mirror of
https://github.com/php/php-src.git
synced 2024-10-03 07:46:12 +00:00
18804 lines
664 KiB
Plaintext
18804 lines
664 KiB
Plaintext
# Magic data for file(1) command.
|
||
# Format is described in magic(files), where:
|
||
# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
|
||
# Don't edit this file, edit /etc/magic or send your magic improvements
|
||
# to the maintainers, at file@mx.gw.com
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Localstuff: file(1) magic for locally observed files
|
||
#
|
||
# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
|
||
# Add any locally observed files here. Remember:
|
||
# text if readable, executable if runnable binary, data if unreadable.
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $
|
||
# acorn: file(1) magic for files found on Acorn systems
|
||
#
|
||
|
||
# RISC OS Chunk File Format
|
||
# From RISC OS Programmer's Reference Manual, Appendix D
|
||
# We guess the file type from the type of the first chunk.
|
||
0 lelong 0xc3cbc6c5 RISC OS Chunk data
|
||
>12 string OBJ_ \b, AOF object
|
||
>12 string LIB_ \b, ALF library
|
||
|
||
# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
|
||
16 lelong 0xef000011 RISC OS AIF executable
|
||
|
||
# RISC OS Draw files
|
||
# From RISC OS Programmer's Reference Manual, Appendix E
|
||
0 string Draw RISC OS Draw file data
|
||
|
||
# RISC OS new format font files
|
||
# From RISC OS Programmer's Reference Manual, Appendix E
|
||
0 string FONT\0 RISC OS outline font data,
|
||
>5 byte x version %d
|
||
0 string FONT\1 RISC OS 1bpp font data,
|
||
>5 byte x version %d
|
||
0 string FONT\4 RISC OS 4bpp font data
|
||
>5 byte x version %d
|
||
|
||
# RISC OS Music files
|
||
# From RISC OS Programmer's Reference Manual, Appendix E
|
||
0 string Maestro\r RISC OS music file
|
||
>8 byte x version %d
|
||
|
||
>8 byte x type %d
|
||
|
||
# Digital Symphony data files
|
||
# From: Bernard Jungen (bern8817@euphonynet.be)
|
||
0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
|
||
>8 byte x version %d,
|
||
>9 pstring x named "%s",
|
||
>(9.b+19) byte =0 8-bit logarithmic
|
||
>(9.b+19) byte =1 LZW-compressed linear
|
||
>(9.b+19) byte =2 8-bit linear signed
|
||
>(9.b+19) byte =3 16-bit linear signed
|
||
>(9.b+19) byte =4 SigmaDelta-compressed linear
|
||
>(9.b+19) byte =5 SigmaDelta-compressed logarithmic
|
||
>(9.b+19) byte >5 unknown format
|
||
|
||
0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
|
||
>8 byte x version %d,
|
||
>9 byte =1 1 voice,
|
||
>9 byte !1 %d voices,
|
||
>10 leshort =1 1 track,
|
||
>10 leshort !1 %d tracks,
|
||
>12 leshort =1 1 pattern
|
||
>12 leshort !1 %d patterns
|
||
|
||
0 string \x02\x01\x13\x13\x10\x14\x12\x0e
|
||
>9 byte =0 Digital Symphony sequence (RISC OS),
|
||
>>8 byte x version %d,
|
||
>>10 byte =1 1 line,
|
||
>>10 byte !1 %d lines,
|
||
>>11 leshort =1 1 position
|
||
>>11 leshort !1 %d positions
|
||
>9 byte =1 Digital Symphony pattern data (RISC OS),
|
||
>>8 byte x version %d,
|
||
>>10 leshort =1 1 pattern
|
||
>>10 leshort !1 %d patterns
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
|
||
# adi: file(1) magic for ADi's objects
|
||
# From Gregory McGarry <g.mcgarry@ieee.org>
|
||
#
|
||
0 leshort 0x521c COFF DSP21k
|
||
>18 lelong &02 executable,
|
||
>18 lelong ^02
|
||
>>18 lelong &01 static object,
|
||
>>18 lelong ^01 relocatable object,
|
||
>18 lelong &010 stripped
|
||
>18 lelong ^010 not stripped
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
|
||
# adventure: file(1) magic for Adventure game files
|
||
#
|
||
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
|
||
# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
|
||
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
|
||
#
|
||
# ALAN
|
||
# I assume there are other, lower versions, but these are the only ones I
|
||
# saw in the archive.
|
||
0 beshort 0x0206 ALAN game data
|
||
>2 byte <10 version 2.6%d
|
||
|
||
|
||
# Infocom (see z-machine)
|
||
#------------------------------------------------------------------------------
|
||
# Z-machine: file(1) magic for Z-machine binaries.
|
||
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
#
|
||
#http://www.gnelson.demon.co.uk/zspec/sect11.html
|
||
#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
|
||
#http://en.wikipedia.org/wiki/Z-machine
|
||
# The first byte is the Z-machine revision; it is always between 1 and 8. We
|
||
# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
|
||
# well as an occasional MP3 file), so we sanity-check the version number.
|
||
#
|
||
# It might be possible to sanity-check the release number as well, as it seems
|
||
# (at least in classic Infocom games) to always be a relatively small number,
|
||
# always under 150 or so, but as this isn't rigorous, we'll wait on that until
|
||
# it becomes clear that it's needed.
|
||
#
|
||
0 ubyte >0
|
||
>0 ubyte <9
|
||
>>16 belong&0xfe00f0f0 0x3030
|
||
>>>0 ubyte < 10
|
||
>>>>2 ubeshort < 10
|
||
>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
|
||
>>>>>>0 ubyte < 10 Infocom (Z-machine %d,
|
||
>>>>>>>2 ubeshort < 10 Release %d /
|
||
>>>>>>>>18 string >\0 Serial %.6s)
|
||
!:strength + 40
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Glulx: file(1) magic for Glulx binaries.
|
||
#
|
||
# I haven't checked for false matches yet.
|
||
#
|
||
0 string Glul Glulx game data
|
||
>4 beshort x (Version %d
|
||
>>6 byte x \b.%d
|
||
>>8 byte x \b.%d)
|
||
>36 string Info Compiled by Inform
|
||
|
||
|
||
|
||
# For Quetzal and blorb magic see iff
|
||
|
||
|
||
# TADS (Text Adventure Development System) version 2
|
||
# All files are machine-independent (games compile to byte-code) and are tagged
|
||
# with a version string of the form "V2.<digit>.<digit>\0".
|
||
# Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
|
||
0 string TADS2\ bin TADS
|
||
>9 belong !0x0A0D1A00 game data, CORRUPTED
|
||
>9 belong 0x0A0D1A00
|
||
>>13 string >\0 %s game data
|
||
# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
|
||
0 string TADS2\ rsc TADS
|
||
>9 belong !0x0A0D1A00 resource data, CORRUPTED
|
||
>9 belong 0x0A0D1A00
|
||
>>13 string >\0 %s resource data
|
||
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
|
||
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
|
||
# "TADS2 save\n\r\032\0" and the interpreter version.
|
||
0 string TADS2\ save/g TADS
|
||
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
|
||
>12 belong 0x0A0D1A00
|
||
>>(16.s+32) string >\0 %s saved game data
|
||
# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
|
||
# version.
|
||
0 string TADS2\ save TADS
|
||
>10 belong !0x0A0D1A00 saved game data, CORRUPTED
|
||
>10 belong 0x0A0D1A00
|
||
>>14 string >\0 %s saved game data
|
||
|
||
# TADS (Text Adventure Development System) version 3
|
||
# Game files start with "T3-image\015\012\032"
|
||
0 string T3-image\015\012\032
|
||
>11 leshort x TADS 3 game data (format version %d)
|
||
# Saved game files start with "T3-state-v####\015\012\032"
|
||
# where #### is a format version number
|
||
0 string T3-state-v
|
||
>14 string \015\012\032 TADS 3 saved game data (format version
|
||
>>10 byte x %c
|
||
>>11 byte x \b%c
|
||
>>12 byte x \b%c
|
||
>>13 byte x \b%c)
|
||
|
||
# Danny Milosavljevic <danny.milo@gmx.net>
|
||
# this are adrift (adventure game standard) game files, extension .taf
|
||
# depending on version magic continues with 0x93453E6139FA (V 4.0)
|
||
# 0x9445376139FA (V 3.90)
|
||
# 0x9445366139FA (V 3.80)
|
||
# this is from source (http://www.adrift.org.uk/) and I have some taf
|
||
# files, and checked them.
|
||
#0 belong 0x3C423FC9
|
||
#>4 belong 0x6A87C2CF Adrift game file
|
||
#!:mime application/x-adrift
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
|
||
# allegro: file(1) magic for Allegro datafiles
|
||
# Toby Deshane <hac@shoelace.digivill.net>
|
||
#
|
||
0 belong 0x736C6821 Allegro datafile (packed)
|
||
0 belong 0x736C682E Allegro datafile (not packed/autodetect)
|
||
0 belong 0x736C682B Allegro datafile (appended exe data)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
|
||
# alliant: file(1) magic for Alliant FX series a.out files
|
||
#
|
||
# If the FX series is the one that had a processor with a 68K-derived
|
||
# instruction set, the "short" should probably become "beshort" and the
|
||
# "long" should probably become "belong".
|
||
# If it's the i860-based one, they should probably become either the
|
||
# big-endian or little-endian versions, depending on the mode they ran
|
||
# the 860 in....
|
||
#
|
||
0 short 0420 0420 Alliant virtual executable
|
||
>2 short &0x0020 common library
|
||
>16 long >0 not stripped
|
||
0 short 0421 0421 Alliant compact executable
|
||
>2 short &0x0020 common library
|
||
>16 long >0 not stripped
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
|
||
# amanda: file(1) magic for amanda file format
|
||
#
|
||
0 string AMANDA:\ AMANDA
|
||
>8 string TAPESTART\ DATE tape header file,
|
||
>>23 string X
|
||
>>>25 string >\ Unused %s
|
||
>>23 string >\ DATE %s
|
||
>8 string FILE\ dump file,
|
||
>>13 string >\ DATE %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
|
||
# amigaos: file(1) magic for AmigaOS binary formats:
|
||
|
||
#
|
||
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
|
||
#
|
||
0 belong 0x000003fa AmigaOS shared library
|
||
0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
|
||
0 belong 0x000003e7 AmigaOS object/library data
|
||
#
|
||
0 beshort 0xe310 Amiga Workbench
|
||
>2 beshort 1
|
||
>>48 byte 1 disk icon
|
||
>>48 byte 2 drawer icon
|
||
>>48 byte 3 tool icon
|
||
>>48 byte 4 project icon
|
||
>>48 byte 5 garbage icon
|
||
>>48 byte 6 device icon
|
||
>>48 byte 7 kickstart icon
|
||
>>48 byte 8 workbench application icon
|
||
>2 beshort >1 icon, vers. %d
|
||
#
|
||
# various sound formats from the Amiga
|
||
# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
|
||
#
|
||
0 string FC14 Future Composer 1.4 Module sound file
|
||
0 string SMOD Future Composer 1.3 Module sound file
|
||
0 string AON4artofnoise Art Of Noise Module sound file
|
||
1 string MUGICIAN/SOFTEYES Mugician Module sound file
|
||
58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
|
||
0 string Synth4.0 Synthesis Module sound file
|
||
0 string ARP. The Holy Noise Module sound file
|
||
0 string BeEp\0 JamCracker Module sound file
|
||
0 string COSO\0 Hippel-COSO Module sound file
|
||
# Too simple (short, pure ASCII, deep), MPi
|
||
#26 string V.3 Brian Postma's Soundmon Module sound file v3
|
||
#26 string BPSM Brian Postma's Soundmon Module sound file v3
|
||
#26 string V.2 Brian Postma's Soundmon Module sound file v2
|
||
|
||
# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
|
||
0 beshort 0x0f00 AmigaOS bitmap font
|
||
0 beshort 0x0f03 AmigaOS outline font
|
||
0 belong 0x80001001 AmigaOS outline tag
|
||
0 string ##\ version catalog translation
|
||
0 string EMOD\0 Amiga E module
|
||
8 string ECXM\0 ECX module
|
||
0 string/c @database AmigaGuide file
|
||
|
||
# Amiga disk types
|
||
#
|
||
0 string RDSK Rigid Disk Block
|
||
>160 string x on %.24s
|
||
0 string DOS\0 Amiga DOS disk
|
||
0 string DOS\1 Amiga FFS disk
|
||
0 string DOS\2 Amiga Inter DOS disk
|
||
0 string DOS\3 Amiga Inter FFS disk
|
||
0 string DOS\4 Amiga Fastdir DOS disk
|
||
0 string DOS\5 Amiga Fastdir FFS disk
|
||
0 string KICK Kickstart disk
|
||
|
||
# From: Alex Beregszaszi <alex@fsn.hu>
|
||
0 string LZX LZX compressed archive (Amiga)
|
||
|
||
# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
|
||
0 string .KEY AmigaDOS script
|
||
0 string .key AmigaDOS script
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: animation,v 1.48 2013/03/09 22:36:00 christos Exp $
|
||
# animation: file(1) magic for animation/movie formats
|
||
#
|
||
# animation formats
|
||
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
|
||
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
|
||
# SGI and Apple formats
|
||
0 string MOVI Silicon Graphics movie file
|
||
!:mime video/x-sgi-movie
|
||
4 string moov Apple QuickTime
|
||
!:mime video/quicktime
|
||
>12 string mvhd \b movie (fast start)
|
||
>12 string mdra \b URL
|
||
>12 string cmov \b movie (fast start, compressed header)
|
||
>12 string rmra \b multiple URLs
|
||
4 string mdat Apple QuickTime movie (unoptimized)
|
||
!:mime video/quicktime
|
||
#4 string wide Apple QuickTime movie (unoptimized)
|
||
#!:mime video/quicktime
|
||
#4 string skip Apple QuickTime movie (modified)
|
||
#!:mime video/quicktime
|
||
#4 string free Apple QuickTime movie (modified)
|
||
#!:mime video/quicktime
|
||
4 string idsc Apple QuickTime image (fast start)
|
||
!:mime image/x-quicktime
|
||
#4 string idat Apple QuickTime image (unoptimized)
|
||
#!:mime image/x-quicktime
|
||
4 string pckg Apple QuickTime compressed archive
|
||
!:mime application/x-quicktime-player
|
||
4 string/W jP JPEG 2000 image
|
||
!:mime image/jp2
|
||
4 string ftyp ISO Media
|
||
>8 string isom \b, MPEG v4 system, version 1
|
||
!:mime video/mp4
|
||
>8 string iso2 \b, MPEG v4 system, part 12 revision
|
||
>8 string mp41 \b, MPEG v4 system, version 1
|
||
!:mime video/mp4
|
||
>8 string mp42 \b, MPEG v4 system, version 2
|
||
!:mime video/mp4
|
||
>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
|
||
>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
|
||
>8 string/W jp2 \b, JPEG 2000
|
||
!:mime image/jp2
|
||
>8 string 3ge \b, MPEG v4 system, 3GPP
|
||
!:mime video/3gpp
|
||
>8 string 3gg \b, MPEG v4 system, 3GPP
|
||
!:mime video/3gpp
|
||
>8 string 3gp \b, MPEG v4 system, 3GPP
|
||
!:mime video/3gpp
|
||
>8 string 3gs \b, MPEG v4 system, 3GPP
|
||
!:mime video/3gpp
|
||
>8 string 3g2 \b, MPEG v4 system, 3GPP2
|
||
!:mime video/3gpp2
|
||
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
|
||
>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
|
||
>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
|
||
>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
|
||
!:mime video/mp4
|
||
>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
|
||
!:mime video/3gpp
|
||
>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC
|
||
!:mime audio/mp4
|
||
>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC
|
||
!:mime video/mp4
|
||
>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted
|
||
>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked
|
||
>8 string/W qt \b, Apple QuickTime movie
|
||
!:mime video/quicktime
|
||
|
||
# MPEG sequences
|
||
# Scans for all common MPEG header start codes
|
||
0 belong 0x00000001
|
||
>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
|
||
>>5 byte 66 \b, baseline
|
||
>>5 byte 77 \b, main
|
||
>>5 byte 88 \b, extended
|
||
>>7 byte x \b @ L %u
|
||
0 belong&0xFFFFFF00 0x00000100
|
||
>3 byte 0xBA MPEG sequence
|
||
!:mime video/mpeg
|
||
>>4 byte &0x40 \b, v2, program multiplex
|
||
>>4 byte ^0x40 \b, v1, system multiplex
|
||
>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
|
||
>3 byte&0x1F 0x07 MPEG sequence, H.264 video
|
||
>>4 byte 66 \b, baseline
|
||
>>4 byte 77 \b, main
|
||
>>4 byte 88 \b, extended
|
||
>>6 byte x \b @ L %u
|
||
# GRR too general as it catches also FoxPro Memo example NG.FPT
|
||
>3 byte 0xB0 MPEG sequence, v4
|
||
# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
|
||
#>>4 byte !0 MPEG sequence, v4
|
||
!:mime video/mpeg4-generic
|
||
>>5 belong 0x000001B5
|
||
>>>9 byte &0x80
|
||
>>>>10 byte&0xF0 16 \b, video
|
||
>>>>10 byte&0xF0 32 \b, still texture
|
||
>>>>10 byte&0xF0 48 \b, mesh
|
||
>>>>10 byte&0xF0 64 \b, face
|
||
>>>9 byte&0xF8 8 \b, video
|
||
>>>9 byte&0xF8 16 \b, still texture
|
||
>>>9 byte&0xF8 24 \b, mesh
|
||
>>>9 byte&0xF8 32 \b, face
|
||
>>4 byte 1 \b, simple @ L1
|
||
>>4 byte 2 \b, simple @ L2
|
||
>>4 byte 3 \b, simple @ L3
|
||
>>4 byte 4 \b, simple @ L0
|
||
>>4 byte 17 \b, simple scalable @ L1
|
||
>>4 byte 18 \b, simple scalable @ L2
|
||
>>4 byte 33 \b, core @ L1
|
||
>>4 byte 34 \b, core @ L2
|
||
>>4 byte 50 \b, main @ L2
|
||
>>4 byte 51 \b, main @ L3
|
||
>>4 byte 53 \b, main @ L4
|
||
>>4 byte 66 \b, n-bit @ L2
|
||
>>4 byte 81 \b, scalable texture @ L1
|
||
>>4 byte 97 \b, simple face animation @ L1
|
||
>>4 byte 98 \b, simple face animation @ L2
|
||
>>4 byte 99 \b, simple face basic animation @ L1
|
||
>>4 byte 100 \b, simple face basic animation @ L2
|
||
>>4 byte 113 \b, basic animation text @ L1
|
||
>>4 byte 114 \b, basic animation text @ L2
|
||
>>4 byte 129 \b, hybrid @ L1
|
||
>>4 byte 130 \b, hybrid @ L2
|
||
>>4 byte 145 \b, advanced RT simple @ L!
|
||
>>4 byte 146 \b, advanced RT simple @ L2
|
||
>>4 byte 147 \b, advanced RT simple @ L3
|
||
>>4 byte 148 \b, advanced RT simple @ L4
|
||
>>4 byte 161 \b, core scalable @ L1
|
||
>>4 byte 162 \b, core scalable @ L2
|
||
>>4 byte 163 \b, core scalable @ L3
|
||
>>4 byte 177 \b, advanced coding efficiency @ L1
|
||
>>4 byte 178 \b, advanced coding efficiency @ L2
|
||
>>4 byte 179 \b, advanced coding efficiency @ L3
|
||
>>4 byte 180 \b, advanced coding efficiency @ L4
|
||
>>4 byte 193 \b, advanced core @ L1
|
||
>>4 byte 194 \b, advanced core @ L2
|
||
>>4 byte 209 \b, advanced scalable texture @ L1
|
||
>>4 byte 210 \b, advanced scalable texture @ L2
|
||
>>4 byte 211 \b, advanced scalable texture @ L3
|
||
>>4 byte 225 \b, simple studio @ L1
|
||
>>4 byte 226 \b, simple studio @ L2
|
||
>>4 byte 227 \b, simple studio @ L3
|
||
>>4 byte 228 \b, simple studio @ L4
|
||
>>4 byte 229 \b, core studio @ L1
|
||
>>4 byte 230 \b, core studio @ L2
|
||
>>4 byte 231 \b, core studio @ L3
|
||
>>4 byte 232 \b, core studio @ L4
|
||
>>4 byte 240 \b, advanced simple @ L0
|
||
>>4 byte 241 \b, advanced simple @ L1
|
||
>>4 byte 242 \b, advanced simple @ L2
|
||
>>4 byte 243 \b, advanced simple @ L3
|
||
>>4 byte 244 \b, advanced simple @ L4
|
||
>>4 byte 245 \b, advanced simple @ L5
|
||
>>4 byte 247 \b, advanced simple @ L3b
|
||
>>4 byte 248 \b, FGS @ L0
|
||
>>4 byte 249 \b, FGS @ L1
|
||
>>4 byte 250 \b, FGS @ L2
|
||
>>4 byte 251 \b, FGS @ L3
|
||
>>4 byte 252 \b, FGS @ L4
|
||
>>4 byte 253 \b, FGS @ L5
|
||
>3 byte 0xB5 MPEG sequence, v4
|
||
!:mime video/mpeg4-generic
|
||
>>4 byte &0x80
|
||
>>>5 byte&0xF0 16 \b, video (missing profile header)
|
||
>>>5 byte&0xF0 32 \b, still texture (missing profile header)
|
||
>>>5 byte&0xF0 48 \b, mesh (missing profile header)
|
||
>>>5 byte&0xF0 64 \b, face (missing profile header)
|
||
>>4 byte&0xF8 8 \b, video (missing profile header)
|
||
>>4 byte&0xF8 16 \b, still texture (missing profile header)
|
||
>>4 byte&0xF8 24 \b, mesh (missing profile header)
|
||
>>4 byte&0xF8 32 \b, face (missing profile header)
|
||
>3 byte 0xB3 MPEG sequence
|
||
!:mime video/mpeg
|
||
>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>12 belong 0x000001B5 \b, v2,
|
||
>>>16 byte&0x0F 1 \b HP
|
||
>>>16 byte&0x0F 2 \b Spt
|
||
>>>16 byte&0x0F 3 \b SNR
|
||
>>>16 byte&0x0F 4 \b MP
|
||
>>>16 byte&0x0F 5 \b SP
|
||
>>>17 byte&0xF0 64 \b@HL
|
||
>>>17 byte&0xF0 96 \b@H-14
|
||
>>>17 byte&0xF0 128 \b@ML
|
||
>>>17 byte&0xF0 160 \b@LL
|
||
>>>17 byte &0x08 \b progressive
|
||
>>>17 byte ^0x08 \b interlaced
|
||
>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
|
||
>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
|
||
>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
|
||
>>11 byte &0x02
|
||
>>>75 byte &0x01
|
||
>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>>>140 belong 0x000001B5 \b, v2,
|
||
>>>>>144 byte&0x0F 1 \b HP
|
||
>>>>>144 byte&0x0F 2 \b Spt
|
||
>>>>>144 byte&0x0F 3 \b SNR
|
||
>>>>>144 byte&0x0F 4 \b MP
|
||
>>>>>144 byte&0x0F 5 \b SP
|
||
>>>>>145 byte&0xF0 64 \b@HL
|
||
>>>>>145 byte&0xF0 96 \b@H-14
|
||
>>>>>145 byte&0xF0 128 \b@ML
|
||
>>>>>145 byte&0xF0 160 \b@LL
|
||
>>>>>145 byte &0x08 \b progressive
|
||
>>>>>145 byte ^0x08 \b interlaced
|
||
>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
|
||
>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
|
||
>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
|
||
>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
|
||
>>76 belong 0x000001B5 \b, v2,
|
||
>>>80 byte&0x0F 1 \b HP
|
||
>>>80 byte&0x0F 2 \b Spt
|
||
>>>80 byte&0x0F 3 \b SNR
|
||
>>>80 byte&0x0F 4 \b MP
|
||
>>>80 byte&0x0F 5 \b SP
|
||
>>>81 byte&0xF0 64 \b@HL
|
||
>>>81 byte&0xF0 96 \b@H-14
|
||
>>>81 byte&0xF0 128 \b@ML
|
||
>>>81 byte&0xF0 160 \b@LL
|
||
>>>81 byte &0x08 \b progressive
|
||
>>>81 byte ^0x08 \b interlaced
|
||
>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
|
||
>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
|
||
>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
|
||
>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
|
||
>>>7 byte&0xF0 0x10 \b, 16:9
|
||
>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
|
||
>>>7 byte&0xF0 0x10 \b, 16:9
|
||
>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
|
||
>>>7 byte&0xF0 0x10 \b, 4:3
|
||
>>4 beshort&0xFFF0 0x2C00 \b, 4CIF
|
||
>>>5 beshort&0x0FFF 0x01E0 \b NTSC
|
||
>>>5 beshort&0x0FFF 0x0240 \b PAL
|
||
>>>7 byte&0xF0 0x20 \b, 4:3
|
||
>>>7 byte&0xF0 0x30 \b, 16:9
|
||
>>>7 byte&0xF0 0x40 \b, 11:5
|
||
>>>7 byte&0xF0 0x80 \b, PAL 4:3
|
||
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
|
||
>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
|
||
>>>7 byte&0xF0 0x10 \b, 4:3
|
||
>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
|
||
>>>7 byte&0xF0 0x10 \b, 4:3
|
||
>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
|
||
>>>7 byte&0xF0 0x10 \b, 4:3
|
||
>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
|
||
>>>7 byte&0xF0 0x10 \b, 4:3
|
||
>>4 beshort&0xFFF0 0x1600 \b, CIF
|
||
>>>5 beshort&0x0FFF 0x00F0 \b NTSC
|
||
>>>5 beshort&0x0FFF 0x0120 \b PAL
|
||
>>>7 byte&0xF0 0x20 \b, 4:3
|
||
>>>7 byte&0xF0 0x30 \b, 16:9
|
||
>>>7 byte&0xF0 0x40 \b, 11:5
|
||
>>>7 byte&0xF0 0x80 \b, PAL 4:3
|
||
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
|
||
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
|
||
>>>>7 byte&0xF0 0x20 \b, 4:3
|
||
>>>>7 byte&0xF0 0x30 \b, 16:9
|
||
>>>>7 byte&0xF0 0x40 \b, 11:5
|
||
>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
|
||
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
|
||
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
|
||
>>>7 byte&0xF0 0x20 \b, 4:3
|
||
>>>7 byte&0xF0 0x30 \b, 16:9
|
||
>>>7 byte&0xF0 0x40 \b, 11:5
|
||
>>4 beshort&0xFFF0 0x1E00 \b, SVCD
|
||
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
|
||
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
|
||
>>>7 byte&0xF0 0x20 \b, 4:3
|
||
>>>7 byte&0xF0 0x30 \b, 16:9
|
||
>>>7 byte&0xF0 0x40 \b, 11:5
|
||
>>7 byte&0x0F 1 \b, 23.976 fps
|
||
>>7 byte&0x0F 2 \b, 24 fps
|
||
>>7 byte&0x0F 3 \b, 25 fps
|
||
>>7 byte&0x0F 4 \b, 29.97 fps
|
||
>>7 byte&0x0F 5 \b, 30 fps
|
||
>>7 byte&0x0F 6 \b, 50 fps
|
||
>>7 byte&0x0F 7 \b, 59.94 fps
|
||
>>7 byte&0x0F 8 \b, 60 fps
|
||
>>11 byte &0x04 \b, Constrained
|
||
|
||
# MPEG ADTS Audio (*.mpx/mxa/aac)
|
||
# from dreesen@math.fu-berlin.de
|
||
# modified to fully support MPEG ADTS
|
||
|
||
# MP3, M1A
|
||
# modified by Joerg Jenderek
|
||
# GRR the original test are too common for many DOS files
|
||
# so don't accept as MP3 until we've tested the rate
|
||
0 beshort&0xFFFE 0xFFFA
|
||
# rates
|
||
>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
|
||
!:mime audio/mpeg
|
||
>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
|
||
!:mime audio/mpeg
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 44.1 kHz
|
||
>2 byte&0x0C 0x04 \b, 48 kHz
|
||
>2 byte&0x0C 0x08 \b, 32 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MP2, M1A
|
||
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
|
||
!:mime audio/mpeg
|
||
# rates
|
||
>2 byte&0xF0 0x10 \b, 32 kbps
|
||
>2 byte&0xF0 0x20 \b, 48 kbps
|
||
>2 byte&0xF0 0x30 \b, 56 kbps
|
||
>2 byte&0xF0 0x40 \b, 64 kbps
|
||
>2 byte&0xF0 0x50 \b, 80 kbps
|
||
>2 byte&0xF0 0x60 \b, 96 kbps
|
||
>2 byte&0xF0 0x70 \b, 112 kbps
|
||
>2 byte&0xF0 0x80 \b, 128 kbps
|
||
>2 byte&0xF0 0x90 \b, 160 kbps
|
||
>2 byte&0xF0 0xA0 \b, 192 kbps
|
||
>2 byte&0xF0 0xB0 \b, 224 kbps
|
||
>2 byte&0xF0 0xC0 \b, 256 kbps
|
||
>2 byte&0xF0 0xD0 \b, 320 kbps
|
||
>2 byte&0xF0 0xE0 \b, 384 kbps
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 44.1 kHz
|
||
>2 byte&0x0C 0x04 \b, 48 kHz
|
||
>2 byte&0x0C 0x08 \b, 32 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MPA, M1A
|
||
# updated by Joerg Jenderek
|
||
# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
|
||
# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
|
||
# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
|
||
#0 beshort&0xFFFE 0xFFFE
|
||
#>2 ubyte&0xF0 >0x0F
|
||
#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
|
||
## rate
|
||
#>>>2 byte&0xF0 0x10 \b, 32 kbps
|
||
#>>>2 byte&0xF0 0x20 \b, 64 kbps
|
||
#>>>2 byte&0xF0 0x30 \b, 96 kbps
|
||
#>>>2 byte&0xF0 0x40 \b, 128 kbps
|
||
#>>>2 byte&0xF0 0x50 \b, 160 kbps
|
||
#>>>2 byte&0xF0 0x60 \b, 192 kbps
|
||
#>>>2 byte&0xF0 0x70 \b, 224 kbps
|
||
#>>>2 byte&0xF0 0x80 \b, 256 kbps
|
||
#>>>2 byte&0xF0 0x90 \b, 288 kbps
|
||
#>>>2 byte&0xF0 0xA0 \b, 320 kbps
|
||
#>>>2 byte&0xF0 0xB0 \b, 352 kbps
|
||
#>>>2 byte&0xF0 0xC0 \b, 384 kbps
|
||
#>>>2 byte&0xF0 0xD0 \b, 416 kbps
|
||
#>>>2 byte&0xF0 0xE0 \b, 448 kbps
|
||
## timing
|
||
#>>>2 byte&0x0C 0x00 \b, 44.1 kHz
|
||
#>>>2 byte&0x0C 0x04 \b, 48 kHz
|
||
#>>>2 byte&0x0C 0x08 \b, 32 kHz
|
||
## channels/options
|
||
#>>>3 byte&0xC0 0x00 \b, Stereo
|
||
#>>>3 byte&0xC0 0x40 \b, JntStereo
|
||
#>>>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
#>>>3 byte&0xC0 0xC0 \b, Monaural
|
||
##>1 byte ^0x01 \b, Data Verify
|
||
##>2 byte &0x02 \b, Packet Pad
|
||
##>2 byte &0x01 \b, Custom Flag
|
||
##>3 byte &0x08 \b, Copyrighted
|
||
##>3 byte &0x04 \b, Original Source
|
||
##>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
##>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MP3, M2A
|
||
0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
|
||
!:mime audio/mpeg
|
||
# rate
|
||
>2 byte&0xF0 0x10 \b, 8 kbps
|
||
>2 byte&0xF0 0x20 \b, 16 kbps
|
||
>2 byte&0xF0 0x30 \b, 24 kbps
|
||
>2 byte&0xF0 0x40 \b, 32 kbps
|
||
>2 byte&0xF0 0x50 \b, 40 kbps
|
||
>2 byte&0xF0 0x60 \b, 48 kbps
|
||
>2 byte&0xF0 0x70 \b, 56 kbps
|
||
>2 byte&0xF0 0x80 \b, 64 kbps
|
||
>2 byte&0xF0 0x90 \b, 80 kbps
|
||
>2 byte&0xF0 0xA0 \b, 96 kbps
|
||
>2 byte&0xF0 0xB0 \b, 112 kbps
|
||
>2 byte&0xF0 0xC0 \b, 128 kbps
|
||
>2 byte&0xF0 0xD0 \b, 144 kbps
|
||
>2 byte&0xF0 0xE0 \b, 160 kbps
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 22.05 kHz
|
||
>2 byte&0x0C 0x04 \b, 24 kHz
|
||
>2 byte&0x0C 0x08 \b, 16 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MP2, M2A
|
||
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
|
||
# rate
|
||
>2 byte&0xF0 0x10 \b, 8 kbps
|
||
>2 byte&0xF0 0x20 \b, 16 kbps
|
||
>2 byte&0xF0 0x30 \b, 24 kbps
|
||
>2 byte&0xF0 0x40 \b, 32 kbps
|
||
>2 byte&0xF0 0x50 \b, 40 kbps
|
||
>2 byte&0xF0 0x60 \b, 48 kbps
|
||
>2 byte&0xF0 0x70 \b, 56 kbps
|
||
>2 byte&0xF0 0x80 \b, 64 kbps
|
||
>2 byte&0xF0 0x90 \b, 80 kbps
|
||
>2 byte&0xF0 0xA0 \b, 96 kbps
|
||
>2 byte&0xF0 0xB0 \b, 112 kbps
|
||
>2 byte&0xF0 0xC0 \b, 128 kbps
|
||
>2 byte&0xF0 0xD0 \b, 144 kbps
|
||
>2 byte&0xF0 0xE0 \b, 160 kbps
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 22.05 kHz
|
||
>2 byte&0x0C 0x04 \b, 24 kHz
|
||
>2 byte&0x0C 0x08 \b, 16 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MPA, M2A
|
||
0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
|
||
!:mime audio/mpeg
|
||
# rate
|
||
>2 byte&0xF0 0x10 \b, 32 kbps
|
||
>2 byte&0xF0 0x20 \b, 48 kbps
|
||
>2 byte&0xF0 0x30 \b, 56 kbps
|
||
>2 byte&0xF0 0x40 \b, 64 kbps
|
||
>2 byte&0xF0 0x50 \b, 80 kbps
|
||
>2 byte&0xF0 0x60 \b, 96 kbps
|
||
>2 byte&0xF0 0x70 \b, 112 kbps
|
||
>2 byte&0xF0 0x80 \b, 128 kbps
|
||
>2 byte&0xF0 0x90 \b, 144 kbps
|
||
>2 byte&0xF0 0xA0 \b, 160 kbps
|
||
>2 byte&0xF0 0xB0 \b, 176 kbps
|
||
>2 byte&0xF0 0xC0 \b, 192 kbps
|
||
>2 byte&0xF0 0xD0 \b, 224 kbps
|
||
>2 byte&0xF0 0xE0 \b, 256 kbps
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 22.05 kHz
|
||
>2 byte&0x0C 0x04 \b, 24 kHz
|
||
>2 byte&0x0C 0x08 \b, 16 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# MP3, M25A
|
||
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
|
||
!:mime audio/mpeg
|
||
# rate
|
||
>2 byte&0xF0 0x10 \b, 8 kbps
|
||
>2 byte&0xF0 0x20 \b, 16 kbps
|
||
>2 byte&0xF0 0x30 \b, 24 kbps
|
||
>2 byte&0xF0 0x40 \b, 32 kbps
|
||
>2 byte&0xF0 0x50 \b, 40 kbps
|
||
>2 byte&0xF0 0x60 \b, 48 kbps
|
||
>2 byte&0xF0 0x70 \b, 56 kbps
|
||
>2 byte&0xF0 0x80 \b, 64 kbps
|
||
>2 byte&0xF0 0x90 \b, 80 kbps
|
||
>2 byte&0xF0 0xA0 \b, 96 kbps
|
||
>2 byte&0xF0 0xB0 \b, 112 kbps
|
||
>2 byte&0xF0 0xC0 \b, 128 kbps
|
||
>2 byte&0xF0 0xD0 \b, 144 kbps
|
||
>2 byte&0xF0 0xE0 \b, 160 kbps
|
||
# timing
|
||
>2 byte&0x0C 0x00 \b, 11.025 kHz
|
||
>2 byte&0x0C 0x04 \b, 12 kHz
|
||
>2 byte&0x0C 0x08 \b, 8 kHz
|
||
# channels/options
|
||
>3 byte&0xC0 0x00 \b, Stereo
|
||
>3 byte&0xC0 0x40 \b, JntStereo
|
||
>3 byte&0xC0 0x80 \b, 2x Monaural
|
||
>3 byte&0xC0 0xC0 \b, Monaural
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Packet Pad
|
||
#>2 byte &0x01 \b, Custom Flag
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
#>3 byte &0x04 \b, Original Source
|
||
#>3 byte&0x03 1 \b, NR: 50/15 ms
|
||
#>3 byte&0x03 3 \b, NR: CCIT J.17
|
||
|
||
# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
|
||
|
||
# Stored AAC streams (instead of the MP4 format)
|
||
0 string ADIF MPEG ADIF, AAC
|
||
!:mime audio/x-hx-aac-adif
|
||
>4 byte &0x80
|
||
>>13 byte &0x10 \b, VBR
|
||
>>13 byte ^0x10 \b, CBR
|
||
>>16 byte&0x1E 0x02 \b, single stream
|
||
>>16 byte&0x1E 0x04 \b, 2 streams
|
||
>>16 byte&0x1E 0x06 \b, 3 streams
|
||
>>16 byte &0x08 \b, 4 or more streams
|
||
>>16 byte &0x10 \b, 8 or more streams
|
||
>>4 byte &0x80 \b, Copyrighted
|
||
>>13 byte &0x40 \b, Original Source
|
||
>>13 byte &0x20 \b, Home Flag
|
||
>4 byte ^0x80
|
||
>>4 byte &0x10 \b, VBR
|
||
>>4 byte ^0x10 \b, CBR
|
||
>>7 byte&0x1E 0x02 \b, single stream
|
||
>>7 byte&0x1E 0x04 \b, 2 streams
|
||
>>7 byte&0x1E 0x06 \b, 3 streams
|
||
>>7 byte &0x08 \b, 4 or more streams
|
||
>>7 byte &0x10 \b, 8 or more streams
|
||
>>4 byte &0x40 \b, Original Stream(s)
|
||
>>4 byte &0x20 \b, Home Source
|
||
|
||
# Live or stored single AAC stream (used with MPEG-2 systems)
|
||
0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
|
||
!:mime audio/x-hx-aac-adts
|
||
>1 byte &0x08 \b, v2
|
||
>1 byte ^0x08 \b, v4
|
||
# profile
|
||
>>2 byte &0xC0 \b LTP
|
||
>2 byte&0xc0 0x00 \b Main
|
||
>2 byte&0xc0 0x40 \b LC
|
||
>2 byte&0xc0 0x80 \b SSR
|
||
# timing
|
||
>2 byte&0x3c 0x00 \b, 96 kHz
|
||
>2 byte&0x3c 0x04 \b, 88.2 kHz
|
||
>2 byte&0x3c 0x08 \b, 64 kHz
|
||
>2 byte&0x3c 0x0c \b, 48 kHz
|
||
>2 byte&0x3c 0x10 \b, 44.1 kHz
|
||
>2 byte&0x3c 0x14 \b, 32 kHz
|
||
>2 byte&0x3c 0x18 \b, 24 kHz
|
||
>2 byte&0x3c 0x1c \b, 22.05 kHz
|
||
>2 byte&0x3c 0x20 \b, 16 kHz
|
||
>2 byte&0x3c 0x24 \b, 12 kHz
|
||
>2 byte&0x3c 0x28 \b, 11.025 kHz
|
||
>2 byte&0x3c 0x2c \b, 8 kHz
|
||
# channels
|
||
>2 beshort&0x01c0 0x0040 \b, monaural
|
||
>2 beshort&0x01c0 0x0080 \b, stereo
|
||
>2 beshort&0x01c0 0x00c0 \b, stereo + center
|
||
>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
|
||
>2 beshort&0x01c0 0x0140 \b, surround
|
||
>2 beshort&0x01c0 0x0180 \b, surround + LFE
|
||
>2 beshort &0x01C0 \b, surround + side
|
||
#>1 byte ^0x01 \b, Data Verify
|
||
#>2 byte &0x02 \b, Custom Flag
|
||
#>3 byte &0x20 \b, Original Stream
|
||
#>3 byte &0x10 \b, Home Source
|
||
#>3 byte &0x08 \b, Copyrighted
|
||
|
||
# Live MPEG-4 audio streams (instead of RTP FlexMux)
|
||
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
|
||
!:mime audio/x-mp4a-latm
|
||
#>1 beshort&0x1FFF x \b, %u byte packet
|
||
>3 byte&0xE0 0x40
|
||
>>4 byte&0x3C 0x04 \b, single stream
|
||
>>4 byte&0x3C 0x08 \b, 2 streams
|
||
>>4 byte&0x3C 0x0C \b, 3 streams
|
||
>>4 byte &0x08 \b, 4 or more streams
|
||
>>4 byte &0x20 \b, 8 or more streams
|
||
>3 byte&0xC0 0
|
||
>>4 byte&0x78 0x08 \b, single stream
|
||
>>4 byte&0x78 0x10 \b, 2 streams
|
||
>>4 byte&0x78 0x18 \b, 3 streams
|
||
>>4 byte &0x20 \b, 4 or more streams
|
||
>>4 byte &0x40 \b, 8 or more streams
|
||
# This magic isn't strong enough (matches plausible ISO-8859-1 text)
|
||
#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
|
||
#!:mime audio/x-mp4a-latm
|
||
|
||
# Summary: FLI animation format
|
||
# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
|
||
# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
|
||
4 leshort 0xAF11
|
||
# standard FLI always has 320x200 resolution and 8 bit color
|
||
>8 leshort 320
|
||
>>10 leshort 200
|
||
>>>12 leshort 8 FLI animation, 320x200x8
|
||
!:mime video/x-fli
|
||
>>>>6 leshort x \b, %d frames
|
||
# frame speed is multiple of 1/70s
|
||
>>>>16 leshort x \b, %d/70s per frame
|
||
|
||
# Summary: FLC animation format
|
||
# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
|
||
# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
|
||
4 leshort 0xAF12
|
||
# standard FLC always use 8 bit color
|
||
>12 leshort 8 FLC animation
|
||
!:mime video/x-flc
|
||
>>8 leshort x \b, %d
|
||
>>10 leshort x \bx%dx8
|
||
>>6 uleshort x \b, %d frames
|
||
>>16 uleshort x \b, %dms per frame
|
||
|
||
# DL animation format
|
||
# XXX - collision with most `mips' magic
|
||
#
|
||
# I couldn't find a real magic number for these, however, this
|
||
# -appears- to work. Note that it might catch other files, too, so be
|
||
# careful!
|
||
#
|
||
# Note that title and author appear in the two 20-byte chunks
|
||
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
|
||
# 255 (hex FF)! The DL format is really bad.
|
||
#
|
||
#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
|
||
#!:mime video/x-unknown
|
||
#>42 byte x - %d screens,
|
||
#>43 byte x %d commands
|
||
#0 byte 2 DL version 2
|
||
#!:mime video/x-unknown
|
||
#>1 byte 1 - large format (320x200,1 image/screen),
|
||
#>1 byte 2 - medium format (160x100,4 images/screen),
|
||
#>1 byte >2 - unknown format,
|
||
#>42 byte x %d screens,
|
||
#>43 byte x %d commands
|
||
# Based on empirical evidence, DL version 3 have several nulls following the
|
||
# \003. Most of them start with non-null values at hex offset 0x34 or so.
|
||
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
|
||
|
||
# iso 13818 transport stream
|
||
#
|
||
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
|
||
# syncbyte 8 bit 0x47
|
||
# error_ind 1 bit -
|
||
# payload_start 1 bit 1
|
||
# priority 1 bit -
|
||
# PID 13 bit 0x0000
|
||
# scrambling 2 bit -
|
||
# adaptfld_ctrl 2 bit 1 or 3
|
||
# conti_count 4 bit -
|
||
0 belong&0xFF5FFF10 0x47400010
|
||
>188 byte 0x47 MPEG transport stream data
|
||
|
||
# DIF digital video file format <mpruett@sgi.com>
|
||
0 belong&0xffffff00 0x1f070000 DIF
|
||
>4 byte &0x01 (DVCPRO) movie file
|
||
>4 byte ^0x01 (DV) movie file
|
||
>3 byte &0x80 (PAL)
|
||
>3 byte ^0x80 (NTSC)
|
||
|
||
# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
|
||
0 belong 0x3026b275 Microsoft ASF
|
||
!:mime video/x-ms-asf
|
||
|
||
# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
|
||
0 string \x8aMNG MNG video data,
|
||
!:mime video/x-mng
|
||
>4 belong !0x0d0a1a0a CORRUPTED,
|
||
>4 belong 0x0d0a1a0a
|
||
>>16 belong x %ld x
|
||
>>20 belong x %ld
|
||
|
||
# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
|
||
0 string \x8bJNG JNG video data,
|
||
!:mime video/x-jng
|
||
>4 belong !0x0d0a1a0a CORRUPTED,
|
||
>4 belong 0x0d0a1a0a
|
||
>>16 belong x %ld x
|
||
>>20 belong x %ld
|
||
|
||
# Vivo video (Wolfram Kleff)
|
||
3 string \x0D\x0AVersion:Vivo Vivo video data
|
||
|
||
# VRML (Virtual Reality Modelling Language)
|
||
0 string/w #VRML\ V1.0\ ascii VRML 1 file
|
||
!:mime model/vrml
|
||
0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
|
||
!:mime model/vrml
|
||
|
||
# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
|
||
# From Michel Briand <michelbriand@free.fr>
|
||
0 string/t \<?xml\ version="
|
||
!:strength +1
|
||
>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text
|
||
!:mime model/x3d
|
||
|
||
#---------------------------------------------------------------------------
|
||
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
|
||
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
|
||
#
|
||
0 string HVQM4 %s
|
||
>6 string >\0 v%s
|
||
>0 byte x GameCube movie,
|
||
>0x34 ubeshort x %d x
|
||
>0x36 ubeshort x %d,
|
||
>0x26 ubeshort x %dus,
|
||
>0x42 ubeshort 0 no audio
|
||
>0x42 ubeshort >0 %dHz audio
|
||
|
||
# From: "Stefan A. Haubenthal" <polluks@web.de>
|
||
0 string DVDVIDEO-VTS Video title set,
|
||
>0x21 byte x v%x
|
||
0 string DVDVIDEO-VMG Video manager,
|
||
>0x21 byte x v%x
|
||
|
||
# From: Behan Webster <behanw@websterwood.com>
|
||
# NuppelVideo used by Mythtv (*.nuv)
|
||
# Note: there are two identical stanzas here differing only in the
|
||
# initial string matched. It used to be done with a regex, but we're
|
||
# trying to get rid of those.
|
||
0 string NuppelVideo MythTV NuppelVideo
|
||
>12 string x v%s
|
||
>20 lelong x (%d
|
||
>24 lelong x \bx%d),
|
||
>36 string P \bprogressive,
|
||
>36 string I \binterlaced,
|
||
>40 ledouble x \baspect:%.2f,
|
||
>48 ledouble x \bfps:%.2f
|
||
0 string MythTV MythTV NuppelVideo
|
||
>12 string x v%s
|
||
>20 lelong x (%d
|
||
>24 lelong x \bx%d),
|
||
>36 string P \bprogressive,
|
||
>36 string I \binterlaced,
|
||
>40 ledouble x \baspect:%.2f,
|
||
>48 ledouble x \bfps:%.2f
|
||
|
||
# MPEG file
|
||
# MPEG sequences
|
||
# FIXME: This section is from the old magic.mime file and needs integrating with the rest
|
||
0 belong 0x000001BA
|
||
>4 byte &0x40
|
||
!:mime video/mp2p
|
||
>4 byte ^0x40
|
||
!:mime video/mpeg
|
||
0 belong 0x000001BB
|
||
!:mime video/mpeg
|
||
0 belong 0x000001B0
|
||
!:mime video/mp4v-es
|
||
0 belong 0x000001B5
|
||
!:mime video/mp4v-es
|
||
0 belong 0x000001B3
|
||
!:mime video/mpv
|
||
0 belong&0xFF5FFF1F 0x47400010
|
||
!:mime video/mp2t
|
||
0 belong 0x00000001
|
||
>4 byte&0x1F 0x07
|
||
!:mime video/h264
|
||
|
||
# Type: Bink Video
|
||
# Extension: .bik
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container
|
||
# From: <hoehle@users.sourceforge.net> 2008-07-18
|
||
0 string BIK Bink Video
|
||
>3 regex =[a-z] rev.%s
|
||
#>4 ulelong x size %d
|
||
>20 ulelong x \b, %d
|
||
>24 ulelong x \bx%d
|
||
>8 ulelong x \b, %d frames
|
||
>32 ulelong x at rate %d/
|
||
>28 ulelong >1 \b%d
|
||
>40 ulelong =0 \b, no audio
|
||
>40 ulelong !0 \b, %d audio track
|
||
>>40 ulelong !1 \bs
|
||
# follow properties of the first audio track only
|
||
>>48 uleshort x %dHz
|
||
>>51 byte&0x20 0 mono
|
||
>>51 byte&0x20 !0 stereo
|
||
#>>51 byte&0x10 0 FFT
|
||
#>>51 byte&0x10 !0 DCT
|
||
|
||
# Type: NUT Container
|
||
# URL: http://wiki.multimedia.cx/index.php?title=NUT
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0 string nut/multimedia\ container\0 NUT multimedia container
|
||
|
||
# Type: Nullsoft Video (NSV)
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string NSVf Nullsoft Video
|
||
|
||
# Type: REDCode Video
|
||
# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
4 string RED1 REDCode Video
|
||
|
||
# Type: MTV Multimedia File
|
||
# URL: http://wiki.multimedia.cx/index.php?title=MTV
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string AMVS MTV Multimedia File
|
||
|
||
# Type: ARMovie
|
||
# URL: http://wiki.multimedia.cx/index.php?title=ARMovie
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string ARMovie\012 ARMovie
|
||
|
||
# Type: Interplay MVE Movie
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string Interplay\040MVE\040File\032 Interplay MVE Movie
|
||
|
||
# Type: Windows Television DVR File
|
||
# URL: http://wiki.multimedia.cx/index.php?title=WTV
|
||
# From: Mike Melanson <mike@mutlimedia.cx>
|
||
# This takes the form of a Windows-style GUID
|
||
0 bequad 0xB7D800203749DA11
|
||
>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media
|
||
|
||
# Type: Sega FILM/CPK Multimedia
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string FILM Sega FILM/CPK Multimedia,
|
||
>32 belong x %d x
|
||
>28 belong x %d
|
||
|
||
# Type: Nintendo THP Multimedia
|
||
# URL: http://wiki.multimedia.cx/index.php?title=THP
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string THP\0 Nintendo THP Multimedia
|
||
|
||
# Type: BBC Dirac Video
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Dirac
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string BBCD BBC Dirac Video
|
||
|
||
# Type: RAD Game Tools Smacker Multimedia
|
||
# URL: http://wiki.multimedia.cx/index.php?title=Smacker
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string SMK RAD Game Tools Smacker Multimedia
|
||
>3 byte x version %c,
|
||
>4 lelong x %d x
|
||
>8 lelong x %d,
|
||
>12 lelong x %d frames
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
|
||
# aout: file(1) magic for a.out executable/object/etc entries that
|
||
# handle executables on multiple platforms.
|
||
#
|
||
|
||
#
|
||
# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
|
||
# BSDI), netbsd, and vax (for UNIX/32V and BSD)
|
||
#
|
||
# XXX - is there anything we can look at to distinguish BSD/OS 386 from
|
||
# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag
|
||
# works only for binaries using shared libraries. Grabbing the entry
|
||
# point from the a.out header, using it to find the first code executed
|
||
# in the program, and looking at that might help.
|
||
#
|
||
0 lelong 0407 a.out little-endian 32-bit executable
|
||
>16 lelong >0 not stripped
|
||
>32 byte 0x6a (uses BSD/OS shared libs)
|
||
|
||
0 lelong 0410 a.out little-endian 32-bit pure executable
|
||
>16 lelong >0 not stripped
|
||
>32 byte 0x6a (uses BSD/OS shared libs)
|
||
|
||
0 lelong 0413 a.out little-endian 32-bit demand paged pure executable
|
||
>16 lelong >0 not stripped
|
||
>32 byte 0x6a (uses BSD/OS shared libs)
|
||
|
||
#
|
||
# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
|
||
# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
|
||
#
|
||
# XXX - is there anything we can look at to distinguish old SunOS 68010
|
||
# from old 68020 IRIX from old NetBSD? Again, I guess we could look at
|
||
# the first instruction or instructions in the program.
|
||
#
|
||
0 belong 0407 a.out big-endian 32-bit executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong 0410 a.out big-endian 32-bit pure executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong 0413 a.out big-endian 32-bit demand paged executable
|
||
>16 belong >0 not stripped
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
|
||
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
|
||
# workspaces)
|
||
#
|
||
0 long 0100554 APL workspace (Ken's original?)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
|
||
# apple: file(1) magic for Apple file formats
|
||
#
|
||
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
|
||
0 string \x0aGL Binary II (apple ][) data
|
||
0 string \x76\xff Squeezed (apple ][) data
|
||
0 string NuFile NuFile archive (apple ][) data
|
||
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
|
||
0 belong 0x00051600 AppleSingle encoded Macintosh file
|
||
0 belong 0x00051607 AppleDouble encoded Macintosh file
|
||
|
||
# Type: Apple Emulator 2IMG format
|
||
# From: Radek Vokal <rvokal@redhat.com>
|
||
0 string 2IMG Apple ][ 2IMG Disk Image
|
||
>4 string XGS! \b, XGS
|
||
>4 string CTKG \b, Catakig
|
||
>4 string ShIm \b, Sheppy's ImageMaker
|
||
>4 string WOOF \b, Sweet 16
|
||
>4 string B2TR \b, Bernie ][ the Rescue
|
||
>4 string !nfc \b, ASIMOV2
|
||
>4 string x \b, Unknown Format
|
||
>0xc byte 00 \b, DOS 3.3 sector order
|
||
>>0x10 byte 00 \b, Volume 254
|
||
>>0x10 byte&0x7f x \b, Volume %u
|
||
>0xc byte 01 \b, ProDOS sector order
|
||
>>0x14 short x \b, %u Blocks
|
||
>0xc byte 02 \b, NIB data
|
||
|
||
# magic for Newton PDA package formats
|
||
# from Ruda Moura <ruda@helllabs.org>
|
||
0 string package0 Newton package, NOS 1.x,
|
||
>12 belong &0x80000000 AutoRemove,
|
||
>12 belong &0x40000000 CopyProtect,
|
||
>12 belong &0x10000000 NoCompression,
|
||
>12 belong &0x04000000 Relocation,
|
||
>12 belong &0x02000000 UseFasterCompression,
|
||
>16 belong x version %d
|
||
|
||
0 string package1 Newton package, NOS 2.x,
|
||
>12 belong &0x80000000 AutoRemove,
|
||
>12 belong &0x40000000 CopyProtect,
|
||
>12 belong &0x10000000 NoCompression,
|
||
>12 belong &0x04000000 Relocation,
|
||
>12 belong &0x02000000 UseFasterCompression,
|
||
>16 belong x version %d
|
||
|
||
0 string package4 Newton package,
|
||
>8 byte 8 NOS 1.x,
|
||
>8 byte 9 NOS 2.x,
|
||
>12 belong &0x80000000 AutoRemove,
|
||
>12 belong &0x40000000 CopyProtect,
|
||
>12 belong &0x10000000 NoCompression,
|
||
|
||
# The following entries for the Apple II are for files that have
|
||
# been transferred as raw binary data from an Apple, without having
|
||
# been encapsulated by any of the above archivers.
|
||
#
|
||
# In general, Apple II formats are hard to identify because Apple DOS
|
||
# and especially Apple ProDOS have strong typing in the file system and
|
||
# therefore programmers never felt much need to include type information
|
||
# in the files themselves.
|
||
#
|
||
# Eric Fischer <enf@pobox.com>
|
||
|
||
# AppleWorks word processor:
|
||
#
|
||
# This matches the standard tab stops for an AppleWorks file, but if
|
||
# a file has a tab stop set in the first four columns this will fail.
|
||
#
|
||
# The "O" is really the magic number, but that's so common that it's
|
||
# necessary to check the tab stops that follow it to avoid false positives.
|
||
|
||
4 string O==== AppleWorks word processor data
|
||
>85 byte&0x01 >0 \b, zoomed
|
||
>90 byte&0x01 >0 \b, paginated
|
||
>92 byte&0x01 >0 \b, with mail merge
|
||
#>91 byte x \b, left margin %d
|
||
|
||
# AppleWorks database:
|
||
#
|
||
# This isn't really a magic number, but it's the closest thing to one
|
||
# that I could find. The 1 and 2 really mean "order in which you defined
|
||
# categories" and "left to right, top to bottom," respectively; the D and R
|
||
# mean that the cursor should move either down or right when you press Return.
|
||
|
||
#30 string \x01D AppleWorks database data
|
||
#30 string \x02D AppleWorks database data
|
||
#30 string \x01R AppleWorks database data
|
||
#30 string \x02R AppleWorks database data
|
||
|
||
# AppleWorks spreadsheet:
|
||
#
|
||
# Likewise, this isn't really meant as a magic number. The R or C means
|
||
# row- or column-order recalculation; the A or M means automatic or manual
|
||
# recalculation.
|
||
|
||
#131 string RA AppleWorks spreadsheet data
|
||
#131 string RM AppleWorks spreadsheet data
|
||
#131 string CA AppleWorks spreadsheet data
|
||
#131 string CM AppleWorks spreadsheet data
|
||
|
||
# Applesoft BASIC:
|
||
#
|
||
# This is incredibly sloppy, but will be true if the program was
|
||
# written at its usual memory location of 2048 and its first line
|
||
# number is less than 256. Yuck.
|
||
# update by Joerg Jenderek at Feb 2013
|
||
|
||
# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
|
||
#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
|
||
0 belong&0x00ff00ff 0x00080000
|
||
# assuming that line number must be positive
|
||
>2 leshort >0 Applesoft BASIC program data, first line number %d
|
||
#>2 leshort x \b, first line number %d
|
||
|
||
# ORCA/EZ assembler:
|
||
#
|
||
# This will not identify ORCA/M source files, since those have
|
||
# some sort of date code instead of the two zero bytes at 6 and 7
|
||
# XXX Conflicts with ELF
|
||
#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
|
||
#>5 byte x \b, build number %d
|
||
|
||
# Broderbund Fantavision
|
||
#
|
||
# I don't know what these values really mean, but they seem to recur.
|
||
# Will they cause too many conflicts?
|
||
|
||
# Probably :-)
|
||
#2 belong&0xFF00FF 0x040008 Fantavision movie data
|
||
|
||
# Some attempts at images.
|
||
#
|
||
# These are actually just bit-for-bit dumps of the frame buffer, so
|
||
# there's really no reasonably way to distinguish them except for their
|
||
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
|
||
# or, occasionally, 8184.
|
||
#
|
||
# Nevertheless this will manage to catch a lot of images that happen
|
||
# to have a solid-colored line at the bottom of the screen.
|
||
|
||
# GRR: Magic too weak
|
||
#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
|
||
#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
|
||
#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
|
||
#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
|
||
#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
|
||
|
||
# Beagle Bros. Apple Mechanic fonts
|
||
|
||
0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
|
||
|
||
# Apple Universal Disk Image Format (UDIF) - dmg files.
|
||
# From Johan Gade.
|
||
# These entries are disabled for now until we fix the following issues.
|
||
#
|
||
# Note there might be some problems with the "VAX COFF executable"
|
||
# entry. Note this entry should be placed before the mac filesystem section,
|
||
# particularly the "Apple Partition data" entry.
|
||
#
|
||
# The intended meaning of these tests is, that the file is only of the
|
||
# specified type if both of the lines are correct - i.e. if the first
|
||
# line matches and the second doesn't then it is not of that type.
|
||
#
|
||
#0 long 0x7801730d
|
||
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
|
||
#
|
||
# Note that this entry is recognized correctly by the "Apple Partition
|
||
# data" entry - however since this entry is more specific - this
|
||
# information seems to be more useful.
|
||
#0 long 0x45520200
|
||
#>0x410 string disk\ image UDIF read/write image (UDRW)
|
||
|
||
# From: Toby Peterson <toby@apple.com>
|
||
0 string bplist00 Apple binary property list
|
||
|
||
# Apple binary property list (bplist)
|
||
# Assumes version bytes are hex.
|
||
# Provides content hints for version 0 files. Assumes that the root
|
||
# object is the first object (true for CoreFoundation implementation).
|
||
# From: David Remahl <dremahl@apple.com>
|
||
0 string bplist
|
||
>6 byte x \bCoreFoundation binary property list data, version 0x%c
|
||
>>7 byte x \b%c
|
||
>6 string 00 \b
|
||
>>8 byte&0xF0 0x00 \b
|
||
>>>8 byte&0x0F 0x00 \b, root type: null
|
||
>>>8 byte&0x0F 0x08 \b, root type: false boolean
|
||
>>>8 byte&0x0F 0x09 \b, root type: true boolean
|
||
>>8 byte&0xF0 0x10 \b, root type: integer
|
||
>>8 byte&0xF0 0x20 \b, root type: real
|
||
>>8 byte&0xF0 0x30 \b, root type: date
|
||
>>8 byte&0xF0 0x40 \b, root type: data
|
||
>>8 byte&0xF0 0x50 \b, root type: ascii string
|
||
>>8 byte&0xF0 0x60 \b, root type: unicode string
|
||
>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
|
||
>>8 byte&0xF0 0xa0 \b, root type: array
|
||
>>8 byte&0xF0 0xd0 \b, root type: dictionary
|
||
|
||
# Apple/NeXT typedstream data
|
||
# Serialization format used by NeXT and Apple for various
|
||
# purposes in YellowStep/Cocoa, including some nib files.
|
||
# From: David Remahl <dremahl@apple.com>
|
||
2 string typedstream NeXT/Apple typedstream data, big endian
|
||
>0 byte x \b, version %hhd
|
||
>0 byte <5 \b
|
||
>>13 byte 0x81 \b
|
||
>>>14 ubeshort x \b, system %hd
|
||
2 string streamtyped NeXT/Apple typedstream data, little endian
|
||
>0 byte x \b, version %hhd
|
||
>0 byte <5 \b
|
||
>>13 byte 0x81 \b
|
||
>>>14 uleshort x \b, system %hd
|
||
|
||
#------------------------------------------------------------------------------
|
||
# CAF: Apple CoreAudio File Format
|
||
#
|
||
# Container format for high-end audio purposes.
|
||
# From: David Remahl <dremahl@apple.com>
|
||
#
|
||
0 string caff CoreAudio Format audio file
|
||
>4 beshort <10 version %d
|
||
>6 beshort x
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Keychain database files
|
||
0 string kych Mac OS X Keychain File
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Code Signing related file types
|
||
0 belong 0xfade0c00 Mac OS X Code Requirement
|
||
>8 belong 1 (opExpr)
|
||
>4 belong x - %d bytes
|
||
|
||
0 belong 0xfade0c01 Mac OS X Code Requirement Set
|
||
>8 belong >1 containing %d items
|
||
>4 belong x - %d bytes
|
||
|
||
0 belong 0xfade0c02 Mac OS X Code Directory
|
||
>8 belong x version %x
|
||
>12 belong >0 flags 0x%x
|
||
>4 belong x - %d bytes
|
||
|
||
0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
|
||
>4 belong x - %d bytes
|
||
|
||
0 belong 0xfade0cc1 Mac OS X Detached Code Signature
|
||
>8 belong >1 (%d elements)
|
||
>4 belong x - %d bytes
|
||
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
# .vdi
|
||
4 string innotek\ VirtualBox\ Disk\ Image %s
|
||
|
||
# Apple disk partition stuff, strengthen the magic using byte 4
|
||
0 beshort 0x4552
|
||
>4 byte 0 Apple Driver Map
|
||
>>2 beshort x \b, blocksize %d
|
||
>>4 belong x \b, blockcount %d
|
||
>>10 beshort x \b, devtype %d
|
||
>>12 beshort x \b, devid %d
|
||
>>20 beshort x \b, descriptors %d
|
||
# Assume 8 partitions each at a multiple of the sector size.
|
||
# We could glean this from the partition descriptors, but they are empty!?!?
|
||
>>(2.S*1) indirect \b, contains[@0x%x]:
|
||
>>(2.S*2) indirect \b, contains[@0x%x]:
|
||
>>(2.S*3) indirect \b, contains[@0x%x]:
|
||
>>(2.S*4) indirect \b, contains[@0x%x]:
|
||
>>(2.S*5) indirect \b, contains[@0x%x]:
|
||
>>(2.S*6) indirect \b, contains[@0x%x]:
|
||
>>(2.S*7) indirect \b, contains[@0x%x]:
|
||
>>(2.S*8) indirect \b, contains[@0x%x]:
|
||
|
||
# Yes, the 3rd and 4th bytes are reserved, but we use them to make the
|
||
# magic stronger.
|
||
0 belong 0x504d0000 Apple Partition Map
|
||
>4 belong x \b, map block count %d
|
||
>8 belong x \b, start block %d
|
||
>12 belong x \b, block count %d
|
||
>16 string >0 \b, name %s
|
||
>48 string >0 \b, type %s
|
||
>124 string >0 \b, processor %s
|
||
>140 string >0 \b, boot arguments %s
|
||
>92 belong & 1 \b, valid
|
||
>92 belong & 2 \b, allocated
|
||
>92 belong & 4 \b, in use
|
||
>92 belong & 8 \b, has boot info
|
||
>92 belong & 16 \b, readable
|
||
>92 belong & 32 \b, writable
|
||
>92 belong & 64 \b, pic boot code
|
||
>92 belong & 128 \b, chain compatible driver
|
||
>92 belong & 256 \b, real driver
|
||
>92 belong & 512 \b, chain driver
|
||
>92 belong & 1024 \b, mount at startup
|
||
>92 belong & 2048 \b, is the startup partition
|
||
|
||
#http://wiki.mozilla.org/DS_Store_File_Format`
|
||
#http://en.wikipedia.org/wiki/.DS_Store
|
||
0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# applix: file(1) magic for Applixware
|
||
# From: Peter Soos <sp@osb.hu>
|
||
#
|
||
0 string *BEGIN Applixware
|
||
>7 string WORDS Words Document
|
||
>7 string GRAPHICS Graphic
|
||
>7 string RASTER Bitmap
|
||
>7 string SPREADSHEETS Spreadsheet
|
||
>7 string MACRO Macro
|
||
>7 string BUILDER Builder Object
|
||
#------------------------------------------------------------------------------
|
||
# $File: archive,v 1.79 2013/02/08 17:24:06 christos Exp $
|
||
# archive: file(1) magic for archive formats (see also "msdos" for self-
|
||
# extracting compressed archives)
|
||
#
|
||
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
|
||
# pre-POSIX "tar" archives are handled in the C code.
|
||
|
||
# POSIX tar archives
|
||
257 string ustar\0 POSIX tar archive
|
||
!:mime application/x-tar # encoding: posix
|
||
257 string ustar\040\040\0 GNU tar archive
|
||
!:mime application/x-tar # encoding: gnu
|
||
|
||
# Incremental snapshot gnu-tar format from:
|
||
# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
|
||
0 string GNU\ tar- GNU tar incremental snapshot data
|
||
>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
|
||
|
||
# cpio archives
|
||
#
|
||
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
|
||
# The idea is to indicate archives produced on machines with the same
|
||
# byte order as the machine running "file" with "cpio archive", and
|
||
# to indicate archives produced on machines with the opposite byte order
|
||
# from the machine running "file" with "byte-swapped cpio archive".
|
||
#
|
||
# The SVR4 "cpio(4)" hints that there are additional formats, but they
|
||
# are defined as "short"s; I think all the new formats are
|
||
# character-header formats and thus are strings, not numbers.
|
||
0 short 070707 cpio archive
|
||
!:mime application/x-cpio
|
||
0 short 0143561 byte-swapped cpio archive
|
||
!:mime application/x-cpio # encoding: swapped
|
||
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
|
||
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
|
||
0 string 070702 ASCII cpio archive (SVR4 with CRC)
|
||
|
||
#
|
||
# Various archive formats used by various versions of the "ar"
|
||
# command.
|
||
#
|
||
|
||
#
|
||
# Original UNIX archive formats.
|
||
# They were written with binary values in host byte order, and
|
||
# the magic number was a host "int", which might have been 16 bits
|
||
# or 32 bits. We don't say "PDP-11" or "VAX", as there might have
|
||
# been ports to little-endian 16-bit-int or 32-bit-int platforms
|
||
# (x86?) using some of those formats; if none existed, feel free
|
||
# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
|
||
# 32-bit. There might have been big-endian ports of that sort as
|
||
# well.
|
||
#
|
||
0 leshort 0177555 very old 16-bit-int little-endian archive
|
||
0 beshort 0177555 very old 16-bit-int big-endian archive
|
||
0 lelong 0177555 very old 32-bit-int little-endian archive
|
||
0 belong 0177555 very old 32-bit-int big-endian archive
|
||
|
||
0 leshort 0177545 old 16-bit-int little-endian archive
|
||
>2 string __.SYMDEF random library
|
||
0 beshort 0177545 old 16-bit-int big-endian archive
|
||
>2 string __.SYMDEF random library
|
||
0 lelong 0177545 old 32-bit-int little-endian archive
|
||
>4 string __.SYMDEF random library
|
||
0 belong 0177545 old 32-bit-int big-endian archive
|
||
>4 string __.SYMDEF random library
|
||
|
||
#
|
||
# From "pdp" (but why a 4-byte quantity?)
|
||
#
|
||
0 lelong 0x39bed PDP-11 old archive
|
||
0 lelong 0x39bee PDP-11 4.0 archive
|
||
|
||
#
|
||
# XXX - what flavor of APL used this, and was it a variant of
|
||
# some ar archive format? It's similar to, but not the same
|
||
# as, the APL workspace magic numbers in pdp.
|
||
#
|
||
0 long 0100554 apl workspace
|
||
|
||
#
|
||
# System V Release 1 portable(?) archive format.
|
||
#
|
||
0 string =<ar> System V Release 1 ar archive
|
||
!:mime application/x-archive
|
||
|
||
#
|
||
# Debian package; it's in the portable archive format, and needs to go
|
||
# before the entry for regular portable archives, as it's recognized as
|
||
# a portable archive whose first member has a name beginning with
|
||
# "debian".
|
||
#
|
||
0 string =!<arch>\ndebian
|
||
!:mime application/x-debian-package
|
||
>8 string debian-split part of multipart Debian package
|
||
>8 string debian-binary Debian binary package
|
||
>8 string !debian
|
||
>68 string >\0 (format %s)
|
||
# These next two lines do not work, because a bzip2 Debian archive
|
||
# still uses gzip for the control.tar (first in the archive). Only
|
||
# data.tar varies, and the location of its filename varies too.
|
||
# file/libmagic does not current have support for ascii-string based
|
||
# (offsets) as of 2005-09-15.
|
||
#>81 string bz2 \b, uses bzip2 compression
|
||
#>84 string gz \b, uses gzip compression
|
||
#>136 ledate x created: %s
|
||
|
||
#
|
||
# MIPS archive; they're in the portable archive format, and need to go
|
||
# before the entry for regular portable archives, as it's recognized as
|
||
# a portable archive whose first member has a name beginning with
|
||
# "__________E".
|
||
#
|
||
0 string =!<arch>\n__________E MIPS archive
|
||
!:mime application/x-archive
|
||
>20 string U with MIPS Ucode members
|
||
>21 string L with MIPSEL members
|
||
>21 string B with MIPSEB members
|
||
>19 string L and an EL hash table
|
||
>19 string B and an EB hash table
|
||
>22 string X -- out of date
|
||
|
||
0 search/1 -h- Software Tools format archive text
|
||
|
||
#
|
||
# BSD/SVR2-and-later portable archive formats.
|
||
#
|
||
0 string =!<arch> current ar archive
|
||
!:mime application/x-archive
|
||
>8 string __.SYMDEF random library
|
||
>68 string __.SYMDEF\ SORTED random library
|
||
|
||
#
|
||
# "Thin" archive, as can be produced by GNU ar.
|
||
#
|
||
0 string =!<thin>\n thin archive with
|
||
>68 belong 0 no symbol entries
|
||
>68 belong 1 %d symbol entry
|
||
>68 belong >1 %d symbol entries
|
||
|
||
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
#
|
||
# The first byte is the magic (0x1a), byte 2 is the compression type for
|
||
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
|
||
# filename of the first file (null terminated). Since some types collide
|
||
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
|
||
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
|
||
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
|
||
!:mime application/x-arc
|
||
# [JW] stuff taken from idarc, obviously ARC successors:
|
||
0 lelong&0x8080ffff 0x00000a1a PAK archive data
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000141a ARC+ archive data
|
||
!:mime application/x-arc
|
||
0 lelong&0x8080ffff 0x0000481a HYP archive data
|
||
!:mime application/x-arc
|
||
|
||
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
|
||
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
|
||
# [GRR: the original entries collide with ARC, above; replaced with combined
|
||
# version (not tested)]
|
||
#0 byte 0x1a RISC OS archive (spark format)
|
||
0 string \032archive RISC OS archive (ArcFS format)
|
||
0 string Archive\000 RISC OS archive (ArcFS format)
|
||
|
||
# All these were taken from idarc, many could not be verified. Unfortunately,
|
||
# there were many low-quality sigs, i.e. easy to trigger false positives.
|
||
# Please notify me of any real-world fishy/ambiguous signatures and I'll try
|
||
# to get my hands on the actual archiver and see if I find something better. [JW]
|
||
# probably many can be enhanced by finding some 0-byte or control char near the start
|
||
|
||
# idarc calls this Crush/Uncompressed... *shrug*
|
||
0 string CRUSH Crush archive data
|
||
# Squeeze It (.sqz)
|
||
0 string HLSQZ Squeeze It archive data
|
||
# SQWEZ
|
||
0 string SQWEZ SQWEZ archive data
|
||
# HPack (.hpk)
|
||
0 string HPAK HPack archive data
|
||
# HAP
|
||
0 string \x91\x33HF HAP archive data
|
||
# MD/MDCD
|
||
0 string MDmd MDCD archive data
|
||
# LIM
|
||
0 string LIM\x1a LIM archive data
|
||
# SAR
|
||
3 string LH5 SAR archive data
|
||
# BSArc/BS2
|
||
0 string \212\3SB\020\0 BSArc/BS2 archive data
|
||
# Bethesda Softworks Archive (Oblivion)
|
||
0 string BSA\0 BSArc archive data
|
||
>4 lelong x version %d
|
||
# MAR
|
||
2 string =-ah MAR archive data
|
||
# ACB
|
||
#0 belong&0x00f800ff 0x00800000 ACB archive data
|
||
# CPZ
|
||
# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
|
||
# JRC
|
||
0 string JRchive JRC archive data
|
||
# Quantum
|
||
0 string DS\0 Quantum archive data
|
||
# ReSOF
|
||
0 string PK\3\6 ReSOF archive data
|
||
# QuArk
|
||
0 string 7\4 QuArk archive data
|
||
# YAC
|
||
14 string YC YAC archive data
|
||
# X1
|
||
0 string X1 X1 archive data
|
||
0 string XhDr X1 archive data
|
||
# CDC Codec (.dqt)
|
||
0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
|
||
# AMGC
|
||
0 string \xad6" AMGC archive data
|
||
# NuLIB
|
||
0 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
|
||
# PakLeo
|
||
0 string LEOLZW PAKLeo archive data
|
||
# ChArc
|
||
0 string SChF ChArc archive data
|
||
# PSA
|
||
0 string PSA PSA archive data
|
||
# CrossePAC
|
||
0 string DSIGDCC CrossePAC archive data
|
||
# Freeze
|
||
0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
|
||
# KBoom
|
||
0 string \xc2\xa8MP\xc2\xa8 KBoom archive data
|
||
# NSQ, must go after CDC Codec
|
||
0 string \x76\xff NSQ archive data
|
||
# DPA
|
||
0 string Dirk\ Paehl DPA archive data
|
||
# BA
|
||
# TODO: idarc says "bytes 0-2 == bytes 3-5"
|
||
# TTComp
|
||
0 string \0\6 TTComp archive data
|
||
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
|
||
0 string ESP ESP archive data
|
||
# ZPack
|
||
0 string \1ZPK\1 ZPack archive data
|
||
# Sky
|
||
0 string \xbc\x40 Sky archive data
|
||
# UFA
|
||
0 string UFA UFA archive data
|
||
# Dry
|
||
0 string =-H2O DRY archive data
|
||
# FoxSQZ
|
||
0 string FOXSQZ FoxSQZ archive data
|
||
# AR7
|
||
0 string ,AR7 AR7 archive data
|
||
# PPMZ
|
||
0 string PPMZ PPMZ archive data
|
||
# MS Compress
|
||
4 string \x88\xf0\x27 MS Compress archive data
|
||
# updated by Joerg Jenderek
|
||
>9 string \0
|
||
>>0 string KWAJ
|
||
>>>7 string \321\003 MS Compress archive data
|
||
>>>>14 ulong >0 \b, original size: %ld bytes
|
||
>>>>18 ubyte >0x65
|
||
>>>>>18 string x \b, was %.8s
|
||
>>>>>(10.b-4) string x \b.%.3s
|
||
# MP3 (archiver, not lossy audio compression)
|
||
0 string MP3\x1a MP3-Archiver archive data
|
||
# ZET
|
||
0 string OZ\xc3\x9d ZET archive data
|
||
# TSComp
|
||
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
|
||
# ARQ
|
||
0 string gW\4\1 ARQ archive data
|
||
# Squash
|
||
3 string OctSqu Squash archive data
|
||
# Terse
|
||
0 string \5\1\1\0 Terse archive data
|
||
# PUCrunch
|
||
0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
|
||
# UHarc
|
||
0 string UHA UHarc archive data
|
||
# ABComp
|
||
0 string \2AB ABComp archive data
|
||
0 string \3AB2 ABComp archive data
|
||
# CMP
|
||
0 string CO\0 CMP archive data
|
||
# Splint
|
||
0 string \x93\xb9\x06 Splint archive data
|
||
# InstallShield
|
||
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
|
||
# Gather
|
||
1 string GTH Gather archive data
|
||
# BOA
|
||
0 string BOA BOA archive data
|
||
# RAX
|
||
0 string ULEB\xa RAX archive data
|
||
# Xtreme
|
||
0 string ULEB\0 Xtreme archive data
|
||
# Pack Magic
|
||
0 string @\xc3\xa2\1\0 Pack Magic archive data
|
||
# BTS
|
||
0 belong&0xfeffffff 0x1a034465 BTS archive data
|
||
# ELI 5750
|
||
0 string Ora\ ELI 5750 archive data
|
||
# QFC
|
||
0 string \x1aFC\x1a QFC archive data
|
||
0 string \x1aQF\x1a QFC archive data
|
||
# PRO-PACK
|
||
0 string RNC PRO-PACK archive data
|
||
# 777
|
||
0 string 777 777 archive data
|
||
# LZS221
|
||
0 string sTaC LZS221 archive data
|
||
# HPA
|
||
0 string HPA HPA archive data
|
||
# Arhangel
|
||
0 string LG Arhangel archive data
|
||
# EXP1, uses bzip2
|
||
0 string 0123456789012345BZh EXP1 archive data
|
||
# IMP
|
||
0 string IMP\xa IMP archive data
|
||
# NRV
|
||
0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
|
||
# Squish
|
||
0 string \x73\xb2\x90\xf4 Squish archive data
|
||
# Par
|
||
0 string PHILIPP Par archive data
|
||
0 string PAR Par archive data
|
||
# HIT
|
||
0 string UB HIT archive data
|
||
# SBX
|
||
0 belong&0xfffff000 0x53423000 SBX archive data
|
||
# NaShrink
|
||
0 string NSK NaShrink archive data
|
||
# SAPCAR
|
||
0 string #\ CAR\ archive\ header SAPCAR archive data
|
||
0 string CAR\ 2.00RG SAPCAR archive data
|
||
# Disintegrator
|
||
0 string DST Disintegrator archive data
|
||
# ASD
|
||
0 string ASD ASD archive data
|
||
# InstallShield CAB
|
||
0 string ISc( InstallShield CAB
|
||
# TOP4
|
||
0 string T4\x1a TOP4 archive data
|
||
# BatComp left out: sig looks like COM executable
|
||
# so TODO: get real 4dos batcomp file and find sig
|
||
# BlakHole
|
||
0 string BH\5\7 BlakHole archive data
|
||
# BIX
|
||
0 string BIX0 BIX archive data
|
||
# ChiefLZA
|
||
0 string ChfLZ ChiefLZA archive data
|
||
# Blink
|
||
0 string Blink Blink archive data
|
||
# Logitech Compress
|
||
0 string \xda\xfa Logitech Compress archive data
|
||
# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
|
||
1 string (C)\ STEPANYUK ARS-Sfx archive data
|
||
# AKT/AKT32
|
||
0 string AKT32 AKT32 archive data
|
||
0 string AKT AKT archive data
|
||
# NPack
|
||
0 string MSTSM NPack archive data
|
||
# PFT
|
||
0 string \0\x50\0\x14 PFT archive data
|
||
# SemOne
|
||
0 string SEM SemOne archive data
|
||
# PPMD
|
||
0 string \x8f\xaf\xac\x84 PPMD archive data
|
||
# FIZ
|
||
0 string FIZ FIZ archive data
|
||
# MSXiE
|
||
0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
|
||
# DeepFreezer
|
||
0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
|
||
# DC
|
||
0 string =<DC- DC archive data
|
||
# TPac
|
||
0 string \4TPAC\3 TPac archive data
|
||
# Ai
|
||
0 string Ai\1\1\0 Ai archive data
|
||
0 string Ai\1\0\0 Ai archive data
|
||
# Ai32
|
||
0 string Ai\2\0 Ai32 archive data
|
||
0 string Ai\2\1 Ai32 archive data
|
||
# SBC
|
||
0 string SBC SBC archive data
|
||
# Ybs
|
||
0 string YBS Ybs archive data
|
||
# DitPack
|
||
0 string \x9e\0\0 DitPack archive data
|
||
# DMS
|
||
0 string DMS! DMS archive data
|
||
# EPC
|
||
0 string \x8f\xaf\xac\x8c EPC archive data
|
||
# VSARC
|
||
0 string VS\x1a VSARC archive data
|
||
# PDZ
|
||
0 string PDZ PDZ archive data
|
||
# ReDuq
|
||
0 string rdqx ReDuq archive data
|
||
# GCA
|
||
0 string GCAX GCA archive data
|
||
# PPMN
|
||
0 string pN PPMN archive data
|
||
# WinImage
|
||
3 string WINIMAGE WinImage archive data
|
||
# Compressia
|
||
0 string CMP0CMP Compressia archive data
|
||
# UHBC
|
||
0 string UHB UHBC archive data
|
||
# WinHKI
|
||
0 string \x61\x5C\x04\x05 WinHKI archive data
|
||
# WWPack data file
|
||
0 string WWP WWPack archive data
|
||
# BSN (BSA, PTS-DOS)
|
||
0 string \xffBSG BSN archive data
|
||
1 string \xffBSG BSN archive data
|
||
3 string \xffBSG BSN archive data
|
||
1 string \0\xae\2 BSN archive data
|
||
1 string \0\xae\3 BSN archive data
|
||
1 string \0\xae\7 BSN archive data
|
||
# AIN
|
||
0 string \x33\x18 AIN archive data
|
||
0 string \x33\x17 AIN archive data
|
||
# XPA32
|
||
0 string xpa\0\1 XPA32 archive data
|
||
# SZip (TODO: doesn't catch all versions)
|
||
0 string SZ\x0a\4 SZip archive data
|
||
# XPack DiskImage
|
||
0 string jm XPack DiskImage archive data
|
||
# XPack Data
|
||
0 string xpa XPack archive data
|
||
# XPack Single Data
|
||
0 string \xc3\x8d\ jm XPack single archive data
|
||
|
||
# TODO: missing due to unknown magic/magic at end of file:
|
||
#DWC
|
||
#ARG
|
||
#ZAR
|
||
#PC/3270
|
||
#InstallIt
|
||
#RKive
|
||
#RK
|
||
#XPack Diskimage
|
||
|
||
# These were inspired by idarc, but actually verified
|
||
# Dzip archiver (.dz)
|
||
0 string DZ Dzip archive data
|
||
>2 byte x \b, version %i
|
||
>3 byte x \b.%i
|
||
# ZZip archiver (.zz)
|
||
0 string ZZ\ \0\0 ZZip archive data
|
||
0 string ZZ0 ZZip archive data
|
||
# PAQ archiver (.paq)
|
||
0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
|
||
0 string PAQ PAQ archive data
|
||
>3 byte&0xf0 0x30
|
||
>>3 byte x (v%c)
|
||
# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
|
||
0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
|
||
0 string JARCS JAR (ARJ Software, Inc.) archive data
|
||
|
||
# ARJ archiver (jason@jarthur.Claremont.EDU)
|
||
0 leshort 0xea60 ARJ archive data
|
||
!:mime application/x-arj
|
||
>5 byte x \b, v%d,
|
||
>8 byte &0x04 multi-volume,
|
||
>8 byte &0x10 slash-switched,
|
||
>8 byte &0x20 backup,
|
||
>34 string x original name: %s,
|
||
>7 byte 0 os: MS-DOS
|
||
>7 byte 1 os: PRIMOS
|
||
>7 byte 2 os: Unix
|
||
>7 byte 3 os: Amiga
|
||
>7 byte 4 os: Macintosh
|
||
>7 byte 5 os: OS/2
|
||
>7 byte 6 os: Apple ][ GS
|
||
>7 byte 7 os: Atari ST
|
||
>7 byte 8 os: NeXT
|
||
>7 byte 9 os: VAX/VMS
|
||
>3 byte >0 %d]
|
||
# [JW] idarc says this is also possible
|
||
2 leshort 0xea60 ARJ archive data
|
||
|
||
# HA archiver (Greg Roelofs, newt@uchicago.edu)
|
||
# This is a really bad format. A file containing HAWAII will match this...
|
||
#0 string HA HA archive data,
|
||
#>2 leshort =1 1 file,
|
||
#>2 leshort >1 %u files,
|
||
#>4 byte&0x0f =0 first is type CPY
|
||
#>4 byte&0x0f =1 first is type ASC
|
||
#>4 byte&0x0f =2 first is type HSC
|
||
#>4 byte&0x0f =0x0e first is type DIR
|
||
#>4 byte&0x0f =0x0f first is type SPECIAL
|
||
# suggestion: at least identify small archives (<1024 files)
|
||
0 belong&0xffff00fc 0x48410000 HA archive data
|
||
>2 leshort =1 1 file,
|
||
>2 leshort >1 %u files,
|
||
>4 byte&0x0f =0 first is type CPY
|
||
>4 byte&0x0f =1 first is type ASC
|
||
>4 byte&0x0f =2 first is type HSC
|
||
>4 byte&0x0f =0x0e first is type DIR
|
||
>4 byte&0x0f =0x0f first is type SPECIAL
|
||
|
||
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
|
||
0 string HPAK HPACK archive data
|
||
|
||
# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
|
||
0 string \351,\001JAM\ JAM archive,
|
||
>7 string >\0 version %.4s
|
||
>0x26 byte =0x27 -
|
||
>>0x2b string >\0 label %.11s,
|
||
>>0x27 lelong x serial %08x,
|
||
>>0x36 string >\0 fstype %.8s
|
||
|
||
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
|
||
2 string -lh0- LHarc 1.x/ARX archive data [lh0]
|
||
!:mime application/x-lharc
|
||
2 string -lh1- LHarc 1.x/ARX archive data [lh1]
|
||
!:mime application/x-lharc
|
||
2 string -lz4- LHarc 1.x archive data [lz4]
|
||
!:mime application/x-lharc
|
||
2 string -lz5- LHarc 1.x archive data [lz5]
|
||
!:mime application/x-lharc
|
||
# [never seen any but the last; -lh4- reported in comp.compression:]
|
||
2 string -lzs- LHa/LZS archive data [lzs]
|
||
!:mime application/x-lha
|
||
2 string -lh\40- LHa 2.x? archive data [lh ]
|
||
!:mime application/x-lha
|
||
2 string -lhd- LHa 2.x? archive data [lhd]
|
||
!:mime application/x-lha
|
||
2 string -lh2- LHa 2.x? archive data [lh2]
|
||
!:mime application/x-lha
|
||
2 string -lh3- LHa 2.x? archive data [lh3]
|
||
!:mime application/x-lha
|
||
2 string -lh4- LHa (2.x) archive data [lh4]
|
||
!:mime application/x-lha
|
||
2 string -lh5- LHa (2.x) archive data [lh5]
|
||
!:mime application/x-lha
|
||
2 string -lh6- LHa (2.x) archive data [lh6]
|
||
!:mime application/x-lha
|
||
2 string -lh7- LHa (2.x)/LHark archive data [lh7]
|
||
!:mime application/x-lha
|
||
>20 byte x - header level %d
|
||
# taken from idarc [JW]
|
||
2 string -lZ PUT archive data
|
||
2 string -lz LZS archive data
|
||
2 string -sw1- Swag archive data
|
||
|
||
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
|
||
0 string Rar! RAR archive data,
|
||
!:mime application/x-rar
|
||
>44 byte x v%0x,
|
||
>10 byte >0 flags:
|
||
>>10 byte &0x01 Archive volume,
|
||
>>10 byte &0x02 Commented,
|
||
>>10 byte &0x04 Locked,
|
||
>>10 byte &0x08 Solid,
|
||
>>10 byte &0x20 Authenticated,
|
||
>35 byte 0 os: MS-DOS
|
||
>35 byte 1 os: OS/2
|
||
>35 byte 2 os: Win32
|
||
>35 byte 3 os: Unix
|
||
# some old version? idarc says:
|
||
0 string RE\x7e\x5e RAR archive data
|
||
|
||
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
|
||
0 string SQSH squished archive data (Acorn RISCOS)
|
||
|
||
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
|
||
# [JW] see exe section for self-extracting version
|
||
0 string UC2\x1a UC2 archive data
|
||
|
||
# PKZIP multi-volume archive
|
||
0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
|
||
!:mime application/zip
|
||
|
||
# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
|
||
0 string PK\005\006 Zip archive data (empty)
|
||
0 string PK\003\004
|
||
|
||
# Specialised zip formats which start with a member named 'mimetype'
|
||
# (stored uncompressed, with no 'extra field') containing the file's MIME type.
|
||
# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
|
||
# contents starting with "application/":
|
||
>26 string \x8\0\0\0mimetypeapplication/
|
||
|
||
# KOffice / OpenOffice & StarOffice / OpenDocument formats
|
||
# From: Abel Cheung <abel@oaka.org>
|
||
|
||
# KOffice (1.2 or above) formats
|
||
# (mimetype contains "application/vnd.kde.<SUBTYPE>")
|
||
>>50 string vnd.kde. KOffice (>=1.2)
|
||
>>>58 string karbon Karbon document
|
||
>>>58 string kchart KChart document
|
||
>>>58 string kformula KFormula document
|
||
>>>58 string kivio Kivio document
|
||
>>>58 string kontour Kontour document
|
||
>>>58 string kpresenter KPresenter document
|
||
>>>58 string kspread KSpread document
|
||
>>>58 string kword KWord document
|
||
|
||
# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
|
||
# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
|
||
>>50 string vnd.sun.xml. OpenOffice.org 1.x
|
||
>>>62 string writer Writer
|
||
>>>>68 byte !0x2e document
|
||
>>>>68 string .template template
|
||
>>>>68 string .global global document
|
||
>>>62 string calc Calc
|
||
>>>>66 byte !0x2e spreadsheet
|
||
>>>>66 string .template template
|
||
>>>62 string draw Draw
|
||
>>>>66 byte !0x2e document
|
||
>>>>66 string .template template
|
||
>>>62 string impress Impress
|
||
>>>>69 byte !0x2e presentation
|
||
>>>>69 string .template template
|
||
>>>62 string math Math document
|
||
>>>62 string base Database file
|
||
|
||
# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
|
||
# http://lists.oasis-open.org/archives/office/200505/msg00006.html
|
||
# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
|
||
>>50 string vnd.oasis.opendocument. OpenDocument
|
||
>>>73 string text
|
||
>>>>77 byte !0x2d Text
|
||
!:mime application/vnd.oasis.opendocument.text
|
||
>>>>77 string -template Text Template
|
||
!:mime application/vnd.oasis.opendocument.text-template
|
||
>>>>77 string -web HTML Document Template
|
||
!:mime application/vnd.oasis.opendocument.text-web
|
||
>>>>77 string -master Master Document
|
||
!:mime application/vnd.oasis.opendocument.text-master
|
||
>>>73 string graphics
|
||
>>>>81 byte !0x2d Drawing
|
||
!:mime application/vnd.oasis.opendocument.graphics
|
||
>>>>81 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.graphics-template
|
||
>>>73 string presentation
|
||
>>>>85 byte !0x2d Presentation
|
||
!:mime application/vnd.oasis.opendocument.presentation
|
||
>>>>85 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.presentation-template
|
||
>>>73 string spreadsheet
|
||
>>>>84 byte !0x2d Spreadsheet
|
||
!:mime application/vnd.oasis.opendocument.spreadsheet
|
||
>>>>84 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.spreadsheet-template
|
||
>>>73 string chart
|
||
>>>>78 byte !0x2d Chart
|
||
!:mime application/vnd.oasis.opendocument.chart
|
||
>>>>78 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.chart-template
|
||
>>>73 string formula
|
||
>>>>80 byte !0x2d Formula
|
||
!:mime application/vnd.oasis.opendocument.formula
|
||
>>>>80 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.formula-template
|
||
>>>73 string database Database
|
||
!:mime application/vnd.oasis.opendocument.database
|
||
>>>73 string image
|
||
>>>>78 byte !0x2d Image
|
||
!:mime application/vnd.oasis.opendocument.image
|
||
>>>>78 string -template Template
|
||
!:mime application/vnd.oasis.opendocument.image-template
|
||
|
||
# EPUB (OEBPS) books using OCF (OEBPS Container Format)
|
||
# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
|
||
# From: Ralf Brown <ralf.brown@gmail.com>
|
||
>0x1E string mimetypeapplication/epub+zip EPUB document
|
||
!:mime application/epub+zip
|
||
|
||
# Catch other ZIP-with-mimetype formats
|
||
# In a ZIP file, the bytes immediately after a member's contents are
|
||
# always "PK". The 2 regex rules here print the "mimetype" member's
|
||
# contents up to the first 'P'. Luckily, most MIME types don't contain
|
||
# any capital 'P's. This is a kludge.
|
||
# (mimetype contains "application/<OTHER>")
|
||
>>50 string !epub+zip
|
||
>>>50 string !vnd.oasis.opendocument.
|
||
>>>>50 string !vnd.sun.xml.
|
||
>>>>>50 string !vnd.kde.
