import file-5.14

changes are "name" + "use" keyword features, bug fixes
This commit is contained in:
christos 2013-03-23 15:49:08 +00:00
parent cde04e5237
commit 52df37c7bd
58 changed files with 1427 additions and 658 deletions

View File

@ -1,3 +1,47 @@
2013-03-06 21:24 Christos Zoulas <christos@zoulas.com>
* fix recursive magic separator printing
2013-02-26 19:28 Christos Zoulas <christos@zoulas.com>
* limit recursion level for mget
* fix pread() related breakage in cdf
* handle offsets properly in recursive "use"
2013-02-18 10:39 Christos Zoulas <christos@zoulas.com>
* add elf reading of debug info to determine if file is stripped
(Jan Kaluza)
* use pread()
2013-01-25 18:05 Christos Zoulas <christos@zoulas.com>
* change mime description size from 64 to 80 to accommodate OOXML.
2013-01-11 14:50 Christos Zoulas <christos@zoulas.com>
* Warn about inconsistent continuation levels.
* Change fsmagic to add a space after it prints.
2013-01-10 21:00 Christos Zoulas <christos@zoulas.com>
* Make getline public so that file can link against it.
Perhaps it is better to rename it, or hide it differently.
Fixes builds on platforms that do not provide it.
2013-01-07 16:30 Christos Zoulas <christos@zoulas.com>
* Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document
what long, int, short, etc is (Guy Harris)
2013-01-06 11:20 Christos Zoulas <christos@zoulas.com>
* add magic_version function and constant
* Redo memory allocation and de-allocation.
(prevents double frees on non mmap platforms)
* Fix bug with name/use having to do with passing
found state from the parent to the child and back.
2012-12-19 8:47 Christos Zoulas <christos@zoulas.com>
* Only print elf capabilities for archs we know (Jan Kaluza)

View File

@ -1,5 +1,5 @@
** README for file(1) Command **
@(#) $File: README,v 1.44 2011/03/24 13:03:39 rrt Exp $
@(#) $File: README,v 1.45 2013/01/11 16:51:01 christos Exp $
Mailing List: file@mx.gw.com
Bug tracker: http://bugs.gw.com/
@ -68,15 +68,19 @@ src/apprentice.c - parses /etc/magic to learn magic
src/apptype.c - used for OS/2 specific application type magic
src/asprintf.c - replacement for OS's that don't have it.
src/ascmagic.c - third & last set of tests, based on hardwired assumptions.
src/asctime_r.c - for systems that don't have it.
src/asprintf.c - for systems that don't have it.
src/cdf.c - parser for Microsoft Compound Document Files
src/cdf_time.c - time converter for CDF.
src/compress.c - handles decompressing files to look inside.
src/ctime_r.c - for systems that don't have it.
src/encoding.c - handles unicode encodings
src/file.c - the main program
src/file.h - header file
src/fsmagic.c - first set of tests the program runs, based on filesystem info
src/funcs.c - utilility functions
src/getopt_long.c - used for OS/2 specific application type magic
src/getopt_long.c - for systems that don't have it.
src/getline.c - for systems that don't have it.
src/is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore).
src/names.h - header file for ascmagic.c
src/magic.c - the libmagic api
@ -84,14 +88,13 @@ src/print.c - print results, errors, warnings.
src/readcdf.c - CDF wrapper.
src/readelf.[ch] - Stand-alone elf parsing code.
src/softmagic.c - 2nd set of tests, based on /etc/magic
src/strlcat.c - used for OS/2 specific application type magic
src/strlcpy.c - used for OS/2 specific application type magic
src/vasprintf.c - used for OS/2 specific application type magic
doc/file.1 - man page for the command
doc/magic.4 - man page for the magic file, courtesy Guy Harris.
src/strlcat.c - for systems that don't have it.
src/strlcpy.c - for systems that don't have it.
src/vasprintf.c - for systems that don't have it.
doc/file.man - man page for the command
doc/magic.man - man page for the magic file, courtesy Guy Harris.
Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile.
Magdir - directory of /etc/magic pieces
------------------------------------------------------------------------------
If you submit a new magic entry please make sure you read the following

