new file 3.31
This commit is contained in:
christos
parent
e852afa89f
commit
0bb263b436
|
|
@ -0,0 +1,7 @@
|
|||
#------------------------------------------------------------------------------
|
||||
# allegro: file(1) magic for Allegro datafiles
|
||||
# Toby Deshane <hac@shoelace.digivill.net>
|
||||
#
|
||||
0 belong 0x736C6821 Allegro datafile (packed)
|
||||
0 belong 0x736C682E Allegro datafile (not packed/autodetect)
|
||||
0 belong 0x736C682B Allegro datafile (appended exe data)
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# claris: file(1) magic for claris
|
||||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||||
# Claris Works a word processor, etc.
|
||||
# Version 3.0
|
||||
|
||||
# .pct claris works clip art files
|
||||
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
|
||||
#*
|
||||
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
|
||||
#null to byte 1000 octal
|
||||
514 string \377\377\377\377\000 Claris clip art?
|
||||
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
|
||||
514 string \377\377\377\377\001 Claris clip art?
|
||||
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
|
||||
|
||||
# Claris works files
|
||||
# .cwk
|
||||
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
|
||||
# .plt
|
||||
0 string \020\341\000\000\010\010 Claris Works pallete files .plt
|
||||
|
||||
# .msp a dictionary file I am not sure about this I have only one .msp file
|
||||
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
|
||||
|
||||
# .usp are user dictionary bits
|
||||
# I am not sure about a magic header:
|
||||
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
|
||||
# soh S p f 8 U D sp ^ S cr nl p o d i
|
||||
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
|
||||
# a t r i s t sp ^ S cr nl d i v sp #
|
||||
|
||||
# .mth Thesaurus
|
||||
# statrts with \0 but no magic header
|
||||
|
||||
# .chy Hyphenation file
|
||||
# I am not sure: 000 210 034 000 000
|
||||
|
||||
# other claris files
|
||||
#./windows/claris/useng.ndx: data
|
||||
#./windows/claris/xtndtran.l32: data
|
||||
#./windows/claris/xtndtran.lst: data
|
||||
#./windows/claris/clworks.lbl: data
|
||||
#./windows/claris/clworks.prf: data
|
||||
#./windows/claris/userd.spl: data
|
||||
|
|
@ -0,0 +1,122 @@
|
|||
#------------------------------------------------------------------------------
|
||||
# Console game magic
|
||||
# Toby Deshane <hac@shoelace.digivill.net>
|
||||
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
|
||||
# ROM dump format
|
||||
|
||||
0 string NES\032 iNES ROM dump,
|
||||
>4 byte x %dx16k PRG
|
||||
>5 byte x \b, %dx8k CHR
|
||||
>6 byte&0x01 =0x1 \b, [Vert.]
|
||||
>6 byte&0x01 =0x0 \b, [Horiz.]
|
||||
>6 byte&0x02 =0x2 \b, [SRAM]
|
||||
>6 byte&0x04 =0x4 \b, [Trainer]
|
||||
>6 byte&0x04 =0x8 \b, [4-Scr]
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
|
||||
#
|
||||
0x104 belong 0xCEED6666 Gameboy ROM:
|
||||
>0x134 string >\0 "%.16s"
|
||||
>0x146 byte 0x03 \b,[SGB]
|
||||
>0x147 byte 0x00 \b, [ROM ONLY]
|
||||
>0x147 byte 0x01 \b, [ROM+MBC1]
|
||||
>0x147 byte 0x02 \b, [ROM+MBC1+RAM]
|
||||
>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
|
||||
>0x147 byte 0x05 \b, [ROM+MBC2]
|
||||
>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
|
||||
>0x147 byte 0x08 \b, [ROM+RAM]
|
||||
>0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
|
||||
>0x147 byte 0x0B \b, [ROM+MMM01]
|
||||
>0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
|
||||
>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
|
||||
>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
|
||||
>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
|
||||
>0x147 byte 0x11 \b, [ROM+MBC3]
|
||||
>0x147 byte 0x12 \b, [ROM+MBC3+RAM]
|
||||
>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
|
||||
>0x147 byte 0x19 \b, [ROM+MBC5]
|
||||
>0x147 byte 0x1A \b, [ROM+MBC5+RAM]
|
||||
>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
|
||||
>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
|
||||
>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
|
||||
>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
|
||||
>0x147 byte 0x1F \b, [Pocket Camera]
|
||||
>0x147 byte 0xFD \b, [Bandai TAMA5]
|
||||
>0x147 byte 0xFE \b, [Hudson HuC-3]
|
||||
>0x147 byte 0xFF \b, [Hudson HuC-1]
|
||||
|
||||
>0x148 byte 0 \b, ROM: 256Kbit
|
||||
>0x148 byte 1 \b, ROM: 512Kbit
|
||||
>0x148 byte 2 \b, ROM: 1Mbit
|
||||
>0x148 byte 3 \b, ROM: 2Mbit
|
||||
>0x148 byte 4 \b, ROM: 4Mbit
|
||||
>0x148 byte 5 \b, ROM: 8Mbit
|
||||
>0x148 byte 6 \b, ROM: 16Mbit
|
||||
>0x148 byte 0x52 \b, ROM: 9Mbit
|
||||
>0x148 byte 0x53 \b, ROM: 10Mbit
|
||||
>0x148 byte 0x54 \b, ROM: 12Mbit