|
||
>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
|
||
!:mime application/zip
|
||
# (mimetype contents other than "application/*")
|
||
>26 string \x8\0\0\0mimetype
|
||
>>38 string !application/
|
||
>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
|
||
!:mime application/zip
|
||
|
||
# Java Jar files
|
||
>(26.s+30) leshort 0xcafe Java Jar file data (zip)
|
||
!:mime application/jar
|
||
|
||
# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
|
||
# Next line excludes specialized formats:
|
||
>(26.s+30) leshort !0xcafe
|
||
>>26 string !\x8\0\0\0mimetype Zip archive data
|
||
!:mime application/zip
|
||
>>>4 byte 0x09 \b, at least v0.9 to extract
|
||
>>>4 byte 0x0a \b, at least v1.0 to extract
|
||
>>>4 byte 0x0b \b, at least v1.1 to extract
|
||
>>>4 byte 0x14 \b, at least v2.0 to extract
|
||
>>>4 byte 0x2d \b, at least v3.0 to extract
|
||
>>>0x161 string WINZIP \b, WinZIP self-extracting
|
||
|
||
# StarView Metafile
|
||
# From Pierre Ducroquet <pinaraf@pinaraf.info>
|
||
0 string VCLMTF StarView MetaFile
|
||
>6 beshort x \b, version %d
|
||
>8 belong x \b, size %d
|
||
|
||
# Zoo archiver
|
||
20 lelong 0xfdc4a7dc Zoo archive data
|
||
!:mime application/x-zoo
|
||
>4 byte >48 \b, v%c.
|
||
>>6 byte >47 \b%c
|
||
>>>7 byte >47 \b%c
|
||
>32 byte >0 \b, modify: v%d
|
||
>>33 byte x \b.%d+
|
||
>42 lelong 0xfdc4a7dc \b,
|
||
>>70 byte >0 extract: v%d
|
||
>>>71 byte x \b.%d+
|
||
|
||
# Shell archives
|
||
10 string #\ This\ is\ a\ shell\ archive shell archive text
|
||
!:mime application/octet-stream
|
||
|
||
#
|
||
# LBR. NB: May conflict with the questionable
|
||
# "binary Computer Graphics Metafile" format.
|
||
#
|
||
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
|
||
#
|
||
# PMA (CP/M derivative of LHA)
|
||
#
|
||
2 string -pm0- PMarc archive data [pm0]
|
||
2 string -pm1- PMarc archive data [pm1]
|
||
2 string -pm2- PMarc archive data [pm2]
|
||
2 string -pms- PMarc SFX archive (CP/M, DOS)
|
||
5 string -pc1- PopCom compressed executable (CP/M)
|
||
|
||
# From Rafael Laboissiere <rafael@laboissiere.net>
|
||
# The Project Revision Control System (see
|
||
# http://prcs.sourceforge.net) generates a packaged project
|
||
# file which is recognized by the following entry:
|
||
0 leshort 0xeb81 PRCS packaged project
|
||
|
||
# Microsoft cabinets
|
||
# by David Necas (Yeti) <yeti@physics.muni.cz>
|
||
#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
|
||
#>25 byte x v%d
|
||
#>24 byte x \b.%d
|
||
# MPi: All CABs have version 1.3, so this is pointless.
|
||
# Better magic in debian-additions.
|
||
|
||
# GTKtalog catalogs
|
||
# by David Necas (Yeti) <yeti@physics.muni.cz>
|
||
4 string gtktalog\ GTKtalog catalog data,
|
||
>13 string 3 version 3
|
||
>>14 beshort 0x677a (gzipped)
|
||
>>14 beshort !0x677a (not gzipped)
|
||
>13 string >3 version %s
|
||
|
||
############################################################################
|
||
# Parity archive reconstruction file, the 'par' file format now used on Usenet.
|
||
0 string PAR\0 PARity archive data
|
||
>48 leshort =0 - Index file
|
||
>48 leshort >0 - file number %d
|
||
|
||
# Felix von Leitner <felix-file@fefe.de>
|
||
0 string d8:announce BitTorrent file
|
||
!:mime application/x-bittorrent
|
||
|
||
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
|
||
0 beshort 0x0e0f Atari MSA archive data
|
||
>2 beshort x \b, %d sectors per track
|
||
>4 beshort 0 \b, 1 sided
|
||
>4 beshort 1 \b, 2 sided
|
||
>6 beshort x \b, starting track: %d
|
||
>8 beshort x \b, ending track: %d
|
||
|
||
# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
|
||
0 string PK00PK\003\004 Zip archive data
|
||
|
||
# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
|
||
# by Stefan `Sec` Zehl <sec@42.org>
|
||
7 string **ACE** ACE archive data
|
||
>15 byte >0 version %d
|
||
>16 byte =0x00 \b, from MS-DOS
|
||
>16 byte =0x01 \b, from OS/2
|
||
>16 byte =0x02 \b, from Win/32
|
||
>16 byte =0x03 \b, from Unix
|
||
>16 byte =0x04 \b, from MacOS
|
||
>16 byte =0x05 \b, from WinNT
|
||
>16 byte =0x06 \b, from Primos
|
||
>16 byte =0x07 \b, from AppleGS
|
||
>16 byte =0x08 \b, from Atari
|
||
>16 byte =0x09 \b, from Vax/VMS
|
||
>16 byte =0x0A \b, from Amiga
|
||
>16 byte =0x0B \b, from Next
|
||
>14 byte x \b, version %d to extract
|
||
>5 leshort &0x0080 \b, multiple volumes,
|
||
>>17 byte x \b (part %d),
|
||
>5 leshort &0x0002 \b, contains comment
|
||
>5 leshort &0x0200 \b, sfx
|
||
>5 leshort &0x0400 \b, small dictionary
|
||
>5 leshort &0x0800 \b, multi-volume
|
||
>5 leshort &0x1000 \b, contains AV-String
|
||
>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
|
||
>5 leshort &0x2000 \b, with recovery record
|
||
>5 leshort &0x4000 \b, locked
|
||
>5 leshort &0x8000 \b, solid
|
||
# Date in MS-DOS format (whatever that is)
|
||
#>18 lelong x Created on
|
||
|
||
# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
|
||
# <doj@cubic.org>
|
||
0x1A string sfArk sfArk compressed Soundfont
|
||
>0x15 string 2
|
||
>>0x1 string >\0 Version %s
|
||
>>0x2A string >\0 : %s
|
||
|
||
# DR-DOS 7.03 Packed File *.??_
|
||
0 string Packed\ File\ Personal NetWare Packed File
|
||
>12 string x \b, was "%.12s"
|
||
|
||
# EET archive
|
||
# From: Tilman Sauerbeck <tilman@code-monkey.de>
|
||
0 belong 0x1ee7ff00 EET archive
|
||
!:mime application/x-eet
|
||
|
||
# rzip archives
|
||
0 string RZIP rzip compressed data
|
||
>4 byte x - version %d
|
||
>5 byte x \b.%d
|
||
>6 belong x (%d bytes)
|
||
|
||
# From: "Robert Dale" <robdale@gmail.com>
|
||
0 belong 123 dar archive,
|
||
>4 belong x label "%.8x
|
||
>>8 belong x %.8x
|
||
>>>12 beshort x %.4x"
|
||
>14 byte 0x54 end slice
|
||
>14 beshort 0x4e4e multi-part
|
||
>14 beshort 0x4e53 multi-part, with -S
|
||
|
||
# Symbian installation files
|
||
# http://www.thouky.co.uk/software/psifs/sis.html
|
||
# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
|
||
8 lelong 0x10000419 Symbian installation file
|
||
!:mime application/vnd.symbian.install
|
||
>4 lelong 0x1000006D (EPOC release 3/4/5)
|
||
>4 lelong 0x10003A12 (EPOC release 6)
|
||
0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
|
||
!:mime x-epoc/x-sisx-app
|
||
|
||
# From "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
0 string MPQ\032 MoPaQ (MPQ) archive
|
||
|
||
# From: Dirk Jagdmann <doj@cubic.org>
|
||
# xar archive format: http://code.google.com/p/xar/
|
||
0 string xar! xar archive
|
||
>6 beshort x - version %ld
|
||
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
# .kgb
|
||
0 string KGB_arch KGB Archiver file
|
||
>10 string x with compression level %.1s
|
||
|
||
# xar (eXtensible ARchiver) archive
|
||
# From: "David Remahl" <dremahl@apple.com>
|
||
0 string xar! xar archive
|
||
#>4 beshort x header size %d
|
||
>6 beshort x version %d,
|
||
#>8 quad x compressed TOC: %d,
|
||
#>16 quad x uncompressed TOC: %d,
|
||
>24 belong 0 no checksum
|
||
>24 belong 1 SHA-1 checksum
|
||
>24 belong 2 MD5 checksum
|
||
|
||
# Type: Parity Archive
|
||
# From: Daniel van Eeden <daniel_e@dds.nl>
|
||
0 string PAR2 Parity Archive Volume Set
|
||
|
||
# Bacula volume format. (Volumes always start with a block header.)
|
||
# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
12 string BB02 Bacula volume
|
||
>20 bedate x \b, started %s
|
||
|
||
# ePub is XHTML + XML inside a ZIP archive. The first member of the
|
||
# archive must be an uncompressed file called 'mimetype' with contents
|
||
# 'application/epub+zip'
|
||
|
||
|
||
# From: "Michael Gorny" <mgorny@gentoo.org>
|
||
# ZPAQ: http://mattmahoney.net/dc/zpaq.html
|
||
0 string zPQ ZPAQ stream
|
||
>3 byte x \b, level %d
|
||
|
||
# BBeB ebook, unencrypted (LRF format)
|
||
# URL: http://www.sven.de/librie/Librie/LrfFormat
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
|
||
>8 beshort x \b, version %d
|
||
>36 byte 1 \b, front-to-back
|
||
>36 byte 16 \b, back-to-front
|
||
>42 beshort x \b, (%dx,
|
||
>44 beshort x %d)
|
||
#------------------------------------------------------------------------------
|
||
# $File: assembler,v 1.4 2013/01/04 23:31:11 christos Exp $
|
||
# make: file(1) magic for assembler source
|
||
#
|
||
0 regex \^[\020\t]*\\.asciiz assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.byte assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.even assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.globl assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.text assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.file assembler source text
|
||
!:mime text/x-asm
|
||
0 regex \^[\020\t]*\\.type assembler source text
|
||
!:mime text/x-asm
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
|
||
# strings as "long" - we assume they're just strings:
|
||
# From: guy@netapp.com (Guy Harris)
|
||
#
|
||
0 string *STA Aster*x
|
||
>7 string WORD Words Document
|
||
>7 string GRAP Graphic
|
||
>7 string SPRE Spreadsheet
|
||
>7 string MACR Macro
|
||
0 string 2278 Aster*x Version 2
|
||
>29 byte 0x36 Words Document
|
||
>29 byte 0x35 Graphic
|
||
>29 byte 0x32 Spreadsheet
|
||
>29 byte 0x38 Macro
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
|
||
# att3b: file(1) magic for AT&T 3B machines
|
||
#
|
||
# The `versions' should be un-commented if they work for you.
|
||
# (Was the problem just one of endianness?)
|
||
#
|
||
# 3B20
|
||
#
|
||
# The 3B20 conflicts with SCCS.
|
||
#0 beshort 0550 3b20 COFF executable
|
||
#>12 belong >0 not stripped
|
||
#>22 beshort >0 - version %ld
|
||
#0 beshort 0551 3b20 COFF executable (TV)
|
||
#>12 belong >0 not stripped
|
||
#>22 beshort >0 - version %ld
|
||
#
|
||
# WE32K
|
||
#
|
||
0 beshort 0560 WE32000 COFF
|
||
>18 beshort ^00000020 object
|
||
>18 beshort &00000020 executable
|
||
>12 belong >0 not stripped
|
||
>18 beshort ^00010000 N/A on 3b2/300 w/paging
|
||
>18 beshort &00020000 32100 required
|
||
>18 beshort &00040000 and MAU hardware required
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (pure)
|
||
>20 beshort 0413 (demand paged)
|
||
>20 beshort 0443 (target shared library)
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 0561 WE32000 COFF executable (TV)
|
||
>12 belong >0 not stripped
|
||
#>18 beshort &00020000 - 32100 required
|
||
#>18 beshort &00040000 and MAU hardware required
|
||
#>22 beshort >0 - version %ld
|
||
#
|
||
# core file for 3b2
|
||
0 string \000\004\036\212\200 3b2 core file
|
||
>364 string >\0 of '%s'
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $
|
||
# audio: file(1) magic for sound formats (see also "iff")
|
||
#
|
||
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
|
||
# and others
|
||
#
|
||
|
||
# Sun/NeXT audio data
|
||
0 string .snd Sun/NeXT audio data:
|
||
>12 belong 1 8-bit ISDN mu-law,
|
||
!:mime audio/basic
|
||
>12 belong 2 8-bit linear PCM [REF-PCM],
|
||
!:mime audio/basic
|
||
>12 belong 3 16-bit linear PCM,
|
||
!:mime audio/basic
|
||
>12 belong 4 24-bit linear PCM,
|
||
!:mime audio/basic
|
||
>12 belong 5 32-bit linear PCM,
|
||
!:mime audio/basic
|
||
>12 belong 6 32-bit IEEE floating point,
|
||
!:mime audio/basic
|
||
>12 belong 7 64-bit IEEE floating point,
|
||
!:mime audio/basic
|
||
>12 belong 8 Fragmented sample data,
|
||
>12 belong 10 DSP program,
|
||
>12 belong 11 8-bit fixed point,
|
||
>12 belong 12 16-bit fixed point,
|
||
>12 belong 13 24-bit fixed point,
|
||
>12 belong 14 32-bit fixed point,
|
||
>12 belong 18 16-bit linear with emphasis,
|
||
>12 belong 19 16-bit linear compressed,
|
||
>12 belong 20 16-bit linear with emphasis and compression,
|
||
>12 belong 21 Music kit DSP commands,
|
||
>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
|
||
!:mime audio/x-adpcm
|
||
>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
|
||
>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
|
||
>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
|
||
>12 belong 27 8-bit A-law (CCITT G.711),
|
||
>20 belong 1 mono,
|
||
>20 belong 2 stereo,
|
||
>20 belong 4 quad,
|
||
>16 belong >0 %d Hz
|
||
|
||
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
|
||
# that uses little-endian encoding and has a different magic number
|
||
0 lelong 0x0064732E DEC audio data:
|
||
>12 lelong 1 8-bit ISDN mu-law,
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 2 8-bit linear PCM [REF-PCM],
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 3 16-bit linear PCM,
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 4 24-bit linear PCM,
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 5 32-bit linear PCM,
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 6 32-bit IEEE floating point,
|
||
!:mime audio/x-dec-basic
|
||
>12 lelong 7 64-bit IEEE floating point,
|
||
!:mime audio/x-dec-basic
|
||
>12 belong 8 Fragmented sample data,
|
||
>12 belong 10 DSP program,
|
||
>12 belong 11 8-bit fixed point,
|
||
>12 belong 12 16-bit fixed point,
|
||
>12 belong 13 24-bit fixed point,
|
||
>12 belong 14 32-bit fixed point,
|
||
>12 belong 18 16-bit linear with emphasis,
|
||
>12 belong 19 16-bit linear compressed,
|
||
>12 belong 20 16-bit linear with emphasis and compression,
|
||
>12 belong 21 Music kit DSP commands,
|
||
>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
|
||
!:mime audio/x-dec-basic
|
||
>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
|
||
>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
|
||
>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
|
||
>12 belong 27 8-bit A-law (CCITT G.711),
|
||
>20 lelong 1 mono,
|
||
>20 lelong 2 stereo,
|
||
>20 lelong 4 quad,
|
||
>16 lelong >0 %d Hz
|
||
|
||
# Creative Labs AUDIO stuff
|
||
0 string MThd Standard MIDI data
|
||
!:mime audio/midi
|
||
>8 beshort x (format %d)
|
||
>10 beshort x using %d track
|
||
>10 beshort >1 \bs
|
||
>12 beshort&0x7fff x at 1/%d
|
||
>12 beshort&0x8000 >0 SMPTE
|
||
|
||
0 string CTMF Creative Music (CMF) data
|
||
!:mime audio/x-unknown
|
||
0 string SBI SoundBlaster instrument data
|
||
!:mime audio/x-unknown
|
||
0 string Creative\ Voice\ File Creative Labs voice data
|
||
!:mime audio/x-unknown
|
||
# is this next line right? it came this way...
|
||
>19 byte 0x1A
|
||
>23 byte >0 - version %d
|
||
>22 byte >0 \b.%d
|
||
|
||
# first entry is also the string "NTRK"
|
||
0 belong 0x4e54524b MultiTrack sound data
|
||
>4 belong x - version %ld
|
||
|
||
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
|
||
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
|
||
0 string EMOD Extended MOD sound data,
|
||
>4 byte&0xf0 x version %d
|
||
>4 byte&0x0f x \b.%d,
|
||
>45 byte x %d instruments
|
||
>83 byte 0 (module)
|
||
>83 byte 1 (song)
|
||
|
||
# Real Audio (Magic .ra\0375)
|
||
0 belong 0x2e7261fd RealAudio sound file
|
||
!:mime audio/x-pn-realaudio
|
||
0 string .RMF\0\0\0 RealMedia file
|
||
!:mime application/vnd.rn-realmedia
|
||
#video/x-pn-realvideo
|
||
#video/vnd.rn-realvideo
|
||
#application/vnd.rn-realmedia
|
||
# sigh, there are many mimes for that but the above are the most common.
|
||
|
||
# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
|
||
# Oct 31, 1995
|
||
# fixed by <doj@cubic.org> 2003-06-24
|
||
# Too short...
|
||
#0 string MTM MultiTracker Module sound file
|
||
#0 string if Composer 669 Module sound data
|
||
#0 string JN Composer 669 Module sound data (extended format)
|
||
0 string MAS_U ULT(imate) Module sound data
|
||
|
||
#0 string FAR Module sound data
|
||
#>4 string >\15 Title: "%s"
|
||
|
||
0x2c string SCRM ScreamTracker III Module sound data
|
||
>0 string >\0 Title: "%s"
|
||
|
||
# Gravis UltraSound patches
|
||
# From <ache@nagual.ru>
|
||
|
||
0 string GF1PATCH110\0ID#000002\0 GUS patch
|
||
0 string GF1PATCH100\0ID#000002\0 Old GUS patch
|
||
|
||
# mime types according to http://www.geocities.com/nevilo/mod.htm:
|
||
# audio/it .it
|
||
# audio/x-zipped-it .itz
|
||
# audio/xm fasttracker modules
|
||
# audio/x-s3m screamtracker modules
|
||
# audio/s3m screamtracker modules
|
||
# audio/x-zipped-mod mdz
|
||
# audio/mod mod
|
||
# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
|
||
|
||
#
|
||
# Taken from loader code from mikmod version 2.14
|
||
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
|
||
# <doj@cubic.org> added title printing on 2003-06-24
|
||
0 string MAS_UTrack_V00
|
||
>14 string >/0 ultratracker V1.%.1s module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-tracker-module
|
||
|
||
0 string UN05 MikMod UNI format module sound data
|
||
|
||
0 string Extended\ Module: Fasttracker II module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-tracker-module
|
||
>17 string >\0 Title: "%s"
|
||
|
||
21 string/c =!SCREAM! Screamtracker 2 module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-screamtracker-module
|
||
21 string BMOD2STM Screamtracker 2 module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-screamtracker-module
|
||
1080 string M.K. 4-channel Protracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-protracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string M!K! 4-channel Protracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-protracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string FLT4 4-channel Startracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-startracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string FLT8 8-channel Startracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-startracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string 4CHN 4-channel Fasttracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-fasttracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string 6CHN 6-channel Fasttracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-fasttracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string 8CHN 8-channel Fasttracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-fasttracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string CD81 8-channel Octalyser module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-octalysertracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string OKTA 8-channel Octalyzer module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-octalysertracker-module
|
||
>0 string >\0 Title: "%s"
|
||
# Not good enough.
|
||
#1082 string CH
|
||
#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
|
||
1080 string 16CN 16-channel Taketracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-taketracker-module
|
||
>0 string >\0 Title: "%s"
|
||
1080 string 32CN 32-channel Taketracker module sound data
|
||
!:mime audio/x-mod
|
||
#audio/x-taketracker-module
|
||
>0 string >\0 Title: "%s"
|
||
|
||
# TOC sound files -Trevor Johnson <trevor@jpj.net>
|
||
#
|
||
0 string TOC TOC sound file
|
||
|
||
# sidfiles <pooka@iki.fi>
|
||
# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
|
||
0 string SIDPLAY\ INFOFILE Sidplay info file
|
||
|
||
0 string PSID PlaySID v2.2+ (AMIGA) sidtune
|
||
>4 beshort >0 w/ header v%d,
|
||
>14 beshort =1 single song,
|
||
>14 beshort >1 %d songs,
|
||
>16 beshort >0 default song: %d
|
||
>0x16 string >\0 name: "%s"
|
||
>0x36 string >\0 author: "%s"
|
||
>0x56 string >\0 copyright: "%s"
|
||
|
||
0 string RSID RSID sidtune PlaySID compatible
|
||
>4 beshort >0 w/ header v%d,
|
||
>14 beshort =1 single song,
|
||
>14 beshort >1 %d songs,
|
||
>16 beshort >0 default song: %d
|
||
>0x16 string >\0 name: "%s"
|
||
>0x36 string >\0 author: "%s"
|
||
>0x56 string >\0 copyright: "%s"
|
||
|
||
# IRCAM sound files - Michael Pruett <michael@68k.org>
|
||
# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
|
||
0 belong 0x64a30100 IRCAM file (VAX little-endian)
|
||
0 belong 0x0001a364 IRCAM file (VAX big-endian)
|
||
0 belong 0x64a30200 IRCAM file (Sun big-endian)
|
||
0 belong 0x0002a364 IRCAM file (Sun little-endian)
|
||
0 belong 0x64a30300 IRCAM file (MIPS little-endian)
|
||
0 belong 0x0003a364 IRCAM file (MIPS big-endian)
|
||
0 belong 0x64a30400 IRCAM file (NeXT big-endian)
|
||
0 belong 0x64a30400 IRCAM file (NeXT big-endian)
|
||
0 belong 0x0004a364 IRCAM file (NeXT little-endian)
|
||
|
||
# NIST SPHERE <mpruett@sgi.com>
|
||
0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
|
||
|
||
# Sample Vision <mpruett@sgi.com>
|
||
0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
|
||
|
||
# Audio Visual Research <tonigonenstein@users.sourceforge.net>
|
||
0 string 2BIT Audio Visual Research file,
|
||
>12 beshort =0 mono,
|
||
>12 beshort =-1 stereo,
|
||
>14 beshort x %d bits
|
||
>16 beshort =0 unsigned,
|
||
>16 beshort =-1 signed,
|
||
>22 belong&0x00ffffff x %d Hz,
|
||
>18 beshort =0 no loop,
|
||
>18 beshort =-1 loop,
|
||
>21 ubyte <128 note %d,
|
||
>22 byte =0 replay 5.485 KHz
|
||
>22 byte =1 replay 8.084 KHz
|
||
>22 byte =2 replay 10.971 KHz
|
||
>22 byte =3 replay 16.168 KHz
|
||
>22 byte =4 replay 21.942 KHz
|
||
>22 byte =5 replay 32.336 KHz
|
||
>22 byte =6 replay 43.885 KHz
|
||
>22 byte =7 replay 47.261 KHz
|
||
|
||
# SGI SoundTrack <mpruett@sgi.com>
|
||
0 string _SGI_SoundTrack SGI SoundTrack project file
|
||
# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
|
||
0 string ID3 Audio file with ID3 version 2
|
||
>3 byte x \b.%d
|
||
>4 byte x \b.%d
|
||
>>5 byte &0x80 \b, unsynchronized frames
|
||
>>5 byte &0x40 \b, extended header
|
||
>>5 byte &0x20 \b, experimental
|
||
>>5 byte &0x10 \b, footer present
|
||
>(6.I) indirect x \b, contains:
|
||
|
||
# NSF (NES sound file) magic
|
||
0 string NESM\x1a NES Sound File
|
||
>14 string >\0 ("%s" by
|
||
>46 string >\0 %s, copyright
|
||
>78 string >\0 %s),
|
||
>5 byte x version %d,
|
||
>6 byte x %d tracks,
|
||
>122 byte&0x2 =1 dual PAL/NTSC
|
||
>122 byte&0x1 =1 PAL
|
||
>122 byte&0x1 =0 NTSC
|
||
|
||
# Type: SNES SPC700 sound files
|
||
# From: Josh Triplett <josh@freedesktop.org>
|
||
0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file
|
||
>&0 string 0.30 \b, version %s
|
||
>>0x23 byte 0x1B \b, without ID666 tag
|
||
>>0x23 byte 0x1A \b, with ID666 tag
|
||
>>>0x2E string >\0 \b, song "%.32s"
|
||
>>>0x4E string >\0 \b, game "%.32s"
|
||
|
||
# Impulse tracker module (audio/x-it)
|
||
0 string IMPM Impulse Tracker module sound data -
|
||
!:mime audio/x-mod
|
||
>4 string >\0 "%s"
|
||
>40 leshort !0 compatible w/ITv%x
|
||
>42 leshort !0 created w/ITv%x
|
||
|
||
# Imago Orpheus module (audio/x-imf)
|
||
60 string IM10 Imago Orpheus module sound data -
|
||
>0 string >\0 "%s"
|
||
|
||
# From <collver1@attbi.com>
|
||
# These are the /etc/magic entries to decode modules, instruments, and
|
||
# samples in Impulse Tracker's native format.
|
||
|
||
0 string IMPS Impulse Tracker Sample
|
||
>18 byte &2 16 bit
|
||
>18 byte ^2 8 bit
|
||
>18 byte &4 stereo
|
||
>18 byte ^4 mono
|
||
0 string IMPI Impulse Tracker Instrument
|
||
>28 leshort !0 ITv%x
|
||
>30 byte !0 %d samples
|
||
|
||
# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
|
||
# From <collver1@attbi.com>
|
||
0 string LM8953 Yamaha TX Wave
|
||
>22 byte 0x49 looped
|
||
>22 byte 0xC9 non-looped
|
||
>23 byte 1 33kHz
|
||
>23 byte 2 50kHz
|
||
>23 byte 3 16kHz
|
||
|
||
# scream tracker: file(1) magic for Scream Tracker sample files
|
||
#
|
||
# From <collver1@attbi.com>
|
||
76 string SCRS Scream Tracker Sample
|
||
>0 byte 1 sample
|
||
>0 byte 2 adlib melody
|
||
>0 byte >2 adlib drum
|
||
>31 byte &2 stereo
|
||
>31 byte ^2 mono
|
||
>31 byte &4 16bit little endian
|
||
>31 byte ^4 8bit
|
||
>30 byte 0 unpacked
|
||
>30 byte 1 packed
|
||
|
||
# audio
|
||
# From: Cory Dikkers <cdikkers@swbell.net>
|
||
0 string MMD0 MED music file, version 0
|
||
0 string MMD1 OctaMED Pro music file, version 1
|
||
0 string MMD3 OctaMED Soundstudio music file, version 3
|
||
0 string OctaMEDCmpr OctaMED Soundstudio compressed file
|
||
0 string MED MED_Song
|
||
0 string SymM Symphonie SymMOD music file
|
||
#
|
||
0 string THX AHX version
|
||
>3 byte =0 1 module data
|
||
>3 byte =1 2 module data
|
||
#
|
||
0 string OKTASONG Oktalyzer module data
|
||
#
|
||
0 string DIGI\ Booster\ module\0 %s
|
||
>20 byte >0 %c
|
||
>>21 byte >0 \b%c
|
||
>>>22 byte >0 \b%c
|
||
>>>>23 byte >0 \b%c
|
||
>610 string >\0 \b, "%s"
|
||
#
|
||
0 string DBM0 DIGI Booster Pro Module
|
||
>4 byte >0 V%X.
|
||
>>5 byte x \b%02X
|
||
>16 string >\0 \b, "%s"
|
||
#
|
||
0 string FTMN FaceTheMusic module
|
||
>16 string >\0d \b, "%s"
|
||
|
||
# From: <doj@cubic.org> 2003-06-24
|
||
0 string AMShdr\32 Velvet Studio AMS Module v2.2
|
||
0 string Extreme Extreme Tracker AMS Module v1.3
|
||
0 string DDMF Xtracker DMF Module
|
||
>4 byte x v%i
|
||
>0xD string >\0 Title: "%s"
|
||
>0x2B string >\0 Composer: "%s"
|
||
0 string DSM\32 Dynamic Studio Module DSM
|
||
0 string SONG DigiTrekker DTM Module
|
||
0 string DMDL DigiTrakker MDL Module
|
||
0 string PSM\32 Protracker Studio PSM Module
|
||
44 string PTMF Poly Tracker PTM Module
|
||
>0 string >\32 Title: "%s"
|
||
0 string MT20 MadTracker 2.0 Module MT2
|
||
0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
|
||
0 string RTMM RTM Module
|
||
0x426 string MaDoKaN96 XMS Adlib Module
|
||
>0 string >\0 Composer: "%s"
|
||
0 string AMF AMF Module
|
||
>4 string >\0 Title: "%s"
|
||
0 string MODINFO1 Open Cubic Player Module Inforation MDZ
|
||
0 string Extended\40Instrument: Fast Tracker II Instrument
|
||
|
||
# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
|
||
# NOA Nancy Codec file
|
||
0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
|
||
# Yamaha SMAF format
|
||
0 string MMMD Yamaha SMAF file
|
||
# Sharp Jisaku Melody format for PDC
|
||
0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
|
||
>20 string Ver01.00 Ver. 1.00
|
||
>>32 byte x , %d tracks
|
||
|
||
# Free lossless audio codec <http://flac.sourceforge.net>
|
||
# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
|
||
0 string fLaC FLAC audio bitstream data
|
||
!:mime audio/x-flac
|
||
>4 byte&0x7f >0 \b, unknown version
|
||
>4 byte&0x7f 0 \b
|
||
# some common bits/sample values
|
||
>>20 beshort&0x1f0 0x030 \b, 4 bit
|
||
>>20 beshort&0x1f0 0x050 \b, 6 bit
|
||
>>20 beshort&0x1f0 0x070 \b, 8 bit
|
||
>>20 beshort&0x1f0 0x0b0 \b, 12 bit
|
||
>>20 beshort&0x1f0 0x0f0 \b, 16 bit
|
||
>>20 beshort&0x1f0 0x170 \b, 24 bit
|
||
>>20 byte&0xe 0x0 \b, mono
|
||
>>20 byte&0xe 0x2 \b, stereo
|
||
>>20 byte&0xe 0x4 \b, 3 channels
|
||
>>20 byte&0xe 0x6 \b, 4 channels
|
||
>>20 byte&0xe 0x8 \b, 5 channels
|
||
>>20 byte&0xe 0xa \b, 6 channels
|
||
>>20 byte&0xe 0xc \b, 7 channels
|
||
>>20 byte&0xe 0xe \b, 8 channels
|
||
# some common sample rates
|
||
>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
|
||
>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
|
||
>>17 belong&0xfffff0 0x07d000 \b, 32 kHz
|
||
>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
|
||
>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
|
||
>>17 belong&0xfffff0 0x03e800 \b, 16 kHz
|
||
>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
|
||
>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
|
||
>>17 belong&0xfffff0 0x01f400 \b, 8 kHz
|
||
>>17 belong&0xfffff0 0x177000 \b, 96 kHz
|
||
>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
|
||
>>21 byte&0xf >0 \b, >4G samples
|
||
>>21 byte&0xf 0 \b
|
||
>>>22 belong >0 \b, %u samples
|
||
>>>22 belong 0 \b, length unknown
|
||
|
||
# (ISDN) VBOX voice message file (Wolfram Kleff)
|
||
0 string VBOX VBOX voice message data
|
||
|
||
# ReBorn Song Files (.rbs)
|
||
# David J. Singer <doc@deadvirgins.org.uk>
|
||
8 string RB40 RBS Song file
|
||
>29 string ReBorn created by ReBorn
|
||
>37 string Propellerhead created by ReBirth
|
||
|
||
# Synthesizer Generator and Kimwitu share their file format
|
||
0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
|
||
# Kimwitu++ uses a slightly different magic
|
||
0 string A#S#C#S#S#L#HUB Kimwitu++ data
|
||
|
||
# From "Simon Hosie
|
||
0 string TFMX-SONG TFMX module sound data
|
||
|
||
# Monkey's Audio compressed audio format (.ape)
|
||
# From danny.milo@gmx.net (Danny Milosavljevic)
|
||
# New version from Abel Cheung <abel (@) oaka.org>
|
||
0 string MAC\040 Monkey's Audio compressed format
|
||
!:mime audio/x-ape
|
||
>4 uleshort >0x0F8B version %d
|
||
>>(0x08.l) uleshort =1000 with fast compression
|
||
>>(0x08.l) uleshort =2000 with normal compression
|
||
>>(0x08.l) uleshort =3000 with high compression
|
||
>>(0x08.l) uleshort =4000 with extra high compression
|
||
>>(0x08.l) uleshort =5000 with insane compression
|
||
>>(0x08.l+18) uleshort =1 \b, mono
|
||
>>(0x08.l+18) uleshort =2 \b, stereo
|
||
>>(0x08.l+20) ulelong x \b, sample rate %d
|
||
>4 uleshort <0x0F8C version %d
|
||
>>6 uleshort =1000 with fast compression
|
||
>>6 uleshort =2000 with normal compression
|
||
>>6 uleshort =3000 with high compression
|
||
>>6 uleshort =4000 with extra high compression
|
||
>>6 uleshort =5000 with insane compression
|
||
>>10 uleshort =1 \b, mono
|
||
>>10 uleshort =2 \b, stereo
|
||
>>12 ulelong x \b, sample rate %d
|
||
|
||
# adlib sound files
|
||
# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
|
||
0 string RAWADATA RdosPlay RAW
|
||
|
||
1068 string RoR AMUSIC Adlib Tracker
|
||
|
||
0 string JCH EdLib
|
||
|
||
0 string mpu401tr MPU-401 Trakker
|
||
|
||
0 string SAdT Surprise! Adlib Tracker
|
||
>4 byte x Version %d
|
||
|
||
0 string XAD! eXotic ADlib
|
||
|
||
0 string ofTAZ! eXtra Simple Music
|
||
|
||
# Spectrum 128 tunes (.ay files).
|
||
# From: Emanuel Haupt <ehaupt@critical.ch>
|
||
0 string ZXAYEMUL Spectrum 128 tune
|
||
|
||
0 string \0BONK BONK,
|
||
#>5 byte x version %d
|
||
>14 byte x %d channel(s),
|
||
>15 byte =1 lossless,
|
||
>15 byte =0 lossy,
|
||
>16 byte x mid-side
|
||
|
||
384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
|
||
|
||
# format VQF (proprietary codec for sound)
|
||
# some infos on the header file available at :
|
||
# http://www.twinvq.org/english/technology_format.html
|
||
0 string TWIN97012000 VQF data
|
||
>27 short 0 \b, Mono
|
||
>27 short 1 \b, Stereo
|
||
>31 short >0 \b, %d kbit/s
|
||
>35 short >0 \b, %d kHz
|
||
|
||
# Nelson A. de Oliveira (naoliv@gmail.com)
|
||
# .eqf
|
||
0 string Winamp\ EQ\ library\ file %s
|
||
# it will match only versions like v<digit>.<digit>
|
||
# Since I saw only eqf files with version v1.1 I think that it's OK
|
||
>23 string x \b%.4s
|
||
# .preset
|
||
0 string [Equalizer\ preset] XMMS equalizer preset
|
||
# .m3u
|
||
0 search/1 #EXTM3U M3U playlist text
|
||
# .pls
|
||
0 search/1 [playlist] PLS playlist text
|
||
# licq.conf
|
||
1 string [licq] LICQ configuration file
|
||
|
||
# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
|
||
0 string ICE! SNDH Atari ST music
|
||
0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
|
||
|
||
# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
|
||
0 string MP+ Musepack audio
|
||
!:mime audio/x-musepack
|
||
>3 byte 255 \b, SV pre8
|
||
>3 byte&0xF 0x6 \b, SV 6
|
||
>3 byte&0xF 0x8 \b, SV 8
|
||
>3 byte&0xF 0x7 \b, SV 7
|
||
>>3 byte&0xF0 0x0 \b.0
|
||
>>3 byte&0xF0 0x10 \b.1
|
||
>>3 byte&0xF0 240 \b.15
|
||
>>10 byte&0xF0 0x0 \b, no profile
|
||
>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
|
||
>>10 byte&0xF0 0x50 \b, quality 0
|
||
>>10 byte&0xF0 0x60 \b, quality 1
|
||
>>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
|
||
>>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
|
||
>>10 byte&0xF0 0x90 \b, quality 4 (Radio)
|
||
>>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
|
||
>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
|
||
>>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
|
||
>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
|
||
>>10 byte&0xF0 0xE0 \b, quality 9
|
||
>>10 byte&0xF0 0xF0 \b, quality 10
|
||
>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
|
||
>>27 byte 102 \b, Beta 1.02
|
||
>>27 byte 104 \b, Beta 1.04
|
||
>>27 byte 105 \b, Alpha 1.05
|
||
>>27 byte 106 \b, Beta 1.06
|
||
>>27 byte 110 \b, Release 1.1
|
||
>>27 byte 111 \b, Alpha 1.11
|
||
>>27 byte 112 \b, Beta 1.12
|
||
>>27 byte 113 \b, Alpha 1.13
|
||
>>27 byte 114 \b, Beta 1.14
|
||
>>27 byte 115 \b, Alpha 1.15
|
||
|
||
# IMY
|
||
# from http://filext.com/detaillist.php?extdetail=IMY
|
||
# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
|
||
# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
|
||
# http://www.wx800.com/msg/download/irda/iMelody.pdf
|
||
0 string BEGIN:IMELODY iMelody Ringtone Format
|
||
|
||
# From: "Mateus Caruccio" <mateus@caruccio.com>
|
||
# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
|
||
0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature
|
||
|
||
# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
|
||
60 string SONG SoundFX Module sound file
|
||
|
||
# Type: Adaptive Multi-Rate Codec
|
||
# URL: http://filext.com/detaillist.php?extdetail=AMR
|
||
# From: Russell Coker <russell@coker.com.au>
|
||
0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
|
||
|
||
# Type: SuperCollider 3 Synth Definition File Format
|
||
# From: Mario Lang <mlang@debian.org>
|
||
0 string SCgf SuperCollider3 Synth Definition file,
|
||
>4 belong x version %d
|
||
|
||
# Type: True Audio Lossless Audio
|
||
# URL: http://wiki.multimedia.cx/index.php?title=True_Audio
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string TTA1 True Audio Lossless Audio
|
||
|
||
# Type: WavPack Lossless Audio
|
||
# URL: http://wiki.multimedia.cx/index.php?title=WavPack
|
||
# From: Mike Melanson <mike@multimedia.cx>
|
||
0 string wvpk WavPack Lossless Audio
|
||
|
||
#----------------------------------------------------------------
|
||
# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# basis: file(1) magic for BBx/Pro5-files
|
||
# Oliver Dammer <dammer@olida.de> 2005/11/07
|
||
# http://www.basis.com business-basic-files.
|
||
#
|
||
0 string \074\074bbx\076\076 BBx
|
||
>7 string \000 indexed file
|
||
>7 string \001 serial file
|
||
>7 string \002 keyed file
|
||
>>13 short 0 (sort)
|
||
>7 string \004 program
|
||
>>18 byte x (LEVEL %d)
|
||
>>>23 string >\000 psaved
|
||
>7 string \006 mkeyed file
|
||
>>13 short 0 (sort)
|
||
>>8 string \000 (mkey)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# bFLT: file(1) magic for BFLT uclinux binary files
|
||
#
|
||
# From Philippe De Muyter <phdm@macqel.be>
|
||
#
|
||
0 string bFLT BFLT executable
|
||
>4 belong x - version %ld
|
||
>4 belong 4
|
||
>>36 belong&0x1 0x1 ram
|
||
>>36 belong&0x2 0x2 gotpic
|
||
>>36 belong&0x4 0x4 gzip
|
||
>>36 belong&0x8 0x8 gzdata
|
||
# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
|
||
# http://ftg.lbl.gov/checkpoint
|
||
0 string C\0\0\0R\0\0\0 BLCR
|
||
>16 lelong 1 x86
|
||
>16 lelong 3 alpha
|
||
>16 lelong 5 x86-64
|
||
>16 lelong 7 ARM
|
||
>8 lelong x context data (little endian, version %d)
|
||
# Uncomment the following only of your "file" program supports "search"
|
||
#>0 search/1024 VMA\06 for kernel
|
||
#>>&1 byte x %d.
|
||
#>>&2 byte x %d.
|
||
#>>&3 byte x %d
|
||
0 string \0\0\0C\0\0\0R BLCR
|
||
>16 belong 2 SPARC
|
||
>16 belong 4 ppc
|
||
>16 belong 6 ppc64
|
||
>16 belong 7 ARMEB
|
||
>16 belong 8 SPARC64
|
||
>8 belong x context data (big endian, version %d)
|
||
# Uncomment the following only of your "file" program supports "search"
|
||
#>0 search/1024 VMA\06 for kernel
|
||
#>>&1 byte x %d.
|
||
#>>&2 byte x \b%d.
|
||
#>>&3 byte x \b%d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# blender: file(1) magic for Blender 3D related files
|
||
#
|
||
# Native format rule v1.2. For questions use the developers list
|
||
# http://lists.blender.org/mailman/listinfo/bf-committers
|
||
# GLOB chunk was moved near start and provides subversion info since 2.42
|
||
|
||
0 string =BLENDER Blender3D,
|
||
>7 string =_ saved as 32-bits
|
||
>>8 string =v little endian
|
||
>>>9 byte x with version %c.
|
||
>>>10 byte x \b%c
|
||
>>>11 byte x \b%c
|
||
>>>0x40 string =GLOB \b.
|
||
>>>>0x58 leshort x \b%.4d
|
||
>>8 string =V big endian
|
||
>>>9 byte x with version %c.
|
||
>>>10 byte x \b%c
|
||
>>>11 byte x \b%c
|
||
>>>0x40 string =GLOB \b.
|
||
>>>>0x58 beshort x \b%.4d
|
||
>7 string =- saved as 64-bits
|
||
>>8 string =v little endian
|
||
>>9 byte x with version %c.
|
||
>>10 byte x \b%c
|
||
>>11 byte x \b%c
|
||
>>0x44 string =GLOB \b.
|
||
>>>0x60 leshort x \b%.4d
|
||
>>8 string =V big endian
|
||
>>>9 byte x with version %c.
|
||
>>>10 byte x \b%c
|
||
>>>11 byte x \b%c
|
||
>>>0x44 string =GLOB \b.
|
||
>>>>0x60 beshort x \b%.4d
|
||
|
||
# Scripts that run in the embeded Python interpreter
|
||
0 string #!BPY Blender3D BPython script
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
|
||
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
|
||
#
|
||
# Note that this 0407 conflicts with several other a.out formats...
|
||
#
|
||
# XXX - should this be redone with "be" and "le", so that it works on
|
||
# little-endian machines as well? If so, what's the deal with
|
||
# "VAX-order" and "VAX-order2"?
|
||
#
|
||
#0 long 0407 68K Blit (standalone) executable
|
||
#0 short 0407 VAX-order2 68K Blit (standalone) executable
|
||
0 short 03401 VAX-order 68K Blit (standalone) executable
|
||
0 long 0406 68k Blit mpx/mux executable
|
||
0 short 0406 VAX-order2 68k Blit mpx/mux executable
|
||
0 short 03001 VAX-order 68k Blit mpx/mux executable
|
||
# Need more values for WE32 DMD executables.
|
||
# Note that 0520 is the same as COFF
|
||
#0 short 0520 tty630 layers executable
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# i80960 b.out objects and archives
|
||
#
|
||
0 long 0x10d i960 b.out relocatable object
|
||
>16 long >0 not stripped
|
||
#
|
||
# b.out archive (hp-rt on i960)
|
||
0 string =!<bout> b.out archive
|
||
>8 string __.SYMDEF random library
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
|
||
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
|
||
# Some object/executable formats use the same magic numbers as are used
|
||
# in other OSes; those are handled by entries in aout.
|
||
#
|
||
|
||
0 lelong 0314 386 compact demand paged pure executable
|
||
>16 lelong >0 not stripped
|
||
>32 byte 0x6a (uses shared libs)
|
||
|
||
# same as in SunOS 4.x, except for static shared libraries
|
||
0 belong&077777777 0600413 sparc demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <4096 shared library
|
||
>>20 belong =4096 dynamically linked executable
|
||
>>20 belong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
>36 belong 0xb4100001 (uses shared libs)
|
||
|
||
0 belong&077777777 0600410 sparc pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
>36 belong 0xb4100001 (uses shared libs)
|
||
|
||
0 belong&077777777 0600407 sparc
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
>36 belong 0xb4100001 (uses shared libs)
|
||
# Chiasmus is a encryption standard developed by the German Federal
|
||
# Office for Information Security (Bundesamt fuer Sicherheit in der
|
||
# Informationstechnik).
|
||
|
||
# Extension: .xia
|
||
0 string XIA1 Chiasmus encrypted data
|
||
|
||
# Extension: .xis
|
||
0 string XIS Chiasmus key
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# BTSnoop: file(1) magic for BTSnoop files
|
||
#
|
||
# From <marcel@holtmann.org>
|
||
0 string btsnoop\0 BTSnoop
|
||
>8 belong x version %d,
|
||
>12 belong 1001 Unencapsulated HCI
|
||
>12 belong 1002 HCI UART (H4)
|
||
>12 belong 1003 HCI BCSP
|
||
>12 belong 1004 HCI Serial (H5)
|
||
>>12 belong x type %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# c64: file(1) magic for various commodore 64 related files
|
||
#
|
||
# From: Dirk Jagdmann <doj@cubic.org>
|
||
|
||
0x16500 belong 0x12014100 D64 Image
|
||
0x16500 belong 0x12014180 D71 Image
|
||
0x61800 belong 0x28034400 D81 Image
|
||
0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
|
||
0 belong 0x43154164 X64 Image
|
||
|
||
0 string GCR-1541 GCR Image
|
||
>8 byte x version: %i
|
||
>9 byte x tracks: %i
|
||
|
||
9 string PSUR ARC archive (c64)
|
||
2 string -LH1- LHA archive (c64)
|
||
|
||
0 string C64File PC64 Emulator file
|
||
>8 string >\0 "%s"
|
||
0 string C64Image PC64 Freezer Image
|
||
|
||
0 beshort 0x38CD C64 PCLink Image
|
||
0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
|
||
|
||
0 belong 0xFF424CFF WRAptor packer (c64)
|
||
|
||
0 string C64S\x20tape\x20file T64 tape Image
|
||
>32 leshort x Version:0x%x
|
||
>36 leshort !0 Entries:%i
|
||
>40 string x Name:%.24s
|
||
|
||
0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
|
||
>32 leshort x Version:0x%x
|
||
>36 leshort !0 Entries:%i
|
||
>40 string x Name:%.24s
|
||
|
||
0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
|
||
>32 leshort x Version:0x%x
|
||
>36 leshort !0 Entries:%i
|
||
>40 string x Name:%.24s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cad,v 1.11 2011/12/08 12:12:46 rrt Exp $
|
||
# autocad: file(1) magic for cad files
|
||
#
|
||
|
||
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
|
||
# Written December 01, 2003 by Lester Hightower
|
||
# Based on the DWG File Format Specifications at http://www.opendwg.org/
|
||
0 string \101\103\061\060\061 AutoCAD
|
||
>5 string \062\000\000\000\000 DWG ver. R13
|
||
>5 string \064\000\000\000\000 DWG ver. R14
|
||
|
||
# Microstation DGN/CIT Files (www.bentley.com)
|
||
# Last updated July 29, 2005 by Lester Hightower
|
||
# DGN is the default file extension of Microstation/Intergraph CAD files.
|
||
# CIT is the proprietary raster format (similar to TIFF) used to attach
|
||
# raster underlays to Microstation DGN (vector) drawings.
|
||
#
|
||
# http://www.wotsit.org/search.asp
|
||
# http://filext.com/detaillist.php?extdetail=DGN
|
||
# http://filext.com/detaillist.php?extdetail=CIT
|
||
#
|
||
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
|
||
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
|
||
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
|
||
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
|
||
0 string \010\011\376 Microstation
|
||
>3 string \002
|
||
>>30 string \026\105 DGNFile
|
||
>>30 string \034\105 DGNFile
|
||
>>30 string \073\107 DGNFile
|
||
>>30 string \073\110 DGNFile
|
||
>>30 string \106\107 DGNFile
|
||
>>30 string \110\103 DGNFile
|
||
>>30 string \120\104 DGNFile
|
||
>>30 string \172\104 DGNFile
|
||
>>30 string \172\105 DGNFile
|
||
>>30 string \172\106 DGNFile
|
||
>>30 string \234\106 DGNFile
|
||
>>30 string \273\105 DGNFile
|
||
>>30 string \306\106 DGNFile
|
||
>>30 string \310\104 DGNFile
|
||
>>30 string \341\104 DGNFile
|
||
>>30 string \372\103 DGNFile
|
||
>>30 string \372\104 DGNFile
|
||
>>30 string \372\106 DGNFile
|
||
>>30 string \376\103 DGNFile
|
||
>4 string \030\000\000 CITFile
|
||
>4 string \030\000\003 CITFile
|
||
|
||
# AutoCad, from Nahuel Greco
|
||
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
|
||
0 string AC1012 DWG AutoDesk AutoCad (release 12)
|
||
0 string AC1013 DWG AutoDesk AutoCad (release 13)
|
||
0 string AC1014 DWG AutoDesk AutoCad (release 14)
|
||
# A new version of AutoCAD DWG
|
||
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
|
||
# ICQ 358572321)
|
||
# From various sources like:
|
||
# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
|
||
0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
|
||
0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
|
||
0 string AC1024 DWG AutoDesk AutoCAD 2010/2011
|
||
|
||
# KOMPAS 2D drawing from ASCON
|
||
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
|
||
# gathered nor specification
|
||
# ASCON http://ascon.net/main/ in English,
|
||
# http://ascon.ru/ main site in Russian
|
||
# Extension is CDW for drawing and FRW for fragment of drawing
|
||
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
|
||
# ICQ 358572321, http://vkontakte.ru/id16076543)
|
||
# From:
|
||
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
|
||
# (in russian) and my experiments
|
||
0 string KF
|
||
>2 belong 0x4E00000C Kompas drawing 12.0 SP1
|
||
>2 belong 0x4D00000C Kompas drawing 12.0
|
||
>2 belong 0x3200000B Kompas drawing 11.0 SP1
|
||
>2 belong 0x3100000B Kompas drawing 11.0
|
||
>2 belong 0x2310000A Kompas drawing 10.0 SP1
|
||
>2 belong 0x2110000A Kompas drawing 10.0
|
||
>2 belong 0x08000009 Kompas drawing 9.0 SP1
|
||
>2 belong 0x05000009 Kompas drawing 9.0
|
||
>2 belong 0x33010008 Kompas drawing 8+
|
||
>2 belong 0x1A000008 Kompas drawing 8.0
|
||
>2 belong 0x2C010107 Kompas drawing 7+
|
||
>2 belong 0x05000007 Kompas drawing 7.0
|
||
>2 belong 0x32000006 Kompas drawing 6+
|
||
>2 belong 0x09000006 Kompas drawing 6.0
|
||
>2 belong 0x5C009005 Kompas drawing 5.11R03
|
||
>2 belong 0x54009005 Kompas drawing 5.11R02
|
||
>2 belong 0x51009005 Kompas drawing 5.11R01
|
||
>2 belong 0x22009005 Kompas drawing 5.10R03
|
||
>2 belong 0x22009005 Kompas drawing 5.10R02 mar
|
||
>2 belong 0x21009005 Kompas drawing 5.10R02 febr
|
||
>2 belong 0x19009005 Kompas drawing 5.10R01
|
||
>2 belong 0xF4008005 Kompas drawing 5.9R01.003
|
||
>2 belong 0x1C008005 Kompas drawing 5.9R01.002
|
||
>2 belong 0x11008005 Kompas drawing 5.8R01.003
|
||
|
||
# CAD: file(1) magic for computer aided design files
|
||
# Phillip Griffith <phillip dot griffith at gmail dot com>
|
||
# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
|
||
#
|
||
0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
|
||
0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
|
||
0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
|
||
0 beshort 0x0809 Bentley/Intergraph MicroStation
|
||
>0x02 byte 0xfe
|
||
>>0x04 beshort 0x1800 CIT raster CAD
|
||
0 string AC1012 AutoDesk AutoCAD R13
|
||
0 string AC1014 AutoDesk AutoCAD R14
|
||
0 string AC1015 AutoDesk AutoCAD R2000
|
||
|
||
# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
|
||
#16 beshort 0x3d3d image/x-3ds
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $
|
||
# Cafe Babes unite!
|
||
#
|
||
# Since Java bytecode and Mach-O universal binaries have the same magic number,
|
||
# the test must be performed in the same "magic" sequence to get both right.
|
||
# The long at offset 4 in a Mach-O universal binary tells the number of
|
||
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
|
||
# version and the short at offset 6 is the JVM major version. Since there are only
|
||
# only 18 labeled Mach-O architectures at current, and the first released
|
||
# Java class format was version 43.0, we can safely choose any number
|
||
# between 18 and 39 to test the number of architectures against
|
||
# (and use as a hack). Let's not use 18, because the Mach-O people
|
||
# might add another one or two as time goes by...
|
||
#
|
||
### JAVA START ###
|
||
0 belong 0xcafebabe
|
||
!:mime application/x-java-applet
|
||
>4 belong >30 compiled Java class data,
|
||
>>6 beshort x version %d.
|
||
>>4 beshort x \b%d
|
||
# Which is which?
|
||
#>>4 belong 0x032d (Java 1.0)
|
||
#>>4 belong 0x032d (Java 1.1)
|
||
>>4 belong 0x002e (Java 1.2)
|
||
>>4 belong 0x002f (Java 1.3)
|
||
>>4 belong 0x0030 (Java 1.4)
|
||
>>4 belong 0x0031 (Java 1.5)
|
||
>>4 belong 0x0032 (Java 1.6)
|
||
|
||
0 belong 0xcafed00d JAR compressed with pack200,
|
||
>5 byte x version %d.
|
||
>4 byte x \b%d
|
||
!:mime application/x-java-pack200
|
||
|
||
|
||
0 belong 0xcafed00d JAR compressed with pack200,
|
||
>5 byte x version %d.
|
||
>4 byte x \b%d
|
||
!:mime application/x-java-pack200
|
||
|
||
### JAVA END ###
|
||
### MACH-O START ###
|
||
|
||
0 name mach-o \b [
|
||
>0 use mach-o-cpu \b
|
||
>&(8.L) indirect \b:
|
||
>0 belong x \b]
|
||
|
||
0 belong 0xcafebabe
|
||
>4 belong 1 Mach-O universal binary with 1 architecture:
|
||
>>8 use mach-o \b
|
||
>4 belong >1
|
||
>>4 belong <20 Mach-O universal binary with %ld architectures:
|
||
>>>8 use mach-o \b
|
||
>>>28 use mach-o \b
|
||
>>4 belong >2
|
||
>>>48 use mach-o \b
|
||
>>4 belong >3
|
||
>>>68 use mach-o \b
|
||
|
||
### MACH-O END ###
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# CDDB: file(1) magic for CDDB(tm) format CD text data files
|
||
#
|
||
# From <steve@gracenote.com>
|
||
#
|
||
# This is the /etc/magic entry to decode datafiles as used by
|
||
# CDDB-enabled CD player applications.
|
||
#
|
||
|
||
0 search/1/w #\040xmcd CDDB(tm) format CD text data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
|
||
# chord: file(1) magic for Chord music sheet typesetting utility input files
|
||
#
|
||
# From Philippe De Muyter <phdm@macqel.be>
|
||
# File format is actually free, but many distributed files begin with `{title'
|
||
#
|
||
0 string {title Chord text file
|
||
|
||
# Type: PowerTab file format
|
||
# URL: http://www.power-tab.net/
|
||
# From: Jelmer Vernooij <jelmer@samba.org>
|
||
0 string ptab\003\000 Power-Tab v3 Tablature File
|
||
0 string ptab\004\000 Power-Tab v4 Tablature File
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# cisco: file(1) magic for cisco Systems routers
|
||
#
|
||
# Most cisco file-formats are covered by the generic elf code
|
||
#
|
||
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
|
||
0 belong&0xffffff00 0x85011400 cisco IOS microcode
|
||
>7 string >\0 for '%s'
|
||
0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
|
||
>7 string >\0 for '%s'
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# citrus locale declaration
|
||
#
|
||
|
||
0 string RuneCT Citrus locale declaration for LC_CTYPE
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: c-lang,v 1.17 2012/04/28 21:20:26 christos Exp $
|
||
# c-lang: file(1) magic for C and related languages programs
|
||
#
|
||
|
||
# BCPL
|
||
0 search/8192 "libhdr" BCPL source text
|
||
!:mime text/x-bcpl
|
||
0 search/8192 "LIBHDR" BCPL source text
|
||
!:mime text/x-bcpl
|
||
|
||
# C
|
||
0 regex \^#include C source text
|
||
!:mime text/x-c
|
||
0 regex \^char C source text
|
||
!:mime text/x-c
|
||
0 regex \^double C source text
|
||
!:mime text/x-c
|
||
0 regex \^extern C source text
|
||
!:mime text/x-c
|
||
0 regex \^float C source text
|
||
!:mime text/x-c
|
||
0 regex \^struct C source text
|
||
!:mime text/x-c
|
||
0 regex \^union C source text
|
||
!:mime text/x-c
|
||
0 search/8192 main( C source text
|
||
!:mime text/x-c
|
||
|
||
# C++
|
||
# The strength of these rules is increased so they beat the C rules above
|
||
0 regex \^template C++ source text
|
||
!:strength + 5
|
||
!:mime text/x-c++
|
||
0 regex \^virtual C++ source text
|
||
!:strength + 5
|
||
!:mime text/x-c++
|
||
0 regex \^class C++ source text
|
||
!:strength + 5
|
||
!:mime text/x-c++
|
||
0 regex \^public: C++ source text
|
||
!:strength + 5
|
||
!:mime text/x-c++
|
||
0 regex \^private: C++ source text
|
||
!:strength + 5
|
||
!:mime text/x-c++
|
||
|
||
# From: Mikhail Teterin <mi@aldan.algebra.com>
|
||
0 string cscope cscope reference data
|
||
>7 string x version %.2s
|
||
# We skip the path here, because it is often long (so file will
|
||
# truncate it) and mostly redundant.
|
||
# The inverted index functionality was added some time betwen
|
||
# versions 11 and 15, so look for -q if version is above 14:
|
||
>7 string >14
|
||
>>10 search/100 \ -q\ with inverted index
|
||
>10 search/100 \ -c\ text (non-compressed)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# clarion: file(1) magic for # Clarion Personal/Professional Developer
|
||
# (v2 and above)
|
||
# From: Julien Blache <jb@jblache.org>
|
||
|
||
# Database files
|
||
# signature
|
||
0 leshort 0x3343 Clarion Developer (v2 and above) data file
|
||
# attributes
|
||
>2 leshort &0x0001 \b, locked
|
||
>2 leshort &0x0004 \b, encrypted
|
||
>2 leshort &0x0008 \b, memo file exists
|
||
>2 leshort &0x0010 \b, compressed
|
||
>2 leshort &0x0040 \b, read only
|
||
# number of records
|
||
>5 lelong x \b, %ld records
|
||
|
||
# Memo files
|
||
0 leshort 0x334d Clarion Developer (v2 and above) memo data
|
||
|
||
# Key/Index files
|
||
# No magic? :(
|
||
|
||
# Help files
|
||
0 leshort 0x49e0 Clarion Developer (v2 and above) help data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $
|
||
# claris: file(1) magic for claris
|
||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||
# Claris Works a word processor, etc.
|
||
# Version 3.0
|
||
|
||
# .pct claris works clip art files
|
||
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
|
||
#*
|
||
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
|
||
#null to byte 1000 octal
|
||
514 string \377\377\377\377\000
|
||
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
|
||
514 string \377\377\377\377\001
|
||
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
|
||
|
||
# Claris works files
|
||
# .cwk
|
||
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
|
||
# .plt
|
||
0 string \020\341\000\000\010\010 Claris Works pallete files .plt
|
||
|
||
# .msp a dictionary file I am not sure about this I have only one .msp file
|
||
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
|
||
|
||
# .usp are user dictionary bits
|
||
# I am not sure about a magic header:
|
||
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
|
||
# soh S p f 8 U D sp ^ S cr nl p o d i
|
||
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
|
||
# a t r i s t sp ^ S cr nl d i v sp #
|
||
|
||
# .mth Thesaurus
|
||
# starts with \0 but no magic header
|
||
|
||
# .chy Hyphenation file
|
||
# I am not sure: 000 210 034 000 000
|
||
|
||
# other claris files
|
||
#./windows/claris/useng.ndx: data
|
||
#./windows/claris/xtndtran.l32: data
|
||
#./windows/claris/xtndtran.lst: data
|
||
#./windows/claris/clworks.lbl: data
|
||
#./windows/claris/clworks.prf: data
|
||
#./windows/claris/userd.spl: data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
|
||
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
|
||
#
|
||
# XXX - what byte order does the Clipper use?
|
||
#
|
||
# XXX - what's the "!" stuff:
|
||
#
|
||
# >18 short !074000,000000 C1 R1
|
||
# >18 short !074000,004000 C2 R1
|
||
# >18 short !074000,010000 C3 R1
|
||
# >18 short !074000,074000 TEST
|
||
#
|
||
# I shall assume it's ANDing the field with the first value and
|
||
# comparing it with the second, and rewrite it as:
|
||
#
|
||
# >18 short&074000 000000 C1 R1
|
||
# >18 short&074000 004000 C2 R1
|
||
# >18 short&074000 010000 C3 R1
|
||
# >18 short&074000 074000 TEST
|
||
#
|
||
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
|
||
# sort, nor does SunOS 4.x, so either it's something Intergraph added
|
||
# in CLIX, or something AT&T added in SVR3.2 or later, or something
|
||
# somebody else thought was a good idea; it's not documented in the
|
||
# man page for this version of "magic", nor does it appear to be
|
||
# implemented (at least not after I blew off the bogus code to turn
|
||
# old-style "&"s into new-style "&"s, which just didn't work at all).
|
||
#
|
||
0 short 0575 CLIPPER COFF executable (VAX #)
|
||
>20 short 0407 (impure)
|
||
>20 short 0410 (5.2 compatible)
|
||
>20 short 0411 (pure)
|
||
>20 short 0413 (demand paged)
|
||
>20 short 0443 (target shared library)
|
||
>12 long >0 not stripped
|
||
>22 short >0 - version %ld
|
||
0 short 0577 CLIPPER COFF executable
|
||
>18 short&074000 000000 C1 R1
|
||
>18 short&074000 004000 C2 R1
|
||
>18 short&074000 010000 C3 R1
|
||
>18 short&074000 074000 TEST
|
||
>20 short 0407 (impure)
|
||
>20 short 0410 (pure)
|
||
>20 short 0411 (separate I&D)
|
||
>20 short 0413 (paged)
|
||
>20 short 0443 (target shared library)
|
||
>12 long >0 not stripped
|
||
>22 short >0 - version %ld
|
||
>48 long&01 01 alignment trap enabled
|
||
>52 byte 1 -Ctnc
|
||
>52 byte 2 -Ctsw
|
||
>52 byte 3 -Ctpw
|
||
>52 byte 4 -Ctcb
|
||
>53 byte 1 -Cdnc
|
||
>53 byte 2 -Cdsw
|
||
>53 byte 3 -Cdpw
|
||
>53 byte 4 -Cdcb
|
||
>54 byte 1 -Csnc
|
||
>54 byte 2 -Cssw
|
||
>54 byte 3 -Cspw
|
||
>54 byte 4 -Cscb
|
||
4 string pipe CLIPPER instruction trace
|
||
4 string prof CLIPPER instruction profile
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
|
||
# commands: file(1) magic for various shells and interpreters
|
||
#
|
||
#0 string/w : shell archive or script for antique kernel text
|
||
0 string/wt #!\ /bin/sh POSIX shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /bin/csh C shell script text executable
|
||
!:mime text/x-shellscript
|
||
# korn shell magic, sent by George Wu, gwu@clyde.att.com
|
||
0 string/wt #!\ /bin/ksh Korn shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /bin/tcsh Tenex C shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable
|
||
!:mime text/x-shellscript
|
||
|
||
#
|
||
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
|
||
0 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /bin/nawk new awk script text executable
|
||
!:mime text/x-nawk
|
||
0 string/wt #!\ /usr/bin/nawk new awk script text executable
|
||
!:mime text/x-nawk
|
||
0 string/wt #!\ /usr/local/bin/nawk new awk script text executable
|
||
!:mime text/x-nawk
|
||
0 string/wt #!\ /bin/gawk GNU awk script text executable
|
||
!:mime text/x-gawk
|
||
0 string/wt #!\ /usr/bin/gawk GNU awk script text executable
|
||
!:mime text/x-gawk
|
||
0 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable
|
||
!:mime text/x-gawk
|
||
#
|
||
0 string/wt #!\ /bin/awk awk script text executable
|
||
!:mime text/x-awk
|
||
0 string/wt #!\ /usr/bin/awk awk script text executable
|
||
!:mime text/x-awk
|
||
0 regex =^\\s*BEGIN\\s*[{] awk script text
|
||
|
||
# AT&T Bell Labs' Plan 9 shell
|
||
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
|
||
|
||
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
|
||
0 string/wt #!\ /bin/bash Bourne-Again shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable
|
||
!:mime text/x-shellscript
|
||
0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
|
||
!:mime text/x-shellscript
|
||
|
||
# PHP scripts
|
||
# Ulf Harnhammar <ulfh@update.uu.se>
|
||
0 search/1/c =<?php PHP script text
|
||
!:strength + 10
|
||
!:mime text/x-php
|
||
0 search/1 =<?\n PHP script text
|
||
!:mime text/x-php
|
||
0 search/1 =<?\r PHP script text
|
||
!:mime text/x-php
|
||
0 search/1/w #!\ /usr/local/bin/php PHP script text executable
|
||
!:strength + 10
|
||
!:mime text/x-php
|
||
0 search/1/w #!\ /usr/bin/php PHP script text executable
|
||
!:strength + 10
|
||
!:mime text/x-php
|
||
# Smarty compiled template, http://www.smarty.net/
|
||
# Elan Ruusamae <glen@delfi.ee>
|
||
0 string =<?php\ /*\ Smarty\ version Smarty compiled template
|
||
>24 regex [0-9.]+ \b, version %s
|
||
!:mime text/x-php
|
||
|
||
0 string Zend\x00 PHP script Zend Optimizer data
|
||
|
||
0 string/t $! DCL command file
|
||
|
||
# Type: Pdmenu
|
||
# URL: http://packages.debian.org/pdmenu
|
||
# From: Edward Betts <edward@debian.org>
|
||
0 string #!/usr/bin/pdmenu Pdmenu configuration file text
|
||
|
||
#----------------------------------------------------------------------------
|
||
# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
|
||
# communication
|
||
|
||
# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
|
||
# It is used for conformance testing of communication protocols.
|
||
# Added by W. Borgert <debacle@debian.org>.
|
||
0 string $Suite TTCN Abstract Test Suite
|
||
>&1 string $SuiteId
|
||
>>&1 string >\n %s
|
||
>&2 string $SuiteId
|
||
>>&1 string >\n %s
|
||
>&3 string $SuiteId
|
||
>>&1 string >\n %s
|
||
|
||
# MSC (message sequence charts) are a formal description technique,
|
||
# described in ITU-T Z.120, mainly used for communication protocols.
|
||
# Added by W. Borgert <debacle@debian.org>.
|
||
0 string mscdocument Message Sequence Chart (document)
|
||
0 string msc Message Sequence Chart (chart)
|
||
0 string submsc Message Sequence Chart (subchart)
|
||
#------------------------------------------------------------------------------
|
||
# $File: compress,v 1.49 2011/12/07 22:04:27 christos Exp $
|
||
# compress: file(1) magic for pure-compression formats (no archives)
|
||
#
|
||
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
|
||
#
|
||
# Formats for various forms of compressed data
|
||
# Formats for "compress" proper have been moved into "compress.c",
|
||
# because it tries to uncompress it to figure out what's inside.
|
||
|
||
# standard unix compress
|
||
0 string \037\235 compress'd data
|
||
!:mime application/x-compress
|
||
!:apple LZIVZIVU
|
||
>2 byte&0x80 >0 block compressed
|
||
>2 byte&0x1f x %d bits
|
||
|
||
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
|
||
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
|
||
# * Original filename is only at offset 10 if "extra field" absent
|
||
# * Produce shorter output - notably, only report compression methods
|
||
# other than 8 ("deflate", the only method defined in RFC 1952).
|
||
0 string \037\213 gzip compressed data
|
||
!:mime application/x-gzip
|
||
>2 byte <8 \b, reserved method
|
||
>2 byte >8 \b, unknown method
|
||
>3 byte &0x01 \b, ASCII
|
||
>3 byte &0x02 \b, has CRC
|
||
>3 byte &0x04 \b, extra field
|
||
>3 byte&0xC =0x08
|
||
>>10 string x \b, was "%s"
|
||
>3 byte &0x10 \b, has comment
|
||
>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
|
||
>9 byte =0x01 \b, from Amiga
|
||
>9 byte =0x02 \b, from VMS
|
||
>9 byte =0x03 \b, from Unix
|
||
>9 byte =0x04 \b, from VM/CMS
|
||
>9 byte =0x05 \b, from Atari
|
||
>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
|
||
>9 byte =0x07 \b, from MacOS
|
||
>9 byte =0x08 \b, from Z-System
|
||
>9 byte =0x09 \b, from CP/M
|
||
>9 byte =0x0A \b, from TOPS/20
|
||
>9 byte =0x0B \b, from NTFS filesystem (NT)
|
||
>9 byte =0x0C \b, from QDOS
|
||
>9 byte =0x0D \b, from Acorn RISCOS
|
||
>3 byte &0x10 \b, comment
|
||
>3 byte &0x20 \b, encrypted
|
||
>4 ledate >0 \b, last modified: %s
|
||
>8 byte 2 \b, max compression
|
||
>8 byte 4 \b, max speed
|
||
|
||
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
|
||
0 string \037\036 packed data
|
||
!:mime application/octet-stream
|
||
>2 belong >1 \b, %d characters originally
|
||
>2 belong =1 \b, %d character originally
|
||
#
|
||
# This magic number is byte-order-independent.
|
||
0 short 0x1f1f old packed data
|
||
!:mime application/octet-stream
|
||
|
||
# XXX - why *two* entries for "compacted data", one of which is
|
||
# byte-order independent, and one of which is byte-order dependent?
|
||
#
|
||
0 short 0x1fff compacted data
|
||
!:mime application/octet-stream
|
||
# This string is valid for SunOS (BE) and a matching "short" is listed
|
||
# in the Ultrix (LE) magic file.
|
||
0 string \377\037 compacted data
|
||
!:mime application/octet-stream
|
||
0 short 0145405 huf output
|
||
!:mime application/octet-stream
|
||
|
||
# bzip2
|
||
0 string BZh bzip2 compressed data
|
||
!:mime application/x-bzip2
|
||
>3 byte >47 \b, block size = %c00k
|
||
|
||
# lzip
|
||
0 string LZIP lzip compressed data
|
||
!:mime application/x-lzip
|
||
>4 byte x \b, version: %d
|
||
|
||
# squeeze and crunch
|
||
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
|
||
0 beshort 0x76FF squeezed data,
|
||
>4 string x original name %s
|
||
0 beshort 0x76FE crunched data,
|
||
>2 string x original name %s
|
||
0 beshort 0x76FD LZH compressed data,
|
||
>2 string x original name %s
|
||
|
||
# Freeze
|
||
0 string \037\237 frozen file 2.1
|
||
0 string \037\236 frozen file 1.0 (or gzip 0.5)
|
||
|
||
# SCO compress -H (LZH)
|
||
0 string \037\240 SCO compress -H (LZH) data
|
||
|
||
# European GSM 06.10 is a provisional standard for full-rate speech
|
||
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
|
||
# excitation/long term prediction) coding at 13 kbit/s.
|
||
#
|
||
# There's only a magic nibble (4 bits); that nibble repeats every 33
|
||
# bytes. This isn't suited for use, but maybe we can use it someday.
|
||
#
|
||
# This will cause very short GSM files to be declared as data and
|
||
# mismatches to be declared as data too!
|
||
#0 byte&0xF0 0xd0 data
|
||
#>33 byte&0xF0 0xd0
|
||
#>66 byte&0xF0 0xd0
|
||
#>99 byte&0xF0 0xd0
|
||
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
|
||
|
||
# bzip a block-sorting file compressor
|
||
# by Julian Seward <sewardj@cs.man.ac.uk> and others
|
||
#
|
||
#0 string BZ bzip compressed data
|
||
#>2 byte x \b, version: %c
|
||
#>3 string =1 \b, compression block size 100k
|
||
#>3 string =2 \b, compression block size 200k
|
||
#>3 string =3 \b, compression block size 300k
|
||
#>3 string =4 \b, compression block size 400k
|
||
#>3 string =5 \b, compression block size 500k
|
||
#>3 string =6 \b, compression block size 600k
|
||
#>3 string =7 \b, compression block size 700k
|
||
#>3 string =8 \b, compression block size 800k
|
||
#>3 string =9 \b, compression block size 900k
|
||
|
||
# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
|
||
0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
|
||
>9 beshort <0x0940
|
||
>>9 byte&0xf0 =0x00 - version 0.
|
||
>>9 beshort&0x0fff x \b%03x,
|
||
>>13 byte 1 LZO1X-1,
|
||
>>13 byte 2 LZO1X-1(15),
|
||
>>13 byte 3 LZO1X-999,
|
||
## >>22 bedate >0 last modified: %s,
|
||
>>14 byte =0x00 os: MS-DOS
|
||
>>14 byte =0x01 os: Amiga
|
||
>>14 byte =0x02 os: VMS
|
||
>>14 byte =0x03 os: Unix
|
||
>>14 byte =0x05 os: Atari
|
||
>>14 byte =0x06 os: OS/2
|
||
>>14 byte =0x07 os: MacOS
|
||
>>14 byte =0x0A os: Tops/20
|
||
>>14 byte =0x0B os: WinNT
|
||
>>14 byte =0x0E os: Win32
|
||
>9 beshort >0x0939
|
||
>>9 byte&0xf0 =0x00 - version 0.
|
||
>>9 byte&0xf0 =0x10 - version 1.
|
||
>>9 byte&0xf0 =0x20 - version 2.
|
||
>>9 beshort&0x0fff x \b%03x,
|
||
>>15 byte 1 LZO1X-1,
|
||
>>15 byte 2 LZO1X-1(15),
|
||
>>15 byte 3 LZO1X-999,
|
||
## >>25 bedate >0 last modified: %s,
|
||
>>17 byte =0x00 os: MS-DOS
|
||
>>17 byte =0x01 os: Amiga
|
||
>>17 byte =0x02 os: VMS
|
||
>>17 byte =0x03 os: Unix
|
||
>>17 byte =0x05 os: Atari
|
||
>>17 byte =0x06 os: OS/2
|
||
>>17 byte =0x07 os: MacOS
|
||
>>17 byte =0x0A os: Tops/20
|
||
>>17 byte =0x0B os: WinNT
|
||
>>17 byte =0x0E os: Win32
|
||
|
||
# 4.3BSD-Quasijarus Strong Compression
|
||
# http://minnie.tuhs.org/Quasijarus/compress.html
|
||
0 string \037\241 Quasijarus strong compressed data
|
||
|
||
# From: Cory Dikkers <cdikkers@swbell.net>
|
||
0 string XPKF Amiga xpkf.library compressed data
|
||
0 string PP11 Power Packer 1.1 compressed data
|
||
0 string PP20 Power Packer 2.0 compressed data,
|
||
>4 belong 0x09090909 fast compression
|
||
>4 belong 0x090A0A0A mediocre compression
|
||
>4 belong 0x090A0B0B good compression
|
||
>4 belong 0x090A0C0C very good compression
|
||
>4 belong 0x090A0C0D best compression
|
||
|
||
# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
|
||
# http://www.7-zip.org or DOC/7zFormat.txt
|
||
#
|
||
0 string 7z\274\257\047\034 7-zip archive data,
|
||
>6 byte x version %d
|
||
>7 byte x \b.%d
|
||
!:mime application/x-7z-compressed
|
||
|
||
# Type: LZMA
|
||
0 lelong&0xffffff =0x5d
|
||
>12 leshort =0xff LZMA compressed data,
|
||
>>5 lequad =0xffffffffffffffff streamed
|
||
>>5 lequad !0xffffffffffffffff non-streamed, size %lld
|
||
!:mime application/x-lzma
|
||
|
||
# http://tukaani.org/xz/xz-file-format.txt
|
||
0 ustring \xFD7zXZ\x00 XZ compressed data
|
||
!:mime application/x-xz
|
||
|
||
# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
|
||
0 string LRZI LRZIP compressed data
|
||
>4 byte x - version %d
|
||
>5 byte x \b.%d
|
||
!:mime application/x-lrzip
|
||
|
||
# AFX compressed files (Wolfram Kleff)
|
||
2 string -afx- AFX compressed file data
|
||
|
||
# Supplementary magic data for the file(1) command to support
|
||
# rzip(1). The format is described in magic(5).
|
||
#
|
||
# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
|
||
# this file.
|
||
#
|
||
0 string RZIP rzip compressed data
|
||
>4 byte x - version %d
|
||
>5 byte x \b.%d
|
||
>6 belong x (%d bytes)
|
||
|
||
0 string ArC\x01 FreeArc archive <http://freearc.org>
|
||
|
||
# Type: DACT compressed files
|
||
0 long 0x444354C3 DACT compressed data
|
||
>4 byte >-1 (version %i.
|
||
>5 byte >-1 %i.
|
||
>6 byte >-1 %i)
|
||
>7 long >0 , original size: %i bytes
|
||
>15 long >30 , block size: %i bytes
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
|
||
# Console game magic
|
||
# Toby Deshane <hac@shoelace.digivill.net>
|
||
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
|
||
# ROM dump format
|
||
|
||
0 string NES\032 iNES ROM dump,
|
||
>4 byte x %dx16k PRG
|
||
>5 byte x \b, %dx8k CHR
|
||
>6 byte&0x01 =0x1 \b, [Vert.]
|
||
>6 byte&0x01 =0x0 \b, [Horiz.]
|
||
>6 byte&0x02 =0x2 \b, [SRAM]
|
||
>6 byte&0x04 =0x4 \b, [Trainer]
|
||
>6 byte&0x04 =0x8 \b, [4-Scr]
|
||
|
||
#------------------------------------------------------------------------------
|
||
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
|
||
#
|
||
0x104 belong 0xCEED6666 Gameboy ROM:
|
||
>0x134 string >\0 "%.16s"
|
||
>0x146 byte 0x03 \b,[SGB]
|
||
>0x147 byte 0x00 \b, [ROM ONLY]
|
||
>0x147 byte 0x01 \b, [ROM+MBC1]
|
||
>0x147 byte 0x02 \b, [ROM+MBC1+RAM]
|
||
>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
|
||
>0x147 byte 0x05 \b, [ROM+MBC2]
|
||
>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
|
||
>0x147 byte 0x08 \b, [ROM+RAM]
|
||
>0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
|
||
>0x147 byte 0x0B \b, [ROM+MMM01]
|
||
>0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
|
||
>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
|
||
>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
|
||
>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
|
||
>0x147 byte 0x11 \b, [ROM+MBC3]
|
||
>0x147 byte 0x12 \b, [ROM+MBC3+RAM]
|
||
>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
|
||
>0x147 byte 0x19 \b, [ROM+MBC5]
|
||
>0x147 byte 0x1A \b, [ROM+MBC5+RAM]
|
||
>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
|
||
>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
|
||
>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
|
||
>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
|
||
>0x147 byte 0x1F \b, [Pocket Camera]
|
||
>0x147 byte 0xFD \b, [Bandai TAMA5]
|
||
>0x147 byte 0xFE \b, [Hudson HuC-3]
|
||
>0x147 byte 0xFF \b, [Hudson HuC-1]
|
||
|
||
>0x148 byte 0 \b, ROM: 256Kbit
|
||
>0x148 byte 1 \b, ROM: 512Kbit
|
||
>0x148 byte 2 \b, ROM: 1Mbit
|
||
>0x148 byte 3 \b, ROM: 2Mbit
|
||
>0x148 byte 4 \b, ROM: 4Mbit
|
||
>0x148 byte 5 \b, ROM: 8Mbit
|
||
>0x148 byte 6 \b, ROM: 16Mbit
|
||
>0x148 byte 0x52 \b, ROM: 9Mbit
|
||
>0x148 byte 0x53 \b, ROM: 10Mbit
|
||
>0x148 byte 0x54 \b, ROM: 12Mbit
|
||
|
||
>0x149 byte 1 \b, RAM: 16Kbit
|
||
>0x149 byte 2 \b, RAM: 64Kbit
|
||
>0x149 byte 3 \b, RAM: 128Kbit
|
||
>0x149 byte 4 \b, RAM: 1Mbit
|
||
|
||
#>0x14e long x \b, CRC: %x
|
||
|
||
#------------------------------------------------------------------------------
|
||
# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
|
||
#
|
||
0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
|
||
>0x120 string >\0 Name: "%.16s"
|
||
>0x110 string >\0 %.16s
|
||
>0x1B0 string RA with SRAM
|
||
|
||
#------------------------------------------------------------------------------
|
||
# genesis: file(1) magic for the Super MegaDrive ROM dump format
|
||
#
|
||
0x280 string EAGN Super MagicDrive ROM dump
|
||
>0 byte x %dx16k blocks
|
||
>2 byte 0 \b, last in series or standalone
|
||
>2 byte >0 \b, split ROM
|
||
>8 byte 0xAA
|
||
>9 byte 0xBB
|
||
|
||
#------------------------------------------------------------------------------
|
||
# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
|
||
#
|
||
0x280 string EAMG Super MagicDrive ROM dump
|
||
>0 byte x %dx16k blocks
|
||
>2 byte x \b, last in series or standalone
|
||
>8 byte 0xAA
|
||
>9 byte 0xBB
|
||
|
||
#------------------------------------------------------------------------------
|
||
# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
|
||
#
|
||
# Does not detect all images. Very preliminary guesswork. Need more data
|
||
# on format.
|
||
#
|
||
# FIXME: need a little more info...;P
|
||
#
|
||
#0 byte 0xF3
|
||
#>1 byte 0xED Sega Master System/Game Gear ROM dump
|
||
#>1 byte 0x31 Sega Master System/Game Gear ROM dump
|
||
#>1 byte 0xDB Sega Master System/Game Gear ROM dump
|
||
#>1 byte 0xAF Sega Master System/Game Gear ROM dump
|
||
#>1 byte 0xC3 Sega Master System/Game Gear ROM dump
|
||
|
||
#------------------------------------------------------------------------------
|
||
# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
|
||
#
|
||
0 belong 0x21068028 Sega Dreamcast VMU game image
|
||
0 string LCDi Dream Animator file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
|
||
#
|
||
0 belong 0x37804012 V64 Nintendo 64 ROM dump
|
||
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
# Nintendo .nds
|
||
192 string \044\377\256Qi\232 Nintendo DS Game ROM Image
|
||
# Nintendo .gba
|
||
0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image
|
||
|
||
#------------------------------------------------------------------------------
|
||
# msx: file(1) magic for MSX game cartridge dumps
|
||
# Too simple - MPi
|
||
#0 beshort 0x4142 MSX game cartridge dump
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
|
||
0 string PS-X\ EXE Sony Playstation executable
|
||
# Area:
|
||
>113 string x (%s)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
|
||
0 string XBEH XBE, Microsoft Xbox executable
|
||
# probabilistic checks whether signed or not
|
||
>0x0004 ulelong =0x0
|
||
>>&2 ulelong =0x0
|
||
>>>&2 ulelong =0x0 \b, not signed
|
||
>0x0004 ulelong >0
|
||
>>&2 ulelong >0
|
||
>>>&2 ulelong >0 \b, signed
|
||
# expect base address of 0x10000
|
||
>0x0104 ulelong =0x10000
|
||
>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
|
||
>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
|
||
>>>(0x0118-0x0FF60) ulelong >0 (regions:
|
||
>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
|
||
>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
|
||
>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
|
||
>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
|
||
>>>(0x0118-0x0FF60) ulelong >0 \b)
|
||
|
||
# --------------------------------
|
||
# Microsoft Xbox data file formats
|
||
0 string XIP0 XIP, Microsoft Xbox data
|
||
0 string XTF0 XTF, Microsoft Xbox data
|
||
|
||
# Atari Lynx cartridge dump (EXE/BLL header)
|
||
# From: "Stefan A. Haubenthal" <polluks@web.de>
|
||
|
||
# Double-check that the image type matches too, 0x8008 conflicts with
|
||
# 8 character OMF-86 object file headers.
|
||
0 beshort 0x8008
|
||
>6 string BS93 Lynx homebrew cartridge
|
||
>>2 beshort x \b, RAM start $%04x
|
||
>6 string LYNX Lynx cartridge
|
||
>>2 beshort x \b, RAM start $%04x
|
||
|
||
# Opera file system that is used on the 3DO console
|
||
# From: Serge van den Boom <svdb@stack.nl>
|
||
0 string \x01ZZZZZ\x01 3DO "Opera" file system
|
||
|
||
# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
|
||
0 string GBS Nintendo Gameboy Music/Audio Data
|
||
12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
|
||
|
||
# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
|
||
0 string PPF30 Playstation Patch File version 3.0
|
||
>5 byte 0 \b, PPF 1.0 patch
|
||
>5 byte 1 \b, PPF 2.0 patch
|
||
>5 byte 2 \b, PPF 3.0 patch
|
||
>>56 byte 0 \b, Imagetype BIN (any)
|
||
>>56 byte 1 \b, Imagetype GI (PrimoDVD)
|
||
>>57 byte 0 \b, Blockcheck disabled
|
||
>>57 byte 1 \b, Blockcheck enabled
|
||
>>58 byte 0 \b, Undo data not available
|
||
>>58 byte 1 \b, Undo data available
|
||
>6 string x \b, description: %s
|
||
|
||
0 string PPF20 Playstation Patch File version 2.0
|
||
>5 byte 0 \b, PPF 1.0 patch
|
||
>5 byte 1 \b, PPF 2.0 patch
|
||
>>56 lelong >0 \b, size of file to patch %d
|
||
>6 string x \b, description: %s
|
||
|
||
0 string PPF10 Playstation Patch File version 1.0
|
||
>5 byte 0 \b, Simple Encoding
|
||
>6 string x \b, description: %s
|
||
|
||
# From: Daniel Dawson <ddawson@icehouse.net>
|
||
# SNES9x .smv "movie" file format.
|
||
0 string SMV\x1A SNES9x input recording
|
||
>0x4 lelong x \b, version %d
|
||
# version 4 is latest so far
|
||
>0x4 lelong <5
|
||
>>0x8 ledate x \b, recorded at %s
|
||
>>0xc lelong >0 \b, rerecorded %d times
|
||
>>0x10 lelong x \b, %d frames long
|
||
>>0x14 byte >0 \b, data for controller(s):
|
||
>>>0x14 byte &0x1 #1
|
||
>>>0x14 byte &0x2 #2
|
||
>>>0x14 byte &0x4 #3
|
||
>>>0x14 byte &0x8 #4
|
||
>>>0x14 byte &0x10 #5
|
||
>>0x15 byte ^0x1 \b, begins from snapshot
|
||
>>0x15 byte &0x1 \b, begins from reset
|
||
>>0x15 byte ^0x2 \b, NTSC standard
|
||
>>0x15 byte &0x2 \b, PAL standard
|
||
>>0x17 byte &0x1 \b, settings:
|
||
# WIP1Timing not used as of version 4
|
||
>>>0x4 lelong <4
|
||
>>>>0x17 byte &0x2 WIP1Timing
|
||
>>>0x17 byte &0x4 Left+Right
|
||
>>>0x17 byte &0x8 VolumeEnvX
|
||
>>>0x17 byte &0x10 FakeMute
|
||
>>>0x17 byte &0x20 SyncSound
|
||
# New flag as of version 4
|
||
>>>0x4 lelong >3
|
||
>>>>0x17 byte &0x80 NoCPUShutdown
|
||
>>0x4 lelong <4
|
||
>>>0x18 lelong >0x23
|
||
>>>>0x20 leshort !0
|
||
>>>>>0x20 lestring16 x \b, metadata: "%s"
|
||
>>0x4 lelong >3
|
||
>>>0x24 byte >0 \b, port 1:
|
||
>>>>0x24 byte 1 joypad
|
||
>>>>0x24 byte 2 mouse
|
||
>>>>0x24 byte 3 SuperScope
|
||
>>>>0x24 byte 4 Justifier
|
||
>>>>0x24 byte 5 multitap
|
||
>>>0x24 byte >0 \b, port 2:
|
||
>>>>0x25 byte 1 joypad
|
||
>>>>0x25 byte 2 mouse
|
||
>>>>0x25 byte 3 SuperScope
|
||
>>>>0x25 byte 4 Justifier
|
||
>>>>0x25 byte 5 multitap
|
||
>>>0x18 lelong >0x43
|
||
>>>>0x40 leshort !0
|
||
>>>>>0x40 lestring16 x \b, metadata: "%s"
|
||
>>0x17 byte &0x40 \b, ROM:
|
||
>>>(0x18.l-26) lelong x CRC32 0x%08x
|
||
>>>(0x18.l-23) string x "%s"
|
||
|
||
# Type: scummVM savegame files
|
||
# From: Sven Hartge <debian@ds9.argh.org>
|
||
0 string SCVM ScummVM savegame
|
||
>12 string >\0 "%s"
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
|
||
# convex: file(1) magic for Convex boxes
|
||
#
|
||
# Convexes are big-endian.
|
||
#
|
||
# /*\
|
||
# * Below are the magic numbers and tests added for Convex.
|
||
# * Added at beginning, because they are expected to be used most.
|
||
# \*/
|
||
0 belong 0507 Convex old-style object
|
||
>16 belong >0 not stripped
|
||
0 belong 0513 Convex old-style demand paged executable
|
||
>16 belong >0 not stripped
|
||
0 belong 0515 Convex old-style pre-paged executable
|
||
>16 belong >0 not stripped
|
||
0 belong 0517 Convex old-style pre-paged, non-swapped executable
|
||
>16 belong >0 not stripped
|
||
0 belong 0x011257 Core file
|
||
#
|
||
# The following are a series of dump format magic numbers. Each one
|
||
# corresponds to a drastically different dump format. The first on is
|
||
# the original dump format on a 4.1 BSD or earlier file system. The
|
||
# second marks the change between the 4.1 file system and the 4.2 file
|
||
# system. The Third marks the changing of the block size from 1K
|
||
# to 2K to be compatible with an IDC file system. The fourth indicates
|
||
# a dump that is dependent on Convex Storage Manager, because data in
|
||
# secondary storage is not physically contained within the dump.
|
||
# The restore program uses these number to determine how the data is
|
||
# to be extracted.
|
||
#
|
||
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
|
||
24 belong =60014 dump format, Convex Storage Manager by-reference dump
|
||
#
|
||
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
|
||
# If there is no `=' sign, assume just checking for whether the bit is set?
|
||
#
|
||
0 belong 0601 Convex SOFF
|
||
>88 belong&0x000f0000 =0x00000000 c1
|
||
>88 belong &0x00010000 c2
|
||
>88 belong &0x00020000 c2mp
|
||
>88 belong &0x00040000 parallel
|
||
>88 belong &0x00080000 intrinsic
|
||
>88 belong &0x00000001 demand paged
|
||
>88 belong &0x00000002 pre-paged
|
||
>88 belong &0x00000004 non-swapped
|
||
>88 belong &0x00000008 POSIX
|
||
#
|
||
>84 belong &0x80000000 executable
|
||
>84 belong &0x40000000 object
|
||
>84 belong&0x20000000 =0 not stripped
|
||
>84 belong&0x18000000 =0x00000000 native fpmode
|
||
>84 belong&0x18000000 =0x10000000 ieee fpmode
|
||
>84 belong&0x18000000 =0x18000000 undefined fpmode
|
||
#
|
||
0 belong 0605 Convex SOFF core
|
||
#
|
||
0 belong 0607 Convex SOFF checkpoint
|
||
>88 belong&0x000f0000 =0x00000000 c1
|
||
>88 belong &0x00010000 c2
|
||
>88 belong &0x00020000 c2mp
|
||
>88 belong &0x00040000 parallel
|
||
>88 belong &0x00080000 intrinsic
|
||
>88 belong &0x00000008 POSIX
|
||
#
|
||
>84 belong&0x18000000 =0x00000000 native fpmode
|
||
>84 belong&0x18000000 =0x10000000 ieee fpmode
|
||
>84 belong&0x18000000 =0x18000000 undefined fpmode
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
|
||
# cracklib: file (1) magic for cracklib v2.7
|
||
|
||
0 lelong 0x70775631 Cracklib password index, little endian
|
||
>4 long >0 (%i words)
|
||
>4 long 0 ("64-bit")
|
||
>>8 long >-1 (%i words)
|
||
0 belong 0x70775631 Cracklib password index, big endian
|
||
>4 belong >-1 (%i words)
|
||
# really bellong 0x0000000070775631
|
||
0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
|
||
>12 belong >0 (%i words)
|
||
|
||
# ----------------------------------------------------------------------------
|
||
# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
|
||
# ctags: file (1) magic for Exuberant Ctags files
|
||
# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
|
||
0 search/1 =!_TAG Exuberant Ctags tag file text
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
|
||
# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com>
|
||
#
|
||
0 string ACMP Map file for the AssaultCube FPS game
|
||
0 string CUBE Map file for cube and cube2 engine games
|
||
0 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
|
||
# Cups: file(1) magic for the cups raster file format
|
||
# From: Laurent Martelli <martellilaurent@gmail.com>
|
||
# http://www.cups.org/documentation.php/spec-raster.html
|
||
#
|
||
|
||
0 name cups-be
|
||
>280 lelong x \b, %d
|
||
>284 lelong x \bx%d dpi
|
||
>376 lelong x \b, %dx
|
||
>380 lelong x \b%d pixels
|
||
>388 lelong x %d bits/color
|
||
>392 lelong x %d bits/pixel
|
||
>400 lelong 0 ColorOrder=Chunky
|
||
>400 lelong 1 ColorOrder=Banded
|
||
>400 lelong 2 ColorOrder=Planar
|
||
>404 lelong 0 ColorSpace=gray
|
||
>404 lelong 1 ColorSpace=RGB
|
||
>404 lelong 2 ColorSpace=RGBA
|
||
>404 lelong 3 ColorSpace=black
|
||
>404 lelong 4 ColorSpace=CMY
|
||
>404 lelong 5 ColorSpace=YMC
|
||
>404 lelong 6 ColorSpace=CMYK
|
||
>404 lelong 7 ColorSpace=YMCK
|
||
>404 lelong 8 ColorSpace=KCMY
|
||
>404 lelong 9 ColorSpace=KCMYcm
|
||
>404 lelong 10 ColorSpace=GMCK
|
||
>404 lelong 11 ColorSpace=GMCS
|
||
>404 lelong 12 ColorSpace=WHITE
|
||
>404 lelong 13 ColorSpace=GOLD
|
||
>404 lelong 14 ColorSpace=SILVER
|
||
>404 lelong 15 ColorSpace=CIE XYZ
|
||
>404 lelong 16 ColorSpace=CIE Lab
|
||
>404 lelong 17 ColorSpace=RGBW
|
||
>404 lelong 18 ColorSpace=sGray
|
||
>404 lelong 19 ColorSpace=sRGB
|
||
>404 lelong 20 ColorSpace=AdobeRGB
|
||
|
||
# Cups Raster image format, Big Endian
|
||
0 string RaS
|
||
>3 string t Cups Raster version 1, Big Endian
|
||
>3 string 2 Cups Raster version 2, Big Endian
|
||
>3 string 3 Cups Raster version 3, Big Endian
|
||
!:mime application/vnd.cups-raster
|
||
>0 use ^cups-be
|
||
|
||
|
||
# Cups Raster image format, Little Endian
|
||
1 string SaR
|
||
>0 string t Cups Raster version 1, Little Endian
|
||
>0 string 2 Cups Raster version 2, Little Endian
|
||
>0 string 3 Cups Raster version 3, Little Endian
|
||
!:mime application/vnd.cups-raster
|
||
>0 use \^cups-be
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
|
||
# dact: file(1) magic for DACT compressed files
|
||
#
|
||
0 long 0x444354C3 DACT compressed data
|
||
>4 byte >-1 (version %i.