View File

@ -2,6 +2,6 @@
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.46 2012/08/26 10:43:05 christos Exp $
# $File: animation,v 1.48 2013/03/09 22:36:00 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -89,7 +89,10 @@
>>4 byte 77 \b, main
>>4 byte 88 \b, extended
>>6 byte x \b @ L %u
# GRR too general as it catches also FoxPro Memo example NG.FPT
>3 byte 0xB0 MPEG sequence, v4
# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
#>>4 byte !0 MPEG sequence, v4
!:mime video/mpeg4-generic
>>5 belong 0x000001B5
>>>9 byte &0x80
@ -751,7 +754,7 @@
>0 byte x GameCube movie,
>0x34 ubeshort x %d x
>0x36 ubeshort x %d,
>0x26 ubeshort x %dµs,
>0x26 ubeshort x %dus,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio

View File

@ -0,0 +1,46 @@
#------------------------------------------------------------------------------
# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
# aout: file(1) magic for a.out executable/object/etc entries that
# handle executables on multiple platforms.
#
#
# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
# BSDI), netbsd, and vax (for UNIX/32V and BSD)
#
# XXX - is there anything we can look at to distinguish BSD/OS 386 from
# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag
# works only for binaries using shared libraries. Grabbing the entry
# point from the a.out header, using it to find the first code executed
# in the program, and looking at that might help.
#
0 lelong 0407 a.out little-endian 32-bit executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
0 lelong 0410 a.out little-endian 32-bit pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
0 lelong 0413 a.out little-endian 32-bit demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
#
# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
#
# XXX - is there anything we can look at to distinguish old SunOS 68010
# from old 68020 IRIX from old NetBSD? Again, I guess we could look at
# the first instruction or instructions in the program.
#
0 belong 0407 a.out big-endian 32-bit executable
>16 belong >0 not stripped
0 belong 0410 a.out big-endian 32-bit pure executable
>16 belong >0 not stripped
0 belong 0413 a.out big-endian 32-bit demand paged executable
>16 belong >0 not stripped

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: audio,v 1.65 2012/10/31 13:38:40 christos Exp $
# $File: audio,v 1.66 2013/02/06 14:18:52 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@ -512,7 +512,7 @@
>>12 ulelong x \b, sample rate %d
# adlib sound files
# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
0 string RAWADATA RdosPlay RAW
1068 string RoR AMUSIC Adlib Tracker

View File

@ -1,25 +1,15 @@
#------------------------------------------------------------------------------
# $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $
# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
# Some object/executable formats use the same magic numbers as are used
# in other OSes; those are handled by entries in aout.
#
0 lelong 0314 386 compact demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0407 386 executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0410 386 pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 0413 386 demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
# same as in SunOS 4.x, except for static shared libraries
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80

View File

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.10 2012/10/31 16:32:01 christos Exp $
# $File: cafebabe,v 1.14 2013/02/27 16:59:59 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O fat-files have the same magic number, the test
# must be performed in the same "magic" sequence to get both right. The long
# at offset 4 in a mach-O fat file tells the number of architectures; the short at
# offset 4 in a Java bytecode file is the JVM minor version and the
# short at offset 6 is the JVM major version. Since there are only
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
@ -30,49 +30,34 @@
>>4 belong 0x0032 (Java 1.6)
0 belong 0xcafed00d JAR compressed with pack200,
>>5 byte x version %d.
>>4 byte x \b%d
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
0 belong 0xcafed00d JAR compressed with pack200,
>>5 byte x version %d.
>>4 byte x \b%d
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
### JAVA END ###
### MACH-O START ###
# 16777216 = 0x01000000
0 name mach-o \b [
>0 belong 0xffffffff \bAny
>0 belong 1 \bVax
>0 belong 6 \bMC680x0
>0 belong 7 \bI386
>0 belong 8 \bMIPS
>0 belong 10 \bMC98000
>0 belong 11 \bHPPA
>0 belong 12 \bARM
>0 belong 13 \bMC88000
>0 belong 14 \bSPARC
>0 belong 15 \bI860
>0 belong 16 \bALPHA
>0 belong 17 \bPOWERPC
>0 belong 16777223 \bX86_64
>0 belong 16777233 \bPOWERPC64
>&(8.L) indirect :
0 name mach-o \b [
>0 use mach-o-cpu \b
>&(8.L) indirect \b:
>0 belong x \b]
0 belong 0xcafebabe
>4 belong 1 Mach-O fat file with 1 architecture:
>>8 use mach-o
>4 belong 1 Mach-O universal binary with 1 architecture:
>>8 use mach-o \b
>4 belong >1
>>4 belong <20 Mach-O fat file with %ld architectures:
>>>8 use mach-o
>>>28 use mach-o
>>>4 belong >2
>>>>48 use mach-o
>>>>>4 belong >3
>>>>>68 use mach-o
>>4 belong <20 Mach-O universal binary with %ld architectures:
>>>8 use mach-o \b
>>>28 use mach-o \b
>>4 belong >2
>>>48 use mach-o \b
>>4 belong >3
>>>68 use mach-o \b
### MACH-O END ###