|
||||
|
||||
>0x149 byte 1 \b, RAM: 16Kbit
|
||||
>0x149 byte 2 \b, RAM: 64Kbit
|
||||
>0x149 byte 3 \b, RAM: 128Kbit
|
||||
>0x149 byte 4 \b, RAM: 1Mbit
|
||||
|
||||
#>0x14e long x \b, CRC: %x
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
|
||||
#
|
||||
0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
|
||||
>0x120 string >\0 Name: "%.16s"
|
||||
>0x110 string >\0 %.16s
|
||||
>0x1B0 string RA with SRAM
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# genesis: file(1) magic for the Super MegaDrive ROM dump format
|
||||
#
|
||||
0x280 string EAGN Super MagicDrive ROM dump
|
||||
>0 byte x %dx16k blocks
|
||||
>2 byte 0 \b, last in series or standalone
|
||||
>2 byte >0 \b, split ROM
|
||||
>8 byte 0xAA
|
||||
>9 byte 0xBB
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
|
||||
#
|
||||
0x280 string EAMG Super MagicDrive ROM dump
|
||||
>0 byte x %dx16k blocks
|
||||
>2 byte x \b, last in series or standalone
|
||||
>8 byte 0xAA
|
||||
>9 byte 0xBB
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
|
||||
#
|
||||
# Does not detect all images. Very preliminary guesswork. Need more data
|
||||
# on format.
|
||||
#
|
||||
# FIXME: need a little more info...;P
|
||||
#
|
||||
#0 byte 0xF3
|
||||
#>1 byte 0xED Sega Master System/Game Gear ROM dump
|
||||
#>1 byte 0x31 Sega Master System/Game Gear ROM dump
|
||||
#>1 byte 0xDB Sega Master System/Game Gear ROM dump
|
||||
#>1 byte 0xAF Sega Master System/Game Gear ROM dump
|
||||
#>1 byte 0xC3 Sega Master System/Game Gear ROM dump
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
|
||||
#
|
||||
0 belong 0x21068028 Sega Dreamcast VMU game image
|
||||
0 string LCDi Dream Animator file
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
|
||||
#
|
||||
0 belong 0x37804012 V64 Nintendo 64 ROM dump
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# msx: file(1) magic for MSX game cartridge dumps
|
||||
0 beshort 0x4142 MSX game cartridge dump
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
|
||||
# Stefan Praszalowicz (hpicollo@worldnet.fr)
|
||||
#0 lelong 0x10000037 Epoc32
|
||||
>4 lelong 0x1000006D
|
||||
>>8 lelong 0x1000007F Word
|
||||
>>8 lelong 0x10000088 Sheet
|
||||
>>8 lelong 0x1000007D Sketch
|
||||
>>8 lelong 0x10000085 TextEd
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# fsav: file(1) magic for datafellows fsav virus definition files
|
||||
# Anthon van der Neut (anthon@mnt.org)
|
||||
0 beshort 0x1575 fsav (linux) macro virus
|
||||
>8 leshort >0 (%d-
|
||||
>11 byte >0 \b%02d-
|
||||
>10 byte >0 \b%02d)
|
||||
|
||||
# comment this out for now because it regognizes every file where
|
||||
# the eighth character is \n
|
||||
#8 byte 0x0a
|
||||
#>12 byte 0x07
|
||||
#>11 leshort >0 fsav (linux) virus (%d-
|
||||
#>10 byte 0 \b01-
|
||||
#>10 byte 1 \b02-
|
||||
#>10 byte 2 \b03-
|
||||
#>10 byte 3 \b04-
|
||||
#>10 byte 4 \b05-
|
||||
#>10 byte 5 \b06-
|
||||
#>10 byte 6 \b07-
|
||||
#>10 byte 7 \b08-
|
||||
#>10 byte 8 \b08-
|
||||
#>10 byte 9 \b10-
|
||||
#>10 byte 10 \b11-
|
||||
#>10 byte 11 \b12-
|
||||
#>9 byte >0 \b%02d)
|
||||
|
|
@ -7,3 +7,6 @@
|
|||
0 string \225\4\22\336 GNU message catalog (big endian),
|
||||
>4 belong x revision %d,
|
||||
>8 belong x %d messages
|
||||
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
|
||||
0 string *nazgul* Nazgul style compiled message catalog
|
||||
>8 lelong >0 \b, version %ld
|
||||
|
|
|
|||
|
|
@ -0,0 +1,57 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# maple: file(1) magic for maple files
|
||||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||||
# Maple V release 4, a multi-purpose math program
|
||||
#
|
||||
|
||||
# maple library .lib
|
||||
0 string \000MVR4\nI MapleVr4 library
|
||||
|
||||
# .ind
|
||||
# no magic for these :-(
|
||||
# they are compiled indexes for maple files
|
||||
|
||||
# .hdb
|
||||
0 string \000\004\000\000 Maple help database
|
||||
|
||||
# .mhp
|
||||
# this has the form <PACKAGE=name>
|
||||
0 string \<PACKAGE= Maple help file
|
||||
0 string \<HELP\ NAME= Maple help file
|
||||
0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
|
||||
0 string #\ Newton Maple help file, old style
|
||||
0 string #\ daub Maple help file, old style
|
||||
0 string #=========== Maple help file, old style
|
||||
|
||||
# .mws
|
||||
0 string \000\000\001\044\000\221 Maple worksheet
|
||||
#this is anomalous
|
||||
0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
|
||||
# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
|
||||
# that is {VERSION major_version miunor_version computer_type version_string}
|
||||
0 string {VERSION\ Maple worksheet
|
||||
>9 string >\0 version %.1s.