|
||
>5 byte >-1 $BS%i.
|
||
>6 byte >-1 $BS%i)
|
||
>7 long >0 $BS, original size: %i bytes
|
||
>15 long >30 $BS, block size: %i bytes
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $
|
||
# database: file(1) magic for various databases
|
||
#
|
||
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
|
||
#
|
||
#
|
||
# GDBM magic numbers
|
||
# Will be maintained as part of the GDBM distribution in the future.
|
||
# <downsj@teeny.org>
|
||
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
|
||
!:mime application/x-gdbm
|
||
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
|
||
!:mime application/x-gdbm
|
||
0 string GDBM GNU dbm 2.x database
|
||
!:mime application/x-gdbm
|
||
#
|
||
# Berkeley DB
|
||
#
|
||
# Ian Darwin's file /etc/magic files: big/little-endian version.
|
||
#
|
||
# Hash 1.85/1.86 databases store metadata in network byte order.
|
||
# Btree 1.85/1.86 databases store the metadata in host byte order.
|
||
# Hash and Btree 2.X and later databases store the metadata in host byte order.
|
||
|
||
0 long 0x00061561 Berkeley DB
|
||
!:mime application/x-dbm
|
||
>8 belong 4321
|
||
>>4 belong >2 1.86
|
||
>>4 belong <3 1.85
|
||
>>4 belong >0 (Hash, version %d, native byte-order)
|
||
>8 belong 1234
|
||
>>4 belong >2 1.86
|
||
>>4 belong <3 1.85
|
||
>>4 belong >0 (Hash, version %d, little-endian)
|
||
|
||
0 belong 0x00061561 Berkeley DB
|
||
>8 belong 4321
|
||
>>4 belong >2 1.86
|
||
>>4 belong <3 1.85
|
||
>>4 belong >0 (Hash, version %d, big-endian)
|
||
>8 belong 1234
|
||
>>4 belong >2 1.86
|
||
>>4 belong <3 1.85
|
||
>>4 belong >0 (Hash, version %d, native byte-order)
|
||
|
||
0 long 0x00053162 Berkeley DB 1.85/1.86
|
||
>4 long >0 (Btree, version %d, native byte-order)
|
||
0 belong 0x00053162 Berkeley DB 1.85/1.86
|
||
>4 belong >0 (Btree, version %d, big-endian)
|
||
0 lelong 0x00053162 Berkeley DB 1.85/1.86
|
||
>4 lelong >0 (Btree, version %d, little-endian)
|
||
|
||
12 long 0x00061561 Berkeley DB
|
||
>16 long >0 (Hash, version %d, native byte-order)
|
||
12 belong 0x00061561 Berkeley DB
|
||
>16 belong >0 (Hash, version %d, big-endian)
|
||
12 lelong 0x00061561 Berkeley DB
|
||
>16 lelong >0 (Hash, version %d, little-endian)
|
||
|
||
12 long 0x00053162 Berkeley DB
|
||
>16 long >0 (Btree, version %d, native byte-order)
|
||
12 belong 0x00053162 Berkeley DB
|
||
>16 belong >0 (Btree, version %d, big-endian)
|
||
12 lelong 0x00053162 Berkeley DB
|
||
>16 lelong >0 (Btree, version %d, little-endian)
|
||
|
||
12 long 0x00042253 Berkeley DB
|
||
>16 long >0 (Queue, version %d, native byte-order)
|
||
12 belong 0x00042253 Berkeley DB
|
||
>16 belong >0 (Queue, version %d, big-endian)
|
||
12 lelong 0x00042253 Berkeley DB
|
||
>16 lelong >0 (Queue, version %d, little-endian)
|
||
|
||
# From Max Bowsher.
|
||
12 long 0x00040988 Berkeley DB
|
||
>16 long >0 (Log, version %d, native byte-order)
|
||
12 belong 0x00040988 Berkeley DB
|
||
>16 belong >0 (Log, version %d, big-endian)
|
||
12 lelong 0x00040988 Berkeley DB
|
||
>16 lelong >0 (Log, version %d, little-endian)
|
||
|
||
#
|
||
#
|
||
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
|
||
0 string RRD RRDTool DB
|
||
>4 string x version %s
|
||
#----------------------------------------------------------------------
|
||
# ROOT: file(1) magic for ROOT databases
|
||
#
|
||
0 string root\0 ROOT file
|
||
>4 belong x Version %d
|
||
>33 belong x (Compression: %d)
|
||
|
||
# XXX: Weak magic.
|
||
# Alex Ott <ott@jet.msk.su>
|
||
## Paradox file formats
|
||
#2 leshort 0x0800 Paradox
|
||
#>0x39 byte 3 v. 3.0
|
||
#>0x39 byte 4 v. 3.5
|
||
#>0x39 byte 9 v. 4.x
|
||
#>0x39 byte 10 v. 5.x
|
||
#>0x39 byte 11 v. 5.x
|
||
#>0x39 byte 12 v. 7.x
|
||
#>>0x04 byte 0 indexed .DB data file
|
||
#>>0x04 byte 1 primary index .PX file
|
||
#>>0x04 byte 2 non-indexed .DB data file
|
||
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
|
||
#>>0x04 byte 4 secondary index .Ynn file
|
||
#>>0x04 byte 5 incrementing secondary index .Xnn file
|
||
#>>0x04 byte 6 non-incrementing secondary index .XGn file
|
||
#>>0x04 byte 7 secondary index .YGn file
|
||
#>>>0x04 byte 8 incrementing secondary index .XGn file
|
||
|
||
## XBase database files
|
||
# updated by Joerg Jenderek at Feb 2013
|
||
# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
|
||
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
|
||
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
|
||
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
|
||
0 ubelong&0x0000FFFF <0x00000C20
|
||
# skip Infocom game Z-machine
|
||
>2 ubyte >0
|
||
# skip Androids *.xml
|
||
>>3 ubyte >0
|
||
>>>3 ubyte <32
|
||
# 1 < version VV
|
||
>>>>0 ubyte >1
|
||
# skip HELP.CA3 by test for reserved byte ( NULL )
|
||
>>>>>27 ubyte 0
|
||
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
|
||
#>>>>>30 ubeshort x 30NULL?%x
|
||
# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
|
||
>>>>>>24 ubelong&0xffFFFFff >0x01302000
|
||
# .DBF or .MDX
|
||
>>>>>>24 ubelong&0xffFFFFff <0x01302001
|
||
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
|
||
>>>>>>>24 ubelong&0xffFFFFff =0
|
||
# test for 2 reserved NULL bytes,transaction and encryption byte flag
|
||
>>>>>>>>12 ubelong&0xFFFFfEfE 0
|
||
# test for MDX flag
|
||
>>>>>>>>>28 ubyte x
|
||
>>>>>>>>>28 ubyte&0xf8 0
|
||
# header size >= 32
|
||
>>>>>>>>>>8 uleshort >31
|
||
# skip PIC15736.PCX by test for language driver name or field name
|
||
>>>>>>>>>>>32 ubyte >0
|
||
!:mime application/x-dbf
|
||
#!:mime application/x-dbf; charset=unknown-8bit ??
|
||
#!:mime application/x-dbase
|
||
>>>>>>>>>>>>0 use xbase-type
|
||
# database file
|
||
>>>>>>>>>>>>0 ubyte x \b DBF
|
||
>>>>>>>>>>>>4 lelong 0 \b, no records
|
||
>>>>>>>>>>>>4 lelong >0 \b, %ld record
|
||
# plural s appended
|
||
>>>>>>>>>>>>>4 lelong >1 \bs
|
||
# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
|
||
# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
|
||
>>>>>>>>>>>>10 uleshort x * %d
|
||
# file size = records * record size + header size
|
||
>>>>>>>>>>>>1 ubyte x \b, update-date
|
||
>>>>>>>>>>>>1 use xbase-date
|
||
# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
|
||
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
|
||
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
|
||
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
|
||
#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
|
||
>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
|
||
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
|
||
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
|
||
# 1st record offset + 1 = header size
|
||
>>>>>>>>>>>>8 uleshort >0
|
||
>>>>>>>>>>>>(8.s+1) ubyte >0
|
||
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
|
||
>>>>>>>>>>>>>(8.s+1) ubyte >0
|
||
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
|
||
# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
|
||
>>>>>>>24 ubelong&0x0133f7ff >0
|
||
# test for reserved NULL byte
|
||
>>>>>>>>47 ubyte x
|
||
# test for valid TAG key format (0x10 or 0)
|
||
>>>>>>>>>559 ubyte&0xeF 0
|
||
# test MM <= 12
|
||
>>>>>>>>>45 ubeshort <0x0C20
|
||
>>>>>>>>>>45 ubyte >0
|
||
>>>>>>>>>>>46 ubyte <32
|
||
>>>>>>>>>>>>46 ubyte >0
|
||
#!:mime application/x-mdx
|
||
>>>>>>>>>>>>>0 use xbase-type
|
||
>>>>>>>>>>>>>0 ubyte x \b MDX
|
||
>>>>>>>>>>>>>1 ubyte x \b, creation-date
|
||
>>>>>>>>>>>>>1 use xbase-date
|
||
>>>>>>>>>>>>>44 ubyte x \b, update-date
|
||
>>>>>>>>>>>>>44 use xbase-date
|
||
# No.of tags in use (1,2,5,12)
|
||
>>>>>>>>>>>>>28 uleshort x \b, %d
|
||
# No. of entries in tag (0x30)
|
||
>>>>>>>>>>>>>25 ubyte x \b/%d tags
|
||
# Length of tag
|
||
>>>>>>>>>>>>>26 ubyte x * %d
|
||
# 1st tag name_
|
||
>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
|
||
# 2nd tag name
|
||
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
|
||
#
|
||
# Print the xBase names of different version variants
|
||
0 name xbase-type
|
||
>0 ubyte <2
|
||
# 1 < version
|
||
>0 ubyte >1
|
||
>>0 ubyte 0x02 FoxBase
|
||
# FoxBase+/dBaseIII+, no memo
|
||
>>0 ubyte 0x03 FoxBase+/dBase III
|
||
# dBASE IV no memo file
|
||
>>0 ubyte 0x04 dBase IV
|
||
# dBASE V no memo file
|
||
>>0 ubyte 0x05 dBase V
|
||
>>0 ubyte 0x30 Visual FoxPro
|
||
>>0 ubyte 0x31 Visual FoxPro, autoincrement
|
||
# Visual FoxPro, with field type Varchar or Varbinary
|
||
>>0 ubyte 0x32 Visual FoxPro, with field type Varchar
|
||
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
|
||
>>0 ubyte 0x43 dBase IV, with SQL table
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0x62 dBase IV, with SQL table
|
||
# dBASE IV, with memo!!
|
||
>>0 ubyte 0x7b dBase IV, with memo
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0x82 dBase IV, with SQL system
|
||
# FoxBase+/dBaseIII+ with memo .DBT!
|
||
>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
|
||
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
|
||
>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
|
||
# dBASE IV with memo!
|
||
>>0 ubyte 0x8B dBase IV, with memo .DBT
|
||
# dBase IV with SQL Table,no memo?
|
||
>>0 ubyte 0x8E dBase IV, with SQL table
|
||
# .dbv and .dbt memo (Flagship)?
|
||
>>0 ubyte 0xB3 Flagship
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0xCA dBase IV with memo .DBT
|
||
# dBASE IV with SQL table, with memo .DBT
|
||
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
|
||
# HiPer-Six format;Clipper SIX, with SMT memo file
|
||
>>0 ubyte 0xE5 Clipper SIX with memo
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
|
||
>>0 ubyte 0xF5 FoxPro with memo
|
||
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
|
||
#>>0 ubyte 0xFA FoxPro 2.x, with memo
|
||
# unkown version (should not happen)
|
||
>>0 default x xBase
|
||
>>>0 ubyte x (0x%x)
|
||
# flags in version byte
|
||
# DBT flag (with dBASE III memo .DBT)!!
|
||
# >>0 ubyte&0x80 >0 DBT_FLAG=%x
|
||
# memo flag ??
|
||
# >>0 ubyte&0x08 >0 MEMO_FLAG=%x
|
||
# SQL flag ??
|
||
# >>0 ubyte&0x70 >0 SQL_FLAG=%x
|
||
# test and print the date of xBase .DBF .MDX
|
||
0 name xbase-date
|
||
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
|
||
>0 ubelong x
|
||
>1 ubyte <13
|
||
>>1 ubyte >0
|
||
>>>2 ubyte >0
|
||
>>>>2 ubyte <32
|
||
>>>>>0 ubyte x
|
||
# YY is interpreted as 20YY or 19YY
|
||
>>>>>>0 ubyte <100 \b %.2d
|
||
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
|
||
>>>>>>0 ubyte >99 \b %d
|
||
>>>>>1 ubyte x \b-%d
|
||
>>>>>2 ubyte x \b-%d
|
||
|
||
# dBase memo files .DBT or .FPT
|
||
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
|
||
16 ubyte <4
|
||
>16 ubyte !2
|
||
>>16 ubyte !1
|
||
# next free block index is positive
|
||
>>>0 ulelong >0
|
||
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
|
||
>>>>17 ubelong&0xFFfdFE00 0x00000000
|
||
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
|
||
>>>>>20 ubelong&0xFF01209B 0x00000000
|
||
# dBASE III
|
||
>>>>>>16 ubyte 3
|
||
# dBASE III DBT
|
||
>>>>>>>0 use xbase-memo-print
|
||
# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
|
||
>>>>>>16 ubyte 0
|
||
# dBASE IV DBT with DBF name or DBF garbage
|
||
>>>>>>>8 ubelong >0x40000000
|
||
# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
|
||
>>>>>>>>0 ulelong <0x01010002
|
||
>>>>>>>>>0 use xbase-memo-print
|
||
>>>>>>>8 ubelong 0
|
||
# skip MM*DD*.bin by test for for reserved NULL byte
|
||
>>>>>>>>508 ubelong 0
|
||
>>>>>>>>>0 use xbase-memo-print
|
||
# garbage PCX , ZIP , JAR , XPI
|
||
>>>>>>>8 default x
|
||
|
||
# Print the information of dBase DBT or FoxPro FPT memo files
|
||
0 name xbase-memo-print
|
||
>0 ubyte x
|
||
# test version
|
||
# memo file
|
||
>>16 ubyte 3 dBase III DBT
|
||
>>16 ubyte 0
|
||
>>>512 ubelong <0x00000003 FoxPro FPT
|
||
# Size of blocks for FoxPro
|
||
>>>>6 ubeshort x \b, blocks size %lu
|
||
# Number of next available block for appending data for FoxPro
|
||
>>>>0 ubelong =0 \b, next free block index %lu
|
||
>>>>0 ubelong !0 \b, next free block index %lu
|
||
>>>512 default x dBase IV DBT
|
||
# DBF file name without extention
|
||
>>>>8 string >\0 \b of %-.8s.DBF
|
||
# size of blocks ; not reliable 0x2020204C
|
||
#>>>>4 ulelong =0 \b, blocks size %lu
|
||
>>>>4 ulelong !0 \b, blocks size %lu
|
||
# Block length found 0 , 512
|
||
#>>>>20 uleshort =0 \b, block length %u
|
||
>>>>20 uleshort !0 \b, block length %u
|
||
# Number of next available block for appending data
|
||
>>>>0 ulelong =0 \b, next free block index %lu
|
||
>>>>0 ulelong !0 \b, next free block index %lu
|
||
>>512 ubelong x
|
||
>>>512 ubelong =0xFFFF0800
|
||
>>>>520 string >\0 \b, 1st used item "%s"
|
||
# FoxPro
|
||
>>>512 ubelong <3
|
||
# FoxPro memo
|
||
>>>>512 ubelong =1
|
||
>>>>520 string >\0 \b, 1st used item "%s"
|
||
>>>512 default x
|
||
# may be deleted memo field
|
||
>>>>512 string >\0 \b, 1st item "%s"
|
||
|
||
# TODO:
|
||
# DBASE index file *.NDX
|
||
# DBASE Compound Index file *.CDX
|
||
# dBASE IV Printer Driver *.PRF
|
||
## End of XBase database stuff
|
||
|
||
# MS Access database
|
||
4 string Standard\ Jet\ DB Microsoft Access Database
|
||
!:mime application/x-msaccess
|
||
4 string Standard\ ACE\ DB Microsoft Access Database
|
||
!:mime application/x-msaccess
|
||
|
||
# TDB database from Samba et al - Martin Pool <mbp@samba.org>
|
||
0 string TDB\ file TDB database
|
||
>32 lelong 0x2601196D version 6, little-endian
|
||
>>36 lelong x hash size %d bytes
|
||
|
||
# SE Linux policy database
|
||
0 lelong 0xf97cff8c SE Linux policy
|
||
>16 lelong x v%d
|
||
>20 lelong 1 MLS
|
||
>24 lelong x %d symbols
|
||
>28 lelong x %d ocons
|
||
|
||
# ICE authority file data (Wolfram Kleff)
|
||
2 string ICE ICE authority data
|
||
|
||
# X11 Xauthority file (Wolfram Kleff)
|
||
10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
|
||
|
||
# From: Maxime Henrion <mux@FreeBSD.org>
|
||
# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
|
||
0 string PGDMP PostgreSQL custom database dump
|
||
>5 byte x - v%d
|
||
>6 byte x \b.%d
|
||
>5 beshort <0x101 \b-0
|
||
>5 beshort >0x100
|
||
>>7 byte x \b-%d
|
||
|
||
# Type: Advanced Data Format (ADF) database
|
||
# URL: http://www.grc.nasa.gov/WWW/cgns/adf/
|
||
# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
|
||
0 string @(#)ADF\ Database CGNS Advanced Data Format
|
||
|
||
# Tokyo Cabinet magic data
|
||
# http://tokyocabinet.sourceforge.net/index.html
|
||
0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
|
||
>14 string x \b (%s)
|
||
>32 byte 0 \b, Hash
|
||
!:mime application/x-tokyocabinet-hash
|
||
>32 byte 1 \b, B+ tree
|
||
!:mime application/x-tokyocabinet-btree
|
||
>32 byte 2 \b, Fixed-length
|
||
!:mime application/x-tokyocabinet-fixed
|
||
>32 byte 3 \b, Table
|
||
!:mime application/x-tokyocabinet-table
|
||
>33 byte &1 \b, [open]
|
||
>33 byte &2 \b, [fatal]
|
||
>34 byte x \b, apow=%d
|
||
>35 byte x \b, fpow=%d
|
||
>36 byte &0x01 \b, [large]
|
||
>36 byte &0x02 \b, [deflate]
|
||
>36 byte &0x04 \b, [bzip]
|
||
>36 byte &0x08 \b, [tcbs]
|
||
>36 byte &0x10 \b, [excodec]
|
||
>40 lequad x \b, bnum=%lld
|
||
>48 lequad x \b, rnum=%lld
|
||
>56 lequad x \b, fsiz=%lld
|
||
|
||
# Type: QDBM Quick Database Manager
|
||
# From: Benoit Sibaud <bsibaud@april.org>
|
||
0 string \\[depot\\]\n\f Quick Database Manager, little endian
|
||
0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
|
||
|
||
# Type: TokyoCabinet database
|
||
# URL: http://tokyocabinet.sourceforge.net/
|
||
# From: Benoit Sibaud <bsibaud@april.org>
|
||
0 string ToKyO\ CaBiNeT\n TokyoCabinet database
|
||
>14 string x (version %s)
|
||
|
||
# From: Stephane Blondon http://www.yaal.fr
|
||
# Database file for Zope (done by FileStorage)
|
||
0 string FS21 Zope Object Database File Storage (data)
|
||
# Cache file for the database of Zope (done by ClientStorage)
|
||
0 string ZEC3 Zope Object Database Client Cache File (data)
|
||
|
||
# IDA (Interactive Disassembler) database
|
||
0 string IDA1 IDA (Interactive Disassembler) database
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
|
||
# diamond: file(1) magic for Diamond system
|
||
#
|
||
# ... diamond is a multi-media mail and electronic conferencing system....
|
||
#
|
||
# XXX - I think it was either renamed Slate, or replaced by Slate....
|
||
#
|
||
# The full deal is too long...
|
||
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
|
||
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
|
||
# diff: file(1) magic for diff(1) output
|
||
#
|
||
0 search/1 diff\ diff output text
|
||
!:mime text/x-diff
|
||
0 search/1 ***\ diff output text
|
||
!:mime text/x-diff
|
||
0 search/1 Only\ in\ diff output text
|
||
!:mime text/x-diff
|
||
0 search/1 Common\ subdirectories:\ diff output text
|
||
!:mime text/x-diff
|
||
|
||
0 search/1 Index: RCS/CVS diff output text
|
||
!:mime text/x-diff
|
||
|
||
# bsdiff: file(1) magic for bsdiff(1) output
|
||
0 string/b BSDIFF40 bsdiff(1) patch file
|
||
|
||
|
||
# unified diff
|
||
0 search/4096 ---\
|
||
>&0 search/1024 \n
|
||
>>&0 search/1 +++\
|
||
>>>&0 search/1024 \n
|
||
>>>>&0 search/1 @@ unified diff output text
|
||
!:mime text/x-diff
|
||
!:strength + 90
|
||
|
||
# librsync -- the library for network deltas
|
||
#
|
||
# Copyright (C) 2001 by Martin Pool. You may do whatever you want with
|
||
# this file.
|
||
#
|
||
0 belong 0x72730236 rdiff network-delta data
|
||
|
||
0 belong 0x72730136 rdiff network-delta signature data
|
||
>4 belong x (block length=%d,
|
||
>8 belong x signature strength=%d)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
|
||
# Digital UNIX - Info
|
||
#
|
||
0 string =!<arch>\n________64E Alpha archive
|
||
>22 string X -- out of date
|
||
#
|
||
|
||
0 leshort 0603
|
||
>24 leshort 0410 COFF format alpha pure
|
||
>24 leshort 0413 COFF format alpha demand paged
|
||
>>22 leshort&030000 !020000 executable
|
||
>>22 leshort&020000 !0 dynamically linked
|
||
>>16 lelong !0 not stripped
|
||
>>16 lelong 0 stripped
|
||
>>27 byte x - version %d
|
||
>>26 byte x \b.%d
|
||
>>28 byte x \b-%d
|
||
>24 leshort 0407 COFF format alpha object
|
||
>>22 leshort&030000 020000 shared library
|
||
>>27 byte x - version %d
|
||
>>26 byte x \b.%d
|
||
>>28 byte x \b-%d
|
||
|
||
# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
|
||
#
|
||
# The actual magic number is just "Core", followed by a 2-byte version
|
||
# number; however, treating any file that begins with "Core" as a Digital
|
||
# UNIX core dump file may produce too many false hits, so we include one
|
||
# byte of the version number as well; DU 5.0 appears only to be up to
|
||
# version 2.
|
||
#
|
||
0 string Core\001 Alpha COFF format core dump (Digital UNIX)
|
||
>24 string >\0 \b, from '%s'
|
||
0 string Core\002 Alpha COFF format core dump (Digital UNIX)
|
||
>24 string >\0 \b, from '%s'
|
||
#
|
||
# The next is incomplete, we could tell more about this format,
|
||
# but its not worth it.
|
||
0 leshort 0x188 Alpha compressed COFF
|
||
0 leshort 0x18f Alpha u-code object
|
||
#
|
||
#
|
||
# Some other interesting Digital formats,
|
||
0 string \377\377\177 ddis/ddif
|
||
0 string \377\377\174 ddis/dots archive
|
||
0 string \377\377\176 ddis/dtif table data
|
||
0 string \033c\033 LN03 output
|
||
0 long 04553207 X image
|
||
#
|
||
0 string =!<PDF>!\n profiling data file
|
||
#
|
||
# Locale data tables (MIPS and Alpha).
|
||
#
|
||
0 short 0x0501 locale data table
|
||
>6 short 0x24 for MIPS
|
||
>6 short 0x40 for Alpha
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $
|
||
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
|
||
# from http://www.atsc.org/standards/a_52a.pdf
|
||
# corrections, additions, etc. are always welcome!
|
||
#
|
||
# syncword
|
||
0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
|
||
!:mime audio/vnd.dolby.dd-raw
|
||
# fscod
|
||
>4 byte&0xc0 0x00 48 kHz,
|
||
>4 byte&0xc0 0x40 44.1 kHz,
|
||
>4 byte&0xc0 0x80 32 kHz,
|
||
# is this one used for 96 kHz?
|
||
>4 byte&0xc0 0xc0 reserved frequency,
|
||
#
|
||
>5 byte&7 = 0 \b, complete main (CM)
|
||
>5 byte&7 = 1 \b, music and effects (ME)
|
||
>5 byte&7 = 2 \b, visually impaired (VI)
|
||
>5 byte&7 = 3 \b, hearing impaired (HI)
|
||
>5 byte&7 = 4 \b, dialogue (D)
|
||
>5 byte&7 = 5 \b, commentary (C)
|
||
>5 byte&7 = 6 \b, emergency (E)
|
||
# acmod
|
||
>6 byte&0xe0 0x00 1+1 front,
|
||
>6 byte&0xe0 0x20 1 front/0 rear,
|
||
>6 byte&0xe0 0x40 2 front/0 rear,
|
||
>6 byte&0xe0 0x60 3 front/0 rear,
|
||
>6 byte&0xe0 0x80 2 front/1 rear,
|
||
>6 byte&0xe0 0xa0 3 front/1 rear,
|
||
>6 byte&0xe0 0xc0 2 front/2 rear,
|
||
>6 byte&0xe0 0xe0 3 front/2 rear,
|
||
# lfeon (these may be incorrect)
|
||
>7 byte&0x40 0x00 LFE off,
|
||
>7 byte&0x40 0x40 LFE on,
|
||
#
|
||
>4 byte&0x3e = 0x00 \b, 32 kbit/s
|
||
>4 byte&0x3e = 0x02 \b, 40 kbit/s
|
||
>4 byte&0x3e = 0x04 \b, 48 kbit/s
|
||
>4 byte&0x3e = 0x06 \b, 56 kbit/s
|
||
>4 byte&0x3e = 0x08 \b, 64 kbit/s
|
||
>4 byte&0x3e = 0x0a \b, 80 kbit/s
|
||
>4 byte&0x3e = 0x0c \b, 96 kbit/s
|
||
>4 byte&0x3e = 0x0e \b, 112 kbit/s
|
||
>4 byte&0x3e = 0x10 \b, 128 kbit/s
|
||
>4 byte&0x3e = 0x12 \b, 160 kbit/s
|
||
>4 byte&0x3e = 0x14 \b, 192 kbit/s
|
||
>4 byte&0x3e = 0x16 \b, 224 kbit/s
|
||
>4 byte&0x3e = 0x18 \b, 256 kbit/s
|
||
>4 byte&0x3e = 0x1a \b, 320 kbit/s
|
||
>4 byte&0x3e = 0x1c \b, 384 kbit/s
|
||
>4 byte&0x3e = 0x1e \b, 448 kbit/s
|
||
>4 byte&0x3e = 0x20 \b, 512 kbit/s
|
||
>4 byte&0x3e = 0x22 \b, 576 kbit/s
|
||
>4 byte&0x3e = 0x24 \b, 640 kbit/s
|
||
# dsurmod (these may be incorrect)
|
||
>6 beshort&0x0180 0x0000 Dolby Surround not indicated
|
||
>6 beshort&0x0180 0x0080 not Dolby Surround encoded
|
||
>6 beshort&0x0180 0x0100 Dolby Surround encoded
|
||
>6 beshort&0x0180 0x0180 reserved Dolby Surround mode
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
|
||
# dump: file(1) magic for dump file format--for new and old dump filesystems
|
||
#
|
||
# We specify both byte orders in order to recognize byte-swapped dumps.
|
||
#
|
||
0 name new-dump-be
|
||
>4 bedate x Previous dump %s,
|
||
>8 bedate x This dump %s,
|
||
>12 belong >0 Volume %ld,
|
||
>692 belong 0 Level zero, type:
|
||
>692 belong >0 Level %d, type:
|
||
>0 belong 1 tape header,
|
||
>0 belong 2 beginning of file record,
|
||
>0 belong 3 map of inodes on tape,
|
||
>0 belong 4 continuation of file record,
|
||
>0 belong 5 end of volume,
|
||
>0 belong 6 map of inodes deleted,
|
||
>0 belong 7 end of medium (for floppy),
|
||
>676 string >\0 Label %s,
|
||
>696 string >\0 Filesystem %s,
|
||
>760 string >\0 Device %s,
|
||
>824 string >\0 Host %s,
|
||
>888 belong >0 Flags %x
|
||
|
||
0 name old-dump-be
|
||
#>4 bedate x Previous dump %s,
|
||
#>8 bedate x This dump %s,
|
||
>12 belong >0 Volume %ld,
|
||
>692 belong 0 Level zero, type:
|
||
>692 belong >0 Level %d, type:
|
||
>0 belong 1 tape header,
|
||
>0 belong 2 beginning of file record,
|
||
>0 belong 3 map of inodes on tape,
|
||
>0 belong 4 continuation of file record,
|
||
>0 belong 5 end of volume,
|
||
>0 belong 6 map of inodes deleted,
|
||
>0 belong 7 end of medium (for floppy),
|
||
>676 string >\0 Label %s,
|
||
>696 string >\0 Filesystem %s,
|
||
>760 string >\0 Device %s,
|
||
>824 string >\0 Host %s,
|
||
>888 belong >0 Flags %x
|
||
|
||
0 name ufs2-dump-be
|
||
>896 beqdate x Previous dump %s,
|
||
>904 beqdate x This dump %s,
|
||
>12 belong >0 Volume %ld,
|
||
>692 belong 0 Level zero, type:
|
||
>692 belong >0 Level %d, type:
|
||
>0 belong 1 tape header,
|
||
>0 belong 2 beginning of file record,
|
||
>0 belong 3 map of inodes on tape,
|
||
>0 belong 4 continuation of file record,
|
||
>0 belong 5 end of volume,
|
||
>0 belong 6 map of inodes deleted,
|
||
>0 belong 7 end of medium (for floppy),
|
||
>676 string >\0 Label %s,
|
||
>696 string >\0 Filesystem %s,
|
||
>760 string >\0 Device %s,
|
||
>824 string >\0 Host %s,
|
||
>888 belong >0 Flags %x
|
||
|
||
24 belong 60012 new-fs dump file (big endian),
|
||
>0 use new-dump-be
|
||
|
||
24 belong 60011 old-fs dump file (big endian),
|
||
>0 use old-dump-be
|
||
|
||
24 lelong 60012 new-fs dump file (little endian),
|
||
>0 use \^new-dump-be
|
||
|
||
24 lelong 60011 old-fs dump file (little endian),
|
||
>0 use \^old-dump-be
|
||
|
||
|
||
24 belong 0x19540119 new-fs dump file (ufs2, big endian),
|
||
>0 use ufs2-dump-be
|
||
|
||
24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
|
||
>0 use \^ufs2-dump-be
|
||
|
||
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
|
||
>2 medate x Previous dump %s,
|
||
>6 medate x This dump %s,
|
||
>10 leshort >0 Volume %ld,
|
||
>0 leshort 1 tape header.
|
||
>0 leshort 2 beginning of file record.
|
||
>0 leshort 3 map of inodes on tape.
|
||
>0 leshort 4 continuation of file record.
|
||
>0 leshort 5 end of volume.
|
||
>0 leshort 6 map of inodes deleted.
|
||
>0 leshort 7 end of medium (for floppy).
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
|
||
# Dyadic: file(1) magic for Dyalog APL.
|
||
#
|
||
0 byte 0xaa
|
||
>1 byte <4 Dyalog APL
|
||
>>1 byte 0x00 incomplete workspace
|
||
>>1 byte 0x01 component file
|
||
>>1 byte 0x02 external variable
|
||
>>1 byte 0x03 workspace
|
||
>>2 byte x version %d
|
||
>>3 byte x .%d
|
||
|
||
0 beshort 0xaa03 Dyalog APL
|
||
>2 byte x workspace type %d
|
||
>3 byte x subtype %d
|
||
>7 byte&0x28 0x00 32-bit
|
||
>7 byte&0x28 0x20 64-bit
|
||
>7 byte&0x0c 0x00 classic
|
||
>7 byte&0x0c 0x04 unicode
|
||
>7 byte&0x88 0x00 big-endian
|
||
>7 byte&0x88 0x80 little-endian
|
||
|
||
0 byte 0xaa Dyalog APL
|
||
>1 byte 0x00 aplcore
|
||
>1 byte 0x01 component file 32-bit non-journaled non-checksummed
|
||
>1 byte 0x02 external variable exclusive
|
||
>1 byte 0x06 external variable shared
|
||
>1 byte 0x07 session
|
||
>1 byte 0x08 mapped file 32-bit
|
||
>1 byte 0x09 component file 64-bit non-journaled non-checksummed
|
||
>1 byte 0x0a mapped file 64-bit
|
||
>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
|
||
>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
|
||
>1 byte 0x0d component file 32-bit level 1 journaled checksummed
|
||
>1 byte 0x0e component file 64-bit level 1 journaled checksummed
|
||
>1 byte 0x0f component file 32-bit level 2 journaled checksummed
|
||
>1 byte 0x10 component file 64-bit level 2 journaled checksummed
|
||
>1 byte 0x11 component file 32-bit level 3 journaled checksummed
|
||
>1 byte 0x12 component file 64-bit level 3 journaled checksummed
|
||
>1 byte 0x13 component file 32-bit non-journaled checksummed
|
||
>1 byte 0x14 component file 64-bit non-journaled checksummed
|
||
>1 byte 0x80 DDB
|
||
|
||
0 short 0x6060 Dyalog APL transfer
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
|
||
# ebml: file(1) magic for various Extensible Binary Meta Language
|
||
# http://www.matroska.org/technical/specs/index.html#track
|
||
0 belong 0x1a45dfa3 EBML file
|
||
>4 search/b/100 \102\202
|
||
>>&1 string x \b, creator %.8s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $
|
||
# T602 editor documents
|
||
# by David Necas <yeti@physics.muni.cz>
|
||
0 string @CT\ T602 document data,
|
||
>4 string 0 Kamenicky
|
||
>4 string 1 CP 852
|
||
>4 string 2 KOI8-CS
|
||
>4 string >2 unknown encoding
|
||
|
||
# Vi IMproved Encrypted file
|
||
# by David Necas <yeti@physics.muni.cz>
|
||
0 string VimCrypt~ Vim encrypted file data
|
||
# Vi IMproved Swap file
|
||
# by Sven Wegener <swegener@gentoo.org>
|
||
0 string b0VIM\ Vim swap file
|
||
>&0 string >\0 \b, version %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# efi: file(1) magic for Universal EFI binaries
|
||
|
||
0 lelong 0x0ef1fab9
|
||
>4 lelong 1 Universal EFI binary with 1 architecture
|
||
>>&0 lelong 7 \b, i386
|
||
>>&0 lelong 0x01000007 \b, x86_64
|
||
>4 lelong 2 Universal EFI binary with 2 architectures
|
||
>>&0 lelong 7 \b, i386
|
||
>>&0 lelong 0x01000007 \b, x86_64
|
||
>>&20 lelong 7 \b, i386
|
||
>>&20 lelong 0x01000007 \b, x86_64
|
||
>4 lelong >2 Universal EFI binary with %ld architectures
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: elf,v 1.59 2013/03/21 17:50:02 christos Exp $
|
||
# elf: file(1) magic for ELF executables
|
||
#
|
||
# We have to check the byte order flag to see what byte order all the
|
||
# other stuff in the header is in.
|
||
#
|
||
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
|
||
#
|
||
# Created by: unknown
|
||
# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
|
||
# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
|
||
# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
|
||
# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
|
||
# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
|
||
|
||
0 name elf-le
|
||
>16 leshort 0 no file type,
|
||
!:mime application/octet-stream
|
||
>16 leshort 1 relocatable,
|
||
!:mime application/x-object
|
||
>16 leshort 2 executable,
|
||
!:mime application/x-executable
|
||
>16 leshort 3 shared object,
|
||
!:mime application/x-sharedlib
|
||
>16 leshort 4 core file
|
||
!:mime application/x-coredump
|
||
# Core file detection is not reliable.
|
||
#>>>(0x38+0xcc) string >\0 of '%s'
|
||
#>>>(0x38+0x10) lelong >0 (signal %d),
|
||
>16 leshort &0xff00 processor-specific,
|
||
>18 leshort 0 no machine,
|
||
>18 leshort 1 AT&T WE32100
|
||
>18 leshort 2 SPARC
|
||
>18 leshort 3 Intel 80386,
|
||
>18 leshort 4 Motorola
|
||
>>4 byte 1
|
||
>>>36 lelong &0x01000000 68000 - invalid byte order,
|
||
>>>36 lelong &0x00810000 CPU32 - invalid byte order,
|
||
>>>36 lelong 0 68020 - invalid byte order,
|
||
>18 leshort 5 Motorola 88000 - invalid byte order,
|
||
>18 leshort 6 Intel 80486,
|
||
>18 leshort 7 Intel 80860,
|
||
# The official e_machine number for MIPS is now #8, regardless of endianness.
|
||
# The second number (#10) will be deprecated later. For now, we still
|
||
# say something if #10 is encountered, but only gory details for #8.
|
||
>18 leshort 8 MIPS,
|
||
>>4 byte 1
|
||
>>>36 lelong &0x20 N32
|
||
>18 leshort 10 MIPS,
|
||
>>4 byte 1
|
||
>>>36 lelong &0x20 N32
|
||
>18 leshort 8
|
||
# only for 32-bit
|
||
>>4 byte 1
|
||
>>>36 lelong&0xf0000000 0x00000000 MIPS-I
|
||
>>>36 lelong&0xf0000000 0x10000000 MIPS-II
|
||
>>>36 lelong&0xf0000000 0x20000000 MIPS-III
|
||
>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
|
||
>>>36 lelong&0xf0000000 0x40000000 MIPS-V
|
||
>>>36 lelong&0xf0000000 0x50000000 MIPS32
|
||
>>>36 lelong&0xf0000000 0x60000000 MIPS64
|
||
>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2
|
||
>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2
|
||
# only for 64-bit
|
||
>>4 byte 2
|
||
>>>48 lelong&0xf0000000 0x00000000 MIPS-I
|
||
>>>48 lelong&0xf0000000 0x10000000 MIPS-II
|
||
>>>48 lelong&0xf0000000 0x20000000 MIPS-III
|
||
>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
|
||
>>>48 lelong&0xf0000000 0x40000000 MIPS-V
|
||
>>>48 lelong&0xf0000000 0x50000000 MIPS32
|
||
>>>48 lelong&0xf0000000 0x60000000 MIPS64
|
||
>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2
|
||
>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2
|
||
>18 leshort 9 Amdahl - invalid byte order,
|
||
>18 leshort 10 MIPS (deprecated),
|
||
>18 leshort 11 RS6000 - invalid byte order,
|
||
>18 leshort 15 PA-RISC - invalid byte order,
|
||
# only for 32-bit
|
||
>>4 byte 1
|
||
>>>38 leshort 0x0214 2.0
|
||
>>>36 leshort &0x0008 (LP64)
|
||
# only for 64-bit
|
||
>>4 byte 2
|
||
>>>50 leshort 0x0214 2.0
|
||
>>>48 leshort &0x0008 (LP64)
|
||
>18 leshort 16 nCUBE,
|
||
>18 leshort 17 Fujitsu VPP500,
|
||
>18 leshort 18 SPARC32PLUS,
|
||
# only for 32-bit
|
||
>>4 byte 1
|
||
>>>36 lelong&0xffff00 0x000100 V8+ Required,
|
||
>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
|
||
>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
|
||
>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
|
||
>18 leshort 20 PowerPC or cisco 4500,
|
||
>18 leshort 21 64-bit PowerPC or cisco 7500,
|
||
>18 leshort 22 IBM S/390,
|
||
>18 leshort 23 Cell SPU,
|
||
>18 leshort 24 cisco SVIP,
|
||
>18 leshort 25 cisco 7200,
|
||
>18 leshort 36 NEC V800 or cisco 12000,
|
||
>18 leshort 37 Fujitsu FR20,
|
||
>18 leshort 38 TRW RH-32,
|
||
>18 leshort 39 Motorola RCE,
|
||
>18 leshort 40 ARM,
|
||
>>4 byte 1
|
||
>>>36 lelong&0xff000000 0x04000000 EABI4
|
||
>>>36 lelong&0xff000000 0x05000000 EABI5
|
||
>18 leshort 41 Alpha,
|
||
>18 leshort 0xa390 IBM S/390 (obsolete),
|
||
>18 leshort 42 Renesas SH,
|
||
>18 leshort 43 SPARC V9,
|
||
>>4 byte 2
|
||
>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required,
|
||
>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required,
|
||
>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required,
|
||
>>>48 lelong&0x3 0 total store ordering,
|
||
>>>48 lelong&0x3 1 partial store ordering,
|
||
>>>48 lelong&0x3 2 relaxed memory ordering,
|
||
>18 leshort 44 Siemens Tricore Embedded Processor,
|
||
>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
|
||
>18 leshort 46 Renesas H8/300,
|
||
>18 leshort 47 Renesas H8/300H,
|
||
>18 leshort 48 Renesas H8S,
|
||
>18 leshort 49 Renesas H8/500,
|
||
>18 leshort 50 IA-64,
|
||
>18 leshort 51 Stanford MIPS-X,
|
||
>18 leshort 52 Motorola Coldfire,
|
||
>18 leshort 53 Motorola M68HC12,
|
||
>18 leshort 54 Fujitsu MMA,
|
||
>18 leshort 55 Siemens PCP,
|
||
>18 leshort 56 Sony nCPU,
|
||
>18 leshort 57 Denso NDR1,
|
||
>18 leshort 58 Start*Core,
|
||
>18 leshort 59 Toyota ME16,
|
||
>18 leshort 60 ST100,
|
||
>18 leshort 61 Tinyj emb.,
|
||
>18 leshort 62 x86-64,
|
||
>18 leshort 63 Sony DSP,
|
||
>18 leshort 66 FX66,
|
||
>18 leshort 67 ST9+ 8/16 bit,
|
||
>18 leshort 68 ST7 8 bit,
|
||
>18 leshort 69 MC68HC16,
|
||
>18 leshort 70 MC68HC11,
|
||
>18 leshort 71 MC68HC08,
|
||
>18 leshort 72 MC68HC05,
|
||
>18 leshort 73 SGI SVx or Cray NV1,
|
||
>18 leshort 74 ST19 8 bit,
|
||
>18 leshort 75 Digital VAX,
|
||
>18 leshort 76 Axis cris,
|
||
>18 leshort 77 Infineon 32-bit embedded,
|
||
>18 leshort 78 Element 14 64-bit DSP,
|
||
>18 leshort 79 LSI Logic 16-bit DSP,
|
||
>18 leshort 80 MMIX,
|
||
>18 leshort 81 Harvard machine-independent,
|
||
>18 leshort 82 SiTera Prism,
|
||
>18 leshort 83 Atmel AVR 8-bit,
|
||
>18 leshort 84 Fujitsu FR30,
|
||
>18 leshort 85 Mitsubishi D10V,
|
||
>18 leshort 86 Mitsubishi D30V,
|
||
>18 leshort 87 NEC v850,
|
||
>18 leshort 88 Renesas M32R,
|
||
>18 leshort 89 Matsushita MN10300,
|
||
>18 leshort 90 Matsushita MN10200,
|
||
>18 leshort 91 picoJava,
|
||
>18 leshort 92 OpenRISC,
|
||
>18 leshort 93 ARC Cores Tangent-A5,
|
||
>18 leshort 94 Tensilica Xtensa,
|
||
>18 leshort 97 NatSemi 32k,
|
||
>18 leshort 106 Analog Devices Blackfin,
|
||
>18 leshort 113 Altera Nios II,
|
||
>18 leshort 174 META,
|
||
>18 leshort 183 ARM aarch64,
|
||
>18 leshort 187 Tilera TILE64,
|
||
>18 leshort 188 Tilera TILEPro,
|
||
>18 leshort 191 Tilera TILE-Gx,
|
||
>18 leshort 0x3426 OpenRISC (obsolete),
|
||
>18 leshort 0x8472 OpenRISC (obsolete),
|
||
>18 leshort 0x9026 Alpha (unofficial),
|
||
>20 lelong 0 invalid version
|
||
>20 lelong 1 version 1
|
||
|
||
0 string \177ELF ELF
|
||
!:strength *2
|
||
>4 byte 0 invalid class
|
||
>4 byte 1 32-bit
|
||
>4 byte 2 64-bit
|
||
>5 byte 0 invalid byte order
|
||
>5 byte 1 LSB
|
||
>>0 use elf-le
|
||
>5 byte 2 MSB
|
||
>>0 use \^elf-le
|
||
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
|
||
# like proper ELF, but extracting the string had bad results.
|
||
>4 byte <0x80
|
||
>>8 string >\0 (%s)
|
||
>8 string \0
|
||
>>7 byte 0 (SYSV)
|
||
>>7 byte 1 (HP-UX)
|
||
>>7 byte 2 (NetBSD)
|
||
>>7 byte 3 (GNU/Linux)
|
||
>>7 byte 4 (GNU/Hurd)
|
||
>>7 byte 5 (86Open)
|
||
>>7 byte 6 (Solaris)
|
||
>>7 byte 7 (Monterey)
|
||
>>7 byte 8 (IRIX)
|
||
>>7 byte 9 (FreeBSD)
|
||
>>7 byte 10 (Tru64)
|
||
>>7 byte 11 (Novell Modesto)
|
||
>>7 byte 12 (OpenBSD)
|
||
>8 string \2
|
||
>>7 byte 13 (OpenVMS)
|
||
>>7 byte 97 (ARM)
|
||
>>7 byte 255 (embedded)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
|
||
# encore: file(1) magic for Encore machines
|
||
#
|
||
# XXX - needs to have the byte order specified (NS32K was little-endian,
|
||
# dunno whether they run the 88K in little-endian mode or not).
|
||
#
|
||
0 short 0x154 Encore
|
||
>20 short 0x107 executable
|
||
>20 short 0x108 pure executable
|
||
>20 short 0x10b demand-paged executable
|
||
>20 short 0x10f unsupported executable
|
||
>12 long >0 not stripped
|
||
>22 short >0 - version %ld
|
||
>22 short 0 -
|
||
#>4 date x stamp %s
|
||
0 short 0x155 Encore unsupported executable
|
||
>12 long >0 not stripped
|
||
>22 short >0 - version %ld
|
||
>22 short 0 -
|
||
#>4 date x stamp %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $
|
||
# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
|
||
# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
|
||
# Useful information for improving this file can be found at:
|
||
# http://software.frodo.looijaard.name/psiconv/formats/Index.html
|
||
#------------------------------------------------------------------------------
|
||
0 lelong 0x10000037 Psion Series 5
|
||
>4 lelong 0x10000039 font file
|
||
>4 lelong 0x1000003A printer driver
|
||
>4 lelong 0x1000003B clipboard
|
||
>4 lelong 0x10000042 multi-bitmap image
|
||
!:mime image/x-epoc-mbm
|
||
>4 lelong 0x1000006A application information file
|
||
>4 lelong 0x1000006D
|
||
>>8 lelong 0x1000007D Sketch image
|
||
!:mime image/x-epoc-sketch
|
||
>>8 lelong 0x1000007E voice note
|
||
>>8 lelong 0x1000007F Word file
|
||
!:mime application/x-epoc-word
|
||
>>8 lelong 0x10000085 OPL program (TextEd)
|
||
!:mime application/x-epoc-opl
|
||
>>8 lelong 0x10000087 Comms settings
|
||
>>8 lelong 0x10000088 Sheet file
|
||
!:mime application/x-epoc-sheet
|
||
>>8 lelong 0x100001C4 EasyFax initialisation file
|
||
>4 lelong 0x10000073 OPO module
|
||
!:mime application/x-epoc-opo
|
||
>4 lelong 0x10000074 OPL application
|
||
!:mime application/x-epoc-app
|
||
>4 lelong 0x1000008A exported multi-bitmap image
|
||
>4 lelong 0x1000016D
|
||
>>8 lelong 0x10000088 Comms names
|
||
|
||
0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
|
||
|
||
0 lelong 0x10000050 Psion Series 5
|
||
>4 lelong 0x1000006D database
|
||
>>8 lelong 0x10000084 Agenda file
|
||
!:mime application/x-epoc-agenda
|
||
>>8 lelong 0x10000086 Data file
|
||
!:mime application/x-epoc-data
|
||
>>8 lelong 0x10000CEA Jotter file
|
||
!:mime application/x-epoc-jotter
|
||
>4 lelong 0x100000E4 ini file
|
||
|
||
0 lelong 0x10000079 Psion Series 5 binary:
|
||
>4 lelong 0x00000000 DLL
|
||
>4 lelong 0x10000049 comms hardware library
|
||
>4 lelong 0x1000004A comms protocol library
|
||
>4 lelong 0x1000005D OPX
|
||
>4 lelong 0x1000006C application
|
||
>4 lelong 0x1000008D DLL
|
||
>4 lelong 0x100000AC logical device driver
|
||
>4 lelong 0x100000AD physical device driver
|
||
>4 lelong 0x100000E5 file transfer protocol
|
||
>4 lelong 0x100000E5 file transfer protocol
|
||
>4 lelong 0x10000140 printer definition
|
||
>4 lelong 0x10000141 printer definition
|
||
|
||
0 lelong 0x1000007A Psion Series 5 executable
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
|
||
# erlang: file(1) magic for Erlang JAM and BEAM files
|
||
# URL: http://www.erlang.org/faq/x779.html#AEN812
|
||
|
||
# OTP R3-R4
|
||
0 string \0177BEAM! Old Erlang BEAM file
|
||
>6 short >0 - version %d
|
||
|
||
# OTP R5 and onwards
|
||
0 string FOR1
|
||
>8 string BEAM Erlang BEAM file
|
||
|
||
# 4.2 version may have a copyright notice!
|
||
4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
|
||
79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
|
||
|
||
4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3
|
||
|
||
0 bequad 0x0000000000ABCDEF Erlang DETS file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
|
||
# Based on info from
|
||
# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
|
||
0 belong 9994 ESRI Shapefile
|
||
>4 belong =0
|
||
>8 belong =0
|
||
>12 belong =0
|
||
>16 belong =0
|
||
>20 belong =0
|
||
>28 lelong x version %d
|
||
>24 belong x length %d
|
||
>32 lelong =0 type Null Shape
|
||
>32 lelong =1 type Point
|
||
>32 lelong =3 type PolyLine
|
||
>32 lelong =5 type Polygon
|
||
>32 lelong =8 type MultiPoint
|
||
>32 lelong =11 type PointZ
|
||
>32 lelong =13 type PolyLineZ
|
||
>32 lelong =15 type PolygonZ
|
||
>32 lelong =18 type MultiPointZ
|
||
>32 lelong =21 type PointM
|
||
>32 lelong =23 type PolyLineM
|
||
>32 lelong =25 type PolygonM
|
||
>32 lelong =28 type MultiPointM
|
||
>32 lelong =31 type MultiPatch
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
|
||
# From Roger Leigh <roger@whinlatter.uklinux.net>
|
||
0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
|
||
0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
|
||
0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: filesystems,v 1.77 2013/03/14 01:38:30 christos Exp $
|
||
# filesystems: file(1) magic for different filesystems
|
||
#
|
||
0 string \366\366\366\366 PC formatted floppy with no filesystem
|
||
# Sun disk labels
|
||
# From /usr/include/sun/dklabel.h:
|
||
0774 beshort 0xdabe
|
||
# modified by Joerg Jenderek, because original test
|
||
# succeeds for Cabinet archive dao360.dl_ with negative blocks
|
||
>0770 long >0 Sun disk label
|
||
>>0 string x '%s
|
||
>>>31 string >\0 \b%s
|
||
>>>>63 string >\0 \b%s
|
||
>>>>>95 string >\0 \b%s
|
||
>>0 string x \b'
|
||
>>0734 short >0 %d rpm,
|
||
>>0736 short >0 %d phys cys,
|
||
>>0740 short >0 %d alts/cyl,
|
||
>>0746 short >0 %d interleave,
|
||
>>0750 short >0 %d data cyls,
|
||
>>0752 short >0 %d alt cyls,
|
||
>>0754 short >0 %d heads/partition,
|
||
>>0756 short >0 %d sectors/track,
|
||
>>0764 long >0 start cyl %ld,
|
||
>>0770 long x %ld blocks
|
||
# Is there a boot block written 1 sector in?
|
||
>512 belong&077777777 0600407 \b, boot block present
|
||
|
||
# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
|
||
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
|
||
0 string SBMBAKUP_ Smart Boot Manager backup file
|
||
>9 string x \b, version %-5.5s
|
||
>>14 string =_
|
||
>>>15 string x %-.1s
|
||
>>>>16 string =_ \b.
|
||
>>>>>17 string x \b%-.1s
|
||
>>>>>>18 string =_ \b.
|
||
>>>>>>>19 string x \b%-.1s
|
||
>>>22 ubyte 0
|
||
>>>>21 ubyte x \b, from drive 0x%x
|
||
>>>22 ubyte >0
|
||
>>>>21 string x \b, from drive %s
|
||
>>>535 search/17 \x55\xAA
|
||
>>>>&-512 indirect x \b; contains
|
||
|
||
# updated by Joerg Jenderek at Nov 2012
|
||
# DOS Emulator image is 128 byte, null right padded header + harddisc image
|
||
0 string DOSEMU\0
|
||
>0x27E leshort 0xAA55
|
||
#offset is 128
|
||
>>19 ubyte 128
|
||
>>>(19.b-1) ubyte 0x0 DOS Emulator image
|
||
>>>>7 ulelong >0 \b, %u heads
|
||
>>>>11 ulelong >0 \b, %d sectors/track
|
||
>>>>15 ulelong >0 \b, %d cylinders
|
||
>>>>128 indirect x \b; contains
|
||
|
||
# x86 boot sector updated by Joerg Jenderek at Sep 2007,May 2011
|
||
# for any allowed sector sizes
|
||
30 search/481 \x55\xAA
|
||
# to display x86 boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
|
||
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
|
||
!:strength +72
|
||
# for sector sizes < 512 Bytes
|
||
>11 uleshort <512
|
||
>>(11.s-2) uleshort 0xAA55 x86 boot sector
|
||
# for sector sizes with 512 or more Bytes
|
||
>0x1FE leshort 0xAA55 x86 boot sector
|
||
# keep old x86 boot sector as dummy for mbr and bootloader displaying
|
||
# only for sector sizes with 512 or more Bytes
|
||
0x1FE leshort 0xAA55
|
||
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
|
||
!:strength +21
|
||
>2 string OSBS \b, OS/BS MBR
|
||
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
|
||
# and http://en.wikipedia.org/wiki/Master_Boot_Record
|
||
# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
|
||
# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
|
||
>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
|
||
# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
|
||
# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
|
||
>>8 ubequad 0x8bf45007501ffbfc
|
||
# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
|
||
>>>0x16 ubyte 0xF3 \b,DOS 2
|
||
>>>>219 regex Author\ -\ Author:
|
||
# found "David Litton" , "A Pehrsson "
|
||
>>>>>&0 string x "%s"
|
||
>>>0x16 ubyte 0xF2
|
||
# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
|
||
# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
|
||
>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
|
||
# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
|
||
>>>>0x22 default x \b,D0S version 3.3-7.0
|
||
# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
|
||
# where nn is string offset varying for different languages
|
||
# "Invalid partition table" nn=0x8b for english version
|
||
>>>>>(0x49.b) string Invalid\ partition\ table english
|
||
>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german
|
||
>>>>>(0x49.b) string Table\ de\ partition\ invalide french
|
||
>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese
|
||
>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish
|
||
>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian
|
||
>>>>>0x49 ubyte >0 at offset 0x%x
|
||
>>>>>>(0x49.b) string >\0 "%s"
|
||
# "Error loading operating system" nn=0xa3 for english version
|
||
# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version
|
||
# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version
|
||
# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version
|
||
# "Error al cargar sistema operativo" nn=0xa8 for spanish version
|
||
# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version
|
||
>>>>>0x74 ubyte >0 at offset 0x%x
|
||
>>>>>>(0x74.b) string >\0 "%s"
|
||
# "Missing operating system" nn=0xc2 for english version
|
||
# "Betriebssystem fehlt" nn=0xcd for german version
|
||
# "Syst\212me d'exploitation absent" nn=0xd2 for french version
|
||
# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version
|
||
# "Falta sistema operativo" nn=0xca for spanish version
|
||
# "Sistema operativo mancante" nn=0xe2 for italian version
|
||
>>>>>0x79 ubyte >0 at offset 0x%x
|
||
>>>>>>(0x79.b) string >\0 "%s"
|
||
# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
|
||
# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
|
||
>>8 ubequad 0x5007501ffcbe1b7c
|
||
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
|
||
>>>24 ubequad 0xf3a4cbbebe07b104 9M
|
||
# "Invalid partition table" nn=0x10F for english version
|
||
# "Ungültige Partitionstabelle" nn=0x10F for german version
|
||
# "Table de partition erronée" nn=0x10F for french version
|
||
# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
|
||
>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
|
||
>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
|
||
>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french
|
||
>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian
|
||
>>>>0x3C ubyte x at offset 0x%x+0xFF
|
||
>>>>(0x3C.b+0x0FF) string >\0 "%s"
|
||
# "Error loading operating system" nn=0x127 for english version
|
||
# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
|
||
# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version
|
||
# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
|
||
>>>>0xBD ubyte x at offset 0x1%x
|
||
>>>>(0xBD.b+0x100) string >\0 "%s"
|
||
# "Missing operating system" nn=0x146 for english version
|
||
# "Betriebssystem fehlt" nn=0x151 for german version
|
||
# "Système d'exploitation manquant" nn=0x15e for french version
|
||
# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
|
||
>>>>0xA9 ubyte x at offset 0x1%x
|
||
>>>>(0xA9.b+0x100) string >\0 "%s"
|
||
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
|
||
# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
|
||
>>>24 ubequad 0xf3a4cbbdbe07b104 XP
|
||
# where xxyyzz are lower bits from offsets of error messages varying for different languages
|
||
>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
|
||
>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
|
||
# "Invalid partition table" xx=0x12C for english version
|
||
# "Ungültige Partitionstabelle" xx=0x12C for german version
|
||
>>>>0x1b5 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b5.b+0x100) string >\0 "%s"
|
||
# "Error loading operating system" yy=0x144 for english version
|
||
# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version
|
||
>>>>0x1b6 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b6.b+0x100) string >\0 "%s"
|
||
# "Missing operating system" zz=0x163 for english version
|
||
# "Betriebssystem nicht vorhanden" zz=0x16e for german version
|
||
>>>>0x1b7 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b7.b+0x100) string >\0 "%s"
|
||
# Microsoft Windows Vista or 7
|
||
# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
|
||
>>8 ubequad 0xc08ed8be007cbf00
|
||
# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
|
||
# assembler instructions: jnz 0729;cmp ebx,"TCPA"
|
||
>>>0xEC ubequad 0x753b6681fb544350 Vista
|
||
# where xxyyzz are lower bits from offsets of error messages varying for different languages
|
||
>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
|
||
#>>>>0x1B4 ubelong&0x00FFFFFF ? german
|
||
# "Invalid partition table" xx=0x162 for english version
|
||
# "Ungültige Partitionstabelle" xx=0x1?? for german version
|
||
>>>>0x1b5 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b5.b+0x100) string >\0 "%s"
|
||
# "Error loading operating system" yy=0x17a for english version
|
||
# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version
|
||
>>>>0x1b6 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b6.b+0x100) string >\0 "%s"
|
||
# "Missing operating system" zz=0x199 for english version
|
||
# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
|
||
>>>>0x1b7 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b7.b+0x100) string >\0 "%s"
|
||
# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
|
||
# assembler instructions: cmp ebx,"TCPA";cmp
|
||
>>>0xEC ubequad 0x6681fb5443504175 Windows 7
|
||
# where xxyyzz are lower bits from offsets of error messages varying for different languages
|
||
>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
|
||
#>>>>0x1B4 ubelong&0x00FFFFFF ? german
|
||
# "Invalid partition table" xx=0x163 for english version
|
||
# "Ungültige Partitionstabelle" xx=0x1?? for german version
|
||
>>>>0x1b5 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b5.b+0x100) string >\0 "%s"
|
||
# "Error loading operating system" yy=0x17b for english version
|
||
# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version
|
||
>>>>0x1b6 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b6.b+0x100) string >\0 "%s"
|
||
# "Missing operating system" zz=0x19a for english version
|
||
# "Betriebssystem nicht vorhanden" zz=0x1?? for german version
|
||
>>>>0x1b7 ubyte >0 at offset 0x1%x
|
||
>>>>(0x1b7.b+0x100) string >\0 "%s"
|
||
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
|
||
# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
|
||
>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
|
||
# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
|
||
>>0xDA uleshort 0
|
||
>>>0xDC ulelong >0 \b, created
|
||
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
|
||
>>>>0xDC ubyte x with driveID 0x%x
|
||
# hours, minutes and seconds
|
||
>>>>0xDf ubyte x at %x
|
||
>>>>0xDe ubyte x \b:%x
|
||
>>>>0xDd ubyte x \b:%x
|
||
# special case for Microsoft MS-DOS 3.21 spanish
|
||
# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
|
||
>0 ubequad 0xfab830008ed0bc00
|
||
# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
|
||
>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
|
||
# Microsoft MBR IPL end
|
||
|
||
# dr-dos with some upper-, lowercase variants
|
||
>0x9D string Invalid\ partition\ table$
|
||
>>181 string No\ Operating\ System$
|
||
>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
|
||
>0x9D string Invalid\ partition\ table$
|
||
>>181 string No\ operating\ system$
|
||
>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
|
||
>342 string Invalid\ partition\ table$
|
||
>>366 string No\ operating\ system$
|
||
>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
|
||
>295 string NEWLDR\0
|
||
>>302 string Bad\ PT\ $
|
||
>>>310 string No\ OS\ $
|
||
>>>>317 string OS\ load\ err$
|
||
>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
|
||
>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
|
||
>>>>>>>387 string Copyright\ (c)\ 1984,1998
|
||
>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
|
||
#
|
||
# tests for different MS-DOS Master Boot Records (MBR) moved and merged
|
||
#
|
||
#>0x145 string Default:\ F \b, FREE-DOS MBR
|
||
#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
|
||
>0x145 search/7 Default:\ F \b, FREE-DOS MBR
|
||
#>>313 string F0\ .\ .\ .
|
||
#>>>322 string disk\ 1
|
||
#>>>>382 string FAT3
|
||
>64 string no\ active\ partition\ found
|
||
>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
|
||
# Ranish Partition Manager http://www.ranish.com/part/
|
||
>387 search/4 \0\ Error!\r
|
||
>>378 search/7 Virus!
|
||
>>>397 search/4 Booting\
|
||
>>>>408 search/4 HD1/\0 \b, Ranish MBR (
|
||
>>>>>416 string Writing\ changes... \b2.37
|
||
>>>>>>438 ubyte x \b,0x%x dots
|
||
>>>>>>440 ubyte >0 \b,virus check
|
||
>>>>>>441 ubyte >0 \b,partition %c
|
||
#2.38,2.42,2.44
|
||
>>>>>416 string !Writing\ changes... \b
|
||
>>>>>>418 ubyte 1 \bvirus check,
|
||
>>>>>>419 ubyte x \b0x%x seconds
|
||
>>>>>>420 ubyte&0x0F >0 \b,partition
|
||
>>>>>>>420 ubyte&0x0F <5 \b %x
|
||
>>>>>>>420 ubyte&0x0F 0Xf \b ask
|
||
>>>>>420 ubyte x \b)
|
||
#
|
||
# SYSLINUX MBR moved
|
||
# http://www.acronis.de/
|
||
>362 string MBR\ Error\ \0\r
|
||
>>376 string ress\ any\ key\ to\
|
||
>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
|
||
# added by Joerg Jenderek
|
||
# http://www.visopsys.org/
|
||
# http://partitionlogic.org.uk/
|
||
>309 string No\ bootable\ partition\ found\r
|
||
>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
|
||
>349 string No\ bootable\ partition\ found\r
|
||
>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
|
||
# bootloader, bootmanager
|
||
>0x40 string SBML
|
||
# label with 11 characters of FAT 12 bit filesystem
|
||
>>43 string SMART\ BTMGR
|
||
>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
|
||
# OEM-ID not always "SBM"
|
||
#>>>>3 strings SBM
|
||
>>>>6 string >\0 \b, version %s
|
||
>382 string XOSLLOADXCF \b, eXtended Operating System Loader
|
||
>6 string LILO \b, LInux i386 boot LOader
|
||
>>120 string LILO \b, version 22.3.4 SuSe
|
||
>>172 string LILO \b, version 22.5.8 Debian
|
||
# updated by Joerg Jenderek at Oct 2008
|
||
# variables according to grub-0.97/stage1/stage1.S or
|
||
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
|
||
# usual values are marked with comments to get only informations of strange GRUB loaders
|
||
>342 search/60 \0Geom\0
|
||
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
|
||
>>0x41 ubyte <2
|
||
>>>0x3E ubyte >2 \b; GRand Unified Bootloader
|
||
# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
|
||
>>>>0x3E ubyte x \b, stage1 version 0x%x
|
||
#If it is 0xFF, use a drive passed by BIOS
|
||
>>>>0x40 ubyte <0xFF \b, boot drive 0x%x
|
||
# in most case 0,1,0x2e for GRUB 0.5.95
|
||
>>>>0x41 ubyte >0 \b, LBA flag 0x%x
|
||
>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
|
||
#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
|
||
>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
|
||
#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
|
||
>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
|
||
>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
|
||
#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
|
||
>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
|
||
>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>>394 string stage1 \b, GRUB version 0.5.95
|
||
>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
|
||
>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>>377 string GRUB\ \0 \b, GRUB version 0.94
|
||
>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
|
||
>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
|
||
#unkown version
|
||
>>>343 string Geom\0Read\0\ Error\0
|
||
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
|
||
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
|
||
>>>>374 string GRUB\ \0 \b, GRUB version n.m
|
||
# SYSLINUX bootloader moved
|
||
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
|
||
# http://www.bcdwb.de/bcdw/index_e.htm
|
||
>3 string BCDL
|
||
>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
|
||
# mbr partition table entries
|
||
# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs
|
||
>3 string !MS
|
||
>>3 string !SYSLINUX
|
||
>>>3 string !MTOOL
|
||
>>>>3 string !NEWLDR
|
||
>>>>>5 string !DOS
|
||
# not FAT (32 bit)
|
||
>>>>>>82 string !FAT32
|
||
#not Linux kernel
|
||
>>>>>>>514 string !HdrS
|
||
#not BeOS
|
||
>>>>>>>>422 string !Be\ Boot\ Loader
|
||
# active flag 0 or 0x80 and type > 0
|
||
>>>>>>>>>446 ubyte <0x81
|
||
>>>>>>>>>>446 ubyte&0x7F 0
|
||
>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
|
||
>>>>>>>>>>>>446 ubyte 0x80 \b, active
|
||
>>>>>>>>>>>>447 ubyte x \b, starthead %u
|
||
#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
|
||
#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
|
||
>>>>>>>>>>>>454 ulelong x \b, startsector %u
|
||
>>>>>>>>>>>>458 ulelong x \b, %u sectors
|
||
#
|
||
>>>>>>>>>462 ubyte <0x81
|
||
>>>>>>>>>>462 ubyte&0x7F 0
|
||
>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
|
||
>>>>>>>>>>>>462 ubyte 0x80 \b, active
|
||
>>>>>>>>>>>>463 ubyte x \b, starthead %u
|
||
#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
|
||
#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
|
||
>>>>>>>>>>>>470 ulelong x \b, startsector %u
|
||
>>>>>>>>>>>>474 ulelong x \b, %u sectors
|
||
#
|
||
>>>>>>>>>478 ubyte <0x81
|
||
>>>>>>>>>>478 ubyte&0x7F 0
|
||
>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
|
||
>>>>>>>>>>>>478 ubyte 0x80 \b, active
|
||
>>>>>>>>>>>>479 ubyte x \b, starthead %u
|
||
#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
|
||
#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
|
||
#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
|
||
>>>>>>>>>>>>486 ulelong x \b, startsector %u
|
||
>>>>>>>>>>>>490 ulelong x \b, %u sectors
|
||
#
|
||
>>>>>>>>>494 ubyte <0x81
|
||
>>>>>>>>>>494 ubyte&0x7F 0
|
||
>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
|
||
>>>>>>>>>>>>494 ubyte 0x80 \b, active
|
||
>>>>>>>>>>>>495 ubyte x \b, starthead %u
|
||
#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
|
||
#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
|
||
>>>>>>>>>>>>502 ulelong x \b, startsector %u
|
||
>>>>>>>>>>>>506 ulelong x \b, %u sectors
|
||
# mbr partition table entries end
|
||
# http://www.acronis.de/
|
||
#FAT label=ACRONIS\ SZ
|
||
#OEM-ID=BOOTWIZ0
|
||
>442 string Non-system\ disk,\
|
||
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
|
||
# updated by Joerg Jenderek at Nov 2012
|
||
# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
|
||
>>>477 ubyte&0xDF >0
|
||
>>>>477 string x \b %-.3s
|
||
>>>>>480 ubyte&0xDF >0
|
||
>>>>>>480 string x \b%-.4s
|
||
>>>>>>>484 ubyte&0xDF >0
|
||
>>>>>>>>484 string x \b%-.1s
|
||
>>>>485 ubyte&0xDF >0
|
||
>>>>>485 string x \b.%-.3s
|
||
#
|
||
>185 string FDBOOT\ Version\
|
||
>>204 string \rNo\ Systemdisk.\
|
||
>>>220 string Booting\ from\ harddisk.\n\r
|
||
>>>245 string Cannot\ load\ from\ harddisk.\n\r
|
||
>>>>273 string Insert\ Systemdisk\
|
||
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
|
||
>>>>>>200 string >\0 \b, version %-3s
|
||
>242 string Bootsector\ from\ C.H.\ Hochst\204
|
||
# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
|
||
# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
|
||
# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
|
||
>242 search/127 Bootsector\ from\ C.H.\ Hochst
|
||
>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
|
||
# followed by variants with point,CR-NL or NL-CR
|
||
>>>208 search/261 Cannot\ load\ from\ harddisk.
|
||
# followed by variants CR-NL or NL-CR
|
||
>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
|
||
# followed by variants with point,CR-NL or NL-CR
|
||
>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
|
||
# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
|
||
>>>>>>&0 string x \b, version %-4.4s
|
||
>(1.b+2) ubyte 0xe
|
||
>>(1.b+3) ubyte 0x1f
|
||
>>>(1.b+4) ubyte 0xbe
|
||
# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
|
||
>>>>(1.b+5) ubyte&0xd3 0x53
|
||
>>>>>(1.b+6) ubyte 0x7c
|
||
# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
|
||
>>>>>>(1.b+7) ubyte 0xac
|
||
>>>>>>>(1.b+8) ubyte 0x22
|
||
>>>>>>>>(1.b+9) ubyte 0xc0
|
||
>>>>>>>>>(1.b+10) ubyte 0x74
|
||
>>>>>>>>>>(1.b+11) ubyte 0x0b
|
||
>>>>>>>>>>>(1.b+12) ubyte 0x56
|
||
>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
|
||
# FAT1X version
|
||
>>>>>>>>>>>>>(1.b+5) ubyte 0x5b
|
||
>>>>>>>>>>>>>>0x5b string >\0 "%-s"
|
||
# FAT32 version
|
||
>>>>>>>>>>>>>(1.b+5) ubyte 0x77
|
||
>>>>>>>>>>>>>>0x77 string >\0 "%-s"
|
||
>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
|
||
#>>244 string from\ dosemu-freedos-*-bin.tgz\r
|
||
#>>>170 string Sorry,\ could\ not\ load\ an\
|
||
#>>>>195 string operating\ system.\r\n
|
||
#
|
||
>103 string This\ is\ not\ a\ bootable\ disk.\
|
||
>>132 string Please\ insert\ a\ bootable\
|
||
>>>157 string floppy\ and\r\n
|
||
>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
|
||
#
|
||
>66 string Solaris\ Boot\ Sector
|
||
>>99 string Incomplete\ MDBoot\ load.
|
||
>>>89 string Version \b, Sun Solaris Bootloader
|
||
>>>>97 byte x version %c
|
||
#
|
||
>408 string OS/2\ !!\ SYS01475\r\0
|
||
>>429 string OS/2\ !!\ SYS02025\r\0
|
||
>>>450 string OS/2\ !!\ SYS02027\r\0
|
||
>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
|
||
#
|
||
>409 string OS/2\ !!\ SYS01475\r\0
|
||
>>430 string OS/2\ !!\ SYS02025\r\0
|
||
>>>451 string OS/2\ !!\ SYS02027\r\0
|
||
>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
|
||
>112 string This\ disk\ is\ not\ bootable\r
|
||
>>142 string If\ you\ wish\ to\ make\ it\ bootable
|
||
>>>176 string run\ the\ DOS\ program\ SYS\
|
||
>>>200 string after\ the\r
|
||
>>>>216 string system\ has\ been\ loaded\r\n
|
||
>>>>>242 string Please\ insert\ a\ DOS\ diskette\
|
||
>>>>>271 string into\r\n\ the\ drive\ and\
|
||
>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
|
||
# XP
|
||
>430 string NTLDR\ is\ missing\xFF\r\n
|
||
>>449 string Disk\ error\xFF\r\n
|
||
>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
|
||
# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
|
||
>>>>417 ubyte&0xDF >0
|
||
>>>>>417 string x %-.5s
|
||
>>>>>>422 ubyte&0xDF >0
|
||
>>>>>>>422 string x \b%-.3s
|
||
>>>>>425 ubyte&0xDF >0
|
||
>>>>>>425 string >\ \b.%-.3s
|
||
#
|
||
>>>>371 ubyte >0x20
|
||
>>>>>368 ubyte&0xDF >0
|
||
>>>>>>368 string x %-.5s
|
||
>>>>>>>373 ubyte&0xDF >0
|
||
>>>>>>>>373 string x \b%-.3s
|
||
>>>>>>376 ubyte&0xDF >0
|
||
>>>>>>>376 string x \b.%-.3s
|
||
#
|
||
>430 string NTLDR\ nicht\ gefunden\xFF\r\n
|
||
>>453 string Datentr\204gerfehler\xFF\r\n
|
||
>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
|
||
>>>>417 ubyte&0xDF >0
|
||
>>>>>417 string x %-.5s
|
||
>>>>>>422 ubyte&0xDF >0
|
||
>>>>>>>422 string x \b%-.3s
|
||
>>>>>425 ubyte&0xDF >0
|
||
>>>>>>425 string >\ \b.%-.3s
|
||
# offset variant
|
||
>>>>379 string \0
|
||
>>>>>368 ubyte&0xDF >0
|
||
>>>>>>368 string x %-.5s
|
||
>>>>>>>373 ubyte&0xDF >0
|
||
>>>>>>>>373 string x \b%-.3s
|
||
#
|
||
>430 string NTLDR\ fehlt\xFF\r\n
|
||
>>444 string Datentr\204gerfehler\xFF\r\n
|
||
>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
|
||
>>>>417 ubyte&0xDF >0
|
||
>>>>>417 string x %-.5s
|
||
>>>>>>422 ubyte&0xDF >0
|
||
>>>>>>>422 string x \b%-.3s
|
||
>>>>>425 ubyte&0xDF >0
|
||
>>>>>>425 string >\ \b.%-.3s
|
||
# variant
|
||
>>>>371 ubyte >0x20
|
||
>>>>>368 ubyte&0xDF >0
|
||
>>>>>>368 string x %-.5s
|
||
>>>>>>>373 ubyte&0xDF >0
|
||
>>>>>>>>373 string x \b%-.3s
|
||
>>>>>>376 ubyte&0xDF >0
|
||
>>>>>>>376 string x \b.%-.3s
|
||
#
|
||
>430 string NTLDR\ fehlt\xFF\r\n
|
||
>>444 string Medienfehler\xFF\r\n
|
||
>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
|
||
>>>>371 ubyte >0x20
|
||
>>>>>368 ubyte&0xDF >0
|
||
>>>>>>368 string x %-.5s
|
||
>>>>>>>373 ubyte&0xDF >0
|
||
>>>>>>>>373 string x \b%-.3s
|
||
>>>>>>376 ubyte&0xDF >0
|
||
>>>>>>>376 string x \b.%-.3s
|
||
# variant
|
||
>>>>417 ubyte&0xDF >0
|
||
>>>>>417 string x %-.5s
|
||
>>>>>>422 ubyte&0xDF >0
|
||
>>>>>>>422 string x \b%-.3s
|
||
>>>>>425 ubyte&0xDF >0
|
||
>>>>>>425 string >\ \b.%-.3s
|
||
#
|
||
>430 string Datentr\204ger\ entfernen\xFF\r\n
|
||
>>454 string Medienfehler\xFF\r\n
|
||
>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
|
||
>>>>379 string \0
|
||
>>>>>368 ubyte&0xDF >0
|
||
>>>>>>368 string x %-.5s
|
||
>>>>>>>373 ubyte&0xDF >0
|
||
>>>>>>>>373 string x \b%-.3s
|
||
>>>>>>376 ubyte&0xDF >0
|
||
>>>>>>>376 string x \b.%-.3s
|
||
# variant
|
||
>>>>417 ubyte&0xDF >0
|
||
>>>>>417 string x %-.5s
|
||
>>>>>>422 ubyte&0xDF >0
|
||
>>>>>>>422 string x \b%-.3s
|
||
>>>>>425 ubyte&0xDF >0
|
||
>>>>>>425 string >\ \b.%-.3s
|
||
#
|
||
|
||
#>3 string NTFS\ \ \ \
|
||
>389 string Fehler\ beim\ Lesen\
|
||
>>407 string des\ Datentr\204gers
|
||
>>>426 string NTLDR\ fehlt
|
||
>>>>440 string NTLDR\ ist\ komprimiert
|
||
>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
|
||
#>3 string NTFS\ \ \ \
|
||
>313 string A\ disk\ read\ error\ occurred.\r
|
||
>>345 string A\ kernel\ file\ is\ missing\
|
||
>>>370 string from\ the\ disk.\r
|
||
>>>>484 string NTLDR\ is\ compressed
|
||
>>>>>429 string Insert\ a\ system\ diskette\
|
||
>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
|
||
# DOS loader variants different languages,offsets
|
||
>472 ubyte&0xDF >0
|
||
>>389 string Invalid\ system\ disk\xFF\r\n
|
||
>>>411 string Disk\ I/O\ error
|
||
>>>>428 string Replace\ the\ disk,\ and\
|
||
>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
|
||
#IO.SYS
|
||
>>>>>>472 ubyte&0xDF >0
|
||
>>>>>>>472 string x \b %-.2s
|
||
>>>>>>>>474 ubyte&0xDF >0
|
||
>>>>>>>>>474 string x \b%-.5s
|
||
>>>>>>>>>>479 ubyte&0xDF >0
|
||
>>>>>>>>>>>479 string x \b%-.1s
|
||
>>>>>>>480 ubyte&0xDF >0
|
||
>>>>>>>>480 string x \b.%-.3s
|
||
#MSDOS.SYS
|
||
>>>>>>>483 ubyte&0xDF >0 \b+
|
||
>>>>>>>>483 string x \b%-.5s
|
||
>>>>>>>>>488 ubyte&0xDF >0
|
||
>>>>>>>>>>488 string x \b%-.3s
|
||
>>>>>>>>491 ubyte&0xDF >0
|
||
>>>>>>>>>491 string x \b.%-.3s
|
||
#
|
||
>>390 string Invalid\ system\ disk\xFF\r\n
|
||
>>>412 string Disk\ I/O\ error\xFF\r\n
|
||
>>>>429 string Replace\ the\ disk,\ and\
|
||
>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
|
||
>>388 string Ungueltiges\ System\ \xFF\r\n
|
||
>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
|
||
>>>>427 string Datentraeger\ wechseln\ und\
|
||
>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
|
||
#WINBOOT.SYS only not spaces (0xDF)
|
||
>>>>>>497 ubyte&0xDF >0
|
||
>>>>>>>497 string x %-.5s
|
||
>>>>>>>>502 ubyte&0xDF >0
|
||
>>>>>>>>>502 string x \b%-.1s
|
||
>>>>>>>>>>503 ubyte&0xDF >0
|
||
>>>>>>>>>>>503 string x \b%-.1s
|
||
>>>>>>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>504 string x \b%-.1s
|
||
>>>>>>505 ubyte&0xDF >0
|
||
>>>>>>>505 string x \b.%-.3s
|
||
#IO.SYS
|
||
>>>>>>472 ubyte&0xDF >0 or
|
||
>>>>>>>472 string x \b %-.2s
|
||
>>>>>>>>474 ubyte&0xDF >0
|
||
>>>>>>>>>474 string x \b%-.5s
|
||
>>>>>>>>>>479 ubyte&0xDF >0
|
||
>>>>>>>>>>>479 string x \b%-.1s
|
||
>>>>>>>480 ubyte&0xDF >0
|
||
>>>>>>>>480 string x \b.%-.3s
|
||
#MSDOS.SYS
|
||
>>>>>>>483 ubyte&0xDF >0 \b+
|
||
>>>>>>>>483 string x \b%-.5s
|
||
>>>>>>>>>488 ubyte&0xDF >0
|
||
>>>>>>>>>>488 string x \b%-.3s
|
||
>>>>>>>>491 ubyte&0xDF >0
|
||
>>>>>>>>>491 string x \b.%-.3s
|
||
#
|
||
>>390 string Ungueltiges\ System\ \xFF\r\n
|
||
>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
|
||
>>>>429 string Datentraeger\ wechseln\ und\
|
||
>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
|
||
#WINBOOT.SYS only not spaces (0xDF)
|
||
>>>>>>497 ubyte&0xDF >0
|
||
>>>>>>>497 string x %-.7s
|
||
>>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>>504 string x \b%-.1s
|
||
>>>>>>505 ubyte&0xDF >0
|
||
>>>>>>>505 string x \b.%-.3s
|
||
#IO.SYS
|
||
>>>>>>472 ubyte&0xDF >0 or
|
||
>>>>>>>472 string x \b %-.2s
|
||
>>>>>>>>474 ubyte&0xDF >0
|
||
>>>>>>>>>474 string x \b%-.6s
|
||
>>>>>>>480 ubyte&0xDF >0
|
||
>>>>>>>>480 string x \b.%-.3s
|
||
#MSDOS.SYS
|
||
>>>>>>>483 ubyte&0xDF >0 \b+
|
||
>>>>>>>>483 string x \b%-.5s
|
||
>>>>>>>>>488 ubyte&0xDF >0
|
||
>>>>>>>>>>488 string x \b%-.3s
|
||
>>>>>>>>491 ubyte&0xDF >0
|
||
>>>>>>>>>491 string x \b.%-.3s
|
||
#
|
||
>>389 string Ungueltiges\ System\ \xFF\r\n
|
||
>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
|
||
>>>>428 string Datentraeger\ wechseln\ und\
|
||
>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
|
||
# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
|
||
>>>>>>472 string x %-.2s
|
||
>>>>>>>474 ubyte&0xDF >0
|
||
>>>>>>>>474 string x \b%-.5s
|
||
>>>>>>>>479 ubyte&0xDF >0
|
||
>>>>>>>>>479 string x \b%-.1s
|
||
>>>>>>480 ubyte&0xDF >0
|
||
>>>>>>>480 string x \b.%-.3s
|
||
>>>>>>483 ubyte&0xDF >0 \b+
|
||
>>>>>>>483 string x \b%-.5s
|
||
>>>>>>>488 ubyte&0xDF >0
|
||
>>>>>>>>488 string x \b%-.2s
|
||
>>>>>>>>490 ubyte&0xDF >0
|
||
>>>>>>>>>490 string x \b%-.1s
|
||
>>>>>>>491 ubyte&0xDF >0
|
||
>>>>>>>>491 string x \b.%-.3s
|
||
>479 ubyte&0xDF >0
|
||
>>416 string Kein\ System\ oder\
|
||
>>>433 string Laufwerksfehler
|
||
>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
|
||
#IO.SYS
|
||
>>>>>479 string x \b %-.2s
|
||
>>>>>>481 ubyte&0xDF >0
|
||
>>>>>>>481 string x \b%-.6s
|
||
>>>>>487 ubyte&0xDF >0
|
||
>>>>>>487 string x \b.%-.3s
|
||
#MSDOS.SYS
|
||
>>>>>>490 ubyte&0xDF >0 \b+
|
||
>>>>>>>490 string x \b%-.5s
|
||
>>>>>>>>495 ubyte&0xDF >0
|
||
>>>>>>>>>495 string x \b%-.3s
|
||
>>>>>>>498 ubyte&0xDF >0
|
||
>>>>>>>>498 string x \b.%-.3s
|
||
#
|
||
>376 search/41 Non-System\ disk\ or\
|
||
>>395 search/41 disk\ error\r
|
||
>>>407 search/41 Replace\ and\
|
||
>>>>419 search/41 press\ \b,
|
||
>>>>419 search/41 strike\ \b, old
|
||
>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
|
||
#449 Disk\ Boot\ failure\r MS 3.21
|
||
#466 Boot\ Failure\r MS 3.30
|
||
>>>>>468 search/18 \0
|
||
#IO.SYS,IBMBIO.COM
|
||
>>>>>>&0 string x \b %-.2s
|
||
>>>>>>>&-20 ubyte&0xDF >0
|
||
>>>>>>>>&-1 string x \b%-.4s
|
||
>>>>>>>>>&-16 ubyte&0xDF >0
|
||
>>>>>>>>>>&-1 string x \b%-.2s
|
||
>>>>>>&8 ubyte&0xDF >0 \b.
|
||
>>>>>>>&-1 string x \b%-.3s
|
||
#MSDOS.SYS,IBMDOS.COM
|
||
>>>>>>&11 ubyte&0xDF >0 \b+
|
||
>>>>>>>&-1 string x \b%-.5s
|
||
>>>>>>>>&-6 ubyte&0xDF >0
|
||
>>>>>>>>>&-1 string x \b%-.1s
|
||
>>>>>>>>>>&-5 ubyte&0xDF >0
|
||
>>>>>>>>>>>&-1 string x \b%-.2s
|
||
>>>>>>>&7 ubyte&0xDF >0 \b.
|
||
>>>>>>>>&-1 string x \b%-.3s
|
||
>441 string Cannot\ load\ from\ harddisk.\n\r
|
||
>>469 string Insert\ Systemdisk\
|
||
>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
|
||
#>43 string \224R-LOADER\ \ SYS =label
|
||
>54 string SYS
|
||
>>324 string VASKK
|
||
>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
|
||
#
|
||
>98 string Press\ a\ key\ to\ retry\0\r
|
||
>>120 string Cannot\ find\ file\ \0\r
|
||
>>>139 string Disk\ read\ error\0\r
|
||
>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
|
||
#DRBIOS.SYS
|
||
>>>>>44 ubyte&0xDF >0
|
||
>>>>>>44 string x \b %-.6s
|
||
>>>>>>>50 ubyte&0xDF >0
|
||
>>>>>>>>50 string x \b%-.2s
|
||
>>>>>>52 ubyte&0xDF >0
|
||
>>>>>>>52 string x \b.%-.3s
|
||
#
|
||
>70 string IBMBIO\ \ COM
|
||
>>472 string Cannot\ load\ DOS!\
|
||
>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
|
||
>>471 string Cannot\ load\ DOS\
|
||
>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
|
||
#??
|
||
>444 string KERNEL\ \ SYS
|
||
>>314 string BOOT\ error! \b, FREE-DOS Bootloader
|
||
>499 string KERNEL\ \ SYS
|
||
>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
|
||
>449 string KERNEL\ \ SYS
|
||
>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
|
||
#
|
||
>449 string Loading\ FreeDOS
|
||
>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
|
||
>>>497 ubyte&0xDF >0
|
||
>>>>497 string x \b %-.6s
|
||
>>>>>503 ubyte&0xDF >0
|
||
>>>>>>503 string x \b%-.1s
|
||
>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>504 string x \b%-.1s
|
||
>>>>505 ubyte&0xDF >0
|
||
>>>>>505 string x \b.%-.3s
|
||
#
|
||
>331 string Error!.0 \b, FREE-DOS 1.0 bootloader
|
||
#
|
||
>125 string Loading\ FreeDOS...\r
|
||
>>311 string BOOT\ error!\r \b, FREE-DOS bootloader
|
||
>>>441 ubyte&0xDF >0
|
||
>>>>441 string x \b %-.6s
|
||
>>>>>447 ubyte&0xDF >0
|
||
>>>>>>447 string x \b%-.1s
|
||
>>>>>>>448 ubyte&0xDF >0
|
||
>>>>>>>>448 string x \b%-.1s
|
||
>>>>449 ubyte&0xDF >0
|
||
>>>>>449 string x \b.%-.3s
|
||
>124 string FreeDOS\0
|
||
>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
|
||
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
|
||
>>>497 ubyte&0xDF >0
|
||
>>>>497 string x \b %-.6s
|
||
>>>>>503 ubyte&0xDF >0
|
||
>>>>>>503 string x \b%-.1s
|
||
>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>504 string x \b%-.1s
|
||
>>>>505 ubyte&0xDF >0
|
||
>>>>>505 string x \b.%-.3s
|
||
>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
|
||
>>>497 ubyte&0xDF >0
|
||
>>>>497 string x \b %-.6s
|
||
>>>>>503 ubyte&0xDF >0
|
||
>>>>>>503 string x \b%-.1s
|
||
>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>504 string x \b%-.1s
|
||
>>>>505 ubyte&0xDF >0
|
||
>>>>>505 string x \b.%-.3s
|
||
>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
|
||
>>>497 ubyte&0xDF >0
|
||
>>>>497 string x \b %-.6s
|
||
>>>>>503 ubyte&0xDF >0
|
||
>>>>>>503 string x \b%-.1s
|
||
>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>504 string x \b%-.1s
|
||
>>>>505 ubyte&0xDF >0
|
||
>>>>>505 string x \b.%-.3s
|
||
>336 string Error!\
|
||
>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
|
||
>>>497 ubyte&0xDF >0
|
||
>>>>497 string x \b %-.6s
|
||
>>>>>503 ubyte&0xDF >0
|
||
>>>>>>503 string x \b%-.1s
|
||
>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>504 string x \b%-.1s
|
||
>>>>505 ubyte&0xDF >0
|
||
>>>>>505 string x \b.%-.3s
|
||
# added by Joerg Jenderek
|
||
# http://www.visopsys.org/
|
||
# http://partitionlogic.org.uk/
|
||
# OEM-ID=Visopsys
|
||
>478 ulelong 0
|
||
>>(1.b+326) string I/O\ Error\ reading\
|
||
>>>(1.b+344) string Visopsys\ loader\r
|
||
>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
|
||
# http://alexfru.chat.ru/epm.html#bootprog
|
||
>494 ubyte >0x4D
|
||
>>495 string >E
|
||
>>>495 string <S
|
||
#OEM-ID is not reliable
|
||
>>>>3 string BootProg
|
||
# It just looks for a program file name at the root directory
|
||
# and loads corresponding file with following execution.
|
||
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
|
||
>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
|
||
>>>>>499 string x \b %-.1s
|
||
>>>>>>500 ubyte&0xDF >0
|
||
>>>>>>>500 string x \b%-.1s
|
||
>>>>>>>>501 ubyte&0xDF >0
|
||
>>>>>>>>>501 string x \b%-.1s
|
||
>>>>>>>>>>502 ubyte&0xDF >0
|
||
>>>>>>>>>>>502 string x \b%-.1s
|
||
>>>>>>>>>>>>503 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>503 string x \b%-.1s
|
||
>>>>>>>>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>504 string x \b%-.1s
|
||
>>>>>>>>>>>>>>>>505 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>>>505 string x \b%-.1s
|
||
>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
|
||
#name extension
|
||
>>>>>507 ubyte&0xDF >0 \b.
|
||
>>>>>>507 string x \b%-.1s
|
||
>>>>>>>508 ubyte&0xDF >0
|
||
>>>>>>>>508 string x \b%-.1s
|
||
>>>>>>>>>509 ubyte&0xDF >0
|
||
>>>>>>>>>>509 string x \b%-.1s
|
||
#If the boot sector fails to read any other sector,
|
||
#it prints a very short message ("RE") to the screen and hangs the computer.
|
||
#If the boot sector fails to find needed program in the root directory,
|
||
#it also hangs with another message ("NF").
|
||
>>>>>492 string RENF \b, FAT (12 bit)
|
||
>>>>>495 string RENF \b, FAT (16 bit)
|
||
# http://alexfru.chat.ru/epm.html#bootprog
|
||
>494 ubyte >0x4D
|
||
>>495 string >E
|
||
>>>495 string <S
|
||
#OEM-ID is not reliable
|
||
>>>>3 string BootProg
|
||
# It just looks for a program file name at the root directory
|
||
# and loads corresponding file with following execution.
|
||
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
|
||
>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
|
||
>>>>>499 string x \b %-.1s
|
||
>>>>>>500 ubyte&0xDF >0
|
||
>>>>>>>500 string x \b%-.1s
|
||
>>>>>>>>501 ubyte&0xDF >0
|
||
>>>>>>>>>501 string x \b%-.1s
|
||
>>>>>>>>>>502 ubyte&0xDF >0
|
||
>>>>>>>>>>>502 string x \b%-.1s
|
||
>>>>>>>>>>>>503 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>503 string x \b%-.1s
|
||
>>>>>>>>>>>>>>504 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>504 string x \b%-.1s
|
||
>>>>>>>>>>>>>>>>505 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>>>505 string x \b%-.1s
|
||
>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
|
||
>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
|
||
#name extension
|
||
>>>>>507 ubyte&0xDF >0 \b.
|
||
>>>>>>507 string x \b%-.1s
|
||
>>>>>>>508 ubyte&0xDF >0
|
||
>>>>>>>>508 string x \b%-.1s
|
||
>>>>>>>>>509 ubyte&0xDF >0
|
||
>>>>>>>>>>509 string x \b%-.1s
|
||
#If the boot sector fails to read any other sector,
|
||
#it prints a very short message ("RE") to the screen and hangs the computer.
|
||
#If the boot sector fails to find needed program in the root directory,
|
||
#it also hangs with another message ("NF").