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.43 2012/06/21 01:08:56 christos Exp $
# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@ -80,7 +80,7 @@
!:strength + 10
!:mime text/x-php
# Smarty compiled template, http://www.smarty.net/
# Elan Ruusamäe <glen@delfi.ee>
# Elan Ruusamae <glen@delfi.ee>
0 string =<?php\ /*\ Smarty\ version Smarty compiled template
>24 regex [0-9.]+ \b, version %s
!:mime text/x-php

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: console,v 1.18 2010/09/20 19:19:17 rrt Exp $
# $File: console,v 1.19 2013/02/06 14:18:52 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
@ -137,7 +137,7 @@
>113 string x (%s)
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
@ -177,7 +177,7 @@
# From: Serge van den Boom <svdb@stack.nl>
0 string \x01ZZZZZ\x01 3DO "Opera" file system
# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 string GBS Nintendo Gameboy Music/Audio Data
12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.30 2012/08/26 10:23:30 christos Exp $
# $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -114,91 +114,241 @@
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
#0 byte 0x02
#>8 leshort >0
#>>12 leshort 0 FoxBase
#!:mime application/x-dbf
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
# updated by Joerg Jenderek at Feb 2013
# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
# skip Infocom game Z-machine
>2 ubyte >0
# skip Androids *.xml
>>3 ubyte >0
>>>3 ubyte <32
# 1 < version VV
>>>>0 ubyte >1
# skip HELP.CA3 by test for reserved byte ( NULL )
>>>>>27 ubyte 0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#>>>>>30 ubeshort x 30NULL?%x
# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>24 ubelong&0xffFFFFff >0x01302000
# .DBF or .MDX
>>>>>>24 ubelong&0xffFFFFff <0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
>>>>>>>24 ubelong&0xffFFFFff =0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
>>>>>>>>12 ubelong&0xFFFFfEfE 0
# test for MDX flag
>>>>>>>>>28 ubyte x
>>>>>>>>>28 ubyte&0xf8 0
# header size >= 32
>>>>>>>>>>8 uleshort >31
# skip PIC15736.PCX by test for language driver name or field name
>>>>>>>>>>>32 ubyte >0
!:mime application/x-dbf
#!:mime application/x-dbf; charset=unknown-8bit ??
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
# database file
>>>>>>>>>>>>0 ubyte x \b DBF
>>>>>>>>>>>>4 lelong 0 \b, no records
>>>>>>>>>>>>4 lelong >0 \b, %ld record
# plural s appended
>>>>>>>>>>>>>4 lelong >1 \bs
# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
>>>>>>>>>>>>10 uleshort x * %d
# file size = records * record size + header size
>>>>>>>>>>>>1 ubyte x \b, update-date
>>>>>>>>>>>>1 use xbase-date
# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
>>>>>>>>>>>>8 uleshort >0
>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
>>>>>>>24 ubelong&0x0133f7ff >0
# test for reserved NULL byte
>>>>>>>>47 ubyte x
# test for valid TAG key format (0x10 or 0)
>>>>>>>>>559 ubyte&0xeF 0
# test MM <= 12
>>>>>>>>>45 ubeshort <0x0C20
>>>>>>>>>>45 ubyte >0
>>>>>>>>>>>46 ubyte <32
>>>>>>>>>>>>46 ubyte >0
#!:mime application/x-mdx
>>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>>0 ubyte x \b MDX
>>>>>>>>>>>>>1 ubyte x \b, creation-date
>>>>>>>>>>>>>1 use xbase-date
>>>>>>>>>>>>>44 ubyte x \b, update-date
>>>>>>>>>>>>>44 use xbase-date
# No.of tags in use (1,2,5,12)
>>>>>>>>>>>>>28 uleshort x \b, %d
# No. of entries in tag (0x30)
>>>>>>>>>>>>>25 ubyte x \b/%d tags
# Length of tag
>>>>>>>>>>>>>26 ubyte x * %d
# 1st tag name_
>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
# 2nd tag name
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
#0 byte 0x03
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x04
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 dBASE IV no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x05
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 dBASE V no memo file
