #>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
696: ## rate
697: #>>>2 byte&0xF0 0x10 \b, 32 kbps
698: #>>>2 byte&0xF0 0x20 \b, 64 kbps
699: #>>>2 byte&0xF0 0x30 \b, 96 kbps
700: #>>>2 byte&0xF0 0x40 \b, 128 kbps
701: #>>>2 byte&0xF0 0x50 \b, 160 kbps
702: #>>>2 byte&0xF0 0x60 \b, 192 kbps
703: #>>>2 byte&0xF0 0x70 \b, 224 kbps
704: #>>>2 byte&0xF0 0x80 \b, 256 kbps
705: #>>>2 byte&0xF0 0x90 \b, 288 kbps
706: #>>>2 byte&0xF0 0xA0 \b, 320 kbps
707: #>>>2 byte&0xF0 0xB0 \b, 352 kbps
708: #>>>2 byte&0xF0 0xC0 \b, 384 kbps
709: #>>>2 byte&0xF0 0xD0 \b, 416 kbps
710: #>>>2 byte&0xF0 0xE0 \b, 448 kbps
711: ## timing
712: #>>>2 byte&0x0C 0x00 \b, 44.1 kHz
713: #>>>2 byte&0x0C 0x04 \b, 48 kHz
714: #>>>2 byte&0x0C 0x08 \b, 32 kHz
715: ## channels/options
716: #>>>3 byte&0xC0 0x00 \b, Stereo
717: #>>>3 byte&0xC0 0x40 \b, JntStereo
718: #>>>3 byte&0xC0 0x80 \b, 2x Monaural
719: #>>>3 byte&0xC0 0xC0 \b, Monaural
720: ##>1 byte ^0x01 \b, Data Verify
721: ##>2 byte &0x02 \b, Packet Pad
722: ##>2 byte &0x01 \b, Custom Flag
723: ##>3 byte &0x08 \b, Copyrighted
724: ##>3 byte &0x04 \b, Original Source
725: ##>3 byte&0x03 1 \b, NR: 50/15 ms
726: ##>3 byte&0x03 3 \b, NR: CCIT J.17
727:
728: # MP3, M2A
729: 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
1.1.1.2 misho 730: !:mime audio/mpeg
1.1 misho 731: # rate
732: >2 byte&0xF0 0x10 \b, 8 kbps
733: >2 byte&0xF0 0x20 \b, 16 kbps
734: >2 byte&0xF0 0x30 \b, 24 kbps
735: >2 byte&0xF0 0x40 \b, 32 kbps
736: >2 byte&0xF0 0x50 \b, 40 kbps
737: >2 byte&0xF0 0x60 \b, 48 kbps
738: >2 byte&0xF0 0x70 \b, 56 kbps
739: >2 byte&0xF0 0x80 \b, 64 kbps
740: >2 byte&0xF0 0x90 \b, 80 kbps
741: >2 byte&0xF0 0xA0 \b, 96 kbps
742: >2 byte&0xF0 0xB0 \b, 112 kbps
743: >2 byte&0xF0 0xC0 \b, 128 kbps
744: >2 byte&0xF0 0xD0 \b, 144 kbps
745: >2 byte&0xF0 0xE0 \b, 160 kbps
746: # timing
747: >2 byte&0x0C 0x00 \b, 22.05 kHz
748: >2 byte&0x0C 0x04 \b, 24 kHz
749: >2 byte&0x0C 0x08 \b, 16 kHz
750: # channels/options
751: >3 byte&0xC0 0x00 \b, Stereo
752: >3 byte&0xC0 0x40 \b, JntStereo
753: >3 byte&0xC0 0x80 \b, 2x Monaural
754: >3 byte&0xC0 0xC0 \b, Monaural
755: #>1 byte ^0x01 \b, Data Verify
756: #>2 byte &0x02 \b, Packet Pad
757: #>2 byte &0x01 \b, Custom Flag
758: #>3 byte &0x08 \b, Copyrighted
759: #>3 byte &0x04 \b, Original Source
760: #>3 byte&0x03 1 \b, NR: 50/15 ms
761: #>3 byte&0x03 3 \b, NR: CCIT J.17
762:
763: # MP2, M2A
764: 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
765: # rate
766: >2 byte&0xF0 0x10 \b, 8 kbps
767: >2 byte&0xF0 0x20 \b, 16 kbps
768: >2 byte&0xF0 0x30 \b, 24 kbps
769: >2 byte&0xF0 0x40 \b, 32 kbps
770: >2 byte&0xF0 0x50 \b, 40 kbps
771: >2 byte&0xF0 0x60 \b, 48 kbps
772: >2 byte&0xF0 0x70 \b, 56 kbps
773: >2 byte&0xF0 0x80 \b, 64 kbps
774: >2 byte&0xF0 0x90 \b, 80 kbps
775: >2 byte&0xF0 0xA0 \b, 96 kbps
776: >2 byte&0xF0 0xB0 \b, 112 kbps
777: >2 byte&0xF0 0xC0 \b, 128 kbps
778: >2 byte&0xF0 0xD0 \b, 144 kbps
779: >2 byte&0xF0 0xE0 \b, 160 kbps
780: # timing
781: >2 byte&0x0C 0x00 \b, 22.05 kHz
782: >2 byte&0x0C 0x04 \b, 24 kHz
783: >2 byte&0x0C 0x08 \b, 16 kHz
784: # channels/options
785: >3 byte&0xC0 0x00 \b, Stereo
786: >3 byte&0xC0 0x40 \b, JntStereo
787: >3 byte&0xC0 0x80 \b, 2x Monaural
788: >3 byte&0xC0 0xC0 \b, Monaural
789: #>1 byte ^0x01 \b, Data Verify
790: #>2 byte &0x02 \b, Packet Pad
791: #>2 byte &0x01 \b, Custom Flag
792: #>3 byte &0x08 \b, Copyrighted
793: #>3 byte &0x04 \b, Original Source
794: #>3 byte&0x03 1 \b, NR: 50/15 ms
795: #>3 byte&0x03 3 \b, NR: CCIT J.17
796:
797: # MPA, M2A
798: 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
1.1.1.2 misho 799: !:mime audio/mpeg
1.1 misho 800: # rate
801: >2 byte&0xF0 0x10 \b, 32 kbps
802: >2 byte&0xF0 0x20 \b, 48 kbps
803: >2 byte&0xF0 0x30 \b, 56 kbps
804: >2 byte&0xF0 0x40 \b, 64 kbps
805: >2 byte&0xF0 0x50 \b, 80 kbps
806: >2 byte&0xF0 0x60 \b, 96 kbps
807: >2 byte&0xF0 0x70 \b, 112 kbps
808: >2 byte&0xF0 0x80 \b, 128 kbps
809: >2 byte&0xF0 0x90 \b, 144 kbps
810: >2 byte&0xF0 0xA0 \b, 160 kbps
811: >2 byte&0xF0 0xB0 \b, 176 kbps
812: >2 byte&0xF0 0xC0 \b, 192 kbps
813: >2 byte&0xF0 0xD0 \b, 224 kbps
814: >2 byte&0xF0 0xE0 \b, 256 kbps
815: # timing
816: >2 byte&0x0C 0x00 \b, 22.05 kHz
817: >2 byte&0x0C 0x04 \b, 24 kHz
818: >2 byte&0x0C 0x08 \b, 16 kHz
819: # channels/options
820: >3 byte&0xC0 0x00 \b, Stereo
821: >3 byte&0xC0 0x40 \b, JntStereo
822: >3 byte&0xC0 0x80 \b, 2x Monaural
823: >3 byte&0xC0 0xC0 \b, Monaural
824: #>1 byte ^0x01 \b, Data Verify
825: #>2 byte &0x02 \b, Packet Pad
826: #>2 byte &0x01 \b, Custom Flag
827: #>3 byte &0x08 \b, Copyrighted
828: #>3 byte &0x04 \b, Original Source
829: #>3 byte&0x03 1 \b, NR: 50/15 ms
830: #>3 byte&0x03 3 \b, NR: CCIT J.17
831:
832: # MP3, M25A
833: 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
1.1.1.2 misho 834: !:mime audio/mpeg
1.1 misho 835: # rate
836: >2 byte&0xF0 0x10 \b, 8 kbps
837: >2 byte&0xF0 0x20 \b, 16 kbps
838: >2 byte&0xF0 0x30 \b, 24 kbps
839: >2 byte&0xF0 0x40 \b, 32 kbps
840: >2 byte&0xF0 0x50 \b, 40 kbps
841: >2 byte&0xF0 0x60 \b, 48 kbps
842: >2 byte&0xF0 0x70 \b, 56 kbps
843: >2 byte&0xF0 0x80 \b, 64 kbps
844: >2 byte&0xF0 0x90 \b, 80 kbps
845: >2 byte&0xF0 0xA0 \b, 96 kbps
846: >2 byte&0xF0 0xB0 \b, 112 kbps
847: >2 byte&0xF0 0xC0 \b, 128 kbps
848: >2 byte&0xF0 0xD0 \b, 144 kbps
849: >2 byte&0xF0 0xE0 \b, 160 kbps
850: # timing
851: >2 byte&0x0C 0x00 \b, 11.025 kHz
852: >2 byte&0x0C 0x04 \b, 12 kHz
853: >2 byte&0x0C 0x08 \b, 8 kHz
854: # channels/options
855: >3 byte&0xC0 0x00 \b, Stereo
856: >3 byte&0xC0 0x40 \b, JntStereo
857: >3 byte&0xC0 0x80 \b, 2x Monaural
858: >3 byte&0xC0 0xC0 \b, Monaural
859: #>1 byte ^0x01 \b, Data Verify
860: #>2 byte &0x02 \b, Packet Pad
861: #>2 byte &0x01 \b, Custom Flag
862: #>3 byte &0x08 \b, Copyrighted
863: #>3 byte &0x04 \b, Original Source
864: #>3 byte&0x03 1 \b, NR: 50/15 ms
865: #>3 byte&0x03 3 \b, NR: CCIT J.17
866:
867: # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
868:
869: # Stored AAC streams (instead of the MP4 format)
870: 0 string ADIF MPEG ADIF, AAC
871: !:mime audio/x-hx-aac-adif
872: >4 byte &0x80
873: >>13 byte &0x10 \b, VBR
874: >>13 byte ^0x10 \b, CBR
875: >>16 byte&0x1E 0x02 \b, single stream
876: >>16 byte&0x1E 0x04 \b, 2 streams
877: >>16 byte&0x1E 0x06 \b, 3 streams
878: >>16 byte &0x08 \b, 4 or more streams
879: >>16 byte &0x10 \b, 8 or more streams
880: >>4 byte &0x80 \b, Copyrighted
881: >>13 byte &0x40 \b, Original Source
882: >>13 byte &0x20 \b, Home Flag
883: >4 byte ^0x80
884: >>4 byte &0x10 \b, VBR
885: >>4 byte ^0x10 \b, CBR
886: >>7 byte&0x1E 0x02 \b, single stream
887: >>7 byte&0x1E 0x04 \b, 2 streams
888: >>7 byte&0x1E 0x06 \b, 3 streams
889: >>7 byte &0x08 \b, 4 or more streams
890: >>7 byte &0x10 \b, 8 or more streams
891: >>4 byte &0x40 \b, Original Stream(s)
892: >>4 byte &0x20 \b, Home Source
893:
894: # Live or stored single AAC stream (used with MPEG-2 systems)
895: 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
896: !:mime audio/x-hx-aac-adts
897: >1 byte &0x08 \b, v2
898: >1 byte ^0x08 \b, v4
899: # profile
900: >>2 byte &0xC0 \b LTP
901: >2 byte&0xc0 0x00 \b Main
902: >2 byte&0xc0 0x40 \b LC
903: >2 byte&0xc0 0x80 \b SSR
904: # timing
905: >2 byte&0x3c 0x00 \b, 96 kHz
906: >2 byte&0x3c 0x04 \b, 88.2 kHz
907: >2 byte&0x3c 0x08 \b, 64 kHz
908: >2 byte&0x3c 0x0c \b, 48 kHz
909: >2 byte&0x3c 0x10 \b, 44.1 kHz
910: >2 byte&0x3c 0x14 \b, 32 kHz
911: >2 byte&0x3c 0x18 \b, 24 kHz
912: >2 byte&0x3c 0x1c \b, 22.05 kHz
913: >2 byte&0x3c 0x20 \b, 16 kHz
914: >2 byte&0x3c 0x24 \b, 12 kHz
915: >2 byte&0x3c 0x28 \b, 11.025 kHz
916: >2 byte&0x3c 0x2c \b, 8 kHz
917: # channels
918: >2 beshort&0x01c0 0x0040 \b, monaural
919: >2 beshort&0x01c0 0x0080 \b, stereo
920: >2 beshort&0x01c0 0x00c0 \b, stereo + center
921: >2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
922: >2 beshort&0x01c0 0x0140 \b, surround
923: >2 beshort&0x01c0 0x0180 \b, surround + LFE
924: >2 beshort &0x01C0 \b, surround + side
925: #>1 byte ^0x01 \b, Data Verify
926: #>2 byte &0x02 \b, Custom Flag
927: #>3 byte &0x20 \b, Original Stream
928: #>3 byte &0x10 \b, Home Source
929: #>3 byte &0x08 \b, Copyrighted
930:
931: # Live MPEG-4 audio streams (instead of RTP FlexMux)
932: 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
933: !:mime audio/x-mp4a-latm
934: #>1 beshort&0x1FFF x \b, %u byte packet
935: >3 byte&0xE0 0x40
936: >>4 byte&0x3C 0x04 \b, single stream
937: >>4 byte&0x3C 0x08 \b, 2 streams
938: >>4 byte&0x3C 0x0C \b, 3 streams
939: >>4 byte &0x08 \b, 4 or more streams
940: >>4 byte &0x20 \b, 8 or more streams
941: >3 byte&0xC0 0
942: >>4 byte&0x78 0x08 \b, single stream
943: >>4 byte&0x78 0x10 \b, 2 streams
944: >>4 byte&0x78 0x18 \b, 3 streams
945: >>4 byte &0x20 \b, 4 or more streams
946: >>4 byte &0x40 \b, 8 or more streams
947: # This magic isn't strong enough (matches plausible ISO-8859-1 text)
948: #0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
949: #!:mime audio/x-mp4a-latm
950:
951: # Summary: FLI animation format
952: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
953: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
954: 4 leshort 0xAF11
955: # standard FLI always has 320x200 resolution and 8 bit color
956: >8 leshort 320
957: >>10 leshort 200
958: >>>12 leshort 8 FLI animation, 320x200x8
959: !:mime video/x-fli
960: >>>>6 leshort x \b, %d frames
961: # frame speed is multiple of 1/70s
962: >>>>16 leshort x \b, %d/70s per frame
963:
964: # Summary: FLC animation format
965: # Created by: Daniel Quinlan <quinlan@yggdrasil.com>
966: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
967: 4 leshort 0xAF12
968: # standard FLC always use 8 bit color
969: >12 leshort 8 FLC animation
970: !:mime video/x-flc
971: >>8 leshort x \b, %d
972: >>10 leshort x \bx%dx8
973: >>6 uleshort x \b, %d frames
974: >>16 uleshort x \b, %dms per frame
975:
976: # DL animation format
977: # XXX - collision with most `mips' magic
978: #
979: # I couldn't find a real magic number for these, however, this
980: # -appears- to work. Note that it might catch other files, too, so be
981: # careful!
982: #
983: # Note that title and author appear in the two 20-byte chunks
984: # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
985: # 255 (hex FF)! The DL format is really bad.
986: #
987: #0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
988: #!:mime video/x-unknown
989: #>42 byte x - %d screens,
990: #>43 byte x %d commands
991: #0 byte 2 DL version 2
992: #!:mime video/x-unknown
993: #>1 byte 1 - large format (320x200,1 image/screen),
994: #>1 byte 2 - medium format (160x100,4 images/screen),
995: #>1 byte >2 - unknown format,
996: #>42 byte x %d screens,
997: #>43 byte x %d commands
998: # Based on empirical evidence, DL version 3 have several nulls following the
999: # \003. Most of them start with non-null values at hex offset 0x34 or so.
1000: #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
1001:
1002: # iso 13818 transport stream
1003: #
1004: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1005: # syncbyte 8 bit 0x47
1006: # error_ind 1 bit -
1007: # payload_start 1 bit 1
1008: # priority 1 bit -
1009: # PID 13 bit 0x0000
1010: # scrambling 2 bit -
1011: # adaptfld_ctrl 2 bit 1 or 3
1.1.1.3 misho 1012: # conti_count 4 bit -
1013: 0 belong&0xFF5FFF10 0x47400010
1014: >188 byte 0x47 MPEG transport stream data
1.1 misho 1015:
1016: # DIF digital video file format <mpruett@sgi.com>
1017: 0 belong&0xffffff00 0x1f070000 DIF
1018: >4 byte &0x01 (DVCPRO) movie file
1019: >4 byte ^0x01 (DV) movie file
1020: >3 byte &0x80 (PAL)
1021: >3 byte ^0x80 (NTSC)
1022:
1023: # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
1024: 0 belong 0x3026b275 Microsoft ASF
1.1.1.2 misho 1025: !:mime video/x-ms-asf
1.1 misho 1026:
1027: # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1028: 0 string \x8aMNG MNG video data,
1029: !:mime video/x-mng
1030: >4 belong !0x0d0a1a0a CORRUPTED,
1031: >4 belong 0x0d0a1a0a
1032: >>16 belong x %ld x
1033: >>20 belong x %ld
1034:
1035: # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
1036: 0 string \x8bJNG JNG video data,
1037: !:mime video/x-jng
1038: >4 belong !0x0d0a1a0a CORRUPTED,
1039: >4 belong 0x0d0a1a0a
1040: >>16 belong x %ld x
1041: >>20 belong x %ld
1042:
1043: # Vivo video (Wolfram Kleff)
1044: 3 string \x0D\x0AVersion:Vivo Vivo video data
1045:
1046: # VRML (Virtual Reality Modelling Language)
1.1.1.2 misho 1047: 0 string/w #VRML\ V1.0\ ascii VRML 1 file
1.1 misho 1048: !:mime model/vrml
1.1.1.2 misho 1049: 0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
1.1 misho 1050: !:mime model/vrml
1051:
1052: # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1053: # From Michel Briand <michelbriand@free.fr>
1.1.1.3 misho 1054: 0 string/t \<?xml\ version="
1.1 misho 1055: !:strength +1
1.1.1.2 misho 1056: >20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
1.1 misho 1057: !:mime model/x3d
1058:
1059: #---------------------------------------------------------------------------
1060: # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1061: # From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1062: #
1063: 0 string HVQM4 %s
1064: >6 string >\0 v%s
1065: >0 byte x GameCube movie,
1066: >0x34 ubeshort x %d x
1067: >0x36 ubeshort x %d,
1.1.1.3 misho 1068: >0x26 ubeshort x %dus,
1.1 misho 1069: >0x42 ubeshort 0 no audio
1070: >0x42 ubeshort >0 %dHz audio
1071:
1072: # From: "Stefan A. Haubenthal" <polluks@web.de>
1073: 0 string DVDVIDEO-VTS Video title set,
1074: >0x21 byte x v%x
1075: 0 string DVDVIDEO-VMG Video manager,
1076: >0x21 byte x v%x
1077:
1078: # From: Behan Webster <behanw@websterwood.com>
1079: # NuppelVideo used by Mythtv (*.nuv)
1080: # Note: there are two identical stanzas here differing only in the
1081: # initial string matched. It used to be done with a regex, but we're
1082: # trying to get rid of those.
1083: 0 string NuppelVideo MythTV NuppelVideo
1084: >12 string x v%s
1085: >20 lelong x (%d
1086: >24 lelong x \bx%d),
1087: >36 string P \bprogressive,
1088: >36 string I \binterlaced,
1089: >40 ledouble x \baspect:%.2f,
1090: >48 ledouble x \bfps:%.2f
1091: 0 string MythTV MythTV NuppelVideo
1092: >12 string x v%s
1093: >20 lelong x (%d
1094: >24 lelong x \bx%d),
1095: >36 string P \bprogressive,
1096: >36 string I \binterlaced,
1097: >40 ledouble x \baspect:%.2f,
1098: >48 ledouble x \bfps:%.2f
1099:
1100: # MPEG file
1101: # MPEG sequences
1102: # FIXME: This section is from the old magic.mime file and needs integrating with the rest
1103: 0 belong 0x000001BA
1104: >4 byte &0x40
1105: !:mime video/mp2p
1106: >4 byte ^0x40
1107: !:mime video/mpeg
1108: 0 belong 0x000001BB
1109: !:mime video/mpeg
1110: 0 belong 0x000001B0
1111: !:mime video/mp4v-es
1112: 0 belong 0x000001B5
1113: !:mime video/mp4v-es
1114: 0 belong 0x000001B3
1115: !:mime video/mpv
1116: 0 belong&0xFF5FFF1F 0x47400010
1117: !:mime video/mp2t
1118: 0 belong 0x00000001
1119: >4 byte&0x1F 0x07
1120: !:mime video/h264
1121:
1.1.1.2 misho 1122: # Type: Bink Video
1.1.1.3 misho 1123: # Extension: .bik
1124: # URL: http://wiki.multimedia.cx/index.php?title=Bink_Container
1.1.1.2 misho 1125: # From: <hoehle@users.sourceforge.net> 2008-07-18
1126: 0 string BIK Bink Video
1127: >3 regex =[a-z] rev.%s
1128: #>4 ulelong x size %d
1129: >20 ulelong x \b, %d
1130: >24 ulelong x \bx%d
1131: >8 ulelong x \b, %d frames
1132: >32 ulelong x at rate %d/
1133: >28 ulelong >1 \b%d
1134: >40 ulelong =0 \b, no audio
1135: >40 ulelong !0 \b, %d audio track
1136: >>40 ulelong !1 \bs
1137: # follow properties of the first audio track only
1138: >>48 uleshort x %dHz
1139: >>51 byte&0x20 0 mono
1140: >>51 byte&0x20 !0 stereo
1141: #>>51 byte&0x10 0 FFT
1142: #>>51 byte&0x10 !0 DCT
1143:
1144: # Type: NUT Container
1145: # URL: http://wiki.multimedia.cx/index.php?title=NUT
1146: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
1147: 0 string nut/multimedia\ container\0 NUT multimedia container
1148:
1.1.1.3 misho 1149: # Type: Nullsoft Video (NSV)
1150: # URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1151: # From: Mike Melanson <mike@multimedia.cx>
1152: 0 string NSVf Nullsoft Video
1153:
1154: # Type: REDCode Video
1155: # URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
1156: # From: Mike Melanson <mike@multimedia.cx>
1157: 4 string RED1 REDCode Video
1158:
1159: # Type: MTV Multimedia File
1160: # URL: http://wiki.multimedia.cx/index.php?title=MTV
1161: # From: Mike Melanson <mike@multimedia.cx>
1162: 0 string AMVS MTV Multimedia File
1163:
1164: # Type: ARMovie
1165: # URL: http://wiki.multimedia.cx/index.php?title=ARMovie
1166: # From: Mike Melanson <mike@multimedia.cx>
1167: 0 string ARMovie\012 ARMovie
1168:
1169: # Type: Interplay MVE Movie
1170: # URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE
1171: # From: Mike Melanson <mike@multimedia.cx>
1172: 0 string Interplay\040MVE\040File\032 Interplay MVE Movie
1173:
1174: # Type: Windows Television DVR File
1175: # URL: http://wiki.multimedia.cx/index.php?title=WTV
1176: # From: Mike Melanson <mike@mutlimedia.cx>
1177: # This takes the form of a Windows-style GUID
1178: 0 bequad 0xB7D800203749DA11
1179: >8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media
1180:
1181: # Type: Sega FILM/CPK Multimedia
1182: # URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM
1183: # From: Mike Melanson <mike@multimedia.cx>
1184: 0 string FILM Sega FILM/CPK Multimedia,
1185: >32 belong x %d x
1186: >28 belong x %d
1187:
1188: # Type: Nintendo THP Multimedia
1189: # URL: http://wiki.multimedia.cx/index.php?title=THP
1190: # From: Mike Melanson <mike@multimedia.cx>
1191: 0 string THP\0 Nintendo THP Multimedia
1192:
1193: # Type: BBC Dirac Video
1194: # URL: http://wiki.multimedia.cx/index.php?title=Dirac
1195: # From: Mike Melanson <mike@multimedia.cx>
1196: 0 string BBCD BBC Dirac Video
1197:
1198: # Type: RAD Game Tools Smacker Multimedia
1199: # URL: http://wiki.multimedia.cx/index.php?title=Smacker
1200: # From: Mike Melanson <mike@multimedia.cx>
1201: 0 string SMK RAD Game Tools Smacker Multimedia
1202: >3 byte x version %c,
1203: >4 lelong x %d x
1204: >8 lelong x %d,
1205: >12 lelong x %d frames
1206:
1207: #------------------------------------------------------------------------------
1208: # $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1209: # aout: file(1) magic for a.out executable/object/etc entries that
1210: # handle executables on multiple platforms.
1211: #
1212:
1213: #
1214: # Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1215: # BSDI), netbsd, and vax (for UNIX/32V and BSD)
1216: #
1217: # XXX - is there anything we can look at to distinguish BSD/OS 386 from
1218: # NetBSD 386 from various VAX binaries? The BSD/OS shared library flag
1219: # works only for binaries using shared libraries. Grabbing the entry
1220: # point from the a.out header, using it to find the first code executed
1221: # in the program, and looking at that might help.
1222: #
1223: 0 lelong 0407 a.out little-endian 32-bit executable
1224: >16 lelong >0 not stripped
1225: >32 byte 0x6a (uses BSD/OS shared libs)
1226:
1227: 0 lelong 0410 a.out little-endian 32-bit pure executable
1228: >16 lelong >0 not stripped
1229: >32 byte 0x6a (uses BSD/OS shared libs)
1230:
1231: 0 lelong 0413 a.out little-endian 32-bit demand paged pure executable
1232: >16 lelong >0 not stripped
1233: >32 byte 0x6a (uses BSD/OS shared libs)
1234:
1235: #
1236: # Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1237: # mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1238: #
1239: # XXX - is there anything we can look at to distinguish old SunOS 68010
1240: # from old 68020 IRIX from old NetBSD? Again, I guess we could look at
1241: # the first instruction or instructions in the program.
1242: #
1243: 0 belong 0407 a.out big-endian 32-bit executable
1244: >16 belong >0 not stripped
1245:
1246: 0 belong 0410 a.out big-endian 32-bit pure executable
1247: >16 belong >0 not stripped
1248:
1249: 0 belong 0413 a.out big-endian 32-bit demand paged executable
1250: >16 belong >0 not stripped
1251:
1252:
1.1 misho 1253: #------------------------------------------------------------------------------
1.1.1.2 misho 1254: # $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1.1 misho 1255: # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
1256: # workspaces)
1257: #
1258: 0 long 0100554 APL workspace (Ken's original?)
1.1.1.2 misho 1259:
1.1 misho 1260: #------------------------------------------------------------------------------
1.1.1.3 misho 1261: # $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
1.1 misho 1262: # apple: file(1) magic for Apple file formats
1263: #
1.1.1.3 misho 1264: 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
1.1 misho 1265: 0 string \x0aGL Binary II (apple ][) data
1266: 0 string \x76\xff Squeezed (apple ][) data
1267: 0 string NuFile NuFile archive (apple ][) data
1268: 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
1269: 0 belong 0x00051600 AppleSingle encoded Macintosh file
1270: 0 belong 0x00051607 AppleDouble encoded Macintosh file
1271:
1272: # Type: Apple Emulator 2IMG format
1273: # From: Radek Vokal <rvokal@redhat.com>
1274: 0 string 2IMG Apple ][ 2IMG Disk Image
1275: >4 string XGS! \b, XGS
1276: >4 string CTKG \b, Catakig
1277: >4 string ShIm \b, Sheppy's ImageMaker
1278: >4 string WOOF \b, Sweet 16
1279: >4 string B2TR \b, Bernie ][ the Rescue
1280: >4 string !nfc \b, ASIMOV2
1281: >4 string x \b, Unknown Format
1282: >0xc byte 00 \b, DOS 3.3 sector order
1283: >>0x10 byte 00 \b, Volume 254
1284: >>0x10 byte&0x7f x \b, Volume %u
1285: >0xc byte 01 \b, ProDOS sector order
1286: >>0x14 short x \b, %u Blocks
1287: >0xc byte 02 \b, NIB data
1288:
1289: # magic for Newton PDA package formats
1290: # from Ruda Moura <ruda@helllabs.org>
1291: 0 string package0 Newton package, NOS 1.x,
1292: >12 belong &0x80000000 AutoRemove,
1293: >12 belong &0x40000000 CopyProtect,
1294: >12 belong &0x10000000 NoCompression,
1295: >12 belong &0x04000000 Relocation,
1296: >12 belong &0x02000000 UseFasterCompression,
1297: >16 belong x version %d
1298:
1299: 0 string package1 Newton package, NOS 2.x,
1300: >12 belong &0x80000000 AutoRemove,
1301: >12 belong &0x40000000 CopyProtect,
1302: >12 belong &0x10000000 NoCompression,
1303: >12 belong &0x04000000 Relocation,
1304: >12 belong &0x02000000 UseFasterCompression,
1305: >16 belong x version %d
1306:
1307: 0 string package4 Newton package,
1308: >8 byte 8 NOS 1.x,
1309: >8 byte 9 NOS 2.x,
1310: >12 belong &0x80000000 AutoRemove,
1311: >12 belong &0x40000000 CopyProtect,
1312: >12 belong &0x10000000 NoCompression,
1313:
1314: # The following entries for the Apple II are for files that have
1315: # been transferred as raw binary data from an Apple, without having
1316: # been encapsulated by any of the above archivers.
1317: #
1318: # In general, Apple II formats are hard to identify because Apple DOS
1319: # and especially Apple ProDOS have strong typing in the file system and
1320: # therefore programmers never felt much need to include type information
1321: # in the files themselves.
1322: #
1323: # Eric Fischer <enf@pobox.com>
1324:
1325: # AppleWorks word processor:
1326: #
1327: # This matches the standard tab stops for an AppleWorks file, but if
1328: # a file has a tab stop set in the first four columns this will fail.
1329: #
1330: # The "O" is really the magic number, but that's so common that it's
1331: # necessary to check the tab stops that follow it to avoid false positives.
1332:
1333: 4 string O==== AppleWorks word processor data
1334: >85 byte&0x01 >0 \b, zoomed
1335: >90 byte&0x01 >0 \b, paginated
1336: >92 byte&0x01 >0 \b, with mail merge
1337: #>91 byte x \b, left margin %d
1338:
1339: # AppleWorks database:
1340: #
1341: # This isn't really a magic number, but it's the closest thing to one
1342: # that I could find. The 1 and 2 really mean "order in which you defined
1343: # categories" and "left to right, top to bottom," respectively; the D and R
1344: # mean that the cursor should move either down or right when you press Return.
1345:
1346: #30 string \x01D AppleWorks database data
1347: #30 string \x02D AppleWorks database data
1348: #30 string \x01R AppleWorks database data
1349: #30 string \x02R AppleWorks database data
1350:
1351: # AppleWorks spreadsheet:
1352: #
1353: # Likewise, this isn't really meant as a magic number. The R or C means
1354: # row- or column-order recalculation; the A or M means automatic or manual
1355: # recalculation.
1356:
1357: #131 string RA AppleWorks spreadsheet data
1358: #131 string RM AppleWorks spreadsheet data
1359: #131 string CA AppleWorks spreadsheet data
1360: #131 string CM AppleWorks spreadsheet data
1361:
1362: # Applesoft BASIC:
1363: #
1364: # This is incredibly sloppy, but will be true if the program was
1365: # written at its usual memory location of 2048 and its first line
1366: # number is less than 256. Yuck.
1.1.1.3 misho 1367: # update by Joerg Jenderek at Feb 2013
1.1 misho 1368:
1.1.1.3 misho 1369: # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1370: #0 belong&0xff00ff 0x80000 Applesoft BASIC program data
1371: 0 belong&0x00ff00ff 0x00080000
1372: # assuming that line number must be positive
1373: >2 leshort >0 Applesoft BASIC program data, first line number %d
1.1 misho 1374: #>2 leshort x \b, first line number %d
1375:
1376: # ORCA/EZ assembler:
1377: #
1378: # This will not identify ORCA/M source files, since those have
1379: # some sort of date code instead of the two zero bytes at 6 and 7
1380: # XXX Conflicts with ELF
1381: #4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
1382: #>5 byte x \b, build number %d
1383:
1384: # Broderbund Fantavision
1385: #
1386: # I don't know what these values really mean, but they seem to recur.
1387: # Will they cause too many conflicts?
1388:
1389: # Probably :-)
1390: #2 belong&0xFF00FF 0x040008 Fantavision movie data
1391:
1392: # Some attempts at images.
1393: #
1394: # These are actually just bit-for-bit dumps of the frame buffer, so
1395: # there's really no reasonably way to distinguish them except for their
1396: # address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1397: # or, occasionally, 8184.
1398: #
1399: # Nevertheless this will manage to catch a lot of images that happen
1400: # to have a solid-colored line at the bottom of the screen.
1401:
1402: # GRR: Magic too weak
1403: #8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
1404: #8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
1405: #8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
1406: #8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
1407: #8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
1408:
1409: # Beagle Bros. Apple Mechanic fonts
1410:
1411: 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
1412:
1413: # Apple Universal Disk Image Format (UDIF) - dmg files.
1414: # From Johan Gade.
1415: # These entries are disabled for now until we fix the following issues.
1416: #
1417: # Note there might be some problems with the "VAX COFF executable"
1418: # entry. Note this entry should be placed before the mac filesystem section,
1419: # particularly the "Apple Partition data" entry.
1420: #
1421: # The intended meaning of these tests is, that the file is only of the
1422: # specified type if both of the lines are correct - i.e. if the first
1423: # line matches and the second doesn't then it is not of that type.
1424: #
1425: #0 long 0x7801730d
1426: #>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
1427: #
1428: # Note that this entry is recognized correctly by the "Apple Partition
1429: # data" entry - however since this entry is more specific - this
1430: # information seems to be more useful.
1431: #0 long 0x45520200
1432: #>0x410 string disk\ image UDIF read/write image (UDRW)
1433:
1434: # From: Toby Peterson <toby@apple.com>
1435: 0 string bplist00 Apple binary property list
1436:
1437: # Apple binary property list (bplist)
1438: # Assumes version bytes are hex.
1439: # Provides content hints for version 0 files. Assumes that the root
1440: # object is the first object (true for CoreFoundation implementation).
1441: # From: David Remahl <dremahl@apple.com>
1442: 0 string bplist
1443: >6 byte x \bCoreFoundation binary property list data, version 0x%c
1444: >>7 byte x \b%c
1445: >6 string 00 \b
1446: >>8 byte&0xF0 0x00 \b
1447: >>>8 byte&0x0F 0x00 \b, root type: null
1448: >>>8 byte&0x0F 0x08 \b, root type: false boolean
1449: >>>8 byte&0x0F 0x09 \b, root type: true boolean
1450: >>8 byte&0xF0 0x10 \b, root type: integer
1451: >>8 byte&0xF0 0x20 \b, root type: real
1452: >>8 byte&0xF0 0x30 \b, root type: date
1453: >>8 byte&0xF0 0x40 \b, root type: data
1454: >>8 byte&0xF0 0x50 \b, root type: ascii string
1455: >>8 byte&0xF0 0x60 \b, root type: unicode string
1456: >>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
1457: >>8 byte&0xF0 0xa0 \b, root type: array
1458: >>8 byte&0xF0 0xd0 \b, root type: dictionary
1459:
1460: # Apple/NeXT typedstream data
1461: # Serialization format used by NeXT and Apple for various
1462: # purposes in YellowStep/Cocoa, including some nib files.
1463: # From: David Remahl <dremahl@apple.com>
1464: 2 string typedstream NeXT/Apple typedstream data, big endian
1465: >0 byte x \b, version %hhd
1466: >0 byte <5 \b
1467: >>13 byte 0x81 \b
1468: >>>14 ubeshort x \b, system %hd
1469: 2 string streamtyped NeXT/Apple typedstream data, little endian
1470: >0 byte x \b, version %hhd
1471: >0 byte <5 \b
1472: >>13 byte 0x81 \b
1473: >>>14 uleshort x \b, system %hd
1474:
1475: #------------------------------------------------------------------------------
1476: # CAF: Apple CoreAudio File Format
1477: #
1478: # Container format for high-end audio purposes.
1479: # From: David Remahl <dremahl@apple.com>
1480: #
1481: 0 string caff CoreAudio Format audio file
1482: >4 beshort <10 version %d
1483: >6 beshort x
1484:
1485:
1486: #------------------------------------------------------------------------------
1487: # Keychain database files
1488: 0 string kych Mac OS X Keychain File
1489:
1490: #------------------------------------------------------------------------------
1491: # Code Signing related file types
1492: 0 belong 0xfade0c00 Mac OS X Code Requirement
1493: >8 belong 1 (opExpr)
1494: >4 belong x - %d bytes
1495:
1496: 0 belong 0xfade0c01 Mac OS X Code Requirement Set
1497: >8 belong >1 containing %d items
1498: >4 belong x - %d bytes
1499:
1500: 0 belong 0xfade0c02 Mac OS X Code Directory
1501: >8 belong x version %x
1502: >12 belong >0 flags 0x%x
1503: >4 belong x - %d bytes
1504:
1505: 0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
1506: >4 belong x - %d bytes
1507:
1508: 0 belong 0xfade0cc1 Mac OS X Detached Code Signature
1509: >8 belong >1 (%d elements)
1510: >4 belong x - %d bytes
1511:
1512: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1513: # .vdi
1514: 4 string innotek\ VirtualBox\ Disk\ Image %s
1515:
1.1.1.3 misho 1516: # Apple disk partition stuff, strengthen the magic using byte 4
1517: 0 beshort 0x4552
1518: >4 byte 0 Apple Driver Map
1519: >>2 beshort x \b, blocksize %d
1520: >>4 belong x \b, blockcount %d
1521: >>10 beshort x \b, devtype %d
1522: >>12 beshort x \b, devid %d
1523: >>20 beshort x \b, descriptors %d
1524: # Assume 8 partitions each at a multiple of the sector size.
1525: # We could glean this from the partition descriptors, but they are empty!?!?
1526: >>(2.S*1) indirect \b, contains[@0x%x]:
1527: >>(2.S*2) indirect \b, contains[@0x%x]:
1528: >>(2.S*3) indirect \b, contains[@0x%x]:
1529: >>(2.S*4) indirect \b, contains[@0x%x]:
1530: >>(2.S*5) indirect \b, contains[@0x%x]:
1531: >>(2.S*6) indirect \b, contains[@0x%x]:
1532: >>(2.S*7) indirect \b, contains[@0x%x]:
1533: >>(2.S*8) indirect \b, contains[@0x%x]:
1534:
1535: # Yes, the 3rd and 4th bytes are reserved, but we use them to make the
1536: # magic stronger.
1537: 0 belong 0x504d0000 Apple Partition Map
1538: >4 belong x \b, map block count %d
1539: >8 belong x \b, start block %d
1540: >12 belong x \b, block count %d
1541: >16 string >0 \b, name %s
1542: >48 string >0 \b, type %s
1543: >124 string >0 \b, processor %s
1544: >140 string >0 \b, boot arguments %s
1545: >92 belong & 1 \b, valid
1546: >92 belong & 2 \b, allocated
1547: >92 belong & 4 \b, in use
1548: >92 belong & 8 \b, has boot info
1549: >92 belong & 16 \b, readable
1550: >92 belong & 32 \b, writable
1551: >92 belong & 64 \b, pic boot code
1552: >92 belong & 128 \b, chain compatible driver
1553: >92 belong & 256 \b, real driver
1554: >92 belong & 512 \b, chain driver
1555: >92 belong & 1024 \b, mount at startup
1556: >92 belong & 2048 \b, is the startup partition
1557:
1558: #http://wiki.mozilla.org/DS_Store_File_Format`
1559: #http://en.wikipedia.org/wiki/.DS_Store
1560: 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
1561:
1.1 misho 1562: #------------------------------------------------------------------------------
1.1.1.2 misho 1563: # $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 1564: # applix: file(1) magic for Applixware
1565: # From: Peter Soos <sp@osb.hu>
1566: #
1567: 0 string *BEGIN Applixware
1568: >7 string WORDS Words Document
1569: >7 string GRAPHICS Graphic
1570: >7 string RASTER Bitmap
1571: >7 string SPREADSHEETS Spreadsheet
1572: >7 string MACRO Macro
1573: >7 string BUILDER Builder Object
1574: #------------------------------------------------------------------------------
1.1.1.3 misho 1575: # $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $
1.1 misho 1576: # archive: file(1) magic for archive formats (see also "msdos" for self-
1577: # extracting compressed archives)
1578: #
1579: # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
1580: # pre-POSIX "tar" archives are handled in the C code.
1581:
1582: # POSIX tar archives
1583: 257 string ustar\0 POSIX tar archive
1584: !:mime application/x-tar # encoding: posix
1585: 257 string ustar\040\040\0 GNU tar archive
1586: !:mime application/x-tar # encoding: gnu
1587:
1.1.1.3 misho 1588: # Incremental snapshot gnu-tar format from:
1589: # http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
1590: 0 string GNU\ tar- GNU tar incremental snapshot data
1591: >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
1592:
1.1 misho 1593: # cpio archives
1594: #
1595: # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
1596: # The idea is to indicate archives produced on machines with the same
1597: # byte order as the machine running "file" with "cpio archive", and
1598: # to indicate archives produced on machines with the opposite byte order
1599: # from the machine running "file" with "byte-swapped cpio archive".
1600: #
1601: # The SVR4 "cpio(4)" hints that there are additional formats, but they
1602: # are defined as "short"s; I think all the new formats are
1603: # character-header formats and thus are strings, not numbers.
1604: 0 short 070707 cpio archive
1605: !:mime application/x-cpio
1606: 0 short 0143561 byte-swapped cpio archive
1607: !:mime application/x-cpio # encoding: swapped
1608: 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
1609: 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
1610: 0 string 070702 ASCII cpio archive (SVR4 with CRC)
1611:
1.1.1.3 misho 1612: #
1613: # Various archive formats used by various versions of the "ar"
1614: # command.
1615: #
1616:
1617: #
1618: # Original UNIX archive formats.
1619: # They were written with binary values in host byte order, and
1620: # the magic number was a host "int", which might have been 16 bits
1621: # or 32 bits. We don't say "PDP-11" or "VAX", as there might have
1622: # been ports to little-endian 16-bit-int or 32-bit-int platforms
1623: # (x86?) using some of those formats; if none existed, feel free
1624: # to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
1625: # 32-bit. There might have been big-endian ports of that sort as
1626: # well.
1627: #
1628: 0 leshort 0177555 very old 16-bit-int little-endian archive
1629: 0 beshort 0177555 very old 16-bit-int big-endian archive
1630: 0 lelong 0177555 very old 32-bit-int little-endian archive
1631: 0 belong 0177555 very old 32-bit-int big-endian archive
1632:
1633: 0 leshort 0177545 old 16-bit-int little-endian archive
1634: >2 string __.SYMDEF random library
1635: 0 beshort 0177545 old 16-bit-int big-endian archive
1636: >2 string __.SYMDEF random library
1637: 0 lelong 0177545 old 32-bit-int little-endian archive
1638: >4 string __.SYMDEF random library
1639: 0 belong 0177545 old 32-bit-int big-endian archive
1640: >4 string __.SYMDEF random library
1641:
1642: #
1643: # From "pdp" (but why a 4-byte quantity?)
1644: #
1645: 0 lelong 0x39bed PDP-11 old archive
1646: 0 lelong 0x39bee PDP-11 4.0 archive
1647:
1648: #
1649: # XXX - what flavor of APL used this, and was it a variant of
1650: # some ar archive format? It's similar to, but not the same
1651: # as, the APL workspace magic numbers in pdp.
1652: #
1653: 0 long 0100554 apl workspace
1654:
1655: #
1656: # System V Release 1 portable(?) archive format.
1657: #
1658: 0 string =<ar> System V Release 1 ar archive
1659: !:mime application/x-archive
1660:
1661: #
1662: # Debian package; it's in the portable archive format, and needs to go
1663: # before the entry for regular portable archives, as it's recognized as
1664: # a portable archive whose first member has a name beginning with
1665: # "debian".
1.1 misho 1666: #
1667: 0 string =!<arch>\ndebian
1668: !:mime application/x-debian-package
1669: >8 string debian-split part of multipart Debian package
1670: >8 string debian-binary Debian binary package
1671: >8 string !debian
1672: >68 string >\0 (format %s)
1673: # These next two lines do not work, because a bzip2 Debian archive
1674: # still uses gzip for the control.tar (first in the archive). Only
1675: # data.tar varies, and the location of its filename varies too.
1676: # file/libmagic does not current have support for ascii-string based
1677: # (offsets) as of 2005-09-15.
1678: #>81 string bz2 \b, uses bzip2 compression
1679: #>84 string gz \b, uses gzip compression
1680: #>136 ledate x created: %s
1681:
1.1.1.3 misho 1682: #
1683: # MIPS archive; they're in the portable archive format, and need to go
1684: # before the entry for regular portable archives, as it's recognized as
1685: # a portable archive whose first member has a name beginning with
1686: # "__________E".
1.1 misho 1687: #
1688: 0 string =!<arch>\n__________E MIPS archive
1.1.1.3 misho 1689: !:mime application/x-archive
1.1 misho 1690: >20 string U with MIPS Ucode members
1691: >21 string L with MIPSEL members
1692: >21 string B with MIPSEB members
1693: >19 string L and an EL hash table
1694: >19 string B and an EB hash table
1695: >22 string X -- out of date
1696:
1697: 0 search/1 -h- Software Tools format archive text
1698:
1699: #
1.1.1.3 misho 1700: # BSD/SVR2-and-later portable archive formats.
1.1 misho 1701: #
1702: 0 string =!<arch> current ar archive
1703: !:mime application/x-archive
1704: >8 string __.SYMDEF random library
1.1.1.3 misho 1705: >68 string __.SYMDEF\ SORTED random library
1706:
1.1 misho 1707: #
1.1.1.3 misho 1708: # "Thin" archive, as can be produced by GNU ar.
1.1 misho 1709: #
1.1.1.3 misho 1710: 0 string =!<thin>\n thin archive with
1711: >68 belong 0 no symbol entries
1712: >68 belong 1 %d symbol entry
1713: >68 belong >1 %d symbol entries
1.1 misho 1714:
1715: # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
1716: #
1717: # The first byte is the magic (0x1a), byte 2 is the compression type for
1718: # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
1719: # filename of the first file (null terminated). Since some types collide
1720: # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
1721: # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
1722: 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
1723: !:mime application/x-arc
1724: 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
1725: !:mime application/x-arc
1726: 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
1727: !:mime application/x-arc
1728: 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
1729: !:mime application/x-arc
1730: 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
1731: !:mime application/x-arc
1732: 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
1733: !:mime application/x-arc
1734: # [JW] stuff taken from idarc, obviously ARC successors:
1735: 0 lelong&0x8080ffff 0x00000a1a PAK archive data
1736: !:mime application/x-arc
1737: 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
1738: !:mime application/x-arc
1739: 0 lelong&0x8080ffff 0x0000481a HYP archive data
1740: !:mime application/x-arc
1741:
1742: # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
1743: # I can't create either SPARK or ArcFS archives so I have not tested this stuff
1744: # [GRR: the original entries collide with ARC, above; replaced with combined
1745: # version (not tested)]
1746: #0 byte 0x1a RISC OS archive (spark format)
1747: 0 string \032archive RISC OS archive (ArcFS format)
1748: 0 string Archive\000 RISC OS archive (ArcFS format)
1749:
1750: # All these were taken from idarc, many could not be verified. Unfortunately,
1751: # there were many low-quality sigs, i.e. easy to trigger false positives.
1752: # Please notify me of any real-world fishy/ambiguous signatures and I'll try
1753: # to get my hands on the actual archiver and see if I find something better. [JW]
1754: # probably many can be enhanced by finding some 0-byte or control char near the start
1755:
1756: # idarc calls this Crush/Uncompressed... *shrug*
1757: 0 string CRUSH Crush archive data
1758: # Squeeze It (.sqz)
1759: 0 string HLSQZ Squeeze It archive data
1760: # SQWEZ
1761: 0 string SQWEZ SQWEZ archive data
1762: # HPack (.hpk)
1763: 0 string HPAK HPack archive data
1764: # HAP
1765: 0 string \x91\x33HF HAP archive data
1766: # MD/MDCD
1767: 0 string MDmd MDCD archive data
1768: # LIM
1769: 0 string LIM\x1a LIM archive data
1770: # SAR
1771: 3 string LH5 SAR archive data
1772: # BSArc/BS2
1.1.1.3 misho 1773: 0 string \212\3SB\020\0 BSArc/BS2 archive data
1774: # Bethesda Softworks Archive (Oblivion)
1775: 0 string BSA\0 BSArc archive data
1776: >4 lelong x version %d
1.1 misho 1777: # MAR
1778: 2 string =-ah MAR archive data
1779: # ACB
1.1.1.3 misho 1780: #0 belong&0x00f800ff 0x00800000 ACB archive data
1.1 misho 1781: # CPZ
1782: # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
1783: # JRC
1784: 0 string JRchive JRC archive data
1785: # Quantum
1786: 0 string DS\0 Quantum archive data
1787: # ReSOF
1788: 0 string PK\3\6 ReSOF archive data
1789: # QuArk
1790: 0 string 7\4 QuArk archive data
1791: # YAC
1792: 14 string YC YAC archive data
1793: # X1
1794: 0 string X1 X1 archive data
1795: 0 string XhDr X1 archive data
1796: # CDC Codec (.dqt)
1797: 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
1798: # AMGC
1799: 0 string \xad6" AMGC archive data
1800: # NuLIB
1.1.1.3 misho 1801: 0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
1.1 misho 1802: # PakLeo
1803: 0 string LEOLZW PAKLeo archive data
1804: # ChArc
1805: 0 string SChF ChArc archive data
1806: # PSA
1807: 0 string PSA PSA archive data
1808: # CrossePAC
1809: 0 string DSIGDCC CrossePAC archive data
1810: # Freeze
1811: 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
1812: # KBoom
1.1.1.3 misho 1813: 0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
1.1 misho 1814: # NSQ, must go after CDC Codec
1815: 0 string \x76\xff NSQ archive data
1816: # DPA
1817: 0 string Dirk\ Paehl DPA archive data
1818: # BA
1819: # TODO: idarc says "bytes 0-2 == bytes 3-5"
1820: # TTComp
1821: 0 string \0\6 TTComp archive data
1822: # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
1823: 0 string ESP ESP archive data
1824: # ZPack
1825: 0 string \1ZPK\1 ZPack archive data
1826: # Sky
1827: 0 string \xbc\x40 Sky archive data
1828: # UFA
1829: 0 string UFA UFA archive data
1830: # Dry
1831: 0 string =-H2O DRY archive data
1832: # FoxSQZ
1833: 0 string FOXSQZ FoxSQZ archive data
1834: # AR7
1835: 0 string ,AR7 AR7 archive data
1836: # PPMZ
1837: 0 string PPMZ PPMZ archive data
1838: # MS Compress
1839: 4 string \x88\xf0\x27 MS Compress archive data
1840: # updated by Joerg Jenderek
1.1.1.3 misho 1841: >9 string \0
1842: >>0 string KWAJ
1.1 misho 1843: >>>7 string \321\003 MS Compress archive data
1844: >>>>14 ulong >0 \b, original size: %ld bytes
1.1.1.3 misho 1845: >>>>18 ubyte >0x65
1846: >>>>>18 string x \b, was %.8s
1847: >>>>>(10.b-4) string x \b.%.3s
1.1 misho 1848: # MP3 (archiver, not lossy audio compression)
1849: 0 string MP3\x1a MP3-Archiver archive data
1850: # ZET
1.1.1.3 misho 1851: 0 string OZ\xc3\x9d ZET archive data
1.1 misho 1852: # TSComp
1853: 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
1854: # ARQ
1855: 0 string gW\4\1 ARQ archive data
1856: # Squash
1857: 3 string OctSqu Squash archive data
1858: # Terse
1859: 0 string \5\1\1\0 Terse archive data
1860: # PUCrunch
1861: 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
1862: # UHarc
1863: 0 string UHA UHarc archive data
1864: # ABComp
1865: 0 string \2AB ABComp archive data
1866: 0 string \3AB2 ABComp archive data
1867: # CMP
1868: 0 string CO\0 CMP archive data
1869: # Splint
1870: 0 string \x93\xb9\x06 Splint archive data
1871: # InstallShield
1.1.1.3 misho 1872: 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
1.1 misho 1873: # Gather
1874: 1 string GTH Gather archive data
1875: # BOA
1876: 0 string BOA BOA archive data
1877: # RAX
1878: 0 string ULEB\xa RAX archive data
1879: # Xtreme
1880: 0 string ULEB\0 Xtreme archive data
1881: # Pack Magic
1.1.1.3 misho 1882: 0 string @\xc3\xa2\1\0 Pack Magic archive data
1.1 misho 1883: # BTS
1884: 0 belong&0xfeffffff 0x1a034465 BTS archive data
1885: # ELI 5750
1886: 0 string Ora\ ELI 5750 archive data
1887: # QFC
1888: 0 string \x1aFC\x1a QFC archive data
1889: 0 string \x1aQF\x1a QFC archive data
1890: # PRO-PACK
1891: 0 string RNC PRO-PACK archive data
1892: # 777
1893: 0 string 777 777 archive data
1894: # LZS221
1895: 0 string sTaC LZS221 archive data
1896: # HPA
1897: 0 string HPA HPA archive data
1898: # Arhangel
1899: 0 string LG Arhangel archive data
1900: # EXP1, uses bzip2
1901: 0 string 0123456789012345BZh EXP1 archive data
1902: # IMP
1903: 0 string IMP\xa IMP archive data
1904: # NRV
1905: 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
1906: # Squish
1907: 0 string \x73\xb2\x90\xf4 Squish archive data
1908: # Par
1909: 0 string PHILIPP Par archive data
1910: 0 string PAR Par archive data
1911: # HIT
1912: 0 string UB HIT archive data
1913: # SBX
1914: 0 belong&0xfffff000 0x53423000 SBX archive data
1915: # NaShrink
1916: 0 string NSK NaShrink archive data
1917: # SAPCAR
1918: 0 string #\ CAR\ archive\ header SAPCAR archive data
1919: 0 string CAR\ 2.00RG SAPCAR archive data
1920: # Disintegrator
1921: 0 string DST Disintegrator archive data
1922: # ASD
1923: 0 string ASD ASD archive data
1924: # InstallShield CAB
1925: 0 string ISc( InstallShield CAB
1926: # TOP4
1927: 0 string T4\x1a TOP4 archive data
1928: # BatComp left out: sig looks like COM executable
1929: # so TODO: get real 4dos batcomp file and find sig
1930: # BlakHole
1931: 0 string BH\5\7 BlakHole archive data
1932: # BIX
1933: 0 string BIX0 BIX archive data
1934: # ChiefLZA
1935: 0 string ChfLZ ChiefLZA archive data
1936: # Blink
1937: 0 string Blink Blink archive data
1938: # Logitech Compress
1939: 0 string \xda\xfa Logitech Compress archive data
1940: # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1941: 1 string (C)\ STEPANYUK ARS-Sfx archive data
1942: # AKT/AKT32
1943: 0 string AKT32 AKT32 archive data
1944: 0 string AKT AKT archive data
1945: # NPack
1946: 0 string MSTSM NPack archive data
1947: # PFT
1948: 0 string \0\x50\0\x14 PFT archive data
1949: # SemOne
1950: 0 string SEM SemOne archive data
1951: # PPMD
1952: 0 string \x8f\xaf\xac\x84 PPMD archive data
1953: # FIZ
1954: 0 string FIZ FIZ archive data
1955: # MSXiE
1956: 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
1957: # DeepFreezer
1958: 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
1959: # DC
1960: 0 string =<DC- DC archive data
1961: # TPac
1962: 0 string \4TPAC\3 TPac archive data
1963: # Ai
1964: 0 string Ai\1\1\0 Ai archive data
1965: 0 string Ai\1\0\0 Ai archive data
1966: # Ai32
1967: 0 string Ai\2\0 Ai32 archive data
1968: 0 string Ai\2\1 Ai32 archive data
1969: # SBC
1970: 0 string SBC SBC archive data
1971: # Ybs
1972: 0 string YBS Ybs archive data
1973: # DitPack
1974: 0 string \x9e\0\0 DitPack archive data
1975: # DMS
1976: 0 string DMS! DMS archive data
1977: # EPC
1978: 0 string \x8f\xaf\xac\x8c EPC archive data
1979: # VSARC
1980: 0 string VS\x1a VSARC archive data
1981: # PDZ
1982: 0 string PDZ PDZ archive data
1983: # ReDuq
1984: 0 string rdqx ReDuq archive data
1985: # GCA
1986: 0 string GCAX GCA archive data
1987: # PPMN
1988: 0 string pN PPMN archive data
1989: # WinImage
1990: 3 string WINIMAGE WinImage archive data
1991: # Compressia
1992: 0 string CMP0CMP Compressia archive data
1993: # UHBC
1994: 0 string UHB UHBC archive data
1995: # WinHKI
1996: 0 string \x61\x5C\x04\x05 WinHKI archive data
1997: # WWPack data file
1998: 0 string WWP WWPack archive data
1999: # BSN (BSA, PTS-DOS)
2000: 0 string \xffBSG BSN archive data
2001: 1 string \xffBSG BSN archive data
2002: 3 string \xffBSG BSN archive data
2003: 1 string \0\xae\2 BSN archive data
2004: 1 string \0\xae\3 BSN archive data
2005: 1 string \0\xae\7 BSN archive data
2006: # AIN
2007: 0 string \x33\x18 AIN archive data
2008: 0 string \x33\x17 AIN archive data
2009: # XPA32
2010: 0 string xpa\0\1 XPA32 archive data
2011: # SZip (TODO: doesn't catch all versions)
2012: 0 string SZ\x0a\4 SZip archive data
2013: # XPack DiskImage
2014: 0 string jm XPack DiskImage archive data
2015: # XPack Data
2016: 0 string xpa XPack archive data
2017: # XPack Single Data
1.1.1.3 misho 2018: 0 string \xc3\x8d\ jm XPack single archive data
1.1 misho 2019:
2020: # TODO: missing due to unknown magic/magic at end of file:
2021: #DWC
2022: #ARG
2023: #ZAR
2024: #PC/3270
2025: #InstallIt
2026: #RKive
2027: #RK
2028: #XPack Diskimage
2029:
2030: # These were inspired by idarc, but actually verified
2031: # Dzip archiver (.dz)
2032: 0 string DZ Dzip archive data
2033: >2 byte x \b, version %i
2034: >3 byte x \b.%i
2035: # ZZip archiver (.zz)
2036: 0 string ZZ\ \0\0 ZZip archive data
2037: 0 string ZZ0 ZZip archive data
2038: # PAQ archiver (.paq)
2039: 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
2040: 0 string PAQ PAQ archive data
2041: >3 byte&0xf0 0x30
2042: >>3 byte x (v%c)
2043: # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
2044: 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
2045: 0 string JARCS JAR (ARJ Software, Inc.) archive data
2046:
2047: # ARJ archiver (jason@jarthur.Claremont.EDU)
2048: 0 leshort 0xea60 ARJ archive data
2049: !:mime application/x-arj
2050: >5 byte x \b, v%d,
2051: >8 byte &0x04 multi-volume,
2052: >8 byte &0x10 slash-switched,
2053: >8 byte &0x20 backup,
2054: >34 string x original name: %s,
2055: >7 byte 0 os: MS-DOS
2056: >7 byte 1 os: PRIMOS
2057: >7 byte 2 os: Unix
2058: >7 byte 3 os: Amiga
2059: >7 byte 4 os: Macintosh
2060: >7 byte 5 os: OS/2
2061: >7 byte 6 os: Apple ][ GS
2062: >7 byte 7 os: Atari ST
2063: >7 byte 8 os: NeXT
2064: >7 byte 9 os: VAX/VMS
2065: >3 byte >0 %d]
2066: # [JW] idarc says this is also possible
2067: 2 leshort 0xea60 ARJ archive data
2068:
2069: # HA archiver (Greg Roelofs, newt@uchicago.edu)
2070: # This is a really bad format. A file containing HAWAII will match this...
2071: #0 string HA HA archive data,
2072: #>2 leshort =1 1 file,
2073: #>2 leshort >1 %u files,
2074: #>4 byte&0x0f =0 first is type CPY
2075: #>4 byte&0x0f =1 first is type ASC
2076: #>4 byte&0x0f =2 first is type HSC
2077: #>4 byte&0x0f =0x0e first is type DIR
2078: #>4 byte&0x0f =0x0f first is type SPECIAL
2079: # suggestion: at least identify small archives (<1024 files)
2080: 0 belong&0xffff00fc 0x48410000 HA archive data
2081: >2 leshort =1 1 file,
2082: >2 leshort >1 %u files,
2083: >4 byte&0x0f =0 first is type CPY
2084: >4 byte&0x0f =1 first is type ASC
2085: >4 byte&0x0f =2 first is type HSC
2086: >4 byte&0x0f =0x0e first is type DIR
2087: >4 byte&0x0f =0x0f first is type SPECIAL
2088:
2089: # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
2090: 0 string HPAK HPACK archive data
2091:
2092: # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
2093: 0 string \351,\001JAM\ JAM archive,
2094: >7 string >\0 version %.4s
2095: >0x26 byte =0x27 -
2096: >>0x2b string >\0 label %.11s,
2097: >>0x27 lelong x serial %08x,
2098: >>0x36 string >\0 fstype %.8s
2099:
2100: # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2101: 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
2102: !:mime application/x-lharc
2103: 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
2104: !:mime application/x-lharc
2105: 2 string -lz4- LHarc 1.x archive data [lz4]
2106: !:mime application/x-lharc
2107: 2 string -lz5- LHarc 1.x archive data [lz5]
2108: !:mime application/x-lharc
2109: # [never seen any but the last; -lh4- reported in comp.compression:]
2110: 2 string -lzs- LHa/LZS archive data [lzs]
2111: !:mime application/x-lha
2112: 2 string -lh\40- LHa 2.x? archive data [lh ]
2113: !:mime application/x-lha
2114: 2 string -lhd- LHa 2.x? archive data [lhd]
2115: !:mime application/x-lha
2116: 2 string -lh2- LHa 2.x? archive data [lh2]
2117: !:mime application/x-lha
2118: 2 string -lh3- LHa 2.x? archive data [lh3]
2119: !:mime application/x-lha
2120: 2 string -lh4- LHa (2.x) archive data [lh4]
2121: !:mime application/x-lha
2122: 2 string -lh5- LHa (2.x) archive data [lh5]
2123: !:mime application/x-lha
2124: 2 string -lh6- LHa (2.x) archive data [lh6]
2125: !:mime application/x-lha
2126: 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
2127: !:mime application/x-lha
2128: >20 byte x - header level %d
2129: # taken from idarc [JW]
2130: 2 string -lZ PUT archive data
1.1.1.3 misho 2131: 2 string -lz LZS archive data
1.1 misho 2132: 2 string -sw1- Swag archive data
2133:
2134: # RAR archiver (Greg Roelofs, newt@uchicago.edu)
2135: 0 string Rar! RAR archive data,
2136: !:mime application/x-rar
2137: >44 byte x v%0x,
2138: >10 byte >0 flags:
2139: >>10 byte &0x01 Archive volume,
2140: >>10 byte &0x02 Commented,
2141: >>10 byte &0x04 Locked,
2142: >>10 byte &0x08 Solid,
2143: >>10 byte &0x20 Authenticated,
2144: >35 byte 0 os: MS-DOS
2145: >35 byte 1 os: OS/2
2146: >35 byte 2 os: Win32
2147: >35 byte 3 os: Unix
2148: # some old version? idarc says:
2149: 0 string RE\x7e\x5e RAR archive data
2150:
2151: # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
2152: 0 string SQSH squished archive data (Acorn RISCOS)
2153:
2154: # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
2155: # [JW] see exe section for self-extracting version
2156: 0 string UC2\x1a UC2 archive data
2157:
1.1.1.2 misho 2158: # PKZIP multi-volume archive
2159: 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
2160: !:mime application/zip
2161:
1.1.1.3 misho 2162: # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2163: 0 string PK\005\006 Zip archive data (empty)
1.1 misho 2164: 0 string PK\003\004
2165:
1.1.1.3 misho 2166: # Specialised zip formats which start with a member named 'mimetype'
2167: # (stored uncompressed, with no 'extra field') containing the file's MIME type.
2168: # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
2169: # contents starting with "application/":
2170: >26 string \x8\0\0\0mimetypeapplication/
2171:
2172: # KOffice / OpenOffice & StarOffice / OpenDocument formats
2173: # From: Abel Cheung <abel@oaka.org>
1.1 misho 2174:
1.1.1.3 misho 2175: # KOffice (1.2 or above) formats
2176: # (mimetype contains "application/vnd.kde.<SUBTYPE>")
1.1.1.2 misho 2177: >>50 string vnd.kde. KOffice (>=1.2)
2178: >>>58 string karbon Karbon document
2179: >>>58 string kchart KChart document
2180: >>>58 string kformula KFormula document
2181: >>>58 string kivio Kivio document
2182: >>>58 string kontour Kontour document
2183: >>>58 string kpresenter KPresenter document
2184: >>>58 string kspread KSpread document
2185: >>>58 string kword KWord document
1.1 misho 2186:
1.1.1.3 misho 2187: # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
2188: # (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
1.1.1.2 misho 2189: >>50 string vnd.sun.xml. OpenOffice.org 1.x
2190: >>>62 string writer Writer
2191: >>>>68 byte !0x2e document
2192: >>>>68 string .template template
2193: >>>>68 string .global global document
2194: >>>62 string calc Calc
2195: >>>>66 byte !0x2e spreadsheet
2196: >>>>66 string .template template
2197: >>>62 string draw Draw
2198: >>>>66 byte !0x2e document
2199: >>>>66 string .template template
2200: >>>62 string impress Impress
2201: >>>>69 byte !0x2e presentation
2202: >>>>69 string .template template
2203: >>>62 string math Math document
2204: >>>62 string base Database file
1.1 misho 2205:
1.1.1.3 misho 2206: # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
2207: # http://lists.oasis-open.org/archives/office/200505/msg00006.html
2208: # (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
1.1.1.2 misho 2209: >>50 string vnd.oasis.opendocument. OpenDocument
2210: >>>73 string text
2211: >>>>77 byte !0x2d Text
1.1 misho 2212: !:mime application/vnd.oasis.opendocument.text
1.1.1.2 misho 2213: >>>>77 string -template Text Template
2214: !:mime application/vnd.oasis.opendocument.text-template
2215: >>>>77 string -web HTML Document Template
2216: !:mime application/vnd.oasis.opendocument.text-web
2217: >>>>77 string -master Master Document
2218: !:mime application/vnd.oasis.opendocument.text-master
2219: >>>73 string graphics
2220: >>>>81 byte !0x2d Drawing
2221: !:mime application/vnd.oasis.opendocument.graphics
2222: >>>>81 string -template Template
2223: !:mime application/vnd.oasis.opendocument.graphics-template
2224: >>>73 string presentation
2225: >>>>85 byte !0x2d Presentation
2226: !:mime application/vnd.oasis.opendocument.presentation
2227: >>>>85 string -template Template
2228: !:mime application/vnd.oasis.opendocument.presentation-template
2229: >>>73 string spreadsheet
2230: >>>>84 byte !0x2d Spreadsheet
2231: !:mime application/vnd.oasis.opendocument.spreadsheet
2232: >>>>84 string -template Template
2233: !:mime application/vnd.oasis.opendocument.spreadsheet-template
2234: >>>73 string chart
2235: >>>>78 byte !0x2d Chart
2236: !:mime application/vnd.oasis.opendocument.chart
2237: >>>>78 string -template Template
2238: !:mime application/vnd.oasis.opendocument.chart-template
2239: >>>73 string formula
2240: >>>>80 byte !0x2d Formula
2241: !:mime application/vnd.oasis.opendocument.formula
2242: >>>>80 string -template Template
2243: !:mime application/vnd.oasis.opendocument.formula-template
2244: >>>73 string database Database
2245: !:mime application/vnd.oasis.opendocument.database
2246: >>>73 string image
2247: >>>>78 byte !0x2d Image
2248: !:mime application/vnd.oasis.opendocument.image
2249: >>>>78 string -template Template
2250: !:mime application/vnd.oasis.opendocument.image-template
1.1 misho 2251:
1.1.1.3 misho 2252: # EPUB (OEBPS) books using OCF (OEBPS Container Format)
2253: # http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
2254: # From: Ralf Brown <ralf.brown@gmail.com>
2255: >0x1E string mimetypeapplication/epub+zip EPUB document
2256: !:mime application/epub+zip
2257:
2258: # Catch other ZIP-with-mimetype formats
2259: # In a ZIP file, the bytes immediately after a member's contents are
2260: # always "PK". The 2 regex rules here print the "mimetype" member's
2261: # contents up to the first 'P'. Luckily, most MIME types don't contain
2262: # any capital 'P's. This is a kludge.
2263: # (mimetype contains "application/<OTHER>")
2264: >>50 string !epub+zip
2265: >>>50 string !vnd.oasis.opendocument.
2266: >>>>50 string !vnd.sun.xml.
2267: >>>>>50 string !vnd.kde.
2268: >>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
2269: !:mime application/zip
2270: # (mimetype contents other than "application/*")
2271: >26 string \x8\0\0\0mimetype
2272: >>38 string !application/
2273: >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
2274: !:mime application/zip
2275:
2276: # Java Jar files
2277: >(26.s+30) leshort 0xcafe Java Jar file data (zip)
2278: !:mime application/jar
2279:
2280: # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
2281: # Next line excludes specialized formats:
2282: >(26.s+30) leshort !0xcafe
2283: >>26 string !\x8\0\0\0mimetype Zip archive data
2284: !:mime application/zip
2285: >>>4 byte 0x09 \b, at least v0.9 to extract
2286: >>>4 byte 0x0a \b, at least v1.0 to extract
2287: >>>4 byte 0x0b \b, at least v1.1 to extract
2288: >>>4 byte 0x14 \b, at least v2.0 to extract
2289: >>>4 byte 0x2d \b, at least v3.0 to extract
2290: >>>0x161 string WINZIP \b, WinZIP self-extracting
2291:
2292: # StarView Metafile
2293: # From Pierre Ducroquet <pinaraf@pinaraf.info>
2294: 0 string VCLMTF StarView MetaFile
2295: >6 beshort x \b, version %d
2296: >8 belong x \b, size %d
2297:
1.1 misho 2298: # Zoo archiver
2299: 20 lelong 0xfdc4a7dc Zoo archive data
2300: !:mime application/x-zoo
2301: >4 byte >48 \b, v%c.
2302: >>6 byte >47 \b%c
2303: >>>7 byte >47 \b%c
2304: >32 byte >0 \b, modify: v%d
2305: >>33 byte x \b.%d+
2306: >42 lelong 0xfdc4a7dc \b,
2307: >>70 byte >0 extract: v%d
2308: >>>71 byte x \b.%d+
2309:
2310: # Shell archives
2311: 10 string #\ This\ is\ a\ shell\ archive shell archive text
2312: !:mime application/octet-stream
2313:
2314: #
1.1.1.3 misho 2315: # LBR. NB: May conflict with the questionable
1.1 misho 2316: # "binary Computer Graphics Metafile" format.
2317: #
2318: 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
2319: #
2320: # PMA (CP/M derivative of LHA)
2321: #
2322: 2 string -pm0- PMarc archive data [pm0]
2323: 2 string -pm1- PMarc archive data [pm1]
2324: 2 string -pm2- PMarc archive data [pm2]
2325: 2 string -pms- PMarc SFX archive (CP/M, DOS)
2326: 5 string -pc1- PopCom compressed executable (CP/M)
2327:
2328: # From Rafael Laboissiere <rafael@laboissiere.net>
2329: # The Project Revision Control System (see
2330: # http://prcs.sourceforge.net) generates a packaged project
1.1.1.3 misho 2331: # file which is recognized by the following entry:
1.1 misho 2332: 0 leshort 0xeb81 PRCS packaged project
2333:
1.1.1.3 misho 2334: # Microsoft cabinets
1.1 misho 2335: # by David Necas (Yeti) <yeti@physics.muni.cz>
2336: #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
2337: #>25 byte x v%d
2338: #>24 byte x \b.%d
2339: # MPi: All CABs have version 1.3, so this is pointless.
2340: # Better magic in debian-additions.
2341:
1.1.1.3 misho 2342: # GTKtalog catalogs
1.1 misho 2343: # by David Necas (Yeti) <yeti@physics.muni.cz>
2344: 4 string gtktalog\ GTKtalog catalog data,
2345: >13 string 3 version 3
2346: >>14 beshort 0x677a (gzipped)
2347: >>14 beshort !0x677a (not gzipped)
2348: >13 string >3 version %s
2349:
2350: ############################################################################
2351: # Parity archive reconstruction file, the 'par' file format now used on Usenet.
2352: 0 string PAR\0 PARity archive data
2353: >48 leshort =0 - Index file
2354: >48 leshort >0 - file number %d
2355:
2356: # Felix von Leitner <felix-file@fefe.de>
2357: 0 string d8:announce BitTorrent file
2358: !:mime application/x-bittorrent
2359:
2360: # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
1.1.1.3 misho 2361: 0 beshort 0x0e0f Atari MSA archive data
2362: >2 beshort x \b, %d sectors per track
2363: >4 beshort 0 \b, 1 sided
2364: >4 beshort 1 \b, 2 sided
2365: >6 beshort x \b, starting track: %d
2366: >8 beshort x \b, ending track: %d
1.1 misho 2367:
2368: # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
2369: 0 string PK00PK\003\004 Zip archive data
2370:
2371: # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
2372: # by Stefan `Sec` Zehl <sec@42.org>
2373: 7 string **ACE** ACE archive data
2374: >15 byte >0 version %d
2375: >16 byte =0x00 \b, from MS-DOS
2376: >16 byte =0x01 \b, from OS/2
2377: >16 byte =0x02 \b, from Win/32
2378: >16 byte =0x03 \b, from Unix
2379: >16 byte =0x04 \b, from MacOS
2380: >16 byte =0x05 \b, from WinNT
2381: >16 byte =0x06 \b, from Primos
2382: >16 byte =0x07 \b, from AppleGS
2383: >16 byte =0x08 \b, from Atari
2384: >16 byte =0x09 \b, from Vax/VMS
2385: >16 byte =0x0A \b, from Amiga
2386: >16 byte =0x0B \b, from Next
2387: >14 byte x \b, version %d to extract
2388: >5 leshort &0x0080 \b, multiple volumes,
2389: >>17 byte x \b (part %d),
2390: >5 leshort &0x0002 \b, contains comment
2391: >5 leshort &0x0200 \b, sfx
2392: >5 leshort &0x0400 \b, small dictionary
2393: >5 leshort &0x0800 \b, multi-volume
2394: >5 leshort &0x1000 \b, contains AV-String
2395: >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
2396: >5 leshort &0x2000 \b, with recovery record
2397: >5 leshort &0x4000 \b, locked
2398: >5 leshort &0x8000 \b, solid
2399: # Date in MS-DOS format (whatever that is)
2400: #>18 lelong x Created on
2401:
2402: # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
2403: # <doj@cubic.org>
2404: 0x1A string sfArk sfArk compressed Soundfont
2405: >0x15 string 2
2406: >>0x1 string >\0 Version %s
2407: >>0x2A string >\0 : %s
2408:
2409: # DR-DOS 7.03 Packed File *.??_
2410: 0 string Packed\ File\ Personal NetWare Packed File
1.1.1.3 misho 2411: >12 string x \b, was "%.12s"
1.1 misho 2412:
2413: # EET archive
2414: # From: Tilman Sauerbeck <tilman@code-monkey.de>
2415: 0 belong 0x1ee7ff00 EET archive
2416: !:mime application/x-eet
2417:
2418: # rzip archives
2419: 0 string RZIP rzip compressed data
2420: >4 byte x - version %d
2421: >5 byte x \b.%d
2422: >6 belong x (%d bytes)
2423:
2424: # From: "Robert Dale" <robdale@gmail.com>
2425: 0 belong 123 dar archive,
2426: >4 belong x label "%.8x
2427: >>8 belong x %.8x
2428: >>>12 beshort x %.4x"
2429: >14 byte 0x54 end slice
2430: >14 beshort 0x4e4e multi-part
2431: >14 beshort 0x4e53 multi-part, with -S
2432:
2433: # Symbian installation files
2434: # http://www.thouky.co.uk/software/psifs/sis.html
2435: # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
2436: 8 lelong 0x10000419 Symbian installation file
2437: !:mime application/vnd.symbian.install
2438: >4 lelong 0x1000006D (EPOC release 3/4/5)
2439: >4 lelong 0x10003A12 (EPOC release 6)
2440: 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
2441: !:mime x-epoc/x-sisx-app
2442:
2443: # From "Nelson A. de Oliveira" <naoliv@gmail.com>
2444: 0 string MPQ\032 MoPaQ (MPQ) archive
2445:
2446: # From: Dirk Jagdmann <doj@cubic.org>
2447: # xar archive format: http://code.google.com/p/xar/
2448: 0 string xar! xar archive
2449: >6 beshort x - version %ld
2450:
2451: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2452: # .kgb
2453: 0 string KGB_arch KGB Archiver file
2454: >10 string x with compression level %.1s
2455:
2456: # xar (eXtensible ARchiver) archive
2457: # From: "David Remahl" <dremahl@apple.com>
2458: 0 string xar! xar archive
2459: #>4 beshort x header size %d
2460: >6 beshort x version %d,
2461: #>8 quad x compressed TOC: %d,
2462: #>16 quad x uncompressed TOC: %d,
2463: >24 belong 0 no checksum
2464: >24 belong 1 SHA-1 checksum
2465: >24 belong 2 MD5 checksum
2466:
2467: # Type: Parity Archive
2468: # From: Daniel van Eeden <daniel_e@dds.nl>
1.1.1.2 misho 2469: 0 string PAR2 Parity Archive Volume Set
2470:
2471: # Bacula volume format. (Volumes always start with a block header.)
2472: # URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
2473: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
2474: 12 string BB02 Bacula volume
2475: >20 bedate x \b, started %s
1.1 misho 2476:
1.1.1.3 misho 2477: # ePub is XHTML + XML inside a ZIP archive. The first member of the
2478: # archive must be an uncompressed file called 'mimetype' with contents
2479: # 'application/epub+zip'
2480:
2481:
2482: # From: "Michael Gorny" <mgorny@gentoo.org>
2483: # ZPAQ: http://mattmahoney.net/dc/zpaq.html
2484: 0 string zPQ ZPAQ stream
2485: >3 byte x \b, level %d
2486:
2487: # BBeB ebook, unencrypted (LRF format)
2488: # URL: http://www.sven.de/librie/Librie/LrfFormat
2489: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
2490: 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
2491: >8 beshort x \b, version %d
2492: >36 byte 1 \b, front-to-back
2493: >36 byte 16 \b, back-to-front
2494: >42 beshort x \b, (%dx,
2495: >44 beshort x %d)
2496: #------------------------------------------------------------------------------
2497: # $File: assembler,v 1.4 2013/01/04 23:31:11 christos Exp $
2498: # make: file(1) magic for assembler source
2499: #
2500: 0 regex \^[\020\t]*\\.asciiz assembler source text
2501: !:mime text/x-asm
2502: 0 regex \^[\020\t]*\\.byte assembler source text
2503: !:mime text/x-asm
2504: 0 regex \^[\020\t]*\\.even assembler source text
2505: !:mime text/x-asm
2506: 0 regex \^[\020\t]*\\.globl assembler source text
2507: !:mime text/x-asm
2508: 0 regex \^[\020\t]*\\.text assembler source text
2509: !:mime text/x-asm
2510: 0 regex \^[\020\t]*\\.file assembler source text
2511: !:mime text/x-asm
2512: 0 regex \^[\020\t]*\\.type assembler source text
2513: !:mime text/x-asm
2514:
1.1 misho 2515: #------------------------------------------------------------------------------
1.1.1.2 misho 2516: # $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 2517: # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
2518: # strings as "long" - we assume they're just strings:
2519: # From: guy@netapp.com (Guy Harris)
2520: #
2521: 0 string *STA Aster*x
2522: >7 string WORD Words Document
2523: >7 string GRAP Graphic
2524: >7 string SPRE Spreadsheet
2525: >7 string MACR Macro
2526: 0 string 2278 Aster*x Version 2
2527: >29 byte 0x36 Words Document
2528: >29 byte 0x35 Graphic
2529: >29 byte 0x32 Spreadsheet
2530: >29 byte 0x38 Macro
2531:
2532:
2533: #------------------------------------------------------------------------------
1.1.1.2 misho 2534: # $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 2535: # att3b: file(1) magic for AT&T 3B machines
2536: #
2537: # The `versions' should be un-commented if they work for you.
2538: # (Was the problem just one of endianness?)
2539: #
2540: # 3B20
2541: #
2542: # The 3B20 conflicts with SCCS.
2543: #0 beshort 0550 3b20 COFF executable
2544: #>12 belong >0 not stripped
2545: #>22 beshort >0 - version %ld
2546: #0 beshort 0551 3b20 COFF executable (TV)
2547: #>12 belong >0 not stripped
2548: #>22 beshort >0 - version %ld
2549: #
2550: # WE32K
2551: #
2552: 0 beshort 0560 WE32000 COFF
2553: >18 beshort ^00000020 object
2554: >18 beshort &00000020 executable
2555: >12 belong >0 not stripped
2556: >18 beshort ^00010000 N/A on 3b2/300 w/paging
2557: >18 beshort &00020000 32100 required
2558: >18 beshort &00040000 and MAU hardware required
2559: >20 beshort 0407 (impure)
2560: >20 beshort 0410 (pure)
2561: >20 beshort 0413 (demand paged)
2562: >20 beshort 0443 (target shared library)
2563: >22 beshort >0 - version %ld
2564: 0 beshort 0561 WE32000 COFF executable (TV)
2565: >12 belong >0 not stripped
2566: #>18 beshort &00020000 - 32100 required
2567: #>18 beshort &00040000 and MAU hardware required
2568: #>22 beshort >0 - version %ld
2569: #
2570: # core file for 3b2
2571: 0 string \000\004\036\212\200 3b2 core file
2572: >364 string >\0 of '%s'
1.1.1.2 misho 2573:
1.1 misho 2574: #------------------------------------------------------------------------------
1.1.1.3 misho 2575: # $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $
1.1 misho 2576: # audio: file(1) magic for sound formats (see also "iff")
2577: #
2578: # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
2579: # and others
2580: #
2581:
2582: # Sun/NeXT audio data
2583: 0 string .snd Sun/NeXT audio data:
2584: >12 belong 1 8-bit ISDN mu-law,
2585: !:mime audio/basic
2586: >12 belong 2 8-bit linear PCM [REF-PCM],
2587: !:mime audio/basic
2588: >12 belong 3 16-bit linear PCM,
2589: !:mime audio/basic
2590: >12 belong 4 24-bit linear PCM,
2591: !:mime audio/basic
2592: >12 belong 5 32-bit linear PCM,
2593: !:mime audio/basic
2594: >12 belong 6 32-bit IEEE floating point,
2595: !:mime audio/basic
2596: >12 belong 7 64-bit IEEE floating point,
2597: !:mime audio/basic
2598: >12 belong 8 Fragmented sample data,
2599: >12 belong 10 DSP program,
2600: >12 belong 11 8-bit fixed point,
2601: >12 belong 12 16-bit fixed point,
2602: >12 belong 13 24-bit fixed point,
2603: >12 belong 14 32-bit fixed point,
2604: >12 belong 18 16-bit linear with emphasis,
2605: >12 belong 19 16-bit linear compressed,
2606: >12 belong 20 16-bit linear with emphasis and compression,
2607: >12 belong 21 Music kit DSP commands,
2608: >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2609: !:mime audio/x-adpcm
2610: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2611: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2612: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2613: >12 belong 27 8-bit A-law (CCITT G.711),
2614: >20 belong 1 mono,
2615: >20 belong 2 stereo,
2616: >20 belong 4 quad,
2617: >16 belong >0 %d Hz
2618:
2619: # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
2620: # that uses little-endian encoding and has a different magic number
2621: 0 lelong 0x0064732E DEC audio data:
2622: >12 lelong 1 8-bit ISDN mu-law,
2623: !:mime audio/x-dec-basic
2624: >12 lelong 2 8-bit linear PCM [REF-PCM],
2625: !:mime audio/x-dec-basic
2626: >12 lelong 3 16-bit linear PCM,
2627: !:mime audio/x-dec-basic
2628: >12 lelong 4 24-bit linear PCM,
2629: !:mime audio/x-dec-basic
2630: >12 lelong 5 32-bit linear PCM,
2631: !:mime audio/x-dec-basic
2632: >12 lelong 6 32-bit IEEE floating point,
2633: !:mime audio/x-dec-basic
2634: >12 lelong 7 64-bit IEEE floating point,
2635: !:mime audio/x-dec-basic
2636: >12 belong 8 Fragmented sample data,
2637: >12 belong 10 DSP program,
2638: >12 belong 11 8-bit fixed point,
2639: >12 belong 12 16-bit fixed point,
2640: >12 belong 13 24-bit fixed point,
2641: >12 belong 14 32-bit fixed point,
2642: >12 belong 18 16-bit linear with emphasis,
2643: >12 belong 19 16-bit linear compressed,
2644: >12 belong 20 16-bit linear with emphasis and compression,
2645: >12 belong 21 Music kit DSP commands,
2646: >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
2647: !:mime audio/x-dec-basic
2648: >12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
2649: >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
2650: >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
2651: >12 belong 27 8-bit A-law (CCITT G.711),
2652: >20 lelong 1 mono,
2653: >20 lelong 2 stereo,
2654: >20 lelong 4 quad,
2655: >16 lelong >0 %d Hz
2656:
2657: # Creative Labs AUDIO stuff
2658: 0 string MThd Standard MIDI data
2659: !:mime audio/midi
2660: >8 beshort x (format %d)
2661: >10 beshort x using %d track
2662: >10 beshort >1 \bs
2663: >12 beshort&0x7fff x at 1/%d
2664: >12 beshort&0x8000 >0 SMPTE
2665:
2666: 0 string CTMF Creative Music (CMF) data
2667: !:mime audio/x-unknown
2668: 0 string SBI SoundBlaster instrument data
2669: !:mime audio/x-unknown
2670: 0 string Creative\ Voice\ File Creative Labs voice data
2671: !:mime audio/x-unknown
2672: # is this next line right? it came this way...
2673: >19 byte 0x1A
2674: >23 byte >0 - version %d
2675: >22 byte >0 \b.%d
2676:
2677: # first entry is also the string "NTRK"
2678: 0 belong 0x4e54524b MultiTrack sound data
2679: >4 belong x - version %ld
2680:
2681: # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
2682: # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
2683: 0 string EMOD Extended MOD sound data,
2684: >4 byte&0xf0 x version %d
2685: >4 byte&0x0f x \b.%d,
2686: >45 byte x %d instruments
2687: >83 byte 0 (module)
2688: >83 byte 1 (song)
2689:
2690: # Real Audio (Magic .ra\0375)
2691: 0 belong 0x2e7261fd RealAudio sound file
2692: !:mime audio/x-pn-realaudio
2693: 0 string .RMF\0\0\0 RealMedia file
2694: !:mime application/vnd.rn-realmedia
2695: #video/x-pn-realvideo
2696: #video/vnd.rn-realvideo
2697: #application/vnd.rn-realmedia
2698: # sigh, there are many mimes for that but the above are the most common.
2699:
2700: # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
2701: # Oct 31, 1995
2702: # fixed by <doj@cubic.org> 2003-06-24
2703: # Too short...
2704: #0 string MTM MultiTracker Module sound file
2705: #0 string if Composer 669 Module sound data
2706: #0 string JN Composer 669 Module sound data (extended format)
2707: 0 string MAS_U ULT(imate) Module sound data
2708:
2709: #0 string FAR Module sound data
2710: #>4 string >\15 Title: "%s"
2711:
2712: 0x2c string SCRM ScreamTracker III Module sound data
2713: >0 string >\0 Title: "%s"
2714:
2715: # Gravis UltraSound patches
2716: # From <ache@nagual.ru>
2717:
2718: 0 string GF1PATCH110\0ID#000002\0 GUS patch
2719: 0 string GF1PATCH100\0ID#000002\0 Old GUS patch
2720:
2721: # mime types according to http://www.geocities.com/nevilo/mod.htm:
2722: # audio/it .it
2723: # audio/x-zipped-it .itz
2724: # audio/xm fasttracker modules
2725: # audio/x-s3m screamtracker modules
2726: # audio/s3m screamtracker modules
2727: # audio/x-zipped-mod mdz
2728: # audio/mod mod
2729: # audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
2730:
2731: #
2732: # Taken from loader code from mikmod version 2.14
2733: # by Steve McIntyre (stevem@chiark.greenend.org.uk)
2734: # <doj@cubic.org> added title printing on 2003-06-24
2735: 0 string MAS_UTrack_V00
2736: >14 string >/0 ultratracker V1.%.1s module sound data
2737: !:mime audio/x-mod
2738: #audio/x-tracker-module
2739:
2740: 0 string UN05 MikMod UNI format module sound data
2741:
2742: 0 string Extended\ Module: Fasttracker II module sound data
2743: !:mime audio/x-mod
2744: #audio/x-tracker-module
2745: >17 string >\0 Title: "%s"
2746:
2747: 21 string/c =!SCREAM! Screamtracker 2 module sound data
2748: !:mime audio/x-mod
2749: #audio/x-screamtracker-module
2750: 21 string BMOD2STM Screamtracker 2 module sound data
2751: !:mime audio/x-mod
2752: #audio/x-screamtracker-module
2753: 1080 string M.K. 4-channel Protracker module sound data
2754: !:mime audio/x-mod
2755: #audio/x-protracker-module
2756: >0 string >\0 Title: "%s"
2757: 1080 string M!K! 4-channel Protracker module sound data
2758: !:mime audio/x-mod
2759: #audio/x-protracker-module
2760: >0 string >\0 Title: "%s"
2761: 1080 string FLT4 4-channel Startracker module sound data
2762: !:mime audio/x-mod
2763: #audio/x-startracker-module
2764: >0 string >\0 Title: "%s"
2765: 1080 string FLT8 8-channel Startracker module sound data
2766: !:mime audio/x-mod
2767: #audio/x-startracker-module
2768: >0 string >\0 Title: "%s"
2769: 1080 string 4CHN 4-channel Fasttracker module sound data
2770: !:mime audio/x-mod
2771: #audio/x-fasttracker-module
2772: >0 string >\0 Title: "%s"
2773: 1080 string 6CHN 6-channel Fasttracker module sound data
2774: !:mime audio/x-mod
2775: #audio/x-fasttracker-module
2776: >0 string >\0 Title: "%s"
2777: 1080 string 8CHN 8-channel Fasttracker module sound data
2778: !:mime audio/x-mod
2779: #audio/x-fasttracker-module
2780: >0 string >\0 Title: "%s"
2781: 1080 string CD81 8-channel Octalyser module sound data
2782: !:mime audio/x-mod
2783: #audio/x-octalysertracker-module
2784: >0 string >\0 Title: "%s"
2785: 1080 string OKTA 8-channel Octalyzer module sound data
2786: !:mime audio/x-mod
2787: #audio/x-octalysertracker-module
2788: >0 string >\0 Title: "%s"
2789: # Not good enough.
2790: #1082 string CH
2791: #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
2792: 1080 string 16CN 16-channel Taketracker module sound data
2793: !:mime audio/x-mod
2794: #audio/x-taketracker-module
2795: >0 string >\0 Title: "%s"
2796: 1080 string 32CN 32-channel Taketracker module sound data
2797: !:mime audio/x-mod
2798: #audio/x-taketracker-module
2799: >0 string >\0 Title: "%s"
2800:
2801: # TOC sound files -Trevor Johnson <trevor@jpj.net>
2802: #
2803: 0 string TOC TOC sound file
2804:
2805: # sidfiles <pooka@iki.fi>
2806: # added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
2807: 0 string SIDPLAY\ INFOFILE Sidplay info file
2808:
2809: 0 string PSID PlaySID v2.2+ (AMIGA) sidtune
2810: >4 beshort >0 w/ header v%d,
2811: >14 beshort =1 single song,
2812: >14 beshort >1 %d songs,
2813: >16 beshort >0 default song: %d
2814: >0x16 string >\0 name: "%s"
2815: >0x36 string >\0 author: "%s"
2816: >0x56 string >\0 copyright: "%s"
2817:
2818: 0 string RSID RSID sidtune PlaySID compatible
2819: >4 beshort >0 w/ header v%d,
2820: >14 beshort =1 single song,
2821: >14 beshort >1 %d songs,
2822: >16 beshort >0 default song: %d
2823: >0x16 string >\0 name: "%s"
2824: >0x36 string >\0 author: "%s"
2825: >0x56 string >\0 copyright: "%s"
2826:
1.1.1.3 misho 2827: # IRCAM sound files - Michael Pruett <michael@68k.org>
2828: # http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
2829: 0 belong 0x64a30100 IRCAM file (VAX little-endian)
2830: 0 belong 0x0001a364 IRCAM file (VAX big-endian)
2831: 0 belong 0x64a30200 IRCAM file (Sun big-endian)
2832: 0 belong 0x0002a364 IRCAM file (Sun little-endian)
1.1 misho 2833: 0 belong 0x64a30300 IRCAM file (MIPS little-endian)
1.1.1.3 misho 2834: 0 belong 0x0003a364 IRCAM file (MIPS big-endian)
2835: 0 belong 0x64a30400 IRCAM file (NeXT big-endian)
2836: 0 belong 0x64a30400 IRCAM file (NeXT big-endian)
2837: 0 belong 0x0004a364 IRCAM file (NeXT little-endian)
1.1 misho 2838:
2839: # NIST SPHERE <mpruett@sgi.com>
2840: 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
2841:
2842: # Sample Vision <mpruett@sgi.com>
2843: 0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
2844:
2845: # Audio Visual Research <tonigonenstein@users.sourceforge.net>
2846: 0 string 2BIT Audio Visual Research file,
2847: >12 beshort =0 mono,
2848: >12 beshort =-1 stereo,
2849: >14 beshort x %d bits
2850: >16 beshort =0 unsigned,
2851: >16 beshort =-1 signed,
2852: >22 belong&0x00ffffff x %d Hz,
2853: >18 beshort =0 no loop,
2854: >18 beshort =-1 loop,
2855: >21 ubyte <128 note %d,
2856: >22 byte =0 replay 5.485 KHz
2857: >22 byte =1 replay 8.084 KHz
1.1.1.2 misho 2858: >22 byte =2 replay 10.971 KHz
2859: >22 byte =3 replay 16.168 KHz
1.1 misho 2860: >22 byte =4 replay 21.942 KHz
2861: >22 byte =5 replay 32.336 KHz
2862: >22 byte =6 replay 43.885 KHz
2863: >22 byte =7 replay 47.261 KHz
2864:
2865: # SGI SoundTrack <mpruett@sgi.com>
2866: 0 string _SGI_SoundTrack SGI SoundTrack project file
2867: # ID3 version 2 tags <waschk@informatik.uni-rostock.de>
1.1.1.2 misho 2868: 0 string ID3 Audio file with ID3 version 2
2869: >3 byte x \b.%d
2870: >4 byte x \b.%d
2871: >>5 byte &0x80 \b, unsynchronized frames
2872: >>5 byte &0x40 \b, extended header
2873: >>5 byte &0x20 \b, experimental
2874: >>5 byte &0x10 \b, footer present
2875: >(6.I) indirect x \b, contains:
1.1 misho 2876:
2877: # NSF (NES sound file) magic
2878: 0 string NESM\x1a NES Sound File
2879: >14 string >\0 ("%s" by
2880: >46 string >\0 %s, copyright
2881: >78 string >\0 %s),
2882: >5 byte x version %d,
2883: >6 byte x %d tracks,
2884: >122 byte&0x2 =1 dual PAL/NTSC
2885: >122 byte&0x1 =1 PAL
2886: >122 byte&0x1 =0 NTSC
2887:
2888: # Type: SNES SPC700 sound files
2889: # From: Josh Triplett <josh@freedesktop.org>
2890: 0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
2891: >&0 string 0.30 \b, version %s
2892: >>0x23 byte 0x1B \b, without ID666 tag
2893: >>0x23 byte 0x1A \b, with ID666 tag
2894: >>>0x2E string >\0 \b, song "%.32s"
2895: >>>0x4E string >\0 \b, game "%.32s"
2896:
2897: # Impulse tracker module (audio/x-it)
2898: 0 string IMPM Impulse Tracker module sound data -
2899: !:mime audio/x-mod
2900: >4 string >\0 "%s"
2901: >40 leshort !0 compatible w/ITv%x
2902: >42 leshort !0 created w/ITv%x
2903:
2904: # Imago Orpheus module (audio/x-imf)
2905: 60 string IM10 Imago Orpheus module sound data -
2906: >0 string >\0 "%s"
2907:
2908: # From <collver1@attbi.com>
2909: # These are the /etc/magic entries to decode modules, instruments, and
2910: # samples in Impulse Tracker's native format.
2911:
2912: 0 string IMPS Impulse Tracker Sample
2913: >18 byte &2 16 bit
2914: >18 byte ^2 8 bit
2915: >18 byte &4 stereo
2916: >18 byte ^4 mono
2917: 0 string IMPI Impulse Tracker Instrument
2918: >28 leshort !0 ITv%x
2919: >30 byte !0 %d samples
2920:
2921: # Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
2922: # From <collver1@attbi.com>
2923: 0 string LM8953 Yamaha TX Wave
2924: >22 byte 0x49 looped
2925: >22 byte 0xC9 non-looped
2926: >23 byte 1 33kHz
2927: >23 byte 2 50kHz
2928: >23 byte 3 16kHz
2929:
2930: # scream tracker: file(1) magic for Scream Tracker sample files
2931: #
2932: # From <collver1@attbi.com>
2933: 76 string SCRS Scream Tracker Sample
2934: >0 byte 1 sample
2935: >0 byte 2 adlib melody
2936: >0 byte >2 adlib drum
2937: >31 byte &2 stereo
2938: >31 byte ^2 mono
2939: >31 byte &4 16bit little endian
2940: >31 byte ^4 8bit
2941: >30 byte 0 unpacked
2942: >30 byte 1 packed
2943:
2944: # audio
2945: # From: Cory Dikkers <cdikkers@swbell.net>
2946: 0 string MMD0 MED music file, version 0
2947: 0 string MMD1 OctaMED Pro music file, version 1
2948: 0 string MMD3 OctaMED Soundstudio music file, version 3
2949: 0 string OctaMEDCmpr OctaMED Soundstudio compressed file
2950: 0 string MED MED_Song
2951: 0 string SymM Symphonie SymMOD music file
2952: #
2953: 0 string THX AHX version
2954: >3 byte =0 1 module data
2955: >3 byte =1 2 module data
2956: #
2957: 0 string OKTASONG Oktalyzer module data
2958: #
2959: 0 string DIGI\ Booster\ module\0 %s
2960: >20 byte >0 %c
2961: >>21 byte >0 \b%c
2962: >>>22 byte >0 \b%c
2963: >>>>23 byte >0 \b%c
2964: >610 string >\0 \b, "%s"
2965: #
2966: 0 string DBM0 DIGI Booster Pro Module
2967: >4 byte >0 V%X.