|
||||
>>10 string
|
||||
>>>11 string >\0 %.1s
|
||||
|
||||
# .mps
|
||||
0 string \0\0\001$ Maple something
|
||||
# from byte 4 it is either 'nul E' or 'soh R'
|
||||
# I think 'nul E' means a file that was saved as a different name
|
||||
# a sort of revision marking
|
||||
# 'soh R' means new
|
||||
>4 string \000\105 An old revision
|
||||
>4 string \001\122 The latest save
|
||||
|
||||
# .mpl
|
||||
# some of these are the same as .mps above
|
||||
#0000000 000 000 001 044 000 105 same as .mps
|
||||
#0000000 000 000 001 044 001 122 same as .mps
|
||||
|
||||
0 string #\n##\ <SHAREFILE= Maple something
|
||||
0 string \n#\n##\ <SHAREFILE= Maple something
|
||||
0 string ##\ <SHAREFILE= Maple something
|
||||
0 string #\r##\ <SHAREFILE= Maple something
|
||||
0 string \r#\r##\ <SHAREFILE= Maple something
|
||||
0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# mathematica: file(1) magic for mathematica files
|
||||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||||
# Mathematica a multi-purpose math program
|
||||
# versions 2.2 and 3.0
|
||||
|
||||
#mathematica .mb
|
||||
0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
|
||||
0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
|
||||
|
||||
# .ma
|
||||
# multiple possibilites:
|
||||
|
||||
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
|
||||
#>41 string >\0 %s
|
||||
|
||||
#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
|
||||
|
||||
#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
|
||||
#>675 string >\0 %s #doesn't work well
|
||||
|
||||
# there may be 'cr' instread of 'nl' in some does this matter?
|
||||
|
||||
# generic:
|
||||
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
|
||||
0 string \(\*\^\r\n\r\n\:\:\[\011 Mathematica notebook version 2.x
|
||||
0 string (*^\015 Mathematica notebook version 2.x
|
||||
0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
|
||||
0 string (*^\r::[\011 Mathematica notebook version 2.x
|
||||
0 string (*^\r\n::[\011 Mathematica notebook version 2.x
|
||||
0 string (*^\n\n::[\011 Mathematica notebook version 2.x
|
||||
0 string (*^\n::[\011 Mathematica notebook version 2.x
|
||||
|
||||
|
||||
# Mathematica .mx files
|
||||
|
||||
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
|
||||
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
|
||||
#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
|
||||
# >71... is optional
|
||||
>88 string >\0 from %s
|
||||
|
||||
|
||||
# Mathematica files PBF:
|
||||
# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
|
||||
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
|
||||
|
||||
# .ml files These are menu resources I think
|
||||
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
|
||||
# how to put that into a magic rule?
|
||||
4 string \ A~ MAthematica .ml file
|
||||
|
||||
# .nb files
|
||||
#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
|
||||
0 string (*********************** Mathematica 3.0 notebook
|
||||
|
||||
# other (* matches it is a comment start in these langs
|
||||
0 string (* Mathematica, or Pascal, Modula-2 or 3 code
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# msvc: file(1) magic for msvc
|
||||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||||
# Microsoft visual C
|
||||
#
|
||||
# I have version 1.0
|
||||
|
||||
# .aps
|
||||
0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
|
||||
|
||||
# .ide
|
||||
#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
|
||||
0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
|
||||
|
||||
# .res
|
||||
0 string \000\000\000\000\040\000\000\000\377 MSVC .res
|
||||
0 string \377\003\000\377\001\000\020\020\350 MSVC .res
|
||||
0 string \377\003\000\377\001\000\060\020\350 MSVC .res
|
||||
|
||||
#.lib
|
||||
0 string \360\015\000\000 Microsoft Visual C library
|
||||
0 string \360\075\000\000 Microsoft Visual C library
|
||||
0 string \360\175\000\000 Microsoft Visual C library
|
||||
|
||||
#.pch
|
||||
0 string DTJPCH0\000\022\103\006\200 Microsoft visula C .pch
|
||||
|
||||
# .pdb
|
||||
# too long 0 string Microsoft\ C/C++\ program\ database\
|
||||
0 string Microsoft\ C/C++\ MSVC program database
|
||||
>18 string program\ database\
|
||||
>33 string >\0 ver %s
|
||||
|
||||
#.sbr
|
||||
0 string \000\002\000\007\000 MSVC .sbr
|
||||
>5 string >\0 %s
|
||||
|
||||
#.bsc
|
||||
0 string \002\000\002\001 MSVC .bsc
|
||||
|
||||
#.wsp
|
||||