|
||
>>>>>492 string RENF \b, FAT (12 bit)
|
||
>>>>>495 string RENF \b, FAT (16 bit)
|
||
# x86 bootloader end
|
||
|
||
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
|
||
# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
|
||
>0 string RRaA
|
||
>>0x1E4 string rrAa \b, FSInfosector
|
||
#>>0x1FC uleshort =0 SHOULD BE ZERO
|
||
>>>0x1E8 ulelong <0xffffffff \b, %u free clusters
|
||
>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
|
||
|
||
# added by Joerg Jenderek at Nov 2012
|
||
# http://www.thenakedpc.com/articles/v04/08/0408-05.html
|
||
# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
|
||
0 string PNCIHISK\0 Norton Utilities disc image data
|
||
# real x86 boot sector with jump instruction
|
||
>509 search/1026 \x55\xAA\xeb
|
||
>>&-1 indirect x \b; contains
|
||
# http://file-extension.net/seeker/file_extension_dat
|
||
0 string PNCIUNDO Norton Disk Doctor UnDo file
|
||
#
|
||
|
||
# updated by Joerg Jenderek at Sep 2007
|
||
>3 ubyte 0
|
||
#no active flag
|
||
>>446 ubyte 0
|
||
# partition 1 not empty
|
||
>>>450 ubyte >0
|
||
# partitions 3,4 empty
|
||
>>>>482 ubyte 0
|
||
>>>>>498 ubyte 0
|
||
# partition 2 ID=0,5,15
|
||
>>>>>>466 ubyte <0x10
|
||
>>>>>>>466 ubyte 0x05 \b, extended partition table
|
||
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
|
||
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
|
||
|
||
# DOS x86 sector separated and moved from "x86 boot sector" by Joerg Jenderek at May 2011
|
||
|
||
>0x200 lelong 0x82564557 \b, BSD disklabel
|
||
# FATX
|
||
0 string FATX FATX filesystem data
|
||
|
||
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
|
||
0 string -rom1fs- romfs filesystem, version 1
|
||
>8 belong x %d bytes,
|
||
>16 string x named %s.
|
||
|
||
# netboot image - Juan Cespedes <cespedes@debian.org>
|
||
0 lelong 0x1b031336L Netboot image,
|
||
>4 lelong&0xFFFFFF00 0
|
||
>>4 lelong&0x100 0x000 mode 2
|
||
>>4 lelong&0x100 0x100 mode 3
|
||
>4 lelong&0xFFFFFF00 !0 unknown mode
|
||
|
||
0x18b string OS/2 OS/2 Boot Manager
|
||
|
||
# updated by Joerg Jenderek at Oct 2008 and Sep 2012
|
||
# http://syslinux.zytor.com/iso.php
|
||
# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
|
||
# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
|
||
0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
|
||
>631 search/689 ISOLINUX\ isolinux Loader
|
||
>>&0 string x (version %-4.4s)
|
||
# http://syslinux.zytor.com/pxe.php
|
||
# assembler instructions: jmp 7C05
|
||
0 ulelong 0x007c05ea pxelinux loader (version 2.13 or older)
|
||
# assembler instructions: pushfd;pushad
|
||
0 ulelong 0x60669c66 pxelinux loader
|
||
# assembler instructions: jmp 05
|
||
0 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer)
|
||
# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
|
||
0 string LDLINUX\ SYS\ SYSLINUX loader
|
||
>12 string x (older version %-4.4s)
|
||
0 string \r\nSYSLINUX\ SYSLINUX loader
|
||
>11 string x (version %-4.4s)
|
||
# syslinux updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
|
||
# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
|
||
0 ulelong&0x80909bEB 0x009018EB
|
||
# OEM-ID not always "SYSLINUX"
|
||
>434 search/47 Boot\ failed
|
||
# followed by \r\n\0 or :\
|
||
>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
|
||
>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
|
||
>459 search/30 Boot\ error\r\n\0
|
||
>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
|
||
# SYSLINUX MBR updated and separated from "x86 boot sector" by Joerg Jenderek at Sep 2012
|
||
# assembler instructions: mov di,0600h;mov cx,0100h
|
||
16 search/4 \xbf\x00\x06\xb9\x00\x01
|
||
# to display SYSLINUX MBR (36) before old x86 boot sector one with partition table (strength=50+21)
|
||
!:strength +36
|
||
>94 search/249 Missing\ operating\ system
|
||
# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
|
||
# skip Ranish MBR
|
||
>>408 search/4 HD1/\0
|
||
>>408 default x
|
||
>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
|
||
# followed by "ing " or space
|
||
>>>>292 search/98 error
|
||
>>>>>&0 string \r (version 3.35 or older)
|
||
>>>>>&0 string .\r (version 3.52 or newer)
|
||
>>>>>&0 default x (version 3.36-3.51 )
|
||
>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
|
||
>>156 search/10 \0Boot\ partition\ not\ found\r\n
|
||
>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
|
||
>>174 search/10 \0Missing\ OS\r\n
|
||
>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
|
||
# SYSLINUX END
|
||
|
||
# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
|
||
# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
|
||
0 ubequad 0x31c08ed0bc007c8e
|
||
# mbr_bootsel magic before partition table not reliable with small ipl fragments
|
||
#>444 uleshort 0xb5e1
|
||
>0004 uleshort x
|
||
# ERRorTeXT
|
||
>>181 search/166 Error\ \0\r\n NetBSD mbr
|
||
# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
|
||
>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
|
||
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
|
||
>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
|
||
# BOOT_EXTENDED definitions contains assembler instructions:
|
||
# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
|
||
>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
|
||
# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
|
||
>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
|
||
# not TERSE_ERROR
|
||
>>>196 search/106 No\ active\ partition\0
|
||
>>>>&0 string Disk\ read\ error\0
|
||
>>>>>&0 string No\ operating\ system\0 \b,verbose
|
||
# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
|
||
>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
|
||
# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
|
||
>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
|
||
# assembler instructions: movw nametab,bx
|
||
>>>0x26 search/21 \xBB\x94\x07
|
||
# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
|
||
>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
|
||
>>>>>181 search/166 Error\ \0
|
||
# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
|
||
>>>>>>&3 string x \b,"%s"
|
||
# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
|
||
# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
|
||
# assembler instructions: jmp short 0x58;nop;ASCII
|
||
0 ubequad&0xeb58908000000000 0xeb58900000000000
|
||
# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
|
||
>(1.b+2) ubequad 0xfa31c08ed88ec08e
|
||
# Error messages at end of code
|
||
>>376 string No\ operating\ system\r\n\0
|
||
>>>398 string Disk\ error\r\n\0FDD\0HDD\0
|
||
>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
|
||
|
||
# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
|
||
# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
|
||
# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
|
||
# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
|
||
0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
|
||
# pointer to the data starting with Neil Turton signature string
|
||
>(0x1BC.s) string NDTmbr
|
||
>>&-14 string 1234F\0 Turton mbr (
|
||
# parameters also viewed by install-mbr --list
|
||
>>>(0x1BC.s+7) ubyte x \b%u<=
|
||
>>>(0x1BC.s+9) ubyte x \bVersion<=%u
|
||
#>>>(0x1BC.s+8) ubyte x asm_flag_%x
|
||
>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix
|
||
# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
|
||
>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk
|
||
#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
|
||
#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x
|
||
#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
|
||
#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
|
||
# for older versions
|
||
>>>(0x1BC.s+9) ubyte <2
|
||
#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
|
||
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
|
||
# floppy A: or B:
|
||
>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
|
||
>>>>(0x1BC.s+13) ubyte >1
|
||
# 1st hard disc
|
||
#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
|
||
# not 1st hard disc
|
||
>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
|
||
# for version >= 2 maximal timeout can be 65534
|
||
>>>(0x1BC.s+9) ubyte >1
|
||
#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
|
||
>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
|
||
# floppy A: or B:
|
||
>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
|
||
>>>>(0x1BC.s+14) ubyte >1
|
||
# 1st hard disc
|
||
#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
|
||
# not 1st hard disc
|
||
>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x
|
||
>>>0 ubyte x \b)
|
||
|
||
# added by Joerg Jenderek
|
||
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
|
||
# grub-1.94/kern/i386/pc/startup.S
|
||
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
|
||
# usual values are marked with comments to get only informations of strange GRUB loaders
|
||
0x200 uleshort 0x70EA
|
||
# found only version 3.{1,2}
|
||
>0x206 ubeshort >0x0300
|
||
# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
|
||
>>0x212 ubyte >0x29
|
||
>>>0x213 ubyte >0x29
|
||
# not iso9660_stage1_5
|
||
#>>>0 ulelong&0x00BE5652 0x00BE5652
|
||
>>>>0x213 ubyte >0x29 GRand Unified Bootloader
|
||
# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
|
||
>>>>0x217 ubyte 0xFF stage1_5
|
||
>>>>0x217 ubyte <0xFF stage2
|
||
>>>>0x206 ubyte x \b version %u
|
||
>>>>0x207 ubyte x \b.%u
|
||
# module_size for 1.94
|
||
>>>>0x208 ulelong <0xffffff \b, installed partition %u
|
||
#>>>>0x208 ulelong =0xffffff \b, %u (default)
|
||
>>>>0x208 ulelong >0xffffff \b, installed partition %u
|
||
# GRUB 0.5.95 unofficial
|
||
>>>>0x20C ulelong&0x2E300000 0x2E300000
|
||
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
|
||
>>>>>0x20C ubyte x \b, identifier 0x%x
|
||
#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
|
||
>>>>>0x20D ubyte >0 \b, LBA flag 0x%x
|
||
# GRUB version as string
|
||
>>>>>0x20E string >\0 \b, GRUB version %-s
|
||
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
|
||
>>>>>>0x215 ulong 0xffffffff
|
||
>>>>>>>0x219 string >\0 \b, configuration file %-s
|
||
>>>>>>0x215 ulong !0xffffffff
|
||
>>>>>>>0x215 string >\0 \b, configuration file %-s
|
||
# newer GRUB versions
|
||
>>>>0x20C ulelong&0x2E300000 !0x2E300000
|
||
##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
|
||
>>>>>0x20C ulelong >0 \b, saved entry %d
|
||
# for 1.94 contains kernel image size
|
||
# for 0.93,0.94,0.96,0.97
|
||
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
|
||
>>>>>0x210 ubyte x \b, identifier 0x%x
|
||
# The flag for LBA forcing is in most cases 0
|
||
#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
|
||
>>>>>0x211 ubyte >0 \b, LBA flag 0x%x
|
||
# GRUB version as string
|
||
>>>>>0x212 string >\0 \b, GRUB version %-s
|
||
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
|
||
>>>>>0x217 ulong 0xffffffff
|
||
>>>>>>0x21b string >\0 \b, configuration file %-s
|
||
>>>>>0x217 ulong !0xffffffff
|
||
>>>>>>0x217 string >\0 \b, configuration file %-s
|
||
|
||
# DOS x86 sector updated and separated from "x86 boot sector" by Joerg Jenderek at May 2011
|
||
# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
|
||
# over BIOS parameter block (BPB)
|
||
# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
|
||
# older drives may use Near JuMP instruction E9 xx xx
|
||
# minimal short forward jump found 0x29 for bootloaders or 0x0
|
||
# maximal short forward jump is 0x7f
|
||
# OEM-ID is empty or contain readable bytes
|
||
0 ulelong&0x804000E9 0x000000E9
|
||
# mtools-3.9.8/msdos.h
|
||
# usual values are marked with comments to get only informations of strange FAT systems
|
||
# valid sectorsize must be a power of 2 from 32 to 32768
|
||
>11 uleshort&0xf001f 0
|
||
>>11 uleshort <32769
|
||
>>>11 uleshort >31
|
||
>>>>21 ubyte&0xf0 0xF0
|
||
>>>>>0 ubyte 0xEB
|
||
>>>>>>1 ubyte x \b, code offset 0x%x+2
|
||
>>>>>0 ubyte 0xE9
|
||
>>>>>>1 uleshort x \b, code offset 0x%x+2
|
||
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
|
||
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
|
||
>>>>>>8 string IHC \b cached by Windows 9M
|
||
>>>>>11 uleshort >512 \b, Bytes/sector %u
|
||
#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
|
||
>>>>>11 uleshort <512 \b, Bytes/sector %u
|
||
>>>>>13 ubyte >1 \b, sectors/cluster %u
|
||
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
|
||
>>>>>82 string FAT32
|
||
>>>>>>14 uleshort !32 \b, reserved sectors %u
|
||
#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
|
||
>>>>>82 string !FAT32
|
||
>>>>>>14 uleshort >1 \b, reserved sectors %u
|
||
#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
|
||
#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
|
||
>>>>>16 ubyte >2 \b, FATs %u
|
||
#>>>>>16 ubyte =2 \b, FATs %u (usual)
|
||
>>>>>16 ubyte =1 \b, FAT %u
|
||
>>>>>16 ubyte >0
|
||
>>>>>17 uleshort >0 \b, root entries %u
|
||
#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
|
||
>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
|
||
#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
|
||
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
|
||
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
|
||
>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
|
||
>>>>>22 uleshort >0 \b, sectors/FAT %u
|
||
#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
|
||
>>>>>24 uleshort x \b, sectors/track %u
|
||
>>>>>26 ubyte >2 \b, heads %u
|
||
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
|
||
>>>>>26 ubyte =1 \b, heads %u
|
||
# valid only for sector sizes with more then 32 Bytes
|
||
>>>>>11 uleshort >32
|
||
# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
|
||
>>>>>>38 ubyte !0x70
|
||
>>>>>>>28 ulelong >0 \b, hidden sectors %u
|
||
#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
|
||
>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
|
||
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
|
||
# FAT<32 bit specific
|
||
>>>>>>>82 string !FAT32
|
||
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
|
||
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
|
||
>>>>>>>>36 ubyte !0x80
|
||
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
|
||
>>>>>>>>37 ubyte >0 \b, reserved 0x%x
|
||
#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
|
||
# value is 0x80 for NTFS
|
||
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
|
||
>>>>>>>>38 ubyte =0x29
|
||
>>>>>>>>>39 ulelong x \b, serial number 0x%x
|
||
>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
|
||
>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
|
||
>>>>>>>>>43 string =NO\ NAME \b, unlabeled
|
||
# there exist some old floppies without word FAT at offset 54
|
||
# a word like "FATnm " is only a hint for a FAT size on nm-bits
|
||
# Normally the number of clusters is calculated by the values of BPP.
|
||
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
|
||
# otherwise FAT is 16 bit.
|
||
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
|
||
>>>>>>54 string FAT \b, FAT
|
||
>>>>>>>54 string FAT12 \b (12 bit)
|
||
>>>>>>>54 string FAT16 \b (16 bit)
|
||
# FAT32 bit specific
|
||
>>>>>82 string FAT32 \b, FAT (32 bit)
|
||
>>>>>>36 ulelong x \b, sectors/FAT %u
|
||
# http://technet.microsoft.com/en-us/library/cc977221.aspx
|
||
>>>>>>40 uleshort >0 \b, extension flags 0x%x
|
||
#>>>>>>40 uleshort =0 \b, extension flags %u
|
||
>>>>>>42 uleshort >0 \b, fsVersion %u
|
||
#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
|
||
>>>>>>44 ulelong >2 \b, rootdir cluster %u
|
||
#>>>>>>44 ulelong =2 \b, rootdir cluster %u
|
||
#>>>>>>44 ulelong =1 \b, rootdir cluster %u
|
||
>>>>>>48 uleshort >1 \b, infoSector %u
|
||
#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
|
||
>>>>>>48 uleshort <1 \b, infoSector %u
|
||
>>>>>>50 uleshort >6 \b, Backup boot sector %u
|
||
#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
|
||
>>>>>>50 uleshort <6 \b, Backup boot sector %u
|
||
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
|
||
>>>>>>52 ulelong >0 \b, reserved1 0x%x
|
||
>>>>>>56 ulelong >0 \b, reserved2 0x%x
|
||
>>>>>>60 ulelong >0 \b, reserved3 0x%x
|
||
# same structure as FAT1X
|
||
#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
|
||
#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
|
||
>>>>>>64 ubyte !0x80
|
||
>>>>>>>64 ubyte >0 \b, physical drive 0x%x
|
||
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
|
||
>>>>>>65 ubyte >0 \b, reserved 0x%x
|
||
>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
|
||
>>>>>>66 ubyte =0x29
|
||
>>>>>>>67 ulelong x \b, serial number 0x%x
|
||
>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
|
||
>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
|
||
>>>>>>>71 string =NO\ NAME \b, unlabeled
|
||
# additional tests for floppy image added by Joerg Jenderek
|
||
# no fixed disk
|
||
>>>>>21 ubyte !0xF8
|
||
# floppy media with 12 bit FAT
|
||
>>>>>>54 string !FAT16
|
||
# test for FAT after bootsector
|
||
>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
|
||
# floppy image
|
||
!:mime application/x-ima
|
||
# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
|
||
# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
|
||
# 0 FATs
|
||
>>>>>16 ubyte =0
|
||
# 0 root entries
|
||
>>>>>>17 uleshort =0
|
||
# 0 DOS sectors
|
||
>>>>>>>19 uleshort =0
|
||
# 0 sectors/FAT
|
||
# dos < 4.0 BootSector value found is 0x80
|
||
#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
|
||
>>>>>>>>22 uleshort =0 \b; NTFS
|
||
>>>>>>>>>24 uleshort >0 \b, sectors/track %u
|
||
>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x
|
||
>>>>>>>>>40 ulequad >0 \b, sectors %lld
|
||
>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
|
||
>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
|
||
# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
|
||
# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
|
||
>>>>>>>>>64 lelong <256
|
||
>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
|
||
>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
|
||
# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
|
||
# Values 128 to 255 represent index block sizes of 2^(256-N) byte
|
||
>>>>>>>>>68 ulelong <256
|
||
>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
|
||
#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
|
||
>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
|
||
>>>>>>>>>72 ulequad x \b, serial number 0%llx
|
||
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
|
||
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
|
||
>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
|
||
>>>>>>>>>>&-92 indirect x \b; contains
|
||
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
|
||
# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
|
||
# unused assembler instructions JMP y2;NOP;NOP
|
||
0x056 ulelong&0xFFFF0FFF 0x909002EB
|
||
# unicode loadername terminated by CTRL-D
|
||
>(0.s*2) ulelong&0xFFFFFF00 0x00040000
|
||
# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
|
||
>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
|
||
>>0x12 string $
|
||
>>>0x0c lestring16 x \b%-2.2s
|
||
### DOS,NTFS boot sectors end
|
||
|
||
9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
|
||
>8404 string x last mounted on %s,
|
||
#>9504 ledate x last checked at %s,
|
||
>8224 ledate x last written at %s,
|
||
>8401 byte x clean flag %d,
|
||
>8228 lelong x number of blocks %d,
|
||
>8232 lelong x number of data blocks %d,
|
||
>8236 lelong x number of cylinder groups %d,
|
||
>8240 lelong x block size %d,
|
||
>8244 lelong x fragment size %d,
|
||
>8252 lelong x minimum percentage of free blocks %d,
|
||
>8256 lelong x rotational delay %dms,
|
||
>8260 lelong x disk rotational speed %drps,
|
||
>8320 lelong 0 TIME optimization
|
||
>8320 lelong 1 SPACE optimization
|
||
|
||
42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
|
||
>&-1164 string x last mounted on %s,
|
||
>&-696 string >\0 volume name %s,
|
||
>&-304 leqldate x last written at %s,
|
||
>&-1167 byte x clean flag %d,
|
||
>&-1168 byte x readonly flag %d,
|
||
>&-296 lequad x number of blocks %lld,
|
||
>&-288 lequad x number of data blocks %lld,
|
||
>&-1332 lelong x number of cylinder groups %d,
|
||
>&-1328 lelong x block size %d,
|
||
>&-1324 lelong x fragment size %d,
|
||
>&-180 lelong x average file size %d,
|
||
>&-176 lelong x average number of files in dir %d,
|
||
>&-272 lequad x pending blocks to free %lld,
|
||
>&-264 lelong x pending inodes to free %ld,
|
||
>&-664 lequad x system-wide uuid %0llx,
|
||
>&-1316 lelong x minimum percentage of free blocks %d,
|
||
>&-1248 lelong 0 TIME optimization
|
||
>&-1248 lelong 1 SPACE optimization
|
||
|
||
66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
|
||
>&-1164 string x last mounted on %s,
|
||
>&-696 string >\0 volume name %s,
|
||
>&-304 leqldate x last written at %s,
|
||
>&-1167 byte x clean flag %d,
|
||
>&-1168 byte x readonly flag %d,
|
||
>&-296 lequad x number of blocks %lld,
|
||
>&-288 lequad x number of data blocks %lld,
|
||
>&-1332 lelong x number of cylinder groups %d,
|
||
>&-1328 lelong x block size %d,
|
||
>&-1324 lelong x fragment size %d,
|
||
>&-180 lelong x average file size %d,
|
||
>&-176 lelong x average number of files in dir %d,
|
||
>&-272 lequad x pending blocks to free %lld,
|
||
>&-264 lelong x pending inodes to free %ld,
|
||
>&-664 lequad x system-wide uuid %0llx,
|
||
>&-1316 lelong x minimum percentage of free blocks %d,
|
||
>&-1248 lelong 0 TIME optimization
|
||
>&-1248 lelong 1 SPACE optimization
|
||
|
||
9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
|
||
>7168 belong 0x4c41424c Apple UFS Volume
|
||
>>7186 string x named %s,
|
||
>>7176 belong x volume label version %d,
|
||
>>7180 bedate x created on %s,
|
||
>8404 string x last mounted on %s,
|
||
#>9504 bedate x last checked at %s,
|
||
>8224 bedate x last written at %s,
|
||
>8401 byte x clean flag %d,
|
||
>8228 belong x number of blocks %d,
|
||
>8232 belong x number of data blocks %d,
|
||
>8236 belong x number of cylinder groups %d,
|
||
>8240 belong x block size %d,
|
||
>8244 belong x fragment size %d,
|
||
>8252 belong x minimum percentage of free blocks %d,
|
||
>8256 belong x rotational delay %dms,
|
||
>8260 belong x disk rotational speed %drps,
|
||
>8320 belong 0 TIME optimization
|
||
>8320 belong 1 SPACE optimization
|
||
|
||
42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
|
||
>&-1164 string x last mounted on %s,
|
||
>&-696 string >\0 volume name %s,
|
||
>&-304 beqldate x last written at %s,
|
||
>&-1167 byte x clean flag %d,
|
||
>&-1168 byte x readonly flag %d,
|
||
>&-296 bequad x number of blocks %lld,
|
||
>&-288 bequad x number of data blocks %lld,
|
||
>&-1332 belong x number of cylinder groups %d,
|
||
>&-1328 belong x block size %d,
|
||
>&-1324 belong x fragment size %d,
|
||
>&-180 belong x average file size %d,
|
||
>&-176 belong x average number of files in dir %d,
|
||
>&-272 bequad x pending blocks to free %lld,
|
||
>&-264 belong x pending inodes to free %ld,
|
||
>&-664 bequad x system-wide uuid %0llx,
|
||
>&-1316 belong x minimum percentage of free blocks %d,
|
||
>&-1248 belong 0 TIME optimization
|
||
>&-1248 belong 1 SPACE optimization
|
||
|
||
66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
|
||
>&-1164 string x last mounted on %s,
|
||
>&-696 string >\0 volume name %s,
|
||
>&-304 beqldate x last written at %s,
|
||
>&-1167 byte x clean flag %d,
|
||
>&-1168 byte x readonly flag %d,
|
||
>&-296 bequad x number of blocks %lld,
|
||
>&-288 bequad x number of data blocks %lld,
|
||
>&-1332 belong x number of cylinder groups %d,
|
||
>&-1328 belong x block size %d,
|
||
>&-1324 belong x fragment size %d,
|
||
>&-180 belong x average file size %d,
|
||
>&-176 belong x average number of files in dir %d,
|
||
>&-272 bequad x pending blocks to free %lld,
|
||
>&-264 belong x pending inodes to free %ld,
|
||
>&-664 bequad x system-wide uuid %0llx,
|
||
>&-1316 belong x minimum percentage of free blocks %d,
|
||
>&-1248 belong 0 TIME optimization
|
||
>&-1248 belong 1 SPACE optimization
|
||
|
||
# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
|
||
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
|
||
# volume label and UUID Russell Coker
|
||
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
|
||
0x438 leshort 0xEF53 Linux
|
||
>0x44c lelong x rev %d
|
||
>0x43e leshort x \b.%d
|
||
# No journal? ext2
|
||
>0x45c lelong ^0x0000004 ext2 filesystem data
|
||
>>0x43a leshort ^0x0000001 (mounted or unclean)
|
||
# Has a journal? ext3 or ext4
|
||
>0x45c lelong &0x0000004
|
||
# and small INCOMPAT?
|
||
>>0x460 lelong <0x0000040
|
||
# and small RO_COMPAT?
|
||
>>>0x464 lelong <0x0000008 ext3 filesystem data
|
||
# else large RO_COMPAT?
|
||
>>>0x464 lelong >0x0000007 ext4 filesystem data
|
||
# else large INCOMPAT?
|
||
>>0x460 lelong >0x000003f ext4 filesystem data
|
||
>0x468 belong x \b, UUID=%08x
|
||
>0x46c beshort x \b-%04x
|
||
>0x46e beshort x \b-%04x
|
||
>0x470 beshort x \b-%04x
|
||
>0x472 belong x \b-%08x
|
||
>0x476 beshort x \b%04x
|
||
>0x478 string >0 \b, volume name "%s"
|
||
# General flags for any ext* fs
|
||
>0x460 lelong &0x0000004 (needs journal recovery)
|
||
>0x43a leshort &0x0000002 (errors)
|
||
# INCOMPAT flags
|
||
>0x460 lelong &0x0000001 (compressed)
|
||
#>0x460 lelong &0x0000002 (filetype)
|
||
#>0x460 lelong &0x0000010 (meta bg)
|
||
>0x460 lelong &0x0000040 (extents)
|
||
>0x460 lelong &0x0000080 (64bit)
|
||
#>0x460 lelong &0x0000100 (mmp)
|
||
#>0x460 lelong &0x0000200 (flex bg)
|
||
# RO_INCOMPAT flags
|
||
#>0x464 lelong &0x0000001 (sparse super)
|
||
>0x464 lelong &0x0000002 (large files)
|
||
>0x464 lelong &0x0000008 (huge files)
|
||
#>0x464 lelong &0x0000010 (gdt checksum)
|
||
#>0x464 lelong &0x0000020 (many subdirs)
|
||
#>0x463 lelong &0x0000040 (extra isize)
|
||
|
||
# Minix filesystems - Juan Cespedes <cespedes@debian.org>
|
||
0x410 leshort 0x137f
|
||
!:strength / 2
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V1, %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 beshort 0x137f
|
||
!:strength / 2
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 leshort 0x138f
|
||
!:strength / 2
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 beshort 0x138f
|
||
!:strength / 2
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 leshort 0x2468
|
||
>0x402 beshort < 100
|
||
>>0x402 beshort > -1 Minix filesystem, V2, %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 beshort 0x2468
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones
|
||
>0x1e string minix \b, bootable
|
||
|
||
0x410 leshort 0x2478
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 leshort 0x2478
|
||
>0x402 beshort < 100
|
||
>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 beshort 0x2478
|
||
>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones
|
||
>0x1e string minix \b, bootable
|
||
0x410 leshort 0x4d5a
|
||
>0x402 beshort !0 Minix filesystem, V3, %d zones
|
||
>0x1e string minix \b, bootable
|
||
|
||
# SGI disk labels - Nathan Scott <nathans@debian.org>
|
||
0 belong 0x0BE5A941 SGI disk label (volume header)
|
||
|
||
# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
|
||
0 belong 0x58465342 SGI XFS filesystem data
|
||
>0x4 belong x (blksz %d,
|
||
>0x68 beshort x inosz %d,
|
||
>0x64 beshort ^0x2004 v1 dirs)
|
||
>0x64 beshort &0x2004 v2 dirs)
|
||
|
||
############################################################################
|
||
# Minix-ST kernel floppy
|
||
0x800 belong 0x46fc2700 Atari-ST Minix kernel image
|
||
>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
|
||
>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
|
||
|
||
############################################################################
|
||
# Hmmm, is this a better way of detecting _standard_ floppy images ?
|
||
19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
|
||
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
|
||
19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
|
||
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
|
||
19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
|
||
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
|
||
|
||
19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
|
||
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
|
||
19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
|
||
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
|
||
|
||
19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
|
||
19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
|
||
|
||
# Valid media descriptor bytes for MS-DOS:
|
||
#
|
||
# Byte Capacity Media Size and Type
|
||
# -------------------------------------------------
|
||
#
|
||
# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
|
||
# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
|
||
# F9 720K 3.5-inch, 2-sided, 9-sector
|
||
# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
|
||
# FD 360K 5.25-inch, 2-sided, 9-sector
|
||
# FF 320K 5.25-inch, 2-sided, 8-sector
|
||
# FC 180K 5.25-inch, 1-sided, 9-sector
|
||
# FE 160K 5.25-inch, 1-sided, 8-sector
|
||
# FE 250K 8-inch, 1-sided, single-density
|
||
# FD 500K 8-inch, 2-sided, single-density
|
||
# FE 1.2 MB 8-inch, 2-sided, double-density
|
||
# F8 ----- Fixed disk
|
||
#
|
||
# FC xxxK Apricot 70x1x9 boot disk.
|
||
#
|
||
# Originally a bitmap:
|
||
# xxxxxxx0 Not two sided
|
||
# xxxxxxx1 Double sided
|
||
# xxxxxx0x Not 8 SPT
|
||
# xxxxxx1x 8 SPT
|
||
# xxxxx0xx Not Removable drive
|
||
# xxxxx1xx Removable drive
|
||
# 11111xxx Must be one.
|
||
#
|
||
# But now it's rather random:
|
||
# 111111xx Low density disk
|
||
# 00 SS, Not 8 SPT
|
||
# 01 DS, Not 8 SPT
|
||
# 10 SS, 8 SPT
|
||
# 11 DS, 8 SPT
|
||
#
|
||
# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4
|
||
# 11110000 High density 3 1/2 floppy disk
|
||
# 11111000 Hard disk any format
|
||
#
|
||
|
||
# CDROM Filesystems
|
||
# Modified for UDF by gerardo.cacciari@gmail.com
|
||
32769 string CD001 #
|
||
!:mime application/x-iso9660-image
|
||
>38913 string !NSR0 ISO 9660 CD-ROM filesystem data
|
||
>38913 string NSR0 UDF filesystem data
|
||
>>38917 string 1 (version 1.0)
|
||
>>38917 string 2 (version 1.5)
|
||
>>38917 string 3 (version 2.0)
|
||
>>38917 byte >0x33 (unknown version, ID 0x%X)
|
||
>>38917 byte <0x31 (unknown version, ID 0x%X)
|
||
# "application id" which appears to be used as a volume label
|
||
>32808 string/T >\0 '%s'
|
||
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
|
||
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
|
||
!:mime application/x-iso9660-image
|
||
32776 string CDROM High Sierra CD-ROM filesystem data
|
||
|
||
# .cso files
|
||
0 string CISO Compressed ISO CD image
|
||
|
||
# cramfs filesystem - russell@coker.com.au
|
||
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
|
||
>4 lelong x size %lu
|
||
>8 lelong &1 version #2
|
||
>8 lelong &2 sorted_dirs
|
||
>8 lelong &4 hole_support
|
||
>32 lelong x CRC 0x%x,
|
||
>36 lelong x edition %lu,
|
||
>40 lelong x %lu blocks,
|
||
>44 lelong x %lu files
|
||
|
||
0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
|
||
>4 belong x size %lu
|
||
>8 belong &1 version #2
|
||
>8 belong &2 sorted_dirs
|
||
>8 belong &4 hole_support
|
||
>32 belong x CRC 0x%x,
|
||
>36 belong x edition %lu,
|
||
>40 belong x %lu blocks,
|
||
>44 belong x %lu files
|
||
|
||
# reiserfs - russell@coker.com.au
|
||
0x10034 string ReIsErFs ReiserFS V3.5
|
||
0x10034 string ReIsEr2Fs ReiserFS V3.6
|
||
0x10034 string ReIsEr3Fs ReiserFS V3.6.19
|
||
>0x1002c leshort x block size %d
|
||
>0x10032 leshort &2 (mounted or unclean)
|
||
>0x10000 lelong x num blocks %d
|
||
>0x10040 lelong 1 tea hash
|
||
>0x10040 lelong 2 yura hash
|
||
>0x10040 lelong 3 r5 hash
|
||
|
||
# JFFS - russell@coker.com.au
|
||
0 lelong 0x34383931 Linux Journalled Flash File system, little endian
|
||
0 belong 0x34383931 Linux Journalled Flash File system, big endian
|
||
|
||
# EST flat binary format (which isn't, but anyway)
|
||
# From: Mark Brown <broonie@sirena.org.uk>
|
||
0 string ESTFBINR EST flat binary
|
||
|
||
# Aculab VoIP firmware
|
||
# From: Mark Brown <broonie@sirena.org.uk>
|
||
0 string VoIP\ Startup\ and Aculab VoIP firmware
|
||
>35 string x format %s
|
||
|
||
# From: Mark Brown <broonie@sirena.org.uk> [old]
|
||
# From: Behan Webster <behanw@websterwood.com>
|
||
0 belong 0x27051956 u-boot legacy uImage,
|
||
>32 string x %s,
|
||
>28 byte 0 Invalid os/
|
||
>28 byte 1 OpenBSD/
|
||
>28 byte 2 NetBSD/
|
||
>28 byte 3 FreeBSD/
|
||
>28 byte 4 4.4BSD/
|
||
>28 byte 5 Linux/
|
||
>28 byte 6 SVR4/
|
||
>28 byte 7 Esix/
|
||
>28 byte 8 Solaris/
|
||
>28 byte 9 Irix/
|
||
>28 byte 10 SCO/
|
||
>28 byte 11 Dell/
|
||
>28 byte 12 NCR/
|
||
>28 byte 13 LynxOS/
|
||
>28 byte 14 VxWorks/
|
||
>28 byte 15 pSOS/
|
||
>28 byte 16 QNX/
|
||
>28 byte 17 Firmware/
|
||
>28 byte 18 RTEMS/
|
||
>28 byte 19 ARTOS/
|
||
>28 byte 20 Unity OS/
|
||
>28 byte 21 INTEGRITY/
|
||
>29 byte 0 \bInvalid CPU,
|
||
>29 byte 1 \bAlpha,
|
||
>29 byte 2 \bARM,
|
||
>29 byte 3 \bIntel x86,
|
||
>29 byte 4 \bIA64,
|
||
>29 byte 5 \bMIPS,
|
||
>29 byte 6 \bMIPS 64-bit,
|
||
>29 byte 7 \bPowerPC,
|
||
>29 byte 8 \bIBM S390,
|
||
>29 byte 9 \bSuperH,
|
||
>29 byte 10 \bSparc,
|
||
>29 byte 11 \bSparc 64-bit,
|
||
>29 byte 12 \bM68K,
|
||
>29 byte 13 \bNios-32,
|
||
>29 byte 14 \bMicroBlaze,
|
||
>29 byte 15 \bNios-II,
|
||
>29 byte 16 \bBlackfin,
|
||
>29 byte 17 \bAVR32,
|
||
>29 byte 18 \bSTMicroelectronics ST200,
|
||
>30 byte 0 Invalid Image
|
||
>30 byte 1 Standalone Program
|
||
>30 byte 2 OS Kernel Image
|
||
>30 byte 3 RAMDisk Image
|
||
>30 byte 4 Multi-File Image
|
||
>30 byte 5 Firmware Image
|
||
>30 byte 6 Script File
|
||
>30 byte 7 Filesystem Image (any type)
|
||
>30 byte 8 Binary Flat Device Tree BLOB
|
||
>31 byte 0 (Not compressed),
|
||
>31 byte 1 (gzip),
|
||
>31 byte 2 (bzip2),
|
||
>31 byte 3 (lzma),
|
||
>12 belong x %d bytes,
|
||
>8 bedate x %s,
|
||
>16 belong x Load Address: 0x%08X,
|
||
>20 belong x Entry Point: 0x%08X,
|
||
>4 belong x Header CRC: 0x%08X,
|
||
>24 belong x Data CRC: 0x%08X
|
||
|
||
# JFFS2 file system
|
||
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
|
||
0 leshort 0x1985 Linux jffs2 filesystem data little endian
|
||
|
||
# Squashfs
|
||
0 string sqsh Squashfs filesystem, big endian,
|
||
>28 beshort x version %d.
|
||
>30 beshort x \b%d,
|
||
>28 beshort <3
|
||
>>8 belong x %d bytes,
|
||
>28 beshort >2
|
||
>>28 beshort <4
|
||
>>>63 bequad x %lld bytes,
|
||
>>28 beshort >3
|
||
>>>40 bequad x %lld bytes,
|
||
#>>67 belong x %d bytes,
|
||
>4 belong x %d inodes,
|
||
>28 beshort <2
|
||
>>32 beshort x blocksize: %d bytes,
|
||
>28 beshort >1
|
||
>>28 beshort <4
|
||
>>>51 belong x blocksize: %d bytes,
|
||
>>28 beshort >3
|
||
>>>12 belong x blocksize: %d bytes,
|
||
>28 beshort <4
|
||
>>39 bedate x created: %s
|
||
>28 beshort >3
|
||
>>8 bedate x created: %s
|
||
0 string hsqs Squashfs filesystem, little endian,
|
||
>28 leshort x version %d.
|
||
>30 leshort x \b%d,
|
||
>28 leshort <3
|
||
>>8 lelong x %d bytes,
|
||
>28 leshort >2
|
||
>>28 leshort <4
|
||
>>>63 lequad x %lld bytes,
|
||
>>28 leshort >3
|
||
>>>40 lequad x %lld bytes,
|
||
#>>63 lelong x %d bytes,
|
||
>4 lelong x %d inodes,
|
||
>28 leshort <2
|
||
>>32 leshort x blocksize: %d bytes,
|
||
>28 leshort >1
|
||
>>28 leshort <4
|
||
>>>51 lelong x blocksize: %d bytes,
|
||
>>28 leshort >3
|
||
>>>12 lelong x blocksize: %d bytes,
|
||
>28 leshort <4
|
||
>>39 ledate x created: %s
|
||
>28 leshort >3
|
||
>>8 ledate x created: %s
|
||
|
||
# AFS Dump Magic
|
||
# From: Ty Sarna <tsarna@sarna.org>
|
||
0 string \x01\xb3\xa1\x13\x22 AFS Dump
|
||
>&0 belong x (v%d)
|
||
>>&0 byte 0x76
|
||
>>>&0 belong x Vol %d,
|
||
>>>>&0 byte 0x6e
|
||
>>>>>&0 string x %s
|
||
>>>>>>&1 byte 0x74
|
||
>>>>>>>&0 beshort 2
|
||
>>>>>>>>&4 bedate x on: %s
|
||
>>>>>>>>&0 bedate =0 full dump
|
||
>>>>>>>>&0 bedate !0 incremental since: %s
|
||
|
||
#----------------------------------------------------------
|
||
#delta ISO Daniel Novotny (dnovotny@redhat.com)
|
||
0 string DISO Delta ISO data
|
||
>4 belong x version %d
|
||
|
||
# VMS backup savesets - gerardo.cacciari@gmail.com
|
||
#
|
||
4 string \x01\x00\x01\x00\x01\x00
|
||
>(0.s+16) string \x01\x01
|
||
>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
|
||
>>>40 lelong x (block size %d,
|
||
>>>49 string >\0 original name '%s',
|
||
>>>2 short 1024 VAX generated)
|
||
>>>2 short 2048 AXP generated)
|
||
>>>2 short 4096 I64 generated)
|
||
|
||
# Summary: Oracle Clustered Filesystem
|
||
# Created by: Aaron Botsis <redhat@digitalmafia.org>
|
||
8 string OracleCFS Oracle Clustered Filesystem,
|
||
>4 long x rev %d
|
||
>0 long x \b.%d,
|
||
>560 string x label: %.64s,
|
||
>136 string x mountpoint: %.128s
|
||
|
||
# Summary: Oracle ASM tagged volume
|
||
# Created by: Aaron Botsis <redhat@digitalmafia.org>
|
||
32 string ORCLDISK Oracle ASM Volume,
|
||
>40 string x Disk Name: %0.12s
|
||
32 string ORCLCLRD Oracle ASM Volume (cleared),
|
||
>40 string x Disk Name: %0.12s
|
||
|
||
# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
|
||
8 string OracleCFS Oracle Clustered Filesystem,
|
||
>4 long x rev %d
|
||
>0 long x \b.%d,
|
||
>560 string x label: %.64s,
|
||
>136 string x mountpoint: %.128s
|
||
|
||
# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
|
||
32 string ORCLDISK Oracle ASM Volume,
|
||
>40 string x Disk Name: %0.12s
|
||
32 string ORCLCLRD Oracle ASM Volume (cleared),
|
||
>40 string x Disk Name: %0.12s
|
||
|
||
# Compaq/HP RILOE floppy image
|
||
# From: Dirk Jagdmann <doj@cubic.org>
|
||
0 string CPQRFBLO Compaq/HP RILOE floppy image
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
|
||
# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
|
||
# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
|
||
#
|
||
1008 string DECFILE11 Files-11 On-Disk Structure
|
||
>525 byte x Level %d
|
||
>525 byte x (ODS-%d);
|
||
>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
|
||
>1017 string B
|
||
>>525 byte 2 VAX/VMS or OpenVMS file system;
|
||
>>525 byte 5 OpenVMS Alpha or Itanium file system;
|
||
>984 string x volume label is '%-12.12s'
|
||
|
||
# From: Thomas Klausner <wiz@NetBSD.org>
|
||
# http://filext.com/file-extension/DAA
|
||
# describes the daa file format. The magic would be:
|
||
0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive
|
||
|
||
# From Albert Cahalan <acahalan@gmail.com>
|
||
# really le32 operation,destination,payloadsize (but quite predictable)
|
||
# 01 00 00 00 00 00 00 c0 00 02 00 00
|
||
0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware
|
||
|
||
# From Eric Sandeen
|
||
# GFS2
|
||
0x10000 belong 0x01161970
|
||
>0x10018 belong 0x0000051d GFS1 Filesystem
|
||
>>0x10024 belong x (blocksize %d,
|
||
>>0x10060 string >\0 lockproto %s)
|
||
>0x10018 belong 0x00000709 GFS2 Filesystem
|
||
>>0x10024 belong x (blocksize %d,
|
||
>>0x10060 string >\0 lockproto %s)
|
||
|
||
# BTRFS
|
||
0x10040 string _BHRfS_M BTRFS Filesystem
|
||
>0x1012b string >\0 (label "%s",
|
||
>0x10090 lelong x sectorsize %d,
|
||
>0x10094 lelong x nodesize %d,
|
||
>0x10098 lelong x leafsize %d)
|
||
|
||
|
||
# dvdisaster's .ecc
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
0 string *dvdisaster* dvdisaster error correction file
|
||
|
||
# xfs metadump image
|
||
# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
|
||
# but can we do the << ? For now it's always 512 (0x200) anyway.
|
||
0 string XFSM
|
||
>0x200 string XFSB XFS filesystem metadump image
|
||
|
||
# Type: CROM filesystem
|
||
# From: Werner Fink <werner@suse.de>
|
||
0 string CROMFS CROMFS
|
||
>6 string >\0 \b version %2.2s,
|
||
>8 ulequad >0 \b block data at %lld,
|
||
>16 ulequad >0 \b fblock table at %lld,
|
||
>24 ulequad >0 \b inode table at %lld,
|
||
>32 ulequad >0 \b root at %lld,
|
||
>40 ulelong >0 \b fblock size = %ld,
|
||
>44 ulelong >0 \b block size = %ld,
|
||
>48 ulequad >0 \b bytes = %lld
|
||
|
||
# Type: xfs metadump image
|
||
# From: Daniel Novotny <dnovotny@redhat.com>
|
||
# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
|
||
# but can we do the << ? For now it's always 512 (0x200) anyway.
|
||
0 string XFSM
|
||
>0x200 string XFSB XFS filesystem metadump image
|
||
|
||
# Type: delta ISO
|
||
# From: Daniel Novotny <dnovotny@redhat.com>
|
||
0 string DISO Delta ISO data,
|
||
>4 belong x version %d
|
||
|
||
# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
|
||
# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0x8000 string JFS1
|
||
# Because it's text-only magic, check a binary value (version) to be sure.
|
||
# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
|
||
# mountable.
|
||
>&0 lelong <3 JFS2 filesystem image
|
||
# Label is followed by a UUID; we have to limit string length to avoid
|
||
# appending the UUID in the case of a 16-byte label.
|
||
>>&144 regex [\x20-\x7E]{1,16} (label "%s")
|
||
>>&0 lequad x \b, %lld blocks
|
||
>>&8 lelong x \b, blocksize %d
|
||
>>&32 lelong&0x00000006 >0 (dirty)
|
||
>>&36 lelong >0 (compressed)
|
||
|
||
# LFS
|
||
0 lelong 0x070162 LFS filesystem image
|
||
>4 lelong 1 version 1,
|
||
>>8 lelong x \b blocks %u,
|
||
>>12 lelong x \b blocks per segment %u,
|
||
>4 lelong 2 version 2,
|
||
>>8 lelong x \b fragments %u,
|
||
>>12 lelong x \b bytes per segment %u,
|
||
>16 lelong x \b disk blocks %u,
|
||
>20 lelong x \b block size %u,
|
||
>24 lelong x \b fragment size %u,
|
||
>28 lelong x \b fragments per block %u,
|
||
>32 lelong x \b start for free list %u,
|
||
>36 lelong x \b number of free blocks %d,
|
||
>40 lelong x \b number of files %u,
|
||
>44 lelong x \b blocks available for writing %d,
|
||
>48 lelong x \b inodes in cache %d,
|
||
>52 lelong x \b inode file disk address 0x%x,
|
||
>56 lelong x \b inode file inode number %u,
|
||
>60 lelong x \b address of last segment written 0x%x,
|
||
>64 lelong x \b address of next segment to write 0x%x,
|
||
>68 lelong x \b address of current segment written 0x%x
|
||
|
||
0 string td\000 floppy image data (TeleDisk, compressed)
|
||
0 string TD\000 floppy image data (TeleDisk)
|
||
|
||
0 string CQ\024 floppy image data (CopyQM,
|
||
>16 leshort x %d sectors,
|
||
>18 leshort x %d heads.)
|
||
|
||
0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
|
||
|
||
0 beshort 0xAA58 floppy image data (IBM SaveDskF, old)
|
||
0 beshort 0xAA59 floppy image data (IBM SaveDskF)
|
||
0 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed)
|
||
|
||
0 string \074CPM_Disk\076 disk image data (YAZE)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $
|
||
# flash: file(1) magic for Macromedia Flash file format
|
||
#
|
||
# See
|
||
#
|
||
# http://www.macromedia.com/software/flash/open/
|
||
#
|
||
0 string FWS Macromedia Flash data,
|
||
>3 byte x version %d
|
||
!:mime application/x-shockwave-flash
|
||
0 string CWS Macromedia Flash data (compressed),
|
||
!:mime application/x-shockwave-flash
|
||
>3 byte x version %d
|
||
# From: Cal Peake <cp@absolutedigital.net>
|
||
0 string FLV Macromedia Flash Video
|
||
!:mime video/x-flv
|
||
|
||
#
|
||
# Yosu Gomez
|
||
0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
|
||
0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
|
||
# From Dave Wilson
|
||
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
|
||
# fonts: file(1) magic for font data
|
||
#
|
||
0 search/1 FONT ASCII vfont text
|
||
0 short 0436 Berkeley vfont data
|
||
0 short 017001 byte-swapped Berkeley vfont data
|
||
|
||
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
|
||
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
|
||
>20 string >\0 (%s)
|
||
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
|
||
0 string %!FontType1 PostScript Type 1 font program data
|
||
6 string %!FontType1 PostScript Type 1 font program data
|
||
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
|
||
|
||
# X11 font files in SNF (Server Natural Format) format
|
||
# updated by Joerg Jenderek at Feb 2013
|
||
# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
|
||
0 belong 00000004 X11 SNF font data, MSB first
|
||
#>104 belong 00000004 X11 SNF font data, MSB first
|
||
!:mime application/x-font-sfn
|
||
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
|
||
0 lelong 00000004
|
||
>104 lelong 00000004 X11 SNF font data, LSB first
|
||
!:mime application/x-font-sfn
|
||
|
||
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 search/1 STARTFONT\ X11 BDF font text
|
||
|
||
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
|
||
0 string \001fcp X11 Portable Compiled Font data
|
||
>12 byte 0x02 \b, LSB first
|
||
>12 byte 0x0a \b, MSB first
|
||
0 string D1.0\015 X11 Speedo font data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# FIGlet fonts and controlfiles
|
||
# From figmagic supplied with Figlet version 2.2
|
||
# "David E. O'Brien" <obrien@FreeBSD.ORG>
|
||
0 string flf FIGlet font
|
||
>3 string >2a version %-2.2s
|
||
0 string flc FIGlet controlfile
|
||
>3 string >2a version %-2.2s
|
||
|
||
# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
|
||
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
|
||
0 belong 0x14025919 libGrx font data,
|
||
>8 leshort x %dx
|
||
>10 leshort x \b%d
|
||
>40 string x %s
|
||
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
|
||
0 belong 0xff464f4e DOS code page font data collection
|
||
7 belong 0x00454741 DOS code page font data
|
||
7 belong 0x00564944 DOS code page font data (from Linux?)
|
||
4098 string DOSFONT DOSFONT2 encrypted font data
|
||
|
||
# downloadable fonts for browser (prints type) anthon@mnt.org
|
||
0 string PFR1 PFR1 font
|
||
>102 string >0 \b: %s
|
||
|
||
# True Type fonts
|
||
0 string \000\001\000\000\000 TrueType font data
|
||
!:mime application/x-font-ttf
|
||
|
||
0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
|
||
0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
|
||
|
||
# TrueType/OpenType font collections (.ttc)
|
||
# http://www.microsoft.com/typography/otspec/otff.htm
|
||
0 string ttcf TrueType font collection data
|
||
>4 belong 0x00010000 \b, 1.0
|
||
>>8 belong >0 \b, %d fonts
|
||
>4 belong 0x00020000 \b, 2.0
|
||
>>8 belong >0 \b, %d fonts
|
||
# 0x44454947 = 'DSIG'
|
||
>>>16 belong 0x44534947 \b, digitally signed
|
||
|
||
# Opentype font data from Avi Bercovich
|
||
0 string OTTO OpenType font data
|
||
!:mime application/vnd.ms-opentype
|
||
|
||
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
|
||
0 string SplineFontDB: Spline Font Database
|
||
!:mime application/vnd.font-fontforge-sfd
|
||
>14 string x version %s
|
||
|
||
# EOT
|
||
34 string LP Embedded OpenType (EOT)
|
||
!:mime application/vnd.ms-fontobject
|
||
|
||
# Web Open Font Format (.woff)
|
||
# http://www.w3.org/TR/WOFF/
|
||
0 string wOFF Web Open Font Format
|
||
>4 belong x \b, flavor %d
|
||
>8 belong x \b, length %d
|
||
>20 beshort x \b, version %hd
|
||
>22 beshort x \b.%hd
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $
|
||
# FORTRAN source
|
||
0 regex/100 \^[Cc][\ \t] FORTRAN program
|
||
!:mime text/x-fortran
|
||
!:strength - 5
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
|
||
# frame: file(1) magic for FrameMaker files
|
||
#
|
||
# This stuff came on a FrameMaker demo tape, most of which is
|
||
# copyright, but this file is "published" as witness the following:
|
||
#
|
||
# Note that this is the Framemaker Maker Interchange Format, not the
|
||
# Normal format which would be application/vnd.framemaker.
|
||
#
|
||
0 string \<MakerFile FrameMaker document
|
||
!:mime application/x-mif
|
||
>11 string 5.5 (5.5
|
||
>11 string 5.0 (5.0
|
||
>11 string 4.0 (4.0
|
||
>11 string 3.0 (3.0
|
||
>11 string 2.0 (2.0
|
||
>11 string 1.0 (1.0
|
||
>14 byte x %c)
|
||
0 string \<MIFFile FrameMaker MIF (ASCII) file
|
||
!:mime application/x-mif
|
||
>9 string 4.0 (4.0)
|
||
>9 string 3.0 (3.0)
|
||
>9 string 2.0 (2.0)
|
||
>9 string 1.0 (1.x)
|
||
0 search/1 \<MakerDictionary FrameMaker Dictionary text
|
||
!:mime application/x-mif
|
||
>17 string 3.0 (3.0)
|
||
>17 string 2.0 (2.0)
|
||
>17 string 1.0 (1.x)
|
||
0 string \<MakerScreenFont FrameMaker Font file
|
||
!:mime application/x-mif
|
||
>17 string 1.01 (%s)
|
||
0 string \<MML FrameMaker MML file
|
||
!:mime application/x-mif
|
||
0 string \<BookFile FrameMaker Book file
|
||
!:mime application/x-mif
|
||
>10 string 3.0 (3.0
|
||
>10 string 2.0 (2.0
|
||
>10 string 1.0 (1.0
|
||
>13 byte x %c)
|
||
# XXX - this book entry should be verified, if you find one, uncomment this
|
||
#0 string \<Book\ FrameMaker Book (ASCII) file
|
||
#!:mime application/x-mif
|
||
#>6 string 3.0 (3.0)
|
||
#>6 string 2.0 (2.0)
|
||
#>6 string 1.0 (1.0)
|
||
0 string \<Maker Intermediate Print File FrameMaker IPL file
|
||
!:mime application/x-mif
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
|
||
# freebsd: file(1) magic for FreeBSD objects
|
||
#
|
||
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
|
||
# little-endian on x86).
|
||
#
|
||
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
|
||
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
|
||
# schemes for distinguishing between executable images, shared libraries,
|
||
# and object files.
|
||
#
|
||
# FreeBSD says:
|
||
#
|
||
# Regardless of whether it's pure, demand-paged, or none of the
|
||
# above:
|
||
#
|
||
# if the entry point is < 4096, then it's a shared library if
|
||
# the "has run-time loader information" bit is set, and is
|
||
# position-independent if the "is position-independent" bit
|
||
# is set;
|
||
#
|
||
# if the entry point is >= 4096 (or >4095, same thing), then it's
|
||
# an executable, and is dynamically-linked if the "has run-time
|
||
# loader information" bit is set.
|
||
#
|
||
# On x86, NetBSD says:
|
||
#
|
||
# If it's neither pure nor demand-paged:
|
||
#
|
||
# if it has the "has run-time loader information" bit set, it's
|
||
# a dynamically-linked executable;
|
||
#
|
||
# if it doesn't have that bit set, then:
|
||
#
|
||
# if it has the "is position-independent" bit set, it's
|
||
# position-independent;
|
||
#
|
||
# if the entry point is non-zero, it's an executable, otherwise
|
||
# it's an object file.
|
||
#
|
||
# If it's pure:
|
||
#
|
||
# if it has the "has run-time loader information" bit set, it's
|
||
# a dynamically-linked executable, otherwise it's just an
|
||
# executable.
|
||
#
|
||
# If it's demand-paged:
|
||
#
|
||
# if it has the "has run-time loader information" bit set,
|
||
# then:
|
||
#
|
||
# if the entry point is < 4096, it's a shared library;
|
||
#
|
||
# if the entry point is = 4096 or > 4096 (i.e., >= 4096),
|
||
# it's a dynamically-linked executable);
|
||
#
|
||
# if it doesn't have the "has run-time loader information" bit
|
||
# set, then it's just an executable.
|
||
#
|
||
# (On non-x86, NetBSD does much the same thing, except that it uses
|
||
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
|
||
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
|
||
# had 8K pages; dunno about MIPS.)
|
||
#
|
||
# I suspect the two will differ only in perverse and uninteresting cases
|
||
# ("shared" libraries that aren't demand-paged and whose pages probably
|
||
# won't actually be shared, executables with entry points <4096).
|
||
#
|
||
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
|
||
# what the right answer is (although using ">4095", FreeBSD-style, is
|
||
# probably better than separately checking for "=4096" and ">4096",
|
||
# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
|
||
# executables using the NetBSD technique.)
|
||
#
|
||
0 lelong&0377777777 041400407 FreeBSD/i386
|
||
>20 lelong <4096
|
||
>>3 byte&0xC0 &0x80 shared library
|
||
>>3 byte&0xC0 0x40 PIC object
|
||
>>3 byte&0xC0 0x00 object
|
||
>20 lelong >4095
|
||
>>3 byte&0x80 0x80 dynamically linked executable
|
||
>>3 byte&0x80 0x00 executable
|
||
>16 lelong >0 not stripped
|
||
|
||
0 lelong&0377777777 041400410 FreeBSD/i386 pure
|
||
>20 lelong <4096
|
||
>>3 byte&0xC0 &0x80 shared library
|
||
>>3 byte&0xC0 0x40 PIC object
|
||
>>3 byte&0xC0 0x00 object
|
||
>20 lelong >4095
|
||
>>3 byte&0x80 0x80 dynamically linked executable
|
||
>>3 byte&0x80 0x00 executable
|
||
>16 lelong >0 not stripped
|
||
|
||
0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
|
||
>20 lelong <4096
|
||
>>3 byte&0xC0 &0x80 shared library
|
||
>>3 byte&0xC0 0x40 PIC object
|
||
>>3 byte&0xC0 0x00 object
|
||
>20 lelong >4095
|
||
>>3 byte&0x80 0x80 dynamically linked executable
|
||
>>3 byte&0x80 0x00 executable
|
||
>16 lelong >0 not stripped
|
||
|
||
0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
|
||
>20 lelong <4096
|
||
>>3 byte&0xC0 &0x80 shared library
|
||
>>3 byte&0xC0 0x40 PIC object
|
||
>>3 byte&0xC0 0x00 object
|
||
>20 lelong >4095
|
||
>>3 byte&0x80 0x80 dynamically linked executable
|
||
>>3 byte&0x80 0x00 executable
|
||
>16 lelong >0 not stripped
|
||
|
||
# XXX gross hack to identify core files
|
||
# cores start with a struct tss; we take advantage of the following:
|
||
# byte 7: highest byte of the kernel stack pointer, always 0xfe
|
||
# 8/9: kernel (ring 0) ss value, always 0x0010
|
||
# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
|
||
# 28: low order byte of the current PTD entry, always 0 since the
|
||
# PTD is page-aligned
|
||
#
|
||
7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
|
||
>1039 string >\0 from '%s'
|
||
|
||
# /var/run/ld.so.hints
|
||
# What are you laughing about?
|
||
0 lelong 011421044151 ld.so hints file (Little Endian
|
||
>4 lelong >0 \b, version %d)
|
||
>4 belong <1 \b)
|
||
0 belong 011421044151 ld.so hints file (Big Endian
|
||
>4 belong >0 \b, version %d)
|
||
>4 belong <1 \b)
|
||
|
||
#
|
||
# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
|
||
#
|
||
0 string SCRSHOT_ scrshot(1) screenshot,
|
||
>8 byte x version %d,
|
||
>9 byte 2 %d bytes in header,
|
||
>>10 byte x %d chars wide by
|
||
>>11 byte x %d chars high
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $
|
||
# fsav: file(1) magic for datafellows fsav virus definition files
|
||
# Anthon van der Neut (anthon@mnt.org)
|
||
|
||
# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
|
||
0 beshort 0x1575 fsav macro virus signatures
|
||
>8 leshort >0 (%d-
|
||
>11 byte >0 \b%02d-
|
||
>10 byte >0 \b%02d)
|
||
# ftp://ftp.f-prot.com/pub/sign.zip
|
||
#10 ubyte <12
|
||
#>9 ubyte <32
|
||
#>>8 ubyte 0x0a
|
||
#>>>12 ubyte 0x07
|
||
#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
|
||
#>>>>10 byte 0 \b01-
|
||
#>>>>10 byte 1 \b02-
|
||
#>>>>10 byte 2 \b03-
|
||
#>>>>10 byte 3 \b04-
|
||
#>>>>10 byte 4 \b05-
|
||
#>>>>10 byte 5 \b06-
|
||
#>>>>10 byte 6 \b07-
|
||
#>>>>10 byte 7 \b08-
|
||
#>>>>10 byte 8 \b09-
|
||
#>>>>10 byte 9 \b10-
|
||
#>>>>10 byte 10 \b11-
|
||
#>>>>10 byte 11 \b12-
|
||
#>>>>9 ubyte >0 \b%02d)
|
||
# ftp://ftp.f-prot.com/pub/sign2.zip
|
||
#0 ubyte 0x62
|
||
#>1 ubyte 0xF5
|
||
#>>2 ubyte 0x1
|
||
#>>>3 ubyte 0x1
|
||
#>>>>4 ubyte 0x0e
|
||
#>>>>>13 ubyte >0 fsav virus signatures
|
||
#>>>>>>11 ubyte x size 0x%02x
|
||
#>>>>>>12 ubyte x \b%02x
|
||
#>>>>>>13 ubyte x \b%02x bytes
|
||
|
||
# Joerg Jenderek: joerg dot jenderek at web dot de
|
||
# http://www.clamav.net/doc/latest/html/node45.html
|
||
# .cvd files start with a 512 bytes colon separated header
|
||
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
|
||
# + gzipped tarball files
|
||
0 string ClamAV-VDB:
|
||
>11 string >\0 Clam AntiVirus database %-.23s
|
||
>>34 string :
|
||
>>>35 string !: \b, version
|
||
>>>>35 string x \b%-.1s
|
||
>>>>>36 string !:
|
||
>>>>>>36 string x \b%-.1s
|
||
>>>>>>>37 string !:
|
||
>>>>>>>>37 string x \b%-.1s
|
||
>>>>>>>>>38 string !:
|
||
>>>>>>>>>>38 string x \b%-.1s
|
||
>512 string \037\213 \b, gzipped
|
||
>769 string ustar\0 \b, tarred
|
||
|
||
# Type: Grisoft AVG AntiVirus
|
||
# From: David Newgas <david@newgas.net>
|
||
0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
|
||
# fusecompress: file(1) magic for fusecompress
|
||
0 string \037\135\211 FuseCompress(ed) data
|
||
>3 byte 0x00 (none format)
|
||
>3 byte 0x01 (bz2 format)
|
||
>3 byte 0x02 (gz format)
|
||
>3 byte 0x03 (lzo format)
|
||
>3 byte 0x04 (xor format)
|
||
>3 byte >0x04 (unknown format)
|
||
>4 long x uncompressed size: %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
|
||
# games: file(1) for games
|
||
|
||
# Fabio Bonelli <fabiobonelli@libero.it>
|
||
# Quake II - III data files
|
||
0 string IDP2 Quake II 3D Model file,
|
||
>20 long x %lu skin(s),
|
||
>8 long x (%lu x
|
||
>12 long x %lu),
|
||
>40 long x %lu frame(s),
|
||
>16 long x Frame size %lu bytes,
|
||
>24 long x %lu vertices/frame,
|
||
>28 long x %lu texture coordinates,
|
||
>32 long x %lu triangles/frame
|
||
|
||
0 string IBSP Quake
|
||
>4 long 0x26 II Map file (BSP)
|
||
>4 long 0x2E III Map file (BSP)
|
||
|
||
0 string IDS2 Quake II SP2 sprite file
|
||
|
||
#---------------------------------------------------------------------------
|
||
# Doom and Quake
|
||
# submitted by Nicolas Patrois
|
||
|
||
0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
|
||
# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
|
||
|
||
24 string LxD\ 203 Linuxdoom save
|
||
>0 string x , name=%s
|
||
>44 string x , world=%s
|
||
|
||
# Quake
|
||
|
||
0 string PACK Quake I or II world or extension
|
||
>8 lelong >0 \b, %d entries
|
||
|
||
#0 string -1\x0a Quake I demo
|
||
#>30 string x version %.4s
|
||
#>61 string x level %s
|
||
|
||
#0 string 5\x0a Quake I save
|
||
|
||
# The levels
|
||
|
||
# Quake 1
|
||
|
||
0 string 5\x0aIntroduction Quake I save: start Introduction
|
||
0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
|
||
0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
|
||
0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
|
||
0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
|
||
0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
|
||
0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
|
||
0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
|
||
0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
|
||
0 string 5\x0athe_Installation Quake I save: e2m1 The installation
|
||
0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
|
||
0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
|
||
0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
|
||
0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
|
||
0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
|
||
0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
|
||
0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
|
||
0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
|
||
0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
|
||
0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
|
||
0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
|
||
0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
|
||
0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
|
||
0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
|
||
0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
|
||
0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
|
||
0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
|
||
0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
|
||
0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
|
||
0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
|
||
0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
|
||
0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
|
||
|
||
# Quake DeathMatch levels
|
||
|
||
0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
|
||
0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
|
||
0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
|
||
0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
|
||
0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
|
||
0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
|
||
|
||
# Scourge of Armagon
|
||
|
||
0 string 5\x0aCommand_HQ Quake I save: start Command HQ
|
||
0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
|
||
0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
|
||
0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
|
||
0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
|
||
0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
|
||
0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
|
||
0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
|
||
0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
|
||
0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
|
||
0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
|
||
0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
|
||
0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
|
||
0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
|
||
0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
|
||
0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
|
||
0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
|
||
0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
|
||
|
||
# Malice
|
||
|
||
0 string 5\x0aThe_Academy Quake I save: start The academy
|
||
0 string 5\x0aThe_Lab Quake I save: d1 The lab
|
||
0 string 5\x0aArea_33 Quake I save: d1b Area 33
|
||
0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
|
||
0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
|
||
0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
|
||
0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
|
||
0 string 5\x0aArea44 Quake I save: d1c Area 44
|
||
0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
|
||
0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
|
||
0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
|
||
0 string 5\x0aThe_Flood Quake I save: d5 The flood
|
||
0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
|
||
0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
|
||
0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
|
||
0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
|
||
0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
|
||
0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
|
||
0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
|
||
0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
|
||
0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
|
||
|
||
# Malice DeathMatch levels
|
||
|
||
0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
|
||
0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
|
||
0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
|
||
0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
|
||
0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
|
||
0 string 5\x0aDOMINO Quake I save: ddm6 Domino
|
||
0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
|
||
|
||
|
||
0 string MComprHD MAME CHD compressed hard disk image,
|
||
>12 belong x version %lu
|
||
|
||
# doom - submitted by Jon Dowland
|
||
|
||
0 string =IWAD doom main IWAD data
|
||
>4 lelong x containing %d lumps
|
||
0 string =PWAD doom patch PWAD data
|
||
>4 lelong x containing %d lumps
|
||
|
||
# Build engine group files (Duke Nukem, Shadow Warrior, ...)
|
||
# Extension: .grp
|
||
# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
|
||
0 string KenSilverman Build engine group file
|
||
>12 lelong x containing %d files
|
||
|
||
# Summary: Warcraft 3 save
|
||
# Extension: .w3g
|
||
# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
0 string Warcraft\ III\ recorded\ game %s
|
||
|
||
|
||
# Summary: Warcraft 3 map
|
||
# Extension: .w3m
|
||
# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
0 string HM3W Warcraft III map file
|
||
|
||
|
||
# Summary: SGF Smart Game Format
|
||
# Extension: .sgf
|
||
# Reference: http://www.red-bean.com/sgf/
|
||
# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
|
||
# Modified by (1): Abel Cheung (regex, more game format)
|
||
# FIXME: Some games don't have GM (game type)
|
||
0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
|
||
>2 search/0x200/b GM[
|
||
>>&0 string 1] (Go)
|
||
>>&0 string 2] (Othello)
|
||
>>&0 string 3] (chess)
|
||
>>&0 string 4] (Gomoku+Renju)
|
||
>>&0 string 5] (Nine Men's Morris)
|
||
>>&0 string 6] (Backgammon)
|
||
>>&0 string 7] (Chinese chess)
|
||
>>&0 string 8] (Shogi)
|
||
>>&0 string 9] (Lines of Action)
|
||
>>&0 string 10] (Ataxx)
|
||
>>&0 string 11] (Hex)
|
||
>>&0 string 12] (Jungle)
|
||
>>&0 string 13] (Neutron)
|
||
>>&0 string 14] (Philosopher's Football)
|
||
>>&0 string 15] (Quadrature)
|
||
>>&0 string 16] (Trax)
|
||
>>&0 string 17] (Tantrix)
|
||
>>&0 string 18] (Amazons)
|
||
>>&0 string 19] (Octi)
|
||
>>&0 string 20] (Gess)
|
||
>>&0 string 21] (Twixt)
|
||
>>&0 string 22] (Zertz)
|
||
>>&0 string 23] (Plateau)
|
||
>>&0 string 24] (Yinsh)
|
||
>>&0 string 25] (Punct)
|
||
>>&0 string 26] (Gobblet)
|
||
>>&0 string 27] (hive)
|
||
>>&0 string 28] (Exxit)
|
||
>>&0 string 29] (Hnefatal)
|
||
>>&0 string 30] (Kuba)
|
||
>>&0 string 31] (Tripples)
|
||
>>&0 string 32] (Chase)
|
||
>>&0 string 33] (Tumbling Down)
|
||
>>&0 string 34] (Sahara)
|
||
>>&0 string 35] (Byte)
|
||
>>&0 string 36] (Focus)
|
||
>>&0 string 37] (Dvonn)
|
||
>>&0 string 38] (Tamsk)
|
||
>>&0 string 39] (Gipf)
|
||
>>&0 string 40] (Kropki)
|
||
|
||
##############################################
|
||
# NetImmerse/Gamebryo game engine entries
|
||
|
||
# Summary: Gamebryo game engine file
|
||
# Extension: .nif, .kf
|
||
# Created by: Abel Cheung <abelcheung@gmail.com>
|
||
0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file
|
||
>&0 regex [0-9a-z.]+ \b, version %s
|
||
|
||
# Summary: Gamebryo game engine file
|
||
# Extension: .kfm
|
||
# Created by: Abel Cheung <abelcheung@gmail.com>
|
||
0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File
|
||
>&0 regex [0-9a-z.]+ \b, version %s
|
||
|
||
# Summary: NetImmerse game engine file
|
||
# Extension .nif
|
||
# Created by: Abel Cheung <abelcheung@gmail.com>
|
||
0 string NetImmerse\ File\ Format,\ Versio
|
||
>&0 string n\ NetImmerse game engine file
|
||
>>&0 regex [0-9a-z.]+ \b, version %s
|
||
|
||
# Type: SGF Smart Game Format
|
||
# URL: http://www.red-bean.com/sgf/
|
||
# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
|
||
2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format
|
||
>2 regex/c GM\\[1\\] - Go Game
|
||
>2 regex/c GM\\[6\\] - BackGammon Game
|
||
>2 regex/c GM\\[11\\] - Hex Game
|
||
>2 regex/c GM\\[18\\] - Amazons Game
|
||
>2 regex/c GM\\[19\\] - Octi Game
|
||
>2 regex/c GM\\[20\\] - Gess Game
|
||
>2 regex/c GM\\[21\\] - twix Game
|
||
|
||
# Epic Games/Unreal Engine Package
|
||
#
|
||
0 lelong 0x9E2A83C1 Unreal Engine Package,
|
||
>4 leshort x version: %i
|
||
>12 lelong !0 \b, names: %i
|
||
>28 lelong !0 \b, imports: %i
|
||
>20 lelong !0 \b, exports: %i
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# gcc: file(1) magic for GCC special files
|
||
#
|
||
0 string gpch GCC precompiled header
|
||
|
||
# The version field is annoying. It's 3 characters, not zero-terminated.
|
||
>5 byte x (version %c
|
||
>6 byte x \b%c
|
||
>7 byte x \b%c)
|
||
|
||
# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
|
||
>4 byte 67 for C
|
||
>4 byte 111 for Objective C
|
||
>4 byte 43 for C++
|
||
>4 byte 79 for Objective C++
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
|
||
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
|
||
|
||
######################################################################
|
||
#
|
||
# Acoustic Doppler Current Profilers (ADCP)
|
||
#
|
||
######################################################################
|
||
|
||
0 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP)
|
||
|
||
######################################################################
|
||
#
|
||
# Metadata
|
||
#
|
||
######################################################################
|
||
|
||
0 string Identification_Information FGDC ASCII metadata
|
||
|
||
######################################################################
|
||
#
|
||
# Seimsic / Subbottom
|
||
#
|
||
######################################################################
|
||
|
||
# Knudsen subbottom chirp profiler - Binary File Format: B9
|
||
# KEB D409-03167 V1.75 Huffman
|
||
0 string KEB\ Knudsen seismic KEL binary (KEB) -
|
||
>4 regex [-A-Z0-9]* Software: %s
|
||
>>&1 regex V[0-9]*\.[0-9]* version %s
|
||
|
||
######################################################################
|
||
#
|
||
# LIDAR - Laser altimetry or bathy
|
||
#
|
||
######################################################################
|
||
|
||
|
||
# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
|
||
0 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar
|
||
>4 regex [0-9]*\.[0-9]* version %s
|
||
|
||
0 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data
|
||
>3 byte x version %d .
|
||
>4 byte x %d
|
||
|
||
|
||
######################################################################
|
||
#
|
||
# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
|
||
#
|
||
######################################################################
|
||
|
||
# GeoAcoustics - GeoSwath Plus
|
||
4 beshort 0x2002 GeoSwath RDF
|
||
0 string Start:- GeoSwatch auf text file
|
||
|
||
# Seabeam 2100
|
||
# mbsystem code mb41
|
||
0 string SB2100 SeaBeam 2100 multibeam sonar
|
||
0 string SB2100DR SeaBeam 2100 DR multibeam sonar
|
||
0 string SB2100PR SeaBeam 2100 PR multibeam sonar
|
||
|
||
# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
|
||
# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
|
||
0 string $HSF XSE multibeam
|
||
|
||
# mb121 http://www.saic.com/maritime/gsf/
|
||
8 string GSF-v SAIC generic sensor format (GSF) sonar data,
|
||
>&0 regex [0-9]*\.[0-9]* version %s
|
||
|
||
# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
|
||
# mb161
|
||
9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format
|
||
|
||
# MBSystem processing caches the mbinfo output
|
||
1 string Swath\ Data\ File: mbsystem info cache
|
||
|
||
# Caris John Hughes Clark format
|
||
0 string HDCS Caris multibeam sonar related data
|
||
1 string Start/Stop\ parameter\ header: Caris ASCII project summary
|
||
|
||
######################################################################
|
||
#
|
||
# Visualization and 3D modeling
|
||
#
|
||
######################################################################
|
||
|
||
# IVS - IVS3d.com Tagged Data Represetation
|
||
0 string %%\ TDR\ 2.0 IVS Fledermaus TDR file
|
||
|
||
# http://www.ecma-international.org/publications/standards/Ecma-363.htm
|
||
# 3D in PDFs
|
||
0 string U3D ECMA-363, Universal 3D
|
||
|
||
######################################################################
|
||
#
|
||
# Support files
|
||
#
|
||
######################################################################
|
||
|
||
# https://midas.psi.ch/elog/
|
||
0 string $@MID@$ elog journal entry
|
||
|
||
# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
|
||
0 string DSBB Surfer 6 binary grid file
|
||
>4 leshort x \b, %d
|
||
>6 leshort x \bx%d
|
||
>8 ledouble x \b, minx=%g
|
||
>16 ledouble x \b, maxx=%g
|
||
>24 ledouble x \b, miny=%g
|
||
>32 ledouble x \b, maxy=%g
|
||
>40 ledouble x \b, minz=%g
|
||
>48 ledouble x \b, maxz=%g
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# GEOS files (Vidar Madsen, vidar@gimp.org)
|
||
# semi-commonly used in embedded and handheld systems.
|
||
0 belong 0xc745c153 GEOS
|
||
>40 byte 1 executable
|
||
>40 byte 2 VMFile
|
||
>40 byte 3 binary
|
||
>40 byte 4 directory label
|
||
>40 byte <1 unknown
|
||
>40 byte >4 unknown
|
||
>4 string >\0 \b, name "%s"
|
||
#>44 short x \b, version %d
|
||
#>46 short x \b.%d
|
||
#>48 short x \b, rev %d
|
||
#>50 short x \b.%d
|
||
#>52 short x \b, proto %d
|
||
#>54 short x \br%d
|
||
#>168 string >\0 \b, copyright "%s"
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $
|
||
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
|
||
# by Federico Mena <federico@nuclecu.unam.mx>
|
||
|
||
0 string GIMP\ Gradient GIMP gradient data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# XCF: file(1) magic for the XCF image format used in the GIMP developed
|
||
# by Spencer Kimball and Peter Mattis
|
||
# ('Bucky' LaDieu, nega@vt.edu)
|
||
|
||
0 string gimp\ xcf GIMP XCF image data,
|
||
!:mime image/x-xcf
|
||
>9 string file version 0,
|
||
>9 string v version
|
||
>>10 string >\0 %s,
|
||
>14 belong x %lu x
|
||
>18 belong x %lu,
|
||
>22 belong 0 RGB Color
|
||
>22 belong 1 Greyscale
|
||
>22 belong 2 Indexed Color
|
||
>22 belong >2 Unknown Image Type.
|
||
|
||
#------------------------------------------------------------------------------
|
||
# XCF: file(1) magic for the patterns used in the GIMP, developed
|
||
# by Spencer Kimball and Peter Mattis
|
||
# ('Bucky' LaDieu, nega@vt.edu)
|
||
|
||
20 string GPAT GIMP pattern data,
|
||
>24 string x %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# XCF: file(1) magic for the brushes used in the GIMP, developed
|
||
# by Spencer Kimball and Peter Mattis
|
||
# ('Bucky' LaDieu, nega@vt.edu)
|
||
|
||
20 string GIMP GIMP brush data
|
||
|
||
# GIMP Curves File
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
0 string #\040GIMP\040Curves\040File GIMP curve file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $
|
||
# GNOME related files
|
||
|
||
# Contributed by Josh Triplett
|
||
# FIXME: Could be simplified if pstring supported two-byte counts
|
||
0 string GnomeKeyring\n\r\0\n GNOME keyring
|
||
>&0 ubyte 0 \b, major version 0
|
||
>>&0 ubyte 0 \b, minor version 0
|
||
>>>&0 ubyte 0 \b, crypto type 0 (AES)
|
||
>>>&0 ubyte >0 \b, crypto type %hhu (unknown)
|
||
>>>&1 ubyte 0 \b, hash type 0 (MD5)
|
||
>>>&1 ubyte >0 \b, hash type %hhu (unknown)
|
||
>>>&2 ubelong 0xFFFFFFFF \b, name NULL
|
||
>>>&2 ubelong !0xFFFFFFFF
|
||
>>>>&-4 ubelong >255 \b, name too long for file's pstring type
|
||
>>>>&-4 ubelong <256
|
||
>>>>>&-1 pstring x \b, name "%s"
|
||
>>>>>>&0 ubeqdate x \b, last modified %s
|
||
>>>>>>&8 ubeqdate x \b, created %s
|
||
>>>>>>&16 ubelong &1
|
||
>>>>>>>&0 ubelong x \b, locked if idle for %u seconds
|
||
>>>>>>&16 ubelong ^1 \b, not locked if idle
|
||
>>>>>>&24 ubelong x \b, hash iterations %u
|
||
>>>>>>&28 ubequad x \b, salt %llu
|
||
>>>>>>&52 ubelong x \b, %u item(s)
|
||
|
||
# From: Alex Beregszaszi <alex@fsn.hu>
|
||
4 string gtktalog GNOME Catalogue (gtktalog)
|
||
>13 string >\0 version %s
|
||
|
||
# Summary: GStreamer binary registry
|
||
# Extension: .bin
|
||
# Submitted by: Josh Triplett <josh@joshtriplett.org>
|
||
0 belong 0xc0def00d GStreamer binary registry
|
||
>4 string x \b, version %s
|
||
|
||
# GVariant Database file
|
||
# By Elan Ruusamae <glen@delfi.ee>
|
||
# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
|
||
# It's always "GVariant", it's byte swapped on incompatible archs
|
||
# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
|
||
# file_builder_serialise()
|
||
# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
|
||
0 string GVariant GVariant Database file,
|
||
# version is never filled. probably future extension
|
||
>8 lelong x version %d
|
||
# not sure are these usable, so commented out
|
||
#>>16 lelong x start %d,
|
||
#>>>20 lelong x end %d
|
||
|
||
# G-IR database made by gobject-introspect toolset,
|
||
# http://live.gnome.org/GObjectIntrospection
|
||
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
|
||
>16 byte x \b, v%d
|
||
>17 byte x \b.%d
|
||
>20 leshort x \b, %d entries
|
||
>22 leshort x \b/%d local
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $
|
||
# gnu: file(1) magic for various GNU tools
|
||
#
|
||
# GNU nlsutils message catalog file format
|
||
#
|
||
# GNU message catalog (.mo and .gmo files)
|
||
|
||
0 string \336\22\4\225 GNU message catalog (little endian),
|
||
>6 leshort x revision %d.
|
||
>4 leshort >0 \b%d,
|
||
>>8 lelong x %d messages,
|
||
>>36 lelong x %d sysdep messages
|
||
>4 leshort =0 \b%d,
|
||
>>8 lelong x %d messages
|
||
|
||
0 string \225\4\22\336 GNU message catalog (big endian),
|
||
>4 beshort x revision %d.
|
||
>6 beshort >0 \b%d,
|
||
>>8 belong x %d messages,
|
||
>>36 belong x %d sysdep messages
|
||
>6 beshort =0 \b%d,
|
||
>>8 belong x %d messages
|
||
|
||
|
||
# GnuPG
|
||
# The format is very similar to pgp
|
||
0 string \001gpg GPG key trust database
|
||
>4 byte x version %d
|
||
# Note: magic.mime had 0x8501 for the next line instead of 0x8502
|
||
0 beshort 0x8502 GPG encrypted data
|
||
!:mime text/PGP # encoding: data
|
||
|
||
# This magic is not particularly good, as the keyrings don't have true
|
||
# magic. Nevertheless, it covers many keyrings.
|
||
0 beshort 0x9901 GPG key public ring
|
||
!:mime application/x-gnupg-keyring
|
||
|
||
# Symmetric encryption
|
||
0 leshort 0x0d8c
|
||
>4 leshort 0x0203
|
||
>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
|
||
>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
|
||
>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
|
||
>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
|
||
>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
|
||
>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
|
||
>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
|
||
>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
|
||
>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
|
||
>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
|
||
|
||
|
||
# Gnumeric spreadsheet
|
||
# This entry is only semi-helpful, as Gnumeric compresses its files, so
|
||
# they will ordinarily reported as "compressed", but at least -z helps
|
||
39 string =<gmr:Workbook Gnumeric spreadsheet
|
||
|
||
# From: James Youngman <jay@gnu.org>
|
||
# gnu find magic
|
||
0 string \0LOCATE GNU findutils locate database data
|
||
>7 string >\0 \b, format %s
|
||
>7 string 02 \b (frcode)
|
||
|
||
# Files produced by GNU gettext
|
||
0 long 0xDE120495 GNU-format message catalog data
|
||
0 long 0x950412DE GNU-format message catalog data
|
||
|
||
# gettext message catalogue
|
||
0 regex \^msgid\ GNU gettext message catalogue text
|
||
!:mime text/x-po
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# gnumeric: file(1) magic for Gnumeric spreadsheet
|
||
# This entry is only semi-helpful, as Gnumeric compresses its files, so
|
||
# they will ordinarily reported as "compressed", but at least -z helps
|
||
39 string =<gmr:Workbook Gnumeric spreadsheet
|
||
!:mime application/x-gnumeric
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $
|
||
#
|
||
# GPT Partition table patterns.
|
||
# Author: Rogier Goossens (goossens.rogier@gmail.com)
|
||
# Note that a GPT-formatted disk must contain an MBR as well.
|
||
#
|
||
|
||
# The initial segment (up to >>>>>>>>422) was copied from the X86
|
||
# partition table code (aka MBR).
|
||
# This is kept separate, so that MBR partitions are not reported as well.
|
||
# (use -k if you do want them as well)
|
||
|
||
# First, detect the MBR partiton table
|
||
# If more than one GPT protective MBR partition exists, don't print anything
|
||
# (the other MBR detection code will then just print the MBR partition table)
|
||
0x1FE leshort 0xAA55
|
||
>3 string !MS
|
||
>>3 string !SYSLINUX
|
||
>>>3 string !MTOOL
|
||
>>>>3 string !NEWLDR
|
||
>>>>>5 string !DOS
|
||
# not FAT (32 bit)
|
||
>>>>>>82 string !FAT32
|
||
#not Linux kernel
|
||
>>>>>>>514 string !HdrS
|
||
#not BeOS
|
||
>>>>>>>>422 string !Be\ Boot\ Loader
|
||
# GPT with protective MBR entry in partition 1 (only)
|
||
>>>>>>>>>450 ubyte 0xee
|
||
>>>>>>>>>>466 ubyte !0xee
|
||
>>>>>>>>>>>482 ubyte !0xee
|
||
>>>>>>>>>>>>498 ubyte !0xee
|
||
#>>>>>>>>>>>>>446 use gpt-mbr-partition
|
||
>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
|
||
>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
|
||
>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
|
||
>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
|
||
>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
|
||
>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
|
||
# GPT with protective MBR entry in partition 2 (only)
|
||
>>>>>>>>>450 ubyte !0xee
|
||
>>>>>>>>>>466 ubyte 0xee
|
||
>>>>>>>>>>>482 ubyte !0xee
|
||
>>>>>>>>>>>>498 ubyte !0xee
|
||
#>>>>>>>>>>>>>462 use gpt-mbr-partition
|
||
>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
|
||
>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
|
||
>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
|
||
>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
|
||
>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
|
||
>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
|
||
# GPT with protective MBR entry in partition 3 (only)
|
||
>>>>>>>>>450 ubyte !0xee
|
||
>>>>>>>>>>466 ubyte !0xee
|
||
>>>>>>>>>>>482 ubyte 0xee
|
||
>>>>>>>>>>>>498 ubyte !0xee
|
||
#>>>>>>>>>>>>>478 use gpt-mbr-partition
|
||
>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
|
||
>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
|
||
>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
|
||
>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
|
||
>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
|
||
>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
|
||
# GPT with protective MBR entry in partition 4 (only)
|
||
>>>>>>>>>450 ubyte !0xee
|
||
>>>>>>>>>>466 ubyte !0xee
|
||
>>>>>>>>>>>482 ubyte !0xee
|
||
>>>>>>>>>>>>498 ubyte 0xee
|
||
#>>>>>>>>>>>>>494 use gpt-mbr-partition
|
||
>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
|
||
>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
|
||
>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
|
||
>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
|
||
>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
|
||
>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
|
||
>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
|
||
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
|
||
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
|
||
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
|
||
|
||
# The following code does GPT detection and processing, including
|
||
# sector size detection.
|
||
# It has to be duplicated above because the top-level pattern
|
||
# (i.e. not called using 'use') must print *something* for file
|
||
# to count it as a match. Text only printed in named patterns is
|
||
# not counted, and causes file to continue, and try and match
|
||
# other patterns.
|
||
#
|
||
# Unfortunately, when assuming sector sizes >=16k, if the sector size
|
||
# happens to be 512 instead, we may find confusing data after the GPT
|
||
# table... If the GPT table has less than 128 entries, this may even
|
||
# happen for assumed sector sizes as small as 4k
|
||
# This could be solved by checking for the presence of the backup GPT
|
||
# header as well, but that makes the logic extremely complex
|
||
##0 name gpt-mbr-partition
|
||
##>(8.l*8192) string EFI\ PART
|
||
##>>(8.l*8192) use gpt-mbr-type
|
||
##>>&-8 use gpt-table
|
||
##>>0 ubyte x of 8192 bytes
|
||
##>(8.l*8192) string !EFI\ PART
|
||
##>>(8.l*4096) string EFI\ PART GPT partition table
|
||
##>>>0 use gpt-mbr-type
|
||
##>>>&-8 use gpt-table
|
||
##>>>0 ubyte x of 4096 bytes
|
||
##>>(8.l*4096) string !EFI\ PART
|
||
##>>>(8.l*2048) string EFI\ PART GPT partition table
|
||
##>>>>0 use gpt-mbr-type
|
||
##>>>>&-8 use gpt-table
|
||
##>>>>0 ubyte x of 2048 bytes
|
||
##>>>(8.l*2048) string !EFI\ PART
|
||
##>>>>(8.l*1024) string EFI\ PART GPT partition table
|
||
##>>>>>0 use gpt-mbr-type
|
||
##>>>>>&-8 use gpt-table
|
||
##>>>>>0 ubyte x of 1024 bytes
|
||
##>>>>(8.l*1024) string !EFI\ PART
|
||
##>>>>>(8.l*512) string EFI\ PART GPT partition table
|
||
##>>>>>>0 use gpt-mbr-type
|
||
##>>>>>>&-8 use gpt-table
|
||
##>>>>>>0 ubyte x of 512 bytes
|
||
|
||
# Print details of MBR type for a GPT-disk
|
||
# Calling code ensures that there is only one 0xee partition.
|
||
0 name gpt-mbr-type
|
||
# GPT with protective MBR entry in partition 1
|
||
>450 ubyte 0xee
|
||
>>454 ulelong 1
|
||
>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>454 ulelong !1 \b (nonstandard: not at LBA 1)
|
||
# GPT with protective MBR entry in partition 2
|
||
>466 ubyte 0xee
|
||
>>470 ulelong 1
|
||
>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
|
||
>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>470 ulelong !1 \b (nonstandard: not at LBA 1)
|
||
# GPT with protective MBR entry in partition 3
|
||
>482 ubyte 0xee
|
||
>>486 ulelong 1
|
||
>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
|
||
>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>486 ulelong !1 \b (nonstandard: not at LBA 1)
|
||
# GPT with protective MBR entry in partition 4
|
||
>498 ubyte 0xee
|
||
>>502 ulelong 1
|
||
>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
|
||
>>502 ulelong !1 \b (nonstandard: not at LBA 1)
|
||
|
||
# Print the information from a GPT partition table structure
|
||
0 name gpt-table
|
||
>10 uleshort x \b, version %u
|
||
>8 uleshort x \b.%u
|
||
# a GUID is just like a UUID, except it's displayed mixed-endian.
|
||
>56 ulelong x \b, GUID: %08x
|
||
>60 uleshort x \b-%04x
|
||
>62 uleshort x \b-%04x
|
||
>64 ubeshort x \b-%04x
|
||
>66 ubeshort x \b-%04x
|
||
>68 ubelong x \b%08x
|
||
#>80 uleshort x \b, %d partition entries
|
||
>32 ulequad+1 x \b, disk size: %lld sectors
|
||
|
||
# In case a GPT data-structure is at LBA 0, report it as well
|
||
# This covers systems which are not GPT-aware, and which show
|
||
# and allow access to the protective partition. This code will
|
||
# detect the contents of such a partition.
|
||
0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
|
||
>0 use gpt-table
|
||
>0 ubyte x (sector size unknown)
|
||
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
|
||
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
|
||
#
|
||
# ACE/gr binary
|
||
0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
|
||
>39 byte >0 - version %c
|
||
# ACE/gr ascii
|
||
0 string #\ xvgr\ parameter\ file ACE/gr ascii file
|
||
0 string #\ xmgr\ parameter\ file ACE/gr ascii file
|
||
0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
|
||
# Grace projects
|
||
0 string #\ Grace\ project\ file Grace project file
|
||
>23 string @version\ (version
|
||
>>32 byte >0 %c
|
||
>>33 string >\0 \b.%.2s
|
||
>>35 string >\0 \b.%.2s)
|
||
# ACE/gr fit description files
|
||
0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
|
||
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
|
||
# graphviz: file(1) magic for http://www.graphviz.org/
|
||
|
||
# FIXME: These patterns match too generally. For example, the first
|
||
# line matches a LaTeX file containing the word "graph" (with a {
|
||
# following later) and the second line matches this file.
|
||
#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
|
||
#!:mime text/vnd.graphviz
|
||
#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
|
||
#!:mime text/vnd.graphviz
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
|
||
# gringotts: file(1) magic for Gringotts
|
||
# http://devel.pluto.linux.it/projects/Gringotts/
|
||
# author: Germano Rizzo <mano@pluto.linux.it>
|
||
#GRG3????Y
|
||
0 string GRG Gringotts data file
|
||
#file format 1
|
||
>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
|
||
#file format 2
|
||
>3 string 2 v.2, MCRYPT S2K,
|
||
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
|
||
>>8 byte&0x70 0x10 SERPENT crypt,
|
||
>>8 byte&0x70 0x20 TWOFISH crypt,
|
||
>>8 byte&0x70 0x30 CAST-256 crypt,
|
||
>>8 byte&0x70 0x40 SAFER+ crypt,
|
||
>>8 byte&0x70 0x50 LOKI97 crypt,
|
||
>>8 byte&0x70 0x60 3DES crypt,
|
||
>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
|
||
>>8 byte&0x08 0x00 SHA1 hash,
|
||
>>8 byte&0x08 0x08 RIPEMD-160 hash,
|
||
>>8 byte&0x04 0x00 ZLib
|
||
>>8 byte&0x04 0x04 BZip2
|
||
>>8 byte&0x03 0x00 lvl.0
|
||
>>8 byte&0x03 0x01 lvl.3
|
||
>>8 byte&0x03 0x02 lvl.6
|
||
>>8 byte&0x03 0x03 lvl.9
|
||
#file format 3
|
||
>3 string 3 v.3, OpenPGP S2K,
|
||
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
|
||
>>8 byte&0x70 0x10 SERPENT crypt,
|
||
>>8 byte&0x70 0x20 TWOFISH crypt,
|
||
>>8 byte&0x70 0x30 CAST-256 crypt,
|
||
>>8 byte&0x70 0x40 SAFER+ crypt,
|
||
>>8 byte&0x70 0x50 LOKI97 crypt,
|
||
>>8 byte&0x70 0x60 3DES crypt,
|
||
>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
|
||
>>8 byte&0x08 0x00 SHA1 hash,
|
||
>>8 byte&0x08 0x08 RIPEMD-160 hash,
|
||
>>8 byte&0x04 0x00 ZLib
|
||
>>8 byte&0x04 0x04 BZip2
|
||
>>8 byte&0x03 0x00 lvl.0
|
||
>>8 byte&0x03 0x01 lvl.3
|
||
>>8 byte&0x03 0x02 lvl.6
|
||
>>8 byte&0x03 0x03 lvl.9
|
||
#file format >3
|
||
>3 string >3 v.%.1s (unknown details)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
|
||
# Guile file magic from <dalepsmith@gmail.com>
|
||
# http://www.gnu.org/s/guile/
|
||
# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
|
||
|
||
0 string GOOF---- Guile Object
|
||
>8 string LE \b, little endian
|
||
>8 string BE \b, big endian
|
||
>11 string 4 \b, 32bit
|
||
>11 string 8 \b, 64bit
|
||
>13 regex .\.. \b, bytecode v%s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