2968: >>5 byte x \b%02X
2969: >16 string >\0 \b, "%s"
2970: #
2971: 0 string FTMN FaceTheMusic module
2972: >16 string >\0d \b, "%s"
2973:
2974: # From: <doj@cubic.org> 2003-06-24
2975: 0 string AMShdr\32 Velvet Studio AMS Module v2.2
2976: 0 string Extreme Extreme Tracker AMS Module v1.3
2977: 0 string DDMF Xtracker DMF Module
2978: >4 byte x v%i
2979: >0xD string >\0 Title: "%s"
2980: >0x2B string >\0 Composer: "%s"
2981: 0 string DSM\32 Dynamic Studio Module DSM
2982: 0 string SONG DigiTrekker DTM Module
2983: 0 string DMDL DigiTrakker MDL Module
2984: 0 string PSM\32 Protracker Studio PSM Module
2985: 44 string PTMF Poly Tracker PTM Module
2986: >0 string >\32 Title: "%s"
2987: 0 string MT20 MadTracker 2.0 Module MT2
2988: 0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
2989: 0 string RTMM RTM Module
2990: 0x426 string MaDoKaN96 XMS Adlib Module
2991: >0 string >\0 Composer: "%s"
2992: 0 string AMF AMF Module
2993: >4 string >\0 Title: "%s"
2994: 0 string MODINFO1 Open Cubic Player Module Inforation MDZ
2995: 0 string Extended\40Instrument: Fast Tracker II Instrument
2996:
2997: # From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
2998: # NOA Nancy Codec file
2999: 0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
3000: # Yamaha SMAF format
3001: 0 string MMMD Yamaha SMAF file
3002: # Sharp Jisaku Melody format for PDC
3003: 0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
3004: >20 string Ver01.00 Ver. 1.00
3005: >>32 byte x , %d tracks
3006:
3007: # Free lossless audio codec <http://flac.sourceforge.net>
3008: # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
3009: 0 string fLaC FLAC audio bitstream data
3010: !:mime audio/x-flac
3011: >4 byte&0x7f >0 \b, unknown version
3012: >4 byte&0x7f 0 \b
3013: # some common bits/sample values
3014: >>20 beshort&0x1f0 0x030 \b, 4 bit
3015: >>20 beshort&0x1f0 0x050 \b, 6 bit
3016: >>20 beshort&0x1f0 0x070 \b, 8 bit
3017: >>20 beshort&0x1f0 0x0b0 \b, 12 bit
3018: >>20 beshort&0x1f0 0x0f0 \b, 16 bit
3019: >>20 beshort&0x1f0 0x170 \b, 24 bit
3020: >>20 byte&0xe 0x0 \b, mono
3021: >>20 byte&0xe 0x2 \b, stereo
3022: >>20 byte&0xe 0x4 \b, 3 channels
3023: >>20 byte&0xe 0x6 \b, 4 channels
3024: >>20 byte&0xe 0x8 \b, 5 channels
3025: >>20 byte&0xe 0xa \b, 6 channels
3026: >>20 byte&0xe 0xc \b, 7 channels
3027: >>20 byte&0xe 0xe \b, 8 channels
3028: # some common sample rates
3029: >>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
3030: >>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
3031: >>17 belong&0xfffff0 0x07d000 \b, 32 kHz
3032: >>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
3033: >>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
3034: >>17 belong&0xfffff0 0x03e800 \b, 16 kHz
3035: >>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
3036: >>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
3037: >>17 belong&0xfffff0 0x01f400 \b, 8 kHz
3038: >>17 belong&0xfffff0 0x177000 \b, 96 kHz
3039: >>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
3040: >>21 byte&0xf >0 \b, >4G samples
3041: >>21 byte&0xf 0 \b
3042: >>>22 belong >0 \b, %u samples
3043: >>>22 belong 0 \b, length unknown
3044:
3045: # (ISDN) VBOX voice message file (Wolfram Kleff)
3046: 0 string VBOX VBOX voice message data
3047:
3048: # ReBorn Song Files (.rbs)
3049: # David J. Singer <doc@deadvirgins.org.uk>
3050: 8 string RB40 RBS Song file
3051: >29 string ReBorn created by ReBorn
3052: >37 string Propellerhead created by ReBirth
3053:
3054: # Synthesizer Generator and Kimwitu share their file format
3055: 0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
3056: # Kimwitu++ uses a slightly different magic
3057: 0 string A#S#C#S#S#L#HUB Kimwitu++ data
3058:
3059: # From "Simon Hosie
3060: 0 string TFMX-SONG TFMX module sound data
3061:
3062: # Monkey's Audio compressed audio format (.ape)
3063: # From danny.milo@gmx.net (Danny Milosavljevic)
3064: # New version from Abel Cheung <abel (@) oaka.org>
3065: 0 string MAC\040 Monkey's Audio compressed format
1.1.1.3 misho 3066: !:mime audio/x-ape
1.1 misho 3067: >4 uleshort >0x0F8B version %d
3068: >>(0x08.l) uleshort =1000 with fast compression
3069: >>(0x08.l) uleshort =2000 with normal compression
3070: >>(0x08.l) uleshort =3000 with high compression
3071: >>(0x08.l) uleshort =4000 with extra high compression
3072: >>(0x08.l) uleshort =5000 with insane compression
3073: >>(0x08.l+18) uleshort =1 \b, mono
3074: >>(0x08.l+18) uleshort =2 \b, stereo
3075: >>(0x08.l+20) ulelong x \b, sample rate %d
3076: >4 uleshort <0x0F8C version %d
3077: >>6 uleshort =1000 with fast compression
3078: >>6 uleshort =2000 with normal compression
3079: >>6 uleshort =3000 with high compression
3080: >>6 uleshort =4000 with extra high compression
3081: >>6 uleshort =5000 with insane compression
3082: >>10 uleshort =1 \b, mono
3083: >>10 uleshort =2 \b, stereo
3084: >>12 ulelong x \b, sample rate %d
3085:
3086: # adlib sound files
1.1.1.3 misho 3087: # From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
1.1 misho 3088: 0 string RAWADATA RdosPlay RAW
3089:
3090: 1068 string RoR AMUSIC Adlib Tracker
3091:
3092: 0 string JCH EdLib
3093:
3094: 0 string mpu401tr MPU-401 Trakker
3095:
3096: 0 string SAdT Surprise! Adlib Tracker
3097: >4 byte x Version %d
3098:
3099: 0 string XAD! eXotic ADlib
3100:
3101: 0 string ofTAZ! eXtra Simple Music
3102:
3103: # Spectrum 128 tunes (.ay files).
3104: # From: Emanuel Haupt <ehaupt@critical.ch>
3105: 0 string ZXAYEMUL Spectrum 128 tune
3106:
3107: 0 string \0BONK BONK,
3108: #>5 byte x version %d
3109: >14 byte x %d channel(s),
3110: >15 byte =1 lossless,
3111: >15 byte =0 lossy,
3112: >16 byte x mid-side
3113:
3114: 384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
3115:
3116: # format VQF (proprietary codec for sound)
3117: # some infos on the header file available at :
3118: # http://www.twinvq.org/english/technology_format.html
3119: 0 string TWIN97012000 VQF data
3120: >27 short 0 \b, Mono
3121: >27 short 1 \b, Stereo
3122: >31 short >0 \b, %d kbit/s
3123: >35 short >0 \b, %d kHz
3124:
3125: # Nelson A. de Oliveira (naoliv@gmail.com)
3126: # .eqf
3127: 0 string Winamp\ EQ\ library\ file %s
3128: # it will match only versions like v<digit>.<digit>
3129: # Since I saw only eqf files with version v1.1 I think that it's OK
3130: >23 string x \b%.4s
3131: # .preset
3132: 0 string [Equalizer\ preset] XMMS equalizer preset
3133: # .m3u
3134: 0 search/1 #EXTM3U M3U playlist text
3135: # .pls
3136: 0 search/1 [playlist] PLS playlist text
3137: # licq.conf
3138: 1 string [licq] LICQ configuration file
3139:
3140: # Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
3141: 0 string ICE! SNDH Atari ST music
3142: 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
3143:
3144: # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
3145: 0 string MP+ Musepack audio
1.1.1.3 misho 3146: !:mime audio/x-musepack
1.1 misho 3147: >3 byte 255 \b, SV pre8
3148: >3 byte&0xF 0x6 \b, SV 6
3149: >3 byte&0xF 0x8 \b, SV 8
3150: >3 byte&0xF 0x7 \b, SV 7
3151: >>3 byte&0xF0 0x0 \b.0
3152: >>3 byte&0xF0 0x10 \b.1
3153: >>3 byte&0xF0 240 \b.15
3154: >>10 byte&0xF0 0x0 \b, no profile
3155: >>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
3156: >>10 byte&0xF0 0x50 \b, quality 0
3157: >>10 byte&0xF0 0x60 \b, quality 1
3158: >>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
3159: >>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
3160: >>10 byte&0xF0 0x90 \b, quality 4 (Radio)
3161: >>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
3162: >>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
3163: >>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
3164: >>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
3165: >>10 byte&0xF0 0xE0 \b, quality 9
3166: >>10 byte&0xF0 0xF0 \b, quality 10
3167: >>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
3168: >>27 byte 102 \b, Beta 1.02
3169: >>27 byte 104 \b, Beta 1.04
3170: >>27 byte 105 \b, Alpha 1.05
3171: >>27 byte 106 \b, Beta 1.06
3172: >>27 byte 110 \b, Release 1.1
3173: >>27 byte 111 \b, Alpha 1.11
3174: >>27 byte 112 \b, Beta 1.12
3175: >>27 byte 113 \b, Alpha 1.13
3176: >>27 byte 114 \b, Beta 1.14
3177: >>27 byte 115 \b, Alpha 1.15
3178:
3179: # IMY
3180: # from http://filext.com/detaillist.php?extdetail=IMY
3181: # http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
3182: # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
3183: # http://www.wx800.com/msg/download/irda/iMelody.pdf
3184: 0 string BEGIN:IMELODY iMelody Ringtone Format
3185:
3186: # From: "Mateus Caruccio" <mateus@caruccio.com>
3187: # guitar pro v3,4,5 from http://filext.com/file-extension/gp3
3188: 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
3189:
3190: # From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
3191: 60 string SONG SoundFX Module sound file
3192:
3193: # Type: Adaptive Multi-Rate Codec
3194: # URL: http://filext.com/detaillist.php?extdetail=AMR
3195: # From: Russell Coker <russell@coker.com.au>
3196: 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
3197:
3198: # Type: SuperCollider 3 Synth Definition File Format
3199: # From: Mario Lang <mlang@debian.org>
3200: 0 string SCgf SuperCollider3 Synth Definition file,
3201: >4 belong x version %d
1.1.1.2 misho 3202:
1.1.1.3 misho 3203: # Type: True Audio Lossless Audio
3204: # URL: http://wiki.multimedia.cx/index.php?title=True_Audio
3205: # From: Mike Melanson <mike@multimedia.cx>
3206: 0 string TTA1 True Audio Lossless Audio
3207:
3208: # Type: WavPack Lossless Audio
3209: # URL: http://wiki.multimedia.cx/index.php?title=WavPack
3210: # From: Mike Melanson <mike@multimedia.cx>
3211: 0 string wvpk WavPack Lossless Audio
3212:
1.1 misho 3213: #----------------------------------------------------------------
1.1.1.2 misho 3214: # $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3215: # basis: file(1) magic for BBx/Pro5-files
3216: # Oliver Dammer <dammer@olida.de> 2005/11/07
3217: # http://www.basis.com business-basic-files.
3218: #
3219: 0 string \074\074bbx\076\076 BBx
3220: >7 string \000 indexed file
3221: >7 string \001 serial file
3222: >7 string \002 keyed file
3223: >>13 short 0 (sort)
3224: >7 string \004 program
3225: >>18 byte x (LEVEL %d)
3226: >>>23 string >\000 psaved
3227: >7 string \006 mkeyed file
3228: >>13 short 0 (sort)
3229: >>8 string \000 (mkey)
1.1.1.2 misho 3230:
1.1 misho 3231: #------------------------------------------------------------------------------
1.1.1.2 misho 3232: # $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3233: # bFLT: file(1) magic for BFLT uclinux binary files
3234: #
3235: # From Philippe De Muyter <phdm@macqel.be>
3236: #
3237: 0 string bFLT BFLT executable
3238: >4 belong x - version %ld
3239: >4 belong 4
3240: >>36 belong&0x1 0x1 ram
3241: >>36 belong&0x2 0x2 gotpic
3242: >>36 belong&0x4 0x4 gzip
3243: >>36 belong&0x8 0x8 gzdata
1.1.1.2 misho 3244: # Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
3245: # http://ftg.lbl.gov/checkpoint
3246: 0 string C\0\0\0R\0\0\0 BLCR
3247: >16 lelong 1 x86
3248: >16 lelong 3 alpha
3249: >16 lelong 5 x86-64
3250: >16 lelong 7 ARM
3251: >8 lelong x context data (little endian, version %d)
3252: # Uncomment the following only of your "file" program supports "search"
3253: #>0 search/1024 VMA\06 for kernel
3254: #>>&1 byte x %d.
3255: #>>&2 byte x %d.
3256: #>>&3 byte x %d
3257: 0 string \0\0\0C\0\0\0R BLCR
3258: >16 belong 2 SPARC
3259: >16 belong 4 ppc
3260: >16 belong 6 ppc64
3261: >16 belong 7 ARMEB
3262: >16 belong 8 SPARC64
3263: >8 belong x context data (big endian, version %d)
3264: # Uncomment the following only of your "file" program supports "search"
3265: #>0 search/1024 VMA\06 for kernel
3266: #>>&1 byte x %d.
1.1.1.3 misho 3267: #>>&2 byte x \b%d.
3268: #>>&3 byte x \b%d
1.1.1.2 misho 3269:
1.1 misho 3270: #------------------------------------------------------------------------------
1.1.1.2 misho 3271: # $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3272: # blender: file(1) magic for Blender 3D related files
3273: #
3274: # Native format rule v1.2. For questions use the developers list
3275: # http://lists.blender.org/mailman/listinfo/bf-committers
3276: # GLOB chunk was moved near start and provides subversion info since 2.42
3277:
3278: 0 string =BLENDER Blender3D,
3279: >7 string =_ saved as 32-bits
3280: >>8 string =v little endian
3281: >>>9 byte x with version %c.
3282: >>>10 byte x \b%c
3283: >>>11 byte x \b%c
3284: >>>0x40 string =GLOB \b.
3285: >>>>0x58 leshort x \b%.4d
3286: >>8 string =V big endian
3287: >>>9 byte x with version %c.
3288: >>>10 byte x \b%c
3289: >>>11 byte x \b%c
3290: >>>0x40 string =GLOB \b.
3291: >>>>0x58 beshort x \b%.4d
3292: >7 string =- saved as 64-bits
3293: >>8 string =v little endian
3294: >>9 byte x with version %c.
3295: >>10 byte x \b%c
3296: >>11 byte x \b%c
3297: >>0x44 string =GLOB \b.
3298: >>>0x60 leshort x \b%.4d
3299: >>8 string =V big endian
3300: >>>9 byte x with version %c.
3301: >>>10 byte x \b%c
3302: >>>11 byte x \b%c
3303: >>>0x44 string =GLOB \b.
3304: >>>>0x60 beshort x \b%.4d
3305:
1.1.1.4 misho 3306: # Scripts that run in the embedded Python interpreter
1.1 misho 3307: 0 string #!BPY Blender3D BPython script
3308:
3309: #------------------------------------------------------------------------------
1.1.1.2 misho 3310: # $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
1.1 misho 3311: # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
3312: #
3313: # Note that this 0407 conflicts with several other a.out formats...
3314: #
3315: # XXX - should this be redone with "be" and "le", so that it works on
3316: # little-endian machines as well? If so, what's the deal with
3317: # "VAX-order" and "VAX-order2"?
3318: #
3319: #0 long 0407 68K Blit (standalone) executable
3320: #0 short 0407 VAX-order2 68K Blit (standalone) executable
3321: 0 short 03401 VAX-order 68K Blit (standalone) executable
3322: 0 long 0406 68k Blit mpx/mux executable
3323: 0 short 0406 VAX-order2 68k Blit mpx/mux executable
3324: 0 short 03001 VAX-order 68k Blit mpx/mux executable
3325: # Need more values for WE32 DMD executables.
3326: # Note that 0520 is the same as COFF
3327: #0 short 0520 tty630 layers executable
1.1.1.2 misho 3328:
3329: #------------------------------------------------------------------------------
3330: # $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3331: # i80960 b.out objects and archives
3332: #
3333: 0 long 0x10d i960 b.out relocatable object
3334: >16 long >0 not stripped
3335: #
3336: # b.out archive (hp-rt on i960)
3337: 0 string =!<bout> b.out archive
3338: >8 string __.SYMDEF random library
1.1.1.2 misho 3339:
1.1 misho 3340: #------------------------------------------------------------------------------
1.1.1.3 misho 3341: # $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
1.1 misho 3342: # bsdi: file(1) magic for BSD/OS (from BSDI) objects
1.1.1.3 misho 3343: # Some object/executable formats use the same magic numbers as are used
3344: # in other OSes; those are handled by entries in aout.
1.1 misho 3345: #
3346:
3347: 0 lelong 0314 386 compact demand paged pure executable
3348: >16 lelong >0 not stripped
3349: >32 byte 0x6a (uses shared libs)
3350:
3351: # same as in SunOS 4.x, except for static shared libraries
3352: 0 belong&077777777 0600413 sparc demand paged
3353: >0 byte &0x80
3354: >>20 belong <4096 shared library
3355: >>20 belong =4096 dynamically linked executable
3356: >>20 belong >4096 dynamically linked executable
3357: >0 byte ^0x80 executable
3358: >16 belong >0 not stripped
3359: >36 belong 0xb4100001 (uses shared libs)
3360:
3361: 0 belong&077777777 0600410 sparc pure
3362: >0 byte &0x80 dynamically linked executable
3363: >0 byte ^0x80 executable
3364: >16 belong >0 not stripped
3365: >36 belong 0xb4100001 (uses shared libs)
3366:
3367: 0 belong&077777777 0600407 sparc
3368: >0 byte &0x80 dynamically linked executable
3369: >0 byte ^0x80 executable
3370: >16 belong >0 not stripped
3371: >36 belong 0xb4100001 (uses shared libs)
1.1.1.2 misho 3372: # Chiasmus is a encryption standard developed by the German Federal
3373: # Office for Information Security (Bundesamt fuer Sicherheit in der
3374: # Informationstechnik).
3375:
3376: # Extension: .xia
3377: 0 string XIA1 Chiasmus encrypted data
3378:
3379: # Extension: .xis
3380: 0 string XIS Chiasmus key
3381:
1.1 misho 3382: #------------------------------------------------------------------------------
1.1.1.2 misho 3383: # $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3384: # BTSnoop: file(1) magic for BTSnoop files
3385: #
3386: # From <marcel@holtmann.org>
3387: 0 string btsnoop\0 BTSnoop
3388: >8 belong x version %d,
3389: >12 belong 1001 Unencapsulated HCI
3390: >12 belong 1002 HCI UART (H4)
3391: >12 belong 1003 HCI BCSP
3392: >12 belong 1004 HCI Serial (H5)
3393: >>12 belong x type %d
3394:
3395: #------------------------------------------------------------------------------
1.1.1.2 misho 3396: # $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3397: # c64: file(1) magic for various commodore 64 related files
3398: #
3399: # From: Dirk Jagdmann <doj@cubic.org>
3400:
3401: 0x16500 belong 0x12014100 D64 Image
3402: 0x16500 belong 0x12014180 D71 Image
3403: 0x61800 belong 0x28034400 D81 Image
3404: 0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
3405: 0 belong 0x43154164 X64 Image
3406:
3407: 0 string GCR-1541 GCR Image
3408: >8 byte x version: %i
3409: >9 byte x tracks: %i
3410:
3411: 9 string PSUR ARC archive (c64)
3412: 2 string -LH1- LHA archive (c64)
3413:
3414: 0 string C64File PC64 Emulator file
3415: >8 string >\0 "%s"
3416: 0 string C64Image PC64 Freezer Image
3417:
3418: 0 beshort 0x38CD C64 PCLink Image
3419: 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
3420:
3421: 0 belong 0xFF424CFF WRAptor packer (c64)
3422:
3423: 0 string C64S\x20tape\x20file T64 tape Image
3424: >32 leshort x Version:0x%x
3425: >36 leshort !0 Entries:%i
3426: >40 string x Name:%.24s
3427:
3428: 0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3429: >32 leshort x Version:0x%x
3430: >36 leshort !0 Entries:%i
3431: >40 string x Name:%.24s
3432:
3433: 0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
3434: >32 leshort x Version:0x%x
3435: >36 leshort !0 Entries:%i
3436: >40 string x Name:%.24s
3437:
3438: #------------------------------------------------------------------------------
1.1.1.3 misho 3439: # $File: cad,v 1.11 2011/12/08 12:12:46 rrt Exp $
1.1 misho 3440: # autocad: file(1) magic for cad files
3441: #
3442:
3443: # AutoCAD DWG versions R13/R14 (www.autodesk.com)
3444: # Written December 01, 2003 by Lester Hightower
3445: # Based on the DWG File Format Specifications at http://www.opendwg.org/
3446: 0 string \101\103\061\060\061 AutoCAD
3447: >5 string \062\000\000\000\000 DWG ver. R13
3448: >5 string \064\000\000\000\000 DWG ver. R14
3449:
3450: # Microstation DGN/CIT Files (www.bentley.com)
3451: # Last updated July 29, 2005 by Lester Hightower
3452: # DGN is the default file extension of Microstation/Intergraph CAD files.
3453: # CIT is the proprietary raster format (similar to TIFF) used to attach
3454: # raster underlays to Microstation DGN (vector) drawings.
3455: #
3456: # http://www.wotsit.org/search.asp
3457: # http://filext.com/detaillist.php?extdetail=DGN
3458: # http://filext.com/detaillist.php?extdetail=CIT
3459: #
3460: # http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
3461: # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
3462: # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
3463: # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
3464: 0 string \010\011\376 Microstation
3465: >3 string \002
3466: >>30 string \026\105 DGNFile
3467: >>30 string \034\105 DGNFile
3468: >>30 string \073\107 DGNFile
3469: >>30 string \073\110 DGNFile
3470: >>30 string \106\107 DGNFile
3471: >>30 string \110\103 DGNFile
3472: >>30 string \120\104 DGNFile
3473: >>30 string \172\104 DGNFile
3474: >>30 string \172\105 DGNFile
3475: >>30 string \172\106 DGNFile
3476: >>30 string \234\106 DGNFile
3477: >>30 string \273\105 DGNFile
3478: >>30 string \306\106 DGNFile
3479: >>30 string \310\104 DGNFile
3480: >>30 string \341\104 DGNFile
3481: >>30 string \372\103 DGNFile
3482: >>30 string \372\104 DGNFile
3483: >>30 string \372\106 DGNFile
3484: >>30 string \376\103 DGNFile
3485: >4 string \030\000\000 CITFile
3486: >4 string \030\000\003 CITFile
3487:
3488: # AutoCad, from Nahuel Greco
3489: # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
1.1.1.3 misho 3490: 0 string AC1012 DWG AutoDesk AutoCad (release 12)
3491: 0 string AC1013 DWG AutoDesk AutoCad (release 13)
3492: 0 string AC1014 DWG AutoDesk AutoCad (release 14)
3493: # A new version of AutoCAD DWG
3494: # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3495: # ICQ 358572321)
3496: # From various sources like:
3497: # http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
3498: 0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
3499: 0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
3500: 0 string AC1024 DWG AutoDesk AutoCAD 2010/2011
3501:
3502: # KOMPAS 2D drawing from ASCON
3503: # This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
3504: # gathered nor specification
3505: # ASCON http://ascon.net/main/ in English,
3506: # http://ascon.ru/ main site in Russian
3507: # Extension is CDW for drawing and FRW for fragment of drawing
3508: # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
3509: # ICQ 358572321, http://vkontakte.ru/id16076543)
3510: # From:
3511: # http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
3512: # (in russian) and my experiments
3513: 0 string KF
3514: >2 belong 0x4E00000C Kompas drawing 12.0 SP1
3515: >2 belong 0x4D00000C Kompas drawing 12.0
3516: >2 belong 0x3200000B Kompas drawing 11.0 SP1
3517: >2 belong 0x3100000B Kompas drawing 11.0
3518: >2 belong 0x2310000A Kompas drawing 10.0 SP1
3519: >2 belong 0x2110000A Kompas drawing 10.0
3520: >2 belong 0x08000009 Kompas drawing 9.0 SP1
3521: >2 belong 0x05000009 Kompas drawing 9.0
3522: >2 belong 0x33010008 Kompas drawing 8+
3523: >2 belong 0x1A000008 Kompas drawing 8.0
3524: >2 belong 0x2C010107 Kompas drawing 7+
3525: >2 belong 0x05000007 Kompas drawing 7.0
3526: >2 belong 0x32000006 Kompas drawing 6+
3527: >2 belong 0x09000006 Kompas drawing 6.0
3528: >2 belong 0x5C009005 Kompas drawing 5.11R03
3529: >2 belong 0x54009005 Kompas drawing 5.11R02
3530: >2 belong 0x51009005 Kompas drawing 5.11R01
3531: >2 belong 0x22009005 Kompas drawing 5.10R03
3532: >2 belong 0x22009005 Kompas drawing 5.10R02 mar
3533: >2 belong 0x21009005 Kompas drawing 5.10R02 febr
3534: >2 belong 0x19009005 Kompas drawing 5.10R01
3535: >2 belong 0xF4008005 Kompas drawing 5.9R01.003
3536: >2 belong 0x1C008005 Kompas drawing 5.9R01.002
3537: >2 belong 0x11008005 Kompas drawing 5.8R01.003
1.1 misho 3538:
3539: # CAD: file(1) magic for computer aided design files
3540: # Phillip Griffith <phillip dot griffith at gmail dot com>
3541: # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
3542: #
3543: 0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
3544: 0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3545: 0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
3546: 0 beshort 0x0809 Bentley/Intergraph MicroStation
3547: >0x02 byte 0xfe
3548: >>0x04 beshort 0x1800 CIT raster CAD
3549: 0 string AC1012 AutoDesk AutoCAD R13
3550: 0 string AC1014 AutoDesk AutoCAD R14
3551: 0 string AC1015 AutoDesk AutoCAD R2000
1.1.1.2 misho 3552:
1.1.1.3 misho 3553: # 3DS (3d Studio files) Conflicts with diff output 0x3d '='
3554: #16 beshort 0x3d3d image/x-3ds
3555:
1.1 misho 3556: #------------------------------------------------------------------------------
1.1.1.3 misho 3557: # $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $
1.1 misho 3558: # Cafe Babes unite!
3559: #
1.1.1.3 misho 3560: # Since Java bytecode and Mach-O universal binaries have the same magic number,
3561: # the test must be performed in the same "magic" sequence to get both right.
3562: # The long at offset 4 in a Mach-O universal binary tells the number of
3563: # architectures; the short at offset 4 in a Java bytecode file is the JVM minor
3564: # version and the short at offset 6 is the JVM major version. Since there are only
1.1 misho 3565: # only 18 labeled Mach-O architectures at current, and the first released
3566: # Java class format was version 43.0, we can safely choose any number
3567: # between 18 and 39 to test the number of architectures against
3568: # (and use as a hack). Let's not use 18, because the Mach-O people
3569: # might add another one or two as time goes by...
3570: #
1.1.1.3 misho 3571: ### JAVA START ###
1.1.1.2 misho 3572: 0 belong 0xcafebabe
1.1 misho 3573: !:mime application/x-java-applet
1.1.1.2 misho 3574: >4 belong >30 compiled Java class data,
3575: >>6 beshort x version %d.
3576: >>4 beshort x \b%d
3577: # Which is which?
3578: #>>4 belong 0x032d (Java 1.0)
3579: #>>4 belong 0x032d (Java 1.1)
3580: >>4 belong 0x002e (Java 1.2)
3581: >>4 belong 0x002f (Java 1.3)
3582: >>4 belong 0x0030 (Java 1.4)
3583: >>4 belong 0x0031 (Java 1.5)
3584: >>4 belong 0x0032 (Java 1.6)
3585:
1.1.1.3 misho 3586: 0 belong 0xcafed00d JAR compressed with pack200,
3587: >5 byte x version %d.
3588: >4 byte x \b%d
3589: !:mime application/x-java-pack200
1.1.1.2 misho 3590:
3591:
3592: 0 belong 0xcafed00d JAR compressed with pack200,
1.1.1.3 misho 3593: >5 byte x version %d.
3594: >4 byte x \b%d
1.1 misho 3595: !:mime application/x-java-pack200
1.1.1.2 misho 3596:
1.1.1.3 misho 3597: ### JAVA END ###
3598: ### MACH-O START ###
3599:
3600: 0 name mach-o \b [
3601: >0 use mach-o-cpu \b
3602: >&(8.L) indirect \b:
3603: >0 belong x \b]
3604:
3605: 0 belong 0xcafebabe
3606: >4 belong 1 Mach-O universal binary with 1 architecture:
3607: >>8 use mach-o \b
3608: >4 belong >1
3609: >>4 belong <20 Mach-O universal binary with %ld architectures:
3610: >>>8 use mach-o \b
3611: >>>28 use mach-o \b
3612: >>4 belong >2
3613: >>>48 use mach-o \b
3614: >>4 belong >3
3615: >>>68 use mach-o \b
3616:
3617: ### MACH-O END ###
3618:
1.1 misho 3619: #------------------------------------------------------------------------------
1.1.1.2 misho 3620: # $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3621: # CDDB: file(1) magic for CDDB(tm) format CD text data files
3622: #
3623: # From <steve@gracenote.com>
3624: #
3625: # This is the /etc/magic entry to decode datafiles as used by
3626: # CDDB-enabled CD player applications.
3627: #
3628:
1.1.1.2 misho 3629: 0 search/1/w #\040xmcd CDDB(tm) format CD text data
1.1 misho 3630:
3631: #------------------------------------------------------------------------------
1.1.1.3 misho 3632: # $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
1.1 misho 3633: # chord: file(1) magic for Chord music sheet typesetting utility input files
3634: #
3635: # From Philippe De Muyter <phdm@macqel.be>
3636: # File format is actually free, but many distributed files begin with `{title'
3637: #
3638: 0 string {title Chord text file
3639:
3640: # Type: PowerTab file format
3641: # URL: http://www.power-tab.net/
3642: # From: Jelmer Vernooij <jelmer@samba.org>
3643: 0 string ptab\003\000 Power-Tab v3 Tablature File
3644: 0 string ptab\004\000 Power-Tab v4 Tablature File
1.1.1.2 misho 3645:
1.1 misho 3646: #------------------------------------------------------------------------------
1.1.1.2 misho 3647: # $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3648: # cisco: file(1) magic for cisco Systems routers
3649: #
3650: # Most cisco file-formats are covered by the generic elf code
3651: #
3652: # Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
3653: 0 belong&0xffffff00 0x85011400 cisco IOS microcode
3654: >7 string >\0 for '%s'
3655: 0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
3656: >7 string >\0 for '%s'
1.1.1.2 misho 3657:
1.1 misho 3658: #------------------------------------------------------------------------------
1.1.1.2 misho 3659: # $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3660: # citrus locale declaration
3661: #
3662:
3663: 0 string RuneCT Citrus locale declaration for LC_CTYPE
3664:
3665: #------------------------------------------------------------------------------
1.1.1.3 misho 3666: # $File: c-lang,v 1.17 2012/04/28 21:20:26 christos Exp $
3667: # c-lang: file(1) magic for C and related languages programs
1.1.1.2 misho 3668: #
3669:
1.1.1.3 misho 3670: # BCPL
3671: 0 search/8192 "libhdr" BCPL source text
3672: !:mime text/x-bcpl
3673: 0 search/8192 "LIBHDR" BCPL source text
3674: !:mime text/x-bcpl
3675:
3676: # C
3677: 0 regex \^#include C source text
3678: !:mime text/x-c
3679: 0 regex \^char C source text
3680: !:mime text/x-c
3681: 0 regex \^double C source text
3682: !:mime text/x-c
3683: 0 regex \^extern C source text
3684: !:mime text/x-c
3685: 0 regex \^float C source text
3686: !:mime text/x-c
3687: 0 regex \^struct C source text
3688: !:mime text/x-c
3689: 0 regex \^union C source text
3690: !:mime text/x-c
3691: 0 search/8192 main( C source text
3692: !:mime text/x-c
3693:
3694: # C++
3695: # The strength of these rules is increased so they beat the C rules above
3696: 0 regex \^template C++ source text
3697: !:strength + 5
3698: !:mime text/x-c++
3699: 0 regex \^virtual C++ source text
3700: !:strength + 5
3701: !:mime text/x-c++
3702: 0 regex \^class C++ source text
3703: !:strength + 5
3704: !:mime text/x-c++
3705: 0 regex \^public: C++ source text
3706: !:strength + 5
3707: !:mime text/x-c++
3708: 0 regex \^private: C++ source text
3709: !:strength + 5
3710: !:mime text/x-c++
1.1.1.2 misho 3711:
3712: # From: Mikhail Teterin <mi@aldan.algebra.com>
3713: 0 string cscope cscope reference data
3714: >7 string x version %.2s
3715: # We skip the path here, because it is often long (so file will
3716: # truncate it) and mostly redundant.
3717: # The inverted index functionality was added some time betwen
3718: # versions 11 and 15, so look for -q if version is above 14:
3719: >7 string >14
3720: >>10 search/100 \ -q\ with inverted index
3721: >10 search/100 \ -c\ text (non-compressed)
3722:
3723: #------------------------------------------------------------------------------
3724: # $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 3725: # clarion: file(1) magic for # Clarion Personal/Professional Developer
3726: # (v2 and above)
3727: # From: Julien Blache <jb@jblache.org>
3728:
3729: # Database files
3730: # signature
3731: 0 leshort 0x3343 Clarion Developer (v2 and above) data file
3732: # attributes
3733: >2 leshort &0x0001 \b, locked
3734: >2 leshort &0x0004 \b, encrypted
3735: >2 leshort &0x0008 \b, memo file exists
3736: >2 leshort &0x0010 \b, compressed
3737: >2 leshort &0x0040 \b, read only
3738: # number of records
3739: >5 lelong x \b, %ld records
3740:
3741: # Memo files
3742: 0 leshort 0x334d Clarion Developer (v2 and above) memo data
3743:
3744: # Key/Index files
3745: # No magic? :(
3746:
3747: # Help files
3748: 0 leshort 0x49e0 Clarion Developer (v2 and above) help data
3749:
3750: #------------------------------------------------------------------------------
1.1.1.3 misho 3751: # $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $
1.1 misho 3752: # claris: file(1) magic for claris
3753: # "H. Nanosecond" <aldomel@ix.netcom.com>
3754: # Claris Works a word processor, etc.
3755: # Version 3.0
3756:
3757: # .pct claris works clip art files
3758: #0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
3759: #*
3760: #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
3761: #null to byte 1000 octal
1.1.1.3 misho 3762: 514 string \377\377\377\377\000
3763: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
3764: 514 string \377\377\377\377\001
3765: >0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
1.1 misho 3766:
3767: # Claris works files
3768: # .cwk
3769: 0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
3770: # .plt
3771: 0 string \020\341\000\000\010\010 Claris Works pallete files .plt
3772:
3773: # .msp a dictionary file I am not sure about this I have only one .msp file
3774: 0 string \002\271\262\000\040\002\000\164 Claris works dictionary
3775:
3776: # .usp are user dictionary bits
3777: # I am not sure about a magic header:
3778: #0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
3779: # soh S p f 8 U D sp ^ S cr nl p o d i
3780: #0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
3781: # a t r i s t sp ^ S cr nl d i v sp #
3782:
3783: # .mth Thesaurus
3784: # starts with \0 but no magic header
3785:
3786: # .chy Hyphenation file
3787: # I am not sure: 000 210 034 000 000
3788:
3789: # other claris files
3790: #./windows/claris/useng.ndx: data
3791: #./windows/claris/xtndtran.l32: data
3792: #./windows/claris/xtndtran.lst: data
3793: #./windows/claris/clworks.lbl: data
3794: #./windows/claris/clworks.prf: data
3795: #./windows/claris/userd.spl: data
3796:
3797: #------------------------------------------------------------------------------
1.1.1.2 misho 3798: # $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
1.1 misho 3799: # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
3800: #
3801: # XXX - what byte order does the Clipper use?
3802: #
3803: # XXX - what's the "!" stuff:
3804: #
3805: # >18 short !074000,000000 C1 R1
3806: # >18 short !074000,004000 C2 R1
3807: # >18 short !074000,010000 C3 R1
3808: # >18 short !074000,074000 TEST
3809: #
3810: # I shall assume it's ANDing the field with the first value and
3811: # comparing it with the second, and rewrite it as:
3812: #
3813: # >18 short&074000 000000 C1 R1
3814: # >18 short&074000 004000 C2 R1
3815: # >18 short&074000 010000 C3 R1
3816: # >18 short&074000 074000 TEST
3817: #
3818: # as SVR3.1's "file" doesn't support anything of the "!074000,000000"
3819: # sort, nor does SunOS 4.x, so either it's something Intergraph added
3820: # in CLIX, or something AT&T added in SVR3.2 or later, or something
3821: # somebody else thought was a good idea; it's not documented in the
3822: # man page for this version of "magic", nor does it appear to be
3823: # implemented (at least not after I blew off the bogus code to turn
3824: # old-style "&"s into new-style "&"s, which just didn't work at all).
3825: #
3826: 0 short 0575 CLIPPER COFF executable (VAX #)
3827: >20 short 0407 (impure)
3828: >20 short 0410 (5.2 compatible)
3829: >20 short 0411 (pure)
3830: >20 short 0413 (demand paged)
3831: >20 short 0443 (target shared library)
3832: >12 long >0 not stripped
3833: >22 short >0 - version %ld
3834: 0 short 0577 CLIPPER COFF executable
3835: >18 short&074000 000000 C1 R1
3836: >18 short&074000 004000 C2 R1
3837: >18 short&074000 010000 C3 R1
3838: >18 short&074000 074000 TEST
3839: >20 short 0407 (impure)
3840: >20 short 0410 (pure)
3841: >20 short 0411 (separate I&D)
3842: >20 short 0413 (paged)
3843: >20 short 0443 (target shared library)
3844: >12 long >0 not stripped
3845: >22 short >0 - version %ld
3846: >48 long&01 01 alignment trap enabled
3847: >52 byte 1 -Ctnc
3848: >52 byte 2 -Ctsw
3849: >52 byte 3 -Ctpw
3850: >52 byte 4 -Ctcb
3851: >53 byte 1 -Cdnc
3852: >53 byte 2 -Cdsw
3853: >53 byte 3 -Cdpw
3854: >53 byte 4 -Cdcb
3855: >54 byte 1 -Csnc
3856: >54 byte 2 -Cssw
3857: >54 byte 3 -Cspw
3858: >54 byte 4 -Cscb
3859: 4 string pipe CLIPPER instruction trace
3860: 4 string prof CLIPPER instruction profile
3861:
3862: #------------------------------------------------------------------------------
1.1.1.3 misho 3863: # $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
1.1 misho 3864: # commands: file(1) magic for various shells and interpreters
3865: #
1.1.1.3 misho 3866: #0 string/w : shell archive or script for antique kernel text
3867: 0 string/wt #!\ /bin/sh POSIX shell script text executable
1.1 misho 3868: !:mime text/x-shellscript
1.1.1.3 misho 3869: 0 string/wt #!\ /bin/csh C shell script text executable
1.1 misho 3870: !:mime text/x-shellscript
3871: # korn shell magic, sent by George Wu, gwu@clyde.att.com
1.1.1.3 misho 3872: 0 string/wt #!\ /bin/ksh Korn shell script text executable
1.1 misho 3873: !:mime text/x-shellscript
1.1.1.3 misho 3874: 0 string/wt #!\ /bin/tcsh Tenex C shell script text executable
1.1 misho 3875: !:mime text/x-shellscript
1.1.1.3 misho 3876: 0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable
1.1 misho 3877: !:mime text/x-shellscript
1.1.1.3 misho 3878: 0 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable
1.1 misho 3879: !:mime text/x-shellscript
1.1.1.3 misho 3880: 0 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable
1.1 misho 3881: !:mime text/x-shellscript
3882:
3883: #
3884: # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
1.1.1.3 misho 3885: 0 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3886: !:mime text/x-shellscript
1.1.1.3 misho 3887: 0 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3888: !:mime text/x-shellscript
1.1.1.3 misho 3889: 0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
1.1 misho 3890: !:mime text/x-shellscript
1.1.1.3 misho 3891: 0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
1.1 misho 3892: !:mime text/x-shellscript
1.1.1.3 misho 3893: 0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
1.1 misho 3894: !:mime text/x-shellscript
1.1.1.3 misho 3895: 0 string/wt #!\ /bin/nawk new awk script text executable
1.1 misho 3896: !:mime text/x-nawk
1.1.1.3 misho 3897: 0 string/wt #!\ /usr/bin/nawk new awk script text executable
1.1 misho 3898: !:mime text/x-nawk
1.1.1.3 misho 3899: 0 string/wt #!\ /usr/local/bin/nawk new awk script text executable
1.1 misho 3900: !:mime text/x-nawk
1.1.1.3 misho 3901: 0 string/wt #!\ /bin/gawk GNU awk script text executable
1.1 misho 3902: !:mime text/x-gawk
1.1.1.3 misho 3903: 0 string/wt #!\ /usr/bin/gawk GNU awk script text executable
1.1 misho 3904: !:mime text/x-gawk
1.1.1.3 misho 3905: 0 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable
1.1 misho 3906: !:mime text/x-gawk
3907: #
1.1.1.3 misho 3908: 0 string/wt #!\ /bin/awk awk script text executable
1.1 misho 3909: !:mime text/x-awk
1.1.1.3 misho 3910: 0 string/wt #!\ /usr/bin/awk awk script text executable
1.1 misho 3911: !:mime text/x-awk
3912: 0 regex =^\\s*BEGIN\\s*[{] awk script text
3913:
3914: # AT&T Bell Labs' Plan 9 shell
1.1.1.3 misho 3915: 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
1.1 misho 3916:
3917: # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
1.1.1.3 misho 3918: 0 string/wt #!\ /bin/bash Bourne-Again shell script text executable
1.1.1.2 misho 3919: !:mime text/x-shellscript
1.1.1.3 misho 3920: 0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable
1.1.1.2 misho 3921: !:mime text/x-shellscript
1.1.1.3 misho 3922: 0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable
1.1 misho 3923: !:mime text/x-shellscript
1.1.1.3 misho 3924: 0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
1.1 misho 3925: !:mime text/x-shellscript
3926:
3927: # PHP scripts
3928: # Ulf Harnhammar <ulfh@update.uu.se>
3929: 0 search/1/c =<?php PHP script text
1.1.1.3 misho 3930: !:strength + 10
1.1 misho 3931: !:mime text/x-php
3932: 0 search/1 =<?\n PHP script text
3933: !:mime text/x-php
3934: 0 search/1 =<?\r PHP script text
3935: !:mime text/x-php
1.1.1.2 misho 3936: 0 search/1/w #!\ /usr/local/bin/php PHP script text executable
1.1.1.3 misho 3937: !:strength + 10
1.1 misho 3938: !:mime text/x-php
1.1.1.2 misho 3939: 0 search/1/w #!\ /usr/bin/php PHP script text executable
1.1.1.3 misho 3940: !:strength + 10
3941: !:mime text/x-php
3942: # Smarty compiled template, http://www.smarty.net/
3943: # Elan Ruusamae <glen@delfi.ee>
3944: 0 string =<?php\ /*\ Smarty\ version Smarty compiled template
3945: >24 regex [0-9.]+ \b, version %s
1.1 misho 3946: !:mime text/x-php
3947:
3948: 0 string Zend\x00 PHP script Zend Optimizer data
3949:
1.1.1.3 misho 3950: 0 string/t $! DCL command file
1.1 misho 3951:
3952: # Type: Pdmenu
3953: # URL: http://packages.debian.org/pdmenu
3954: # From: Edward Betts <edward@debian.org>
1.1.1.3 misho 3955: 0 string #!/usr/bin/pdmenu Pdmenu configuration file text
1.1 misho 3956:
3957: #----------------------------------------------------------------------------
1.1.1.2 misho 3958: # $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
1.1 misho 3959: # communication
3960:
3961: # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
3962: # It is used for conformance testing of communication protocols.
3963: # Added by W. Borgert <debacle@debian.org>.
3964: 0 string $Suite TTCN Abstract Test Suite
3965: >&1 string $SuiteId
3966: >>&1 string >\n %s
3967: >&2 string $SuiteId
3968: >>&1 string >\n %s
3969: >&3 string $SuiteId
3970: >>&1 string >\n %s
3971:
3972: # MSC (message sequence charts) are a formal description technique,
3973: # described in ITU-T Z.120, mainly used for communication protocols.
3974: # Added by W. Borgert <debacle@debian.org>.
3975: 0 string mscdocument Message Sequence Chart (document)
3976: 0 string msc Message Sequence Chart (chart)
3977: 0 string submsc Message Sequence Chart (subchart)
3978: #------------------------------------------------------------------------------
1.1.1.3 misho 3979: # $File: compress,v 1.49 2011/12/07 22:04:27 christos Exp $
1.1 misho 3980: # compress: file(1) magic for pure-compression formats (no archives)
3981: #
3982: # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
3983: #
3984: # Formats for various forms of compressed data
3985: # Formats for "compress" proper have been moved into "compress.c",
3986: # because it tries to uncompress it to figure out what's inside.
3987:
3988: # standard unix compress
3989: 0 string \037\235 compress'd data
3990: !:mime application/x-compress
1.1.1.2 misho 3991: !:apple LZIVZIVU
1.1 misho 3992: >2 byte&0x80 >0 block compressed
3993: >2 byte&0x1f x %d bits
3994:
3995: # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
3996: # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
3997: # * Original filename is only at offset 10 if "extra field" absent
3998: # * Produce shorter output - notably, only report compression methods
1.1.1.3 misho 3999: # other than 8 ("deflate", the only method defined in RFC 1952).
1.1 misho 4000: 0 string \037\213 gzip compressed data
4001: !:mime application/x-gzip
4002: >2 byte <8 \b, reserved method
4003: >2 byte >8 \b, unknown method
4004: >3 byte &0x01 \b, ASCII
4005: >3 byte &0x02 \b, has CRC
4006: >3 byte &0x04 \b, extra field
4007: >3 byte&0xC =0x08
4008: >>10 string x \b, was "%s"
4009: >3 byte &0x10 \b, has comment
4010: >9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
4011: >9 byte =0x01 \b, from Amiga
4012: >9 byte =0x02 \b, from VMS
4013: >9 byte =0x03 \b, from Unix
4014: >9 byte =0x04 \b, from VM/CMS
4015: >9 byte =0x05 \b, from Atari
4016: >9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
4017: >9 byte =0x07 \b, from MacOS
4018: >9 byte =0x08 \b, from Z-System
4019: >9 byte =0x09 \b, from CP/M
4020: >9 byte =0x0A \b, from TOPS/20
4021: >9 byte =0x0B \b, from NTFS filesystem (NT)
4022: >9 byte =0x0C \b, from QDOS
4023: >9 byte =0x0D \b, from Acorn RISCOS
4024: >3 byte &0x10 \b, comment
4025: >3 byte &0x20 \b, encrypted
4026: >4 ledate >0 \b, last modified: %s
4027: >8 byte 2 \b, max compression
4028: >8 byte 4 \b, max speed
4029:
4030: # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
4031: 0 string \037\036 packed data
4032: !:mime application/octet-stream
4033: >2 belong >1 \b, %d characters originally
4034: >2 belong =1 \b, %d character originally
4035: #
4036: # This magic number is byte-order-independent.
4037: 0 short 0x1f1f old packed data
4038: !:mime application/octet-stream
4039:
4040: # XXX - why *two* entries for "compacted data", one of which is
4041: # byte-order independent, and one of which is byte-order dependent?
4042: #
4043: 0 short 0x1fff compacted data
4044: !:mime application/octet-stream
4045: # This string is valid for SunOS (BE) and a matching "short" is listed
4046: # in the Ultrix (LE) magic file.
4047: 0 string \377\037 compacted data
4048: !:mime application/octet-stream
4049: 0 short 0145405 huf output
4050: !:mime application/octet-stream
4051:
4052: # bzip2
4053: 0 string BZh bzip2 compressed data
4054: !:mime application/x-bzip2
4055: >3 byte >47 \b, block size = %c00k
4056:
1.1.1.2 misho 4057: # lzip
4058: 0 string LZIP lzip compressed data
4059: !:mime application/x-lzip
4060: >4 byte x \b, version: %d
4061:
1.1 misho 4062: # squeeze and crunch
4063: # Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
4064: 0 beshort 0x76FF squeezed data,
4065: >4 string x original name %s
4066: 0 beshort 0x76FE crunched data,
4067: >2 string x original name %s
4068: 0 beshort 0x76FD LZH compressed data,
4069: >2 string x original name %s
4070:
4071: # Freeze
4072: 0 string \037\237 frozen file 2.1
4073: 0 string \037\236 frozen file 1.0 (or gzip 0.5)
4074:
4075: # SCO compress -H (LZH)
4076: 0 string \037\240 SCO compress -H (LZH) data
4077:
4078: # European GSM 06.10 is a provisional standard for full-rate speech
4079: # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
4080: # excitation/long term prediction) coding at 13 kbit/s.
4081: #
4082: # There's only a magic nibble (4 bits); that nibble repeats every 33
4083: # bytes. This isn't suited for use, but maybe we can use it someday.
4084: #
4085: # This will cause very short GSM files to be declared as data and
4086: # mismatches to be declared as data too!
4087: #0 byte&0xF0 0xd0 data
4088: #>33 byte&0xF0 0xd0
4089: #>66 byte&0xF0 0xd0
4090: #>99 byte&0xF0 0xd0
4091: #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
4092:
4093: # bzip a block-sorting file compressor
4094: # by Julian Seward <sewardj@cs.man.ac.uk> and others
4095: #
4096: #0 string BZ bzip compressed data
4097: #>2 byte x \b, version: %c
4098: #>3 string =1 \b, compression block size 100k
4099: #>3 string =2 \b, compression block size 200k
4100: #>3 string =3 \b, compression block size 300k
4101: #>3 string =4 \b, compression block size 400k
4102: #>3 string =5 \b, compression block size 500k
4103: #>3 string =6 \b, compression block size 600k
4104: #>3 string =7 \b, compression block size 700k
4105: #>3 string =8 \b, compression block size 800k
4106: #>3 string =9 \b, compression block size 900k
4107:
4108: # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
4109: 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
4110: >9 beshort <0x0940
4111: >>9 byte&0xf0 =0x00 - version 0.
4112: >>9 beshort&0x0fff x \b%03x,
4113: >>13 byte 1 LZO1X-1,
4114: >>13 byte 2 LZO1X-1(15),
4115: >>13 byte 3 LZO1X-999,
4116: ## >>22 bedate >0 last modified: %s,
4117: >>14 byte =0x00 os: MS-DOS
4118: >>14 byte =0x01 os: Amiga
4119: >>14 byte =0x02 os: VMS
4120: >>14 byte =0x03 os: Unix
4121: >>14 byte =0x05 os: Atari
4122: >>14 byte =0x06 os: OS/2
4123: >>14 byte =0x07 os: MacOS
4124: >>14 byte =0x0A os: Tops/20
4125: >>14 byte =0x0B os: WinNT
4126: >>14 byte =0x0E os: Win32
4127: >9 beshort >0x0939
4128: >>9 byte&0xf0 =0x00 - version 0.
4129: >>9 byte&0xf0 =0x10 - version 1.
4130: >>9 byte&0xf0 =0x20 - version 2.
4131: >>9 beshort&0x0fff x \b%03x,
4132: >>15 byte 1 LZO1X-1,
4133: >>15 byte 2 LZO1X-1(15),
4134: >>15 byte 3 LZO1X-999,
4135: ## >>25 bedate >0 last modified: %s,
4136: >>17 byte =0x00 os: MS-DOS
4137: >>17 byte =0x01 os: Amiga
4138: >>17 byte =0x02 os: VMS
4139: >>17 byte =0x03 os: Unix
4140: >>17 byte =0x05 os: Atari
4141: >>17 byte =0x06 os: OS/2
4142: >>17 byte =0x07 os: MacOS
4143: >>17 byte =0x0A os: Tops/20
4144: >>17 byte =0x0B os: WinNT
4145: >>17 byte =0x0E os: Win32
4146:
4147: # 4.3BSD-Quasijarus Strong Compression
4148: # http://minnie.tuhs.org/Quasijarus/compress.html
4149: 0 string \037\241 Quasijarus strong compressed data
4150:
4151: # From: Cory Dikkers <cdikkers@swbell.net>
4152: 0 string XPKF Amiga xpkf.library compressed data
4153: 0 string PP11 Power Packer 1.1 compressed data
4154: 0 string PP20 Power Packer 2.0 compressed data,
4155: >4 belong 0x09090909 fast compression
4156: >4 belong 0x090A0A0A mediocre compression
4157: >4 belong 0x090A0B0B good compression
4158: >4 belong 0x090A0C0C very good compression
4159: >4 belong 0x090A0C0D best compression
4160:
4161: # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
1.1.1.3 misho 4162: # http://www.7-zip.org or DOC/7zFormat.txt
1.1 misho 4163: #
4164: 0 string 7z\274\257\047\034 7-zip archive data,
4165: >6 byte x version %d
4166: >7 byte x \b.%d
1.1.1.2 misho 4167: !:mime application/x-7z-compressed
1.1 misho 4168:
4169: # Type: LZMA
1.1.1.3 misho 4170: 0 lelong&0xffffff =0x5d
4171: >12 leshort =0xff LZMA compressed data,
4172: >>5 lequad =0xffffffffffffffff streamed
4173: >>5 lequad !0xffffffffffffffff non-streamed, size %lld
4174: !:mime application/x-lzma
1.1.1.2 misho 4175:
4176: # http://tukaani.org/xz/xz-file-format.txt
4177: 0 ustring \xFD7zXZ\x00 XZ compressed data
4178: !:mime application/x-xz
1.1 misho 4179:
1.1.1.3 misho 4180: # https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
4181: 0 string LRZI LRZIP compressed data
4182: >4 byte x - version %d
4183: >5 byte x \b.%d
4184: !:mime application/x-lrzip
4185:
1.1 misho 4186: # AFX compressed files (Wolfram Kleff)
4187: 2 string -afx- AFX compressed file data
4188:
4189: # Supplementary magic data for the file(1) command to support
4190: # rzip(1). The format is described in magic(5).
4191: #
4192: # Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
4193: # this file.
4194: #
4195: 0 string RZIP rzip compressed data
4196: >4 byte x - version %d
4197: >5 byte x \b.%d
4198: >6 belong x (%d bytes)
1.1.1.2 misho 4199:
1.1.1.3 misho 4200: 0 string ArC\x01 FreeArc archive <http://freearc.org>
1.1.1.2 misho 4201:
4202: # Type: DACT compressed files
4203: 0 long 0x444354C3 DACT compressed data
4204: >4 byte >-1 (version %i.
4205: >5 byte >-1 %i.
4206: >6 byte >-1 %i)
4207: >7 long >0 , original size: %i bytes
4208: >15 long >30 , block size: %i bytes
4209:
1.1 misho 4210: #------------------------------------------------------------------------------
1.1.1.3 misho 4211: # $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
1.1 misho 4212: # Console game magic
4213: # Toby Deshane <hac@shoelace.digivill.net>
4214: # ines: file(1) magic for Marat's iNES Nintendo Entertainment System
4215: # ROM dump format
4216:
4217: 0 string NES\032 iNES ROM dump,
4218: >4 byte x %dx16k PRG
4219: >5 byte x \b, %dx8k CHR
4220: >6 byte&0x01 =0x1 \b, [Vert.]
4221: >6 byte&0x01 =0x0 \b, [Horiz.]
4222: >6 byte&0x02 =0x2 \b, [SRAM]
4223: >6 byte&0x04 =0x4 \b, [Trainer]
4224: >6 byte&0x04 =0x8 \b, [4-Scr]
4225:
4226: #------------------------------------------------------------------------------
4227: # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
4228: #
4229: 0x104 belong 0xCEED6666 Gameboy ROM:
4230: >0x134 string >\0 "%.16s"
4231: >0x146 byte 0x03 \b,[SGB]
4232: >0x147 byte 0x00 \b, [ROM ONLY]
4233: >0x147 byte 0x01 \b, [ROM+MBC1]
4234: >0x147 byte 0x02 \b, [ROM+MBC1+RAM]
4235: >0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
4236: >0x147 byte 0x05 \b, [ROM+MBC2]
4237: >0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
4238: >0x147 byte 0x08 \b, [ROM+RAM]
4239: >0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
4240: >0x147 byte 0x0B \b, [ROM+MMM01]
4241: >0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
4242: >0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
4243: >0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
4244: >0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
4245: >0x147 byte 0x11 \b, [ROM+MBC3]
4246: >0x147 byte 0x12 \b, [ROM+MBC3+RAM]
4247: >0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
4248: >0x147 byte 0x19 \b, [ROM+MBC5]
4249: >0x147 byte 0x1A \b, [ROM+MBC5+RAM]
4250: >0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
4251: >0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
4252: >0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
4253: >0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
4254: >0x147 byte 0x1F \b, [Pocket Camera]
4255: >0x147 byte 0xFD \b, [Bandai TAMA5]
4256: >0x147 byte 0xFE \b, [Hudson HuC-3]
4257: >0x147 byte 0xFF \b, [Hudson HuC-1]
4258:
4259: >0x148 byte 0 \b, ROM: 256Kbit
4260: >0x148 byte 1 \b, ROM: 512Kbit
4261: >0x148 byte 2 \b, ROM: 1Mbit
4262: >0x148 byte 3 \b, ROM: 2Mbit
4263: >0x148 byte 4 \b, ROM: 4Mbit
4264: >0x148 byte 5 \b, ROM: 8Mbit
4265: >0x148 byte 6 \b, ROM: 16Mbit
4266: >0x148 byte 0x52 \b, ROM: 9Mbit
4267: >0x148 byte 0x53 \b, ROM: 10Mbit
4268: >0x148 byte 0x54 \b, ROM: 12Mbit
4269:
4270: >0x149 byte 1 \b, RAM: 16Kbit
4271: >0x149 byte 2 \b, RAM: 64Kbit
4272: >0x149 byte 3 \b, RAM: 128Kbit
4273: >0x149 byte 4 \b, RAM: 1Mbit
4274:
4275: #>0x14e long x \b, CRC: %x
4276:
4277: #------------------------------------------------------------------------------
4278: # genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
4279: #
4280: 0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
4281: >0x120 string >\0 Name: "%.16s"
4282: >0x110 string >\0 %.16s
4283: >0x1B0 string RA with SRAM
4284:
4285: #------------------------------------------------------------------------------
4286: # genesis: file(1) magic for the Super MegaDrive ROM dump format
4287: #
4288: 0x280 string EAGN Super MagicDrive ROM dump
4289: >0 byte x %dx16k blocks
4290: >2 byte 0 \b, last in series or standalone
4291: >2 byte >0 \b, split ROM
4292: >8 byte 0xAA
4293: >9 byte 0xBB
4294:
4295: #------------------------------------------------------------------------------
4296: # genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
4297: #
4298: 0x280 string EAMG Super MagicDrive ROM dump
4299: >0 byte x %dx16k blocks
4300: >2 byte x \b, last in series or standalone
4301: >8 byte 0xAA
4302: >9 byte 0xBB
4303:
4304: #------------------------------------------------------------------------------
4305: # smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
4306: #
4307: # Does not detect all images. Very preliminary guesswork. Need more data
4308: # on format.
4309: #
4310: # FIXME: need a little more info...;P
4311: #
4312: #0 byte 0xF3
4313: #>1 byte 0xED Sega Master System/Game Gear ROM dump
4314: #>1 byte 0x31 Sega Master System/Game Gear ROM dump
4315: #>1 byte 0xDB Sega Master System/Game Gear ROM dump
4316: #>1 byte 0xAF Sega Master System/Game Gear ROM dump
4317: #>1 byte 0xC3 Sega Master System/Game Gear ROM dump
4318:
4319: #------------------------------------------------------------------------------
4320: # dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
4321: #
4322: 0 belong 0x21068028 Sega Dreamcast VMU game image
4323: 0 string LCDi Dream Animator file
4324:
4325: #------------------------------------------------------------------------------
4326: # v64: file(1) uncertain magic for the V64 format N64 ROM dumps
4327: #
4328: 0 belong 0x37804012 V64 Nintendo 64 ROM dump
4329:
4330: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
4331: # Nintendo .nds
4332: 192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
4333: # Nintendo .gba
4334: 0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
4335:
4336: #------------------------------------------------------------------------------
4337: # msx: file(1) magic for MSX game cartridge dumps
4338: # Too simple - MPi
4339: #0 beshort 0x4142 MSX game cartridge dump
4340:
4341: #------------------------------------------------------------------------------
4342: # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
4343: 0 string PS-X\ EXE Sony Playstation executable
4344: # Area:
4345: >113 string x (%s)
4346:
4347: #------------------------------------------------------------------------------
1.1.1.3 misho 4348: # Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
1.1 misho 4349: 0 string XBEH XBE, Microsoft Xbox executable
4350: # probabilistic checks whether signed or not
4351: >0x0004 ulelong =0x0
4352: >>&2 ulelong =0x0
4353: >>>&2 ulelong =0x0 \b, not signed
4354: >0x0004 ulelong >0
4355: >>&2 ulelong >0
4356: >>>&2 ulelong >0 \b, signed
4357: # expect base address of 0x10000
4358: >0x0104 ulelong =0x10000
4359: >>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
4360: >>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
4361: >>>(0x0118-0x0FF60) ulelong >0 (regions:
4362: >>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
4363: >>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
4364: >>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
4365: >>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
4366: >>>(0x0118-0x0FF60) ulelong >0 \b)
4367:
4368: # --------------------------------
4369: # Microsoft Xbox data file formats
4370: 0 string XIP0 XIP, Microsoft Xbox data
4371: 0 string XTF0 XTF, Microsoft Xbox data
4372:
4373: # Atari Lynx cartridge dump (EXE/BLL header)
4374: # From: "Stefan A. Haubenthal" <polluks@web.de>
4375:
1.1.1.3 misho 4376: # Double-check that the image type matches too, 0x8008 conflicts with
4377: # 8 character OMF-86 object file headers.
4378: 0 beshort 0x8008
4379: >6 string BS93 Lynx homebrew cartridge
4380: >>2 beshort x \b, RAM start $%04x
4381: >6 string LYNX Lynx cartridge
4382: >>2 beshort x \b, RAM start $%04x
1.1 misho 4383:
4384: # Opera file system that is used on the 3DO console
4385: # From: Serge van den Boom <svdb@stack.nl>
4386: 0 string \x01ZZZZZ\x01 3DO "Opera" file system
4387:
1.1.1.3 misho 4388: # From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
1.1 misho 4389: 0 string GBS Nintendo Gameboy Music/Audio Data
4390: 12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
4391:
4392: # Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
4393: 0 string PPF30 Playstation Patch File version 3.0
4394: >5 byte 0 \b, PPF 1.0 patch
4395: >5 byte 1 \b, PPF 2.0 patch
4396: >5 byte 2 \b, PPF 3.0 patch
4397: >>56 byte 0 \b, Imagetype BIN (any)
4398: >>56 byte 1 \b, Imagetype GI (PrimoDVD)
4399: >>57 byte 0 \b, Blockcheck disabled
4400: >>57 byte 1 \b, Blockcheck enabled
4401: >>58 byte 0 \b, Undo data not available
4402: >>58 byte 1 \b, Undo data available
4403: >6 string x \b, description: %s
4404:
4405: 0 string PPF20 Playstation Patch File version 2.0
4406: >5 byte 0 \b, PPF 1.0 patch
4407: >5 byte 1 \b, PPF 2.0 patch
4408: >>56 lelong >0 \b, size of file to patch %d
4409: >6 string x \b, description: %s
4410:
4411: 0 string PPF10 Playstation Patch File version 1.0
4412: >5 byte 0 \b, Simple Encoding
4413: >6 string x \b, description: %s
4414:
4415: # From: Daniel Dawson <ddawson@icehouse.net>
4416: # SNES9x .smv "movie" file format.
4417: 0 string SMV\x1A SNES9x input recording
4418: >0x4 lelong x \b, version %d
4419: # version 4 is latest so far
4420: >0x4 lelong <5
4421: >>0x8 ledate x \b, recorded at %s
4422: >>0xc lelong >0 \b, rerecorded %d times
4423: >>0x10 lelong x \b, %d frames long
4424: >>0x14 byte >0 \b, data for controller(s):
4425: >>>0x14 byte &0x1 #1
4426: >>>0x14 byte &0x2 #2
4427: >>>0x14 byte &0x4 #3
4428: >>>0x14 byte &0x8 #4
4429: >>>0x14 byte &0x10 #5
4430: >>0x15 byte ^0x1 \b, begins from snapshot
4431: >>0x15 byte &0x1 \b, begins from reset
4432: >>0x15 byte ^0x2 \b, NTSC standard
4433: >>0x15 byte &0x2 \b, PAL standard
4434: >>0x17 byte &0x1 \b, settings:
4435: # WIP1Timing not used as of version 4
4436: >>>0x4 lelong <4
4437: >>>>0x17 byte &0x2 WIP1Timing
4438: >>>0x17 byte &0x4 Left+Right
4439: >>>0x17 byte &0x8 VolumeEnvX
4440: >>>0x17 byte &0x10 FakeMute
4441: >>>0x17 byte &0x20 SyncSound
4442: # New flag as of version 4
4443: >>>0x4 lelong >3
4444: >>>>0x17 byte &0x80 NoCPUShutdown
4445: >>0x4 lelong <4
4446: >>>0x18 lelong >0x23
4447: >>>>0x20 leshort !0
4448: >>>>>0x20 lestring16 x \b, metadata: "%s"
4449: >>0x4 lelong >3
4450: >>>0x24 byte >0 \b, port 1:
4451: >>>>0x24 byte 1 joypad
4452: >>>>0x24 byte 2 mouse
4453: >>>>0x24 byte 3 SuperScope
4454: >>>>0x24 byte 4 Justifier
4455: >>>>0x24 byte 5 multitap
4456: >>>0x24 byte >0 \b, port 2:
4457: >>>>0x25 byte 1 joypad
4458: >>>>0x25 byte 2 mouse
4459: >>>>0x25 byte 3 SuperScope
4460: >>>>0x25 byte 4 Justifier
4461: >>>>0x25 byte 5 multitap
4462: >>>0x18 lelong >0x43
4463: >>>>0x40 leshort !0
4464: >>>>>0x40 lestring16 x \b, metadata: "%s"
4465: >>0x17 byte &0x40 \b, ROM:
4466: >>>(0x18.l-26) lelong x CRC32 0x%08x
4467: >>>(0x18.l-23) string x "%s"
4468:
4469: # Type: scummVM savegame files
4470: # From: Sven Hartge <debian@ds9.argh.org>
1.1.1.2 misho 4471: 0 string SCVM ScummVM savegame
1.1 misho 4472: >12 string >\0 "%s"
1.1.1.2 misho 4473:
1.1 misho 4474: #------------------------------------------------------------------------------
1.1.1.3 misho 4475: # $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
1.1 misho 4476: # convex: file(1) magic for Convex boxes
4477: #
4478: # Convexes are big-endian.
4479: #
4480: # /*\
4481: # * Below are the magic numbers and tests added for Convex.
4482: # * Added at beginning, because they are expected to be used most.
4483: # \*/
4484: 0 belong 0507 Convex old-style object
4485: >16 belong >0 not stripped
4486: 0 belong 0513 Convex old-style demand paged executable
4487: >16 belong >0 not stripped
4488: 0 belong 0515 Convex old-style pre-paged executable
4489: >16 belong >0 not stripped
4490: 0 belong 0517 Convex old-style pre-paged, non-swapped executable
4491: >16 belong >0 not stripped
4492: 0 belong 0x011257 Core file
4493: #
4494: # The following are a series of dump format magic numbers. Each one
4495: # corresponds to a drastically different dump format. The first on is
4496: # the original dump format on a 4.1 BSD or earlier file system. The
4497: # second marks the change between the 4.1 file system and the 4.2 file
4498: # system. The Third marks the changing of the block size from 1K
4499: # to 2K to be compatible with an IDC file system. The fourth indicates
4500: # a dump that is dependent on Convex Storage Manager, because data in
4501: # secondary storage is not physically contained within the dump.
4502: # The restore program uses these number to determine how the data is
4503: # to be extracted.
4504: #
4505: 24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
4506: 24 belong =60014 dump format, Convex Storage Manager by-reference dump
4507: #
4508: # what follows is a bunch of bit-mask checks on the flags field of the opthdr.
4509: # If there is no `=' sign, assume just checking for whether the bit is set?
4510: #
4511: 0 belong 0601 Convex SOFF
4512: >88 belong&0x000f0000 =0x00000000 c1
4513: >88 belong &0x00010000 c2
4514: >88 belong &0x00020000 c2mp
4515: >88 belong &0x00040000 parallel
4516: >88 belong &0x00080000 intrinsic
4517: >88 belong &0x00000001 demand paged
4518: >88 belong &0x00000002 pre-paged
4519: >88 belong &0x00000004 non-swapped
4520: >88 belong &0x00000008 POSIX
4521: #
4522: >84 belong &0x80000000 executable
4523: >84 belong &0x40000000 object
4524: >84 belong&0x20000000 =0 not stripped
4525: >84 belong&0x18000000 =0x00000000 native fpmode
4526: >84 belong&0x18000000 =0x10000000 ieee fpmode
4527: >84 belong&0x18000000 =0x18000000 undefined fpmode
4528: #
4529: 0 belong 0605 Convex SOFF core
4530: #
4531: 0 belong 0607 Convex SOFF checkpoint
4532: >88 belong&0x000f0000 =0x00000000 c1
4533: >88 belong &0x00010000 c2
4534: >88 belong &0x00020000 c2mp
4535: >88 belong &0x00040000 parallel
4536: >88 belong &0x00080000 intrinsic
4537: >88 belong &0x00000008 POSIX
4538: #
4539: >84 belong&0x18000000 =0x00000000 native fpmode
4540: >84 belong&0x18000000 =0x10000000 ieee fpmode
4541: >84 belong&0x18000000 =0x18000000 undefined fpmode
4542:
4543: #------------------------------------------------------------------------------
1.1.1.2 misho 4544: # $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
1.1 misho 4545: # cracklib: file (1) magic for cracklib v2.7
4546:
4547: 0 lelong 0x70775631 Cracklib password index, little endian
4548: >4 long >0 (%i words)
4549: >4 long 0 ("64-bit")
4550: >>8 long >-1 (%i words)
4551: 0 belong 0x70775631 Cracklib password index, big endian
4552: >4 belong >-1 (%i words)
4553: # really bellong 0x0000000070775631
4554: 0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
4555: >12 belong >0 (%i words)
1.1.1.2 misho 4556:
1.1 misho 4557: # ----------------------------------------------------------------------------
1.1.1.2 misho 4558: # $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
1.1 misho 4559: # ctags: file (1) magic for Exuberant Ctags files
4560: # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
4561: 0 search/1 =!_TAG Exuberant Ctags tag file text
4562:
4563: #------------------------------------------------------------------------------
1.1.1.3 misho 4564: # $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
4565: # file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com>
4566: #
4567: 0 string ACMP Map file for the AssaultCube FPS game
4568: 0 string CUBE Map file for cube and cube2 engine games
4569: 0 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games
4570:
4571: #------------------------------------------------------------------------------
4572: # $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
4573: # Cups: file(1) magic for the cups raster file format
4574: # From: Laurent Martelli <martellilaurent@gmail.com>
4575: # http://www.cups.org/documentation.php/spec-raster.html
4576: #
4577:
4578: 0 name cups-be
4579: >280 lelong x \b, %d
4580: >284 lelong x \bx%d dpi
4581: >376 lelong x \b, %dx
4582: >380 lelong x \b%d pixels
4583: >388 lelong x %d bits/color
4584: >392 lelong x %d bits/pixel
4585: >400 lelong 0 ColorOrder=Chunky
4586: >400 lelong 1 ColorOrder=Banded
4587: >400 lelong 2 ColorOrder=Planar
4588: >404 lelong 0 ColorSpace=gray
4589: >404 lelong 1 ColorSpace=RGB
4590: >404 lelong 2 ColorSpace=RGBA
4591: >404 lelong 3 ColorSpace=black
4592: >404 lelong 4 ColorSpace=CMY
4593: >404 lelong 5 ColorSpace=YMC
4594: >404 lelong 6 ColorSpace=CMYK
4595: >404 lelong 7 ColorSpace=YMCK
4596: >404 lelong 8 ColorSpace=KCMY
4597: >404 lelong 9 ColorSpace=KCMYcm
4598: >404 lelong 10 ColorSpace=GMCK
4599: >404 lelong 11 ColorSpace=GMCS
4600: >404 lelong 12 ColorSpace=WHITE
4601: >404 lelong 13 ColorSpace=GOLD
4602: >404 lelong 14 ColorSpace=SILVER
4603: >404 lelong 15 ColorSpace=CIE XYZ
4604: >404 lelong 16 ColorSpace=CIE Lab
4605: >404 lelong 17 ColorSpace=RGBW
4606: >404 lelong 18 ColorSpace=sGray
4607: >404 lelong 19 ColorSpace=sRGB
4608: >404 lelong 20 ColorSpace=AdobeRGB
4609:
4610: # Cups Raster image format, Big Endian
4611: 0 string RaS
4612: >3 string t Cups Raster version 1, Big Endian
4613: >3 string 2 Cups Raster version 2, Big Endian
4614: >3 string 3 Cups Raster version 3, Big Endian
4615: !:mime application/vnd.cups-raster
4616: >0 use ^cups-be
4617:
4618:
4619: # Cups Raster image format, Little Endian
4620: 1 string SaR
4621: >0 string t Cups Raster version 1, Little Endian
4622: >0 string 2 Cups Raster version 2, Little Endian
4623: >0 string 3 Cups Raster version 3, Little Endian
4624: !:mime application/vnd.cups-raster
4625: >0 use \^cups-be
4626:
4627: #------------------------------------------------------------------------------
1.1.1.2 misho 4628: # $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
1.1 misho 4629: # dact: file(1) magic for DACT compressed files
4630: #
4631: 0 long 0x444354C3 DACT compressed data
4632: >4 byte >-1 (version %i.
4633: >5 byte >-1 $BS%i.
4634: >6 byte >-1 $BS%i)
4635: >7 long >0 $BS, original size: %i bytes
4636: >15 long >30 $BS, block size: %i bytes
4637:
4638: #------------------------------------------------------------------------------
1.1.1.3 misho 4639: # $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $
1.1 misho 4640: # database: file(1) magic for various databases
4641: #
4642: # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
4643: #
4644: #
4645: # GDBM magic numbers
4646: # Will be maintained as part of the GDBM distribution in the future.
4647: # <downsj@teeny.org>
4648: 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
4649: !:mime application/x-gdbm
4650: 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
4651: !:mime application/x-gdbm
4652: 0 string GDBM GNU dbm 2.x database
4653: !:mime application/x-gdbm
4654: #
4655: # Berkeley DB
4656: #
4657: # Ian Darwin's file /etc/magic files: big/little-endian version.
4658: #
4659: # Hash 1.85/1.86 databases store metadata in network byte order.
4660: # Btree 1.85/1.86 databases store the metadata in host byte order.
4661: # Hash and Btree 2.X and later databases store the metadata in host byte order.
4662:
4663: 0 long 0x00061561 Berkeley DB
4664: !:mime application/x-dbm
4665: >8 belong 4321
4666: >>4 belong >2 1.86
4667: >>4 belong <3 1.85
4668: >>4 belong >0 (Hash, version %d, native byte-order)
4669: >8 belong 1234
4670: >>4 belong >2 1.86
4671: >>4 belong <3 1.85
4672: >>4 belong >0 (Hash, version %d, little-endian)
4673:
4674: 0 belong 0x00061561 Berkeley DB
4675: >8 belong 4321
4676: >>4 belong >2 1.86
4677: >>4 belong <3 1.85
4678: >>4 belong >0 (Hash, version %d, big-endian)
4679: >8 belong 1234
4680: >>4 belong >2 1.86
4681: >>4 belong <3 1.85
4682: >>4 belong >0 (Hash, version %d, native byte-order)
4683:
4684: 0 long 0x00053162 Berkeley DB 1.85/1.86
4685: >4 long >0 (Btree, version %d, native byte-order)
4686: 0 belong 0x00053162 Berkeley DB 1.85/1.86
4687: >4 belong >0 (Btree, version %d, big-endian)
4688: 0 lelong 0x00053162 Berkeley DB 1.85/1.86
4689: >4 lelong >0 (Btree, version %d, little-endian)
4690:
4691: 12 long 0x00061561 Berkeley DB
4692: >16 long >0 (Hash, version %d, native byte-order)
4693: 12 belong 0x00061561 Berkeley DB
4694: >16 belong >0 (Hash, version %d, big-endian)
4695: 12 lelong 0x00061561 Berkeley DB
4696: >16 lelong >0 (Hash, version %d, little-endian)
4697:
4698: 12 long 0x00053162 Berkeley DB
4699: >16 long >0 (Btree, version %d, native byte-order)
4700: 12 belong 0x00053162 Berkeley DB
4701: >16 belong >0 (Btree, version %d, big-endian)
4702: 12 lelong 0x00053162 Berkeley DB
4703: >16 lelong >0 (Btree, version %d, little-endian)
4704:
4705: 12 long 0x00042253 Berkeley DB
4706: >16 long >0 (Queue, version %d, native byte-order)
4707: 12 belong 0x00042253 Berkeley DB
4708: >16 belong >0 (Queue, version %d, big-endian)
4709: 12 lelong 0x00042253 Berkeley DB
4710: >16 lelong >0 (Queue, version %d, little-endian)
4711:
4712: # From Max Bowsher.
4713: 12 long 0x00040988 Berkeley DB
4714: >16 long >0 (Log, version %d, native byte-order)
4715: 12 belong 0x00040988 Berkeley DB
4716: >16 belong >0 (Log, version %d, big-endian)
4717: 12 lelong 0x00040988 Berkeley DB
4718: >16 lelong >0 (Log, version %d, little-endian)
4719:
4720: #
4721: #
4722: # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
4723: 0 string RRD RRDTool DB
4724: >4 string x version %s
4725: #----------------------------------------------------------------------
4726: # ROOT: file(1) magic for ROOT databases
4727: #
4728: 0 string root\0 ROOT file
4729: >4 belong x Version %d
4730: >33 belong x (Compression: %d)
4731:
4732: # XXX: Weak magic.
4733: # Alex Ott <ott@jet.msk.su>
4734: ## Paradox file formats
4735: #2 leshort 0x0800 Paradox
4736: #>0x39 byte 3 v. 3.0
4737: #>0x39 byte 4 v. 3.5
4738: #>0x39 byte 9 v. 4.x
4739: #>0x39 byte 10 v. 5.x
4740: #>0x39 byte 11 v. 5.x
4741: #>0x39 byte 12 v. 7.x
4742: #>>0x04 byte 0 indexed .DB data file
4743: #>>0x04 byte 1 primary index .PX file
4744: #>>0x04 byte 2 non-indexed .DB data file
4745: #>>0x04 byte 3 non-incrementing secondary index .Xnn file
4746: #>>0x04 byte 4 secondary index .Ynn file
4747: #>>0x04 byte 5 incrementing secondary index .Xnn file
4748: #>>0x04 byte 6 non-incrementing secondary index .XGn file
4749: #>>0x04 byte 7 secondary index .YGn file
4750: #>>>0x04 byte 8 incrementing secondary index .XGn file
4751:
4752: ## XBase database files
1.1.1.3 misho 4753: # updated by Joerg Jenderek at Feb 2013
4754: # http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
4755: # http://www.clicketyclick.dk/databases/xbase/format/dbf.html
4756: # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
4757: # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
4758: 0 ubelong&0x0000FFFF <0x00000C20
4759: # skip Infocom game Z-machine
4760: >2 ubyte >0
4761: # skip Androids *.xml
4762: >>3 ubyte >0
4763: >>>3 ubyte <32
4764: # 1 < version VV
4765: >>>>0 ubyte >1
4766: # skip HELP.CA3 by test for reserved byte ( NULL )
4767: >>>>>27 ubyte 0
4768: # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
4769: #>>>>>30 ubeshort x 30NULL?%x
4770: # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
4771: >>>>>>24 ubelong&0xffFFFFff >0x01302000
4772: # .DBF or .MDX
4773: >>>>>>24 ubelong&0xffFFFFff <0x01302001
4774: # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
4775: >>>>>>>24 ubelong&0xffFFFFff =0
4776: # test for 2 reserved NULL bytes,transaction and encryption byte flag
4777: >>>>>>>>12 ubelong&0xFFFFfEfE 0
4778: # test for MDX flag
4779: >>>>>>>>>28 ubyte x
4780: >>>>>>>>>28 ubyte&0xf8 0
4781: # header size >= 32
4782: >>>>>>>>>>8 uleshort >31
4783: # skip PIC15736.PCX by test for language driver name or field name
4784: >>>>>>>>>>>32 ubyte >0
4785: !:mime application/x-dbf
4786: #!:mime application/x-dbf; charset=unknown-8bit ??
4787: #!:mime application/x-dbase
4788: >>>>>>>>>>>>0 use xbase-type
4789: # database file
4790: >>>>>>>>>>>>0 ubyte x \b DBF
4791: >>>>>>>>>>>>4 lelong 0 \b, no records
4792: >>>>>>>>>>>>4 lelong >0 \b, %ld record
4793: # plural s appended
4794: >>>>>>>>>>>>>4 lelong >1 \bs
4795: # http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
4796: # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
4797: >>>>>>>>>>>>10 uleshort x * %d
4798: # file size = records * record size + header size
4799: >>>>>>>>>>>>1 ubyte x \b, update-date
4800: >>>>>>>>>>>>1 use xbase-date
4801: # http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
4802: #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
4803: # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
4804: >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
4805: #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
4806: >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
4807: >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
4808: >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
4809: # 1st record offset + 1 = header size
4810: >>>>>>>>>>>>8 uleshort >0
4811: >>>>>>>>>>>>(8.s+1) ubyte >0
4812: >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
4813: >>>>>>>>>>>>>(8.s+1) ubyte >0
4814: >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
4815: # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
4816: >>>>>>>24 ubelong&0x0133f7ff >0
4817: # test for reserved NULL byte
4818: >>>>>>>>47 ubyte x
4819: # test for valid TAG key format (0x10 or 0)
4820: >>>>>>>>>559 ubyte&0xeF 0
4821: # test MM <= 12
4822: >>>>>>>>>45 ubeshort <0x0C20
4823: >>>>>>>>>>45 ubyte >0
4824: >>>>>>>>>>>46 ubyte <32
4825: >>>>>>>>>>>>46 ubyte >0
4826: #!:mime application/x-mdx
4827: >>>>>>>>>>>>>0 use xbase-type
4828: >>>>>>>>>>>>>0 ubyte x \b MDX
4829: >>>>>>>>>>>>>1 ubyte x \b, creation-date
4830: >>>>>>>>>>>>>1 use xbase-date
4831: >>>>>>>>>>>>>44 ubyte x \b, update-date
4832: >>>>>>>>>>>>>44 use xbase-date
4833: # No.of tags in use (1,2,5,12)
4834: >>>>>>>>>>>>>28 uleshort x \b, %d
4835: # No. of entries in tag (0x30)
4836: >>>>>>>>>>>>>25 ubyte x \b/%d tags
4837: # Length of tag
4838: >>>>>>>>>>>>>26 ubyte x * %d
4839: # 1st tag name_
4840: >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
4841: # 2nd tag name
4842: #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
4843: #
4844: # Print the xBase names of different version variants
4845: 0 name xbase-type
4846: >0 ubyte <2
4847: # 1 < version
4848: >0 ubyte >1
4849: >>0 ubyte 0x02 FoxBase
4850: # FoxBase+/dBaseIII+, no memo
4851: >>0 ubyte 0x03 FoxBase+/dBase III
4852: # dBASE IV no memo file
4853: >>0 ubyte 0x04 dBase IV
4854: # dBASE V no memo file
4855: >>0 ubyte 0x05 dBase V
4856: >>0 ubyte 0x30 Visual FoxPro
4857: >>0 ubyte 0x31 Visual FoxPro, autoincrement
4858: # Visual FoxPro, with field type Varchar or Varbinary
4859: >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
4860: # dBASE IV SQL, no memo;dbv memo var size (Flagship)
4861: >>0 ubyte 0x43 dBase IV, with SQL table
4862: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4863: #>>0 ubyte 0x62 dBase IV, with SQL table
4864: # dBASE IV, with memo!!
4865: >>0 ubyte 0x7b dBase IV, with memo
4866: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4867: #>>0 ubyte 0x82 dBase IV, with SQL system
4868: # FoxBase+/dBaseIII+ with memo .DBT!
4869: >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
4870: # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
4871: >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
4872: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4873: #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
4874: # dBASE IV with memo!
4875: >>0 ubyte 0x8B dBase IV, with memo .DBT
4876: # dBase IV with SQL Table,no memo?
4877: >>0 ubyte 0x8E dBase IV, with SQL table
4878: # .dbv and .dbt memo (Flagship)?
4879: >>0 ubyte 0xB3 Flagship
4880: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4881: #>>0 ubyte 0xCA dBase IV with memo .DBT
4882: # dBASE IV with SQL table, with memo .DBT
4883: >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
4884: # HiPer-Six format;Clipper SIX, with SMT memo file
4885: >>0 ubyte 0xE5 Clipper SIX with memo
4886: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4887: #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
4888: >>0 ubyte 0xF5 FoxPro with memo
4889: # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
4890: #>>0 ubyte 0xFA FoxPro 2.x, with memo
1.1.1.5 ! misho 4891: # unknown version (should not happen)
1.1.1.3 misho 4892: >>0 default x xBase
4893: >>>0 ubyte x (0x%x)
4894: # flags in version byte
4895: # DBT flag (with dBASE III memo .DBT)!!
4896: # >>0 ubyte&0x80 >0 DBT_FLAG=%x
4897: # memo flag ??
4898: # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
4899: # SQL flag ??
4900: # >>0 ubyte&0x70 >0 SQL_FLAG=%x
4901: # test and print the date of xBase .DBF .MDX
4902: 0 name xbase-date
4903: # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
4904: >0 ubelong x
4905: >1 ubyte <13
4906: >>1 ubyte >0
4907: >>>2 ubyte >0
4908: >>>>2 ubyte <32
4909: >>>>>0 ubyte x
4910: # YY is interpreted as 20YY or 19YY
4911: >>>>>>0 ubyte <100 \b %.2d
4912: # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
4913: >>>>>>0 ubyte >99 \b %d
4914: >>>>>1 ubyte x \b-%d
4915: >>>>>2 ubyte x \b-%d
4916:
4917: # dBase memo files .DBT or .FPT
4918: # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
4919: 16 ubyte <4
4920: >16 ubyte !2
4921: >>16 ubyte !1
4922: # next free block index is positive
4923: >>>0 ulelong >0
4924: # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
4925: >>>>17 ubelong&0xFFfdFE00 0x00000000
4926: # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
4927: >>>>>20 ubelong&0xFF01209B 0x00000000
4928: # dBASE III
4929: >>>>>>16 ubyte 3
4930: # dBASE III DBT
4931: >>>>>>>0 use xbase-memo-print
4932: # dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
4933: >>>>>>16 ubyte 0
4934: # dBASE IV DBT with DBF name or DBF garbage
4935: >>>>>>>8 ubelong >0x40000000
4936: # skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
4937: >>>>>>>>0 ulelong <0x01010002
4938: >>>>>>>>>0 use xbase-memo-print
4939: >>>>>>>8 ubelong 0
4940: # skip MM*DD*.bin by test for for reserved NULL byte
4941: >>>>>>>>508 ubelong 0
4942: >>>>>>>>>0 use xbase-memo-print
4943: # garbage PCX , ZIP , JAR , XPI
4944: >>>>>>>8 default x
4945:
4946: # Print the information of dBase DBT or FoxPro FPT memo files
4947: 0 name xbase-memo-print
4948: >0 ubyte x
4949: # test version
4950: # memo file
4951: >>16 ubyte 3 dBase III DBT
4952: >>16 ubyte 0
4953: >>>512 ubelong <0x00000003 FoxPro FPT
4954: # Size of blocks for FoxPro
4955: >>>>6 ubeshort x \b, blocks size %lu
4956: # Number of next available block for appending data for FoxPro
4957: >>>>0 ubelong =0 \b, next free block index %lu
4958: >>>>0 ubelong !0 \b, next free block index %lu
4959: >>>512 default x dBase IV DBT
4960: # DBF file name without extension
4961: >>>>8 string >\0 \b of %-.8s.DBF
4962: # size of blocks ; not reliable 0x2020204C
4963: #>>>>4 ulelong =0 \b, blocks size %lu
4964: >>>>4 ulelong !0 \b, blocks size %lu
4965: # Block length found 0 , 512
4966: #>>>>20 uleshort =0 \b, block length %u
4967: >>>>20 uleshort !0 \b, block length %u
4968: # Number of next available block for appending data
4969: >>>>0 ulelong =0 \b, next free block index %lu
4970: >>>>0 ulelong !0 \b, next free block index %lu
4971: >>512 ubelong x
4972: >>>512 ubelong =0xFFFF0800
4973: >>>>520 string >\0 \b, 1st used item "%s"
4974: # FoxPro
4975: >>>512 ubelong <3
4976: # FoxPro memo
4977: >>>>512 ubelong =1
4978: >>>>520 string >\0 \b, 1st used item "%s"
4979: >>>512 default x
4980: # may be deleted memo field
4981: >>>>512 string >\0 \b, 1st item "%s"
4982:
4983: # TODO:
4984: # DBASE index file *.NDX
4985: # DBASE Compound Index file *.CDX
4986: # dBASE IV Printer Driver *.PRF
4987: ## End of XBase database stuff
1.1 misho 4988:
4989: # MS Access database
4990: 4 string Standard\ Jet\ DB Microsoft Access Database
4991: !:mime application/x-msaccess
1.1.1.3 misho 4992: 4 string Standard\ ACE\ DB Microsoft Access Database
4993: !:mime application/x-msaccess
1.1 misho 4994:
4995: # TDB database from Samba et al - Martin Pool <mbp@samba.org>
4996: 0 string TDB\ file TDB database
4997: >32 lelong 0x2601196D version 6, little-endian
4998: >>36 lelong x hash size %d bytes
4999:
5000: # SE Linux policy database
5001: 0 lelong 0xf97cff8c SE Linux policy
5002: >16 lelong x v%d
5003: >20 lelong 1 MLS
5004: >24 lelong x %d symbols
5005: >28 lelong x %d ocons
5006:
5007: # ICE authority file data (Wolfram Kleff)
5008: 2 string ICE ICE authority data
5009:
5010: # X11 Xauthority file (Wolfram Kleff)
5011: 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5012: 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5013: 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5014: 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5015: 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5016: 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5017: 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5018: 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5019: 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
5020:
5021: # From: Maxime Henrion <mux@FreeBSD.org>
5022: # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
5023: 0 string PGDMP PostgreSQL custom database dump
5024: >5 byte x - v%d
5025: >6 byte x \b.%d
5026: >5 beshort <0x101 \b-0
5027: >5 beshort >0x100
5028: >>7 byte x \b-%d
5029:
5030: # Type: Advanced Data Format (ADF) database
5031: # URL: http://www.grc.nasa.gov/WWW/cgns/adf/
5032: # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
5033: 0 string @(#)ADF\ Database CGNS Advanced Data Format
5034:
1.1.1.2 misho 5035: # Tokyo Cabinet magic data
5036: # http://tokyocabinet.sourceforge.net/index.html
5037: 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
5038: >14 string x \b (%s)
5039: >32 byte 0 \b, Hash
5040: !:mime application/x-tokyocabinet-hash
5041: >32 byte 1 \b, B+ tree
5042: !:mime application/x-tokyocabinet-btree
5043: >32 byte 2 \b, Fixed-length
5044: !:mime application/x-tokyocabinet-fixed
5045: >32 byte 3 \b, Table
5046: !:mime application/x-tokyocabinet-table
5047: >33 byte &1 \b, [open]
5048: >33 byte &2 \b, [fatal]
5049: >34 byte x \b, apow=%d
5050: >35 byte x \b, fpow=%d
5051: >36 byte &0x01 \b, [large]
5052: >36 byte &0x02 \b, [deflate]
5053: >36 byte &0x04 \b, [bzip]
5054: >36 byte &0x08 \b, [tcbs]
5055: >36 byte &0x10 \b, [excodec]
5056: >40 lequad x \b, bnum=%lld
5057: >48 lequad x \b, rnum=%lld
5058: >56 lequad x \b, fsiz=%lld
5059:
1.1 misho 5060: # Type: QDBM Quick Database Manager
5061: # From: Benoit Sibaud <bsibaud@april.org>
1.1.1.2 misho 5062: 0 string \\[depot\\]\n\f Quick Database Manager, little endian
5063: 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
1.1 misho 5064:
5065: # Type: TokyoCabinet database
5066: # URL: http://tokyocabinet.sourceforge.net/
5067: # From: Benoit Sibaud <bsibaud@april.org>
1.1.1.2 misho 5068: 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
5069: >14 string x (version %s)
1.1 misho 5070:
1.1.1.3 misho 5071: # From: Stephane Blondon http://www.yaal.fr
5072: # Database file for Zope (done by FileStorage)
5073: 0 string FS21 Zope Object Database File Storage (data)
5074: # Cache file for the database of Zope (done by ClientStorage)
5075: 0 string ZEC3 Zope Object Database Client Cache File (data)
5076:
5077: # IDA (Interactive Disassembler) database
5078: 0 string IDA1 IDA (Interactive Disassembler) database
5079:
1.1 misho 5080: #------------------------------------------------------------------------------
1.1.1.2 misho 5081: # $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
1.1 misho 5082: # diamond: file(1) magic for Diamond system
5083: #
5084: # ... diamond is a multi-media mail and electronic conferencing system....
5085: #
5086: # XXX - I think it was either renamed Slate, or replaced by Slate....
5087: #
5088: # The full deal is too long...
5089: #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
5090: 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
1.1.1.2 misho 5091:
1.1 misho 5092: #------------------------------------------------------------------------------
1.1.1.3 misho 5093: # $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
1.1 misho 5094: # diff: file(1) magic for diff(1) output
5095: #
5096: 0 search/1 diff\ diff output text
5097: !:mime text/x-diff
5098: 0 search/1 ***\ diff output text
5099: !:mime text/x-diff
5100: 0 search/1 Only\ in\ diff output text
5101: !:mime text/x-diff
5102: 0 search/1 Common\ subdirectories:\ diff output text
5103: !:mime text/x-diff
5104:
5105: 0 search/1 Index: RCS/CVS diff output text
5106: !:mime text/x-diff
1.1.1.2 misho 5107:
5108: # bsdiff: file(1) magic for bsdiff(1) output
1.1.1.3 misho 5109: 0 string/b BSDIFF40 bsdiff(1) patch file
5110:
5111:
5112: # unified diff
5113: 0 search/4096 ---\
5114: >&0 search/1024 \n
5115: >>&0 search/1 +++\
5116: >>>&0 search/1024 \n
5117: >>>>&0 search/1 @@ unified diff output text
5118: !:mime text/x-diff
5119: !:strength + 90
5120:
5121: # librsync -- the library for network deltas
5122: #
5123: # Copyright (C) 2001 by Martin Pool. You may do whatever you want with
5124: # this file.
5125: #
5126: 0 belong 0x72730236 rdiff network-delta data
5127:
5128: 0 belong 0x72730136 rdiff network-delta signature data
5129: >4 belong x (block length=%d,
5130: >8 belong x signature strength=%d)
1.1.1.2 misho 5131:
5132: #------------------------------------------------------------------------------
1.1.1.3 misho 5133: # $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
1.1 misho 5134: # Digital UNIX - Info
5135: #
5136: 0 string =!<arch>\n________64E Alpha archive
5137: >22 string X -- out of date
5138: #
1.1.1.3 misho 5139:
5140: 0 leshort 0603
5141: >24 leshort 0410 COFF format alpha pure
5142: >24 leshort 0413 COFF format alpha demand paged
5143: >>22 leshort&030000 !020000 executable
5144: >>22 leshort&020000 !0 dynamically linked
5145: >>16 lelong !0 not stripped
5146: >>16 lelong 0 stripped
5147: >>27 byte x - version %d
5148: >>26 byte x \b.%d
5149: >>28 byte x \b-%d
5150: >24 leshort 0407 COFF format alpha object
5151: >>22 leshort&030000 020000 shared library
5152: >>27 byte x - version %d
5153: >>26 byte x \b.%d
5154: >>28 byte x \b-%d
5155:
5156: # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
5157: #
5158: # The actual magic number is just "Core", followed by a 2-byte version
5159: # number; however, treating any file that begins with "Core" as a Digital
5160: # UNIX core dump file may produce too many false hits, so we include one
5161: # byte of the version number as well; DU 5.0 appears only to be up to
5162: # version 2.
5163: #
5164: 0 string Core\001 Alpha COFF format core dump (Digital UNIX)
5165: >24 string >\0 \b, from '%s'
5166: 0 string Core\002 Alpha COFF format core dump (Digital UNIX)
5167: >24 string >\0 \b, from '%s'
1.1 misho 5168: #
5169: # The next is incomplete, we could tell more about this format,
5170: # but its not worth it.
5171: 0 leshort 0x188 Alpha compressed COFF
5172: 0 leshort 0x18f Alpha u-code object
5173: #
5174: #
5175: # Some other interesting Digital formats,
5176: 0 string \377\377\177 ddis/ddif
5177: 0 string \377\377\174 ddis/dots archive
5178: 0 string \377\377\176 ddis/dtif table data
5179: 0 string \033c\033 LN03 output
5180: 0 long 04553207 X image
5181: #
5182: 0 string =!<PDF>!\n profiling data file
5183: #
5184: # Locale data tables (MIPS and Alpha).
5185: #
5186: 0 short 0x0501 locale data table
5187: >6 short 0x24 for MIPS
5188: >6 short 0x40 for Alpha
1.1.1.2 misho 5189:
5190: #------------------------------------------------------------------------------
1.1.1.3 misho 5191: # $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $
1.1 misho 5192: # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
5193: # from http://www.atsc.org/standards/a_52a.pdf
5194: # corrections, additions, etc. are always welcome!
5195: #
5196: # syncword
5197: 0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
1.1.1.3 misho 5198: !:mime audio/vnd.dolby.dd-raw
1.1 misho 5199: # fscod
5200: >4 byte&0xc0 0x00 48 kHz,
5201: >4 byte&0xc0 0x40 44.1 kHz,
5202: >4 byte&0xc0 0x80 32 kHz,
5203: # is this one used for 96 kHz?