0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
|
||||
# these seem to start with the version and contain menus
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# netscape: file(1) magic for Netscape files
|
||||
# "H. Nanosecond" <aldomel@ix.netcom.com>
|
||||
# version 3 and 4 I think
|
||||
#
|
||||
|
||||
# Netscape Address book .nab
|
||||
0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
|
||||
|
||||
# .snm Caches
|
||||
0 string #\ Netscape\ folder\ cache Netscape folder cache
|
||||
0 string \000\036\204\220\000 Netscape folder cache
|
||||
# .n2p
|
||||
# Net 2 Phone
|
||||
#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
|
||||
0 string SX961999 Net2phone
|
||||
|
||||
#
|
||||
#This is files ending in .art, FIXME add more rules
|
||||
0 string JG\004\016\0\0\0\0 ART
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# project: file(1) magic for Project management
|
||||
#
|
||||
# Magic strings for ftnchek project files. Alexander Mai
|
||||
0 string FTNCHEK_\ P project file for ftnchek
|
||||
>10 string 1 version 2.7
|
||||
>10 string 2 version 2.8 to 2.10
|
||||
>10 string 3 version 2.11 or later
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
# -----------------------------------------------------------
|
||||
# VMware specific files (deducted from version 1.1 and log file entries)
|
||||
# Anthon van der Neut (anthon@mnt.org)
|
||||
0 belong 0x4d52564e VMware nvram
|
||||
0 belong 0x434f5744 VMware virtual disk
|
||||
>32 lelong x (%d/
|
||||
>36 lelong x \b%d/
|
||||
>40 lelong x \b%d)
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
#------------------------------------------------------------------------------
|
||||
# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
|
||||
#
|
||||
0 string %XDELTA% XDelta binary patch file 0.14
|
||||
0 string %XDZ000% XDelta binary patch file 0.18
|
||||
0 string %XDZ001% XDelta binary patch file 0.20
|
||||
0 string %XDZ002% XDelta binary patch file 1.0
|
||||
0 string %XDZ003% XDelta binary patch file 1.0.4
|
||||
0 string %XDZ004% XDelta binary patch file 1.1
|
||||
|
|
@ -0,0 +1,532 @@
|
|||
$NetBSD: magic.mime,v 1.1.1.1 2000/05/14 22:44:21 christos Exp $
|
||||
# Magic data for KMimeMagic (originally for file(1) command)
|
||||
#
|
||||
# The format is 4-5 columns:
|
||||
# Column #1: byte number to begin checking from, ">" indicates continuation
|
||||
# Column #2: type of data to match
|
||||
# Column #3: contents of data to match
|
||||
# Column #4: MIME type of result
|
||||
# Column #5: MIME encoding of result (optional)
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# Localstuff: file(1) magic for locally observed files
|
||||
# Add any locally observed files here.
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# end local stuff
|
||||
#------------------------------------------------------------------------------
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# Java
|
||||
|
||||
0 short 0xcafe
|
||||
>2 short 0xbabe application/java
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# audio: file(1) magic for sound formats
|
||||
#
|
||||
# from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
|
||||
#
|
||||
|
||||
# Sun/NeXT audio data
|
||||
0 string .snd
|
||||
>12 belong 1 audio/basic
|
||||
>12 belong 2 audio/basic
|
||||
>12 belong 3 audio/basic
|
||||
>12 belong 4 audio/basic
|
||||
>12 belong 5 audio/basic
|
||||
>12 belong 6 audio/basic
|
||||
>12 belong 7 audio/basic
|
||||
|
||||
>12 belong 23 audio/x-adpcm
|
||||
|
||||
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
|
||||
# that uses little-endian encoding and has a different magic number
|
||||
# (0x0064732E in little-endian encoding).
|
||||
0 lelong 0x0064732E
|
||||
>12 lelong 1 audio/x-dec-basic
|
||||
>12 lelong 2 audio/x-dec-basic
|
||||
>12 lelong 3 audio/x-dec-basic
|
||||
>12 lelong 4 audio/x-dec-basic
|
||||
>12 lelong 5 audio/x-dec-basic
|
||||
>12 lelong 6 audio/x-dec-basic
|
||||
>12 lelong 7 audio/x-dec-basic
|
||||
# compressed (G.721 ADPCM)
|
||||
>12 lelong 23 audio/x-dec-adpcm
|
||||
|
||||
# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
|
||||
# AIFF audio data
|
||||
8 string AIFF audio/x-aiff
|
||||
# AIFF-C audio data
|
||||
8 string AIFC audio/x-aiff
|
||||
# IFF/8SVX audio data
|
||||
8 string 8SVX audio/x-aiff
|
||||
|
||||
# Creative Labs AUDIO stuff
|
||||
# Standard MIDI data
|
||||
0 string MThd audio/unknown
|
||||
#>9 byte >0 (format %d)