|
||
# hitach-sh: file(1) magic for Hitachi Super-H
|
||
#
|
||
# Super-H COFF
|
||
#
|
||
# below test line conflicts with 2nd NTFS filesystem sector
|
||
0 beshort 0x0500 Hitachi SH big-endian COFF
|
||
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
|
||
#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF
|
||
>18 beshort&0x0002 =0x0000 object
|
||
>18 beshort&0x0002 =0x0002 executable
|
||
>18 beshort&0x0008 =0x0008 \b, stripped
|
||
>18 beshort&0x0008 =0x0000 \b, not stripped
|
||
#
|
||
0 leshort 0x0550 Hitachi SH little-endian COFF
|
||
>18 leshort&0x0002 =0x0000 object
|
||
>18 leshort&0x0002 =0x0002 executable
|
||
>18 leshort&0x0008 =0x0008 \b, stripped
|
||
>18 leshort&0x0008 =0x0000 \b, not stripped
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
|
||
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
|
||
#
|
||
# XXX - somebody should figure out whether any byte order needs to be
|
||
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
|
||
# big-endian as it was mostly 68K-based.
|
||
#
|
||
# I think the 500 series was the old stack-based machines, running a
|
||
# UNIX environment atop the "SUN kernel"; dunno whether it was
|
||
# big-endian or little-endian.
|
||
#
|
||
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
|
||
# hp300 are 68020+68881 based; hp400 are also 68k. The following basic
|
||
# HP magic is useful for reference, but using "long" magic is a better
|
||
# practice in order to avoid collisions.
|
||
#
|
||
# Guy Harris (guy@netapp.com): some additions to this list came from
|
||
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
|
||
# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
|
||
# "/etc/magic", though, except for the "archive file relocatable library"
|
||
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
|
||
# used in executables, or have they just not yet updated "/etc/magic"
|
||
# completely?
|
||
#
|
||
# 0 beshort 200 hp200 (68010) BSD binary
|
||
# 0 beshort 300 hp300 (68020+68881) BSD binary
|
||
# 0 beshort 0x20c hp200/300 HP-UX binary
|
||
# 0 beshort 0x20d hp400 (68030) HP-UX binary
|
||
# 0 beshort 0x20e hp400 (68040?) HP-UX binary
|
||
# 0 beshort 0x20b PA-RISC1.0 HP-UX binary
|
||
# 0 beshort 0x210 PA-RISC1.1 HP-UX binary
|
||
# 0 beshort 0x211 PA-RISC1.2 HP-UX binary
|
||
# 0 beshort 0x214 PA-RISC2.0 HP-UX binary
|
||
|
||
#
|
||
# The "misc" stuff needs a byte order; the archives look suspiciously
|
||
# like the old 177545 archives (0xff65 = 0177545).
|
||
#
|
||
#### Old Apollo stuff
|
||
0 beshort 0627 Apollo m68k COFF executable
|
||
>18 beshort ^040000 not stripped
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 0624 apollo a88k COFF executable
|
||
>18 beshort ^040000 not stripped
|
||
>22 beshort >0 - version %ld
|
||
0 long 01203604016 TML 0123 byte-order format
|
||
0 long 01702407010 TML 1032 byte-order format
|
||
0 long 01003405017 TML 2301 byte-order format
|
||
0 long 01602007412 TML 3210 byte-order format
|
||
#### PA-RISC 1.1
|
||
0 belong 0x02100106 PA-RISC1.1 relocatable object
|
||
0 belong 0x02100107 PA-RISC1.1 executable
|
||
>168 belong &0x00000004 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x02100108 PA-RISC1.1 shared executable
|
||
>168 belong&0x4 0x4 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0210010b PA-RISC1.1 demand-load executable
|
||
>168 belong&0x4 0x4 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0210010e PA-RISC1.1 shared library
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0210010d PA-RISC1.1 dynamic load library
|
||
>96 belong >0 - not stripped
|
||
|
||
#### PA-RISC 2.0
|
||
0 belong 0x02140106 PA-RISC2.0 relocatable object
|
||
|
||
0 belong 0x02140107 PA-RISC2.0 executable
|
||
>168 belong &0x00000004 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x02140108 PA-RISC2.0 shared executable
|
||
>168 belong &0x00000004 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0214010b PA-RISC2.0 demand-load executable
|
||
>168 belong &0x00000004 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0214010e PA-RISC2.0 shared library
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x0214010d PA-RISC2.0 dynamic load library
|
||
>96 belong >0 - not stripped
|
||
|
||
#### 800
|
||
0 belong 0x020b0106 PA-RISC1.0 relocatable object
|
||
|
||
0 belong 0x020b0107 PA-RISC1.0 executable
|
||
>168 belong&0x4 0x4 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x020b0108 PA-RISC1.0 shared executable
|
||
>168 belong&0x4 0x4 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x020b010b PA-RISC1.0 demand-load executable
|
||
>168 belong&0x4 0x4 dynamically linked
|
||
>(144) belong 0x054ef630 dynamically linked
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x020b010e PA-RISC1.0 shared library
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x020b010d PA-RISC1.0 dynamic load library
|
||
>96 belong >0 - not stripped
|
||
|
||
0 belong 0x213c6172 archive file
|
||
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
|
||
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
|
||
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
|
||
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
|
||
|
||
#### 500
|
||
0 long 0x02080106 HP s500 relocatable executable
|
||
>16 long >0 - version %ld
|
||
|
||
0 long 0x02080107 HP s500 executable
|
||
>16 long >0 - version %ld
|
||
|
||
0 long 0x02080108 HP s500 pure executable
|
||
>16 long >0 - version %ld
|
||
|
||
#### 200
|
||
0 belong 0x020c0108 HP s200 pure executable
|
||
>4 beshort >0 - version %ld
|
||
>8 belong &0x80000000 save fp regs
|
||
>8 belong &0x40000000 dynamically linked
|
||
>8 belong &0x20000000 debuggable
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020c0107 HP s200 executable
|
||
>4 beshort >0 - version %ld
|
||
>8 belong &0x80000000 save fp regs
|
||
>8 belong &0x40000000 dynamically linked
|
||
>8 belong &0x20000000 debuggable
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020c010b HP s200 demand-load executable
|
||
>4 beshort >0 - version %ld
|
||
>8 belong &0x80000000 save fp regs
|
||
>8 belong &0x40000000 dynamically linked
|
||
>8 belong &0x20000000 debuggable
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020c0106 HP s200 relocatable executable
|
||
>4 beshort >0 - version %ld
|
||
>6 beshort >0 - highwater %d
|
||
>8 belong &0x80000000 save fp regs
|
||
>8 belong &0x20000000 debuggable
|
||
>8 belong &0x10000000 PIC
|
||
|
||
0 belong 0x020a0108 HP s200 (2.x release) pure executable
|
||
>4 beshort >0 - version %ld
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020a0107 HP s200 (2.x release) executable
|
||
>4 beshort >0 - version %ld
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020c010e HP s200 shared library
|
||
>4 beshort >0 - version %ld
|
||
>6 beshort >0 - highwater %d
|
||
>36 belong >0 not stripped
|
||
|
||
0 belong 0x020c010d HP s200 dynamic load library
|
||
>4 beshort >0 - version %ld
|
||
>6 beshort >0 - highwater %d
|
||
>36 belong >0 not stripped
|
||
|
||
#### MISC
|
||
0 long 0x0000ff65 HP old archive
|
||
0 long 0x020aff65 HP s200 old archive
|
||
0 long 0x020cff65 HP s200 old archive
|
||
0 long 0x0208ff65 HP s500 old archive
|
||
|
||
0 long 0x015821a6 HP core file
|
||
|
||
0 long 0x4da7eee8 HP-WINDOWS font
|
||
>8 byte >0 - version %ld
|
||
0 string Bitmapfile HP Bitmapfile
|
||
|
||
0 string IMGfile CIS compimg HP Bitmapfile
|
||
# XXX - see "lif"
|
||
#0 short 0x8000 lif file
|
||
0 long 0x020c010c compiled Lisp
|
||
|
||
0 string msgcat01 HP NLS message catalog,
|
||
>8 long >0 %d messages
|
||
|
||
# Summary: HP-48/49 calculator
|
||
# Created by: phk@data.fls.dk
|
||
# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
|
||
# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
|
||
0 string HPHP HP
|
||
>4 string 48 48 binary
|
||
>4 string 49 49 binary
|
||
>7 byte >64 - Rev %c
|
||
>8 leshort 0x2911 (ADR)
|
||
>8 leshort 0x2933 (REAL)
|
||
>8 leshort 0x2955 (LREAL)
|
||
>8 leshort 0x2977 (COMPLX)
|
||
>8 leshort 0x299d (LCOMPLX)
|
||
>8 leshort 0x29bf (CHAR)
|
||
>8 leshort 0x29e8 (ARRAY)
|
||
>8 leshort 0x2a0a (LNKARRAY)
|
||
>8 leshort 0x2a2c (STRING)
|
||
>8 leshort 0x2a4e (HXS)
|
||
>8 leshort 0x2a74 (LIST)
|
||
>8 leshort 0x2a96 (DIR)
|
||
>8 leshort 0x2ab8 (ALG)
|
||
>8 leshort 0x2ada (UNIT)
|
||
>8 leshort 0x2afc (TAGGED)
|
||
>8 leshort 0x2b1e (GROB)
|
||
>8 leshort 0x2b40 (LIB)
|
||
>8 leshort 0x2b62 (BACKUP)
|
||
>8 leshort 0x2b88 (LIBDATA)
|
||
>8 leshort 0x2d9d (PROG)
|
||
>8 leshort 0x2dcc (CODE)
|
||
>8 leshort 0x2e48 (GNAME)
|
||
>8 leshort 0x2e6d (LNAME)
|
||
>8 leshort 0x2e92 (XLIB)
|
||
|
||
0 string %%HP: HP text
|
||
>6 string T(0) - T(0)
|
||
>6 string T(1) - T(1)
|
||
>6 string T(2) - T(2)
|
||
>6 string T(3) - T(3)
|
||
>10 string A(D) A(D)
|
||
>10 string A(R) A(R)
|
||
>10 string A(G) A(G)
|
||
>14 string F(.) F(.);
|
||
>14 string F(,) F(,);
|
||
|
||
|
||
# Summary: HP-38/39 calculator
|
||
# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
||
0 string HP3
|
||
>3 string 8 HP 38
|
||
>3 string 9 HP 39
|
||
>4 string Bin binary
|
||
>4 string Asc ASCII
|
||
>7 string A (Directory List)
|
||
>7 string B (Zaplet)
|
||
>7 string C (Note)
|
||
>7 string D (Program)
|
||
>7 string E (Variable)
|
||
>7 string F (List)
|
||
>7 string G (Matrix)
|
||
>7 string H (Library)
|
||
>7 string I (Target List)
|
||
>7 string J (ASCII Vector specification)
|
||
>7 string K (wildcard)
|
||
|
||
# Summary: HP-38/39 calculator
|
||
# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
||
0 string HP3
|
||
>3 string 8 HP 38
|
||
>3 string 9 HP 39
|
||
>4 string Bin binary
|
||
>4 string Asc ASCII
|
||
>7 string A (Directory List)
|
||
>7 string B (Zaplet)
|
||
>7 string C (Note)
|
||
>7 string D (Program)
|
||
>7 string E (Variable)
|
||
>7 string F (List)
|
||
>7 string G (Matrix)
|
||
>7 string H (Library)
|
||
>7 string I (Target List)
|
||
>7 string J (ASCII Vector specification)
|
||
>7 string K (wildcard)
|
||
|
||
# hpBSD magic numbers
|
||
0 beshort 200 hp200 (68010) BSD
|
||
>2 beshort 0407 impure binary
|
||
>2 beshort 0410 read-only binary
|
||
>2 beshort 0413 demand paged binary
|
||
0 beshort 300 hp300 (68020+68881) BSD
|
||
>2 beshort 0407 impure binary
|
||
>2 beshort 0410 read-only binary
|
||
>2 beshort 0413 demand paged binary
|
||
#
|
||
# From David Gero <dgero@nortelnetworks.com>
|
||
# HP-UX 10.20 core file format from /usr/include/sys/core.h
|
||
# Unfortunately, HP-UX uses corehead blocks without specifying the order
|
||
# There are four we care about:
|
||
# CORE_KERNEL, which starts with the string "HP-UX"
|
||
# CORE_EXEC, which contains the name of the command
|
||
# CORE_PROC, which contains the signal number that caused the core dump
|
||
# CORE_FORMAT, which contains the version of the core file format (== 1)
|
||
# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
|
||
# but we include all 6 variations of the order of the first 3, and
|
||
# assume that PROC will always be last
|
||
# Order 1: KERNEL, EXEC, FORMAT, PROC
|
||
0x10 string HP-UX
|
||
>0 belong 2
|
||
>>0xC belong 0x3C
|
||
>>>0x4C belong 0x100
|
||
>>>>0x58 belong 0x44
|
||
>>>>>0xA0 belong 1
|
||
>>>>>>0xAC belong 4
|
||
>>>>>>>0xB0 belong 1
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0x90 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
# Order 2: KERNEL, FORMAT, EXEC, PROC
|
||
>>>0x4C belong 1
|
||
>>>>0x58 belong 4
|
||
>>>>>0x5C belong 1
|
||
>>>>>>0x60 belong 0x100
|
||
>>>>>>>0x6C belong 0x44
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0xA4 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
# Order 3: FORMAT, KERNEL, EXEC, PROC
|
||
0x24 string HP-UX
|
||
>0 belong 1
|
||
>>0xC belong 4
|
||
>>>0x10 belong 1
|
||
>>>>0x14 belong 2
|
||
>>>>>0x20 belong 0x3C
|
||
>>>>>>0x60 belong 0x100
|
||
>>>>>>>0x6C belong 0x44
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0xA4 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
# Order 4: EXEC, KERNEL, FORMAT, PROC
|
||
0x64 string HP-UX
|
||
>0 belong 0x100
|
||
>>0xC belong 0x44
|
||
>>>0x54 belong 2
|
||
>>>>0x60 belong 0x3C
|
||
>>>>>0xA0 belong 1
|
||
>>>>>>0xAC belong 4
|
||
>>>>>>>0xB0 belong 1
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0x44 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
# Order 5: FORMAT, EXEC, KERNEL, PROC
|
||
0x78 string HP-UX
|
||
>0 belong 1
|
||
>>0xC belong 4
|
||
>>>0x10 belong 1
|
||
>>>>0x14 belong 0x100
|
||
>>>>>0x20 belong 0x44
|
||
>>>>>>0x68 belong 2
|
||
>>>>>>>0x74 belong 0x3C
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0x58 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
# Order 6: EXEC, FORMAT, KERNEL, PROC
|
||
>0 belong 0x100
|
||
>>0xC belong 0x44
|
||
>>>0x54 belong 1
|
||
>>>>0x60 belong 4
|
||
>>>>>0x64 belong 1
|
||
>>>>>>0x68 belong 2
|
||
>>>>>>>0x74 belong 0x2C
|
||
>>>>>>>>0xB4 belong 4 core file
|
||
>>>>>>>>>0x44 string >\0 from '%s'
|
||
>>>>>>>>>0xC4 belong 3 - received SIGQUIT
|
||
>>>>>>>>>0xC4 belong 4 - received SIGILL
|
||
>>>>>>>>>0xC4 belong 5 - received SIGTRAP
|
||
>>>>>>>>>0xC4 belong 6 - received SIGABRT
|
||
>>>>>>>>>0xC4 belong 7 - received SIGEMT
|
||
>>>>>>>>>0xC4 belong 8 - received SIGFPE
|
||
>>>>>>>>>0xC4 belong 10 - received SIGBUS
|
||
>>>>>>>>>0xC4 belong 11 - received SIGSEGV
|
||
>>>>>>>>>0xC4 belong 12 - received SIGSYS
|
||
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
|
||
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
|
||
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
|
||
# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
|
||
# Magic too short!
|
||
#0 string HU Human68k
|
||
#>68 string LZX LZX compressed
|
||
#>>72 string >\0 (version %s)
|
||
#>(8.L+74) string LZX LZX compressed
|
||
#>>(8.L+78) string >\0 (version %s)
|
||
#>60 belong >0 binded
|
||
#>(8.L+66) string #HUPAIR hupair
|
||
#>0 string HU X executable
|
||
#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
|
||
#>4 belong >0 - base address 0x%x
|
||
#>28 belong >0 not stripped
|
||
#>32 belong >0 with debug information
|
||
#0 beshort 0x601a Human68k Z executable
|
||
#0 beshort 0x6000 Human68k object file
|
||
#0 belong 0xd1000000 Human68k ar binary archive
|
||
#0 belong 0xd1010000 Human68k ar ascii archive
|
||
#0 beshort 0x0068 Human68k lib archive
|
||
#4 string LZX Human68k LZX compressed
|
||
#>8 string >\0 (version %s)
|
||
#>4 string LZX R executable
|
||
#2 string #HUPAIR Human68k hupair R executable
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
|
||
# ibm370: file(1) magic for IBM 370 and compatibles.
|
||
#
|
||
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
|
||
# What the heck *is* "USS/370"?
|
||
# AIX 4.1's "/etc/magic" has
|
||
#
|
||
# 0 short 0535 370 sysV executable
|
||
# >12 long >0 not stripped
|
||
# >22 short >0 - version %d
|
||
# >30 long >0 - 5.2 format
|
||
# 0 short 0530 370 sysV pure executable
|
||
# >12 long >0 not stripped
|
||
# >22 short >0 - version %d
|
||
# >30 long >0 - 5.2 format
|
||
#
|
||
# instead of the "USS/370" versions of the same magic numbers.
|
||
#
|
||
0 beshort 0537 370 XA sysV executable
|
||
>12 belong >0 not stripped
|
||
>22 beshort >0 - version %d
|
||
>30 belong >0 - 5.2 format
|
||
0 beshort 0532 370 XA sysV pure executable
|
||
>12 belong >0 not stripped
|
||
>22 beshort >0 - version %d
|
||
>30 belong >0 - 5.2 format
|
||
0 beshort 054001 370 sysV pure executable
|
||
>12 belong >0 not stripped
|
||
0 beshort 055001 370 XA sysV pure executable
|
||
>12 belong >0 not stripped
|
||
0 beshort 056401 370 sysV executable
|
||
>12 belong >0 not stripped
|
||
0 beshort 057401 370 XA sysV executable
|
||
>12 belong >0 not stripped
|
||
0 beshort 0531 SVR2 executable (Amdahl-UTS)
|
||
>12 belong >0 not stripped
|
||
>24 belong >0 - version %ld
|
||
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
|
||
>12 belong >0 not stripped
|
||
>24 belong >0 - version %ld
|
||
0 beshort 0530 SVR2 pure executable (USS/370)
|
||
>12 belong >0 not stripped
|
||
>24 belong >0 - version %ld
|
||
0 beshort 0535 SVR2 executable (USS/370)
|
||
>12 belong >0 not stripped
|
||
>24 belong >0 - version %ld
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
|
||
# ibm6000: file(1) magic for RS/6000 and the RT PC.
|
||
#
|
||
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
|
||
>12 belong >0 not stripped
|
||
# Breaks sun4 statically linked execs.
|
||
#0 beshort 0x0103 executable (RT Version 2) or obj module
|
||
#>2 byte 0x50 pure
|
||
#>28 belong >0 not stripped
|
||
#>6 beshort >0 - version %ld
|
||
0 beshort 0x0104 shared library
|
||
0 beshort 0x0105 ctab data
|
||
0 beshort 0xfe04 structured file
|
||
0 string 0xabcdef AIX message catalog
|
||
0 belong 0x000001f9 AIX compiled message catalog
|
||
0 string \<aiaff> archive
|
||
0 string \<bigaf> archive (big format)
|
||
|
||
0 beshort 0x01f7 64-bit XCOFF executable or object module
|
||
>20 belong 0 not stripped
|
||
4 belong &0x0feeddb0 AIX core file
|
||
>1 byte &0x01 fulldump
|
||
>7 byte &0x01 32-bit
|
||
>>0x6e0 string >\0 \b, %s
|
||
>7 byte &0x02 64-bit
|
||
>>0x524 string >\0 \b, %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
|
||
# icc: file(1) magic for International Color Consortium file formats
|
||
|
||
#
|
||
# Color profiles as per the ICC's "Image technology colour management -
|
||
# Architecture, profile format, and data structure" specification.
|
||
# See
|
||
#
|
||
# http://www.color.org/specification/ICC1v43_2010-12.pdf
|
||
#
|
||
# for Specification ICC.1:2010 (Profile version 4.3.0.0).
|
||
#
|
||
# Bytes 36 to 39 contain a generic profile file signature of "acsp";
|
||
# bytes 40 to 43 "may be used to identify the primary platform/operating
|
||
# system framework for which the profile was created".
|
||
#
|
||
# There are other fields that might be worth dumping as well.
|
||
#
|
||
|
||
# This appears to be what's used for Apple ColorSync profiles.
|
||
# Instead of adding that, Apple just changed the generic "acsp" entry
|
||
# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
|
||
# Management System, ICC Profile".
|
||
# Yes, it's "APPL", not "AAPL"; see the spec.
|
||
36 string acspAPPL ColorSync ICC Profile
|
||
!:mime application/vnd.iccprofile
|
||
|
||
# Microsoft ICM color profile
|
||
36 string acspMSFT Microsoft ICM Color Profile
|
||
!:mime application/vnd.iccprofile
|
||
|
||
# Yes, that's a blank after "SGI".
|
||
36 string acspSGI\ SGI ICC Profile
|
||
!:mime application/vnd.iccprofile
|
||
|
||
# XXX - is this what's used for the Sun KCMS or not? The standard file
|
||
# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
|
||
# and there *is* an identified "primary platform" value of SUNW.
|
||
36 string acspSUNW Sun KCMS ICC Profile
|
||
!:mime application/vnd.iccprofile
|
||
|
||
# Any other profile.
|
||
# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
|
||
# and use "acsp" for everything else and dump the "primary platform"
|
||
# string in those cases?
|
||
36 string acsp ICC Profile
|
||
!:mime application/vnd.iccprofile
|
||
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
|
||
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
|
||
#
|
||
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
|
||
# Arts for file interchange. It has also been used by Apple, SGI, and
|
||
# especially Commodore-Amiga.
|
||
#
|
||
# IFF files begin with an 8 byte FORM header, followed by a 4 character
|
||
# FORM type, which is followed by the first chunk in the FORM.
|
||
|
||
0 string FORM IFF data
|
||
#>4 belong x \b, FORM is %d bytes long
|
||
# audio formats
|
||
>8 string AIFF \b, AIFF audio
|
||
!:mime audio/x-aiff
|
||
>8 string AIFC \b, AIFF-C compressed audio
|
||
!:mime audio/x-aiff
|
||
>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
|
||
!:mime audio/x-aiff
|
||
>8 string 16SV \b, 16SV 16-bit sampled sound voice
|
||
>8 string SAMP \b, SAMP sampled audio
|
||
>8 string MAUD \b, MAUD MacroSystem audio
|
||
>8 string SMUS \b, SMUS simple music
|
||
>8 string CMUS \b, CMUS complex music
|
||
# image formats
|
||
>8 string ILBMBMHD \b, ILBM interleaved image
|
||
>>20 beshort x \b, %d x
|
||
>>22 beshort x %d
|
||
>8 string RGBN \b, RGBN 12-bit RGB image
|
||
>8 string RGB8 \b, RGB8 24-bit RGB image
|
||
>8 string DEEP \b, DEEP TVPaint/XiPaint image
|
||
>8 string DR2D \b, DR2D 2-D object
|
||
>8 string TDDD \b, TDDD 3-D rendering
|
||
>8 string LWOB \b, LWOB 3-D object
|
||
>8 string LWO2 \b, LWO2 3-D object, v2
|
||
>8 string LWLO \b, LWLO 3-D layered object
|
||
>8 string REAL \b, REAL Real3D rendering
|
||
>8 string MC4D \b, MC4D MaxonCinema4D rendering
|
||
>8 string ANIM \b, ANIM animation
|
||
>8 string YAFA \b, YAFA animation
|
||
>8 string SSA\ \b, SSA super smooth animation
|
||
>8 string ACBM \b, ACBM continuous image
|
||
>8 string FAXX \b, FAXX fax image
|
||
# other formats
|
||
>8 string FTXT \b, FTXT formatted text
|
||
>8 string CTLG \b, CTLG message catalog
|
||
>8 string PREF \b, PREF preferences
|
||
>8 string DTYP \b, DTYP datatype description
|
||
>8 string PTCH \b, PTCH binary patch
|
||
>8 string AMFF \b, AMFF AmigaMetaFile format
|
||
>8 string WZRD \b, WZRD StormWIZARD resource
|
||
>8 string DOC\ \b, DOC desktop publishing document
|
||
>8 string WVQA \b, Westwood Studios VQA Multimedia,
|
||
>>24 leshort x %d video frames,
|
||
>>26 leshort x %d x
|
||
>>28 leshort x %d
|
||
>8 string MOVE \b, Wing Commander III Video
|
||
>>12 string _PC_ \b, PC version
|
||
>>12 string 3DO_ \b, 3DO version
|
||
|
||
# These go at the end of the iff rules
|
||
#
|
||
# I don't see why these might collide with anything else.
|
||
#
|
||
# Interactive Fiction related formats
|
||
#
|
||
>8 string IFRS \b, Blorb Interactive Fiction
|
||
>>24 string Exec with executable chunk
|
||
>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: images,v 1.81 2013/03/09 22:36:00 christos Exp $
|
||
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
|
||
# XPM bitmaps)
|
||
#
|
||
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
|
||
# additions by janl@ifi.uio.no as well as others. Jan also suggested
|
||
# merging several one- and two-line files into here.
|
||
#
|
||
# little magic: PCX (first byte is 0x0a)
|
||
|
||
# Targa - matches `povray', `ppmtotga' and `xv' outputs
|
||
# by Philippe De Muyter <phdm@macqel.be>
|
||
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
|
||
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
|
||
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
|
||
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
|
||
# `tgatoppm' recognizes a superset (Index may be anything)
|
||
1 belong&0xfff7ffff 0x01010000 Targa image data - Map
|
||
>2 byte&8 8 - RLE
|
||
>12 leshort >0 %hd x
|
||
>14 leshort >0 %hd
|
||
1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
|
||
>2 byte&8 8 - RLE
|
||
>12 leshort >0 %hd x
|
||
>14 leshort >0 %hd
|
||
1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
|
||
>2 byte&8 8 - RLE
|
||
>12 leshort >0 %hd x
|
||
>14 leshort >0 %hd
|
||
|
||
# PBMPLUS images
|
||
# The next byte following the magic is always whitespace.
|
||
# strength is changed to try these patterns before "x86 boot sector"
|
||
0 search/1 P1
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PBM image text
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-bitmap
|
||
0 search/1 P2
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PGM image text
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-greymap
|
||
0 search/1 P3 Netpbm PPM image text
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PPM image text
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-pixmap
|
||
0 string P4
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-bitmap
|
||
0 string P5
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-greymap
|
||
0 string P6
|
||
>3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data
|
||
>3 regex =[0-9]+\ \b, size = %sx
|
||
>>3 regex =\ [0-9]+ \b%s
|
||
!:strength + 45
|
||
!:mime image/x-portable-pixmap
|
||
0 string P7 Netpbm PAM image file
|
||
!:mime image/x-portable-pixmap
|
||
|
||
# From: bryanh@giraffe-data.com (Bryan Henderson)
|
||
0 string \117\072 Solitaire Image Recorder format
|
||
>4 string \013 MGI Type 11
|
||
>4 string \021 MGI Type 17
|
||
0 string .MDA MicroDesign data
|
||
>21 byte 48 version 2
|
||
>21 byte 51 version 3
|
||
0 string .MDP MicroDesign page data
|
||
>21 byte 48 version 2
|
||
>21 byte 51 version 3
|
||
|
||
# NIFF (Navy Interchange File Format, a modification of TIFF) images
|
||
# [GRR: this *must* go before TIFF]
|
||
0 string IIN1 NIFF image data
|
||
!:mime image/x-niff
|
||
|
||
# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
|
||
# (CIFF) file. These are apparently all little-endian.
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
|
||
0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data
|
||
!:mime image/x-canon-crw
|
||
>16 leshort x \b, version %d.
|
||
>14 leshort x \b%d
|
||
|
||
# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
|
||
# number. Put this above the TIFF test to make sure we detect them.
|
||
# These are apparently all little-endian.
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
|
||
0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data
|
||
!:mime image/x-canon-cr2
|
||
>10 byte x \b, version %d.
|
||
>11 byte x \b%d
|
||
|
||
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
# The second word of TIFF files is the TIFF version number, 42, which has
|
||
# never changed. The TIFF specification recommends testing for it.
|
||
0 string MM\x00\x2a TIFF image data, big-endian
|
||
!:mime image/tiff
|
||
0 string II\x2a\x00 TIFF image data, little-endian
|
||
!:mime image/tiff
|
||
|
||
0 string MM\x00\x2b Big TIFF image data, big-endian
|
||
!:mime image/tiff
|
||
0 string II\x2b\x00 Big TIFF image data, little-endian
|
||
!:mime image/tiff
|
||
|
||
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
|
||
# (Greg Roelofs, newt@uchicago.edu)
|
||
# (Albert Cahalan, acahalan@cs.uml.edu)
|
||
#
|
||
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
|
||
#
|
||
0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
|
||
!:mime image/png
|
||
>16 belong x \b, %ld x
|
||
>20 belong x %ld,
|
||
>24 byte x %d-bit
|
||
>25 byte 0 grayscale,
|
||
>25 byte 2 \b/color RGB,
|
||
>25 byte 3 colormap,
|
||
>25 byte 4 gray+alpha,
|
||
>25 byte 6 \b/color RGBA,
|
||
#>26 byte 0 deflate/32K,
|
||
>28 byte 0 non-interlaced
|
||
>28 byte 1 interlaced
|
||
|
||
# possible GIF replacements; none yet released!
|
||
# (Greg Roelofs, newt@uchicago.edu)
|
||
#
|
||
# GRR 950115: this was mine ("Zip GIF"):
|
||
0 string GIF94z ZIF image (GIF+deflate alpha)
|
||
!:mime image/x-unknown
|
||
#
|
||
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
|
||
#
|
||
0 string FGF95a FGF image (GIF+deflate beta)
|
||
!:mime image/x-unknown
|
||
#
|
||
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
|
||
# (best; not yet implemented):
|
||
#
|
||
0 string PBF PBF image (deflate compression)
|
||
!:mime image/x-unknown
|
||
|
||
# GIF
|
||
0 string GIF8 GIF image data
|
||
!:mime image/gif
|
||
!:apple 8BIMGIFf
|
||
>4 string 7a \b, version 8%s,
|
||
>4 string 9a \b, version 8%s,
|
||
>6 leshort >0 %hd x
|
||
>8 leshort >0 %hd
|
||
#>10 byte &0x80 color mapped,
|
||
#>10 byte&0x07 =0x00 2 colors
|
||
#>10 byte&0x07 =0x01 4 colors
|
||
#>10 byte&0x07 =0x02 8 colors
|
||
#>10 byte&0x07 =0x03 16 colors
|
||
#>10 byte&0x07 =0x04 32 colors
|
||
#>10 byte&0x07 =0x05 64 colors
|
||
#>10 byte&0x07 =0x06 128 colors
|
||
#>10 byte&0x07 =0x07 256 colors
|
||
|
||
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
|
||
# 1 plane, no encoding.
|
||
0 string \361\0\100\273 CMU window manager raster image data
|
||
>4 lelong >0 %d x
|
||
>8 lelong >0 %d,
|
||
>12 lelong >0 %d-bit
|
||
|
||
# Magick Image File Format
|
||
0 string id=ImageMagick MIFF image data
|
||
|
||
# Artisan
|
||
0 long 1123028772 Artisan image data
|
||
>4 long 1 \b, rectangular 24-bit
|
||
>4 long 2 \b, rectangular 8-bit with colormap
|
||
>4 long 3 \b, rectangular 32-bit (24-bit with matte)
|
||
|
||
# FIG (Facility for Interactive Generation of figures), an object-based format
|
||
0 search/1 #FIG FIG image text
|
||
>5 string x \b, version %.3s
|
||
|
||
# PHIGS
|
||
0 string ARF_BEGARF PHIGS clear text archive
|
||
0 string @(#)SunPHIGS SunPHIGS
|
||
# version number follows, in the form m.n
|
||
>40 string SunBin binary
|
||
>32 string archive archive
|
||
|
||
# GKS (Graphics Kernel System)
|
||
0 string GKSM GKS Metafile
|
||
>24 string SunGKS \b, SunGKS
|
||
|
||
# CGM image files
|
||
0 string BEGMF clear text Computer Graphics Metafile
|
||
|
||
# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
|
||
0 string yz MGR bitmap, modern format, 8-bit aligned
|
||
0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
|
||
0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
|
||
0 string yx MGR bitmap, modern format, squeezed
|
||
|
||
# Fuzzy Bitmap (FBM) images
|
||
0 string %bitmap\0 FBM image data
|
||
>30 long 0x31 \b, mono
|
||
>30 long 0x33 \b, color
|
||
|
||
# facsimile data
|
||
1 string PC\ Research,\ Inc group 3 fax data
|
||
>29 byte 0 \b, normal resolution (204x98 DPI)
|
||
>29 byte 1 \b, fine resolution (204x196 DPI)
|
||
# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
|
||
0 string Sfff structured fax file
|
||
|
||
# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
|
||
# most files with the extension .EPA and some with .BMP
|
||
0 string \x11\x06 Award BIOS Logo, 136 x 84
|
||
!:mime image/x-award-bioslogo
|
||
0 string \x11\x09 Award BIOS Logo, 136 x 126
|
||
!:mime image/x-award-bioslogo
|
||
#0 string \x07\x1f BIOS Logo corrupted?
|
||
# http://www.blackfiveservices.co.uk/awbmtools.shtml
|
||
# http://biosgfx.narod.ru/v3/
|
||
# http://biosgfx.narod.ru/abr-2/
|
||
0 string AWBM
|
||
>4 leshort <1981 Award BIOS bitmap
|
||
!:mime image/x-award-bmp
|
||
# image width is a multiple of 4
|
||
>>4 leshort&0x0003 0
|
||
>>>4 leshort x \b, %d
|
||
>>>6 leshort x x %d
|
||
>>4 leshort&0x0003 >0 \b,
|
||
>>>4 leshort&0x0003 =1
|
||
>>>>4 leshort x %d+3
|
||
>>>4 leshort&0x0003 =2
|
||
>>>>4 leshort x %d+2
|
||
>>>4 leshort&0x0003 =3
|
||
>>>>4 leshort x %d+1
|
||
>>>6 leshort x x %d
|
||
# at offset 8 starts imagedata followed by "RGB " marker
|
||
|
||
# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
|
||
0 string BM
|
||
>14 leshort 12 PC bitmap, OS/2 1.x format
|
||
!:mime image/x-ms-bmp
|
||
>>18 leshort x \b, %d x
|
||
>>20 leshort x %d
|
||
>14 leshort 64 PC bitmap, OS/2 2.x format
|
||
!:mime image/x-ms-bmp
|
||
>>18 leshort x \b, %d x
|
||
>>20 leshort x %d
|
||
>14 leshort 40 PC bitmap, Windows 3.x format
|
||
!:mime image/x-ms-bmp
|
||
>>18 lelong x \b, %d x
|
||
>>22 lelong x %d x
|
||
>>28 leshort x %d
|
||
>14 leshort 128 PC bitmap, Windows NT/2000 format
|
||
!:mime image/x-ms-bmp
|
||
>>18 lelong x \b, %d x
|
||
>>22 lelong x %d x
|
||
>>28 leshort x %d
|
||
# Too simple - MPi
|
||
#0 string IC PC icon data
|
||
#0 string PI PC pointer image data
|
||
#0 string CI PC color icon data
|
||
#0 string CP PC color pointer image data
|
||
# Conflicts with other entries [BABYL]
|
||
#0 string BA PC bitmap array data
|
||
|
||
# XPM icons (Greg Roelofs, newt@uchicago.edu)
|
||
0 search/1 /*\ XPM\ */ X pixmap image text
|
||
!:mime image/x-xpmi
|
||
|
||
# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
|
||
0 leshort 0xcc52 RLE image data,
|
||
>6 leshort x %d x
|
||
>8 leshort x %d
|
||
>2 leshort >0 \b, lower left corner: %d
|
||
>4 leshort >0 \b, lower right corner: %d
|
||
>10 byte&0x1 =0x1 \b, clear first
|
||
>10 byte&0x2 =0x2 \b, no background
|
||
>10 byte&0x4 =0x4 \b, alpha channel
|
||
>10 byte&0x8 =0x8 \b, comment
|
||
>11 byte >0 \b, %d color channels
|
||
>12 byte >0 \b, %d bits per pixel
|
||
>13 byte >0 \b, %d color map channels
|
||
|
||
# image file format (Robert Potter, potter@cs.rochester.edu)
|
||
0 string Imagefile\ version- iff image data
|
||
# this adds the whole header (inc. version number), informative but longish
|
||
>10 string >\0 %s
|
||
|
||
# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 belong 0x59a66a95 Sun raster image data
|
||
>4 belong >0 \b, %d x
|
||
>8 belong >0 %d,
|
||
>12 belong >0 %d-bit,
|
||
#>16 belong >0 %d bytes long,
|
||
>20 belong 0 old format,
|
||
#>20 belong 1 standard,
|
||
>20 belong 2 compressed,
|
||
>20 belong 3 RGB,
|
||
>20 belong 4 TIFF,
|
||
>20 belong 5 IFF,
|
||
>20 belong 0xffff reserved for testing,
|
||
>24 belong 0 no colormap
|
||
>24 belong 1 RGB colormap
|
||
>24 belong 2 raw colormap
|
||
#>28 belong >0 colormap is %d bytes long
|
||
|
||
# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
#
|
||
# See
|
||
# http://reality.sgi.com/grafica/sgiimage.html
|
||
#
|
||
0 beshort 474 SGI image data
|
||
#>2 byte 0 \b, verbatim
|
||
>2 byte 1 \b, RLE
|
||
#>3 byte 1 \b, normal precision
|
||
>3 byte 2 \b, high precision
|
||
>4 beshort x \b, %d-D
|
||
>6 beshort x \b, %d x
|
||
>8 beshort x %d
|
||
>10 beshort x \b, %d channel
|
||
>10 beshort !1 \bs
|
||
>80 string >0 \b, "%s"
|
||
|
||
0 string IT01 FIT image data
|
||
>4 belong x \b, %d x
|
||
>8 belong x %d x
|
||
>12 belong x %d
|
||
#
|
||
0 string IT02 FIT image data
|
||
>4 belong x \b, %d x
|
||
>8 belong x %d x
|
||
>12 belong x %d
|
||
#
|
||
2048 string PCD_IPI Kodak Photo CD image pack file
|
||
>0xe02 byte&0x03 0x00 , landscape mode
|
||
>0xe02 byte&0x03 0x01 , portrait mode
|
||
>0xe02 byte&0x03 0x02 , landscape mode
|
||
>0xe02 byte&0x03 0x03 , portrait mode
|
||
0 string PCD_OPA Kodak Photo CD overview pack file
|
||
|
||
# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
|
||
# FITS is the Flexible Image Transport System, the de facto standard for
|
||
# data and image transfer, storage, etc., for the astronomical community.
|
||
# (FITS floating point formats are big-endian.)
|
||
0 string SIMPLE\ \ = FITS image data
|
||
>109 string 8 \b, 8-bit, character or unsigned binary integer
|
||
>108 string 16 \b, 16-bit, two's complement binary integer
|
||
>107 string \ 32 \b, 32-bit, two's complement binary integer
|
||
>107 string -32 \b, 32-bit, floating point, single precision
|
||
>107 string -64 \b, 64-bit, floating point, double precision
|
||
|
||
# other images
|
||
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
|
||
|
||
# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
|
||
# stuff.
|
||
#
|
||
0 beshort 0x1010 PEX Binary Archive
|
||
|
||
# DICOM medical imaging data
|
||
128 string DICM DICOM medical imaging data
|
||
!:mime application/dicom
|
||
|
||
# XWD - X Window Dump file.
|
||
# As described in /usr/X11R6/include/X11/XWDFile.h
|
||
# used by the xwd program.
|
||
# Bradford Castalia, idaeim, 1/01
|
||
# updated by Adam Buchbinder, 2/09
|
||
# The following assumes version 7 of the format; the first long is the length
|
||
# of the header, which is at least 25 4-byte longs, and the one at offset 8
|
||
# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
|
||
# which is a maximum of 32.
|
||
0 belong >100
|
||
>8 belong <3
|
||
>>12 belong <33
|
||
>>>4 belong 7 XWD X Window Dump image data
|
||
!:mime image/x-xwindowdump
|
||
>>>>100 string >\0 \b, "%s"
|
||
>>>>16 belong x \b, %dx
|
||
>>>>20 belong x \b%dx
|
||
>>>>12 belong x \b%d
|
||
|
||
# PDS - Planetary Data System
|
||
# These files use Parameter Value Language in the header section.
|
||
# Unfortunately, there is no certain magic, but the following
|
||
# strings have been found to be most likely.
|
||
0 string NJPL1I00 PDS (JPL) image data
|
||
2 string NJPL1I PDS (JPL) image data
|
||
0 string CCSD3ZF PDS (CCSD) image data
|
||
2 string CCSD3Z PDS (CCSD) image data
|
||
0 string PDS_ PDS image data
|
||
0 string LBLSIZE= PDS (VICAR) image data
|
||
|
||
# pM8x: ATARI STAD compressed bitmap format
|
||
#
|
||
# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
|
||
# p M 8 5/6 xx yy zz data...
|
||
# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
|
||
# bytes either run horizontally (pM85) or vertically (pM86). yy is the
|
||
# most frequent byte, xx and zz are runlength escape codes, where xx is
|
||
# used for runs of yy.
|
||
#
|
||
0 string pM85 Atari ST STAD bitmap image data (hor)
|
||
>5 byte 0x00 (white background)
|
||
>5 byte 0xFF (black background)
|
||
0 string pM86 Atari ST STAD bitmap image data (vert)
|
||
>5 byte 0x00 (white background)
|
||
>5 byte 0xFF (black background)
|
||
|
||
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
|
||
# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
|
||
0 leshort 0x0296 Atari ATR image
|
||
|
||
# XXX:
|
||
# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
|
||
# magic.
|
||
# SGI RICE image file <mpruett@sgi.com>
|
||
#0 beshort 0x5249 RICE image
|
||
#>2 beshort x v%d
|
||
#>4 beshort x (%d x
|
||
#>6 beshort x %d)
|
||
#>8 beshort 0 8 bit
|
||
#>8 beshort 1 10 bit
|
||
#>8 beshort 2 12 bit
|
||
#>8 beshort 3 13 bit
|
||
#>10 beshort 0 4:2:2
|
||
#>10 beshort 1 4:2:2:4
|
||
#>10 beshort 2 4:4:4
|
||
#>10 beshort 3 4:4:4:4
|
||
#>12 beshort 1 RGB
|
||
#>12 beshort 2 CCIR601
|
||
#>12 beshort 3 RP175
|
||
#>12 beshort 4 YUV
|
||
|
||
# PCX image files
|
||
# From: Dan Fandrich <dan@coneharvesters.com>
|
||
# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
|
||
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
|
||
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
|
||
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
|
||
0 ubelong&0xffF8fe00 0x0a000000
|
||
# for PCX bit depth > 0
|
||
>3 ubyte >0
|
||
# test for valid versions
|
||
>>1 ubyte <6
|
||
>>>1 ubyte !1 PCX
|
||
!:mime image/x-pcx
|
||
#!:mime image/pcx
|
||
>>>>1 ubyte 0 ver. 2.5 image data
|
||
>>>>1 ubyte 2 ver. 2.8 image data, with palette
|
||
>>>>1 ubyte 3 ver. 2.8 image data, without palette
|
||
>>>>1 ubyte 4 for Windows image data
|
||
>>>>1 ubyte 5 ver. 3.0 image data
|
||
>>>>4 uleshort x bounding box [%hd,
|
||
>>>>6 uleshort x %d] -
|
||
>>>>8 uleshort x [%d,
|
||
>>>>10 uleshort x %d],
|
||
>>>>65 ubyte >1 %d planes each of
|
||
>>>>3 ubyte x %d-bit
|
||
>>>>68 byte 1 colour,
|
||
>>>>68 byte 2 grayscale,
|
||
# this should not happen
|
||
>>>>68 default x image,
|
||
>>>>12 leshort >0 %d x
|
||
>>>>>14 uleshort x %d dpi,
|
||
>>>>2 byte 0 uncompressed
|
||
>>>>2 byte 1 RLE compressed
|
||
|
||
# Adobe Photoshop
|
||
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
|
||
0 string 8BPS Adobe Photoshop Image
|
||
!:mime image/vnd.adobe.photoshop
|
||
>4 beshort 2 (PSB)
|
||
>18 belong x \b, %d x
|
||
>14 belong x %d,
|
||
>24 beshort 0 bitmap
|
||
>24 beshort 1 grayscale
|
||
>>12 beshort 2 with alpha
|
||
>24 beshort 2 indexed
|
||
>24 beshort 3 RGB
|
||
>>12 beshort 4 \bA
|
||
>24 beshort 4 CMYK
|
||
>>12 beshort 5 \bA
|
||
>24 beshort 7 multichannel
|
||
>24 beshort 8 duotone
|
||
>24 beshort 9 lab
|
||
>12 beshort > 1
|
||
>>12 beshort x \b, %dx
|
||
>12 beshort 1 \b,
|
||
>22 beshort x %d-bit channel
|
||
>12 beshort > 1 \bs
|
||
|
||
# XV thumbnail indicator (ThMO)
|
||
0 string P7\ 332 XV thumbnail image data
|
||
|
||
# NITF is defined by United States MIL-STD-2500A
|
||
0 string NITF National Imagery Transmission Format
|
||
>25 string >\0 dated %.14s
|
||
|
||
# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
|
||
0 belong 0x00010008 GEM Image data
|
||
>12 beshort x %d x
|
||
>14 beshort x %d,
|
||
>4 beshort x %d planes,
|
||
>8 beshort x %d x
|
||
>10 beshort x %d pixelsize
|
||
|
||
# GEM Metafile (Wolfram Kleff)
|
||
0 lelong 0x0018FFFF GEM Metafile data
|
||
>4 leshort x version %d
|
||
|
||
#
|
||
# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
|
||
# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
|
||
#
|
||
0 string \0\nSMJPEG SMJPEG
|
||
>8 belong x %d.x data
|
||
# According to the specification you could find any number of _TXT
|
||
# headers here, but I can't think of any way of handling that. None of
|
||
# the SMJPEG files I tried it on used this feature. Even if such a
|
||
# file is encountered the output should still be reasonable.
|
||
>16 string _SND \b,
|
||
>>24 beshort >0 %d Hz
|
||
>>26 byte 8 8-bit
|
||
>>26 byte 16 16-bit
|
||
>>28 string NONE uncompressed
|
||
# >>28 string APCM ADPCM compressed
|
||
>>27 byte 1 mono
|
||
>>28 byte 2 stereo
|
||
# Help! Isn't there any way to avoid writing this part twice?
|
||
>>32 string _VID \b,
|
||
# >>>48 string JFIF JPEG
|
||
>>>40 belong >0 %d frames
|
||
>>>44 beshort >0 (%d x
|
||
>>>46 beshort >0 %d)
|
||
>16 string _VID \b,
|
||
# >>32 string JFIF JPEG
|
||
>>24 belong >0 %d frames
|
||
>>28 beshort >0 (%d x
|
||
>>30 beshort >0 %d)
|
||
|
||
0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
|
||
|
||
# "thumbnail file" (icon)
|
||
# descended from "xv", but in use by other applications as well (Wolfram Kleff)
|
||
0 string P7\ 332 XV "thumbnail file" (icon) data
|
||
|
||
# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
|
||
0 string KiSS KISS/GS
|
||
>4 byte 16 color
|
||
>>5 byte x %d bit
|
||
>>8 leshort x %d colors
|
||
>>10 leshort x %d groups
|
||
>4 byte 32 cell
|
||
>>5 byte x %d bit
|
||
>>8 leshort x %d x
|
||
>>10 leshort x %d
|
||
>>12 leshort x +%d
|
||
>>14 leshort x +%d
|
||
|
||
# Webshots (www.webshots.com), by John Harrison
|
||
0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
|
||
|
||
# Hercules DASD image files
|
||
# From Jan Jaeger <jj@septa.nl>
|
||
0 string CKD_P370 Hercules CKD DASD image file
|
||
>8 long x \b, %d heads per cylinder
|
||
>12 long x \b, track size %d bytes
|
||
>16 byte x \b, device type 33%2.2X
|
||
|
||
0 string CKD_C370 Hercules compressed CKD DASD image file
|
||
>8 long x \b, %d heads per cylinder
|
||
>12 long x \b, track size %d bytes
|
||
>16 byte x \b, device type 33%2.2X
|
||
|
||
0 string CKD_S370 Hercules CKD DASD shadow file
|
||
>8 long x \b, %d heads per cylinder
|
||
>12 long x \b, track size %d bytes
|
||
>16 byte x \b, device type 33%2.2X
|
||
|
||
# Squeak images and programs - etoffi@softhome.net
|
||
0 string \146\031\0\0 Squeak image data
|
||
0 search/1 'From\040Squeak Squeak program text
|
||
|
||
# partimage: file(1) magic for PartImage files (experimental, incomplete)
|
||
# Author: Hans-Joachim Baader <hjb@pro-linux.de>
|
||
0 string PaRtImAgE-VoLuMe PartImage
|
||
>0x0020 string 0.6.1 file version %s
|
||
>>0x0060 lelong >-1 volume %ld
|
||
#>>0x0064 8 byte identifier
|
||
#>>0x007c reserved
|
||
>>0x0200 string >\0 type %s
|
||
>>0x1400 string >\0 device %s,
|
||
>>0x1600 string >\0 original filename %s,
|
||
# Some fields omitted
|
||
>>0x2744 lelong 0 not compressed
|
||
>>0x2744 lelong 1 gzip compressed
|
||
>>0x2744 lelong 2 bzip2 compressed
|
||
>>0x2744 lelong >2 compressed with unknown algorithm
|
||
>0x0020 string >0.6.1 file version %s
|
||
>0x0020 string <0.6.1 file version %s
|
||
|
||
# DCX is multi-page PCX, using a simple header of up to 1024
|
||
# offsets for the respective PCX components.
|
||
# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
|
||
0 lelong 987654321 DCX multi-page PCX image data
|
||
|
||
# Simon Walton <simonw@matteworld.com>
|
||
# Kodak Cineon format for scanned negatives
|
||
# http://www.kodak.com/US/en/motion/support/dlad/
|
||
0 lelong 0xd75f2a80 Cineon image data
|
||
>200 belong >0 \b, %ld x
|
||
>204 belong >0 %ld
|
||
|
||
|
||
# Bio-Rad .PIC is an image format used by microscope control systems
|
||
# and related image processing software used by biologists.
|
||
# From: Vebjorn Ljosa <vebjorn@ljosa.com>
|
||
# BOOL values are two-byte integers; use them to rule out false positives.
|
||
# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
|
||
# Samples: http://www.loci.wisc.edu/software/sample-data
|
||
14 leshort <2
|
||
>62 leshort <2
|
||
>>54 leshort 12345 Bio-Rad .PIC Image File
|
||
>>>0 leshort >0 %hd x
|
||
>>>2 leshort >0 %hd,
|
||
>>>4 leshort =1 1 image in file
|
||
>>>4 leshort >1 %hd images in file
|
||
|
||
# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
|
||
# The description of *.mrw format can be found at
|
||
# http://www.dalibor.cz/minolta/raw_file_format.htm
|
||
0 string \000MRM Minolta Dimage camera raw image data
|
||
|
||
# Summary: DjVu image / document
|
||
# Extension: .djvu
|
||
# Reference: http://djvu.org/docs/DjVu3Spec.djvu
|
||
# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
|
||
# Modified by (1): Abel Cheung <abelcheung@gmail.com>
|
||
0 string AT&TFORM
|
||
>12 string DJVM DjVu multiple page document
|
||
!:mime image/vnd.djvu
|
||
>12 string DJVU DjVu image or single page document
|
||
!:mime image/vnd.djvu
|
||
>12 string DJVI DjVu shared document
|
||
!:mime image/vnd.djvu
|
||
>12 string THUM DjVu page thumbnails
|
||
!:mime image/vnd.djvu
|
||
|
||
# Originally by Marc Espie
|
||
# Modified by Robert Minsk <robertminsk at yahoo.com>
|
||
# http://www.openexr.com/openexrfilelayout.pdf
|
||
0 lelong 20000630 OpenEXR image data,
|
||
!:mime image/x-exr
|
||
>4 lelong&0x000000ff x version %d,
|
||
>4 lelong ^0x00000200 storage: scanline
|
||
>4 lelong &0x00000200 storage: tiled
|
||
>8 search/0x1000 compression\0 \b, compression:
|
||
>>&16 byte 0 none
|
||
>>&16 byte 1 rle
|
||
>>&16 byte 2 zips
|
||
>>&16 byte 3 zip
|
||
>>&16 byte 4 piz
|
||
>>&16 byte 5 pxr24
|
||
>>&16 byte 6 b44
|
||
>>&16 byte 7 b44a
|
||
>>&16 byte >7 unknown
|
||
>8 search/0x1000 dataWindow\0 \b, dataWindow:
|
||
>>&10 lelong x (%d
|
||
>>&14 lelong x %d)-
|
||
>>&18 lelong x \b(%d
|
||
>>&22 lelong x %d)
|
||
>8 search/0x1000 displayWindow\0 \b, displayWindow:
|
||
>>&10 lelong x (%d
|
||
>>&14 lelong x %d)-
|
||
>>&18 lelong x \b(%d
|
||
>>&22 lelong x %d)
|
||
>8 search/0x1000 lineOrder\0 \b, lineOrder:
|
||
>>&14 byte 0 increasing y
|
||
>>&14 byte 1 decreasing y
|
||
>>&14 byte 2 random y
|
||
>>&14 byte >2 unknown
|
||
|
||
# SMPTE Digital Picture Exchange Format, SMPTE DPX
|
||
#
|
||
# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
|
||
# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
|
||
# Robert Minsk <robertminsk at yahoo.com>
|
||
0 string SDPX DPX image data, big-endian,
|
||
!:mime image/x-dpx
|
||
>768 beshort <4
|
||
>>772 belong x %dx
|
||
>>776 belong x \b%d,
|
||
>768 beshort >3
|
||
>>776 belong x %dx
|
||
>>772 belong x \b%d,
|
||
>768 beshort 0 left to right/top to bottom
|
||
>768 beshort 1 right to left/top to bottom
|
||
>768 beshort 2 left to right/bottom to top
|
||
>768 beshort 3 right to left/bottom to top
|
||
>768 beshort 4 top to bottom/left to right
|
||
>768 beshort 5 top to bottom/right to left
|
||
>768 leshort 6 bottom to top/left to right
|
||
>768 leshort 7 bottom to top/right to left
|
||
|
||
# From: Tom Hilinski <tom.hilinski@comcast.net>
|
||
# http://www.unidata.ucar.edu/packages/netcdf/
|
||
0 string CDF\001 NetCDF Data Format data
|
||
|
||
#-----------------------------------------------------------------------
|
||
# Hierarchical Data Format, used to facilitate scientific data exchange
|
||
# specifications at http://hdf.ncsa.uiuc.edu/
|
||
0 belong 0x0e031301 Hierarchical Data Format (version 4) data
|
||
!:mime application/x-hdf
|
||
0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data
|
||
!:mime application/x-hdf
|
||
|
||
# From: Tobias Burnus <burnus@net-b.de>
|
||
# Xara (for a while: Corel Xara) is a graphic package, see
|
||
# http://www.xara.com/ for Windows and as GPL application for Linux
|
||
0 string XARA\243\243 Xara graphics file
|
||
|
||
# http://www.cartesianinc.com/Tech/
|
||
0 string CPC\262 Cartesian Perceptual Compression image
|
||
!:mime image/x-cpi
|
||
|
||
# From Albert Cahalan <acahalan@gmail.com>
|
||
# puredigital used it for the CVS disposable camcorder
|
||
#8 lelong 4 ZBM bitmap image data
|
||
#>4 leshort x %u x
|
||
#>6 leshort x %u
|
||
|
||
# From Albert Cahalan <acahalan@gmail.com>
|
||
# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
|
||
0 string C565 OLPC firmware icon image data
|
||
>4 leshort x %u x
|
||
>6 leshort x %u
|
||
|
||
# Applied Images - Image files from Cytovision
|
||
# Gustavo Junior Alves <gjalves@gjalves.com.br>
|
||
0 string \xce\xda\xde\xfa Cytovision Metaphases file
|
||
0 string \xed\xad\xef\xac Cytovision Karyotype file
|
||
0 string \x0b\x00\x03\x00 Cytovision FISH Probe file
|
||
0 string \xed\xfe\xda\xbe Cytovision FLEX file
|
||
0 string \xed\xab\xed\xfe Cytovision FLEX file
|
||
0 string \xad\xfd\xea\xad Cytovision RATS file
|
||
|
||
# Wavelet Scalar Quantization format used in gray-scale fingerprint images
|
||
# From Tano M Fotang <mfotang@quanteq.com>
|
||
0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data
|
||
|
||
# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
|
||
# From: Markus Heidelberg <markus.heidelberg at web.de>
|
||
0 string/t [BitmapInfo2] Polar Monitor Bitmap text
|
||
!:mime image/x-polar-monitor-bitmap
|
||
|
||
# From: Rick Richardson <rick.richardson@comcast.net>
|
||
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
|
||
|
||
# Type: Ulead Photo Explorer5 (.pe5)
|
||
# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
|
||
# From: Simon Horman <horms@debian.org>
|
||
0 string IIO2H Ulead Photo Explorer5
|
||
|
||
# Type: X11 cursor
|
||
# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
|
||
# From: Mathias Brodala <info@noctus.net>
|
||
0 string Xcur X11 cursor
|
||
|
||
# Type: Olympus ORF raw images.
|
||
# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0 string MMOR Olympus ORF raw image data, big-endian
|
||
!:mime image/x-olympus-orf
|
||
0 string IIRO Olympus ORF raw image data, little-endian
|
||
!:mime image/x-olympus-orf
|
||
0 string IIRS Olympus ORF raw image data, little-endian
|
||
!:mime image/x-olympus-orf
|
||
|
||
# Type: files used in modern AVCHD camcoders to store clip information
|
||
# Extension: .cpi
|
||
# From: Alexander Danilov <alexander.a.danilov@gmail.com>
|
||
0 string HDMV0100 AVCHD Clip Information
|
||
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
|
||
# Radiance HDR; usually has .pic or .hdr extension.
|
||
0 string #?RADIANCE\n Radiance HDR image data
|
||
#!mime image/vnd.radiance
|
||
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
|
||
# Used by the pfstools packages. The regex matches for the image size could
|
||
# probably use some work. The MIME type is made up; if there's one in
|
||
# actual common use, it should replace the one below.
|
||
0 string PFS1\x0a PFS HDR image data
|
||
#!mime image/x-pfs
|
||
>1 regex [0-9]*\ \b, %s
|
||
>>1 regex \ [0-9]{4} \bx%s
|
||
|
||
# Type: Foveon X3F
|
||
# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# Note that the MIME type isn't defined anywhere that I can find; if
|
||
# there's a canonical type for this format, it should replace this one.
|
||
0 string FOVb Foveon X3F raw image data
|
||
!:mime image/x-x3f
|
||
>6 leshort x \b, version %d.
|
||
>4 leshort x \b%d
|
||
>28 lelong x \b, %dx
|
||
>32 lelong x \b%d
|
||
|
||
# Paint.NET file
|
||
# From Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0 string PDN3 Paint.NET image data
|
||
!:mime image/x-paintnet
|
||
|
||
# Not really an image.
|
||
# From: "Tano M. Fotang" <mfotang@quanteq.com>
|
||
0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
|
||
# inform: file(1) magic for Inform interactive fiction language
|
||
|
||
# URL: http://www.inform-fiction.org/
|
||
# From: Reuben Thomas <rrt@sc3d.org>
|
||
|
||
0 search/100/cW constant\ story Inform source text
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
|
||
# intel: file(1) magic for x86 Unix
|
||
#
|
||
# Various flavors of x86 UNIX executable/object (other than Xenix, which
|
||
# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
|
||
# Windows as well.
|
||
#
|
||
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
|
||
# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
|
||
# as well, if, as, and when IBM makes it portable.
|
||
#
|
||
# The `versions' should be un-commented if they work for you.
|
||
# (Was the problem just one of endianness?)
|
||
#
|
||
0 leshort 0502 basic-16 executable
|
||
>12 lelong >0 not stripped
|
||
#>22 leshort >0 - version %ld
|
||
0 leshort 0503 basic-16 executable (TV)
|
||
>12 lelong >0 not stripped
|
||
#>22 leshort >0 - version %ld
|
||
0 leshort 0510 x86 executable
|
||
>12 lelong >0 not stripped
|
||
0 leshort 0511 x86 executable (TV)
|
||
>12 lelong >0 not stripped
|
||
0 leshort =0512 iAPX 286 executable small model (COFF)
|
||
>12 lelong >0 not stripped
|
||
#>22 leshort >0 - version %ld
|
||
0 leshort =0522 iAPX 286 executable large model (COFF)
|
||
>12 lelong >0 not stripped
|
||
#>22 leshort >0 - version %ld
|
||
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
|
||
0 leshort =0514 80386 COFF executable
|
||
>12 lelong >0 not stripped
|
||
>22 leshort >0 - version %ld
|
||
|
||
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
|
||
# mapped into memory between 0xC0000 and 0xFFFFF
|
||
# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
|
||
0 beshort 0x55AA BIOS (ia32) ROM Ext.
|
||
>5 string USB USB
|
||
>7 string LDR UNDI image
|
||
>30 string IBM IBM comp. Video
|
||
>26 string Adaptec Adaptec
|
||
>28 string Adaptec Adaptec
|
||
>42 string PROMISE Promise
|
||
>2 byte x (%d*512)
|
||
|
||
# Flash descriptors for Intel SPI flash roms.
|
||
# From Dr. Jesus <j@hug.gs>
|
||
0 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
|
||
16 lelong 0x0ff0a55a Intel serial flash for PCH ROM
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
|
||
# interleaf: file(1) magic for InterLeaf TPS:
|
||
#
|
||
0 string =\210OPS Interleaf saved data
|
||
0 string =<!OPS Interleaf document text
|
||
>5 string ,\ Version\ = \b, version
|
||
>>17 string >\0 %.3s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
|
||
# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
|
||
# "/etc/magic":
|
||
# From: guy@netapp.com (Guy Harris)
|
||
#
|
||
4 string pgscriptver IslandWrite document
|
||
13 string DrawFile IslandDraw document
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
|
||
# ispell: file(1) magic for ispell
|
||
#
|
||
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
|
||
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
|
||
# (No other current magic entries collide.)
|
||
#
|
||
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
|
||
#
|
||
0 leshort&0xFFFC 0x9600 little endian ispell
|
||
>0 byte 0 hash file (?),
|
||
>0 byte 1 3.0 hash file,
|
||
>0 byte 2 3.1 hash file,
|
||
>0 byte 3 hash file (?),
|
||
>2 leshort 0x00 8-bit, no capitalization, 26 flags
|
||
>2 leshort 0x01 7-bit, no capitalization, 26 flags
|
||
>2 leshort 0x02 8-bit, capitalization, 26 flags
|
||
>2 leshort 0x03 7-bit, capitalization, 26 flags
|
||
>2 leshort 0x04 8-bit, no capitalization, 52 flags
|
||
>2 leshort 0x05 7-bit, no capitalization, 52 flags
|
||
>2 leshort 0x06 8-bit, capitalization, 52 flags
|
||
>2 leshort 0x07 7-bit, capitalization, 52 flags
|
||
>2 leshort 0x08 8-bit, no capitalization, 128 flags
|
||
>2 leshort 0x09 7-bit, no capitalization, 128 flags
|
||
>2 leshort 0x0A 8-bit, capitalization, 128 flags
|
||
>2 leshort 0x0B 7-bit, capitalization, 128 flags
|
||
>2 leshort 0x0C 8-bit, no capitalization, 256 flags
|
||
>2 leshort 0x0D 7-bit, no capitalization, 256 flags
|
||
>2 leshort 0x0E 8-bit, capitalization, 256 flags
|
||
>2 leshort 0x0F 7-bit, capitalization, 256 flags
|
||
>4 leshort >0 and %d string characters
|
||
0 beshort&0xFFFC 0x9600 big endian ispell
|
||
>1 byte 0 hash file (?),
|
||
>1 byte 1 3.0 hash file,
|
||
>1 byte 2 3.1 hash file,
|
||
>1 byte 3 hash file (?),
|
||
>2 beshort 0x00 8-bit, no capitalization, 26 flags
|
||
>2 beshort 0x01 7-bit, no capitalization, 26 flags
|
||
>2 beshort 0x02 8-bit, capitalization, 26 flags
|
||
>2 beshort 0x03 7-bit, capitalization, 26 flags
|
||
>2 beshort 0x04 8-bit, no capitalization, 52 flags
|
||
>2 beshort 0x05 7-bit, no capitalization, 52 flags
|
||
>2 beshort 0x06 8-bit, capitalization, 52 flags
|
||
>2 beshort 0x07 7-bit, capitalization, 52 flags
|
||
>2 beshort 0x08 8-bit, no capitalization, 128 flags
|
||
>2 beshort 0x09 7-bit, no capitalization, 128 flags
|
||
>2 beshort 0x0A 8-bit, capitalization, 128 flags
|
||
>2 beshort 0x0B 7-bit, capitalization, 128 flags
|
||
>2 beshort 0x0C 8-bit, no capitalization, 256 flags
|
||
>2 beshort 0x0D 7-bit, no capitalization, 256 flags
|
||
>2 beshort 0x0E 8-bit, capitalization, 256 flags
|
||
>2 beshort 0x0F 7-bit, capitalization, 256 flags
|
||
>4 beshort >0 and %d string characters
|
||
# ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
|
||
# Ispell 4.0
|
||
0 string ISPL ispell
|
||
>4 long x hash file version %d,
|
||
>8 long x lexletters %d,
|
||
>12 long x lexsize %d,
|
||
>16 long x hashsize %d,
|
||
>20 long x stblsize %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $
|
||
# ISO Zipped file format
|
||
# http://www.ezbsystems.com/isz/iszspec.txt
|
||
0 string IsZ! ISO Zipped file
|
||
>4 byte x \b, header size %u
|
||
>5 byte x \b, version %u
|
||
>8 lelong x \b, serial %u
|
||
#12 leshort x \b, sector size %u
|
||
#>16 lelong x \b, total sectors %u
|
||
>17 byte >0 \b, password protected
|
||
#>24 lequad x \b, segment size %llu
|
||
#>32 lelong x \b, blocks %u
|
||
#>36 lelong x \b, block size %u
|
||
|
||
#------------------------------------------------------------
|
||
# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
|
||
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
|
||
# same magic number, 0xcafebabe, so they are both handled
|
||
# in the entry called "cafebabe".
|
||
#------------------------------------------------------------
|
||
# Java serialization
|
||
# From Martin Pool (m.pool@pharos.com.au)
|
||
0 beshort 0xaced Java serialization data
|
||
>2 beshort >0x0004 \b, version %d
|
||
|
||
0 belong 0xfeedfeed Java KeyStore
|
||
!:mime application/x-java-keystore
|
||
0 belong 0xcececece Java JCE KeyStore
|
||
!:mime application/x-java-jce-keystore
|
||
|
||
# Dalvik .dex format. http://retrodev.com/android/dexformat.html
|
||
# From <mkf@google.com> "Mike Fleming"
|
||
0 string dex\n
|
||
>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file
|
||
>4 string >000 version %s
|
||
0 string dey\n
|
||
>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host)
|
||
>4 string >000 version %s
|
||
|
||
# Java source
|
||
0 regex ^import.*;$ Java source
|
||
!:mime text/x-java
|
||
|
||
# http://android.stackexchange.com/questions/23357/\
|
||
# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
|
||
# 23608#23608
|
||
0 string ANDROID\040BACKUP\n Android Backup
|
||
>15 string 1\n \b, version 1
|
||
>17 string 0\n \b, uncompressed
|
||
>17 string 1\n \b, compressed
|
||
>19 string none\n \b, unencrypted
|
||
>19 string AES-256\n \b, encrypted AES-256
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
|
||
# javascript: magic for javascript and node.js scripts.
|
||
#
|
||
0 search/1/w #!/bin/node Node.js script text executable
|
||
!:mime application/javascript
|
||
0 search/1/w #!/usr/bin/node Node.js script text executable
|
||
!:mime application/javascript
|
||
0 search/1/w #!/bin/nodejs Node.js script text executable
|
||
!:mime application/javascript
|
||
0 search/1/w #!/usr/bin/nodejs Node.js script text executable
|
||
!:mime application/javascript
|
||
0 search/1 #!/usr/bin/env\ node Node.js script text executable
|
||
!:mime application/javascript
|
||
0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable
|
||
!:mime application/javascript
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
|
||
# JPEG images
|
||
# SunOS 5.5.1 had
|
||
#
|
||
# 0 string \377\330\377\340 JPEG file
|
||
# 0 string \377\330\377\356 JPG file
|
||
#
|
||
# both of which turn into "JPEG image data" here.
|
||
#
|
||
0 beshort 0xffd8 JPEG image data
|
||
!:mime image/jpeg
|
||
!:apple 8BIMJPEG
|
||
!:strength +2
|
||
>6 string JFIF \b, JFIF standard
|
||
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
|
||
# in a vain attempt to add image size reporting for JFIF. Note that these
|
||
# tests are not fool-proof since some perfectly valid JPEGs are currently
|
||
# impossible to specify in magic(4) format.
|
||
# First, a little JFIF version info:
|
||
>>11 byte x \b %d.
|
||
>>12 byte x \b%02d
|
||
# Next, the resolution or aspect ratio of the image:
|
||
#>>13 byte 0 \b, aspect ratio
|
||
#>>13 byte 1 \b, resolution (DPI)
|
||
#>>13 byte 2 \b, resolution (DPCM)
|
||
#>>4 beshort x \b, segment length %d
|
||
# Next, show thumbnail info, if it exists:
|
||
>>18 byte !0 \b, thumbnail %dx
|
||
>>>19 byte x \b%d
|
||
|
||
# EXIF moved down here to avoid reporting a bogus version number,
|
||
# and EXIF version number printing added.
|
||
# - Patrik R=E5dman <patrik+file-magic@iki.fi>
|
||
>6 string Exif \b, EXIF standard
|
||
# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
|
||
# All possible combinations of entries have to be enumerated, since no looping
|
||
# is possible. And both endians are possible...
|
||
# The combinations included below are from real-world JPEGs.
|
||
# Little-endian
|
||
>>12 string II
|
||
# IFD 0 Entry #5:
|
||
>>>70 leshort 0x8769
|
||
# EXIF IFD Entry #1:
|
||
>>>>(78.l+14) leshort 0x9000
|
||
>>>>>(78.l+23) byte x %c
|
||
>>>>>(78.l+24) byte x \b.%c
|
||
>>>>>(78.l+25) byte !0x30 \b%c
|
||
# IFD 0 Entry #9:
|
||
>>>118 leshort 0x8769
|
||
# EXIF IFD Entry #3:
|
||
>>>>(126.l+38) leshort 0x9000
|
||
>>>>>(126.l+47) byte x %c
|
||
>>>>>(126.l+48) byte x \b.%c
|
||
>>>>>(126.l+49) byte !0x30 \b%c
|
||
# IFD 0 Entry #10
|
||
>>>130 leshort 0x8769
|
||
# EXIF IFD Entry #3:
|
||
>>>>(138.l+38) leshort 0x9000
|
||
>>>>>(138.l+47) byte x %c
|
||
>>>>>(138.l+48) byte x \b.%c
|
||
>>>>>(138.l+49) byte !0x30 \b%c
|
||
# EXIF IFD Entry #4:
|
||
>>>>(138.l+50) leshort 0x9000
|
||
>>>>>(138.l+59) byte x %c
|
||
>>>>>(138.l+60) byte x \b.%c
|
||
>>>>>(138.l+61) byte !0x30 \b%c
|
||
# EXIF IFD Entry #5:
|
||
>>>>(138.l+62) leshort 0x9000
|
||
>>>>>(138.l+71) byte x %c
|
||
>>>>>(138.l+72) byte x \b.%c
|
||
>>>>>(138.l+73) byte !0x30 \b%c
|
||
# IFD 0 Entry #11
|
||
>>>142 leshort 0x8769
|
||
# EXIF IFD Entry #3:
|
||
>>>>(150.l+38) leshort 0x9000
|
||
>>>>>(150.l+47) byte x %c
|
||
>>>>>(150.l+48) byte x \b.%c
|
||
>>>>>(150.l+49) byte !0x30 \b%c
|
||
# EXIF IFD Entry #4:
|
||
>>>>(150.l+50) leshort 0x9000
|
||
>>>>>(150.l+59) byte x %c
|
||
>>>>>(150.l+60) byte x \b.%c
|
||
>>>>>(150.l+61) byte !0x30 \b%c
|
||
# EXIF IFD Entry #5:
|
||
>>>>(150.l+62) leshort 0x9000
|
||
>>>>>(150.l+71) byte x %c
|
||
>>>>>(150.l+72) byte x \b.%c
|
||
>>>>>(150.l+73) byte !0x30 \b%c
|
||
# Big-endian
|
||
>>12 string MM
|
||
# IFD 0 Entry #9:
|
||
>>>118 beshort 0x8769
|
||
# EXIF IFD Entry #1:
|
||
>>>>(126.L+14) beshort 0x9000
|
||
>>>>>(126.L+23) byte x %c
|
||
>>>>>(126.L+24) byte x \b.%c
|
||
>>>>>(126.L+25) byte !0x30 \b%c
|
||
# EXIF IFD Entry #3:
|
||
>>>>(126.L+38) beshort 0x9000
|
||
>>>>>(126.L+47) byte x %c
|
||
>>>>>(126.L+48) byte x \b.%c
|
||
>>>>>(126.L+49) byte !0x30 \b%c
|
||
# IFD 0 Entry #10
|
||
>>>130 beshort 0x8769
|
||
# EXIF IFD Entry #3:
|
||
>>>>(138.L+38) beshort 0x9000
|
||
>>>>>(138.L+47) byte x %c
|
||
>>>>>(138.L+48) byte x \b.%c
|
||
>>>>>(138.L+49) byte !0x30 \b%c
|
||
# EXIF IFD Entry #5:
|
||
>>>>(138.L+62) beshort 0x9000
|
||
>>>>>(138.L+71) byte x %c
|
||
>>>>>(138.L+72) byte x \b.%c
|
||
>>>>>(138.L+73) byte !0x30 \b%c
|
||
# IFD 0 Entry #11
|
||
>>>142 beshort 0x8769
|
||
# EXIF IFD Entry #4:
|
||
>>>>(150.L+50) beshort 0x9000
|
||
>>>>>(150.L+59) byte x %c
|
||
>>>>>(150.L+60) byte x \b.%c
|
||
>>>>>(150.L+61) byte !0x30 \b%c
|
||
# Here things get sticky. We can do ONE MORE marker segment with
|
||
# indirect addressing, and that's all. It would be great if we could
|
||
# do pointer arithemetic like in an assembler language. Christos?
|
||
# And if there was some sort of looping construct to do searches, plus a few
|
||
# named accumulators, it would be even more effective...
|
||
# At least we can show a comment if no other segments got inserted before:
|
||
>(4.S+5) byte 0xFE \b, comment:
|
||
>>(4.S+6) pstring/HJ x "%s"
|
||
# Or, we can show the encoding type (I've included only the three most common)
|
||
# and image dimensions if we are lucky and the SOFn (image segment) is here:
|
||
>(4.S+5) byte 0xC0 \b, baseline
|
||
>>(4.S+6) byte x \b, precision %d
|
||
>>(4.S+7) beshort x \b, %dx
|
||
>>(4.S+9) beshort x \b%d
|
||
>(4.S+5) byte 0xC1 \b, extended sequential
|
||
>>(4.S+6) byte x \b, precision %d
|
||
>>(4.S+7) beshort x \b, %dx
|
||
>>(4.S+9) beshort x \b%d
|
||
>(4.S+5) byte 0xC2 \b, progressive
|
||
>>(4.S+6) byte x \b, precision %d
|
||
>>(4.S+7) beshort x \b, %dx
|
||
>>(4.S+9) beshort x \b%d
|
||
# I've commented-out quantisation table reporting. I doubt anyone cares yet.
|
||
#>(4.S+5) byte 0xDB \b, quantisation table
|
||
#>>(4.S+6) beshort x \b length=%d
|
||
#>14 beshort x \b, %d x
|
||
#>16 beshort x \b %d
|
||
|
||
# HSI is Handmade Software's proprietary JPEG encoding scheme
|
||
0 string hsi1 JPEG image data, HSI proprietary
|
||
|
||
# From: David Santinoli <david@santinoli.com>
|
||
0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000
|
||
# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
|
||
# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
|
||
# https://github.com/bitsgalore/jp2kMagic
|
||
#
|
||
# Now read value of 'Brand' field, which yields a few possibilities:
|
||
>20 string \x6a\x70\x32\x20 Part 1 (JP2)
|
||
!:mime image/jp2
|
||
>20 string \x6a\x70\x78\x20 Part 2 (JPX)
|
||
!:mime image/jpx
|
||
>20 string \x6a\x70\x6d\x20 Part 6 (JPM)
|
||
!:mime image/jpm
|
||
>20 string \x6d\x6a\x70\x32 Part 3 (MJ2)
|
||
!:mime video/mj2
|
||
|
||
# Type: JPEG 2000 codesream
|
||
# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
|
||
0 belong 0xff4fff51 JPEG 2000 codestream
|
||
45 beshort 0xff52
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
|
||
# karma: file(1) magic for Karma data files
|
||
#
|
||
# From <rgooch@atnf.csiro.au>
|
||
|
||
0 string KarmaRHD Version Karma Data Structure Version
|
||
>16 belong x %lu
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
|
||
# kde: file(1) magic for KDE
|
||
|
||
0 string/t [KDE\ Desktop\ Entry] KDE desktop entry
|
||
!:mime application/x-kdelnk
|
||
0 string/t #\ KDE\ Config\ File KDE config file
|
||
!:mime application/x-kdelnk
|
||
0 string/t #\ xmcd xmcd database file for kscd
|
||
!:mime text/x-xmcd
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
|
||
# keepass: file(1) magic for KeePass file
|
||
#
|
||
# Keepass Password Safe:
|
||
# * original one: http://keepass.info/
|
||
# * *nix port: http://www.keepassx.org/
|
||
# * android port: http://code.google.com/p/keepassdroid/
|
||
|
||
0 lelong 0x9AA2D903 Keepass password database
|
||
>4 lelong 0xB54BFB65 1.x KDB
|
||
>>48 lelong >0 \b, %d groups
|
||
>>52 lelong >0 \b, %d entries
|
||
>>8 lelong&0x0f 1 \b, SHA-256
|
||
>>8 lelong&0x0f 2 \b, AES
|
||
>>8 lelong&0x0f 4 \b, RC4
|
||
>>8 lelong&0x0f 8 \b, Twofish
|
||
>>120 lelong >0 \b, %d key transformation rounds
|
||
>4 lelong 0xB54BFB67 2.x KDBX
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
|
||
# Type: Google KML, formerly Keyhole Markup Language
|
||
# Future development of this format has been handed
|
||
# over to the Open Geospatial Consortium.
|
||
# http://www.opengeospatial.org/standards/kml/
|
||
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
|
||
0 string/t \<?xml
|
||
>20 search/400 \ xmlns=
|
||
>>&0 regex ['"]http://earth.google.com/kml Google KML document
|
||
!:mime application/vnd.google-earth.kml+xml
|
||
>>>&1 string 2.0' \b, version 2.0
|
||
>>>&1 string 2.1' \b, version 2.1
|
||
>>>&1 string 2.2' \b, version 2.2
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Type: OpenGIS KML, formerly Keyhole Markup Language
|
||
# This standard is maintained by the
|
||
# Open Geospatial Consortium.
|
||
# http://www.opengeospatial.org/standards/kml/
|
||
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
|
||
>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
|
||
!:mime application/vnd.google-earth.kml+xml
|
||
>>>&1 string/t 2.2 \b, version 2.2
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Type: Google KML Archive (ZIP based)
|
||
# http://code.google.com/apis/kml/documentation/kml_tut.html
|
||
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
|
||
0 string PK\003\004
|
||
>4 byte 0x14
|
||
>>30 string doc.kml Compressed Google KML Document, including resources.
|
||
!:mime application/vnd.google-earth.kmz
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
|
||
# DEC SRC Virtual Paper: Lectern files
|
||
# Karl M. Hegbloom <karlheg@inetarena.com>
|
||
0 string lect DEC SRC Virtual Paper Lectern file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
|
||
# lex: file(1) magic for lex
|
||
#
|
||
# derived empirically, your offsets may vary!
|
||
0 search/100 yyprevious C program text (from lex)
|
||
>3 search/1 >\0 for %s
|
||
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
0 search/100 generated\ by\ flex C program text (from flex)
|
||
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
0 search/1 %{ lex description text
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
|
||
# lif: file(1) magic for lif
|
||
#
|
||
# (Daniel Quinlan <quinlan@yggdrasil.com>)
|
||
#
|
||
0 beshort 0x8000 lif file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $
|
||
# linux: file(1) magic for Linux files
|
||
#
|
||
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
# The following basic Linux magic is useful for reference, but using
|
||
# "long" magic is a better practice in order to avoid collisions.
|
||
#
|
||
# 2 leshort 100 Linux/i386
|
||
# >0 leshort 0407 impure executable (OMAGIC)
|
||
# >0 leshort 0410 pure executable (NMAGIC)
|
||
# >0 leshort 0413 demand-paged executable (ZMAGIC)
|
||
# >0 leshort 0314 demand-paged executable (QMAGIC)
|
||
#
|
||
0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
|
||
>16 lelong 0 \b, stripped
|
||
0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
|
||
>16 lelong 0 \b, stripped
|
||
0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
|
||
>16 lelong 0 \b, stripped
|
||
0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
|
||
>16 lelong 0 \b, stripped
|
||
#
|
||
0 string \007\001\000 Linux/i386 object file
|
||
>20 lelong >0x1020 \b, DLL library
|
||
# Linux-8086 stuff:
|
||
0 string \01\03\020\04 Linux-8086 impure executable
|
||
>28 long !0 not stripped
|
||
0 string \01\03\040\04 Linux-8086 executable
|
||
>28 long !0 not stripped
|
||
#
|
||
0 string \243\206\001\0 Linux-8086 object file
|
||
#
|
||
0 string \01\03\020\20 Minix-386 impure executable
|
||
>28 long !0 not stripped
|
||
0 string \01\03\040\20 Minix-386 executable
|
||
>28 long !0 not stripped
|
||
0 string \01\03\04\20 Minix-386 NSYM/GNU executable
|
||
>28 long !0 not stripped
|
||
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
|
||
216 lelong 0421 Linux/i386 core file
|
||
>220 string >\0 of '%s'
|
||
>200 lelong >0 (signal %d)
|
||
#
|
||
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
# this can be overridden by the DOS executable (COM) entry
|
||
2 string LILO Linux/i386 LILO boot/chain loader
|
||
#
|
||
# Linux make config build file, from Ole Aamot <oka@oka.no>
|
||
28 string make\ config Linux make config build file
|
||
#
|
||
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
|
||
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
|
||
0 leshort 0x0436 Linux/i386 PC Screen Font v1 data,
|
||
>2 byte&0x01 0 256 characters,
|
||
>2 byte&0x01 !0 512 characters,
|
||
>2 byte&0x02 0 no directory,
|
||
>2 byte&0x02 !0 Unicode directory,
|
||
>3 byte >0 8x%d
|
||
0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
|
||
>16 lelong x %d characters,
|
||
>12 lelong&0x01 0 no directory,
|
||
>12 lelong&0x01 !0 Unicode directory,
|
||
>24 lelong x %d
|
||
>28 lelong x \bx%d
|
||
|
||
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
4086 string SWAP-SPACE Linux/i386 swap file
|
||
# From: Jeff Bailey <jbailey@ubuntu.com>
|
||
# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
|
||
4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
|
||
# From: James Hunt <james.hunt@ubuntu.com>
|
||
4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate)
|
||
# according to man page of mkswap (8) March 1999
|
||
# volume label and UUID Russell Coker
|
||
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
|
||
4086 string SWAPSPACE2 Linux/i386 swap file (new style),
|
||
>0x400 long x version %d (4K pages),
|
||
>0x404 long x size %d pages,
|
||
>1052 string \0 no label,
|
||
>1052 string >\0 LABEL=%s,
|
||
>0x40c belong x UUID=%08x
|
||
>0x410 beshort x \b-%04x
|
||
>0x412 beshort x \b-%04x
|
||
>0x414 beshort x \b-%04x
|
||
>0x416 belong x \b-%08x
|
||
>0x41a beshort x \b%04x
|
||
# From Daniel Novotny <dnovotny@redhat.com>
|
||
# swap file for PowerPC
|
||
65526 string SWAPSPACE2 Linux/ppc swap file
|
||
16374 string SWAPSPACE2 Linux/ia64 swap file
|
||
#
|
||
# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
|
||
# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
|
||
# and Nicolas Lichtmaier <nick@debian.org>
|
||
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
|
||
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
|
||
514 string HdrS Linux kernel
|
||
!:strength + 5
|
||
>510 leshort 0xAA55 x86 boot executable
|
||
>>518 leshort >0x1ff
|
||
>>>529 byte 0 zImage,
|
||
>>>529 byte 1 bzImage,
|
||
>>>(526.s+0x200) string >\0 version %s,
|
||
>>498 leshort 1 RO-rootFS,
|
||
>>498 leshort 0 RW-rootFS,
|
||
>>508 leshort >0 root_dev 0x%X,
|
||
>>502 leshort >0 swap_dev 0x%X,
|
||
>>504 leshort >0 RAMdisksize %u KB,
|
||
>>506 leshort 0xFFFF Normal VGA
|
||
>>506 leshort 0xFFFE Extended VGA
|
||
>>506 leshort 0xFFFD Prompt for Videomode
|
||
>>506 leshort >0 Video mode %d
|
||
# This also matches new kernels, which were caught above by "HdrS".
|
||
0 belong 0xb8c0078e Linux kernel
|
||
>0x1e3 string Loading version 1.3.79 or older
|
||
>0x1e9 string Loading from prehistoric times
|
||
|
||
# System.map files - Nicolas Lichtmaier <nick@debian.org>
|
||
8 search/1 \ A\ _text Linux kernel symbol map text
|
||
|
||
# LSM entries - Nicolas Lichtmaier <nick@debian.org>
|
||
0 search/1 Begin3 Linux Software Map entry text
|
||
0 search/1 Begin4 Linux Software Map entry text (new format)
|
||
|
||
# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
|
||
0 belong 0x4f4f4f4d User-mode Linux COW file
|
||
>4 belong <3 \b, version %d
|
||
>>8 string >\0 \b, backing file %s
|
||
>4 belong >2 \b, version %d
|
||
>>32 string >\0 \b, backing file %s
|
||
|
||
############################################################################
|
||
# Linux kernel versions
|
||
|
||
0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
|
||
>497 leshort 0 x86 boot sector
|
||
>>514 belong 0x8e of a kernel from the dawn of time!
|
||
>>514 belong 0x908ed8b4 version 0.99-1.1.42
|
||
>>514 belong 0x908ed8b8 for memtest86
|
||
|
||
>497 leshort !0 x86 kernel
|
||
>>504 leshort >0 RAMdisksize=%u KB
|
||
>>502 leshort >0 swap=0x%X
|
||
>>508 leshort >0 root=0x%X
|
||
>>>498 leshort 1 \b-ro
|
||
>>>498 leshort 0 \b-rw
|
||
>>506 leshort 0xFFFF vga=normal
|
||
>>506 leshort 0xFFFE vga=extended
|
||
>>506 leshort 0xFFFD vga=ask
|
||
>>506 leshort >0 vga=%d
|
||
>>514 belong 0x908ed881 version 1.1.43-1.1.45
|
||
>>514 belong 0x15b281cd
|
||
>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
|
||
>>>0xa99 belong 0x55AA5a5a version 1.3.1,2
|
||
>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
|
||
>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
|
||
>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
|
||
>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
|
||
>>514 string HdrS
|
||
>>>518 leshort >0x1FF
|
||
>>>>529 byte 0 \b, zImage
|
||
>>>>529 byte 1 \b, bzImage
|
||
>>>>(526.s+0x200) string >\0 \b, version %s
|
||
|
||
# Linux boot sector thefts.
|
||
0 belong 0xb8c0078e Linux
|
||
>0x1e6 belong 0x454c4b53 ELKS Kernel
|
||
>0x1e6 belong !0x454c4b53 style boot sector
|
||
|
||
############################################################################
|
||
# Linux S390 kernel image
|
||
# Created by: Jan Kaluza <jkaluza@redhat.com>
|
||
8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
|
||
>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
|
||
# 64bit
|
||
>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
|
||
>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
|
||
>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
|
||
>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
|
||
# 32bit
|
||
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
|
||
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
|
||
>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
|
||
>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
|
||
|
||
# Linux ARM compressed kernel image
|
||
# From: Kevin Cernekee <cernekee@gmail.com>
|
||
36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian)
|
||
36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
|
||
|
||
############################################################################
|
||
# Linux 8086 executable
|
||
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
|
||
>5 string .
|
||
>>4 string >\0 \b, libc version %s
|
||
|
||
0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
|
||
>2 byte&0x01 !0 \b, unmapped zero page
|
||
>2 byte&0x20 0 \b, impure
|
||
>2 byte&0x20 !0
|
||
>>2 byte&0x10 !0 \b, A_EXEC
|
||
>2 byte&0x02 !0 \b, A_PAL
|
||
>2 byte&0x04 !0 \b, A_NSYM
|
||
>2 byte&0x08 !0 \b, A_STAND
|
||
>2 byte&0x40 !0 \b, A_PURE
|
||
>2 byte&0x80 !0 \b, A_TOVLY
|
||
>28 long !0 \b, not stripped
|
||
>37 string .
|
||
>>36 string >\0 \b, libc version %s
|
||
|
||
# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
|
||
# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
|
||
# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
|
||
# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
|
||
|
||
# SYSLINUX boot logo files (from 'ppmtolss16' sources)
|
||
# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
|
||
# file extension .lss .16
|
||
0 lelong =0x1413f33d SYSLINUX' LSS16 image data
|
||
# syslinux-4.05/mime/image/x-lss16.xml
|
||
!:mime image/x-lss16
|
||
>4 leshort x \b, width %d
|
||
>6 leshort x \b, height %d
|
||
|
||
0 string OOOM User-Mode-Linux's Copy-On-Write disk image
|
||
>4 belong x version %d
|
||
|
||
# SE Linux policy database
|
||
# From: Mike Frysinger <vapier@gentoo.org>
|
||
0 lelong 0xf97cff8c SE Linux policy
|
||
>16 lelong x v%d
|
||
>20 lelong 1 MLS
|
||
>24 lelong x %d symbols
|
||
>28 lelong x %d ocons
|
||
|
||
# Linux Logical Volume Manager (LVM)
|
||
# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
|
||
#
|
||
# System ID, UUID and volume group name are 128 bytes long
|
||
# but they should never be full and initialized with zeros...
|
||
#
|
||
# LVM1
|
||
#
|
||
0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
|
||
>0x12c string >\0 , System ID: %s
|
||
|
||
0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
|
||
>0x12c string >\0 , System ID: %s
|
||
|
||
# LVM2
|
||
#
|
||
# It seems that the label header can be in one the four first sector
|
||
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
|
||
#
|
||
# 0x200 seems to be the common case
|
||
|
||
0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
|
||
# read the offset to add to the start of the header, and the header
|
||
# start in 0x200
|
||
>&(&-12.l-0x21) byte x
|
||
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
|
||
>>&0x0 string >\x2f \b, UUID: %.6s
|
||
>>&0x6 string >\x2f \b-%.4s
|
||
>>&0xa string >\x2f \b-%.4s
|
||
>>&0xe string >\x2f \b-%.4s
|
||
>>&0x12 string >\x2f \b-%.4s
|
||
>>&0x16 string >\x2f \b-%.4s
|
||
>>&0x1a string >\x2f \b-%.6s
|
||
>>&0x20 lequad x \b, size: %lld
|
||
|
||
0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
|
||
>&(&-12.l-0x21) byte x
|
||
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
|
||
>>&0x0 string >\x2f \b, UUID: %.6s
|
||
>>&0x6 string >\x2f \b-%.4s
|
||
>>&0xa string >\x2f \b-%.4s
|
||
>>&0xe string >\x2f \b-%.4s
|
||
>>&0x12 string >\x2f \b-%.4s
|
||
>>&0x16 string >\x2f \b-%.4s
|
||
>>&0x1a string >\x2f \b-%.6s
|
||
>>&0x20 lequad x \b, size: %lld
|
||
|
||
0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
|
||
>&(&-12.l-0x21) byte x
|
||
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
|
||
>>&0x0 string >\x2f \b, UUID: %.6s
|
||
>>&0x6 string >\x2f \b-%.4s
|
||
>>&0xa string >\x2f \b-%.4s
|
||
>>&0xe string >\x2f \b-%.4s
|
||
>>&0x12 string >\x2f \b-%.4s
|
||
>>&0x16 string >\x2f \b-%.4s
|
||
>>&0x1a string >\x2f \b-%.6s
|
||
>>&0x20 lequad x \b, size: %lld
|
||
|
||
0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
|
||
>&(&-12.l-0x21) byte x
|
||
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
|
||
>>&0x0 string >\x2f \b, UUID: %.6s
|
||
>>&0x6 string >\x2f \b-%.4s
|
||
>>&0xa string >\x2f \b-%.4s
|
||
>>&0xe string >\x2f \b-%.4s
|
||
>>&0x12 string >\x2f \b-%.4s
|
||
>>&0x16 string >\x2f \b-%.4s
|
||
>>&0x1a string >\x2f \b-%.6s
|
||
>>&0x20 lequad x \b, size: %lld
|
||
|
||
# LVM snapshot
|
||
# from Jason Farrel
|
||
0 string SnAp LVM Snapshot (CopyOnWrite store)
|
||
>4 lelong !0 - valid,
|
||
>4 lelong 0 - invalid,
|
||
>8 lelong x version %d,
|
||
>12 lelong x chunk_size %d
|
||
|
||
# SE Linux policy database
|
||
0 lelong 0xf97cff8c SE Linux policy
|
||
>16 lelong x v%d
|
||
>20 lelong 1 MLS
|
||
>24 lelong x %d symbols
|
||
>28 lelong x %d ocons
|
||
|
||
# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
|
||
# Anthon van der Neut (anthon@mnt.org)
|
||
0 string LUKS\xba\xbe LUKS encrypted file,
|
||
>6 beshort x ver %d
|
||
>8 string x [%s,
|
||
>40 string x %s,
|
||
>72 string x %s]
|
||
>168 string x UUID: %s
|
||
|
||
|
||
# Summary: Xen saved domain file
|
||
# Created by: Radek Vokal <rvokal@redhat.com>
|
||
0 string LinuxGuestRecord Xen saved domain
|
||
>20 search/256 (name
|
||
>>&1 string x (name %s)
|
||
|
||
# Type: Xen, the virtual machine monitor
|
||
# From: Radek Vokal <rvokal@redhat.com>
|
||
0 string LinuxGuestRecord Xen saved domain
|
||
#>2 regex \(name\ [^)]*\) %s
|
||
>20 search/256 (name (name
|
||
>>&1 string x %s...)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
|
||
# lisp: file(1) magic for lisp programs
|
||
#
|
||
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
|
||
# updated by Joerg Jenderek
|
||
# GRR: This lot is too weak
|
||
#0 string ;;
|
||
# windows INF files often begin with semicolon and use CRLF as line end
|
||
# lisp files are mainly created on unix system with LF as line end
|
||
#>2 search/4096 !\r Lisp/Scheme program text
|
||
#>2 search/4096 \r Windows INF file
|
||
|
||
0 search/4096 (setq\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
0 search/4096 (defvar\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
0 search/4096 (defparam\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
0 search/4096 (defun\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
0 search/4096 (autoload\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
0 search/4096 (custom-set-variables\ Lisp/Scheme program text
|
||
!:mime text/x-lisp
|
||
|
||
# Emacs 18 - this is always correct, but not very magical.
|
||
0 string \012( Emacs v18 byte-compiled Lisp data
|
||
!:mime application/x-elc
|
||
# Emacs 19+ - ver. recognition added by Ian Springer
|
||
# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
|
||
# - Chris Chittleborough <cchittleborough@yahoo.com.au>
|
||
0 string ;ELC
|
||
>4 byte >18
|
||
>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
|
||
!:mime application/x-elc
|
||
|
||
# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
|
||
0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
|
||
0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
|
||
|
||
0 long 0x70768BD2 CLISP memory image data
|
||
0 long 0xD28B7670 CLISP memory image data, other endian
|
||
|
||
#.com and .bin for MIT scheme
|
||
0 string \372\372\372\372 MIT scheme (library?)