5204: >4 byte&0xc0 0xc0 reserved frequency,
5205: #
5206: >5 byte&7 = 0 \b, complete main (CM)
5207: >5 byte&7 = 1 \b, music and effects (ME)
5208: >5 byte&7 = 2 \b, visually impaired (VI)
5209: >5 byte&7 = 3 \b, hearing impaired (HI)
5210: >5 byte&7 = 4 \b, dialogue (D)
5211: >5 byte&7 = 5 \b, commentary (C)
5212: >5 byte&7 = 6 \b, emergency (E)
5213: # acmod
5214: >6 byte&0xe0 0x00 1+1 front,
5215: >6 byte&0xe0 0x20 1 front/0 rear,
5216: >6 byte&0xe0 0x40 2 front/0 rear,
5217: >6 byte&0xe0 0x60 3 front/0 rear,
5218: >6 byte&0xe0 0x80 2 front/1 rear,
5219: >6 byte&0xe0 0xa0 3 front/1 rear,
5220: >6 byte&0xe0 0xc0 2 front/2 rear,
5221: >6 byte&0xe0 0xe0 3 front/2 rear,
5222: # lfeon (these may be incorrect)
5223: >7 byte&0x40 0x00 LFE off,
5224: >7 byte&0x40 0x40 LFE on,
5225: #
5226: >4 byte&0x3e = 0x00 \b, 32 kbit/s
5227: >4 byte&0x3e = 0x02 \b, 40 kbit/s
5228: >4 byte&0x3e = 0x04 \b, 48 kbit/s
5229: >4 byte&0x3e = 0x06 \b, 56 kbit/s
5230: >4 byte&0x3e = 0x08 \b, 64 kbit/s
5231: >4 byte&0x3e = 0x0a \b, 80 kbit/s
5232: >4 byte&0x3e = 0x0c \b, 96 kbit/s
5233: >4 byte&0x3e = 0x0e \b, 112 kbit/s
5234: >4 byte&0x3e = 0x10 \b, 128 kbit/s
5235: >4 byte&0x3e = 0x12 \b, 160 kbit/s
5236: >4 byte&0x3e = 0x14 \b, 192 kbit/s
5237: >4 byte&0x3e = 0x16 \b, 224 kbit/s
5238: >4 byte&0x3e = 0x18 \b, 256 kbit/s
5239: >4 byte&0x3e = 0x1a \b, 320 kbit/s
5240: >4 byte&0x3e = 0x1c \b, 384 kbit/s
5241: >4 byte&0x3e = 0x1e \b, 448 kbit/s
5242: >4 byte&0x3e = 0x20 \b, 512 kbit/s
5243: >4 byte&0x3e = 0x22 \b, 576 kbit/s
5244: >4 byte&0x3e = 0x24 \b, 640 kbit/s
5245: # dsurmod (these may be incorrect)
5246: >6 beshort&0x0180 0x0000 Dolby Surround not indicated
5247: >6 beshort&0x0180 0x0080 not Dolby Surround encoded
5248: >6 beshort&0x0180 0x0100 Dolby Surround encoded
5249: >6 beshort&0x0180 0x0180 reserved Dolby Surround mode
5250:
5251: #------------------------------------------------------------------------------
1.1.1.3 misho 5252: # $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
1.1 misho 5253: # dump: file(1) magic for dump file format--for new and old dump filesystems
5254: #
5255: # We specify both byte orders in order to recognize byte-swapped dumps.
5256: #
1.1.1.3 misho 5257: 0 name new-dump-be
1.1 misho 5258: >4 bedate x Previous dump %s,
5259: >8 bedate x This dump %s,
5260: >12 belong >0 Volume %ld,
5261: >692 belong 0 Level zero, type:
5262: >692 belong >0 Level %d, type:
5263: >0 belong 1 tape header,
5264: >0 belong 2 beginning of file record,
5265: >0 belong 3 map of inodes on tape,
5266: >0 belong 4 continuation of file record,
5267: >0 belong 5 end of volume,
5268: >0 belong 6 map of inodes deleted,
5269: >0 belong 7 end of medium (for floppy),
5270: >676 string >\0 Label %s,
5271: >696 string >\0 Filesystem %s,
5272: >760 string >\0 Device %s,
5273: >824 string >\0 Host %s,
5274: >888 belong >0 Flags %x
5275:
1.1.1.3 misho 5276: 0 name old-dump-be
1.1 misho 5277: #>4 bedate x Previous dump %s,
5278: #>8 bedate x This dump %s,
5279: >12 belong >0 Volume %ld,
5280: >692 belong 0 Level zero, type:
5281: >692 belong >0 Level %d, type:
5282: >0 belong 1 tape header,
5283: >0 belong 2 beginning of file record,
5284: >0 belong 3 map of inodes on tape,
5285: >0 belong 4 continuation of file record,
5286: >0 belong 5 end of volume,
5287: >0 belong 6 map of inodes deleted,
5288: >0 belong 7 end of medium (for floppy),
5289: >676 string >\0 Label %s,
5290: >696 string >\0 Filesystem %s,
5291: >760 string >\0 Device %s,
5292: >824 string >\0 Host %s,
5293: >888 belong >0 Flags %x
5294:
1.1.1.3 misho 5295: 0 name ufs2-dump-be
1.1 misho 5296: >896 beqdate x Previous dump %s,
5297: >904 beqdate x This dump %s,
5298: >12 belong >0 Volume %ld,
5299: >692 belong 0 Level zero, type:
5300: >692 belong >0 Level %d, type:
5301: >0 belong 1 tape header,
5302: >0 belong 2 beginning of file record,
5303: >0 belong 3 map of inodes on tape,
5304: >0 belong 4 continuation of file record,
5305: >0 belong 5 end of volume,
5306: >0 belong 6 map of inodes deleted,
5307: >0 belong 7 end of medium (for floppy),
5308: >676 string >\0 Label %s,
5309: >696 string >\0 Filesystem %s,
5310: >760 string >\0 Device %s,
5311: >824 string >\0 Host %s,
5312: >888 belong >0 Flags %x
5313:
1.1.1.3 misho 5314: 24 belong 60012 new-fs dump file (big endian),
5315: >0 use new-dump-be
5316:
5317: 24 belong 60011 old-fs dump file (big endian),
5318: >0 use old-dump-be
5319:
5320: 24 lelong 60012 new-fs dump file (little endian),
5321: >0 use \^new-dump-be
5322:
5323: 24 lelong 60011 old-fs dump file (little endian),
5324: >0 use \^old-dump-be
5325:
5326:
5327: 24 belong 0x19540119 new-fs dump file (ufs2, big endian),
5328: >0 use ufs2-dump-be
5329:
5330: 24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
5331: >0 use \^ufs2-dump-be
5332:
5333: 18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
5334: >2 medate x Previous dump %s,
5335: >6 medate x This dump %s,
5336: >10 leshort >0 Volume %ld,
5337: >0 leshort 1 tape header.
5338: >0 leshort 2 beginning of file record.
5339: >0 leshort 3 map of inodes on tape.
5340: >0 leshort 4 continuation of file record.
5341: >0 leshort 5 end of volume.
5342: >0 leshort 6 map of inodes deleted.
5343: >0 leshort 7 end of medium (for floppy).
1.1 misho 5344:
5345: #------------------------------------------------------------------------------
1.1.1.3 misho 5346: # $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
1.1 misho 5347: # Dyadic: file(1) magic for Dyalog APL.
5348: #
1.1.1.2 misho 5349: 0 byte 0xaa
1.1 misho 5350: >1 byte <4 Dyalog APL
5351: >>1 byte 0x00 incomplete workspace
5352: >>1 byte 0x01 component file
5353: >>1 byte 0x02 external variable
5354: >>1 byte 0x03 workspace
5355: >>2 byte x version %d
5356: >>3 byte x .%d
5357:
1.1.1.2 misho 5358: 0 beshort 0xaa03 Dyalog APL
5359: >2 byte x workspace type %d
5360: >3 byte x subtype %d
5361: >7 byte&0x28 0x00 32-bit
5362: >7 byte&0x28 0x20 64-bit
5363: >7 byte&0x0c 0x00 classic
5364: >7 byte&0x0c 0x04 unicode
5365: >7 byte&0x88 0x00 big-endian
5366: >7 byte&0x88 0x80 little-endian
5367:
5368: 0 byte 0xaa Dyalog APL
5369: >1 byte 0x00 aplcore
5370: >1 byte 0x01 component file 32-bit non-journaled non-checksummed
5371: >1 byte 0x02 external variable exclusive
5372: >1 byte 0x06 external variable shared
5373: >1 byte 0x07 session
5374: >1 byte 0x08 mapped file 32-bit
5375: >1 byte 0x09 component file 64-bit non-journaled non-checksummed
5376: >1 byte 0x0a mapped file 64-bit
5377: >1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
5378: >1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
5379: >1 byte 0x0d component file 32-bit level 1 journaled checksummed
5380: >1 byte 0x0e component file 64-bit level 1 journaled checksummed
5381: >1 byte 0x0f component file 32-bit level 2 journaled checksummed
5382: >1 byte 0x10 component file 64-bit level 2 journaled checksummed
5383: >1 byte 0x11 component file 32-bit level 3 journaled checksummed
5384: >1 byte 0x12 component file 64-bit level 3 journaled checksummed
5385: >1 byte 0x13 component file 32-bit non-journaled checksummed
5386: >1 byte 0x14 component file 64-bit non-journaled checksummed
5387: >1 byte 0x80 DDB
5388:
5389: 0 short 0x6060 Dyalog APL transfer
5390:
1.1 misho 5391: #------------------------------------------------------------------------------
1.1.1.3 misho 5392: # $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
5393: # ebml: file(1) magic for various Extensible Binary Meta Language
5394: # http://www.matroska.org/technical/specs/index.html#track
5395: 0 belong 0x1a45dfa3 EBML file
5396: >4 search/b/100 \102\202
5397: >>&1 string x \b, creator %.8s
5398:
5399: #------------------------------------------------------------------------------
1.1.1.2 misho 5400: # $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $
1.1 misho 5401: # T602 editor documents
5402: # by David Necas <yeti@physics.muni.cz>
5403: 0 string @CT\ T602 document data,
5404: >4 string 0 Kamenicky
5405: >4 string 1 CP 852
5406: >4 string 2 KOI8-CS
5407: >4 string >2 unknown encoding
5408:
5409: # Vi IMproved Encrypted file
5410: # by David Necas <yeti@physics.muni.cz>
5411: 0 string VimCrypt~ Vim encrypted file data
5412: # Vi IMproved Swap file
5413: # by Sven Wegener <swegener@gentoo.org>
5414: 0 string b0VIM\ Vim swap file
5415: >&0 string >\0 \b, version %s
5416:
5417: #------------------------------------------------------------------------------
1.1.1.2 misho 5418: # $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 5419: # efi: file(1) magic for Universal EFI binaries
5420:
5421: 0 lelong 0x0ef1fab9
5422: >4 lelong 1 Universal EFI binary with 1 architecture
5423: >>&0 lelong 7 \b, i386
5424: >>&0 lelong 0x01000007 \b, x86_64
5425: >4 lelong 2 Universal EFI binary with 2 architectures
5426: >>&0 lelong 7 \b, i386
5427: >>&0 lelong 0x01000007 \b, x86_64
5428: >>&20 lelong 7 \b, i386
5429: >>&20 lelong 0x01000007 \b, x86_64
5430: >4 lelong >2 Universal EFI binary with %ld architectures
5431:
5432: #------------------------------------------------------------------------------
1.1.1.3 misho 5433: # $File: elf,v 1.59 2013/03/21 17:50:02 christos Exp $
1.1 misho 5434: # elf: file(1) magic for ELF executables
5435: #
5436: # We have to check the byte order flag to see what byte order all the
5437: # other stuff in the header is in.
5438: #
5439: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
5440: #
5441: # Created by: unknown
5442: # Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
5443: # Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
5444: # Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
5445: # Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
5446: # Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
1.1.1.3 misho 5447:
5448: 0 name elf-le
5449: >16 leshort 0 no file type,
1.1 misho 5450: !:mime application/octet-stream
1.1.1.3 misho 5451: >16 leshort 1 relocatable,
1.1 misho 5452: !:mime application/x-object
1.1.1.3 misho 5453: >16 leshort 2 executable,
1.1 misho 5454: !:mime application/x-executable
1.1.1.3 misho 5455: >16 leshort 3 shared object,
1.1 misho 5456: !:mime application/x-sharedlib
1.1.1.3 misho 5457: >16 leshort 4 core file
1.1 misho 5458: !:mime application/x-coredump
5459: # Core file detection is not reliable.
5460: #>>>(0x38+0xcc) string >\0 of '%s'
5461: #>>>(0x38+0x10) lelong >0 (signal %d),
1.1.1.3 misho 5462: >16 leshort &0xff00 processor-specific,
5463: >18 leshort 0 no machine,
5464: >18 leshort 1 AT&T WE32100
5465: >18 leshort 2 SPARC
5466: >18 leshort 3 Intel 80386,
5467: >18 leshort 4 Motorola
5468: >>4 byte 1
1.1 misho 5469: >>>36 lelong &0x01000000 68000 - invalid byte order,
5470: >>>36 lelong &0x00810000 CPU32 - invalid byte order,
5471: >>>36 lelong 0 68020 - invalid byte order,
1.1.1.3 misho 5472: >18 leshort 5 Motorola 88000 - invalid byte order,
5473: >18 leshort 6 Intel 80486,
5474: >18 leshort 7 Intel 80860,
1.1 misho 5475: # The official e_machine number for MIPS is now #8, regardless of endianness.
5476: # The second number (#10) will be deprecated later. For now, we still
5477: # say something if #10 is encountered, but only gory details for #8.
1.1.1.3 misho 5478: >18 leshort 8 MIPS,
5479: >>4 byte 1
1.1 misho 5480: >>>36 lelong &0x20 N32
1.1.1.3 misho 5481: >18 leshort 10 MIPS,
5482: >>4 byte 1
1.1 misho 5483: >>>36 lelong &0x20 N32
1.1.1.3 misho 5484: >18 leshort 8
1.1 misho 5485: # only for 32-bit
1.1.1.3 misho 5486: >>4 byte 1
5487: >>>36 lelong&0xf0000000 0x00000000 MIPS-I
5488: >>>36 lelong&0xf0000000 0x10000000 MIPS-II
5489: >>>36 lelong&0xf0000000 0x20000000 MIPS-III
5490: >>>36 lelong&0xf0000000 0x30000000 MIPS-IV
5491: >>>36 lelong&0xf0000000 0x40000000 MIPS-V
5492: >>>36 lelong&0xf0000000 0x50000000 MIPS32
5493: >>>36 lelong&0xf0000000 0x60000000 MIPS64
5494: >>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
5495: >>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
1.1 misho 5496: # only for 64-bit
1.1.1.3 misho 5497: >>4 byte 2
5498: >>>48 lelong&0xf0000000 0x00000000 MIPS-I
5499: >>>48 lelong&0xf0000000 0x10000000 MIPS-II
5500: >>>48 lelong&0xf0000000 0x20000000 MIPS-III
5501: >>>48 lelong&0xf0000000 0x30000000 MIPS-IV
5502: >>>48 lelong&0xf0000000 0x40000000 MIPS-V
5503: >>>48 lelong&0xf0000000 0x50000000 MIPS32
5504: >>>48 lelong&0xf0000000 0x60000000 MIPS64
5505: >>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
5506: >>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
5507: >18 leshort 9 Amdahl - invalid byte order,
5508: >18 leshort 10 MIPS (deprecated),
5509: >18 leshort 11 RS6000 - invalid byte order,
5510: >18 leshort 15 PA-RISC - invalid byte order,
5511: # only for 32-bit
5512: >>4 byte 1
5513: >>>38 leshort 0x0214 2.0
5514: >>>36 leshort &0x0008 (LP64)
5515: # only for 64-bit
5516: >>4 byte 2
1.1 misho 5517: >>>50 leshort 0x0214 2.0
1.1.1.3 misho 5518: >>>48 leshort &0x0008 (LP64)
5519: >18 leshort 16 nCUBE,
5520: >18 leshort 17 Fujitsu VPP500,
5521: >18 leshort 18 SPARC32PLUS,
1.1 misho 5522: # only for 32-bit
1.1.1.3 misho 5523: >>4 byte 1
5524: >>>36 lelong&0xffff00 0x000100 V8+ Required,
5525: >>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
5526: >>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
5527: >>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
5528: >18 leshort 20 PowerPC or cisco 4500,
5529: >18 leshort 21 64-bit PowerPC or cisco 7500,
5530: >18 leshort 22 IBM S/390,
5531: >18 leshort 23 Cell SPU,
5532: >18 leshort 24 cisco SVIP,
5533: >18 leshort 25 cisco 7200,
5534: >18 leshort 36 NEC V800 or cisco 12000,
5535: >18 leshort 37 Fujitsu FR20,
5536: >18 leshort 38 TRW RH-32,
5537: >18 leshort 39 Motorola RCE,
5538: >18 leshort 40 ARM,
5539: >>4 byte 1
5540: >>>36 lelong&0xff000000 0x04000000 EABI4
5541: >>>36 lelong&0xff000000 0x05000000 EABI5
5542: >18 leshort 41 Alpha,
5543: >18 leshort 0xa390 IBM S/390 (obsolete),
5544: >18 leshort 42 Renesas SH,
5545: >18 leshort 43 SPARC V9,
5546: >>4 byte 2
5547: >>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
5548: >>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
5549: >>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
5550: >>>48 lelong&0x3 0 total store ordering,
5551: >>>48 lelong&0x3 1 partial store ordering,
5552: >>>48 lelong&0x3 2 relaxed memory ordering,
5553: >18 leshort 44 Siemens Tricore Embedded Processor,
5554: >18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
5555: >18 leshort 46 Renesas H8/300,
5556: >18 leshort 47 Renesas H8/300H,
5557: >18 leshort 48 Renesas H8S,
5558: >18 leshort 49 Renesas H8/500,
5559: >18 leshort 50 IA-64,
5560: >18 leshort 51 Stanford MIPS-X,
5561: >18 leshort 52 Motorola Coldfire,
5562: >18 leshort 53 Motorola M68HC12,
5563: >18 leshort 54 Fujitsu MMA,
5564: >18 leshort 55 Siemens PCP,
5565: >18 leshort 56 Sony nCPU,
5566: >18 leshort 57 Denso NDR1,
5567: >18 leshort 58 Start*Core,
5568: >18 leshort 59 Toyota ME16,
5569: >18 leshort 60 ST100,
5570: >18 leshort 61 Tinyj emb.,
5571: >18 leshort 62 x86-64,
5572: >18 leshort 63 Sony DSP,
5573: >18 leshort 66 FX66,
5574: >18 leshort 67 ST9+ 8/16 bit,
5575: >18 leshort 68 ST7 8 bit,
5576: >18 leshort 69 MC68HC16,
5577: >18 leshort 70 MC68HC11,
5578: >18 leshort 71 MC68HC08,
5579: >18 leshort 72 MC68HC05,
5580: >18 leshort 73 SGI SVx or Cray NV1,
5581: >18 leshort 74 ST19 8 bit,
5582: >18 leshort 75 Digital VAX,
5583: >18 leshort 76 Axis cris,
5584: >18 leshort 77 Infineon 32-bit embedded,
5585: >18 leshort 78 Element 14 64-bit DSP,
5586: >18 leshort 79 LSI Logic 16-bit DSP,
5587: >18 leshort 80 MMIX,
5588: >18 leshort 81 Harvard machine-independent,
5589: >18 leshort 82 SiTera Prism,
5590: >18 leshort 83 Atmel AVR 8-bit,
5591: >18 leshort 84 Fujitsu FR30,
5592: >18 leshort 85 Mitsubishi D10V,
5593: >18 leshort 86 Mitsubishi D30V,
5594: >18 leshort 87 NEC v850,
5595: >18 leshort 88 Renesas M32R,
5596: >18 leshort 89 Matsushita MN10300,
5597: >18 leshort 90 Matsushita MN10200,
5598: >18 leshort 91 picoJava,
5599: >18 leshort 92 OpenRISC,
5600: >18 leshort 93 ARC Cores Tangent-A5,
5601: >18 leshort 94 Tensilica Xtensa,
5602: >18 leshort 97 NatSemi 32k,
5603: >18 leshort 106 Analog Devices Blackfin,
5604: >18 leshort 113 Altera Nios II,
5605: >18 leshort 174 META,
5606: >18 leshort 183 ARM aarch64,
5607: >18 leshort 187 Tilera TILE64,
5608: >18 leshort 188 Tilera TILEPro,
5609: >18 leshort 191 Tilera TILE-Gx,
5610: >18 leshort 0x3426 OpenRISC (obsolete),
5611: >18 leshort 0x8472 OpenRISC (obsolete),
5612: >18 leshort 0x9026 Alpha (unofficial),
5613: >20 lelong 0 invalid version
5614: >20 lelong 1 version 1
5615:
5616: 0 string \177ELF ELF
5617: !:strength *2
5618: >4 byte 0 invalid class
5619: >4 byte 1 32-bit
5620: >4 byte 2 64-bit
5621: >5 byte 0 invalid byte order
5622: >5 byte 1 LSB
5623: >>0 use elf-le
5624: >5 byte 2 MSB
5625: >>0 use \^elf-le
1.1 misho 5626: # Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
5627: # like proper ELF, but extracting the string had bad results.
5628: >4 byte <0x80
5629: >>8 string >\0 (%s)
5630: >8 string \0
5631: >>7 byte 0 (SYSV)
5632: >>7 byte 1 (HP-UX)
5633: >>7 byte 2 (NetBSD)
5634: >>7 byte 3 (GNU/Linux)
5635: >>7 byte 4 (GNU/Hurd)
5636: >>7 byte 5 (86Open)
5637: >>7 byte 6 (Solaris)
5638: >>7 byte 7 (Monterey)
5639: >>7 byte 8 (IRIX)
5640: >>7 byte 9 (FreeBSD)
5641: >>7 byte 10 (Tru64)
5642: >>7 byte 11 (Novell Modesto)
5643: >>7 byte 12 (OpenBSD)
5644: >8 string \2
5645: >>7 byte 13 (OpenVMS)
5646: >>7 byte 97 (ARM)
5647: >>7 byte 255 (embedded)
5648:
5649: #------------------------------------------------------------------------------
1.1.1.2 misho 5650: # $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
1.1 misho 5651: # encore: file(1) magic for Encore machines
5652: #
5653: # XXX - needs to have the byte order specified (NS32K was little-endian,
5654: # dunno whether they run the 88K in little-endian mode or not).
5655: #
5656: 0 short 0x154 Encore
5657: >20 short 0x107 executable
5658: >20 short 0x108 pure executable
5659: >20 short 0x10b demand-paged executable
5660: >20 short 0x10f unsupported executable
5661: >12 long >0 not stripped
5662: >22 short >0 - version %ld
5663: >22 short 0 -
5664: #>4 date x stamp %s
5665: 0 short 0x155 Encore unsupported executable
5666: >12 long >0 not stripped
5667: >22 short >0 - version %ld
5668: >22 short 0 -
5669: #>4 date x stamp %s
5670:
5671: #------------------------------------------------------------------------------
1.1.1.3 misho 5672: # $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $
1.1.1.2 misho 5673: # EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
5674: # Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
5675: # Useful information for improving this file can be found at:
5676: # http://software.frodo.looijaard.name/psiconv/formats/Index.html
5677: #------------------------------------------------------------------------------
5678: 0 lelong 0x10000037 Psion Series 5
5679: >4 lelong 0x10000039 font file
5680: >4 lelong 0x1000003A printer driver
5681: >4 lelong 0x1000003B clipboard
5682: >4 lelong 0x10000042 multi-bitmap image
5683: !:mime image/x-epoc-mbm
5684: >4 lelong 0x1000006A application information file
1.1 misho 5685: >4 lelong 0x1000006D
1.1.1.2 misho 5686: >>8 lelong 0x1000007D Sketch image
5687: !:mime image/x-epoc-sketch
5688: >>8 lelong 0x1000007E voice note
5689: >>8 lelong 0x1000007F Word file
5690: !:mime application/x-epoc-word
5691: >>8 lelong 0x10000085 OPL program (TextEd)
5692: !:mime application/x-epoc-opl
1.1.1.3 misho 5693: >>8 lelong 0x10000087 Comms settings
1.1.1.2 misho 5694: >>8 lelong 0x10000088 Sheet file
5695: !:mime application/x-epoc-sheet
5696: >>8 lelong 0x100001C4 EasyFax initialisation file
5697: >4 lelong 0x10000073 OPO module
5698: !:mime application/x-epoc-opo
5699: >4 lelong 0x10000074 OPL application
5700: !:mime application/x-epoc-app
5701: >4 lelong 0x1000008A exported multi-bitmap image
1.1.1.3 misho 5702: >4 lelong 0x1000016D
5703: >>8 lelong 0x10000088 Comms names
1.1.1.2 misho 5704:
5705: 0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
5706:
5707: 0 lelong 0x10000050 Psion Series 5
5708: >4 lelong 0x1000006D database
1.1.1.3 misho 5709: >>8 lelong 0x10000084 Agenda file
5710: !:mime application/x-epoc-agenda
5711: >>8 lelong 0x10000086 Data file
5712: !:mime application/x-epoc-data
5713: >>8 lelong 0x10000CEA Jotter file
5714: !:mime application/x-epoc-jotter
1.1.1.2 misho 5715: >4 lelong 0x100000E4 ini file
5716:
5717: 0 lelong 0x10000079 Psion Series 5 binary:
5718: >4 lelong 0x00000000 DLL
5719: >4 lelong 0x10000049 comms hardware library
5720: >4 lelong 0x1000004A comms protocol library
5721: >4 lelong 0x1000005D OPX
5722: >4 lelong 0x1000006C application
5723: >4 lelong 0x1000008D DLL
5724: >4 lelong 0x100000AC logical device driver
5725: >4 lelong 0x100000AD physical device driver
5726: >4 lelong 0x100000E5 file transfer protocol
5727: >4 lelong 0x100000E5 file transfer protocol
5728: >4 lelong 0x10000140 printer definition
5729: >4 lelong 0x10000141 printer definition
5730:
5731: 0 lelong 0x1000007A Psion Series 5 executable
1.1 misho 5732:
5733: #------------------------------------------------------------------------------
1.1.1.3 misho 5734: # $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
1.1 misho 5735: # erlang: file(1) magic for Erlang JAM and BEAM files
5736: # URL: http://www.erlang.org/faq/x779.html#AEN812
5737:
5738: # OTP R3-R4
5739: 0 string \0177BEAM! Old Erlang BEAM file
5740: >6 short >0 - version %d
5741:
5742: # OTP R5 and onwards
5743: 0 string FOR1
5744: >8 string BEAM Erlang BEAM file
5745:
5746: # 4.2 version may have a copyright notice!
1.1.1.2 misho 5747: 4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
5748: 79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
1.1 misho 5749:
1.1.1.2 misho 5750: 4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3
5751:
5752: 0 bequad 0x0000000000ABCDEF Erlang DETS file
1.1 misho 5753:
5754: #------------------------------------------------------------------------------
1.1.1.2 misho 5755: # $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 5756: # ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
5757: # Based on info from
5758: # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
5759: 0 belong 9994 ESRI Shapefile
5760: >4 belong =0
5761: >8 belong =0
5762: >12 belong =0
5763: >16 belong =0
5764: >20 belong =0
5765: >28 lelong x version %d
5766: >24 belong x length %d
5767: >32 lelong =0 type Null Shape
5768: >32 lelong =1 type Point
5769: >32 lelong =3 type PolyLine
5770: >32 lelong =5 type Polygon
5771: >32 lelong =8 type MultiPoint
5772: >32 lelong =11 type PointZ
5773: >32 lelong =13 type PolyLineZ
5774: >32 lelong =15 type PolygonZ
5775: >32 lelong =18 type MultiPointZ
5776: >32 lelong =21 type PointM
5777: >32 lelong =23 type PolyLineM
5778: >32 lelong =25 type PolygonM
5779: >32 lelong =28 type MultiPointM
5780: >32 lelong =31 type MultiPatch
5781:
5782: #------------------------------------------------------------------------------
1.1.1.2 misho 5783: # $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 5784: # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
5785: # From Roger Leigh <roger@whinlatter.uklinux.net>
5786: 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
5787: 0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
5788: 0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
5789:
5790:
5791: #------------------------------------------------------------------------------
1.1.1.3 misho 5792: # $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $
1.1 misho 5793: # filesystems: file(1) magic for different filesystems
5794: #
5795: 0 string \366\366\366\366 PC formatted floppy with no filesystem
5796: # Sun disk labels
5797: # From /usr/include/sun/dklabel.h:
5798: 0774 beshort 0xdabe
5799: # modified by Joerg Jenderek, because original test
5800: # succeeds for Cabinet archive dao360.dl_ with negative blocks
5801: >0770 long >0 Sun disk label
5802: >>0 string x '%s
5803: >>>31 string >\0 \b%s
5804: >>>>63 string >\0 \b%s
5805: >>>>>95 string >\0 \b%s
5806: >>0 string x \b'
5807: >>0734 short >0 %d rpm,
5808: >>0736 short >0 %d phys cys,
5809: >>0740 short >0 %d alts/cyl,
5810: >>0746 short >0 %d interleave,
5811: >>0750 short >0 %d data cyls,
5812: >>0752 short >0 %d alt cyls,
5813: >>0754 short >0 %d heads/partition,
5814: >>0756 short >0 %d sectors/track,
5815: >>0764 long >0 start cyl %ld,
5816: >>0770 long x %ld blocks
5817: # Is there a boot block written 1 sector in?
5818: >512 belong&077777777 0600407 \b, boot block present
1.1.1.3 misho 5819:
5820: # Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
1.1 misho 5821: # (http://btmgr.sourceforge.net/docs/user-guide-3.html)
5822: 0 string SBMBAKUP_ Smart Boot Manager backup file
5823: >9 string x \b, version %-5.5s
5824: >>14 string =_
5825: >>>15 string x %-.1s
5826: >>>>16 string =_ \b.
5827: >>>>>17 string x \b%-.1s
5828: >>>>>>18 string =_ \b.
5829: >>>>>>>19 string x \b%-.1s
5830: >>>22 ubyte 0
5831: >>>>21 ubyte x \b, from drive 0x%x
5832: >>>22 ubyte >0
5833: >>>>21 string x \b, from drive %s
1.1.1.3 misho 5834: >>>535 search/17 \x55\xAA
5835: >>>>&-512 indirect x \b; contains
1.1 misho 5836:
1.1.1.3 misho 5837: # updated by Joerg Jenderek at Nov 2012
1.1 misho 5838: # DOS Emulator image is 128 byte, null right padded header + harddisc image
5839: 0 string DOSEMU\0
5840: >0x27E leshort 0xAA55
5841: #offset is 128
5842: >>19 ubyte 128
5843: >>>(19.b-1) ubyte 0x0 DOS Emulator image
5844: >>>>7 ulelong >0 \b, %u heads
5845: >>>>11 ulelong >0 \b, %d sectors/track
5846: >>>>15 ulelong >0 \b, %d cylinders
1.1.1.3 misho 5847: >>>>128 indirect x \b; contains
1.1 misho 5848:
1.1.1.3 misho 5849: # x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
5850: # for any allowed sector sizes
5851: 30 search/481 \x55\xAA
5852: # to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
5853: # DOS BPB information (70) and after DOS floppy (120) like in previous file version
5854: !:strength +72
5855: # for sector sizes < 512 Bytes
5856: >11 uleshort <512
5857: >>(11.s-2) uleshort 0xAA55 x86 boot sector
5858: # for sector sizes with 512 or more Bytes
5859: >0x1FE leshort 0xAA55 x86 boot sector
5860: # keep old x86 boot sector as dummy for mbr and bootloader displaying
1.1 misho 5861: # only for sector sizes with 512 or more Bytes
1.1.1.3 misho 5862: 0x1FE leshort 0xAA55
5863: # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
5864: !:strength +21
1.1 misho 5865: >2 string OSBS \b, OS/BS MBR
1.1.1.3 misho 5866: # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
5867: # and http://en.wikipedia.org/wiki/Master_Boot_Record
5868: # test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
5869: # characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
5870: >0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
5871: # Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
5872: # assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
5873: >>8 ubequad 0x8bf45007501ffbfc
5874: # http://thestarman.pcministry.com/asm/mbr/200MBR.htm
5875: >>>0x16 ubyte 0xF3 \b,DOS 2
5876: >>>>219 regex Author\ -\ Author:
5877: # found "David Litton" , "A Pehrsson "
5878: >>>>>&0 string x "%s"
5879: >>>0x16 ubyte 0xF2
5880: # NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
5881: # assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
5882: >>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
5883: # version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
5884: >>>>0x22 default x \b,D0S version 3.3-7.0
5885: # error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
5886: # where nn is string offset varying for different languages
5887: # "Invalid partition table" nn=0x8b for english version
5888: >>>>>(0x49.b) string Invalid\ partition\ table english
5889: >>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
5890: >>>>>(0x49.b) string Table\ de\ partition\ invalide french
5891: >>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
5892: >>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
5893: >>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
5894: >>>>>0x49 ubyte >0 at offset 0x%x
5895: >>>>>>(0x49.b) string >\0 "%s"
5896: # "Error loading operating system" nn=0xa3 for english version
5897: # "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
5898: # "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
5899: # "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
5900: # "Error al cargar sistema operativo" nn=0xa8 for spanish version
5901: # "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
5902: >>>>>0x74 ubyte >0 at offset 0x%x
5903: >>>>>>(0x74.b) string >\0 "%s"
5904: # "Missing operating system" nn=0xc2 for english version
5905: # "Betriebssystem fehlt" nn=0xcd for german version
5906: # "Syst\212me d'exploitation absent" nn=0xd2 for french version
5907: # "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
5908: # "Falta sistema operativo" nn=0xca for spanish version
5909: # "Sistema operativo mancante" nn=0xe2 for italian version
5910: >>>>>0x79 ubyte >0 at offset 0x%x
5911: >>>>>>(0x79.b) string >\0 "%s"
5912: # Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
5913: # assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
5914: >>8 ubequad 0x5007501ffcbe1b7c
5915: # assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
5916: >>>24 ubequad 0xf3a4cbbebe07b104 9M
5917: # "Invalid partition table" nn=0x10F for english version
5918: # "Ungültige Partitionstabelle" nn=0x10F for german version
5919: # "Table de partition erronée" nn=0x10F for french version
5920: # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
5921: >>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
5922: >>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
5923: >>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
5924: >>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
5925: >>>>0x3C ubyte x at offset 0x%x+0xFF
5926: >>>>(0x3C.b+0x0FF) string >\0 "%s"
5927: # "Error loading operating system" nn=0x127 for english version
5928: # "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
5929: # "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version
5930: # "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
5931: >>>>0xBD ubyte x at offset 0x1%x
5932: >>>>(0xBD.b+0x100) string >\0 "%s"
5933: # "Missing operating system" nn=0x146 for english version
5934: # "Betriebssystem fehlt" nn=0x151 for german version
5935: # "Système d'exploitation manquant" nn=0x15e for french version
5936: # "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
5937: >>>>0xA9 ubyte x at offset 0x1%x
5938: >>>>(0xA9.b+0x100) string >\0 "%s"
5939: # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
5940: # assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
5941: >>>24 ubequad 0xf3a4cbbdbe07b104 XP
5942: # where xxyyzz are lower bits from offsets of error messages varying for different languages
5943: >>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
5944: >>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
5945: # "Invalid partition table" xx=0x12C for english version
5946: # "Ungültige Partitionstabelle" xx=0x12C for german version
5947: >>>>0x1b5 ubyte >0 at offset 0x1%x
5948: >>>>(0x1b5.b+0x100) string >\0 "%s"
5949: # "Error loading operating system" yy=0x144 for english version
5950: # "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
5951: >>>>0x1b6 ubyte >0 at offset 0x1%x
5952: >>>>(0x1b6.b+0x100) string >\0 "%s"
5953: # "Missing operating system" zz=0x163 for english version
5954: # "Betriebssystem nicht vorhanden" zz=0x16e for german version
5955: >>>>0x1b7 ubyte >0 at offset 0x1%x
5956: >>>>(0x1b7.b+0x100) string >\0 "%s"
5957: # Microsoft Windows Vista or 7
5958: # assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
5959: >>8 ubequad 0xc08ed8be007cbf00
5960: # Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
5961: # assembler instructions: jnz 0729;cmp ebx,"TCPA"
5962: >>>0xEC ubequad 0x753b6681fb544350 Vista
5963: # where xxyyzz are lower bits from offsets of error messages varying for different languages
5964: >>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
5965: #>>>>0x1B4 ubelong&0x00FFFFFF ? german
5966: # "Invalid partition table" xx=0x162 for english version
5967: # "Ungültige Partitionstabelle" xx=0x1?? for german version
5968: >>>>0x1b5 ubyte >0 at offset 0x1%x
5969: >>>>(0x1b5.b+0x100) string >\0 "%s"
5970: # "Error loading operating system" yy=0x17a for english version
5971: # "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
5972: >>>>0x1b6 ubyte >0 at offset 0x1%x
5973: >>>>(0x1b6.b+0x100) string >\0 "%s"
5974: # "Missing operating system" zz=0x199 for english version
5975: # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
5976: >>>>0x1b7 ubyte >0 at offset 0x1%x
5977: >>>>(0x1b7.b+0x100) string >\0 "%s"
5978: # Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
5979: # assembler instructions: cmp ebx,"TCPA";cmp
5980: >>>0xEC ubequad 0x6681fb5443504175 Windows 7
5981: # where xxyyzz are lower bits from offsets of error messages varying for different languages
5982: >>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
5983: #>>>>0x1B4 ubelong&0x00FFFFFF ? german
5984: # "Invalid partition table" xx=0x163 for english version
5985: # "Ungültige Partitionstabelle" xx=0x1?? for german version
5986: >>>>0x1b5 ubyte >0 at offset 0x1%x
5987: >>>>(0x1b5.b+0x100) string >\0 "%s"
5988: # "Error loading operating system" yy=0x17b for english version
5989: # "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
5990: >>>>0x1b6 ubyte >0 at offset 0x1%x
5991: >>>>(0x1b6.b+0x100) string >\0 "%s"
5992: # "Missing operating system" zz=0x19a for english version
5993: # "Betriebssystem nicht vorhanden" zz=0x1?? for german version
5994: >>>>0x1b7 ubyte >0 at offset 0x1%x
5995: >>>>(0x1b7.b+0x100) string >\0 "%s"
5996: # http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
5997: # http://en.wikipedia.org/wiki/MBR_disk_signature#ID
5998: >>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
5999: # driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
6000: >>0xDA uleshort 0
6001: >>>0xDC ulelong >0 \b, created
6002: # physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
6003: >>>>0xDC ubyte x with driveID 0x%x
6004: # hours, minutes and seconds
6005: >>>>0xDf ubyte x at %x
6006: >>>>0xDe ubyte x \b:%x
6007: >>>>0xDd ubyte x \b:%x
6008: # special case for Microsoft MS-DOS 3.21 spanish
6009: # assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
6010: >0 ubequad 0xfab830008ed0bc00
6011: # assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
6012: >>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
6013: # Microsoft MBR IPL end
6014:
1.1 misho 6015: # dr-dos with some upper-, lowercase variants
6016: >0x9D string Invalid\ partition\ table$
6017: >>181 string No\ Operating\ System$
6018: >>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
6019: >0x9D string Invalid\ partition\ table$
6020: >>181 string No\ operating\ system$
6021: >>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
6022: >342 string Invalid\ partition\ table$
6023: >>366 string No\ operating\ system$
6024: >>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
6025: >295 string NEWLDR\0
6026: >>302 string Bad\ PT\ $
6027: >>>310 string No\ OS\ $
6028: >>>>317 string OS\ load\ err$
6029: >>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
6030: >>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
6031: >>>>>>>387 string Copyright\ (c)\ 1984,1998
6032: >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
1.1.1.3 misho 6033: #
6034: # tests for different MS-DOS Master Boot Records (MBR) moved and merged
6035: #
1.1.1.2 misho 6036: #>0x145 string Default:\ F \b, FREE-DOS MBR
6037: #>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
6038: >0x145 search/7 Default:\ F \b, FREE-DOS MBR
6039: #>>313 string F0\ .\ .\ .
6040: #>>>322 string disk\ 1
6041: #>>>>382 string FAT3
1.1 misho 6042: >64 string no\ active\ partition\ found
6043: >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
1.1.1.2 misho 6044: # Ranish Partition Manager http://www.ranish.com/part/
6045: >387 search/4 \0\ Error!\r
6046: >>378 search/7 Virus!
6047: >>>397 search/4 Booting\
6048: >>>>408 search/4 HD1/\0 \b, Ranish MBR (
6049: >>>>>416 string Writing\ changes... \b2.37
6050: >>>>>>438 ubyte x \b,0x%x dots
6051: >>>>>>440 ubyte >0 \b,virus check
6052: >>>>>>441 ubyte >0 \b,partition %c
6053: #2.38,2.42,2.44
6054: >>>>>416 string !Writing\ changes... \b
6055: >>>>>>418 ubyte 1 \bvirus check,
6056: >>>>>>419 ubyte x \b0x%x seconds
6057: >>>>>>420 ubyte&0x0F >0 \b,partition
6058: >>>>>>>420 ubyte&0x0F <5 \b %x
6059: >>>>>>>420 ubyte&0x0F 0Xf \b ask
6060: >>>>>420 ubyte x \b)
6061: #
1.1.1.3 misho 6062: # SYSLINUX MBR moved
1.1 misho 6063: # http://www.acronis.de/
6064: >362 string MBR\ Error\ \0\r
6065: >>376 string ress\ any\ key\ to\
6066: >>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
6067: # added by Joerg Jenderek
6068: # http://www.visopsys.org/
6069: # http://partitionlogic.org.uk/
6070: >309 string No\ bootable\ partition\ found\r
6071: >>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
6072: >349 string No\ bootable\ partition\ found\r
6073: >>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
6074: # bootloader, bootmanager
6075: >0x40 string SBML
6076: # label with 11 characters of FAT 12 bit filesystem
6077: >>43 string SMART\ BTMGR
1.1.1.2 misho 6078: >>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
6079: # OEM-ID not always "SBM"
6080: #>>>>3 strings SBM
6081: >>>>6 string >\0 \b, version %s
1.1 misho 6082: >382 string XOSLLOADXCF \b, eXtended Operating System Loader
6083: >6 string LILO \b, LInux i386 boot LOader
6084: >>120 string LILO \b, version 22.3.4 SuSe
6085: >>172 string LILO \b, version 22.5.8 Debian
1.1.1.2 misho 6086: # updated by Joerg Jenderek at Oct 2008
1.1 misho 6087: # variables according to grub-0.97/stage1/stage1.S or
6088: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
6089: # usual values are marked with comments to get only informations of strange GRUB loaders
1.1.1.2 misho 6090: >342 search/60 \0Geom\0
6091: #>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
1.1 misho 6092: >>0x41 ubyte <2
6093: >>>0x3E ubyte >2 \b; GRand Unified Bootloader
6094: # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
6095: >>>>0x3E ubyte x \b, stage1 version 0x%x
6096: #If it is 0xFF, use a drive passed by BIOS
6097: >>>>0x40 ubyte <0xFF \b, boot drive 0x%x
6098: # in most case 0,1,0x2e for GRUB 0.5.95
6099: >>>>0x41 ubyte >0 \b, LBA flag 0x%x
6100: >>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
6101: #>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
6102: >>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
6103: #>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
6104: >>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
6105: >>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
6106: #>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
6107: >>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
6108: >>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
6109: >>>>>394 string stage1 \b, GRUB version 0.5.95
6110: >>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
6111: >>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
6112: >>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
6113: >>>>>377 string GRUB\ \0 \b, GRUB version 0.94
6114: >>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
6115: >>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
6116: >>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
6117: >>>>>385 string GRUB\ \0 \b, GRUB version 0.97
1.1.1.5 ! misho 6118: #unknown version
1.1 misho 6119: >>>343 string Geom\0Read\0\ Error\0
6120: >>>>321 string Loading\ stage1.5 \b, GRUB version x.y
6121: >>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
6122: >>>>374 string GRUB\ \0 \b, GRUB version n.m
1.1.1.3 misho 6123: # SYSLINUX bootloader moved
1.1 misho 6124: >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
6125: # http://www.bcdwb.de/bcdw/index_e.htm
6126: >3 string BCDL
6127: >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
1.1.1.2 misho 6128: # mbr partition table entries
6129: # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
1.1 misho 6130: >3 string !MS
6131: >>3 string !SYSLINUX
6132: >>>3 string !MTOOL
1.1.1.2 misho 6133: >>>>3 string !NEWLDR
6134: >>>>>5 string !DOS
1.1 misho 6135: # not FAT (32 bit)
1.1.1.2 misho 6136: >>>>>>82 string !FAT32
1.1 misho 6137: #not Linux kernel
6138: >>>>>>>514 string !HdrS
6139: #not BeOS
6140: >>>>>>>>422 string !Be\ Boot\ Loader
6141: # active flag 0 or 0x80 and type > 0
6142: >>>>>>>>>446 ubyte <0x81
6143: >>>>>>>>>>446 ubyte&0x7F 0
6144: >>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
6145: >>>>>>>>>>>>446 ubyte 0x80 \b, active
6146: >>>>>>>>>>>>447 ubyte x \b, starthead %u
6147: #>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
6148: #>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
6149: >>>>>>>>>>>>454 ulelong x \b, startsector %u
6150: >>>>>>>>>>>>458 ulelong x \b, %u sectors
6151: #
6152: >>>>>>>>>462 ubyte <0x81
6153: >>>>>>>>>>462 ubyte&0x7F 0
6154: >>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
6155: >>>>>>>>>>>>462 ubyte 0x80 \b, active
6156: >>>>>>>>>>>>463 ubyte x \b, starthead %u
6157: #>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
6158: #>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
6159: >>>>>>>>>>>>470 ulelong x \b, startsector %u
6160: >>>>>>>>>>>>474 ulelong x \b, %u sectors
6161: #
6162: >>>>>>>>>478 ubyte <0x81
6163: >>>>>>>>>>478 ubyte&0x7F 0
6164: >>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
6165: >>>>>>>>>>>>478 ubyte 0x80 \b, active
6166: >>>>>>>>>>>>479 ubyte x \b, starthead %u
6167: #>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
6168: #>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
6169: #>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
6170: >>>>>>>>>>>>486 ulelong x \b, startsector %u
6171: >>>>>>>>>>>>490 ulelong x \b, %u sectors
6172: #
6173: >>>>>>>>>494 ubyte <0x81
6174: >>>>>>>>>>494 ubyte&0x7F 0
6175: >>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
6176: >>>>>>>>>>>>494 ubyte 0x80 \b, active
6177: >>>>>>>>>>>>495 ubyte x \b, starthead %u
6178: #>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
6179: #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
6180: >>>>>>>>>>>>502 ulelong x \b, startsector %u
6181: >>>>>>>>>>>>506 ulelong x \b, %u sectors
1.1.1.2 misho 6182: # mbr partition table entries end
1.1 misho 6183: # http://www.acronis.de/
6184: #FAT label=ACRONIS\ SZ
6185: #OEM-ID=BOOTWIZ0
6186: >442 string Non-system\ disk,\
6187: >>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
1.1.1.3 misho 6188: # updated by Joerg Jenderek at Nov 2012
6189: # DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
1.1 misho 6190: >>>477 ubyte&0xDF >0
6191: >>>>477 string x \b %-.3s
6192: >>>>>480 ubyte&0xDF >0
1.1.1.3 misho 6193: >>>>>>480 string x \b%-.4s
6194: >>>>>>>484 ubyte&0xDF >0
6195: >>>>>>>>484 string x \b%-.1s
1.1 misho 6196: >>>>485 ubyte&0xDF >0
6197: >>>>>485 string x \b.%-.3s
6198: #
6199: >185 string FDBOOT\ Version\
6200: >>204 string \rNo\ Systemdisk.\
6201: >>>220 string Booting\ from\ harddisk.\n\r
6202: >>>245 string Cannot\ load\ from\ harddisk.\n\r
6203: >>>>273 string Insert\ Systemdisk\
6204: >>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
6205: >>>>>>200 string >\0 \b, version %-3s
6206: >242 string Bootsector\ from\ C.H.\ Hochst\204
1.1.1.3 misho 6207: # http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
6208: # updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
6209: # skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
6210: >242 search/127 Bootsector\ from\ C.H.\ Hochst
6211: >>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
6212: # followed by variants with point,CR-NL or NL-CR
6213: >>>208 search/261 Cannot\ load\ from\ harddisk.
6214: # followed by variants CR-NL or NL-CR
6215: >>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
6216: # followed by variants with point,CR-NL or NL-CR
6217: >>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
6218: # followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
6219: >>>>>>&0 string x \b, version %-4.4s
1.1 misho 6220: >(1.b+2) ubyte 0xe
6221: >>(1.b+3) ubyte 0x1f
6222: >>>(1.b+4) ubyte 0xbe
1.1.1.3 misho 6223: # message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
6224: >>>>(1.b+5) ubyte&0xd3 0x53
6225: >>>>>(1.b+6) ubyte 0x7c
6226: # assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
6227: >>>>>>(1.b+7) ubyte 0xac
6228: >>>>>>>(1.b+8) ubyte 0x22
6229: >>>>>>>>(1.b+9) ubyte 0xc0
6230: >>>>>>>>>(1.b+10) ubyte 0x74
6231: >>>>>>>>>>(1.b+11) ubyte 0x0b
6232: >>>>>>>>>>>(1.b+12) ubyte 0x56
6233: >>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
6234: # FAT1X version
6235: >>>>>>>>>>>>>(1.b+5) ubyte 0x5b
6236: >>>>>>>>>>>>>>0x5b string >\0 "%-s"
6237: # FAT32 version
6238: >>>>>>>>>>>>>(1.b+5) ubyte 0x77
6239: >>>>>>>>>>>>>>0x77 string >\0 "%-s"
1.1.1.2 misho 6240: >214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
6241: #>>244 string from\ dosemu-freedos-*-bin.tgz\r
6242: #>>>170 string Sorry,\ could\ not\ load\ an\
6243: #>>>>195 string operating\ system.\r\n
6244: #
1.1 misho 6245: >103 string This\ is\ not\ a\ bootable\ disk.\
6246: >>132 string Please\ insert\ a\ bootable\
6247: >>>157 string floppy\ and\r\n
6248: >>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
6249: #
6250: >66 string Solaris\ Boot\ Sector
6251: >>99 string Incomplete\ MDBoot\ load.
6252: >>>89 string Version \b, Sun Solaris Bootloader
6253: >>>>97 byte x version %c
6254: #
6255: >408 string OS/2\ !!\ SYS01475\r\0
6256: >>429 string OS/2\ !!\ SYS02025\r\0
6257: >>>450 string OS/2\ !!\ SYS02027\r\0
6258: >>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
6259: #
6260: >409 string OS/2\ !!\ SYS01475\r\0
6261: >>430 string OS/2\ !!\ SYS02025\r\0
6262: >>>451 string OS/2\ !!\ SYS02027\r\0
6263: >>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
6264: >112 string This\ disk\ is\ not\ bootable\r
6265: >>142 string If\ you\ wish\ to\ make\ it\ bootable
6266: >>>176 string run\ the\ DOS\ program\ SYS\
6267: >>>200 string after\ the\r
6268: >>>>216 string system\ has\ been\ loaded\r\n
6269: >>>>>242 string Please\ insert\ a\ DOS\ diskette\
6270: >>>>>271 string into\r\n\ the\ drive\ and\
6271: >>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
6272: # XP
6273: >430 string NTLDR\ is\ missing\xFF\r\n
6274: >>449 string Disk\ error\xFF\r\n
6275: >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
6276: # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
6277: >>>>417 ubyte&0xDF >0
6278: >>>>>417 string x %-.5s
6279: >>>>>>422 ubyte&0xDF >0
6280: >>>>>>>422 string x \b%-.3s
6281: >>>>>425 ubyte&0xDF >0
6282: >>>>>>425 string >\ \b.%-.3s
6283: #
6284: >>>>371 ubyte >0x20
6285: >>>>>368 ubyte&0xDF >0
6286: >>>>>>368 string x %-.5s
6287: >>>>>>>373 ubyte&0xDF >0
6288: >>>>>>>>373 string x \b%-.3s
6289: >>>>>>376 ubyte&0xDF >0
6290: >>>>>>>376 string x \b.%-.3s
6291: #
6292: >430 string NTLDR\ nicht\ gefunden\xFF\r\n
6293: >>453 string Datentr\204gerfehler\xFF\r\n
6294: >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
6295: >>>>417 ubyte&0xDF >0
6296: >>>>>417 string x %-.5s
6297: >>>>>>422 ubyte&0xDF >0
6298: >>>>>>>422 string x \b%-.3s
6299: >>>>>425 ubyte&0xDF >0
6300: >>>>>>425 string >\ \b.%-.3s
6301: # offset variant
6302: >>>>379 string \0
6303: >>>>>368 ubyte&0xDF >0
6304: >>>>>>368 string x %-.5s
6305: >>>>>>>373 ubyte&0xDF >0
6306: >>>>>>>>373 string x \b%-.3s
6307: #
6308: >430 string NTLDR\ fehlt\xFF\r\n
6309: >>444 string Datentr\204gerfehler\xFF\r\n
6310: >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
6311: >>>>417 ubyte&0xDF >0
6312: >>>>>417 string x %-.5s
6313: >>>>>>422 ubyte&0xDF >0
6314: >>>>>>>422 string x \b%-.3s
6315: >>>>>425 ubyte&0xDF >0
6316: >>>>>>425 string >\ \b.%-.3s
6317: # variant
6318: >>>>371 ubyte >0x20
6319: >>>>>368 ubyte&0xDF >0
6320: >>>>>>368 string x %-.5s
6321: >>>>>>>373 ubyte&0xDF >0
6322: >>>>>>>>373 string x \b%-.3s
6323: >>>>>>376 ubyte&0xDF >0
6324: >>>>>>>376 string x \b.%-.3s
6325: #
6326: >430 string NTLDR\ fehlt\xFF\r\n
6327: >>444 string Medienfehler\xFF\r\n
6328: >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
6329: >>>>371 ubyte >0x20
6330: >>>>>368 ubyte&0xDF >0
6331: >>>>>>368 string x %-.5s
6332: >>>>>>>373 ubyte&0xDF >0
6333: >>>>>>>>373 string x \b%-.3s
6334: >>>>>>376 ubyte&0xDF >0
6335: >>>>>>>376 string x \b.%-.3s
6336: # variant
6337: >>>>417 ubyte&0xDF >0
6338: >>>>>417 string x %-.5s
6339: >>>>>>422 ubyte&0xDF >0
6340: >>>>>>>422 string x \b%-.3s
6341: >>>>>425 ubyte&0xDF >0
6342: >>>>>>425 string >\ \b.%-.3s
6343: #
6344: >430 string Datentr\204ger\ entfernen\xFF\r\n
6345: >>454 string Medienfehler\xFF\r\n
6346: >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
1.1.1.2 misho 6347: >>>>379 string \0
6348: >>>>>368 ubyte&0xDF >0
6349: >>>>>>368 string x %-.5s
6350: >>>>>>>373 ubyte&0xDF >0
6351: >>>>>>>>373 string x \b%-.3s
6352: >>>>>>376 ubyte&0xDF >0
6353: >>>>>>>376 string x \b.%-.3s
6354: # variant
6355: >>>>417 ubyte&0xDF >0
6356: >>>>>417 string x %-.5s
6357: >>>>>>422 ubyte&0xDF >0
6358: >>>>>>>422 string x \b%-.3s
6359: >>>>>425 ubyte&0xDF >0
6360: >>>>>>425 string >\ \b.%-.3s
6361: #
6362:
1.1 misho 6363: #>3 string NTFS\ \ \ \
6364: >389 string Fehler\ beim\ Lesen\
6365: >>407 string des\ Datentr\204gers
6366: >>>426 string NTLDR\ fehlt
6367: >>>>440 string NTLDR\ ist\ komprimiert
6368: >>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
6369: #>3 string NTFS\ \ \ \
6370: >313 string A\ disk\ read\ error\ occurred.\r
6371: >>345 string A\ kernel\ file\ is\ missing\
6372: >>>370 string from\ the\ disk.\r
6373: >>>>484 string NTLDR\ is\ compressed
6374: >>>>>429 string Insert\ a\ system\ diskette\
6375: >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
6376: # DOS loader variants different languages,offsets
6377: >472 ubyte&0xDF >0
6378: >>389 string Invalid\ system\ disk\xFF\r\n
6379: >>>411 string Disk\ I/O\ error
6380: >>>>428 string Replace\ the\ disk,\ and\
6381: >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
6382: #IO.SYS
6383: >>>>>>472 ubyte&0xDF >0
6384: >>>>>>>472 string x \b %-.2s
6385: >>>>>>>>474 ubyte&0xDF >0
6386: >>>>>>>>>474 string x \b%-.5s
6387: >>>>>>>>>>479 ubyte&0xDF >0
6388: >>>>>>>>>>>479 string x \b%-.1s
6389: >>>>>>>480 ubyte&0xDF >0
6390: >>>>>>>>480 string x \b.%-.3s
6391: #MSDOS.SYS
6392: >>>>>>>483 ubyte&0xDF >0 \b+
6393: >>>>>>>>483 string x \b%-.5s
6394: >>>>>>>>>488 ubyte&0xDF >0
6395: >>>>>>>>>>488 string x \b%-.3s
6396: >>>>>>>>491 ubyte&0xDF >0
6397: >>>>>>>>>491 string x \b.%-.3s
6398: #
6399: >>390 string Invalid\ system\ disk\xFF\r\n
6400: >>>412 string Disk\ I/O\ error\xFF\r\n
6401: >>>>429 string Replace\ the\ disk,\ and\
6402: >>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
6403: >>388 string Ungueltiges\ System\ \xFF\r\n
6404: >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
6405: >>>>427 string Datentraeger\ wechseln\ und\
6406: >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
6407: #WINBOOT.SYS only not spaces (0xDF)
6408: >>>>>>497 ubyte&0xDF >0
6409: >>>>>>>497 string x %-.5s
6410: >>>>>>>>502 ubyte&0xDF >0
6411: >>>>>>>>>502 string x \b%-.1s
6412: >>>>>>>>>>503 ubyte&0xDF >0
6413: >>>>>>>>>>>503 string x \b%-.1s
6414: >>>>>>>>>>>>504 ubyte&0xDF >0
6415: >>>>>>>>>>>>>504 string x \b%-.1s
6416: >>>>>>505 ubyte&0xDF >0
6417: >>>>>>>505 string x \b.%-.3s
6418: #IO.SYS
6419: >>>>>>472 ubyte&0xDF >0 or
6420: >>>>>>>472 string x \b %-.2s
6421: >>>>>>>>474 ubyte&0xDF >0
6422: >>>>>>>>>474 string x \b%-.5s
6423: >>>>>>>>>>479 ubyte&0xDF >0
6424: >>>>>>>>>>>479 string x \b%-.1s
6425: >>>>>>>480 ubyte&0xDF >0
6426: >>>>>>>>480 string x \b.%-.3s
6427: #MSDOS.SYS
6428: >>>>>>>483 ubyte&0xDF >0 \b+
6429: >>>>>>>>483 string x \b%-.5s
6430: >>>>>>>>>488 ubyte&0xDF >0
6431: >>>>>>>>>>488 string x \b%-.3s
6432: >>>>>>>>491 ubyte&0xDF >0
6433: >>>>>>>>>491 string x \b.%-.3s
6434: #
6435: >>390 string Ungueltiges\ System\ \xFF\r\n
6436: >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
6437: >>>>429 string Datentraeger\ wechseln\ und\
6438: >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
6439: #WINBOOT.SYS only not spaces (0xDF)
6440: >>>>>>497 ubyte&0xDF >0
6441: >>>>>>>497 string x %-.7s
6442: >>>>>>>>504 ubyte&0xDF >0
6443: >>>>>>>>>504 string x \b%-.1s
6444: >>>>>>505 ubyte&0xDF >0
6445: >>>>>>>505 string x \b.%-.3s
6446: #IO.SYS
6447: >>>>>>472 ubyte&0xDF >0 or
6448: >>>>>>>472 string x \b %-.2s
6449: >>>>>>>>474 ubyte&0xDF >0
6450: >>>>>>>>>474 string x \b%-.6s
6451: >>>>>>>480 ubyte&0xDF >0
6452: >>>>>>>>480 string x \b.%-.3s
6453: #MSDOS.SYS
6454: >>>>>>>483 ubyte&0xDF >0 \b+
6455: >>>>>>>>483 string x \b%-.5s
6456: >>>>>>>>>488 ubyte&0xDF >0
6457: >>>>>>>>>>488 string x \b%-.3s
6458: >>>>>>>>491 ubyte&0xDF >0
6459: >>>>>>>>>491 string x \b.%-.3s
6460: #
6461: >>389 string Ungueltiges\ System\ \xFF\r\n
6462: >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
6463: >>>>428 string Datentraeger\ wechseln\ und\
6464: >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
6465: # DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
6466: >>>>>>472 string x %-.2s
6467: >>>>>>>474 ubyte&0xDF >0
6468: >>>>>>>>474 string x \b%-.5s
6469: >>>>>>>>479 ubyte&0xDF >0
6470: >>>>>>>>>479 string x \b%-.1s
6471: >>>>>>480 ubyte&0xDF >0
6472: >>>>>>>480 string x \b.%-.3s
6473: >>>>>>483 ubyte&0xDF >0 \b+
6474: >>>>>>>483 string x \b%-.5s
6475: >>>>>>>488 ubyte&0xDF >0
6476: >>>>>>>>488 string x \b%-.2s
6477: >>>>>>>>490 ubyte&0xDF >0
6478: >>>>>>>>>490 string x \b%-.1s
6479: >>>>>>>491 ubyte&0xDF >0
6480: >>>>>>>>491 string x \b.%-.3s
6481: >479 ubyte&0xDF >0
6482: >>416 string Kein\ System\ oder\
6483: >>>433 string Laufwerksfehler
6484: >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
6485: #IO.SYS
6486: >>>>>479 string x \b %-.2s
6487: >>>>>>481 ubyte&0xDF >0
6488: >>>>>>>481 string x \b%-.6s
6489: >>>>>487 ubyte&0xDF >0
6490: >>>>>>487 string x \b.%-.3s
6491: #MSDOS.SYS
6492: >>>>>>490 ubyte&0xDF >0 \b+
6493: >>>>>>>490 string x \b%-.5s
6494: >>>>>>>>495 ubyte&0xDF >0
6495: >>>>>>>>>495 string x \b%-.3s
6496: >>>>>>>498 ubyte&0xDF >0
6497: >>>>>>>>498 string x \b.%-.3s
6498: #
6499: >376 search/41 Non-System\ disk\ or\
6500: >>395 search/41 disk\ error\r
6501: >>>407 search/41 Replace\ and\
6502: >>>>419 search/41 press\ \b,
6503: >>>>419 search/41 strike\ \b, old
6504: >>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
6505: #449 Disk\ Boot\ failure\r MS 3.21
6506: #466 Boot\ Failure\r MS 3.30
6507: >>>>>468 search/18 \0
6508: #IO.SYS,IBMBIO.COM
6509: >>>>>>&0 string x \b %-.2s
6510: >>>>>>>&-20 ubyte&0xDF >0
6511: >>>>>>>>&-1 string x \b%-.4s
6512: >>>>>>>>>&-16 ubyte&0xDF >0
6513: >>>>>>>>>>&-1 string x \b%-.2s
6514: >>>>>>&8 ubyte&0xDF >0 \b.
6515: >>>>>>>&-1 string x \b%-.3s
6516: #MSDOS.SYS,IBMDOS.COM
6517: >>>>>>&11 ubyte&0xDF >0 \b+
6518: >>>>>>>&-1 string x \b%-.5s
6519: >>>>>>>>&-6 ubyte&0xDF >0
6520: >>>>>>>>>&-1 string x \b%-.1s
6521: >>>>>>>>>>&-5 ubyte&0xDF >0
6522: >>>>>>>>>>>&-1 string x \b%-.2s
6523: >>>>>>>&7 ubyte&0xDF >0 \b.
6524: >>>>>>>>&-1 string x \b%-.3s
6525: >441 string Cannot\ load\ from\ harddisk.\n\r
6526: >>469 string Insert\ Systemdisk\
6527: >>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
6528: #>43 string \224R-LOADER\ \ SYS =label
6529: >54 string SYS
6530: >>324 string VASKK
6531: >>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
6532: #
6533: >98 string Press\ a\ key\ to\ retry\0\r
6534: >>120 string Cannot\ find\ file\ \0\r
6535: >>>139 string Disk\ read\ error\0\r
6536: >>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
6537: #DRBIOS.SYS
6538: >>>>>44 ubyte&0xDF >0
6539: >>>>>>44 string x \b %-.6s
6540: >>>>>>>50 ubyte&0xDF >0
6541: >>>>>>>>50 string x \b%-.2s
6542: >>>>>>52 ubyte&0xDF >0
6543: >>>>>>>52 string x \b.%-.3s
6544: #
6545: >70 string IBMBIO\ \ COM
6546: >>472 string Cannot\ load\ DOS!\
6547: >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
6548: >>471 string Cannot\ load\ DOS\
6549: >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
1.1.1.2 misho 6550: #??
1.1 misho 6551: >444 string KERNEL\ \ SYS
6552: >>314 string BOOT\ error! \b, FREE-DOS Bootloader
6553: >499 string KERNEL\ \ SYS
6554: >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
6555: >449 string KERNEL\ \ SYS
6556: >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
1.1.1.2 misho 6557: #
6558: >449 string Loading\ FreeDOS
6559: >>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
6560: >>>497 ubyte&0xDF >0
6561: >>>>497 string x \b %-.6s
6562: >>>>>503 ubyte&0xDF >0
6563: >>>>>>503 string x \b%-.1s
6564: >>>>>>>504 ubyte&0xDF >0
6565: >>>>>>>>504 string x \b%-.1s
6566: >>>>505 ubyte&0xDF >0
6567: >>>>>505 string x \b.%-.3s
6568: #
6569: >331 string Error!.0 \b, FREE-DOS 1.0 bootloader
6570: #
1.1 misho 6571: >125 string Loading\ FreeDOS...\r
6572: >>311 string BOOT\ error!\r \b, FREE-DOS bootloader
6573: >>>441 ubyte&0xDF >0
6574: >>>>441 string x \b %-.6s
6575: >>>>>447 ubyte&0xDF >0
6576: >>>>>>447 string x \b%-.1s
6577: >>>>>>>448 ubyte&0xDF >0
6578: >>>>>>>>448 string x \b%-.1s
6579: >>>>449 ubyte&0xDF >0
6580: >>>>>449 string x \b.%-.3s
6581: >124 string FreeDOS\0
6582: >>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
6583: # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
6584: >>>497 ubyte&0xDF >0
6585: >>>>497 string x \b %-.6s
6586: >>>>>503 ubyte&0xDF >0
6587: >>>>>>503 string x \b%-.1s
6588: >>>>>>>504 ubyte&0xDF >0
6589: >>>>>>>>504 string x \b%-.1s
6590: >>>>505 ubyte&0xDF >0
6591: >>>>>505 string x \b.%-.3s
6592: >>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
6593: >>>497 ubyte&0xDF >0
6594: >>>>497 string x \b %-.6s
6595: >>>>>503 ubyte&0xDF >0
6596: >>>>>>503 string x \b%-.1s
6597: >>>>>>>504 ubyte&0xDF >0
6598: >>>>>>>>504 string x \b%-.1s
6599: >>>>505 ubyte&0xDF >0
6600: >>>>>505 string x \b.%-.3s
6601: >>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
6602: >>>497 ubyte&0xDF >0
6603: >>>>497 string x \b %-.6s
6604: >>>>>503 ubyte&0xDF >0
6605: >>>>>>503 string x \b%-.1s
6606: >>>>>>>504 ubyte&0xDF >0
6607: >>>>>>>>504 string x \b%-.1s
6608: >>>>505 ubyte&0xDF >0
6609: >>>>>505 string x \b.%-.3s
6610: >336 string Error!\
6611: >>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
6612: >>>497 ubyte&0xDF >0
6613: >>>>497 string x \b %-.6s
6614: >>>>>503 ubyte&0xDF >0
6615: >>>>>>503 string x \b%-.1s
6616: >>>>>>>504 ubyte&0xDF >0
6617: >>>>>>>>504 string x \b%-.1s
6618: >>>>505 ubyte&0xDF >0
6619: >>>>>505 string x \b.%-.3s
6620: # added by Joerg Jenderek
6621: # http://www.visopsys.org/
6622: # http://partitionlogic.org.uk/
6623: # OEM-ID=Visopsys
6624: >478 ulelong 0
6625: >>(1.b+326) string I/O\ Error\ reading\
6626: >>>(1.b+344) string Visopsys\ loader\r
6627: >>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
6628: # http://alexfru.chat.ru/epm.html#bootprog
6629: >494 ubyte >0x4D
6630: >>495 string >E
6631: >>>495 string <S
6632: #OEM-ID is not reliable
6633: >>>>3 string BootProg
6634: # It just looks for a program file name at the root directory
6635: # and loads corresponding file with following execution.
6636: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
6637: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
6638: >>>>>499 string x \b %-.1s
6639: >>>>>>500 ubyte&0xDF >0
6640: >>>>>>>500 string x \b%-.1s
6641: >>>>>>>>501 ubyte&0xDF >0
6642: >>>>>>>>>501 string x \b%-.1s
6643: >>>>>>>>>>502 ubyte&0xDF >0
6644: >>>>>>>>>>>502 string x \b%-.1s
6645: >>>>>>>>>>>>503 ubyte&0xDF >0
6646: >>>>>>>>>>>>>503 string x \b%-.1s
6647: >>>>>>>>>>>>>>504 ubyte&0xDF >0
6648: >>>>>>>>>>>>>>>504 string x \b%-.1s
6649: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
6650: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
6651: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
6652: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
6653: #name extension
6654: >>>>>507 ubyte&0xDF >0 \b.
6655: >>>>>>507 string x \b%-.1s
6656: >>>>>>>508 ubyte&0xDF >0
6657: >>>>>>>>508 string x \b%-.1s
6658: >>>>>>>>>509 ubyte&0xDF >0
6659: >>>>>>>>>>509 string x \b%-.1s
6660: #If the boot sector fails to read any other sector,
6661: #it prints a very short message ("RE") to the screen and hangs the computer.
6662: #If the boot sector fails to find needed program in the root directory,
6663: #it also hangs with another message ("NF").
6664: >>>>>492 string RENF \b, FAT (12 bit)
6665: >>>>>495 string RENF \b, FAT (16 bit)
6666: # http://alexfru.chat.ru/epm.html#bootprog
6667: >494 ubyte >0x4D
6668: >>495 string >E
6669: >>>495 string <S
6670: #OEM-ID is not reliable
6671: >>>>3 string BootProg
6672: # It just looks for a program file name at the root directory
6673: # and loads corresponding file with following execution.
6674: # DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
6675: >>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
6676: >>>>>499 string x \b %-.1s
6677: >>>>>>500 ubyte&0xDF >0
6678: >>>>>>>500 string x \b%-.1s
6679: >>>>>>>>501 ubyte&0xDF >0
6680: >>>>>>>>>501 string x \b%-.1s
6681: >>>>>>>>>>502 ubyte&0xDF >0
6682: >>>>>>>>>>>502 string x \b%-.1s
6683: >>>>>>>>>>>>503 ubyte&0xDF >0
6684: >>>>>>>>>>>>>503 string x \b%-.1s
6685: >>>>>>>>>>>>>>504 ubyte&0xDF >0
6686: >>>>>>>>>>>>>>>504 string x \b%-.1s
6687: >>>>>>>>>>>>>>>>505 ubyte&0xDF >0
6688: >>>>>>>>>>>>>>>>>505 string x \b%-.1s
6689: >>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
6690: >>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
6691: #name extension
6692: >>>>>507 ubyte&0xDF >0 \b.
6693: >>>>>>507 string x \b%-.1s
6694: >>>>>>>508 ubyte&0xDF >0
6695: >>>>>>>>508 string x \b%-.1s
6696: >>>>>>>>>509 ubyte&0xDF >0
6697: >>>>>>>>>>509 string x \b%-.1s
6698: #If the boot sector fails to read any other sector,
6699: #it prints a very short message ("RE") to the screen and hangs the computer.
6700: #If the boot sector fails to find needed program in the root directory,
6701: #it also hangs with another message ("NF").
6702: >>>>>492 string RENF \b, FAT (12 bit)
6703: >>>>>495 string RENF \b, FAT (16 bit)
1.1.1.2 misho 6704: # x86 bootloader end
1.1.1.3 misho 6705:
6706: # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
6707: # and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
6708: >0 string RRaA
6709: >>0x1E4 string rrAa \b, FSInfosector
6710: #>>0x1FC uleshort =0 SHOULD BE ZERO
6711: >>>0x1E8 ulelong <0xffffffff \b, %u free clusters
6712: >>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
6713:
6714: # added by Joerg Jenderek at Nov 2012
6715: # http://www.thenakedpc.com/articles/v04/08/0408-05.html
6716: # Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
6717: 0 string PNCIHISK\0 Norton Utilities disc image data
6718: # real x86 boot sector with jump instruction
6719: >509 search/1026 \x55\xAA\xeb
6720: >>&-1 indirect x \b; contains
6721: # http://file-extension.net/seeker/file_extension_dat
6722: 0 string PNCIUNDO Norton Disk Doctor UnDo file
6723: #
6724:
1.1 misho 6725: # updated by Joerg Jenderek at Sep 2007
6726: >3 ubyte 0
6727: #no active flag
6728: >>446 ubyte 0
6729: # partition 1 not empty
6730: >>>450 ubyte >0
6731: # partitions 3,4 empty
6732: >>>>482 ubyte 0
6733: >>>>>498 ubyte 0
6734: # partition 2 ID=0,5,15
6735: >>>>>>466 ubyte <0x10
6736: >>>>>>>466 ubyte 0x05 \b, extended partition table
6737: >>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
6738: >>>>>>>466 ubyte 0x0 \b, extended partition table (last)
1.1.1.3 misho 6739:
6740: # DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
6741:
1.1 misho 6742: >0x200 lelong 0x82564557 \b, BSD disklabel
6743: # FATX
6744: 0 string FATX FATX filesystem data
6745:
6746: # romfs filesystems - Juan Cespedes <cespedes@debian.org>
1.1.1.2 misho 6747: 0 string -rom1fs- romfs filesystem, version 1
1.1 misho 6748: >8 belong x %d bytes,
6749: >16 string x named %s.
6750:
6751: # netboot image - Juan Cespedes <cespedes@debian.org>
6752: 0 lelong 0x1b031336L Netboot image,
6753: >4 lelong&0xFFFFFF00 0
6754: >>4 lelong&0x100 0x000 mode 2
6755: >>4 lelong&0x100 0x100 mode 3
6756: >4 lelong&0xFFFFFF00 !0 unknown mode
6757:
6758: 0x18b string OS/2 OS/2 Boot Manager
6759:
1.1.1.3 misho 6760: # updated by Joerg Jenderek at Oct 2008 and Sep 2012
1.1.1.2 misho 6761: # http://syslinux.zytor.com/iso.php
1.1.1.3 misho 6762: # tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
6763: # assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
6764: 0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
6765: >631 search/689 ISOLINUX\ isolinux Loader
6766: >>&0 string x (version %-4.4s)
1.1.1.2 misho 6767: # http://syslinux.zytor.com/pxe.php
1.1.1.3 misho 6768: # assembler instructions: jmp 7C05
6769: 0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
6770: # assembler instructions: pushfd;pushad
6771: 0 ulelong 0x60669c66 pxelinux loader
6772: # assembler instructions: jmp 05
6773: 0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
6774: # http://syslinux.zytor.com/wiki/index.php/SYSLINUX
6775: 0 string LDLINUX\ SYS\ SYSLINUX loader
6776: >12 string x (older version %-4.4s)
6777: 0 string \r\nSYSLINUX\ SYSLINUX loader
6778: >11 string x (version %-4.4s)
6779: # syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
6780: # assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
6781: 0 ulelong&0x80909bEB 0x009018EB
6782: # OEM-ID not always "SYSLINUX"
6783: >434 search/47 Boot\ failed
6784: # followed by \r\n\0 or :\
6785: >>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
6786: >>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
6787: >459 search/30 Boot\ error\r\n\0
6788: >>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
6789: # SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
6790: # assembler instructions: mov di,0600h;mov cx,0100h
6791: 16 search/4 \xbf\x00\x06\xb9\x00\x01
6792: # to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21)
6793: !:strength +36
6794: >94 search/249 Missing\ operating\ system
6795: # followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
6796: # skip Ranish MBR
6797: >>408 search/4 HD1/\0
6798: >>408 default x
6799: >>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
6800: # followed by "ing " or space
6801: >>>>292 search/98 error
6802: >>>>>&0 string \r (version 3.35 or older)
6803: >>>>>&0 string .\r (version 3.52 or newer)
6804: >>>>>&0 default x (version 3.36-3.51 )
6805: >368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
6806: >>156 search/10 \0Boot\ partition\ not\ found\r\n
6807: >>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
6808: >>174 search/10 \0Missing\ OS\r\n
6809: >>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
6810: # SYSLINUX END
6811:
6812: # NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
6813: # assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
6814: 0 ubequad 0x31c08ed0bc007c8e
6815: # mbr_bootsel magic before partition table not reliable with small ipl fragments
6816: #>444 uleshort 0xb5e1
6817: >0004 uleshort x
6818: # ERRorTeXT
6819: >>181 search/166 Error\ \0\r\n NetBSD mbr
6820: # NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
6821: >>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
6822: # BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
6823: >>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
6824: # BOOT_EXTENDED definitions contains assembler instructions:
6825: # xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
6826: >>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
6827: # COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
6828: >>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
6829: # not TERSE_ERROR
6830: >>>196 search/106 No\ active\ partition\0
6831: >>>>&0 string Disk\ read\ error\0
6832: >>>>>&0 string No\ operating\ system\0 \b,verbose
6833: # not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
6834: >>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
6835: # not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
6836: >>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
6837: # assembler instructions: movw nametab,bx
6838: >>>0x26 search/21 \xBB\x94\x07
6839: # not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
6840: >>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
6841: >>>>>181 search/166 Error\ \0
6842: # "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
6843: >>>>>>&3 string x \b,"%s"
6844: # Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
6845: # added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
6846: # assembler instructions: jmp short 0x58;nop;ASCII
6847: 0 ubequad&0xeb58908000000000 0xeb58900000000000
6848: # assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
6849: >(1.b+2) ubequad 0xfa31c08ed88ec08e
6850: # Error messages at end of code
6851: >>376 string No\ operating\ system\r\n\0
6852: >>>398 string Disk\ error\r\n\0FDD\0HDD\0
6853: >>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
6854:
6855: # Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
6856: # added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
6857: # for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
6858: # or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
6859: 0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
6860: # pointer to the data starting with Neil Turton signature string
6861: >(0x1BC.s) string NDTmbr
6862: >>&-14 string 1234F\0 Turton mbr (
6863: # parameters also viewed by install-mbr --list
6864: >>>(0x1BC.s+7) ubyte x \b%u<=
6865: >>>(0x1BC.s+9) ubyte x \bVersion<=%u
6866: #>>>(0x1BC.s+8) ubyte x asm_flag_%x
6867: >>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
6868: # variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
6869: >>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
6870: #0x1~1,..,0x8~4,0x10~F,0x80~A enabled
6871: #>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
6872: #0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
6873: #>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
6874: # for older versions
6875: >>>(0x1BC.s+9) ubyte <2
6876: #>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
6877: >>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
6878: # floppy A: or B:
6879: >>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
6880: >>>>(0x1BC.s+13) ubyte >1
6881: # 1st hard disc
6882: #>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
6883: # not 1st hard disc
6884: >>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
6885: # for version >= 2 maximal timeout can be 65534
6886: >>>(0x1BC.s+9) ubyte >1
6887: #>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
6888: >>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
6889: # floppy A: or B:
6890: >>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
6891: >>>>(0x1BC.s+14) ubyte >1
6892: # 1st hard disc
6893: #>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
6894: # not 1st hard disc
6895: >>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
6896: >>>0 ubyte x \b)
1.1.1.2 misho 6897:
1.1 misho 6898: # added by Joerg Jenderek
6899: # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
6900: # grub-1.94/kern/i386/pc/startup.S
6901: # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
6902: # usual values are marked with comments to get only informations of strange GRUB loaders
6903: 0x200 uleshort 0x70EA
6904: # found only version 3.{1,2}
6905: >0x206 ubeshort >0x0300
6906: # GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
6907: >>0x212 ubyte >0x29
6908: >>>0x213 ubyte >0x29
6909: # not iso9660_stage1_5
6910: #>>>0 ulelong&0x00BE5652 0x00BE5652
6911: >>>>0x213 ubyte >0x29 GRand Unified Bootloader
6912: # config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
6913: >>>>0x217 ubyte 0xFF stage1_5
6914: >>>>0x217 ubyte <0xFF stage2
6915: >>>>0x206 ubyte x \b version %u
6916: >>>>0x207 ubyte x \b.%u
6917: # module_size for 1.94
6918: >>>>0x208 ulelong <0xffffff \b, installed partition %u
6919: #>>>>0x208 ulelong =0xffffff \b, %u (default)
6920: >>>>0x208 ulelong >0xffffff \b, installed partition %u
6921: # GRUB 0.5.95 unofficial
6922: >>>>0x20C ulelong&0x2E300000 0x2E300000
6923: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
6924: >>>>>0x20C ubyte x \b, identifier 0x%x
6925: #>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
6926: >>>>>0x20D ubyte >0 \b, LBA flag 0x%x
6927: # GRUB version as string
6928: >>>>>0x20E string >\0 \b, GRUB version %-s
6929: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6930: >>>>>>0x215 ulong 0xffffffff
6931: >>>>>>>0x219 string >\0 \b, configuration file %-s
6932: >>>>>>0x215 ulong !0xffffffff
6933: >>>>>>>0x215 string >\0 \b, configuration file %-s
6934: # newer GRUB versions
6935: >>>>0x20C ulelong&0x2E300000 !0x2E300000
6936: ##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
6937: >>>>>0x20C ulelong >0 \b, saved entry %d
6938: # for 1.94 contains kernel image size
6939: # for 0.93,0.94,0.96,0.97
6940: # 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
6941: >>>>>0x210 ubyte x \b, identifier 0x%x
6942: # The flag for LBA forcing is in most cases 0
6943: #>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
6944: >>>>>0x211 ubyte >0 \b, LBA flag 0x%x
6945: # GRUB version as string
6946: >>>>>0x212 string >\0 \b, GRUB version %-s
6947: # for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
6948: >>>>>0x217 ulong 0xffffffff
6949: >>>>>>0x21b string >\0 \b, configuration file %-s
6950: >>>>>0x217 ulong !0xffffffff
6951: >>>>>>0x217 string >\0 \b, configuration file %-s
6952:
1.1.1.3 misho 6953: # DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
6954: # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
6955: # over BIOS parameter block (BPB)
6956: # http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
6957: # older drives may use Near JuMP instruction E9 xx xx
6958: # minimal short forward jump found 0x29 for bootloaders or 0x0
6959: # maximal short forward jump is 0x7f
6960: # OEM-ID is empty or contain readable bytes
6961: 0 ulelong&0x804000E9 0x000000E9
6962: # mtools-3.9.8/msdos.h
6963: # usual values are marked with comments to get only informations of strange FAT systems
6964: # valid sectorsize must be a power of 2 from 32 to 32768
6965: >11 uleshort&0xf001f 0
6966: >>11 uleshort <32769
6967: >>>11 uleshort >31
6968: >>>>21 ubyte&0xf0 0xF0
6969: >>>>>0 ubyte 0xEB
6970: >>>>>>1 ubyte x \b, code offset 0x%x+2
6971: >>>>>0 ubyte 0xE9
6972: >>>>>>1 uleshort x \b, code offset 0x%x+2
6973: >>>>>3 string >\0 \b, OEM-ID "%-.8s"
6974: #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
6975: >>>>>>8 string IHC \b cached by Windows 9M
6976: >>>>>11 uleshort >512 \b, Bytes/sector %u
6977: #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
6978: >>>>>11 uleshort <512 \b, Bytes/sector %u
6979: >>>>>13 ubyte >1 \b, sectors/cluster %u
6980: #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
6981: >>>>>82 string FAT32
6982: >>>>>>14 uleshort !32 \b, reserved sectors %u
6983: #>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
6984: >>>>>82 string !FAT32
6985: >>>>>>14 uleshort >1 \b, reserved sectors %u
6986: #>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
6987: #>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
6988: >>>>>16 ubyte >2 \b, FATs %u
6989: #>>>>>16 ubyte =2 \b, FATs %u (usual)
6990: >>>>>16 ubyte =1 \b, FAT %u
6991: >>>>>16 ubyte >0
6992: >>>>>17 uleshort >0 \b, root entries %u
6993: #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
6994: >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
6995: #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
6996: >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
6997: #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
6998: >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
6999: >>>>>22 uleshort >0 \b, sectors/FAT %u
7000: #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
7001: >>>>>24 uleshort x \b, sectors/track %u
7002: >>>>>26 ubyte >2 \b, heads %u
7003: #>>>>>26 ubyte =2 \b, heads %u (usual floppy)
7004: >>>>>26 ubyte =1 \b, heads %u
7005: # valid only for sector sizes with more then 32 Bytes
7006: >>>>>11 uleshort >32
7007: # skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
7008: >>>>>>38 ubyte !0x70
7009: >>>>>>>28 ulelong >0 \b, hidden sectors %u
7010: #>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
7011: >>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
7012: #>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
7013: # FAT<32 bit specific
7014: >>>>>>>82 string !FAT32
7015: #>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
7016: #>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
7017: >>>>>>>>36 ubyte !0x80
7018: >>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
7019: >>>>>>>>37 ubyte >0 \b, reserved 0x%x
7020: #>>>>>>>>37 ubyte =0 \b, reserved 0x%x
7021: # value is 0x80 for NTFS
7022: >>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
7023: >>>>>>>>38 ubyte =0x29
7024: >>>>>>>>>39 ulelong x \b, serial number 0x%x
7025: >>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
7026: >>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
7027: >>>>>>>>>43 string =NO\ NAME \b, unlabeled
7028: # there exist some old floppies without word FAT at offset 54
7029: # a word like "FATnm " is only a hint for a FAT size on nm-bits
7030: # Normally the number of clusters is calculated by the values of BPP.
7031: # if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
7032: # otherwise FAT is 16 bit.
7033: # http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
7034: >>>>>>54 string FAT \b, FAT
7035: >>>>>>>54 string FAT12 \b (12 bit)
7036: >>>>>>>54 string FAT16 \b (16 bit)
7037: # FAT32 bit specific
7038: >>>>>82 string FAT32 \b, FAT (32 bit)
7039: >>>>>>36 ulelong x \b, sectors/FAT %u
7040: # http://technet.microsoft.com/en-us/library/cc977221.aspx
7041: >>>>>>40 uleshort >0 \b, extension flags 0x%x
7042: #>>>>>>40 uleshort =0 \b, extension flags %u
7043: >>>>>>42 uleshort >0 \b, fsVersion %u
7044: #>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
7045: >>>>>>44 ulelong >2 \b, rootdir cluster %u
7046: #>>>>>>44 ulelong =2 \b, rootdir cluster %u
7047: #>>>>>>44 ulelong =1 \b, rootdir cluster %u
7048: >>>>>>48 uleshort >1 \b, infoSector %u
7049: #>>>>>>48 uleshort =1 \b, infoSector %u (usual)
7050: >>>>>>48 uleshort <1 \b, infoSector %u
7051: >>>>>>50 uleshort >6 \b, Backup boot sector %u
7052: #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
7053: >>>>>>50 uleshort <6 \b, Backup boot sector %u
7054: # corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
7055: >>>>>>52 ulelong >0 \b, reserved1 0x%x
7056: >>>>>>56 ulelong >0 \b, reserved2 0x%x
7057: >>>>>>60 ulelong >0 \b, reserved3 0x%x
7058: # same structure as FAT1X
7059: #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
7060: #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
7061: >>>>>>64 ubyte !0x80
7062: >>>>>>>64 ubyte >0 \b, physical drive 0x%x
7063: # in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
7064: >>>>>>65 ubyte >0 \b, reserved 0x%x
7065: >>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
7066: >>>>>>66 ubyte =0x29
7067: >>>>>>>67 ulelong x \b, serial number 0x%x
7068: >>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
7069: >>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
7070: >>>>>>>71 string =NO\ NAME \b, unlabeled
7071: # additional tests for floppy image added by Joerg Jenderek
7072: # no fixed disk
7073: >>>>>21 ubyte !0xF8
7074: # floppy media with 12 bit FAT
7075: >>>>>>54 string !FAT16
7076: # test for FAT after bootsector
7077: >>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
7078: # floppy image
7079: !:mime application/x-ima
7080: # NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
7081: # and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
7082: # 0 FATs
7083: >>>>>16 ubyte =0
7084: # 0 root entries
7085: >>>>>>17 uleshort =0
7086: # 0 DOS sectors
7087: >>>>>>>19 uleshort =0
7088: # 0 sectors/FAT
7089: # dos < 4.0 BootSector value found is 0x80
7090: #38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
7091: >>>>>>>>22 uleshort =0 \b; NTFS
7092: >>>>>>>>>24 uleshort >0 \b, sectors/track %u
7093: >>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
7094: >>>>>>>>>40 ulequad >0 \b, sectors %lld
7095: >>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
7096: >>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
7097: # Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
7098: # Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
7099: >>>>>>>>>64 lelong <256
7100: >>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
7101: >>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
7102: # Values 0 to 127 represent index block sizes of 0 to 127 clusters.
7103: # Values 128 to 255 represent index block sizes of 2^(256-N) byte
7104: >>>>>>>>>68 ulelong <256
7105: >>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
7106: #>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
7107: >>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
7108: >>>>>>>>>72 ulequad x \b, serial number 0%llx
7109: >>>>>>>>>80 ulelong >0 \b, checksum 0x%x
7110: #>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
7111: >>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
7112: >>>>>>>>>>&-92 indirect x \b; contains
7113: # For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
7114: # http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
7115: # unused assembler instructions JMP y2;NOP;NOP
7116: 0x056 ulelong&0xFFFF0FFF 0x909002EB
7117: # unicode loadername terminated by CTRL-D
7118: >(0.s*2) ulelong&0xFFFFFF00 0x00040000
7119: # loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
7120: >>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
7121: >>0x12 string $
7122: >>>0x0c lestring16 x \b%-2.2s
7123: ### DOS,NTFS boot sectors end
7124:
1.1 misho 7125: 9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
7126: >8404 string x last mounted on %s,
7127: #>9504 ledate x last checked at %s,
7128: >8224 ledate x last written at %s,
7129: >8401 byte x clean flag %d,
7130: >8228 lelong x number of blocks %d,
7131: >8232 lelong x number of data blocks %d,
7132: >8236 lelong x number of cylinder groups %d,
7133: >8240 lelong x block size %d,
7134: >8244 lelong x fragment size %d,
7135: >8252 lelong x minimum percentage of free blocks %d,
7136: >8256 lelong x rotational delay %dms,
7137: >8260 lelong x disk rotational speed %drps,
7138: >8320 lelong 0 TIME optimization
7139: >8320 lelong 1 SPACE optimization
7140:
7141: 42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
7142: >&-1164 string x last mounted on %s,
7143: >&-696 string >\0 volume name %s,
7144: >&-304 leqldate x last written at %s,
7145: >&-1167 byte x clean flag %d,
7146: >&-1168 byte x readonly flag %d,
7147: >&-296 lequad x number of blocks %lld,
7148: >&-288 lequad x number of data blocks %lld,
7149: >&-1332 lelong x number of cylinder groups %d,
7150: >&-1328 lelong x block size %d,
7151: >&-1324 lelong x fragment size %d,
7152: >&-180 lelong x average file size %d,
7153: >&-176 lelong x average number of files in dir %d,
7154: >&-272 lequad x pending blocks to free %lld,
7155: >&-264 lelong x pending inodes to free %ld,
7156: >&-664 lequad x system-wide uuid %0llx,
7157: >&-1316 lelong x minimum percentage of free blocks %d,
7158: >&-1248 lelong 0 TIME optimization
7159: >&-1248 lelong 1 SPACE optimization
7160:
7161: 66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
7162: >&-1164 string x last mounted on %s,
7163: >&-696 string >\0 volume name %s,
7164: >&-304 leqldate x last written at %s,
7165: >&-1167 byte x clean flag %d,
7166: >&-1168 byte x readonly flag %d,
7167: >&-296 lequad x number of blocks %lld,
7168: >&-288 lequad x number of data blocks %lld,
7169: >&-1332 lelong x number of cylinder groups %d,
7170: >&-1328 lelong x block size %d,
7171: >&-1324 lelong x fragment size %d,
7172: >&-180 lelong x average file size %d,
7173: >&-176 lelong x average number of files in dir %d,
7174: >&-272 lequad x pending blocks to free %lld,
7175: >&-264 lelong x pending inodes to free %ld,
7176: >&-664 lequad x system-wide uuid %0llx,
7177: >&-1316 lelong x minimum percentage of free blocks %d,
7178: >&-1248 lelong 0 TIME optimization
7179: >&-1248 lelong 1 SPACE optimization
7180:
7181: 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
7182: >7168 belong 0x4c41424c Apple UFS Volume
7183: >>7186 string x named %s,
7184: >>7176 belong x volume label version %d,
7185: >>7180 bedate x created on %s,
7186: >8404 string x last mounted on %s,
7187: #>9504 bedate x last checked at %s,
7188: >8224 bedate x last written at %s,
7189: >8401 byte x clean flag %d,
7190: >8228 belong x number of blocks %d,
7191: >8232 belong x number of data blocks %d,
7192: >8236 belong x number of cylinder groups %d,
7193: >8240 belong x block size %d,
7194: >8244 belong x fragment size %d,
7195: >8252 belong x minimum percentage of free blocks %d,
7196: >8256 belong x rotational delay %dms,
7197: >8260 belong x disk rotational speed %drps,
7198: >8320 belong 0 TIME optimization
7199: >8320 belong 1 SPACE optimization
7200:
7201: 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
7202: >&-1164 string x last mounted on %s,
7203: >&-696 string >\0 volume name %s,
7204: >&-304 beqldate x last written at %s,
7205: >&-1167 byte x clean flag %d,
7206: >&-1168 byte x readonly flag %d,
7207: >&-296 bequad x number of blocks %lld,
7208: >&-288 bequad x number of data blocks %lld,
7209: >&-1332 belong x number of cylinder groups %d,
7210: >&-1328 belong x block size %d,
7211: >&-1324 belong x fragment size %d,
7212: >&-180 belong x average file size %d,
7213: >&-176 belong x average number of files in dir %d,
7214: >&-272 bequad x pending blocks to free %lld,
7215: >&-264 belong x pending inodes to free %ld,
7216: >&-664 bequad x system-wide uuid %0llx,
7217: >&-1316 belong x minimum percentage of free blocks %d,
7218: >&-1248 belong 0 TIME optimization
7219: >&-1248 belong 1 SPACE optimization
7220:
7221: 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
7222: >&-1164 string x last mounted on %s,
7223: >&-696 string >\0 volume name %s,
7224: >&-304 beqldate x last written at %s,
7225: >&-1167 byte x clean flag %d,
7226: >&-1168 byte x readonly flag %d,
7227: >&-296 bequad x number of blocks %lld,
7228: >&-288 bequad x number of data blocks %lld,
7229: >&-1332 belong x number of cylinder groups %d,
7230: >&-1328 belong x block size %d,
7231: >&-1324 belong x fragment size %d,
7232: >&-180 belong x average file size %d,
7233: >&-176 belong x average number of files in dir %d,
7234: >&-272 bequad x pending blocks to free %lld,
7235: >&-264 belong x pending inodes to free %ld,
7236: >&-664 bequad x system-wide uuid %0llx,
7237: >&-1316 belong x minimum percentage of free blocks %d,
7238: >&-1248 belong 0 TIME optimization
7239: >&-1248 belong 1 SPACE optimization
7240:
7241: # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
7242: # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
7243: # volume label and UUID Russell Coker
7244: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
7245: 0x438 leshort 0xEF53 Linux
7246: >0x44c lelong x rev %d
7247: >0x43e leshort x \b.%d
7248: # No journal? ext2
7249: >0x45c lelong ^0x0000004 ext2 filesystem data
7250: >>0x43a leshort ^0x0000001 (mounted or unclean)
7251: # Has a journal? ext3 or ext4
7252: >0x45c lelong &0x0000004
7253: # and small INCOMPAT?
7254: >>0x460 lelong <0x0000040
7255: # and small RO_COMPAT?
7256: >>>0x464 lelong <0x0000008 ext3 filesystem data
7257: # else large RO_COMPAT?
7258: >>>0x464 lelong >0x0000007 ext4 filesystem data
7259: # else large INCOMPAT?
7260: >>0x460 lelong >0x000003f ext4 filesystem data
1.1.1.2 misho 7261: >0x468 belong x \b, UUID=%08x
7262: >0x46c beshort x \b-%04x
7263: >0x46e beshort x \b-%04x
7264: >0x470 beshort x \b-%04x
7265: >0x472 belong x \b-%08x
7266: >0x476 beshort x \b%04x
1.1 misho 7267: >0x478 string >0 \b, volume name "%s"
7268: # General flags for any ext* fs
7269: >0x460 lelong &0x0000004 (needs journal recovery)
7270: >0x43a leshort &0x0000002 (errors)
7271: # INCOMPAT flags
7272: >0x460 lelong &0x0000001 (compressed)
7273: #>0x460 lelong &0x0000002 (filetype)
7274: #>0x460 lelong &0x0000010 (meta bg)
7275: >0x460 lelong &0x0000040 (extents)
7276: >0x460 lelong &0x0000080 (64bit)
7277: #>0x460 lelong &0x0000100 (mmp)
7278: #>0x460 lelong &0x0000200 (flex bg)
7279: # RO_INCOMPAT flags
7280: #>0x464 lelong &0x0000001 (sparse super)
7281: >0x464 lelong &0x0000002 (large files)
7282: >0x464 lelong &0x0000008 (huge files)
7283: #>0x464 lelong &0x0000010 (gdt checksum)
7284: #>0x464 lelong &0x0000020 (many subdirs)
7285: #>0x463 lelong &0x0000040 (extra isize)
7286:
1.1.1.3 misho 7287: # Minix filesystems - Juan Cespedes <cespedes@debian.org>
7288: 0x410 leshort 0x137f
7289: !:strength / 2
7290: >0x402 beshort < 100
7291: >0x402 beshort > -1 Minix filesystem, V1, %d zones
7292: >0x1e string minix \b, bootable
7293: 0x410 beshort 0x137f
7294: !:strength / 2
7295: >0x402 beshort < 100
7296: >0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
7297: >0x1e string minix \b, bootable
7298: 0x410 leshort 0x138f
7299: !:strength / 2
7300: >0x402 beshort < 100
7301: >0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
7302: >0x1e string minix \b, bootable
7303: 0x410 beshort 0x138f
7304: !:strength / 2
7305: >0x402 beshort < 100
7306: >0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
7307: >0x1e string minix \b, bootable
7308: 0x410 leshort 0x2468
7309: >0x402 beshort < 100
7310: >>0x402 beshort > -1 Minix filesystem, V2, %d zones
7311: >0x1e string minix \b, bootable
7312: 0x410 beshort 0x2468
7313: >0x402 beshort < 100
7314: >0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
7315: >0x1e string minix \b, bootable
7316:
7317: 0x410 leshort 0x2478
7318: >0x402 beshort < 100
7319: >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
7320: >0x1e string minix \b, bootable
7321: 0x410 leshort 0x2478
7322: >0x402 beshort < 100
7323: >0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
7324: >0x1e string minix \b, bootable
7325: 0x410 beshort 0x2478
7326: >0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
7327: >0x1e string minix \b, bootable
7328: 0x410 leshort 0x4d5a
7329: >0x402 beshort !0 Minix filesystem, V3, %d zones
7330: >0x1e string minix \b, bootable
7331:
1.1 misho 7332: # SGI disk labels - Nathan Scott <nathans@debian.org>
7333: 0 belong 0x0BE5A941 SGI disk label (volume header)
7334:
7335: # SGI XFS filesystem - Nathan Scott <nathans@debian.org>
7336: 0 belong 0x58465342 SGI XFS filesystem data
7337: >0x4 belong x (blksz %d,
7338: >0x68 beshort x inosz %d,
7339: >0x64 beshort ^0x2004 v1 dirs)
7340: >0x64 beshort &0x2004 v2 dirs)
7341:
7342: ############################################################################
7343: # Minix-ST kernel floppy
7344: 0x800 belong 0x46fc2700 Atari-ST Minix kernel image
7345: >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
7346: >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
7347:
7348: ############################################################################
7349: # Hmmm, is this a better way of detecting _standard_ floppy images ?
