NetBSD/usr.bin/file/magic.5

196 lines
5.9 KiB
Groff
Raw Normal View History

.TH MAGIC 5 "Public Domain"
1993-03-21 21:04:42 +03:00
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
.SH NAME
1993-03-21 12:45:37 +03:00
magic \- file command's magic number file
1993-03-21 21:04:42 +03:00
.SH DESCRIPTION
1993-03-21 12:45:37 +03:00
The
1993-03-21 21:04:42 +03:00
.IR file (1)
1993-03-21 12:45:37 +03:00
command identifies the type of a file using,
among other tests,
a test for whether the file begins with a certain
1993-03-21 21:04:42 +03:00
.IR "magic number" .
1993-03-21 12:45:37 +03:00
The file
1993-03-21 21:04:42 +03:00
.B /etc/magic
1993-03-21 12:45:37 +03:00
specifies what magic numbers are to be tested for,
what message to print if a particular magic number is found,
and additional information to extract from the file.
1993-03-21 21:04:42 +03:00
.PP
1993-03-21 12:45:37 +03:00
Each line of the file specifies a test to be performed.
A test compares the data starting at a particular offset
in the file with a 1-byte, 2-byte, or 4-byte numeric value or
a string. If the test succeeds, a message is printed.
The line consists of the following fields:
1993-03-21 21:04:42 +03:00
.IP offset \w'message'u+2n
1993-03-21 12:45:37 +03:00
A number specifying the offset, in bytes, into the file of the data
which is to be tested.
1993-03-21 21:04:42 +03:00
.IP type
1993-03-21 12:45:37 +03:00
The type of the data to be tested. The possible values are:
1993-03-21 21:04:42 +03:00
.RS
.IP byte \w'message'u+2n
1993-03-21 12:45:37 +03:00
A one-byte value.
1993-03-21 21:04:42 +03:00
.IP short
A two-byte value (on most systems) in this machine's native byte order.
1993-03-21 21:04:42 +03:00
.IP long
A four-byte value (on most systems) in this machine's native byte order.
1993-03-21 21:04:42 +03:00
.IP string
1993-03-21 12:45:37 +03:00
A string of bytes.
.IP date
A four-byte value interpreted as a unix date.
.IP beshort
A two-byte value (on most systems) in big-endian byte order.
.IP belong
A four-byte value (on most systems) in big-endian byte order.
.IP bedate
A four-byte value (on most systems) in big-endian byte order,
interpreted as a unix date.
.IP leshort
A two-byte value (on most systems) in little-endian byte order.
.IP lelong
A four-byte value (on most systems) in little-endian byte order.
.IP ledate
A four-byte value (on most systems) in little-endian byte order,
interpreted as a unix date.
1993-03-21 21:04:42 +03:00
.RE
1993-11-03 07:31:34 +03:00
.PP
The numeric types may optionally be followed by
.B &
and a numeric value,
to specify that the value is to be AND'ed with the
1993-11-03 07:31:34 +03:00
numeric value before any comparisons are done. Prepending a
.B u
to the type indicates that ordered comparisons should be unsigned.
1993-03-21 21:04:42 +03:00
.IP test
1993-03-21 12:45:37 +03:00
The value to be compared with the value from the file. If the type is
numeric, this value
is specified in C form; if it is a string, it is specified as a C string
with the usual escapes permitted (e.g. \en for new-line).
1993-03-21 21:04:42 +03:00
.IP
1993-03-21 12:45:37 +03:00
Numeric values
may be preceded by a character indicating the operation to be performed.
It may be
1993-03-21 21:04:42 +03:00
.BR = ,
1993-03-21 12:45:37 +03:00
to specify that the value from the file must equal the specified value,
1993-03-21 21:04:42 +03:00
.BR < ,
1993-03-21 12:45:37 +03:00
to specify that the value from the file must be less than the specified
value,
1993-03-21 21:04:42 +03:00
.BR > ,
1993-03-21 12:45:37 +03:00
to specify that the value from the file must be greater than the specified
value,
1993-03-21 21:04:42 +03:00
.BR & ,
to specify that the value from the file must have set all of the bits
that are set in the specified value,
or
.BR ^ ,
to specify that the value from the file must have clear any of the bits
that are set in the specified value.
.IP
1993-03-21 12:45:37 +03:00
Numeric values are specified in C form; e.g.