|
||
|
||
# From: David Allouche <david@allouche.net>
|
||
0 search/1 \<TeXmacs| TeXmacs document text
|
||
!:mime text/texmacs
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
|
||
# llvm: file(1) magic for LLVM byte-codes
|
||
# URL: http://llvm.org/docs/BitCodeFormat.html
|
||
# From: Al Stone <ahs3@fc.hp.com>
|
||
|
||
0 string llvm LLVM byte-codes, uncompressed
|
||
0 string llvc0 LLVM byte-codes, null compression
|
||
0 string llvc1 LLVM byte-codes, gzip compression
|
||
0 string llvc2 LLVM byte-codes, bzip2 compression
|
||
|
||
0 lelong 0x0b17c0de LLVM bitcode, wrapper
|
||
# Are these Mach-O ABI values? They appear to be.
|
||
>16 lelong 0x01000007 x86_64
|
||
>16 lelong 0x00000007 i386
|
||
>16 lelong 0x00000012 ppc
|
||
>16 lelong 0x01000012 ppc64
|
||
>16 lelong 0x0000000c arm
|
||
|
||
0 string BC\xc0\xde LLVM IR bitcode
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
|
||
# lua: file(1) magic for Lua scripting language
|
||
# URL: http://www.lua.org/
|
||
# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
|
||
|
||
# Lua scripts
|
||
0 search/1/w #!\ /usr/bin/lua Lua script text executable
|
||
!:mime text/x-lua
|
||
0 search/1/w #!\ /usr/local/bin/lua Lua script text executable
|
||
!:mime text/x-lua
|
||
0 search/1 #!/usr/bin/env\ lua Lua script text executable
|
||
!:mime text/x-lua
|
||
0 search/1 #!\ /usr/bin/env\ lua Lua script text executable
|
||
!:mime text/x-lua
|
||
|
||
# Lua bytecode
|
||
0 string \033Lua Lua bytecode,
|
||
>4 byte 0x50 version 5.0
|
||
>4 byte 0x51 version 5.1
|
||
>4 byte 0x52 version 5.2
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
|
||
# luks: file(1) magic for Linux Unified Key Setup
|
||
# URL: http://luks.endorphin.org/spec
|
||
# From: Anthon van der Neut <anthon@mnt.org>
|
||
|
||
0 string LUKS\xba\xbe LUKS encrypted file,
|
||
>6 beshort x ver %d
|
||
>8 string x [%s,
|
||
>40 string x %s,
|
||
>72 string x %s]
|
||
>168 string x UUID: %s
|
||
#------------------------------------------------------------------------------
|
||
# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
|
||
# make: file(1) magic for M4 scripts
|
||
#
|
||
0 regex \^dnl\ M4 macro processor script text
|
||
!:mime text/x-m4
|
||
|
||
#------------------------------------------------------------
|
||
# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $
|
||
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
|
||
# Unfortunately the first, cafebabe, is shared with
|
||
# Java ByteCode, so they are both handled in the file "cafebabe".
|
||
# The "feedface" ones are handled herein.
|
||
#------------------------------------------------------------
|
||
# if set, it's for the 64-bit version of the architecture
|
||
# yes, this is separate from the low-order magic number bit
|
||
# it's also separate from the "64-bit libraries" bit in the
|
||
# upper 8 bits of the CPU subtype
|
||
|
||
0 name mach-o-cpu
|
||
>0 belong&0x01000000 0
|
||
#
|
||
# 32-bit ABIs.
|
||
#
|
||
# 1 vax
|
||
>>0 belong&0x00ffffff 1
|
||
>>>4 belong&0x00ffffff 0 vax
|
||
>>>4 belong&0x00ffffff 1 vax11/780
|
||
>>>4 belong&0x00ffffff 2 vax11/785
|
||
>>>4 belong&0x00ffffff 3 vax11/750
|
||
>>>4 belong&0x00ffffff 4 vax11/730
|
||
>>>4 belong&0x00ffffff 5 uvaxI
|
||
>>>4 belong&0x00ffffff 6 uvaxII
|
||
>>>4 belong&0x00ffffff 7 vax8200
|
||
>>>4 belong&0x00ffffff 8 vax8500
|
||
>>>4 belong&0x00ffffff 9 vax8600
|
||
>>>4 belong&0x00ffffff 10 vax8650
|
||
>>>4 belong&0x00ffffff 11 vax8800
|
||
>>>4 belong&0x00ffffff 12 uvaxIII
|
||
>>>4 belong&0x00ffffff >12 vax subarchitecture=%ld
|
||
>>0 belong&0x00ffffff 2 romp
|
||
>>0 belong&0x00ffffff 3 architecture=3
|
||
>>0 belong&0x00ffffff 4 ns32032
|
||
>>0 belong&0x00ffffff 5 ns32332
|
||
>>0 belong&0x00ffffff 6 m68k
|
||
# 7 x86
|
||
>>0 belong&0x00ffffff 7
|
||
>>>4 belong&0x0000000f 3 i386
|
||
>>>4 belong&0x0000000f 4 i486
|
||
>>>>4 belong&0x00fffff0 0
|
||
>>>>4 belong&0x00fffff0 0x80 \bsx
|
||
>>>4 belong&0x0000000f 5 i586
|
||
>>>4 belong&0x0000000f 6
|
||
>>>>4 belong&0x00fffff0 0 p6
|
||
>>>>4 belong&0x00fffff0 0x10 pentium_pro
|
||
>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20
|
||
>>>>4 belong&0x00fffff0 0x30 pentium_2_m3
|
||
>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
|
||
>>>>4 belong&0x00fffff0 0x50 pentium_2_m5
|
||
>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx
|
||
>>>4 belong&0x0000000f 7 celeron
|
||
>>>>4 belong&0x00fffff0 0x00 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x10 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x20 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x30 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x40 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x50 \b_m0x%lx
|
||
>>>>4 belong&0x00fffff0 0x60
|
||
>>>>4 belong&0x00fffff0 0x70 \b_mobile
|
||
>>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx
|
||
>>>4 belong&0x0000000f 8 pentium_3
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 0x10 \b_m
|
||
>>>>4 belong&0x00fffff0 0x20 \b_xeon
|
||
>>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx
|
||
>>>4 belong&0x0000000f 9 pentiumM
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx
|
||
>>>4 belong&0x0000000f 10 pentium_4
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 0x10 \b_m
|
||
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
|
||
>>>4 belong&0x0000000f 11 itanium
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 0x10 \b_2
|
||
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
|
||
>>>4 belong&0x0000000f 12 xeon
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 0x10 \b_mp
|
||
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
|
||
>>>4 belong&0x0000000f >12 ia32 family=%ld
|
||
>>>>4 belong&0x00fffff0 0x00
|
||
>>>>4 belong&0x00fffff0 >0x00 model=%lx
|
||
>>0 belong&0x00ffffff 8 mips
|
||
>>>4 belong&0x00ffffff 1 R2300
|
||
>>>4 belong&0x00ffffff 2 R2600
|
||
>>>4 belong&0x00ffffff 3 R2800
|
||
>>>4 belong&0x00ffffff 4 R2000a
|
||
>>>4 belong&0x00ffffff 5 R2000
|
||
>>>4 belong&0x00ffffff 6 R3000a
|
||
>>>4 belong&0x00ffffff 7 R3000
|
||
>>>4 belong&0x00ffffff >7 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff 9 ns32532
|
||
>>0 belong&0x00ffffff 10 mc98000
|
||
>>0 belong&0x00ffffff 11 hppa
|
||
>>>4 belong&0x00ffffff 0 7100
|
||
>>>4 belong&0x00ffffff 1 7100LC
|
||
>>>4 belong&0x00ffffff >1 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff 12 arm
|
||
>>>4 belong&0x00ffffff 0
|
||
>>>4 belong&0x00ffffff 1 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 2 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 3 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 4 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 5 \b_v4t
|
||
>>>4 belong&0x00ffffff 6 \b_v6
|
||
>>>4 belong&0x00ffffff 7 \b_v5tej
|
||
>>>4 belong&0x00ffffff 8 \b_xscale
|
||
>>>4 belong&0x00ffffff 9 \b_v7
|
||
>>>4 belong&0x00ffffff 10 \b_v7f
|
||
>>>4 belong&0x00ffffff 11 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 12 \b_v7k
|
||
>>>4 belong&0x00ffffff >12 subarchitecture=%ld
|
||
# 13 m88k
|
||
>>0 belong&0x00ffffff 13
|
||
>>>4 belong&0x00ffffff 0 mc88000
|
||
>>>4 belong&0x00ffffff 1 mc88100
|
||
>>>4 belong&0x00ffffff 2 mc88110
|
||
>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff 14 sparc
|
||
>>0 belong&0x00ffffff 15 i860g
|
||
>>0 belong&0x00ffffff 16 alpha
|
||
>>0 belong&0x00ffffff 17 rs6000
|
||
>>0 belong&0x00ffffff 18 ppc
|
||
>>>4 belong&0x00ffffff 0
|
||
>>>4 belong&0x00ffffff 1 \b_601
|
||
>>>4 belong&0x00ffffff 2 \b_602
|
||
>>>4 belong&0x00ffffff 3 \b_603
|
||
>>>4 belong&0x00ffffff 4 \b_603e
|
||
>>>4 belong&0x00ffffff 5 \b_603ev
|
||
>>>4 belong&0x00ffffff 6 \b_604
|
||
>>>4 belong&0x00ffffff 7 \b_604e
|
||
>>>4 belong&0x00ffffff 8 \b_620
|
||
>>>4 belong&0x00ffffff 9 \b_650
|
||
>>>4 belong&0x00ffffff 10 \b_7400
|
||
>>>4 belong&0x00ffffff 11 \b_7450
|
||
>>>4 belong&0x00ffffff 100 \b_970
|
||
>>>4 belong&0x00ffffff >100 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff >18 architecture=%ld
|
||
>0 belong&0x01000000 0x01000000
|
||
#
|
||
# 64-bit ABIs.
|
||
#
|
||
>>0 belong&0x00ffffff 0 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 1 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 2 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 3 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 4 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 5 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 6 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 7 x86_64
|
||
>>>4 belong&0x00ffffff 0 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 1 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 2 subarchitecture=%ld
|
||
>>>4 belong&0x00ffffff 3
|
||
>>>4 belong&0x00ffffff 4 \b_arch1
|
||
>>>4 belong&0x00ffffff >4 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff 8 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 9 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 10 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 11 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 12 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 13 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 14 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 15 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 16 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 17 64-bit architecture=%ld
|
||
>>0 belong&0x00ffffff 18 ppc64
|
||
>>>4 belong&0x00ffffff 0
|
||
>>>4 belong&0x00ffffff 1 \b_601
|
||
>>>4 belong&0x00ffffff 2 \b_602
|
||
>>>4 belong&0x00ffffff 3 \b_603
|
||
>>>4 belong&0x00ffffff 4 \b_603e
|
||
>>>4 belong&0x00ffffff 5 \b_603ev
|
||
>>>4 belong&0x00ffffff 6 \b_604
|
||
>>>4 belong&0x00ffffff 7 \b_604e
|
||
>>>4 belong&0x00ffffff 8 \b_620
|
||
>>>4 belong&0x00ffffff 9 \b_650
|
||
>>>4 belong&0x00ffffff 10 \b_7400
|
||
>>>4 belong&0x00ffffff 11 \b_7450
|
||
>>>4 belong&0x00ffffff 100 \b_970
|
||
>>>4 belong&0x00ffffff >100 subarchitecture=%ld
|
||
>>0 belong&0x00ffffff >18 64-bit architecture=%ld
|
||
|
||
|
||
0 name mach-o-be
|
||
>0 byte 0xcf 64-bit
|
||
>4 use mach-o-cpu
|
||
>12 belong 1 object
|
||
>12 belong 2 executable
|
||
>12 belong 3 fixed virtual memory shared library
|
||
>12 belong 4 core
|
||
>12 belong 5 preload executable
|
||
>12 belong 6 dynamically linked shared library
|
||
>12 belong 7 dynamic linker
|
||
>12 belong 8 bundle
|
||
>12 belong 9 dynamically linked shared library stub
|
||
>12 belong 10 dSYM companion file
|
||
>12 belong 11 kext bundle
|
||
>12 belong >11
|
||
>>12 belong x filetype=%ld
|
||
|
||
#
|
||
0 lelong&0xfffffffe 0xfeedface Mach-O
|
||
!:strength +1
|
||
>0 use \^mach-o-be
|
||
|
||
0 belong&0xfffffffe 0xfeedface Mach-O
|
||
!:strength +1
|
||
>0 use mach-o-be
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $
|
||
# macintosh description
|
||
#
|
||
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
|
||
# Daniel Quinlan, quinlan@yggdrasil.com
|
||
11 string must\ be\ converted\ with\ BinHex BinHex binary text
|
||
!:mime application/mac-binhex40
|
||
>41 string x \b, version %.3s
|
||
|
||
# Stuffit archives are the de facto standard of compression for Macintosh
|
||
# files obtained from most archives. (franklsm@tuns.ca)
|
||
0 string SIT! StuffIt Archive (data)
|
||
!:mime application/x-stuffit
|
||
!:apple SIT!SIT!
|
||
>2 string x : %s
|
||
0 string SITD StuffIt Deluxe (data)
|
||
>2 string x : %s
|
||
0 string Seg StuffIt Deluxe Segment (data)
|
||
>2 string x : %s
|
||
|
||
# Newer StuffIt archives (grant@netbsd.org)
|
||
0 string StuffIt StuffIt Archive
|
||
!:mime application/x-stuffit
|
||
!:apple SIT!SIT!
|
||
#>162 string >0 : %s
|
||
|
||
# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
|
||
# GRR: Too weak
|
||
#0 string APPL Macintosh Application (data)
|
||
#>2 string x \b: %s
|
||
|
||
# Macintosh System files (franklsm@tuns.ca)
|
||
# GRR: Too weak
|
||
#0 string zsys Macintosh System File (data)
|
||
#0 string FNDR Macintosh Finder (data)
|
||
#0 string libr Macintosh Library (data)
|
||
#>2 string x : %s
|
||
#0 string shlb Macintosh Shared Library (data)
|
||
#>2 string x : %s
|
||
#0 string cdev Macintosh Control Panel (data)
|
||
#>2 string x : %s
|
||
#0 string INIT Macintosh Extension (data)
|
||
#>2 string x : %s
|
||
#0 string FFIL Macintosh Truetype Font (data)
|
||
#>2 string x : %s
|
||
#0 string LWFN Macintosh Postscript Font (data)
|
||
#>2 string x : %s
|
||
|
||
# Additional Macintosh Files (franklsm@tuns.ca)
|
||
# GRR: Too weak
|
||
#0 string PACT Macintosh Compact Pro Archive (data)
|
||
#>2 string x : %s
|
||
#0 string ttro Macintosh TeachText File (data)
|
||
#>2 string x : %s
|
||
#0 string TEXT Macintosh TeachText File (data)
|
||
#>2 string x : %s
|
||
#0 string PDF Macintosh PDF File (data)
|
||
#>2 string x : %s
|
||
|
||
# MacBinary format (Eric Fischer, enf@pobox.com)
|
||
#
|
||
# Unfortunately MacBinary doesn't really have a magic number prior
|
||
# to the MacBinary III format. The checksum is really the way to
|
||
# do it, but the magic file format isn't up to the challenge.
|
||
#
|
||
# 0 byte 0
|
||
# 1 byte # filename length
|
||
# 2 string # filename
|
||
# 65 string # file type
|
||
# 69 string # file creator
|
||
# 73 byte # Finder flags
|
||
# 74 byte 0
|
||
# 75 beshort # vertical posn in window
|
||
# 77 beshort # horiz posn in window
|
||
# 79 beshort # window or folder ID
|
||
# 81 byte # protected?
|
||
# 82 byte 0
|
||
# 83 belong # length of data segment
|
||
# 87 belong # length of resource segment
|
||
# 91 belong # file creation date
|
||
# 95 belong # file modification date
|
||
# 99 beshort # length of comment after resource
|
||
# 101 byte # new Finder flags
|
||
# 102 string mBIN # (only in MacBinary III)
|
||
# 106 byte # char. code of file name
|
||
# 107 byte # still more Finder flags
|
||
# 116 belong # total file length
|
||
# 120 beshort # length of add'l header
|
||
# 122 byte 129 # for MacBinary II
|
||
# 122 byte 130 # for MacBinary III
|
||
# 123 byte 129 # minimum version that can read fmt
|
||
# 124 beshort # checksum
|
||
#
|
||
# This attempts to use the version numbers as a magic number, requiring
|
||
# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
|
||
# be 0x81. This works for the files I have, but maybe not for everyone's.
|
||
|
||
# Unfortunately, this magic is quite weak - MPi
|
||
#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
|
||
|
||
# MacBinary I doesn't have the version number field at all, but MacBinary II
|
||
# has been in use since 1987 so I hope there aren't many really old files
|
||
# floating around that this will miss. The original spec calls for using
|
||
# the nulls in 0, 74, and 82 as the magic number.
|
||
#
|
||
# Another possibility, that would also work for MacBinary I, is to use
|
||
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
|
||
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
|
||
# and that 74 will be 0. So something like
|
||
#
|
||
# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
|
||
#
|
||
# >73 byte&0x01 0x01 \b, inited
|
||
# >73 byte&0x02 0x02 \b, changed
|
||
# >73 byte&0x04 0x04 \b, busy
|
||
# >73 byte&0x08 0x08 \b, bozo
|
||
# >73 byte&0x10 0x10 \b, system
|
||
# >73 byte&0x10 0x20 \b, bundle
|
||
# >73 byte&0x10 0x40 \b, invisible
|
||
# >73 byte&0x10 0x80 \b, locked
|
||
|
||
#>65 string x \b, type "%4.4s"
|
||
|
||
#>65 string 8BIM (PhotoShop)
|
||
#>65 string ALB3 (PageMaker 3)
|
||
#>65 string ALB4 (PageMaker 4)
|
||
#>65 string ALT3 (PageMaker 3)
|
||
#>65 string APPL (application)
|
||
#>65 string AWWP (AppleWorks word processor)
|
||
#>65 string CIRC (simulated circuit)
|
||
#>65 string DRWG (MacDraw)
|
||
#>65 string EPSF (Encapsulated PostScript)
|
||
#>65 string FFIL (font suitcase)
|
||
#>65 string FKEY (function key)
|
||
#>65 string FNDR (Macintosh Finder)
|
||
#>65 string GIFf (GIF image)
|
||
#>65 string Gzip (GNU gzip)
|
||
#>65 string INIT (system extension)
|
||
#>65 string LIB\ (library)
|
||
#>65 string LWFN (PostScript font)
|
||
#>65 string MSBC (Microsoft BASIC)
|
||
#>65 string PACT (Compact Pro archive)
|
||
#>65 string PDF\ (Portable Document Format)
|
||
#>65 string PICT (picture)
|
||
#>65 string PNTG (MacPaint picture)
|
||
#>65 string PREF (preferences)
|
||
#>65 string PROJ (Think C project)
|
||
#>65 string QPRJ (Think Pascal project)
|
||
#>65 string SCFL (Defender scores)
|
||
#>65 string SCRN (startup screen)
|
||
#>65 string SITD (StuffIt Deluxe)
|
||
#>65 string SPn3 (SuperPaint)
|
||
#>65 string STAK (HyperCard stack)
|
||
#>65 string Seg\ (StuffIt segment)
|
||
#>65 string TARF (Unix tar archive)
|
||
#>65 string TEXT (ASCII)
|
||
#>65 string TIFF (TIFF image)
|
||
#>65 string TOVF (Eudora table of contents)
|
||
#>65 string WDBN (Microsoft Word word processor)
|
||
#>65 string WORD (MacWrite word processor)
|
||
#>65 string XLS\ (Microsoft Excel)
|
||
#>65 string ZIVM (compress (.Z))
|
||
#>65 string ZSYS (Pre-System 7 system file)
|
||
#>65 string acf3 (Aldus FreeHand)
|
||
#>65 string cdev (control panel)
|
||
#>65 string dfil (Desk Acessory suitcase)
|
||
#>65 string libr (library)
|
||
#>65 string nX^d (WriteNow word processor)
|
||
#>65 string nX^w (WriteNow dictionary)
|
||
#>65 string rsrc (resource)
|
||
#>65 string scbk (Scrapbook)
|
||
#>65 string shlb (shared library)
|
||
#>65 string ttro (SimpleText read-only)
|
||
#>65 string zsys (system file)
|
||
|
||
#>69 string x \b, creator "%4.4s"
|
||
|
||
# Somewhere, Apple has a repository of registered Creator IDs. These are
|
||
# just the ones that I happened to have files from and was able to identify.
|
||
|
||
#>69 string 8BIM (Adobe Photoshop)
|
||
#>69 string ALD3 (PageMaker 3)
|
||
#>69 string ALD4 (PageMaker 4)
|
||
#>69 string ALFA (Alpha editor)
|
||
#>69 string APLS (Apple Scanner)
|
||
#>69 string APSC (Apple Scanner)
|
||
#>69 string BRKL (Brickles)
|
||
#>69 string BTFT (BitFont)
|
||
#>69 string CCL2 (Common Lisp 2)
|
||
#>69 string CCL\ (Common Lisp)
|
||
#>69 string CDmo (The Talking Moose)
|
||
#>69 string CPCT (Compact Pro)
|
||
#>69 string CSOm (Eudora)
|
||
#>69 string DMOV (Font/DA Mover)
|
||
#>69 string DSIM (DigSim)
|
||
#>69 string EDIT (Macintosh Edit)
|
||
#>69 string ERIK (Macintosh Finder)
|
||
#>69 string EXTR (self-extracting archive)
|
||
#>69 string Gzip (GNU gzip)
|
||
#>69 string KAHL (Think C)
|
||
#>69 string LWFU (LaserWriter Utility)
|
||
#>69 string LZIV (compress)
|
||
#>69 string MACA (MacWrite)
|
||
#>69 string MACS (Macintosh operating system)
|
||
#>69 string MAcK (MacKnowledge terminal emulator)
|
||
#>69 string MLND (Defender)
|
||
#>69 string MPNT (MacPaint)
|
||
#>69 string MSBB (Microsoft BASIC (binary))
|
||
#>69 string MSWD (Microsoft Word)
|
||
#>69 string NCSA (NCSA Telnet)
|
||
#>69 string PJMM (Think Pascal)
|
||
#>69 string PSAL (Hunt the Wumpus)
|
||
#>69 string PSI2 (Apple File Exchange)
|
||
#>69 string R*ch (BBEdit)
|
||
#>69 string RMKR (Resource Maker)
|
||
#>69 string RSED (Resource Editor)
|
||
#>69 string Rich (BBEdit)
|
||
#>69 string SIT! (StuffIt)
|
||
#>69 string SPNT (SuperPaint)
|
||
#>69 string Unix (NeXT Mac filesystem)
|
||
#>69 string VIM! (Vim editor)
|
||
#>69 string WILD (HyperCard)
|
||
#>69 string XCEL (Microsoft Excel)
|
||
#>69 string aCa2 (Fontographer)
|
||
#>69 string aca3 (Aldus FreeHand)
|
||
#>69 string dosa (Macintosh MS-DOS file system)
|
||
#>69 string movr (Font/DA Mover)
|
||
#>69 string nX^n (WriteNow)
|
||
#>69 string pdos (Apple ProDOS file system)
|
||
#>69 string scbk (Scrapbook)
|
||
#>69 string ttxt (SimpleText)
|
||
#>69 string ufox (Foreign File Access)
|
||
|
||
# Just in case...
|
||
|
||
102 string mBIN MacBinary III data with surprising version number
|
||
|
||
# sas magic from Bruce Foster (bef@nwu.edu)
|
||
#
|
||
#0 string SAS SAS
|
||
#>8 string x %s
|
||
0 string SAS SAS
|
||
>24 string DATA data file
|
||
>24 string CATALOG catalog
|
||
>24 string INDEX data file index
|
||
>24 string VIEW data view
|
||
# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
|
||
#
|
||
0x54 string SAS SAS 7+
|
||
>0x9C string DATA data file
|
||
>0x9C string CATALOG catalog
|
||
>0x9C string INDEX data file index
|
||
>0x9C string VIEW data view
|
||
|
||
# spss magic for SPSS system and portable files,
|
||
# from Bruce Foster (bef@nwu.edu).
|
||
|
||
0 long 0xc1e2c3c9 SPSS Portable File
|
||
>40 string x %s
|
||
|
||
0 string $FL2 SPSS System File
|
||
>24 string x %s
|
||
|
||
# Macintosh filesystem data
|
||
# From "Tom N Harris" <telliamed@mac.com>
|
||
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
|
||
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
|
||
# entries depend on the data arithmetic added after v.35
|
||
# There's also some Pascal strings in here, ditto...
|
||
|
||
# The boot block signature, according to IM:Files, is
|
||
# "for HFS volumes, this field always contains the value 0x4C4B."
|
||
# But if this is true for MFS or HFS+ volumes, I don't know.
|
||
# Alternatively, the boot block is supposed to be zeroed if it's
|
||
# unused, so a simply >0 should suffice.
|
||
|
||
0x400 beshort 0xD2D7 Macintosh MFS data
|
||
>0 beshort 0x4C4B (bootable)
|
||
>0x40a beshort &0x8000 (locked)
|
||
>0x402 beldate-0x7C25B080 x created: %s,
|
||
>0x406 beldate-0x7C25B080 >0 last backup: %s,
|
||
>0x414 belong x block size: %d,
|
||
>0x412 beshort x number of blocks: %d,
|
||
>0x424 pstring x volume name: %s
|
||
|
||
# "BD" gives many false positives
|
||
#0x400 beshort 0x4244 Macintosh HFS data
|
||
#>0 beshort 0x4C4B (bootable)
|
||
#>0x40a beshort &0x8000 (locked)
|
||
#>0x40a beshort ^0x0100 (mounted)
|
||
#>0x40a beshort &0x0200 (spared blocks)
|
||
#>0x40a beshort &0x0800 (unclean)
|
||
#>0x47C beshort 0x482B (Embedded HFS+ Volume)
|
||
#>0x402 beldate-0x7C25B080 x created: %s,
|
||
#>0x406 beldate-0x7C25B080 x last modified: %s,
|
||
#>0x440 beldate-0x7C25B080 >0 last backup: %s,
|
||
#>0x414 belong x block size: %d,
|
||
#>0x412 beshort x number of blocks: %d,
|
||
#>0x424 pstring x volume name: %s
|
||
|
||
0x400 beshort 0x482B Macintosh HFS Extended
|
||
>&0 beshort x version %d data
|
||
>0 beshort 0x4C4B (bootable)
|
||
>0x404 belong ^0x00000100 (mounted)
|
||
>&2 belong &0x00000200 (spared blocks)
|
||
>&2 belong &0x00000800 (unclean)
|
||
>&2 belong &0x00008000 (locked)
|
||
>&6 string x last mounted by: '%.4s',
|
||
# really, that should be treated as a belong and we print a string
|
||
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
|
||
>&14 beldate-0x7C25B080 x created: %s,
|
||
# only the creation date is local time, all other timestamps in HFS+ are UTC.
|
||
>&18 bedate-0x7C25B080 x last modified: %s,
|
||
>&22 bedate-0x7C25B080 >0 last backup: %s,
|
||
>&26 bedate-0x7C25B080 >0 last checked: %s,
|
||
>&38 belong x block size: %d,
|
||
>&42 belong x number of blocks: %d,
|
||
>&46 belong x free blocks: %d
|
||
|
||
# I don't think this is really necessary since it doesn't do much and
|
||
# anything with a valid driver descriptor will also have a valid
|
||
# partition map
|
||
#0 beshort 0x4552 Apple Device Driver data
|
||
#>&24 beshort =1 \b, MacOS
|
||
|
||
# Is that the partition type a cstring or a pstring? Well, IM says "strings
|
||
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
|
||
# cstring. Of course, partitions can contain more than four entries, but
|
||
# what're you gonna do?
|
||
# GRR: This magic is too weak, it is just "PM"
|
||
#0x200 beshort 0x504D Apple Partition data
|
||
#>0x2 beshort x (block size: %d):
|
||
#>0x230 string x first type: %s,
|
||
#>0x210 string x name: %s,
|
||
#>0x254 belong x number of blocks: %d,
|
||
#>0x400 beshort 0x504D
|
||
#>>0x430 string x second type: %s,
|
||
#>>0x410 string x name: %s,
|
||
#>>0x454 belong x number of blocks: %d,
|
||
#>>0x600 beshort 0x504D
|
||
#>>>0x630 string x third type: %s,
|
||
#>>>0x610 string x name: %s,
|
||
#>>>0x654 belong x number of blocks: %d,
|
||
#>>0x800 beshort 0x504D
|
||
#>>>0x830 string x fourth type: %s,
|
||
#>>>0x810 string x name: %s,
|
||
#>>>0x854 belong x number of blocks: %d,
|
||
#>>>0xa00 beshort 0x504D
|
||
#>>>>0xa30 string x fifth type: %s,
|
||
#>>>>0xa10 string x name: %s,
|
||
#>>>>0xa54 belong x number of blocks: %d
|
||
#>>>0xc00 beshort 0x504D
|
||
#>>>>0xc30 string x sixth type: %s,
|
||
#>>>>0xc10 string x name: %s,
|
||
#>>>>0xc54 belong x number of blocks: %d
|
||
## AFAIK, only the signature is different
|
||
#0x200 beshort 0x5453 Apple Old Partition data
|
||
#>0x2 beshort x block size: %d,
|
||
#>0x230 string x first type: %s,
|
||
#>0x210 string x name: %s,
|
||
#>0x254 belong x number of blocks: %d,
|
||
#>0x400 beshort 0x504D
|
||
#>>0x430 string x second type: %s,
|
||
#>>0x410 string x name: %s,
|
||
#>>0x454 belong x number of blocks: %d,
|
||
#>>0x800 beshort 0x504D
|
||
#>>>0x830 string x third type: %s,
|
||
#>>>0x810 string x name: %s,
|
||
#>>>0x854 belong x number of blocks: %d,
|
||
#>>>0xa00 beshort 0x504D
|
||
#>>>>0xa30 string x fourth type: %s,
|
||
#>>>>0xa10 string x name: %s,
|
||
#>>>>0xa54 belong x number of blocks: %d
|
||
|
||
# From: Remi Mommsen <mommsen@slac.stanford.edu>
|
||
0 string BOMStore Mac OS X bill of materials (BOM) file
|
||
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
|
||
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
|
||
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
|
||
# don't know what they mean.
|
||
0 belong 0x100
|
||
>(0x4.L+24) beshort x
|
||
>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
|
||
>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
|
||
>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
|
||
>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
|
||
# MacOS files
|
||
#
|
||
|
||
0 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
|
||
# magic: file(1) magic for magic files
|
||
#
|
||
0 string/t #\ Magic magic text file for file(1) cmd
|
||
0 lelong 0xF11E041C magic binary file for file(1) cmd
|
||
>4 lelong x (version %d) (little endian)
|
||
0 belong 0xF11E041C magic binary file for file(1) cmd
|
||
>4 belong x (version %d) (big endian)
|
||
#------------------------------------------------------------------------------
|
||
# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
|
||
# mail.news: file(1) magic for mail and news
|
||
#
|
||
# Unfortunately, saved netnews also has From line added in some news software.
|
||
#0 string From mail text
|
||
0 string/t Relay-Version: old news text
|
||
!:mime message/rfc822
|
||
0 string/t #!\ rnews batched news text
|
||
!:mime message/rfc822
|
||
0 string/t N#!\ rnews mailed, batched news text
|
||
!:mime message/rfc822
|
||
0 string/t Forward\ to mail forwarding text
|
||
!:mime message/rfc822
|
||
0 string/t Pipe\ to mail piping text
|
||
!:mime message/rfc822
|
||
0 string/tc delivered-to: SMTP mail text
|
||
!:mime message/rfc822
|
||
0 string/tc return-path: SMTP mail text
|
||
!:mime message/rfc822
|
||
0 string/t Path: news text
|
||
!:mime message/news
|
||
0 string/t Xref: news text
|
||
!:mime message/news
|
||
0 string/t From: news or mail text
|
||
!:mime message/rfc822
|
||
0 string/t Article saved news text
|
||
!:mime message/news
|
||
0 string/t BABYL Emacs RMAIL text
|
||
0 string/t Received: RFC 822 mail text
|
||
!:mime message/rfc822
|
||
0 string/t MIME-Version: MIME entity text
|
||
#0 string/t Content- MIME entity text
|
||
|
||
# TNEF files...
|
||
0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
|
||
!:mime application/vnd.ms-tnef
|
||
|
||
# From: Kevin Sullivan <ksulliva@psc.edu>
|
||
0 string *mbx* MBX mail folder
|
||
|
||
# From: Simon Matter <simon.matter@invoca.ch>
|
||
0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
|
||
|
||
# JAM(mbp) Fidonet message area databases
|
||
# JHR file
|
||
0 string JAM\0 JAM message area header file
|
||
>12 leshort >0 (%d messages)
|
||
|
||
# Squish Fidonet message area databases
|
||
# SQD file (requires at least one message in the area)
|
||
# XXX: Weak magic
|
||
#256 leshort 0xAFAE4453 Squish message area data file
|
||
#>4 leshort >0 (%d messages)
|
||
|
||
#0 string \<!--\ MHonArc text/html; x-type=mhonarc
|
||
|
||
# Cyrus: file(1) magic for compiled Cyrus sieve scripts
|
||
# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
|
||
# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
|
||
# From: Philipp Hahn <hahn@univention.de>
|
||
|
||
# Compiled Cyrus sieve script
|
||
0 string CyrSBytecode Cyrus sieve bytecode data,
|
||
>12 belong =1 version 1, big-endian
|
||
>12 lelong =1 version 1, little-endian
|
||
>12 belong x version %d, network-endian
|
||
#------------------------------------------------------------------------------
|
||
# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $
|
||
# make: file(1) magic for makefiles
|
||
#
|
||
0 regex \^CFLAGS makefile script text
|
||
!:mime text/x-makefile
|
||
0 regex \^LDFLAGS makefile script text
|
||
!:mime text/x-makefile
|
||
0 regex \^all: makefile script text
|
||
!:mime text/x-makefile
|
||
0 regex \^.PRECIOUS makefile script text
|
||
!:mime text/x-makefile
|
||
|
||
0 regex \^SUBDIRS automake makefile script text
|
||
!:mime text/x-makefile
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
|
||
# maple: file(1) magic for maple files
|
||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||
# Maple V release 4, a multi-purpose math program
|
||
#
|
||
|
||
# maple library .lib
|
||
0 string \000MVR4\nI MapleVr4 library
|
||
|
||
# .ind
|
||
# no magic for these :-(
|
||
# they are compiled indexes for maple files
|
||
|
||
# .hdb
|
||
0 string \000\004\000\000 Maple help database
|
||
|
||
# .mhp
|
||
# this has the form <PACKAGE=name>
|
||
0 string \<PACKAGE= Maple help file
|
||
0 string \<HELP\ NAME= Maple help file
|
||
0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
|
||
#0 string #\ Newton Maple help file, old style
|
||
0 string #\ daub Maple help file, old style
|
||
#0 string #=========== Maple help file, old style
|
||
|
||
# .mws
|
||
0 string \000\000\001\044\000\221 Maple worksheet
|
||
#this is anomalous
|
||
0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
|
||
# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
|
||
# that is {VERSION major_version miunor_version computer_type version_string}
|
||
0 string {VERSION\ Maple worksheet
|
||
>9 string >\0 version %.1s.
|
||
>>11 string >\0 %.1s
|
||
|
||
# .mps
|
||
0 string \0\0\001$ Maple something
|
||
# from byte 4 it is either 'nul E' or 'soh R'
|
||
# I think 'nul E' means a file that was saved as a different name
|
||
# a sort of revision marking
|
||
# 'soh R' means new
|
||
>4 string \000\105 An old revision
|
||
>4 string \001\122 The latest save
|
||
|
||
# .mpl
|
||
# some of these are the same as .mps above
|
||
#0000000 000 000 001 044 000 105 same as .mps
|
||
#0000000 000 000 001 044 001 122 same as .mps
|
||
|
||
0 string #\n##\ <SHAREFILE= Maple something
|
||
0 string \n#\n##\ <SHAREFILE= Maple something
|
||
0 string ##\ <SHAREFILE= Maple something
|
||
0 string #\r##\ <SHAREFILE= Maple something
|
||
0 string \r#\r##\ <SHAREFILE= Maple something
|
||
0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
|
||
#--------------------------------------------
|
||
# marc21: file(1) magic for MARC 21 Format
|
||
#
|
||
# Kevin Ford (kefo@loc.gov)
|
||
#
|
||
# MARC21 formats are for the representation and communication
|
||
# of bibliographic and related information in machine-readable
|
||
# form. For more info, see http://www.loc.gov/marc/
|
||
|
||
|
||
# leader position 20-21 must be 45
|
||
20 string 45
|
||
|
||
# leader starts with 5 digits, followed by codes specific to MARC format
|
||
>0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
|
||
!:mime application/marc
|
||
>0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority
|
||
!:mime application/marc
|
||
>0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
|
||
!:mime application/marc
|
||
0 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification
|
||
!:mime application/marc
|
||
>0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community
|
||
!:mime application/marc
|
||
|
||
# leader position 22-23, should be "00" but is it?
|
||
>0 regex/1 (^.{21})([^0]{2}) (non-conforming)
|
||
!:mime application/marc
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
|
||
# mathcad: file(1) magic for Mathcad documents
|
||
# URL: http://www.mathsoft.com/
|
||
# From: Josh Triplett <josh@freedesktop.org>
|
||
|
||
0 string .MCAD\t Mathcad document
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
|
||
# mathematica: file(1) magic for mathematica files
|
||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||
# Mathematica a multi-purpose math program
|
||
# versions 2.2 and 3.0
|
||
|
||
#mathematica .mb
|
||
0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
|
||
0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
|
||
|
||
# .ma
|
||
# multiple possibilites:
|
||
|
||
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
|
||
#>41 string >\0 %s
|
||
|
||
#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
|
||
|
||
#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
|
||
#>675 string >\0 %s #doesn't work well
|
||
|
||
# there may be 'cr' instread of 'nl' in some does this matter?
|
||
|
||
# generic:
|
||
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\015 Mathematica notebook version 2.x
|
||
0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\r::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\r\n::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\n\n::[\011 Mathematica notebook version 2.x
|
||
0 string (*^\n::[\011 Mathematica notebook version 2.x
|
||
|
||
|
||
# Mathematica .mx files
|
||
|
||
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
|
||
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
|
||
#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
|
||
# >71... is optional
|
||
>88 string >\0 from %s
|
||
|
||
|
||
# Mathematica files PBF:
|
||
# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
|
||
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
|
||
|
||
# .ml files These are menu resources I think
|
||
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
|
||
# how to put that into a magic rule?
|
||
4 string \ A~ MAthematica .ml file
|
||
|
||
# .nb files
|
||
#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
|
||
0 string (*********************** Mathematica 3.0 notebook
|
||
|
||
# other (* matches it is a comment start in these langs
|
||
# GRR: Too weak; also matches other languages e.g. ML
|
||
#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
|
||
|
||
#########################
|
||
# MatLab v5
|
||
0 string MATLAB Matlab v5 mat-file
|
||
>126 short 0x494d (big endian)
|
||
>>124 beshort x version 0x%04x
|
||
>126 short 0x4d49 (little endian)
|
||
>>124 leshort x version 0x%04x
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
|
||
# matroska: file(1) magic for Matroska files
|
||
#
|
||
# See http://www.matroska.org/
|
||
#
|
||
|
||
# EBML id:
|
||
0 belong 0x1a45dfa3
|
||
# DocType id:
|
||
>4 search/4096 \x42\x82
|
||
# DocType contents:
|
||
>>&1 string webm WebM
|
||
!:mime video/webm
|
||
>>&1 string matroska Matroska data
|
||
!:mime video/x-matroska
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
|
||
# Mavroyanopoulos Nikos <nmav@hellug.gr>
|
||
# mcrypt: file(1) magic for mcrypt 2.2.x;
|
||
0 string \0m\3 mcrypt 2.5 encrypted data,
|
||
>4 string >\0 algorithm: %s,
|
||
>>&1 leshort >0 keysize: %d bytes,
|
||
>>>&0 string >\0 mode: %s,
|
||
|
||
0 string \0m\2 mcrypt 2.2 encrypted data,
|
||
>3 byte 0 algorithm: blowfish-448,
|
||
>3 byte 1 algorithm: DES,
|
||
>3 byte 2 algorithm: 3DES,
|
||
>3 byte 3 algorithm: 3-WAY,
|
||
>3 byte 4 algorithm: GOST,
|
||
>3 byte 6 algorithm: SAFER-SK64,
|
||
>3 byte 7 algorithm: SAFER-SK128,
|
||
>3 byte 8 algorithm: CAST-128,
|
||
>3 byte 9 algorithm: xTEA,
|
||
>3 byte 10 algorithm: TWOFISH-128,
|
||
>3 byte 11 algorithm: RC2,
|
||
>3 byte 12 algorithm: TWOFISH-192,
|
||
>3 byte 13 algorithm: TWOFISH-256,
|
||
>3 byte 14 algorithm: blowfish-128,
|
||
>3 byte 15 algorithm: blowfish-192,
|
||
>3 byte 16 algorithm: blowfish-256,
|
||
>3 byte 100 algorithm: RC6,
|
||
>3 byte 101 algorithm: IDEA,
|
||
>4 byte 0 mode: CBC,
|
||
>4 byte 1 mode: ECB,
|
||
>4 byte 2 mode: CFB,
|
||
>4 byte 3 mode: OFB,
|
||
>4 byte 4 mode: nOFB,
|
||
>5 byte 0 keymode: 8bit
|
||
>5 byte 1 keymode: 4bit
|
||
>5 byte 2 keymode: SHA-1 hash
|
||
>5 byte 3 keymode: MD5 hash
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
|
||
# mercurial: file(1) magic for Mercurial changeset bundles
|
||
# http://www.selenic.com/mercurial/wiki/
|
||
#
|
||
# Jesse Glick (jesse.glick@sun.com)
|
||
#
|
||
|
||
0 string HG10 Mercurial changeset bundle
|
||
>4 string UN (uncompressed)
|
||
>4 string GZ (gzip compressed)
|
||
>4 string BZ (bzip2 compressed)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
|
||
# metastore: file(1) magic for metastore files
|
||
# From: Thomas Wissen
|
||
# see http://david.hardeman.nu/software.php#metastore
|
||
0 string MeTaSt00r3 Metastore data file,
|
||
>10 bequad x version %0llx
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
|
||
# mime: file(1) magic for MIME encoded files
|
||
#
|
||
0 string/t Content-Type:\
|
||
>14 string >\0 %s
|
||
0 string/t Content-Type:
|
||
>13 string >\0 %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
|
||
# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
|
||
# and DEC Ultrix
|
||
#
|
||
0 beshort 0x0160 MIPSEB ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>22 byte x - version %ld
|
||
>23 byte x \b.%ld
|
||
#
|
||
0 beshort 0x0162 MIPSEL-BE ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %d
|
||
>22 byte x \b.%ld
|
||
#
|
||
0 beshort 0x6001 MIPSEB-LE ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %d
|
||
>22 byte x \b.%ld
|
||
#
|
||
0 beshort 0x6201 MIPSEL ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %ld
|
||
>22 byte x \b.%ld
|
||
#
|
||
# MIPS 2 additions
|
||
#
|
||
0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>22 byte x - version %ld
|
||
>23 byte x \b.%ld
|
||
#
|
||
0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>22 byte x - version %ld
|
||
>23 byte x \b.%ld
|
||
#
|
||
0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %ld
|
||
>22 byte x \b.%ld
|
||
#
|
||
0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %ld
|
||
>22 byte x \b.%ld
|
||
#
|
||
# MIPS 3 additions
|
||
#
|
||
0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>22 byte x - version %ld
|
||
>23 byte x \b.%ld
|
||
#
|
||
0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (swapped)
|
||
>20 beshort 0413 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>22 byte x - version %ld
|
||
>23 byte x \b.%ld
|
||
#
|
||
0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %ld
|
||
>22 byte x \b.%ld
|
||
#
|
||
0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
|
||
>20 beshort 03401 (impure)
|
||
>20 beshort 04001 (swapped)
|
||
>20 beshort 05401 (paged)
|
||
>8 belong >0 not stripped
|
||
>8 belong 0 stripped
|
||
>23 byte x - version %ld
|
||
>22 byte x \b.%ld
|
||
#
|
||
0 beshort 0x180 MIPSEB Ucode
|
||
0 beshort 0x182 MIPSEL-BE Ucode
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
|
||
# mirage: file(1) magic for Mirage executables
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 long 31415 Mirage Assembler m.out executable
|
||
|
||
#-----------------------------------------------------------------------------
|
||
# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $
|
||
# misctools: file(1) magic for miscellaneous UNIX tools.
|
||
#
|
||
0 search/1 %%!! X-Post-It-Note text
|
||
0 string/c BEGIN:VCALENDAR vCalendar calendar file
|
||
!:mime text/calendar
|
||
0 string/c BEGIN:VCARD vCard visiting card
|
||
!:mime text/x-vcard
|
||
|
||
# Summary: Libtool library file
|
||
# Extension: .la
|
||
# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
|
||
0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
|
||
|
||
# Summary: Libtool object file
|
||
# Extension: .lo
|
||
# Submitted by: Abel Cheung <abelcheung@gmail.com>
|
||
0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
|
||
|
||
# From: Daniel Novotny <dnovotny@redhat.com>
|
||
0 string MDMP\x93\xA7 MDMP crash report data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
|
||
# mkid: file(1) magic for mkid(1) databases
|
||
#
|
||
# ID is the binary tags database produced by mkid(1).
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 string \311\304 ID tags data
|
||
>2 short >0 version %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
|
||
# mlssa: file(1) magic for MLSSA datafiles
|
||
#
|
||
0 lelong 0xffffabcd MLSSA datafile,
|
||
>4 leshort x algorithm %d,
|
||
>10 lelong x %d samples
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
|
||
# mmdf: file(1) magic for MMDF mail files
|
||
#
|
||
0 string \001\001\001\001 MMDF mailbox
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $
|
||
# modem: file(1) magic for modem programs
|
||
#
|
||
# From: Florian La Roche <florian@knorke.saar.de>
|
||
1 string PC\ Research,\ Inc Digifax-G3-File
|
||
>29 byte 1 \b, fine resolution
|
||
>29 byte 0 \b, normal resolution
|
||
|
||
0 short 0x0100 raw G3 data, byte-padded
|
||
0 short 0x1400 raw G3 data
|
||
#
|
||
# Magic data for vgetty voice formats
|
||
# (Martin Seine & Marc Eberhard)
|
||
|
||
#
|
||
# raw modem data version 1
|
||
#
|
||
0 string RMD1 raw modem data
|
||
>4 string >\0 (%s /
|
||
>20 short >0 compression type 0x%04x)
|
||
|
||
#
|
||
# portable voice format 1
|
||
#
|
||
0 string PVF1\n portable voice format
|
||
>5 string >\0 (binary %s)
|
||
|
||
#
|
||
# portable voice format 2
|
||
#
|
||
0 string PVF2\n portable voice format
|
||
>5 string >\0 (ascii %s)
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
|
||
# motorola: file(1) magic for Motorola 68K and 88K binaries
|
||
#
|
||
# 68K
|
||
#
|
||
0 beshort 0520 mc68k COFF
|
||
>18 beshort ^00000020 object
|
||
>18 beshort &00000020 executable
|
||
>12 belong >0 not stripped
|
||
>168 string .lowmem Apple toolbox
|
||
>20 beshort 0407 (impure)
|
||
>20 beshort 0410 (pure)
|
||
>20 beshort 0413 (demand paged)
|
||
>20 beshort 0421 (standalone)
|
||
0 beshort 0521 mc68k executable (shared)
|
||
>12 belong >0 not stripped
|
||
0 beshort 0522 mc68k executable (shared demand paged)
|
||
>12 belong >0 not stripped
|
||
#
|
||
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
|
||
#
|
||
0 beshort 0554 68K BCS executable
|
||
#
|
||
# 88K
|
||
#
|
||
# Motorola/88Open BCS
|
||
#
|
||
0 beshort 0555 88K BCS executable
|
||
#
|
||
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
|
||
0 string S0 Motorola S-Record; binary data in text format
|
||
|
||
# ATARI ST relocatable PRG
|
||
#
|
||
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
|
||
# (according to Roland Waldi, Oct 21, 1987)
|
||
# besides the magic 0x601a, the text segment size is checked to be
|
||
# not larger than 1 MB (which is a lot on ST).
|
||
# The additional 0x601b distinction I took from Doug Lee's magic.
|
||
0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
|
||
>2 belong x (txt=%ld,
|
||
>6 belong x dat=%ld,
|
||
>10 belong x bss=%ld,
|
||
>14 belong x sym=%ld)
|
||
0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
|
||
>2 belong x (txt=%ld,
|
||
>6 belong x dat=%ld,
|
||
>10 belong x bss=%ld,
|
||
>14 belong x sym=%ld)
|
||
|
||
# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
|
||
0 beshort 0x601A Atari 68xxx executable,
|
||
>2 belong x text len %lu,
|
||
>6 belong x data len %lu,
|
||
>10 belong x BSS len %lu,
|
||
>14 belong x symboltab len %lu,
|
||
>18 belong 0
|
||
>22 belong &0x01 fastload flag,
|
||
>22 belong &0x02 may be loaded to alternate RAM,
|
||
>22 belong &0x04 malloc may be from alternate RAM,
|
||
>22 belong x flags: 0x%lX,
|
||
>26 beshort 0 no relocation tab
|
||
>26 beshort !0 + relocation tab
|
||
>30 string SFX [Self-Extracting LZH SFX archive]
|
||
>38 string SFX [Self-Extracting LZH SFX archive]
|
||
>44 string ZIP! [Self-Extracting ZIP SFX archive]
|
||
|
||
0 beshort 0x0064 Atari 68xxx CPX file
|
||
>8 beshort x (version %04lx)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# mozilla: file(1) magic for Mozilla XUL fastload files
|
||
# (XUL.mfasl and XPC.mfasl)
|
||
# URL: http://www.mozilla.org/
|
||
# From: Josh Triplett <josh@freedesktop.org>
|
||
|
||
0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: msdos,v 1.85 2013/03/09 22:36:00 christos Exp $
|
||
# msdos: file(1) magic for MS-DOS files
|
||
#
|
||
|
||
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
|
||
# updated by Joerg Jenderek at Oct 2008,Apr 2011
|
||
0 string/t @
|
||
>1 string/cW \ echo\ off DOS batch file text
|
||
!:mime text/x-msdos-batch
|
||
>1 string/cW echo\ off DOS batch file text
|
||
!:mime text/x-msdos-batch
|
||
>1 string/cW rem DOS batch file text
|
||
!:mime text/x-msdos-batch
|
||
>1 string/cW set\ DOS batch file text
|
||
!:mime text/x-msdos-batch
|
||
|
||
|
||
# OS/2 batch files are REXX. the second regex is a bit generic, oh well
|
||
# the matched commands seem to be common in REXX and uncommon elsewhere
|
||
100 search/0xffff rxfuncadd
|
||
>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
|
||
100 search/0xffff say
|
||
>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
|
||
|
||
0 leshort 0x14c MS Windows COFF Intel 80386 object file
|
||
#>4 ledate x stamp %s
|
||
0 leshort 0x166 MS Windows COFF MIPS R4000 object file
|
||
#>4 ledate x stamp %s
|
||
0 leshort 0x184 MS Windows COFF Alpha object file
|
||
#>4 ledate x stamp %s
|
||
0 leshort 0x268 MS Windows COFF Motorola 68000 object file
|
||
#>4 ledate x stamp %s
|
||
0 leshort 0x1f0 MS Windows COFF PowerPC object file
|
||
#>4 ledate x stamp %s
|
||
0 leshort 0x290 MS Windows COFF PA-RISC object file
|
||
#>4 ledate x stamp %s
|
||
|
||
# Tests for various EXE types.
|
||
#
|
||
# Many of the compressed formats were extraced from IDARC 1.23 source code.
|
||
#
|
||
0 string/b MZ
|
||
!:mime application/x-dosexec
|
||
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
|
||
>0x18 leshort <0x40 MS-DOS executable
|
||
# These traditional tests usually work but not always. When test quality support is
|
||
# implemented these can be turned on.
|
||
#>>0x18 leshort 0x1c (Borland compiler)
|
||
#>>0x18 leshort 0x1e (MS compiler)
|
||
|
||
# If the relocation table is 0x40 or more bytes into the file, it's definitely
|
||
# not a DOS EXE.
|
||
>0x18 leshort >0x3f
|
||
|
||
# Maybe it's a PE?
|
||
>>(0x3c.l) string PE\0\0 PE
|
||
>>>(0x3c.l+24) leshort 0x010b \b32 executable
|
||
>>>(0x3c.l+24) leshort 0x020b \b32+ executable
|
||
>>>(0x3c.l+24) leshort 0x0107 ROM image
|
||
>>>(0x3c.l+24) default x Unknown PE signature
|
||
>>>>&0 leshort x 0x%x
|
||
>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
|
||
>>>(0x3c.l+92) leshort 1 (native)
|
||
>>>(0x3c.l+92) leshort 2 (GUI)
|
||
>>>(0x3c.l+92) leshort 3 (console)
|
||
>>>(0x3c.l+92) leshort 7 (POSIX)
|
||
>>>(0x3c.l+92) leshort 9 (Windows CE)
|
||
>>>(0x3c.l+92) leshort 10 (EFI application)
|
||
>>>(0x3c.l+92) leshort 11 (EFI boot service driver)
|
||
>>>(0x3c.l+92) leshort 12 (EFI runtime driver)
|
||
>>>(0x3c.l+92) leshort 13 (EFI ROM)
|
||
>>>(0x3c.l+92) leshort 14 (XBOX)
|
||
>>>(0x3c.l+92) leshort 15 (Windows boot application)
|
||
>>>(0x3c.l+92) default x (Unknown subsystem
|
||
>>>>&0 leshort x 0x%x)
|
||
>>>(0x3c.l+4) leshort 0x14c Intel 80386
|
||
>>>(0x3c.l+4) leshort 0x166 MIPS R4000
|
||
>>>(0x3c.l+4) leshort 0x168 MIPS R10000
|
||
>>>(0x3c.l+4) leshort 0x184 Alpha
|
||
>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3
|
||
>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4
|
||
>>>(0x3c.l+4) leshort 0x1c0 ARM
|
||
>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb
|
||
>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb
|
||
>>>(0x3c.l+4) leshort 0x1f0 PowerPC
|
||
>>>(0x3c.l+4) leshort 0x200 Intel Itanium
|
||
>>>(0x3c.l+4) leshort 0x266 MIPS16
|
||
>>>(0x3c.l+4) leshort 0x268 Motorola 68000
|
||
>>>(0x3c.l+4) leshort 0x290 PA-RISC
|
||
>>>(0x3c.l+4) leshort 0x366 MIPSIV
|
||
>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU
|
||
>>>(0x3c.l+4) leshort 0xebc EFI byte code
|
||
>>>(0x3c.l+4) leshort 0x8664 x86-64
|
||
>>>(0x3c.l+4) leshort 0xc0ee MSIL
|
||
>>>(0x3c.l+4) default x Unknown processor type
|
||
>>>>&0 leshort x 0x%x
|
||
>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
|
||
>>>(0x3c.l+22) leshort&0x1000 >0 system file
|
||
>>>(0x3c.l+24) leshort 0x010b
|
||
>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
|
||
>>>(0x3c.l+24) leshort 0x020b
|
||
>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly
|
||
|
||
# hooray, there's a DOS extender using the PE format, with a valid PE
|
||
# executable inside (which just prints a message and exits if run in win)
|
||
>>>(8.s*16) string 32STUB \b, 32rtm DOS extender
|
||
>>>(8.s*16) string !32STUB \b, for MS Windows
|
||
>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
|
||
>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
|
||
>>>(0x3c.l+0xf8) search/0x140 UPX2
|
||
>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
|
||
>>>(0x3c.l+0xf8) search/0x140 .idata
|
||
>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
|
||
>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
|
||
>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
|
||
>>>(0x3c.l+0xf8) search/0x140 .rsrc
|
||
>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
|
||
>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
|
||
>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
|
||
>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
|
||
>>>(0x3c.l+0xf8) search/0x140 .data
|
||
>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
|
||
>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
|
||
>>>>(0x3c.l+0xf7) byte x
|
||
>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
|
||
>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
|
||
>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
|
||
>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
|
||
>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
|
||
>>>0x30 string Inno \b, InnoSetup self-extracting archive
|
||
|
||
# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
|
||
# must be one of the unusual subformats.
|
||
>>(0x3c.l) string !PE\0\0 MS-DOS executable
|
||
|
||
>>(0x3c.l) string NE \b, NE
|
||
>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
|
||
>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
|
||
>>>(0x3c.l+0x36) byte 3 for MS-DOS
|
||
>>>(0x3c.l+0x36) byte 4 for Windows 386
|
||
>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services
|
||
>>>(0x3c.l+0x36) default x
|
||
>>>>(0x3c.l+0x36) byte x (unknown OS %x)
|
||
>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
|
||
>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
|
||
>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
|
||
>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
|
||
>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
|
||
|
||
>>(0x3c.l) string LX\0\0 \b, LX
|
||
>>>(0x3c.l+0x0a) leshort <1 (unknown OS)
|
||
>>>(0x3c.l+0x0a) leshort 1 for OS/2
|
||
>>>(0x3c.l+0x0a) leshort 2 for MS Windows
|
||
>>>(0x3c.l+0x0a) leshort 3 for DOS
|
||
>>>(0x3c.l+0x0a) leshort >3 (unknown OS)
|
||
>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
|
||
>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
|
||
>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
|
||
>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
|
||
>>>(0x3c.l+0x08) leshort 1 i80286
|
||
>>>(0x3c.l+0x08) leshort 2 i80386
|
||
>>>(0x3c.l+0x08) leshort 3 i80486
|
||
>>>(8.s*16) string emx \b, emx
|
||
>>>>&1 string x %s
|
||
>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
|
||
|
||
# MS Windows system file, supposedly a collection of LE executables
|
||
>>(0x3c.l) string W3 \b, W3 for MS Windows
|
||
|
||
>>(0x3c.l) string LE\0\0 \b, LE executable
|
||
>>>(0x3c.l+0x0a) leshort 1
|
||
# some DOS extenders use LE files with OS/2 header
|
||
>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
|
||
>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
|
||
>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
|
||
>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
|
||
>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
|
||
>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
|
||
>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
|
||
# this is a wild guess; hopefully it is a specific signature
|
||
>>>>&0x24 lelong <0x50
|
||
>>>>>(&0x4c.l) string \xfc\xb8WATCOM
|
||
>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
|
||
# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
|
||
#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
|
||
# fails with DOS-Extenders.
|
||
>>>(0x3c.l+0x0a) leshort 2 for MS Windows
|
||
>>>(0x3c.l+0x0a) leshort 3 for DOS
|
||
>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
|
||
>>>(&0x7c.l+0x26) string UPX \b, UPX compressed
|
||
>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
|
||
|
||
# looks like ASCII, probably some embedded copyright message.
|
||
# and definitely not NE/LE/LX/PE
|
||
>>0x3c lelong >0x20000000
|
||
>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
|
||
# header data too small for extended executable
|
||
>2 long !0
|
||
>>0x18 leshort <0x40
|
||
>>>(4.s*512) leshort !0x014c
|
||
|
||
>>>>&(2.s-514) string !LE
|
||
>>>>>&-2 string !BW \b, MZ for MS-DOS
|
||
>>>>&(2.s-514) string LE \b, LE
|
||
>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
|
||
# educated guess since indirection is still not capable enough for complex offset
|
||
# calculations (next embedded executable would be at &(&2*512+&0-2)
|
||
# I suspect there are only LE executables in these multi-exe files
|
||
>>>>&(2.s-514) string BW
|
||
>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
|
||
>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
|
||
|
||
# This sequence skips to the first COFF segment, usually .text
|
||
>(4.s*512) leshort 0x014c \b, COFF
|
||
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
|
||
>>(8.s*16) string emx
|
||
>>>&1 string x for DOS, Win or OS/2, emx %s
|
||
>>&(&0x42.l-3) byte x
|
||
>>>&0x26 string UPX \b, UPX compressed
|
||
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
|
||
>>&0x2c search/0xa0 .text
|
||
>>>&0x0b lelong <0x2000
|
||
>>>>&0 lelong >0x6000 \b, 32lite compressed
|
||
|
||
>(8.s*16) string $WdX \b, WDos/X DOS extender
|
||
|
||
# By now an executable type should have been printed out. The executable
|
||
# may be a self-uncompressing archive, so look for evidence of that and
|
||
# print it out.
|
||
#
|
||
# Some signatures below from Greg Roelofs, newt@uchicago.edu.
|
||
#
|
||
>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
|
||
>0xe7 string LH/2\ Self-Extract \b, %s
|
||
>0x1c string UC2X \b, UCEXE compressed
|
||
>0x1c string WWP\ \b, WWPACK compressed
|
||
>0x1c string RJSX \b, ARJ self-extracting archive
|
||
>0x1c string diet \b, diet compressed
|
||
>0x1c string LZ09 \b, LZEXE v0.90 compressed
|
||
>0x1c string LZ91 \b, LZEXE v0.91 compressed
|
||
>0x1c string tz \b, TinyProg compressed
|
||
>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive
|
||
!:mime application/zip
|
||
# Yes, this really is "Copr", not "Corp."
|
||
>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive
|
||
!:mime application/zip
|
||
# winarj stores a message in the stub instead of the sig in the MZ header
|
||
>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
|
||
>0x20 string AIN
|
||
>>0x23 string 2 \b, AIN 2.x compressed
|
||
>>0x23 string <2 \b, AIN 1.x compressed
|
||
>>0x23 string >2 \b, AIN 1.x compressed
|
||
>0x24 string LHa's\ SFX \b, LHa self-extracting archive
|
||
!:mime application/x-lha
|
||
>0x24 string LHA's\ SFX \b, LHa self-extracting archive
|
||
!:mime application/x-lha
|
||
>0x24 string \ $ARX \b, ARX self-extracting archive
|
||
>0x24 string \ $LHarc \b, LHarc self-extracting archive
|
||
>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
|
||
>0x40 string aPKG \b, aPackage self-extracting archive
|
||
>0x64 string W\ Collis\0\0 \b, Compack compressed
|
||
>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
|
||
>>&0xf4 search/0x140 \x0\x40\x1\x0
|
||
>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
|
||
>1638 string -lh5- \b, LHa self-extracting archive v2.13S
|
||
>0x17888 string Rar! \b, RAR self-extracting archive
|
||
|
||
# Skip to the end of the EXE. This will usually work fine in the PE case
|
||
# because the MZ image is hardcoded into the toolchain and almost certainly
|
||
# won't match any of these signatures.
|
||
>(4.s*512) long x
|
||
>>&(2.s-517) byte x
|
||
>>>&0 string PK\3\4 \b, ZIP self-extracting archive
|
||
>>>&0 string Rar! \b, RAR self-extracting archive
|
||
>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
|
||
>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
|
||
>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
|
||
>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
|
||
>>>&7 search/400 **ACE** \b, ACE self-extracting archive
|
||
>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
|
||
|
||
# a few unknown ZIP sfxes, no idea if they are needed or if they are
|
||
# already captured by the generic patterns above
|
||
>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
|
||
# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
|
||
#
|
||
|
||
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
|
||
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
|
||
>>49824 leshort =1 \b, 1 file
|
||
>>49824 leshort >1 \b, %u files
|
||
|
||
# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
|
||
# and http://www.freedos.org/software/?prog=kpdos
|
||
# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
|
||
0 string/b KCF FreeDOS KEYBoard Layout collection
|
||
# only version=0x100 found
|
||
>3 uleshort x \b, version 0x%x
|
||
# length of string containing author,info and special characters
|
||
>6 ubyte >0
|
||
#>>6 pstring x \b, name=%s
|
||
>>7 string >\0 \b, author=%-.14s
|
||
>>7 search/254 \xff \b, info=
|
||
#>>>&0 string x \b%-s
|
||
>>>&0 string x \b%-.15s
|
||
# for FreeDOS *.KL files
|
||
0 string/b KLF FreeDOS KEYBoard Layout file
|
||
# only version=0x100 or 0x101 found
|
||
>3 uleshort x \b, version 0x%x
|
||
# stringlength
|
||
>5 ubyte >0
|
||
>>8 string x \b, name=%-.2s
|
||
0 string \xffKEYB\ \ \ \0\0\0\0
|
||
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
|
||
|
||
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
|
||
# Uncommenting only the first two lines will cover about 2/3 of COM files,
|
||
# but it isn't feasible to match all COM files since there must be at least
|
||
# two dozen different one-byte "magics".
|
||
# test too generic ?
|
||
0 byte 0xe9 DOS executable (COM)
|
||
>0x1FE leshort 0xAA55 \b, boot code
|
||
>6 string SFX\ of\ LHarc (%s)
|
||
|
||
# DOS device driver updated by Joerg Jenderek at May 2011
|
||
# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
|
||
0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
|
||
>40 search/7 UPX! \bUPX compressed
|
||
# DOS device driver attributes
|
||
>4 uleshort&0x8000 0x0000 \bblock device driver
|
||
# character device
|
||
>4 uleshort&0x8000 0x8000 \b
|
||
>>4 uleshort&0x0008 0x0008 \bclock
|
||
# fast video output by int 29h
|
||
>>4 uleshort&0x0010 0x0010 \bfast
|
||
# standard input/output device
|
||
>>4 uleshort&0x0003 >0 \bstandard
|
||
>>>4 uleshort&0x0001 0x0001 \binput
|
||
>>>4 uleshort&0x0003 0x0003 \b/
|
||
>>>4 uleshort&0x0002 0x0002 \boutput
|
||
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
|
||
>0 ubyte x
|
||
# upx compressed device driver has garbage instead of real in name field of header
|
||
>>40 search/7 UPX!
|
||
>>40 default x
|
||
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
|
||
>>>12 ubyte >0x27 \b
|
||
>>>>10 ubyte >0x20
|
||
>>>>>10 ubyte !0x2E
|
||
>>>>>>10 ubyte !0x2A \b%c
|
||
>>>>11 ubyte >0x20
|
||
>>>>>11 ubyte !0x2E \b%c
|
||
>>>>12 ubyte >0x20
|
||
>>>>>12 ubyte !0x39
|
||
>>>>>>12 ubyte !0x2E \b%c
|
||
>>>13 ubyte >0x20
|
||
>>>>13 ubyte !0x2E \b%c
|
||
>>>>14 ubyte >0x20
|
||
>>>>>14 ubyte !0x2E \b%c
|
||
>>>>15 ubyte >0x20
|
||
>>>>>15 ubyte !0x2E \b%c
|
||
>>>>16 ubyte >0x20
|
||
>>>>>16 ubyte !0x2E
|
||
>>>>>>16 ubyte <0xCB \b%c
|
||
>>>>17 ubyte >0x20
|
||
>>>>>17 ubyte !0x2E
|
||
>>>>>>17 ubyte <0x90 \b%c
|
||
# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
|
||
>>>4 uleshort&0x8000 0x8000
|
||
>>>>12 ubyte <0x2F
|
||
# they have their real name at offset 22
|
||
>>>>>22 string >\0 \b%-.5s
|
||
>4 uleshort&0x8000 0x0000
|
||
# 32 bit sector adressing ( > 32 MB) for block devices
|
||
>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
|
||
# support by driver functions 13h, 17h, 18h
|
||
>4 uleshort&0x0040 0x0040 \b,IOCTL-
|
||
# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
|
||
>4 uleshort&0x0800 0x0800 \b,close media-
|
||
# output until busy support by int 10h for character device driver
|
||
>4 uleshort&0x8000 0x8000
|
||
>>4 uleshort&0x2000 0x2000 \b,until busy-
|
||
# direct read/write support by driver functions 03h,0Ch
|
||
>4 uleshort&0x4000 0x4000 \b,control strings-
|
||
>4 uleshort&0x8000 0x8000
|
||
>>4 uleshort&0x6840 >0 \bsupport
|
||
>4 uleshort&0x8000 0x0000
|
||
>>4 uleshort&0x4842 >0 \bsupport
|
||
>0 ubyte x \b)
|
||
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
|
||
# Too weak, matches files that only contain 0's
|
||
#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
|
||
#>4 uleshort&0x8000 0x8000 \bcharacter device driver
|
||
#>>10 string x %-.8s
|
||
#>4 uleshort&0x4000 0x4000 \b,control strings-support)
|
||
|
||
# test too generic ?
|
||
0 byte 0x8c DOS executable (COM)
|
||
# updated by Joerg Jenderek at Oct 2008
|
||
0 ulelong 0xffff10eb DR-DOS executable (COM)
|
||
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
|
||
0 ubeshort&0xeb8d >0xeb00
|
||
# DR-DOS STACKER.COM SCREATE.SYS missed
|
||
>0 byte 0xeb
|
||
>>0x1FE leshort 0xAA55 DOS executable (COM), boot code
|
||
>>85 string UPX DOS executable (COM), UPX compressed
|
||
>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
|
||
>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
|
||
>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
|
||
# updated by Joerg Jenderek at Oct 2008
|
||
#0 byte 0xb8 COM executable
|
||
0 uleshort&0x80ff 0x00b8
|
||
# modified by Joerg Jenderek
|
||
>1 lelong !0x21cd4cff COM executable for DOS
|
||
# http://syslinux.zytor.com/comboot.php
|
||
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
|
||
# start with assembler instructions mov eax,21cd4cffh
|
||
0 uleshort&0xc0ff 0xc0b8
|
||
>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
|
||
# syslinux:doc/comboot.txt
|
||
# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
|
||
# eax,21cd4cfeh) as a magic number.
|
||
0 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R)
|
||
# start with assembler instructions mov eax,21cd4cfeh
|
||
0 uleshort&0xc0ff 0xc0b8
|
||
>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable)
|
||
0 string/b \x81\xfc
|
||
>4 string \x77\x02\xcd\x20\xb9
|
||
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
|
||
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
|
||
# added by Joerg Jenderek at Oct 2008
|
||
# GRR search is not working
|
||
#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
|
||
34 string UPX! FREE-DOS executable (COM), UPX compressed
|
||
35 string UPX! FREE-DOS executable (COM), UPX compressed
|
||
# GRR search is not working
|
||
#2 search/28 \xcd\x21 COM executable for MS-DOS
|
||
#WHICHFAT.cOM
|
||
2 string \xcd\x21 COM executable for DOS
|
||
#DELTREE.cOM DELTREE2.cOM
|
||
4 string \xcd\x21 COM executable for DOS
|
||
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
|
||
5 string \xcd\x21 COM executable for DOS
|
||
#DELTMP.COm HASFAT32.cOM
|
||
7 string \xcd\x21
|
||
>0 byte !0xb8 COM executable for DOS
|
||
#COMP.cOM MORE.COm
|
||
10 string \xcd\x21
|
||
>5 string !\xcd\x21 COM executable for DOS
|
||
#comecho.com
|
||
13 string \xcd\x21 COM executable for DOS
|
||
#HELP.COm EDIT.coM
|
||
18 string \xcd\x21 COM executable for MS-DOS
|
||
#NWRPLTRM.COm
|
||
23 string \xcd\x21 COM executable for MS-DOS
|
||
#LOADFIX.cOm LOADFIX.cOm
|
||
30 string \xcd\x21 COM executable for MS-DOS
|
||
#syslinux.com 3.11
|
||
70 string \xcd\x21 COM executable for DOS
|
||
# many compressed/converted COMs start with a copy loop instead of a jump
|
||
0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
|
||
0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
|
||
>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
|
||
0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
|
||
# FIXME: missing diet .com compression
|
||
|
||
# miscellaneous formats
|
||
0 string/b LZ MS-DOS executable (built-in)
|
||
#0 byte 0xf0 MS-DOS program library data
|
||
#
|
||
|
||
# AAF files:
|
||
# <stuartc@rd.bbc.co.uk> Stuart Cunningham
|
||
0 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
|
||
>30 byte 9 (512B sectors)
|
||
>30 byte 12 (4kB sectors)
|
||
0 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
|
||
>30 byte 9 (512B sectors)
|
||
>30 byte 12 (4kB sectors)
|
||
|
||
# Popular applications
|
||
2080 string Microsoft\ Word\ 6.0\ Document %s
|
||
!:mime application/msword
|
||
2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
|
||
!:mime application/msword
|
||
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
|
||
2112 string MSWordDoc Microsoft Word document data
|
||
!:mime application/msword
|
||
#
|
||
0 belong 0x31be0000 Microsoft Word Document
|
||
!:mime application/msword
|
||
#
|
||
0 string/b PO^Q` Microsoft Word 6.0 Document
|
||
!:mime application/msword
|
||
#
|
||
0 string/b \376\067\0\043 Microsoft Office Document
|
||
!:mime application/msword
|
||
0 string/b \333\245-\0\0\0 Microsoft Office Document
|
||
!:mime application/msword
|
||
512 string/b \354\245\301 Microsoft Word Document
|
||
!:mime application/msword
|
||
|
||
#
|
||
0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
|
||
!:mime application/msword
|
||
#
|
||
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
|
||
!:mime application/vnd.ms-excel
|
||
#
|
||
0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
|
||
!:mime application/msword
|
||
|
||
2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
|
||
!:mime application/vnd.ms-excel
|
||
#
|
||
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
|
||
2114 string Biff5 Microsoft Excel 5.0 Worksheet
|
||
!:mime application/vnd.ms-excel
|
||
# Italian MS-Excel
|
||
2121 string Biff5 Microsoft Excel 5.0 Worksheet
|
||
!:mime application/vnd.ms-excel
|
||
0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
|
||
!:mime application/vnd.ms-excel
|
||
#
|
||
0 belong 0x00001a00 Lotus 1-2-3
|
||
!:mime application/x-123
|
||
>4 belong 0x00100400 wk3 document data
|
||
>4 belong 0x02100400 wk4 document data
|
||
>4 belong 0x07800100 fm3 or fmb document data
|
||
>4 belong 0x07800000 fm3 or fmb document data
|
||
#
|
||
0 belong 0x00000200 Lotus 1-2-3
|
||
!:mime application/x-123
|
||
>4 belong 0x06040600 wk1 document data
|
||
>4 belong 0x06800200 fmt document data
|
||
0 string/b WordPro\0 Lotus WordPro
|
||
!:mime application/vnd.lotus-wordpro
|
||
0 string/b WordPro\r\373 Lotus WordPro
|
||
!:mime application/vnd.lotus-wordpro
|
||
|
||
|
||
# Summary: Script used by InstallScield to uninstall applications
|
||
# Extension: .isu
|
||
# Submitted by: unknown
|
||
# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
|
||
0 string \x71\xa8\x00\x00\x01\x02
|
||
>12 string Stirling\ Technologies, InstallShield Uninstall Script
|
||
|
||
# Winamp .avs
|
||
#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
|
||
0 string/b Nullsoft\ AVS\ Preset\ Winamp plug in
|
||
|
||
# Windows Metafont .WMF
|
||
0 string/b \327\315\306\232 ms-windows metafont .wmf
|
||
0 string/b \002\000\011\000 ms-windows metafont .wmf
|
||
0 string/b \001\000\011\000 ms-windows metafont .wmf
|
||
|
||
#tz3 files whatever that is (MS Works files)
|
||
0 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file
|
||
0 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file
|
||
0 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file
|
||
|
||
# PGP sig files .sig
|
||
#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
|
||
0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
|
||
|
||
# windows zips files .dmf
|
||
0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
|
||
|
||
|
||
#ico files
|
||
0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
|
||
|
||
# Windows icons (Ian Springer <ips@fpk.hp.com>)
|
||
0 string/b \000\000\001\000 MS Windows icon resource
|
||
!:mime image/x-icon
|
||
>4 byte 1 - 1 icon
|
||
>4 byte >1 - %d icons
|
||
>>6 byte >0 \b, %dx
|
||
>>>7 byte >0 \b%d
|
||
>>8 byte 0 \b, 256-colors
|
||
>>8 byte >0 \b, %d-colors
|
||
|
||
|
||
# .chr files
|
||
0 string/b PK\010\010BGI Borland font
|
||
>4 string >\0 %s
|
||
# then there is a copyright notice
|
||
|
||
|
||
# .bgi files
|
||
0 string/b pk\010\010BGI Borland device
|
||
>4 string >\0 %s
|
||
# then there is a copyright notice
|
||
|
||
|
||
# Windows Recycle Bin record file (named INFO2)
|
||
# By Abel Cheung (abelcheung AT gmail dot com)
|
||
# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
|
||
# Since Vista uses another structure, INFO2 structure probably won't change
|
||
# anymore. Detailed analysis in:
|
||
# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
|
||
0 lelong 0x00000004
|
||
>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
|
||
|
||
0 lelong 0x00000005
|
||
>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
|
||
|
||
|
||
##### put in Either Magic/font or Magic/news
|
||
# Acroread or something files wrongly identified as G3 .pfm
|
||
# these have the form \000 \001 any? \002 \000 \000
|
||
# or \000 \001 any? \022 \000 \000
|
||
0 belong&0xffff00ff 0x00010012 PFM data
|
||
>4 string \000\000
|
||
>6 string >\060 - %s
|
||
|
||
0 belong&0xffff00ff 0x00010002 PFM data
|
||
>4 string \000\000
|
||
>6 string >\060 - %s
|
||
#0 string \000\001 pfm?
|
||
#>3 string \022\000\000Copyright\ yes
|
||
#>3 string \002\000\000Copyright\ yes
|
||
#>3 string >\0 oops, not a font file. Cancel that.
|
||
#it clashes with ttf files so put it lower down.
|
||
|
||
# From Doug Lee via a FreeBSD pr
|
||
9 string GERBILDOC First Choice document
|
||
9 string GERBILDB First Choice database
|
||
9 string GERBILCLIP First Choice database
|
||
0 string GERBIL First Choice device file
|
||
9 string RABBITGRAPH RabbitGraph file
|
||
0 string DCU1 Borland Delphi .DCU file
|
||
0 string =!<spell> MKS Spell hash list (old format)
|
||
0 string =!<spell2> MKS Spell hash list
|
||
# Too simple - MPi
|
||
#0 string AH Halo(TM) bitmapped font file
|
||
0 lelong 0x08086b70 TurboC BGI file
|
||
0 lelong 0x08084b50 TurboC Font file
|
||
|
||
# tests for DBase files moved, updated and merged to database
|
||
|
||
0 string PMCC Windows 3.x .GRP file
|
||
1 string RDC-meg MegaDots
|
||
>8 byte >0x2F version %c
|
||
>9 byte >0x2F \b.%c file
|
||
0 lelong 0x4C
|
||
>4 lelong 0x00021401 Windows shortcut file
|
||
|
||
# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
|
||
# only for windows versions equal or greater 3.0
|
||
0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File
|
||
!:mime application/x-dosexec
|
||
#>2 string >\0 \b, Title:%.30s
|
||
>0x24 string >\0 \b for %.63s
|
||
>0x65 string >\0 \b, directory=%.64s
|
||
>0xA5 string >\0 \b, parameters=%.64s
|
||
#>0x181 leshort x \b, offset %x
|
||
#>0x183 leshort x \b, offsetdata %x
|
||
#>0x185 leshort x \b, section length %x
|
||
>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
|
||
>>&0x5e ubyte >0
|
||
>>>&-1 string <PIFMGR.DLL \b, icon=%s
|
||
#>>>&-1 string PIFMGR.DLL \b, icon=%s
|
||
>>>&-1 string >PIFMGR.DLL \b, icon=%s
|
||
>>&0xF0 ubyte >0
|
||
>>>&-1 string <Terminal \b, font=%.32s
|
||
#>>>&-1 string =Terminal \b, font=%.32s
|
||
>>>&-1 string >Terminal \b, font=%.32s
|
||
>>&0x110 ubyte >0
|
||
>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
|
||
#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
|
||
>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
|
||
#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style
|
||
#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style
|
||
>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style
|
||
#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style
|
||
>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS
|
||
#>>&06 string x \b:%s
|
||
>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT
|
||
#>>&06 string x \b:%s
|
||
|
||
# DOS EPS Binary File Header
|
||
# From: Ed Sznyter <ews@Black.Market.NET>
|
||
0 belong 0xC5D0D3C6 DOS EPS Binary File
|
||
>4 long >0 Postscript starts at byte %d
|
||
>>8 long >0 length %d
|
||
>>>12 long >0 Metafile starts at byte %d
|
||
>>>>16 long >0 length %d
|
||
>>>20 long >0 TIFF starts at byte %d
|
||
>>>>24 long >0 length %d
|
||
|
||
# TNEF magic From "Joomy" <joomy@se-ed.net>
|
||
# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
|
||
0 leshort 0x223e9f78 TNEF
|
||
!:mime application/vnd.ms-tnef
|
||
|
||
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
|
||
# of http://www.4dos.info/
|
||
# pointer,HelpID[8]=4DHnnnmm
|
||
0 ulelong 0x48443408 4DOS help file
|
||
>4 string x \b, version %-4.4s
|
||
|
||
# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
|
||
0 ulequad 0x3a000000024e4c MS Advisor help file
|
||
|
||
# HtmlHelp files (.chm)
|
||
0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
|
||
|
||
# GFA-BASIC (Wolfram Kleff)
|
||
2 string/b GFA-BASIC3 GFA-BASIC 3 data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
|
||
# Microsoft Cabinet files
|
||
0 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data
|
||
!:mime application/vnd.ms-cab-compressed
|
||
>8 lelong x \b, %u bytes
|
||
>28 leshort 1 \b, 1 file
|
||
>28 leshort >1 \b, %u files
|
||
|
||
# InstallShield Cabinet files
|
||
0 string/b ISc( InstallShield Cabinet archive data
|
||
>5 byte&0xf0 =0x60 version 6,
|
||
>5 byte&0xf0 !0x60 version 4/5,
|
||
>(12.l+40) lelong x %u files
|
||
|
||
# Windows CE package files
|
||
0 string/b MSCE\0\0\0\0 Microsoft WinCE install header
|
||
>20 lelong 0 \b, architecture-independent
|
||
>20 lelong 103 \b, Hitachi SH3
|
||
>20 lelong 104 \b, Hitachi SH4
|
||
>20 lelong 0xA11 \b, StrongARM
|
||
>20 lelong 4000 \b, MIPS R4000
|
||
>20 lelong 10003 \b, Hitachi SH3
|
||
>20 lelong 10004 \b, Hitachi SH3E
|
||
>20 lelong 10005 \b, Hitachi SH4
|
||
>20 lelong 70001 \b, ARM 7TDMI
|
||
>52 leshort 1 \b, 1 file
|
||
>52 leshort >1 \b, %u files
|
||
>56 leshort 1 \b, 1 registry entry
|
||
>56 leshort >1 \b, %u registry entries
|
||
|
||
|
||
# Windows Enhanced Metafile (EMF)
|
||
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
|
||
# for further information.
|
||
0 ulelong 1
|
||
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
|
||
>>44 ulelong x version 0x%x
|
||
|
||
# From: Alex Beregszaszi <alex@fsn.hu>
|
||
0 string/b COWD VMWare3
|
||
>4 byte 3 disk image
|
||
>>32 lelong x (%d/
|
||
>>36 lelong x \b%d/
|
||
>>40 lelong x \b%d)
|
||
>4 byte 2 undoable disk image
|
||
>>32 string >\0 (%s)
|
||
|
||
0 string/b VMDK VMware4 disk image
|
||
0 string/b KDMV VMware4 disk image
|
||
|
||
#--------------------------------------------------------------------
|
||
# Qemu Emulator Images
|
||
# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
|
||
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
|
||
# Made by reading sources, reading documentation, and doing trial and error
|
||
# on existing QCOW files
|
||
0 string/b QFI\xFB QEMU QCOW Image
|
||
|
||
# Uncomment the following line to display Magic (only used for debugging
|
||
# this magic number)
|
||
#>0 string/b x , Magic: %s
|
||
|
||
# There are currently 2 Versions: "1" and "2".
|
||
# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
|
||
>4 belong 1 (v1)
|
||
|
||
# Using the existence of the Backing File Offset to determine whether
|
||
# to read Backing File Information
|
||
>>12 belong >0 \b, has backing file (
|
||
# Note that this isn't a null-terminated string; the length is actually
|
||
# (16.L). Assuming a null-terminated string happens to work usually, but it
|
||
# may spew junk until it reaches a \0 in some cases.
|
||
>>>(12.L) string >\0 \bpath %s
|
||
|
||
# Modification time of the Backing File
|
||
# Really useful if you want to know if your backing
|
||
# file is still usable together with this image
|
||
>>>>20 bedate >0 \b, mtime %s)
|
||
>>>>20 default x \b)
|
||
|
||
# Size is stored in bytes in a big-endian u64.
|
||
>>24 bequad x \b, %lld bytes
|
||
|
||
# 1 for AES encryption, 0 for none.
|
||
>>36 belong 1 \b, AES-encrypted
|
||
|
||
# http://www.gnome.org/~markmc/qcow-image-format.html
|
||
>4 belong 2 (v2)
|
||
# Using the existence of the Backing File Offset to determine whether
|
||
# to read Backing File Information
|
||
>>8 bequad >0 \b, has backing file
|
||
# Note that this isn't a null-terminated string; the length is actually
|
||
# (16.L). Assuming a null-terminated string happens to work usually, but it
|
||
# may spew junk until it reaches a \0 in some cases. Also, since there's no
|
||
# .Q modifier, we just use the bottom four bytes as an offset. Note that if
|
||
# the file is over 4G, and the backing file path is stored after the first 4G,
|
||
# the wrong filename will be printed. (This should be (8.Q), when that syntax
|
||
# is introduced.)
|
||
>>>(12.L) string >\0 (path %s)
|
||
>>24 bequad x \b, %lld bytes
|
||
>>32 belong 1 \b, AES-encrypted
|
||
|
||
>4 default x (unknown version)
|
||
|
||
0 string/b QEVM QEMU suspend to disk image
|
||
|
||
# QEMU QED Image
|
||
# http://wiki.qemu.org/Features/QED/Specification
|
||
0 string/b QED\0 QEMU QED Image
|
||
|
||
# VDI Image
|
||
64 string/b \x7f\x10\xda\xbe VDI Image
|
||
>68 string/b \x01\x00\x01\x00 version 1.1
|
||
>0 string >\0 (%s)
|
||
>368 lequad x \b, %lld bytes
|
||
|
||
0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
|
||
>32 string x type %s,
|
||
>48 string x subtype %s
|
||
|
||
0 lelong 0x02468ace Bochs Sparse disk image
|
||
|
||
# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
|
||
# False positive with PPT (also currently this string is too long)
|
||
#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
|
||
0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document
|
||
#>48 byte 0x1B Excel Document
|
||
#!:mime application/vnd.ms-excel
|
||
>546 string bjbj Microsoft Word Document
|
||
!:mime application/msword
|
||
>546 string jbjb Microsoft Word Document
|
||
!:mime application/msword
|
||
|
||
0 string/b \224\246\056 Microsoft Word Document
|
||
!:mime application/msword
|
||
|
||
512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
|
||
!:mime application/msword
|
||
|
||
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
||
# Magic type for Dell's BIOS .hdr files
|
||
# Dell's .hdr
|
||
0 string/b $RBU
|
||
>23 string Dell %s system BIOS
|
||
>5 byte 2
|
||
>>48 byte x version %d.
|
||
>>49 byte x \b%d.
|
||
>>50 byte x \b%d
|
||
>5 byte <2
|
||
>>48 string x version %.3s
|
||
|
||
# Type: Microsoft DirectDraw Surface
|
||
# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
|
||
# From: Morten Hustveit <morten@debian.org>
|
||
0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
|
||
>16 lelong >0 %hd x
|
||
>12 lelong >0 %hd,
|
||
>84 string x %.4s
|
||
|
||
# Type: Microsoft Document Imaging Format (.mdi)
|
||
# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
|
||
# From: Daniele Sempione <scrows@oziosi.org>
|
||
0 short 0x5045 Microsoft Document Imaging Format
|
||
|
||
# MS eBook format (.lit)
|
||
0 string/b ITOLITLS Microsoft Reader eBook Data
|
||
>8 lelong x \b, version %u
|
||
!:mime application/x-ms-reader
|
||
|
||
# Windows CE Binary Image Data Format
|
||
# From: Dr. Jesus <j@hug.gs>
|
||
0 string/b B000FF\n Windows Embedded CE binary image
|
||
|
||
# Windows Imaging (WIM) Image
|
||
0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
|
||
|
||
# The second byte of these signatures is a file version; I don't know what,
|
||
# if anything, produced files with version numbers 0-2.
|
||
# From: John Elliott <johne@seasip.demon.co.uk>
|
||
0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
|
||
0 string \xfc\x04\x00 Mallard BASIC program data (v1.29+)
|
||
0 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11)
|
||
0 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+)
|
||
|
||
0 string MIOPEN Mallard BASIC Jetsam data
|
||
0 string Jetsam0 Mallard BASIC Jetsam index data
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $
|
||
# msooxml: file(1) magic for Microsoft Office XML
|
||
# From: Ralf Brown <ralf.brown@gmail.com>
|
||
|
||
# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
|
||
# archive. The first member file is normally "[Content_Types].xml".
|
||
# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
|
||
# file of ePub or OpenDocument, we'll have to scan for a filename
|
||
# which can distinguish between the three types
|
||
|
||
# start by checking for ZIP local file header signature
|
||
0 string PK\003\004
|
||
# make sure the first file is correct
|
||
>0x1E string [Content_Types].xml
|
||
# skip to the second local file header
|
||
# since some documents include a 520-byte extra field following the file
|
||
# header, we need to scan for the next header
|
||
>>(18.l+49) search/2000 PK\003\004
|
||
# now skip to the *third* local file header; again, we need to scan due to a
|
||
# 520-byte extra field following the file header
|
||
>>>&26 search/1000 PK\003\004
|
||
# and check the subdirectory name to determine which type of OOXML
|
||
# file we have
|
||
# Correct the mimetype with the registered ones:
|
||
# http://technet.microsoft.com/en-us/library/cc179224.aspx
|
||
>>>>&26 string word/ Microsoft Word 2007+
|
||
!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
|
||
>>>>&26 string ppt/ Microsoft PowerPoint 2007+
|
||
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
|
||
>>>>&26 string xl/ Microsoft Excel 2007+
|
||
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
|
||
>>>>&26 default x Microsoft OOXML
|
||
!:strength +10
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
|
||
# msvc: file(1) magic for msvc
|
||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||
# Microsoft visual C
|
||
#
|
||
# I have version 1.0
|
||
|
||
# .aps
|
||
0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
|
||
|
||
# .ide
|
||
#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
|
||
0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
|
||
|
||
# .res
|
||
0 string \000\000\000\000\040\000\000\000\377 MSVC .res
|
||
0 string \377\003\000\377\001\000\020\020\350 MSVC .res
|
||
0 string \377\003\000\377\001\000\060\020\350 MSVC .res
|
||
|
||
#.lib
|
||
0 string \360\015\000\000 Microsoft Visual C library
|
||
0 string \360\075\000\000 Microsoft Visual C library
|
||
0 string \360\175\000\000 Microsoft Visual C library
|
||
|
||
#.pch
|
||
0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
|
||
|
||
# .pdb
|
||
# too long 0 string Microsoft\ C/C++\ program\ database\
|
||
0 string Microsoft\ C/C++\ MSVC program database
|
||
>18 string program\ database\
|
||
>33 string >\0 ver %s
|
||
|
||
#.sbr
|
||
0 string \000\002\000\007\000 MSVC .sbr
|
||
>5 string >\0 %s
|
||
|
||
#.bsc
|
||
0 string \002\000\002\001 MSVC .bsc
|
||
|
||
#.wsp
|
||
0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
|
||
# these seem to start with the version and contain menus
|
||
|
||
# ------------------------------------------------------------------------
|
||
# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# mup: file(1) magic for Mup (Music Publisher) input file.
|
||
#
|
||
# From: Abel Cheung <abel (@) oaka.org>
|
||
#
|
||
# NOTE: This header is mainly proposed in the Arkkra mailing list,
|
||
# and is not a mandatory header because of old mup input file
|
||
# compatibility. Noteedit also use mup format, but is not forcing
|
||
# user to use any header as well.
|
||
#
|
||
0 search/1 //!Mup Mup music publication program input text
|
||
>6 string -Arkkra (Arkkra)
|
||
>>13 string -
|
||
>>>16 string .
|
||
>>>>14 string x \b, need V%.4s
|
||
>>>15 string .
|
||
>>>>14 string x \b, need V%.3s
|
||
>6 string -
|
||
>>9 string .
|
||
>>>7 string x \b, need V%.4s
|
||
>>8 string .