7350: 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
7351: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
7352: 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
7353: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
7354: 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
7355: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
7356:
7357: 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
7358: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
7359: 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
7360: >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
7361:
7362: 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
7363: 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
7364:
7365: # Valid media descriptor bytes for MS-DOS:
7366: #
7367: # Byte Capacity Media Size and Type
7368: # -------------------------------------------------
7369: #
7370: # F0 2.88 MB 3.5-inch, 2-sided, 36-sector
7371: # F0 1.44 MB 3.5-inch, 2-sided, 18-sector
7372: # F9 720K 3.5-inch, 2-sided, 9-sector
7373: # F9 1.2 MB 5.25-inch, 2-sided, 15-sector
7374: # FD 360K 5.25-inch, 2-sided, 9-sector
7375: # FF 320K 5.25-inch, 2-sided, 8-sector
7376: # FC 180K 5.25-inch, 1-sided, 9-sector
7377: # FE 160K 5.25-inch, 1-sided, 8-sector
7378: # FE 250K 8-inch, 1-sided, single-density
7379: # FD 500K 8-inch, 2-sided, single-density
7380: # FE 1.2 MB 8-inch, 2-sided, double-density
7381: # F8 ----- Fixed disk
7382: #
7383: # FC xxxK Apricot 70x1x9 boot disk.
7384: #
7385: # Originally a bitmap:
7386: # xxxxxxx0 Not two sided
7387: # xxxxxxx1 Double sided
7388: # xxxxxx0x Not 8 SPT
7389: # xxxxxx1x 8 SPT
7390: # xxxxx0xx Not Removable drive
7391: # xxxxx1xx Removable drive
7392: # 11111xxx Must be one.
7393: #
7394: # But now it's rather random:
7395: # 111111xx Low density disk
7396: # 00 SS, Not 8 SPT
7397: # 01 DS, Not 8 SPT
7398: # 10 SS, 8 SPT
7399: # 11 DS, 8 SPT
7400: #
1.1.1.3 misho 7401: # 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
7402: # 11110000 High density 3 1/2 floppy disk
1.1 misho 7403: # 11111000 Hard disk any format
7404: #
7405:
7406: # CDROM Filesystems
7407: # Modified for UDF by gerardo.cacciari@gmail.com
1.1.1.3 misho 7408: 32769 string CD001 #
1.1 misho 7409: !:mime application/x-iso9660-image
7410: >38913 string !NSR0 ISO 9660 CD-ROM filesystem data
7411: >38913 string NSR0 UDF filesystem data
7412: >>38917 string 1 (version 1.0)
7413: >>38917 string 2 (version 1.5)
7414: >>38917 string 3 (version 2.0)
7415: >>38917 byte >0x33 (unknown version, ID 0x%X)
7416: >>38917 byte <0x31 (unknown version, ID 0x%X)
7417: # "application id" which appears to be used as a volume label
1.1.1.3 misho 7418: >32808 string/T >\0 '%s'
1.1 misho 7419: >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
7420: 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
7421: !:mime application/x-iso9660-image
7422: 32776 string CDROM High Sierra CD-ROM filesystem data
7423:
1.1.1.2 misho 7424: # .cso files
7425: 0 string CISO Compressed ISO CD image
7426:
1.1 misho 7427: # cramfs filesystem - russell@coker.com.au
7428: 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
7429: >4 lelong x size %lu
7430: >8 lelong &1 version #2
7431: >8 lelong &2 sorted_dirs
7432: >8 lelong &4 hole_support
7433: >32 lelong x CRC 0x%x,
7434: >36 lelong x edition %lu,
7435: >40 lelong x %lu blocks,
7436: >44 lelong x %lu files
7437:
7438: 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
7439: >4 belong x size %lu
7440: >8 belong &1 version #2
7441: >8 belong &2 sorted_dirs
7442: >8 belong &4 hole_support
7443: >32 belong x CRC 0x%x,
7444: >36 belong x edition %lu,
7445: >40 belong x %lu blocks,
7446: >44 belong x %lu files
7447:
7448: # reiserfs - russell@coker.com.au
7449: 0x10034 string ReIsErFs ReiserFS V3.5
7450: 0x10034 string ReIsEr2Fs ReiserFS V3.6
7451: 0x10034 string ReIsEr3Fs ReiserFS V3.6.19
7452: >0x1002c leshort x block size %d
7453: >0x10032 leshort &2 (mounted or unclean)
7454: >0x10000 lelong x num blocks %d
7455: >0x10040 lelong 1 tea hash
7456: >0x10040 lelong 2 yura hash
7457: >0x10040 lelong 3 r5 hash
7458:
7459: # JFFS - russell@coker.com.au
7460: 0 lelong 0x34383931 Linux Journalled Flash File system, little endian
7461: 0 belong 0x34383931 Linux Journalled Flash File system, big endian
7462:
7463: # EST flat binary format (which isn't, but anyway)
7464: # From: Mark Brown <broonie@sirena.org.uk>
7465: 0 string ESTFBINR EST flat binary
7466:
7467: # Aculab VoIP firmware
7468: # From: Mark Brown <broonie@sirena.org.uk>
7469: 0 string VoIP\ Startup\ and Aculab VoIP firmware
7470: >35 string x format %s
7471:
1.1.1.2 misho 7472: # From: Mark Brown <broonie@sirena.org.uk> [old]
7473: # From: Behan Webster <behanw@websterwood.com>
7474: 0 belong 0x27051956 u-boot legacy uImage,
7475: >32 string x %s,
7476: >28 byte 0 Invalid os/
7477: >28 byte 1 OpenBSD/
7478: >28 byte 2 NetBSD/
7479: >28 byte 3 FreeBSD/
7480: >28 byte 4 4.4BSD/
7481: >28 byte 5 Linux/
7482: >28 byte 6 SVR4/
7483: >28 byte 7 Esix/
7484: >28 byte 8 Solaris/
7485: >28 byte 9 Irix/
7486: >28 byte 10 SCO/
7487: >28 byte 11 Dell/
7488: >28 byte 12 NCR/
7489: >28 byte 13 LynxOS/
7490: >28 byte 14 VxWorks/
7491: >28 byte 15 pSOS/
7492: >28 byte 16 QNX/
7493: >28 byte 17 Firmware/
7494: >28 byte 18 RTEMS/
7495: >28 byte 19 ARTOS/
7496: >28 byte 20 Unity OS/
7497: >28 byte 21 INTEGRITY/
7498: >29 byte 0 \bInvalid CPU,
7499: >29 byte 1 \bAlpha,
7500: >29 byte 2 \bARM,
7501: >29 byte 3 \bIntel x86,
7502: >29 byte 4 \bIA64,
7503: >29 byte 5 \bMIPS,
7504: >29 byte 6 \bMIPS 64-bit,
7505: >29 byte 7 \bPowerPC,
7506: >29 byte 8 \bIBM S390,
7507: >29 byte 9 \bSuperH,
7508: >29 byte 10 \bSparc,
7509: >29 byte 11 \bSparc 64-bit,
7510: >29 byte 12 \bM68K,
7511: >29 byte 13 \bNios-32,
7512: >29 byte 14 \bMicroBlaze,
7513: >29 byte 15 \bNios-II,
7514: >29 byte 16 \bBlackfin,
7515: >29 byte 17 \bAVR32,
7516: >29 byte 18 \bSTMicroelectronics ST200,
7517: >30 byte 0 Invalid Image
7518: >30 byte 1 Standalone Program
7519: >30 byte 2 OS Kernel Image
7520: >30 byte 3 RAMDisk Image
7521: >30 byte 4 Multi-File Image
7522: >30 byte 5 Firmware Image
7523: >30 byte 6 Script File
7524: >30 byte 7 Filesystem Image (any type)
7525: >30 byte 8 Binary Flat Device Tree BLOB
7526: >31 byte 0 (Not compressed),
7527: >31 byte 1 (gzip),
7528: >31 byte 2 (bzip2),
7529: >31 byte 3 (lzma),
7530: >12 belong x %d bytes,
7531: >8 bedate x %s,
7532: >16 belong x Load Address: 0x%08X,
7533: >20 belong x Entry Point: 0x%08X,
7534: >4 belong x Header CRC: 0x%08X,
7535: >24 belong x Data CRC: 0x%08X
1.1 misho 7536:
7537: # JFFS2 file system
7538: 0 leshort 0x1984 Linux old jffs2 filesystem data little endian
7539: 0 leshort 0x1985 Linux jffs2 filesystem data little endian
7540:
7541: # Squashfs
7542: 0 string sqsh Squashfs filesystem, big endian,
7543: >28 beshort x version %d.
7544: >30 beshort x \b%d,
7545: >28 beshort <3
7546: >>8 belong x %d bytes,
7547: >28 beshort >2
1.1.1.3 misho 7548: >>28 beshort <4
7549: >>>63 bequad x %lld bytes,
7550: >>28 beshort >3
7551: >>>40 bequad x %lld bytes,
1.1 misho 7552: #>>67 belong x %d bytes,
7553: >4 belong x %d inodes,
7554: >28 beshort <2
7555: >>32 beshort x blocksize: %d bytes,
7556: >28 beshort >1
1.1.1.3 misho 7557: >>28 beshort <4
7558: >>>51 belong x blocksize: %d bytes,
7559: >>28 beshort >3
7560: >>>12 belong x blocksize: %d bytes,
7561: >28 beshort <4
7562: >>39 bedate x created: %s
7563: >28 beshort >3
7564: >>8 bedate x created: %s
1.1 misho 7565: 0 string hsqs Squashfs filesystem, little endian,
7566: >28 leshort x version %d.
7567: >30 leshort x \b%d,
7568: >28 leshort <3
7569: >>8 lelong x %d bytes,
7570: >28 leshort >2
1.1.1.3 misho 7571: >>28 leshort <4
7572: >>>63 lequad x %lld bytes,
7573: >>28 leshort >3
7574: >>>40 lequad x %lld bytes,
1.1 misho 7575: #>>63 lelong x %d bytes,
7576: >4 lelong x %d inodes,
7577: >28 leshort <2
7578: >>32 leshort x blocksize: %d bytes,
7579: >28 leshort >1
1.1.1.3 misho 7580: >>28 leshort <4
7581: >>>51 lelong x blocksize: %d bytes,
7582: >>28 leshort >3
7583: >>>12 lelong x blocksize: %d bytes,
7584: >28 leshort <4
7585: >>39 ledate x created: %s
7586: >28 leshort >3
7587: >>8 ledate x created: %s
1.1 misho 7588:
7589: # AFS Dump Magic
7590: # From: Ty Sarna <tsarna@sarna.org>
7591: 0 string \x01\xb3\xa1\x13\x22 AFS Dump
7592: >&0 belong x (v%d)
7593: >>&0 byte 0x76
7594: >>>&0 belong x Vol %d,
7595: >>>>&0 byte 0x6e
7596: >>>>>&0 string x %s
7597: >>>>>>&1 byte 0x74
7598: >>>>>>>&0 beshort 2
7599: >>>>>>>>&4 bedate x on: %s
7600: >>>>>>>>&0 bedate =0 full dump
7601: >>>>>>>>&0 bedate !0 incremental since: %s
7602:
7603: #----------------------------------------------------------
1.1.1.2 misho 7604: #delta ISO Daniel Novotny (dnovotny@redhat.com)
7605: 0 string DISO Delta ISO data
7606: >4 belong x version %d
7607:
1.1 misho 7608: # VMS backup savesets - gerardo.cacciari@gmail.com
7609: #
7610: 4 string \x01\x00\x01\x00\x01\x00
7611: >(0.s+16) string \x01\x01
7612: >>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
7613: >>>40 lelong x (block size %d,
7614: >>>49 string >\0 original name '%s',
7615: >>>2 short 1024 VAX generated)
7616: >>>2 short 2048 AXP generated)
7617: >>>2 short 4096 I64 generated)
7618:
7619: # Summary: Oracle Clustered Filesystem
7620: # Created by: Aaron Botsis <redhat@digitalmafia.org>
7621: 8 string OracleCFS Oracle Clustered Filesystem,
7622: >4 long x rev %d
7623: >0 long x \b.%d,
7624: >560 string x label: %.64s,
7625: >136 string x mountpoint: %.128s
7626:
7627: # Summary: Oracle ASM tagged volume
7628: # Created by: Aaron Botsis <redhat@digitalmafia.org>
7629: 32 string ORCLDISK Oracle ASM Volume,
7630: >40 string x Disk Name: %0.12s
7631: 32 string ORCLCLRD Oracle ASM Volume (cleared),
7632: >40 string x Disk Name: %0.12s
7633:
7634: # Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
7635: 8 string OracleCFS Oracle Clustered Filesystem,
7636: >4 long x rev %d
7637: >0 long x \b.%d,
7638: >560 string x label: %.64s,
7639: >136 string x mountpoint: %.128s
7640:
7641: # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
7642: 32 string ORCLDISK Oracle ASM Volume,
7643: >40 string x Disk Name: %0.12s
7644: 32 string ORCLCLRD Oracle ASM Volume (cleared),
7645: >40 string x Disk Name: %0.12s
7646:
7647: # Compaq/HP RILOE floppy image
7648: # From: Dirk Jagdmann <doj@cubic.org>
7649: 0 string CPQRFBLO Compaq/HP RILOE floppy image
7650:
7651: #------------------------------------------------------------------------------
1.1.1.3 misho 7652: # Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
7653: # These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
7654: # which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
1.1 misho 7655: #
1.1.1.3 misho 7656: 1008 string DECFILE11 Files-11 On-Disk Structure
1.1 misho 7657: >525 byte x Level %d
1.1.1.3 misho 7658: >525 byte x (ODS-%d);
7659: >1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
7660: >1017 string B
7661: >>525 byte 2 VAX/VMS or OpenVMS file system;
7662: >>525 byte 5 OpenVMS Alpha or Itanium file system;
1.1 misho 7663: >984 string x volume label is '%-12.12s'
7664:
7665: # From: Thomas Klausner <wiz@NetBSD.org>
7666: # http://filext.com/file-extension/DAA
7667: # describes the daa file format. The magic would be:
7668: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
7669:
7670: # From Albert Cahalan <acahalan@gmail.com>
7671: # really le32 operation,destination,payloadsize (but quite predictable)
7672: # 01 00 00 00 00 00 00 c0 00 02 00 00
7673: 0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
7674:
7675: # From Eric Sandeen
7676: # GFS2
1.1.1.3 misho 7677: 0x10000 belong 0x01161970
7678: >0x10018 belong 0x0000051d GFS1 Filesystem
7679: >>0x10024 belong x (blocksize %d,
7680: >>0x10060 string >\0 lockproto %s)
7681: >0x10018 belong 0x00000709 GFS2 Filesystem
7682: >>0x10024 belong x (blocksize %d,
7683: >>0x10060 string >\0 lockproto %s)
1.1 misho 7684:
1.1.1.2 misho 7685: # BTRFS
7686: 0x10040 string _BHRfS_M BTRFS Filesystem
7687: >0x1012b string >\0 (label "%s",
7688: >0x10090 lelong x sectorsize %d,
7689: >0x10094 lelong x nodesize %d,
7690: >0x10098 lelong x leafsize %d)
7691:
7692:
1.1 misho 7693: # dvdisaster's .ecc
7694: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
7695: 0 string *dvdisaster* dvdisaster error correction file
7696:
1.1.1.2 misho 7697: # xfs metadump image
7698: # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
7699: # but can we do the << ? For now it's always 512 (0x200) anyway.
7700: 0 string XFSM
7701: >0x200 string XFSB XFS filesystem metadump image
7702:
1.1 misho 7703: # Type: CROM filesystem
7704: # From: Werner Fink <werner@suse.de>
7705: 0 string CROMFS CROMFS
7706: >6 string >\0 \b version %2.2s,
7707: >8 ulequad >0 \b block data at %lld,
7708: >16 ulequad >0 \b fblock table at %lld,
7709: >24 ulequad >0 \b inode table at %lld,
7710: >32 ulequad >0 \b root at %lld,
7711: >40 ulelong >0 \b fblock size = %ld,
7712: >44 ulelong >0 \b block size = %ld,
7713: >48 ulequad >0 \b bytes = %lld
7714:
1.1.1.2 misho 7715: # Type: xfs metadump image
7716: # From: Daniel Novotny <dnovotny@redhat.com>
7717: # mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
7718: # but can we do the << ? For now it's always 512 (0x200) anyway.
7719: 0 string XFSM
7720: >0x200 string XFSB XFS filesystem metadump image
7721:
7722: # Type: delta ISO
7723: # From: Daniel Novotny <dnovotny@redhat.com>
7724: 0 string DISO Delta ISO data,
7725: >4 belong x version %d
7726:
7727: # JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
7728: # See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
7729: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
7730: 0x8000 string JFS1
7731: # Because it's text-only magic, check a binary value (version) to be sure.
7732: # Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
7733: # mountable.
7734: >&0 lelong <3 JFS2 filesystem image
7735: # Label is followed by a UUID; we have to limit string length to avoid
7736: # appending the UUID in the case of a 16-byte label.
7737: >>&144 regex [\x20-\x7E]{1,16} (label "%s")
7738: >>&0 lequad x \b, %lld blocks
7739: >>&8 lelong x \b, blocksize %d
7740: >>&32 lelong&0x00000006 >0 (dirty)
7741: >>&36 lelong >0 (compressed)
7742:
1.1.1.3 misho 7743: # LFS
7744: 0 lelong 0x070162 LFS filesystem image
7745: >4 lelong 1 version 1,
7746: >>8 lelong x \b blocks %u,
7747: >>12 lelong x \b blocks per segment %u,
7748: >4 lelong 2 version 2,
7749: >>8 lelong x \b fragments %u,
7750: >>12 lelong x \b bytes per segment %u,
7751: >16 lelong x \b disk blocks %u,
7752: >20 lelong x \b block size %u,
7753: >24 lelong x \b fragment size %u,
7754: >28 lelong x \b fragments per block %u,
7755: >32 lelong x \b start for free list %u,
7756: >36 lelong x \b number of free blocks %d,
7757: >40 lelong x \b number of files %u,
7758: >44 lelong x \b blocks available for writing %d,
7759: >48 lelong x \b inodes in cache %d,
7760: >52 lelong x \b inode file disk address 0x%x,
7761: >56 lelong x \b inode file inode number %u,
7762: >60 lelong x \b address of last segment written 0x%x,
7763: >64 lelong x \b address of next segment to write 0x%x,
7764: >68 lelong x \b address of current segment written 0x%x
7765:
7766: 0 string td\000 floppy image data (TeleDisk, compressed)
7767: 0 string TD\000 floppy image data (TeleDisk)
7768:
7769: 0 string CQ\024 floppy image data (CopyQM,
7770: >16 leshort x %d sectors,
7771: >18 leshort x %d heads.)
7772:
7773: 0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
7774:
7775: 0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
7776: 0 beshort 0xAA59 floppy image data (IBM SaveDskF)
7777: 0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
7778:
7779: 0 string \074CPM_Disk\076 disk image data (YAZE)
7780:
1.1 misho 7781: #------------------------------------------------------------------------------
1.1.1.2 misho 7782: # $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $
1.1 misho 7783: # flash: file(1) magic for Macromedia Flash file format
7784: #
7785: # See
7786: #
7787: # http://www.macromedia.com/software/flash/open/
7788: #
7789: 0 string FWS Macromedia Flash data,
7790: >3 byte x version %d
7791: !:mime application/x-shockwave-flash
7792: 0 string CWS Macromedia Flash data (compressed),
7793: !:mime application/x-shockwave-flash
7794: >3 byte x version %d
7795: # From: Cal Peake <cp@absolutedigital.net>
7796: 0 string FLV Macromedia Flash Video
7797: !:mime video/x-flv
7798:
7799: #
1.1.1.2 misho 7800: # Yosu Gomez
7801: 0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
7802: 0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
1.1 misho 7803: # From Dave Wilson
7804: 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
1.1.1.2 misho 7805:
1.1 misho 7806: #------------------------------------------------------------------------------
1.1.1.3 misho 7807: # $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
1.1 misho 7808: # fonts: file(1) magic for font data
7809: #
7810: 0 search/1 FONT ASCII vfont text
7811: 0 short 0436 Berkeley vfont data
7812: 0 short 017001 byte-swapped Berkeley vfont data
7813:
7814: # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
1.1.1.2 misho 7815: 0 string %!PS-AdobeFont-1. PostScript Type 1 font text
7816: >20 string >\0 (%s)
1.1 misho 7817: 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
1.1.1.2 misho 7818: 0 string %!FontType1 PostScript Type 1 font program data
7819: 6 string %!FontType1 PostScript Type 1 font program data
7820: 0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
1.1 misho 7821:
7822: # X11 font files in SNF (Server Natural Format) format
1.1.1.3 misho 7823: # updated by Joerg Jenderek at Feb 2013
7824: # http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
1.1 misho 7825: 0 belong 00000004 X11 SNF font data, MSB first
1.1.1.3 misho 7826: #>104 belong 00000004 X11 SNF font data, MSB first
7827: !:mime application/x-font-sfn
7828: # GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
7829: 0 lelong 00000004
7830: >104 lelong 00000004 X11 SNF font data, LSB first
7831: !:mime application/x-font-sfn
1.1 misho 7832:
7833: # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
7834: 0 search/1 STARTFONT\ X11 BDF font text
7835:
7836: # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
7837: # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
7838: 0 string \001fcp X11 Portable Compiled Font data
7839: >12 byte 0x02 \b, LSB first
7840: >12 byte 0x0a \b, MSB first
7841: 0 string D1.0\015 X11 Speedo font data
7842:
7843: #------------------------------------------------------------------------------
7844: # FIGlet fonts and controlfiles
7845: # From figmagic supplied with Figlet version 2.2
7846: # "David E. O'Brien" <obrien@FreeBSD.ORG>
7847: 0 string flf FIGlet font
7848: >3 string >2a version %-2.2s
7849: 0 string flc FIGlet controlfile
7850: >3 string >2a version %-2.2s
7851:
7852: # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
7853: # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
7854: 0 belong 0x14025919 libGrx font data,
7855: >8 leshort x %dx
7856: >10 leshort x \b%d
7857: >40 string x %s
7858: # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
7859: 0 belong 0xff464f4e DOS code page font data collection
7860: 7 belong 0x00454741 DOS code page font data
7861: 7 belong 0x00564944 DOS code page font data (from Linux?)
7862: 4098 string DOSFONT DOSFONT2 encrypted font data
7863:
7864: # downloadable fonts for browser (prints type) anthon@mnt.org
7865: 0 string PFR1 PFR1 font
7866: >102 string >0 \b: %s
7867:
7868: # True Type fonts
7869: 0 string \000\001\000\000\000 TrueType font data
1.1.1.2 misho 7870: !:mime application/x-font-ttf
1.1 misho 7871:
7872: 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
7873: 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
7874:
1.1.1.2 misho 7875: # TrueType/OpenType font collections (.ttc)
7876: # http://www.microsoft.com/typography/otspec/otff.htm
7877: 0 string ttcf TrueType font collection data
7878: >4 belong 0x00010000 \b, 1.0
7879: >>8 belong >0 \b, %d fonts
7880: >4 belong 0x00020000 \b, 2.0
7881: >>8 belong >0 \b, %d fonts
7882: # 0x44454947 = 'DSIG'
7883: >>>16 belong 0x44534947 \b, digitally signed
7884:
1.1 misho 7885: # Opentype font data from Avi Bercovich
1.1.1.2 misho 7886: 0 string OTTO OpenType font data
7887: !:mime application/vnd.ms-opentype
1.1 misho 7888:
1.1.1.3 misho 7889: # Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
1.1 misho 7890: 0 string SplineFontDB: Spline Font Database
1.1.1.2 misho 7891: !:mime application/vnd.font-fontforge-sfd
1.1 misho 7892: >14 string x version %s
1.1.1.2 misho 7893:
1.1.1.3 misho 7894: # EOT
7895: 34 string LP Embedded OpenType (EOT)
7896: !:mime application/vnd.ms-fontobject
7897:
7898: # Web Open Font Format (.woff)
7899: # http://www.w3.org/TR/WOFF/
7900: 0 string wOFF Web Open Font Format
7901: >4 belong x \b, flavor %d
7902: >8 belong x \b, length %d
7903: >20 beshort x \b, version %hd
7904: >22 beshort x \b.%hd
7905:
1.1.1.2 misho 7906: #------------------------------------------------------------------------------
1.1.1.3 misho 7907: # $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $
1.1 misho 7908: # FORTRAN source
1.1.1.2 misho 7909: 0 regex/100 \^[Cc][\ \t] FORTRAN program
1.1 misho 7910: !:mime text/x-fortran
1.1.1.3 misho 7911: !:strength - 5
1.1.1.2 misho 7912:
1.1 misho 7913: #------------------------------------------------------------------------------
1.1.1.2 misho 7914: # $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
1.1 misho 7915: # frame: file(1) magic for FrameMaker files
7916: #
7917: # This stuff came on a FrameMaker demo tape, most of which is
7918: # copyright, but this file is "published" as witness the following:
7919: #
7920: # Note that this is the Framemaker Maker Interchange Format, not the
7921: # Normal format which would be application/vnd.framemaker.
7922: #
7923: 0 string \<MakerFile FrameMaker document
7924: !:mime application/x-mif
7925: >11 string 5.5 (5.5
7926: >11 string 5.0 (5.0
7927: >11 string 4.0 (4.0
7928: >11 string 3.0 (3.0
7929: >11 string 2.0 (2.0
7930: >11 string 1.0 (1.0
7931: >14 byte x %c)
7932: 0 string \<MIFFile FrameMaker MIF (ASCII) file
7933: !:mime application/x-mif
7934: >9 string 4.0 (4.0)
7935: >9 string 3.0 (3.0)
7936: >9 string 2.0 (2.0)
7937: >9 string 1.0 (1.x)
7938: 0 search/1 \<MakerDictionary FrameMaker Dictionary text
7939: !:mime application/x-mif
7940: >17 string 3.0 (3.0)
7941: >17 string 2.0 (2.0)
7942: >17 string 1.0 (1.x)
7943: 0 string \<MakerScreenFont FrameMaker Font file
7944: !:mime application/x-mif
7945: >17 string 1.01 (%s)
7946: 0 string \<MML FrameMaker MML file
7947: !:mime application/x-mif
7948: 0 string \<BookFile FrameMaker Book file
7949: !:mime application/x-mif
7950: >10 string 3.0 (3.0
7951: >10 string 2.0 (2.0
7952: >10 string 1.0 (1.0
7953: >13 byte x %c)
7954: # XXX - this book entry should be verified, if you find one, uncomment this
7955: #0 string \<Book\ FrameMaker Book (ASCII) file
7956: #!:mime application/x-mif
7957: #>6 string 3.0 (3.0)
7958: #>6 string 2.0 (2.0)
7959: #>6 string 1.0 (1.0)
7960: 0 string \<Maker Intermediate Print File FrameMaker IPL file
7961: !:mime application/x-mif
7962:
7963: #------------------------------------------------------------------------------
1.1.1.2 misho 7964: # $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
1.1 misho 7965: # freebsd: file(1) magic for FreeBSD objects
7966: #
7967: # All new-style FreeBSD magic numbers are in host byte order (i.e.,
7968: # little-endian on x86).
7969: #
7970: # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
7971: # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
7972: # schemes for distinguishing between executable images, shared libraries,
7973: # and object files.
7974: #
7975: # FreeBSD says:
7976: #
7977: # Regardless of whether it's pure, demand-paged, or none of the
7978: # above:
7979: #
7980: # if the entry point is < 4096, then it's a shared library if
7981: # the "has run-time loader information" bit is set, and is
7982: # position-independent if the "is position-independent" bit
7983: # is set;
7984: #
7985: # if the entry point is >= 4096 (or >4095, same thing), then it's
7986: # an executable, and is dynamically-linked if the "has run-time
7987: # loader information" bit is set.
7988: #
7989: # On x86, NetBSD says:
7990: #
7991: # If it's neither pure nor demand-paged:
7992: #
7993: # if it has the "has run-time loader information" bit set, it's
7994: # a dynamically-linked executable;
7995: #
7996: # if it doesn't have that bit set, then:
7997: #
7998: # if it has the "is position-independent" bit set, it's
7999: # position-independent;
8000: #
8001: # if the entry point is non-zero, it's an executable, otherwise
8002: # it's an object file.
8003: #
8004: # If it's pure:
8005: #
8006: # if it has the "has run-time loader information" bit set, it's
8007: # a dynamically-linked executable, otherwise it's just an
8008: # executable.
8009: #
8010: # If it's demand-paged:
8011: #
8012: # if it has the "has run-time loader information" bit set,
8013: # then:
8014: #
8015: # if the entry point is < 4096, it's a shared library;
8016: #
8017: # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
8018: # it's a dynamically-linked executable);
8019: #
8020: # if it doesn't have the "has run-time loader information" bit
8021: # set, then it's just an executable.
8022: #
8023: # (On non-x86, NetBSD does much the same thing, except that it uses
8024: # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
8025: # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
8026: # had 8K pages; dunno about MIPS.)
8027: #
8028: # I suspect the two will differ only in perverse and uninteresting cases
8029: # ("shared" libraries that aren't demand-paged and whose pages probably
8030: # won't actually be shared, executables with entry points <4096).
8031: #
8032: # I leave it to those more familiar with FreeBSD and NetBSD to figure out
8033: # what the right answer is (although using ">4095", FreeBSD-style, is
8034: # probably better than separately checking for "=4096" and ">4096",
8035: # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
8036: # executables using the NetBSD technique.)
8037: #
8038: 0 lelong&0377777777 041400407 FreeBSD/i386
8039: >20 lelong <4096
8040: >>3 byte&0xC0 &0x80 shared library
8041: >>3 byte&0xC0 0x40 PIC object
8042: >>3 byte&0xC0 0x00 object
8043: >20 lelong >4095
8044: >>3 byte&0x80 0x80 dynamically linked executable
8045: >>3 byte&0x80 0x00 executable
8046: >16 lelong >0 not stripped
8047:
8048: 0 lelong&0377777777 041400410 FreeBSD/i386 pure
8049: >20 lelong <4096
8050: >>3 byte&0xC0 &0x80 shared library
8051: >>3 byte&0xC0 0x40 PIC object
8052: >>3 byte&0xC0 0x00 object
8053: >20 lelong >4095
8054: >>3 byte&0x80 0x80 dynamically linked executable
8055: >>3 byte&0x80 0x00 executable
8056: >16 lelong >0 not stripped
8057:
8058: 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
8059: >20 lelong <4096
8060: >>3 byte&0xC0 &0x80 shared library
8061: >>3 byte&0xC0 0x40 PIC object
8062: >>3 byte&0xC0 0x00 object
8063: >20 lelong >4095
8064: >>3 byte&0x80 0x80 dynamically linked executable
8065: >>3 byte&0x80 0x00 executable
8066: >16 lelong >0 not stripped
8067:
8068: 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
8069: >20 lelong <4096
8070: >>3 byte&0xC0 &0x80 shared library
8071: >>3 byte&0xC0 0x40 PIC object
8072: >>3 byte&0xC0 0x00 object
8073: >20 lelong >4095
8074: >>3 byte&0x80 0x80 dynamically linked executable
8075: >>3 byte&0x80 0x00 executable
8076: >16 lelong >0 not stripped
8077:
8078: # XXX gross hack to identify core files
8079: # cores start with a struct tss; we take advantage of the following:
8080: # byte 7: highest byte of the kernel stack pointer, always 0xfe
8081: # 8/9: kernel (ring 0) ss value, always 0x0010
8082: # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
8083: # 28: low order byte of the current PTD entry, always 0 since the
8084: # PTD is page-aligned
8085: #
8086: 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
8087: >1039 string >\0 from '%s'
8088:
8089: # /var/run/ld.so.hints
8090: # What are you laughing about?
8091: 0 lelong 011421044151 ld.so hints file (Little Endian
8092: >4 lelong >0 \b, version %d)
8093: >4 belong <1 \b)
8094: 0 belong 011421044151 ld.so hints file (Big Endian
8095: >4 belong >0 \b, version %d)
8096: >4 belong <1 \b)
8097:
8098: #
8099: # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
8100: #
8101: 0 string SCRSHOT_ scrshot(1) screenshot,
8102: >8 byte x version %d,
8103: >9 byte 2 %d bytes in header,
8104: >>10 byte x %d chars wide by
8105: >>11 byte x %d chars high
8106:
8107: #------------------------------------------------------------------------------
1.1.1.2 misho 8108: # $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
1.1 misho 8109: # fsav: file(1) magic for datafellows fsav virus definition files
8110: # Anthon van der Neut (anthon@mnt.org)
8111:
8112: # ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
8113: 0 beshort 0x1575 fsav macro virus signatures
8114: >8 leshort >0 (%d-
8115: >11 byte >0 \b%02d-
8116: >10 byte >0 \b%02d)
8117: # ftp://ftp.f-prot.com/pub/sign.zip
8118: #10 ubyte <12
8119: #>9 ubyte <32
8120: #>>8 ubyte 0x0a
8121: #>>>12 ubyte 0x07
8122: #>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
8123: #>>>>10 byte 0 \b01-
8124: #>>>>10 byte 1 \b02-
8125: #>>>>10 byte 2 \b03-
8126: #>>>>10 byte 3 \b04-
8127: #>>>>10 byte 4 \b05-
8128: #>>>>10 byte 5 \b06-
8129: #>>>>10 byte 6 \b07-
8130: #>>>>10 byte 7 \b08-
8131: #>>>>10 byte 8 \b09-
8132: #>>>>10 byte 9 \b10-
8133: #>>>>10 byte 10 \b11-
8134: #>>>>10 byte 11 \b12-
8135: #>>>>9 ubyte >0 \b%02d)
8136: # ftp://ftp.f-prot.com/pub/sign2.zip
8137: #0 ubyte 0x62
8138: #>1 ubyte 0xF5
8139: #>>2 ubyte 0x1
8140: #>>>3 ubyte 0x1
8141: #>>>>4 ubyte 0x0e
8142: #>>>>>13 ubyte >0 fsav virus signatures
8143: #>>>>>>11 ubyte x size 0x%02x
8144: #>>>>>>12 ubyte x \b%02x
8145: #>>>>>>13 ubyte x \b%02x bytes
8146:
8147: # Joerg Jenderek: joerg dot jenderek at web dot de
8148: # http://www.clamav.net/doc/latest/html/node45.html
8149: # .cvd files start with a 512 bytes colon separated header
8150: # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
8151: # + gzipped tarball files
8152: 0 string ClamAV-VDB:
8153: >11 string >\0 Clam AntiVirus database %-.23s
8154: >>34 string :
8155: >>>35 string !: \b, version
8156: >>>>35 string x \b%-.1s
8157: >>>>>36 string !:
8158: >>>>>>36 string x \b%-.1s
8159: >>>>>>>37 string !:
8160: >>>>>>>>37 string x \b%-.1s
8161: >>>>>>>>>38 string !:
8162: >>>>>>>>>>38 string x \b%-.1s
8163: >512 string \037\213 \b, gzipped
8164: >769 string ustar\0 \b, tarred
8165:
8166: # Type: Grisoft AVG AntiVirus
8167: # From: David Newgas <david@newgas.net>
8168: 0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
1.1.1.2 misho 8169:
1.1 misho 8170: #------------------------------------------------------------------------------
1.1.1.3 misho 8171: # $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
8172: # fusecompress: file(1) magic for fusecompress
8173: 0 string \037\135\211 FuseCompress(ed) data
8174: >3 byte 0x00 (none format)
8175: >3 byte 0x01 (bz2 format)
8176: >3 byte 0x02 (gz format)
8177: >3 byte 0x03 (lzo format)
8178: >3 byte 0x04 (xor format)
8179: >3 byte >0x04 (unknown format)
8180: >4 long x uncompressed size: %d
8181:
8182: #------------------------------------------------------------------------------
8183: # $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
1.1 misho 8184: # games: file(1) for games
8185:
8186: # Fabio Bonelli <fabiobonelli@libero.it>
8187: # Quake II - III data files
8188: 0 string IDP2 Quake II 3D Model file,
8189: >20 long x %lu skin(s),
8190: >8 long x (%lu x
8191: >12 long x %lu),
8192: >40 long x %lu frame(s),
8193: >16 long x Frame size %lu bytes,
8194: >24 long x %lu vertices/frame,
8195: >28 long x %lu texture coordinates,
8196: >32 long x %lu triangles/frame
8197:
8198: 0 string IBSP Quake
8199: >4 long 0x26 II Map file (BSP)
8200: >4 long 0x2E III Map file (BSP)
8201:
8202: 0 string IDS2 Quake II SP2 sprite file
8203:
8204: #---------------------------------------------------------------------------
8205: # Doom and Quake
8206: # submitted by Nicolas Patrois
8207:
8208: 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
8209: # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
8210:
8211: 24 string LxD\ 203 Linuxdoom save
8212: >0 string x , name=%s
8213: >44 string x , world=%s
8214:
8215: # Quake
8216:
8217: 0 string PACK Quake I or II world or extension
1.1.1.2 misho 8218: >8 lelong >0 \b, %d entries
1.1 misho 8219:
8220: #0 string -1\x0a Quake I demo
8221: #>30 string x version %.4s
8222: #>61 string x level %s
8223:
8224: #0 string 5\x0a Quake I save
8225:
8226: # The levels
8227:
8228: # Quake 1
8229:
8230: 0 string 5\x0aIntroduction Quake I save: start Introduction
8231: 0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
8232: 0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
8233: 0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
8234: 0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
8235: 0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
8236: 0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
8237: 0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
8238: 0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
8239: 0 string 5\x0athe_Installation Quake I save: e2m1 The installation
8240: 0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
8241: 0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
8242: 0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
8243: 0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
8244: 0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
8245: 0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
8246: 0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
8247: 0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
8248: 0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
8249: 0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
8250: 0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
8251: 0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
8252: 0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
8253: 0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
8254: 0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
8255: 0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
8256: 0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
8257: 0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
8258: 0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
8259: 0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
8260: 0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
8261: 0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
8262:
8263: # Quake DeathMatch levels
8264:
8265: 0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
8266: 0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
8267: 0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
8268: 0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
8269: 0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
8270: 0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
8271:
8272: # Scourge of Armagon
8273:
8274: 0 string 5\x0aCommand_HQ Quake I save: start Command HQ
8275: 0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
8276: 0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
8277: 0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
8278: 0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
8279: 0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
8280: 0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
8281: 0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
8282: 0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
8283: 0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
8284: 0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
8285: 0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
8286: 0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
8287: 0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
8288: 0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
8289: 0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
8290: 0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
8291: 0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
8292:
8293: # Malice
8294:
8295: 0 string 5\x0aThe_Academy Quake I save: start The academy
8296: 0 string 5\x0aThe_Lab Quake I save: d1 The lab
8297: 0 string 5\x0aArea_33 Quake I save: d1b Area 33
8298: 0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
8299: 0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
8300: 0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
8301: 0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
8302: 0 string 5\x0aArea44 Quake I save: d1c Area 44
8303: 0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
8304: 0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
8305: 0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
8306: 0 string 5\x0aThe_Flood Quake I save: d5 The flood
8307: 0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
8308: 0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
8309: 0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
8310: 0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
8311: 0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
8312: 0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
8313: 0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
8314: 0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
8315: 0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
8316:
8317: # Malice DeathMatch levels
8318:
8319: 0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
8320: 0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
8321: 0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
8322: 0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
8323: 0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
8324: 0 string 5\x0aDOMINO Quake I save: ddm6 Domino
8325: 0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
8326:
8327:
8328: 0 string MComprHD MAME CHD compressed hard disk image,
8329: >12 belong x version %lu
8330:
8331: # doom - submitted by Jon Dowland
8332:
8333: 0 string =IWAD doom main IWAD data
8334: >4 lelong x containing %d lumps
8335: 0 string =PWAD doom patch PWAD data
8336: >4 lelong x containing %d lumps
8337:
1.1.1.3 misho 8338: # Build engine group files (Duke Nukem, Shadow Warrior, ...)
8339: # Extension: .grp
8340: # Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
8341: 0 string KenSilverman Build engine group file
8342: >12 lelong x containing %d files
1.1 misho 8343:
8344: # Summary: Warcraft 3 save
8345: # Extension: .w3g
8346: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
8347: 0 string Warcraft\ III\ recorded\ game %s
8348:
8349:
8350: # Summary: Warcraft 3 map
8351: # Extension: .w3m
8352: # Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
8353: 0 string HM3W Warcraft III map file
8354:
8355:
8356: # Summary: SGF Smart Game Format
8357: # Extension: .sgf
8358: # Reference: http://www.red-bean.com/sgf/
8359: # Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
8360: # Modified by (1): Abel Cheung (regex, more game format)
8361: # FIXME: Some games don't have GM (game type)
8362: 0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
1.1.1.3 misho 8363: >2 search/0x200/b GM[
1.1 misho 8364: >>&0 string 1] (Go)
8365: >>&0 string 2] (Othello)
8366: >>&0 string 3] (chess)
8367: >>&0 string 4] (Gomoku+Renju)
8368: >>&0 string 5] (Nine Men's Morris)
8369: >>&0 string 6] (Backgammon)
8370: >>&0 string 7] (Chinese chess)
8371: >>&0 string 8] (Shogi)
8372: >>&0 string 9] (Lines of Action)
8373: >>&0 string 10] (Ataxx)
8374: >>&0 string 11] (Hex)
8375: >>&0 string 12] (Jungle)
8376: >>&0 string 13] (Neutron)
8377: >>&0 string 14] (Philosopher's Football)
8378: >>&0 string 15] (Quadrature)
8379: >>&0 string 16] (Trax)
8380: >>&0 string 17] (Tantrix)
8381: >>&0 string 18] (Amazons)
8382: >>&0 string 19] (Octi)
8383: >>&0 string 20] (Gess)
8384: >>&0 string 21] (Twixt)
8385: >>&0 string 22] (Zertz)
8386: >>&0 string 23] (Plateau)
8387: >>&0 string 24] (Yinsh)
8388: >>&0 string 25] (Punct)
8389: >>&0 string 26] (Gobblet)
8390: >>&0 string 27] (hive)
8391: >>&0 string 28] (Exxit)
8392: >>&0 string 29] (Hnefatal)
8393: >>&0 string 30] (Kuba)
8394: >>&0 string 31] (Tripples)
8395: >>&0 string 32] (Chase)
8396: >>&0 string 33] (Tumbling Down)
8397: >>&0 string 34] (Sahara)
8398: >>&0 string 35] (Byte)
8399: >>&0 string 36] (Focus)
8400: >>&0 string 37] (Dvonn)
8401: >>&0 string 38] (Tamsk)
8402: >>&0 string 39] (Gipf)
8403: >>&0 string 40] (Kropki)
8404:
8405: ##############################################
8406: # NetImmerse/Gamebryo game engine entries
8407:
8408: # Summary: Gamebryo game engine file
8409: # Extension: .nif, .kf
8410: # Created by: Abel Cheung <abelcheung@gmail.com>
8411: 0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file
8412: >&0 regex [0-9a-z.]+ \b, version %s
8413:
8414: # Summary: Gamebryo game engine file
8415: # Extension: .kfm
8416: # Created by: Abel Cheung <abelcheung@gmail.com>
8417: 0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File
8418: >&0 regex [0-9a-z.]+ \b, version %s
8419:
8420: # Summary: NetImmerse game engine file
8421: # Extension .nif
8422: # Created by: Abel Cheung <abelcheung@gmail.com>
8423: 0 string NetImmerse\ File\ Format,\ Versio
8424: >&0 string n\ NetImmerse game engine file
8425: >>&0 regex [0-9a-z.]+ \b, version %s
8426:
8427: # Type: SGF Smart Game Format
8428: # URL: http://www.red-bean.com/sgf/
8429: # From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
8430: 2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
8431: >2 regex/c GM\\[1\\] - Go Game
8432: >2 regex/c GM\\[6\\] - BackGammon Game
8433: >2 regex/c GM\\[11\\] - Hex Game
8434: >2 regex/c GM\\[18\\] - Amazons Game
8435: >2 regex/c GM\\[19\\] - Octi Game
8436: >2 regex/c GM\\[20\\] - Gess Game
8437: >2 regex/c GM\\[21\\] - twix Game
8438:
1.1.1.3 misho 8439: # Epic Games/Unreal Engine Package
8440: #
8441: 0 lelong 0x9E2A83C1 Unreal Engine Package,
8442: >4 leshort x version: %i
8443: >12 lelong !0 \b, names: %i
8444: >28 lelong !0 \b, imports: %i
8445: >20 lelong !0 \b, exports: %i
8446:
1.1 misho 8447: #------------------------------------------------------------------------------
1.1.1.2 misho 8448: # $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 8449: # gcc: file(1) magic for GCC special files
8450: #
8451: 0 string gpch GCC precompiled header
8452:
8453: # The version field is annoying. It's 3 characters, not zero-terminated.
8454: >5 byte x (version %c
8455: >6 byte x \b%c
8456: >7 byte x \b%c)
8457:
8458: # 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
8459: >4 byte 67 for C
8460: >4 byte 111 for Objective C
8461: >4 byte 43 for C++
8462: >4 byte 79 for Objective C++
8463:
8464: #------------------------------------------------------------------------------
1.1.1.3 misho 8465: # $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
8466: # Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
8467:
8468: ######################################################################
8469: #
8470: # Acoustic Doppler Current Profilers (ADCP)
8471: #
8472: ######################################################################
8473:
8474: 0 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP)
8475:
8476: ######################################################################
8477: #
8478: # Metadata
8479: #
8480: ######################################################################
8481:
8482: 0 string Identification_Information FGDC ASCII metadata
8483:
8484: ######################################################################
8485: #
8486: # Seimsic / Subbottom
8487: #
8488: ######################################################################
8489:
8490: # Knudsen subbottom chirp profiler - Binary File Format: B9
8491: # KEB D409-03167 V1.75 Huffman
8492: 0 string KEB\ Knudsen seismic KEL binary (KEB) -
8493: >4 regex [-A-Z0-9]* Software: %s
8494: >>&1 regex V[0-9]*\.[0-9]* version %s
8495:
8496: ######################################################################
8497: #
8498: # LIDAR - Laser altimetry or bathy
8499: #
8500: ######################################################################
8501:
8502:
8503: # Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
8504: 0 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar
8505: >4 regex [0-9]*\.[0-9]* version %s
8506:
8507: 0 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data
8508: >3 byte x version %d .
8509: >4 byte x %d
8510:
8511:
8512: ######################################################################
8513: #
8514: # MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
8515: #
8516: ######################################################################
8517:
8518: # GeoAcoustics - GeoSwath Plus
8519: 4 beshort 0x2002 GeoSwath RDF
8520: 0 string Start:- GeoSwatch auf text file
8521:
8522: # Seabeam 2100
8523: # mbsystem code mb41
8524: 0 string SB2100 SeaBeam 2100 multibeam sonar
8525: 0 string SB2100DR SeaBeam 2100 DR multibeam sonar
8526: 0 string SB2100PR SeaBeam 2100 PR multibeam sonar
8527:
8528: # This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
8529: # format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
8530: 0 string $HSF XSE multibeam
8531:
8532: # mb121 http://www.saic.com/maritime/gsf/
8533: 8 string GSF-v SAIC generic sensor format (GSF) sonar data,
8534: >&0 regex [0-9]*\.[0-9]* version %s
8535:
8536: # MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
8537: # mb161
8538: 9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format
8539:
8540: # MBSystem processing caches the mbinfo output
8541: 1 string Swath\ Data\ File: mbsystem info cache
8542:
8543: # Caris John Hughes Clark format
8544: 0 string HDCS Caris multibeam sonar related data
8545: 1 string Start/Stop\ parameter\ header: Caris ASCII project summary
8546:
8547: ######################################################################
8548: #
8549: # Visualization and 3D modeling
8550: #
8551: ######################################################################
8552:
8553: # IVS - IVS3d.com Tagged Data Represetation
8554: 0 string %%\ TDR\ 2.0 IVS Fledermaus TDR file
8555:
8556: # http://www.ecma-international.org/publications/standards/Ecma-363.htm
8557: # 3D in PDFs
8558: 0 string U3D ECMA-363, Universal 3D
8559:
8560: ######################################################################
8561: #
8562: # Support files
8563: #
8564: ######################################################################
8565:
8566: # https://midas.psi.ch/elog/
8567: 0 string $@MID@$ elog journal entry
8568:
8569: # Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
8570: 0 string DSBB Surfer 6 binary grid file
8571: >4 leshort x \b, %d
8572: >6 leshort x \bx%d
8573: >8 ledouble x \b, minx=%g
8574: >16 ledouble x \b, maxx=%g
8575: >24 ledouble x \b, miny=%g
8576: >32 ledouble x \b, maxy=%g
8577: >40 ledouble x \b, minz=%g
8578: >48 ledouble x \b, maxz=%g
8579:
8580:
8581: #------------------------------------------------------------------------------
1.1.1.2 misho 8582: # $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 8583: # GEOS files (Vidar Madsen, vidar@gimp.org)
8584: # semi-commonly used in embedded and handheld systems.
8585: 0 belong 0xc745c153 GEOS
8586: >40 byte 1 executable
8587: >40 byte 2 VMFile
8588: >40 byte 3 binary
8589: >40 byte 4 directory label
8590: >40 byte <1 unknown
8591: >40 byte >4 unknown
8592: >4 string >\0 \b, name "%s"
8593: #>44 short x \b, version %d
8594: #>46 short x \b.%d
8595: #>48 short x \b, rev %d
8596: #>50 short x \b.%d
8597: #>52 short x \b, proto %d
8598: #>54 short x \br%d
8599: #>168 string >\0 \b, copyright "%s"
1.1.1.2 misho 8600:
1.1 misho 8601: #------------------------------------------------------------------------------
1.1.1.3 misho 8602: # $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $
1.1 misho 8603: # GIMP Gradient: file(1) magic for the GIMP's gradient data files
8604: # by Federico Mena <federico@nuclecu.unam.mx>
8605:
8606: 0 string GIMP\ Gradient GIMP gradient data
8607:
8608: #------------------------------------------------------------------------------
8609: # XCF: file(1) magic for the XCF image format used in the GIMP developed
8610: # by Spencer Kimball and Peter Mattis
8611: # ('Bucky' LaDieu, nega@vt.edu)
8612:
8613: 0 string gimp\ xcf GIMP XCF image data,
1.1.1.2 misho 8614: !:mime image/x-xcf
1.1 misho 8615: >9 string file version 0,
8616: >9 string v version
8617: >>10 string >\0 %s,
8618: >14 belong x %lu x
8619: >18 belong x %lu,
8620: >22 belong 0 RGB Color
8621: >22 belong 1 Greyscale
8622: >22 belong 2 Indexed Color
8623: >22 belong >2 Unknown Image Type.
8624:
8625: #------------------------------------------------------------------------------
8626: # XCF: file(1) magic for the patterns used in the GIMP, developed
8627: # by Spencer Kimball and Peter Mattis
8628: # ('Bucky' LaDieu, nega@vt.edu)
8629:
8630: 20 string GPAT GIMP pattern data,
8631: >24 string x %s
8632:
8633: #------------------------------------------------------------------------------
8634: # XCF: file(1) magic for the brushes used in the GIMP, developed
8635: # by Spencer Kimball and Peter Mattis
8636: # ('Bucky' LaDieu, nega@vt.edu)
8637:
8638: 20 string GIMP GIMP brush data
8639:
8640: # GIMP Curves File
8641: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
8642: 0 string #\040GIMP\040Curves\040File GIMP curve file
1.1.1.2 misho 8643:
8644: #------------------------------------------------------------------------------
1.1.1.3 misho 8645: # $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $
8646: # GNOME related files
8647:
1.1 misho 8648: # Contributed by Josh Triplett
8649: # FIXME: Could be simplified if pstring supported two-byte counts
8650: 0 string GnomeKeyring\n\r\0\n GNOME keyring
8651: >&0 ubyte 0 \b, major version 0
8652: >>&0 ubyte 0 \b, minor version 0
1.1.1.3 misho 8653: >>>&0 ubyte 0 \b, crypto type 0 (AES)
1.1 misho 8654: >>>&0 ubyte >0 \b, crypto type %hhu (unknown)
8655: >>>&1 ubyte 0 \b, hash type 0 (MD5)
8656: >>>&1 ubyte >0 \b, hash type %hhu (unknown)
8657: >>>&2 ubelong 0xFFFFFFFF \b, name NULL
8658: >>>&2 ubelong !0xFFFFFFFF
8659: >>>>&-4 ubelong >255 \b, name too long for file's pstring type
8660: >>>>&-4 ubelong <256
8661: >>>>>&-1 pstring x \b, name "%s"
8662: >>>>>>&0 ubeqdate x \b, last modified %s
8663: >>>>>>&8 ubeqdate x \b, created %s
8664: >>>>>>&16 ubelong &1
8665: >>>>>>>&0 ubelong x \b, locked if idle for %u seconds
8666: >>>>>>&16 ubelong ^1 \b, not locked if idle
8667: >>>>>>&24 ubelong x \b, hash iterations %u
8668: >>>>>>&28 ubequad x \b, salt %llu
8669: >>>>>>&52 ubelong x \b, %u item(s)
1.1.1.2 misho 8670:
1.1.1.3 misho 8671: # From: Alex Beregszaszi <alex@fsn.hu>
8672: 4 string gtktalog GNOME Catalogue (gtktalog)
8673: >13 string >\0 version %s
8674:
8675: # Summary: GStreamer binary registry
8676: # Extension: .bin
8677: # Submitted by: Josh Triplett <josh@joshtriplett.org>
8678: 0 belong 0xc0def00d GStreamer binary registry
8679: >4 string x \b, version %s
8680:
8681: # GVariant Database file
8682: # By Elan Ruusamae <glen@delfi.ee>
8683: # https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
8684: # It's always "GVariant", it's byte swapped on incompatible archs
8685: # See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
8686: # file_builder_serialise()
8687: # http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
8688: 0 string GVariant GVariant Database file,
8689: # version is never filled. probably future extension
8690: >8 lelong x version %d
8691: # not sure are these usable, so commented out
8692: #>>16 lelong x start %d,
8693: #>>>20 lelong x end %d
8694:
8695: # G-IR database made by gobject-introspect toolset,
8696: # http://live.gnome.org/GObjectIntrospection
8697: 0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
8698: >16 byte x \b, v%d
8699: >17 byte x \b.%d
8700: >20 leshort x \b, %d entries
8701: >22 leshort x \b/%d local
8702:
1.1 misho 8703: #------------------------------------------------------------------------------
1.1.1.3 misho 8704: # $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $
1.1 misho 8705: # gnu: file(1) magic for various GNU tools
8706: #
8707: # GNU nlsutils message catalog file format
8708: #
1.1.1.3 misho 8709: # GNU message catalog (.mo and .gmo files)
8710:
1.1 misho 8711: 0 string \336\22\4\225 GNU message catalog (little endian),
1.1.1.3 misho 8712: >6 leshort x revision %d.
8713: >4 leshort >0 \b%d,
8714: >>8 lelong x %d messages,
8715: >>36 lelong x %d sysdep messages
8716: >4 leshort =0 \b%d,
8717: >>8 lelong x %d messages
8718:
1.1 misho 8719: 0 string \225\4\22\336 GNU message catalog (big endian),
1.1.1.3 misho 8720: >4 beshort x revision %d.
8721: >6 beshort >0 \b%d,
8722: >>8 belong x %d messages,
8723: >>36 belong x %d sysdep messages
8724: >6 beshort =0 \b%d,
8725: >>8 belong x %d messages
8726:
1.1 misho 8727:
8728: # GnuPG
8729: # The format is very similar to pgp
8730: 0 string \001gpg GPG key trust database
8731: >4 byte x version %d
8732: # Note: magic.mime had 0x8501 for the next line instead of 0x8502
8733: 0 beshort 0x8502 GPG encrypted data
8734: !:mime text/PGP # encoding: data
8735:
8736: # This magic is not particularly good, as the keyrings don't have true
8737: # magic. Nevertheless, it covers many keyrings.
8738: 0 beshort 0x9901 GPG key public ring
8739: !:mime application/x-gnupg-keyring
8740:
1.1.1.3 misho 8741: # Symmetric encryption
8742: 0 leshort 0x0d8c
8743: >4 leshort 0x0203
8744: >>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
8745: >>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
8746: >>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
8747: >>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
8748: >>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
8749: >>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
8750: >>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
8751: >>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
8752: >>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
8753: >>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
8754:
8755:
1.1 misho 8756: # Gnumeric spreadsheet
8757: # This entry is only semi-helpful, as Gnumeric compresses its files, so
8758: # they will ordinarily reported as "compressed", but at least -z helps
8759: 39 string =<gmr:Workbook Gnumeric spreadsheet
8760:
8761: # From: James Youngman <jay@gnu.org>
8762: # gnu find magic
8763: 0 string \0LOCATE GNU findutils locate database data
8764: >7 string >\0 \b, format %s
8765: >7 string 02 \b (frcode)
8766:
8767: # Files produced by GNU gettext
8768: 0 long 0xDE120495 GNU-format message catalog data
8769: 0 long 0x950412DE GNU-format message catalog data
8770:
1.1.1.3 misho 8771: # gettext message catalogue
8772: 0 regex \^msgid\ GNU gettext message catalogue text
8773: !:mime text/x-po
8774:
1.1 misho 8775: #------------------------------------------------------------------------------
1.1.1.2 misho 8776: # $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 8777: # gnumeric: file(1) magic for Gnumeric spreadsheet
8778: # This entry is only semi-helpful, as Gnumeric compresses its files, so
8779: # they will ordinarily reported as "compressed", but at least -z helps
8780: 39 string =<gmr:Workbook Gnumeric spreadsheet
8781: !:mime application/x-gnumeric
8782:
8783: #------------------------------------------------------------------------------
1.1.1.3 misho 8784: # $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $
8785: #
8786: # GPT Partition table patterns.
8787: # Author: Rogier Goossens (goossens.rogier@gmail.com)
8788: # Note that a GPT-formatted disk must contain an MBR as well.
8789: #
8790:
8791: # The initial segment (up to >>>>>>>>422) was copied from the X86
8792: # partition table code (aka MBR).
8793: # This is kept separate, so that MBR partitions are not reported as well.
8794: # (use -k if you do want them as well)
8795:
8796: # First, detect the MBR partiton table
8797: # If more than one GPT protective MBR partition exists, don't print anything
8798: # (the other MBR detection code will then just print the MBR partition table)
8799: 0x1FE leshort 0xAA55
8800: >3 string !MS
8801: >>3 string !SYSLINUX
8802: >>>3 string !MTOOL
8803: >>>>3 string !NEWLDR
8804: >>>>>5 string !DOS
8805: # not FAT (32 bit)
8806: >>>>>>82 string !FAT32
8807: #not Linux kernel
8808: >>>>>>>514 string !HdrS
8809: #not BeOS
8810: >>>>>>>>422 string !Be\ Boot\ Loader
8811: # GPT with protective MBR entry in partition 1 (only)
8812: >>>>>>>>>450 ubyte 0xee
8813: >>>>>>>>>>466 ubyte !0xee
8814: >>>>>>>>>>>482 ubyte !0xee
8815: >>>>>>>>>>>>498 ubyte !0xee
8816: #>>>>>>>>>>>>>446 use gpt-mbr-partition
8817: >>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
8818: >>>>>>>>>>>>>>0 use gpt-mbr-type
8819: >>>>>>>>>>>>>>&-8 use gpt-table
8820: >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
8821: >>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
8822: >>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
8823: >>>>>>>>>>>>>>>0 use gpt-mbr-type
8824: >>>>>>>>>>>>>>>&-8 use gpt-table
8825: >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
8826: >>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
8827: >>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
8828: >>>>>>>>>>>>>>>>0 use gpt-mbr-type
8829: >>>>>>>>>>>>>>>>&-8 use gpt-table
8830: >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
8831: >>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
8832: >>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
8833: >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8834: >>>>>>>>>>>>>>>>>&-8 use gpt-table
8835: >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
8836: >>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
8837: >>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
8838: >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8839: >>>>>>>>>>>>>>>>>>&-8 use gpt-table
8840: >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
8841: # GPT with protective MBR entry in partition 2 (only)
8842: >>>>>>>>>450 ubyte !0xee
8843: >>>>>>>>>>466 ubyte 0xee
8844: >>>>>>>>>>>482 ubyte !0xee
8845: >>>>>>>>>>>>498 ubyte !0xee
8846: #>>>>>>>>>>>>>462 use gpt-mbr-partition
8847: >>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
8848: >>>>>>>>>>>>>>0 use gpt-mbr-type
8849: >>>>>>>>>>>>>>&-8 use gpt-table
8850: >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
8851: >>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
8852: >>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
8853: >>>>>>>>>>>>>>>0 use gpt-mbr-type
8854: >>>>>>>>>>>>>>>&-8 use gpt-table
8855: >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
8856: >>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
8857: >>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
8858: >>>>>>>>>>>>>>>>0 use gpt-mbr-type
8859: >>>>>>>>>>>>>>>>&-8 use gpt-table
8860: >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
8861: >>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
8862: >>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
8863: >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8864: >>>>>>>>>>>>>>>>>&-8 use gpt-table
8865: >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
8866: >>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
8867: >>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
8868: >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8869: >>>>>>>>>>>>>>>>>>&-8 use gpt-table
8870: >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
8871: # GPT with protective MBR entry in partition 3 (only)
8872: >>>>>>>>>450 ubyte !0xee
8873: >>>>>>>>>>466 ubyte !0xee
8874: >>>>>>>>>>>482 ubyte 0xee
8875: >>>>>>>>>>>>498 ubyte !0xee
8876: #>>>>>>>>>>>>>478 use gpt-mbr-partition
8877: >>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
8878: >>>>>>>>>>>>>>0 use gpt-mbr-type
8879: >>>>>>>>>>>>>>&-8 use gpt-table
8880: >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
8881: >>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
8882: >>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
8883: >>>>>>>>>>>>>>>0 use gpt-mbr-type
8884: >>>>>>>>>>>>>>>&-8 use gpt-table
8885: >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
8886: >>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
8887: >>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
8888: >>>>>>>>>>>>>>>>0 use gpt-mbr-type
8889: >>>>>>>>>>>>>>>>&-8 use gpt-table
8890: >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
8891: >>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
8892: >>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
8893: >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8894: >>>>>>>>>>>>>>>>>&-8 use gpt-table
8895: >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
8896: >>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
8897: >>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
8898: >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8899: >>>>>>>>>>>>>>>>>>&-8 use gpt-table
8900: >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
8901: # GPT with protective MBR entry in partition 4 (only)
8902: >>>>>>>>>450 ubyte !0xee
8903: >>>>>>>>>>466 ubyte !0xee
8904: >>>>>>>>>>>482 ubyte !0xee
8905: >>>>>>>>>>>>498 ubyte 0xee
8906: #>>>>>>>>>>>>>494 use gpt-mbr-partition
8907: >>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
8908: >>>>>>>>>>>>>>0 use gpt-mbr-type
8909: >>>>>>>>>>>>>>&-8 use gpt-table
8910: >>>>>>>>>>>>>>0 ubyte x of 8192 bytes
8911: >>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
8912: >>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
8913: >>>>>>>>>>>>>>>0 use gpt-mbr-type
8914: >>>>>>>>>>>>>>>&-8 use gpt-table
8915: >>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
8916: >>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
8917: >>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
8918: >>>>>>>>>>>>>>>>0 use gpt-mbr-type
8919: >>>>>>>>>>>>>>>>&-8 use gpt-table
8920: >>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
8921: >>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
8922: >>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
8923: >>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8924: >>>>>>>>>>>>>>>>>&-8 use gpt-table
8925: >>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
8926: >>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
8927: >>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
8928: >>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
8929: >>>>>>>>>>>>>>>>>>&-8 use gpt-table
8930: >>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
8931:
8932: # The following code does GPT detection and processing, including
8933: # sector size detection.
8934: # It has to be duplicated above because the top-level pattern
8935: # (i.e. not called using 'use') must print *something* for file
8936: # to count it as a match. Text only printed in named patterns is
8937: # not counted, and causes file to continue, and try and match
8938: # other patterns.
8939: #
8940: # Unfortunately, when assuming sector sizes >=16k, if the sector size
8941: # happens to be 512 instead, we may find confusing data after the GPT
8942: # table... If the GPT table has less than 128 entries, this may even
8943: # happen for assumed sector sizes as small as 4k
8944: # This could be solved by checking for the presence of the backup GPT
8945: # header as well, but that makes the logic extremely complex
8946: ##0 name gpt-mbr-partition
8947: ##>(8.l*8192) string EFI\ PART
8948: ##>>(8.l*8192) use gpt-mbr-type
8949: ##>>&-8 use gpt-table
8950: ##>>0 ubyte x of 8192 bytes
8951: ##>(8.l*8192) string !EFI\ PART
8952: ##>>(8.l*4096) string EFI\ PART GPT partition table
8953: ##>>>0 use gpt-mbr-type
8954: ##>>>&-8 use gpt-table
8955: ##>>>0 ubyte x of 4096 bytes
8956: ##>>(8.l*4096) string !EFI\ PART
8957: ##>>>(8.l*2048) string EFI\ PART GPT partition table
8958: ##>>>>0 use gpt-mbr-type
8959: ##>>>>&-8 use gpt-table
8960: ##>>>>0 ubyte x of 2048 bytes
8961: ##>>>(8.l*2048) string !EFI\ PART
8962: ##>>>>(8.l*1024) string EFI\ PART GPT partition table
8963: ##>>>>>0 use gpt-mbr-type
8964: ##>>>>>&-8 use gpt-table
8965: ##>>>>>0 ubyte x of 1024 bytes
8966: ##>>>>(8.l*1024) string !EFI\ PART
8967: ##>>>>>(8.l*512) string EFI\ PART GPT partition table
8968: ##>>>>>>0 use gpt-mbr-type
8969: ##>>>>>>&-8 use gpt-table
8970: ##>>>>>>0 ubyte x of 512 bytes
8971:
8972: # Print details of MBR type for a GPT-disk
8973: # Calling code ensures that there is only one 0xee partition.
8974: 0 name gpt-mbr-type
8975: # GPT with protective MBR entry in partition 1
8976: >450 ubyte 0xee
8977: >>454 ulelong 1
8978: >>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8979: >>454 ulelong !1 \b (nonstandard: not at LBA 1)
8980: # GPT with protective MBR entry in partition 2
8981: >466 ubyte 0xee
8982: >>470 ulelong 1
8983: >>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8984: >>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8985: >>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8986: >>470 ulelong !1 \b (nonstandard: not at LBA 1)
8987: # GPT with protective MBR entry in partition 3
8988: >482 ubyte 0xee
8989: >>486 ulelong 1
8990: >>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
8991: >>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8992: >>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8993: >>486 ulelong !1 \b (nonstandard: not at LBA 1)
8994: # GPT with protective MBR entry in partition 4
8995: >498 ubyte 0xee
8996: >>502 ulelong 1
8997: >>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
8998: >>502 ulelong !1 \b (nonstandard: not at LBA 1)
8999:
9000: # Print the information from a GPT partition table structure
9001: 0 name gpt-table
9002: >10 uleshort x \b, version %u
9003: >8 uleshort x \b.%u
9004: # a GUID is just like a UUID, except it's displayed mixed-endian.
9005: >56 ulelong x \b, GUID: %08x
9006: >60 uleshort x \b-%04x
9007: >62 uleshort x \b-%04x
9008: >64 ubeshort x \b-%04x
9009: >66 ubeshort x \b-%04x
9010: >68 ubelong x \b%08x
9011: #>80 uleshort x \b, %d partition entries
9012: >32 ulequad+1 x \b, disk size: %lld sectors
9013:
9014: # In case a GPT data-structure is at LBA 0, report it as well
9015: # This covers systems which are not GPT-aware, and which show
9016: # and allow access to the protective partition. This code will
9017: # detect the contents of such a partition.
9018: 0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
9019: >0 use gpt-table
9020: >0 ubyte x (sector size unknown)
9021:
9022:
9023:
9024: #------------------------------------------------------------------------------
1.1.1.2 misho 9025: # $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
1.1 misho 9026: # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
9027: #
9028: # ACE/gr binary
9029: 0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
9030: >39 byte >0 - version %c
9031: # ACE/gr ascii
9032: 0 string #\ xvgr\ parameter\ file ACE/gr ascii file
9033: 0 string #\ xmgr\ parameter\ file ACE/gr ascii file
9034: 0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
9035: # Grace projects
9036: 0 string #\ Grace\ project\ file Grace project file
9037: >23 string @version\ (version
9038: >>32 byte >0 %c
9039: >>33 string >\0 \b.%.2s
9040: >>35 string >\0 \b.%.2s)
9041: # ACE/gr fit description files
9042: 0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
9043: # end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
9044:
9045: #------------------------------------------------------------------------------
1.1.1.2 misho 9046: # $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
1.1 misho 9047: # graphviz: file(1) magic for http://www.graphviz.org/
1.1.1.2 misho 9048:
9049: # FIXME: These patterns match too generally. For example, the first
9050: # line matches a LaTeX file containing the word "graph" (with a {
9051: # following later) and the second line matches this file.
9052: #0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
9053: #!:mime text/vnd.graphviz
9054: #0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
9055: #!:mime text/vnd.graphviz
1.1 misho 9056:
9057: #------------------------------------------------------------------------------
1.1.1.2 misho 9058: # $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 9059: # gringotts: file(1) magic for Gringotts
9060: # http://devel.pluto.linux.it/projects/Gringotts/
9061: # author: Germano Rizzo <mano@pluto.linux.it>
9062: #GRG3????Y
9063: 0 string GRG Gringotts data file
9064: #file format 1
9065: >3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
9066: #file format 2
9067: >3 string 2 v.2, MCRYPT S2K,
9068: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
9069: >>8 byte&0x70 0x10 SERPENT crypt,
9070: >>8 byte&0x70 0x20 TWOFISH crypt,
9071: >>8 byte&0x70 0x30 CAST-256 crypt,
9072: >>8 byte&0x70 0x40 SAFER+ crypt,
9073: >>8 byte&0x70 0x50 LOKI97 crypt,
9074: >>8 byte&0x70 0x60 3DES crypt,
9075: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
9076: >>8 byte&0x08 0x00 SHA1 hash,
9077: >>8 byte&0x08 0x08 RIPEMD-160 hash,
9078: >>8 byte&0x04 0x00 ZLib
9079: >>8 byte&0x04 0x04 BZip2
9080: >>8 byte&0x03 0x00 lvl.0
9081: >>8 byte&0x03 0x01 lvl.3
9082: >>8 byte&0x03 0x02 lvl.6
9083: >>8 byte&0x03 0x03 lvl.9
9084: #file format 3
9085: >3 string 3 v.3, OpenPGP S2K,
9086: >>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
9087: >>8 byte&0x70 0x10 SERPENT crypt,
9088: >>8 byte&0x70 0x20 TWOFISH crypt,
9089: >>8 byte&0x70 0x30 CAST-256 crypt,
9090: >>8 byte&0x70 0x40 SAFER+ crypt,
9091: >>8 byte&0x70 0x50 LOKI97 crypt,
9092: >>8 byte&0x70 0x60 3DES crypt,
9093: >>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
9094: >>8 byte&0x08 0x00 SHA1 hash,
9095: >>8 byte&0x08 0x08 RIPEMD-160 hash,
9096: >>8 byte&0x04 0x00 ZLib
9097: >>8 byte&0x04 0x04 BZip2
9098: >>8 byte&0x03 0x00 lvl.0
9099: >>8 byte&0x03 0x01 lvl.3
9100: >>8 byte&0x03 0x02 lvl.6
9101: >>8 byte&0x03 0x03 lvl.9
9102: #file format >3
9103: >3 string >3 v.%.1s (unknown details)
9104:
9105: #------------------------------------------------------------------------------
1.1.1.3 misho 9106: # $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
9107: # Guile file magic from <dalepsmith@gmail.com>
9108: # http://www.gnu.org/s/guile/
9109: # http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
9110:
9111: 0 string GOOF---- Guile Object
9112: >8 string LE \b, little endian
9113: >8 string BE \b, big endian
9114: >11 string 4 \b, 32bit
9115: >11 string 8 \b, 64bit
9116: >13 regex .\.. \b, bytecode v%s
9117:
9118: #------------------------------------------------------------------------------
9119: # $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
1.1 misho 9120: # hitach-sh: file(1) magic for Hitachi Super-H
9121: #
9122: # Super-H COFF
9123: #
1.1.1.3 misho 9124: # below test line conflicts with 2nd NTFS filesystem sector
1.1 misho 9125: 0 beshort 0x0500 Hitachi SH big-endian COFF
1.1.1.3 misho 9126: # 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
9127: #0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF
1.1 misho 9128: >18 beshort&0x0002 =0x0000 object
9129: >18 beshort&0x0002 =0x0002 executable
9130: >18 beshort&0x0008 =0x0008 \b, stripped
9131: >18 beshort&0x0008 =0x0000 \b, not stripped
9132: #
9133: 0 leshort 0x0550 Hitachi SH little-endian COFF
9134: >18 leshort&0x0002 =0x0000 object
9135: >18 leshort&0x0002 =0x0002 executable
9136: >18 leshort&0x0008 =0x0008 \b, stripped
9137: >18 leshort&0x0008 =0x0000 \b, not stripped
9138:
1.1.1.2 misho 9139:
1.1 misho 9140: #------------------------------------------------------------------------------
1.1.1.2 misho 9141: # $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
1.1 misho 9142: # hp: file(1) magic for Hewlett Packard machines (see also "printer")
9143: #
9144: # XXX - somebody should figure out whether any byte order needs to be
9145: # applied to the "TML" stuff; I'm assuming the Apollo stuff is
9146: # big-endian as it was mostly 68K-based.
9147: #
9148: # I think the 500 series was the old stack-based machines, running a
9149: # UNIX environment atop the "SUN kernel"; dunno whether it was
9150: # big-endian or little-endian.
9151: #
9152: # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
9153: # hp300 are 68020+68881 based; hp400 are also 68k. The following basic
9154: # HP magic is useful for reference, but using "long" magic is a better
9155: # practice in order to avoid collisions.
9156: #
9157: # Guy Harris (guy@netapp.com): some additions to this list came from
9158: # HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
9159: # 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
9160: # "/etc/magic", though, except for the "archive file relocatable library"
9161: # stuff, and the 68030 and 68040 stuff isn't there at all - are they not
9162: # used in executables, or have they just not yet updated "/etc/magic"
9163: # completely?
9164: #
9165: # 0 beshort 200 hp200 (68010) BSD binary
9166: # 0 beshort 300 hp300 (68020+68881) BSD binary
9167: # 0 beshort 0x20c hp200/300 HP-UX binary
9168: # 0 beshort 0x20d hp400 (68030) HP-UX binary
9169: # 0 beshort 0x20e hp400 (68040?) HP-UX binary
9170: # 0 beshort 0x20b PA-RISC1.0 HP-UX binary
9171: # 0 beshort 0x210 PA-RISC1.1 HP-UX binary
9172: # 0 beshort 0x211 PA-RISC1.2 HP-UX binary
9173: # 0 beshort 0x214 PA-RISC2.0 HP-UX binary
9174:
9175: #
9176: # The "misc" stuff needs a byte order; the archives look suspiciously
9177: # like the old 177545 archives (0xff65 = 0177545).
9178: #
9179: #### Old Apollo stuff
9180: 0 beshort 0627 Apollo m68k COFF executable
9181: >18 beshort ^040000 not stripped
9182: >22 beshort >0 - version %ld
9183: 0 beshort 0624 apollo a88k COFF executable
9184: >18 beshort ^040000 not stripped
9185: >22 beshort >0 - version %ld
9186: 0 long 01203604016 TML 0123 byte-order format
9187: 0 long 01702407010 TML 1032 byte-order format
9188: 0 long 01003405017 TML 2301 byte-order format
9189: 0 long 01602007412 TML 3210 byte-order format
9190: #### PA-RISC 1.1
9191: 0 belong 0x02100106 PA-RISC1.1 relocatable object
9192: 0 belong 0x02100107 PA-RISC1.1 executable
9193: >168 belong &0x00000004 dynamically linked
9194: >(144) belong 0x054ef630 dynamically linked
9195: >96 belong >0 - not stripped
9196:
9197: 0 belong 0x02100108 PA-RISC1.1 shared executable
9198: >168 belong&0x4 0x4 dynamically linked
9199: >(144) belong 0x054ef630 dynamically linked
9200: >96 belong >0 - not stripped
9201:
9202: 0 belong 0x0210010b PA-RISC1.1 demand-load executable
9203: >168 belong&0x4 0x4 dynamically linked
9204: >(144) belong 0x054ef630 dynamically linked
9205: >96 belong >0 - not stripped
9206:
9207: 0 belong 0x0210010e PA-RISC1.1 shared library
9208: >96 belong >0 - not stripped
9209:
9210: 0 belong 0x0210010d PA-RISC1.1 dynamic load library
9211: >96 belong >0 - not stripped
9212:
9213: #### PA-RISC 2.0
9214: 0 belong 0x02140106 PA-RISC2.0 relocatable object
9215:
9216: 0 belong 0x02140107 PA-RISC2.0 executable
9217: >168 belong &0x00000004 dynamically linked
9218: >(144) belong 0x054ef630 dynamically linked
9219: >96 belong >0 - not stripped
9220:
9221: 0 belong 0x02140108 PA-RISC2.0 shared executable
9222: >168 belong &0x00000004 dynamically linked
9223: >(144) belong 0x054ef630 dynamically linked
9224: >96 belong >0 - not stripped
9225:
9226: 0 belong 0x0214010b PA-RISC2.0 demand-load executable
9227: >168 belong &0x00000004 dynamically linked
9228: >(144) belong 0x054ef630 dynamically linked
9229: >96 belong >0 - not stripped
9230:
9231: 0 belong 0x0214010e PA-RISC2.0 shared library
9232: >96 belong >0 - not stripped
9233:
9234: 0 belong 0x0214010d PA-RISC2.0 dynamic load library
9235: >96 belong >0 - not stripped
9236:
9237: #### 800
9238: 0 belong 0x020b0106 PA-RISC1.0 relocatable object
9239:
9240: 0 belong 0x020b0107 PA-RISC1.0 executable
9241: >168 belong&0x4 0x4 dynamically linked
9242: >(144) belong 0x054ef630 dynamically linked
9243: >96 belong >0 - not stripped
9244:
9245: 0 belong 0x020b0108 PA-RISC1.0 shared executable
9246: >168 belong&0x4 0x4 dynamically linked
9247: >(144) belong 0x054ef630 dynamically linked
9248: >96 belong >0 - not stripped
9249:
9250: 0 belong 0x020b010b PA-RISC1.0 demand-load executable
9251: >168 belong&0x4 0x4 dynamically linked
9252: >(144) belong 0x054ef630 dynamically linked
9253: >96 belong >0 - not stripped
9254:
9255: 0 belong 0x020b010e PA-RISC1.0 shared library
9256: >96 belong >0 - not stripped
9257:
9258: 0 belong 0x020b010d PA-RISC1.0 dynamic load library
9259: >96 belong >0 - not stripped
9260:
9261: 0 belong 0x213c6172 archive file
9262: >68 belong 0x020b0619 - PA-RISC1.0 relocatable library
9263: >68 belong 0x02100619 - PA-RISC1.1 relocatable library
9264: >68 belong 0x02110619 - PA-RISC1.2 relocatable library
9265: >68 belong 0x02140619 - PA-RISC2.0 relocatable library
9266:
9267: #### 500
9268: 0 long 0x02080106 HP s500 relocatable executable
9269: >16 long >0 - version %ld
9270:
9271: 0 long 0x02080107 HP s500 executable
9272: >16 long >0 - version %ld
9273:
9274: 0 long 0x02080108 HP s500 pure executable
9275: >16 long >0 - version %ld
9276:
9277: #### 200
9278: 0 belong 0x020c0108 HP s200 pure executable
9279: >4 beshort >0 - version %ld
9280: >8 belong &0x80000000 save fp regs
9281: >8 belong &0x40000000 dynamically linked
9282: >8 belong &0x20000000 debuggable
9283: >36 belong >0 not stripped
9284:
9285: 0 belong 0x020c0107 HP s200 executable
9286: >4 beshort >0 - version %ld
9287: >8 belong &0x80000000 save fp regs
9288: >8 belong &0x40000000 dynamically linked
9289: >8 belong &0x20000000 debuggable
9290: >36 belong >0 not stripped
9291:
9292: 0 belong 0x020c010b HP s200 demand-load executable
9293: >4 beshort >0 - version %ld
9294: >8 belong &0x80000000 save fp regs
9295: >8 belong &0x40000000 dynamically linked
9296: >8 belong &0x20000000 debuggable
9297: >36 belong >0 not stripped
9298:
9299: 0 belong 0x020c0106 HP s200 relocatable executable
9300: >4 beshort >0 - version %ld
9301: >6 beshort >0 - highwater %d
9302: >8 belong &0x80000000 save fp regs
9303: >8 belong &0x20000000 debuggable
9304: >8 belong &0x10000000 PIC
9305:
9306: 0 belong 0x020a0108 HP s200 (2.x release) pure executable
9307: >4 beshort >0 - version %ld
9308: >36 belong >0 not stripped
9309:
9310: 0 belong 0x020a0107 HP s200 (2.x release) executable
9311: >4 beshort >0 - version %ld
9312: >36 belong >0 not stripped
9313:
9314: 0 belong 0x020c010e HP s200 shared library
9315: >4 beshort >0 - version %ld
9316: >6 beshort >0 - highwater %d
9317: >36 belong >0 not stripped
9318:
9319: 0 belong 0x020c010d HP s200 dynamic load library
9320: >4 beshort >0 - version %ld
9321: >6 beshort >0 - highwater %d
9322: >36 belong >0 not stripped
9323:
9324: #### MISC
9325: 0 long 0x0000ff65 HP old archive
9326: 0 long 0x020aff65 HP s200 old archive
9327: 0 long 0x020cff65 HP s200 old archive
9328: 0 long 0x0208ff65 HP s500 old archive
9329:
9330: 0 long 0x015821a6 HP core file
9331:
9332: 0 long 0x4da7eee8 HP-WINDOWS font
9333: >8 byte >0 - version %ld
9334: 0 string Bitmapfile HP Bitmapfile
9335:
9336: 0 string IMGfile CIS compimg HP Bitmapfile
9337: # XXX - see "lif"
9338: #0 short 0x8000 lif file
9339: 0 long 0x020c010c compiled Lisp
9340:
9341: 0 string msgcat01 HP NLS message catalog,
9342: >8 long >0 %d messages
9343:
9344: # Summary: HP-48/49 calculator
9345: # Created by: phk@data.fls.dk
9346: # Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
9347: # Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
9348: 0 string HPHP HP
9349: >4 string 48 48 binary
9350: >4 string 49 49 binary
9351: >7 byte >64 - Rev %c
9352: >8 leshort 0x2911 (ADR)
9353: >8 leshort 0x2933 (REAL)
9354: >8 leshort 0x2955 (LREAL)
9355: >8 leshort 0x2977 (COMPLX)
9356: >8 leshort 0x299d (LCOMPLX)
9357: >8 leshort 0x29bf (CHAR)
9358: >8 leshort 0x29e8 (ARRAY)
9359: >8 leshort 0x2a0a (LNKARRAY)
9360: >8 leshort 0x2a2c (STRING)
9361: >8 leshort 0x2a4e (HXS)
9362: >8 leshort 0x2a74 (LIST)
9363: >8 leshort 0x2a96 (DIR)
9364: >8 leshort 0x2ab8 (ALG)
9365: >8 leshort 0x2ada (UNIT)
9366: >8 leshort 0x2afc (TAGGED)
9367: >8 leshort 0x2b1e (GROB)
9368: >8 leshort 0x2b40 (LIB)
9369: >8 leshort 0x2b62 (BACKUP)
9370: >8 leshort 0x2b88 (LIBDATA)
9371: >8 leshort 0x2d9d (PROG)
9372: >8 leshort 0x2dcc (CODE)
9373: >8 leshort 0x2e48 (GNAME)
9374: >8 leshort 0x2e6d (LNAME)
9375: >8 leshort 0x2e92 (XLIB)
9376:
9377: 0 string %%HP: HP text
9378: >6 string T(0) - T(0)
9379: >6 string T(1) - T(1)
9380: >6 string T(2) - T(2)
9381: >6 string T(3) - T(3)
9382: >10 string A(D) A(D)
9383: >10 string A(R) A(R)
9384: >10 string A(G) A(G)
9385: >14 string F(.) F(.);
9386: >14 string F(,) F(,);
9387:
9388:
9389: # Summary: HP-38/39 calculator
9390: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
9391: 0 string HP3
9392: >3 string 8 HP 38
9393: >3 string 9 HP 39
9394: >4 string Bin binary
9395: >4 string Asc ASCII
9396: >7 string A (Directory List)
9397: >7 string B (Zaplet)
9398: >7 string C (Note)
9399: >7 string D (Program)
9400: >7 string E (Variable)
9401: >7 string F (List)
9402: >7 string G (Matrix)
9403: >7 string H (Library)
9404: >7 string I (Target List)
9405: >7 string J (ASCII Vector specification)
9406: >7 string K (wildcard)
9407:
9408: # Summary: HP-38/39 calculator
9409: # Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
9410: 0 string HP3
9411: >3 string 8 HP 38
9412: >3 string 9 HP 39
9413: >4 string Bin binary
9414: >4 string Asc ASCII
9415: >7 string A (Directory List)
9416: >7 string B (Zaplet)
9417: >7 string C (Note)
9418: >7 string D (Program)
9419: >7 string E (Variable)
9420: >7 string F (List)
9421: >7 string G (Matrix)
9422: >7 string H (Library)
9423: >7 string I (Target List)
9424: >7 string J (ASCII Vector specification)
9425: >7 string K (wildcard)
9426:
9427: # hpBSD magic numbers
9428: 0 beshort 200 hp200 (68010) BSD
9429: >2 beshort 0407 impure binary
9430: >2 beshort 0410 read-only binary
9431: >2 beshort 0413 demand paged binary
9432: 0 beshort 300 hp300 (68020+68881) BSD
9433: >2 beshort 0407 impure binary
9434: >2 beshort 0410 read-only binary
9435: >2 beshort 0413 demand paged binary
9436: #
9437: # From David Gero <dgero@nortelnetworks.com>
9438: # HP-UX 10.20 core file format from /usr/include/sys/core.h
9439: # Unfortunately, HP-UX uses corehead blocks without specifying the order
9440: # There are four we care about:
9441: # CORE_KERNEL, which starts with the string "HP-UX"
9442: # CORE_EXEC, which contains the name of the command
9443: # CORE_PROC, which contains the signal number that caused the core dump
9444: # CORE_FORMAT, which contains the version of the core file format (== 1)
9445: # The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
9446: # but we include all 6 variations of the order of the first 3, and
9447: # assume that PROC will always be last
9448: # Order 1: KERNEL, EXEC, FORMAT, PROC
9449: 0x10 string HP-UX
9450: >0 belong 2
9451: >>0xC belong 0x3C
9452: >>>0x4C belong 0x100
9453: >>>>0x58 belong 0x44
9454: >>>>>0xA0 belong 1
9455: >>>>>>0xAC belong 4
9456: >>>>>>>0xB0 belong 1
9457: >>>>>>>>0xB4 belong 4 core file
9458: >>>>>>>>>0x90 string >\0 from '%s'
9459: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9460: >>>>>>>>>0xC4 belong 4 - received SIGILL
9461: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9462: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9463: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9464: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9465: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9466: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9467: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9468: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9469: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9470: # Order 2: KERNEL, FORMAT, EXEC, PROC
9471: >>>0x4C belong 1
9472: >>>>0x58 belong 4
9473: >>>>>0x5C belong 1
9474: >>>>>>0x60 belong 0x100
9475: >>>>>>>0x6C belong 0x44
9476: >>>>>>>>0xB4 belong 4 core file
9477: >>>>>>>>>0xA4 string >\0 from '%s'
9478: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9479: >>>>>>>>>0xC4 belong 4 - received SIGILL
9480: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9481: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9482: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9483: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9484: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9485: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9486: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9487: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9488: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9489: # Order 3: FORMAT, KERNEL, EXEC, PROC
9490: 0x24 string HP-UX
9491: >0 belong 1
9492: >>0xC belong 4
9493: >>>0x10 belong 1
9494: >>>>0x14 belong 2
9495: >>>>>0x20 belong 0x3C
9496: >>>>>>0x60 belong 0x100
9497: >>>>>>>0x6C belong 0x44
9498: >>>>>>>>0xB4 belong 4 core file
9499: >>>>>>>>>0xA4 string >\0 from '%s'
9500: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9501: >>>>>>>>>0xC4 belong 4 - received SIGILL
9502: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9503: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9504: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9505: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9506: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9507: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9508: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9509: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9510: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9511: # Order 4: EXEC, KERNEL, FORMAT, PROC
9512: 0x64 string HP-UX
9513: >0 belong 0x100
9514: >>0xC belong 0x44
9515: >>>0x54 belong 2
9516: >>>>0x60 belong 0x3C
9517: >>>>>0xA0 belong 1
9518: >>>>>>0xAC belong 4
9519: >>>>>>>0xB0 belong 1
9520: >>>>>>>>0xB4 belong 4 core file
9521: >>>>>>>>>0x44 string >\0 from '%s'
9522: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9523: >>>>>>>>>0xC4 belong 4 - received SIGILL
9524: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9525: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9526: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9527: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9528: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9529: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9530: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9531: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9532: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9533: # Order 5: FORMAT, EXEC, KERNEL, PROC
9534: 0x78 string HP-UX
9535: >0 belong 1
9536: >>0xC belong 4
9537: >>>0x10 belong 1
9538: >>>>0x14 belong 0x100
9539: >>>>>0x20 belong 0x44
9540: >>>>>>0x68 belong 2
9541: >>>>>>>0x74 belong 0x3C
9542: >>>>>>>>0xB4 belong 4 core file
9543: >>>>>>>>>0x58 string >\0 from '%s'
9544: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9545: >>>>>>>>>0xC4 belong 4 - received SIGILL
9546: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9547: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9548: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9549: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9550: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9551: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9552: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9553: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9554: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9555: # Order 6: EXEC, FORMAT, KERNEL, PROC
9556: >0 belong 0x100
9557: >>0xC belong 0x44
9558: >>>0x54 belong 1
9559: >>>>0x60 belong 4
9560: >>>>>0x64 belong 1
9561: >>>>>>0x68 belong 2
9562: >>>>>>>0x74 belong 0x2C
9563: >>>>>>>>0xB4 belong 4 core file
9564: >>>>>>>>>0x44 string >\0 from '%s'
9565: >>>>>>>>>0xC4 belong 3 - received SIGQUIT
9566: >>>>>>>>>0xC4 belong 4 - received SIGILL
9567: >>>>>>>>>0xC4 belong 5 - received SIGTRAP
9568: >>>>>>>>>0xC4 belong 6 - received SIGABRT
9569: >>>>>>>>>0xC4 belong 7 - received SIGEMT
9570: >>>>>>>>>0xC4 belong 8 - received SIGFPE
9571: >>>>>>>>>0xC4 belong 10 - received SIGBUS
9572: >>>>>>>>>0xC4 belong 11 - received SIGSEGV
9573: >>>>>>>>>0xC4 belong 12 - received SIGSYS
9574: >>>>>>>>>0xC4 belong 33 - received SIGXCPU
9575: >>>>>>>>>0xC4 belong 34 - received SIGXFSZ
9576:
9577:
9578:
9579: #------------------------------------------------------------------------------
1.1.1.2 misho 9580: # $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 9581: # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
9582: # Magic too short!
9583: #0 string HU Human68k
9584: #>68 string LZX LZX compressed
9585: #>>72 string >\0 (version %s)
9586: #>(8.L+74) string LZX LZX compressed
9587: #>>(8.L+78) string >\0 (version %s)
9588: #>60 belong >0 binded
9589: #>(8.L+66) string #HUPAIR hupair
9590: #>0 string HU X executable
9591: #>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
9592: #>4 belong >0 - base address 0x%x
9593: #>28 belong >0 not stripped
9594: #>32 belong >0 with debug information
9595: #0 beshort 0x601a Human68k Z executable
9596: #0 beshort 0x6000 Human68k object file
9597: #0 belong 0xd1000000 Human68k ar binary archive
9598: #0 belong 0xd1010000 Human68k ar ascii archive
9599: #0 beshort 0x0068 Human68k lib archive
9600: #4 string LZX Human68k LZX compressed
9601: #>8 string >\0 (version %s)
9602: #>4 string LZX R executable
9603: #2 string #HUPAIR Human68k hupair R executable
9604:
9605: #------------------------------------------------------------------------------
1.1.1.2 misho 9606: # $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
1.1 misho 9607: # ibm370: file(1) magic for IBM 370 and compatibles.
9608: #
9609: # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
9610: # What the heck *is* "USS/370"?
9611: # AIX 4.1's "/etc/magic" has
9612: #
9613: # 0 short 0535 370 sysV executable
9614: # >12 long >0 not stripped
9615: # >22 short >0 - version %d
9616: # >30 long >0 - 5.2 format
9617: # 0 short 0530 370 sysV pure executable
9618: # >12 long >0 not stripped
9619: # >22 short >0 - version %d
9620: # >30 long >0 - 5.2 format
9621: #
9622: # instead of the "USS/370" versions of the same magic numbers.
9623: #
9624: 0 beshort 0537 370 XA sysV executable
9625: >12 belong >0 not stripped
9626: >22 beshort >0 - version %d
9627: >30 belong >0 - 5.2 format
9628: 0 beshort 0532 370 XA sysV pure executable
9629: >12 belong >0 not stripped
9630: >22 beshort >0 - version %d
9631: >30 belong >0 - 5.2 format
9632: 0 beshort 054001 370 sysV pure executable
9633: >12 belong >0 not stripped
9634: 0 beshort 055001 370 XA sysV pure executable
9635: >12 belong >0 not stripped
9636: 0 beshort 056401 370 sysV executable
9637: >12 belong >0 not stripped
9638: 0 beshort 057401 370 XA sysV executable
9639: >12 belong >0 not stripped
9640: 0 beshort 0531 SVR2 executable (Amdahl-UTS)
9641: >12 belong >0 not stripped
9642: >24 belong >0 - version %ld
9643: 0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
9644: >12 belong >0 not stripped
9645: >24 belong >0 - version %ld
9646: 0 beshort 0530 SVR2 pure executable (USS/370)
9647: >12 belong >0 not stripped
9648: >24 belong >0 - version %ld
9649: 0 beshort 0535 SVR2 executable (USS/370)
9650: >12 belong >0 not stripped
9651: >24 belong >0 - version %ld
9652:
9653: #------------------------------------------------------------------------------
1.1.1.3 misho 9654: # $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
1.1 misho 9655: # ibm6000: file(1) magic for RS/6000 and the RT PC.
9656: #
9657: 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
9658: >12 belong >0 not stripped
9659: # Breaks sun4 statically linked execs.
9660: #0 beshort 0x0103 executable (RT Version 2) or obj module
9661: #>2 byte 0x50 pure
9662: #>28 belong >0 not stripped
9663: #>6 beshort >0 - version %ld
9664: 0 beshort 0x0104 shared library
9665: 0 beshort 0x0105 ctab data
9666: 0 beshort 0xfe04 structured file
9667: 0 string 0xabcdef AIX message catalog
9668: 0 belong 0x000001f9 AIX compiled message catalog
9669: 0 string \<aiaff> archive
9670: 0 string \<bigaf> archive (big format)
9671:
1.1.1.3 misho 9672: 0 beshort 0x01f7 64-bit XCOFF executable or object module
9673: >20 belong 0 not stripped
9674: 4 belong &0x0feeddb0 AIX core file
9675: >1 byte &0x01 fulldump
9676: >7 byte &0x01 32-bit
9677: >>0x6e0 string >\0 \b, %s
9678: >7 byte &0x02 64-bit
9679: >>0x524 string >\0 \b, %s
1.1 misho 9680:
9681: #------------------------------------------------------------------------------
1.1.1.3 misho 9682: # $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
9683: # icc: file(1) magic for International Color Consortium file formats
9684:
9685: #
9686: # Color profiles as per the ICC's "Image technology colour management -
9687: # Architecture, profile format, and data structure" specification.
9688: # See
9689: #
9690: # http://www.color.org/specification/ICC1v43_2010-12.pdf
9691: #
9692: # for Specification ICC.1:2010 (Profile version 4.3.0.0).
9693: #
9694: # Bytes 36 to 39 contain a generic profile file signature of "acsp";
9695: # bytes 40 to 43 "may be used to identify the primary platform/operating
9696: # system framework for which the profile was created".
9697: #
9698: # There are other fields that might be worth dumping as well.
9699: #
9700:
9701: # This appears to be what's used for Apple ColorSync profiles.
9702: # Instead of adding that, Apple just changed the generic "acsp" entry
9703: # to be for "ColorSync ICC Color Profile" rather than "Kodak Color
9704: # Management System, ICC Profile".
9705: # Yes, it's "APPL", not "AAPL"; see the spec.
9706: 36 string acspAPPL ColorSync ICC Profile
9707: !:mime application/vnd.iccprofile
9708:
9709: # Microsoft ICM color profile
9710: 36 string acspMSFT Microsoft ICM Color Profile
9711: !:mime application/vnd.iccprofile
9712:
9713: # Yes, that's a blank after "SGI".
9714: 36 string acspSGI\ SGI ICC Profile
9715: !:mime application/vnd.iccprofile
9716:
9717: # XXX - is this what's used for the Sun KCMS or not? The standard file
9718: # uses just "acsp" for that, but Apple's file uses it for "ColorSync",
9719: # and there *is* an identified "primary platform" value of SUNW.
9720: 36 string acspSUNW Sun KCMS ICC Profile
9721: !:mime application/vnd.iccprofile
9722:
9723: # Any other profile.
9724: # XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
9725: # and use "acsp" for everything else and dump the "primary platform"
9726: # string in those cases?
9727: 36 string acsp ICC Profile
9728: !:mime application/vnd.iccprofile
9729:
9730:
9731:
9732: #------------------------------------------------------------------------------
9733: # $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
1.1 misho 9734: # iff: file(1) magic for Interchange File Format (see also "audio" & "images")
9735: #
9736: # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
9737: # Arts for file interchange. It has also been used by Apple, SGI, and
9738: # especially Commodore-Amiga.
9739: #
9740: # IFF files begin with an 8 byte FORM header, followed by a 4 character
9741: # FORM type, which is followed by the first chunk in the FORM.
9742:
9743: 0 string FORM IFF data
9744: #>4 belong x \b, FORM is %d bytes long
9745: # audio formats
9746: >8 string AIFF \b, AIFF audio
9747: !:mime audio/x-aiff
9748: >8 string AIFC \b, AIFF-C compressed audio
9749: !:mime audio/x-aiff
9750: >8 string 8SVX \b, 8SVX 8-bit sampled sound voice
9751: !:mime audio/x-aiff
9752: >8 string 16SV \b, 16SV 16-bit sampled sound voice
9753: >8 string SAMP \b, SAMP sampled audio
9754: >8 string MAUD \b, MAUD MacroSystem audio
9755: >8 string SMUS \b, SMUS simple music
9756: >8 string CMUS \b, CMUS complex music
9757: # image formats
9758: >8 string ILBMBMHD \b, ILBM interleaved image
9759: >>20 beshort x \b, %d x
9760: >>22 beshort x %d
9761: >8 string RGBN \b, RGBN 12-bit RGB image
9762: >8 string RGB8 \b, RGB8 24-bit RGB image
9763: >8 string DEEP \b, DEEP TVPaint/XiPaint image
9764: >8 string DR2D \b, DR2D 2-D object
9765: >8 string TDDD \b, TDDD 3-D rendering
9766: >8 string LWOB \b, LWOB 3-D object
9767: >8 string LWO2 \b, LWO2 3-D object, v2
9768: >8 string LWLO \b, LWLO 3-D layered object
9769: >8 string REAL \b, REAL Real3D rendering
9770: >8 string MC4D \b, MC4D MaxonCinema4D rendering
9771: >8 string ANIM \b, ANIM animation
9772: >8 string YAFA \b, YAFA animation
9773: >8 string SSA\ \b, SSA super smooth animation
9774: >8 string ACBM \b, ACBM continuous image
9775: >8 string FAXX \b, FAXX fax image
9776: # other formats
9777: >8 string FTXT \b, FTXT formatted text
9778: >8 string CTLG \b, CTLG message catalog
9779: >8 string PREF \b, PREF preferences
9780: >8 string DTYP \b, DTYP datatype description
9781: >8 string PTCH \b, PTCH binary patch
9782: >8 string AMFF \b, AMFF AmigaMetaFile format
9783: >8 string WZRD \b, WZRD StormWIZARD resource
9784: >8 string DOC\ \b, DOC desktop publishing document
1.1.1.3 misho 9785: >8 string WVQA \b, Westwood Studios VQA Multimedia,
9786: >>24 leshort x %d video frames,
9787: >>26 leshort x %d x
9788: >>28 leshort x %d
9789: >8 string MOVE \b, Wing Commander III Video
9790: >>12 string _PC_ \b, PC version
9791: >>12 string 3DO_ \b, 3DO version
1.1 misho 9792:
9793: # These go at the end of the iff rules
9794: #
9795: # I don't see why these might collide with anything else.