|
||||
#>11 byte >1 using %d channels
|
||||
# Creative Music (CMF) data
|
||||
0 string CTMF audio/unknown
|
||||
# SoundBlaster instrument data
|
||||
0 string SBI audio/unknown
|
||||
# Creative Labs voice data
|
||||
0 string Creative\ Voice\ File audio/unknown
|
||||
## is this next line right? it came this way...
|
||||
#>19 byte 0x1A
|
||||
#>23 byte >0 - version %d
|
||||
#>22 byte >0 \b.%d
|
||||
|
||||
# [GRR 950115: is this also Creative Labs? Guessing that first line
|
||||
# should be string instead of unknown-endian long...]
|
||||
#0 long 0x4e54524b MultiTrack sound data
|
||||
#0 string NTRK MultiTrack sound data
|
||||
#>4 long x - version %ld
|
||||
|
||||
# Microsoft WAVE format (*.wav)
|
||||
# [GRR 950115: probably all of the shorts and longs should be leshort/lelong]
|
||||
# Microsoft RIFF
|
||||
0 string RIFF audio/unknown
|
||||
# - WAVE format
|
||||
>8 string WAVE audio/x-wav
|
||||
#
|
||||
0 belong 0x2e7261fd application/x-realaudio
|
||||
|
||||
# MPEG Layer 3 sound files
|
||||
# Modified the 11/20/97 at 15:59:04 by Christophe Prud'homme <christophe.prudhomme@asci.fr>
|
||||
0 belong 0xfffb audio/x-mp3
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# c-lang: file(1) magic for C programs or various scripts
|
||||
#
|
||||
|
||||
# XPM icons (Greg Roelofs, newt@uchicago.edu)
|
||||
# ideally should go into "images", but entries below would tag XPM as C source
|
||||
0 string /*\ XPM image/x-xpm 7bit
|
||||
|
||||
# this first will upset you if you're a PL/1 shop... (are there any left?)
|
||||
# in which case rm it; ascmagic will catch real C programs
|
||||
# C or REXX program text
|
||||
#0 string /* text/x-c
|
||||
# C++ program text
|
||||
#0 string // text/x-c++
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# commands: file(1) magic for various shells and interpreters