|
||
>>>7 string x \b, need V%.3s
|
||
#------------------------------------------------------------------------------
|
||
# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
|
||
# music: file (1) magic for music formats
|
||
|
||
# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
|
||
# and Bagpipe Writer by Doug Wickstrom
|
||
#
|
||
0 string Bagpipe Bagpipe
|
||
>8 string Reader Reader
|
||
>>15 string >\0 (version %.3s)
|
||
>8 string Music\ Writer Music Writer
|
||
>>20 string :
|
||
>>>21 string >\0 (version %.3s)
|
||
>>21 string Gold Gold
|
||
>>>25 string :
|
||
>>>>26 string >\0 (version %.3s)
|
||
|
||
|
||
#-----------------------------------------------------------------------------
|
||
# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
|
||
# natinst: file(1) magic for National Instruments Code Files
|
||
|
||
#
|
||
# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
|
||
# version 1
|
||
# Many formats still missing, we use, for the moment LabVIEW
|
||
# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
|
||
#
|
||
0 string RSRC National Instruments,
|
||
# Check if it's a LabVIEW File
|
||
>8 string LV LabVIEW File,
|
||
# Check wich kind of file is
|
||
>>10 string SB Code Resource File, data
|
||
>>10 string IN Virtual Instrument Program, data
|
||
>>10 string AR VI Library, data
|
||
# This is for Menu Libraries
|
||
>8 string LMNULBVW Portable File Names, data
|
||
# This is for General Resources
|
||
>8 string rsc Resources File, data
|
||
# This is for VXI Package
|
||
0 string VMAP National Instruments, VXI File, data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
|
||
# ncr: file(1) magic for NCR Tower objects
|
||
#
|
||
# contributed by
|
||
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
|
||
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
|
||
#
|
||
0 beshort 000610 Tower/XP rel 2 object
|
||
>12 belong >0 not stripped
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0410 pure executable
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000615 Tower/XP rel 2 object
|
||
>12 belong >0 not stripped
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0410 pure executable
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000620 Tower/XP rel 3 object
|
||
>12 belong >0 not stripped
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0410 pure executable
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000625 Tower/XP rel 3 object
|
||
>12 belong >0 not stripped
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0410 pure executable
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000630 Tower32/600/400 68020 object
|
||
>12 belong >0 not stripped
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0410 pure executable
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000640 Tower32/800 68020
|
||
>18 beshort &020000 w/68881 object
|
||
>18 beshort &040000 compatible object
|
||
>18 beshort &060000 object
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0413 pure executable
|
||
>12 belong >0 not stripped
|
||
>22 beshort >0 - version %ld
|
||
0 beshort 000645 Tower32/800 68010
|
||
>18 beshort &040000 compatible object
|
||
>18 beshort &060000 object
|
||
>20 beshort 0407 executable
|
||
>20 beshort 0413 pure executable
|
||
>12 belong >0 not stripped
|
||
>22 beshort >0 - version %ld
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $
|
||
# netbsd: file(1) magic for NetBSD objects
|
||
#
|
||
# All new-style magic numbers are in network byte order.
|
||
# The old-style magic numbers are indistinguishable from the same magic
|
||
# numbers used in other systems, and are handled, for all those systems,
|
||
# in aout.
|
||
#
|
||
|
||
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 041400410 a.out NetBSD/i386 pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 041400407 a.out NetBSD/i386
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 041400507 a.out NetBSD/i386 core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <8192 shared library
|
||
>>20 belong =8192 dynamically linked executable
|
||
>>20 belong >8192 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 041600410 a.out NetBSD/m68k pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 041600407 a.out NetBSD/m68k
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 belong !0 executable
|
||
>>20 belong =0 object file
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 041600507 a.out NetBSD/m68k core
|
||
>12 string >\0 from '%s'
|
||
>32 belong !0 (signal %d)
|
||
|
||
0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <4096 shared library
|
||
>>20 belong =4096 dynamically linked executable
|
||
>>20 belong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042000407 a.out NetBSD/m68k4k
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 belong !0 executable
|
||
>>20 belong =0 object file
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
|
||
>12 string >\0 from '%s'
|
||
>32 belong !0 (signal %d)
|
||
|
||
0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042200407 a.out NetBSD/ns32532
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
0 belong&0377777777 045200507 a.out NetBSD/powerpc core
|
||
>12 string >\0 from '%s'
|
||
|
||
0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <8192 shared library
|
||
>>20 belong =8192 dynamically linked executable
|
||
>>20 belong >8192 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042400410 a.out NetBSD/sparc pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042400407 a.out NetBSD/sparc
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 belong !0 executable
|
||
>>20 belong =0 object file
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 042400507 a.out NetBSD/sparc core
|
||
>12 string >\0 from '%s'
|
||
>32 belong !0 (signal %d)
|
||
|
||
0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042600410 a.out NetBSD/pmax pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042600407 a.out NetBSD/pmax
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 042600507 a.out NetBSD/pmax core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 043000407 a.out NetBSD/vax 1k
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 045400407 a.out NetBSD/vax 4k
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
# NetBSD/alpha does not support (and has never supported) a.out objects,
|
||
# so no rules are provided for them. NetBSD/alpha ELF objects are
|
||
# dealt with in "elf".
|
||
0 lelong 0x00070185 ECOFF NetBSD/alpha binary
|
||
>10 leshort 0x0001 not stripped
|
||
>10 leshort 0x0000 stripped
|
||
0 belong&0377777777 043200507 a.out NetBSD/alpha core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <8192 shared library
|
||
>>20 belong =8192 dynamically linked executable
|
||
>>20 belong >8192 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 043400410 a.out NetBSD/mips pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 043400407 a.out NetBSD/mips
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 belong !0 executable
|
||
>>20 belong =0 object file
|
||
>16 belong >0 not stripped
|
||
0 belong&0377777777 043400507 a.out NetBSD/mips core
|
||
>12 string >\0 from '%s'
|
||
>32 belong !0 (signal %d)
|
||
|
||
0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
|
||
>0 byte &0x80
|
||
>>20 lelong <4096 shared library
|
||
>>20 lelong =4096 dynamically linked executable
|
||
>>20 lelong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 lelong >0 not stripped
|
||
0 belong&0377777777 043600407 a.out NetBSD/arm32
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80
|
||
>>0 byte &0x40 position independent
|
||
>>20 lelong !0 executable
|
||
>>20 lelong =0 object file
|
||
>16 lelong >0 not stripped
|
||
# NetBSD/arm26 has always used ELF objects, but it shares a core file
|
||
# format with NetBSD/arm32.
|
||
0 belong&0377777777 043600507 a.out NetBSD/arm core
|
||
>12 string >\0 from '%s'
|
||
>32 lelong !0 (signal %d)
|
||
|
||
# Kernel core dump format
|
||
0 belong&0x0000ffff 0x00008fca NetBSD kernel core file
|
||
>0 belong&0x03ff0000 0x00000000 \b, Unknown
|
||
>0 belong&0x03ff0000 0x00001000 \b, sun 68010/68020
|
||
>0 belong&0x03ff0000 0x00020000 \b, sun 68020
|
||
>0 belong&0x03ff0000 0x00640000 \b, 386 PC
|
||
>0 belong&0x03ff0000 0x00860000 \b, i386 BSD
|
||
>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages)
|
||
>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages)
|
||
>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD
|
||
>0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD
|
||
>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD
|
||
>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages)
|
||
>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD
|
||
>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian)
|
||
>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD
|
||
>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages)
|
||
>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD
|
||
>0 belong&0x03ff0000 0x00920000 \b, ppc BSD (Big Endian)
|
||
>0 belong&0x03ff0000 0x00930000 \b, vax BSD (4K pages)
|
||
>0 belong&0x03ff0000 0x00940000 \b, mips1 BSD
|
||
>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD
|
||
>0 belong&0x03ff0000 0x00960000 \b, parisc BSD
|
||
>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD
|
||
>0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD
|
||
>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD
|
||
>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD
|
||
>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
|
||
>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
|
||
>0 belong&0x03ff0000 0x00c80000 \b, hp200
|
||
>0 belong&0x03ff0000 0x020b0000 \b, hp300 (68020+68881) HP-UX
|
||
>0 belong&0x03ff0000 0x020c0000 \b, hp300 (68020+68881) HP-UX
|
||
>0 belong&0xfc000000 0x04000000 \b, CPU
|
||
>0 belong&0xfc000000 0x08000000 \b, DATA
|
||
>0 belong&0xfc000000 0x10000000 \b, STACK
|
||
>4 leshort x \b, (headersize = %d
|
||
>6 leshort x \b, segmentsize = %d
|
||
>6 lelong x \b, segments = %d)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# netscape: file(1) magic for Netscape files
|
||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||
# version 3 and 4 I think
|
||
#
|
||
|
||
# Netscape Address book .nab
|
||
0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
|
||
|
||
# Netscape Communicator address book
|
||
0 string \000\017\102\111 Netscape Communicator address book
|
||
|
||
# .snm Caches
|
||
0 string #\ Netscape\ folder\ cache Netscape folder cache
|
||
0 string \000\036\204\220\000 Netscape folder cache
|
||
# .n2p
|
||
# Net 2 Phone
|
||
#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
|
||
0 string SX961999 Net2phone
|
||
|
||
#
|
||
#This is files ending in .art, FIXME add more rules
|
||
0 string JG\004\016\0\0\0\0 ART
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# netware: file(1) magic for NetWare Loadable Modules (NLMs)
|
||
# From: Mads Martin Joergensen <mmj@suse.de>
|
||
|
||
0 string NetWare\ Loadable\ Module NetWare Loadable Module
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
|
||
#
|
||
0 string StartFontMetrics ASCII font metrics
|
||
0 string StartFont ASCII font bits
|
||
0 belong 0x137A2944 NeWS bitmap font
|
||
0 belong 0x137A2947 NeWS font family
|
||
0 belong 0x137A2950 scalable OpenFont binary
|
||
0 belong 0x137A2951 encrypted scalable OpenFont binary
|
||
8 belong 0x137A2B45 X11/NeWS bitmap font
|
||
8 belong 0x137A2B48 X11/NeWS font family
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# nitpicker: file(1) magic for Flowfiles.
|
||
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
|
||
0 string NPFF NItpicker Flow File
|
||
>4 byte x V%d.
|
||
>5 byte x %d
|
||
>6 bedate x started: %s
|
||
>10 bedate x stopped: %s
|
||
>14 belong x Bytes: %u
|
||
>18 belong x Bytes1: %u
|
||
>22 belong x Flows: %u
|
||
>26 belong x Pkts: %u
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $
|
||
# OASIS
|
||
# Summary: OASIS stream file
|
||
# Long descripton: Open Artwork System Interchange Standard
|
||
# File extension: .oas
|
||
# Full name: Ben Cowley (bcowley@broadcom.com)
|
||
# Philip Dixon (pdixon@broadcom.com)
|
||
# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
|
||
# (see page 3)
|
||
0 string %SEMI-OASIS\r\n OASIS Stream file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
|
||
# ocaml: file(1) magic for Objective Caml files.
|
||
0 string Caml1999 OCaml
|
||
>8 string X exec file
|
||
>8 string I interface file (.cmi)
|
||
>8 string O object file (.cmo)
|
||
>8 string A library file (.cma)
|
||
>8 string Y native object file (.cmx)
|
||
>8 string Z native library file (.cmxa)
|
||
>8 string M abstract syntax tree implementation file
|
||
>8 string N abstract syntax tree interface file
|
||
>9 string >\0 (Version %3.3s)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
|
||
0 string Octave-1-L Octave binary data (little endian)
|
||
0 string Octave-1-B Octave binary data (big endian)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
|
||
# storage (http://en.wikipedia.org/wiki/Structured_Storage)
|
||
# Additional tests for OLE 2 Compound Documents should be under this recipe.
|
||
|
||
0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
|
||
# - Microstation V8 DGN files (www.bentley.com)
|
||
# Last update on 10/23/2006 by Lester Hightower
|
||
> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
|
||
# - Visio documents
|
||
# Last update on 10/23/2006 by Lester Hightower
|
||
> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# olf: file(1) magic for OLF executables
|
||
#
|
||
# We have to check the byte order flag to see what byte order all the
|
||
# other stuff in the header is in.
|
||
#
|
||
# MIPS R3000 may also be for MIPS R2000.
|
||
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
|
||
#
|
||
# Created by Erik Theisen <etheisen@openbsd.org>
|
||
# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
|
||
0 string \177OLF OLF
|
||
>4 byte 0 invalid class
|
||
>4 byte 1 32-bit
|
||
>4 byte 2 64-bit
|
||
>7 byte 0 invalid os
|
||
>7 byte 1 OpenBSD
|
||
>7 byte 2 NetBSD
|
||
>7 byte 3 FreeBSD
|
||
>7 byte 4 4.4BSD
|
||
>7 byte 5 Linux
|
||
>7 byte 6 SVR4
|
||
>7 byte 7 esix
|
||
>7 byte 8 Solaris
|
||
>7 byte 9 Irix
|
||
>7 byte 10 SCO
|
||
>7 byte 11 Dell
|
||
>7 byte 12 NCR
|
||
>5 byte 0 invalid byte order
|
||
>5 byte 1 LSB
|
||
>>16 leshort 0 no file type,
|
||
>>16 leshort 1 relocatable,
|
||
>>16 leshort 2 executable,
|
||
>>16 leshort 3 shared object,
|
||
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
|
||
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
|
||
>>16 leshort 4 core file
|
||
>>>(0x38+0xcc) string >\0 of '%s'
|
||
>>>(0x38+0x10) lelong >0 (signal %d),
|
||
>>16 leshort &0xff00 processor-specific,
|
||
>>18 leshort 0 no machine,
|
||
>>18 leshort 1 AT&T WE32100 - invalid byte order,
|
||
>>18 leshort 2 SPARC - invalid byte order,
|
||
>>18 leshort 3 Intel 80386,
|
||
>>18 leshort 4 Motorola 68000 - invalid byte order,
|
||
>>18 leshort 5 Motorola 88000 - invalid byte order,
|
||
>>18 leshort 6 Intel 80486,
|
||
>>18 leshort 7 Intel 80860,
|
||
>>18 leshort 8 MIPS R3000_BE - invalid byte order,
|
||
>>18 leshort 9 Amdahl - invalid byte order,
|
||
>>18 leshort 10 MIPS R3000_LE,
|
||
>>18 leshort 11 RS6000 - invalid byte order,
|
||
>>18 leshort 15 PA-RISC - invalid byte order,
|
||
>>18 leshort 16 nCUBE,
|
||
>>18 leshort 17 VPP500,
|
||
>>18 leshort 18 SPARC32PLUS,
|
||
>>18 leshort 20 PowerPC,
|
||
>>18 leshort 0x9026 Alpha,
|
||
>>20 lelong 0 invalid version
|
||
>>20 lelong 1 version 1
|
||
>>36 lelong 1 MathCoPro/FPU/MAU Required
|
||
>8 string >\0 (%s)
|
||
>5 byte 2 MSB
|
||
>>16 beshort 0 no file type,
|
||
>>16 beshort 1 relocatable,
|
||
>>16 beshort 2 executable,
|
||
>>16 beshort 3 shared object,
|
||
>>16 beshort 4 core file,
|
||
>>>(0x38+0xcc) string >\0 of '%s'
|
||
>>>(0x38+0x10) belong >0 (signal %d),
|
||
>>16 beshort &0xff00 processor-specific,
|
||
>>18 beshort 0 no machine,
|
||
>>18 beshort 1 AT&T WE32100,
|
||
>>18 beshort 2 SPARC,
|
||
>>18 beshort 3 Intel 80386 - invalid byte order,
|
||
>>18 beshort 4 Motorola 68000,
|
||
>>18 beshort 5 Motorola 88000,
|
||
>>18 beshort 6 Intel 80486 - invalid byte order,
|
||
>>18 beshort 7 Intel 80860,
|
||
>>18 beshort 8 MIPS R3000_BE,
|
||
>>18 beshort 9 Amdahl,
|
||
>>18 beshort 10 MIPS R3000_LE - invalid byte order,
|
||
>>18 beshort 11 RS6000,
|
||
>>18 beshort 15 PA-RISC,
|
||
>>18 beshort 16 nCUBE,
|
||
>>18 beshort 17 VPP500,
|
||
>>18 beshort 18 SPARC32PLUS,
|
||
>>18 beshort 20 PowerPC or cisco 4500,
|
||
>>18 beshort 21 cisco 7500,
|
||
>>18 beshort 24 cisco SVIP,
|
||
>>18 beshort 25 cisco 7200,
|
||
>>18 beshort 36 cisco 12000,
|
||
>>18 beshort 0x9026 Alpha,
|
||
>>20 belong 0 invalid version
|
||
>>20 belong 1 version 1
|
||
>>36 belong 1 MathCoPro/FPU/MAU Required
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $
|
||
# os2: file(1) magic for OS/2 files
|
||
#
|
||
|
||
# Provided 1998/08/22 by
|
||
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
|
||
1 search/1 InternetShortcut MS Windows 95 Internet shortcut text
|
||
>24 search/1 >\ (URL=<%s>)
|
||
|
||
# OS/2 URL objects
|
||
# Provided 1998/08/22 by
|
||
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
|
||
#0 string http: OS/2 URL object text
|
||
#>5 string >\ (WWW) <http:%s>
|
||
#0 string mailto: OS/2 URL object text
|
||
#>7 string >\ (email) <%s>
|
||
#0 string news: OS/2 URL object text
|
||
#>5 string >\ (Usenet) <%s>
|
||
#0 string ftp: OS/2 URL object text
|
||
#>4 string >\ (FTP) <ftp:%s>
|
||
#0 string file: OS/2 URL object text
|
||
#>5 string >\ (Local file) <%s>
|
||
|
||
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
|
||
# Carl Hauser (chauser.parc@xerox.com) and
|
||
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
|
||
# list the following header format in inf02a.doc:
|
||
#
|
||
# int16 ID; // ID magic word (5348h = "HS")
|
||
# int8 unknown1; // unknown purpose, could be third letter of ID
|
||
# int8 flags; // probably a flag word...
|
||
# // bit 0: set if INF style file
|
||
# // bit 4: set if HLP style file
|
||
# // patching this byte allows reading HLP files
|
||
# // using the VIEW command, while help files
|
||
# // seem to work with INF settings here as well.
|
||
# int16 hdrsize; // total size of header
|
||
# int16 unknown2; // unknown purpose
|
||
#
|
||
0 string HSP\x01\x9b\x00 OS/2 INF
|
||
>107 string >0 (%s)
|
||
0 string HSP\x10\x9b\x00 OS/2 HLP
|
||
>107 string >0 (%s)
|
||
|
||
# OS/2 INI (this is a guess)
|
||
0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
|
||
# os400: file(1) magic for IBM OS/400 files
|
||
#
|
||
# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
|
||
# In spite of its quite variable format (due to internal memory page
|
||
# length differences between CISC and RISC versions of the OS) the
|
||
# SAVF structure hasn't suitable offsets to identify the catalog
|
||
# header in the first descriptor where there are some useful infos,
|
||
# so we must search in a somewhat large area for a particular string
|
||
# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
|
||
# descriptor space) preceded by a two byte constant.
|
||
#
|
||
1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
|
||
>&212 byte 0x01 \b, created with SAVOBJ
|
||
>&212 byte 0x02 \b, created with SAVLIB
|
||
>&212 byte 0x07 \b, created with SAVCFG
|
||
>&212 byte 0x08 \b, created with SAVSECDTA
|
||
>&212 byte 0x0A \b, created with SAVSECDTA
|
||
>&212 byte 0x0B \b, created with SAVDLO
|
||
>&212 byte 0x0D \b, created with SAVLICPGM
|
||
>&212 byte 0x11 \b, created with SAVCHGOBJ
|
||
>&213 byte 0x44 \b, at least V5R4 to open
|
||
>&213 byte 0x43 \b, at least V5R3 to open
|
||
>&213 byte 0x42 \b, at least V5R2 to open
|
||
>&213 byte 0x41 \b, at least V5R1 to open
|
||
>&213 byte 0x40 \b, at least V4R5 to open
|
||
>&213 byte 0x3F \b, at least V4R4 to open
|
||
>&213 byte 0x3E \b, at least V4R3 to open
|
||
>&213 byte 0x3C \b, at least V4R2 to open
|
||
>&213 byte 0x3D \b, at least V4R1M4 to open
|
||
>&213 byte 0x3B \b, at least V4R1 to open
|
||
>&213 byte 0x3A \b, at least V3R7 to open
|
||
>&213 byte 0x35 \b, at least V3R6 to open
|
||
>&213 byte 0x36 \b, at least V3R2 to open
|
||
>&213 byte 0x34 \b, at least V3R1 to open
|
||
>&213 byte 0x31 \b, at least V3R0M5 to open
|
||
>&213 byte 0x30 \b, at least V2R3 to open
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
|
||
#
|
||
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
|
||
#
|
||
# Redistribution and use in source and binary forms, with or without
|
||
# modification, are permitted provided that the following conditions
|
||
# are met:
|
||
# 1. Redistributions of source code must retain the above copyright
|
||
# notice, this list of conditions and the following disclaimer.
|
||
# 2. Redistributions in binary form must reproduce the above copyright
|
||
# notice, this list of conditions and the following disclaimer in the
|
||
# documentation and/or other materials provided with the distribution.
|
||
#
|
||
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
||
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
||
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
||
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||
#
|
||
#
|
||
#
|
||
# OS9/6809 module descriptions:
|
||
#
|
||
0 beshort 0x87CD OS9/6809 module:
|
||
#
|
||
>6 byte&0x0f 0x00 non-executable
|
||
>6 byte&0x0f 0x01 machine language
|
||
>6 byte&0x0f 0x02 BASIC I-code
|
||
>6 byte&0x0f 0x03 Pascal P-code
|
||
>6 byte&0x0f 0x04 C I-code
|
||
>6 byte&0x0f 0x05 COBOL I-code
|
||
>6 byte&0x0f 0x06 Fortran I-code
|
||
#
|
||
>6 byte&0xf0 0x10 program executable
|
||
>6 byte&0xf0 0x20 subroutine
|
||
>6 byte&0xf0 0x30 multi-module
|
||
>6 byte&0xf0 0x40 data module
|
||
#
|
||
>6 byte&0xf0 0xC0 system module
|
||
>6 byte&0xf0 0xD0 file manager
|
||
>6 byte&0xf0 0xE0 device driver
|
||
>6 byte&0xf0 0xF0 device descriptor
|
||
#
|
||
# OS9/m68k stuff (to be continued)
|
||
#
|
||
0 beshort 0x4AFC OS9/68K module:
|
||
#
|
||
# attr
|
||
>0x14 byte&0x80 0x80 re-entrant
|
||
>0x14 byte&0x40 0x40 ghost
|
||
>0x14 byte&0x20 0x20 system-state
|
||
#
|
||
# lang:
|
||
#
|
||
>0x13 byte 1 machine language
|
||
>0x13 byte 2 BASIC I-code
|
||
>0x13 byte 3 Pascal P-code
|
||
>0x13 byte 4 C I-code
|
||
>0x13 byte 5 COBOL I-code
|
||
>0x13 byte 6 Fortran I-code
|
||
#
|
||
#
|
||
# type:
|
||
#
|
||
>0x12 byte 1 program executable
|
||
>0x12 byte 2 subroutine
|
||
>0x12 byte 3 multi-module
|
||
>0x12 byte 4 data module
|
||
>0x12 byte 11 trap library
|
||
>0x12 byte 12 system module
|
||
>0x12 byte 13 file manager
|
||
>0x12 byte 14 device driver
|
||
>0x12 byte 15 device descriptor
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
|
||
#
|
||
# Mach magic number info
|
||
#
|
||
0 long 0xefbe OSF/Rose object
|
||
# I386 magic number info
|
||
#
|
||
0 short 0565 i386 COFF object
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: palm,v 1.9 2012/01/16 15:16:43 christos Exp $
|
||
# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
|
||
#
|
||
# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
|
||
|
||
# These are weak, byte 59 is not guaranteed to be 0 and there are
|
||
# 8 character identifiers at byte 60, one I found for appl is BIGb.
|
||
# What are the possibilities and where is this documented?
|
||
|
||
# appl
|
||
#59 byte \0
|
||
#>60 string appl PalmOS application
|
||
#>0 string >\0 "%s"
|
||
# TEXt
|
||
#59 byte \0
|
||
#>60 belong TEXt AportisDoc file
|
||
#>0 string >\0 "%s"
|
||
# HACK
|
||
#59 byte \0
|
||
#>60 string HACK HackMaster hack
|
||
#>0 string >\0 "%s"
|
||
|
||
# Variety of PalmOS document types
|
||
# Michael-John Turner <mj@debian.org>
|
||
# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
|
||
60 string BVokBDIC BDicty PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DB99DBOS DB PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string vIMGView FireViewer/ImageViewer PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string PmDBPmDB HanDBase PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string InfoINDB InfoView PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string ToGoToGo iSilo PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string JfDbJBas JFile PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string JfDbJFil JFile Pro PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DATALSdb List PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string Mdb1Mdb1 MobileDB PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string PNRdPPrs PeanutPress PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DataPlkr Plucker PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DataSprd QuickSheet PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string SM01SMem SuperMemo PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string TEXtTlDc TealDoc PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string InfoTlIf TealInfo PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DataTlMl TealMeal PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string DataTlPt TealPaint PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string dataTDBP ThinkDB PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string TdatTide Tides PalmOS document
|
||
>0 string >\0 "%s"
|
||
60 string ToRaTRPW TomeRaider PalmOS document
|
||
>0 string >\0 "%s"
|
||
|
||
# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
|
||
# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
|
||
# annotations.
|
||
# For other versions, just outputs version.
|
||
#
|
||
60 string zTXT A GutenPalm zTXT e-book
|
||
>0 string >\0 "%s"
|
||
>(0x4E.L) byte 0
|
||
>>(0x4E.L+1) byte x (v0.%02d)
|
||
>(0x4E.L) byte 1
|
||
>>(0x4E.L+1) byte x (v1.%02d)
|
||
>>>(0x4E.L+10) beshort >0
|
||
>>>>(0x4E.L+10) beshort <2 - 1 bookmark
|
||
>>>>(0x4E.L+10) beshort >1 - %d bookmarks
|
||
>>>(0x4E.L+14) beshort >0
|
||
>>>>(0x4E.L+14) beshort <2 - 1 annotation
|
||
>>>>(0x4E.L+14) beshort >1 - %d annotations
|
||
>(0x4E.L) byte >1 (v%d.
|
||
>>(0x4E.L+1) byte x %02d)
|
||
|
||
# Palm OS .prc file types
|
||
60 string libr Palm OS dynamic library data
|
||
>0 string >\0 "%s"
|
||
60 string ptch Palm OS operating system patch data
|
||
>0 string >\0 "%s"
|
||
|
||
# Mobipocket (www.mobipocket.com), donated by Carl Witty
|
||
60 string BOOKMOBI Mobipocket E-book
|
||
>0 string >\0 "%s"
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
#
|
||
# Parix COFF executables
|
||
# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
|
||
#
|
||
0 beshort&0xfff 0xACE PARIX
|
||
>0 byte&0xf0 0x80 T800
|
||
>0 byte&0xf0 0x90 T9000
|
||
>19 byte&0x02 0x02 executable
|
||
>19 byte&0x02 0x00 object
|
||
>19 byte&0x0c 0x00 not stripped
|
||
#------------------------------------------------------------------------------
|
||
# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
|
||
# parrot: file(1) magic for Parrot Virtual Machine
|
||
# URL: http://www.lua.org/
|
||
# From: Lubomir Rintel <lkundrak@v3.sk>
|
||
|
||
# Compiled Parrot byte code
|
||
0 string \376PBC\r\n\032\n Parrot bytecode
|
||
>64 byte x %d.
|
||
>72 byte x \b%d,
|
||
>8 byte >0 %d byte words,
|
||
>16 byte 0 little-endian,
|
||
>16 byte 1 big-endian,
|
||
>32 byte 0 IEEE-754 8 byte double floats,
|
||
>32 byte 1 x86 12 byte long double floats,
|
||
>32 byte 2 IEEE-754 16 byte long double floats,
|
||
>32 byte 3 MIPS 16 byte long double floats,
|
||
>32 byte 4 AIX 16 byte long double floats,
|
||
>32 byte 5 4-byte floats,
|
||
>40 byte x Parrot %d.
|
||
>48 byte x \b%d.
|
||
>56 byte x \b%d
|
||
#------------------------------------------------------------------------------
|
||
# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
|
||
# pascal: file(1) magic for Pascal source
|
||
#
|
||
0 search/8192 (input, Pascal source text
|
||
!:mime text/x-pascal
|
||
0 regex \^program Pascal source text
|
||
!:mime text/x-pascal
|
||
0 regex \^record Pascal source text
|
||
!:mime text/x-pascal
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# pbm: file(1) magic for Portable Bitmap files
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 short 0x2a17 "compact bitmap" format (Poskanzer)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# pdf: file(1) magic for Portable Document Format
|
||
#
|
||
|
||
0 string %PDF- PDF document
|
||
!:mime application/pdf
|
||
>5 byte x \b, version %c
|
||
>7 byte x \b.%c
|
||
|
||
# From: Nick Schmalenberger <nick@schmalenberger.us>
|
||
# Forms Data Format
|
||
0 string %FDF- FDF document
|
||
>5 byte x \b, version %c
|
||
>7 byte x \b.%c
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $
|
||
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
|
||
#
|
||
0 lelong 0101555 PDP-11 single precision APL workspace
|
||
0 lelong 0101554 PDP-11 double precision APL workspace
|
||
#
|
||
# PDP-11 a.out
|
||
#
|
||
0 leshort 0407 PDP-11 executable
|
||
>8 leshort >0 not stripped
|
||
>15 byte >0 - version %ld
|
||
|
||
0 leshort 0401 PDP-11 UNIX/RT ldp
|
||
0 leshort 0405 PDP-11 old overlay
|
||
|
||
0 leshort 0410 PDP-11 pure executable
|
||
>8 leshort >0 not stripped
|
||
>15 byte >0 - version %ld
|
||
|
||
0 leshort 0411 PDP-11 separate I&D executable
|
||
>8 leshort >0 not stripped
|
||
>15 byte >0 - version %ld
|
||
|
||
0 leshort 0437 PDP-11 kernel overlay
|
||
|
||
# These last three are derived from 2.11BSD file(1)
|
||
0 leshort 0413 PDP-11 demand-paged pure executable
|
||
>8 leshort >0 not stripped
|
||
|
||
0 leshort 0430 PDP-11 overlaid pure executable
|
||
>8 leshort >0 not stripped
|
||
|
||
0 leshort 0431 PDP-11 overlaid separate executable
|
||
>8 leshort >0 not stripped
|
||
#------------------------------------------------------------------------------
|
||
# $File: perl,v 1.20 2012/06/21 01:16:49 christos Exp $
|
||
# perl: file(1) magic for Larry Wall's perl language.
|
||
#
|
||
# The `eval' lines recognizes an outrageously clever hack.
|
||
# Keith Waclena <keith@cerberus.uchicago.edu>
|
||
# Send additions to <perl5-porters@perl.org>
|
||
0 search/1/w #!\ /bin/perl Perl script text executable
|
||
!:mime text/x-perl
|
||
0 search/1 eval\ "exec\ /bin/perl Perl script text
|
||
!:mime text/x-perl
|
||
0 search/1/w #!\ /usr/bin/perl Perl script text executable
|
||
!:mime text/x-perl
|
||
0 search/1 eval\ "exec\ /usr/bin/perl Perl script text
|
||
!:mime text/x-perl
|
||
0 search/1/w #!\ /usr/local/bin/perl Perl script text executable
|
||
!:mime text/x-perl
|
||
0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text
|
||
!:mime text/x-perl
|
||
0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
|
||
!:mime text/x-perl
|
||
0 search/1 #!/usr/bin/env\ perl Perl script text executable
|
||
!:mime text/x-perl
|
||
0 search/1 #!\ /usr/bin/env\ perl Perl script text executable
|
||
!:mime text/x-perl
|
||
|
||
# by Dmitry V. Levin and Alexey Tourbin
|
||
# check the first line
|
||
0 search/1 package
|
||
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
|
||
!:strength + 10
|
||
# not 'p', check other lines
|
||
0 search/1 !p
|
||
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
|
||
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
|
||
!:strength + 10
|
||
|
||
# Perl POD documents
|
||
# From: Tom Hukins <tom@eborcom.com>
|
||
0 search/1/W \=pod\n Perl POD document text
|
||
0 search/1/W \n\=pod\n Perl POD document text
|
||
0 search/1/W \=head1\ Perl POD document text
|
||
0 search/1/W \n\=head1\ Perl POD document text
|
||
0 search/1/W \=head2\ Perl POD document text
|
||
0 search/1/W \n\=head2\ Perl POD document text
|
||
0 search/1/W \=encoding\ Perl POD document text
|
||
0 search/1/W \n\=encoding\ Perl POD document text
|
||
|
||
|
||
# Perl Storable data files.
|
||
0 string perl-store perl Storable (v0.6) data
|
||
>4 byte >0 (net-order %d)
|
||
>>4 byte &01 (network-ordered)
|
||
>>4 byte =3 (major 1)
|
||
>>4 byte =2 (major 1)
|
||
|
||
0 string pst0 perl Storable (v0.7) data
|
||
>4 byte >0
|
||
>>4 byte &01 (network-ordered)
|
||
>>4 byte =5 (major 2)
|
||
>>4 byte =4 (major 2)
|
||
>>5 byte >0 (minor %d)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $
|
||
# pgp: file(1) magic for Pretty Good Privacy
|
||
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
|
||
#
|
||
0 beshort 0x9900 PGP key public ring
|
||
!:mime application/x-pgp-keyring
|
||
0 beshort 0x9501 PGP key security ring
|
||
!:mime application/x-pgp-keyring
|
||
0 beshort 0x9500 PGP key security ring
|
||
!:mime application/x-pgp-keyring
|
||
0 beshort 0xa600 PGP encrypted data
|
||
#!:mime application/pgp-encrypted
|
||
#0 string -----BEGIN\040PGP text/PGP armored data
|
||
!:mime text/PGP # encoding: armored data
|
||
#>15 string PUBLIC\040KEY\040BLOCK- public key block
|
||
#>15 string MESSAGE- message
|
||
#>15 string SIGNED\040MESSAGE- signed message
|
||
#>15 string PGP\040SIGNATURE- signature
|
||
|
||
2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block
|
||
!:mime application/pgp-keys
|
||
0 string -----BEGIN\040PGP\40MESSAGE- PGP message
|
||
!:mime application/pgp
|
||
0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature
|
||
!:mime application/pgp-signature
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# pkgadd: file(1) magic for SysV R4 PKG Datastreams
|
||
#
|
||
0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
|
||
!:mime application/x-svr4-package
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
|
||
# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
|
||
# From: "Stefan A. Haubenthal" <polluks@web.de>
|
||
#
|
||
0 belong 0x00000107 Plan 9 executable, Motorola 68k
|
||
0 belong 0x000001EB Plan 9 executable, Intel 386
|
||
0 belong 0x00000247 Plan 9 executable, Intel 960
|
||
0 belong 0x000002AB Plan 9 executable, SPARC
|
||
0 belong 0x00000407 Plan 9 executable, MIPS R3000
|
||
0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
|
||
0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
|
||
0 belong 0x000005AB Plan 9 executable, AMD 29000
|
||
0 belong 0x00000647 Plan 9 executable, ARM 7-something
|
||
0 belong 0x000006EB Plan 9 executable, PowerPC
|
||
0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
|
||
0 belong 0x0000084B Plan 9 executable, DEC Alpha
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# plus5: file(1) magic for Plus Five's UNIX MUMPS
|
||
#
|
||
# XXX - byte order? Paging Hokey....
|
||
#
|
||
0 short 0x259 mumps avl global
|
||
>2 byte >0 (V%d)
|
||
>6 byte >0 with %d byte name
|
||
>7 byte >0 and %d byte data cells
|
||
0 short 0x25a mumps blt global
|
||
>2 byte >0 (V%d)
|
||
>8 short >0 - %d byte blocks
|
||
>15 byte 0x00 - P/D format
|
||
>15 byte 0x01 - P/K/D format
|
||
>15 byte 0x02 - K/D format
|
||
>15 byte >0x02 - Bad Flags
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
|
||
# printer: file(1) magic for printer-formatted files
|
||
#
|
||
|
||
# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 string %! PostScript document text
|
||
!:mime application/postscript
|
||
!:apple ASPSTEXT
|
||
>2 string PS-Adobe- conforming
|
||
>>11 string >\0 DSC level %.3s
|
||
>>>15 string EPS \b, type %s
|
||
>>>15 string Query \b, type %s
|
||
>>>15 string ExitServer \b, type %s
|
||
>>>15 search/1000 %%LanguageLevel:\
|
||
>>>>&0 string >\0 \b, Level %s
|
||
# Some PCs have the annoying habit of adding a ^D as a document separator
|
||
0 string \004%! PostScript document text
|
||
!:mime application/postscript
|
||
!:apple ASPSTEXT
|
||
>3 string PS-Adobe- conforming
|
||
>>12 string >\0 DSC level %.3s
|
||
>>>16 string EPS \b, type %s
|
||
>>>16 string Query \b, type %s
|
||
>>>16 string ExitServer \b, type %s
|
||
>>>16 search/1000 %%LanguageLevel:\
|
||
>>>>&0 string >\0 \b, Level %s
|
||
0 string \033%-12345X%!PS PostScript document
|
||
|
||
# DOS EPS Binary File Header
|
||
# From: Ed Sznyter <ews@Black.Market.NET>
|
||
0 belong 0xC5D0D3C6 DOS EPS Binary File
|
||
>4 long >0 Postscript starts at byte %d
|
||
>>8 long >0 length %d
|
||
>>>12 long >0 Metafile starts at byte %d
|
||
>>>>16 long >0 length %d
|
||
>>>20 long >0 TIFF starts at byte %d
|
||
>>>>24 long >0 length %d
|
||
|
||
# Summary: Adobe's PostScript Printer Description File
|
||
# Extension: .ppd
|
||
# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
|
||
# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
|
||
#
|
||
0 string *PPD-Adobe:\x20 PPD file
|
||
>&0 string x \b, version %s
|
||
|
||
# HP Printer Job Language
|
||
0 string \033%-12345X@PJL HP Printer Job Language data
|
||
# HP Printer Job Language
|
||
# The header found on Win95 HP plot files is the "Silliest Thing possible"
|
||
# (TM)
|
||
# Every driver puts the language at some random position, with random case
|
||
# (LANGUAGE and Language)
|
||
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
|
||
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
|
||
#
|
||
0 string \033%-12345X@PJL HP Printer Job Language data
|
||
>&0 string >\0 %s
|
||
>>&0 string >\0 %s
|
||
>>>&0 string >\0 %s
|
||
>>>>&0 string >\0 %s
|
||
#>15 string \ ENTER\ LANGUAGE\ =
|
||
#>31 string PostScript PostScript
|
||
|
||
# From: Stefan Thurner <thurners@nicsys.de>
|
||
0 string \033%-12345X@PJL
|
||
>&0 search/10000 %! PJL encapsulated PostScript document text
|
||
|
||
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 string \033E\033 HP PCL printer data
|
||
>3 string \&l0A - default page size
|
||
>3 string \&l1A - US executive page size
|
||
>3 string \&l2A - US letter page size
|
||
>3 string \&l3A - US legal page size
|
||
>3 string \&l26A - A4 page size
|
||
>3 string \&l80A - Monarch envelope size
|
||
>3 string \&l81A - No. 10 envelope size
|
||
>3 string \&l90A - Intl. DL envelope size
|
||
>3 string \&l91A - Intl. C5 envelope size
|
||
>3 string \&l100A - Intl. B5 envelope size
|
||
>3 string \&l-81A - No. 10 envelope size (landscape)
|
||
>3 string \&l-90A - Intl. DL envelope size (landscape)
|
||
|
||
# IMAGEN printer-ready files:
|
||
0 string @document( Imagen printer
|
||
# this only works if "language xxx" is first item in Imagen header.
|
||
>10 string language\ impress (imPRESS data)
|
||
>10 string language\ daisy (daisywheel text)
|
||
>10 string language\ diablo (daisywheel text)
|
||
>10 string language\ printer (line printer emulation)
|
||
>10 string language\ tektronix (Tektronix 4014 emulation)
|
||
# Add any other languages that your Imagen uses - remember
|
||
# to keep the word `text' if the file is human-readable.
|
||
# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
|
||
#
|
||
# Now magic for IMAGEN font files...
|
||
0 string Rast RST-format raster font data
|
||
>45 string >0 face %s
|
||
# From Jukka Ukkonen
|
||
0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
|
||
|
||
# From <mike@flyn.org>
|
||
# These are the /etc/magic entries to decode data sent to an Epson printer.
|
||
0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# zenographics: file(1) magic for Zenographics ZjStream printer data
|
||
# Rick Richardson rickr@mn.rr.com
|
||
0 string JZJZ
|
||
>0x12 string ZZ Zenographics ZjStream printer data (big-endian)
|
||
0 string ZJZJ
|
||
>0x12 string ZZ Zenographics ZjStream printer data (little-endian)
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Oak Technologies printer stream
|
||
# Rick Richardson <rickr@mn.rr.com>
|
||
0 string OAK
|
||
>0x07 byte 0
|
||
>0x0b byte 0 Oak Technologies printer stream
|
||
|
||
# This would otherwise be recognized as PostScript - nick@debian.org
|
||
0 string %!VMF SunClock's Vector Map Format data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# HP LaserJet 1000 series downloadable firmware file
|
||
0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
|
||
|
||
# From: Paolo <oopla@users.sf.net>
|
||
# Epson ESC/Page, ESC/PageColor
|
||
0 string \x1b\x01@EJL Epson ESC/Page language printer data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $
|
||
# project: file(1) magic for Project management
|
||
#
|
||
# Magic strings for ftnchek project files. Alexander Mai
|
||
0 string FTNCHEK_\ P project file for ftnchek
|
||
>10 string 1 version 2.7
|
||
>10 string 2 version 2.8 to 2.10
|
||
>10 string 3 version 2.11 or later
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
|
||
# psdbms: file(1) magic for psdatabase
|
||
#
|
||
0 belong&0xff00ffff 0x56000000 ps database
|
||
>1 string >\0 version %s
|
||
>4 string >\0 from kernel %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
|
||
# pulsar: file(1) magic for Pulsar POP3 daemon binary files
|
||
#
|
||
# http://pulsar.sourceforge.net
|
||
# mailto:rok.papez@lugos.si
|
||
#
|
||
|
||
0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
|
||
>4 ubelong x Version: %d.
|
||
>8 ubelong x \b%d
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
|
||
# pwsafe: file(1) magic for passwordsafe file
|
||
#
|
||
# Password Safe
|
||
# http://passwordsafe.sourceforge.net/
|
||
# file format specs
|
||
# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
|
||
# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
|
||
# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
|
||
# V2 and V1 have no easy identifier that I can find
|
||
# .psafe3
|
||
0 string PWS3 Password Safe V3 database
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
|
||
# pyramid: file(1) magic for Pyramids
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 long 0x50900107 Pyramid 90x family executable
|
||
0 long 0x50900108 Pyramid 90x family pure executable
|
||
>16 long >0 not stripped
|
||
0 long 0x5090010b Pyramid 90x family demand paged pure executable
|
||
>16 long >0 not stripped
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: python,v 1.22 2013/03/18 12:49:55 christos Exp $
|
||
# python: file(1) magic for python
|
||
#
|
||
# Outlook puts """ too for urgent messages
|
||
# From: David Necas <yeti@physics.muni.cz>
|
||
# often the module starts with a multiline string
|
||
0 string/t """ Python script text executable
|
||
# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
|
||
# that Py_UnicodeFlag is off for Python 2)
|
||
# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
|
||
0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
|
||
0 belong 0x87c60d0a python 2.0 byte-compiled
|
||
0 belong 0x2aeb0d0a python 2.1 byte-compiled
|
||
0 belong 0x2ded0d0a python 2.2 byte-compiled
|
||
0 belong 0x3bf20d0a python 2.3 byte-compiled
|
||
0 belong 0x6df20d0a python 2.4 byte-compiled
|
||
0 belong 0xb3f20d0a python 2.5 byte-compiled
|
||
0 belong 0xd1f20d0a python 2.6 byte-compiled
|
||
0 belong 0x03f30d0a python 2.7 byte-compiled
|
||
0 belong 0x3b0c0d0a python 3.0 byte-compiled
|
||
0 belong 0x4f0c0d0a python 3.1 byte-compiled
|
||
0 belong 0x6c0c0d0a python 3.2 byte-compiled
|
||
0 belong 0x9e0c0d0a python 3.3 byte-compiled
|
||
|
||
0 search/1/w #!\ /usr/bin/python Python script text executable
|
||
!:mime text/x-python
|
||
0 search/1/w #!\ /usr/local/bin/python Python script text executable
|
||
!:mime text/x-python
|
||
0 search/1 #!/usr/bin/env\ python Python script text executable
|
||
!:mime text/x-python
|
||
0 search/1 #!\ /usr/bin/env\ python Python script text executable
|
||
!:mime text/x-python
|
||
|
||
|
||
# from module.submodule import func1, func2
|
||
0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
|
||
!:mime text/x-python
|
||
|
||
# def __init__ (self, ...):
|
||
0 search/4096 def\ __init__
|
||
>&0 search/64 self Python script text executable
|
||
!:mime text/x-python
|
||
|
||
# comments
|
||
0 search/4096 '''
|
||
>&0 regex .*'''$ Python script text executable
|
||
!:mime text/x-python
|
||
|
||
0 search/4096 """
|
||
>&0 regex .*"""$ Python script text executable
|
||
!:mime text/x-python
|
||
|
||
# try:
|
||
# except: or finally:
|
||
# block
|
||
0 search/4096 try:
|
||
>&0 regex \^\\s*except.*: Python script text executable
|
||
!:mime text/x-python
|
||
>&0 search/4096 finally: Python script text executable
|
||
!:mime text/x-python
|
||
|
||
# def name(args, args):
|
||
0 regex \^(\ |\\t)*def\ +[a-zA-Z]+
|
||
>&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable
|
||
!:mime text/x-python
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
|
||
# file(1) magic for revision control files
|
||
# From Hendrik Scholz <hendrik@scholz.net>
|
||
0 string/t /1\ :pserver: cvs password text file
|
||
|
||
# Conary changesets
|
||
# From: Jonathan Smith <smithj@rpath.com>
|
||
0 belong 0xea3f81bb Conary changeset data
|
||
|
||
# Type: Git bundles (git-bundle)
|
||
# From: Josh Triplett <josh@freedesktop.org>
|
||
0 string #\ v2\ git\ bundle\n Git bundle
|
||
|
||
# Type: Git pack
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
|
||
# those have a little-endian offset immediately following the magic 'PACK',
|
||
# the first byte of which is never 0, while the first byte of the Git pack
|
||
# version, since it's a tiny number stored in big-endian format, is always 0.
|
||
0 string PACK\0 Git pack
|
||
>4 belong >0 \b, version %d
|
||
>>8 belong >0 \b, %d objects
|
||
|
||
# Type: Git pack index
|
||
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
0 string \377tOc Git pack index
|
||
>4 belong =2 \b, version 2
|
||
|
||
# Type: Git index file
|
||
# From: Frederic Briare <fbriere@fbriere.net>
|
||
0 string DIRC Git index
|
||
>4 belong >0 \b, version %d
|
||
>>8 belong >0 \b, %d entries
|
||
|
||
# Type: Mercurial bundles
|
||
# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
|
||
0 string HG10 Mercurial bundle,
|
||
>4 string UN uncompressed
|
||
>4 string BZ bzip2 compressed
|
||
|
||
# Type: Subversion (SVN) dumps
|
||
# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
|
||
0 string SVN-fs-dump-format-version: Subversion dumpfile
|
||
>28 string >\0 (version: %s)
|
||
|
||
# Type: Bazaar revision bundles and merge requests
|
||
# URL: http://www.bazaar-vcs.org/
|
||
# From: Jelmer Vernooij <jelmer@samba.org>
|
||
0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle
|
||
0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $
|
||
# riff: file(1) magic for RIFF format
|
||
# See
|
||
#
|
||
# http://www.seanet.com/users/matts/riffmci/riffmci.htm
|
||
#
|
||
# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
|
||
#
|
||
0 string RIFF RIFF (little-endian) data
|
||
# RIFF Palette format
|
||
>8 string PAL \b, palette
|
||
>>16 leshort x \b, version %d
|
||
>>18 leshort x \b, %d entries
|
||
# RIFF Device Independent Bitmap format
|
||
>8 string RDIB \b, device-independent bitmap
|
||
>>16 string BM
|
||
>>>30 leshort 12 \b, OS/2 1.x format
|
||
>>>>34 leshort x \b, %d x
|
||
>>>>36 leshort x %d
|
||
>>>30 leshort 64 \b, OS/2 2.x format
|
||
>>>>34 leshort x \b, %d x
|
||
>>>>36 leshort x %d
|
||
>>>30 leshort 40 \b, Windows 3.x format
|
||
>>>>34 lelong x \b, %d x
|
||
>>>>38 lelong x %d x
|
||
>>>>44 leshort x %d
|
||
# RIFF MIDI format
|
||
>8 string RMID \b, MIDI
|
||
# RIFF Multimedia Movie File format
|
||
>8 string RMMP \b, multimedia movie
|
||
# RIFF wrapper for MP3
|
||
>8 string RMP3 \b, MPEG Layer 3 audio
|
||
# Microsoft WAVE format (*.wav)
|
||
>8 string WAVE \b, WAVE audio
|
||
!:mime audio/x-wav
|
||
>>20 leshort 1 \b, Microsoft PCM
|
||
>>>34 leshort >0 \b, %d bit
|
||
>>20 leshort 2 \b, Microsoft ADPCM
|
||
>>20 leshort 6 \b, ITU G.711 A-law
|
||
>>20 leshort 7 \b, ITU G.711 mu-law
|
||
>>20 leshort 8 \b, Microsoft DTS
|
||
>>20 leshort 17 \b, IMA ADPCM
|
||
>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
|
||
>>20 leshort 49 \b, GSM 6.10
|
||
>>20 leshort 64 \b, ITU G.721 ADPCM
|
||
>>20 leshort 80 \b, MPEG
|
||
>>20 leshort 85 \b, MPEG Layer 3
|
||
>>20 leshort 0x2001 \b, DTS
|
||
>>22 leshort =1 \b, mono
|
||
>>22 leshort =2 \b, stereo
|
||
>>22 leshort >2 \b, %d channels
|
||
>>24 lelong >0 %d Hz
|
||
# Corel Draw Picture
|
||
>8 string CDRA \b, Corel Draw Picture
|
||
!:mime image/x-coreldraw
|
||
# AVI == Audio Video Interleave
|
||
>8 string AVI\040 \b, AVI
|
||
!:mime video/x-msvideo
|
||
>>12 string LIST
|
||
>>>20 string hdrlavih
|
||
>>>>&36 lelong x \b, %lu x
|
||
>>>>&40 lelong x %lu,
|
||
>>>>&4 lelong >1000000 <1 fps,
|
||
>>>>&4 lelong 1000000 1.00 fps,
|
||
>>>>&4 lelong 500000 2.00 fps,
|
||
>>>>&4 lelong 333333 3.00 fps,
|
||
>>>>&4 lelong 250000 4.00 fps,
|
||
>>>>&4 lelong 200000 5.00 fps,
|
||
>>>>&4 lelong 166667 6.00 fps,
|
||
>>>>&4 lelong 142857 7.00 fps,
|
||
>>>>&4 lelong 125000 8.00 fps,
|
||
>>>>&4 lelong 111111 9.00 fps,
|
||
>>>>&4 lelong 100000 10.00 fps,
|
||
# ]9.9,10.1[
|
||
>>>>&4 lelong <101010
|
||
>>>>>&-4 lelong >99010
|
||
>>>>>>&-4 lelong !100000 ~10 fps,
|
||
>>>>&4 lelong 83333 12.00 fps,
|
||
# ]11.9,12.1[
|
||
>>>>&4 lelong <84034
|
||
>>>>>&-4 lelong >82645
|
||
>>>>>>&-4 lelong !83333 ~12 fps,
|
||
>>>>&4 lelong 66667 15.00 fps,
|
||
# ]14.9,15.1[
|
||
>>>>&4 lelong <67114
|
||
>>>>>&-4 lelong >66225
|
||
>>>>>>&-4 lelong !66667 ~15 fps,
|
||
>>>>&4 lelong 50000 20.00 fps,
|
||
>>>>&4 lelong 41708 23.98 fps,
|
||
>>>>&4 lelong 41667 24.00 fps,
|
||
# ]23.9,24.1[
|
||
>>>>&4 lelong <41841
|
||
>>>>>&-4 lelong >41494
|
||
>>>>>>&-4 lelong !41708
|
||
>>>>>>>&-4 lelong !41667 ~24 fps,
|
||
>>>>&4 lelong 40000 25.00 fps,
|
||
# ]24.9,25.1[
|
||
>>>>&4 lelong <40161
|
||
>>>>>&-4 lelong >39841
|
||
>>>>>>&-4 lelong !40000 ~25 fps,
|
||
>>>>&4 lelong 33367 29.97 fps,
|
||
>>>>&4 lelong 33333 30.00 fps,
|
||
# ]29.9,30.1[
|
||
>>>>&4 lelong <33445
|
||
>>>>>&-4 lelong >33223
|
||
>>>>>>&-4 lelong !33367
|
||
>>>>>>>&-4 lelong !33333 ~30 fps,
|
||
>>>>&4 lelong <32224 >30 fps,
|
||
##>>>>&4 lelong x (%lu)
|
||
##>>>>&20 lelong x %lu frames,
|
||
# Note: The tests below assume that the AVI has 1 or 2 streams,
|
||
# "vids" optionally followed by "auds".
|
||
# (Should cover 99.9% of all AVIs.)
|
||
# assuming avih length = 56
|
||
>>>88 string LIST
|
||
>>>>96 string strlstrh
|
||
>>>>>108 string vids video:
|
||
>>>>>>&0 lelong 0 uncompressed
|
||
# skip past vids strh
|
||
>>>>>>(104.l+108) string strf
|
||
>>>>>>>(104.l+132) lelong 1 RLE 8bpp
|
||
>>>>>>>(104.l+132) string/c cvid Cinepak
|
||
>>>>>>>(104.l+132) string/c i263 Intel I.263
|
||
>>>>>>>(104.l+132) string/c iv32 Indeo 3.2
|
||
>>>>>>>(104.l+132) string/c iv41 Indeo 4.1
|
||
>>>>>>>(104.l+132) string/c iv50 Indeo 5.0
|
||
>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
|
||
>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
|
||
>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
|
||
>>>>>>>(104.l+132) string/c mjpg Motion JPEG
|
||
>>>>>>>(104.l+132) string/c div3 DivX 3
|
||
>>>>>>>>112 string/c div3 Low-Motion
|
||
>>>>>>>>112 string/c div4 Fast-Motion
|
||
>>>>>>>(104.l+132) string/c divx DivX 4
|
||
>>>>>>>(104.l+132) string/c dx50 DivX 5
|
||
>>>>>>>(104.l+132) string/c xvid XviD
|
||
>>>>>>>(104.l+132) string/c h264 H.264
|
||
>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
|
||
>>>>>>>(104.l+132) string/c h264 X.264 or H.264
|
||
>>>>>>>(104.l+132) lelong 0
|
||
##>>>>>>>(104.l+132) string x (%.4s)
|
||
# skip past first (video) LIST
|
||
>>>>(92.l+96) string LIST
|
||
>>>>>(92.l+104) string strlstrh
|
||
>>>>>>(92.l+116) string auds \b, audio:
|
||
# auds strh length = 56:
|
||
>>>>>>>(92.l+172) string strf
|
||
>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
|
||
>>>>>>>>(92.l+180) leshort 0x0002 ADPCM
|
||
>>>>>>>>(92.l+180) leshort 0x0006 aLaw
|
||
>>>>>>>>(92.l+180) leshort 0x0007 uLaw
|
||
>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
|
||
>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
|
||
>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
|
||
>>>>>>>>(92.l+180) leshort 0x0161 DivX
|
||
##>>>>>>>>(92.l+180) leshort x (0x%.4x)
|
||
>>>>>>>>(92.l+182) leshort 1 (mono,
|
||
>>>>>>>>(92.l+182) leshort 2 (stereo,
|
||
>>>>>>>>(92.l+182) leshort >2 (%d channels,
|
||
>>>>>>>>(92.l+184) lelong x %d Hz)
|
||
# auds strh length = 64:
|
||
>>>>>>>(92.l+180) string strf
|
||
>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
|
||
>>>>>>>>(92.l+188) leshort 0x0002 ADPCM
|
||
>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
|
||
>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
|
||
>>>>>>>>(92.l+188) leshort 0x0161 DivX
|
||
##>>>>>>>>(92.l+188) leshort x (0x%.4x)
|
||
>>>>>>>>(92.l+190) leshort 1 (mono,
|
||
>>>>>>>>(92.l+190) leshort 2 (stereo,
|
||
>>>>>>>>(92.l+190) leshort >2 (%d channels,
|
||
>>>>>>>>(92.l+192) lelong x %d Hz)
|
||
# Animated Cursor format
|
||
>8 string ACON \b, animated cursor
|
||
# SoundFont 2 <mpruett@sgi.com>
|
||
>8 string sfbk SoundFont/Bank
|
||
# MPEG-1 wrapped in a RIFF, apparently
|
||
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
|
||
>8 string 4XMV \b, 4X Movie file
|
||
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
|
||
>8 string AMV\040 \b, AMV
|
||
|
||
#
|
||
# XXX - some of the below may only appear in little-endian form.
|
||
#
|
||
# Also "MV93" appears to be for one form of Macromedia Director
|
||
# files, and "GDMF" appears to be another multimedia format.
|
||
#
|
||
0 string RIFX RIFF (big-endian) data
|
||
# RIFF Palette format
|
||
>8 string PAL \b, palette
|
||
>>16 beshort x \b, version %d
|
||
>>18 beshort x \b, %d entries
|
||
# RIFF Device Independent Bitmap format
|
||
>8 string RDIB \b, device-independent bitmap
|
||
>>16 string BM
|
||
>>>30 beshort 12 \b, OS/2 1.x format
|
||
>>>>34 beshort x \b, %d x
|
||
>>>>36 beshort x %d
|
||
>>>30 beshort 64 \b, OS/2 2.x format
|
||
>>>>34 beshort x \b, %d x
|
||
>>>>36 beshort x %d
|
||
>>>30 beshort 40 \b, Windows 3.x format
|
||
>>>>34 belong x \b, %d x
|
||
>>>>38 belong x %d x
|
||
>>>>44 beshort x %d
|
||
# RIFF MIDI format
|
||
>8 string RMID \b, MIDI
|
||
# RIFF Multimedia Movie File format
|
||
>8 string RMMP \b, multimedia movie
|
||
# Microsoft WAVE format (*.wav)
|
||
>8 string WAVE \b, WAVE audio
|
||
>>20 leshort 1 \b, Microsoft PCM
|
||
>>>34 leshort >0 \b, %d bit
|
||
>>22 beshort =1 \b, mono
|
||
>>22 beshort =2 \b, stereo
|
||
>>22 beshort >2 \b, %d channels
|
||
>>24 belong >0 %d Hz
|
||
# Corel Draw Picture
|
||
>8 string CDRA \b, Corel Draw Picture
|
||
# AVI == Audio Video Interleave
|
||
>8 string AVI\040 \b, AVI
|
||
# Animated Cursor format
|
||
>8 string ACON \b, animated cursor
|
||
# Notation Interchange File Format (big-endian only)
|
||
>8 string NIFF \b, Notation Interchange File Format
|
||
# SoundFont 2 <mpruett@sgi.com>
|
||
>8 string sfbk SoundFont/Bank
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Sony Wave64
|
||
# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
|
||
# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
|
||
0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data
|
||
# 128 bit + total file size (64 bits) so 24 bytes
|
||
# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
|
||
>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio
|
||
!:mime audio/x-w64
|
||
# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
|
||
>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b
|
||
>>>&10 leshort =1 \b, mono
|
||
>>>&10 leshort =2 \b, stereo
|
||
>>>&10 leshort >2 \b, %d channels
|
||
>>>&12 lelong >0 %d Hz
|
||
|
||
#------------------------------------------------------------------------------
|
||
# MBWF/RF64
|
||
# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
|
||
0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio
|
||
!:mime audio/x-wav
|
||
>40 search/256 fmt\x20 \b
|
||
>>&6 leshort =1 \b, mono
|
||
>>&6 leshort =2 \b, stereo
|
||
>>&6 leshort >2 \b, %d channels
|
||
>>&8 lelong >0 %d Hz
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
|
||
# rinex: file(1) magic for RINEX files
|
||
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
|
||
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
|
||
# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
|
||
60 string RINEX
|
||
>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/broadcast
|
||
>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp)
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/observation
|
||
>80 search/256 XXRINEXC RINEX Data, Clock
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/clock
|
||
>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/navigation
|
||
>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/navigation
|
||
>80 search/256 XXRINEXL RINEX Data, Galileo Navigation
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/navigation
|
||
>80 search/256 XXRINEXM RINEX Data, Meteorological
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/meteorological
|
||
>80 search/256 XXRINEXN RINEX Data, Navigation
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/navigation
|
||
>80 search/256 XXRINEXO RINEX Data, Observation
|
||
>>&32 string x \b, date %15.15s
|
||
>>5 string x \b, version %6.6s
|
||
!:mime rinex/observation
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
|
||
#
|
||
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
|
||
#
|
||
0 belong 0xedabeedb RPM
|
||
!:mime application/x-rpm
|
||
>4 byte x v%d
|
||
>5 byte x \b.%d
|
||
>6 beshort 1 src
|
||
>6 beshort 0 bin
|
||
>>8 beshort 1 i386/x86_64
|
||
>>8 beshort 2 Alpha/Sparc64
|
||
>>8 beshort 3 Sparc
|
||
>>8 beshort 4 MIPS
|
||
>>8 beshort 5 PowerPC
|
||
>>8 beshort 6 68000
|
||
>>8 beshort 7 SGI
|
||
>>8 beshort 8 RS6000
|
||
>>8 beshort 9 IA64
|
||
>>8 beshort 10 Sparc64
|
||
>>8 beshort 11 MIPSel
|
||
>>8 beshort 12 ARM
|
||
>>8 beshort 13 MiNT
|
||
>>8 beshort 14 S/390
|
||
>>8 beshort 15 S/390x
|
||
>>8 beshort 16 PowerPC64
|
||
>>8 beshort 17 SuperH
|
||
>>8 beshort 18 Xtensa
|
||
>>8 beshort 255 noarch
|
||
|
||
#delta RPM Daniel Novotny (dnovotny@redhat.com)
|
||
0 string drpm Delta RPM
|
||
!:mime application/x-rpm
|
||
>12 string x %s
|
||
>>8 beshort 11 MIPSel
|
||
>>8 beshort 12 ARM
|
||
>>8 beshort 13 MiNT
|
||
>>8 beshort 14 S/390
|
||
>>8 beshort 15 S/390x
|
||
>>8 beshort 16 PowerPC64
|
||
>>8 beshort 17 SuperH
|
||
>>8 beshort 18 Xtensa
|
||
>>10 string x %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
|
||
# rtf: file(1) magic for Rich Text Format (RTF)
|
||
#
|
||
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
|
||
#
|
||
0 string {\\rtf Rich Text Format data,
|
||
!:mime text/rtf
|
||
>5 string 1 version 1,
|
||
>>6 string \\ansi ANSI
|
||
>>6 string \\mac Apple Macintosh
|
||
>>6 string \\pc IBM PC, code page 437
|
||
>>6 string \\pca IBM PS/2, code page 850
|
||
>>6 default x unknown character set
|
||
>5 default x unknown version
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $
|
||
# ruby: file(1) magic for Ruby scripting language
|
||
# URL: http://www.ruby-lang.org/
|
||
# From: Reuben Thomas <rrt@sc3d.org>
|
||
|
||
# Ruby scripts
|
||
0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
|
||
!:mime text/x-ruby
|
||
0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
|
||
!:mime text/x-ruby
|
||
0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
|
||
!:mime text/x-ruby
|
||
0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
|
||
!:mime text/x-ruby
|
||
|
||
# What looks like ruby, but does not have a shebang
|
||
# (modules and such)
|
||
# From: Lubomir Rintel <lkundrak@v3.sk>
|
||
0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+'
|
||
>0 regex include\ [A-Z]|def\ [a-z]|\ do$
|
||
>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text
|
||
!:mime text/x-ruby
|
||
0 regex \^[\ \t]*(class|module)[\ \t][A-Z]
|
||
>0 regex (modul|includ)e\ [A-Z]|def\ [a-z]
|
||
>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text
|
||
!:mime text/x-ruby
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# sc: file(1) magic for "sc" spreadsheet
|
||
#
|
||
38 string Spreadsheet sc spreadsheet file
|
||
!:mime application/x-sc
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# sccs: file(1) magic for SCCS archives
|
||
#
|
||
# SCCS archive structure:
|
||
# \001h01207
|
||
# \001s 00276/00000/00000
|
||
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
|
||
# \001c date and time created 87/09/23 08:09:20 by ian
|
||
# \001e
|
||
# \001u
|
||
# \001U
|
||
# ... etc.
|
||
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
|
||
# *Sigh*. And these both came from various parts of the USG.
|
||
# Maybe we should just switch everybody from SCCS to RCS!
|
||
# Further, you can't just say '\001h0', because the five-digit number
|
||
# is a checksum that could (presumably) have any leading digit,
|
||
# and we don't have regular expression matching yet.
|
||
# Hence the following official kludge:
|
||
8 string \001s\ SCCS archive data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $
|
||
# scientific: file(1) magic for scientific formats
|
||
#
|
||
# From: Joe Krahn <krahn@niehs.nih.gov>
|
||
|
||
########################################################
|
||
# CCP4 data and plot files:
|
||
0 string MTZ\040 MTZ reflection file
|
||
|
||
92 string PLOT%%84 Plot84 plotting file
|
||
>52 byte 1 , Little-endian
|
||
>55 byte 1 , Big-endian
|
||
|
||
########################################################
|
||
# Electron density MAP/MASK formats
|
||
|
||
0 string EZD_MAP NEWEZD Electron Density Map
|
||
109 string MAP\040( Old EZD Electron Density Map
|
||
|
||
0 string/c :-)\040Origin BRIX Electron Density Map
|
||
>170 string >0 , Sigma:%.12s
|
||
#>4 string >0 %.178s
|
||
#>4 addr x %.178s
|
||
|
||
7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
|
||
9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
|
||
|
||
208 string MAP\040 CCP4 Electron Density Map
|
||
# Assumes same stamp for float and double (normal case)
|
||
>212 byte 17 \b, Big-endian
|
||
>212 byte 34 \b, VAX format
|
||
>212 byte 68 \b, Little-endian
|
||
>212 byte 85 \b, Convex native
|
||
|
||
############################################################
|
||
# X-Ray Area Detector images
|
||
0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
|
||
>796 lelong <20 Little-endian, IP #%d,
|
||
>>768 lelong >0 Size=%dx
|
||
>>772 lelong >0 \b%d
|
||
>796 belong <20 Big-endian, IP #%d,
|
||
>>768 belong >0 Size=%dx
|
||
>>772 belong >0 \b%d
|
||
|
||
0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
|
||
>796 lelong <20 Little-endian, IP #%d,
|
||
>>768 lelong >0 Size=%dx
|
||
>>772 lelong >0 \b%d
|
||
>796 belong <20 Big-endian, IP #%d,
|
||
>>768 belong >0 Size=%dx
|
||
>>772 belong >0 \b%d
|
||
|
||
|
||
1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
|
||
>1072 ulong >1 Compressed(%d),
|
||
>1100 ulong >1 %d headers,
|
||
>1104 ulong >0 %d x
|
||
>1108 ulong >0 %d,
|
||
>1120 ulong >0 %d bits/pixel
|
||
|
||
# Type: GEDCOM genealogical (family history) data
|
||
# From: Giuseppe Bilotta
|
||
0 search/1/c 0\ HEAD GEDCOM genealogy text
|
||
>&0 search 1\ GEDC
|
||
>>&0 search 2\ VERS version
|
||
>>>&1 search/1 >\0 %s
|
||
# From: Phil Endecott <phil05@chezphil.org>
|
||
0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
|
||
0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
|
||
0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data
|
||
0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data
|
||
|
||
# PDB: Protein Data Bank files
|
||
# Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
#
|
||
# http://www.wwpdb.org/documentation/format32/sect2.html
|
||
# http://www.ch.ic.ac.uk/chemime/
|
||
#
|
||
# The PDB file format is fixed-field, 80 columns. From the spec:
|
||
#
|
||
# COLS DATA
|
||
# 1 - 6 "HEADER"
|
||
# 11 - 50 String(40)
|
||
# 51 - 59 Date
|
||
# 63 - 66 IDcode
|
||
#
|
||
# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
|
||
# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
|
||
# uppercase letters. However, examples have been seen without the date string,
|
||
# e.g., the example on the chemime site.
|
||
0 string HEADER\ \ \ \
|
||
>&0 regex/1 \^.{40}
|
||
>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
|
||
>>>&0 regex/1s [A-Z0-9]{4}.{14}$
|
||
>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s
|
||
!:mime chemical/x-pdb
|
||
>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
|
||
|
||
# Type: GDSII Stream file
|
||
0 belong 0x00060002 GDSII Stream file
|
||
>4 byte 0x00
|
||
>>5 byte x version %d.0
|
||
>4 byte >0x00 version %d
|
||
>>5 byte x \b.%d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
|
||
0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
|
||
0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
|
||
0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
|
||
# Type: SE Linux policy modules *.pp reference policy
|
||
# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
|
||
# URL: http://doc.coker.com.au/computers/selinux-magic
|
||
# From: Russell Coker <russell@coker.com.au>
|
||
|
||
0 lelong 0xf97cff8f SE Linux modular policy
|
||
>4 lelong x version %d,
|
||
>8 lelong x %d sections,
|
||
>>(12.l) lelong 0xf97cff8d
|
||
>>>(12.l+27) lelong x mod version %d,
|
||
>>>(12.l+31) lelong 0 Not MLS,
|
||
>>>(12.l+31) lelong 1 MLS,
|
||
>>>(12.l+23) lelong 2
|
||
>>>>(12.l+47) string >\0 module name %s
|
||
>>>(12.l+23) lelong 1 base
|
||
|
||
1 string policy_module( SE Linux policy module source
|
||
2 string policy_module( SE Linux policy module source
|
||
|
||
0 string ##\ <summary> SE Linux policy interface source
|
||
|
||
#0 search gen_context( SE Linux policy file contexts
|
||
|
||
#0 search gen_sens( SE Linux policy MLS constraints source
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
|
||
# sendmail: file(1) magic for sendmail config files
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 byte 046 Sendmail frozen configuration
|
||
>16 string >\0 - version %s
|
||
0 short 0x271c Sendmail frozen configuration
|
||
>16 string >\0 - version %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# sendmail: file(1) magic for sendmail m4(1) files
|
||
#
|
||
# From Hendrik Scholz <hendrik@scholz.net>
|
||
# i.e. files in /usr/share/sendmail/cf/
|
||
#
|
||
0 string divert(-1)\n sendmail m4 text file
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
|
||
# sequent: file(1) magic for Sequent machines
|
||
#
|
||
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
|
||
# For Sequent's multiprocessor systems (incomplete).
|
||
0 lelong 0x00ea BALANCE NS32000 .o
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 lelong 0x30ea BALANCE NS32000 standalone executable
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
#
|
||
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
|
||
# Symmetry magic nums will not be reached if DOS COM comes before them;
|
||
# byte 0xeb is matched before these get a chance.
|
||
0 leshort 0x12eb SYMMETRY i386 .o
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
0 leshort 0x42eb SYMMETRY i386 standalone executable
|
||
>16 lelong >0 not stripped
|
||
>124 lelong >0 version %ld
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $
|
||
# sgi: file(1) magic for Silicon Graphics operating systems and applications
|
||
#
|
||
# Executable images are handled either in aout (for old-style a.out
|
||
# files for 68K; they are indistinguishable from other big-endian 32-bit
|
||
# a.out files) or in mips (for MIPS ECOFF and Ucode files)
|
||
#
|
||
|
||
# kbd file definitions
|
||
0 string kbd!map kbd map file
|
||
>8 byte >0 Ver %d:
|
||
>10 short >0 with %d table(s)
|
||
|
||
0 beshort 0x8765 disk quotas file
|
||
|
||
0 beshort 0x0506 IRIS Showcase file
|
||
>2 byte 0x49 -
|
||
>3 byte x - version %ld
|
||
0 beshort 0x0226 IRIS Showcase template
|
||
>2 byte 0x63 -
|
||
>3 byte x - version %ld
|
||
0 belong 0x5343464d IRIS Showcase file
|
||
>4 byte x - version %ld
|
||
0 belong 0x5443464d IRIS Showcase template
|
||
>4 byte x - version %ld
|
||
0 belong 0xdeadbabe IRIX Parallel Arena
|
||
>8 belong >0 - version %ld
|
||
|
||
# core files
|
||
#
|
||
# 32bit core file
|
||
0 belong 0xdeadadb0 IRIX core dump
|
||
>4 belong 1 of
|
||
>16 string >\0 '%s'
|
||
# 64bit core file
|
||
0 belong 0xdeadad40 IRIX 64-bit core dump
|
||
>4 belong 1 of
|
||
>16 string >\0 '%s'
|
||
# N32bit core file
|
||
0 belong 0xbabec0bb IRIX N32 core dump
|
||
>4 belong 1 of
|
||
>16 string >\0 '%s'
|
||
# New style crash dump file
|
||
0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
|
||
>36 string >\0 '%s'
|
||
|
||
# Trusted IRIX info
|
||
0 string SGIAUDIT SGI Audit file
|
||
>8 byte x - version %d
|
||
>9 byte x \b.%ld
|
||
#
|
||
0 string WNGZWZSC Wingz compiled script
|
||
0 string WNGZWZSS Wingz spreadsheet
|
||
0 string WNGZWZHP Wingz help file
|
||
#
|
||
0 string #Inventor V IRIS Inventor 1.0 file
|
||
0 string #Inventor V2 Open Inventor 2.0 file
|
||
# GLF is OpenGL stream encoding
|
||
0 string glfHeadMagic(); GLF_TEXT
|
||
4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
|
||
!:strength -30
|
||
4 belong 0x0000007d GLF_BINARY_MSB_FIRST
|
||
!:strength -30
|
||
# GLS is OpenGL stream encoding; GLS is the successor of GLF
|
||
0 string glsBeginGLS( GLS_TEXT
|
||
4 belong 0x10000000 GLS_BINARY_LSB_FIRST
|
||
!:strength -30
|
||
4 belong 0x00000010 GLS_BINARY_MSB_FIRST
|
||
!:strength -30
|
||
|
||
#
|
||
#
|
||
# Performance Co-Pilot file types
|
||
0 string PmNs PCP compiled namespace (V.0)
|
||
0 string PmN PCP compiled namespace
|
||
>3 string >\0 (V.%1.1s)
|
||
#3 lelong 0x84500526 PCP archive
|
||
3 belong 0x84500526 PCP archive
|
||
>7 byte x (V.%d)
|
||
#>20 lelong -2 temporal index
|
||
#>20 lelong -1 metadata
|
||
#>20 lelong 0 log volume #0
|
||
#>20 lelong >0 log volume #%ld
|
||
>20 belong -2 temporal index
|
||
>20 belong -1 metadata
|
||
>20 belong 0 log volume #0
|
||
>20 belong >0 log volume #%ld
|
||
>24 string >\0 host: %s
|
||
0 string PCPFolio PCP
|
||
>9 string Version: Archive Folio
|
||
>18 string >\0 (V.%s)
|
||
0 string #pmchart PCP pmchart view
|
||
>9 string Version
|
||
>17 string >\0 (V%-3.3s)
|
||
0 string #kmchart PCP kmchart view
|
||
>9 string Version
|
||
>17 string >\0 (V.%s)
|
||
0 string pmview PCP pmview config
|
||
>7 string Version
|
||
>15 string >\0 (V%-3.3s)
|
||
0 string #pmlogger PCP pmlogger config
|
||
>10 string Version
|
||
>18 string >\0 (V%1.1s)
|
||
0 string #pmdahotproc PCP pmdahotproc config
|
||
>13 string Version
|
||
>21 string >\0 (V%-3.3s)
|
||
0 string PcPh PCP Help
|
||
>4 string 1 Index
|
||
>4 string 2 Text
|
||
>5 string >\0 (V.%1.1s)
|
||
0 string #pmieconf-rules PCP pmieconf rules
|
||
>16 string >\0 (V.%1.1s)
|
||
3 string pmieconf-pmie PCP pmie config
|
||
>17 string >\0 (V.%1.1s)
|
||
|
||
# SpeedShop data files
|
||
0 lelong 0x13130303 SpeedShop data file
|
||
|
||
# mdbm files
|
||
0 lelong 0x01023962 mdbm file, version 0 (obsolete)
|
||
0 string mdbm mdbm file,
|
||
>5 byte x version %d,
|
||
>6 byte x 2^%d pages,
|
||
>7 byte x pagesize 2^%d,
|
||
>17 byte x hash %d,
|
||
>11 byte x dataformat %d
|
||
|
||
# Alias Maya files
|
||
0 string/t //Maya ASCII Alias Maya Ascii File,
|
||
>13 string >\0 version %s
|
||
8 string MAYAFOR4 Alias Maya Binary File,
|
||
>32 string >\0 version %s scene
|
||
8 string MayaFOR4 Alias Maya Binary File,
|
||
>32 string >\0 version %s scene
|
||
8 string CIMG Alias Maya Image File
|
||
8 string DEEP Alias Maya Image File
|
||
#------------------------------------------------------------------------------
|
||
# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $
|
||
# Type: SVG Vectorial Graphics
|
||
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
|
||
0 string \<?xml\ version="
|
||
>15 string >\0
|
||
>>19 search/4096 \<svg SVG Scalable Vector Graphics image
|
||
!:mime image/svg+xml
|
||
>>19 search/4096 \<gnc-v2 GnuCash file
|
||
!:mime application/x-gnucash
|
||
|
||
# Sitemap file
|
||
0 string/t \<?xml\ version="
|
||
>15 string >\0
|
||
>>19 search/4096 \<urlset XML Sitemap document text
|
||
!:mime application/xml-sitemap
|
||
|
||
# xhtml
|
||
0 string/t \<?xml\ version="
|
||
>15 string >\0
|
||
>>19 search/4096/cWbt \<!doctype\ html XHTML document text
|
||
!:mime text/html
|
||
0 string/t \<?xml\ version='
|
||
>15 string >\0
|
||
>>19 search/4096/cWbt \<!doctype\ html XHTML document text
|
||
!:mime text/html
|
||
0 string/t \<?xml\ version="
|
||
>15 string >\0
|
||
>>19 search/4096/cWbt \<html broken XHTML document text
|
||
!:mime text/html
|
||
|
||
#------------------------------------------------------------------------------
|
||
# sgml: file(1) magic for Standard Generalized Markup Language
|
||
# HyperText Markup Language (HTML) is an SGML document type,
|
||
# from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
|
||
0 search/4096/cWt \<!doctype\ html HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<head HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<title HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<html HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<script HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<style HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<table HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
0 search/4096/cwt \<a\ href= HTML document text
|
||
!:mime text/html
|
||
!:strength + 5
|
||
|
||
# Extensible markup language (XML), a subset of SGML
|
||
# from Marc Prud'hommeaux (marc@apocalypse.org)
|
||
0 search/1/cwt \<?xml XML document text
|
||
!:mime application/xml
|
||
!:strength + 5
|
||
0 string/t \<?xml\ version\ " XML
|
||
!:mime application/xml
|
||
!:strength + 5
|
||
0 string/t \<?xml\ version=" XML
|
||
!:mime application/xml
|
||
!:strength + 5
|
||
>15 string/t >\0 %.3s document text
|
||
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
|
||
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
|
||
0 string \<?xml\ version=' XML
|
||
!:mime application/xml
|
||
!:strength + 5
|
||
>15 string/t >\0 %.3s document text
|
||
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
|
||
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
|
||
0 search/1/wbt \<?xml XML document text
|
||
!:mime application/xml
|
||
!:strength - 10
|
||
0 search/1/wt \<?XML broken XML document text
|
||
!:mime application/xml
|
||
!:strength - 10
|
||
|
||
|
||
# SGML, mostly from rph@sq
|
||
0 search/4096/cwt \<!doctype exported SGML document text
|
||
0 search/4096/cwt \<!subdoc exported SGML subdocument text
|
||
0 search/4096/cwt \<!-- exported SGML document text
|
||
!:strength - 10
|
||
|
||
# Web browser cookie files
|
||
# (Mozilla, Galeon, Netscape 4, Konqueror..)
|
||
# Ulf Harnhammar <ulfh@update.uu.se>
|
||
0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text
|
||
0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
|
||
0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
|
||
|
||
#------------------------------------------------------------------------
|
||
# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# file(1) magic for sharc files
|
||
#
|
||
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
|
||
# FutureGroove Music (dsp@futuregroove.de)
|
||
|
||
#------------------------------------------------------------------------
|
||
#0 string Draw RiscOS Drawfile
|
||
#0 string PACK RiscOS PackdDir archive
|
||
|
||
#------------------------------------------------------------------------
|
||
# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
|
||
|
||
#0 string =! Assembler source
|
||
#0 string Analog ADi asm listing file
|
||
0 string .SYSTEM SHARC architecture file
|
||
0 string .system SHARC architecture file
|
||
|
||
0 leshort 0x521C SHARC COFF binary
|
||
>2 leshort >1 , %hd sections
|
||
>>12 lelong >0 , not stripped
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $
|
||
# sinclair: file(1) sinclair QL
|
||
|
||
# additions to /etc/magic by Thomas M. Ott (ThMO)
|
||
|
||
# Sinclair QL floppy disk formats (ThMO)
|
||
0 string =QL5 QL disk dump data,
|
||
>3 string =A 720 KB,
|
||
>3 string =B 1.44 MB,
|
||
>3 string =C 3.2 MB,
|
||
>4 string >\0 label:%.10s
|
||
|
||
# Sinclair QL OS dump (ThMO)
|
||
# (NOTE: if `file' would be able to use indirect references in a endian format
|
||
# differing from the natural host format, this could be written more
|
||
# reliably and faster...)
|
||
#
|
||
# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
|
||
# than the first 8K of a file... #-(
|
||
#
|
||
#0 belong =0x30000
|
||
#>49124 belong <47104
|
||
#>>49128 belong <47104
|
||
#>>>49132 belong <47104
|
||
#>>>>49136 belong <47104 QL OS dump data,
|
||
#>>>>>49148 string >\0 type %.3s,
|
||
#>>>>>49142 string >\0 version %.4s
|
||
|
||
# Sinclair QL firmware executables (ThMO)
|
||
0 string NqNqNq`\004 QL firmware executable (BCPL)
|
||
|
||
# Sinclair QL libraries (was ThMO)
|
||
0 beshort 0xFB01 QDOS object
|
||
>2 pstring x '%s'
|
||
|
||
# Sinclair QL executables (was ThMO)
|
||
4 belong 0x4AFB QDOS executable
|
||
>9 pstring x '%s'
|
||
|
||
# Sinclair QL ROM (ThMO)
|
||
0 belong =0x4AFB0001 QL plugin-ROM data,
|
||
>9 pstring =\0 un-named
|
||
>9 pstring >\0 named: %s
|
||
# Type: SiSU Markup Language
|
||
# URL: http://www.sisudoc.org/
|
||
# From: Ralph Amissah <ralph.amissah@gmail.com>
|
||
|
||
0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert
|
||
>5 regex [0-9.]+ %s
|
||
|
||
0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master
|
||
>5 regex [0-9.]+ %s
|
||
|
||
0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text
|
||
>5 regex [0-9.]+ %s
|
||
|
||
0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text
|
||
>5 regex [0-9.]+ %s
|
||
|
||
0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text
|
||
>5 regex [0-9.]+ %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $
|
||
# Sketch Drawings: http://sketch.sourceforge.net/
|
||
# From: Edwin Mons <e@ik.nu>
|
||
0 search/1 ##Sketch Sketch document text
|
||
|
||
#-----------------------------------------------
|
||
# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
|
||
# GNU Smalltalk image, starting at version 1.6.2
|
||
# From: catull_us@yahoo.com
|
||
#
|
||
0 string GSTIm\0\0 GNU SmallTalk
|
||
# little-endian
|
||
>7 byte&1 =0 LE image version
|
||
>>10 byte x %d.
|
||
>>9 byte x \b%d.
|
||
>>8 byte x \b%d
|
||
#>>12 lelong x , data: %ld
|
||
#>>16 lelong x , table: %ld
|
||
#>>20 lelong x , memory: %ld
|
||
# big-endian
|
||
>7 byte&1 =1 BE image version
|
||
>>8 byte x %d.
|
||
>>9 byte x \b%d.