9796: #
9797: # Interactive Fiction related formats
9798: #
9799: >8 string IFRS \b, Blorb Interactive Fiction
9800: >>24 string Exec with executable chunk
9801: >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
1.1.1.2 misho 9802:
1.1 misho 9803: #------------------------------------------------------------------------------
1.1.1.3 misho 9804: # $File: images,v 1.81 2013/03/09 22:36:00 christos Exp $
1.1 misho 9805: # images: file(1) magic for image formats (see also "iff", and "c-lang" for
9806: # XPM bitmaps)
9807: #
9808: # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
9809: # additions by janl@ifi.uio.no as well as others. Jan also suggested
9810: # merging several one- and two-line files into here.
9811: #
9812: # little magic: PCX (first byte is 0x0a)
9813:
9814: # Targa - matches `povray', `ppmtotga' and `xv' outputs
9815: # by Philippe De Muyter <phdm@macqel.be>
9816: # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
9817: # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
9818: # at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
9819: # `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
9820: # `tgatoppm' recognizes a superset (Index may be anything)
9821: 1 belong&0xfff7ffff 0x01010000 Targa image data - Map
9822: >2 byte&8 8 - RLE
9823: >12 leshort >0 %hd x
9824: >14 leshort >0 %hd
9825: 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
9826: >2 byte&8 8 - RLE
9827: >12 leshort >0 %hd x
9828: >14 leshort >0 %hd
9829: 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
9830: >2 byte&8 8 - RLE
9831: >12 leshort >0 %hd x
9832: >14 leshort >0 %hd
9833:
9834: # PBMPLUS images
9835: # The next byte following the magic is always whitespace.
1.1.1.3 misho 9836: # strength is changed to try these patterns before "x86 boot sector"
9837: 0 search/1 P1
9838: >3 regex =[0-9]*\ [0-9]* Netpbm PBM image text
9839: >3 regex =[0-9]+\ \b, size = %sx
9840: >>3 regex =\ [0-9]+ \b%s
9841: !:strength + 45
1.1 misho 9842: !:mime image/x-portable-bitmap
1.1.1.3 misho 9843: 0 search/1 P2
9844: >3 regex =[0-9]*\ [0-9]* Netpbm PGM image text
9845: >3 regex =[0-9]+\ \b, size = %sx
9846: >>3 regex =\ [0-9]+ \b%s
9847: !:strength + 45
1.1 misho 9848: !:mime image/x-portable-greymap
9849: 0 search/1 P3 Netpbm PPM image text
1.1.1.3 misho 9850: >3 regex =[0-9]*\ [0-9]* Netpbm PPM image text
9851: >3 regex =[0-9]+\ \b, size = %sx
9852: >>3 regex =\ [0-9]+ \b%s
9853: !:strength + 45
1.1 misho 9854: !:mime image/x-portable-pixmap
1.1.1.3 misho 9855: 0 string P4
9856: >3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data
9857: >3 regex =[0-9]+\ \b, size = %sx
9858: >>3 regex =\ [0-9]+ \b%s
9859: !:strength + 45
1.1 misho 9860: !:mime image/x-portable-bitmap
1.1.1.3 misho 9861: 0 string P5
9862: >3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data
9863: >3 regex =[0-9]+\ \b, size = %sx
9864: >>3 regex =\ [0-9]+ \b%s
9865: !:strength + 45
1.1 misho 9866: !:mime image/x-portable-greymap
1.1.1.3 misho 9867: 0 string P6
9868: >3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data
9869: >3 regex =[0-9]+\ \b, size = %sx
9870: >>3 regex =\ [0-9]+ \b%s
9871: !:strength + 45
1.1 misho 9872: !:mime image/x-portable-pixmap
9873: 0 string P7 Netpbm PAM image file
9874: !:mime image/x-portable-pixmap
9875:
9876: # From: bryanh@giraffe-data.com (Bryan Henderson)
9877: 0 string \117\072 Solitaire Image Recorder format
9878: >4 string \013 MGI Type 11
9879: >4 string \021 MGI Type 17
9880: 0 string .MDA MicroDesign data
9881: >21 byte 48 version 2
9882: >21 byte 51 version 3
9883: 0 string .MDP MicroDesign page data
9884: >21 byte 48 version 2
9885: >21 byte 51 version 3
9886:
9887: # NIFF (Navy Interchange File Format, a modification of TIFF) images
9888: # [GRR: this *must* go before TIFF]
9889: 0 string IIN1 NIFF image data
9890: !:mime image/x-niff
9891:
1.1.1.2 misho 9892: # Canon RAW version 1 (CRW) files are a type of Canon Image File Format
9893: # (CIFF) file. These are apparently all little-endian.
9894: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
9895: # URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
9896: 0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data
9897: !:mime image/x-canon-crw
9898: >16 leshort x \b, version %d.
9899: >14 leshort x \b%d
9900:
9901: # Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
9902: # number. Put this above the TIFF test to make sure we detect them.
9903: # These are apparently all little-endian.
9904: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
9905: # URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
9906: 0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data
9907: !:mime image/x-canon-cr2
9908: >10 byte x \b, version %d.
9909: >11 byte x \b%d
9910:
1.1 misho 9911: # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
9912: # The second word of TIFF files is the TIFF version number, 42, which has
9913: # never changed. The TIFF specification recommends testing for it.
9914: 0 string MM\x00\x2a TIFF image data, big-endian
9915: !:mime image/tiff
9916: 0 string II\x2a\x00 TIFF image data, little-endian
9917: !:mime image/tiff
9918:
1.1.1.3 misho 9919: 0 string MM\x00\x2b Big TIFF image data, big-endian
9920: !:mime image/tiff
9921: 0 string II\x2b\x00 Big TIFF image data, little-endian
9922: !:mime image/tiff
9923:
1.1 misho 9924: # PNG [Portable Network Graphics, or "PNG's Not GIF"] images
9925: # (Greg Roelofs, newt@uchicago.edu)
9926: # (Albert Cahalan, acahalan@cs.uml.edu)
9927: #
9928: # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
9929: #
1.1.1.2 misho 9930: 0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
1.1 misho 9931: !:mime image/png
9932: >16 belong x \b, %ld x
9933: >20 belong x %ld,
9934: >24 byte x %d-bit
9935: >25 byte 0 grayscale,
9936: >25 byte 2 \b/color RGB,
9937: >25 byte 3 colormap,
9938: >25 byte 4 gray+alpha,
9939: >25 byte 6 \b/color RGBA,
9940: #>26 byte 0 deflate/32K,
9941: >28 byte 0 non-interlaced
9942: >28 byte 1 interlaced
9943:
9944: # possible GIF replacements; none yet released!
9945: # (Greg Roelofs, newt@uchicago.edu)
9946: #
9947: # GRR 950115: this was mine ("Zip GIF"):
9948: 0 string GIF94z ZIF image (GIF+deflate alpha)
9949: !:mime image/x-unknown
9950: #
9951: # GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
9952: #
9953: 0 string FGF95a FGF image (GIF+deflate beta)
9954: !:mime image/x-unknown
9955: #
9956: # GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
9957: # (best; not yet implemented):
9958: #
9959: 0 string PBF PBF image (deflate compression)
9960: !:mime image/x-unknown
9961:
9962: # GIF
9963: 0 string GIF8 GIF image data
9964: !:mime image/gif
1.1.1.2 misho 9965: !:apple 8BIMGIFf
1.1 misho 9966: >4 string 7a \b, version 8%s,
9967: >4 string 9a \b, version 8%s,
9968: >6 leshort >0 %hd x
9969: >8 leshort >0 %hd
9970: #>10 byte &0x80 color mapped,
9971: #>10 byte&0x07 =0x00 2 colors
9972: #>10 byte&0x07 =0x01 4 colors
9973: #>10 byte&0x07 =0x02 8 colors
9974: #>10 byte&0x07 =0x03 16 colors
9975: #>10 byte&0x07 =0x04 32 colors
9976: #>10 byte&0x07 =0x05 64 colors
9977: #>10 byte&0x07 =0x06 128 colors
9978: #>10 byte&0x07 =0x07 256 colors
9979:
9980: # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
9981: # 1 plane, no encoding.
9982: 0 string \361\0\100\273 CMU window manager raster image data
9983: >4 lelong >0 %d x
9984: >8 lelong >0 %d,
9985: >12 lelong >0 %d-bit
9986:
9987: # Magick Image File Format
9988: 0 string id=ImageMagick MIFF image data
9989:
9990: # Artisan
9991: 0 long 1123028772 Artisan image data
9992: >4 long 1 \b, rectangular 24-bit
9993: >4 long 2 \b, rectangular 8-bit with colormap
9994: >4 long 3 \b, rectangular 32-bit (24-bit with matte)
9995:
9996: # FIG (Facility for Interactive Generation of figures), an object-based format
9997: 0 search/1 #FIG FIG image text
9998: >5 string x \b, version %.3s
9999:
10000: # PHIGS
10001: 0 string ARF_BEGARF PHIGS clear text archive
10002: 0 string @(#)SunPHIGS SunPHIGS
10003: # version number follows, in the form m.n
10004: >40 string SunBin binary
10005: >32 string archive archive
10006:
10007: # GKS (Graphics Kernel System)
10008: 0 string GKSM GKS Metafile
10009: >24 string SunGKS \b, SunGKS
10010:
10011: # CGM image files
10012: 0 string BEGMF clear text Computer Graphics Metafile
10013:
10014: # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
10015: 0 string yz MGR bitmap, modern format, 8-bit aligned
10016: 0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
10017: 0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
10018: 0 string yx MGR bitmap, modern format, squeezed
10019:
10020: # Fuzzy Bitmap (FBM) images
10021: 0 string %bitmap\0 FBM image data
10022: >30 long 0x31 \b, mono
10023: >30 long 0x33 \b, color
10024:
10025: # facsimile data
10026: 1 string PC\ Research,\ Inc group 3 fax data
10027: >29 byte 0 \b, normal resolution (204x98 DPI)
10028: >29 byte 1 \b, fine resolution (204x196 DPI)
10029: # From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
10030: 0 string Sfff structured fax file
10031:
1.1.1.3 misho 10032: # From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
10033: # most files with the extension .EPA and some with .BMP
10034: 0 string \x11\x06 Award BIOS Logo, 136 x 84
10035: !:mime image/x-award-bioslogo
10036: 0 string \x11\x09 Award BIOS Logo, 136 x 126
10037: !:mime image/x-award-bioslogo
10038: #0 string \x07\x1f BIOS Logo corrupted?
10039: # http://www.blackfiveservices.co.uk/awbmtools.shtml
10040: # http://biosgfx.narod.ru/v3/
10041: # http://biosgfx.narod.ru/abr-2/
10042: 0 string AWBM
10043: >4 leshort <1981 Award BIOS bitmap
10044: !:mime image/x-award-bmp
10045: # image width is a multiple of 4
10046: >>4 leshort&0x0003 0
10047: >>>4 leshort x \b, %d
10048: >>>6 leshort x x %d
10049: >>4 leshort&0x0003 >0 \b,
10050: >>>4 leshort&0x0003 =1
10051: >>>>4 leshort x %d+3
10052: >>>4 leshort&0x0003 =2
10053: >>>>4 leshort x %d+2
10054: >>>4 leshort&0x0003 =3
10055: >>>>4 leshort x %d+1
10056: >>>6 leshort x x %d
10057: # at offset 8 starts imagedata followed by "RGB " marker
1.1 misho 10058:
10059: # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
10060: 0 string BM
10061: >14 leshort 12 PC bitmap, OS/2 1.x format
10062: !:mime image/x-ms-bmp
10063: >>18 leshort x \b, %d x
10064: >>20 leshort x %d
10065: >14 leshort 64 PC bitmap, OS/2 2.x format
10066: !:mime image/x-ms-bmp
10067: >>18 leshort x \b, %d x
10068: >>20 leshort x %d
10069: >14 leshort 40 PC bitmap, Windows 3.x format
10070: !:mime image/x-ms-bmp
10071: >>18 lelong x \b, %d x
10072: >>22 lelong x %d x
10073: >>28 leshort x %d
10074: >14 leshort 128 PC bitmap, Windows NT/2000 format
10075: !:mime image/x-ms-bmp
10076: >>18 lelong x \b, %d x
10077: >>22 lelong x %d x
10078: >>28 leshort x %d
10079: # Too simple - MPi
10080: #0 string IC PC icon data
10081: #0 string PI PC pointer image data
10082: #0 string CI PC color icon data
10083: #0 string CP PC color pointer image data
10084: # Conflicts with other entries [BABYL]
10085: #0 string BA PC bitmap array data
10086:
10087: # XPM icons (Greg Roelofs, newt@uchicago.edu)
10088: 0 search/1 /*\ XPM\ */ X pixmap image text
1.1.1.3 misho 10089: !:mime image/x-xpmi
1.1 misho 10090:
10091: # Utah Raster Toolkit RLE images (janl@ifi.uio.no)
10092: 0 leshort 0xcc52 RLE image data,
10093: >6 leshort x %d x
10094: >8 leshort x %d
10095: >2 leshort >0 \b, lower left corner: %d
10096: >4 leshort >0 \b, lower right corner: %d
10097: >10 byte&0x1 =0x1 \b, clear first
10098: >10 byte&0x2 =0x2 \b, no background
10099: >10 byte&0x4 =0x4 \b, alpha channel
10100: >10 byte&0x8 =0x8 \b, comment
10101: >11 byte >0 \b, %d color channels
10102: >12 byte >0 \b, %d bits per pixel
10103: >13 byte >0 \b, %d color map channels
10104:
10105: # image file format (Robert Potter, potter@cs.rochester.edu)
10106: 0 string Imagefile\ version- iff image data
10107: # this adds the whole header (inc. version number), informative but longish
10108: >10 string >\0 %s
10109:
10110: # Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
10111: 0 belong 0x59a66a95 Sun raster image data
10112: >4 belong >0 \b, %d x
10113: >8 belong >0 %d,
10114: >12 belong >0 %d-bit,
10115: #>16 belong >0 %d bytes long,
10116: >20 belong 0 old format,
10117: #>20 belong 1 standard,
10118: >20 belong 2 compressed,
10119: >20 belong 3 RGB,
10120: >20 belong 4 TIFF,
10121: >20 belong 5 IFF,
10122: >20 belong 0xffff reserved for testing,
10123: >24 belong 0 no colormap
10124: >24 belong 1 RGB colormap
10125: >24 belong 2 raw colormap
10126: #>28 belong >0 colormap is %d bytes long
10127:
10128: # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
10129: #
10130: # See
10131: # http://reality.sgi.com/grafica/sgiimage.html
10132: #
10133: 0 beshort 474 SGI image data
10134: #>2 byte 0 \b, verbatim
10135: >2 byte 1 \b, RLE
10136: #>3 byte 1 \b, normal precision
10137: >3 byte 2 \b, high precision
10138: >4 beshort x \b, %d-D
10139: >6 beshort x \b, %d x
10140: >8 beshort x %d
10141: >10 beshort x \b, %d channel
10142: >10 beshort !1 \bs
10143: >80 string >0 \b, "%s"
10144:
10145: 0 string IT01 FIT image data
10146: >4 belong x \b, %d x
10147: >8 belong x %d x
10148: >12 belong x %d
10149: #
10150: 0 string IT02 FIT image data
10151: >4 belong x \b, %d x
10152: >8 belong x %d x
10153: >12 belong x %d
10154: #
10155: 2048 string PCD_IPI Kodak Photo CD image pack file
10156: >0xe02 byte&0x03 0x00 , landscape mode
10157: >0xe02 byte&0x03 0x01 , portrait mode
10158: >0xe02 byte&0x03 0x02 , landscape mode
10159: >0xe02 byte&0x03 0x03 , portrait mode
10160: 0 string PCD_OPA Kodak Photo CD overview pack file
10161:
10162: # FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
10163: # FITS is the Flexible Image Transport System, the de facto standard for
10164: # data and image transfer, storage, etc., for the astronomical community.
10165: # (FITS floating point formats are big-endian.)
10166: 0 string SIMPLE\ \ = FITS image data
10167: >109 string 8 \b, 8-bit, character or unsigned binary integer
10168: >108 string 16 \b, 16-bit, two's complement binary integer
10169: >107 string \ 32 \b, 32-bit, two's complement binary integer
10170: >107 string -32 \b, 32-bit, floating point, single precision
10171: >107 string -64 \b, 64-bit, floating point, double precision
10172:
10173: # other images
10174: 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
10175:
10176: # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
10177: # stuff.
10178: #
10179: 0 beshort 0x1010 PEX Binary Archive
10180:
10181: # DICOM medical imaging data
10182: 128 string DICM DICOM medical imaging data
10183: !:mime application/dicom
10184:
10185: # XWD - X Window Dump file.
10186: # As described in /usr/X11R6/include/X11/XWDFile.h
10187: # used by the xwd program.
10188: # Bradford Castalia, idaeim, 1/01
1.1.1.2 misho 10189: # updated by Adam Buchbinder, 2/09
10190: # The following assumes version 7 of the format; the first long is the length
10191: # of the header, which is at least 25 4-byte longs, and the one at offset 8
10192: # is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
10193: # which is a maximum of 32.
10194: 0 belong >100
10195: >8 belong <3
10196: >>12 belong <33
10197: >>>4 belong 7 XWD X Window Dump image data
10198: !:mime image/x-xwindowdump
10199: >>>>100 string >\0 \b, "%s"
10200: >>>>16 belong x \b, %dx
10201: >>>>20 belong x \b%dx
10202: >>>>12 belong x \b%d
1.1 misho 10203:
10204: # PDS - Planetary Data System
10205: # These files use Parameter Value Language in the header section.
10206: # Unfortunately, there is no certain magic, but the following
10207: # strings have been found to be most likely.
10208: 0 string NJPL1I00 PDS (JPL) image data
10209: 2 string NJPL1I PDS (JPL) image data
10210: 0 string CCSD3ZF PDS (CCSD) image data
10211: 2 string CCSD3Z PDS (CCSD) image data
10212: 0 string PDS_ PDS image data
10213: 0 string LBLSIZE= PDS (VICAR) image data
10214:
10215: # pM8x: ATARI STAD compressed bitmap format
10216: #
10217: # from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
10218: # p M 8 5/6 xx yy zz data...
10219: # Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
10220: # bytes either run horizontally (pM85) or vertically (pM86). yy is the
10221: # most frequent byte, xx and zz are runlength escape codes, where xx is
10222: # used for runs of yy.
10223: #
10224: 0 string pM85 Atari ST STAD bitmap image data (hor)
10225: >5 byte 0x00 (white background)
10226: >5 byte 0xFF (black background)
10227: 0 string pM86 Atari ST STAD bitmap image data (vert)
10228: >5 byte 0x00 (white background)
10229: >5 byte 0xFF (black background)
10230:
1.1.1.3 misho 10231: # Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
1.1 misho 10232: # http://www.atarimax.com/jindroush.atari.org/afmtatr.html
10233: 0 leshort 0x0296 Atari ATR image
10234:
10235: # XXX:
10236: # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
10237: # magic.
10238: # SGI RICE image file <mpruett@sgi.com>
10239: #0 beshort 0x5249 RICE image
10240: #>2 beshort x v%d
10241: #>4 beshort x (%d x
10242: #>6 beshort x %d)
10243: #>8 beshort 0 8 bit
10244: #>8 beshort 1 10 bit
10245: #>8 beshort 2 12 bit
10246: #>8 beshort 3 13 bit
10247: #>10 beshort 0 4:2:2
10248: #>10 beshort 1 4:2:2:4
10249: #>10 beshort 2 4:4:4
10250: #>10 beshort 3 4:4:4:4
10251: #>12 beshort 1 RGB
10252: #>12 beshort 2 CCIR601
10253: #>12 beshort 3 RP175
10254: #>12 beshort 4 YUV
10255:
10256: # PCX image files
10257: # From: Dan Fandrich <dan@coneharvesters.com>
1.1.1.3 misho 10258: # updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
10259: # http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
10260: # GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
10261: # test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
10262: 0 ubelong&0xffF8fe00 0x0a000000
10263: # for PCX bit depth > 0
10264: >3 ubyte >0
10265: # test for valid versions
10266: >>1 ubyte <6
10267: >>>1 ubyte !1 PCX
10268: !:mime image/x-pcx
10269: #!:mime image/pcx
10270: >>>>1 ubyte 0 ver. 2.5 image data
10271: >>>>1 ubyte 2 ver. 2.8 image data, with palette
10272: >>>>1 ubyte 3 ver. 2.8 image data, without palette
10273: >>>>1 ubyte 4 for Windows image data
10274: >>>>1 ubyte 5 ver. 3.0 image data
10275: >>>>4 uleshort x bounding box [%hd,
10276: >>>>6 uleshort x %d] -
10277: >>>>8 uleshort x [%d,
10278: >>>>10 uleshort x %d],
10279: >>>>65 ubyte >1 %d planes each of
10280: >>>>3 ubyte x %d-bit
10281: >>>>68 byte 1 colour,
10282: >>>>68 byte 2 grayscale,
10283: # this should not happen
10284: >>>>68 default x image,
10285: >>>>12 leshort >0 %d x
10286: >>>>>14 uleshort x %d dpi,
10287: >>>>2 byte 0 uncompressed
10288: >>>>2 byte 1 RLE compressed
1.1 misho 10289:
10290: # Adobe Photoshop
1.1.1.2 misho 10291: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
1.1 misho 10292: 0 string 8BPS Adobe Photoshop Image
10293: !:mime image/vnd.adobe.photoshop
1.1.1.2 misho 10294: >4 beshort 2 (PSB)
10295: >18 belong x \b, %d x
10296: >14 belong x %d,
10297: >24 beshort 0 bitmap
10298: >24 beshort 1 grayscale
10299: >>12 beshort 2 with alpha
10300: >24 beshort 2 indexed
10301: >24 beshort 3 RGB
10302: >>12 beshort 4 \bA
10303: >24 beshort 4 CMYK
10304: >>12 beshort 5 \bA
10305: >24 beshort 7 multichannel
10306: >24 beshort 8 duotone
10307: >24 beshort 9 lab
10308: >12 beshort > 1
10309: >>12 beshort x \b, %dx
10310: >12 beshort 1 \b,
10311: >22 beshort x %d-bit channel
10312: >12 beshort > 1 \bs
1.1 misho 10313:
10314: # XV thumbnail indicator (ThMO)
10315: 0 string P7\ 332 XV thumbnail image data
10316:
10317: # NITF is defined by United States MIL-STD-2500A
10318: 0 string NITF National Imagery Transmission Format
10319: >25 string >\0 dated %.14s
10320:
10321: # GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
10322: 0 belong 0x00010008 GEM Image data
10323: >12 beshort x %d x
10324: >14 beshort x %d,
10325: >4 beshort x %d planes,
10326: >8 beshort x %d x
10327: >10 beshort x %d pixelsize
10328:
10329: # GEM Metafile (Wolfram Kleff)
10330: 0 lelong 0x0018FFFF GEM Metafile data
10331: >4 leshort x version %d
10332:
10333: #
10334: # SMJPEG. A custom Motion JPEG format used by Loki Entertainment
10335: # Software Torbjorn Andersson <d91tan@Update.UU.SE>.
10336: #
10337: 0 string \0\nSMJPEG SMJPEG
10338: >8 belong x %d.x data
10339: # According to the specification you could find any number of _TXT
10340: # headers here, but I can't think of any way of handling that. None of
10341: # the SMJPEG files I tried it on used this feature. Even if such a
10342: # file is encountered the output should still be reasonable.
10343: >16 string _SND \b,
10344: >>24 beshort >0 %d Hz
10345: >>26 byte 8 8-bit
10346: >>26 byte 16 16-bit
10347: >>28 string NONE uncompressed
10348: # >>28 string APCM ADPCM compressed
10349: >>27 byte 1 mono
10350: >>28 byte 2 stereo
10351: # Help! Isn't there any way to avoid writing this part twice?
10352: >>32 string _VID \b,
10353: # >>>48 string JFIF JPEG
10354: >>>40 belong >0 %d frames
10355: >>>44 beshort >0 (%d x
10356: >>>46 beshort >0 %d)
10357: >16 string _VID \b,
10358: # >>32 string JFIF JPEG
10359: >>24 belong >0 %d frames
10360: >>28 beshort >0 (%d x
10361: >>30 beshort >0 %d)
10362:
10363: 0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
10364:
10365: # "thumbnail file" (icon)
10366: # descended from "xv", but in use by other applications as well (Wolfram Kleff)
10367: 0 string P7\ 332 XV "thumbnail file" (icon) data
10368:
10369: # taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
10370: 0 string KiSS KISS/GS
10371: >4 byte 16 color
10372: >>5 byte x %d bit
10373: >>8 leshort x %d colors
10374: >>10 leshort x %d groups
10375: >4 byte 32 cell
10376: >>5 byte x %d bit
10377: >>8 leshort x %d x
10378: >>10 leshort x %d
10379: >>12 leshort x +%d
10380: >>14 leshort x +%d
10381:
10382: # Webshots (www.webshots.com), by John Harrison
10383: 0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
10384:
10385: # Hercules DASD image files
10386: # From Jan Jaeger <jj@septa.nl>
10387: 0 string CKD_P370 Hercules CKD DASD image file
10388: >8 long x \b, %d heads per cylinder
10389: >12 long x \b, track size %d bytes
10390: >16 byte x \b, device type 33%2.2X
10391:
10392: 0 string CKD_C370 Hercules compressed CKD DASD image file
10393: >8 long x \b, %d heads per cylinder
10394: >12 long x \b, track size %d bytes
10395: >16 byte x \b, device type 33%2.2X
10396:
10397: 0 string CKD_S370 Hercules CKD DASD shadow file
10398: >8 long x \b, %d heads per cylinder
10399: >12 long x \b, track size %d bytes
10400: >16 byte x \b, device type 33%2.2X
10401:
10402: # Squeak images and programs - etoffi@softhome.net
10403: 0 string \146\031\0\0 Squeak image data
10404: 0 search/1 'From\040Squeak Squeak program text
10405:
10406: # partimage: file(1) magic for PartImage files (experimental, incomplete)
10407: # Author: Hans-Joachim Baader <hjb@pro-linux.de>
10408: 0 string PaRtImAgE-VoLuMe PartImage
10409: >0x0020 string 0.6.1 file version %s
10410: >>0x0060 lelong >-1 volume %ld
10411: #>>0x0064 8 byte identifier
10412: #>>0x007c reserved
10413: >>0x0200 string >\0 type %s
10414: >>0x1400 string >\0 device %s,
10415: >>0x1600 string >\0 original filename %s,
10416: # Some fields omitted
10417: >>0x2744 lelong 0 not compressed
10418: >>0x2744 lelong 1 gzip compressed
10419: >>0x2744 lelong 2 bzip2 compressed
10420: >>0x2744 lelong >2 compressed with unknown algorithm
10421: >0x0020 string >0.6.1 file version %s
10422: >0x0020 string <0.6.1 file version %s
10423:
10424: # DCX is multi-page PCX, using a simple header of up to 1024
10425: # offsets for the respective PCX components.
10426: # From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
10427: 0 lelong 987654321 DCX multi-page PCX image data
10428:
10429: # Simon Walton <simonw@matteworld.com>
10430: # Kodak Cineon format for scanned negatives
10431: # http://www.kodak.com/US/en/motion/support/dlad/
10432: 0 lelong 0xd75f2a80 Cineon image data
10433: >200 belong >0 \b, %ld x
10434: >204 belong >0 %ld
10435:
10436:
10437: # Bio-Rad .PIC is an image format used by microscope control systems
10438: # and related image processing software used by biologists.
10439: # From: Vebjorn Ljosa <vebjorn@ljosa.com>
1.1.1.2 misho 10440: # BOOL values are two-byte integers; use them to rule out false positives.
10441: # http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
10442: # Samples: http://www.loci.wisc.edu/software/sample-data
10443: 14 leshort <2
10444: >62 leshort <2
10445: >>54 leshort 12345 Bio-Rad .PIC Image File
10446: >>>0 leshort >0 %hd x
10447: >>>2 leshort >0 %hd,
10448: >>>4 leshort =1 1 image in file
10449: >>>4 leshort >1 %hd images in file
1.1 misho 10450:
10451: # From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
10452: # The description of *.mrw format can be found at
10453: # http://www.dalibor.cz/minolta/raw_file_format.htm
10454: 0 string \000MRM Minolta Dimage camera raw image data
10455:
10456: # Summary: DjVu image / document
10457: # Extension: .djvu
10458: # Reference: http://djvu.org/docs/DjVu3Spec.djvu
10459: # Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
10460: # Modified by (1): Abel Cheung <abelcheung@gmail.com>
10461: 0 string AT&TFORM
10462: >12 string DJVM DjVu multiple page document
1.1.1.2 misho 10463: !:mime image/vnd.djvu
1.1 misho 10464: >12 string DJVU DjVu image or single page document
1.1.1.2 misho 10465: !:mime image/vnd.djvu
1.1 misho 10466: >12 string DJVI DjVu shared document
1.1.1.2 misho 10467: !:mime image/vnd.djvu
1.1 misho 10468: >12 string THUM DjVu page thumbnails
1.1.1.2 misho 10469: !:mime image/vnd.djvu
1.1 misho 10470:
1.1.1.3 misho 10471: # Originally by Marc Espie
10472: # Modified by Robert Minsk <robertminsk at yahoo.com>
10473: # http://www.openexr.com/openexrfilelayout.pdf
10474: 0 lelong 20000630 OpenEXR image data,
10475: !:mime image/x-exr
10476: >4 lelong&0x000000ff x version %d,
10477: >4 lelong ^0x00000200 storage: scanline
10478: >4 lelong &0x00000200 storage: tiled
10479: >8 search/0x1000 compression\0 \b, compression:
10480: >>&16 byte 0 none
10481: >>&16 byte 1 rle
10482: >>&16 byte 2 zips
10483: >>&16 byte 3 zip
10484: >>&16 byte 4 piz
10485: >>&16 byte 5 pxr24
10486: >>&16 byte 6 b44
10487: >>&16 byte 7 b44a
10488: >>&16 byte >7 unknown
10489: >8 search/0x1000 dataWindow\0 \b, dataWindow:
10490: >>&10 lelong x (%d
10491: >>&14 lelong x %d)-
10492: >>&18 lelong x \b(%d
10493: >>&22 lelong x %d)
10494: >8 search/0x1000 displayWindow\0 \b, displayWindow:
10495: >>&10 lelong x (%d
10496: >>&14 lelong x %d)-
10497: >>&18 lelong x \b(%d
10498: >>&22 lelong x %d)
10499: >8 search/0x1000 lineOrder\0 \b, lineOrder:
10500: >>&14 byte 0 increasing y
10501: >>&14 byte 1 decreasing y
10502: >>&14 byte 2 random y
10503: >>&14 byte >2 unknown
10504:
10505: # SMPTE Digital Picture Exchange Format, SMPTE DPX
10506: #
10507: # ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
10508: # Moving-Picture Exchange (DPX), v1.0, 18 February 1994
10509: # Robert Minsk <robertminsk at yahoo.com>
10510: 0 string SDPX DPX image data, big-endian,
10511: !:mime image/x-dpx
10512: >768 beshort <4
10513: >>772 belong x %dx
10514: >>776 belong x \b%d,
10515: >768 beshort >3
10516: >>776 belong x %dx
10517: >>772 belong x \b%d,
10518: >768 beshort 0 left to right/top to bottom
10519: >768 beshort 1 right to left/top to bottom
10520: >768 beshort 2 left to right/bottom to top
10521: >768 beshort 3 right to left/bottom to top
10522: >768 beshort 4 top to bottom/left to right
10523: >768 beshort 5 top to bottom/right to left
10524: >768 leshort 6 bottom to top/left to right
10525: >768 leshort 7 bottom to top/right to left
1.1 misho 10526:
10527: # From: Tom Hilinski <tom.hilinski@comcast.net>
10528: # http://www.unidata.ucar.edu/packages/netcdf/
10529: 0 string CDF\001 NetCDF Data Format data
10530:
10531: #-----------------------------------------------------------------------
10532: # Hierarchical Data Format, used to facilitate scientific data exchange
10533: # specifications at http://hdf.ncsa.uiuc.edu/
10534: 0 belong 0x0e031301 Hierarchical Data Format (version 4) data
10535: !:mime application/x-hdf
1.1.1.3 misho 10536: 0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data
1.1 misho 10537: !:mime application/x-hdf
10538:
10539: # From: Tobias Burnus <burnus@net-b.de>
10540: # Xara (for a while: Corel Xara) is a graphic package, see
10541: # http://www.xara.com/ for Windows and as GPL application for Linux
10542: 0 string XARA\243\243 Xara graphics file
10543:
10544: # http://www.cartesianinc.com/Tech/
10545: 0 string CPC\262 Cartesian Perceptual Compression image
10546: !:mime image/x-cpi
10547:
10548: # From Albert Cahalan <acahalan@gmail.com>
10549: # puredigital used it for the CVS disposable camcorder
10550: #8 lelong 4 ZBM bitmap image data
10551: #>4 leshort x %u x
10552: #>6 leshort x %u
10553:
10554: # From Albert Cahalan <acahalan@gmail.com>
10555: # uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
10556: 0 string C565 OLPC firmware icon image data
10557: >4 leshort x %u x
10558: >6 leshort x %u
10559:
10560: # Applied Images - Image files from Cytovision
10561: # Gustavo Junior Alves <gjalves@gjalves.com.br>
10562: 0 string \xce\xda\xde\xfa Cytovision Metaphases file
10563: 0 string \xed\xad\xef\xac Cytovision Karyotype file
10564: 0 string \x0b\x00\x03\x00 Cytovision FISH Probe file
10565: 0 string \xed\xfe\xda\xbe Cytovision FLEX file
10566: 0 string \xed\xab\xed\xfe Cytovision FLEX file
10567: 0 string \xad\xfd\xea\xad Cytovision RATS file
10568:
10569: # Wavelet Scalar Quantization format used in gray-scale fingerprint images
10570: # From Tano M Fotang <mfotang@quanteq.com>
10571: 0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
10572:
1.1.1.3 misho 10573: # Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
10574: # From: Markus Heidelberg <markus.heidelberg at web.de>
10575: 0 string/t [BitmapInfo2] Polar Monitor Bitmap text
10576: !:mime image/x-polar-monitor-bitmap
10577:
10578: # From: Rick Richardson <rick.richardson@comcast.net>
10579: 0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
1.1.1.2 misho 10580:
1.1 misho 10581: # Type: Ulead Photo Explorer5 (.pe5)
10582: # URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
10583: # From: Simon Horman <horms@debian.org>
1.1.1.2 misho 10584: 0 string IIO2H Ulead Photo Explorer5
1.1 misho 10585:
10586: # Type: X11 cursor
10587: # URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
10588: # From: Mathias Brodala <info@noctus.net>
1.1.1.2 misho 10589: 0 string Xcur X11 cursor
10590:
10591: # Type: Olympus ORF raw images.
10592: # URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF
10593: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
10594: 0 string MMOR Olympus ORF raw image data, big-endian
10595: !:mime image/x-olympus-orf
10596: 0 string IIRO Olympus ORF raw image data, little-endian
10597: !:mime image/x-olympus-orf
10598: 0 string IIRS Olympus ORF raw image data, little-endian
10599: !:mime image/x-olympus-orf
10600:
10601: # Type: files used in modern AVCHD camcoders to store clip information
10602: # Extension: .cpi
10603: # From: Alexander Danilov <alexander.a.danilov@gmail.com>
10604: 0 string HDMV0100 AVCHD Clip Information
10605:
10606: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
10607: # URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
10608: # Radiance HDR; usually has .pic or .hdr extension.
10609: 0 string #?RADIANCE\n Radiance HDR image data
10610: #!mime image/vnd.radiance
10611:
10612: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
10613: # URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
10614: # Used by the pfstools packages. The regex matches for the image size could
10615: # probably use some work. The MIME type is made up; if there's one in
10616: # actual common use, it should replace the one below.
10617: 0 string PFS1\x0a PFS HDR image data
10618: #!mime image/x-pfs
10619: >1 regex [0-9]*\ \b, %s
10620: >>1 regex \ [0-9]{4} \bx%s
10621:
10622: # Type: Foveon X3F
10623: # URL: http://www.photofo.com/downloads/x3f-raw-format.pdf
10624: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
10625: # Note that the MIME type isn't defined anywhere that I can find; if
10626: # there's a canonical type for this format, it should replace this one.
10627: 0 string FOVb Foveon X3F raw image data
10628: !:mime image/x-x3f
10629: >6 leshort x \b, version %d.
10630: >4 leshort x \b%d
10631: >28 lelong x \b, %dx
10632: >32 lelong x \b%d
10633:
10634: # Paint.NET file
10635: # From Adam Buchbinder <adam.buchbinder@gmail.com>
10636: 0 string PDN3 Paint.NET image data
10637: !:mime image/x-paintnet
1.1 misho 10638:
1.1.1.3 misho 10639: # Not really an image.
10640: # From: "Tano M. Fotang" <mfotang@quanteq.com>
10641: 0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
10642:
1.1 misho 10643: #------------------------------------------------------------------------------
1.1.1.2 misho 10644: # $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
1.1 misho 10645: # inform: file(1) magic for Inform interactive fiction language
10646:
10647: # URL: http://www.inform-fiction.org/
10648: # From: Reuben Thomas <rrt@sc3d.org>
10649:
1.1.1.2 misho 10650: 0 search/100/cW constant\ story Inform source text
1.1 misho 10651:
10652: #------------------------------------------------------------------------------
1.1.1.3 misho 10653: # $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
1.1 misho 10654: # intel: file(1) magic for x86 Unix
10655: #
10656: # Various flavors of x86 UNIX executable/object (other than Xenix, which
10657: # is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
10658: # Windows as well.
10659: #
10660: # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
10661: # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
10662: # as well, if, as, and when IBM makes it portable.
10663: #
10664: # The `versions' should be un-commented if they work for you.
10665: # (Was the problem just one of endianness?)
10666: #
10667: 0 leshort 0502 basic-16 executable
10668: >12 lelong >0 not stripped
10669: #>22 leshort >0 - version %ld
10670: 0 leshort 0503 basic-16 executable (TV)
10671: >12 lelong >0 not stripped
10672: #>22 leshort >0 - version %ld
10673: 0 leshort 0510 x86 executable
10674: >12 lelong >0 not stripped
10675: 0 leshort 0511 x86 executable (TV)
10676: >12 lelong >0 not stripped
10677: 0 leshort =0512 iAPX 286 executable small model (COFF)
10678: >12 lelong >0 not stripped
10679: #>22 leshort >0 - version %ld
10680: 0 leshort =0522 iAPX 286 executable large model (COFF)
10681: >12 lelong >0 not stripped
10682: #>22 leshort >0 - version %ld
10683: # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
10684: 0 leshort =0514 80386 COFF executable
10685: >12 lelong >0 not stripped
10686: >22 leshort >0 - version %ld
10687:
10688: # rom: file(1) magic for BIOS ROM Extensions found in intel machines
10689: # mapped into memory between 0xC0000 and 0xFFFFF
1.1.1.3 misho 10690: # From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
1.1 misho 10691: 0 beshort 0x55AA BIOS (ia32) ROM Ext.
10692: >5 string USB USB
10693: >7 string LDR UNDI image
10694: >30 string IBM IBM comp. Video
10695: >26 string Adaptec Adaptec
10696: >28 string Adaptec Adaptec
10697: >42 string PROMISE Promise
10698: >2 byte x (%d*512)
10699:
1.1.1.3 misho 10700: # Flash descriptors for Intel SPI flash roms.
10701: # From Dr. Jesus <j@hug.gs>
10702: 0 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
10703: 16 lelong 0x0ff0a55a Intel serial flash for PCH ROM
10704:
1.1 misho 10705: #------------------------------------------------------------------------------
1.1.1.2 misho 10706: # $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
1.1 misho 10707: # interleaf: file(1) magic for InterLeaf TPS:
10708: #
10709: 0 string =\210OPS Interleaf saved data
10710: 0 string =<!OPS Interleaf document text
10711: >5 string ,\ Version\ = \b, version
10712: >>17 string >\0 %.3s
10713:
10714: #------------------------------------------------------------------------------
1.1.1.2 misho 10715: # $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 10716: # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
10717: # "/etc/magic":
10718: # From: guy@netapp.com (Guy Harris)
10719: #
10720: 4 string pgscriptver IslandWrite document
10721: 13 string DrawFile IslandDraw document
10722:
10723:
10724: #------------------------------------------------------------------------------
1.1.1.2 misho 10725: # $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
1.1 misho 10726: # ispell: file(1) magic for ispell
10727: #
10728: # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
10729: # will match 0x9600 through 0x9603 in *both* little endian and big endian.
10730: # (No other current magic entries collide.)
10731: #
10732: # Updated by Daniel Quinlan (quinlan@yggdrasil.com)
10733: #
10734: 0 leshort&0xFFFC 0x9600 little endian ispell
10735: >0 byte 0 hash file (?),
10736: >0 byte 1 3.0 hash file,
10737: >0 byte 2 3.1 hash file,
10738: >0 byte 3 hash file (?),
10739: >2 leshort 0x00 8-bit, no capitalization, 26 flags
10740: >2 leshort 0x01 7-bit, no capitalization, 26 flags
10741: >2 leshort 0x02 8-bit, capitalization, 26 flags
10742: >2 leshort 0x03 7-bit, capitalization, 26 flags
10743: >2 leshort 0x04 8-bit, no capitalization, 52 flags
10744: >2 leshort 0x05 7-bit, no capitalization, 52 flags
10745: >2 leshort 0x06 8-bit, capitalization, 52 flags
10746: >2 leshort 0x07 7-bit, capitalization, 52 flags
10747: >2 leshort 0x08 8-bit, no capitalization, 128 flags
10748: >2 leshort 0x09 7-bit, no capitalization, 128 flags
10749: >2 leshort 0x0A 8-bit, capitalization, 128 flags
10750: >2 leshort 0x0B 7-bit, capitalization, 128 flags
10751: >2 leshort 0x0C 8-bit, no capitalization, 256 flags
10752: >2 leshort 0x0D 7-bit, no capitalization, 256 flags
10753: >2 leshort 0x0E 8-bit, capitalization, 256 flags
10754: >2 leshort 0x0F 7-bit, capitalization, 256 flags
10755: >4 leshort >0 and %d string characters
10756: 0 beshort&0xFFFC 0x9600 big endian ispell
10757: >1 byte 0 hash file (?),
10758: >1 byte 1 3.0 hash file,
10759: >1 byte 2 3.1 hash file,
10760: >1 byte 3 hash file (?),
10761: >2 beshort 0x00 8-bit, no capitalization, 26 flags
10762: >2 beshort 0x01 7-bit, no capitalization, 26 flags
10763: >2 beshort 0x02 8-bit, capitalization, 26 flags
10764: >2 beshort 0x03 7-bit, capitalization, 26 flags
10765: >2 beshort 0x04 8-bit, no capitalization, 52 flags
10766: >2 beshort 0x05 7-bit, no capitalization, 52 flags
10767: >2 beshort 0x06 8-bit, capitalization, 52 flags
10768: >2 beshort 0x07 7-bit, capitalization, 52 flags
10769: >2 beshort 0x08 8-bit, no capitalization, 128 flags
10770: >2 beshort 0x09 7-bit, no capitalization, 128 flags
10771: >2 beshort 0x0A 8-bit, capitalization, 128 flags
10772: >2 beshort 0x0B 7-bit, capitalization, 128 flags
10773: >2 beshort 0x0C 8-bit, no capitalization, 256 flags
10774: >2 beshort 0x0D 7-bit, no capitalization, 256 flags
10775: >2 beshort 0x0E 8-bit, capitalization, 256 flags
10776: >2 beshort 0x0F 7-bit, capitalization, 256 flags
10777: >4 beshort >0 and %d string characters
10778: # ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
10779: # Ispell 4.0
10780: 0 string ISPL ispell
10781: >4 long x hash file version %d,
10782: >8 long x lexletters %d,
10783: >12 long x lexsize %d,
10784: >16 long x hashsize %d,
10785: >20 long x stblsize %d
1.1.1.2 misho 10786:
1.1.1.3 misho 10787: #------------------------------------------------------------------------------
10788: # $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $
10789: # ISO Zipped file format
10790: # http://www.ezbsystems.com/isz/iszspec.txt
10791: 0 string IsZ! ISO Zipped file
10792: >4 byte x \b, header size %u
10793: >5 byte x \b, version %u
10794: >8 lelong x \b, serial %u
10795: #12 leshort x \b, sector size %u
10796: #>16 lelong x \b, total sectors %u
10797: >17 byte >0 \b, password protected
10798: #>24 lequad x \b, segment size %llu
10799: #>32 lelong x \b, blocks %u
10800: #>36 lelong x \b, block size %u
10801:
1.1 misho 10802: #------------------------------------------------------------
1.1.1.3 misho 10803: # $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
1.1 misho 10804: # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
10805: # same magic number, 0xcafebabe, so they are both handled
10806: # in the entry called "cafebabe".
10807: #------------------------------------------------------------
10808: # Java serialization
10809: # From Martin Pool (m.pool@pharos.com.au)
10810: 0 beshort 0xaced Java serialization data
10811: >2 beshort >0x0004 \b, version %d
10812:
10813: 0 belong 0xfeedfeed Java KeyStore
10814: !:mime application/x-java-keystore
10815: 0 belong 0xcececece Java JCE KeyStore
10816: !:mime application/x-java-jce-keystore
10817:
10818: # Dalvik .dex format. http://retrodev.com/android/dexformat.html
10819: # From <mkf@google.com> "Mike Fleming"
10820: 0 string dex\n
10821: >0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
10822: >4 string >000 version %s
10823: 0 string dey\n
10824: >0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
10825: >4 string >000 version %s
10826:
1.1.1.3 misho 10827: # Java source
10828: 0 regex ^import.*;$ Java source
10829: !:mime text/x-java
10830:
10831: # http://android.stackexchange.com/questions/23357/\
10832: # is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
10833: # 23608#23608
10834: 0 string ANDROID\040BACKUP\n Android Backup
10835: >15 string 1\n \b, version 1
10836: >17 string 0\n \b, uncompressed
10837: >17 string 1\n \b, compressed
10838: >19 string none\n \b, unencrypted
10839: >19 string AES-256\n \b, encrypted AES-256
10840:
10841: #------------------------------------------------------------------------------
10842: # $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
10843: # javascript: magic for javascript and node.js scripts.
10844: #
10845: 0 search/1/w #!/bin/node Node.js script text executable
10846: !:mime application/javascript
10847: 0 search/1/w #!/usr/bin/node Node.js script text executable
10848: !:mime application/javascript
10849: 0 search/1/w #!/bin/nodejs Node.js script text executable
10850: !:mime application/javascript
10851: 0 search/1/w #!/usr/bin/nodejs Node.js script text executable
10852: !:mime application/javascript
10853: 0 search/1 #!/usr/bin/env\ node Node.js script text executable
10854: !:mime application/javascript
10855: 0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable
10856: !:mime application/javascript
1.1 misho 10857:
10858: #------------------------------------------------------------------------------
1.1.1.3 misho 10859: # $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
1.1 misho 10860: # JPEG images
10861: # SunOS 5.5.1 had
10862: #
10863: # 0 string \377\330\377\340 JPEG file
10864: # 0 string \377\330\377\356 JPG file
10865: #
10866: # both of which turn into "JPEG image data" here.
10867: #
10868: 0 beshort 0xffd8 JPEG image data
10869: !:mime image/jpeg
1.1.1.2 misho 10870: !:apple 8BIMJPEG
1.1.1.3 misho 10871: !:strength +2
1.1 misho 10872: >6 string JFIF \b, JFIF standard
10873: # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
10874: # in a vain attempt to add image size reporting for JFIF. Note that these
10875: # tests are not fool-proof since some perfectly valid JPEGs are currently
10876: # impossible to specify in magic(4) format.
10877: # First, a little JFIF version info:
10878: >>11 byte x \b %d.
10879: >>12 byte x \b%02d
10880: # Next, the resolution or aspect ratio of the image:
10881: #>>13 byte 0 \b, aspect ratio
10882: #>>13 byte 1 \b, resolution (DPI)
10883: #>>13 byte 2 \b, resolution (DPCM)
10884: #>>4 beshort x \b, segment length %d
10885: # Next, show thumbnail info, if it exists:
10886: >>18 byte !0 \b, thumbnail %dx
10887: >>>19 byte x \b%d
10888:
10889: # EXIF moved down here to avoid reporting a bogus version number,
10890: # and EXIF version number printing added.
10891: # - Patrik R=E5dman <patrik+file-magic@iki.fi>
10892: >6 string Exif \b, EXIF standard
10893: # Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
10894: # All possible combinations of entries have to be enumerated, since no looping
10895: # is possible. And both endians are possible...
10896: # The combinations included below are from real-world JPEGs.
10897: # Little-endian
10898: >>12 string II
10899: # IFD 0 Entry #5:
10900: >>>70 leshort 0x8769
10901: # EXIF IFD Entry #1:
10902: >>>>(78.l+14) leshort 0x9000
10903: >>>>>(78.l+23) byte x %c
10904: >>>>>(78.l+24) byte x \b.%c
10905: >>>>>(78.l+25) byte !0x30 \b%c
10906: # IFD 0 Entry #9:
10907: >>>118 leshort 0x8769
10908: # EXIF IFD Entry #3:
10909: >>>>(126.l+38) leshort 0x9000
10910: >>>>>(126.l+47) byte x %c
10911: >>>>>(126.l+48) byte x \b.%c
10912: >>>>>(126.l+49) byte !0x30 \b%c
10913: # IFD 0 Entry #10
10914: >>>130 leshort 0x8769
10915: # EXIF IFD Entry #3:
10916: >>>>(138.l+38) leshort 0x9000
10917: >>>>>(138.l+47) byte x %c
10918: >>>>>(138.l+48) byte x \b.%c
10919: >>>>>(138.l+49) byte !0x30 \b%c
10920: # EXIF IFD Entry #4:
10921: >>>>(138.l+50) leshort 0x9000
10922: >>>>>(138.l+59) byte x %c
10923: >>>>>(138.l+60) byte x \b.%c
10924: >>>>>(138.l+61) byte !0x30 \b%c
10925: # EXIF IFD Entry #5:
10926: >>>>(138.l+62) leshort 0x9000
10927: >>>>>(138.l+71) byte x %c
10928: >>>>>(138.l+72) byte x \b.%c
10929: >>>>>(138.l+73) byte !0x30 \b%c
10930: # IFD 0 Entry #11
10931: >>>142 leshort 0x8769
10932: # EXIF IFD Entry #3:
10933: >>>>(150.l+38) leshort 0x9000
10934: >>>>>(150.l+47) byte x %c
10935: >>>>>(150.l+48) byte x \b.%c
10936: >>>>>(150.l+49) byte !0x30 \b%c
10937: # EXIF IFD Entry #4:
10938: >>>>(150.l+50) leshort 0x9000
10939: >>>>>(150.l+59) byte x %c
10940: >>>>>(150.l+60) byte x \b.%c
10941: >>>>>(150.l+61) byte !0x30 \b%c
10942: # EXIF IFD Entry #5:
10943: >>>>(150.l+62) leshort 0x9000
10944: >>>>>(150.l+71) byte x %c
10945: >>>>>(150.l+72) byte x \b.%c
10946: >>>>>(150.l+73) byte !0x30 \b%c
10947: # Big-endian
10948: >>12 string MM
10949: # IFD 0 Entry #9:
10950: >>>118 beshort 0x8769
10951: # EXIF IFD Entry #1:
10952: >>>>(126.L+14) beshort 0x9000
10953: >>>>>(126.L+23) byte x %c
10954: >>>>>(126.L+24) byte x \b.%c
10955: >>>>>(126.L+25) byte !0x30 \b%c
10956: # EXIF IFD Entry #3:
10957: >>>>(126.L+38) beshort 0x9000
10958: >>>>>(126.L+47) byte x %c
10959: >>>>>(126.L+48) byte x \b.%c
10960: >>>>>(126.L+49) byte !0x30 \b%c
10961: # IFD 0 Entry #10
10962: >>>130 beshort 0x8769
10963: # EXIF IFD Entry #3:
10964: >>>>(138.L+38) beshort 0x9000
10965: >>>>>(138.L+47) byte x %c
10966: >>>>>(138.L+48) byte x \b.%c
10967: >>>>>(138.L+49) byte !0x30 \b%c
10968: # EXIF IFD Entry #5:
10969: >>>>(138.L+62) beshort 0x9000
10970: >>>>>(138.L+71) byte x %c
10971: >>>>>(138.L+72) byte x \b.%c
10972: >>>>>(138.L+73) byte !0x30 \b%c
10973: # IFD 0 Entry #11
10974: >>>142 beshort 0x8769
10975: # EXIF IFD Entry #4:
10976: >>>>(150.L+50) beshort 0x9000
10977: >>>>>(150.L+59) byte x %c
10978: >>>>>(150.L+60) byte x \b.%c
10979: >>>>>(150.L+61) byte !0x30 \b%c
10980: # Here things get sticky. We can do ONE MORE marker segment with
10981: # indirect addressing, and that's all. It would be great if we could
10982: # do pointer arithemetic like in an assembler language. Christos?
10983: # And if there was some sort of looping construct to do searches, plus a few
10984: # named accumulators, it would be even more effective...
10985: # At least we can show a comment if no other segments got inserted before:
1.1.1.3 misho 10986: >(4.S+5) byte 0xFE \b, comment:
10987: >>(4.S+6) pstring/HJ x "%s"
1.1 misho 10988: # Or, we can show the encoding type (I've included only the three most common)
10989: # and image dimensions if we are lucky and the SOFn (image segment) is here:
10990: >(4.S+5) byte 0xC0 \b, baseline
10991: >>(4.S+6) byte x \b, precision %d
10992: >>(4.S+7) beshort x \b, %dx
10993: >>(4.S+9) beshort x \b%d
10994: >(4.S+5) byte 0xC1 \b, extended sequential
10995: >>(4.S+6) byte x \b, precision %d
10996: >>(4.S+7) beshort x \b, %dx
10997: >>(4.S+9) beshort x \b%d
10998: >(4.S+5) byte 0xC2 \b, progressive
10999: >>(4.S+6) byte x \b, precision %d
11000: >>(4.S+7) beshort x \b, %dx
11001: >>(4.S+9) beshort x \b%d
11002: # I've commented-out quantisation table reporting. I doubt anyone cares yet.
11003: #>(4.S+5) byte 0xDB \b, quantisation table
11004: #>>(4.S+6) beshort x \b length=%d
11005: #>14 beshort x \b, %d x
11006: #>16 beshort x \b %d
11007:
11008: # HSI is Handmade Software's proprietary JPEG encoding scheme
11009: 0 string hsi1 JPEG image data, HSI proprietary
11010:
11011: # From: David Santinoli <david@santinoli.com>
1.1.1.3 misho 11012: 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000
11013: # From: Johan van der Knijff <johan.vanderknijff@kb.nl>
11014: # Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
11015: # https://github.com/bitsgalore/jp2kMagic
11016: #
11017: # Now read value of 'Brand' field, which yields a few possibilities:
11018: >20 string \x6a\x70\x32\x20 Part 1 (JP2)
11019: !:mime image/jp2
11020: >20 string \x6a\x70\x78\x20 Part 2 (JPX)
11021: !:mime image/jpx
11022: >20 string \x6a\x70\x6d\x20 Part 6 (JPM)
11023: !:mime image/jpm
11024: >20 string \x6d\x6a\x70\x32 Part 3 (MJ2)
11025: !:mime video/mj2
1.1 misho 11026:
11027: # Type: JPEG 2000 codesream
11028: # From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
11029: 0 belong 0xff4fff51 JPEG 2000 codestream
11030: 45 beshort 0xff52
11031:
11032: #------------------------------------------------------------------------------
1.1.1.2 misho 11033: # $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 11034: # karma: file(1) magic for Karma data files
11035: #
11036: # From <rgooch@atnf.csiro.au>
11037:
11038: 0 string KarmaRHD Version Karma Data Structure Version
11039: >16 belong x %lu
11040:
11041: #------------------------------------------------------------------------------
1.1.1.3 misho 11042: # $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
1.1 misho 11043: # kde: file(1) magic for KDE
11044:
1.1.1.3 misho 11045: 0 string/t [KDE\ Desktop\ Entry] KDE desktop entry
1.1 misho 11046: !:mime application/x-kdelnk
1.1.1.3 misho 11047: 0 string/t #\ KDE\ Config\ File KDE config file
1.1 misho 11048: !:mime application/x-kdelnk
1.1.1.3 misho 11049: 0 string/t #\ xmcd xmcd database file for kscd
1.1 misho 11050: !:mime text/x-xmcd
1.1.1.2 misho 11051:
11052: #------------------------------------------------------------------------------
1.1.1.3 misho 11053: # $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
11054: # keepass: file(1) magic for KeePass file
11055: #
11056: # Keepass Password Safe:
11057: # * original one: http://keepass.info/
11058: # * *nix port: http://www.keepassx.org/
11059: # * android port: http://code.google.com/p/keepassdroid/
11060:
11061: 0 lelong 0x9AA2D903 Keepass password database
11062: >4 lelong 0xB54BFB65 1.x KDB
11063: >>48 lelong >0 \b, %d groups
11064: >>52 lelong >0 \b, %d entries
11065: >>8 lelong&0x0f 1 \b, SHA-256
11066: >>8 lelong&0x0f 2 \b, AES
11067: >>8 lelong&0x0f 4 \b, RC4
11068: >>8 lelong&0x0f 8 \b, Twofish
11069: >>120 lelong >0 \b, %d key transformation rounds
11070: >4 lelong 0xB54BFB67 2.x KDBX
11071:
11072: #------------------------------------------------------------------------------
11073: # $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
1.1.1.2 misho 11074: # Type: Google KML, formerly Keyhole Markup Language
11075: # Future development of this format has been handed
11076: # over to the Open Geospatial Consortium.
11077: # http://www.opengeospatial.org/standards/kml/
11078: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
1.1.1.3 misho 11079: 0 string/t \<?xml
1.1.1.2 misho 11080: >20 search/400 \ xmlns=
11081: >>&0 regex ['"]http://earth.google.com/kml Google KML document
11082: !:mime application/vnd.google-earth.kml+xml
11083: >>>&1 string 2.0' \b, version 2.0
11084: >>>&1 string 2.1' \b, version 2.1
11085: >>>&1 string 2.2' \b, version 2.2
11086:
11087: #------------------------------------------------------------------------------
11088: # Type: OpenGIS KML, formerly Keyhole Markup Language
11089: # This standard is maintained by the
11090: # Open Geospatial Consortium.
11091: # http://www.opengeospatial.org/standards/kml/
11092: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
11093: >>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
11094: !:mime application/vnd.google-earth.kml+xml
1.1.1.3 misho 11095: >>>&1 string/t 2.2 \b, version 2.2
1.1.1.2 misho 11096:
11097: #------------------------------------------------------------------------------
11098: # Type: Google KML Archive (ZIP based)
11099: # http://code.google.com/apis/kml/documentation/kml_tut.html
11100: # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
11101: 0 string PK\003\004
11102: >4 byte 0x14
11103: >>30 string doc.kml Compressed Google KML Document, including resources.
11104: !:mime application/vnd.google-earth.kmz
11105:
1.1 misho 11106: #------------------------------------------------------------------------------
1.1.1.2 misho 11107: # $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 11108: # DEC SRC Virtual Paper: Lectern files
11109: # Karl M. Hegbloom <karlheg@inetarena.com>
11110: 0 string lect DEC SRC Virtual Paper Lectern file
1.1.1.2 misho 11111:
1.1 misho 11112: #------------------------------------------------------------------------------
1.1.1.2 misho 11113: # $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 11114: # lex: file(1) magic for lex
11115: #
11116: # derived empirically, your offsets may vary!
11117: 0 search/100 yyprevious C program text (from lex)
11118: >3 search/1 >\0 for %s
11119: # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
11120: 0 search/100 generated\ by\ flex C program text (from flex)
11121: # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
11122: 0 search/1 %{ lex description text
11123:
11124: #------------------------------------------------------------------------------
1.1.1.2 misho 11125: # $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
1.1 misho 11126: # lif: file(1) magic for lif
11127: #
11128: # (Daniel Quinlan <quinlan@yggdrasil.com>)
11129: #
11130: 0 beshort 0x8000 lif file
1.1.1.2 misho 11131:
1.1 misho 11132: #------------------------------------------------------------------------------
1.1.1.3 misho 11133: # $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $
1.1 misho 11134: # linux: file(1) magic for Linux files
11135: #
11136: # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
11137: # The following basic Linux magic is useful for reference, but using
11138: # "long" magic is a better practice in order to avoid collisions.
11139: #
11140: # 2 leshort 100 Linux/i386
11141: # >0 leshort 0407 impure executable (OMAGIC)
11142: # >0 leshort 0410 pure executable (NMAGIC)
11143: # >0 leshort 0413 demand-paged executable (ZMAGIC)
11144: # >0 leshort 0314 demand-paged executable (QMAGIC)
11145: #
11146: 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
11147: >16 lelong 0 \b, stripped
11148: 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
11149: >16 lelong 0 \b, stripped
11150: 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
11151: >16 lelong 0 \b, stripped
11152: 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
11153: >16 lelong 0 \b, stripped
11154: #
11155: 0 string \007\001\000 Linux/i386 object file
11156: >20 lelong >0x1020 \b, DLL library
11157: # Linux-8086 stuff:
11158: 0 string \01\03\020\04 Linux-8086 impure executable
11159: >28 long !0 not stripped
11160: 0 string \01\03\040\04 Linux-8086 executable
11161: >28 long !0 not stripped
11162: #
11163: 0 string \243\206\001\0 Linux-8086 object file
11164: #
11165: 0 string \01\03\020\20 Minix-386 impure executable
11166: >28 long !0 not stripped
11167: 0 string \01\03\040\20 Minix-386 executable
11168: >28 long !0 not stripped
1.1.1.3 misho 11169: 0 string \01\03\04\20 Minix-386 NSYM/GNU executable
11170: >28 long !0 not stripped
1.1 misho 11171: # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
11172: 216 lelong 0421 Linux/i386 core file
11173: >220 string >\0 of '%s'
11174: >200 lelong >0 (signal %d)
11175: #
11176: # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
11177: # this can be overridden by the DOS executable (COM) entry
11178: 2 string LILO Linux/i386 LILO boot/chain loader
11179: #
1.1.1.3 misho 11180: # Linux make config build file, from Ole Aamot <oka@oka.no>
11181: 28 string make\ config Linux make config build file
11182: #
1.1 misho 11183: # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
1.1.1.2 misho 11184: # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
11185: # See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
11186: 0 leshort 0x0436 Linux/i386 PC Screen Font v1 data,
11187: >2 byte&0x01 0 256 characters,
11188: >2 byte&0x01 !0 512 characters,
11189: >2 byte&0x02 0 no directory,
11190: >2 byte&0x02 !0 Unicode directory,
1.1 misho 11191: >3 byte >0 8x%d
1.1.1.2 misho 11192: 0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
11193: >16 lelong x %d characters,
11194: >12 lelong&0x01 0 no directory,
11195: >12 lelong&0x01 !0 Unicode directory,
11196: >24 lelong x %d
11197: >28 lelong x \bx%d
11198:
1.1 misho 11199: # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
11200: 4086 string SWAP-SPACE Linux/i386 swap file
11201: # From: Jeff Bailey <jbailey@ubuntu.com>
11202: # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
11203: 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
1.1.1.3 misho 11204: # From: James Hunt <james.hunt@ubuntu.com>
11205: 4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate)
1.1 misho 11206: # according to man page of mkswap (8) March 1999
11207: # volume label and UUID Russell Coker
11208: # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
11209: 4086 string SWAPSPACE2 Linux/i386 swap file (new style),
11210: >0x400 long x version %d (4K pages),
11211: >0x404 long x size %d pages,
11212: >1052 string \0 no label,
11213: >1052 string >\0 LABEL=%s,
1.1.1.2 misho 11214: >0x40c belong x UUID=%08x
11215: >0x410 beshort x \b-%04x
11216: >0x412 beshort x \b-%04x
11217: >0x414 beshort x \b-%04x
11218: >0x416 belong x \b-%08x
11219: >0x41a beshort x \b%04x
11220: # From Daniel Novotny <dnovotny@redhat.com>
11221: # swap file for PowerPC
11222: 65526 string SWAPSPACE2 Linux/ppc swap file
1.1.1.3 misho 11223: 16374 string SWAPSPACE2 Linux/ia64 swap file
1.1 misho 11224: #
11225: # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
11226: # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
1.1.1.3 misho 11227: # and Nicolas Lichtmaier <nick@debian.org>
1.1 misho 11228: # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
11229: # Linux kernel boot images (i386 arch) (Wolfram Kleff)
11230: 514 string HdrS Linux kernel
1.1.1.3 misho 11231: !:strength + 5
1.1 misho 11232: >510 leshort 0xAA55 x86 boot executable
11233: >>518 leshort >0x1ff
1.1.1.2 misho 11234: >>>529 byte 0 zImage,
1.1 misho 11235: >>>529 byte 1 bzImage,
11236: >>>(526.s+0x200) string >\0 version %s,
11237: >>498 leshort 1 RO-rootFS,
11238: >>498 leshort 0 RW-rootFS,
11239: >>508 leshort >0 root_dev 0x%X,
11240: >>502 leshort >0 swap_dev 0x%X,
11241: >>504 leshort >0 RAMdisksize %u KB,
11242: >>506 leshort 0xFFFF Normal VGA
11243: >>506 leshort 0xFFFE Extended VGA
11244: >>506 leshort 0xFFFD Prompt for Videomode
11245: >>506 leshort >0 Video mode %d
11246: # This also matches new kernels, which were caught above by "HdrS".
11247: 0 belong 0xb8c0078e Linux kernel
11248: >0x1e3 string Loading version 1.3.79 or older
11249: >0x1e9 string Loading from prehistoric times
11250:
1.1.1.3 misho 11251: # System.map files - Nicolas Lichtmaier <nick@debian.org>
1.1 misho 11252: 8 search/1 \ A\ _text Linux kernel symbol map text
11253:
1.1.1.3 misho 11254: # LSM entries - Nicolas Lichtmaier <nick@debian.org>
1.1 misho 11255: 0 search/1 Begin3 Linux Software Map entry text
11256: 0 search/1 Begin4 Linux Software Map entry text (new format)
11257:
11258: # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
11259: 0 belong 0x4f4f4f4d User-mode Linux COW file
11260: >4 belong <3 \b, version %d
11261: >>8 string >\0 \b, backing file %s
11262: >4 belong >2 \b, version %d
11263: >>32 string >\0 \b, backing file %s
11264:
11265: ############################################################################
11266: # Linux kernel versions
11267:
11268: 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
11269: >497 leshort 0 x86 boot sector
11270: >>514 belong 0x8e of a kernel from the dawn of time!
11271: >>514 belong 0x908ed8b4 version 0.99-1.1.42
11272: >>514 belong 0x908ed8b8 for memtest86
11273:
11274: >497 leshort !0 x86 kernel
11275: >>504 leshort >0 RAMdisksize=%u KB
11276: >>502 leshort >0 swap=0x%X
11277: >>508 leshort >0 root=0x%X
11278: >>>498 leshort 1 \b-ro
11279: >>>498 leshort 0 \b-rw
11280: >>506 leshort 0xFFFF vga=normal
11281: >>506 leshort 0xFFFE vga=extended
11282: >>506 leshort 0xFFFD vga=ask
11283: >>506 leshort >0 vga=%d
11284: >>514 belong 0x908ed881 version 1.1.43-1.1.45
11285: >>514 belong 0x15b281cd
11286: >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
11287: >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
11288: >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
11289: >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
11290: >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
11291: >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
11292: >>514 string HdrS
11293: >>>518 leshort >0x1FF
11294: >>>>529 byte 0 \b, zImage
11295: >>>>529 byte 1 \b, bzImage
11296: >>>>(526.s+0x200) string >\0 \b, version %s
11297:
11298: # Linux boot sector thefts.
11299: 0 belong 0xb8c0078e Linux
11300: >0x1e6 belong 0x454c4b53 ELKS Kernel
11301: >0x1e6 belong !0x454c4b53 style boot sector
11302:
11303: ############################################################################
1.1.1.3 misho 11304: # Linux S390 kernel image
11305: # Created by: Jan Kaluza <jkaluza@redhat.com>
11306: 8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
11307: >0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
11308: # 64bit
11309: >>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
11310: >>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
11311: >>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
11312: >>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
11313: # 32bit
11314: >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
11315: >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
11316: >>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
11317: >>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
11318:
11319: # Linux ARM compressed kernel image
11320: # From: Kevin Cernekee <cernekee@gmail.com>
11321: 36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian)
11322: 36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
11323:
11324: ############################################################################
1.1 misho 11325: # Linux 8086 executable
11326: 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
11327: >5 string .
11328: >>4 string >\0 \b, libc version %s
11329:
11330: 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
11331: >2 byte&0x01 !0 \b, unmapped zero page
11332: >2 byte&0x20 0 \b, impure
11333: >2 byte&0x20 !0
11334: >>2 byte&0x10 !0 \b, A_EXEC
11335: >2 byte&0x02 !0 \b, A_PAL
11336: >2 byte&0x04 !0 \b, A_NSYM
11337: >2 byte&0x08 !0 \b, A_STAND
11338: >2 byte&0x40 !0 \b, A_PURE
11339: >2 byte&0x80 !0 \b, A_TOVLY
11340: >28 long !0 \b, not stripped
11341: >37 string .
11342: >>36 string >\0 \b, libc version %s
11343:
11344: # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
11345: # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
11346: # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
11347: # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
11348:
11349: # SYSLINUX boot logo files (from 'ppmtolss16' sources)
1.1.1.3 misho 11350: # http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
11351: # file extension .lss .16
1.1 misho 11352: 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
1.1.1.3 misho 11353: # syslinux-4.05/mime/image/x-lss16.xml
11354: !:mime image/x-lss16
1.1 misho 11355: >4 leshort x \b, width %d
11356: >6 leshort x \b, height %d
11357:
11358: 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
11359: >4 belong x version %d
11360:
11361: # SE Linux policy database
11362: # From: Mike Frysinger <vapier@gentoo.org>
11363: 0 lelong 0xf97cff8c SE Linux policy
11364: >16 lelong x v%d
11365: >20 lelong 1 MLS
11366: >24 lelong x %d symbols
11367: >28 lelong x %d ocons
11368:
11369: # Linux Logical Volume Manager (LVM)
11370: # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
11371: #
11372: # System ID, UUID and volume group name are 128 bytes long
11373: # but they should never be full and initialized with zeros...
11374: #
11375: # LVM1
11376: #
11377: 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
11378: >0x12c string >\0 , System ID: %s
11379:
11380: 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
11381: >0x12c string >\0 , System ID: %s
11382:
11383: # LVM2
11384: #
11385: # It seems that the label header can be in one the four first sector
11386: # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
11387: #
11388: # 0x200 seems to be the common case
11389:
1.1.1.3 misho 11390: 0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
1.1 misho 11391: # read the offset to add to the start of the header, and the header
11392: # start in 0x200
1.1.1.3 misho 11393: >&(&-12.l-0x21) byte x
11394: # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11395: >>&0x0 string >\x2f \b, UUID: %.6s
11396: >>&0x6 string >\x2f \b-%.4s
11397: >>&0xa string >\x2f \b-%.4s
11398: >>&0xe string >\x2f \b-%.4s
11399: >>&0x12 string >\x2f \b-%.4s
11400: >>&0x16 string >\x2f \b-%.4s
11401: >>&0x1a string >\x2f \b-%.6s
11402: >>&0x20 lequad x \b, size: %lld
11403:
11404: 0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
11405: >&(&-12.l-0x21) byte x
11406: # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11407: >>&0x0 string >\x2f \b, UUID: %.6s
11408: >>&0x6 string >\x2f \b-%.4s
11409: >>&0xa string >\x2f \b-%.4s
11410: >>&0xe string >\x2f \b-%.4s
11411: >>&0x12 string >\x2f \b-%.4s
11412: >>&0x16 string >\x2f \b-%.4s
11413: >>&0x1a string >\x2f \b-%.6s
11414: >>&0x20 lequad x \b, size: %lld
11415:
11416: 0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
11417: >&(&-12.l-0x21) byte x
11418: # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11419: >>&0x0 string >\x2f \b, UUID: %.6s
11420: >>&0x6 string >\x2f \b-%.4s
11421: >>&0xa string >\x2f \b-%.4s
11422: >>&0xe string >\x2f \b-%.4s
11423: >>&0x12 string >\x2f \b-%.4s
11424: >>&0x16 string >\x2f \b-%.4s
11425: >>&0x1a string >\x2f \b-%.6s
11426: >>&0x20 lequad x \b, size: %lld
11427:
11428: 0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
11429: >&(&-12.l-0x21) byte x
11430: # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
11431: >>&0x0 string >\x2f \b, UUID: %.6s
11432: >>&0x6 string >\x2f \b-%.4s
11433: >>&0xa string >\x2f \b-%.4s
11434: >>&0xe string >\x2f \b-%.4s
11435: >>&0x12 string >\x2f \b-%.4s
11436: >>&0x16 string >\x2f \b-%.4s
11437: >>&0x1a string >\x2f \b-%.6s
11438: >>&0x20 lequad x \b, size: %lld
1.1 misho 11439:
11440: # LVM snapshot
11441: # from Jason Farrel
11442: 0 string SnAp LVM Snapshot (CopyOnWrite store)
11443: >4 lelong !0 - valid,
11444: >4 lelong 0 - invalid,
11445: >8 lelong x version %d,
11446: >12 lelong x chunk_size %d
11447:
11448: # SE Linux policy database
11449: 0 lelong 0xf97cff8c SE Linux policy
11450: >16 lelong x v%d
11451: >20 lelong 1 MLS
11452: >24 lelong x %d symbols
11453: >28 lelong x %d ocons
11454:
11455: # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
11456: # Anthon van der Neut (anthon@mnt.org)
11457: 0 string LUKS\xba\xbe LUKS encrypted file,
11458: >6 beshort x ver %d
11459: >8 string x [%s,
11460: >40 string x %s,
11461: >72 string x %s]
11462: >168 string x UUID: %s
11463:
11464:
11465: # Summary: Xen saved domain file
11466: # Created by: Radek Vokal <rvokal@redhat.com>
11467: 0 string LinuxGuestRecord Xen saved domain
11468: >20 search/256 (name
11469: >>&1 string x (name %s)
11470:
11471: # Type: Xen, the virtual machine monitor
11472: # From: Radek Vokal <rvokal@redhat.com>
11473: 0 string LinuxGuestRecord Xen saved domain
11474: #>2 regex \(name\ [^)]*\) %s
11475: >20 search/256 (name (name
11476: >>&1 string x %s...)
1.1.1.2 misho 11477:
1.1 misho 11478: #------------------------------------------------------------------------------
1.1.1.2 misho 11479: # $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
1.1 misho 11480: # lisp: file(1) magic for lisp programs
11481: #
11482: # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
11483:
11484: # updated by Joerg Jenderek
11485: # GRR: This lot is too weak
11486: #0 string ;;
11487: # windows INF files often begin with semicolon and use CRLF as line end
11488: # lisp files are mainly created on unix system with LF as line end
1.1.1.2 misho 11489: #>2 search/4096 !\r Lisp/Scheme program text
11490: #>2 search/4096 \r Windows INF file
1.1 misho 11491:
1.1.1.2 misho 11492: 0 search/4096 (setq\ Lisp/Scheme program text
1.1 misho 11493: !:mime text/x-lisp
1.1.1.2 misho 11494: 0 search/4096 (defvar\ Lisp/Scheme program text
1.1 misho 11495: !:mime text/x-lisp
1.1.1.2 misho 11496: 0 search/4096 (defparam\ Lisp/Scheme program text
1.1 misho 11497: !:mime text/x-lisp
1.1.1.2 misho 11498: 0 search/4096 (defun\ Lisp/Scheme program text
1.1 misho 11499: !:mime text/x-lisp
1.1.1.2 misho 11500: 0 search/4096 (autoload\ Lisp/Scheme program text
1.1 misho 11501: !:mime text/x-lisp
1.1.1.2 misho 11502: 0 search/4096 (custom-set-variables\ Lisp/Scheme program text
1.1 misho 11503: !:mime text/x-lisp
11504:
11505: # Emacs 18 - this is always correct, but not very magical.
11506: 0 string \012( Emacs v18 byte-compiled Lisp data
11507: !:mime application/x-elc
11508: # Emacs 19+ - ver. recognition added by Ian Springer
11509: # Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
11510: # - Chris Chittleborough <cchittleborough@yahoo.com.au>
11511: 0 string ;ELC
11512: >4 byte >18
11513: >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
11514: !:mime application/x-elc
11515:
11516: # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
11517: 0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
11518: 0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
11519:
11520: 0 long 0x70768BD2 CLISP memory image data
11521: 0 long 0xD28B7670 CLISP memory image data, other endian
11522:
11523: #.com and .bin for MIT scheme
11524: 0 string \372\372\372\372 MIT scheme (library?)
11525:
11526: # From: David Allouche <david@allouche.net>
11527: 0 search/1 \<TeXmacs| TeXmacs document text
11528: !:mime text/texmacs
11529:
11530: #------------------------------------------------------------------------------
1.1.1.3 misho 11531: # $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
1.1 misho 11532: # llvm: file(1) magic for LLVM byte-codes
1.1.1.2 misho 11533: # URL: http://llvm.org/docs/BitCodeFormat.html
1.1 misho 11534: # From: Al Stone <ahs3@fc.hp.com>
11535:
11536: 0 string llvm LLVM byte-codes, uncompressed
11537: 0 string llvc0 LLVM byte-codes, null compression
11538: 0 string llvc1 LLVM byte-codes, gzip compression
11539: 0 string llvc2 LLVM byte-codes, bzip2 compression
1.1.1.3 misho 11540:
11541: 0 lelong 0x0b17c0de LLVM bitcode, wrapper
11542: # Are these Mach-O ABI values? They appear to be.
11543: >16 lelong 0x01000007 x86_64
11544: >16 lelong 0x00000007 i386
11545: >16 lelong 0x00000012 ppc
11546: >16 lelong 0x01000012 ppc64
11547: >16 lelong 0x0000000c arm
11548:
11549: 0 string BC\xc0\xde LLVM IR bitcode
1.1.1.2 misho 11550:
1.1 misho 11551: #------------------------------------------------------------------------------
1.1.1.3 misho 11552: # $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
1.1 misho 11553: # lua: file(1) magic for Lua scripting language
11554: # URL: http://www.lua.org/
11555: # From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
11556:
11557: # Lua scripts
1.1.1.2 misho 11558: 0 search/1/w #!\ /usr/bin/lua Lua script text executable
1.1 misho 11559: !:mime text/x-lua
1.1.1.2 misho 11560: 0 search/1/w #!\ /usr/local/bin/lua Lua script text executable
1.1 misho 11561: !:mime text/x-lua
11562: 0 search/1 #!/usr/bin/env\ lua Lua script text executable
11563: !:mime text/x-lua
11564: 0 search/1 #!\ /usr/bin/env\ lua Lua script text executable
11565: !:mime text/x-lua
11566:
11567: # Lua bytecode
11568: 0 string \033Lua Lua bytecode,
11569: >4 byte 0x50 version 5.0
11570: >4 byte 0x51 version 5.1
1.1.1.3 misho 11571: >4 byte 0x52 version 5.2
1.1 misho 11572:
11573: #------------------------------------------------------------------------------
1.1.1.2 misho 11574: # $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 11575: # luks: file(1) magic for Linux Unified Key Setup
11576: # URL: http://luks.endorphin.org/spec
11577: # From: Anthon van der Neut <anthon@mnt.org>
11578:
11579: 0 string LUKS\xba\xbe LUKS encrypted file,
11580: >6 beshort x ver %d
11581: >8 string x [%s,
11582: >40 string x %s,
11583: >72 string x %s]
11584: >168 string x UUID: %s
1.1.1.3 misho 11585: #------------------------------------------------------------------------------
11586: # $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
11587: # make: file(1) magic for M4 scripts
11588: #
11589: 0 regex \^dnl\ M4 macro processor script text
11590: !:mime text/x-m4
1.1.1.2 misho 11591:
1.1 misho 11592: #------------------------------------------------------------
1.1.1.3 misho 11593: # $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $
1.1 misho 11594: # Mach has two magic numbers, 0xcafebabe and 0xfeedface.
11595: # Unfortunately the first, cafebabe, is shared with
11596: # Java ByteCode, so they are both handled in the file "cafebabe".
11597: # The "feedface" ones are handled herein.
11598: #------------------------------------------------------------
1.1.1.3 misho 11599: # if set, it's for the 64-bit version of the architecture
11600: # yes, this is separate from the low-order magic number bit
11601: # it's also separate from the "64-bit libraries" bit in the
11602: # upper 8 bits of the CPU subtype
11603:
11604: 0 name mach-o-cpu
11605: >0 belong&0x01000000 0
11606: #
11607: # 32-bit ABIs.
11608: #
11609: # 1 vax
11610: >>0 belong&0x00ffffff 1
11611: >>>4 belong&0x00ffffff 0 vax
11612: >>>4 belong&0x00ffffff 1 vax11/780
11613: >>>4 belong&0x00ffffff 2 vax11/785
11614: >>>4 belong&0x00ffffff 3 vax11/750
11615: >>>4 belong&0x00ffffff 4 vax11/730
11616: >>>4 belong&0x00ffffff 5 uvaxI
11617: >>>4 belong&0x00ffffff 6 uvaxII
11618: >>>4 belong&0x00ffffff 7 vax8200
11619: >>>4 belong&0x00ffffff 8 vax8500
11620: >>>4 belong&0x00ffffff 9 vax8600
11621: >>>4 belong&0x00ffffff 10 vax8650
11622: >>>4 belong&0x00ffffff 11 vax8800
11623: >>>4 belong&0x00ffffff 12 uvaxIII
11624: >>>4 belong&0x00ffffff >12 vax subarchitecture=%ld
11625: >>0 belong&0x00ffffff 2 romp
11626: >>0 belong&0x00ffffff 3 architecture=3
11627: >>0 belong&0x00ffffff 4 ns32032
11628: >>0 belong&0x00ffffff 5 ns32332
11629: >>0 belong&0x00ffffff 6 m68k
11630: # 7 x86
11631: >>0 belong&0x00ffffff 7
11632: >>>4 belong&0x0000000f 3 i386
11633: >>>4 belong&0x0000000f 4 i486
11634: >>>>4 belong&0x00fffff0 0
11635: >>>>4 belong&0x00fffff0 0x80 \bsx
11636: >>>4 belong&0x0000000f 5 i586
11637: >>>4 belong&0x0000000f 6
11638: >>>>4 belong&0x00fffff0 0 p6
11639: >>>>4 belong&0x00fffff0 0x10 pentium_pro
11640: >>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20
11641: >>>>4 belong&0x00fffff0 0x30 pentium_2_m3
11642: >>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
11643: >>>>4 belong&0x00fffff0 0x50 pentium_2_m5
11644: >>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx
11645: >>>4 belong&0x0000000f 7 celeron
11646: >>>>4 belong&0x00fffff0 0x00 \b_m0x%lx
11647: >>>>4 belong&0x00fffff0 0x10 \b_m0x%lx
11648: >>>>4 belong&0x00fffff0 0x20 \b_m0x%lx
11649: >>>>4 belong&0x00fffff0 0x30 \b_m0x%lx
11650: >>>>4 belong&0x00fffff0 0x40 \b_m0x%lx
11651: >>>>4 belong&0x00fffff0 0x50 \b_m0x%lx
11652: >>>>4 belong&0x00fffff0 0x60
11653: >>>>4 belong&0x00fffff0 0x70 \b_mobile
11654: >>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx
11655: >>>4 belong&0x0000000f 8 pentium_3
11656: >>>>4 belong&0x00fffff0 0x00
11657: >>>>4 belong&0x00fffff0 0x10 \b_m
11658: >>>>4 belong&0x00fffff0 0x20 \b_xeon
11659: >>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx
11660: >>>4 belong&0x0000000f 9 pentiumM
11661: >>>>4 belong&0x00fffff0 0x00
11662: >>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx
11663: >>>4 belong&0x0000000f 10 pentium_4
11664: >>>>4 belong&0x00fffff0 0x00
11665: >>>>4 belong&0x00fffff0 0x10 \b_m
11666: >>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
11667: >>>4 belong&0x0000000f 11 itanium
11668: >>>>4 belong&0x00fffff0 0x00
11669: >>>>4 belong&0x00fffff0 0x10 \b_2
11670: >>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
11671: >>>4 belong&0x0000000f 12 xeon
11672: >>>>4 belong&0x00fffff0 0x00
11673: >>>>4 belong&0x00fffff0 0x10 \b_mp
11674: >>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
11675: >>>4 belong&0x0000000f >12 ia32 family=%ld
11676: >>>>4 belong&0x00fffff0 0x00
11677: >>>>4 belong&0x00fffff0 >0x00 model=%lx
11678: >>0 belong&0x00ffffff 8 mips
11679: >>>4 belong&0x00ffffff 1 R2300
11680: >>>4 belong&0x00ffffff 2 R2600
11681: >>>4 belong&0x00ffffff 3 R2800
11682: >>>4 belong&0x00ffffff 4 R2000a
11683: >>>4 belong&0x00ffffff 5 R2000
11684: >>>4 belong&0x00ffffff 6 R3000a
11685: >>>4 belong&0x00ffffff 7 R3000
11686: >>>4 belong&0x00ffffff >7 subarchitecture=%ld
11687: >>0 belong&0x00ffffff 9 ns32532
11688: >>0 belong&0x00ffffff 10 mc98000
11689: >>0 belong&0x00ffffff 11 hppa
11690: >>>4 belong&0x00ffffff 0 7100
11691: >>>4 belong&0x00ffffff 1 7100LC
11692: >>>4 belong&0x00ffffff >1 subarchitecture=%ld
11693: >>0 belong&0x00ffffff 12 arm
11694: >>>4 belong&0x00ffffff 0
11695: >>>4 belong&0x00ffffff 1 subarchitecture=%ld
11696: >>>4 belong&0x00ffffff 2 subarchitecture=%ld
11697: >>>4 belong&0x00ffffff 3 subarchitecture=%ld
11698: >>>4 belong&0x00ffffff 4 subarchitecture=%ld
11699: >>>4 belong&0x00ffffff 5 \b_v4t
11700: >>>4 belong&0x00ffffff 6 \b_v6
11701: >>>4 belong&0x00ffffff 7 \b_v5tej
11702: >>>4 belong&0x00ffffff 8 \b_xscale
11703: >>>4 belong&0x00ffffff 9 \b_v7
11704: >>>4 belong&0x00ffffff 10 \b_v7f
11705: >>>4 belong&0x00ffffff 11 subarchitecture=%ld
11706: >>>4 belong&0x00ffffff 12 \b_v7k
11707: >>>4 belong&0x00ffffff >12 subarchitecture=%ld
11708: # 13 m88k
11709: >>0 belong&0x00ffffff 13
11710: >>>4 belong&0x00ffffff 0 mc88000
11711: >>>4 belong&0x00ffffff 1 mc88100
11712: >>>4 belong&0x00ffffff 2 mc88110
11713: >>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld
11714: >>0 belong&0x00ffffff 14 sparc
11715: >>0 belong&0x00ffffff 15 i860g
11716: >>0 belong&0x00ffffff 16 alpha
11717: >>0 belong&0x00ffffff 17 rs6000
11718: >>0 belong&0x00ffffff 18 ppc
11719: >>>4 belong&0x00ffffff 0
11720: >>>4 belong&0x00ffffff 1 \b_601
11721: >>>4 belong&0x00ffffff 2 \b_602
11722: >>>4 belong&0x00ffffff 3 \b_603
11723: >>>4 belong&0x00ffffff 4 \b_603e
11724: >>>4 belong&0x00ffffff 5 \b_603ev
11725: >>>4 belong&0x00ffffff 6 \b_604
11726: >>>4 belong&0x00ffffff 7 \b_604e
11727: >>>4 belong&0x00ffffff 8 \b_620
11728: >>>4 belong&0x00ffffff 9 \b_650
11729: >>>4 belong&0x00ffffff 10 \b_7400
11730: >>>4 belong&0x00ffffff 11 \b_7450
11731: >>>4 belong&0x00ffffff 100 \b_970
11732: >>>4 belong&0x00ffffff >100 subarchitecture=%ld
11733: >>0 belong&0x00ffffff >18 architecture=%ld
11734: >0 belong&0x01000000 0x01000000
11735: #
11736: # 64-bit ABIs.
11737: #
11738: >>0 belong&0x00ffffff 0 64-bit architecture=%ld
11739: >>0 belong&0x00ffffff 1 64-bit architecture=%ld
11740: >>0 belong&0x00ffffff 2 64-bit architecture=%ld
11741: >>0 belong&0x00ffffff 3 64-bit architecture=%ld
11742: >>0 belong&0x00ffffff 4 64-bit architecture=%ld
11743: >>0 belong&0x00ffffff 5 64-bit architecture=%ld
11744: >>0 belong&0x00ffffff 6 64-bit architecture=%ld
11745: >>0 belong&0x00ffffff 7 x86_64
11746: >>>4 belong&0x00ffffff 0 subarchitecture=%ld
11747: >>>4 belong&0x00ffffff 1 subarchitecture=%ld
11748: >>>4 belong&0x00ffffff 2 subarchitecture=%ld
11749: >>>4 belong&0x00ffffff 3
11750: >>>4 belong&0x00ffffff 4 \b_arch1
11751: >>>4 belong&0x00ffffff >4 subarchitecture=%ld
11752: >>0 belong&0x00ffffff 8 64-bit architecture=%ld
11753: >>0 belong&0x00ffffff 9 64-bit architecture=%ld
11754: >>0 belong&0x00ffffff 10 64-bit architecture=%ld
11755: >>0 belong&0x00ffffff 11 64-bit architecture=%ld
11756: >>0 belong&0x00ffffff 12 64-bit architecture=%ld
11757: >>0 belong&0x00ffffff 13 64-bit architecture=%ld
11758: >>0 belong&0x00ffffff 14 64-bit architecture=%ld
11759: >>0 belong&0x00ffffff 15 64-bit architecture=%ld
11760: >>0 belong&0x00ffffff 16 64-bit architecture=%ld
11761: >>0 belong&0x00ffffff 17 64-bit architecture=%ld
11762: >>0 belong&0x00ffffff 18 ppc64
11763: >>>4 belong&0x00ffffff 0
11764: >>>4 belong&0x00ffffff 1 \b_601
11765: >>>4 belong&0x00ffffff 2 \b_602
11766: >>>4 belong&0x00ffffff 3 \b_603
11767: >>>4 belong&0x00ffffff 4 \b_603e
11768: >>>4 belong&0x00ffffff 5 \b_603ev
11769: >>>4 belong&0x00ffffff 6 \b_604
11770: >>>4 belong&0x00ffffff 7 \b_604e
11771: >>>4 belong&0x00ffffff 8 \b_620
11772: >>>4 belong&0x00ffffff 9 \b_650
11773: >>>4 belong&0x00ffffff 10 \b_7400
11774: >>>4 belong&0x00ffffff 11 \b_7450
11775: >>>4 belong&0x00ffffff 100 \b_970
11776: >>>4 belong&0x00ffffff >100 subarchitecture=%ld
11777: >>0 belong&0x00ffffff >18 64-bit architecture=%ld
11778:
11779:
11780: 0 name mach-o-be
1.1 misho 11781: >0 byte 0xcf 64-bit
1.1.1.3 misho 11782: >4 use mach-o-cpu
1.1 misho 11783: >12 belong 1 object
11784: >12 belong 2 executable
11785: >12 belong 3 fixed virtual memory shared library
11786: >12 belong 4 core
11787: >12 belong 5 preload executable
1.1.1.3 misho 11788: >12 belong 6 dynamically linked shared library
11789: >12 belong 7 dynamic linker
1.1 misho 11790: >12 belong 8 bundle
11791: >12 belong 9 dynamically linked shared library stub
1.1.1.3 misho 11792: >12 belong 10 dSYM companion file
11793: >12 belong 11 kext bundle
11794: >12 belong >11
1.1 misho 11795: >>12 belong x filetype=%ld
1.1.1.3 misho 11796:
11797: #
11798: 0 lelong&0xfffffffe 0xfeedface Mach-O
11799: !:strength +1
11800: >0 use \^mach-o-be
11801:
11802: 0 belong&0xfffffffe 0xfeedface Mach-O
11803: !:strength +1
11804: >0 use mach-o-be
1.1 misho 11805:
11806: #------------------------------------------------------------------------------
1.1.1.3 misho 11807: # $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
1.1 misho 11808: # macintosh description
11809: #
11810: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
11811: # Daniel Quinlan, quinlan@yggdrasil.com
11812: 11 string must\ be\ converted\ with\ BinHex BinHex binary text
11813: !:mime application/mac-binhex40
11814: >41 string x \b, version %.3s
11815:
11816: # Stuffit archives are the de facto standard of compression for Macintosh
11817: # files obtained from most archives. (franklsm@tuns.ca)
11818: 0 string SIT! StuffIt Archive (data)
1.1.1.2 misho 11819: !:mime application/x-stuffit
11820: !:apple SIT!SIT!
1.1 misho 11821: >2 string x : %s
11822: 0 string SITD StuffIt Deluxe (data)
11823: >2 string x : %s
11824: 0 string Seg StuffIt Deluxe Segment (data)
11825: >2 string x : %s
11826:
11827: # Newer StuffIt archives (grant@netbsd.org)
11828: 0 string StuffIt StuffIt Archive
11829: !:mime application/x-stuffit
1.1.1.2 misho 11830: !:apple SIT!SIT!
1.1 misho 11831: #>162 string >0 : %s
11832:
11833: # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
11834: # GRR: Too weak
11835: #0 string APPL Macintosh Application (data)
11836: #>2 string x \b: %s
11837:
11838: # Macintosh System files (franklsm@tuns.ca)
11839: # GRR: Too weak
11840: #0 string zsys Macintosh System File (data)
11841: #0 string FNDR Macintosh Finder (data)
11842: #0 string libr Macintosh Library (data)
11843: #>2 string x : %s
11844: #0 string shlb Macintosh Shared Library (data)
11845: #>2 string x : %s
11846: #0 string cdev Macintosh Control Panel (data)
11847: #>2 string x : %s
11848: #0 string INIT Macintosh Extension (data)
11849: #>2 string x : %s
11850: #0 string FFIL Macintosh Truetype Font (data)
11851: #>2 string x : %s
11852: #0 string LWFN Macintosh Postscript Font (data)
11853: #>2 string x : %s
11854:
11855: # Additional Macintosh Files (franklsm@tuns.ca)
11856: # GRR: Too weak
11857: #0 string PACT Macintosh Compact Pro Archive (data)
11858: #>2 string x : %s
11859: #0 string ttro Macintosh TeachText File (data)
11860: #>2 string x : %s
11861: #0 string TEXT Macintosh TeachText File (data)
11862: #>2 string x : %s
11863: #0 string PDF Macintosh PDF File (data)
11864: #>2 string x : %s
11865:
11866: # MacBinary format (Eric Fischer, enf@pobox.com)
11867: #
11868: # Unfortunately MacBinary doesn't really have a magic number prior
11869: # to the MacBinary III format. The checksum is really the way to
11870: # do it, but the magic file format isn't up to the challenge.
11871: #
11872: # 0 byte 0
11873: # 1 byte # filename length
11874: # 2 string # filename
11875: # 65 string # file type
11876: # 69 string # file creator
11877: # 73 byte # Finder flags
11878: # 74 byte 0
11879: # 75 beshort # vertical posn in window
11880: # 77 beshort # horiz posn in window
11881: # 79 beshort # window or folder ID
11882: # 81 byte # protected?
11883: # 82 byte 0
11884: # 83 belong # length of data segment
11885: # 87 belong # length of resource segment
11886: # 91 belong # file creation date
11887: # 95 belong # file modification date
11888: # 99 beshort # length of comment after resource
11889: # 101 byte # new Finder flags
11890: # 102 string mBIN # (only in MacBinary III)
11891: # 106 byte # char. code of file name
11892: # 107 byte # still more Finder flags
11893: # 116 belong # total file length
11894: # 120 beshort # length of add'l header
11895: # 122 byte 129 # for MacBinary II
11896: # 122 byte 130 # for MacBinary III
11897: # 123 byte 129 # minimum version that can read fmt
11898: # 124 beshort # checksum
11899: #
11900: # This attempts to use the version numbers as a magic number, requiring
11901: # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
11902: # be 0x81. This works for the files I have, but maybe not for everyone's.
11903:
11904: # Unfortunately, this magic is quite weak - MPi
11905: #122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
11906:
11907: # MacBinary I doesn't have the version number field at all, but MacBinary II
11908: # has been in use since 1987 so I hope there aren't many really old files
11909: # floating around that this will miss. The original spec calls for using
11910: # the nulls in 0, 74, and 82 as the magic number.
11911: #
11912: # Another possibility, that would also work for MacBinary I, is to use
11913: # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
11914: # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
11915: # and that 74 will be 0. So something like
11916: #
11917: # 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
11918: #
11919: # >73 byte&0x01 0x01 \b, inited
11920: # >73 byte&0x02 0x02 \b, changed
11921: # >73 byte&0x04 0x04 \b, busy
11922: # >73 byte&0x08 0x08 \b, bozo
11923: # >73 byte&0x10 0x10 \b, system
11924: # >73 byte&0x10 0x20 \b, bundle
11925: # >73 byte&0x10 0x40 \b, invisible
11926: # >73 byte&0x10 0x80 \b, locked
11927:
11928: #>65 string x \b, type "%4.4s"
11929:
11930: #>65 string 8BIM (PhotoShop)
11931: #>65 string ALB3 (PageMaker 3)
11932: #>65 string ALB4 (PageMaker 4)
11933: #>65 string ALT3 (PageMaker 3)
11934: #>65 string APPL (application)
11935: #>65 string AWWP (AppleWorks word processor)
11936: #>65 string CIRC (simulated circuit)
11937: #>65 string DRWG (MacDraw)
11938: #>65 string EPSF (Encapsulated PostScript)
11939: #>65 string FFIL (font suitcase)
11940: #>65 string FKEY (function key)
11941: #>65 string FNDR (Macintosh Finder)
11942: #>65 string GIFf (GIF image)
11943: #>65 string Gzip (GNU gzip)
11944: #>65 string INIT (system extension)
11945: #>65 string LIB\ (library)
11946: #>65 string LWFN (PostScript font)
11947: #>65 string MSBC (Microsoft BASIC)
11948: #>65 string PACT (Compact Pro archive)
11949: #>65 string PDF\ (Portable Document Format)
11950: #>65 string PICT (picture)
11951: #>65 string PNTG (MacPaint picture)
11952: #>65 string PREF (preferences)
11953: #>65 string PROJ (Think C project)
11954: #>65 string QPRJ (Think Pascal project)
11955: #>65 string SCFL (Defender scores)
11956: #>65 string SCRN (startup screen)
11957: #>65 string SITD (StuffIt Deluxe)
11958: #>65 string SPn3 (SuperPaint)
11959: #>65 string STAK (HyperCard stack)
11960: #>65 string Seg\ (StuffIt segment)
11961: #>65 string TARF (Unix tar archive)
11962: #>65 string TEXT (ASCII)
11963: #>65 string TIFF (TIFF image)
11964: #>65 string TOVF (Eudora table of contents)
11965: #>65 string WDBN (Microsoft Word word processor)
11966: #>65 string WORD (MacWrite word processor)
11967: #>65 string XLS\ (Microsoft Excel)
11968: #>65 string ZIVM (compress (.Z))
11969: #>65 string ZSYS (Pre-System 7 system file)
11970: #>65 string acf3 (Aldus FreeHand)
11971: #>65 string cdev (control panel)
1.1.1.4 misho 11972: #>65 string dfil (Desk Accessory suitcase)
1.1 misho 11973: #>65 string libr (library)
11974: #>65 string nX^d (WriteNow word processor)
11975: #>65 string nX^w (WriteNow dictionary)
11976: #>65 string rsrc (resource)
11977: #>65 string scbk (Scrapbook)
11978: #>65 string shlb (shared library)
11979: #>65 string ttro (SimpleText read-only)
11980: #>65 string zsys (system file)
11981:
11982: #>69 string x \b, creator "%4.4s"
11983:
11984: # Somewhere, Apple has a repository of registered Creator IDs. These are
11985: # just the ones that I happened to have files from and was able to identify.