|
||||
#
|
||||
#0 string :\ shell archive or commands for antique kernel text
|
||||
0 string #!/bin/sh application/x-shellscript
|
||||
0 string #!\ /bin/sh application/x-shellscript
|
||||
0 string #!/bin/csh application/x-shellscript
|
||||
0 string #!\ /bin/csh application/x-shellscript
|
||||
# korn shell magic, sent by George Wu, gwu@clyde.att.com
|
||||
0 string #!/bin/ksh application/x-shellscript
|
||||
0 string #!\ /bin/ksh application/x-shellscript
|
||||
0 string #!/bin/tcsh application/x-shellscript
|
||||
0 string #!\ /bin/tcsh application/x-shellscript
|
||||
0 string #!/usr/local/tcsh application/x-shellscript
|
||||
0 string #!\ /usr/local/tcsh application/x-shellscript
|
||||
0 string #!/usr/local/bin/tcsh application/x-shellscript
|
||||
0 string #!\ /usr/local/bin/tcsh application/x-shellscript
|
||||
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
|
||||
0 string #!/bin/bash application/x-shellscript
|
||||
0 string #!\ /bin/bash application/x-shellscript
|
||||
0 string #!/usr/local/bin/bash application/x-shellscript
|
||||
0 string #!\ /usr/local/bin/bash application/x-shellscript
|
||||
|
||||
#
|
||||
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
|
||||
0 string #!/usr/local/bin/zsh application/x-shellscript
|
||||
0 string #!\ /usr/local/bin/zsh application/x-shellscript
|
||||
0 string #!/usr/local/bin/ash application/x-shellscript
|
||||
0 string #!\ /usr/local/bin/ash application/x-shellscript
|
||||
#0 string #!/usr/local/bin/ae Neil Brown's ae
|
||||
#0 string #!\ /usr/local/bin/ae Neil Brown's ae
|
||||
0 string #!/bin/nawk application/x-nawk
|
||||
0 string #!\ /bin/nawk application/x-nawk
|
||||
0 string #!/usr/bin/nawk application/x-nawk
|
||||
0 string #!\ /usr/bin/nawk application/x-nawk
|
||||
0 string #!/usr/local/bin/nawk application/x-nawk
|
||||
0 string #!\ /usr/local/bin/nawk application/x-nawk
|
||||
0 string #!/bin/gawk application/x-gawk
|
||||
0 string #!\ /bin/gawk application/x-gawk
|
||||
0 string #!/usr/bin/gawk application/x-gawk
|
||||
0 string #!\ /usr/bin/gawk application/x-gawk
|
||||
0 string #!/usr/local/bin/gawk application/x-gawk
|
||||
0 string #!\ /usr/local/bin/gawk application/x-gawk
|
||||
#
|
||||
0 string #!/bin/awk application/x-awk
|
||||
0 string #!\ /bin/awk application/x-awk
|
||||
0 string #!/usr/bin/awk application/x-awk
|
||||
0 string #!\ /usr/bin/awk application/x-awk
|
||||
0 string BEGIN application/x-awk
|
||||
|
||||
# For Larry Wall's perl language. The ``eval'' line recognizes an
|
||||
# outrageously clever hack for USG systems.
|
||||
# Keith Waclena <keith@cerberus.uchicago.edu>
|
||||
0 string #!/bin/perl application/x-perl
|
||||
0 string #!\ /bin/perl application/x-perl
|
||||
0 string eval\ "exec\ /bin/perl application/x-perl
|
||||
0 string #!/usr/bin/perl application/x-perl
|
||||
0 string #!\ /usr/bin/perl application/x-perl
|
||||
0 string eval\ "exec\ /usr/bin/perl application/x-perl
|
||||
0 string #!/usr/local/bin/perl application/x-perl
|
||||
0 string #!\ /usr/local/bin/perl application/x-perl
|
||||
0 string eval\ "exec\ /usr/local/bin/perl application/x-perl
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# compress: file(1) magic for pure-compression formats (no archives)
|
||||
#
|
||||
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
|
||||
#
|
||||
# Formats for various forms of compressed data
|
||||
# Formats for "compress" proper have been moved into "compress.c",
|
||||
# because it tries to uncompress it to figure out what's inside.
|
||||
|
||||
# standard unix compress
|
||||
0 string \037\235 application/x-compress
|
||||
|
||||
# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
|
||||
0 string \037\213 application/x-gzip
|
||||
|
||||
0 string PK\003\004 application/x-zip
|
||||
|
||||
# According to gzip.h, this is the correct byte order for packed data.
|
||||
0 string \037\036 application/octet-stream
|
||||
#
|
||||
# This magic number is byte-order-independent.
|
||||
#
|
||||
0 short 017437 application/octet-stream
|
||||
|
||||
# XXX - why *two* entries for "compacted data", one of which is
|
||||
# byte-order independent, and one of which is byte-order dependent?
|
||||
#
|
||||
# compacted data
|
||||
0 short 0x1fff application/octet-stream
|
||||
0 string \377\037 application/octet-stream
|
||||
# huf output
|
||||
0 short 0145405 application/octet-stream
|
||||
|
||||
# Squeeze and Crunch...
|
||||
# These numbers were gleaned from the Unix versions of the programs to
|
||||
# handle these formats. Note that I can only uncrunch, not crunch, and
|
||||
# I didn't have a crunched file handy, so the crunch number is untested.
|
||||
# Keith Waclena <keith@cerberus.uchicago.edu>
|
||||
#0 leshort 0x76FF squeezed data (CP/M, DOS)
|
||||
#0 leshort 0x76FE crunched data (CP/M, DOS)
|
||||
|
||||
# Freeze
|
||||
#0 string \037\237 Frozen file 2.1
|
||||
#0 string \037\236 Frozen file 1.0 (or gzip 0.5)
|
||||
|
||||
# lzh?
|
||||
#0 string \037\240 LZH compressed data
|
||||
|
||||
257 string ustar\0 application/x-tar posix
|
||||
257 string ustar\040\040\0 application/x-tar gnu
|
||||
|
||||
0 short 070707 application/x-cpio
|
||||
0 short 0143561 application/x-cpio swapped
|
||||
|
||||
0 string =<ar> application/x-archive
|
||||
0 string !<arch> application/x-archive
|
||||
>8 string debian application/x-debian-package
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
#
|
||||
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
|
||||
#
|
||||
0 beshort 0xedab
|
||||
>2 beshort 0xeedb application/x-rpm
|
||||
|
||||
0 lelong&0x8080ffff 0x0000081a application/x-arc lzw
|
||||
0 lelong&0x8080ffff 0x0000091a application/x-arc squashed
|
||||
0 lelong&0x8080ffff 0x0000021a application/x-arc uncompressed
|
||||
0 lelong&0x8080ffff 0x0000031a application/x-arc packed
|
||||
0 lelong&0x8080ffff 0x0000041a application/x-arc squeezed
|
||||
0 lelong&0x8080ffff 0x0000061a application/x-arc crunched
|
||||
|
||||
0 leshort 0xea60 application/octet-stream x-arj
|
||||
|
||||
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
|
||||
2 string -lh0- application/x-lharc lh0
|
||||
2 string -lh1- application/x-lharc lh1
|
||||
2 string -lz4- application/x-lharc lz4
|
||||
2 string -lz5- application/x-lharc lz5
|
||||
# [never seen any but the last; -lh4- reported in comp.compression:]
|
||||
2 string -lzs- application/x-lha lzs
|
||||
2 string -lh\ - application/x-lha lh
|
||||
2 string -lhd- application/x-lha lhd
|
||||
2 string -lh2- application/x-lha lh2
|
||||
2 string -lh3- application/x-lha lh3
|
||||
2 string -lh4- application/x-lha lh4
|
||||
2 string -lh5- application/x-lha lh5
|
||||
# Shell archives
|
||||
10 string #\ This\ is\ a\ shell\ archive application/octet-stream x-shell
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# frame: file(1) magic for FrameMaker files
|
||||
#
|
||||
# This stuff came on a FrameMaker demo tape, most of which is
|
||||
# copyright, but this file is "published" as witness the following:
|
||||
#
|
||||
0 string \<MakerFile application/x-frame
|
||||
0 string \<MIFFile application/x-frame
|
||||
0 string \<MakerDictionary application/x-frame
|
||||
0 string \<MakerScreenFon application/x-frame
|
||||
0 string \<MML application/x-frame
|
||||
0 string \<Book application/x-frame
|
||||
0 string \<Maker application/x-frame
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# html: file(1) magic for HTML (HyperText Markup Language) docs
|
||||
#
|
||||
# from Daniel Quinlan <quinlan@yggdrasil.com>
|
||||
#
|
||||
0 string \<HEAD text/html
|
||||
0 string \<head text/html
|
||||
0 string \<TITLE text/html
|
||||
0 string \<title text/html
|
||||
0 string \<html text/html
|
||||
0 string \<HTML text/html
|
||||
0 string \<!-- text/html
|
||||
0 string \<h1 text/html
|
||||
0 string \<H1 text/html
|
||||
0 string \<!doctype\ HTML text/html
|
||||
0 string \<!DOCTYPE\ HTML text/html
|
||||
0 string \<!doctype\ html text/html
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# images: file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