|
||
>>10 byte x \b%d
|
||
#>>12 belong x , data: %ld
|
||
#>>16 belong x , table: %ld
|
||
#>>20 belong x , memory: %ld
|
||
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
|
||
# smile: file(1) magic for Smile serialization
|
||
#
|
||
# The Smile serialization format uses a 4-byte header:
|
||
#
|
||
# Constant byte #0: 0x3A (ASCII ':')
|
||
# Constant byte #1: 0x29 (ASCII ')')
|
||
# Constant byte #2: 0x0A (ASCII linefeed, '\n')
|
||
# Variable byte #3, consisting of bits:
|
||
# Bits 4-7 (4 MSB): 4-bit version number
|
||
# Bits 3: Reserved
|
||
# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
|
||
# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
|
||
# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
|
||
#
|
||
# Reference: http://wiki.fasterxml.com/SmileFormatSpec
|
||
# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
|
||
|
||
# Detection
|
||
0 string :)\n Smile binary data
|
||
|
||
# Versioning
|
||
>3 byte&0xF0 x version %d:
|
||
|
||
# Properties
|
||
>3 byte&0x04 0x04 binary raw,
|
||
>3 byte&0x04 0x00 binary encoded,
|
||
>3 byte&0x02 0x02 shared String values enabled,
|
||
>3 byte&0x02 0x00 shared String values disabled,
|
||
>3 byte&0x01 0x01 shared field names enabled
|
||
>3 byte&0x01 0x00 shared field names disabled
|
||
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
|
||
# sniffer: file(1) magic for packet capture files
|
||
#
|
||
# From: guy@alum.mit.edu (Guy Harris)
|
||
#
|
||
|
||
#
|
||
# Microsoft Network Monitor 1.x capture files.
|
||
#
|
||
0 string RTSS NetMon capture file
|
||
>5 byte x - version %d
|
||
>4 byte x \b.%d
|
||
>6 leshort 0 (Unknown)
|
||
>6 leshort 1 (Ethernet)
|
||
>6 leshort 2 (Token Ring)
|
||
>6 leshort 3 (FDDI)
|
||
>6 leshort 4 (ATM)
|
||
>6 leshort >4 (type %d)
|
||
|
||
#
|
||
# Microsoft Network Monitor 2.x capture files.
|
||
#
|
||
0 string GMBU NetMon capture file
|
||
>5 byte x - version %d
|
||
>4 byte x \b.%d
|
||
>6 leshort 0 (Unknown)
|
||
>6 leshort 1 (Ethernet)
|
||
>6 leshort 2 (Token Ring)
|
||
>6 leshort 3 (FDDI)
|
||
>6 leshort 4 (ATM)
|
||
>6 leshort 5 (IP-over-IEEE 1394)
|
||
>6 leshort 6 (802.11)
|
||
>6 leshort 7 (Raw IP)
|
||
>6 leshort 8 (Raw IP)
|
||
>6 leshort 9 (Raw IP)
|
||
>6 leshort >9 (type %d)
|
||
|
||
#
|
||
# Network General Sniffer capture files.
|
||
# Sorry, make that "Network Associates Sniffer capture files."
|
||
# Sorry, make that "Network General old DOS Sniffer capture files."
|
||
#
|
||
0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
|
||
>33 byte 2 (compressed)
|
||
>23 leshort x - version %d
|
||
>25 leshort x \b.%d
|
||
>32 byte 0 (Token Ring)
|
||
>32 byte 1 (Ethernet)
|
||
>32 byte 2 (ARCNET)
|
||
>32 byte 3 (StarLAN)
|
||
>32 byte 4 (PC Network broadband)
|
||
>32 byte 5 (LocalTalk)
|
||
>32 byte 6 (Znet)
|
||
>32 byte 7 (Internetwork Analyzer)
|
||
>32 byte 9 (FDDI)
|
||
>32 byte 10 (ATM)
|
||
|
||
#
|
||
# Cinco Networks NetXRay capture files.
|
||
# Sorry, make that "Network General Sniffer Basic capture files."
|
||
# Sorry, make that "Network Associates Sniffer Basic capture files."
|
||
# Sorry, make that "Network Associates Sniffer Basic, and Windows
|
||
# Sniffer Pro", capture files."
|
||
# Sorry, make that "Network General Sniffer capture files."
|
||
# Sorry, make that "NetScout Sniffer capture files."
|
||
#
|
||
0 string XCP\0 NetXRay capture file
|
||
>4 string >\0 - version %s
|
||
>44 leshort 0 (Ethernet)
|
||
>44 leshort 1 (Token Ring)
|
||
>44 leshort 2 (FDDI)
|
||
>44 leshort 3 (WAN)
|
||
>44 leshort 8 (ATM)
|
||
>44 leshort 9 (802.11)
|
||
|
||
#
|
||
# "libpcap" capture files.
|
||
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
|
||
# the main program that uses that format, but there are other programs
|
||
# that use "libpcap", or that use the same capture file format.)
|
||
#
|
||
0 name pcap-be
|
||
>4 beshort x - version %d
|
||
>6 beshort x \b.%d
|
||
>20 belong 0 (No link-layer encapsulation
|
||
>20 belong 1 (Ethernet
|
||
>20 belong 2 (3Mb Ethernet
|
||
>20 belong 3 (AX.25
|
||
>20 belong 4 (ProNET
|
||
>20 belong 5 (CHAOS
|
||
>20 belong 6 (Token Ring
|
||
>20 belong 7 (BSD ARCNET
|
||
>20 belong 8 (SLIP
|
||
>20 belong 9 (PPP
|
||
>20 belong 10 (FDDI
|
||
>20 belong 11 (RFC 1483 ATM
|
||
>20 belong 12 (raw IP
|
||
>20 belong 13 (BSD/OS SLIP
|
||
>20 belong 14 (BSD/OS PPP
|
||
>20 belong 19 (Linux ATM Classical IP
|
||
>20 belong 50 (PPP or Cisco HDLC
|
||
>20 belong 51 (PPP-over-Ethernet
|
||
>20 belong 99 (Symantec Enterprise Firewall
|
||
>20 belong 100 (RFC 1483 ATM
|
||
>20 belong 101 (raw IP
|
||
>20 belong 102 (BSD/OS SLIP
|
||
>20 belong 103 (BSD/OS PPP
|
||
>20 belong 104 (BSD/OS Cisco HDLC
|
||
>20 belong 105 (802.11
|
||
>20 belong 106 (Linux Classical IP over ATM
|
||
>20 belong 107 (Frame Relay
|
||
>20 belong 108 (OpenBSD loopback
|
||
>20 belong 109 (OpenBSD IPsec encrypted
|
||
>20 belong 112 (Cisco HDLC
|
||
>20 belong 113 (Linux "cooked"
|
||
>20 belong 114 (LocalTalk
|
||
>20 belong 117 (OpenBSD PFLOG
|
||
>20 belong 119 (802.11 with Prism header
|
||
>20 belong 122 (RFC 2625 IP over Fibre Channel
|
||
>20 belong 123 (SunATM
|
||
>20 belong 127 (802.11 with radiotap header
|
||
>20 belong 129 (Linux ARCNET
|
||
>20 belong 138 (Apple IP over IEEE 1394
|
||
>20 belong 139 (MTP2 with pseudo-header
|
||
>20 belong 140 (MTP2
|
||
>20 belong 141 (MTP3
|
||
>20 belong 142 (SCCP
|
||
>20 belong 143 (DOCSIS
|
||
>20 belong 144 (IrDA
|
||
>20 belong 147 (Private use 0
|
||
>20 belong 148 (Private use 1
|
||
>20 belong 149 (Private use 2
|
||
>20 belong 150 (Private use 3
|
||
>20 belong 151 (Private use 4
|
||
>20 belong 152 (Private use 5
|
||
>20 belong 153 (Private use 6
|
||
>20 belong 154 (Private use 7
|
||
>20 belong 155 (Private use 8
|
||
>20 belong 156 (Private use 9
|
||
>20 belong 157 (Private use 10
|
||
>20 belong 158 (Private use 11
|
||
>20 belong 159 (Private use 12
|
||
>20 belong 160 (Private use 13
|
||
>20 belong 161 (Private use 14
|
||
>20 belong 162 (Private use 15
|
||
>20 belong 163 (802.11 with AVS header
|
||
>20 belong 165 (BACnet MS/TP
|
||
>20 belong 166 (PPPD
|
||
>20 belong 169 (GPRS LLC
|
||
>20 belong 177 (Linux LAPD
|
||
>20 belong 187 (Bluetooth HCI H4
|
||
>20 belong 189 (Linux USB
|
||
>20 belong 192 (PPI
|
||
>20 belong 195 (802.15.4
|
||
>20 belong 196 (SITA
|
||
>20 belong 197 (Endace ERF
|
||
>20 belong 201 (Bluetooth HCI H4 with pseudo-header
|
||
>20 belong 202 (AX.25 with KISS header
|
||
>20 belong 203 (LAPD
|
||
>20 belong 204 (PPP with direction pseudo-header
|
||
>20 belong 205 (Cisco HDLC with direction pseudo-header
|
||
>20 belong 206 (Frame Relay with direction pseudo-header
|
||
>20 belong 209 (Linux IPMB
|
||
>20 belong 215 (802.15.4 with non-ASK PHY header
|
||
>20 belong 220 (Memory-mapped Linux USB
|
||
>20 belong 224 (Fibre Channel FC-2
|
||
>20 belong 225 (Fibre Channel FC-2 with frame delimiters
|
||
>20 belong 226 (Solaris IPNET
|
||
>20 belong 227 (SocketCAN
|
||
>20 belong 228 (Raw IPv4
|
||
>20 belong 229 (Raw IPv6
|
||
>20 belong 230 (802.15.4 without FCS
|
||
>20 belong 231 (D-Bus messages
|
||
>20 belong 235 (DVB-CI
|
||
>20 belong 236 (MUX27010
|
||
>20 belong 237 (STANAG 5066 D_PDUs
|
||
>20 belong 239 (Linux netlink NFLOG messages
|
||
>20 belong 240 (Hilscher netAnalyzer
|
||
>20 belong 241 (Hilscher netAnalyzer with delimiters
|
||
>20 belong 242 (IP-over-Infiniband
|
||
>20 belong 243 (MPEG-2 Transport Stream packets
|
||
>20 belong 244 (ng4t ng40
|
||
>20 belong 245 (NFC LLCP
|
||
>20 belong 247 (Infiniband
|
||
>20 belong 248 (SCTP
|
||
>16 belong x \b, capture length %d)
|
||
|
||
0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
|
||
!:mime application/vnd.tcpdump.pcap
|
||
>0 use pcap-be
|
||
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
|
||
!:mime application/vnd.tcpdump.pcap
|
||
>0 use \^pcap-be
|
||
|
||
#
|
||
# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
|
||
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
|
||
# the main program that uses that format, but there are other programs
|
||
# that use "libpcap", or that use the same capture file format.)
|
||
#
|
||
0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
|
||
>0 use pcap-be
|
||
0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
|
||
>0 use \^pcap-be
|
||
|
||
#
|
||
# "pcap-ng" capture files.
|
||
# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
|
||
# Pcap-ng files can contain multiple sections. Printing the endianness,
|
||
# snaplen, or other information from the first SHB may be misleading.
|
||
#
|
||
0 ubelong 0x0a0d0d0a
|
||
>8 ubelong 0x1a2b3c4d pcap-ng capture file
|
||
>>12 beshort x - version %d
|
||
>>14 beshort x \b.%d
|
||
0 ulelong 0x0a0d0d0a
|
||
>8 ulelong 0x1a2b3c4d pcap-ng capture file
|
||
>>12 leshort x - version %d
|
||
>>14 leshort x \b.%d
|
||
|
||
#
|
||
# AIX "iptrace" capture files.
|
||
#
|
||
0 string iptrace\ 1.0 "iptrace" capture file
|
||
0 string iptrace\ 2.0 "iptrace" capture file
|
||
|
||
#
|
||
# Novell LANalyzer capture files.
|
||
#
|
||
0 leshort 0x1001 LANalyzer capture file
|
||
0 leshort 0x1007 LANalyzer capture file
|
||
|
||
#
|
||
# HP-UX "nettl" capture files.
|
||
#
|
||
0 string \x54\x52\x00\x64\x00 "nettl" capture file
|
||
|
||
#
|
||
# RADCOM WAN/LAN Analyzer capture files.
|
||
#
|
||
0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
|
||
|
||
#
|
||
# NetStumbler log files. Not really packets, per se, but about as
|
||
# close as you can get. These are log files from NetStumbler, a
|
||
# Windows program, that scans for 802.11b networks.
|
||
#
|
||
0 string NetS NetStumbler log file
|
||
>8 lelong x \b, %d stations found
|
||
|
||
#
|
||
# *Peek tagged capture files.
|
||
#
|
||
0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file
|
||
|
||
#
|
||
# Visual Networks traffic capture files.
|
||
#
|
||
0 string \x05VNF Visual Networks traffic capture file
|
||
|
||
#
|
||
# Network Instruments Observer capture files.
|
||
#
|
||
0 string ObserverPktBuffe Network Instruments Observer capture file
|
||
|
||
#
|
||
# Files from Accellent Group's 5View products.
|
||
#
|
||
0 string \xaa\xaa\xaa\xaa 5View capture file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
|
||
# softquad: file(1) magic for SoftQuad Publishing Software
|
||
#
|
||
# Author/Editor and RulesBuilder
|
||
#
|
||
# XXX - byte order?
|
||
#
|
||
0 string \<!SQ\ DTD> Compiled SGML rules file
|
||
>9 string >\0 Type %s
|
||
0 string \<!SQ\ A/E> A/E SGML Document binary
|
||
>9 string >\0 Type %s
|
||
0 string \<!SQ\ STS> A/E SGML binary styles file
|
||
>9 string >\0 Type %s
|
||
0 short 0xc0de Compiled PSI (v1) data
|
||
0 short 0xc0da Compiled PSI (v2) data
|
||
>3 string >\0 (%s)
|
||
# Binary sqtroff font/desc files...
|
||
0 short 0125252 SoftQuad DESC or font file binary
|
||
>2 short >0 - version %d
|
||
# Bitmaps...
|
||
0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
|
||
#0 string SQ\ BITMAP2 SoftQuad Raster Format data
|
||
# sqtroff intermediate language (replacement for ditroff int. lang.)
|
||
0 string X\ SoftQuad troff Context intermediate
|
||
>2 string 495 for AT&T 495 laser printer
|
||
>2 string hp for Hewlett-Packard LaserJet
|
||
>2 string impr for IMAGEN imPRESS
|
||
>2 string ps for PostScript
|
||
|
||
# From: Michael Piefel <piefel@debian.org>
|
||
# sqtroff intermediate language (replacement for ditroff int. lang.)
|
||
0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
|
||
0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
|
||
0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
|
||
0 string X\ ps SoftQuad troff Context intermediate for PostScript
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
|
||
# spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
|
||
#
|
||
# Cloyce D. Spradling <cloyce@headgear.org>
|
||
|
||
0 string spec SPEC
|
||
>4 string .cpu CPU
|
||
>>8 string <: \b%.4s
|
||
>>12 string . raw result text
|
||
|
||
17 string version=SPECjbb SPECjbb
|
||
>32 string <: \b%.4s
|
||
>>37 string <: v%.4s raw result text
|
||
|
||
0 string BEGIN\040SPECWEB SPECweb
|
||
>13 string <: \b%.2s
|
||
>>15 string _SSL \b_SSL
|
||
>>>20 string <: v%.4s raw result text
|
||
>>16 string <: v%.4s raw result text
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $
|
||
# spectrum: file(1) magic for Spectrum emulator files.
|
||
#
|
||
# John Elliott <jce@seasip.demon.co.uk>
|
||
|
||
#
|
||
# Spectrum +3DOS header
|
||
#
|
||
0 string PLUS3DOS\032 Spectrum +3 data
|
||
>15 byte 0 - BASIC program
|
||
>15 byte 1 - number array
|
||
>15 byte 2 - character array
|
||
>15 byte 3 - memory block
|
||
>>16 belong 0x001B0040 (screen)
|
||
>15 byte 4 - Tasword document
|
||
>15 string TAPEFILE - ZXT tapefile
|
||
#
|
||
# Tape file. This assumes the .TAP starts with a Spectrum-format header,
|
||
# which nearly all will.
|
||
#
|
||
# Update: Sanity-check string contents to be printable.
|
||
# -Adam Buchbinder <adam.buchbinder@gmail.com>
|
||
#
|
||
0 string \023\000\000
|
||
>4 string >\0
|
||
>>4 string <\177 Spectrum .TAP data "%-10.10s"
|
||
>>>3 byte 0 - BASIC program
|
||
>>>3 byte 1 - number array
|
||
>>>3 byte 2 - character array
|
||
>>>3 byte 3 - memory block
|
||
>>>>14 belong 0x001B0040 (screen)
|
||
|
||
# The following three blocks are from pak21-spectrum@srcf.ucam.org
|
||
# TZX tape images
|
||
0 string ZXTape!\x1a Spectrum .TZX data
|
||
>8 byte x version %d
|
||
>9 byte x \b.%d
|
||
|
||
# RZX input recording files
|
||
0 string RZX! Spectrum .RZX data
|
||
>4 byte x version %d
|
||
>5 byte x \b.%d
|
||
|
||
# Floppy disk images
|
||
0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
|
||
0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
|
||
0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
|
||
0 string SINCLAIR Spectrum .SCL Betadisk image
|
||
|
||
# Hard disk images
|
||
0 string RS-IDE\x1a Spectrum .HDF hard disk image
|
||
>7 byte x \b, version 0x%02x
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $
|
||
# sql: file(1) magic for SQL files
|
||
#
|
||
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
|
||
# Recognize some MySQL files.
|
||
# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
|
||
# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
|
||
#
|
||
0 beshort 0xfe01 MySQL table definition file
|
||
>2 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
|
||
>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
|
||
>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
|
||
>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file
|
||
>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
|
||
>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
|
||
>3 byte x Version %d
|
||
0 string \376bin MySQL replication log
|
||
0 belong&0xffffff00 0xfefe0b00
|
||
>4 string MARIALOG MySQL Maria transaction log file
|
||
>>3 byte x Version %d
|
||
0 belong&0xffffff00 0xfefe0c00
|
||
>4 string MACF MySQL Maria control file
|
||
>>3 byte x Version %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# iRiver H Series database file
|
||
# From Ken Guest <ken@linux.ie>
|
||
# As observed from iRivNavi.iDB and unencoded firmware
|
||
#
|
||
0 string iRivDB iRiver Database file
|
||
>11 string >\0 Version %s
|
||
>39 string iHP-100 [H Series]
|
||
|
||
#------------------------------------------------------------------------------
|
||
# SQLite database files
|
||
# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
|
||
#
|
||
# Version 1 used GDBM internally; its files cannot be distinguished
|
||
# from other GDBM files.
|
||
#
|
||
# Version 2 used this format:
|
||
0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
|
||
|
||
# Version 3 of SQLite allows applications to embed their own "user version"
|
||
# number in the database. Detect this and distinguish those files.
|
||
|
||
0 string SQLite\ format\ 3
|
||
>60 string _MTN Monotone source repository
|
||
>60 belong !0 SQLite 3.x database, user version %u
|
||
>60 belong 0 SQLite 3.x database
|
||
|
||
# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
|
||
# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
|
||
# pceditor_V2003.jar
|
||
0 string PSDB\0 Panasonic channel list database
|
||
>126 string SQLite\ format\ 3
|
||
>>&-15 indirect x \b; contains
|
||
# Type: OpenSSH key files
|
||
# From: Nicolas Collignon <tsointsoin@gmail.com>
|
||
|
||
0 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key,
|
||
>28 string >\0 version %s
|
||
|
||
0 string ssh-dss\ OpenSSH DSA public key
|
||
0 string ssh-rsa\ OpenSSH RSA public key
|
||
# Type: OpenSSL certificates/key files
|
||
# From: Nicolas Collignon <tsointsoin@gmail.com>
|
||
|
||
0 string -----BEGIN\ CERTIFICATE----- PEM certificate
|
||
0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request
|
||
0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key
|
||
0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $
|
||
# sun: file(1) magic for Sun machines
|
||
#
|
||
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
|
||
# releases. (5.x uses ELF.) Entries for executables without an
|
||
# architecture type, used before the 68020-based Sun-3's came out,
|
||
# are in aout, as they're indistinguishable from other big-endian
|
||
# 32-bit a.out files.
|
||
#
|
||
0 belong&077777777 0600413 a.out SunOS sparc demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <4096 shared library
|
||
>>20 belong =4096 dynamically linked executable
|
||
>>20 belong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0600410 a.out SunOS sparc pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0600407 a.out SunOS sparc
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0400413 a.out SunOS mc68020 demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <4096 shared library
|
||
>>20 belong =4096 dynamically linked executable
|
||
>>20 belong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0400410 a.out SunOS mc68020 pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0400407 a.out SunOS mc68020
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0200413 a.out SunOS mc68010 demand paged
|
||
>0 byte &0x80
|
||
>>20 belong <4096 shared library
|
||
>>20 belong =4096 dynamically linked executable
|
||
>>20 belong >4096 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0200410 a.out SunOS mc68010 pure
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
0 belong&077777777 0200407 a.out SunOS mc68010
|
||
>0 byte &0x80 dynamically linked executable
|
||
>0 byte ^0x80 executable
|
||
>16 belong >0 not stripped
|
||
|
||
#
|
||
# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
|
||
# binary executed in compatibility mode under SunOS 5.x".
|
||
#
|
||
0 belong 0x080456 SunOS core file
|
||
>4 belong 432 (SPARC)
|
||
>>132 string >\0 from '%s'
|
||
>>116 belong =3 (quit)
|
||
>>116 belong =4 (illegal instruction)
|
||
>>116 belong =5 (trace trap)
|
||
>>116 belong =6 (abort)
|
||
>>116 belong =7 (emulator trap)
|
||
>>116 belong =8 (arithmetic exception)
|
||
>>116 belong =9 (kill)
|
||
>>116 belong =10 (bus error)
|
||
>>116 belong =11 (segmentation violation)
|
||
>>116 belong =12 (bad argument to system call)
|
||
>>116 belong =29 (resource lost)
|
||
>>120 belong x (T=%dK,
|
||
>>124 belong x D=%dK,
|
||
>>128 belong x S=%dK)
|
||
>4 belong 826 (68K)
|
||
>>128 string >\0 from '%s'
|
||
>4 belong 456 (SPARC 4.x BCP)
|
||
>>152 string >\0 from '%s'
|
||
# Sun SunPC
|
||
0 long 0xfa33c08e SunPC 4.0 Hard Disk
|
||
0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
|
||
# Sun snoop (see RFC 1761, which describes the capture file format,
|
||
# RFC 3827, which describes some additional datalink types, and
|
||
# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
|
||
# which is the IANA registry of Snoop datalink types)
|
||
#
|
||
0 string snoop Snoop capture file
|
||
>8 belong >0 - version %ld
|
||
>12 belong 0 (IEEE 802.3)
|
||
>12 belong 1 (IEEE 802.4)
|
||
>12 belong 2 (IEEE 802.5)
|
||
>12 belong 3 (IEEE 802.6)
|
||
>12 belong 4 (Ethernet)
|
||
>12 belong 5 (HDLC)
|
||
>12 belong 6 (Character synchronous)
|
||
>12 belong 7 (IBM channel-to-channel adapter)
|
||
>12 belong 8 (FDDI)
|
||
>12 belong 9 (Other)
|
||
>12 belong 10 (type %ld)
|
||
>12 belong 11 (type %ld)
|
||
>12 belong 12 (type %ld)
|
||
>12 belong 13 (type %ld)
|
||
>12 belong 14 (type %ld)
|
||
>12 belong 15 (type %ld)
|
||
>12 belong 16 (Fibre Channel)
|
||
>12 belong 17 (ATM)
|
||
>12 belong 18 (ATM Classical IP)
|
||
>12 belong 19 (type %ld)
|
||
>12 belong 20 (type %ld)
|
||
>12 belong 21 (type %ld)
|
||
>12 belong 22 (type %ld)
|
||
>12 belong 23 (type %ld)
|
||
>12 belong 24 (type %ld)
|
||
>12 belong 25 (type %ld)
|
||
>12 belong 26 (IP over Infiniband)
|
||
>12 belong >26 (type %ld)
|
||
|
||
#---------------------------------------------------------------------------
|
||
# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
|
||
# lead Sun/Cobalt developer) who agrees that they are good and worthy of
|
||
# inclusion.
|
||
|
||
# Boot ROM images for Sun/Cobalt Linux server appliances
|
||
0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
|
||
>38 string x V%.4s
|
||
|
||
# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
|
||
# at the very end where file(1) can't get it.
|
||
0 string CRfs COBALT boot rom data (Flat boot rom or file system)
|
||
|
||
#------------------------------------------------------------------------
|
||
# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# sysex: file(1) magic for MIDI sysex files
|
||
#
|
||
#
|
||
0 byte 0xF0 SysEx File -
|
||
|
||
# North American Group
|
||
>1 byte 0x01 Sequential
|
||
>1 byte 0x02 IDP
|
||
>1 byte 0x03 OctavePlateau
|
||
>1 byte 0x04 Moog
|
||
>1 byte 0x05 Passport
|
||
>1 byte 0x06 Lexicon
|
||
>1 byte 0x07 Kurzweil/Future Retro
|
||
>>3 byte 0x77 777
|
||
>>4 byte 0x00 Bank
|
||
>>4 byte 0x01 Song
|
||
>>5 byte 0x0f 16
|
||
>>5 byte 0x0e 15
|
||
>>5 byte 0x0d 14
|
||
>>5 byte 0x0c 13
|
||
>>5 byte 0x0b 12
|
||
>>5 byte 0x0a 11
|
||
>>5 byte 0x09 10
|
||
>>5 byte 0x08 9
|
||
>>5 byte 0x07 8
|
||
>>5 byte 0x06 7
|
||
>>5 byte 0x05 6
|
||
>>5 byte 0x04 5
|
||
>>5 byte 0x03 4
|
||
>>5 byte 0x02 3
|
||
>>5 byte 0x01 2
|
||
>>5 byte 0x00 1
|
||
>>5 byte 0x10 (ALL)
|
||
>>2 byte x \b, Channel %d
|
||
>1 byte 0x08 Fender
|
||
>1 byte 0x09 Gulbransen
|
||
>1 byte 0x0a AKG
|
||
>1 byte 0x0b Voyce
|
||
>1 byte 0x0c Waveframe
|
||
>1 byte 0x0d ADA
|
||
>1 byte 0x0e Garfield
|
||
>1 byte 0x0f Ensoniq
|
||
>1 byte 0x10 Oberheim
|
||
>>2 byte 0x06 Matrix 6 series
|
||
>>3 byte 0x0A Dump (All)
|
||
>>3 byte 0x01 Dump (Bank)
|
||
>>4 belong 0x0002040E Matrix 1000
|
||
>>>11 byte <2 User bank %d
|
||
>>>11 byte >1 Preset bank %d
|
||
>1 byte 0x11 Apple
|
||
>1 byte 0x12 GreyMatter
|
||
>1 byte 0x14 PalmTree
|
||
>1 byte 0x15 JLCooper
|
||
>1 byte 0x16 Lowrey
|
||
>1 byte 0x17 AdamsSmith
|
||
>1 byte 0x18 E-mu
|
||
>1 byte 0x19 Harmony
|
||
>1 byte 0x1a ART
|
||
>1 byte 0x1b Baldwin
|
||
>1 byte 0x1c Eventide
|
||
>1 byte 0x1d Inventronics
|
||
>1 byte 0x1f Clarity
|
||
|
||
# European Group
|
||
>1 byte 0x21 SIEL
|
||
>1 byte 0x22 Synthaxe
|
||
>1 byte 0x24 Hohner
|
||
>1 byte 0x25 Twister
|
||
>1 byte 0x26 Solton
|
||
>1 byte 0x27 Jellinghaus
|
||
>1 byte 0x28 Southworth
|
||
>1 byte 0x29 PPG
|
||
>1 byte 0x2a JEN
|
||
>1 byte 0x2b SSL
|
||
>1 byte 0x2c AudioVertrieb
|
||
|
||
>1 byte 0x2f ELKA
|
||
>>3 byte 0x09 EK-44
|
||
|
||
>1 byte 0x30 Dynacord
|
||
>1 byte 0x31 Jomox
|
||
>1 byte 0x33 Clavia
|
||
>1 byte 0x39 Soundcraft
|
||
# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
|
||
>1 byte 0x3e Waldorf
|
||
>>2 byte 0x00 microWave
|
||
>>2 byte 0x0E microwave2 / XT
|
||
>>2 byte 0x0F Q / Q+
|
||
>>3 byte =0 (default id)
|
||
>>3 byte >0 (
|
||
>>>3 byte <0x7F \bdevice %d)
|
||
>>>3 byte =0x7F \bbroadcast id)
|
||
>>3 byte 0x7f Microwave I
|
||
>>>4 byte 0x00 SNDR (Sound Request)
|
||
>>>4 byte 0x10 SNDD (Sound Dump)
|
||
>>>4 byte 0x20 SNDP (Sound Parameter Change)
|
||
>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
|
||
>>>4 byte 0x70 BOOT (Sound Reserved)
|
||
>>>4 byte 0x01 MULR (Multi Request)
|
||
>>>4 byte 0x11 MULD (Multi Dump)
|
||
>>>4 byte 0x21 MULP (Multi Parameter Change)
|
||
>>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
|
||
>>>4 byte 0x71 OS (Multi Reserved)
|
||
>>>4 byte 0x02 DRMR (Drum Map Request)
|
||
>>>4 byte 0x12 DRMD (Drum Map Dump)
|
||
>>>4 byte 0x22 DRMP (Drum Map Parameter Change)
|
||
>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
|
||
>>>4 byte 0x72 BIN (Drum Map Reserved)
|
||
>>>4 byte 0x03 PATR (Sequencer Pattern Request)
|
||
>>>4 byte 0x13 PATD (Sequencer Pattern Dump)
|
||
>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
|
||
>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
|
||
>>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
|
||
>>>4 byte 0x04 GLBR (Global Parameter Request)
|
||
>>>4 byte 0x14 GLBD (Global Parameter Dump)
|
||
>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
|
||
>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
|
||
>>>4 byte 0x07 MODR (Mode Parameter Request)
|
||
>>>4 byte 0x17 MODD (Mode Parameter Dump)
|
||
>>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
|
||
>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
|
||
>>2 byte 0x10 microQ
|
||
>>>4 byte 0x00 SNDR (Sound Request)
|
||
>>>4 byte 0x10 SNDD (Sound Dump)
|
||
>>>4 byte 0x20 SNDP (Sound Parameter Change)
|
||
>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
|
||
>>>4 byte 0x70 (Sound Reserved)
|
||
>>>4 byte 0x01 MULR (Multi Request)
|
||
>>>4 byte 0x11 MULD (Multi Dump)
|
||
>>>4 byte 0x21 MULP (Multi Parameter Change)
|
||
>>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
|
||
>>>4 byte 0x71 OS (Multi Reserved)
|
||
>>>4 byte 0x02 DRMR (Drum Map Request)
|
||
>>>4 byte 0x12 DRMD (Drum Map Dump)
|
||
>>>4 byte 0x22 DRMP (Drum Map Parameter Change)
|
||
>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
|
||
>>>4 byte 0x72 BIN (Drum Map Reserved)
|
||
>>>4 byte 0x04 GLBR (Global Parameter Request)
|
||
>>>4 byte 0x14 GLBD (Global Parameter Dump)
|
||
>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
|
||
>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
|
||
>>2 byte 0x11 rackAttack
|
||
>>>4 byte 0x00 SNDR (Sound Parameter Request)
|
||
>>>4 byte 0x10 SNDD (Sound Parameter Dump)
|
||
>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
|
||
>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
|
||
>>>4 byte 0x01 PRGR (Program Parameter Request)
|
||
>>>4 byte 0x11 PRGD (Program Parameter Dump)
|
||
>>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
|
||
>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
|
||
>>>4 byte 0x71 OS (Program Parameter Reserved)
|
||
>>>4 byte 0x03 PATR (Pattern Parameter Request)
|
||
>>>4 byte 0x13 PATD (Pattern Parameter Dump)
|
||
>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
|
||
>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
|
||
>>>4 byte 0x04 GLBR (Global Parameter Request)
|
||
>>>4 byte 0x14 GLBD (Global Parameter Dump)
|
||
>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
|
||
>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
|
||
>>>4 byte 0x05 EFXR (FX Parameter Request)
|
||
>>>4 byte 0x15 EFXD (FX Parameter Dump)
|
||
>>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
|
||
>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
|
||
>>>4 byte 0x07 MODR (Mode Command Request)
|
||
>>>4 byte 0x17 MODD (Mode Command Dump)
|
||
>>>4 byte 0x27 MODP (Mode Command Parameter Change)
|
||
>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
|
||
>>2 byte 0x03 Wave
|
||
>>>4 byte 0x00 SBPR (Soundprogram)
|
||
>>>4 byte 0x01 SAPR (Performance)
|
||
>>>4 byte 0x02 SWAVE (Wave)
|
||
>>>4 byte 0x03 SWTBL (Wave control table)
|
||
>>>4 byte 0x04 SVT (Velocity Curve)
|
||
>>>4 byte 0x05 STT (Tuning Table)
|
||
>>>4 byte 0x06 SGLB (Global Parameters)
|
||
>>>4 byte 0x07 SARRMAP (Performance Program Change Map)
|
||
>>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
|
||
>>>4 byte 0x09 SBPRPAR (Sound Parameter)
|
||
>>>4 byte 0x0A SARRPAR (Performance Parameter)
|
||
>>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
|
||
>>>4 byte 0x0F SBULK (Bulk Switch on/off)
|
||
|
||
# Japanese Group
|
||
>1 byte 0x40 Kawai
|
||
>>3 byte 0x20 K1
|
||
>>3 byte 0x22 K4
|
||
|
||
>1 byte 0x41 Roland
|
||
>>3 byte 0x14 D-50
|
||
>>3 byte 0x2b U-220
|
||
>>3 byte 0x02 TR-707
|
||
|
||
>1 byte 0x42 Korg
|
||
>>3 byte 0x19 M1
|
||
|
||
>1 byte 0x43 Yamaha
|
||
>1 byte 0x44 Casio
|
||
>1 byte 0x46 Kamiya
|
||
>1 byte 0x47 Akai
|
||
>1 byte 0x48 Victor
|
||
>1 byte 0x49 Mesosha
|
||
>1 byte 0x4b Fujitsu
|
||
>1 byte 0x4c Sony
|
||
>1 byte 0x4e Teac
|
||
>1 byte 0x50 Matsushita
|
||
>1 byte 0x51 Fostex
|
||
>1 byte 0x52 Zoom
|
||
>1 byte 0x54 Matsushita
|
||
>1 byte 0x57 Acoustic tech. lab.
|
||
|
||
>1 belong&0xffffff00 0x00007400 Ta Horng
|
||
>1 belong&0xffffff00 0x00007500 e-Tek
|
||
>1 belong&0xffffff00 0x00007600 E-Voice
|
||
>1 belong&0xffffff00 0x00007700 Midisoft
|
||
>1 belong&0xffffff00 0x00007800 Q-Sound
|
||
>1 belong&0xffffff00 0x00007900 Westrex
|
||
>1 belong&0xffffff00 0x00007a00 Nvidia*
|
||
>1 belong&0xffffff00 0x00007b00 ESS
|
||
>1 belong&0xffffff00 0x00007c00 Mediatrix
|
||
>1 belong&0xffffff00 0x00007d00 Brooktree
|
||
>1 belong&0xffffff00 0x00007e00 Otari
|
||
>1 belong&0xffffff00 0x00007f00 Key Electronics
|
||
>1 belong&0xffffff00 0x00010000 Shure
|
||
>1 belong&0xffffff00 0x00010100 AuraSound
|
||
>1 belong&0xffffff00 0x00010200 Crystal
|
||
>1 belong&0xffffff00 0x00010300 Rockwell
|
||
>1 belong&0xffffff00 0x00010400 Silicon Graphics
|
||
>1 belong&0xffffff00 0x00010500 Midiman
|
||
>1 belong&0xffffff00 0x00010600 PreSonus
|
||
>1 belong&0xffffff00 0x00010800 Topaz
|
||
>1 belong&0xffffff00 0x00010900 Cast Lightning
|
||
>1 belong&0xffffff00 0x00010a00 Microsoft
|
||
>1 belong&0xffffff00 0x00010b00 Sonic Foundry
|
||
>1 belong&0xffffff00 0x00010c00 Line 6
|
||
>1 belong&0xffffff00 0x00010d00 Beatnik Inc.
|
||
>1 belong&0xffffff00 0x00010e00 Van Koerving
|
||
>1 belong&0xffffff00 0x00010f00 Altech Systems
|
||
>1 belong&0xffffff00 0x00011000 S & S Research
|
||
>1 belong&0xffffff00 0x00011100 VLSI Technology
|
||
>1 belong&0xffffff00 0x00011200 Chromatic
|
||
>1 belong&0xffffff00 0x00011300 Sapphire
|
||
>1 belong&0xffffff00 0x00011400 IDRC
|
||
>1 belong&0xffffff00 0x00011500 Justonic Tuning
|
||
>1 belong&0xffffff00 0x00011600 TorComp
|
||
>1 belong&0xffffff00 0x00011700 Newtek Inc.
|
||
>1 belong&0xffffff00 0x00011800 Sound Sculpture
|
||
>1 belong&0xffffff00 0x00011900 Walker Technical
|
||
>1 belong&0xffffff00 0x00011a00 Digital Harmony
|
||
>1 belong&0xffffff00 0x00011b00 InVision
|
||
>1 belong&0xffffff00 0x00011c00 T-Square
|
||
>1 belong&0xffffff00 0x00011d00 Nemesys
|
||
>1 belong&0xffffff00 0x00011e00 DBX
|
||
>1 belong&0xffffff00 0x00011f00 Syndyne
|
||
>1 belong&0xffffff00 0x00012000 Bitheadz
|
||
>1 belong&0xffffff00 0x00012100 Cakewalk
|
||
>1 belong&0xffffff00 0x00012200 Staccato
|
||
>1 belong&0xffffff00 0x00012300 National Semicon.
|
||
>1 belong&0xffffff00 0x00012400 Boom Theory
|
||
>1 belong&0xffffff00 0x00012500 Virtual DSP Corp
|
||
>1 belong&0xffffff00 0x00012600 Antares
|
||
>1 belong&0xffffff00 0x00012700 Angel Software
|
||
>1 belong&0xffffff00 0x00012800 St Louis Music
|
||
>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
|
||
>1 belong&0xffffff00 0x00012a00 Ashley Audio
|
||
>1 belong&0xffffff00 0x00012b00 Vari-Lite
|
||
>1 belong&0xffffff00 0x00012c00 Summit Audio
|
||
>1 belong&0xffffff00 0x00012d00 Aureal Semicon.
|
||
>1 belong&0xffffff00 0x00012e00 SeaSound
|
||
>1 belong&0xffffff00 0x00012f00 U.S. Robotics
|
||
>1 belong&0xffffff00 0x00013000 Aurisis
|
||
>1 belong&0xffffff00 0x00013100 Nearfield Multimedia
|
||
>1 belong&0xffffff00 0x00013200 FM7 Inc.
|
||
>1 belong&0xffffff00 0x00013300 Swivel Systems
|
||
>1 belong&0xffffff00 0x00013400 Hyperactive
|
||
>1 belong&0xffffff00 0x00013500 MidiLite
|
||
>1 belong&0xffffff00 0x00013600 Radical
|
||
>1 belong&0xffffff00 0x00013700 Roger Linn
|
||
>1 belong&0xffffff00 0x00013800 Helicon
|
||
>1 belong&0xffffff00 0x00013900 Event
|
||
>1 belong&0xffffff00 0x00013a00 Sonic Network
|
||
>1 belong&0xffffff00 0x00013b00 Realtime Music
|
||
>1 belong&0xffffff00 0x00013c00 Apogee Digital
|
||
|
||
>1 belong&0xffffff00 0x00202b00 Medeli Electronics
|
||
>1 belong&0xffffff00 0x00202c00 Charlie Lab
|
||
>1 belong&0xffffff00 0x00202d00 Blue Chip Music
|
||
>1 belong&0xffffff00 0x00202e00 BEE OH Corp
|
||
>1 belong&0xffffff00 0x00202f00 LG Semicon America
|
||
>1 belong&0xffffff00 0x00203000 TESI
|
||
>1 belong&0xffffff00 0x00203100 EMAGIC
|
||
>1 belong&0xffffff00 0x00203200 Behringer
|
||
>1 belong&0xffffff00 0x00203300 Access Music
|
||
>1 belong&0xffffff00 0x00203400 Synoptic
|
||
>1 belong&0xffffff00 0x00203500 Hanmesoft Corp
|
||
>1 belong&0xffffff00 0x00203600 Terratec
|
||
>1 belong&0xffffff00 0x00203700 Proel SpA
|
||
>1 belong&0xffffff00 0x00203800 IBK MIDI
|
||
>1 belong&0xffffff00 0x00203900 IRCAM
|
||
>1 belong&0xffffff00 0x00203a00 Propellerhead Software
|
||
>1 belong&0xffffff00 0x00203b00 Red Sound Systems
|
||
>1 belong&0xffffff00 0x00203c00 Electron ESI AB
|
||
>1 belong&0xffffff00 0x00203d00 Sintefex Audio
|
||
>1 belong&0xffffff00 0x00203e00 Music and More
|
||
>1 belong&0xffffff00 0x00203f00 Amsaro
|
||
>1 belong&0xffffff00 0x00204000 CDS Advanced Technology
|
||
>1 belong&0xffffff00 0x00204100 Touched by Sound
|
||
>1 belong&0xffffff00 0x00204200 DSP Arts
|
||
>1 belong&0xffffff00 0x00204300 Phil Rees Music
|
||
>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
|
||
>1 belong&0xffffff00 0x00204500 Soundart
|
||
>1 belong&0xffffff00 0x00204600 C-Mexx Software
|
||
>1 belong&0xffffff00 0x00204700 Klavis Tech.
|
||
>1 belong&0xffffff00 0x00204800 Noteheads AB
|
||
|
||
0 string T707 Roland TR-707 Data
|
||
#------------------------------------------------------------------------------
|
||
# file: file(1) magic for Tcl scripting language
|
||
# URL: http://www.tcl.tk/
|
||
# From: gustaf neumann
|
||
|
||
# Tcl scripts
|
||
0 search/1/w #!\ /usr/bin/tcl Tcl script text executable
|
||
!:mime text/x-lua
|
||
0 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1 #!/usr/bin/env\ tcl Tcl script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable
|
||
!:mime text/x-tcl
|
||
0 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable
|
||
!:mime text/x-tcl
|
||
|
||
# check the first line
|
||
0 search/1 package\ req
|
||
>0 regex \^package[\ \t]+req Tcl script
|
||
# not 'p', check other lines
|
||
0 search/1 !p
|
||
>0 regex \^package[\ \t]+req Tcl script
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
|
||
# teapot: file(1) magic for "teapot" spreadsheet
|
||
#
|
||
0 string #!teapot\012xdr teapot work sheet (XDR format)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# terminfo: file(1) magic for terminfo
|
||
#
|
||
# XXX - byte order for screen images?
|
||
#
|
||
0 string \032\001 Compiled terminfo entry
|
||
0 short 0433 Curses screen image
|
||
0 short 0434 Curses screen image
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $
|
||
# tex: file(1) magic for TeX files
|
||
#
|
||
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
|
||
#
|
||
# From <conklin@talisman.kaleida.com>
|
||
|
||
# Although we may know the offset of certain text fields in TeX DVI
|
||
# and font files, we can't use them reliably because they are not
|
||
# zero terminated. [but we do anyway, christos]
|
||
0 string \367\002 TeX DVI file
|
||
!:mime application/x-dvi
|
||
>16 string >\0 (%s)
|
||
0 string \367\203 TeX generic font data
|
||
0 string \367\131 TeX packed font data
|
||
>3 string >\0 (%s)
|
||
0 string \367\312 TeX virtual font data
|
||
0 search/1 This\ is\ TeX, TeX transcript text
|
||
0 search/1 This\ is\ METAFONT, METAFONT transcript text
|
||
|
||
# There is no way to detect TeX Font Metric (*.tfm) files without
|
||
# breaking them apart and reading the data. The following patterns
|
||
# match most *.tfm files generated by METAFONT or afm2tfm.
|
||
2 string \000\021 TeX font metric data
|
||
!:mime application/x-tex-tfm
|
||
>33 string >\0 (%s)
|
||
2 string \000\022 TeX font metric data
|
||
!:mime application/x-tex-tfm
|
||
>33 string >\0 (%s)
|
||
|
||
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 search/1 \\input\ texinfo Texinfo source text
|
||
!:mime text/x-texinfo
|
||
0 search/1 This\ is\ Info\ file GNU Info text
|
||
!:mime text/x-info
|
||
|
||
# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
0 search/4096 \\input TeX document text
|
||
!:mime text/x-tex
|
||
!:strength + 15
|
||
0 search/4096 \\section LaTeX document text
|
||
!:mime text/x-tex
|
||
!:strength + 18
|
||
0 search/4096 \\setlength LaTeX document text
|
||
!:mime text/x-tex
|
||
!:strength + 15
|
||
0 search/4096 \\documentstyle LaTeX document text
|
||
!:mime text/x-tex
|
||
!:strength + 18
|
||
0 search/4096 \\chapter LaTeX document text
|
||
!:mime text/x-tex
|
||
!:strength + 18
|
||
0 search/4096 \\documentclass LaTeX 2e document text
|
||
!:mime text/x-tex
|
||
!:strength + 15
|
||
0 search/4096 \\relax LaTeX auxiliary file
|
||
!:mime text/x-tex
|
||
!:strength + 15
|
||
0 search/4096 \\contentsline LaTeX table of contents
|
||
!:mime text/x-tex
|
||
!:strength + 15
|
||
0 search/4096 %\ -*-latex-*- LaTeX document text
|
||
!:mime text/x-tex
|
||
|
||
# Tex document, from Hendrik Scholz <hendrik@scholz.net>
|
||
0 search/1 \\ifx TeX document text
|
||
|
||
# Index and glossary files
|
||
0 search/4096 \\indexentry LaTeX raw index file
|
||
0 search/4096 \\begin{theindex} LaTeX sorted index
|
||
0 search/4096 \\glossaryentry LaTeX raw glossary
|
||
0 search/4096 \\begin{theglossary} LaTeX sorted glossary
|
||
0 search/4096 This\ is\ makeindex Makeindex log file
|
||
|
||
# End of TeX
|
||
|
||
#------------------------------------------------------------------------------
|
||
# file(1) magic for BibTex text files
|
||
# From Hendrik Scholz <hendrik@scholz.net>
|
||
|
||
0 search/1/c @article{ BibTeX text file
|
||
0 search/1/c @book{ BibTeX text file
|
||
0 search/1/c @inbook{ BibTeX text file
|
||
0 search/1/c @incollection{ BibTeX text file
|
||
0 search/1/c @inproceedings{ BibTeX text file
|
||
0 search/1/c @manual{ BibTeX text file
|
||
0 search/1/c @misc{ BibTeX text file
|
||
0 search/1/c @preamble{ BibTeX text file
|
||
0 search/1/c @phdthesis{ BibTeX text file
|
||
0 search/1/c @techreport{ BibTeX text file
|
||
0 search/1/c @unpublished{ BibTeX text file
|
||
|
||
73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header)
|
||
|
||
73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
|
||
|
||
0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
|
||
|
||
0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file
|
||
|
||
0 search/1 @c\ @mapfile{ TeX font aliases text file
|
||
|
||
0 string #LyX LyX document text
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
|
||
# file(1) magic for tgif(1) files
|
||
# From Hendrik Scholz <hendrik@scholz.net>
|
||
0 string %TGIF\ Tgif file version
|
||
>6 string x %s
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
|
||
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
|
||
#
|
||
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
|
||
#
|
||
# Update: Romain Lievin (roms@lpg.ticalc.org).
|
||
#
|
||
# NOTE: This list is not complete.
|
||
# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
|
||
# program/group magic numbers in here because I cannot find any.
|
||
0 string **TI80** TI-80 Graphing Calculator File.
|
||
0 string **TI81** TI-81 Graphing Calculator File.
|
||
#
|
||
# Magic Numbers for the TI-73
|
||
#
|
||
0 string **TI73** TI-73 Graphing Calculator
|
||
>0x00003B byte 0x00 (real number)
|
||
>0x00003B byte 0x01 (list)
|
||
>0x00003B byte 0x02 (matrix)
|
||
>0x00003B byte 0x03 (equation)
|
||
>0x00003B byte 0x04 (string)
|
||
>0x00003B byte 0x05 (program)
|
||
>0x00003B byte 0x06 (assembly program)
|
||
>0x00003B byte 0x07 (picture)
|
||
>0x00003B byte 0x08 (gdb)
|
||
>0x00003B byte 0x0C (complex number)
|
||
>0x00003B byte 0x0F (window settings)
|
||
>0x00003B byte 0x10 (zoom)
|
||
>0x00003B byte 0x11 (table setup)
|
||
>0x00003B byte 0x13 (backup)
|
||
|
||
# Magic Numbers for the TI-82
|
||
#
|
||
0 string **TI82** TI-82 Graphing Calculator
|
||
>0x00003B byte 0x00 (real)
|
||
>0x00003B byte 0x01 (list)
|
||
>0x00003B byte 0x02 (matrix)
|
||
>0x00003B byte 0x03 (Y-variable)
|
||
>0x00003B byte 0x05 (program)
|
||
>0x00003B byte 0x06 (protected prgm)
|
||
>0x00003B byte 0x07 (picture)
|
||
>0x00003B byte 0x08 (gdb)
|
||
>0x00003B byte 0x0B (window settings)
|
||
>0x00003B byte 0x0C (window settings)
|
||
>0x00003B byte 0x0D (table setup)
|
||
>0x00003B byte 0x0E (screenshot)
|
||
>0x00003B byte 0x0F (backup)
|
||
#
|
||
# Magic Numbers for the TI-83
|
||
#
|
||
0 string **TI83** TI-83 Graphing Calculator
|
||
>0x00003B byte 0x00 (real)
|
||
>0x00003B byte 0x01 (list)
|
||
>0x00003B byte 0x02 (matrix)
|
||
>0x00003B byte 0x03 (Y-variable)
|
||
>0x00003B byte 0x04 (string)
|
||
>0x00003B byte 0x05 (program)
|
||
>0x00003B byte 0x06 (protected prgm)
|
||
>0x00003B byte 0x07 (picture)
|
||
>0x00003B byte 0x08 (gdb)
|
||
>0x00003B byte 0x0B (window settings)
|
||
>0x00003B byte 0x0C (window settings)
|
||
>0x00003B byte 0x0D (table setup)
|
||
>0x00003B byte 0x0E (screenshot)
|
||
>0x00003B byte 0x13 (backup)
|
||
#
|
||
# Magic Numbers for the TI-83+
|
||
#
|
||
0 string **TI83F* TI-83+ Graphing Calculator
|
||
>0x00003B byte 0x00 (real number)
|
||
>0x00003B byte 0x01 (list)
|
||
>0x00003B byte 0x02 (matrix)
|
||
>0x00003B byte 0x03 (equation)
|
||
>0x00003B byte 0x04 (string)
|
||
>0x00003B byte 0x05 (program)
|
||
>0x00003B byte 0x06 (assembly program)
|
||
>0x00003B byte 0x07 (picture)
|
||
>0x00003B byte 0x08 (gdb)
|
||
>0x00003B byte 0x0C (complex number)
|
||
>0x00003B byte 0x0F (window settings)
|
||
>0x00003B byte 0x10 (zoom)
|
||
>0x00003B byte 0x11 (table setup)
|
||
>0x00003B byte 0x13 (backup)
|
||
>0x00003B byte 0x15 (application variable)
|
||
>0x00003B byte 0x17 (group of variable)
|
||
|
||
#
|
||
# Magic Numbers for the TI-85
|
||
#
|
||
0 string **TI85** TI-85 Graphing Calculator
|
||
>0x00003B byte 0x00 (real number)
|
||
>0x00003B byte 0x01 (complex number)
|
||
>0x00003B byte 0x02 (real vector)
|
||
>0x00003B byte 0x03 (complex vector)
|
||
>0x00003B byte 0x04 (real list)
|
||
>0x00003B byte 0x05 (complex list)
|
||
>0x00003B byte 0x06 (real matrix)
|
||
>0x00003B byte 0x07 (complex matrix)
|
||
>0x00003B byte 0x08 (real constant)
|
||
>0x00003B byte 0x09 (complex constant)
|
||
>0x00003B byte 0x0A (equation)
|
||
>0x00003B byte 0x0C (string)
|
||
>0x00003B byte 0x0D (function GDB)
|
||
>0x00003B byte 0x0E (polar GDB)
|
||
>0x00003B byte 0x0F (parametric GDB)
|
||
>0x00003B byte 0x10 (diffeq GDB)
|
||
>0x00003B byte 0x11 (picture)
|
||
>0x00003B byte 0x12 (program)
|
||
>0x00003B byte 0x13 (range)
|
||
>0x00003B byte 0x17 (window settings)
|
||
>0x00003B byte 0x18 (window settings)
|
||
>0x00003B byte 0x19 (window settings)
|
||
>0x00003B byte 0x1A (window settings)
|
||
>0x00003B byte 0x1B (zoom)
|
||
>0x00003B byte 0x1D (backup)
|
||
>0x00003B byte 0x1E (unknown)
|
||
>0x00003B byte 0x2A (equation)
|
||
>0x000032 string ZS4 - ZShell Version 4 File.
|
||
>0x000032 string ZS3 - ZShell Version 3 File.
|
||
#
|
||
# Magic Numbers for the TI-86
|
||
#
|
||
0 string **TI86** TI-86 Graphing Calculator
|
||
>0x00003B byte 0x00 (real number)
|
||
>0x00003B byte 0x01 (complex number)
|
||
>0x00003B byte 0x02 (real vector)
|
||
>0x00003B byte 0x03 (complex vector)
|
||
>0x00003B byte 0x04 (real list)
|
||
>0x00003B byte 0x05 (complex list)
|
||
>0x00003B byte 0x06 (real matrix)
|
||
>0x00003B byte 0x07 (complex matrix)
|
||
>0x00003B byte 0x08 (real constant)
|
||
>0x00003B byte 0x09 (complex constant)
|
||
>0x00003B byte 0x0A (equation)
|
||
>0x00003B byte 0x0C (string)
|
||
>0x00003B byte 0x0D (function GDB)
|
||
>0x00003B byte 0x0E (polar GDB)
|
||
>0x00003B byte 0x0F (parametric GDB)
|
||
>0x00003B byte 0x10 (diffeq GDB)
|
||
>0x00003B byte 0x11 (picture)
|
||
>0x00003B byte 0x12 (program)
|
||
>0x00003B byte 0x13 (range)
|
||
>0x00003B byte 0x17 (window settings)
|
||
>0x00003B byte 0x18 (window settings)
|
||
>0x00003B byte 0x19 (window settings)
|
||
>0x00003B byte 0x1A (window settings)
|
||
>0x00003B byte 0x1B (zoom)
|
||
>0x00003B byte 0x1D (backup)
|
||
>0x00003B byte 0x1E (unknown)
|
||
>0x00003B byte 0x2A (equation)
|
||
#
|
||
# Magic Numbers for the TI-89
|
||
#
|
||
0 string **TI89** TI-89 Graphing Calculator
|
||
>0x000048 byte 0x00 (expression)
|
||
>0x000048 byte 0x04 (list)
|
||
>0x000048 byte 0x06 (matrix)
|
||
>0x000048 byte 0x0A (data)
|
||
>0x000048 byte 0x0B (text)
|
||
>0x000048 byte 0x0C (string)
|
||
>0x000048 byte 0x0D (graphic data base)
|
||
>0x000048 byte 0x0E (figure)
|
||
>0x000048 byte 0x10 (picture)
|
||
>0x000048 byte 0x12 (program)
|
||
>0x000048 byte 0x13 (function)
|
||
>0x000048 byte 0x14 (macro)
|
||
>0x000048 byte 0x1C (zipped)
|
||
>0x000048 byte 0x21 (assembler)
|
||
#
|
||
# Magic Numbers for the TI-92
|
||
#
|
||
0 string **TI92** TI-92 Graphing Calculator
|
||
>0x000048 byte 0x00 (expression)
|
||
>0x000048 byte 0x04 (list)
|
||
>0x000048 byte 0x06 (matrix)
|
||
>0x000048 byte 0x0A (data)
|
||
>0x000048 byte 0x0B (text)
|
||
>0x000048 byte 0x0C (string)
|
||
>0x000048 byte 0x0D (graphic data base)
|
||
>0x000048 byte 0x0E (figure)
|
||
>0x000048 byte 0x10 (picture)
|
||
>0x000048 byte 0x12 (program)
|
||
>0x000048 byte 0x13 (function)
|
||
>0x000048 byte 0x14 (macro)
|
||
>0x000048 byte 0x1D (backup)
|
||
#
|
||
# Magic Numbers for the TI-92+/V200
|
||
#
|
||
0 string **TI92P* TI-92+/V200 Graphing Calculator
|
||
>0x000048 byte 0x00 (expression)
|
||
>0x000048 byte 0x04 (list)
|
||
>0x000048 byte 0x06 (matrix)
|
||
>0x000048 byte 0x0A (data)
|
||
>0x000048 byte 0x0B (text)
|
||
>0x000048 byte 0x0C (string)
|
||
>0x000048 byte 0x0D (graphic data base)
|
||
>0x000048 byte 0x0E (figure)
|
||
>0x000048 byte 0x10 (picture)
|
||
>0x000048 byte 0x12 (program)
|
||
>0x000048 byte 0x13 (function)
|
||
>0x000048 byte 0x14 (macro)
|
||
>0x000048 byte 0x1C (zipped)
|
||
>0x000048 byte 0x21 (assembler)
|
||
#
|
||
# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
|
||
#
|
||
0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
|
||
0 string **TIFL** TI-XX Graphing Calculator (FLASH)
|
||
>8 byte >0 - Revision %d
|
||
>>9 byte x \b.%d,
|
||
>12 byte >0 Revision date %02x
|
||
>>13 byte x \b/%02x
|
||
>>14 beshort x \b/%04x,
|
||
>17 string >/0 name: '%s',
|
||
>48 byte 0x74 device: TI-73,
|
||
>48 byte 0x73 device: TI-83+,
|
||
>48 byte 0x98 device: TI-89,
|
||
>48 byte 0x88 device: TI-92+,
|
||
>49 byte 0x23 type: OS upgrade,
|
||
>49 byte 0x24 type: application,
|
||
>49 byte 0x25 type: certificate,
|
||
>49 byte 0x3e type: license,
|
||
>74 lelong >0 size: %ld bytes
|
||
|
||
# VTi & TiEmu skins (TI Graphing Calculators).
|
||
# From: Romain Lievin (roms@lpg.ticalc.org).
|
||
# Magic Numbers for the VTi skins
|
||
0 string VTI Virtual TI skin
|
||
>3 string v - Version
|
||
>>4 byte >0 \b %c
|
||
>>6 byte x \b.%c
|
||
# Magic Numbers for the TiEmu skins
|
||
0 string TiEmu TiEmu skin
|
||
>6 string v - Version
|
||
>>7 byte >0 \b %c
|
||
>>9 byte x \b.%c
|
||
>>10 byte x \b%c
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
|
||
# timezone: file(1) magic for timezone data
|
||
#
|
||
# from Daniel Quinlan (quinlan@yggdrasil.com)
|
||
# this should work on Linux, SunOS, and maybe others
|
||
# Added new official magic number for recent versions of the Olson code
|
||
0 string TZif timezone data
|
||
>4 byte 0 \b, old version
|
||
>4 byte >0 \b, version %c
|
||
>20 belong 0 \b, no gmt time flags
|
||
>20 belong 1 \b, 1 gmt time flag
|
||
>20 belong >1 \b, %d gmt time flags
|
||
>24 belong 0 \b, no std time flags
|
||
>20 belong 1 \b, 1 std time flag
|
||
>24 belong >1 \b, %d std time flags
|
||
>28 belong 0 \b, no leap seconds
|
||
>28 belong 1 \b, 1 leap second
|
||
>28 belong >1 \b, %d leap seconds
|
||
>32 belong 0 \b, no transition times
|
||
>32 belong 1 \b, 1 transition time
|
||
>32 belong >1 \b, %d transition times
|
||
>36 belong 0 \b, no abbreviation chars
|
||
>36 belong 1 \b, 1 abbreviation char
|
||
>36 belong >1 \b, %d abbreviation chars
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
|
||
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
|
||
# troff: file(1) magic for *roff
|
||
#
|
||
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
|
||
|
||
# troff input
|
||
0 search/1 .\\" troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 search/1 '\\" troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 search/1 '.\\" troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 search/1 \\" troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 search/1 ''' troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
|
||
!:mime text/troff
|
||
0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
|
||
!:mime text/troff
|
||
|
||
# ditroff intermediate output text
|
||
0 search/1 x\ T ditroff output text
|
||
>4 search/1 cat for the C/A/T phototypesetter
|
||
>4 search/1 ps for PostScript
|
||
>4 search/1 dvi for DVI
|
||
>4 search/1 ascii for ASCII
|
||
>4 search/1 lj4 for LaserJet 4
|
||
>4 search/1 latin1 for ISO 8859-1 (Latin 1)
|
||
>4 search/1 X75 for xditview at 75dpi
|
||
>>7 search/1 -12 (12pt)
|
||
>4 search/1 X100 for xditview at 100dpi
|
||
>>8 search/1 -12 (12pt)
|
||
|
||
# output data formats
|
||
0 string \100\357 very old (C/A/T) troff output data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
|
||
# tuxedo: file(1) magic for BEA TUXEDO data files
|
||
#
|
||
# from Ian Springer <ispringer@hotmail.com>
|
||
#
|
||
0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
|
||
# typeset: file(1) magic for other typesetting
|
||
#
|
||
0 string Interpress/Xerox Xerox InterPress data
|
||
>16 string / (version
|
||
>>17 string >\0 %s)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
|
||
# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
|
||
# GRR: These types should be recognised in file_ascmagic so these
|
||
# encodings can be treated by text patterns.
|
||
# Missing types are already dealt with internally.
|
||
#
|
||
0 string +/v8 Unicode text, UTF-7
|
||
0 string +/v9 Unicode text, UTF-7
|
||
0 string +/v+ Unicode text, UTF-7
|
||
0 string +/v/ Unicode text, UTF-7
|
||
0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
|
||
0 string \000\000\376\377 Unicode text, UTF-32, big-endian
|
||
0 string \377\376\000\000 Unicode text, UTF-32, little-endian
|
||
0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
|
||
# unknown: file(1) magic for unknown machines
|
||
#
|
||
# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
|
||
# (executable, pure, and split I&D, respectively), but the PDP-11 version
|
||
# doesn't have the "version %ld", which may be a bogus COFFism (I don't
|
||
# think there was ever COFF for the PDP-11).
|
||
#
|
||
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
|
||
# long, as it would be on a VAX. In any case, that could collide with
|
||
# VAX demand-paged files, as the magic number is little-endian on those
|
||
# binaries, so the first 16 bits of the file would contain 0x10B.
|
||
#
|
||
# Therefore, those entries are commented out.
|
||
#
|
||
# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
|
||
#
|
||
#0 short 0x107 unknown machine executable
|
||
#>8 short >0 not stripped
|
||
#>15 byte >0 - version %ld
|
||
#0 short 0x108 unknown pure executable
|
||
#>8 short >0 not stripped
|
||
#>15 byte >0 - version %ld
|
||
#0 short 0x109 PDP-11 separate I&D
|
||
#>8 short >0 not stripped
|
||
#>15 byte >0 - version %ld
|
||
#0 short 0x10b unknown pure executable
|
||
#>8 short >0 not stripped
|
||
#>15 byte >0 - version %ld
|
||
0 long 0x10c unknown demand paged pure executable
|
||
>16 long >0 not stripped
|
||
0 long 0x10e unknown readable demand paged pure executable
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $
|
||
# file(1) magic for uterus files
|
||
# http://freecode.com/projects/uterus
|
||
#
|
||
0 string UTE+ uterus file
|
||
>4 string v \b, version
|
||
>5 byte x %c
|
||
>6 string . \b.
|
||
>7 byte x \b%c
|
||
>8 string \<\> \b, big-endian
|
||
>>16 belong >0 \b, slut size %u
|
||
>8 string \>\< \b, litte-endian
|
||
>>16 lelong >0 \b, slut size %u
|
||
>10 byte &8 \b, compressed
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
|
||
# uuencode: file(1) magic for ASCII-encoded files
|
||
#
|
||
|
||
# GRR: the first line of xxencoded files is identical to that in uuencoded
|
||
# files, but the first character in most subsequent lines is 'h' instead of
|
||
# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
|
||
# punctuation and survives BITNET gateways better.) If regular expressions
|
||
# were supported, this entry could possibly be split into two with
|
||
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
|
||
0 search/1 begin\ uuencoded or xxencoded text
|
||
|
||
# btoa(1) is an alternative to uuencode that requires less space.
|
||
0 search/1 xbtoa\ Begin btoa'd text
|
||
|
||
# ship(1) is another, much cooler alternative to uuencode.
|
||
# Greg Roelofs, newt@uchicago.edu
|
||
0 search/1 $\012ship ship'd binary text
|
||
|
||
# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
|
||
# Greg Roelofs, newt@uchicago.edu
|
||
0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
|
||
|
||
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
|
||
# Daniel Quinlan, quinlan@yggdrasil.com
|
||
11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
|
||
>41 search/1 x \b, version %.3s
|
||
|
||
# GRR: handle BASE64
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
|
||
# varied.out: file(1) magic for various USG systems
|
||
#
|
||
# Herewith many of the object file formats used by USG systems.
|
||
# Most have been moved to files for a particular processor,
|
||
# and deleted if they duplicate other entries.
|
||
#
|
||
0 short 0610 Perkin-Elmer executable
|
||
# AMD 29K
|
||
0 beshort 0572 amd 29k coff noprebar executable
|
||
0 beshort 01572 amd 29k coff prebar executable
|
||
0 beshort 0160007 amd 29k coff archive
|
||
# Cray
|
||
6 beshort 0407 unicos (cray) executable
|
||
# Ultrix 4.3
|
||
596 string \130\337\377\377 Ultrix core file
|
||
>600 string >\0 from '%s'
|
||
# BeOS and MAcOS PEF executables
|
||
# From: hplus@zilker.net (Jon Watte)
|
||
0 string Joy!peffpwpc header for PowerPC PEF executable
|
||
#
|
||
# ava assembler/linker Uros Platise <uros.platise@ijs.si>
|
||
0 string avaobj AVR assembler object code
|
||
>7 string >\0 version '%s'
|
||
# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
|
||
0 string gmon GNU prof performance data
|
||
>4 long x - version %ld
|
||
# From: Dave Pearson <davep@davep.org>
|
||
# Harbour <URL:http://harbour-project.org/> HRB files.
|
||
0 string \xc0HRB Harbour HRB file
|
||
>4 leshort x version %d
|
||
# Harbour HBV files
|
||
0 string \xc0HBV Harbour variable dump file
|
||
>4 leshort x version %d
|
||
|
||
# From: Alex Beregszaszi <alex@fsn.hu>
|
||
# 0 string exec BugOS executable
|
||
# 0 string pack BugOS archive
|
||
|
||
# From: Jason Spence <jspence@lightconsulting.com>
|
||
# Generated by the "examples" in STM's ST40 devkit, and derived code.
|
||
0 lelong 0x13a9f17e ST40 component image format
|
||
>4 string >\0 \b, name '%s'
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $
|
||
# varied.script: file(1) magic for various interpreter scripts
|
||
|
||
0 string/t #!\ / a
|
||
>3 string >\0 %s script text executable
|
||
!:strength / 2
|
||
0 string/t #!\t/ a
|
||
>3 string >\0 %s script text executable
|
||
!:strength / 2
|
||
0 string/t #!/ a
|
||
>2 string >\0 %s script text executable
|
||
!:strength / 2
|
||
0 string/t #!\ script text executable
|
||
>3 string >\0 for %s
|
||
!:strength / 3
|
||
|
||
# using env
|
||
0 string/t #!/usr/bin/env a
|
||
>15 string/t >\0 %s script text executable
|
||
!:strength / 10
|
||
0 string/t #!\ /usr/bin/env a
|
||
>16 string/t >\0 %s script text executable
|
||
!:strength / 10
|
||
|
||
# From: arno <arenevier@fdn.fr>
|
||
# mozilla xpconnect typelib
|
||
# see http://www.mozilla.org/scriptable/typelib_file.html
|
||
0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
|
||
>0x10 byte x version %d
|
||
>>0x11 byte x \b.%d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
|
||
# vax: file(1) magic for VAX executable/object and APL workspace
|
||
#
|
||
0 lelong 0101557 VAX single precision APL workspace
|
||
0 lelong 0101556 VAX double precision APL workspace
|
||
|
||
#
|
||
# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
|
||
# executables, and are handled in aout)
|
||
#
|
||
0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable
|
||
>16 lelong >0 not stripped
|
||
|
||
#
|
||
# VAX COFF
|
||
#
|
||
# The `versions' were commented out, but have been un-commented out.
|
||
# (Was the problem just one of endianness?)
|
||
#
|
||
0 leshort 0570 VAX COFF executable
|
||
>12 lelong >0 not stripped
|
||
>22 leshort >0 - version %ld
|
||
0 leshort 0575 VAX COFF pure executable
|
||
>12 lelong >0 not stripped
|
||
>22 leshort >0 - version %ld
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
|
||
# vicar: file(1) magic for VICAR files.
|
||
#
|
||
# From: Ossama Othman <othman@astrosun.tn.cornell.edu
|
||
# VICAR is JPL's in-house spacecraft image processing program
|
||
# VICAR image
|
||
0 string LBLSIZE= VICAR image data
|
||
>32 string BYTE \b, 8 bits = VAX byte
|
||
>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
|
||
>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
|
||
>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
|
||
>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
|
||
>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
|
||
# VICAR label file
|
||
43 string SFDU_LABEL VICAR label file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $
|
||
# From: James Nobis <quel@quelrod.net>
|
||
# Microsoft hard disk images for:
|
||
# Virtual Server
|
||
# Virtual PC
|
||
# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
|
||
# .vhd
|
||
0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
|
||
|
||
# Sun xVM VirtualBox Disk Image
|
||
# From: Richard W.M. Jones <rich@annexia.org>
|
||
# VirtualBox Disk Image
|
||
0x40 ulelong 0xbeda107f VirtualBox Disk Image
|
||
>0x44 uleshort >0 \b, major %u
|
||
>0x46 uleshort >0 \b, minor %u
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
|
||
# Virtutech Compressed Random Access File Format
|
||
#
|
||
# From <gustav@virtutech.com>
|
||
0 string \211\277\036\203 Virtutech CRAFF
|
||
>4 belong x v%d
|
||
>20 belong 0 uncompressed
|
||
>20 belong 1 bzipp2ed
|
||
>20 belong 2 gzipped
|
||
>24 belong 0 not clean
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
|
||
# visx: file(1) magic for Visx format files
|
||
#
|
||
0 short 0x5555 VISX image file
|
||
>2 byte 0 (zero)
|
||
>2 byte 1 (unsigned char)
|
||
>2 byte 2 (short integer)
|
||
>2 byte 3 (float 32)
|
||
>2 byte 4 (float 64)
|
||
>2 byte 5 (signed char)
|
||
>2 byte 6 (bit-plane)
|
||
>2 byte 7 (classes)
|
||
>2 byte 8 (statistics)
|
||
>2 byte 10 (ascii text)
|
||
>2 byte 15 (image segments)
|
||
>2 byte 100 (image set)
|
||
>2 byte 101 (unsigned char vector)
|
||
>2 byte 102 (short integer vector)
|
||
>2 byte 103 (float 32 vector)
|
||
>2 byte 104 (float 64 vector)
|
||
>2 byte 105 (signed char vector)
|
||
>2 byte 106 (bit plane vector)
|
||
>2 byte 121 (feature vector)
|
||
>2 byte 122 (feature vector library)
|
||
>2 byte 124 (chain code)
|
||
>2 byte 126 (bit vector)
|
||
>2 byte 130 (graph)
|
||
>2 byte 131 (adjacency graph)
|
||
>2 byte 132 (adjacency graph library)
|
||
>2 string .VISIX (ascii text)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
|
||
# vms: file(1) magic for VMS executables (experimental)
|
||
#
|
||
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
|
||
|
||
# GRR 950122: I'm just guessing on these, based on inspection of the headers
|
||
# of three executables each for Alpha and VAX architectures. The VAX files
|
||
# all had headers similar to this:
|
||
#
|
||
# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
|
||
# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
|
||
#
|
||
0 string \xb0\0\x30\0 VMS VAX executable
|
||
>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
|
||
#
|
||
# The AXP files all looked like this, except that the byte at offset 0x22
|
||
# was 06 in some of them and 07 in others:
|
||
#
|
||
# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
|
||
# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
|
||
# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||
# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
|
||
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
|
||
#
|
||
# GRR this test is still too general as it catches example adressen.dbt
|
||
0 belong 0x03000000
|
||
>8 ubelong 0xec020000 VMS Alpha executable
|
||
>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $
|
||
# VMware specific files (deducted from version 1.1 and log file entries)
|
||
# Anthon van der Neut (anthon@mnt.org)
|
||
0 belong 0x4d52564e VMware nvram
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
|
||
# vorbis: file(1) magic for Ogg/Vorbis files
|
||
#
|
||
# From Felix von Leitner <leitner@fefe.de>
|
||
# Extended by Beni Cherniavsky <cben@crosswinds.net>
|
||
# Further extended by Greg Wooledge <greg@wooledge.org>
|
||
#
|
||
# Most (everything but the number of channels and bitrate) is commented
|
||
# out with `##' as it's not interesting to the average user. The most
|
||
# probable things advanced users would want to uncomment are probably
|
||
# the number of comments and the encoder version.
|
||
#
|
||
# FIXME: The first match has been made a search, so that it can skip
|
||
# over prepended ID3 tags. This will work for MIME type detection, but
|
||
# won't work for detecting other properties of the file (they all need
|
||
# to be made relative to the search). In any case, if the file has ID3
|
||
# tags, the ID3 information will be printed, not the Ogg information,
|
||
# so until that's fixed, this doesn't matter.
|
||
# FIXME[2]: Disable the above for now, since search assumes text mode.
|
||
#
|
||
# --- Ogg Framing ---
|
||
#0 search/1000 OggS Ogg data
|
||
0 string OggS Ogg data
|
||
!:mime application/ogg
|
||
>4 byte !0 UNKNOWN REVISION %u
|
||
##>4 byte 0 revision 0
|
||
>4 byte 0
|
||
##>>14 lelong x (Serial %lX)
|
||
# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
|
||
>>28 string \x7fFLAC \b, FLAC audio
|
||
# non-Vorbis content: Theora
|
||
>>28 string \x80theora \b, Theora video
|
||
# non-Vorbis content: Kate
|
||
>>28 string \x80kate\0\0\0\0 \b, Kate
|
||
>>>37 ubyte x v%u
|
||
>>>38 ubyte x \b.%u,
|
||
>>>40 byte 0 utf8 encoding,
|
||
>>>40 byte !0 unknown character encoding,
|
||
>>>60 string >\0 language %s,
|
||
>>>60 string \0 no language set,
|
||
>>>76 string >\0 category %s
|
||
>>>76 string \0 no category set
|
||
# non-Vorbis content: Skeleton
|
||
>>28 string fishead\0 \b, Skeleton
|
||
>>>36 short x v%u
|
||
>>>40 short x \b.%u
|
||
# non-Vorbis content: Speex
|
||
>>28 string Speex\ \ \ \b, Speex audio
|
||
# non-Vorbis content: OGM
|
||
>>28 string \x01video\0\0\0 \b, OGM video
|
||
>>>37 string/c div3 (DivX 3)
|
||
>>>37 string/c divx (DivX 4)
|
||
>>>37 string/c dx50 (DivX 5)
|
||
>>>37 string/c xvid (XviD)
|
||
# --- First vorbis packet - general header ---
|
||
>>28 string \x01vorbis \b, Vorbis audio,
|
||
>>>35 lelong !0 UNKNOWN VERSION %lu,
|
||
##>>>35 lelong 0 version 0,
|
||
>>>35 lelong 0
|
||
>>>>39 ubyte 1 mono,
|
||
>>>>39 ubyte 2 stereo,
|
||
>>>>39 ubyte >2 %u channels,
|
||
>>>>40 lelong x %lu Hz
|
||
# Minimal, nominal and maximal bitrates specified when encoding
|
||
>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
|
||
# The above tests if at least one of these is specified:
|
||
>>>>>52 lelong !-1
|
||
# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
|
||
# instead of -1.
|
||
# Vorbis 1.0 uses 0 instead of -1.
|
||
>>>>>>52 lelong !0
|
||
>>>>>>>52 lelong !-1000
|
||
>>>>>>>>52 lelong x <%lu
|
||
>>>>>48 lelong !-1
|
||
>>>>>>48 lelong x ~%lu
|
||
>>>>>44 lelong !-1
|
||
>>>>>>44 lelong !-1000
|
||
>>>>>>>44 lelong !0
|
||
>>>>>>>>44 lelong x >%lu
|
||
>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
|
||
# -- Second vorbis header packet - the comments
|
||
# A kludge to read the vendor string. It's a counted string, not a
|
||
# zero-terminated one, so file(1) can't read it in a generic way.
|
||
# libVorbis is the only one existing currently, so I detect specifically
|
||
# it. The interesting value is the cvs date (8 digits decimal).
|
||
# Post-RC1 Ogg files have the second header packet (and thus the version)
|
||
# in a different place, so we must use an indirect offset.
|
||
>>>(84.b+85) string \x03vorbis
|
||
>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
|
||
>>>>>(84.b+120) string >00000000
|
||
# Map to beta version numbers:
|
||
>>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
|
||
>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
|
||
>>>>>>(84.b+120) string >20000508
|
||
>>>>>>>(84.b+120) string <20001031 (beta2-3)
|
||
>>>>>>(84.b+120) string 20001031 (1.0 beta 3)
|
||
>>>>>>(84.b+120) string >20001031
|
||
>>>>>>>(84.b+120) string <20010225 (beta3-4)
|
||
>>>>>>(84.b+120) string 20010225 (1.0 beta 4)
|
||
>>>>>>(84.b+120) string >20010225
|
||
>>>>>>>(84.b+120) string <20010615 (beta4-RC1)
|
||
>>>>>>(84.b+120) string 20010615 (1.0 RC1)
|
||
>>>>>>(84.b+120) string 20010813 (1.0 RC2)
|
||
>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
|
||
>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
|
||
>>>>>>(84.b+120) string 20011217 (1.0 RC3)
|
||
>>>>>>(84.b+120) string 20011231 (1.0 RC3)
|
||
# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
|
||
>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
|
||
# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
|
||
>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
|
||
>>>>>(84.b+117) string >00000000
|
||
>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
|
||
>>>>>>(84.b+117) string 20020717 (1.0)
|
||
>>>>>>(84.b+117) string 20030909 (1.0.1)
|
||
>>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
|
||
# VXL: file(1) magic for VXL binary IO data files
|
||
#
|
||
# from Ian Scott <scottim@sf.net>
|
||
#
|
||
# VXL is a collection of C++ libraries for Computer Vision.
|
||
# See the vsl chapter in the VXL Book for more info
|
||
# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
|
||
# http:/vxl.sf.net
|
||
|
||
2 lelong 0x472b2c4e VXL data file,
|
||
>0 leshort >0 schema version no %d
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
|
||
# warc: file(1) magic for WARC files
|
||
|
||
0 string WARC/ WARC Archive
|
||
>5 string x version %.4s
|
||
!:mime application/warc
|
||
|
||
#------------------------------------------------------------------------------
|
||
# Arc File Format from Internet Archive
|
||
# see http://www.archive.org/web/researcher/ArcFileFormat.php
|
||
0 string filedesc:// Internet Archive File
|
||
!:mime application/x-ia-arc
|
||
>11 search/256 \x0A \b
|
||
>>&0 ubyte >0 \b version %c
|
||
|
||
#------------------------------------------------------------------------------
|
||
# weak: file(1) magic for very weak magic entries, disabled by default
|
||
#
|
||
# These entries are so weak that they might interfere identification of
|
||
# other formats. Example include:
|
||
# - Only identify for 1 or 2 bytes
|
||
# - Match against very wide range of values
|
||
# - Match against generic word in some spoken languages (e.g. English)
|
||
|
||
# Summary: Computer Graphics Metafile
|
||
# Extension: .cgm
|
||
#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
|
||
#0 beshort 0x3020 character Computer Graphics Metafile
|
||
|
||
#0 string =!! Bennet Yee's "face" format
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $
|
||
# windows: file(1) magic for Microsoft Windows
|
||
#
|
||
# This file is mainly reserved for files where programs
|
||
# using them are run almost always on MS Windows 3.x or
|
||
# above, or files only used exclusively in Windows OS,
|
||
# where there is no better category to allocate for.
|
||
# For example, even though WinZIP almost run on Windows
|
||
# only, it is better to treat them as "archive" instead.
|
||
# For format usable in DOS, such as generic executable
|
||
# format, please specify under "msdos" file.
|
||
#
|
||
|
||
|
||
# Summary: Outlook Express DBX file
|
||
# Extension: .dbx
|
||
# Created by: Christophe Monniez
|
||
0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file
|
||
>4 byte =0xC5 \b, message database
|
||
>4 byte =0xC6 \b, folder database
|
||
>4 byte =0xC7 \b, account information
|
||
>4 byte =0x30 \b, offline database
|
||
|
||
|
||
# Summary: Windows crash dump
|
||
# Extension: .dmp
|
||
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
|
||
# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
|
||
# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
|
||
0 string PAGE
|
||
>4 string DUMP MS Windows 32bit crash dump
|
||
>>0x05c byte 0 \b, no PAE
|
||
>>0x05c byte 1 \b, PAE
|
||
>>0xf88 lelong 1 \b, full dump
|
||
>>0xf88 lelong 2 \b, kernel dump
|
||
>>0xf88 lelong 3 \b, small dump
|
||
>>0x068 lelong x \b, %ld pages
|
||
>4 string DU64 MS Windows 64bit crash dump
|
||
>>0xf98 lelong 1 \b, full dump
|
||
>>0xf98 lelong 2 \b, kernel dump
|
||
>>0xf98 lelong 3 \b, small dump
|
||
>>0x090 lequad x \b, %lld pages
|
||
|
||
|
||
# Summary: Vista Event Log
|
||
# Extension: .evtx
|
||
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
|
||
# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
|
||
0 string ElfFile\0 MS Windows Vista Event Log
|
||
>0x2a leshort x \b, %d chunks
|
||
>>0x10 lelong x \b (no. %d in use)
|
||
>0x18 lelong >1 \b, next record no. %d
|
||
>0x18 lelong =1 \b, empty
|
||
>0x78 lelong &1 \b, DIRTY
|
||
>0x78 lelong &2 \b, FULL
|
||
|
||
|
||
# Summary: Windows 3.1 group files
|
||
# Extension: .grp
|
||
# Created by: unknown
|
||
0 string \120\115\103\103 MS Windows 3.1 group files
|
||
|
||
|
||
# Summary: Old format help files
|
||
# Extension: .hlp
|
||
# Created by: Dirk Jagdmann <doj@cubic.org>
|
||
0 lelong 0x00035f3f MS Windows 3.x help file
|
||
|
||
|
||
# Summary: Hyper terminal
|
||
# Extension: .ht
|
||
# Created by: unknown
|
||
0 string HyperTerminal\
|
||
>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
|
||
|
||
# http://ithreats.files.wordpress.com/2009/05/\
|
||
# lnk_the_windows_shortcut_file_format.pdf
|
||
# Summary: Windows shortcut
|
||
# Extension: .lnk
|
||
# Created by: unknown
|
||
# 'L' + GUUID
|
||
0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut
|
||
>20 lelong&1 1 \b, Item id list present
|
||
>20 lelong&2 2 \b, Points to a file or directory
|
||
>20 lelong&4 4 \b, Has Description string
|
||
>20 lelong&8 8 \b, Has Relative path
|
||
>20 lelong&16 16 \b, Has Working directory
|
||
>20 lelong&32 32 \b, Has command line arguments
|
||
>20 lelong&64 64 \b, Icon
|
||
>>56 lelong \b number=%d
|
||
>24 lelong&1 1 \b, Read-Only
|
||
>24 lelong&2 2 \b, Hidden
|
||
>24 lelong&4 4 \b, System
|
||
>24 lelong&8 8 \b, Volume Label
|
||
>24 lelong&16 16 \b, Directory
|
||
>24 lelong&32 32 \b, Archive
|
||
>24 lelong&64 64 \b, Encrypted
|
||
>24 lelong&128 128 \b, Normal
|
||
>24 lelong&256 256 \b, Temporary
|
||
>24 lelong&512 512 \b, Sparse
|
||
>24 lelong&1024 1024 \b, Reparse point
|
||
>24 lelong&2048 2048 \b, Compressed
|
||
>24 lelong&4096 4096 \b, Offline
|
||
>28 leqwdate x \b, ctime=%s
|
||
>36 leqwdate x \b, mtime=%s
|
||
>44 leqwdate x \b, atime=%s
|
||
>52 lelong x \b, length=%u, window=
|
||
>60 lelong&1 1 \bhide
|
||
>60 lelong&2 2 \bnormal
|
||
>60 lelong&4 4 \bshowminimized
|
||
>60 lelong&8 8 \bshowmaximized
|
||
>60 lelong&16 16 \bshownoactivate
|
||
>60 lelong&32 32 \bminimize
|
||
>60 lelong&64 64 \bshowminnoactive
|
||
>60 lelong&128 128 \bshowna
|
||
>60 lelong&256 256 \brestore
|
||
>60 lelong&512 512 \bshowdefault
|
||
#>20 lelong&1 0
|
||
#>>20 lelong&2 2
|
||
#>>>(72.l-64) pstring/h x \b [%s]
|
||
#>20 lelong&1 1
|
||
#>>20 lelong&2 2
|
||
#>>>(72.s) leshort x
|
||
#>>>&75 pstring/h x \b [%s]
|
||
|
||
# Summary: Outlook Personal Folders
|
||
# Created by: unknown
|
||
0 lelong 0x4E444221 Microsoft Outlook email folder
|
||
>10 leshort 0x0e (<=2002)
|
||
>10 leshort 0x17 (>=2003)
|
||
|
||
|
||
# Summary: Windows help cache
|
||
# Created by: unknown
|
||
0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
|
||
|
||
|
||
# Summary: IE cache file
|
||
# Created by: Christophe Monniez
|
||
0 string Client\ UrlCache\ MMF Internet Explorer cache file
|
||
>20 string >\0 version %s
|
||
|
||
|
||
# Summary: Registry files
|
||
# Created by: unknown
|
||
# Modified by (1): Joerg Jenderek
|
||
0 string regf MS Windows registry file, NT/2000 or above
|
||
0 string CREG MS Windows 95/98/ME registry file
|
||
0 string SHCC3 MS Windows 3.1 registry file
|
||
|
||
|
||
# Summary: Windows Registry text
|
||
# Extension: .reg
|
||
# Submitted by: Abel Cheung <abelcheung@gmail.com>
|
||
0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
|
||
0 string Windows\ Registry\ Editor\
|
||
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
|
||
|
||
|
||
# From: Pal Tamas <folti@balabit.hu>
|
||
# Autorun File
|
||
0 string/c [autorun]\r\n Microsoft Windows Autorun file.
|
||
!:mime application/x-setupscript.
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
|
||
# wireless-regdb: file(1) magic for CRDA wireless-regdb file format
|
||
#
|
||
0 string RGDB CRDA wireless regulatory database file
|
||
>4 belong 19 (Version 1)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $
|
||
# wordprocessors: file(1) magic fo word processors.
|
||
#
|
||
####### PWP file format used on Smith Corona Personal Word Processors:
|
||
2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
|
||
>24 byte 2 \b, single spaced
|
||
>24 byte 3 \b, 1.5 spaced
|
||
>24 byte 4 \b, double spaced
|
||
>25 byte 0x42 \b, letter
|
||
>25 byte 0x54 \b, legal
|
||
>26 byte 0x46 \b, A4
|
||
|
||
#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
|
||
0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file
|
||
>15 byte 0 Optimized for Intel
|
||
>15 byte 1 Optimized for Non-Intel
|
||
1 string WPC (Corel/WP)
|
||
>8 short 257 WordPerfect macro
|
||
>8 short 258 WordPerfect help file
|
||
>8 short 259 WordPerfect keyboard file
|
||
>8 short 266 WordPerfect document
|
||
>8 short 267 WordPerfect dictionary
|
||
>8 short 268 WordPerfect thesaurus
|
||
>8 short 269 WordPerfect block
|
||
>8 short 270 WordPerfect rectangular block
|
||
>8 short 271 WordPerfect column block
|
||
>8 short 272 WordPerfect printer data
|
||
>8 short 275 WordPerfect printer data
|
||
>8 short 276 WordPerfect driver resource data
|
||
>8 short 279 WordPerfect hyphenation code
|
||
>8 short 280 WordPerfect hyphenation data
|
||
>8 short 281 WordPerfect macro resource data
|
||
>8 short 283 WordPerfect hyphenation lex
|
||
>8 short 285 WordPerfect wordlist
|
||
>8 short 286 WordPerfect equation resource data
|
||
>8 short 289 WordPerfect spell rules
|
||
>8 short 290 WordPerfect dictionary rules
|
||
>8 short 295 WordPerfect spell rules (Microlytics)
|
||
>8 short 299 WordPerfect settings file
|
||
>8 short 301 WordPerfect 4.2 document
|
||
>8 short 325 WordPerfect dialog file
|
||
>8 short 332 WordPerfect button bar
|
||
>8 short 513 Shell macro
|
||
>8 short 522 Shell definition
|
||
>8 short 769 Notebook macro
|
||
>8 short 770 Notebook help file
|
||
>8 short 771 Notebook keyboard file
|
||
>8 short 778 Notebook definition
|
||
>8 short 1026 Calculator help file
|
||
>8 short 1538 Calendar help file
|
||
>8 short 1546 Calendar data file
|
||
>8 short 1793 Editor macro
|
||
>8 short 1794 Editor help file
|
||
>8 short 1795 Editor keyboard file
|
||
>8 short 1817 Editor macro resource file
|
||
>8 short 2049 Macro editor macro
|
||
>8 short 2050 Macro editor help file
|
||
>8 short 2051 Macro editor keyboard file
|
||
>8 short 2305 PlanPerfect macro
|
||
>8 short 2306 PlanPerfect help file
|
||
>8 short 2307 PlanPerfect keyboard file
|
||
>8 short 2314 PlanPerfect worksheet
|
||
>8 short 2319 PlanPerfect printer definition
|
||
>8 short 2322 PlanPerfect graphic definition
|
||
>8 short 2323 PlanPerfect data
|
||
>8 short 2324 PlanPerfect temporary printer
|
||
>8 short 2329 PlanPerfect macro resource data
|
||
>8 byte 11 Mail
|
||
>8 short 2818 help file
|
||
>8 short 2821 distribution list
|
||
>8 short 2826 out box
|
||
>8 short 2827 in box
|
||
>8 short 2836 users archived mailbox
|
||
>8 short 2837 archived message database
|
||
>8 short 2838 archived attachments
|
||
>8 short 3083 Printer temporary file
|
||
>8 short 3330 Scheduler help file
|
||
>8 short 3338 Scheduler in file
|
||
>8 short 3339 Scheduler out file
|
||
>8 short 3594 GroupWise settings file
|
||
>8 short 3601 GroupWise directory services
|
||
>8 short 3627 GroupWise settings file
|
||
>8 short 4362 Terminal resource data
|
||
>8 short 4363 Terminal resource data
|
||
>8 short 4395 Terminal resource data
|
||
>8 short 4619 GUI loadable text
|
||
>8 short 4620 graphics resource data
|
||
>8 short 4621 printer settings file
|
||
>8 short 4622 port definition file
|
||
>8 short 4623 print queue parameters
|
||
>8 short 4624 compressed file
|
||
>8 short 5130 Network service msg file
|
||
>8 short 5131 Network service msg file
|
||
>8 short 5132 Async gateway login msg
|
||
>8 short 5134 GroupWise message file
|
||
>8 short 7956 GroupWise admin domain database
|
||
>8 short 7957 GroupWise admin host database
|
||
>8 short 7959 GroupWise admin remote host database
|
||
>8 short 7960 GroupWise admin ADS deferment data file
|
||
>8 short 8458 IntelliTAG (SGML) compiled DTD
|
||
>8 long 18219264 WordPerfect graphic image (1.0)
|
||
>8 long 18219520 WordPerfect graphic image (2.0)
|
||
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
|
||
|
||
# Hangul (Korean) Word Processor File
|
||
0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
|
||
# From: Won-Kyu Park <wkpark@kldp.org>
|
||
512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
|
||
!:mime application/x-hwp
|
||
|
||
# CosmicBook, from Benoit Rouits
|
||
0 string CSBK Ted Neslson's CosmicBook hypertext file
|
||
|
||
2 string EYWR AmigaWriter file
|
||
|
||
# chi: file(1) magic for ChiWriter files
|
||
0 string \\1cw\ ChiWriter file
|
||
>5 string >\0 version %s
|
||
0 string \\1cw ChiWriter file
|
||
|
||
# Quark Express from http://www.garykessler.net/library/file_sigs.html
|
||
2 string IIXPR3 Intel Quark Express Document (English)
|
||
2 string IIXPRa Intel Quark Express Document (Korean)
|
||
2 string MMXPR3 Motorola Quark Express Document (English)
|
||
!:mime application/x-quark-xpress-3
|
||
2 string MMXPRa Motorola Quark Express Document (Korean)
|
||
|
||
# adobe indesign (document, whatever...) from querkan
|
||
0 belong 0x0606edf5 Adobe InDesign
|
||
>16 string DOCUMENT Document
|
||
|
||
#------------------------------------------------------------------------------
|
||
# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
|
||
#
|
||
# Contributor kenzo-:
|
||
# Reversed-engineered JS Ichitaro magic numbers
|
||
#
|
||
|
||
0 string DOC
|
||
>43 byte 0x14 Just System Word Processor Ichitaro v4
|
||
!:mime application/x-ichitaro4
|
||
>144 string JDASH application/x-ichitaro4
|
||
|
||
0 string DOC
|
||
>43 byte 0x15 Just System Word Processor Ichitaro v5
|
||
!:mime application/x-ichitaro5
|
||
|
||
0 string DOC
|
||
>43 byte 0x16 Just System Word Processor Ichitaro v6
|
||
!:mime application/x-ichitaro6
|
||
|
||
# Type: Freemind mindmap documents
|
||
# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
|
||
0 string/w \<map\ version Freemind document
|
||
!:mime application/x-freemind
|
||
|
||
# Type: Scribus
|
||
# From: Werner Fink <werner@suse.de>
|
||
0 string \<SCRIBUSUTF8\ Version Scribus Document
|
||
0 string \<SCRIBUSUTF8NEW\ Version Scribus Document
|
||
!:mime application/x-scribus
|
||
|
||
# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
|
||
# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
|
||
0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
|
||
# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
|
||
# Cache format extracted from source:
|
||
# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
|
||
# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
|
||
# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
|
||
0 string wsdl PHP WSDL cache,
|
||
>4 byte x version 0x%02x
|
||
>6 ledate x \b, created %s
|
||
|
||
# uri
|
||
>10 lelong <0x7fffffff
|
||
>>10 pstring/l x \b, uri: "%s"
|
||
|
||
# source
|
||
>>>&0 lelong <0x7fffffff
|
||
>>>>&-4 pstring/l x \b, source: "%s"
|
||
|
||
# target_ns
|
||
>>>>>&0 lelong <0x7fffffff
|
||
>>>>>>&-4 pstring/l x \b, target_ns: "%s"
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
|
||
# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
|
||
#
|
||
0 string %XDELTA% XDelta binary patch file 0.14
|
||
0 string %XDZ000% XDelta binary patch file 0.18
|
||
0 string %XDZ001% XDelta binary patch file 0.20
|
||
0 string %XDZ002% XDelta binary patch file 1.0
|
||
0 string %XDZ003% XDelta binary patch file 1.0.4
|
||
0 string %XDZ004% XDelta binary patch file 1.1
|
||
|
||
0 string \xD6\xC3\xC4\x00 VCDIFF binary diff
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
|
||
# xenix: file(1) magic for Microsoft Xenix
|
||
#
|
||
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
|
||
# model" lifted from "magic.xenix", with comment "derived empirically;
|
||
# treat as folklore until proven"
|
||
#
|
||
# "small model", "large model", "huge model" stuff lifted from XXX
|
||
#
|
||
# XXX - "x.out" collides with PDP-11 archives
|
||
#
|
||
0 string core core file (Xenix)
|
||
0 byte 0x80 8086 relocatable (Microsoft)
|
||
0 leshort 0xff65 x.out
|
||
>2 string __.SYMDEF randomized
|
||
>0 byte x archive
|
||
0 leshort 0x206 Microsoft a.out
|
||
>8 leshort 1 Middle model
|
||
>0x1e leshort &0x10 overlay
|
||
>0x1e leshort &0x2 separate
|
||
>0x1e leshort &0x4 pure
|
||
>0x1e leshort &0x800 segmented
|
||
>0x1e leshort &0x400 standalone
|
||
>0x1e leshort &0x8 fixed-stack
|
||
>0x1c byte &0x80 byte-swapped
|
||
>0x1c byte &0x40 word-swapped
|
||
>0x10 lelong >0 not-stripped
|
||
>0x1e leshort ^0xc000 pre-SysV
|
||
>0x1e leshort &0x4000 V2.3
|
||
>0x1e leshort &0x8000 V3.0
|
||
>0x1c byte &0x4 86
|
||
>0x1c byte &0xb 186
|
||
>0x1c byte &0x9 286
|
||
>0x1c byte &0xa 386
|
||
>0x1f byte <0x040 small model
|
||
>0x1f byte =0x048 large model
|
||
>0x1f byte =0x049 huge model
|
||
>0x1e leshort &0x1 executable
|
||
>0x1e leshort ^0x1 object file
|
||
>0x1e leshort &0x40 Large Text
|
||
>0x1e leshort &0x20 Large Data
|
||
>0x1e leshort &0x120 Huge Objects Enabled
|
||
>0x10 lelong >0 not stripped
|
||
|
||
0 leshort 0x140 old Microsoft 8086 x.out
|
||
>0x3 byte &0x4 separate
|
||
>0x3 byte &0x2 pure
|
||
>0 byte &0x1 executable
|
||
>0 byte ^0x1 relocatable
|
||
>0x14 lelong >0 not stripped
|
||
|
||
0 lelong 0x206 b.out
|
||
>0x1e leshort &0x10 overlay
|
||
>0x1e leshort &0x2 separate
|
||
>0x1e leshort &0x4 pure
|
||
>0x1e leshort &0x800 segmented
|
||
>0x1e leshort &0x400 standalone
|
||
>0x1e leshort &0x1 executable
|
||
>0x1e leshort ^0x1 object file
|
||
>0x1e leshort &0x4000 V2.3
|
||
>0x1e leshort &0x8000 V3.0
|
||
>0x1c byte &0x4 86
|
||
>0x1c byte &0xb 186
|
||
>0x1c byte &0x9 286
|
||
>0x1c byte &0x29 286
|
||
>0x1c byte &0xa 386
|
||
>0x1e leshort &0x4 Large Text
|
||
>0x1e leshort &0x2 Large Data
|
||
>0x1e leshort &0x102 Huge Objects Enabled
|
||
|
||
0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $
|
||
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
|
||
# Xilinx-Magic@RevRagnarok.com
|
||
# Got the info from FPGA-FAQ 0026
|
||
#
|
||
# First there is the sync header and its length
|
||
0 beshort 0x0009
|
||
>2 belong =0x0ff00ff0
|
||
>>&0 belong =0x0ff00ff0
|
||
>>>&0 beshort =0x0000
|
||
>>>>&0 pstring a Xilinx BIT data
|
||
# Next is a Pascal-style string with the NCD name. We want to capture that.
|
||
>>>>0x0F pstring x - from %s
|
||
# It is followed by a NUL
|
||
>>>>>&1 byte 0x00
|
||
# And then 'b'
|
||
>>>>>&2 string b
|
||
# With the part number:
|
||
#>>>>>&5 string 4v (Virtex4)
|
||
#>>>>>&5 string 2v (Virtex II
|
||
#>>>>>>&0 string !p \b)
|
||
#>>>>>>&0 string p Pro)
|
||
>>>>>&4 pstring x - for %s
|
||
# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length
|
||
>>>>>>&1 byte 0x00
|
||
>>>>>>&2 string c
|
||
>>>>>>&4 pstring x - built %s
|
||
>>>>>>>&1 byte 0x00
|
||
>>>>>>>&2 string d
|
||
>>>>>>>&4 pstring x \b(%s)
|
||
>>>>>>>>&1 byte 0x00
|
||
>>>>>>>>&2 string e
|
||
>>>>>>>>&4 belong x - data length 0x%lx
|
||
# Raw bitstream files
|
||
0 long 0xffffffff
|
||
>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
|
||
# xo65 object files
|
||
# From: "Ullrich von Bassewitz" <uz@cc65.org>
|
||
#
|
||
0 string \x55\x7A\x6E\x61 xo65 object,
|
||
>4 leshort x version %d,
|
||
>6 leshort&0x0001 =0x0001 with debug info
|
||
>6 leshort&0x0001 =0x0000 no debug info
|
||
|
||
# xo65 library files
|
||
0 string \x6E\x61\x55\x7A xo65 library,
|
||
>4 leshort x version %d
|
||
|
||
# o65 object files
|
||
0 string \x01\x00\x6F\x36\x35 o65
|
||
>6 leshort&0x1000 =0x0000 executable,
|
||
>6 leshort&0x1000 =0x1000 object,
|
||
>5 byte x version %d,
|
||
>6 leshort&0x8000 =0x8000 65816,
|
||
>6 leshort&0x8000 =0x0000 6502,
|
||
>6 leshort&0x2000 =0x2000 32 bit,
|
||
>6 leshort&0x2000 =0x0000 16 bit,
|
||
>6 leshort&0x4000 =0x4000 page reloc,
|
||
>6 leshort&0x4000 =0x0000 byte reloc,
|
||
>6 leshort&0x0003 =0x0000 alignment 1
|
||
>6 leshort&0x0003 =0x0001 alignment 2
|
||
>6 leshort&0x0003 =0x0002 alignment 4
|
||
>6 leshort&0x0003 =0x0003 alignment 256
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
|
||
# xwindows: file(1) magic for various X/Window system file formats.
|
||
|
||
# Compiled X Keymap
|
||
# XKM (compiled X keymap) files (including version and byte ordering)
|
||
1 string mkx Compiled XKB Keymap: lsb,
|
||
>0 byte >0 version %d
|
||
>0 byte =0 obsolete
|
||
0 string xkm Compiled XKB Keymap: msb,
|
||
>3 byte >0 version %d
|
||
>3 byte =0 obsolete
|
||
|
||
# xfsdump archive
|
||
0 string xFSdump0 xfsdump archive
|
||
>8 belong x (version %d)
|
||
|
||
# Jaleo XFS files
|
||
0 long 395726 Jaleo XFS file
|
||
>4 long x - version %ld
|
||
>8 long x - [%ld -
|
||
>20 long x \b%ldx
|
||
>24 long x \b%ldx
|
||
>28 long 1008 \bYUV422]
|
||
>28 long 1000 \bRGB24]
|
||
|
||
# Xcursor data
|
||
# X11 mouse cursor format defined in libXcursor, see
|
||
# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
|
||
# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
|
||
0 string Xcur Xcursor data
|
||
!:mime image/x-xcursor
|
||
>10 leshort x version %hd
|
||
>>8 leshort x \b.%hd
|
||
#------------------------------------------------------------------------------
|
||
# zfs: file(1) magic for ZFS dumps
|
||
#
|
||
# From <rea-fbsd@codelabs.ru>
|
||
# ZFS dump header has the following structure (as per zfs_ioctl.h
|
||
# in FreeBSD with drr_type is set to DRR_BEGIN)
|
||
#
|
||
# enum {
|
||
# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
|
||
# DRR_WRITE, DRR_FREE, DRR_END,
|
||
# } drr_type;
|
||
# uint32_t drr_pad;
|
||
# uint64_t drr_magic;
|
||
# uint64_t drr_version;
|
||
# uint64_t drr_creation_time;
|
||
# dmu_objset_type_t drr_type;
|
||
# uint32_t drr_pad;
|
||
# uint64_t drr_toguid;
|
||
# uint64_t drr_fromguid;
|
||
# char drr_toname[MAXNAMELEN];
|
||
#
|
||
# Backup magic is 0x00000002f5bacbac (quad word)
|
||
# The drr_type is defined as
|
||
# typedef enum dmu_objset_type {
|
||
# DMU_OST_NONE,
|
||
# DMU_OST_META,
|
||
# DMU_OST_ZFS,
|
||
# DMU_OST_ZVOL,
|
||
# DMU_OST_OTHER, /* For testing only! */
|
||
# DMU_OST_ANY, /* Be careful! */
|
||
# DMU_OST_NUMTYPES
|
||
# } dmu_objset_type_t;
|
||
#
|
||
# Almost all uint64_t fields are printed as the 32-bit ones (with high
|
||
# 32 bits zeroed), because there is no simple way to print them as the
|
||
# full 64-bit values.
|
||
|
||
# Big-endian values
|
||
8 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
|
||
>20 belong x version %lu,
|
||
>32 belong 0 type: NONE,
|
||
>32 belong 1 type: META,
|
||
>32 belong 2 type: ZFS,
|
||
>32 belong 3 type: ZVOL,
|
||
>32 belong 4 type: OTHER,
|
||
>32 belong 5 type: ANY,
|
||
>32 belong >5 type: UNKNOWN (%lu),
|
||
>40 byte x destination GUID: %02X
|
||
>41 byte x %02X
|
||
>42 byte x %02X
|
||
>43 byte x %02X
|
||
>44 byte x %02X
|
||
>45 byte x %02X
|
||
>46 byte x %02X
|
||
>47 byte x %02X,
|
||
>48 ulong >0
|
||
>>52 ulong >0
|
||
>>>48 byte x source GUID: %02X
|
||
>>>49 byte x %02X
|
||
>>>50 byte x %02X
|
||
>>>51 byte x %02X
|
||
>>>52 byte x %02X
|
||
>>>53 byte x %02X
|
||
>>>54 byte x %02X
|
||
>>>55 byte x %02X,
|
||
>56 string >\0 name: '%s'
|
||
|
||
# Little-endian values
|
||
8 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine),
|
||
>16 lelong x version %lu,
|
||
>32 lelong 0 type: NONE,
|
||
>32 lelong 1 type: META,
|
||
>32 lelong 2 type: ZFS,
|
||
>32 lelong 3 type: ZVOL,
|
||
>32 lelong 4 type: OTHER,
|
||
>32 lelong 5 type: ANY,
|
||
>32 lelong >5 type: UNKNOWN (%lu),
|
||
>47 byte x destination GUID: %02X
|
||
>46 byte x %02X
|
||
>45 byte x %02X
|
||
>44 byte x %02X
|
||
>43 byte x %02X
|
||
>42 byte x %02X
|
||
>41 byte x %02X
|
||
>40 byte x %02X,
|
||
>48 ulong >0
|
||
>>52 ulong >0
|
||
>>>55 byte x source GUID: %02X
|
||
>>>54 byte x %02X
|
||
>>>53 byte x %02X
|
||
>>>52 byte x %02X
|
||
>>>51 byte x %02X
|
||
>>>50 byte x %02X
|
||
>>>49 byte x %02X
|
||
>>>48 byte x %02X,
|
||
>56 string >\0 name: '%s'
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
|
||
# zilog: file(1) magic for Zilog Z8000.
|
||
#
|
||
# Was it big-endian or little-endian? My Product Specification doesn't
|
||
# say.
|
||
#
|
||
0 long 0xe807 object file (z8000 a.out)
|
||
0 long 0xe808 pure object file (z8000 a.out)
|
||
0 long 0xe809 separate object file (z8000 a.out)
|
||
0 long 0xe805 overlay object file (z8000 a.out)
|
||
|
||
#------------------------------------------------------------------------------
|
||
# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
|
||
# zyxel: file(1) magic for ZyXEL modems
|
||
#
|
||
# From <rob@pe1chl.ampr.org>
|
||
# These are the /etc/magic entries to decode datafiles as used for the
|
||
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
|
||
# ZyXEL-defined standard)
|
||
|
||
0 string ZyXEL\002 ZyXEL voice data
|
||
>10 byte 0 - CELP encoding
|
||
>10 byte&0x0B 1 - ADPCM2 encoding
|
||
>10 byte&0x0B 2 - ADPCM3 encoding
|
||
>10 byte&0x0B 3 - ADPCM4 encoding
|
||
>10 byte&0x0B 8 - New ADPCM3 encoding
|
||
>10 byte&0x04 4 with resync
|