11986:
11987: #>69 string 8BIM (Adobe Photoshop)
11988: #>69 string ALD3 (PageMaker 3)
11989: #>69 string ALD4 (PageMaker 4)
11990: #>69 string ALFA (Alpha editor)
11991: #>69 string APLS (Apple Scanner)
11992: #>69 string APSC (Apple Scanner)
11993: #>69 string BRKL (Brickles)
11994: #>69 string BTFT (BitFont)
11995: #>69 string CCL2 (Common Lisp 2)
11996: #>69 string CCL\ (Common Lisp)
11997: #>69 string CDmo (The Talking Moose)
11998: #>69 string CPCT (Compact Pro)
11999: #>69 string CSOm (Eudora)
12000: #>69 string DMOV (Font/DA Mover)
12001: #>69 string DSIM (DigSim)
12002: #>69 string EDIT (Macintosh Edit)
12003: #>69 string ERIK (Macintosh Finder)
12004: #>69 string EXTR (self-extracting archive)
12005: #>69 string Gzip (GNU gzip)
12006: #>69 string KAHL (Think C)
12007: #>69 string LWFU (LaserWriter Utility)
12008: #>69 string LZIV (compress)
12009: #>69 string MACA (MacWrite)
12010: #>69 string MACS (Macintosh operating system)
12011: #>69 string MAcK (MacKnowledge terminal emulator)
12012: #>69 string MLND (Defender)
12013: #>69 string MPNT (MacPaint)
12014: #>69 string MSBB (Microsoft BASIC (binary))
12015: #>69 string MSWD (Microsoft Word)
12016: #>69 string NCSA (NCSA Telnet)
12017: #>69 string PJMM (Think Pascal)
12018: #>69 string PSAL (Hunt the Wumpus)
12019: #>69 string PSI2 (Apple File Exchange)
12020: #>69 string R*ch (BBEdit)
12021: #>69 string RMKR (Resource Maker)
12022: #>69 string RSED (Resource Editor)
12023: #>69 string Rich (BBEdit)
12024: #>69 string SIT! (StuffIt)
12025: #>69 string SPNT (SuperPaint)
12026: #>69 string Unix (NeXT Mac filesystem)
12027: #>69 string VIM! (Vim editor)
12028: #>69 string WILD (HyperCard)
12029: #>69 string XCEL (Microsoft Excel)
12030: #>69 string aCa2 (Fontographer)
12031: #>69 string aca3 (Aldus FreeHand)
12032: #>69 string dosa (Macintosh MS-DOS file system)
12033: #>69 string movr (Font/DA Mover)
12034: #>69 string nX^n (WriteNow)
12035: #>69 string pdos (Apple ProDOS file system)
12036: #>69 string scbk (Scrapbook)
12037: #>69 string ttxt (SimpleText)
12038: #>69 string ufox (Foreign File Access)
12039:
12040: # Just in case...
12041:
12042: 102 string mBIN MacBinary III data with surprising version number
12043:
12044: # sas magic from Bruce Foster (bef@nwu.edu)
12045: #
12046: #0 string SAS SAS
12047: #>8 string x %s
12048: 0 string SAS SAS
12049: >24 string DATA data file
12050: >24 string CATALOG catalog
12051: >24 string INDEX data file index
12052: >24 string VIEW data view
12053: # sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
12054: #
12055: 0x54 string SAS SAS 7+
12056: >0x9C string DATA data file
12057: >0x9C string CATALOG catalog
12058: >0x9C string INDEX data file index
12059: >0x9C string VIEW data view
12060:
12061: # spss magic for SPSS system and portable files,
12062: # from Bruce Foster (bef@nwu.edu).
12063:
12064: 0 long 0xc1e2c3c9 SPSS Portable File
12065: >40 string x %s
12066:
12067: 0 string $FL2 SPSS System File
12068: >24 string x %s
12069:
12070: # Macintosh filesystem data
12071: # From "Tom N Harris" <telliamed@mac.com>
12072: # Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
12073: # The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
12074: # entries depend on the data arithmetic added after v.35
12075: # There's also some Pascal strings in here, ditto...
12076:
12077: # The boot block signature, according to IM:Files, is
12078: # "for HFS volumes, this field always contains the value 0x4C4B."
12079: # But if this is true for MFS or HFS+ volumes, I don't know.
12080: # Alternatively, the boot block is supposed to be zeroed if it's
12081: # unused, so a simply >0 should suffice.
12082:
12083: 0x400 beshort 0xD2D7 Macintosh MFS data
12084: >0 beshort 0x4C4B (bootable)
12085: >0x40a beshort &0x8000 (locked)
12086: >0x402 beldate-0x7C25B080 x created: %s,
12087: >0x406 beldate-0x7C25B080 >0 last backup: %s,
12088: >0x414 belong x block size: %d,
12089: >0x412 beshort x number of blocks: %d,
12090: >0x424 pstring x volume name: %s
12091:
1.1.1.3 misho 12092: # "BD" gives many false positives
1.1 misho 12093: #0x400 beshort 0x4244 Macintosh HFS data
12094: #>0 beshort 0x4C4B (bootable)
12095: #>0x40a beshort &0x8000 (locked)
12096: #>0x40a beshort ^0x0100 (mounted)
12097: #>0x40a beshort &0x0200 (spared blocks)
12098: #>0x40a beshort &0x0800 (unclean)
12099: #>0x47C beshort 0x482B (Embedded HFS+ Volume)
12100: #>0x402 beldate-0x7C25B080 x created: %s,
12101: #>0x406 beldate-0x7C25B080 x last modified: %s,
12102: #>0x440 beldate-0x7C25B080 >0 last backup: %s,
12103: #>0x414 belong x block size: %d,
12104: #>0x412 beshort x number of blocks: %d,
12105: #>0x424 pstring x volume name: %s
12106:
12107: 0x400 beshort 0x482B Macintosh HFS Extended
12108: >&0 beshort x version %d data
12109: >0 beshort 0x4C4B (bootable)
12110: >0x404 belong ^0x00000100 (mounted)
12111: >&2 belong &0x00000200 (spared blocks)
12112: >&2 belong &0x00000800 (unclean)
12113: >&2 belong &0x00008000 (locked)
12114: >&6 string x last mounted by: '%.4s',
12115: # really, that should be treated as a belong and we print a string
12116: # based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
12117: >&14 beldate-0x7C25B080 x created: %s,
12118: # only the creation date is local time, all other timestamps in HFS+ are UTC.
12119: >&18 bedate-0x7C25B080 x last modified: %s,
12120: >&22 bedate-0x7C25B080 >0 last backup: %s,
12121: >&26 bedate-0x7C25B080 >0 last checked: %s,
12122: >&38 belong x block size: %d,
12123: >&42 belong x number of blocks: %d,
12124: >&46 belong x free blocks: %d
12125:
12126: # I don't think this is really necessary since it doesn't do much and
12127: # anything with a valid driver descriptor will also have a valid
12128: # partition map
12129: #0 beshort 0x4552 Apple Device Driver data
12130: #>&24 beshort =1 \b, MacOS
12131:
12132: # Is that the partition type a cstring or a pstring? Well, IM says "strings
12133: # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
12134: # cstring. Of course, partitions can contain more than four entries, but
12135: # what're you gonna do?
12136: # GRR: This magic is too weak, it is just "PM"
12137: #0x200 beshort 0x504D Apple Partition data
12138: #>0x2 beshort x (block size: %d):
12139: #>0x230 string x first type: %s,
12140: #>0x210 string x name: %s,
12141: #>0x254 belong x number of blocks: %d,
12142: #>0x400 beshort 0x504D
12143: #>>0x430 string x second type: %s,
12144: #>>0x410 string x name: %s,
12145: #>>0x454 belong x number of blocks: %d,
12146: #>>0x600 beshort 0x504D
12147: #>>>0x630 string x third type: %s,
12148: #>>>0x610 string x name: %s,
12149: #>>>0x654 belong x number of blocks: %d,
12150: #>>0x800 beshort 0x504D
12151: #>>>0x830 string x fourth type: %s,
12152: #>>>0x810 string x name: %s,
12153: #>>>0x854 belong x number of blocks: %d,
12154: #>>>0xa00 beshort 0x504D
12155: #>>>>0xa30 string x fifth type: %s,
12156: #>>>>0xa10 string x name: %s,
12157: #>>>>0xa54 belong x number of blocks: %d
12158: #>>>0xc00 beshort 0x504D
12159: #>>>>0xc30 string x sixth type: %s,
12160: #>>>>0xc10 string x name: %s,
12161: #>>>>0xc54 belong x number of blocks: %d
12162: ## AFAIK, only the signature is different
12163: #0x200 beshort 0x5453 Apple Old Partition data
12164: #>0x2 beshort x block size: %d,
12165: #>0x230 string x first type: %s,
12166: #>0x210 string x name: %s,
12167: #>0x254 belong x number of blocks: %d,
12168: #>0x400 beshort 0x504D
12169: #>>0x430 string x second type: %s,
12170: #>>0x410 string x name: %s,
12171: #>>0x454 belong x number of blocks: %d,
12172: #>>0x800 beshort 0x504D
12173: #>>>0x830 string x third type: %s,
12174: #>>>0x810 string x name: %s,
12175: #>>>0x854 belong x number of blocks: %d,
12176: #>>>0xa00 beshort 0x504D
12177: #>>>>0xa30 string x fourth type: %s,
12178: #>>>>0xa10 string x name: %s,
12179: #>>>>0xa54 belong x number of blocks: %d
12180:
12181: # From: Remi Mommsen <mommsen@slac.stanford.edu>
12182: 0 string BOMStore Mac OS X bill of materials (BOM) file
12183:
1.1.1.2 misho 12184: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
12185: # URL: http://en.wikipedia.org/wiki/Datafork_TrueType
12186: # Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
12187: # TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
12188: # don't know what they mean.
12189: 0 belong 0x100
12190: >(0x4.L+24) beshort x
12191: >>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
12192: >>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
12193: >>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
12194: >>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
12195:
1.1 misho 12196: #------------------------------------------------------------------------------
1.1.1.3 misho 12197: # $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
12198: # MacOS files
12199: #
12200:
12201: 0 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file
12202:
12203: #------------------------------------------------------------------------------
12204: # $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
1.1 misho 12205: # magic: file(1) magic for magic files
12206: #
1.1.1.3 misho 12207: 0 string/t #\ Magic magic text file for file(1) cmd
1.1 misho 12208: 0 lelong 0xF11E041C magic binary file for file(1) cmd
12209: >4 lelong x (version %d) (little endian)
12210: 0 belong 0xF11E041C magic binary file for file(1) cmd
12211: >4 belong x (version %d) (big endian)
12212: #------------------------------------------------------------------------------
1.1.1.3 misho 12213: # $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
1.1 misho 12214: # mail.news: file(1) magic for mail and news
12215: #
12216: # Unfortunately, saved netnews also has From line added in some news software.
12217: #0 string From mail text
1.1.1.3 misho 12218: 0 string/t Relay-Version: old news text
12219: !:mime message/rfc822
12220: 0 string/t #!\ rnews batched news text
1.1 misho 12221: !:mime message/rfc822
1.1.1.3 misho 12222: 0 string/t N#!\ rnews mailed, batched news text
1.1 misho 12223: !:mime message/rfc822
1.1.1.3 misho 12224: 0 string/t Forward\ to mail forwarding text
1.1 misho 12225: !:mime message/rfc822
1.1.1.3 misho 12226: 0 string/t Pipe\ to mail piping text
1.1 misho 12227: !:mime message/rfc822
1.1.1.3 misho 12228: 0 string/tc delivered-to: SMTP mail text
1.1 misho 12229: !:mime message/rfc822
1.1.1.3 misho 12230: 0 string/tc return-path: SMTP mail text
1.1 misho 12231: !:mime message/rfc822
1.1.1.3 misho 12232: 0 string/t Path: news text
1.1 misho 12233: !:mime message/news
1.1.1.3 misho 12234: 0 string/t Xref: news text
1.1 misho 12235: !:mime message/news
1.1.1.3 misho 12236: 0 string/t From: news or mail text
1.1 misho 12237: !:mime message/rfc822
1.1.1.3 misho 12238: 0 string/t Article saved news text
1.1 misho 12239: !:mime message/news
1.1.1.3 misho 12240: 0 string/t BABYL Emacs RMAIL text
12241: 0 string/t Received: RFC 822 mail text
1.1 misho 12242: !:mime message/rfc822
1.1.1.3 misho 12243: 0 string/t MIME-Version: MIME entity text
12244: #0 string/t Content- MIME entity text
1.1 misho 12245:
12246: # TNEF files...
12247: 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
1.1.1.3 misho 12248: !:mime application/vnd.ms-tnef
1.1 misho 12249:
12250: # From: Kevin Sullivan <ksulliva@psc.edu>
12251: 0 string *mbx* MBX mail folder
12252:
12253: # From: Simon Matter <simon.matter@invoca.ch>
12254: 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
12255:
12256: # JAM(mbp) Fidonet message area databases
12257: # JHR file
12258: 0 string JAM\0 JAM message area header file
12259: >12 leshort >0 (%d messages)
12260:
12261: # Squish Fidonet message area databases
12262: # SQD file (requires at least one message in the area)
12263: # XXX: Weak magic
12264: #256 leshort 0xAFAE4453 Squish message area data file
12265: #>4 leshort >0 (%d messages)
12266:
12267: #0 string \<!--\ MHonArc text/html; x-type=mhonarc
12268:
1.1.1.3 misho 12269: # Cyrus: file(1) magic for compiled Cyrus sieve scripts
12270: # URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
12271: # URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
12272: # From: Philipp Hahn <hahn@univention.de>
12273:
12274: # Compiled Cyrus sieve script
12275: 0 string CyrSBytecode Cyrus sieve bytecode data,
12276: >12 belong =1 version 1, big-endian
12277: >12 lelong =1 version 1, little-endian
12278: >12 belong x version %d, network-endian
12279: #------------------------------------------------------------------------------
12280: # $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $
12281: # make: file(1) magic for makefiles
12282: #
12283: 0 regex \^CFLAGS makefile script text
12284: !:mime text/x-makefile
12285: 0 regex \^LDFLAGS makefile script text
12286: !:mime text/x-makefile
12287: 0 regex \^all: makefile script text
12288: !:mime text/x-makefile
12289: 0 regex \^.PRECIOUS makefile script text
12290: !:mime text/x-makefile
12291:
12292: 0 regex \^SUBDIRS automake makefile script text
12293: !:mime text/x-makefile
12294:
1.1 misho 12295: #------------------------------------------------------------------------------
1.1.1.3 misho 12296: # $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
1.1 misho 12297: # maple: file(1) magic for maple files
12298: # "H. Nanosecond" <aldomel@ix.netcom.com>
12299: # Maple V release 4, a multi-purpose math program
12300: #
12301:
12302: # maple library .lib
12303: 0 string \000MVR4\nI MapleVr4 library
12304:
12305: # .ind
12306: # no magic for these :-(
12307: # they are compiled indexes for maple files
12308:
12309: # .hdb
12310: 0 string \000\004\000\000 Maple help database
12311:
12312: # .mhp
12313: # this has the form <PACKAGE=name>
12314: 0 string \<PACKAGE= Maple help file
12315: 0 string \<HELP\ NAME= Maple help file
12316: 0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
12317: #0 string #\ Newton Maple help file, old style
12318: 0 string #\ daub Maple help file, old style
12319: #0 string #=========== Maple help file, old style
12320:
12321: # .mws
12322: 0 string \000\000\001\044\000\221 Maple worksheet
12323: #this is anomalous
12324: 0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
12325: # this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
12326: # that is {VERSION major_version miunor_version computer_type version_string}
12327: 0 string {VERSION\ Maple worksheet
12328: >9 string >\0 version %.1s.
1.1.1.3 misho 12329: >>11 string >\0 %.1s
1.1 misho 12330:
12331: # .mps
12332: 0 string \0\0\001$ Maple something
12333: # from byte 4 it is either 'nul E' or 'soh R'
12334: # I think 'nul E' means a file that was saved as a different name
12335: # a sort of revision marking
12336: # 'soh R' means new
12337: >4 string \000\105 An old revision
12338: >4 string \001\122 The latest save
12339:
12340: # .mpl
12341: # some of these are the same as .mps above
12342: #0000000 000 000 001 044 000 105 same as .mps
12343: #0000000 000 000 001 044 001 122 same as .mps
12344:
12345: 0 string #\n##\ <SHAREFILE= Maple something
12346: 0 string \n#\n##\ <SHAREFILE= Maple something
12347: 0 string ##\ <SHAREFILE= Maple something
12348: 0 string #\r##\ <SHAREFILE= Maple something
12349: 0 string \r#\r##\ <SHAREFILE= Maple something
12350: 0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
1.1.1.3 misho 12351: #--------------------------------------------
12352: # marc21: file(1) magic for MARC 21 Format
12353: #
12354: # Kevin Ford (kefo@loc.gov)
12355: #
12356: # MARC21 formats are for the representation and communication
12357: # of bibliographic and related information in machine-readable
12358: # form. For more info, see http://www.loc.gov/marc/
12359:
12360:
12361: # leader position 20-21 must be 45
12362: 20 string 45
12363:
12364: # leader starts with 5 digits, followed by codes specific to MARC format
12365: >0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
12366: !:mime application/marc
12367: >0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority
12368: !:mime application/marc
12369: >0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
12370: !:mime application/marc
12371: 0 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification
12372: !:mime application/marc
12373: >0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community
12374: !:mime application/marc
12375:
12376: # leader position 22-23, should be "00" but is it?
12377: >0 regex/1 (^.{21})([^0]{2}) (non-conforming)
12378: !:mime application/marc
1.1 misho 12379:
12380: #------------------------------------------------------------------------------
1.1.1.2 misho 12381: # $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 12382: # mathcad: file(1) magic for Mathcad documents
12383: # URL: http://www.mathsoft.com/
12384: # From: Josh Triplett <josh@freedesktop.org>
12385:
12386: 0 string .MCAD\t Mathcad document
1.1.1.2 misho 12387:
1.1 misho 12388: #------------------------------------------------------------------------------
1.1.1.2 misho 12389: # $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
1.1 misho 12390: # mathematica: file(1) magic for mathematica files
12391: # "H. Nanosecond" <aldomel@ix.netcom.com>
12392: # Mathematica a multi-purpose math program
12393: # versions 2.2 and 3.0
12394:
12395: #mathematica .mb
12396: 0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
12397: 0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
12398:
12399: # .ma
12400: # multiple possibilites:
12401:
12402: 0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
12403: #>41 string >\0 %s
12404:
12405: #0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
12406:
12407: #0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
12408: #>675 string >\0 %s #doesn't work well
12409:
12410: # there may be 'cr' instread of 'nl' in some does this matter?
12411:
12412: # generic:
12413: 0 string (*^\r\r::[\011 Mathematica notebook version 2.x
12414: 0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
12415: 0 string (*^\015 Mathematica notebook version 2.x
12416: 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
12417: 0 string (*^\r::[\011 Mathematica notebook version 2.x
12418: 0 string (*^\r\n::[\011 Mathematica notebook version 2.x
12419: 0 string (*^\n\n::[\011 Mathematica notebook version 2.x
12420: 0 string (*^\n::[\011 Mathematica notebook version 2.x
12421:
12422:
12423: # Mathematica .mx files
12424:
12425: #0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
12426: 0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
12427: #>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
12428: # >71... is optional
12429: >88 string >\0 from %s
12430:
12431:
12432: # Mathematica files PBF:
12433: # 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
12434: 0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
12435:
12436: # .ml files These are menu resources I think
12437: # these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
12438: # how to put that into a magic rule?
12439: 4 string \ A~ MAthematica .ml file
12440:
12441: # .nb files
12442: #too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
12443: 0 string (*********************** Mathematica 3.0 notebook
12444:
12445: # other (* matches it is a comment start in these langs
12446: # GRR: Too weak; also matches other languages e.g. ML
12447: #0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
12448:
12449: #########################
12450: # MatLab v5
12451: 0 string MATLAB Matlab v5 mat-file
12452: >126 short 0x494d (big endian)
12453: >>124 beshort x version 0x%04x
12454: >126 short 0x4d49 (little endian)
12455: >>124 leshort x version 0x%04x
12456:
12457:
12458: #------------------------------------------------------------------------------
1.1.1.3 misho 12459: # $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
1.1 misho 12460: # matroska: file(1) magic for Matroska files
12461: #
12462: # See http://www.matroska.org/
12463: #
12464:
12465: # EBML id:
12466: 0 belong 0x1a45dfa3
12467: # DocType id:
1.1.1.3 misho 12468: >4 search/4096 \x42\x82
1.1 misho 12469: # DocType contents:
1.1.1.3 misho 12470: >>&1 string webm WebM
12471: !:mime video/webm
12472: >>&1 string matroska Matroska data
1.1.1.2 misho 12473: !:mime video/x-matroska
1.1 misho 12474:
12475: #------------------------------------------------------------------------------
1.1.1.2 misho 12476: # $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
1.1 misho 12477: # Mavroyanopoulos Nikos <nmav@hellug.gr>
12478: # mcrypt: file(1) magic for mcrypt 2.2.x;
12479: 0 string \0m\3 mcrypt 2.5 encrypted data,
12480: >4 string >\0 algorithm: %s,
12481: >>&1 leshort >0 keysize: %d bytes,
12482: >>>&0 string >\0 mode: %s,
12483:
12484: 0 string \0m\2 mcrypt 2.2 encrypted data,
12485: >3 byte 0 algorithm: blowfish-448,
12486: >3 byte 1 algorithm: DES,
12487: >3 byte 2 algorithm: 3DES,
12488: >3 byte 3 algorithm: 3-WAY,
12489: >3 byte 4 algorithm: GOST,
12490: >3 byte 6 algorithm: SAFER-SK64,
12491: >3 byte 7 algorithm: SAFER-SK128,
12492: >3 byte 8 algorithm: CAST-128,
12493: >3 byte 9 algorithm: xTEA,
12494: >3 byte 10 algorithm: TWOFISH-128,
12495: >3 byte 11 algorithm: RC2,
12496: >3 byte 12 algorithm: TWOFISH-192,
12497: >3 byte 13 algorithm: TWOFISH-256,
12498: >3 byte 14 algorithm: blowfish-128,
12499: >3 byte 15 algorithm: blowfish-192,
12500: >3 byte 16 algorithm: blowfish-256,
12501: >3 byte 100 algorithm: RC6,
12502: >3 byte 101 algorithm: IDEA,
12503: >4 byte 0 mode: CBC,
12504: >4 byte 1 mode: ECB,
12505: >4 byte 2 mode: CFB,
12506: >4 byte 3 mode: OFB,
12507: >4 byte 4 mode: nOFB,
12508: >5 byte 0 keymode: 8bit
12509: >5 byte 1 keymode: 4bit
12510: >5 byte 2 keymode: SHA-1 hash
12511: >5 byte 3 keymode: MD5 hash
12512:
12513: #------------------------------------------------------------------------------
1.1.1.2 misho 12514: # $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 12515: # mercurial: file(1) magic for Mercurial changeset bundles
12516: # http://www.selenic.com/mercurial/wiki/
12517: #
12518: # Jesse Glick (jesse.glick@sun.com)
12519: #
12520:
12521: 0 string HG10 Mercurial changeset bundle
12522: >4 string UN (uncompressed)
12523: >4 string GZ (gzip compressed)
12524: >4 string BZ (bzip2 compressed)
1.1.1.2 misho 12525:
1.1 misho 12526: #------------------------------------------------------------------------------
1.1.1.3 misho 12527: # $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
12528: # metastore: file(1) magic for metastore files
12529: # From: Thomas Wissen
12530: # see http://david.hardeman.nu/software.php#metastore
12531: 0 string MeTaSt00r3 Metastore data file,
12532: >10 bequad x version %0llx
12533:
12534: #------------------------------------------------------------------------------
12535: # $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
1.1 misho 12536: # mime: file(1) magic for MIME encoded files
12537: #
1.1.1.3 misho 12538: 0 string/t Content-Type:\
1.1 misho 12539: >14 string >\0 %s
1.1.1.3 misho 12540: 0 string/t Content-Type:
1.1 misho 12541: >13 string >\0 %s
12542:
12543: #------------------------------------------------------------------------------
1.1.1.3 misho 12544: # $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
12545: # mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
12546: # and DEC Ultrix
1.1 misho 12547: #
12548: 0 beshort 0x0160 MIPSEB ECOFF executable
12549: >20 beshort 0407 (impure)
12550: >20 beshort 0410 (swapped)
12551: >20 beshort 0413 (paged)
12552: >8 belong >0 not stripped
12553: >8 belong 0 stripped
12554: >22 byte x - version %ld
1.1.1.3 misho 12555: >23 byte x \b.%ld
1.1 misho 12556: #
12557: 0 beshort 0x0162 MIPSEL-BE ECOFF executable
12558: >20 beshort 0407 (impure)
12559: >20 beshort 0410 (swapped)
12560: >20 beshort 0413 (paged)
12561: >8 belong >0 not stripped
12562: >8 belong 0 stripped
12563: >23 byte x - version %d
1.1.1.3 misho 12564: >22 byte x \b.%ld
1.1 misho 12565: #
12566: 0 beshort 0x6001 MIPSEB-LE ECOFF executable
12567: >20 beshort 03401 (impure)
12568: >20 beshort 04001 (swapped)
12569: >20 beshort 05401 (paged)
12570: >8 belong >0 not stripped
12571: >8 belong 0 stripped
12572: >23 byte x - version %d
1.1.1.3 misho 12573: >22 byte x \b.%ld
1.1 misho 12574: #
12575: 0 beshort 0x6201 MIPSEL ECOFF executable
12576: >20 beshort 03401 (impure)
12577: >20 beshort 04001 (swapped)
12578: >20 beshort 05401 (paged)
12579: >8 belong >0 not stripped
12580: >8 belong 0 stripped
12581: >23 byte x - version %ld
1.1.1.3 misho 12582: >22 byte x \b.%ld
1.1 misho 12583: #
12584: # MIPS 2 additions
12585: #
12586: 0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
12587: >20 beshort 0407 (impure)
12588: >20 beshort 0410 (swapped)
12589: >20 beshort 0413 (paged)
12590: >8 belong >0 not stripped
12591: >8 belong 0 stripped
12592: >22 byte x - version %ld
1.1.1.3 misho 12593: >23 byte x \b.%ld
1.1 misho 12594: #
12595: 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
12596: >20 beshort 0407 (impure)
12597: >20 beshort 0410 (swapped)
12598: >20 beshort 0413 (paged)
12599: >8 belong >0 not stripped
12600: >8 belong 0 stripped
12601: >22 byte x - version %ld
1.1.1.3 misho 12602: >23 byte x \b.%ld
1.1 misho 12603: #
12604: 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
12605: >20 beshort 03401 (impure)
12606: >20 beshort 04001 (swapped)
12607: >20 beshort 05401 (paged)
12608: >8 belong >0 not stripped
12609: >8 belong 0 stripped
12610: >23 byte x - version %ld
1.1.1.3 misho 12611: >22 byte x \b.%ld
1.1 misho 12612: #
12613: 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
12614: >20 beshort 03401 (impure)
12615: >20 beshort 04001 (swapped)
12616: >20 beshort 05401 (paged)
12617: >8 belong >0 not stripped
12618: >8 belong 0 stripped
12619: >23 byte x - version %ld
1.1.1.3 misho 12620: >22 byte x \b.%ld
1.1 misho 12621: #
12622: # MIPS 3 additions
12623: #
12624: 0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
12625: >20 beshort 0407 (impure)
12626: >20 beshort 0410 (swapped)
12627: >20 beshort 0413 (paged)
12628: >8 belong >0 not stripped
12629: >8 belong 0 stripped
12630: >22 byte x - version %ld
1.1.1.3 misho 12631: >23 byte x \b.%ld
1.1 misho 12632: #
12633: 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
12634: >20 beshort 0407 (impure)
12635: >20 beshort 0410 (swapped)
12636: >20 beshort 0413 (paged)
12637: >8 belong >0 not stripped
12638: >8 belong 0 stripped
12639: >22 byte x - version %ld
1.1.1.3 misho 12640: >23 byte x \b.%ld
1.1 misho 12641: #
12642: 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
12643: >20 beshort 03401 (impure)
12644: >20 beshort 04001 (swapped)
12645: >20 beshort 05401 (paged)
12646: >8 belong >0 not stripped
12647: >8 belong 0 stripped
12648: >23 byte x - version %ld
1.1.1.3 misho 12649: >22 byte x \b.%ld
1.1 misho 12650: #
12651: 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
12652: >20 beshort 03401 (impure)
12653: >20 beshort 04001 (swapped)
12654: >20 beshort 05401 (paged)
12655: >8 belong >0 not stripped
12656: >8 belong 0 stripped
12657: >23 byte x - version %ld
1.1.1.3 misho 12658: >22 byte x \b.%ld
1.1 misho 12659: #
1.1.1.3 misho 12660: 0 beshort 0x180 MIPSEB Ucode
12661: 0 beshort 0x182 MIPSEL-BE Ucode
1.1 misho 12662:
12663: #------------------------------------------------------------------------------
1.1.1.2 misho 12664: # $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
1.1 misho 12665: # mirage: file(1) magic for Mirage executables
12666: #
12667: # XXX - byte order?
12668: #
12669: 0 long 31415 Mirage Assembler m.out executable
1.1.1.2 misho 12670:
1.1 misho 12671: #-----------------------------------------------------------------------------
1.1.1.3 misho 12672: # $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $
1.1 misho 12673: # misctools: file(1) magic for miscellaneous UNIX tools.
12674: #
12675: 0 search/1 %%!! X-Post-It-Note text
12676: 0 string/c BEGIN:VCALENDAR vCalendar calendar file
1.1.1.3 misho 12677: !:mime text/calendar
1.1 misho 12678: 0 string/c BEGIN:VCARD vCard visiting card
12679: !:mime text/x-vcard
12680:
12681: # Summary: Libtool library file
12682: # Extension: .la
12683: # Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
12684: 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
12685:
12686: # Summary: Libtool object file
12687: # Extension: .lo
12688: # Submitted by: Abel Cheung <abelcheung@gmail.com>
12689: 0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
12690:
1.1.1.2 misho 12691: # From: Daniel Novotny <dnovotny@redhat.com>
12692: 0 string MDMP\x93\xA7 MDMP crash report data
12693:
1.1 misho 12694: #------------------------------------------------------------------------------
1.1.1.2 misho 12695: # $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 12696: # mkid: file(1) magic for mkid(1) databases
12697: #
12698: # ID is the binary tags database produced by mkid(1).
12699: #
12700: # XXX - byte order?
12701: #
12702: 0 string \311\304 ID tags data
12703: >2 short >0 version %d
12704:
12705: #------------------------------------------------------------------------------
1.1.1.2 misho 12706: # $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
1.1 misho 12707: # mlssa: file(1) magic for MLSSA datafiles
12708: #
12709: 0 lelong 0xffffabcd MLSSA datafile,
12710: >4 leshort x algorithm %d,
12711: >10 lelong x %d samples
12712:
12713: #------------------------------------------------------------------------------
1.1.1.2 misho 12714: # $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
1.1 misho 12715: # mmdf: file(1) magic for MMDF mail files
12716: #
12717: 0 string \001\001\001\001 MMDF mailbox
1.1.1.2 misho 12718:
1.1 misho 12719: #------------------------------------------------------------------------------
1.1.1.3 misho 12720: # $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $
1.1 misho 12721: # modem: file(1) magic for modem programs
12722: #
12723: # From: Florian La Roche <florian@knorke.saar.de>
12724: 1 string PC\ Research,\ Inc Digifax-G3-File
12725: >29 byte 1 \b, fine resolution
12726: >29 byte 0 \b, normal resolution
12727:
12728: 0 short 0x0100 raw G3 data, byte-padded
12729: 0 short 0x1400 raw G3 data
12730: #
12731: # Magic data for vgetty voice formats
12732: # (Martin Seine & Marc Eberhard)
12733:
12734: #
12735: # raw modem data version 1
12736: #
12737: 0 string RMD1 raw modem data
12738: >4 string >\0 (%s /
12739: >20 short >0 compression type 0x%04x)
12740:
12741: #
12742: # portable voice format 1
12743: #
12744: 0 string PVF1\n portable voice format
12745: >5 string >\0 (binary %s)
12746:
12747: #
12748: # portable voice format 2
12749: #
12750: 0 string PVF2\n portable voice format
12751: >5 string >\0 (ascii %s)
12752:
12753:
12754: #------------------------------------------------------------------------------
1.1.1.2 misho 12755: # $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
1.1 misho 12756: # motorola: file(1) magic for Motorola 68K and 88K binaries
12757: #
12758: # 68K
12759: #
12760: 0 beshort 0520 mc68k COFF
12761: >18 beshort ^00000020 object
12762: >18 beshort &00000020 executable
12763: >12 belong >0 not stripped
12764: >168 string .lowmem Apple toolbox
12765: >20 beshort 0407 (impure)
12766: >20 beshort 0410 (pure)
12767: >20 beshort 0413 (demand paged)
12768: >20 beshort 0421 (standalone)
12769: 0 beshort 0521 mc68k executable (shared)
12770: >12 belong >0 not stripped
12771: 0 beshort 0522 mc68k executable (shared demand paged)
12772: >12 belong >0 not stripped
12773: #
12774: # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
12775: #
12776: 0 beshort 0554 68K BCS executable
12777: #
12778: # 88K
12779: #
12780: # Motorola/88Open BCS
12781: #
12782: 0 beshort 0555 88K BCS executable
12783: #
12784: # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
12785: 0 string S0 Motorola S-Record; binary data in text format
12786:
12787: # ATARI ST relocatable PRG
12788: #
12789: # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
12790: # (according to Roland Waldi, Oct 21, 1987)
12791: # besides the magic 0x601a, the text segment size is checked to be
12792: # not larger than 1 MB (which is a lot on ST).
12793: # The additional 0x601b distinction I took from Doug Lee's magic.
12794: 0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
12795: >2 belong x (txt=%ld,
12796: >6 belong x dat=%ld,
12797: >10 belong x bss=%ld,
12798: >14 belong x sym=%ld)
12799: 0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
12800: >2 belong x (txt=%ld,
12801: >6 belong x dat=%ld,
12802: >10 belong x bss=%ld,
12803: >14 belong x sym=%ld)
12804:
12805: # Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
12806: 0 beshort 0x601A Atari 68xxx executable,
12807: >2 belong x text len %lu,
12808: >6 belong x data len %lu,
12809: >10 belong x BSS len %lu,
12810: >14 belong x symboltab len %lu,
12811: >18 belong 0
12812: >22 belong &0x01 fastload flag,
12813: >22 belong &0x02 may be loaded to alternate RAM,
12814: >22 belong &0x04 malloc may be from alternate RAM,
12815: >22 belong x flags: 0x%lX,
12816: >26 beshort 0 no relocation tab
12817: >26 beshort !0 + relocation tab
12818: >30 string SFX [Self-Extracting LZH SFX archive]
12819: >38 string SFX [Self-Extracting LZH SFX archive]
12820: >44 string ZIP! [Self-Extracting ZIP SFX archive]
12821:
12822: 0 beshort 0x0064 Atari 68xxx CPX file
12823: >8 beshort x (version %04lx)
12824:
12825: #------------------------------------------------------------------------------
1.1.1.2 misho 12826: # $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 12827: # mozilla: file(1) magic for Mozilla XUL fastload files
12828: # (XUL.mfasl and XPC.mfasl)
12829: # URL: http://www.mozilla.org/
12830: # From: Josh Triplett <josh@freedesktop.org>
12831:
12832: 0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
12833:
12834: #------------------------------------------------------------------------------
1.1.1.3 misho 12835: # $File: msdos,v 1.85 2013/03/09 22:36:00 christos Exp $
1.1 misho 12836: # msdos: file(1) magic for MS-DOS files
12837: #
12838:
12839: # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
1.1.1.3 misho 12840: # updated by Joerg Jenderek at Oct 2008,Apr 2011
12841: 0 string/t @
1.1.1.2 misho 12842: >1 string/cW \ echo\ off DOS batch file text
1.1 misho 12843: !:mime text/x-msdos-batch
1.1.1.2 misho 12844: >1 string/cW echo\ off DOS batch file text
1.1 misho 12845: !:mime text/x-msdos-batch
1.1.1.3 misho 12846: >1 string/cW rem DOS batch file text
1.1 misho 12847: !:mime text/x-msdos-batch
1.1.1.2 misho 12848: >1 string/cW set\ DOS batch file text
1.1 misho 12849: !:mime text/x-msdos-batch
12850:
12851:
12852: # OS/2 batch files are REXX. the second regex is a bit generic, oh well
12853: # the matched commands seem to be common in REXX and uncommon elsewhere
12854: 100 search/0xffff rxfuncadd
12855: >100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
12856: 100 search/0xffff say
12857: >100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
12858:
12859: 0 leshort 0x14c MS Windows COFF Intel 80386 object file
12860: #>4 ledate x stamp %s
12861: 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
12862: #>4 ledate x stamp %s
12863: 0 leshort 0x184 MS Windows COFF Alpha object file
12864: #>4 ledate x stamp %s
12865: 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
12866: #>4 ledate x stamp %s
12867: 0 leshort 0x1f0 MS Windows COFF PowerPC object file
12868: #>4 ledate x stamp %s
12869: 0 leshort 0x290 MS Windows COFF PA-RISC object file
12870: #>4 ledate x stamp %s
12871:
1.1.1.3 misho 12872: # Tests for various EXE types.
1.1 misho 12873: #
1.1.1.3 misho 12874: # Many of the compressed formats were extraced from IDARC 1.23 source code.
1.1 misho 12875: #
1.1.1.3 misho 12876: 0 string/b MZ
1.1 misho 12877: !:mime application/x-dosexec
1.1.1.3 misho 12878: # All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
12879: >0x18 leshort <0x40 MS-DOS executable
12880: # These traditional tests usually work but not always. When test quality support is
12881: # implemented these can be turned on.
12882: #>>0x18 leshort 0x1c (Borland compiler)
12883: #>>0x18 leshort 0x1e (MS compiler)
1.1 misho 12884:
1.1.1.3 misho 12885: # If the relocation table is 0x40 or more bytes into the file, it's definitely
12886: # not a DOS EXE.
1.1 misho 12887: >0x18 leshort >0x3f
1.1.1.3 misho 12888:
12889: # Maybe it's a PE?
1.1 misho 12890: >>(0x3c.l) string PE\0\0 PE
1.1.1.3 misho 12891: >>>(0x3c.l+24) leshort 0x010b \b32 executable
12892: >>>(0x3c.l+24) leshort 0x020b \b32+ executable
12893: >>>(0x3c.l+24) leshort 0x0107 ROM image
12894: >>>(0x3c.l+24) default x Unknown PE signature
12895: >>>>&0 leshort x 0x%x
12896: >>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
12897: >>>(0x3c.l+92) leshort 1 (native)
12898: >>>(0x3c.l+92) leshort 2 (GUI)
12899: >>>(0x3c.l+92) leshort 3 (console)
12900: >>>(0x3c.l+92) leshort 7 (POSIX)
12901: >>>(0x3c.l+92) leshort 9 (Windows CE)
1.1 misho 12902: >>>(0x3c.l+92) leshort 10 (EFI application)
12903: >>>(0x3c.l+92) leshort 11 (EFI boot service driver)
12904: >>>(0x3c.l+92) leshort 12 (EFI runtime driver)
1.1.1.3 misho 12905: >>>(0x3c.l+92) leshort 13 (EFI ROM)
12906: >>>(0x3c.l+92) leshort 14 (XBOX)
12907: >>>(0x3c.l+92) leshort 15 (Windows boot application)
12908: >>>(0x3c.l+92) default x (Unknown subsystem
12909: >>>>&0 leshort x 0x%x)
1.1 misho 12910: >>>(0x3c.l+4) leshort 0x14c Intel 80386
12911: >>>(0x3c.l+4) leshort 0x166 MIPS R4000
1.1.1.3 misho 12912: >>>(0x3c.l+4) leshort 0x168 MIPS R10000
1.1 misho 12913: >>>(0x3c.l+4) leshort 0x184 Alpha
1.1.1.3 misho 12914: >>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3
12915: >>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4
12916: >>>(0x3c.l+4) leshort 0x1c0 ARM
12917: >>>(0x3c.l+4) leshort 0x1c2 ARM Thumb
12918: >>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb
1.1 misho 12919: >>>(0x3c.l+4) leshort 0x1f0 PowerPC
12920: >>>(0x3c.l+4) leshort 0x200 Intel Itanium
1.1.1.3 misho 12921: >>>(0x3c.l+4) leshort 0x266 MIPS16
12922: >>>(0x3c.l+4) leshort 0x268 Motorola 68000
12923: >>>(0x3c.l+4) leshort 0x290 PA-RISC
12924: >>>(0x3c.l+4) leshort 0x366 MIPSIV
12925: >>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU
12926: >>>(0x3c.l+4) leshort 0xebc EFI byte code
12927: >>>(0x3c.l+4) leshort 0x8664 x86-64
12928: >>>(0x3c.l+4) leshort 0xc0ee MSIL
12929: >>>(0x3c.l+4) default x Unknown processor type
12930: >>>>&0 leshort x 0x%x
12931: >>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
1.1 misho 12932: >>>(0x3c.l+22) leshort&0x1000 >0 system file
1.1.1.3 misho 12933: >>>(0x3c.l+24) leshort 0x010b
12934: >>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
12935: >>>(0x3c.l+24) leshort 0x020b
12936: >>>>(0x3c.l+248) lelong >0 Mono/.Net assembly
1.1 misho 12937:
1.1.1.3 misho 12938: # hooray, there's a DOS extender using the PE format, with a valid PE
12939: # executable inside (which just prints a message and exits if run in win)
12940: >>>(8.s*16) string 32STUB \b, 32rtm DOS extender
12941: >>>(8.s*16) string !32STUB \b, for MS Windows
12942: >>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
12943: >>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
12944: >>>(0x3c.l+0xf8) search/0x140 UPX2
12945: >>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
12946: >>>(0x3c.l+0xf8) search/0x140 .idata
12947: >>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
12948: >>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
12949: >>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
12950: >>>(0x3c.l+0xf8) search/0x140 .rsrc
12951: >>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
12952: >>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
12953: >>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
12954: >>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
12955: >>>(0x3c.l+0xf8) search/0x140 .data
12956: >>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
12957: >>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
12958: >>>>(0x3c.l+0xf7) byte x
12959: >>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
12960: >>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
12961: >>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
12962: >>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
12963: >>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
12964: >>>0x30 string Inno \b, InnoSetup self-extracting archive
1.1 misho 12965:
1.1.1.3 misho 12966: # Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
12967: # must be one of the unusual subformats.
1.1 misho 12968: >>(0x3c.l) string !PE\0\0 MS-DOS executable
12969:
12970: >>(0x3c.l) string NE \b, NE
12971: >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
12972: >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
12973: >>>(0x3c.l+0x36) byte 3 for MS-DOS
1.1.1.3 misho 12974: >>>(0x3c.l+0x36) byte 4 for Windows 386
12975: >>>(0x3c.l+0x36) byte 5 for Borland Operating System Services
12976: >>>(0x3c.l+0x36) default x
12977: >>>>(0x3c.l+0x36) byte x (unknown OS %x)
1.1 misho 12978: >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
12979: >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
12980: >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
12981: >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
12982: >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
12983:
12984: >>(0x3c.l) string LX\0\0 \b, LX
12985: >>>(0x3c.l+0x0a) leshort <1 (unknown OS)
12986: >>>(0x3c.l+0x0a) leshort 1 for OS/2
12987: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
12988: >>>(0x3c.l+0x0a) leshort 3 for DOS
12989: >>>(0x3c.l+0x0a) leshort >3 (unknown OS)
12990: >>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
12991: >>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
12992: >>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
12993: >>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
12994: >>>(0x3c.l+0x08) leshort 1 i80286
12995: >>>(0x3c.l+0x08) leshort 2 i80386
12996: >>>(0x3c.l+0x08) leshort 3 i80486
12997: >>>(8.s*16) string emx \b, emx
12998: >>>>&1 string x %s
12999: >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
13000:
13001: # MS Windows system file, supposedly a collection of LE executables
13002: >>(0x3c.l) string W3 \b, W3 for MS Windows
13003:
13004: >>(0x3c.l) string LE\0\0 \b, LE executable
13005: >>>(0x3c.l+0x0a) leshort 1
13006: # some DOS extenders use LE files with OS/2 header
13007: >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
13008: >>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
13009: >>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
13010: >>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
13011: >>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
13012: >>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
13013: >>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
13014: # this is a wild guess; hopefully it is a specific signature
13015: >>>>&0x24 lelong <0x50
13016: >>>>>(&0x4c.l) string \xfc\xb8WATCOM
13017: >>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
13018: # another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
13019: #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
13020: # fails with DOS-Extenders.
13021: >>>(0x3c.l+0x0a) leshort 2 for MS Windows
13022: >>>(0x3c.l+0x0a) leshort 3 for DOS
13023: >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
13024: >>>(&0x7c.l+0x26) string UPX \b, UPX compressed
13025: >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
13026:
13027: # looks like ASCII, probably some embedded copyright message.
13028: # and definitely not NE/LE/LX/PE
13029: >>0x3c lelong >0x20000000
13030: >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
13031: # header data too small for extended executable
13032: >2 long !0
13033: >>0x18 leshort <0x40
13034: >>>(4.s*512) leshort !0x014c
13035:
13036: >>>>&(2.s-514) string !LE
13037: >>>>>&-2 string !BW \b, MZ for MS-DOS
13038: >>>>&(2.s-514) string LE \b, LE
13039: >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
13040: # educated guess since indirection is still not capable enough for complex offset
13041: # calculations (next embedded executable would be at &(&2*512+&0-2)
13042: # I suspect there are only LE executables in these multi-exe files
13043: >>>>&(2.s-514) string BW
13044: >>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
13045: >>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
13046:
13047: # This sequence skips to the first COFF segment, usually .text
13048: >(4.s*512) leshort 0x014c \b, COFF
13049: >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
13050: >>(8.s*16) string emx
13051: >>>&1 string x for DOS, Win or OS/2, emx %s
13052: >>&(&0x42.l-3) byte x
13053: >>>&0x26 string UPX \b, UPX compressed
13054: # and yet another guess: small .text, and after large .data is unusal, could be 32lite
13055: >>&0x2c search/0xa0 .text
13056: >>>&0x0b lelong <0x2000
13057: >>>>&0 lelong >0x6000 \b, 32lite compressed
13058:
13059: >(8.s*16) string $WdX \b, WDos/X DOS extender
13060:
1.1.1.3 misho 13061: # By now an executable type should have been printed out. The executable
13062: # may be a self-uncompressing archive, so look for evidence of that and
13063: # print it out.
13064: #
13065: # Some signatures below from Greg Roelofs, newt@uchicago.edu.
1.1 misho 13066: #
13067: >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
1.1.1.3 misho 13068: >0xe7 string LH/2\ Self-Extract \b, %s
13069: >0x1c string UC2X \b, UCEXE compressed
13070: >0x1c string WWP\ \b, WWPACK compressed
13071: >0x1c string RJSX \b, ARJ self-extracting archive
13072: >0x1c string diet \b, diet compressed
13073: >0x1c string LZ09 \b, LZEXE v0.90 compressed
13074: >0x1c string LZ91 \b, LZEXE v0.91 compressed
13075: >0x1c string tz \b, TinyProg compressed
13076: >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
13077: !:mime application/zip
13078: # Yes, this really is "Copr", not "Corp."
13079: >0x1e string PKLITE\ Copr. Self-extracting PKZIP archive
13080: !:mime application/zip
13081: # winarj stores a message in the stub instead of the sig in the MZ header
13082: >0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
13083: >0x20 string AIN
13084: >>0x23 string 2 \b, AIN 2.x compressed
13085: >>0x23 string <2 \b, AIN 1.x compressed
13086: >>0x23 string >2 \b, AIN 1.x compressed
1.1 misho 13087: >0x24 string LHa's\ SFX \b, LHa self-extracting archive
13088: !:mime application/x-lha
13089: >0x24 string LHA's\ SFX \b, LHa self-extracting archive
13090: !:mime application/x-lha
13091: >0x24 string \ $ARX \b, ARX self-extracting archive
13092: >0x24 string \ $LHarc \b, LHarc self-extracting archive
13093: >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
1.1.1.3 misho 13094: >0x40 string aPKG \b, aPackage self-extracting archive
13095: >0x64 string W\ Collis\0\0 \b, Compack compressed
13096: >0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
13097: >>&0xf4 search/0x140 \x0\x40\x1\x0
13098: >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
1.1 misho 13099: >1638 string -lh5- \b, LHa self-extracting archive v2.13S
13100: >0x17888 string Rar! \b, RAR self-extracting archive
13101:
1.1.1.3 misho 13102: # Skip to the end of the EXE. This will usually work fine in the PE case
13103: # because the MZ image is hardcoded into the toolchain and almost certainly
13104: # won't match any of these signatures.
1.1 misho 13105: >(4.s*512) long x
13106: >>&(2.s-517) byte x
13107: >>>&0 string PK\3\4 \b, ZIP self-extracting archive
13108: >>>&0 string Rar! \b, RAR self-extracting archive
13109: >>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
13110: >>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
13111: >>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
13112: >>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
13113: >>>&7 search/400 **ACE** \b, ACE self-extracting archive
13114: >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
13115:
13116: # a few unknown ZIP sfxes, no idea if they are needed or if they are
13117: # already captured by the generic patterns above
13118: >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
13119: # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
13120: #
13121:
13122: # TELVOX Teleinformatica CODEC self-extractor for OS/2:
13123: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
13124: >>49824 leshort =1 \b, 1 file
13125: >>49824 leshort >1 \b, %u files
13126:
1.1.1.3 misho 13127: # added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
13128: # and http://www.freedos.org/software/?prog=kpdos
13129: # for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
13130: 0 string/b KCF FreeDOS KEYBoard Layout collection
13131: # only version=0x100 found
13132: >3 uleshort x \b, version 0x%x
13133: # length of string containing author,info and special characters
13134: >6 ubyte >0
13135: #>>6 pstring x \b, name=%s
13136: >>7 string >\0 \b, author=%-.14s
13137: >>7 search/254 \xff \b, info=
13138: #>>>&0 string x \b%-s
13139: >>>&0 string x \b%-.15s
13140: # for FreeDOS *.KL files
13141: 0 string/b KLF FreeDOS KEYBoard Layout file
13142: # only version=0x100 or 0x101 found
13143: >3 uleshort x \b, version 0x%x
13144: # stringlength
13145: >5 ubyte >0
13146: >>8 string x \b, name=%-.2s
13147: 0 string \xffKEYB\ \ \ \0\0\0\0
13148: >12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
13149:
1.1 misho 13150: # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
13151: # Uncommenting only the first two lines will cover about 2/3 of COM files,
13152: # but it isn't feasible to match all COM files since there must be at least
13153: # two dozen different one-byte "magics".
1.1.1.2 misho 13154: # test too generic ?
13155: 0 byte 0xe9 DOS executable (COM)
13156: >0x1FE leshort 0xAA55 \b, boot code
1.1 misho 13157: >6 string SFX\ of\ LHarc (%s)
1.1.1.3 misho 13158:
13159: # DOS device driver updated by Joerg Jenderek at May 2011
13160: # http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
13161: 0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
13162: >40 search/7 UPX! \bUPX compressed
13163: # DOS device driver attributes
13164: >4 uleshort&0x8000 0x0000 \bblock device driver
13165: # character device
13166: >4 uleshort&0x8000 0x8000 \b
13167: >>4 uleshort&0x0008 0x0008 \bclock
13168: # fast video output by int 29h
13169: >>4 uleshort&0x0010 0x0010 \bfast
13170: # standard input/output device
13171: >>4 uleshort&0x0003 >0 \bstandard
13172: >>>4 uleshort&0x0001 0x0001 \binput
13173: >>>4 uleshort&0x0003 0x0003 \b/
13174: >>>4 uleshort&0x0002 0x0002 \boutput
13175: >>4 uleshort&0x8000 0x8000 \bcharacter device driver
13176: >0 ubyte x
13177: # upx compressed device driver has garbage instead of real in name field of header
13178: >>40 search/7 UPX!
13179: >>40 default x
13180: # leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
13181: >>>12 ubyte >0x27 \b
13182: >>>>10 ubyte >0x20
13183: >>>>>10 ubyte !0x2E
13184: >>>>>>10 ubyte !0x2A \b%c
13185: >>>>11 ubyte >0x20
13186: >>>>>11 ubyte !0x2E \b%c
13187: >>>>12 ubyte >0x20
13188: >>>>>12 ubyte !0x39
13189: >>>>>>12 ubyte !0x2E \b%c
13190: >>>13 ubyte >0x20
13191: >>>>13 ubyte !0x2E \b%c
13192: >>>>14 ubyte >0x20
13193: >>>>>14 ubyte !0x2E \b%c
13194: >>>>15 ubyte >0x20
13195: >>>>>15 ubyte !0x2E \b%c
13196: >>>>16 ubyte >0x20
13197: >>>>>16 ubyte !0x2E
13198: >>>>>>16 ubyte <0xCB \b%c
13199: >>>>17 ubyte >0x20
13200: >>>>>17 ubyte !0x2E
13201: >>>>>>17 ubyte <0x90 \b%c
13202: # some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
13203: >>>4 uleshort&0x8000 0x8000
13204: >>>>12 ubyte <0x2F
13205: # they have their real name at offset 22
13206: >>>>>22 string >\0 \b%-.5s
13207: >4 uleshort&0x8000 0x0000
13208: # 32 bit sector addressing ( > 32 MB) for block devices
13209: >>4 uleshort&0x0002 0x0002 \b,32-bit sector-
13210: # support by driver functions 13h, 17h, 18h
13211: >4 uleshort&0x0040 0x0040 \b,IOCTL-
13212: # open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
13213: >4 uleshort&0x0800 0x0800 \b,close media-
13214: # output until busy support by int 10h for character device driver
13215: >4 uleshort&0x8000 0x8000
13216: >>4 uleshort&0x2000 0x2000 \b,until busy-
13217: # direct read/write support by driver functions 03h,0Ch
13218: >4 uleshort&0x4000 0x4000 \b,control strings-
13219: >4 uleshort&0x8000 0x8000
13220: >>4 uleshort&0x6840 >0 \bsupport
13221: >4 uleshort&0x8000 0x0000
13222: >>4 uleshort&0x4842 >0 \bsupport
13223: >0 ubyte x \b)
13224: # DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
13225: # Too weak, matches files that only contain 0's
13226: #0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
13227: #>4 uleshort&0x8000 0x8000 \bcharacter device driver
13228: #>>10 string x %-.8s
13229: #>4 uleshort&0x4000 0x4000 \b,control strings-support)
13230:
1.1.1.2 misho 13231: # test too generic ?
13232: 0 byte 0x8c DOS executable (COM)
13233: # updated by Joerg Jenderek at Oct 2008
13234: 0 ulelong 0xffff10eb DR-DOS executable (COM)
13235: # byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
13236: 0 ubeshort&0xeb8d >0xeb00
13237: # DR-DOS STACKER.COM SCREATE.SYS missed
1.1.1.3 misho 13238: >0 byte 0xeb
13239: >>0x1FE leshort 0xAA55 DOS executable (COM), boot code
13240: >>85 string UPX DOS executable (COM), UPX compressed
13241: >>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
13242: >>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
13243: >>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
1.1.1.2 misho 13244: # updated by Joerg Jenderek at Oct 2008
1.1 misho 13245: #0 byte 0xb8 COM executable
1.1.1.2 misho 13246: 0 uleshort&0x80ff 0x00b8
1.1 misho 13247: # modified by Joerg Jenderek
1.1.1.2 misho 13248: >1 lelong !0x21cd4cff COM executable for DOS
1.1 misho 13249: # http://syslinux.zytor.com/comboot.php
13250: # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
13251: # start with assembler instructions mov eax,21cd4cffh
1.1.1.2 misho 13252: 0 uleshort&0xc0ff 0xc0b8
13253: >1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
1.1.1.3 misho 13254: # syslinux:doc/comboot.txt
13255: # A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
13256: # eax,21cd4cfeh) as a magic number.
13257: 0 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R)
13258: # start with assembler instructions mov eax,21cd4cfeh
13259: 0 uleshort&0xc0ff 0xc0b8
13260: >1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable)
13261: 0 string/b \x81\xfc
1.1 misho 13262: >4 string \x77\x02\xcd\x20\xb9
13263: >>36 string UPX! FREE-DOS executable (COM), UPX compressed
13264: 252 string Must\ have\ DOS\ version DR-DOS executable (COM)
1.1.1.2 misho 13265: # added by Joerg Jenderek at Oct 2008
13266: # GRR search is not working
13267: #34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
13268: 34 string UPX! FREE-DOS executable (COM), UPX compressed
13269: 35 string UPX! FREE-DOS executable (COM), UPX compressed
1.1 misho 13270: # GRR search is not working
13271: #2 search/28 \xcd\x21 COM executable for MS-DOS
13272: #WHICHFAT.cOM
13273: 2 string \xcd\x21 COM executable for DOS
13274: #DELTREE.cOM DELTREE2.cOM
13275: 4 string \xcd\x21 COM executable for DOS
13276: #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
13277: 5 string \xcd\x21 COM executable for DOS
13278: #DELTMP.COm HASFAT32.cOM
13279: 7 string \xcd\x21
13280: >0 byte !0xb8 COM executable for DOS
13281: #COMP.cOM MORE.COm
13282: 10 string \xcd\x21
13283: >5 string !\xcd\x21 COM executable for DOS
13284: #comecho.com
13285: 13 string \xcd\x21 COM executable for DOS
13286: #HELP.COm EDIT.coM
13287: 18 string \xcd\x21 COM executable for MS-DOS
13288: #NWRPLTRM.COm
13289: 23 string \xcd\x21 COM executable for MS-DOS
13290: #LOADFIX.cOm LOADFIX.cOm
13291: 30 string \xcd\x21 COM executable for MS-DOS
13292: #syslinux.com 3.11
13293: 70 string \xcd\x21 COM executable for DOS
13294: # many compressed/converted COMs start with a copy loop instead of a jump
13295: 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
13296: 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
13297: >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
13298: 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
13299: # FIXME: missing diet .com compression
13300:
13301: # miscellaneous formats
1.1.1.3 misho 13302: 0 string/b LZ MS-DOS executable (built-in)
1.1 misho 13303: #0 byte 0xf0 MS-DOS program library data
13304: #
13305:
13306: # AAF files:
13307: # <stuartc@rd.bbc.co.uk> Stuart Cunningham
1.1.1.3 misho 13308: 0 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
1.1 misho 13309: >30 byte 9 (512B sectors)
13310: >30 byte 12 (4kB sectors)
1.1.1.3 misho 13311: 0 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
1.1 misho 13312: >30 byte 9 (512B sectors)
13313: >30 byte 12 (4kB sectors)
13314:
13315: # Popular applications
13316: 2080 string Microsoft\ Word\ 6.0\ Document %s
13317: !:mime application/msword
13318: 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
13319: !:mime application/msword
13320: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
13321: 2112 string MSWordDoc Microsoft Word document data
13322: !:mime application/msword
13323: #
13324: 0 belong 0x31be0000 Microsoft Word Document
13325: !:mime application/msword
13326: #
1.1.1.3 misho 13327: 0 string/b PO^Q` Microsoft Word 6.0 Document
1.1 misho 13328: !:mime application/msword
13329: #
1.1.1.3 misho 13330: 0 string/b \376\067\0\043 Microsoft Office Document
1.1 misho 13331: !:mime application/msword
1.1.1.3 misho 13332: 0 string/b \333\245-\0\0\0 Microsoft Office Document
1.1 misho 13333: !:mime application/msword
1.1.1.3 misho 13334: 512 string/b \354\245\301 Microsoft Word Document
1.1 misho 13335: !:mime application/msword
1.1.1.3 misho 13336:
13337: #
13338: 0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
13339: !:mime application/msword
1.1 misho 13340: #
13341: 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
13342: !:mime application/vnd.ms-excel
1.1.1.3 misho 13343: #
13344: 0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
13345: !:mime application/msword
1.1 misho 13346:
13347: 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
13348: !:mime application/vnd.ms-excel
13349: #
13350: # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
13351: 2114 string Biff5 Microsoft Excel 5.0 Worksheet
13352: !:mime application/vnd.ms-excel
13353: # Italian MS-Excel
13354: 2121 string Biff5 Microsoft Excel 5.0 Worksheet
13355: !:mime application/vnd.ms-excel
1.1.1.3 misho 13356: 0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
1.1 misho 13357: !:mime application/vnd.ms-excel
13358: #
13359: 0 belong 0x00001a00 Lotus 1-2-3
13360: !:mime application/x-123
13361: >4 belong 0x00100400 wk3 document data
13362: >4 belong 0x02100400 wk4 document data
13363: >4 belong 0x07800100 fm3 or fmb document data
13364: >4 belong 0x07800000 fm3 or fmb document data
13365: #
13366: 0 belong 0x00000200 Lotus 1-2-3
13367: !:mime application/x-123
13368: >4 belong 0x06040600 wk1 document data
13369: >4 belong 0x06800200 fmt document data
1.1.1.3 misho 13370: 0 string/b WordPro\0 Lotus WordPro
1.1 misho 13371: !:mime application/vnd.lotus-wordpro
1.1.1.3 misho 13372: 0 string/b WordPro\r\373 Lotus WordPro
1.1 misho 13373: !:mime application/vnd.lotus-wordpro
13374:
13375:
13376: # Summary: Script used by InstallScield to uninstall applications
13377: # Extension: .isu
13378: # Submitted by: unknown
13379: # Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
13380: 0 string \x71\xa8\x00\x00\x01\x02
13381: >12 string Stirling\ Technologies, InstallShield Uninstall Script
13382:
13383: # Winamp .avs
13384: #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
1.1.1.3 misho 13385: 0 string/b Nullsoft\ AVS\ Preset\ Winamp plug in
1.1 misho 13386:
13387: # Windows Metafont .WMF
1.1.1.3 misho 13388: 0 string/b \327\315\306\232 ms-windows metafont .wmf
13389: 0 string/b \002\000\011\000 ms-windows metafont .wmf
13390: 0 string/b \001\000\011\000 ms-windows metafont .wmf
1.1 misho 13391:
13392: #tz3 files whatever that is (MS Works files)
1.1.1.3 misho 13393: 0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file
13394: 0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file
13395: 0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file
1.1 misho 13396:
13397: # PGP sig files .sig
13398: #0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
13399: 0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
13400: 0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
13401: 0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
13402: 0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
13403: 0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
13404: 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
13405:
13406: # windows zips files .dmf
1.1.1.3 misho 13407: 0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
1.1 misho 13408:
13409:
13410: #ico files
1.1.1.3 misho 13411: 0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
1.1 misho 13412:
13413: # Windows icons (Ian Springer <ips@fpk.hp.com>)
1.1.1.3 misho 13414: 0 string/b \000\000\001\000 MS Windows icon resource
13415: !:mime image/x-icon
1.1 misho 13416: >4 byte 1 - 1 icon
13417: >4 byte >1 - %d icons
13418: >>6 byte >0 \b, %dx
13419: >>>7 byte >0 \b%d
13420: >>8 byte 0 \b, 256-colors
13421: >>8 byte >0 \b, %d-colors
13422:
13423:
13424: # .chr files
1.1.1.3 misho 13425: 0 string/b PK\010\010BGI Borland font
1.1 misho 13426: >4 string >\0 %s
13427: # then there is a copyright notice
13428:
13429:
13430: # .bgi files
1.1.1.3 misho 13431: 0 string/b pk\010\010BGI Borland device
1.1 misho 13432: >4 string >\0 %s
13433: # then there is a copyright notice
13434:
13435:
13436: # Windows Recycle Bin record file (named INFO2)
13437: # By Abel Cheung (abelcheung AT gmail dot com)
13438: # Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
13439: # Since Vista uses another structure, INFO2 structure probably won't change
13440: # anymore. Detailed analysis in:
13441: # http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
13442: 0 lelong 0x00000004
13443: >12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
13444:
13445: 0 lelong 0x00000005
13446: >12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
13447:
13448:
13449: ##### put in Either Magic/font or Magic/news
13450: # Acroread or something files wrongly identified as G3 .pfm
13451: # these have the form \000 \001 any? \002 \000 \000
13452: # or \000 \001 any? \022 \000 \000
13453: 0 belong&0xffff00ff 0x00010012 PFM data
13454: >4 string \000\000
13455: >6 string >\060 - %s
13456:
13457: 0 belong&0xffff00ff 0x00010002 PFM data
13458: >4 string \000\000
13459: >6 string >\060 - %s
13460: #0 string \000\001 pfm?
13461: #>3 string \022\000\000Copyright\ yes
13462: #>3 string \002\000\000Copyright\ yes
13463: #>3 string >\0 oops, not a font file. Cancel that.
13464: #it clashes with ttf files so put it lower down.
13465:
13466: # From Doug Lee via a FreeBSD pr
13467: 9 string GERBILDOC First Choice document
13468: 9 string GERBILDB First Choice database
13469: 9 string GERBILCLIP First Choice database
13470: 0 string GERBIL First Choice device file
13471: 9 string RABBITGRAPH RabbitGraph file
13472: 0 string DCU1 Borland Delphi .DCU file
13473: 0 string =!<spell> MKS Spell hash list (old format)
13474: 0 string =!<spell2> MKS Spell hash list
13475: # Too simple - MPi
13476: #0 string AH Halo(TM) bitmapped font file
13477: 0 lelong 0x08086b70 TurboC BGI file
13478: 0 lelong 0x08084b50 TurboC Font file
13479:
1.1.1.3 misho 13480: # tests for DBase files moved, updated and merged to database
13481:
1.1 misho 13482: 0 string PMCC Windows 3.x .GRP file
13483: 1 string RDC-meg MegaDots
13484: >8 byte >0x2F version %c
13485: >9 byte >0x2F \b.%c file
13486: 0 lelong 0x4C
13487: >4 lelong 0x00021401 Windows shortcut file
13488:
1.1.1.3 misho 13489: # .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
13490: # only for windows versions equal or greater 3.0
13491: 0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
13492: !:mime application/x-dosexec
13493: #>2 string >\0 \b, Title:%.30s
13494: >0x24 string >\0 \b for %.63s
13495: >0x65 string >\0 \b, directory=%.64s
13496: >0xA5 string >\0 \b, parameters=%.64s
13497: #>0x181 leshort x \b, offset %x
13498: #>0x183 leshort x \b, offsetdata %x
13499: #>0x185 leshort x \b, section length %x
13500: >0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
13501: >>&0x5e ubyte >0
13502: >>>&-1 string <PIFMGR.DLL \b, icon=%s
13503: #>>>&-1 string PIFMGR.DLL \b, icon=%s
13504: >>>&-1 string >PIFMGR.DLL \b, icon=%s
13505: >>&0xF0 ubyte >0
13506: >>>&-1 string <Terminal \b, font=%.32s
13507: #>>>&-1 string =Terminal \b, font=%.32s
13508: >>>&-1 string >Terminal \b, font=%.32s
13509: >>&0x110 ubyte >0
13510: >>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
13511: #>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
13512: >>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
13513: #>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
13514: #>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
13515: >0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
13516: #>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
13517: >0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS
13518: #>>&06 string x \b:%s
13519: >0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT
13520: #>>&06 string x \b:%s
13521:
1.1 misho 13522: # DOS EPS Binary File Header
13523: # From: Ed Sznyter <ews@Black.Market.NET>
13524: 0 belong 0xC5D0D3C6 DOS EPS Binary File
13525: >4 long >0 Postscript starts at byte %d
13526: >>8 long >0 length %d
13527: >>>12 long >0 Metafile starts at byte %d
13528: >>>>16 long >0 length %d
13529: >>>20 long >0 TIFF starts at byte %d
13530: >>>>24 long >0 length %d
13531:
13532: # TNEF magic From "Joomy" <joomy@se-ed.net>
13533: # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
13534: 0 leshort 0x223e9f78 TNEF
13535: !:mime application/vnd.ms-tnef
13536:
1.1.1.3 misho 13537: # 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
13538: # of http://www.4dos.info/
13539: # pointer,HelpID[8]=4DHnnnmm
13540: 0 ulelong 0x48443408 4DOS help file
13541: >4 string x \b, version %-4.4s
13542:
13543: # old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
13544: 0 ulequad 0x3a000000024e4c MS Advisor help file
13545:
1.1 misho 13546: # HtmlHelp files (.chm)
1.1.1.3 misho 13547: 0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
1.1 misho 13548:
13549: # GFA-BASIC (Wolfram Kleff)
1.1.1.3 misho 13550: 2 string/b GFA-BASIC3 GFA-BASIC 3 data
1.1 misho 13551:
13552: #------------------------------------------------------------------------------
13553: # From Stuart Caie <kyzer@4u.net> (developer of cabextract)
13554: # Microsoft Cabinet files
1.1.1.3 misho 13555: 0 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data
1.1.1.2 misho 13556: !:mime application/vnd.ms-cab-compressed
1.1 misho 13557: >8 lelong x \b, %u bytes
13558: >28 leshort 1 \b, 1 file
13559: >28 leshort >1 \b, %u files
13560:
13561: # InstallShield Cabinet files
1.1.1.3 misho 13562: 0 string/b ISc( InstallShield Cabinet archive data
1.1 misho 13563: >5 byte&0xf0 =0x60 version 6,
13564: >5 byte&0xf0 !0x60 version 4/5,
13565: >(12.l+40) lelong x %u files
13566:
13567: # Windows CE package files
1.1.1.3 misho 13568: 0 string/b MSCE\0\0\0\0 Microsoft WinCE install header
1.1 misho 13569: >20 lelong 0 \b, architecture-independent
13570: >20 lelong 103 \b, Hitachi SH3
13571: >20 lelong 104 \b, Hitachi SH4
13572: >20 lelong 0xA11 \b, StrongARM
13573: >20 lelong 4000 \b, MIPS R4000
13574: >20 lelong 10003 \b, Hitachi SH3
13575: >20 lelong 10004 \b, Hitachi SH3E
13576: >20 lelong 10005 \b, Hitachi SH4
13577: >20 lelong 70001 \b, ARM 7TDMI
13578: >52 leshort 1 \b, 1 file
13579: >52 leshort >1 \b, %u files
13580: >56 leshort 1 \b, 1 registry entry
13581: >56 leshort >1 \b, %u registry entries
13582:
13583:
13584: # Windows Enhanced Metafile (EMF)
13585: # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
13586: # for further information.
13587: 0 ulelong 1
13588: >40 string \ EMF Windows Enhanced Metafile (EMF) image data
13589: >>44 ulelong x version 0x%x
13590:
13591: # From: Alex Beregszaszi <alex@fsn.hu>
1.1.1.3 misho 13592: 0 string/b COWD VMWare3
1.1 misho 13593: >4 byte 3 disk image
13594: >>32 lelong x (%d/
13595: >>36 lelong x \b%d/
13596: >>40 lelong x \b%d)
13597: >4 byte 2 undoable disk image
13598: >>32 string >\0 (%s)
13599:
1.1.1.3 misho 13600: 0 string/b VMDK VMware4 disk image
13601: 0 string/b KDMV VMware4 disk image
1.1 misho 13602:
13603: #--------------------------------------------------------------------
13604: # Qemu Emulator Images
13605: # Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
1.1.1.2 misho 13606: # Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
13607: # Made by reading sources, reading documentation, and doing trial and error
13608: # on existing QCOW files
1.1.1.3 misho 13609: 0 string/b QFI\xFB QEMU QCOW Image
1.1 misho 13610:
13611: # Uncomment the following line to display Magic (only used for debugging
13612: # this magic number)
1.1.1.3 misho 13613: #>0 string/b x , Magic: %s
1.1 misho 13614:
1.1.1.2 misho 13615: # There are currently 2 Versions: "1" and "2".
13616: # http://www.gnome.org/~markmc/qcow-image-format-version-1.html
13617: >4 belong 1 (v1)
1.1 misho 13618:
1.1.1.2 misho 13619: # Using the existence of the Backing File Offset to determine whether
1.1 misho 13620: # to read Backing File Information
1.1.1.2 misho 13621: >>12 belong >0 \b, has backing file (
13622: # Note that this isn't a null-terminated string; the length is actually
13623: # (16.L). Assuming a null-terminated string happens to work usually, but it
13624: # may spew junk until it reaches a \0 in some cases.
13625: >>>(12.L) string >\0 \bpath %s
1.1 misho 13626:
13627: # Modification time of the Backing File
13628: # Really useful if you want to know if your backing
13629: # file is still usable together with this image
1.1.1.2 misho 13630: >>>>20 bedate >0 \b, mtime %s)
13631: >>>>20 default x \b)
13632:
13633: # Size is stored in bytes in a big-endian u64.
13634: >>24 bequad x \b, %lld bytes
13635:
13636: # 1 for AES encryption, 0 for none.
13637: >>36 belong 1 \b, AES-encrypted
13638:
13639: # http://www.gnome.org/~markmc/qcow-image-format.html
13640: >4 belong 2 (v2)
13641: # Using the existence of the Backing File Offset to determine whether
13642: # to read Backing File Information
13643: >>8 bequad >0 \b, has backing file
13644: # Note that this isn't a null-terminated string; the length is actually
13645: # (16.L). Assuming a null-terminated string happens to work usually, but it
13646: # may spew junk until it reaches a \0 in some cases. Also, since there's no
13647: # .Q modifier, we just use the bottom four bytes as an offset. Note that if
13648: # the file is over 4G, and the backing file path is stored after the first 4G,
13649: # the wrong filename will be printed. (This should be (8.Q), when that syntax
13650: # is introduced.)
13651: >>>(12.L) string >\0 (path %s)
13652: >>24 bequad x \b, %lld bytes
13653: >>32 belong 1 \b, AES-encrypted
1.1 misho 13654:
1.1.1.2 misho 13655: >4 default x (unknown version)
1.1 misho 13656:
1.1.1.3 misho 13657: 0 string/b QEVM QEMU suspend to disk image
13658:
13659: # QEMU QED Image
13660: # http://wiki.qemu.org/Features/QED/Specification
13661: 0 string/b QED\0 QEMU QED Image
13662:
13663: # VDI Image
13664: 64 string/b \x7f\x10\xda\xbe VDI Image
13665: >68 string/b \x01\x00\x01\x00 version 1.1
13666: >0 string >\0 (%s)
13667: >368 lequad x \b, %lld bytes
1.1 misho 13668:
1.1.1.3 misho 13669: 0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
1.1 misho 13670: >32 string x type %s,
13671: >48 string x subtype %s
13672:
13673: 0 lelong 0x02468ace Bochs Sparse disk image
13674:
13675: # from http://filext.com by Derek M Jones <derek@knosof.co.uk>
13676: # False positive with PPT (also currently this string is too long)
1.1.1.3 misho 13677: #0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
13678: 0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document
1.1 misho 13679: #>48 byte 0x1B Excel Document
13680: #!:mime application/vnd.ms-excel
13681: >546 string bjbj Microsoft Word Document
13682: !:mime application/msword
13683: >546 string jbjb Microsoft Word Document
13684: !:mime application/msword
13685:
1.1.1.3 misho 13686: 0 string/b \224\246\056 Microsoft Word Document
1.1 misho 13687: !:mime application/msword
13688:
13689: 512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
13690: !:mime application/msword
13691:
13692: # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
13693: # Magic type for Dell's BIOS .hdr files
13694: # Dell's .hdr
1.1.1.3 misho 13695: 0 string/b $RBU
1.1 misho 13696: >23 string Dell %s system BIOS
1.1.1.3 misho 13697: >5 byte 2
13698: >>48 byte x version %d.
13699: >>49 byte x \b%d.
13700: >>50 byte x \b%d
13701: >5 byte <2
13702: >>48 string x version %.3s
1.1 misho 13703:
13704: # Type: Microsoft DirectDraw Surface
13705: # URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
13706: # From: Morten Hustveit <morten@debian.org>
1.1.1.3 misho 13707: 0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
1.1 misho 13708: >16 lelong >0 %hd x
13709: >12 lelong >0 %hd,
13710: >84 string x %.4s
13711:
13712: # Type: Microsoft Document Imaging Format (.mdi)
13713: # URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
13714: # From: Daniele Sempione <scrows@oziosi.org>
13715: 0 short 0x5045 Microsoft Document Imaging Format
13716:
13717: # MS eBook format (.lit)
1.1.1.3 misho 13718: 0 string/b ITOLITLS Microsoft Reader eBook Data
1.1 misho 13719: >8 lelong x \b, version %u
13720: !:mime application/x-ms-reader
13721:
1.1.1.3 misho 13722: # Windows CE Binary Image Data Format
13723: # From: Dr. Jesus <j@hug.gs>
13724: 0 string/b B000FF\n Windows Embedded CE binary image
13725:
13726: # Windows Imaging (WIM) Image
13727: 0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
13728:
13729: # The second byte of these signatures is a file version; I don't know what,
13730: # if anything, produced files with version numbers 0-2.
13731: # From: John Elliott <johne@seasip.demon.co.uk>
13732: 0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
13733: 0 string \xfc\x04\x00 Mallard BASIC program data (v1.29+)
13734: 0 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11)
13735: 0 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+)
13736:
13737: 0 string MIOPEN Mallard BASIC Jetsam data
13738: 0 string Jetsam0 Mallard BASIC Jetsam index data
13739:
13740:
13741: #------------------------------------------------------------------------------
13742: # $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $
13743: # msooxml: file(1) magic for Microsoft Office XML
13744: # From: Ralf Brown <ralf.brown@gmail.com>
13745:
13746: # .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
13747: # archive. The first member file is normally "[Content_Types].xml".
13748: # Since MSOOXML doesn't have anything like the uncompressed "mimetype"
13749: # file of ePub or OpenDocument, we'll have to scan for a filename
13750: # which can distinguish between the three types
13751:
13752: # start by checking for ZIP local file header signature
13753: 0 string PK\003\004
13754: # make sure the first file is correct
13755: >0x1E string [Content_Types].xml
13756: # skip to the second local file header
13757: # since some documents include a 520-byte extra field following the file
13758: # header, we need to scan for the next header
13759: >>(18.l+49) search/2000 PK\003\004
13760: # now skip to the *third* local file header; again, we need to scan due to a
13761: # 520-byte extra field following the file header
13762: >>>&26 search/1000 PK\003\004
13763: # and check the subdirectory name to determine which type of OOXML
13764: # file we have
13765: # Correct the mimetype with the registered ones:
13766: # http://technet.microsoft.com/en-us/library/cc179224.aspx
13767: >>>>&26 string word/ Microsoft Word 2007+
13768: !:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
13769: >>>>&26 string ppt/ Microsoft PowerPoint 2007+
13770: !:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
13771: >>>>&26 string xl/ Microsoft Excel 2007+
13772: !:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
13773: >>>>&26 default x Microsoft OOXML
13774: !:strength +10
13775:
1.1 misho 13776: #------------------------------------------------------------------------------
1.1.1.2 misho 13777: # $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 13778: # msvc: file(1) magic for msvc
13779: # "H. Nanosecond" <aldomel@ix.netcom.com>
13780: # Microsoft visual C
13781: #
13782: # I have version 1.0
13783:
13784: # .aps
13785: 0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
13786:
13787: # .ide
13788: #too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
13789: 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
13790:
13791: # .res
13792: 0 string \000\000\000\000\040\000\000\000\377 MSVC .res
13793: 0 string \377\003\000\377\001\000\020\020\350 MSVC .res
13794: 0 string \377\003\000\377\001\000\060\020\350 MSVC .res
13795:
13796: #.lib
13797: 0 string \360\015\000\000 Microsoft Visual C library
13798: 0 string \360\075\000\000 Microsoft Visual C library
13799: 0 string \360\175\000\000 Microsoft Visual C library
13800:
13801: #.pch
13802: 0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
13803:
13804: # .pdb
13805: # too long 0 string Microsoft\ C/C++\ program\ database\
13806: 0 string Microsoft\ C/C++\ MSVC program database
13807: >18 string program\ database\
13808: >33 string >\0 ver %s
13809:
13810: #.sbr
13811: 0 string \000\002\000\007\000 MSVC .sbr
13812: >5 string >\0 %s
13813:
13814: #.bsc
13815: 0 string \002\000\002\001 MSVC .bsc
13816:
13817: #.wsp
13818: 0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
13819: # these seem to start with the version and contain menus
1.1.1.2 misho 13820:
1.1 misho 13821: # ------------------------------------------------------------------------
1.1.1.2 misho 13822: # $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 13823: # mup: file(1) magic for Mup (Music Publisher) input file.
13824: #
13825: # From: Abel Cheung <abel (@) oaka.org>
13826: #
13827: # NOTE: This header is mainly proposed in the Arkkra mailing list,
13828: # and is not a mandatory header because of old mup input file
13829: # compatibility. Noteedit also use mup format, but is not forcing
13830: # user to use any header as well.
13831: #
13832: 0 search/1 //!Mup Mup music publication program input text
13833: >6 string -Arkkra (Arkkra)
13834: >>13 string -
13835: >>>16 string .
13836: >>>>14 string x \b, need V%.4s
13837: >>>15 string .
13838: >>>>14 string x \b, need V%.3s
13839: >6 string -
13840: >>9 string .
13841: >>>7 string x \b, need V%.4s
13842: >>8 string .
13843: >>>7 string x \b, need V%.3s
1.1.1.3 misho 13844: #------------------------------------------------------------------------------
13845: # $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
13846: # music: file (1) magic for music formats
13847:
13848: # BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
13849: # and Bagpipe Writer by Doug Wickstrom
13850: #
13851: 0 string Bagpipe Bagpipe
13852: >8 string Reader Reader
13853: >>15 string >\0 (version %.3s)
13854: >8 string Music\ Writer Music Writer
13855: >>20 string :
13856: >>>21 string >\0 (version %.3s)
13857: >>21 string Gold Gold
13858: >>>25 string :
13859: >>>>26 string >\0 (version %.3s)
13860:
1.1 misho 13861:
13862: #-----------------------------------------------------------------------------
1.1.1.3 misho 13863: # $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
1.1 misho 13864: # natinst: file(1) magic for National Instruments Code Files
13865:
13866: #
1.1.1.3 misho 13867: # From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
1.1 misho 13868: # version 1
13869: # Many formats still missing, we use, for the moment LabVIEW
13870: # We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
13871: #
13872: 0 string RSRC National Instruments,
13873: # Check if it's a LabVIEW File
13874: >8 string LV LabVIEW File,
13875: # Check wich kind of file is
13876: >>10 string SB Code Resource File, data
13877: >>10 string IN Virtual Instrument Program, data
13878: >>10 string AR VI Library, data
13879: # This is for Menu Libraries
13880: >8 string LMNULBVW Portable File Names, data
13881: # This is for General Resources
13882: >8 string rsc Resources File, data
13883: # This is for VXI Package
13884: 0 string VMAP National Instruments, VXI File, data
13885:
13886: #------------------------------------------------------------------------------
1.1.1.2 misho 13887: # $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 13888: # ncr: file(1) magic for NCR Tower objects
13889: #
13890: # contributed by
13891: # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
13892: # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
13893: #
13894: 0 beshort 000610 Tower/XP rel 2 object
13895: >12 belong >0 not stripped
13896: >20 beshort 0407 executable
13897: >20 beshort 0410 pure executable
13898: >22 beshort >0 - version %ld
13899: 0 beshort 000615 Tower/XP rel 2 object
13900: >12 belong >0 not stripped
13901: >20 beshort 0407 executable
13902: >20 beshort 0410 pure executable
13903: >22 beshort >0 - version %ld
13904: 0 beshort 000620 Tower/XP rel 3 object
13905: >12 belong >0 not stripped
13906: >20 beshort 0407 executable
13907: >20 beshort 0410 pure executable
13908: >22 beshort >0 - version %ld
13909: 0 beshort 000625 Tower/XP rel 3 object
13910: >12 belong >0 not stripped
13911: >20 beshort 0407 executable
13912: >20 beshort 0410 pure executable
13913: >22 beshort >0 - version %ld
13914: 0 beshort 000630 Tower32/600/400 68020 object
13915: >12 belong >0 not stripped
13916: >20 beshort 0407 executable
13917: >20 beshort 0410 pure executable
13918: >22 beshort >0 - version %ld
13919: 0 beshort 000640 Tower32/800 68020
13920: >18 beshort &020000 w/68881 object
13921: >18 beshort &040000 compatible object
13922: >18 beshort &060000 object
13923: >20 beshort 0407 executable
13924: >20 beshort 0413 pure executable
13925: >12 belong >0 not stripped
13926: >22 beshort >0 - version %ld
13927: 0 beshort 000645 Tower32/800 68010
13928: >18 beshort &040000 compatible object
13929: >18 beshort &060000 object
13930: >20 beshort 0407 executable
13931: >20 beshort 0413 pure executable
13932: >12 belong >0 not stripped
13933: >22 beshort >0 - version %ld
13934:
13935: #------------------------------------------------------------------------------
1.1.1.3 misho 13936: # $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $
1.1 misho 13937: # netbsd: file(1) magic for NetBSD objects
13938: #
13939: # All new-style magic numbers are in network byte order.
1.1.1.3 misho 13940: # The old-style magic numbers are indistinguishable from the same magic
13941: # numbers used in other systems, and are handled, for all those systems,
13942: # in aout.
1.1 misho 13943: #
13944:
13945: 0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
13946: >0 byte &0x80
13947: >>20 lelong <4096 shared library
13948: >>20 lelong =4096 dynamically linked executable
13949: >>20 lelong >4096 dynamically linked executable
13950: >0 byte ^0x80 executable
13951: >16 lelong >0 not stripped
13952: 0 belong&0377777777 041400410 a.out NetBSD/i386 pure
13953: >0 byte &0x80 dynamically linked executable
13954: >0 byte ^0x80 executable
13955: >16 lelong >0 not stripped
13956: 0 belong&0377777777 041400407 a.out NetBSD/i386
13957: >0 byte &0x80 dynamically linked executable
13958: >0 byte ^0x80
13959: >>0 byte &0x40 position independent
13960: >>20 lelong !0 executable
13961: >>20 lelong =0 object file
13962: >16 lelong >0 not stripped
13963: 0 belong&0377777777 041400507 a.out NetBSD/i386 core
13964: >12 string >\0 from '%s'
13965: >32 lelong !0 (signal %d)
13966:
13967: 0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
13968: >0 byte &0x80
13969: >>20 belong <8192 shared library
13970: >>20 belong =8192 dynamically linked executable
13971: >>20 belong >8192 dynamically linked executable
13972: >0 byte ^0x80 executable
13973: >16 belong >0 not stripped
13974: 0 belong&0377777777 041600410 a.out NetBSD/m68k pure
13975: >0 byte &0x80 dynamically linked executable
13976: >0 byte ^0x80 executable
13977: >16 belong >0 not stripped
13978: 0 belong&0377777777 041600407 a.out NetBSD/m68k
13979: >0 byte &0x80 dynamically linked executable
13980: >0 byte ^0x80
13981: >>0 byte &0x40 position independent
13982: >>20 belong !0 executable
13983: >>20 belong =0 object file
13984: >16 belong >0 not stripped
13985: 0 belong&0377777777 041600507 a.out NetBSD/m68k core
13986: >12 string >\0 from '%s'
13987: >32 belong !0 (signal %d)
13988:
13989: 0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
13990: >0 byte &0x80
13991: >>20 belong <4096 shared library
13992: >>20 belong =4096 dynamically linked executable
13993: >>20 belong >4096 dynamically linked executable
13994: >0 byte ^0x80 executable
13995: >16 belong >0 not stripped
13996: 0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
13997: >0 byte &0x80 dynamically linked executable
13998: >0 byte ^0x80 executable
13999: >16 belong >0 not stripped
14000: 0 belong&0377777777 042000407 a.out NetBSD/m68k4k
14001: >0 byte &0x80 dynamically linked executable
14002: >0 byte ^0x80
14003: >>0 byte &0x40 position independent
14004: >>20 belong !0 executable
14005: >>20 belong =0 object file
14006: >16 belong >0 not stripped
14007: 0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
14008: >12 string >\0 from '%s'
14009: >32 belong !0 (signal %d)
14010:
14011: 0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
14012: >0 byte &0x80
14013: >>20 lelong <4096 shared library
14014: >>20 lelong =4096 dynamically linked executable
14015: >>20 lelong >4096 dynamically linked executable
14016: >0 byte ^0x80 executable
14017: >16 lelong >0 not stripped
14018: 0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
14019: >0 byte &0x80 dynamically linked executable
14020: >0 byte ^0x80 executable
14021: >16 lelong >0 not stripped
14022: 0 belong&0377777777 042200407 a.out NetBSD/ns32532
14023: >0 byte &0x80 dynamically linked executable
14024: >0 byte ^0x80
14025: >>0 byte &0x40 position independent
14026: >>20 lelong !0 executable
14027: >>20 lelong =0 object file
14028: >16 lelong >0 not stripped
14029: 0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
14030: >12 string >\0 from '%s'
14031: >32 lelong !0 (signal %d)
14032:
14033: 0 belong&0377777777 045200507 a.out NetBSD/powerpc core
14034: >12 string >\0 from '%s'
14035:
14036: 0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
14037: >0 byte &0x80
14038: >>20 belong <8192 shared library
14039: >>20 belong =8192 dynamically linked executable
14040: >>20 belong >8192 dynamically linked executable
14041: >0 byte ^0x80 executable
14042: >16 belong >0 not stripped
14043: 0 belong&0377777777 042400410 a.out NetBSD/sparc pure
14044: >0 byte &0x80 dynamically linked executable
14045: >0 byte ^0x80 executable
14046: >16 belong >0 not stripped
14047: 0 belong&0377777777 042400407 a.out NetBSD/sparc
14048: >0 byte &0x80 dynamically linked executable
14049: >0 byte ^0x80
14050: >>0 byte &0x40 position independent
14051: >>20 belong !0 executable
14052: >>20 belong =0 object file
14053: >16 belong >0 not stripped
14054: 0 belong&0377777777 042400507 a.out NetBSD/sparc core
14055: >12 string >\0 from '%s'
14056: >32 belong !0 (signal %d)
14057:
14058: 0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
14059: >0 byte &0x80
14060: >>20 lelong <4096 shared library
14061: >>20 lelong =4096 dynamically linked executable
14062: >>20 lelong >4096 dynamically linked executable
14063: >0 byte ^0x80 executable
14064: >16 lelong >0 not stripped
14065: 0 belong&0377777777 042600410 a.out NetBSD/pmax pure
14066: >0 byte &0x80 dynamically linked executable
14067: >0 byte ^0x80 executable
14068: >16 lelong >0 not stripped
14069: 0 belong&0377777777 042600407 a.out NetBSD/pmax
14070: >0 byte &0x80 dynamically linked executable
14071: >0 byte ^0x80
14072: >>0 byte &0x40 position independent
14073: >>20 lelong !0 executable
14074: >>20 lelong =0 object file
14075: >16 lelong >0 not stripped
14076: 0 belong&0377777777 042600507 a.out NetBSD/pmax core
14077: >12 string >\0 from '%s'
14078: >32 lelong !0 (signal %d)
14079:
14080: 0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
14081: >0 byte &0x80
14082: >>20 lelong <4096 shared library
14083: >>20 lelong =4096 dynamically linked executable
14084: >>20 lelong >4096 dynamically linked executable
14085: >0 byte ^0x80 executable
14086: >16 lelong >0 not stripped
14087: 0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
14088: >0 byte &0x80 dynamically linked executable
14089: >0 byte ^0x80 executable
14090: >16 lelong >0 not stripped
14091: 0 belong&0377777777 043000407 a.out NetBSD/vax 1k
14092: >0 byte &0x80 dynamically linked executable
14093: >0 byte ^0x80
14094: >>0 byte &0x40 position independent
14095: >>20 lelong !0 executable
14096: >>20 lelong =0 object file
14097: >16 lelong >0 not stripped
14098: 0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
14099: >12 string >\0 from '%s'
14100: >32 lelong !0 (signal %d)
14101:
14102: 0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
14103: >0 byte &0x80
14104: >>20 lelong <4096 shared library
14105: >>20 lelong =4096 dynamically linked executable
14106: >>20 lelong >4096 dynamically linked executable
14107: >0 byte ^0x80 executable
14108: >16 lelong >0 not stripped
14109: 0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
14110: >0 byte &0x80 dynamically linked executable
14111: >0 byte ^0x80 executable
14112: >16 lelong >0 not stripped
14113: 0 belong&0377777777 045400407 a.out NetBSD/vax 4k
14114: >0 byte &0x80 dynamically linked executable
14115: >0 byte ^0x80
14116: >>0 byte &0x40 position independent
14117: >>20 lelong !0 executable
14118: >>20 lelong =0 object file
14119: >16 lelong >0 not stripped
14120: 0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
14121: >12 string >\0 from '%s'
14122: >32 lelong !0 (signal %d)
14123:
14124: # NetBSD/alpha does not support (and has never supported) a.out objects,
14125: # so no rules are provided for them. NetBSD/alpha ELF objects are
14126: # dealt with in "elf".
14127: 0 lelong 0x00070185 ECOFF NetBSD/alpha binary
14128: >10 leshort 0x0001 not stripped
14129: >10 leshort 0x0000 stripped
14130: 0 belong&0377777777 043200507 a.out NetBSD/alpha core
14131: >12 string >\0 from '%s'
14132: >32 lelong !0 (signal %d)
14133:
14134: 0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
14135: >0 byte &0x80
14136: >>20 belong <8192 shared library
14137: >>20 belong =8192 dynamically linked executable
14138: >>20 belong >8192 dynamically linked executable
14139: >0 byte ^0x80 executable
14140: >16 belong >0 not stripped
14141: 0 belong&0377777777 043400410 a.out NetBSD/mips pure
14142: >0 byte &0x80 dynamically linked executable
14143: >0 byte ^0x80 executable
14144: >16 belong >0 not stripped
14145: 0 belong&0377777777 043400407 a.out NetBSD/mips
14146: >0 byte &0x80 dynamically linked executable
14147: >0 byte ^0x80
14148: >>0 byte &0x40 position independent
14149: >>20 belong !0 executable
14150: >>20 belong =0 object file
14151: >16 belong >0 not stripped
14152: 0 belong&0377777777 043400507 a.out NetBSD/mips core
14153: >12 string >\0 from '%s'
14154: >32 belong !0 (signal %d)
14155:
14156: 0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
14157: >0 byte &0x80
14158: >>20 lelong <4096 shared library
14159: >>20 lelong =4096 dynamically linked executable
14160: >>20 lelong >4096 dynamically linked executable
14161: >0 byte ^0x80 executable
14162: >16 lelong >0 not stripped
14163: 0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
14164: >0 byte &0x80 dynamically linked executable
14165: >0 byte ^0x80 executable
14166: >16 lelong >0 not stripped
14167: 0 belong&0377777777 043600407 a.out NetBSD/arm32
14168: >0 byte &0x80 dynamically linked executable
14169: >0 byte ^0x80
14170: >>0 byte &0x40 position independent
14171: >>20 lelong !0 executable
14172: >>20 lelong =0 object file
14173: >16 lelong >0 not stripped
14174: # NetBSD/arm26 has always used ELF objects, but it shares a core file
14175: # format with NetBSD/arm32.
14176: 0 belong&0377777777 043600507 a.out NetBSD/arm core
14177: >12 string >\0 from '%s'
14178: >32 lelong !0 (signal %d)
14179:
1.1.1.3 misho 14180: # Kernel core dump format
14181: 0 belong&0x0000ffff 0x00008fca NetBSD kernel core file
14182: >0 belong&0x03ff0000 0x00000000 \b, Unknown
14183: >0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020
14184: >0 belong&0x03ff0000 0x00020000 \b, sun 68020
14185: >0 belong&0x03ff0000 0x00640000 \b, 386 PC
14186: >0 belong&0x03ff0000 0x00860000 \b, i386 BSD
14187: >0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages)
14188: >0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages)
14189: >0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD
14190: >0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD
14191: >0 belong&0x03ff0000 0x008b0000 \b, pmax BSD
14192: >0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages)
14193: >0 belong&0x03ff0000 0x008d0000 \b, alpha BSD
14194: >0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian)
14195: >0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD
14196: >0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages)
14197: >0 belong&0x03ff0000 0x00910000 \b, sh3 BSD
14198: >0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian)
14199: >0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages)
14200: >0 belong&0x03ff0000 0x00940000 \b, mips1 BSD
14201: >0 belong&0x03ff0000 0x00950000 \b, mips2 BSD
14202: >0 belong&0x03ff0000 0x00960000 \b, parisc BSD
14203: >0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD
14204: >0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD
14205: >0 belong&0x03ff0000 0x00990000 \b, amd64 BSD
14206: >0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD
14207: >0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
14208: >0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
14209: >0 belong&0x03ff0000 0x00c80000 \b, hp200
14210: >0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX
14211: >0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX
14212: >0 belong&0xfc000000 0x04000000 \b, CPU
14213: >0 belong&0xfc000000 0x08000000 \b, DATA
14214: >0 belong&0xfc000000 0x10000000 \b, STACK
14215: >4 leshort x \b, (headersize = %d
14216: >6 leshort x \b, segmentsize = %d
14217: >6 lelong x \b, segments = %d)
14218:
1.1 misho 14219: #------------------------------------------------------------------------------
1.1.1.2 misho 14220: # $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14221: # netscape: file(1) magic for Netscape files
14222: # "H. Nanosecond" <aldomel@ix.netcom.com>
14223: # version 3 and 4 I think
14224: #
14225:
14226: # Netscape Address book .nab
14227: 0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
14228:
14229: # Netscape Communicator address book
14230: 0 string \000\017\102\111 Netscape Communicator address book
14231:
14232: # .snm Caches
14233: 0 string #\ Netscape\ folder\ cache Netscape folder cache
14234: 0 string \000\036\204\220\000 Netscape folder cache
14235: # .n2p
14236: # Net 2 Phone
14237: #0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
14238: 0 string SX961999 Net2phone
14239:
14240: #
14241: #This is files ending in .art, FIXME add more rules
14242: 0 string JG\004\016\0\0\0\0 ART
14243:
14244: #------------------------------------------------------------------------------
1.1.1.2 misho 14245: # $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14246: # netware: file(1) magic for NetWare Loadable Modules (NLMs)
14247: # From: Mads Martin Joergensen <mmj@suse.de>
14248:
14249: 0 string NetWare\ Loadable\ Module NetWare Loadable Module
14250:
14251: #------------------------------------------------------------------------------
1.1.1.2 misho 14252: # $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14253: # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
14254: #
14255: 0 string StartFontMetrics ASCII font metrics
14256: 0 string StartFont ASCII font bits
14257: 0 belong 0x137A2944 NeWS bitmap font
14258: 0 belong 0x137A2947 NeWS font family
14259: 0 belong 0x137A2950 scalable OpenFont binary
14260: 0 belong 0x137A2951 encrypted scalable OpenFont binary
14261: 8 belong 0x137A2B45 X11/NeWS bitmap font
14262: 8 belong 0x137A2B48 X11/NeWS font family
1.1.1.2 misho 14263:
1.1 misho 14264: #------------------------------------------------------------------------------
1.1.1.2 misho 14265: # $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14266: # nitpicker: file(1) magic for Flowfiles.
14267: # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
14268: 0 string NPFF NItpicker Flow File
14269: >4 byte x V%d.