|
||||
#
|
||||
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
|
||||
# additions by janl@ifi.uio.no as well as others. Jan also suggested
|
||||
# merging several one- and two-line files into here.
|
||||
#
|
||||
# XXX - byte order for GIF and TIFF fields?
|
||||
# [GRR: TIFF allows both byte orders; GIF is probably little-endian]
|
||||
#
|
||||
|
||||
# [GRR: what the hell is this doing in here?]
|
||||
#0 string xbtoa btoa'd file
|
||||
|
||||
# PBMPLUS
|
||||
# PBM file
|
||||
0 string P1 image/x-portable-bitmap 7bit
|
||||
# PGM file
|
||||
0 string P2 image/x-portable-greymap 7bit
|
||||
# PPM file
|
||||
0 string P3 image/x-portable-pixmap 7bit
|
||||
# PBM "rawbits" file
|
||||
0 string P4 image/x-portable-bitmap
|
||||
# PGM "rawbits" file
|
||||
0 string P5 image/x-portable-greymap
|
||||
# PPM "rawbits" file
|
||||
0 string P6 image/x-portable-pixmap
|
||||
|
||||
# NIFF (Navy Interchange File Format, a modification of TIFF)
|
||||
# [GRR: this *must* go before TIFF]
|
||||
0 string IIN1 image/x-niff
|
||||
|
||||
# TIFF and friends
|
||||
# TIFF file, big-endian
|
||||
0 string MM image/tiff
|
||||
# TIFF file, little-endian
|
||||
0 string II image/tiff
|
||||
|
||||
# possible GIF replacements; none yet released!
|
||||
# (Greg Roelofs, newt@uchicago.edu)
|
||||
#
|
||||
# GRR 950115: this was mine ("Zip GIF"):
|
||||
# ZIF image (GIF+deflate alpha)
|
||||
0 string GIF94z image/unknown
|
||||
#
|
||||
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
|
||||
# FGF image (GIF+deflate beta)
|
||||
0 string FGF95a image/unknown
|
||||
#
|
||||
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
|
||||
# (best; not yet implemented):
|
||||
# PBF image (deflate compression)
|
||||
0 string PBF image/unknown
|
||||
|
||||
# GIF
|
||||
0 string GIF image/gif
|
||||
|
||||
# JPEG images
|
||||
0 beshort 0xffd8 image/jpeg
|
||||
|
||||
# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
|
||||
0 string BM image/bmp
|
||||
#>14 byte 12 (OS/2 1.x format)
|
||||
#>14 byte 64 (OS/2 2.x format)
|
||||
#>14 byte 40 (Windows 3.x format)
|
||||
#0 string IC icon
|
||||
#0 string PI pointer
|
||||
#0 string CI color icon
|
||||
#0 string CP color pointer
|
||||
#0 string BA bitmap array
|
||||
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# lisp: file(1) magic for lisp programs
|
||||
#
|
||||
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||||
0 string ;; text/plain 8bit
|
||||
# Emacs 18 - this is always correct, but not very magical.
|
||||
0 string \012( application/x-elc
|
||||
# Emacs 19
|
||||
0 string ;ELC\023\000\000\000 application/x-elc
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# mail.news: file(1) magic for mail and news