1993-03-21 21:04:42 +03:00
.B 13
1993-03-21 12:45:37 +03:00
is decimal,
1993-03-21 21:04:42 +03:00
.B 013
1993-03-21 12:45:37 +03:00
is octal, and
1993-03-21 21:04:42 +03:00
.B 0x13
1993-03-21 12:45:37 +03:00
is hexadecimal.
to specify that any value will match. If the character
is omitted, it is assumed to be
1993-03-21 21:04:42 +03:00
.BR = .
.IP
1993-03-21 12:45:37 +03:00
For string values, the byte string from the
file must match the specified byte string.
The operators
.BR = ,
.B <
and
.B >
(but not
.BR & )
can be applied to strings.
1993-03-21 12:45:37 +03:00
The length used for matching is that of the string argument
in the magic file. This means that a line can match any string, and
then presumably print that string, by doing
.B >\e0
(because all strings are greater than the null string).
1993-03-21 21:04:42 +03:00
.IP message
1993-03-21 12:45:37 +03:00
The message to be printed if the comparison succeeds. If the string
contains a
1993-03-21 21:04:42 +03:00
.IR printf (3S)
1993-03-21 12:45:37 +03:00
format specification, the value from the file (with any specified masking
performed) is printed using the message as the format string.
1993-03-21 21:04:42 +03:00
.PP
1993-03-21 12:45:37 +03:00
Some file formats contain additional information which is to be printed
along with the file type. A line which begins with the character
1993-03-21 21:04:42 +03:00
.B >
indicates additional tests and messages to be printed. The number of
1993-03-21 21:04:42 +03:00
.B >
on the line indicates the level of the test; a line with no
1993-03-21 21:04:42 +03:00
.B >
at the beginning is considered to be at level 0.
Each line at level
.IB n \(pl1
is under the control of the line at level
.IB n
most closely preceding it in the magic file.
If the test on a line at level
.I n
succeeds, the tests specified in all the subsequent lines at level
.IB n \(pl1
1993-03-21 12:45:37 +03:00
are performed, and the messages printed if the tests succeed. The next
line at level
.I n
1993-03-21 12:45:37 +03:00
terminates this.
If the first character following the last
.B >
is a
.B (
then the string after the parenthesis is interpreted as an indirect offset.
That means that the number after the parenthesis is used as a offset in
the file. The value at that offset is read, and is used again as an offset
in the file. Indirect offsets are of the form:
.BI (( x [.[bsl]][+-][ y ]).
The value of
.I x
is used as an offset in the file. A byte, short or long is read at that offset
depending on the
.B [bsl]
type specifier. To that number the value of
.I y
is added and the result is used as an offset in the file. The default type
if one is not specified is long.
1993-03-21 21:04:42 +03:00
.SH BUGS
1993-03-21 12:45:37 +03:00
The formats
.IR long ,
.IR belong ,
.IR lelong ,
.IR short ,
.IR beshort ,
.IR leshort ,
.IR date ,
.IR bedate ,
1993-03-21 12:45:37 +03:00
and
.I ledate
1994-02-10 21:24:46 +03:00
are system-dependent; perhaps they should be specified as a number
1993-03-21 12:45:37 +03:00
of bytes (2B, 4B, etc),
since the files being recognized typically come from
a system on which the lengths are invariant.
1993-03-21 21:04:42 +03:00
.PP
There is (currently) no support for specified-endian data to be used in
indirect offsets.
1993-03-21 21:04:42 +03:00
.SH SEE ALSO
.IR file (1)
1993-03-21 12:45:37 +03:00
\- the command that reads this file.
1993-03-21 21:04:42 +03:00
.\"
.\" From: guy@sun.uucp (Guy Harris)
.\" Newsgroups: net.bugs.usg
.\" Subject: /etc/magic's format isn't well documented
.\" Message-ID: <2752@sun.uucp>
.\" Date: 3 Sep 85 08:19:07 GMT
.\" Organization: Sun Microsystems, Inc.
.\" Lines: 136
.\"
.\" Here's a manual page for the format accepted by the "file" made by adding
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
1994-02-10 21:24:46 +03:00
.\" from: @(#)$Id: magic.5,v 1.6 1994/02/10 18:24:46 jtc Exp $
.\" $Id: magic.5,v 1.6 1994/02/10 18:24:46 jtc Exp $