14270: >5 byte x %d
14271: >6 bedate x started: %s
14272: >10 bedate x stopped: %s
14273: >14 belong x Bytes: %u
14274: >18 belong x Bytes1: %u
14275: >22 belong x Flows: %u
14276: >26 belong x Pkts: %u
14277:
14278: #------------------------------------------------------------------------------
1.1.1.3 misho 14279: # $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $
14280: # OASIS
14281: # Summary: OASIS stream file
14282: # Long descripton: Open Artwork System Interchange Standard
14283: # File extension: .oas
14284: # Full name: Ben Cowley (bcowley@broadcom.com)
14285: # Philip Dixon (pdixon@broadcom.com)
14286: # Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
14287: # (see page 3)
14288: 0 string %SEMI-OASIS\r\n OASIS Stream file
14289:
14290: #------------------------------------------------------------------------------
14291: # $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
1.1 misho 14292: # ocaml: file(1) magic for Objective Caml files.
14293: 0 string Caml1999 OCaml
14294: >8 string X exec file
14295: >8 string I interface file (.cmi)
14296: >8 string O object file (.cmo)
14297: >8 string A library file (.cma)
14298: >8 string Y native object file (.cmx)
14299: >8 string Z native library file (.cmxa)
14300: >8 string M abstract syntax tree implementation file
14301: >8 string N abstract syntax tree interface file
14302: >9 string >\0 (Version %3.3s)
1.1.1.2 misho 14303:
1.1 misho 14304: #------------------------------------------------------------------------------
1.1.1.2 misho 14305: # $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14306: # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
14307: 0 string Octave-1-L Octave binary data (little endian)
14308: 0 string Octave-1-B Octave binary data (big endian)
14309:
14310: #------------------------------------------------------------------------------
1.1.1.2 misho 14311: # $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14312: # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
14313: # storage (http://en.wikipedia.org/wiki/Structured_Storage)
14314: # Additional tests for OLE 2 Compound Documents should be under this recipe.
14315:
14316: 0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
14317: # - Microstation V8 DGN files (www.bentley.com)
14318: # Last update on 10/23/2006 by Lester Hightower
14319: > 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
14320: # - Visio documents
14321: # Last update on 10/23/2006 by Lester Hightower
14322: > 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
14323:
14324: #------------------------------------------------------------------------------
1.1.1.2 misho 14325: # $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14326: # olf: file(1) magic for OLF executables
14327: #
14328: # We have to check the byte order flag to see what byte order all the
14329: # other stuff in the header is in.
14330: #
14331: # MIPS R3000 may also be for MIPS R2000.
14332: # What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
14333: #
14334: # Created by Erik Theisen <etheisen@openbsd.org>
14335: # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
14336: 0 string \177OLF OLF
14337: >4 byte 0 invalid class
14338: >4 byte 1 32-bit
14339: >4 byte 2 64-bit
14340: >7 byte 0 invalid os
14341: >7 byte 1 OpenBSD
14342: >7 byte 2 NetBSD
14343: >7 byte 3 FreeBSD
14344: >7 byte 4 4.4BSD
14345: >7 byte 5 Linux
14346: >7 byte 6 SVR4
14347: >7 byte 7 esix
14348: >7 byte 8 Solaris
14349: >7 byte 9 Irix
14350: >7 byte 10 SCO
14351: >7 byte 11 Dell
14352: >7 byte 12 NCR
14353: >5 byte 0 invalid byte order
14354: >5 byte 1 LSB
14355: >>16 leshort 0 no file type,
14356: >>16 leshort 1 relocatable,
14357: >>16 leshort 2 executable,
14358: >>16 leshort 3 shared object,
14359: # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
14360: # corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
14361: >>16 leshort 4 core file
14362: >>>(0x38+0xcc) string >\0 of '%s'
14363: >>>(0x38+0x10) lelong >0 (signal %d),
14364: >>16 leshort &0xff00 processor-specific,
14365: >>18 leshort 0 no machine,
14366: >>18 leshort 1 AT&T WE32100 - invalid byte order,
14367: >>18 leshort 2 SPARC - invalid byte order,
14368: >>18 leshort 3 Intel 80386,
14369: >>18 leshort 4 Motorola 68000 - invalid byte order,
14370: >>18 leshort 5 Motorola 88000 - invalid byte order,
14371: >>18 leshort 6 Intel 80486,
14372: >>18 leshort 7 Intel 80860,
14373: >>18 leshort 8 MIPS R3000_BE - invalid byte order,
14374: >>18 leshort 9 Amdahl - invalid byte order,
14375: >>18 leshort 10 MIPS R3000_LE,
14376: >>18 leshort 11 RS6000 - invalid byte order,
14377: >>18 leshort 15 PA-RISC - invalid byte order,
14378: >>18 leshort 16 nCUBE,
14379: >>18 leshort 17 VPP500,
14380: >>18 leshort 18 SPARC32PLUS,
14381: >>18 leshort 20 PowerPC,
14382: >>18 leshort 0x9026 Alpha,
14383: >>20 lelong 0 invalid version
14384: >>20 lelong 1 version 1
14385: >>36 lelong 1 MathCoPro/FPU/MAU Required
14386: >8 string >\0 (%s)
14387: >5 byte 2 MSB
14388: >>16 beshort 0 no file type,
14389: >>16 beshort 1 relocatable,
14390: >>16 beshort 2 executable,
14391: >>16 beshort 3 shared object,
14392: >>16 beshort 4 core file,
14393: >>>(0x38+0xcc) string >\0 of '%s'
14394: >>>(0x38+0x10) belong >0 (signal %d),
14395: >>16 beshort &0xff00 processor-specific,
14396: >>18 beshort 0 no machine,
14397: >>18 beshort 1 AT&T WE32100,
14398: >>18 beshort 2 SPARC,
14399: >>18 beshort 3 Intel 80386 - invalid byte order,
14400: >>18 beshort 4 Motorola 68000,
14401: >>18 beshort 5 Motorola 88000,
14402: >>18 beshort 6 Intel 80486 - invalid byte order,
14403: >>18 beshort 7 Intel 80860,
14404: >>18 beshort 8 MIPS R3000_BE,
14405: >>18 beshort 9 Amdahl,
14406: >>18 beshort 10 MIPS R3000_LE - invalid byte order,
14407: >>18 beshort 11 RS6000,
14408: >>18 beshort 15 PA-RISC,
14409: >>18 beshort 16 nCUBE,
14410: >>18 beshort 17 VPP500,
14411: >>18 beshort 18 SPARC32PLUS,
14412: >>18 beshort 20 PowerPC or cisco 4500,
14413: >>18 beshort 21 cisco 7500,
14414: >>18 beshort 24 cisco SVIP,
14415: >>18 beshort 25 cisco 7200,
14416: >>18 beshort 36 cisco 12000,
14417: >>18 beshort 0x9026 Alpha,
14418: >>20 belong 0 invalid version
14419: >>20 belong 1 version 1
14420: >>36 belong 1 MathCoPro/FPU/MAU Required
1.1.1.2 misho 14421:
1.1 misho 14422: #------------------------------------------------------------------------------
1.1.1.2 misho 14423: # $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 14424: # os2: file(1) magic for OS/2 files
14425: #
14426:
14427: # Provided 1998/08/22 by
14428: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
14429: 1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
14430: >24 search/1 >\ (URL=<%s>)
14431:
14432: # OS/2 URL objects
14433: # Provided 1998/08/22 by
14434: # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
14435: #0 string http: OS/2 URL object text
14436: #>5 string >\ (WWW) <http:%s>
14437: #0 string mailto: OS/2 URL object text
14438: #>7 string >\ (email) <%s>
14439: #0 string news: OS/2 URL object text
14440: #>5 string >\ (Usenet) <%s>
14441: #0 string ftp: OS/2 URL object text
14442: #>4 string >\ (FTP) <ftp:%s>
14443: #0 string file: OS/2 URL object text
14444: #>5 string >\ (Local file) <%s>
14445:
14446: # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
14447: # Carl Hauser (chauser.parc@xerox.com) and
14448: # Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
14449: # list the following header format in inf02a.doc:
14450: #
14451: # int16 ID; // ID magic word (5348h = "HS")
14452: # int8 unknown1; // unknown purpose, could be third letter of ID
14453: # int8 flags; // probably a flag word...
14454: # // bit 0: set if INF style file
14455: # // bit 4: set if HLP style file
14456: # // patching this byte allows reading HLP files
14457: # // using the VIEW command, while help files
14458: # // seem to work with INF settings here as well.
14459: # int16 hdrsize; // total size of header
14460: # int16 unknown2; // unknown purpose
14461: #
14462: 0 string HSP\x01\x9b\x00 OS/2 INF
14463: >107 string >0 (%s)
14464: 0 string HSP\x10\x9b\x00 OS/2 HLP
14465: >107 string >0 (%s)
14466:
14467: # OS/2 INI (this is a guess)
14468: 0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
1.1.1.2 misho 14469:
1.1 misho 14470: #------------------------------------------------------------------------------
1.1.1.2 misho 14471: # $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 14472: # os400: file(1) magic for IBM OS/400 files
14473: #
14474: # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
14475: # In spite of its quite variable format (due to internal memory page
14476: # length differences between CISC and RISC versions of the OS) the
14477: # SAVF structure hasn't suitable offsets to identify the catalog
14478: # header in the first descriptor where there are some useful infos,
14479: # so we must search in a somewhat large area for a particular string
14480: # that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
14481: # descriptor space) preceded by a two byte constant.
14482: #
14483: 1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
14484: >&212 byte 0x01 \b, created with SAVOBJ
14485: >&212 byte 0x02 \b, created with SAVLIB
14486: >&212 byte 0x07 \b, created with SAVCFG
14487: >&212 byte 0x08 \b, created with SAVSECDTA
14488: >&212 byte 0x0A \b, created with SAVSECDTA
14489: >&212 byte 0x0B \b, created with SAVDLO
14490: >&212 byte 0x0D \b, created with SAVLICPGM
14491: >&212 byte 0x11 \b, created with SAVCHGOBJ
14492: >&213 byte 0x44 \b, at least V5R4 to open
14493: >&213 byte 0x43 \b, at least V5R3 to open
14494: >&213 byte 0x42 \b, at least V5R2 to open
14495: >&213 byte 0x41 \b, at least V5R1 to open
14496: >&213 byte 0x40 \b, at least V4R5 to open
14497: >&213 byte 0x3F \b, at least V4R4 to open
14498: >&213 byte 0x3E \b, at least V4R3 to open
14499: >&213 byte 0x3C \b, at least V4R2 to open
14500: >&213 byte 0x3D \b, at least V4R1M4 to open
14501: >&213 byte 0x3B \b, at least V4R1 to open
14502: >&213 byte 0x3A \b, at least V3R7 to open
14503: >&213 byte 0x35 \b, at least V3R6 to open
14504: >&213 byte 0x36 \b, at least V3R2 to open
14505: >&213 byte 0x34 \b, at least V3R1 to open
14506: >&213 byte 0x31 \b, at least V3R0M5 to open
14507: >&213 byte 0x30 \b, at least V2R3 to open
1.1.1.2 misho 14508:
14509: #------------------------------------------------------------------------------
1.1.1.3 misho 14510: # $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
1.1 misho 14511: #
14512: # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
14513: #
14514: # Redistribution and use in source and binary forms, with or without
14515: # modification, are permitted provided that the following conditions
14516: # are met:
14517: # 1. Redistributions of source code must retain the above copyright
14518: # notice, this list of conditions and the following disclaimer.
14519: # 2. Redistributions in binary form must reproduce the above copyright
14520: # notice, this list of conditions and the following disclaimer in the
14521: # documentation and/or other materials provided with the distribution.
14522: #
14523: # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14524: # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
14525: # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
14526: # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
14527: # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
14528: # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
14529: # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
14530: # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
14531: # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
14532: # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
14533: #
14534: #
14535: #
14536: # OS9/6809 module descriptions:
14537: #
14538: 0 beshort 0x87CD OS9/6809 module:
14539: #
14540: >6 byte&0x0f 0x00 non-executable
14541: >6 byte&0x0f 0x01 machine language
14542: >6 byte&0x0f 0x02 BASIC I-code
14543: >6 byte&0x0f 0x03 Pascal P-code
14544: >6 byte&0x0f 0x04 C I-code
14545: >6 byte&0x0f 0x05 COBOL I-code
14546: >6 byte&0x0f 0x06 Fortran I-code
14547: #
14548: >6 byte&0xf0 0x10 program executable
14549: >6 byte&0xf0 0x20 subroutine
14550: >6 byte&0xf0 0x30 multi-module
14551: >6 byte&0xf0 0x40 data module
14552: #
14553: >6 byte&0xf0 0xC0 system module
14554: >6 byte&0xf0 0xD0 file manager
14555: >6 byte&0xf0 0xE0 device driver
14556: >6 byte&0xf0 0xF0 device descriptor
14557: #
14558: # OS9/m68k stuff (to be continued)
14559: #
14560: 0 beshort 0x4AFC OS9/68K module:
14561: #
14562: # attr
14563: >0x14 byte&0x80 0x80 re-entrant
14564: >0x14 byte&0x40 0x40 ghost
14565: >0x14 byte&0x20 0x20 system-state
14566: #
14567: # lang:
14568: #
14569: >0x13 byte 1 machine language
14570: >0x13 byte 2 BASIC I-code
14571: >0x13 byte 3 Pascal P-code
14572: >0x13 byte 4 C I-code
14573: >0x13 byte 5 COBOL I-code
14574: >0x13 byte 6 Fortran I-code
14575: #
14576: #
14577: # type:
14578: #
14579: >0x12 byte 1 program executable
14580: >0x12 byte 2 subroutine
14581: >0x12 byte 3 multi-module
14582: >0x12 byte 4 data module
14583: >0x12 byte 11 trap library
14584: >0x12 byte 12 system module
14585: >0x12 byte 13 file manager
14586: >0x12 byte 14 device driver
14587: >0x12 byte 15 device descriptor
1.1.1.2 misho 14588:
14589: #------------------------------------------------------------------------------
14590: # $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
1.1 misho 14591: #
14592: # Mach magic number info
14593: #
14594: 0 long 0xefbe OSF/Rose object
14595: # I386 magic number info
14596: #
14597: 0 short 0565 i386 COFF object
14598:
14599: #------------------------------------------------------------------------------
1.1.1.3 misho 14600: # $File: palm,v 1.9 2012/01/16 15:16:43 christos Exp $
14601: # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
1.1 misho 14602: #
14603: # Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
14604:
1.1.1.3 misho 14605: # These are weak, byte 59 is not guaranteed to be 0 and there are
14606: # 8 character identifiers at byte 60, one I found for appl is BIGb.
14607: # What are the possibilities and where is this documented?
14608:
1.1 misho 14609: # appl
1.1.1.3 misho 14610: #59 byte \0
14611: #>60 string appl PalmOS application
14612: #>0 string >\0 "%s"
1.1 misho 14613: # TEXt
1.1.1.3 misho 14614: #59 byte \0
14615: #>60 belong TEXt AportisDoc file
14616: #>0 string >\0 "%s"
1.1 misho 14617: # HACK
1.1.1.3 misho 14618: #59 byte \0
14619: #>60 string HACK HackMaster hack
14620: #>0 string >\0 "%s"
1.1 misho 14621:
14622: # Variety of PalmOS document types
14623: # Michael-John Turner <mj@debian.org>
14624: # Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
1.1.1.3 misho 14625: 60 string BVokBDIC BDicty PalmOS document
14626: >0 string >\0 "%s"
14627: 60 string DB99DBOS DB PalmOS document
14628: >0 string >\0 "%s"
14629: 60 string vIMGView FireViewer/ImageViewer PalmOS document
14630: >0 string >\0 "%s"
14631: 60 string PmDBPmDB HanDBase PalmOS document
14632: >0 string >\0 "%s"
14633: 60 string InfoINDB InfoView PalmOS document
14634: >0 string >\0 "%s"
14635: 60 string ToGoToGo iSilo PalmOS document
14636: >0 string >\0 "%s"
14637: 60 string JfDbJBas JFile PalmOS document
14638: >0 string >\0 "%s"
14639: 60 string JfDbJFil JFile Pro PalmOS document
14640: >0 string >\0 "%s"
14641: 60 string DATALSdb List PalmOS document
14642: >0 string >\0 "%s"
14643: 60 string Mdb1Mdb1 MobileDB PalmOS document
14644: >0 string >\0 "%s"
14645: 60 string PNRdPPrs PeanutPress PalmOS document
14646: >0 string >\0 "%s"
14647: 60 string DataPlkr Plucker PalmOS document
14648: >0 string >\0 "%s"
14649: 60 string DataSprd QuickSheet PalmOS document
14650: >0 string >\0 "%s"
14651: 60 string SM01SMem SuperMemo PalmOS document
14652: >0 string >\0 "%s"
14653: 60 string TEXtTlDc TealDoc PalmOS document
14654: >0 string >\0 "%s"
14655: 60 string InfoTlIf TealInfo PalmOS document
14656: >0 string >\0 "%s"
14657: 60 string DataTlMl TealMeal PalmOS document
14658: >0 string >\0 "%s"
14659: 60 string DataTlPt TealPaint PalmOS document
14660: >0 string >\0 "%s"
14661: 60 string dataTDBP ThinkDB PalmOS document
14662: >0 string >\0 "%s"
14663: 60 string TdatTide Tides PalmOS document
14664: >0 string >\0 "%s"
14665: 60 string ToRaTRPW TomeRaider PalmOS document
14666: >0 string >\0 "%s"
1.1 misho 14667:
14668: # A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
14669: # For version 1.xx zTXTs, outputs version and numbers of bookmarks and
14670: # annotations.
14671: # For other versions, just outputs version.
14672: #
14673: 60 string zTXT A GutenPalm zTXT e-book
14674: >0 string >\0 "%s"
14675: >(0x4E.L) byte 0
14676: >>(0x4E.L+1) byte x (v0.%02d)
14677: >(0x4E.L) byte 1
14678: >>(0x4E.L+1) byte x (v1.%02d)
14679: >>>(0x4E.L+10) beshort >0
14680: >>>>(0x4E.L+10) beshort <2 - 1 bookmark
14681: >>>>(0x4E.L+10) beshort >1 - %d bookmarks
14682: >>>(0x4E.L+14) beshort >0
14683: >>>>(0x4E.L+14) beshort <2 - 1 annotation
14684: >>>>(0x4E.L+14) beshort >1 - %d annotations
14685: >(0x4E.L) byte >1 (v%d.
14686: >>(0x4E.L+1) byte x %02d)
14687:
14688: # Palm OS .prc file types
14689: 60 string libr Palm OS dynamic library data
14690: >0 string >\0 "%s"
14691: 60 string ptch Palm OS operating system patch data
14692: >0 string >\0 "%s"
14693:
14694: # Mobipocket (www.mobipocket.com), donated by Carl Witty
1.1.1.3 misho 14695: 60 string BOOKMOBI Mobipocket E-book
14696: >0 string >\0 "%s"
1.1 misho 14697:
14698: #------------------------------------------------------------------------------
1.1.1.2 misho 14699: # $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 14700: #
14701: # Parix COFF executables
14702: # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
14703: #
14704: 0 beshort&0xfff 0xACE PARIX
14705: >0 byte&0xf0 0x80 T800
14706: >0 byte&0xf0 0x90 T9000
14707: >19 byte&0x02 0x02 executable
14708: >19 byte&0x02 0x00 object
14709: >19 byte&0x0c 0x00 not stripped
1.1.1.3 misho 14710: #------------------------------------------------------------------------------
14711: # $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
14712: # parrot: file(1) magic for Parrot Virtual Machine
14713: # URL: http://www.lua.org/
14714: # From: Lubomir Rintel <lkundrak@v3.sk>
14715:
14716: # Compiled Parrot byte code
14717: 0 string \376PBC\r\n\032\n Parrot bytecode
14718: >64 byte x %d.
14719: >72 byte x \b%d,
14720: >8 byte >0 %d byte words,
14721: >16 byte 0 little-endian,
14722: >16 byte 1 big-endian,
14723: >32 byte 0 IEEE-754 8 byte double floats,
14724: >32 byte 1 x86 12 byte long double floats,
14725: >32 byte 2 IEEE-754 16 byte long double floats,
14726: >32 byte 3 MIPS 16 byte long double floats,
14727: >32 byte 4 AIX 16 byte long double floats,
14728: >32 byte 5 4-byte floats,
14729: >40 byte x Parrot %d.
14730: >48 byte x \b%d.
14731: >56 byte x \b%d
14732: #------------------------------------------------------------------------------
14733: # $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
14734: # pascal: file(1) magic for Pascal source
14735: #
14736: 0 search/8192 (input, Pascal source text
14737: !:mime text/x-pascal
14738: 0 regex \^program Pascal source text
14739: !:mime text/x-pascal
14740: 0 regex \^record Pascal source text
14741: !:mime text/x-pascal
1.1 misho 14742:
14743: #------------------------------------------------------------------------------
1.1.1.2 misho 14744: # $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14745: # pbm: file(1) magic for Portable Bitmap files
14746: #
14747: # XXX - byte order?
14748: #
14749: 0 short 0x2a17 "compact bitmap" format (Poskanzer)
1.1.1.2 misho 14750:
1.1 misho 14751: #------------------------------------------------------------------------------
1.1.1.2 misho 14752: # $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14753: # pdf: file(1) magic for Portable Document Format
14754: #
14755:
14756: 0 string %PDF- PDF document
14757: !:mime application/pdf
14758: >5 byte x \b, version %c
14759: >7 byte x \b.%c
14760:
14761: # From: Nick Schmalenberger <nick@schmalenberger.us>
14762: # Forms Data Format
14763: 0 string %FDF- FDF document
14764: >5 byte x \b, version %c
14765: >7 byte x \b.%c
14766:
14767: #------------------------------------------------------------------------------
1.1.1.2 misho 14768: # $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $
1.1 misho 14769: # pdp: file(1) magic for PDP-11 executable/object and APL workspace
14770: #
14771: 0 lelong 0101555 PDP-11 single precision APL workspace
14772: 0 lelong 0101554 PDP-11 double precision APL workspace
14773: #
14774: # PDP-11 a.out
14775: #
14776: 0 leshort 0407 PDP-11 executable
14777: >8 leshort >0 not stripped
14778: >15 byte >0 - version %ld
14779:
14780: 0 leshort 0401 PDP-11 UNIX/RT ldp
14781: 0 leshort 0405 PDP-11 old overlay
14782:
14783: 0 leshort 0410 PDP-11 pure executable
14784: >8 leshort >0 not stripped
14785: >15 byte >0 - version %ld
14786:
14787: 0 leshort 0411 PDP-11 separate I&D executable
14788: >8 leshort >0 not stripped
14789: >15 byte >0 - version %ld
14790:
14791: 0 leshort 0437 PDP-11 kernel overlay
14792:
14793: # These last three are derived from 2.11BSD file(1)
14794: 0 leshort 0413 PDP-11 demand-paged pure executable
14795: >8 leshort >0 not stripped
14796:
14797: 0 leshort 0430 PDP-11 overlaid pure executable
14798: >8 leshort >0 not stripped
14799:
14800: 0 leshort 0431 PDP-11 overlaid separate executable
14801: >8 leshort >0 not stripped
14802: #------------------------------------------------------------------------------
1.1.1.3 misho 14803: # $File: perl,v 1.20 2012/06/21 01:16:49 christos Exp $
1.1 misho 14804: # perl: file(1) magic for Larry Wall's perl language.
14805: #
14806: # The `eval' lines recognizes an outrageously clever hack.
14807: # Keith Waclena <keith@cerberus.uchicago.edu>
14808: # Send additions to <perl5-porters@perl.org>
1.1.1.2 misho 14809: 0 search/1/w #!\ /bin/perl Perl script text executable
1.1 misho 14810: !:mime text/x-perl
14811: 0 search/1 eval\ "exec\ /bin/perl Perl script text
14812: !:mime text/x-perl
1.1.1.2 misho 14813: 0 search/1/w #!\ /usr/bin/perl Perl script text executable
1.1 misho 14814: !:mime text/x-perl
14815: 0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
14816: !:mime text/x-perl
1.1.1.2 misho 14817: 0 search/1/w #!\ /usr/local/bin/perl Perl script text executable
1.1 misho 14818: !:mime text/x-perl
14819: 0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
14820: !:mime text/x-perl
14821: 0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
14822: !:mime text/x-perl
1.1.1.3 misho 14823: 0 search/1 #!/usr/bin/env\ perl Perl script text executable
14824: !:mime text/x-perl
14825: 0 search/1 #!\ /usr/bin/env\ perl Perl script text executable
14826: !:mime text/x-perl
1.1 misho 14827:
14828: # by Dmitry V. Levin and Alexey Tourbin
14829: # check the first line
14830: 0 search/1 package
14831: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
1.1.1.3 misho 14832: !:strength + 10
1.1 misho 14833: # not 'p', check other lines
14834: 0 search/1 !p
14835: >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
14836: >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
1.1.1.3 misho 14837: !:strength + 10
1.1 misho 14838:
14839: # Perl POD documents
14840: # From: Tom Hukins <tom@eborcom.com>
1.1.1.2 misho 14841: 0 search/1/W \=pod\n Perl POD document text
14842: 0 search/1/W \n\=pod\n Perl POD document text
14843: 0 search/1/W \=head1\ Perl POD document text
14844: 0 search/1/W \n\=head1\ Perl POD document text
14845: 0 search/1/W \=head2\ Perl POD document text
14846: 0 search/1/W \n\=head2\ Perl POD document text
1.1.1.3 misho 14847: 0 search/1/W \=encoding\ Perl POD document text
14848: 0 search/1/W \n\=encoding\ Perl POD document text
14849:
1.1 misho 14850:
14851: # Perl Storable data files.
14852: 0 string perl-store perl Storable (v0.6) data
14853: >4 byte >0 (net-order %d)
14854: >>4 byte &01 (network-ordered)
14855: >>4 byte =3 (major 1)
14856: >>4 byte =2 (major 1)
14857:
14858: 0 string pst0 perl Storable (v0.7) data
14859: >4 byte >0
14860: >>4 byte &01 (network-ordered)
14861: >>4 byte =5 (major 2)
14862: >>4 byte =4 (major 2)
14863: >>5 byte >0 (minor %d)
14864:
14865: #------------------------------------------------------------------------------
1.1.1.2 misho 14866: # $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $
1.1 misho 14867: # pgp: file(1) magic for Pretty Good Privacy
14868: # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
14869: #
14870: 0 beshort 0x9900 PGP key public ring
14871: !:mime application/x-pgp-keyring
14872: 0 beshort 0x9501 PGP key security ring
14873: !:mime application/x-pgp-keyring
14874: 0 beshort 0x9500 PGP key security ring
14875: !:mime application/x-pgp-keyring
14876: 0 beshort 0xa600 PGP encrypted data
14877: #!:mime application/pgp-encrypted
14878: #0 string -----BEGIN\040PGP text/PGP armored data
14879: !:mime text/PGP # encoding: armored data
14880: #>15 string PUBLIC\040KEY\040BLOCK- public key block
14881: #>15 string MESSAGE- message
14882: #>15 string SIGNED\040MESSAGE- signed message
14883: #>15 string PGP\040SIGNATURE- signature
14884:
14885: 2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
14886: !:mime application/pgp-keys
14887: 0 string -----BEGIN\040PGP\40MESSAGE- PGP message
14888: !:mime application/pgp
14889: 0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
14890: !:mime application/pgp-signature
14891:
14892: #------------------------------------------------------------------------------
1.1.1.2 misho 14893: # $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14894: # pkgadd: file(1) magic for SysV R4 PKG Datastreams
14895: #
14896: 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
14897: !:mime application/x-svr4-package
14898:
14899: #------------------------------------------------------------------------------
1.1.1.2 misho 14900: # $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
1.1 misho 14901: # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
14902: # From: "Stefan A. Haubenthal" <polluks@web.de>
14903: #
14904: 0 belong 0x00000107 Plan 9 executable, Motorola 68k
14905: 0 belong 0x000001EB Plan 9 executable, Intel 386
14906: 0 belong 0x00000247 Plan 9 executable, Intel 960
14907: 0 belong 0x000002AB Plan 9 executable, SPARC
14908: 0 belong 0x00000407 Plan 9 executable, MIPS R3000
14909: 0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
14910: 0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
14911: 0 belong 0x000005AB Plan 9 executable, AMD 29000
14912: 0 belong 0x00000647 Plan 9 executable, ARM 7-something
14913: 0 belong 0x000006EB Plan 9 executable, PowerPC
14914: 0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
14915: 0 belong 0x0000084B Plan 9 executable, DEC Alpha
14916:
14917: #------------------------------------------------------------------------------
1.1.1.2 misho 14918: # $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 14919: # plus5: file(1) magic for Plus Five's UNIX MUMPS
14920: #
14921: # XXX - byte order? Paging Hokey....
14922: #
14923: 0 short 0x259 mumps avl global
14924: >2 byte >0 (V%d)
14925: >6 byte >0 with %d byte name
14926: >7 byte >0 and %d byte data cells
14927: 0 short 0x25a mumps blt global
14928: >2 byte >0 (V%d)
14929: >8 short >0 - %d byte blocks
14930: >15 byte 0x00 - P/D format
14931: >15 byte 0x01 - P/K/D format
14932: >15 byte 0x02 - K/D format
14933: >15 byte >0x02 - Bad Flags
14934:
14935: #------------------------------------------------------------------------------
1.1.1.3 misho 14936: # $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
1.1 misho 14937: # printer: file(1) magic for printer-formatted files
14938: #
14939:
14940: # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
14941: 0 string %! PostScript document text
14942: !:mime application/postscript
1.1.1.2 misho 14943: !:apple ASPSTEXT
1.1 misho 14944: >2 string PS-Adobe- conforming
14945: >>11 string >\0 DSC level %.3s
14946: >>>15 string EPS \b, type %s
14947: >>>15 string Query \b, type %s
14948: >>>15 string ExitServer \b, type %s
14949: >>>15 search/1000 %%LanguageLevel:\
14950: >>>>&0 string >\0 \b, Level %s
14951: # Some PCs have the annoying habit of adding a ^D as a document separator
14952: 0 string \004%! PostScript document text
14953: !:mime application/postscript
1.1.1.2 misho 14954: !:apple ASPSTEXT
1.1 misho 14955: >3 string PS-Adobe- conforming
14956: >>12 string >\0 DSC level %.3s
14957: >>>16 string EPS \b, type %s
14958: >>>16 string Query \b, type %s
14959: >>>16 string ExitServer \b, type %s
14960: >>>16 search/1000 %%LanguageLevel:\
14961: >>>>&0 string >\0 \b, Level %s
14962: 0 string \033%-12345X%!PS PostScript document
14963:
14964: # DOS EPS Binary File Header
14965: # From: Ed Sznyter <ews@Black.Market.NET>
14966: 0 belong 0xC5D0D3C6 DOS EPS Binary File
14967: >4 long >0 Postscript starts at byte %d
14968: >>8 long >0 length %d
14969: >>>12 long >0 Metafile starts at byte %d
14970: >>>>16 long >0 length %d
14971: >>>20 long >0 TIFF starts at byte %d
14972: >>>>24 long >0 length %d
14973:
14974: # Summary: Adobe's PostScript Printer Description File
14975: # Extension: .ppd
14976: # Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
14977: # Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
14978: #
14979: 0 string *PPD-Adobe:\x20 PPD file
14980: >&0 string x \b, version %s
14981:
14982: # HP Printer Job Language
14983: 0 string \033%-12345X@PJL HP Printer Job Language data
14984: # HP Printer Job Language
14985: # The header found on Win95 HP plot files is the "Silliest Thing possible"
14986: # (TM)
14987: # Every driver puts the language at some random position, with random case
14988: # (LANGUAGE and Language)
14989: # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
14990: # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
14991: #
14992: 0 string \033%-12345X@PJL HP Printer Job Language data
14993: >&0 string >\0 %s
14994: >>&0 string >\0 %s
14995: >>>&0 string >\0 %s
14996: >>>>&0 string >\0 %s
14997: #>15 string \ ENTER\ LANGUAGE\ =
14998: #>31 string PostScript PostScript
14999:
1.1.1.3 misho 15000: # From: Stefan Thurner <thurners@nicsys.de>
15001: 0 string \033%-12345X@PJL
15002: >&0 search/10000 %! PJL encapsulated PostScript document text
15003:
1.1 misho 15004: # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
15005: 0 string \033E\033 HP PCL printer data
15006: >3 string \&l0A - default page size
15007: >3 string \&l1A - US executive page size
15008: >3 string \&l2A - US letter page size
15009: >3 string \&l3A - US legal page size
15010: >3 string \&l26A - A4 page size
15011: >3 string \&l80A - Monarch envelope size
15012: >3 string \&l81A - No. 10 envelope size
15013: >3 string \&l90A - Intl. DL envelope size
15014: >3 string \&l91A - Intl. C5 envelope size
15015: >3 string \&l100A - Intl. B5 envelope size
15016: >3 string \&l-81A - No. 10 envelope size (landscape)
15017: >3 string \&l-90A - Intl. DL envelope size (landscape)
15018:
15019: # IMAGEN printer-ready files:
15020: 0 string @document( Imagen printer
15021: # this only works if "language xxx" is first item in Imagen header.
15022: >10 string language\ impress (imPRESS data)
15023: >10 string language\ daisy (daisywheel text)
15024: >10 string language\ diablo (daisywheel text)
15025: >10 string language\ printer (line printer emulation)
15026: >10 string language\ tektronix (Tektronix 4014 emulation)
15027: # Add any other languages that your Imagen uses - remember
15028: # to keep the word `text' if the file is human-readable.
15029: # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
15030: #
15031: # Now magic for IMAGEN font files...
15032: 0 string Rast RST-format raster font data
15033: >45 string >0 face %s
15034: # From Jukka Ukkonen
15035: 0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
15036:
15037: # From <mike@flyn.org>
15038: # These are the /etc/magic entries to decode data sent to an Epson printer.
15039: 0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
15040:
15041:
15042: #------------------------------------------------------------------------------
15043: # zenographics: file(1) magic for Zenographics ZjStream printer data
15044: # Rick Richardson rickr@mn.rr.com
15045: 0 string JZJZ
15046: >0x12 string ZZ Zenographics ZjStream printer data (big-endian)
15047: 0 string ZJZJ
15048: >0x12 string ZZ Zenographics ZjStream printer data (little-endian)
15049:
15050:
15051: #------------------------------------------------------------------------------
15052: # Oak Technologies printer stream
15053: # Rick Richardson <rickr@mn.rr.com>
15054: 0 string OAK
15055: >0x07 byte 0
15056: >0x0b byte 0 Oak Technologies printer stream
15057:
15058: # This would otherwise be recognized as PostScript - nick@debian.org
15059: 0 string %!VMF SunClock's Vector Map Format data
15060:
15061: #------------------------------------------------------------------------------
15062: # HP LaserJet 1000 series downloadable firmware file
15063: 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
15064:
15065: # From: Paolo <oopla@users.sf.net>
15066: # Epson ESC/Page, ESC/PageColor
15067: 0 string \x1b\x01@EJL Epson ESC/Page language printer data
15068:
15069: #------------------------------------------------------------------------------
1.1.1.2 misho 15070: # $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
1.1 misho 15071: # project: file(1) magic for Project management
15072: #
15073: # Magic strings for ftnchek project files. Alexander Mai
15074: 0 string FTNCHEK_\ P project file for ftnchek
15075: >10 string 1 version 2.7
15076: >10 string 2 version 2.8 to 2.10
15077: >10 string 3 version 2.11 or later
15078:
15079: #------------------------------------------------------------------------------
1.1.1.2 misho 15080: # $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
1.1 misho 15081: # psdbms: file(1) magic for psdatabase
15082: #
15083: 0 belong&0xff00ffff 0x56000000 ps database
15084: >1 string >\0 version %s
15085: >4 string >\0 from kernel %s
15086:
15087: #------------------------------------------------------------------------------
1.1.1.2 misho 15088: # $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 15089: # pulsar: file(1) magic for Pulsar POP3 daemon binary files
15090: #
15091: # http://pulsar.sourceforge.net
15092: # mailto:rok.papez@lugos.si
15093: #
15094:
15095: 0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
15096: >4 ubelong x Version: %d.
15097: >8 ubelong x \b%d
15098:
15099:
15100: #------------------------------------------------------------------------------
1.1.1.3 misho 15101: # $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
15102: # pwsafe: file(1) magic for passwordsafe file
15103: #
15104: # Password Safe
15105: # http://passwordsafe.sourceforge.net/
15106: # file format specs
15107: # http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
15108: # V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
15109: # V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
15110: # V2 and V1 have no easy identifier that I can find
15111: # .psafe3
15112: 0 string PWS3 Password Safe V3 database
15113:
15114: #------------------------------------------------------------------------------
1.1.1.2 misho 15115: # $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 15116: # pyramid: file(1) magic for Pyramids
15117: #
15118: # XXX - byte order?
15119: #
15120: 0 long 0x50900107 Pyramid 90x family executable
15121: 0 long 0x50900108 Pyramid 90x family pure executable
15122: >16 long >0 not stripped
15123: 0 long 0x5090010b Pyramid 90x family demand paged pure executable
15124: >16 long >0 not stripped
15125:
15126: #------------------------------------------------------------------------------
1.1.1.3 misho 15127: # $File: python,v 1.22 2013/03/18 12:49:55 christos Exp $
1.1 misho 15128: # python: file(1) magic for python
15129: #
1.1.1.3 misho 15130: # Outlook puts """ too for urgent messages
1.1 misho 15131: # From: David Necas <yeti@physics.muni.cz>
15132: # often the module starts with a multiline string
1.1.1.3 misho 15133: 0 string/t """ Python script text executable
15134: # MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
1.1.1.2 misho 15135: # that Py_UnicodeFlag is off for Python 2)
1.1 misho 15136: # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
15137: 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
15138: 0 belong 0x87c60d0a python 2.0 byte-compiled
15139: 0 belong 0x2aeb0d0a python 2.1 byte-compiled
15140: 0 belong 0x2ded0d0a python 2.2 byte-compiled
15141: 0 belong 0x3bf20d0a python 2.3 byte-compiled
15142: 0 belong 0x6df20d0a python 2.4 byte-compiled
15143: 0 belong 0xb3f20d0a python 2.5 byte-compiled
1.1.1.2 misho 15144: 0 belong 0xd1f20d0a python 2.6 byte-compiled
1.1.1.3 misho 15145: 0 belong 0x03f30d0a python 2.7 byte-compiled
1.1.1.2 misho 15146: 0 belong 0x3b0c0d0a python 3.0 byte-compiled
15147: 0 belong 0x4f0c0d0a python 3.1 byte-compiled
1.1.1.3 misho 15148: 0 belong 0x6c0c0d0a python 3.2 byte-compiled
15149: 0 belong 0x9e0c0d0a python 3.3 byte-compiled
1.1.1.2 misho 15150:
15151: 0 search/1/w #!\ /usr/bin/python Python script text executable
15152: !:mime text/x-python
15153: 0 search/1/w #!\ /usr/local/bin/python Python script text executable
15154: !:mime text/x-python
15155: 0 search/1 #!/usr/bin/env\ python Python script text executable
15156: !:mime text/x-python
1.1.1.3 misho 15157: 0 search/1 #!\ /usr/bin/env\ python Python script text executable
15158: !:mime text/x-python
15159:
15160:
15161: # from module.submodule import func1, func2
15162: 0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
15163: !:mime text/x-python
15164:
15165: # def __init__ (self, ...):
15166: 0 search/4096 def\ __init__
15167: >&0 search/64 self Python script text executable
15168: !:mime text/x-python
15169:
15170: # comments
15171: 0 search/4096 '''
15172: >&0 regex .*'''$ Python script text executable
15173: !:mime text/x-python
15174:
15175: 0 search/4096 """
15176: >&0 regex .*"""$ Python script text executable
15177: !:mime text/x-python
15178:
15179: # try:
15180: # except: or finally:
15181: # block
15182: 0 search/4096 try:
15183: >&0 regex \^\\s*except.*: Python script text executable
15184: !:mime text/x-python
15185: >&0 search/4096 finally: Python script text executable
15186: !:mime text/x-python
15187:
15188: # def name(args, args):
15189: 0 regex \^(\ |\\t)*def\ +[a-zA-Z]+
15190: >&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable
1.1.1.2 misho 15191: !:mime text/x-python
1.1 misho 15192:
15193: #------------------------------------------------------------------------------
1.1.1.3 misho 15194: # $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
1.1 misho 15195: # file(1) magic for revision control files
15196: # From Hendrik Scholz <hendrik@scholz.net>
1.1.1.3 misho 15197: 0 string/t /1\ :pserver: cvs password text file
1.1 misho 15198:
15199: # Conary changesets
15200: # From: Jonathan Smith <smithj@rpath.com>
15201: 0 belong 0xea3f81bb Conary changeset data
15202:
15203: # Type: Git bundles (git-bundle)
15204: # From: Josh Triplett <josh@freedesktop.org>
15205: 0 string #\ v2\ git\ bundle\n Git bundle
15206:
1.1.1.2 misho 15207: # Type: Git pack
15208: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
15209: # The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
15210: # those have a little-endian offset immediately following the magic 'PACK',
15211: # the first byte of which is never 0, while the first byte of the Git pack
15212: # version, since it's a tiny number stored in big-endian format, is always 0.
15213: 0 string PACK\0 Git pack
15214: >4 belong >0 \b, version %d
15215: >>8 belong >0 \b, %d objects
15216:
15217: # Type: Git pack index
15218: # From: Adam Buchbinder <adam.buchbinder@gmail.com>
15219: 0 string \377tOc Git pack index
15220: >4 belong =2 \b, version 2
15221:
15222: # Type: Git index file
1.1.1.3 misho 15223: # From: Frederic Briare <fbriere@fbriere.net>
1.1.1.2 misho 15224: 0 string DIRC Git index
15225: >4 belong >0 \b, version %d
15226: >>8 belong >0 \b, %d entries
15227:
1.1 misho 15228: # Type: Mercurial bundles
15229: # From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
15230: 0 string HG10 Mercurial bundle,
15231: >4 string UN uncompressed
15232: >4 string BZ bzip2 compressed
15233:
15234: # Type: Subversion (SVN) dumps
15235: # From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
15236: 0 string SVN-fs-dump-format-version: Subversion dumpfile
15237: >28 string >\0 (version: %s)
15238:
15239: # Type: Bazaar revision bundles and merge requests
15240: # URL: http://www.bazaar-vcs.org/
15241: # From: Jelmer Vernooij <jelmer@samba.org>
15242: 0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle
15243: 0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
15244:
15245: #------------------------------------------------------------------------------
1.1.1.3 misho 15246: # $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $
1.1 misho 15247: # riff: file(1) magic for RIFF format
15248: # See
15249: #
15250: # http://www.seanet.com/users/matts/riffmci/riffmci.htm
15251: #
1.1.1.3 misho 15252: # AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
1.1 misho 15253: #
15254: 0 string RIFF RIFF (little-endian) data
15255: # RIFF Palette format
15256: >8 string PAL \b, palette
15257: >>16 leshort x \b, version %d
15258: >>18 leshort x \b, %d entries
15259: # RIFF Device Independent Bitmap format
15260: >8 string RDIB \b, device-independent bitmap
15261: >>16 string BM
15262: >>>30 leshort 12 \b, OS/2 1.x format
15263: >>>>34 leshort x \b, %d x
15264: >>>>36 leshort x %d
15265: >>>30 leshort 64 \b, OS/2 2.x format
15266: >>>>34 leshort x \b, %d x
15267: >>>>36 leshort x %d
15268: >>>30 leshort 40 \b, Windows 3.x format
15269: >>>>34 lelong x \b, %d x
15270: >>>>38 lelong x %d x
15271: >>>>44 leshort x %d
15272: # RIFF MIDI format
15273: >8 string RMID \b, MIDI
15274: # RIFF Multimedia Movie File format
15275: >8 string RMMP \b, multimedia movie
15276: # RIFF wrapper for MP3
15277: >8 string RMP3 \b, MPEG Layer 3 audio
15278: # Microsoft WAVE format (*.wav)
15279: >8 string WAVE \b, WAVE audio
15280: !:mime audio/x-wav
15281: >>20 leshort 1 \b, Microsoft PCM
15282: >>>34 leshort >0 \b, %d bit
15283: >>20 leshort 2 \b, Microsoft ADPCM
15284: >>20 leshort 6 \b, ITU G.711 A-law
15285: >>20 leshort 7 \b, ITU G.711 mu-law
1.1.1.2 misho 15286: >>20 leshort 8 \b, Microsoft DTS
1.1 misho 15287: >>20 leshort 17 \b, IMA ADPCM
15288: >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
15289: >>20 leshort 49 \b, GSM 6.10
15290: >>20 leshort 64 \b, ITU G.721 ADPCM
15291: >>20 leshort 80 \b, MPEG
15292: >>20 leshort 85 \b, MPEG Layer 3
1.1.1.2 misho 15293: >>20 leshort 0x2001 \b, DTS
1.1 misho 15294: >>22 leshort =1 \b, mono
15295: >>22 leshort =2 \b, stereo
15296: >>22 leshort >2 \b, %d channels
15297: >>24 lelong >0 %d Hz
15298: # Corel Draw Picture
15299: >8 string CDRA \b, Corel Draw Picture
15300: !:mime image/x-coreldraw
15301: # AVI == Audio Video Interleave
15302: >8 string AVI\040 \b, AVI
15303: !:mime video/x-msvideo
15304: >>12 string LIST
15305: >>>20 string hdrlavih
15306: >>>>&36 lelong x \b, %lu x
15307: >>>>&40 lelong x %lu,
15308: >>>>&4 lelong >1000000 <1 fps,
15309: >>>>&4 lelong 1000000 1.00 fps,
15310: >>>>&4 lelong 500000 2.00 fps,
15311: >>>>&4 lelong 333333 3.00 fps,
15312: >>>>&4 lelong 250000 4.00 fps,
15313: >>>>&4 lelong 200000 5.00 fps,
15314: >>>>&4 lelong 166667 6.00 fps,
15315: >>>>&4 lelong 142857 7.00 fps,
15316: >>>>&4 lelong 125000 8.00 fps,
15317: >>>>&4 lelong 111111 9.00 fps,
15318: >>>>&4 lelong 100000 10.00 fps,
15319: # ]9.9,10.1[
15320: >>>>&4 lelong <101010
15321: >>>>>&-4 lelong >99010
15322: >>>>>>&-4 lelong !100000 ~10 fps,
15323: >>>>&4 lelong 83333 12.00 fps,
15324: # ]11.9,12.1[
15325: >>>>&4 lelong <84034
15326: >>>>>&-4 lelong >82645
15327: >>>>>>&-4 lelong !83333 ~12 fps,
15328: >>>>&4 lelong 66667 15.00 fps,
15329: # ]14.9,15.1[
15330: >>>>&4 lelong <67114
15331: >>>>>&-4 lelong >66225
15332: >>>>>>&-4 lelong !66667 ~15 fps,
15333: >>>>&4 lelong 50000 20.00 fps,
15334: >>>>&4 lelong 41708 23.98 fps,
15335: >>>>&4 lelong 41667 24.00 fps,
15336: # ]23.9,24.1[
15337: >>>>&4 lelong <41841
15338: >>>>>&-4 lelong >41494
15339: >>>>>>&-4 lelong !41708
15340: >>>>>>>&-4 lelong !41667 ~24 fps,
15341: >>>>&4 lelong 40000 25.00 fps,
15342: # ]24.9,25.1[
15343: >>>>&4 lelong <40161
15344: >>>>>&-4 lelong >39841
15345: >>>>>>&-4 lelong !40000 ~25 fps,
15346: >>>>&4 lelong 33367 29.97 fps,
15347: >>>>&4 lelong 33333 30.00 fps,
15348: # ]29.9,30.1[
15349: >>>>&4 lelong <33445
15350: >>>>>&-4 lelong >33223
15351: >>>>>>&-4 lelong !33367
15352: >>>>>>>&-4 lelong !33333 ~30 fps,
15353: >>>>&4 lelong <32224 >30 fps,
15354: ##>>>>&4 lelong x (%lu)
15355: ##>>>>&20 lelong x %lu frames,
15356: # Note: The tests below assume that the AVI has 1 or 2 streams,
15357: # "vids" optionally followed by "auds".
15358: # (Should cover 99.9% of all AVIs.)
15359: # assuming avih length = 56
15360: >>>88 string LIST
15361: >>>>96 string strlstrh
15362: >>>>>108 string vids video:
15363: >>>>>>&0 lelong 0 uncompressed
15364: # skip past vids strh
15365: >>>>>>(104.l+108) string strf
15366: >>>>>>>(104.l+132) lelong 1 RLE 8bpp
15367: >>>>>>>(104.l+132) string/c cvid Cinepak
15368: >>>>>>>(104.l+132) string/c i263 Intel I.263
15369: >>>>>>>(104.l+132) string/c iv32 Indeo 3.2
15370: >>>>>>>(104.l+132) string/c iv41 Indeo 4.1
15371: >>>>>>>(104.l+132) string/c iv50 Indeo 5.0
15372: >>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
15373: >>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
15374: >>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
15375: >>>>>>>(104.l+132) string/c mjpg Motion JPEG
15376: >>>>>>>(104.l+132) string/c div3 DivX 3
15377: >>>>>>>>112 string/c div3 Low-Motion
15378: >>>>>>>>112 string/c div4 Fast-Motion
15379: >>>>>>>(104.l+132) string/c divx DivX 4
15380: >>>>>>>(104.l+132) string/c dx50 DivX 5
15381: >>>>>>>(104.l+132) string/c xvid XviD
15382: >>>>>>>(104.l+132) string/c h264 H.264
15383: >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
15384: >>>>>>>(104.l+132) string/c h264 X.264 or H.264
15385: >>>>>>>(104.l+132) lelong 0
15386: ##>>>>>>>(104.l+132) string x (%.4s)
15387: # skip past first (video) LIST
15388: >>>>(92.l+96) string LIST
15389: >>>>>(92.l+104) string strlstrh
15390: >>>>>>(92.l+116) string auds \b, audio:
15391: # auds strh length = 56:
15392: >>>>>>>(92.l+172) string strf
15393: >>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
15394: >>>>>>>>(92.l+180) leshort 0x0002 ADPCM
15395: >>>>>>>>(92.l+180) leshort 0x0006 aLaw
15396: >>>>>>>>(92.l+180) leshort 0x0007 uLaw
15397: >>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
15398: >>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
15399: >>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
15400: >>>>>>>>(92.l+180) leshort 0x0161 DivX
15401: ##>>>>>>>>(92.l+180) leshort x (0x%.4x)
15402: >>>>>>>>(92.l+182) leshort 1 (mono,
15403: >>>>>>>>(92.l+182) leshort 2 (stereo,
15404: >>>>>>>>(92.l+182) leshort >2 (%d channels,
15405: >>>>>>>>(92.l+184) lelong x %d Hz)
15406: # auds strh length = 64:
15407: >>>>>>>(92.l+180) string strf
15408: >>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
15409: >>>>>>>>(92.l+188) leshort 0x0002 ADPCM
15410: >>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
15411: >>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
15412: >>>>>>>>(92.l+188) leshort 0x0161 DivX
15413: ##>>>>>>>>(92.l+188) leshort x (0x%.4x)
15414: >>>>>>>>(92.l+190) leshort 1 (mono,
15415: >>>>>>>>(92.l+190) leshort 2 (stereo,
15416: >>>>>>>>(92.l+190) leshort >2 (%d channels,
15417: >>>>>>>>(92.l+192) lelong x %d Hz)
15418: # Animated Cursor format
15419: >8 string ACON \b, animated cursor
15420: # SoundFont 2 <mpruett@sgi.com>
15421: >8 string sfbk SoundFont/Bank
15422: # MPEG-1 wrapped in a RIFF, apparently
15423: >8 string CDXA \b, wrapped MPEG-1 (CDXA)
15424: >8 string 4XMV \b, 4X Movie file
1.1.1.3 misho 15425: # AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
15426: >8 string AMV\040 \b, AMV
1.1 misho 15427:
15428: #
15429: # XXX - some of the below may only appear in little-endian form.
15430: #
15431: # Also "MV93" appears to be for one form of Macromedia Director
15432: # files, and "GDMF" appears to be another multimedia format.
15433: #
15434: 0 string RIFX RIFF (big-endian) data
15435: # RIFF Palette format
15436: >8 string PAL \b, palette
15437: >>16 beshort x \b, version %d
15438: >>18 beshort x \b, %d entries
15439: # RIFF Device Independent Bitmap format
15440: >8 string RDIB \b, device-independent bitmap
15441: >>16 string BM
15442: >>>30 beshort 12 \b, OS/2 1.x format
15443: >>>>34 beshort x \b, %d x
15444: >>>>36 beshort x %d
15445: >>>30 beshort 64 \b, OS/2 2.x format
15446: >>>>34 beshort x \b, %d x
15447: >>>>36 beshort x %d
15448: >>>30 beshort 40 \b, Windows 3.x format
15449: >>>>34 belong x \b, %d x
15450: >>>>38 belong x %d x
15451: >>>>44 beshort x %d
15452: # RIFF MIDI format
15453: >8 string RMID \b, MIDI
15454: # RIFF Multimedia Movie File format
15455: >8 string RMMP \b, multimedia movie
15456: # Microsoft WAVE format (*.wav)
15457: >8 string WAVE \b, WAVE audio
15458: >>20 leshort 1 \b, Microsoft PCM
15459: >>>34 leshort >0 \b, %d bit
15460: >>22 beshort =1 \b, mono
15461: >>22 beshort =2 \b, stereo
15462: >>22 beshort >2 \b, %d channels
15463: >>24 belong >0 %d Hz
15464: # Corel Draw Picture
15465: >8 string CDRA \b, Corel Draw Picture
15466: # AVI == Audio Video Interleave
15467: >8 string AVI\040 \b, AVI
15468: # Animated Cursor format
15469: >8 string ACON \b, animated cursor
15470: # Notation Interchange File Format (big-endian only)
15471: >8 string NIFF \b, Notation Interchange File Format
15472: # SoundFont 2 <mpruett@sgi.com>
15473: >8 string sfbk SoundFont/Bank
1.1.1.2 misho 15474:
1.1 misho 15475: #------------------------------------------------------------------------------
1.1.1.3 misho 15476: # Sony Wave64
15477: # see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
15478: # 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
15479: 0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data
15480: # 128 bit + total file size (64 bits) so 24 bytes
15481: # then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
15482: >24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio
15483: !:mime audio/x-w64
15484: # FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
15485: >>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b
15486: >>>&10 leshort =1 \b, mono
15487: >>>&10 leshort =2 \b, stereo
15488: >>>&10 leshort >2 \b, %d channels
15489: >>>&12 lelong >0 %d Hz
15490:
15491: #------------------------------------------------------------------------------
15492: # MBWF/RF64
15493: # see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
15494: 0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio
15495: !:mime audio/x-wav
15496: >40 search/256 fmt\x20 \b
15497: >>&6 leshort =1 \b, mono
15498: >>&6 leshort =2 \b, stereo
15499: >>&6 leshort >2 \b, %d channels
15500: >>&8 lelong >0 %d Hz
15501:
15502:
15503: #------------------------------------------------------------------------------
15504: # $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
15505: # rinex: file(1) magic for RINEX files
15506: # http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
15507: # ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
15508: # data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
15509: 60 string RINEX
15510: >80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast
15511: >>&32 string x \b, date %15.15s
15512: >>5 string x \b, version %6.6s
15513: !:mime rinex/broadcast
15514: >80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp)
15515: >>&32 string x \b, date %15.15s
15516: >>5 string x \b, version %6.6s
15517: !:mime rinex/observation
15518: >80 search/256 XXRINEXC RINEX Data, Clock
15519: >>&32 string x \b, date %15.15s
15520: >>5 string x \b, version %6.6s
15521: !:mime rinex/clock
15522: >80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation
15523: >>&32 string x \b, date %15.15s
15524: >>5 string x \b, version %6.6s
15525: !:mime rinex/navigation
15526: >80 search/256 XXRINEXG RINEX Data, GLONASS Navigation
15527: >>&32 string x \b, date %15.15s
15528: >>5 string x \b, version %6.6s
15529: !:mime rinex/navigation
15530: >80 search/256 XXRINEXL RINEX Data, Galileo Navigation
15531: >>&32 string x \b, date %15.15s
15532: >>5 string x \b, version %6.6s
15533: !:mime rinex/navigation
15534: >80 search/256 XXRINEXM RINEX Data, Meteorological
15535: >>&32 string x \b, date %15.15s
15536: >>5 string x \b, version %6.6s
15537: !:mime rinex/meteorological
15538: >80 search/256 XXRINEXN RINEX Data, Navigation
15539: >>&32 string x \b, date %15.15s
15540: >>5 string x \b, version %6.6s
15541: !:mime rinex/navigation
15542: >80 search/256 XXRINEXO RINEX Data, Observation
15543: >>&32 string x \b, date %15.15s
15544: >>5 string x \b, version %6.6s
15545: !:mime rinex/observation
15546:
15547: #------------------------------------------------------------------------------
15548: # $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
1.1 misho 15549: #
15550: # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
15551: #
1.1.1.3 misho 15552: 0 belong 0xedabeedb RPM
1.1 misho 15553: !:mime application/x-rpm
1.1.1.3 misho 15554: >4 byte x v%d
15555: >5 byte x \b.%d
15556: >6 beshort 1 src
15557: >6 beshort 0 bin
15558: >>8 beshort 1 i386/x86_64
15559: >>8 beshort 2 Alpha/Sparc64
15560: >>8 beshort 3 Sparc
15561: >>8 beshort 4 MIPS
15562: >>8 beshort 5 PowerPC
15563: >>8 beshort 6 68000
15564: >>8 beshort 7 SGI
15565: >>8 beshort 8 RS6000
15566: >>8 beshort 9 IA64
15567: >>8 beshort 10 Sparc64
15568: >>8 beshort 11 MIPSel
15569: >>8 beshort 12 ARM
15570: >>8 beshort 13 MiNT
15571: >>8 beshort 14 S/390
15572: >>8 beshort 15 S/390x
15573: >>8 beshort 16 PowerPC64
15574: >>8 beshort 17 SuperH
15575: >>8 beshort 18 Xtensa
15576: >>8 beshort 255 noarch
1.1.1.2 misho 15577:
15578: #delta RPM Daniel Novotny (dnovotny@redhat.com)
1.1.1.3 misho 15579: 0 string drpm Delta RPM
1.1.1.2 misho 15580: !:mime application/x-rpm
15581: >12 string x %s
1.1.1.3 misho 15582: >>8 beshort 11 MIPSel
15583: >>8 beshort 12 ARM
15584: >>8 beshort 13 MiNT
15585: >>8 beshort 14 S/390
15586: >>8 beshort 15 S/390x
15587: >>8 beshort 16 PowerPC64
15588: >>8 beshort 17 SuperH
15589: >>8 beshort 18 Xtensa
1.1 misho 15590: >>10 string x %s
15591:
15592: #------------------------------------------------------------------------------
1.1.1.2 misho 15593: # $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 15594: # rtf: file(1) magic for Rich Text Format (RTF)
15595: #
15596: # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
15597: #
15598: 0 string {\\rtf Rich Text Format data,
15599: !:mime text/rtf
15600: >5 string 1 version 1,
15601: >>6 string \\ansi ANSI
15602: >>6 string \\mac Apple Macintosh
15603: >>6 string \\pc IBM PC, code page 437
15604: >>6 string \\pca IBM PS/2, code page 850
15605: >>6 default x unknown character set
15606: >5 default x unknown version
1.1.1.2 misho 15607:
1.1 misho 15608: #------------------------------------------------------------------------------
1.1.1.3 misho 15609: # $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $
1.1.1.2 misho 15610: # ruby: file(1) magic for Ruby scripting language
1.1 misho 15611: # URL: http://www.ruby-lang.org/
15612: # From: Reuben Thomas <rrt@sc3d.org>
15613:
15614: # Ruby scripts
1.1.1.2 misho 15615: 0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
15616: !:mime text/x-ruby
15617: 0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
15618: !:mime text/x-ruby
1.1 misho 15619: 0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
1.1.1.2 misho 15620: !:mime text/x-ruby
1.1 misho 15621: 0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
1.1.1.2 misho 15622: !:mime text/x-ruby
1.1 misho 15623:
1.1.1.3 misho 15624: # What looks like ruby, but does not have a shebang
15625: # (modules and such)
15626: # From: Lubomir Rintel <lkundrak@v3.sk>
15627: 0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+'
15628: >0 regex include\ [A-Z]|def\ [a-z]|\ do$
15629: >>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text
15630: !:mime text/x-ruby
15631: 0 regex \^[\ \t]*(class|module)[\ \t][A-Z]
15632: >0 regex (modul|includ)e\ [A-Z]|def\ [a-z]
15633: >>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text
15634: !:mime text/x-ruby
15635:
1.1 misho 15636: #------------------------------------------------------------------------------
1.1.1.2 misho 15637: # $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 15638: # sc: file(1) magic for "sc" spreadsheet
15639: #
15640: 38 string Spreadsheet sc spreadsheet file
15641: !:mime application/x-sc
15642:
15643: #------------------------------------------------------------------------------
1.1.1.2 misho 15644: # $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 15645: # sccs: file(1) magic for SCCS archives
15646: #
15647: # SCCS archive structure:
15648: # \001h01207
15649: # \001s 00276/00000/00000
15650: # \001d D 1.1 87/09/23 08:09:20 ian 1 0
15651: # \001c date and time created 87/09/23 08:09:20 by ian
15652: # \001e
15653: # \001u
15654: # \001U
15655: # ... etc.
15656: # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
15657: # *Sigh*. And these both came from various parts of the USG.
15658: # Maybe we should just switch everybody from SCCS to RCS!
15659: # Further, you can't just say '\001h0', because the five-digit number
15660: # is a checksum that could (presumably) have any leading digit,
15661: # and we don't have regular expression matching yet.
15662: # Hence the following official kludge:
15663: 8 string \001s\ SCCS archive data
1.1.1.2 misho 15664:
1.1 misho 15665: #------------------------------------------------------------------------------
1.1.1.3 misho 15666: # $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $
1.1 misho 15667: # scientific: file(1) magic for scientific formats
15668: #
15669: # From: Joe Krahn <krahn@niehs.nih.gov>
15670:
15671: ########################################################
15672: # CCP4 data and plot files:
15673: 0 string MTZ\040 MTZ reflection file
15674:
15675: 92 string PLOT%%84 Plot84 plotting file
15676: >52 byte 1 , Little-endian
15677: >55 byte 1 , Big-endian
15678:
15679: ########################################################
15680: # Electron density MAP/MASK formats
15681:
15682: 0 string EZD_MAP NEWEZD Electron Density Map
15683: 109 string MAP\040( Old EZD Electron Density Map
15684:
15685: 0 string/c :-)\040Origin BRIX Electron Density Map
15686: >170 string >0 , Sigma:%.12s
15687: #>4 string >0 %.178s
15688: #>4 addr x %.178s
15689:
15690: 7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
15691: 9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
15692:
15693: 208 string MAP\040 CCP4 Electron Density Map
15694: # Assumes same stamp for float and double (normal case)
15695: >212 byte 17 \b, Big-endian
15696: >212 byte 34 \b, VAX format
15697: >212 byte 68 \b, Little-endian
15698: >212 byte 85 \b, Convex native
15699:
15700: ############################################################
15701: # X-Ray Area Detector images
15702: 0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
15703: >796 lelong <20 Little-endian, IP #%d,
15704: >>768 lelong >0 Size=%dx
15705: >>772 lelong >0 \b%d
15706: >796 belong <20 Big-endian, IP #%d,
15707: >>768 belong >0 Size=%dx
15708: >>772 belong >0 \b%d
15709:
15710: 0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
15711: >796 lelong <20 Little-endian, IP #%d,
15712: >>768 lelong >0 Size=%dx
15713: >>772 lelong >0 \b%d
15714: >796 belong <20 Big-endian, IP #%d,
15715: >>768 belong >0 Size=%dx
15716: >>772 belong >0 \b%d
15717:
15718:
15719: 1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
15720: >1072 ulong >1 Compressed(%d),
15721: >1100 ulong >1 %d headers,
15722: >1104 ulong >0 %d x
15723: >1108 ulong >0 %d,
15724: >1120 ulong >0 %d bits/pixel
15725:
15726: # Type: GEDCOM genealogical (family history) data
15727: # From: Giuseppe Bilotta
15728: 0 search/1/c 0\ HEAD GEDCOM genealogy text
15729: >&0 search 1\ GEDC
15730: >>&0 search 2\ VERS version
15731: >>>&1 search/1 >\0 %s
15732: # From: Phil Endecott <phil05@chezphil.org>
15733: 0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
15734: 0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
15735: 0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
15736: 0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
1.1.1.2 misho 15737:
15738: # PDB: Protein Data Bank files
15739: # Adam Buchbinder <adam.buchbinder@gmail.com>
15740: #
15741: # http://www.wwpdb.org/documentation/format32/sect2.html
15742: # http://www.ch.ic.ac.uk/chemime/
15743: #
15744: # The PDB file format is fixed-field, 80 columns. From the spec:
15745: #
15746: # COLS DATA
15747: # 1 - 6 "HEADER"
15748: # 11 - 50 String(40)
15749: # 51 - 59 Date
15750: # 63 - 66 IDcode
15751: #
15752: # Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
15753: # format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
15754: # uppercase letters. However, examples have been seen without the date string,
15755: # e.g., the example on the chemime site.
15756: 0 string HEADER\ \ \ \
15757: >&0 regex/1 \^.{40}
15758: >>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
15759: >>>&0 regex/1s [A-Z0-9]{4}.{14}$
15760: >>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s
15761: !:mime chemical/x-pdb
15762: >>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
15763:
15764: # Type: GDSII Stream file
15765: 0 belong 0x00060002 GDSII Stream file
15766: >4 byte 0x00
15767: >>5 byte x version %d.0
15768: >4 byte >0x00 version %d
15769: >>5 byte x \b.%d
15770:
15771: #------------------------------------------------------------------------------
15772: # $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 15773: 0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
15774: 0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
15775: 0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
15776: # Type: SE Linux policy modules *.pp reference policy
15777: # for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
15778: # URL: http://doc.coker.com.au/computers/selinux-magic
15779: # From: Russell Coker <russell@coker.com.au>
15780:
15781: 0 lelong 0xf97cff8f SE Linux modular policy
15782: >4 lelong x version %d,
15783: >8 lelong x %d sections,
15784: >>(12.l) lelong 0xf97cff8d
15785: >>>(12.l+27) lelong x mod version %d,
15786: >>>(12.l+31) lelong 0 Not MLS,
15787: >>>(12.l+31) lelong 1 MLS,
15788: >>>(12.l+23) lelong 2
15789: >>>>(12.l+47) string >\0 module name %s
15790: >>>(12.l+23) lelong 1 base
15791:
15792: 1 string policy_module( SE Linux policy module source
15793: 2 string policy_module( SE Linux policy module source
15794:
15795: 0 string ##\ <summary> SE Linux policy interface source
15796:
15797: #0 search gen_context( SE Linux policy file contexts
15798:
15799: #0 search gen_sens( SE Linux policy MLS constraints source
15800:
15801: #------------------------------------------------------------------------------
1.1.1.2 misho 15802: # $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
1.1 misho 15803: # sendmail: file(1) magic for sendmail config files
15804: #
15805: # XXX - byte order?
15806: #
15807: 0 byte 046 Sendmail frozen configuration
15808: >16 string >\0 - version %s
15809: 0 short 0x271c Sendmail frozen configuration
15810: >16 string >\0 - version %s
15811:
15812: #------------------------------------------------------------------------------
15813: # sendmail: file(1) magic for sendmail m4(1) files
15814: #
15815: # From Hendrik Scholz <hendrik@scholz.net>
15816: # i.e. files in /usr/share/sendmail/cf/
15817: #
15818: 0 string divert(-1)\n sendmail m4 text file
15819:
15820:
15821: #------------------------------------------------------------------------------
1.1.1.2 misho 15822: # $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
1.1 misho 15823: # sequent: file(1) magic for Sequent machines
15824: #
15825: # Sequent information updated by Don Dwiggins <atsun!dwiggins>.
15826: # For Sequent's multiprocessor systems (incomplete).
15827: 0 lelong 0x00ea BALANCE NS32000 .o
15828: >16 lelong >0 not stripped
15829: >124 lelong >0 version %ld
15830: 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
15831: >16 lelong >0 not stripped
15832: >124 lelong >0 version %ld
15833: 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
15834: >16 lelong >0 not stripped
15835: >124 lelong >0 version %ld
15836: 0 lelong 0x30ea BALANCE NS32000 standalone executable
15837: >16 lelong >0 not stripped
15838: >124 lelong >0 version %ld
15839: #
15840: # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
15841: # Symmetry magic nums will not be reached if DOS COM comes before them;
15842: # byte 0xeb is matched before these get a chance.
15843: 0 leshort 0x12eb SYMMETRY i386 .o
15844: >16 lelong >0 not stripped
15845: >124 lelong >0 version %ld
15846: 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
15847: >16 lelong >0 not stripped
15848: >124 lelong >0 version %ld
15849: 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
15850: >16 lelong >0 not stripped
15851: >124 lelong >0 version %ld
15852: 0 leshort 0x42eb SYMMETRY i386 standalone executable
15853: >16 lelong >0 not stripped
15854: >124 lelong >0 version %ld
15855:
15856: #------------------------------------------------------------------------------
1.1.1.3 misho 15857: # $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $
15858: # sgi: file(1) magic for Silicon Graphics operating systems and applications
15859: #
15860: # Executable images are handled either in aout (for old-style a.out
15861: # files for 68K; they are indistinguishable from other big-endian 32-bit
15862: # a.out files) or in mips (for MIPS ECOFF and Ucode files)
15863: #
15864:
15865: # kbd file definitions
15866: 0 string kbd!map kbd map file
15867: >8 byte >0 Ver %d:
15868: >10 short >0 with %d table(s)
15869:
15870: 0 beshort 0x8765 disk quotas file
15871:
15872: 0 beshort 0x0506 IRIS Showcase file
15873: >2 byte 0x49 -
15874: >3 byte x - version %ld
15875: 0 beshort 0x0226 IRIS Showcase template
15876: >2 byte 0x63 -
15877: >3 byte x - version %ld
15878: 0 belong 0x5343464d IRIS Showcase file
15879: >4 byte x - version %ld
15880: 0 belong 0x5443464d IRIS Showcase template
15881: >4 byte x - version %ld
15882: 0 belong 0xdeadbabe IRIX Parallel Arena
15883: >8 belong >0 - version %ld
15884:
15885: # core files
15886: #
15887: # 32bit core file
15888: 0 belong 0xdeadadb0 IRIX core dump
15889: >4 belong 1 of
15890: >16 string >\0 '%s'
15891: # 64bit core file
15892: 0 belong 0xdeadad40 IRIX 64-bit core dump
15893: >4 belong 1 of
15894: >16 string >\0 '%s'
15895: # N32bit core file
15896: 0 belong 0xbabec0bb IRIX N32 core dump
15897: >4 belong 1 of
15898: >16 string >\0 '%s'
15899: # New style crash dump file
15900: 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
15901: >36 string >\0 '%s'
15902:
15903: # Trusted IRIX info
15904: 0 string SGIAUDIT SGI Audit file
15905: >8 byte x - version %d
15906: >9 byte x \b.%ld
15907: #
15908: 0 string WNGZWZSC Wingz compiled script
15909: 0 string WNGZWZSS Wingz spreadsheet
15910: 0 string WNGZWZHP Wingz help file
15911: #
15912: 0 string #Inventor V IRIS Inventor 1.0 file
15913: 0 string #Inventor V2 Open Inventor 2.0 file
15914: # GLF is OpenGL stream encoding
15915: 0 string glfHeadMagic(); GLF_TEXT
15916: 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
15917: !:strength -30
15918: 4 belong 0x0000007d GLF_BINARY_MSB_FIRST
15919: !:strength -30
15920: # GLS is OpenGL stream encoding; GLS is the successor of GLF
15921: 0 string glsBeginGLS( GLS_TEXT
15922: 4 belong 0x10000000 GLS_BINARY_LSB_FIRST
15923: !:strength -30
15924: 4 belong 0x00000010 GLS_BINARY_MSB_FIRST
15925: !:strength -30
1.1 misho 15926:
15927: #
15928: #
15929: # Performance Co-Pilot file types
15930: 0 string PmNs PCP compiled namespace (V.0)
15931: 0 string PmN PCP compiled namespace
15932: >3 string >\0 (V.%1.1s)
15933: #3 lelong 0x84500526 PCP archive
15934: 3 belong 0x84500526 PCP archive
15935: >7 byte x (V.%d)
15936: #>20 lelong -2 temporal index
15937: #>20 lelong -1 metadata
15938: #>20 lelong 0 log volume #0
15939: #>20 lelong >0 log volume #%ld
15940: >20 belong -2 temporal index
15941: >20 belong -1 metadata
15942: >20 belong 0 log volume #0
15943: >20 belong >0 log volume #%ld
15944: >24 string >\0 host: %s
15945: 0 string PCPFolio PCP
15946: >9 string Version: Archive Folio
15947: >18 string >\0 (V.%s)
15948: 0 string #pmchart PCP pmchart view
15949: >9 string Version
15950: >17 string >\0 (V%-3.3s)
15951: 0 string #kmchart PCP kmchart view
15952: >9 string Version
15953: >17 string >\0 (V.%s)
15954: 0 string pmview PCP pmview config
15955: >7 string Version
15956: >15 string >\0 (V%-3.3s)
15957: 0 string #pmlogger PCP pmlogger config
15958: >10 string Version
15959: >18 string >\0 (V%1.1s)
15960: 0 string #pmdahotproc PCP pmdahotproc config
15961: >13 string Version
15962: >21 string >\0 (V%-3.3s)
15963: 0 string PcPh PCP Help
15964: >4 string 1 Index
15965: >4 string 2 Text
15966: >5 string >\0 (V.%1.1s)
15967: 0 string #pmieconf-rules PCP pmieconf rules
15968: >16 string >\0 (V.%1.1s)
15969: 3 string pmieconf-pmie PCP pmie config
15970: >17 string >\0 (V.%1.1s)
15971:
15972: # SpeedShop data files
15973: 0 lelong 0x13130303 SpeedShop data file
15974:
15975: # mdbm files
15976: 0 lelong 0x01023962 mdbm file, version 0 (obsolete)
15977: 0 string mdbm mdbm file,
15978: >5 byte x version %d,
15979: >6 byte x 2^%d pages,
15980: >7 byte x pagesize 2^%d,
15981: >17 byte x hash %d,
15982: >11 byte x dataformat %d
15983:
15984: # Alias Maya files
1.1.1.3 misho 15985: 0 string/t //Maya ASCII Alias Maya Ascii File,
1.1 misho 15986: >13 string >\0 version %s
15987: 8 string MAYAFOR4 Alias Maya Binary File,
15988: >32 string >\0 version %s scene
15989: 8 string MayaFOR4 Alias Maya Binary File,
15990: >32 string >\0 version %s scene
15991: 8 string CIMG Alias Maya Image File
15992: 8 string DEEP Alias Maya Image File
15993: #------------------------------------------------------------------------------
1.1.1.3 misho 15994: # $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $
1.1 misho 15995: # Type: SVG Vectorial Graphics
15996: # From: Noel Torres <tecnico@ejerciciosresueltos.com>
15997: 0 string \<?xml\ version="
15998: >15 string >\0
1.1.1.2 misho 15999: >>19 search/4096 \<svg SVG Scalable Vector Graphics image
1.1 misho 16000: !:mime image/svg+xml
1.1.1.2 misho 16001: >>19 search/4096 \<gnc-v2 GnuCash file
1.1 misho 16002: !:mime application/x-gnucash
16003:
16004: # Sitemap file
1.1.1.3 misho 16005: 0 string/t \<?xml\ version="
1.1 misho 16006: >15 string >\0
1.1.1.2 misho 16007: >>19 search/4096 \<urlset XML Sitemap document text
1.1 misho 16008: !:mime application/xml-sitemap
16009:
1.1.1.2 misho 16010: # xhtml
1.1.1.3 misho 16011: 0 string/t \<?xml\ version="
1.1.1.2 misho 16012: >15 string >\0
1.1.1.3 misho 16013: >>19 search/4096/cWbt \<!doctype\ html XHTML document text
1.1.1.2 misho 16014: !:mime text/html
1.1.1.3 misho 16015: 0 string/t \<?xml\ version='
1.1.1.2 misho 16016: >15 string >\0
1.1.1.3 misho 16017: >>19 search/4096/cWbt \<!doctype\ html XHTML document text
1.1.1.2 misho 16018: !:mime text/html
1.1.1.3 misho 16019: 0 string/t \<?xml\ version="
1.1.1.2 misho 16020: >15 string >\0
1.1.1.3 misho 16021: >>19 search/4096/cWbt \<html broken XHTML document text
1.1.1.2 misho 16022: !:mime text/html
16023:
1.1 misho 16024: #------------------------------------------------------------------------------
16025: # sgml: file(1) magic for Standard Generalized Markup Language
16026: # HyperText Markup Language (HTML) is an SGML document type,
16027: # from Daniel Quinlan (quinlan@yggdrasil.com)
16028: # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
1.1.1.3 misho 16029: 0 search/4096/cWt \<!doctype\ html HTML document text
1.1.1.2 misho 16030: !:mime text/html
1.1.1.3 misho 16031: !:strength + 5
16032: 0 search/4096/cwt \<head HTML document text
1.1.1.2 misho 16033: !:mime text/html
1.1.1.3 misho 16034: !:strength + 5
16035: 0 search/4096/cwt \<title HTML document text
1.1.1.2 misho 16036: !:mime text/html
1.1.1.3 misho 16037: !:strength + 5
16038: 0 search/4096/cwt \<html HTML document text
1.1.1.2 misho 16039: !:mime text/html
1.1.1.3 misho 16040: !:strength + 5
16041: 0 search/4096/cwt \<script HTML document text
1.1 misho 16042: !:mime text/html
1.1.1.3 misho 16043: !:strength + 5
16044: 0 search/4096/cwt \<style HTML document text
1.1 misho 16045: !:mime text/html
1.1.1.3 misho 16046: !:strength + 5
16047: 0 search/4096/cwt \<table HTML document text
1.1 misho 16048: !:mime text/html
1.1.1.3 misho 16049: !:strength + 5
16050: 0 search/4096/cwt \<a\ href= HTML document text
1.1 misho 16051: !:mime text/html
1.1.1.3 misho 16052: !:strength + 5
1.1 misho 16053:
16054: # Extensible markup language (XML), a subset of SGML
16055: # from Marc Prud'hommeaux (marc@apocalypse.org)
1.1.1.3 misho 16056: 0 search/1/cwt \<?xml XML document text
1.1 misho 16057: !:mime application/xml
1.1.1.3 misho 16058: !:strength + 5
16059: 0 string/t \<?xml\ version\ " XML
1.1 misho 16060: !:mime application/xml
1.1.1.3 misho 16061: !:strength + 5
16062: 0 string/t \<?xml\ version=" XML
1.1 misho 16063: !:mime application/xml
1.1.1.3 misho 16064: !:strength + 5
16065: >15 string/t >\0 %.3s document text
1.1 misho 16066: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
16067: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
16068: 0 string \<?xml\ version=' XML
16069: !:mime application/xml
1.1.1.3 misho 16070: !:strength + 5
16071: >15 string/t >\0 %.3s document text
1.1 misho 16072: >>23 search/1 \<xsl:stylesheet (XSL stylesheet)
16073: >>24 search/1 \<xsl:stylesheet (XSL stylesheet)
1.1.1.2 misho 16074: 0 search/1/wbt \<?xml XML document text
1.1 misho 16075: !:mime application/xml
1.1.1.2 misho 16076: !:strength - 10
1.1.1.3 misho 16077: 0 search/1/wt \<?XML broken XML document text
1.1 misho 16078: !:mime application/xml
1.1.1.2 misho 16079: !:strength - 10
1.1 misho 16080:
16081:
16082: # SGML, mostly from rph@sq
1.1.1.3 misho 16083: 0 search/4096/cwt \<!doctype exported SGML document text
16084: 0 search/4096/cwt \<!subdoc exported SGML subdocument text
16085: 0 search/4096/cwt \<!-- exported SGML document text
1.1.1.2 misho 16086: !:strength - 10
1.1 misho 16087:
16088: # Web browser cookie files
16089: # (Mozilla, Galeon, Netscape 4, Konqueror..)
16090: # Ulf Harnhammar <ulfh@update.uu.se>
16091: 0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text
16092: 0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
16093: 0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
16094:
16095: #------------------------------------------------------------------------
1.1.1.2 misho 16096: # $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 16097: # file(1) magic for sharc files
16098: #
16099: # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
16100: # FutureGroove Music (dsp@futuregroove.de)
16101:
16102: #------------------------------------------------------------------------
16103: #0 string Draw RiscOS Drawfile
16104: #0 string PACK RiscOS PackdDir archive
16105:
16106: #------------------------------------------------------------------------
16107: # SHARC DSP stuff (based on the FGM SHARC DSP SDK)
16108:
16109: #0 string =! Assembler source
16110: #0 string Analog ADi asm listing file
16111: 0 string .SYSTEM SHARC architecture file
16112: 0 string .system SHARC architecture file
16113:
16114: 0 leshort 0x521C SHARC COFF binary
16115: >2 leshort >1 , %hd sections
16116: >>12 lelong >0 , not stripped
16117:
16118: #------------------------------------------------------------------------------
1.1.1.2 misho 16119: # $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 16120: # sinclair: file(1) sinclair QL
16121:
16122: # additions to /etc/magic by Thomas M. Ott (ThMO)
16123:
16124: # Sinclair QL floppy disk formats (ThMO)
16125: 0 string =QL5 QL disk dump data,
16126: >3 string =A 720 KB,
16127: >3 string =B 1.44 MB,
16128: >3 string =C 3.2 MB,
16129: >4 string >\0 label:%.10s
16130:
16131: # Sinclair QL OS dump (ThMO)
16132: # (NOTE: if `file' would be able to use indirect references in a endian format
16133: # differing from the natural host format, this could be written more
16134: # reliably and faster...)
16135: #
16136: # we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
16137: # than the first 8K of a file... #-(
16138: #
16139: #0 belong =0x30000
16140: #>49124 belong <47104
16141: #>>49128 belong <47104
16142: #>>>49132 belong <47104
16143: #>>>>49136 belong <47104 QL OS dump data,
16144: #>>>>>49148 string >\0 type %.3s,
16145: #>>>>>49142 string >\0 version %.4s
16146:
16147: # Sinclair QL firmware executables (ThMO)
16148: 0 string NqNqNq`\004 QL firmware executable (BCPL)
16149:
16150: # Sinclair QL libraries (was ThMO)
16151: 0 beshort 0xFB01 QDOS object
16152: >2 pstring x '%s'
16153:
16154: # Sinclair QL executables (was ThMO)
16155: 4 belong 0x4AFB QDOS executable
16156: >9 pstring x '%s'
16157:
16158: # Sinclair QL ROM (ThMO)
16159: 0 belong =0x4AFB0001 QL plugin-ROM data,
16160: >9 pstring =\0 un-named
16161: >9 pstring >\0 named: %s
16162: # Type: SiSU Markup Language
16163: # URL: http://www.sisudoc.org/
16164: # From: Ralph Amissah <ralph.amissah@gmail.com>
16165:
16166: 0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert
16167: >5 regex [0-9.]+ %s
16168:
16169: 0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master
16170: >5 regex [0-9.]+ %s
16171:
16172: 0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text
16173: >5 regex [0-9.]+ %s
16174:
16175: 0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text
16176: >5 regex [0-9.]+ %s
16177:
16178: 0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text
16179: >5 regex [0-9.]+ %s
1.1.1.2 misho 16180:
1.1 misho 16181: #------------------------------------------------------------------------------
1.1.1.2 misho 16182: # $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 16183: # Sketch Drawings: http://sketch.sourceforge.net/
16184: # From: Edwin Mons <e@ik.nu>
16185: 0 search/1 ##Sketch Sketch document text
16186:
16187: #-----------------------------------------------
1.1.1.2 misho 16188: # $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
1.1 misho 16189: # GNU Smalltalk image, starting at version 1.6.2
16190: # From: catull_us@yahoo.com
16191: #
16192: 0 string GSTIm\0\0 GNU SmallTalk
16193: # little-endian
16194: >7 byte&1 =0 LE image version
16195: >>10 byte x %d.
16196: >>9 byte x \b%d.
16197: >>8 byte x \b%d
16198: #>>12 lelong x , data: %ld
16199: #>>16 lelong x , table: %ld
16200: #>>20 lelong x , memory: %ld
16201: # big-endian
16202: >7 byte&1 =1 BE image version
16203: >>8 byte x %d.
16204: >>9 byte x \b%d.
16205: >>10 byte x \b%d
16206: #>>12 belong x , data: %ld
16207: #>>16 belong x , table: %ld
16208: #>>20 belong x , memory: %ld
16209:
16210:
16211:
16212: #------------------------------------------------------------------------------
1.1.1.3 misho 16213: # $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
16214: # smile: file(1) magic for Smile serialization
16215: #
16216: # The Smile serialization format uses a 4-byte header:
16217: #
16218: # Constant byte #0: 0x3A (ASCII ':')
16219: # Constant byte #1: 0x29 (ASCII ')')
16220: # Constant byte #2: 0x0A (ASCII linefeed, '\n')
16221: # Variable byte #3, consisting of bits:
16222: # Bits 4-7 (4 MSB): 4-bit version number
16223: # Bits 3: Reserved
16224: # Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
16225: # Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
16226: # Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
16227: #
16228: # Reference: http://wiki.fasterxml.com/SmileFormatSpec
16229: # Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
16230:
16231: # Detection
16232: 0 string :)\n Smile binary data
16233:
16234: # Versioning
16235: >3 byte&0xF0 x version %d:
16236:
16237: # Properties
16238: >3 byte&0x04 0x04 binary raw,
16239: >3 byte&0x04 0x00 binary encoded,
16240: >3 byte&0x02 0x02 shared String values enabled,
16241: >3 byte&0x02 0x00 shared String values disabled,
16242: >3 byte&0x01 0x01 shared field names enabled
16243: >3 byte&0x01 0x00 shared field names disabled
16244:
16245:
16246: #------------------------------------------------------------------------------
16247: # $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
1.1 misho 16248: # sniffer: file(1) magic for packet capture files
16249: #
16250: # From: guy@alum.mit.edu (Guy Harris)
16251: #
16252:
16253: #
16254: # Microsoft Network Monitor 1.x capture files.
16255: #
16256: 0 string RTSS NetMon capture file
16257: >5 byte x - version %d
16258: >4 byte x \b.%d
16259: >6 leshort 0 (Unknown)
16260: >6 leshort 1 (Ethernet)
16261: >6 leshort 2 (Token Ring)
16262: >6 leshort 3 (FDDI)
16263: >6 leshort 4 (ATM)
1.1.1.3 misho 16264: >6 leshort >4 (type %d)
1.1 misho 16265:
16266: #
16267: # Microsoft Network Monitor 2.x capture files.
16268: #
16269: 0 string GMBU NetMon capture file
16270: >5 byte x - version %d
16271: >4 byte x \b.%d
16272: >6 leshort 0 (Unknown)
16273: >6 leshort 1 (Ethernet)
16274: >6 leshort 2 (Token Ring)
16275: >6 leshort 3 (FDDI)
16276: >6 leshort 4 (ATM)
1.1.1.3 misho 16277: >6 leshort 5 (IP-over-IEEE 1394)
16278: >6 leshort 6 (802.11)
16279: >6 leshort 7 (Raw IP)
16280: >6 leshort 8 (Raw IP)
16281: >6 leshort 9 (Raw IP)
16282: >6 leshort >9 (type %d)
1.1 misho 16283:
16284: #
16285: # Network General Sniffer capture files.
16286: # Sorry, make that "Network Associates Sniffer capture files."
16287: # Sorry, make that "Network General old DOS Sniffer capture files."
16288: #
16289: 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
16290: >33 byte 2 (compressed)
16291: >23 leshort x - version %d
16292: >25 leshort x \b.%d
16293: >32 byte 0 (Token Ring)
16294: >32 byte 1 (Ethernet)
16295: >32 byte 2 (ARCNET)
16296: >32 byte 3 (StarLAN)
16297: >32 byte 4 (PC Network broadband)
16298: >32 byte 5 (LocalTalk)
16299: >32 byte 6 (Znet)
16300: >32 byte 7 (Internetwork Analyzer)
16301: >32 byte 9 (FDDI)
16302: >32 byte 10 (ATM)
16303:
16304: #
16305: # Cinco Networks NetXRay capture files.
16306: # Sorry, make that "Network General Sniffer Basic capture files."
16307: # Sorry, make that "Network Associates Sniffer Basic capture files."
16308: # Sorry, make that "Network Associates Sniffer Basic, and Windows
16309: # Sniffer Pro", capture files."
16310: # Sorry, make that "Network General Sniffer capture files."
1.1.1.3 misho 16311: # Sorry, make that "NetScout Sniffer capture files."
1.1 misho 16312: #
16313: 0 string XCP\0 NetXRay capture file
16314: >4 string >\0 - version %s
16315: >44 leshort 0 (Ethernet)
16316: >44 leshort 1 (Token Ring)
16317: >44 leshort 2 (FDDI)
16318: >44 leshort 3 (WAN)
16319: >44 leshort 8 (ATM)
16320: >44 leshort 9 (802.11)
16321:
16322: #
16323: # "libpcap" capture files.
16324: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
16325: # the main program that uses that format, but there are other programs
16326: # that use "libpcap", or that use the same capture file format.)
16327: #
1.1.1.3 misho 16328: 0 name pcap-be
1.1 misho 16329: >4 beshort x - version %d
16330: >6 beshort x \b.%d
16331: >20 belong 0 (No link-layer encapsulation
16332: >20 belong 1 (Ethernet
16333: >20 belong 2 (3Mb Ethernet
16334: >20 belong 3 (AX.25
16335: >20 belong 4 (ProNET
16336: >20 belong 5 (CHAOS
16337: >20 belong 6 (Token Ring
16338: >20 belong 7 (BSD ARCNET
16339: >20 belong 8 (SLIP
16340: >20 belong 9 (PPP
16341: >20 belong 10 (FDDI
16342: >20 belong 11 (RFC 1483 ATM
16343: >20 belong 12 (raw IP
16344: >20 belong 13 (BSD/OS SLIP
16345: >20 belong 14 (BSD/OS PPP
16346: >20 belong 19 (Linux ATM Classical IP
16347: >20 belong 50 (PPP or Cisco HDLC
16348: >20 belong 51 (PPP-over-Ethernet
16349: >20 belong 99 (Symantec Enterprise Firewall
16350: >20 belong 100 (RFC 1483 ATM
16351: >20 belong 101 (raw IP
16352: >20 belong 102 (BSD/OS SLIP
16353: >20 belong 103 (BSD/OS PPP
16354: >20 belong 104 (BSD/OS Cisco HDLC
16355: >20 belong 105 (802.11
16356: >20 belong 106 (Linux Classical IP over ATM
16357: >20 belong 107 (Frame Relay
16358: >20 belong 108 (OpenBSD loopback
16359: >20 belong 109 (OpenBSD IPsec encrypted
16360: >20 belong 112 (Cisco HDLC
16361: >20 belong 113 (Linux "cooked"
16362: >20 belong 114 (LocalTalk
16363: >20 belong 117 (OpenBSD PFLOG
16364: >20 belong 119 (802.11 with Prism header
16365: >20 belong 122 (RFC 2625 IP over Fibre Channel
16366: >20 belong 123 (SunATM
16367: >20 belong 127 (802.11 with radiotap header
16368: >20 belong 129 (Linux ARCNET
16369: >20 belong 138 (Apple IP over IEEE 1394
1.1.1.3 misho 16370: >20 belong 139 (MTP2 with pseudo-header
1.1 misho 16371: >20 belong 140 (MTP2
16372: >20 belong 141 (MTP3
1.1.1.3 misho 16373: >20 belong 142 (SCCP
1.1 misho 16374: >20 belong 143 (DOCSIS
16375: >20 belong 144 (IrDA
16376: >20 belong 147 (Private use 0
16377: >20 belong 148 (Private use 1
16378: >20 belong 149 (Private use 2
16379: >20 belong 150 (Private use 3
16380: >20 belong 151 (Private use 4
16381: >20 belong 152 (Private use 5
16382: >20 belong 153 (Private use 6
16383: >20 belong 154 (Private use 7
16384: >20 belong 155 (Private use 8
16385: >20 belong 156 (Private use 9
16386: >20 belong 157 (Private use 10
16387: >20 belong 158 (Private use 11
16388: >20 belong 159 (Private use 12
16389: >20 belong 160 (Private use 13
16390: >20 belong 161 (Private use 14
16391: >20 belong 162 (Private use 15
16392: >20 belong 163 (802.11 with AVS header
1.1.1.3 misho 16393: >20 belong 165 (BACnet MS/TP
16394: >20 belong 166 (PPPD
16395: >20 belong 169 (GPRS LLC
16396: >20 belong 177 (Linux LAPD
16397: >20 belong 187 (Bluetooth HCI H4
16398: >20 belong 189 (Linux USB
16399: >20 belong 192 (PPI
16400: >20 belong 195 (802.15.4
16401: >20 belong 196 (SITA
16402: >20 belong 197 (Endace ERF
16403: >20 belong 201 (Bluetooth HCI H4 with pseudo-header
16404: >20 belong 202 (AX.25 with KISS header
16405: >20 belong 203 (LAPD
16406: >20 belong 204 (PPP with direction pseudo-header
16407: >20 belong 205 (Cisco HDLC with direction pseudo-header
16408: >20 belong 206 (Frame Relay with direction pseudo-header
16409: >20 belong 209 (Linux IPMB
16410: >20 belong 215 (802.15.4 with non-ASK PHY header
16411: >20 belong 220 (Memory-mapped Linux USB
16412: >20 belong 224 (Fibre Channel FC-2
16413: >20 belong 225 (Fibre Channel FC-2 with frame delimiters
16414: >20 belong 226 (Solaris IPNET
16415: >20 belong 227 (SocketCAN
16416: >20 belong 228 (Raw IPv4
16417: >20 belong 229 (Raw IPv6
16418: >20 belong 230 (802.15.4 without FCS
16419: >20 belong 231 (D-Bus messages
16420: >20 belong 235 (DVB-CI
16421: >20 belong 236 (MUX27010
16422: >20 belong 237 (STANAG 5066 D_PDUs
16423: >20 belong 239 (Linux netlink NFLOG messages
16424: >20 belong 240 (Hilscher netAnalyzer
16425: >20 belong 241 (Hilscher netAnalyzer with delimiters
16426: >20 belong 242 (IP-over-Infiniband
16427: >20 belong 243 (MPEG-2 Transport Stream packets
16428: >20 belong 244 (ng4t ng40
16429: >20 belong 245 (NFC LLCP
16430: >20 belong 247 (Infiniband
16431: >20 belong 248 (SCTP
1.1 misho 16432: >16 belong x \b, capture length %d)
1.1.1.3 misho 16433:
16434: 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
16435: !:mime application/vnd.tcpdump.pcap
16436: >0 use pcap-be
1.1 misho 16437: 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
1.1.1.3 misho 16438: !:mime application/vnd.tcpdump.pcap
16439: >0 use \^pcap-be
1.1 misho 16440:
16441: #
16442: # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
16443: # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
16444: # the main program that uses that format, but there are other programs
16445: # that use "libpcap", or that use the same capture file format.)
16446: #
16447: 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
1.1.1.3 misho 16448: >0 use pcap-be
1.1 misho 16449: 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
1.1.1.3 misho 16450: >0 use \^pcap-be
16451:
16452: #
16453: # "pcap-ng" capture files.
16454: # http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
16455: # Pcap-ng files can contain multiple sections. Printing the endianness,
16456: # snaplen, or other information from the first SHB may be misleading.
16457: #
16458: 0 ubelong 0x0a0d0d0a
16459: >8 ubelong 0x1a2b3c4d pcap-ng capture file
16460: >>12 beshort x - version %d
16461: >>14 beshort x \b.%d
16462: 0 ulelong 0x0a0d0d0a
16463: >8 ulelong 0x1a2b3c4d pcap-ng capture file
16464: >>12 leshort x - version %d
16465: >>14 leshort x \b.%d
1.1 misho 16466:
16467: #
16468: # AIX "iptrace" capture files.
16469: #
16470: 0 string iptrace\ 1.0 "iptrace" capture file
16471: 0 string iptrace\ 2.0 "iptrace" capture file
16472:
16473: #
16474: # Novell LANalyzer capture files.
16475: #
16476: 0 leshort 0x1001 LANalyzer capture file
16477: 0 leshort 0x1007 LANalyzer capture file
16478:
16479: #
16480: # HP-UX "nettl" capture files.
16481: #
16482: 0 string \x54\x52\x00\x64\x00 "nettl" capture file
16483:
16484: #
16485: # RADCOM WAN/LAN Analyzer capture files.
16486: #
16487: 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
16488:
16489: #
16490: # NetStumbler log files. Not really packets, per se, but about as
16491: # close as you can get. These are log files from NetStumbler, a
16492: # Windows program, that scans for 802.11b networks.
16493: #
16494: 0 string NetS NetStumbler log file
16495: >8 lelong x \b, %d stations found
16496:
16497: #
1.1.1.3 misho 16498: # *Peek tagged capture files.
1.1 misho 16499: #
1.1.1.3 misho 16500: 0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file
1.1 misho 16501:
16502: #
16503: # Visual Networks traffic capture files.
16504: #
16505: 0 string \x05VNF Visual Networks traffic capture file
16506:
16507: #
16508: # Network Instruments Observer capture files.
16509: #
16510: 0 string ObserverPktBuffe Network Instruments Observer capture file
16511:
16512: #
16513: # Files from Accellent Group's 5View products.
16514: #
16515: 0 string \xaa\xaa\xaa\xaa 5View capture file
1.1.1.2 misho 16516:
1.1 misho 16517: #------------------------------------------------------------------------------
1.1.1.2 misho 16518: # $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
1.1 misho 16519: # softquad: file(1) magic for SoftQuad Publishing Software
16520: #
16521: # Author/Editor and RulesBuilder
16522: #
16523: # XXX - byte order?
16524: #
16525: 0 string \<!SQ\ DTD> Compiled SGML rules file
16526: >9 string >\0 Type %s
16527: 0 string \<!SQ\ A/E> A/E SGML Document binary
16528: >9 string >\0 Type %s
16529: 0 string \<!SQ\ STS> A/E SGML binary styles file
16530: >9 string >\0 Type %s
16531: 0 short 0xc0de Compiled PSI (v1) data
16532: 0 short 0xc0da Compiled PSI (v2) data
16533: >3 string >\0 (%s)
16534: # Binary sqtroff font/desc files...
16535: 0 short 0125252 SoftQuad DESC or font file binary
16536: >2 short >0 - version %d
16537: # Bitmaps...
16538: 0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
16539: #0 string SQ\ BITMAP2 SoftQuad Raster Format data
16540: # sqtroff intermediate language (replacement for ditroff int. lang.)
16541: 0 string X\ SoftQuad troff Context intermediate
16542: >2 string 495 for AT&T 495 laser printer
16543: >2 string hp for Hewlett-Packard LaserJet
16544: >2 string impr for IMAGEN imPRESS
16545: >2 string ps for PostScript
16546:
16547: # From: Michael Piefel <piefel@debian.org>
16548: # sqtroff intermediate language (replacement for ditroff int. lang.)