|
||||
#
|
||||
# There are tests to ascmagic.c to cope with mail and news.
|
||||
0 string Relay-Version: message/rfc822 7bit
|
||||
0 string #!\ rnews message/rfc822 7bit
|
||||
0 string N#!\ rnews message/rfc822 7bit
|
||||
0 string Forward\ to message/rfc822 7bit
|
||||
0 string Pipe\ to message/rfc822 7bit
|
||||
0 string Return-Path: message/rfc822 7bit
|
||||
0 string Path: message/news 8bit
|
||||
0 string Xref: message/news 8bit
|
||||
0 string From: message/rfc822 7bit
|
||||
0 string Article message/news 8bit
|
||||
#------------------------------------------------------------------------------
|
||||
# msword: file(1) magic for MS Word files
|
||||
#
|
||||
# Contributor claims:
|
||||
# Reversed-engineered MS Word magic numbers
|
||||
#
|
||||
|
||||
0 string \376\067\0\043 application/msword
|
||||
0 string \320\317\021\340\241\261 application/msword
|
||||
0 string \333\245-\0\0\0 application/msword
|
||||
|
||||
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# printer: file(1) magic for printer-formatted files
|
||||
#
|
||||
|
||||
# PostScript
|
||||
0 string %! application/postscript
|
||||
0 string \004%! application/postscript
|
||||
|
||||
# Acrobat
|
||||
# (due to clamen@cs.cmu.edu)
|
||||
0 string %PDF- application/pdf
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# sc: file(1) magic for "sc" spreadsheet
|
||||
#
|
||||
38 string Spreadsheet application/x-sc
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# tex: file(1) magic for TeX files
|
||||
#
|
||||
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
|
||||
#
|
||||
# From <conklin@talisman.kaleida.com>
|
||||
|
||||
# Although we may know the offset of certain text fields in TeX DVI
|
||||
# and font files, we can't use them reliably because they are not
|
||||
# zero terminated. [but we do anyway, christos]
|
||||
0 string \367\002 application/x-dvi
|
||||
#0 string \367\203 TeX generic font data
|
||||
#0 string \367\131 TeX packed font data
|
||||
#0 string \367\312 TeX virtual font data
|
||||
#0 string This\ is\ TeX, TeX transcript text
|
||||
#0 string This\ is\ METAFONT, METAFONT transcript text
|
||||
|
||||
# There is no way to detect TeX Font Metric (*.tfm) files without
|
||||
# breaking them apart and reading the data. The following patterns
|
||||
# match most *.tfm files generated by METAFONT or afm2tfm.
|
||||
2 string \000\021 application/x-tex-tfm
|
||||
2 string \000\022 application/x-tex-tfm
|
||||
#>34 string >\0 (%s)
|
||||
|
||||
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||||
#0 string \\input\ texinfo Texinfo source text
|
||||
#0 string This\ is\ Info\ file GNU Info text
|
||||
|
||||
# correct TeX magic for Linux (and maybe more)
|
||||
# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
|
||||
#
|
||||
0 leshort 0x02f7 application/x-dvi
|
||||
|
||||
# RTF - Rich Text Format
|
||||
0 string {\\rtf text/rtf
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# animation: file(1) magic for animation/movie formats
|
||||
#
|
||||
# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
|
||||
# MPEG file
|
||||
0 string \000\000\001\263 video/mpeg
|
||||
# FLI animation format
|
||||
0 leshort 0xAF11 video/fli
|
||||
# FLC animation format
|
||||
0 leshort 0xAF12 video/flc
|
||||
# AVI
|
||||
>8 string AVI\ video/avi
|
||||
#
|
||||
# SGI and Apple formats
|
||||
#
|
||||
0 string MOVI video/sgi
|
||||
4 string moov video/quicktime moov
|
||||
4 string mdat video/quicktime mdat
|
||||
# The contributor claims:
|
||||
# I couldn't find a real magic number for these, however, this
|
||||
# -appears- to work. Note that it might catch other files, too,
|
||||
# so BE CAREFUL!
|
||||
#
|
||||
# Note that title and author appear in the two 20-byte chunks
|
||||
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
|
||||
# 255 (hex FF)! DL format SUCKS BIG ROCKS.
|
||||
#
|
||||
# DL file version 1 , medium format (160x100, 4 images/screen)
|
||||
0 byte 1 video/unknown
|
||||
0 byte 2 video/unknown
|
||||
#
|
||||
# Databases
|
||||
#
|
||||
# GDBM magic numbers
|
||||
# Will be maintained as part of the GDBM distribution in the future.
|
||||
# <downsj@teeny.org>
|
||||
0 belong 0x13579ace application/x-gdbm
|
||||
0 lelong 0x13579ace application/x-gdbm
|
||||
0 string GDBM application/x-gdbm
|
||||
#
|
||||
0 belong 0x061561 application/x-dbm
|
||||
#
|
||||
# Executables
|
||||
#
|
||||
0 string \177ELF
|
||||
>4 byte 0
|
||||
>4 byte 1
|
||||
>4 byte 2
|
||||
>5 byte 0
|
||||
>5 byte 1
|
||||
>>16 leshort 0
|
||||
>>16 leshort 1 application/x-object
|
||||
>>16 leshort 2 application/x-executable
|
||||
>>16 leshort 3 application/x-sharedlib
|
||||
>>16 leshort 4 application/x-coredump
|
||||
#
|
||||
# DOS
|
||||
0 string MZ application/x-dosexec
|
||||
#
|
||||
# KDE
|
||||
0 string [KDE\ Desktop\ Entry] application/x-kdelnk
|
||||
0 string \#\ KDE\ Config\ File application/x-kdelnk
|
||||
# xmcd database file for kscd
|
||||
0 string \#\ xmcd text/xmcd
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# pkgadd: file(1) magic for SysV R4 PKG Datastreams
|
||||
#
|
||||
0 string #\ PaCkAgE\ DaTaStReAm application/x-svr4-package
|
||||
|
||||
|
||||
Loading…
Reference in New Issue