16549: 0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
16550: 0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
16551: 0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
16552: 0 string X\ ps SoftQuad troff Context intermediate for PostScript
16553:
16554: #------------------------------------------------------------------------------
1.1.1.2 misho 16555: # $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 16556: # spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
16557: #
16558: # Cloyce D. Spradling <cloyce@headgear.org>
16559:
16560: 0 string spec SPEC
16561: >4 string .cpu CPU
16562: >>8 string <: \b%.4s
16563: >>12 string . raw result text
16564:
16565: 17 string version=SPECjbb SPECjbb
16566: >32 string <: \b%.4s
16567: >>37 string <: v%.4s raw result text
16568:
16569: 0 string BEGIN\040SPECWEB SPECweb
16570: >13 string <: \b%.2s
16571: >>15 string _SSL \b_SSL
16572: >>>20 string <: v%.4s raw result text
16573: >>16 string <: v%.4s raw result text
16574:
16575: #------------------------------------------------------------------------------
1.1.1.3 misho 16576: # $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $
1.1 misho 16577: # spectrum: file(1) magic for Spectrum emulator files.
16578: #
16579: # John Elliott <jce@seasip.demon.co.uk>
16580:
16581: #
16582: # Spectrum +3DOS header
16583: #
16584: 0 string PLUS3DOS\032 Spectrum +3 data
16585: >15 byte 0 - BASIC program
16586: >15 byte 1 - number array
16587: >15 byte 2 - character array
16588: >15 byte 3 - memory block
16589: >>16 belong 0x001B0040 (screen)
16590: >15 byte 4 - Tasword document
16591: >15 string TAPEFILE - ZXT tapefile
16592: #
16593: # Tape file. This assumes the .TAP starts with a Spectrum-format header,
16594: # which nearly all will.
16595: #
1.1.1.2 misho 16596: # Update: Sanity-check string contents to be printable.
16597: # -Adam Buchbinder <adam.buchbinder@gmail.com>
16598: #
16599: 0 string \023\000\000
16600: >4 string >\0
16601: >>4 string <\177 Spectrum .TAP data "%-10.10s"
16602: >>>3 byte 0 - BASIC program
16603: >>>3 byte 1 - number array
16604: >>>3 byte 2 - character array
16605: >>>3 byte 3 - memory block
16606: >>>>14 belong 0x001B0040 (screen)
1.1 misho 16607:
16608: # The following three blocks are from pak21-spectrum@srcf.ucam.org
16609: # TZX tape images
16610: 0 string ZXTape!\x1a Spectrum .TZX data
16611: >8 byte x version %d
16612: >9 byte x \b.%d
16613:
16614: # RZX input recording files
16615: 0 string RZX! Spectrum .RZX data
16616: >4 byte x version %d
16617: >5 byte x \b.%d
16618:
16619: # Floppy disk images
16620: 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
16621: 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
16622: 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
16623: 0 string SINCLAIR Spectrum .SCL Betadisk image
16624:
16625: # Hard disk images
16626: 0 string RS-IDE\x1a Spectrum .HDF hard disk image
16627: >7 byte x \b, version 0x%02x
16628:
16629: #------------------------------------------------------------------------------
1.1.1.3 misho 16630: # $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $
1.1 misho 16631: # sql: file(1) magic for SQL files
16632: #
16633: # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
16634: # Recognize some MySQL files.
1.1.1.3 misho 16635: # Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
16636: # from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
1.1 misho 16637: #
16638: 0 beshort 0xfe01 MySQL table definition file
16639: >2 byte x Version %d
1.1.1.3 misho 16640: 0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
1.1 misho 16641: >3 byte x Version %d
1.1.1.3 misho 16642: 0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
16643: >3 byte x Version %d
16644: 0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
16645: >3 byte x Version %d
16646: 0 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file
1.1 misho 16647: >3 byte x Version %d
16648: 0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
16649: >3 byte x Version %d
16650: 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
16651: >3 byte x Version %d
1.1.1.3 misho 16652: 0 string \376bin MySQL replication log
16653: 0 belong&0xffffff00 0xfefe0b00
16654: >4 string MARIALOG MySQL Maria transaction log file
16655: >>3 byte x Version %d
16656: 0 belong&0xffffff00 0xfefe0c00
16657: >4 string MACF MySQL Maria control file
16658: >>3 byte x Version %d
1.1 misho 16659:
16660: #------------------------------------------------------------------------------
16661: # iRiver H Series database file
16662: # From Ken Guest <ken@linux.ie>
16663: # As observed from iRivNavi.iDB and unencoded firmware
16664: #
16665: 0 string iRivDB iRiver Database file
16666: >11 string >\0 Version %s
16667: >39 string iHP-100 [H Series]
16668:
16669: #------------------------------------------------------------------------------
16670: # SQLite database files
16671: # Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
16672: #
16673: # Version 1 used GDBM internally; its files cannot be distinguished
16674: # from other GDBM files.
16675: #
16676: # Version 2 used this format:
16677: 0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
16678:
16679: # Version 3 of SQLite allows applications to embed their own "user version"
16680: # number in the database. Detect this and distinguish those files.
16681:
16682: 0 string SQLite\ format\ 3
16683: >60 string _MTN Monotone source repository
16684: >60 belong !0 SQLite 3.x database, user version %u
16685: >60 belong 0 SQLite 3.x database
1.1.1.3 misho 16686:
16687: # Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
16688: # http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
16689: # pceditor_V2003.jar
16690: 0 string PSDB\0 Panasonic channel list database
16691: >126 string SQLite\ format\ 3
16692: >>&-15 indirect x \b; contains
1.1.1.2 misho 16693: # Type: OpenSSH key files
16694: # From: Nicolas Collignon <tsointsoin@gmail.com>
16695:
16696: 0 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key,
16697: >28 string >\0 version %s
16698:
1.1.1.3 misho 16699: 0 string ssh-dss\ OpenSSH DSA public key
16700: 0 string ssh-rsa\ OpenSSH RSA public key
1.1.1.2 misho 16701: # Type: OpenSSL certificates/key files
16702: # From: Nicolas Collignon <tsointsoin@gmail.com>
16703:
16704: 0 string -----BEGIN\ CERTIFICATE----- PEM certificate
16705: 0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request
16706: 0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key
16707: 0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key
1.1 misho 16708:
16709: #------------------------------------------------------------------------------
1.1.1.3 misho 16710: # $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $
1.1 misho 16711: # sun: file(1) magic for Sun machines
16712: #
16713: # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
1.1.1.3 misho 16714: # releases. (5.x uses ELF.) Entries for executables without an
16715: # architecture type, used before the 68020-based Sun-3's came out,
16716: # are in aout, as they're indistinguishable from other big-endian
16717: # 32-bit a.out files.
1.1 misho 16718: #
1.1.1.3 misho 16719: 0 belong&077777777 0600413 a.out SunOS sparc demand paged
1.1 misho 16720: >0 byte &0x80
16721: >>20 belong <4096 shared library
16722: >>20 belong =4096 dynamically linked executable
16723: >>20 belong >4096 dynamically linked executable
16724: >0 byte ^0x80 executable
16725: >16 belong >0 not stripped
16726:
1.1.1.3 misho 16727: 0 belong&077777777 0600410 a.out SunOS sparc pure
1.1 misho 16728: >0 byte &0x80 dynamically linked executable
16729: >0 byte ^0x80 executable
16730: >16 belong >0 not stripped
16731:
1.1.1.3 misho 16732: 0 belong&077777777 0600407 a.out SunOS sparc
1.1 misho 16733: >0 byte &0x80 dynamically linked executable
16734: >0 byte ^0x80 executable
16735: >16 belong >0 not stripped
16736:
1.1.1.3 misho 16737: 0 belong&077777777 0400413 a.out SunOS mc68020 demand paged
1.1 misho 16738: >0 byte &0x80
16739: >>20 belong <4096 shared library
16740: >>20 belong =4096 dynamically linked executable
16741: >>20 belong >4096 dynamically linked executable
16742: >0 byte ^0x80 executable
16743: >16 belong >0 not stripped
16744:
1.1.1.3 misho 16745: 0 belong&077777777 0400410 a.out SunOS mc68020 pure
1.1 misho 16746: >0 byte &0x80 dynamically linked executable
16747: >0 byte ^0x80 executable
16748: >16 belong >0 not stripped
16749:
1.1.1.3 misho 16750: 0 belong&077777777 0400407 a.out SunOS mc68020
1.1 misho 16751: >0 byte &0x80 dynamically linked executable
16752: >0 byte ^0x80 executable
16753: >16 belong >0 not stripped
16754:
1.1.1.3 misho 16755: 0 belong&077777777 0200413 a.out SunOS mc68010 demand paged
1.1 misho 16756: >0 byte &0x80
16757: >>20 belong <4096 shared library
16758: >>20 belong =4096 dynamically linked executable
16759: >>20 belong >4096 dynamically linked executable
16760: >0 byte ^0x80 executable
16761: >16 belong >0 not stripped
16762:
1.1.1.3 misho 16763: 0 belong&077777777 0200410 a.out SunOS mc68010 pure
1.1 misho 16764: >0 byte &0x80 dynamically linked executable
16765: >0 byte ^0x80 executable
16766: >16 belong >0 not stripped
16767:
1.1.1.3 misho 16768: 0 belong&077777777 0200407 a.out SunOS mc68010
1.1 misho 16769: >0 byte &0x80 dynamically linked executable
16770: >0 byte ^0x80 executable
16771: >16 belong >0 not stripped
16772:
16773: #
16774: # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
16775: # binary executed in compatibility mode under SunOS 5.x".
16776: #
16777: 0 belong 0x080456 SunOS core file
16778: >4 belong 432 (SPARC)
16779: >>132 string >\0 from '%s'
16780: >>116 belong =3 (quit)
16781: >>116 belong =4 (illegal instruction)
16782: >>116 belong =5 (trace trap)
16783: >>116 belong =6 (abort)
16784: >>116 belong =7 (emulator trap)
16785: >>116 belong =8 (arithmetic exception)
16786: >>116 belong =9 (kill)
16787: >>116 belong =10 (bus error)
16788: >>116 belong =11 (segmentation violation)
16789: >>116 belong =12 (bad argument to system call)
16790: >>116 belong =29 (resource lost)
16791: >>120 belong x (T=%dK,
16792: >>124 belong x D=%dK,
16793: >>128 belong x S=%dK)
16794: >4 belong 826 (68K)
16795: >>128 string >\0 from '%s'
16796: >4 belong 456 (SPARC 4.x BCP)
16797: >>152 string >\0 from '%s'
16798: # Sun SunPC
16799: 0 long 0xfa33c08e SunPC 4.0 Hard Disk
16800: 0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
1.1.1.3 misho 16801: # Sun snoop (see RFC 1761, which describes the capture file format,
16802: # RFC 3827, which describes some additional datalink types, and
16803: # http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
16804: # which is the IANA registry of Snoop datalink types)
1.1 misho 16805: #
16806: 0 string snoop Snoop capture file
16807: >8 belong >0 - version %ld
16808: >12 belong 0 (IEEE 802.3)
16809: >12 belong 1 (IEEE 802.4)
16810: >12 belong 2 (IEEE 802.5)
16811: >12 belong 3 (IEEE 802.6)
16812: >12 belong 4 (Ethernet)
16813: >12 belong 5 (HDLC)
16814: >12 belong 6 (Character synchronous)
16815: >12 belong 7 (IBM channel-to-channel adapter)
16816: >12 belong 8 (FDDI)
1.1.1.3 misho 16817: >12 belong 9 (Other)
16818: >12 belong 10 (type %ld)
16819: >12 belong 11 (type %ld)
16820: >12 belong 12 (type %ld)
16821: >12 belong 13 (type %ld)
16822: >12 belong 14 (type %ld)
16823: >12 belong 15 (type %ld)
16824: >12 belong 16 (Fibre Channel)
16825: >12 belong 17 (ATM)
16826: >12 belong 18 (ATM Classical IP)
16827: >12 belong 19 (type %ld)
16828: >12 belong 20 (type %ld)
16829: >12 belong 21 (type %ld)
16830: >12 belong 22 (type %ld)
16831: >12 belong 23 (type %ld)
16832: >12 belong 24 (type %ld)
16833: >12 belong 25 (type %ld)
16834: >12 belong 26 (IP over Infiniband)
16835: >12 belong >26 (type %ld)
1.1 misho 16836:
16837: #---------------------------------------------------------------------------
16838: # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
16839: # lead Sun/Cobalt developer) who agrees that they are good and worthy of
16840: # inclusion.
16841:
16842: # Boot ROM images for Sun/Cobalt Linux server appliances
16843: 0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
16844: >38 string x V%.4s
16845:
16846: # New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
16847: # at the very end where file(1) can't get it.
16848: 0 string CRfs COBALT boot rom data (Flat boot rom or file system)
16849:
16850: #------------------------------------------------------------------------
1.1.1.2 misho 16851: # $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 16852: # sysex: file(1) magic for MIDI sysex files
16853: #
16854: #
16855: 0 byte 0xF0 SysEx File -
16856:
16857: # North American Group
16858: >1 byte 0x01 Sequential
16859: >1 byte 0x02 IDP
16860: >1 byte 0x03 OctavePlateau
16861: >1 byte 0x04 Moog
16862: >1 byte 0x05 Passport
16863: >1 byte 0x06 Lexicon
16864: >1 byte 0x07 Kurzweil/Future Retro
16865: >>3 byte 0x77 777
16866: >>4 byte 0x00 Bank
16867: >>4 byte 0x01 Song
16868: >>5 byte 0x0f 16
16869: >>5 byte 0x0e 15
16870: >>5 byte 0x0d 14
16871: >>5 byte 0x0c 13
16872: >>5 byte 0x0b 12
16873: >>5 byte 0x0a 11
16874: >>5 byte 0x09 10
16875: >>5 byte 0x08 9
16876: >>5 byte 0x07 8
16877: >>5 byte 0x06 7
16878: >>5 byte 0x05 6
16879: >>5 byte 0x04 5
16880: >>5 byte 0x03 4
16881: >>5 byte 0x02 3
16882: >>5 byte 0x01 2
16883: >>5 byte 0x00 1
16884: >>5 byte 0x10 (ALL)
16885: >>2 byte x \b, Channel %d
16886: >1 byte 0x08 Fender
16887: >1 byte 0x09 Gulbransen
16888: >1 byte 0x0a AKG
16889: >1 byte 0x0b Voyce
16890: >1 byte 0x0c Waveframe
16891: >1 byte 0x0d ADA
16892: >1 byte 0x0e Garfield
16893: >1 byte 0x0f Ensoniq
16894: >1 byte 0x10 Oberheim
16895: >>2 byte 0x06 Matrix 6 series
16896: >>3 byte 0x0A Dump (All)
16897: >>3 byte 0x01 Dump (Bank)
16898: >>4 belong 0x0002040E Matrix 1000
16899: >>>11 byte <2 User bank %d
16900: >>>11 byte >1 Preset bank %d
16901: >1 byte 0x11 Apple
16902: >1 byte 0x12 GreyMatter
16903: >1 byte 0x14 PalmTree
16904: >1 byte 0x15 JLCooper
16905: >1 byte 0x16 Lowrey
16906: >1 byte 0x17 AdamsSmith
16907: >1 byte 0x18 E-mu
16908: >1 byte 0x19 Harmony
16909: >1 byte 0x1a ART
16910: >1 byte 0x1b Baldwin
16911: >1 byte 0x1c Eventide
16912: >1 byte 0x1d Inventronics
16913: >1 byte 0x1f Clarity
16914:
16915: # European Group
16916: >1 byte 0x21 SIEL
16917: >1 byte 0x22 Synthaxe
16918: >1 byte 0x24 Hohner
16919: >1 byte 0x25 Twister
16920: >1 byte 0x26 Solton
16921: >1 byte 0x27 Jellinghaus
16922: >1 byte 0x28 Southworth
16923: >1 byte 0x29 PPG
16924: >1 byte 0x2a JEN
16925: >1 byte 0x2b SSL
16926: >1 byte 0x2c AudioVertrieb
16927:
16928: >1 byte 0x2f ELKA
16929: >>3 byte 0x09 EK-44
16930:
16931: >1 byte 0x30 Dynacord
16932: >1 byte 0x31 Jomox
16933: >1 byte 0x33 Clavia
16934: >1 byte 0x39 Soundcraft
16935: # Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
16936: >1 byte 0x3e Waldorf
16937: >>2 byte 0x00 microWave
16938: >>2 byte 0x0E microwave2 / XT
16939: >>2 byte 0x0F Q / Q+
16940: >>3 byte =0 (default id)
16941: >>3 byte >0 (
16942: >>>3 byte <0x7F \bdevice %d)
16943: >>>3 byte =0x7F \bbroadcast id)
16944: >>3 byte 0x7f Microwave I
16945: >>>4 byte 0x00 SNDR (Sound Request)
16946: >>>4 byte 0x10 SNDD (Sound Dump)
16947: >>>4 byte 0x20 SNDP (Sound Parameter Change)
16948: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
16949: >>>4 byte 0x70 BOOT (Sound Reserved)
16950: >>>4 byte 0x01 MULR (Multi Request)
16951: >>>4 byte 0x11 MULD (Multi Dump)
16952: >>>4 byte 0x21 MULP (Multi Parameter Change)
16953: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
16954: >>>4 byte 0x71 OS (Multi Reserved)
16955: >>>4 byte 0x02 DRMR (Drum Map Request)
16956: >>>4 byte 0x12 DRMD (Drum Map Dump)
16957: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
16958: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
16959: >>>4 byte 0x72 BIN (Drum Map Reserved)
16960: >>>4 byte 0x03 PATR (Sequencer Pattern Request)
16961: >>>4 byte 0x13 PATD (Sequencer Pattern Dump)
16962: >>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
16963: >>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
16964: >>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
16965: >>>4 byte 0x04 GLBR (Global Parameter Request)
16966: >>>4 byte 0x14 GLBD (Global Parameter Dump)
16967: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
16968: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
16969: >>>4 byte 0x07 MODR (Mode Parameter Request)
16970: >>>4 byte 0x17 MODD (Mode Parameter Dump)
16971: >>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
16972: >>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
16973: >>2 byte 0x10 microQ
16974: >>>4 byte 0x00 SNDR (Sound Request)
16975: >>>4 byte 0x10 SNDD (Sound Dump)
16976: >>>4 byte 0x20 SNDP (Sound Parameter Change)
16977: >>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
16978: >>>4 byte 0x70 (Sound Reserved)
16979: >>>4 byte 0x01 MULR (Multi Request)
16980: >>>4 byte 0x11 MULD (Multi Dump)
16981: >>>4 byte 0x21 MULP (Multi Parameter Change)
16982: >>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
16983: >>>4 byte 0x71 OS (Multi Reserved)
16984: >>>4 byte 0x02 DRMR (Drum Map Request)
16985: >>>4 byte 0x12 DRMD (Drum Map Dump)
16986: >>>4 byte 0x22 DRMP (Drum Map Parameter Change)
16987: >>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
16988: >>>4 byte 0x72 BIN (Drum Map Reserved)
16989: >>>4 byte 0x04 GLBR (Global Parameter Request)
16990: >>>4 byte 0x14 GLBD (Global Parameter Dump)
16991: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
16992: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
16993: >>2 byte 0x11 rackAttack
16994: >>>4 byte 0x00 SNDR (Sound Parameter Request)
16995: >>>4 byte 0x10 SNDD (Sound Parameter Dump)
16996: >>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
16997: >>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
16998: >>>4 byte 0x01 PRGR (Program Parameter Request)
16999: >>>4 byte 0x11 PRGD (Program Parameter Dump)
17000: >>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
17001: >>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
17002: >>>4 byte 0x71 OS (Program Parameter Reserved)
17003: >>>4 byte 0x03 PATR (Pattern Parameter Request)
17004: >>>4 byte 0x13 PATD (Pattern Parameter Dump)
17005: >>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
17006: >>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
17007: >>>4 byte 0x04 GLBR (Global Parameter Request)
17008: >>>4 byte 0x14 GLBD (Global Parameter Dump)
17009: >>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
17010: >>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
17011: >>>4 byte 0x05 EFXR (FX Parameter Request)
17012: >>>4 byte 0x15 EFXD (FX Parameter Dump)
17013: >>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
17014: >>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
17015: >>>4 byte 0x07 MODR (Mode Command Request)
17016: >>>4 byte 0x17 MODD (Mode Command Dump)
17017: >>>4 byte 0x27 MODP (Mode Command Parameter Change)
17018: >>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
17019: >>2 byte 0x03 Wave
17020: >>>4 byte 0x00 SBPR (Soundprogram)
17021: >>>4 byte 0x01 SAPR (Performance)
17022: >>>4 byte 0x02 SWAVE (Wave)
17023: >>>4 byte 0x03 SWTBL (Wave control table)
17024: >>>4 byte 0x04 SVT (Velocity Curve)
17025: >>>4 byte 0x05 STT (Tuning Table)
17026: >>>4 byte 0x06 SGLB (Global Parameters)
17027: >>>4 byte 0x07 SARRMAP (Performance Program Change Map)
17028: >>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
17029: >>>4 byte 0x09 SBPRPAR (Sound Parameter)
17030: >>>4 byte 0x0A SARRPAR (Performance Parameter)
17031: >>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
17032: >>>4 byte 0x0F SBULK (Bulk Switch on/off)
17033:
17034: # Japanese Group
17035: >1 byte 0x40 Kawai
17036: >>3 byte 0x20 K1
17037: >>3 byte 0x22 K4
17038:
17039: >1 byte 0x41 Roland
17040: >>3 byte 0x14 D-50
17041: >>3 byte 0x2b U-220
17042: >>3 byte 0x02 TR-707
17043:
17044: >1 byte 0x42 Korg
17045: >>3 byte 0x19 M1
17046:
17047: >1 byte 0x43 Yamaha
17048: >1 byte 0x44 Casio
17049: >1 byte 0x46 Kamiya
17050: >1 byte 0x47 Akai
17051: >1 byte 0x48 Victor
17052: >1 byte 0x49 Mesosha
17053: >1 byte 0x4b Fujitsu
17054: >1 byte 0x4c Sony
17055: >1 byte 0x4e Teac
17056: >1 byte 0x50 Matsushita
17057: >1 byte 0x51 Fostex
17058: >1 byte 0x52 Zoom
17059: >1 byte 0x54 Matsushita
17060: >1 byte 0x57 Acoustic tech. lab.
17061:
17062: >1 belong&0xffffff00 0x00007400 Ta Horng
17063: >1 belong&0xffffff00 0x00007500 e-Tek
17064: >1 belong&0xffffff00 0x00007600 E-Voice
17065: >1 belong&0xffffff00 0x00007700 Midisoft
17066: >1 belong&0xffffff00 0x00007800 Q-Sound
17067: >1 belong&0xffffff00 0x00007900 Westrex
17068: >1 belong&0xffffff00 0x00007a00 Nvidia*
17069: >1 belong&0xffffff00 0x00007b00 ESS
17070: >1 belong&0xffffff00 0x00007c00 Mediatrix
17071: >1 belong&0xffffff00 0x00007d00 Brooktree
17072: >1 belong&0xffffff00 0x00007e00 Otari
17073: >1 belong&0xffffff00 0x00007f00 Key Electronics
17074: >1 belong&0xffffff00 0x00010000 Shure
17075: >1 belong&0xffffff00 0x00010100 AuraSound
17076: >1 belong&0xffffff00 0x00010200 Crystal
17077: >1 belong&0xffffff00 0x00010300 Rockwell
17078: >1 belong&0xffffff00 0x00010400 Silicon Graphics
17079: >1 belong&0xffffff00 0x00010500 Midiman
17080: >1 belong&0xffffff00 0x00010600 PreSonus
17081: >1 belong&0xffffff00 0x00010800 Topaz
17082: >1 belong&0xffffff00 0x00010900 Cast Lightning
17083: >1 belong&0xffffff00 0x00010a00 Microsoft
17084: >1 belong&0xffffff00 0x00010b00 Sonic Foundry
17085: >1 belong&0xffffff00 0x00010c00 Line 6
17086: >1 belong&0xffffff00 0x00010d00 Beatnik Inc.
17087: >1 belong&0xffffff00 0x00010e00 Van Koerving
17088: >1 belong&0xffffff00 0x00010f00 Altech Systems
17089: >1 belong&0xffffff00 0x00011000 S & S Research
17090: >1 belong&0xffffff00 0x00011100 VLSI Technology
17091: >1 belong&0xffffff00 0x00011200 Chromatic
17092: >1 belong&0xffffff00 0x00011300 Sapphire
17093: >1 belong&0xffffff00 0x00011400 IDRC
17094: >1 belong&0xffffff00 0x00011500 Justonic Tuning
17095: >1 belong&0xffffff00 0x00011600 TorComp
17096: >1 belong&0xffffff00 0x00011700 Newtek Inc.
17097: >1 belong&0xffffff00 0x00011800 Sound Sculpture
17098: >1 belong&0xffffff00 0x00011900 Walker Technical
17099: >1 belong&0xffffff00 0x00011a00 Digital Harmony
17100: >1 belong&0xffffff00 0x00011b00 InVision
17101: >1 belong&0xffffff00 0x00011c00 T-Square
17102: >1 belong&0xffffff00 0x00011d00 Nemesys
17103: >1 belong&0xffffff00 0x00011e00 DBX
17104: >1 belong&0xffffff00 0x00011f00 Syndyne
17105: >1 belong&0xffffff00 0x00012000 Bitheadz
17106: >1 belong&0xffffff00 0x00012100 Cakewalk
17107: >1 belong&0xffffff00 0x00012200 Staccato
17108: >1 belong&0xffffff00 0x00012300 National Semicon.
17109: >1 belong&0xffffff00 0x00012400 Boom Theory
17110: >1 belong&0xffffff00 0x00012500 Virtual DSP Corp
17111: >1 belong&0xffffff00 0x00012600 Antares
17112: >1 belong&0xffffff00 0x00012700 Angel Software
17113: >1 belong&0xffffff00 0x00012800 St Louis Music
17114: >1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
17115: >1 belong&0xffffff00 0x00012a00 Ashley Audio
17116: >1 belong&0xffffff00 0x00012b00 Vari-Lite
17117: >1 belong&0xffffff00 0x00012c00 Summit Audio
17118: >1 belong&0xffffff00 0x00012d00 Aureal Semicon.
17119: >1 belong&0xffffff00 0x00012e00 SeaSound
17120: >1 belong&0xffffff00 0x00012f00 U.S. Robotics
17121: >1 belong&0xffffff00 0x00013000 Aurisis
17122: >1 belong&0xffffff00 0x00013100 Nearfield Multimedia
17123: >1 belong&0xffffff00 0x00013200 FM7 Inc.
17124: >1 belong&0xffffff00 0x00013300 Swivel Systems
17125: >1 belong&0xffffff00 0x00013400 Hyperactive
17126: >1 belong&0xffffff00 0x00013500 MidiLite
17127: >1 belong&0xffffff00 0x00013600 Radical
17128: >1 belong&0xffffff00 0x00013700 Roger Linn
17129: >1 belong&0xffffff00 0x00013800 Helicon
17130: >1 belong&0xffffff00 0x00013900 Event
17131: >1 belong&0xffffff00 0x00013a00 Sonic Network
17132: >1 belong&0xffffff00 0x00013b00 Realtime Music
17133: >1 belong&0xffffff00 0x00013c00 Apogee Digital
17134:
17135: >1 belong&0xffffff00 0x00202b00 Medeli Electronics
17136: >1 belong&0xffffff00 0x00202c00 Charlie Lab
17137: >1 belong&0xffffff00 0x00202d00 Blue Chip Music
17138: >1 belong&0xffffff00 0x00202e00 BEE OH Corp
17139: >1 belong&0xffffff00 0x00202f00 LG Semicon America
17140: >1 belong&0xffffff00 0x00203000 TESI
17141: >1 belong&0xffffff00 0x00203100 EMAGIC
17142: >1 belong&0xffffff00 0x00203200 Behringer
17143: >1 belong&0xffffff00 0x00203300 Access Music
17144: >1 belong&0xffffff00 0x00203400 Synoptic
17145: >1 belong&0xffffff00 0x00203500 Hanmesoft Corp
17146: >1 belong&0xffffff00 0x00203600 Terratec
17147: >1 belong&0xffffff00 0x00203700 Proel SpA
17148: >1 belong&0xffffff00 0x00203800 IBK MIDI
17149: >1 belong&0xffffff00 0x00203900 IRCAM
17150: >1 belong&0xffffff00 0x00203a00 Propellerhead Software
17151: >1 belong&0xffffff00 0x00203b00 Red Sound Systems
17152: >1 belong&0xffffff00 0x00203c00 Electron ESI AB
17153: >1 belong&0xffffff00 0x00203d00 Sintefex Audio
17154: >1 belong&0xffffff00 0x00203e00 Music and More
17155: >1 belong&0xffffff00 0x00203f00 Amsaro
17156: >1 belong&0xffffff00 0x00204000 CDS Advanced Technology
17157: >1 belong&0xffffff00 0x00204100 Touched by Sound
17158: >1 belong&0xffffff00 0x00204200 DSP Arts
17159: >1 belong&0xffffff00 0x00204300 Phil Rees Music
17160: >1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
17161: >1 belong&0xffffff00 0x00204500 Soundart
17162: >1 belong&0xffffff00 0x00204600 C-Mexx Software
17163: >1 belong&0xffffff00 0x00204700 Klavis Tech.
17164: >1 belong&0xffffff00 0x00204800 Noteheads AB
17165:
17166: 0 string T707 Roland TR-707 Data
1.1.1.3 misho 17167: #------------------------------------------------------------------------------
17168: # file: file(1) magic for Tcl scripting language
17169: # URL: http://www.tcl.tk/
17170: # From: gustaf neumann
17171:
17172: # Tcl scripts
17173: 0 search/1/w #!\ /usr/bin/tcl Tcl script text executable
17174: !:mime text/x-lua
17175: 0 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable
17176: !:mime text/x-tcl
17177: 0 search/1 #!/usr/bin/env\ tcl Tcl script text executable
17178: !:mime text/x-tcl
17179: 0 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable
17180: !:mime text/x-tcl
17181: 0 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable
17182: !:mime text/x-tcl
17183: 0 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable
17184: !:mime text/x-tcl
17185: 0 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable
17186: !:mime text/x-tcl
17187: 0 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable
17188: !:mime text/x-tcl
17189:
17190: # check the first line
17191: 0 search/1 package\ req
17192: >0 regex \^package[\ \t]+req Tcl script
17193: # not 'p', check other lines
17194: 0 search/1 !p
17195: >0 regex \^package[\ \t]+req Tcl script
1.1.1.2 misho 17196:
1.1 misho 17197: #------------------------------------------------------------------------------
1.1.1.2 misho 17198: # $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
1.1 misho 17199: # teapot: file(1) magic for "teapot" spreadsheet
17200: #
17201: 0 string #!teapot\012xdr teapot work sheet (XDR format)
17202:
17203: #------------------------------------------------------------------------------
1.1.1.2 misho 17204: # $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 17205: # terminfo: file(1) magic for terminfo
17206: #
17207: # XXX - byte order for screen images?
17208: #
17209: 0 string \032\001 Compiled terminfo entry
17210: 0 short 0433 Curses screen image
17211: 0 short 0434 Curses screen image
1.1.1.2 misho 17212:
1.1 misho 17213: #------------------------------------------------------------------------------
1.1.1.3 misho 17214: # $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $
1.1 misho 17215: # tex: file(1) magic for TeX files
17216: #
17217: # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
17218: #
17219: # From <conklin@talisman.kaleida.com>
17220:
17221: # Although we may know the offset of certain text fields in TeX DVI
17222: # and font files, we can't use them reliably because they are not
17223: # zero terminated. [but we do anyway, christos]
17224: 0 string \367\002 TeX DVI file
17225: !:mime application/x-dvi
17226: >16 string >\0 (%s)
17227: 0 string \367\203 TeX generic font data
17228: 0 string \367\131 TeX packed font data
17229: >3 string >\0 (%s)
17230: 0 string \367\312 TeX virtual font data
17231: 0 search/1 This\ is\ TeX, TeX transcript text
17232: 0 search/1 This\ is\ METAFONT, METAFONT transcript text
17233:
17234: # There is no way to detect TeX Font Metric (*.tfm) files without
17235: # breaking them apart and reading the data. The following patterns
17236: # match most *.tfm files generated by METAFONT or afm2tfm.
17237: 2 string \000\021 TeX font metric data
17238: !:mime application/x-tex-tfm
17239: >33 string >\0 (%s)
17240: 2 string \000\022 TeX font metric data
17241: !:mime application/x-tex-tfm
17242: >33 string >\0 (%s)
17243:
17244: # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
17245: 0 search/1 \\input\ texinfo Texinfo source text
17246: !:mime text/x-texinfo
17247: 0 search/1 This\ is\ Info\ file GNU Info text
17248: !:mime text/x-info
17249:
17250: # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
1.1.1.3 misho 17251: 0 search/4096 \\input TeX document text
1.1 misho 17252: !:mime text/x-tex
1.1.1.3 misho 17253: !:strength + 15
17254: 0 search/4096 \\section LaTeX document text
1.1 misho 17255: !:mime text/x-tex
1.1.1.3 misho 17256: !:strength + 18
17257: 0 search/4096 \\setlength LaTeX document text
1.1 misho 17258: !:mime text/x-tex
1.1.1.3 misho 17259: !:strength + 15
17260: 0 search/4096 \\documentstyle LaTeX document text
1.1 misho 17261: !:mime text/x-tex
1.1.1.3 misho 17262: !:strength + 18
17263: 0 search/4096 \\chapter LaTeX document text
1.1 misho 17264: !:mime text/x-tex
1.1.1.3 misho 17265: !:strength + 18
17266: 0 search/4096 \\documentclass LaTeX 2e document text
1.1 misho 17267: !:mime text/x-tex
1.1.1.3 misho 17268: !:strength + 15
17269: 0 search/4096 \\relax LaTeX auxiliary file
1.1 misho 17270: !:mime text/x-tex
1.1.1.3 misho 17271: !:strength + 15
17272: 0 search/4096 \\contentsline LaTeX table of contents
1.1 misho 17273: !:mime text/x-tex
1.1.1.3 misho 17274: !:strength + 15
17275: 0 search/4096 %\ -*-latex-*- LaTeX document text
1.1 misho 17276: !:mime text/x-tex
17277:
17278: # Tex document, from Hendrik Scholz <hendrik@scholz.net>
17279: 0 search/1 \\ifx TeX document text
17280:
17281: # Index and glossary files
1.1.1.3 misho 17282: 0 search/4096 \\indexentry LaTeX raw index file
17283: 0 search/4096 \\begin{theindex} LaTeX sorted index
17284: 0 search/4096 \\glossaryentry LaTeX raw glossary
17285: 0 search/4096 \\begin{theglossary} LaTeX sorted glossary
17286: 0 search/4096 This\ is\ makeindex Makeindex log file
1.1 misho 17287:
17288: # End of TeX
17289:
17290: #------------------------------------------------------------------------------
17291: # file(1) magic for BibTex text files
17292: # From Hendrik Scholz <hendrik@scholz.net>
17293:
17294: 0 search/1/c @article{ BibTeX text file
17295: 0 search/1/c @book{ BibTeX text file
17296: 0 search/1/c @inbook{ BibTeX text file
17297: 0 search/1/c @incollection{ BibTeX text file
17298: 0 search/1/c @inproceedings{ BibTeX text file
17299: 0 search/1/c @manual{ BibTeX text file
17300: 0 search/1/c @misc{ BibTeX text file
17301: 0 search/1/c @preamble{ BibTeX text file
17302: 0 search/1/c @phdthesis{ BibTeX text file
17303: 0 search/1/c @techreport{ BibTeX text file
17304: 0 search/1/c @unpublished{ BibTeX text file
17305:
17306: 73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header)
17307:
17308: 73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
17309:
17310: 0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
17311:
17312: 0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file
17313:
17314: 0 search/1 @c\ @mapfile{ TeX font aliases text file
1.1.1.2 misho 17315:
1.1.1.3 misho 17316: 0 string #LyX LyX document text
1.1.1.2 misho 17317:
1.1 misho 17318: #------------------------------------------------------------------------------
1.1.1.3 misho 17319: # $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
1.1 misho 17320: # file(1) magic for tgif(1) files
17321: # From Hendrik Scholz <hendrik@scholz.net>
1.1.1.3 misho 17322: 0 string %TGIF\ Tgif file version
1.1.1.2 misho 17323: >6 string x %s
1.1 misho 17324:
1.1.1.2 misho 17325: #------------------------------------------------------------------------------
17326: # $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
1.1 misho 17327: # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
17328: #
17329: # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
17330: #
17331: # Update: Romain Lievin (roms@lpg.ticalc.org).
17332: #
17333: # NOTE: This list is not complete.
17334: # Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
17335: # program/group magic numbers in here because I cannot find any.
17336: 0 string **TI80** TI-80 Graphing Calculator File.
17337: 0 string **TI81** TI-81 Graphing Calculator File.
17338: #
17339: # Magic Numbers for the TI-73
17340: #
17341: 0 string **TI73** TI-73 Graphing Calculator
17342: >0x00003B byte 0x00 (real number)
17343: >0x00003B byte 0x01 (list)
17344: >0x00003B byte 0x02 (matrix)
17345: >0x00003B byte 0x03 (equation)
17346: >0x00003B byte 0x04 (string)
17347: >0x00003B byte 0x05 (program)
17348: >0x00003B byte 0x06 (assembly program)
17349: >0x00003B byte 0x07 (picture)
17350: >0x00003B byte 0x08 (gdb)
17351: >0x00003B byte 0x0C (complex number)
17352: >0x00003B byte 0x0F (window settings)
17353: >0x00003B byte 0x10 (zoom)
17354: >0x00003B byte 0x11 (table setup)
17355: >0x00003B byte 0x13 (backup)
17356:
17357: # Magic Numbers for the TI-82
17358: #
17359: 0 string **TI82** TI-82 Graphing Calculator
17360: >0x00003B byte 0x00 (real)
17361: >0x00003B byte 0x01 (list)
17362: >0x00003B byte 0x02 (matrix)
17363: >0x00003B byte 0x03 (Y-variable)
17364: >0x00003B byte 0x05 (program)
17365: >0x00003B byte 0x06 (protected prgm)
17366: >0x00003B byte 0x07 (picture)
17367: >0x00003B byte 0x08 (gdb)
17368: >0x00003B byte 0x0B (window settings)
17369: >0x00003B byte 0x0C (window settings)
17370: >0x00003B byte 0x0D (table setup)
17371: >0x00003B byte 0x0E (screenshot)
17372: >0x00003B byte 0x0F (backup)
17373: #
17374: # Magic Numbers for the TI-83
17375: #
17376: 0 string **TI83** TI-83 Graphing Calculator
17377: >0x00003B byte 0x00 (real)
17378: >0x00003B byte 0x01 (list)
17379: >0x00003B byte 0x02 (matrix)
17380: >0x00003B byte 0x03 (Y-variable)
17381: >0x00003B byte 0x04 (string)
17382: >0x00003B byte 0x05 (program)
17383: >0x00003B byte 0x06 (protected prgm)
17384: >0x00003B byte 0x07 (picture)
17385: >0x00003B byte 0x08 (gdb)
17386: >0x00003B byte 0x0B (window settings)
17387: >0x00003B byte 0x0C (window settings)
17388: >0x00003B byte 0x0D (table setup)
17389: >0x00003B byte 0x0E (screenshot)
17390: >0x00003B byte 0x13 (backup)
17391: #
17392: # Magic Numbers for the TI-83+
17393: #
17394: 0 string **TI83F* TI-83+ Graphing Calculator
17395: >0x00003B byte 0x00 (real number)
17396: >0x00003B byte 0x01 (list)
17397: >0x00003B byte 0x02 (matrix)
17398: >0x00003B byte 0x03 (equation)
17399: >0x00003B byte 0x04 (string)
17400: >0x00003B byte 0x05 (program)
17401: >0x00003B byte 0x06 (assembly program)
17402: >0x00003B byte 0x07 (picture)
17403: >0x00003B byte 0x08 (gdb)
17404: >0x00003B byte 0x0C (complex number)
17405: >0x00003B byte 0x0F (window settings)
17406: >0x00003B byte 0x10 (zoom)
17407: >0x00003B byte 0x11 (table setup)
17408: >0x00003B byte 0x13 (backup)
17409: >0x00003B byte 0x15 (application variable)
17410: >0x00003B byte 0x17 (group of variable)
17411:
17412: #
17413: # Magic Numbers for the TI-85
17414: #
17415: 0 string **TI85** TI-85 Graphing Calculator
17416: >0x00003B byte 0x00 (real number)
17417: >0x00003B byte 0x01 (complex number)
17418: >0x00003B byte 0x02 (real vector)
17419: >0x00003B byte 0x03 (complex vector)
17420: >0x00003B byte 0x04 (real list)
17421: >0x00003B byte 0x05 (complex list)
17422: >0x00003B byte 0x06 (real matrix)
17423: >0x00003B byte 0x07 (complex matrix)
17424: >0x00003B byte 0x08 (real constant)
17425: >0x00003B byte 0x09 (complex constant)
17426: >0x00003B byte 0x0A (equation)
17427: >0x00003B byte 0x0C (string)
17428: >0x00003B byte 0x0D (function GDB)
17429: >0x00003B byte 0x0E (polar GDB)
17430: >0x00003B byte 0x0F (parametric GDB)
17431: >0x00003B byte 0x10 (diffeq GDB)
17432: >0x00003B byte 0x11 (picture)
17433: >0x00003B byte 0x12 (program)
17434: >0x00003B byte 0x13 (range)
17435: >0x00003B byte 0x17 (window settings)
17436: >0x00003B byte 0x18 (window settings)
17437: >0x00003B byte 0x19 (window settings)
17438: >0x00003B byte 0x1A (window settings)
17439: >0x00003B byte 0x1B (zoom)
17440: >0x00003B byte 0x1D (backup)
17441: >0x00003B byte 0x1E (unknown)
17442: >0x00003B byte 0x2A (equation)
17443: >0x000032 string ZS4 - ZShell Version 4 File.
17444: >0x000032 string ZS3 - ZShell Version 3 File.
17445: #
17446: # Magic Numbers for the TI-86
17447: #
17448: 0 string **TI86** TI-86 Graphing Calculator
17449: >0x00003B byte 0x00 (real number)
17450: >0x00003B byte 0x01 (complex number)
17451: >0x00003B byte 0x02 (real vector)
17452: >0x00003B byte 0x03 (complex vector)
17453: >0x00003B byte 0x04 (real list)
17454: >0x00003B byte 0x05 (complex list)
17455: >0x00003B byte 0x06 (real matrix)
17456: >0x00003B byte 0x07 (complex matrix)
17457: >0x00003B byte 0x08 (real constant)
17458: >0x00003B byte 0x09 (complex constant)
17459: >0x00003B byte 0x0A (equation)
17460: >0x00003B byte 0x0C (string)
17461: >0x00003B byte 0x0D (function GDB)
17462: >0x00003B byte 0x0E (polar GDB)
17463: >0x00003B byte 0x0F (parametric GDB)
17464: >0x00003B byte 0x10 (diffeq GDB)
17465: >0x00003B byte 0x11 (picture)
17466: >0x00003B byte 0x12 (program)
17467: >0x00003B byte 0x13 (range)
17468: >0x00003B byte 0x17 (window settings)
17469: >0x00003B byte 0x18 (window settings)
17470: >0x00003B byte 0x19 (window settings)
17471: >0x00003B byte 0x1A (window settings)
17472: >0x00003B byte 0x1B (zoom)
17473: >0x00003B byte 0x1D (backup)
17474: >0x00003B byte 0x1E (unknown)
17475: >0x00003B byte 0x2A (equation)
17476: #
17477: # Magic Numbers for the TI-89
17478: #
17479: 0 string **TI89** TI-89 Graphing Calculator
17480: >0x000048 byte 0x00 (expression)
17481: >0x000048 byte 0x04 (list)
17482: >0x000048 byte 0x06 (matrix)
17483: >0x000048 byte 0x0A (data)
17484: >0x000048 byte 0x0B (text)
17485: >0x000048 byte 0x0C (string)
17486: >0x000048 byte 0x0D (graphic data base)
17487: >0x000048 byte 0x0E (figure)
17488: >0x000048 byte 0x10 (picture)
17489: >0x000048 byte 0x12 (program)
17490: >0x000048 byte 0x13 (function)
17491: >0x000048 byte 0x14 (macro)
17492: >0x000048 byte 0x1C (zipped)
17493: >0x000048 byte 0x21 (assembler)
17494: #
17495: # Magic Numbers for the TI-92
17496: #
17497: 0 string **TI92** TI-92 Graphing Calculator
17498: >0x000048 byte 0x00 (expression)
17499: >0x000048 byte 0x04 (list)
17500: >0x000048 byte 0x06 (matrix)
17501: >0x000048 byte 0x0A (data)
17502: >0x000048 byte 0x0B (text)
17503: >0x000048 byte 0x0C (string)
17504: >0x000048 byte 0x0D (graphic data base)
17505: >0x000048 byte 0x0E (figure)
17506: >0x000048 byte 0x10 (picture)
17507: >0x000048 byte 0x12 (program)
17508: >0x000048 byte 0x13 (function)
17509: >0x000048 byte 0x14 (macro)
17510: >0x000048 byte 0x1D (backup)
17511: #
17512: # Magic Numbers for the TI-92+/V200
17513: #
17514: 0 string **TI92P* TI-92+/V200 Graphing Calculator
17515: >0x000048 byte 0x00 (expression)
17516: >0x000048 byte 0x04 (list)
17517: >0x000048 byte 0x06 (matrix)
17518: >0x000048 byte 0x0A (data)
17519: >0x000048 byte 0x0B (text)
17520: >0x000048 byte 0x0C (string)
17521: >0x000048 byte 0x0D (graphic data base)
17522: >0x000048 byte 0x0E (figure)
17523: >0x000048 byte 0x10 (picture)
17524: >0x000048 byte 0x12 (program)
17525: >0x000048 byte 0x13 (function)
17526: >0x000048 byte 0x14 (macro)
17527: >0x000048 byte 0x1C (zipped)
17528: >0x000048 byte 0x21 (assembler)
17529: #
17530: # Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
17531: #
17532: 0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
17533: 0 string **TIFL** TI-XX Graphing Calculator (FLASH)
17534: >8 byte >0 - Revision %d
17535: >>9 byte x \b.%d,
17536: >12 byte >0 Revision date %02x
17537: >>13 byte x \b/%02x
17538: >>14 beshort x \b/%04x,
17539: >17 string >/0 name: '%s',
17540: >48 byte 0x74 device: TI-73,
17541: >48 byte 0x73 device: TI-83+,
17542: >48 byte 0x98 device: TI-89,
17543: >48 byte 0x88 device: TI-92+,
17544: >49 byte 0x23 type: OS upgrade,
17545: >49 byte 0x24 type: application,
17546: >49 byte 0x25 type: certificate,
17547: >49 byte 0x3e type: license,
17548: >74 lelong >0 size: %ld bytes
17549:
17550: # VTi & TiEmu skins (TI Graphing Calculators).
17551: # From: Romain Lievin (roms@lpg.ticalc.org).
17552: # Magic Numbers for the VTi skins
17553: 0 string VTI Virtual TI skin
17554: >3 string v - Version
17555: >>4 byte >0 \b %c
17556: >>6 byte x \b.%c
17557: # Magic Numbers for the TiEmu skins
17558: 0 string TiEmu TiEmu skin
17559: >6 string v - Version
17560: >>7 byte >0 \b %c
17561: >>9 byte x \b.%c
17562: >>10 byte x \b%c
17563:
17564: #------------------------------------------------------------------------------
1.1.1.2 misho 17565: # $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
1.1 misho 17566: # timezone: file(1) magic for timezone data
17567: #
17568: # from Daniel Quinlan (quinlan@yggdrasil.com)
17569: # this should work on Linux, SunOS, and maybe others
17570: # Added new official magic number for recent versions of the Olson code
17571: 0 string TZif timezone data
1.1.1.2 misho 17572: >4 byte 0 \b, old version
17573: >4 byte >0 \b, version %c
17574: >20 belong 0 \b, no gmt time flags
17575: >20 belong 1 \b, 1 gmt time flag
17576: >20 belong >1 \b, %d gmt time flags
17577: >24 belong 0 \b, no std time flags
17578: >20 belong 1 \b, 1 std time flag
17579: >24 belong >1 \b, %d std time flags
17580: >28 belong 0 \b, no leap seconds
17581: >28 belong 1 \b, 1 leap second
17582: >28 belong >1 \b, %d leap seconds
17583: >32 belong 0 \b, no transition times
17584: >32 belong 1 \b, 1 transition time
17585: >32 belong >1 \b, %d transition times
17586: >36 belong 0 \b, no abbreviation chars
17587: >36 belong 1 \b, 1 abbreviation char
17588: >36 belong >1 \b, %d abbreviation chars
1.1 misho 17589: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
17590: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
17591: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
17592: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
17593: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
17594: 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
1.1.1.2 misho 17595:
1.1 misho 17596: #------------------------------------------------------------------------------
1.1.1.2 misho 17597: # $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
1.1 misho 17598: # troff: file(1) magic for *roff
17599: #
17600: # updated by Daniel Quinlan (quinlan@yggdrasil.com)
17601:
17602: # troff input
17603: 0 search/1 .\\" troff or preprocessor input text
17604: !:mime text/troff
17605: 0 search/1 '\\" troff or preprocessor input text
17606: !:mime text/troff
17607: 0 search/1 '.\\" troff or preprocessor input text
17608: !:mime text/troff
17609: 0 search/1 \\" troff or preprocessor input text
17610: !:mime text/troff
17611: 0 search/1 ''' troff or preprocessor input text
17612: !:mime text/troff
1.1.1.2 misho 17613: 0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
17614: !:mime text/troff
17615: 0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
17616: !:mime text/troff
1.1 misho 17617:
17618: # ditroff intermediate output text
17619: 0 search/1 x\ T ditroff output text
17620: >4 search/1 cat for the C/A/T phototypesetter
17621: >4 search/1 ps for PostScript
17622: >4 search/1 dvi for DVI
17623: >4 search/1 ascii for ASCII
17624: >4 search/1 lj4 for LaserJet 4
17625: >4 search/1 latin1 for ISO 8859-1 (Latin 1)
17626: >4 search/1 X75 for xditview at 75dpi
17627: >>7 search/1 -12 (12pt)
17628: >4 search/1 X100 for xditview at 100dpi
17629: >>8 search/1 -12 (12pt)
17630:
17631: # output data formats
17632: 0 string \100\357 very old (C/A/T) troff output data
1.1.1.2 misho 17633:
1.1 misho 17634: #------------------------------------------------------------------------------
1.1.1.2 misho 17635: # $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 17636: # tuxedo: file(1) magic for BEA TUXEDO data files
17637: #
17638: # from Ian Springer <ispringer@hotmail.com>
17639: #
17640: 0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
17641:
17642: #------------------------------------------------------------------------------
1.1.1.2 misho 17643: # $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
1.1 misho 17644: # typeset: file(1) magic for other typesetting
17645: #
17646: 0 string Interpress/Xerox Xerox InterPress data
17647: >16 string / (version
17648: >>17 string >\0 %s)
1.1.1.2 misho 17649:
17650: #------------------------------------------------------------------------------
1.1.1.3 misho 17651: # $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
1.1 misho 17652: # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
17653: # GRR: These types should be recognised in file_ascmagic so these
17654: # encodings can be treated by text patterns.
17655: # Missing types are already dealt with internally.
17656: #
17657: 0 string +/v8 Unicode text, UTF-7
17658: 0 string +/v9 Unicode text, UTF-7
17659: 0 string +/v+ Unicode text, UTF-7
17660: 0 string +/v/ Unicode text, UTF-7
17661: 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
1.1.1.2 misho 17662: 0 string \000\000\376\377 Unicode text, UTF-32, big-endian
1.1 misho 17663: 0 string \377\376\000\000 Unicode text, UTF-32, little-endian
17664: 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
17665:
17666: #------------------------------------------------------------------------------
1.1.1.3 misho 17667: # $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
1.1 misho 17668: # unknown: file(1) magic for unknown machines
17669: #
1.1.1.3 misho 17670: # 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
17671: # (executable, pure, and split I&D, respectively), but the PDP-11 version
17672: # doesn't have the "version %ld", which may be a bogus COFFism (I don't
17673: # think there was ever COFF for the PDP-11).
1.1 misho 17674: #
17675: # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
1.1.1.3 misho 17676: # long, as it would be on a VAX. In any case, that could collide with
17677: # VAX demand-paged files, as the magic number is little-endian on those
17678: # binaries, so the first 16 bits of the file would contain 0x10B.
17679: #
17680: # Therefore, those entries are commented out.
17681: #
17682: # 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
17683: #
17684: #0 short 0x107 unknown machine executable
17685: #>8 short >0 not stripped
17686: #>15 byte >0 - version %ld
17687: #0 short 0x108 unknown pure executable
17688: #>8 short >0 not stripped
17689: #>15 byte >0 - version %ld
17690: #0 short 0x109 PDP-11 separate I&D
17691: #>8 short >0 not stripped
17692: #>15 byte >0 - version %ld
17693: #0 short 0x10b unknown pure executable
17694: #>8 short >0 not stripped
17695: #>15 byte >0 - version %ld
1.1 misho 17696: 0 long 0x10c unknown demand paged pure executable
17697: >16 long >0 not stripped
17698: 0 long 0x10e unknown readable demand paged pure executable
1.1.1.2 misho 17699:
1.1 misho 17700: #------------------------------------------------------------------------------
1.1.1.3 misho 17701: # $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $
17702: # file(1) magic for uterus files
17703: # http://freecode.com/projects/uterus
17704: #
17705: 0 string UTE+ uterus file
17706: >4 string v \b, version
17707: >5 byte x %c
17708: >6 string . \b.
17709: >7 byte x \b%c
17710: >8 string \<\> \b, big-endian
17711: >>16 belong >0 \b, slut size %u
17712: >8 string \>\< \b, litte-endian
17713: >>16 lelong >0 \b, slut size %u
17714: >10 byte &8 \b, compressed
17715:
17716: #------------------------------------------------------------------------------
1.1.1.2 misho 17717: # $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 17718: # uuencode: file(1) magic for ASCII-encoded files
17719: #
17720:
17721: # GRR: the first line of xxencoded files is identical to that in uuencoded
17722: # files, but the first character in most subsequent lines is 'h' instead of
17723: # 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
17724: # punctuation and survives BITNET gateways better.) If regular expressions
17725: # were supported, this entry could possibly be split into two with
17726: # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
17727: 0 search/1 begin\ uuencoded or xxencoded text
17728:
17729: # btoa(1) is an alternative to uuencode that requires less space.
17730: 0 search/1 xbtoa\ Begin btoa'd text
17731:
17732: # ship(1) is another, much cooler alternative to uuencode.
17733: # Greg Roelofs, newt@uchicago.edu
17734: 0 search/1 $\012ship ship'd binary text
17735:
17736: # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
17737: # Greg Roelofs, newt@uchicago.edu
17738: 0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
17739:
17740: # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
17741: # Daniel Quinlan, quinlan@yggdrasil.com
17742: 11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
17743: >41 search/1 x \b, version %.3s
17744:
17745: # GRR: handle BASE64
17746:
17747: #------------------------------------------------------------------------------
1.1.1.3 misho 17748: # $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
1.1 misho 17749: # varied.out: file(1) magic for various USG systems
17750: #
17751: # Herewith many of the object file formats used by USG systems.
17752: # Most have been moved to files for a particular processor,
17753: # and deleted if they duplicate other entries.
17754: #
17755: 0 short 0610 Perkin-Elmer executable
17756: # AMD 29K
17757: 0 beshort 0572 amd 29k coff noprebar executable
17758: 0 beshort 01572 amd 29k coff prebar executable
17759: 0 beshort 0160007 amd 29k coff archive
17760: # Cray
17761: 6 beshort 0407 unicos (cray) executable
17762: # Ultrix 4.3
17763: 596 string \130\337\377\377 Ultrix core file
17764: >600 string >\0 from '%s'
17765: # BeOS and MAcOS PEF executables
17766: # From: hplus@zilker.net (Jon Watte)
17767: 0 string Joy!peffpwpc header for PowerPC PEF executable
17768: #
17769: # ava assembler/linker Uros Platise <uros.platise@ijs.si>
17770: 0 string avaobj AVR assembler object code
17771: >7 string >\0 version '%s'
17772: # gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
17773: 0 string gmon GNU prof performance data
17774: >4 long x - version %ld
17775: # From: Dave Pearson <davep@davep.org>
1.1.1.3 misho 17776: # Harbour <URL:http://harbour-project.org/> HRB files.
1.1 misho 17777: 0 string \xc0HRB Harbour HRB file
1.1.1.3 misho 17778: >4 leshort x version %d
17779: # Harbour HBV files
17780: 0 string \xc0HBV Harbour variable dump file
17781: >4 leshort x version %d
1.1 misho 17782:
17783: # From: Alex Beregszaszi <alex@fsn.hu>
17784: # 0 string exec BugOS executable
17785: # 0 string pack BugOS archive
17786:
17787: # From: Jason Spence <jspence@lightconsulting.com>
17788: # Generated by the "examples" in STM's ST40 devkit, and derived code.
17789: 0 lelong 0x13a9f17e ST40 component image format
17790: >4 string >\0 \b, name '%s'
17791:
17792: #------------------------------------------------------------------------------
1.1.1.3 misho 17793: # $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $
1.1 misho 17794: # varied.script: file(1) magic for various interpreter scripts
17795:
1.1.1.3 misho 17796: 0 string/t #!\ / a
1.1 misho 17797: >3 string >\0 %s script text executable
1.1.1.3 misho 17798: !:strength / 2
17799: 0 string/t #!\t/ a
1.1 misho 17800: >3 string >\0 %s script text executable
1.1.1.3 misho 17801: !:strength / 2
17802: 0 string/t #!/ a
1.1 misho 17803: >2 string >\0 %s script text executable
1.1.1.3 misho 17804: !:strength / 2
17805: 0 string/t #!\ script text executable
1.1 misho 17806: >3 string >\0 for %s
1.1.1.3 misho 17807: !:strength / 3
17808:
17809: # using env
17810: 0 string/t #!/usr/bin/env a
17811: >15 string/t >\0 %s script text executable
17812: !:strength / 10
17813: 0 string/t #!\ /usr/bin/env a
17814: >16 string/t >\0 %s script text executable
17815: !:strength / 10
1.1 misho 17816:
17817: # From: arno <arenevier@fdn.fr>
17818: # mozilla xpconnect typelib
17819: # see http://www.mozilla.org/scriptable/typelib_file.html
17820: 0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
17821: >0x10 byte x version %d
17822: >>0x11 byte x \b.%d
17823:
17824: #------------------------------------------------------------------------------
1.1.1.3 misho 17825: # $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
1.1 misho 17826: # vax: file(1) magic for VAX executable/object and APL workspace
17827: #
17828: 0 lelong 0101557 VAX single precision APL workspace
17829: 0 lelong 0101556 VAX double precision APL workspace
17830:
17831: #
1.1.1.3 misho 17832: # VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
17833: # executables, and are handled in aout)
1.1 misho 17834: #
1.1.1.3 misho 17835: 0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable
1.1 misho 17836: >16 lelong >0 not stripped
17837:
17838: #
17839: # VAX COFF
17840: #
1.1.1.3 misho 17841: # The `versions' were commented out, but have been un-commented out.
1.1 misho 17842: # (Was the problem just one of endianness?)
17843: #
17844: 0 leshort 0570 VAX COFF executable
17845: >12 lelong >0 not stripped
17846: >22 leshort >0 - version %ld
17847: 0 leshort 0575 VAX COFF pure executable
17848: >12 lelong >0 not stripped
17849: >22 leshort >0 - version %ld
17850:
17851: #------------------------------------------------------------------------------
1.1.1.2 misho 17852: # $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 17853: # vicar: file(1) magic for VICAR files.
17854: #
17855: # From: Ossama Othman <othman@astrosun.tn.cornell.edu
17856: # VICAR is JPL's in-house spacecraft image processing program
17857: # VICAR image
17858: 0 string LBLSIZE= VICAR image data
17859: >32 string BYTE \b, 8 bits = VAX byte
17860: >32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
17861: >32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
17862: >32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
17863: >32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
17864: >32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
17865: # VICAR label file
17866: 43 string SFDU_LABEL VICAR label file
1.1.1.2 misho 17867:
1.1 misho 17868: #------------------------------------------------------------------------------
1.1.1.3 misho 17869: # $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $
1.1.1.2 misho 17870: # From: James Nobis <quel@quelrod.net>
17871: # Microsoft hard disk images for:
17872: # Virtual Server
17873: # Virtual PC
17874: # http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
17875: # .vhd
17876: 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
17877:
17878: # Sun xVM VirtualBox Disk Image
1.1.1.3 misho 17879: # From: Richard W.M. Jones <rich@annexia.org>
17880: # VirtualBox Disk Image
17881: 0x40 ulelong 0xbeda107f VirtualBox Disk Image
17882: >0x44 uleshort >0 \b, major %u
17883: >0x46 uleshort >0 \b, minor %u
1.1.1.2 misho 17884:
17885: #------------------------------------------------------------------------------
17886: # $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 17887: # Virtutech Compressed Random Access File Format
17888: #
17889: # From <gustav@virtutech.com>
17890: 0 string \211\277\036\203 Virtutech CRAFF
17891: >4 belong x v%d
17892: >20 belong 0 uncompressed
17893: >20 belong 1 bzipp2ed
17894: >20 belong 2 gzipped
17895: >24 belong 0 not clean
17896:
17897: #------------------------------------------------------------------------------
1.1.1.2 misho 17898: # $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
1.1 misho 17899: # visx: file(1) magic for Visx format files
17900: #
17901: 0 short 0x5555 VISX image file
17902: >2 byte 0 (zero)
17903: >2 byte 1 (unsigned char)
17904: >2 byte 2 (short integer)
17905: >2 byte 3 (float 32)
17906: >2 byte 4 (float 64)
17907: >2 byte 5 (signed char)
17908: >2 byte 6 (bit-plane)
17909: >2 byte 7 (classes)
17910: >2 byte 8 (statistics)
17911: >2 byte 10 (ascii text)
17912: >2 byte 15 (image segments)
17913: >2 byte 100 (image set)
17914: >2 byte 101 (unsigned char vector)
17915: >2 byte 102 (short integer vector)
17916: >2 byte 103 (float 32 vector)
17917: >2 byte 104 (float 64 vector)
17918: >2 byte 105 (signed char vector)
17919: >2 byte 106 (bit plane vector)
17920: >2 byte 121 (feature vector)
17921: >2 byte 122 (feature vector library)
17922: >2 byte 124 (chain code)
17923: >2 byte 126 (bit vector)
17924: >2 byte 130 (graph)
17925: >2 byte 131 (adjacency graph)
17926: >2 byte 132 (adjacency graph library)
17927: >2 string .VISIX (ascii text)
17928:
17929: #------------------------------------------------------------------------------
1.1.1.3 misho 17930: # $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
1.1 misho 17931: # vms: file(1) magic for VMS executables (experimental)
17932: #
17933: # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
17934:
17935: # GRR 950122: I'm just guessing on these, based on inspection of the headers
17936: # of three executables each for Alpha and VAX architectures. The VAX files
17937: # all had headers similar to this:
17938: #
17939: # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
17940: # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
17941: #
17942: 0 string \xb0\0\x30\0 VMS VAX executable
17943: >44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
17944: #
17945: # The AXP files all looked like this, except that the byte at offset 0x22
17946: # was 06 in some of them and 07 in others:
17947: #
17948: # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
17949: # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
17950: # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
17951: # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
17952: # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
17953: #
1.1.1.3 misho 17954: # GRR this test is still too general as it catches example addressen.dbt
17955: 0 belong 0x03000000
17956: >8 ubelong 0xec020000 VMS Alpha executable
17957: >>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
1.1 misho 17958:
1.1.1.2 misho 17959: #------------------------------------------------------------------------------
17960: # $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 17961: # VMware specific files (deducted from version 1.1 and log file entries)
17962: # Anthon van der Neut (anthon@mnt.org)
17963: 0 belong 0x4d52564e VMware nvram
17964:
17965: #------------------------------------------------------------------------------
1.1.1.2 misho 17966: # $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
1.1 misho 17967: # vorbis: file(1) magic for Ogg/Vorbis files
17968: #
17969: # From Felix von Leitner <leitner@fefe.de>
17970: # Extended by Beni Cherniavsky <cben@crosswinds.net>
17971: # Further extended by Greg Wooledge <greg@wooledge.org>
17972: #
17973: # Most (everything but the number of channels and bitrate) is commented
17974: # out with `##' as it's not interesting to the average user. The most
17975: # probable things advanced users would want to uncomment are probably
17976: # the number of comments and the encoder version.
17977: #
17978: # FIXME: The first match has been made a search, so that it can skip
17979: # over prepended ID3 tags. This will work for MIME type detection, but
17980: # won't work for detecting other properties of the file (they all need
17981: # to be made relative to the search). In any case, if the file has ID3
17982: # tags, the ID3 information will be printed, not the Ogg information,
17983: # so until that's fixed, this doesn't matter.
17984: # FIXME[2]: Disable the above for now, since search assumes text mode.
17985: #
17986: # --- Ogg Framing ---
17987: #0 search/1000 OggS Ogg data
17988: 0 string OggS Ogg data
17989: !:mime application/ogg
17990: >4 byte !0 UNKNOWN REVISION %u
17991: ##>4 byte 0 revision 0
17992: >4 byte 0
17993: ##>>14 lelong x (Serial %lX)
17994: # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
17995: >>28 string \x7fFLAC \b, FLAC audio
17996: # non-Vorbis content: Theora
17997: >>28 string \x80theora \b, Theora video
17998: # non-Vorbis content: Kate
17999: >>28 string \x80kate\0\0\0\0 \b, Kate
18000: >>>37 ubyte x v%u
18001: >>>38 ubyte x \b.%u,
18002: >>>40 byte 0 utf8 encoding,
18003: >>>40 byte !0 unknown character encoding,
18004: >>>60 string >\0 language %s,
18005: >>>60 string \0 no language set,
18006: >>>76 string >\0 category %s
18007: >>>76 string \0 no category set
18008: # non-Vorbis content: Skeleton
18009: >>28 string fishead\0 \b, Skeleton
18010: >>>36 short x v%u
18011: >>>40 short x \b.%u
18012: # non-Vorbis content: Speex
18013: >>28 string Speex\ \ \ \b, Speex audio
18014: # non-Vorbis content: OGM
18015: >>28 string \x01video\0\0\0 \b, OGM video
18016: >>>37 string/c div3 (DivX 3)
18017: >>>37 string/c divx (DivX 4)
18018: >>>37 string/c dx50 (DivX 5)
18019: >>>37 string/c xvid (XviD)
18020: # --- First vorbis packet - general header ---
18021: >>28 string \x01vorbis \b, Vorbis audio,
18022: >>>35 lelong !0 UNKNOWN VERSION %lu,
18023: ##>>>35 lelong 0 version 0,
18024: >>>35 lelong 0
18025: >>>>39 ubyte 1 mono,
18026: >>>>39 ubyte 2 stereo,
18027: >>>>39 ubyte >2 %u channels,
18028: >>>>40 lelong x %lu Hz
18029: # Minimal, nominal and maximal bitrates specified when encoding
18030: >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
18031: # The above tests if at least one of these is specified:
18032: >>>>>52 lelong !-1
18033: # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
18034: # instead of -1.
18035: # Vorbis 1.0 uses 0 instead of -1.
18036: >>>>>>52 lelong !0
18037: >>>>>>>52 lelong !-1000
18038: >>>>>>>>52 lelong x <%lu
18039: >>>>>48 lelong !-1
18040: >>>>>>48 lelong x ~%lu
18041: >>>>>44 lelong !-1
18042: >>>>>>44 lelong !-1000
18043: >>>>>>>44 lelong !0
18044: >>>>>>>>44 lelong x >%lu
18045: >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
18046: # -- Second vorbis header packet - the comments
18047: # A kludge to read the vendor string. It's a counted string, not a
18048: # zero-terminated one, so file(1) can't read it in a generic way.
18049: # libVorbis is the only one existing currently, so I detect specifically
18050: # it. The interesting value is the cvs date (8 digits decimal).
18051: # Post-RC1 Ogg files have the second header packet (and thus the version)
18052: # in a different place, so we must use an indirect offset.
18053: >>>(84.b+85) string \x03vorbis
18054: >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
18055: >>>>>(84.b+120) string >00000000
18056: # Map to beta version numbers:
18057: >>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
18058: >>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
18059: >>>>>>(84.b+120) string >20000508
18060: >>>>>>>(84.b+120) string <20001031 (beta2-3)
18061: >>>>>>(84.b+120) string 20001031 (1.0 beta 3)
18062: >>>>>>(84.b+120) string >20001031
18063: >>>>>>>(84.b+120) string <20010225 (beta3-4)
18064: >>>>>>(84.b+120) string 20010225 (1.0 beta 4)
18065: >>>>>>(84.b+120) string >20010225
18066: >>>>>>>(84.b+120) string <20010615 (beta4-RC1)
18067: >>>>>>(84.b+120) string 20010615 (1.0 RC1)
18068: >>>>>>(84.b+120) string 20010813 (1.0 RC2)
18069: >>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
18070: >>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
18071: >>>>>>(84.b+120) string 20011217 (1.0 RC3)
18072: >>>>>>(84.b+120) string 20011231 (1.0 RC3)
18073: # Some pre-1.0 CVS snapshots still had "Xiphphorus"...
18074: >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
18075: # For the 1.0 release, Xiphophorus is replaced by Xiph.Org
18076: >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
18077: >>>>>(84.b+117) string >00000000
18078: >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
18079: >>>>>>(84.b+117) string 20020717 (1.0)
18080: >>>>>>(84.b+117) string 20030909 (1.0.1)
18081: >>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
18082:
18083: #------------------------------------------------------------------------------
1.1.1.2 misho 18084: # $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 18085: # VXL: file(1) magic for VXL binary IO data files
18086: #
18087: # from Ian Scott <scottim@sf.net>
18088: #
18089: # VXL is a collection of C++ libraries for Computer Vision.
18090: # See the vsl chapter in the VXL Book for more info
18091: # http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
18092: # http:/vxl.sf.net
18093:
18094: 2 lelong 0x472b2c4e VXL data file,
18095: >0 leshort >0 schema version no %d
18096:
18097: #------------------------------------------------------------------------------
1.1.1.3 misho 18098: # $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
1.1 misho 18099: # warc: file(1) magic for WARC files
18100:
18101: 0 string WARC/ WARC Archive
18102: >5 string x version %.4s
1.1.1.3 misho 18103: !:mime application/warc
18104:
18105: #------------------------------------------------------------------------------
18106: # Arc File Format from Internet Archive
18107: # see http://www.archive.org/web/researcher/ArcFileFormat.php
18108: 0 string filedesc:// Internet Archive File
18109: !:mime application/x-ia-arc
18110: >11 search/256 \x0A \b
18111: >>&0 ubyte >0 \b version %c
1.1.1.2 misho 18112:
1.1 misho 18113: #------------------------------------------------------------------------------
18114: # weak: file(1) magic for very weak magic entries, disabled by default
18115: #
18116: # These entries are so weak that they might interfere identification of
18117: # other formats. Example include:
18118: # - Only identify for 1 or 2 bytes
18119: # - Match against very wide range of values
18120: # - Match against generic word in some spoken languages (e.g. English)
18121:
18122: # Summary: Computer Graphics Metafile
18123: # Extension: .cgm
18124: #0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
18125: #0 beshort 0x3020 character Computer Graphics Metafile
18126:
18127: #0 string =!! Bennet Yee's "face" format
18128:
18129: #------------------------------------------------------------------------------
1.1.1.3 misho 18130: # $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $
1.1 misho 18131: # windows: file(1) magic for Microsoft Windows
18132: #
18133: # This file is mainly reserved for files where programs
18134: # using them are run almost always on MS Windows 3.x or
18135: # above, or files only used exclusively in Windows OS,
18136: # where there is no better category to allocate for.
18137: # For example, even though WinZIP almost run on Windows
18138: # only, it is better to treat them as "archive" instead.
18139: # For format usable in DOS, such as generic executable
18140: # format, please specify under "msdos" file.
18141: #
18142:
18143:
18144: # Summary: Outlook Express DBX file
18145: # Extension: .dbx
18146: # Created by: Christophe Monniez
18147: 0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
18148: >4 byte =0xC5 \b, message database
18149: >4 byte =0xC6 \b, folder database
18150: >4 byte =0xC7 \b, account information
18151: >4 byte =0x30 \b, offline database
18152:
18153:
18154: # Summary: Windows crash dump
18155: # Extension: .dmp
18156: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
18157: # Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
18158: # Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
18159: 0 string PAGE
18160: >4 string DUMP MS Windows 32bit crash dump
18161: >>0x05c byte 0 \b, no PAE
18162: >>0x05c byte 1 \b, PAE
18163: >>0xf88 lelong 1 \b, full dump
18164: >>0xf88 lelong 2 \b, kernel dump
18165: >>0xf88 lelong 3 \b, small dump
18166: >>0x068 lelong x \b, %ld pages
18167: >4 string DU64 MS Windows 64bit crash dump
18168: >>0xf98 lelong 1 \b, full dump
18169: >>0xf98 lelong 2 \b, kernel dump
18170: >>0xf98 lelong 3 \b, small dump
18171: >>0x090 lequad x \b, %lld pages
18172:
18173:
18174: # Summary: Vista Event Log
18175: # Extension: .evtx
18176: # Created by: Andreas Schuster (http://computer.forensikblog.de/)
18177: # Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
18178: 0 string ElfFile\0 MS Windows Vista Event Log
18179: >0x2a leshort x \b, %d chunks
18180: >>0x10 lelong x \b (no. %d in use)
18181: >0x18 lelong >1 \b, next record no. %d
18182: >0x18 lelong =1 \b, empty
18183: >0x78 lelong &1 \b, DIRTY
18184: >0x78 lelong &2 \b, FULL
18185:
18186:
18187: # Summary: Windows 3.1 group files
18188: # Extension: .grp
18189: # Created by: unknown
18190: 0 string \120\115\103\103 MS Windows 3.1 group files
18191:
18192:
18193: # Summary: Old format help files
18194: # Extension: .hlp
18195: # Created by: Dirk Jagdmann <doj@cubic.org>
18196: 0 lelong 0x00035f3f MS Windows 3.x help file
18197:
18198:
18199: # Summary: Hyper terminal
18200: # Extension: .ht
18201: # Created by: unknown
18202: 0 string HyperTerminal\
18203: >15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
18204:
1.1.1.3 misho 18205: # http://ithreats.files.wordpress.com/2009/05/\
18206: # lnk_the_windows_shortcut_file_format.pdf
1.1 misho 18207: # Summary: Windows shortcut
18208: # Extension: .lnk
18209: # Created by: unknown
1.1.1.3 misho 18210: # 'L' + GUUID
1.1 misho 18211: 0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
1.1.1.3 misho 18212: >20 lelong&1 1 \b, Item id list present
18213: >20 lelong&2 2 \b, Points to a file or directory
18214: >20 lelong&4 4 \b, Has Description string
18215: >20 lelong&8 8 \b, Has Relative path
18216: >20 lelong&16 16 \b, Has Working directory
18217: >20 lelong&32 32 \b, Has command line arguments
18218: >20 lelong&64 64 \b, Icon
18219: >>56 lelong \b number=%d
18220: >24 lelong&1 1 \b, Read-Only
18221: >24 lelong&2 2 \b, Hidden
18222: >24 lelong&4 4 \b, System
18223: >24 lelong&8 8 \b, Volume Label
18224: >24 lelong&16 16 \b, Directory
18225: >24 lelong&32 32 \b, Archive
18226: >24 lelong&64 64 \b, Encrypted
18227: >24 lelong&128 128 \b, Normal
18228: >24 lelong&256 256 \b, Temporary
18229: >24 lelong&512 512 \b, Sparse
18230: >24 lelong&1024 1024 \b, Reparse point
18231: >24 lelong&2048 2048 \b, Compressed
18232: >24 lelong&4096 4096 \b, Offline
18233: >28 leqwdate x \b, ctime=%s
18234: >36 leqwdate x \b, mtime=%s
18235: >44 leqwdate x \b, atime=%s
18236: >52 lelong x \b, length=%u, window=
18237: >60 lelong&1 1 \bhide
18238: >60 lelong&2 2 \bnormal
18239: >60 lelong&4 4 \bshowminimized
18240: >60 lelong&8 8 \bshowmaximized
18241: >60 lelong&16 16 \bshownoactivate
18242: >60 lelong&32 32 \bminimize
18243: >60 lelong&64 64 \bshowminnoactive
18244: >60 lelong&128 128 \bshowna
18245: >60 lelong&256 256 \brestore
18246: >60 lelong&512 512 \bshowdefault
18247: #>20 lelong&1 0
18248: #>>20 lelong&2 2
18249: #>>>(72.l-64) pstring/h x \b [%s]
18250: #>20 lelong&1 1
18251: #>>20 lelong&2 2
18252: #>>>(72.s) leshort x
18253: #>>>&75 pstring/h x \b [%s]
1.1 misho 18254:
18255: # Summary: Outlook Personal Folders
18256: # Created by: unknown
18257: 0 lelong 0x4E444221 Microsoft Outlook email folder
18258: >10 leshort 0x0e (<=2002)
18259: >10 leshort 0x17 (>=2003)
18260:
18261:
18262: # Summary: Windows help cache
18263: # Created by: unknown
18264: 0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
18265:
18266:
18267: # Summary: IE cache file
18268: # Created by: Christophe Monniez
18269: 0 string Client\ UrlCache\ MMF Internet Explorer cache file
18270: >20 string >\0 version %s
18271:
18272:
18273: # Summary: Registry files
18274: # Created by: unknown
18275: # Modified by (1): Joerg Jenderek
18276: 0 string regf MS Windows registry file, NT/2000 or above
18277: 0 string CREG MS Windows 95/98/ME registry file
18278: 0 string SHCC3 MS Windows 3.1 registry file
18279:
18280:
18281: # Summary: Windows Registry text
18282: # Extension: .reg
18283: # Submitted by: Abel Cheung <abelcheung@gmail.com>
18284: 0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
18285: 0 string Windows\ Registry\ Editor\
18286: >&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
1.1.1.2 misho 18287:
18288:
18289: # From: Pal Tamas <folti@balabit.hu>
18290: # Autorun File
18291: 0 string/c [autorun]\r\n Microsoft Windows Autorun file.
18292: !:mime application/x-setupscript.
18293:
1.1 misho 18294: #------------------------------------------------------------------------------
1.1.1.2 misho 18295: # $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
18296: # wireless-regdb: file(1) magic for CRDA wireless-regdb file format
18297: #
18298: 0 string RGDB CRDA wireless regulatory database file
18299: >4 belong 19 (Version 1)
18300:
18301: #------------------------------------------------------------------------------
1.1.1.3 misho 18302: # $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $
1.1 misho 18303: # wordprocessors: file(1) magic fo word processors.
18304: #
18305: ####### PWP file format used on Smith Corona Personal Word Processors:
18306: 2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
18307: >24 byte 2 \b, single spaced
18308: >24 byte 3 \b, 1.5 spaced
18309: >24 byte 4 \b, double spaced
18310: >25 byte 0x42 \b, letter
18311: >25 byte 0x54 \b, legal
18312: >26 byte 0x46 \b, A4
18313:
18314: #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
18315: 0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
18316: >15 byte 0 Optimized for Intel
18317: >15 byte 1 Optimized for Non-Intel
18318: 1 string WPC (Corel/WP)
18319: >8 short 257 WordPerfect macro
18320: >8 short 258 WordPerfect help file
18321: >8 short 259 WordPerfect keyboard file
18322: >8 short 266 WordPerfect document
18323: >8 short 267 WordPerfect dictionary
18324: >8 short 268 WordPerfect thesaurus
18325: >8 short 269 WordPerfect block
18326: >8 short 270 WordPerfect rectangular block
18327: >8 short 271 WordPerfect column block
18328: >8 short 272 WordPerfect printer data
18329: >8 short 275 WordPerfect printer data
18330: >8 short 276 WordPerfect driver resource data
18331: >8 short 279 WordPerfect hyphenation code
18332: >8 short 280 WordPerfect hyphenation data
18333: >8 short 281 WordPerfect macro resource data
18334: >8 short 283 WordPerfect hyphenation lex
18335: >8 short 285 WordPerfect wordlist
18336: >8 short 286 WordPerfect equation resource data
18337: >8 short 289 WordPerfect spell rules
18338: >8 short 290 WordPerfect dictionary rules
18339: >8 short 295 WordPerfect spell rules (Microlytics)
18340: >8 short 299 WordPerfect settings file
18341: >8 short 301 WordPerfect 4.2 document
18342: >8 short 325 WordPerfect dialog file
18343: >8 short 332 WordPerfect button bar
18344: >8 short 513 Shell macro
18345: >8 short 522 Shell definition
18346: >8 short 769 Notebook macro
18347: >8 short 770 Notebook help file
18348: >8 short 771 Notebook keyboard file
18349: >8 short 778 Notebook definition
18350: >8 short 1026 Calculator help file
18351: >8 short 1538 Calendar help file
18352: >8 short 1546 Calendar data file
18353: >8 short 1793 Editor macro
18354: >8 short 1794 Editor help file
18355: >8 short 1795 Editor keyboard file
18356: >8 short 1817 Editor macro resource file
18357: >8 short 2049 Macro editor macro
18358: >8 short 2050 Macro editor help file
18359: >8 short 2051 Macro editor keyboard file
18360: >8 short 2305 PlanPerfect macro
18361: >8 short 2306 PlanPerfect help file
18362: >8 short 2307 PlanPerfect keyboard file
18363: >8 short 2314 PlanPerfect worksheet
18364: >8 short 2319 PlanPerfect printer definition
18365: >8 short 2322 PlanPerfect graphic definition
18366: >8 short 2323 PlanPerfect data
18367: >8 short 2324 PlanPerfect temporary printer
18368: >8 short 2329 PlanPerfect macro resource data
18369: >8 byte 11 Mail
18370: >8 short 2818 help file
18371: >8 short 2821 distribution list
18372: >8 short 2826 out box
18373: >8 short 2827 in box
18374: >8 short 2836 users archived mailbox
18375: >8 short 2837 archived message database
18376: >8 short 2838 archived attachments
18377: >8 short 3083 Printer temporary file
18378: >8 short 3330 Scheduler help file
18379: >8 short 3338 Scheduler in file
18380: >8 short 3339 Scheduler out file
18381: >8 short 3594 GroupWise settings file
18382: >8 short 3601 GroupWise directory services
18383: >8 short 3627 GroupWise settings file
18384: >8 short 4362 Terminal resource data
18385: >8 short 4363 Terminal resource data
18386: >8 short 4395 Terminal resource data
18387: >8 short 4619 GUI loadable text
18388: >8 short 4620 graphics resource data
18389: >8 short 4621 printer settings file
18390: >8 short 4622 port definition file
18391: >8 short 4623 print queue parameters
18392: >8 short 4624 compressed file
18393: >8 short 5130 Network service msg file
18394: >8 short 5131 Network service msg file
18395: >8 short 5132 Async gateway login msg
18396: >8 short 5134 GroupWise message file
18397: >8 short 7956 GroupWise admin domain database
18398: >8 short 7957 GroupWise admin host database
18399: >8 short 7959 GroupWise admin remote host database
18400: >8 short 7960 GroupWise admin ADS deferment data file
18401: >8 short 8458 IntelliTAG (SGML) compiled DTD
18402: >8 long 18219264 WordPerfect graphic image (1.0)
18403: >8 long 18219520 WordPerfect graphic image (2.0)
18404: #end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
18405:
18406: # Hangul (Korean) Word Processor File
18407: 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
18408: # From: Won-Kyu Park <wkpark@kldp.org>
18409: 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
18410: !:mime application/x-hwp
18411:
1.1.1.3 misho 18412: # CosmicBook, from Benoit Rouits
1.1 misho 18413: 0 string CSBK Ted Neslson's CosmicBook hypertext file
18414:
18415: 2 string EYWR AmigaWriter file
18416:
18417: # chi: file(1) magic for ChiWriter files
18418: 0 string \\1cw\ ChiWriter file
18419: >5 string >\0 version %s
18420: 0 string \\1cw ChiWriter file
18421:
18422: # Quark Express from http://www.garykessler.net/library/file_sigs.html
18423: 2 string IIXPR3 Intel Quark Express Document (English)
18424: 2 string IIXPRa Intel Quark Express Document (Korean)
18425: 2 string MMXPR3 Motorola Quark Express Document (English)
18426: !:mime application/x-quark-xpress-3
18427: 2 string MMXPRa Motorola Quark Express Document (Korean)
18428:
18429: # adobe indesign (document, whatever...) from querkan
18430: 0 belong 0x0606edf5 Adobe InDesign
18431: >16 string DOCUMENT Document
18432:
18433: #------------------------------------------------------------------------------
18434: # ichitaro456: file(1) magic for Just System Word Processor Ichitaro
18435: #
18436: # Contributor kenzo-:
18437: # Reversed-engineered JS Ichitaro magic numbers
18438: #
18439:
18440: 0 string DOC
18441: >43 byte 0x14 Just System Word Processor Ichitaro v4
18442: !:mime application/x-ichitaro4
18443: >144 string JDASH application/x-ichitaro4
18444:
18445: 0 string DOC
18446: >43 byte 0x15 Just System Word Processor Ichitaro v5
18447: !:mime application/x-ichitaro5
18448:
18449: 0 string DOC
18450: >43 byte 0x16 Just System Word Processor Ichitaro v6
18451: !:mime application/x-ichitaro6
18452:
18453: # Type: Freemind mindmap documents
18454: # From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
1.1.1.2 misho 18455: 0 string/w \<map\ version Freemind document
1.1 misho 18456: !:mime application/x-freemind
18457:
18458: # Type: Scribus
18459: # From: Werner Fink <werner@suse.de>
18460: 0 string \<SCRIBUSUTF8\ Version Scribus Document
18461: 0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
18462: !:mime application/x-scribus
18463:
1.1.1.3 misho 18464: # help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
18465: # markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
18466: 0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file
18467:
18468: #------------------------------------------------------------------------------
18469: # $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
18470: # wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
18471: # Cache format extracted from source:
18472: # http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
18473: # Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
18474: # By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
18475: 0 string wsdl PHP WSDL cache,
18476: >4 byte x version 0x%02x
18477: >6 ledate x \b, created %s
18478:
18479: # uri
18480: >10 lelong <0x7fffffff
18481: >>10 pstring/l x \b, uri: "%s"
18482:
18483: # source
18484: >>>&0 lelong <0x7fffffff
18485: >>>>&-4 pstring/l x \b, source: "%s"
18486:
18487: # target_ns
18488: >>>>>&0 lelong <0x7fffffff
18489: >>>>>>&-4 pstring/l x \b, target_ns: "%s"
18490:
1.1 misho 18491: #------------------------------------------------------------------------------
1.1.1.3 misho 18492: # $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
1.1 misho 18493: # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
18494: #
18495: 0 string %XDELTA% XDelta binary patch file 0.14
18496: 0 string %XDZ000% XDelta binary patch file 0.18
18497: 0 string %XDZ001% XDelta binary patch file 0.20
18498: 0 string %XDZ002% XDelta binary patch file 1.0
18499: 0 string %XDZ003% XDelta binary patch file 1.0.4
18500: 0 string %XDZ004% XDelta binary patch file 1.1
18501:
1.1.1.3 misho 18502: 0 string \xD6\xC3\xC4\x00 VCDIFF binary diff
18503:
1.1 misho 18504: #------------------------------------------------------------------------------
1.1.1.2 misho 18505: # $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
1.1 misho 18506: # xenix: file(1) magic for Microsoft Xenix
18507: #
18508: # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
18509: # model" lifted from "magic.xenix", with comment "derived empirically;
18510: # treat as folklore until proven"
18511: #
18512: # "small model", "large model", "huge model" stuff lifted from XXX
18513: #
18514: # XXX - "x.out" collides with PDP-11 archives
18515: #
18516: 0 string core core file (Xenix)
18517: 0 byte 0x80 8086 relocatable (Microsoft)
18518: 0 leshort 0xff65 x.out
18519: >2 string __.SYMDEF randomized
18520: >0 byte x archive
18521: 0 leshort 0x206 Microsoft a.out
18522: >8 leshort 1 Middle model
18523: >0x1e leshort &0x10 overlay
18524: >0x1e leshort &0x2 separate
18525: >0x1e leshort &0x4 pure
18526: >0x1e leshort &0x800 segmented
18527: >0x1e leshort &0x400 standalone
18528: >0x1e leshort &0x8 fixed-stack
18529: >0x1c byte &0x80 byte-swapped
18530: >0x1c byte &0x40 word-swapped
18531: >0x10 lelong >0 not-stripped
18532: >0x1e leshort ^0xc000 pre-SysV
18533: >0x1e leshort &0x4000 V2.3
18534: >0x1e leshort &0x8000 V3.0
18535: >0x1c byte &0x4 86
18536: >0x1c byte &0xb 186
18537: >0x1c byte &0x9 286
18538: >0x1c byte &0xa 386
18539: >0x1f byte <0x040 small model
18540: >0x1f byte =0x048 large model
18541: >0x1f byte =0x049 huge model
18542: >0x1e leshort &0x1 executable
18543: >0x1e leshort ^0x1 object file
18544: >0x1e leshort &0x40 Large Text
18545: >0x1e leshort &0x20 Large Data
18546: >0x1e leshort &0x120 Huge Objects Enabled
18547: >0x10 lelong >0 not stripped
18548:
18549: 0 leshort 0x140 old Microsoft 8086 x.out
18550: >0x3 byte &0x4 separate
18551: >0x3 byte &0x2 pure
18552: >0 byte &0x1 executable
18553: >0 byte ^0x1 relocatable
18554: >0x14 lelong >0 not stripped
18555:
18556: 0 lelong 0x206 b.out
18557: >0x1e leshort &0x10 overlay
18558: >0x1e leshort &0x2 separate
18559: >0x1e leshort &0x4 pure
18560: >0x1e leshort &0x800 segmented
18561: >0x1e leshort &0x400 standalone
18562: >0x1e leshort &0x1 executable
18563: >0x1e leshort ^0x1 object file
18564: >0x1e leshort &0x4000 V2.3
18565: >0x1e leshort &0x8000 V3.0
18566: >0x1c byte &0x4 86
18567: >0x1c byte &0xb 186
18568: >0x1c byte &0x9 286
18569: >0x1c byte &0x29 286
18570: >0x1c byte &0xa 386
18571: >0x1e leshort &0x4 Large Text
18572: >0x1e leshort &0x2 Large Data
18573: >0x1e leshort &0x102 Huge Objects Enabled
18574:
18575: 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
18576:
18577: #------------------------------------------------------------------------------
1.1.1.3 misho 18578: # $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $
1.1 misho 18579: # This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
18580: # Xilinx-Magic@RevRagnarok.com
18581: # Got the info from FPGA-FAQ 0026
18582: #
18583: # First there is the sync header and its length
18584: 0 beshort 0x0009
18585: >2 belong =0x0ff00ff0
18586: >>&0 belong =0x0ff00ff0
18587: >>>&0 beshort =0x0000
18588: >>>>&0 pstring a Xilinx BIT data
18589: # Next is a Pascal-style string with the NCD name. We want to capture that.
18590: >>>>0x0F pstring x - from %s
18591: # It is followed by a NUL
18592: >>>>>&1 byte 0x00
18593: # And then 'b'
18594: >>>>>&2 string b
18595: # With the part number:
18596: #>>>>>&5 string 4v (Virtex4)
18597: #>>>>>&5 string 2v (Virtex II
18598: #>>>>>>&0 string !p \b)
18599: #>>>>>>&0 string p Pro)
18600: >>>>>&4 pstring x - for %s
18601: # And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
18602: >>>>>>&1 byte 0x00
18603: >>>>>>&2 string c
18604: >>>>>>&4 pstring x - built %s
18605: >>>>>>>&1 byte 0x00
18606: >>>>>>>&2 string d
18607: >>>>>>>&4 pstring x \b(%s)
18608: >>>>>>>>&1 byte 0x00
18609: >>>>>>>>&2 string e
18610: >>>>>>>>&4 belong x - data length 0x%lx
1.1.1.3 misho 18611: # Raw bitstream files
18612: 0 long 0xffffffff
18613: >&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
1.1 misho 18614:
18615: #------------------------------------------------------------------------------
1.1.1.2 misho 18616: # $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
1.1 misho 18617: # xo65 object files
18618: # From: "Ullrich von Bassewitz" <uz@cc65.org>
18619: #
18620: 0 string \x55\x7A\x6E\x61 xo65 object,
18621: >4 leshort x version %d,
18622: >6 leshort&0x0001 =0x0001 with debug info
18623: >6 leshort&0x0001 =0x0000 no debug info
18624:
18625: # xo65 library files
18626: 0 string \x6E\x61\x55\x7A xo65 library,
18627: >4 leshort x version %d
18628:
18629: # o65 object files
18630: 0 string \x01\x00\x6F\x36\x35 o65
18631: >6 leshort&0x1000 =0x0000 executable,
18632: >6 leshort&0x1000 =0x1000 object,
18633: >5 byte x version %d,
18634: >6 leshort&0x8000 =0x8000 65816,
18635: >6 leshort&0x8000 =0x0000 6502,
18636: >6 leshort&0x2000 =0x2000 32 bit,
18637: >6 leshort&0x2000 =0x0000 16 bit,
18638: >6 leshort&0x4000 =0x4000 page reloc,
18639: >6 leshort&0x4000 =0x0000 byte reloc,
18640: >6 leshort&0x0003 =0x0000 alignment 1
18641: >6 leshort&0x0003 =0x0001 alignment 2
18642: >6 leshort&0x0003 =0x0002 alignment 4
18643: >6 leshort&0x0003 =0x0003 alignment 256
18644:
18645: #------------------------------------------------------------------------------
1.1.1.3 misho 18646: # $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
1.1 misho 18647: # xwindows: file(1) magic for various X/Window system file formats.
18648:
18649: # Compiled X Keymap
18650: # XKM (compiled X keymap) files (including version and byte ordering)
18651: 1 string mkx Compiled XKB Keymap: lsb,
18652: >0 byte >0 version %d
18653: >0 byte =0 obsolete
18654: 0 string xkm Compiled XKB Keymap: msb,
18655: >3 byte >0 version %d
1.1.1.3 misho 18656: >3 byte =0 obsolete
1.1 misho 18657:
18658: # xfsdump archive
18659: 0 string xFSdump0 xfsdump archive
18660: >8 belong x (version %d)
18661:
18662: # Jaleo XFS files
18663: 0 long 395726 Jaleo XFS file
18664: >4 long x - version %ld
18665: >8 long x - [%ld -
1.1.1.3 misho 18666: >20 long x \b%ldx
18667: >24 long x \b%ldx
18668: >28 long 1008 \bYUV422]
18669: >28 long 1000 \bRGB24]
1.1 misho 18670:
1.1.1.2 misho 18671: # Xcursor data
18672: # X11 mouse cursor format defined in libXcursor, see
18673: # http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
18674: # http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
18675: 0 string Xcur Xcursor data
18676: !:mime image/x-xcursor
18677: >10 leshort x version %hd
18678: >>8 leshort x \b.%hd
1.1.1.3 misho 18679: #------------------------------------------------------------------------------
18680: # zfs: file(1) magic for ZFS dumps
18681: #
18682: # From <rea-fbsd@codelabs.ru>
18683: # ZFS dump header has the following structure (as per zfs_ioctl.h
18684: # in FreeBSD with drr_type is set to DRR_BEGIN)
18685: #
18686: # enum {
18687: # DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
18688: # DRR_WRITE, DRR_FREE, DRR_END,
18689: # } drr_type;
18690: # uint32_t drr_pad;
18691: # uint64_t drr_magic;
18692: # uint64_t drr_version;
18693: # uint64_t drr_creation_time;
18694: # dmu_objset_type_t drr_type;
18695: # uint32_t drr_pad;
18696: # uint64_t drr_toguid;
18697: # uint64_t drr_fromguid;
18698: # char drr_toname[MAXNAMELEN];
18699: #
18700: # Backup magic is 0x00000002f5bacbac (quad word)
18701: # The drr_type is defined as
18702: # typedef enum dmu_objset_type {
18703: # DMU_OST_NONE,
18704: # DMU_OST_META,
18705: # DMU_OST_ZFS,
18706: # DMU_OST_ZVOL,
18707: # DMU_OST_OTHER, /* For testing only! */
18708: # DMU_OST_ANY, /* Be careful! */
18709: # DMU_OST_NUMTYPES
18710: # } dmu_objset_type_t;
18711: #
18712: # Almost all uint64_t fields are printed as the 32-bit ones (with high
18713: # 32 bits zeroed), because there is no simple way to print them as the
18714: # full 64-bit values.
18715:
18716: # Big-endian values
18717: 8 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
18718: >20 belong x version %lu,
18719: >32 belong 0 type: NONE,
18720: >32 belong 1 type: META,
18721: >32 belong 2 type: ZFS,
18722: >32 belong 3 type: ZVOL,
18723: >32 belong 4 type: OTHER,
18724: >32 belong 5 type: ANY,
18725: >32 belong >5 type: UNKNOWN (%lu),
18726: >40 byte x destination GUID: %02X
18727: >41 byte x %02X
18728: >42 byte x %02X
18729: >43 byte x %02X
18730: >44 byte x %02X
18731: >45 byte x %02X
18732: >46 byte x %02X
18733: >47 byte x %02X,
18734: >48 ulong >0
18735: >>52 ulong >0
18736: >>>48 byte x source GUID: %02X
18737: >>>49 byte x %02X
18738: >>>50 byte x %02X
18739: >>>51 byte x %02X
18740: >>>52 byte x %02X
18741: >>>53 byte x %02X
18742: >>>54 byte x %02X
18743: >>>55 byte x %02X,
18744: >56 string >\0 name: '%s'
18745:
18746: # Little-endian values
18747: 8 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine),
18748: >16 lelong x version %lu,
18749: >32 lelong 0 type: NONE,
18750: >32 lelong 1 type: META,
18751: >32 lelong 2 type: ZFS,
18752: >32 lelong 3 type: ZVOL,
18753: >32 lelong 4 type: OTHER,
18754: >32 lelong 5 type: ANY,
18755: >32 lelong >5 type: UNKNOWN (%lu),
18756: >47 byte x destination GUID: %02X
18757: >46 byte x %02X
18758: >45 byte x %02X
18759: >44 byte x %02X
18760: >43 byte x %02X
18761: >42 byte x %02X
18762: >41 byte x %02X
18763: >40 byte x %02X,
18764: >48 ulong >0
18765: >>52 ulong >0
18766: >>>55 byte x source GUID: %02X
18767: >>>54 byte x %02X
18768: >>>53 byte x %02X
18769: >>>52 byte x %02X
18770: >>>51 byte x %02X
18771: >>>50 byte x %02X
18772: >>>49 byte x %02X
18773: >>>48 byte x %02X,
18774: >56 string >\0 name: '%s'
1.1.1.2 misho 18775:
1.1 misho 18776: #------------------------------------------------------------------------------
1.1.1.2 misho 18777: # $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
1.1 misho 18778: # zilog: file(1) magic for Zilog Z8000.
18779: #
18780: # Was it big-endian or little-endian? My Product Specification doesn't
18781: # say.
18782: #
18783: 0 long 0xe807 object file (z8000 a.out)
18784: 0 long 0xe808 pure object file (z8000 a.out)
18785: 0 long 0xe809 separate object file (z8000 a.out)
18786: 0 long 0xe805 overlay object file (z8000 a.out)
18787:
18788: #------------------------------------------------------------------------------
1.1.1.2 misho 18789: # $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
1.1 misho 18790: # zyxel: file(1) magic for ZyXEL modems
18791: #
18792: # From <rob@pe1chl.ampr.org>
18793: # These are the /etc/magic entries to decode datafiles as used for the
18794: # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
18795: # ZyXEL-defined standard)
18796:
18797: 0 string ZyXEL\002 ZyXEL voice data
18798: >10 byte 0 - CELP encoding
18799: >10 byte&0x0B 1 - ADPCM2 encoding
18800: >10 byte&0x0B 2 - ADPCM3 encoding
18801: >10 byte&0x0B 3 - ADPCM4 encoding
18802: >10 byte&0x0B 8 - New ADPCM3 encoding
18803: >10 byte&0x04 4 with resync
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to magic CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / ext / fileinfo / tests