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x30
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 Visual FoxPro
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x43
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 FlagShip with memo var size
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x7b
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 dBASEIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x83
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 FoxBase+, dBaseIII+ with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8b
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 dBaseIV with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0x8e
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 dBaseIV with SQL Table
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xb3
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 FlagShip with .dbt memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 byte 0xf5
#!:mime application/x-dbf
#>8 leshort >0
#>>12 leshort 0 FoxPro with memo
#>>>0x04 lelong 0 (no records)
#>>>0x04 lelong >0 (%ld records)
#
#0 leshort 0x0006 DBase 3 index file
# Print the xBase names of different version variants
0 name xbase-type
>0 ubyte <2
# 1 < version
>0 ubyte >1
>>0 ubyte 0x02 FoxBase
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
# dBASE IV no memo file
>>0 ubyte 0x04 dBase IV
# dBASE V no memo file
>>0 ubyte 0x05 dBase V
>>0 ubyte 0x30 Visual FoxPro
>>0 ubyte 0x31 Visual FoxPro, autoincrement
# Visual FoxPro, with field type Varchar or Varbinary
>>0 ubyte 0x32 Visual FoxPro, with field type Varchar
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
>>0 ubyte 0x43 dBase IV, with SQL table
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x62 dBase IV, with SQL table
# dBASE IV, with memo!!
>>0 ubyte 0x7b dBase IV, with memo
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x82 dBase IV, with SQL system
# FoxBase+/dBaseIII+ with memo .DBT!
>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
# dBASE IV with memo!
>>0 ubyte 0x8B dBase IV, with memo .DBT
# dBase IV with SQL Table,no memo?
>>0 ubyte 0x8E dBase IV, with SQL table
# .dbv and .dbt memo (Flagship)?
>>0 ubyte 0xB3 Flagship
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xCA dBase IV with memo .DBT
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
>>0 ubyte 0xF5 FoxPro with memo
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#>>0 ubyte 0xFA FoxPro 2.x, with memo
# unkown version (should not happen)
>>0 default x xBase
>>>0 ubyte x (0x%x)
# flags in version byte
# DBT flag (with dBASE III memo .DBT)!!
# >>0 ubyte&0x80 >0 DBT_FLAG=%x
# memo flag ??
# >>0 ubyte&0x08 >0 MEMO_FLAG=%x
# SQL flag ??
# >>0 ubyte&0x70 >0 SQL_FLAG=%x
# test and print the date of xBase .DBF .MDX
0 name xbase-date
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
>0 ubelong x
>1 ubyte <13
>>1 ubyte >0
>>>2 ubyte >0
>>>>2 ubyte <32
>>>>>0 ubyte x
# YY is interpreted as 20YY or 19YY
>>>>>>0 ubyte <100 \b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
>>>>>>0 ubyte >99 \b %d
>>>>>1 ubyte x \b-%d
>>>>>2 ubyte x \b-%d
# dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
16 ubyte <4
>16 ubyte !2
>>16 ubyte !1
# next free block index is positive
>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
>>>>17 ubelong&0xFFfdFE00 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
>>>>>>16 ubyte 3
# dBASE III DBT
>>>>>>>0 use xbase-memo-print
# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
>>>>>>16 ubyte 0
# dBASE IV DBT with DBF name or DBF garbage
>>>>>>>8 ubelong >0x40000000
# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
>>>>>>>>0 ulelong <0x01010002
>>>>>>>>>0 use xbase-memo-print
>>>>>>>8 ubelong 0
# skip MM*DD*.bin by test for for reserved NULL byte
>>>>>>>>508 ubelong 0
>>>>>>>>>0 use xbase-memo-print
# garbage PCX , ZIP , JAR , XPI
>>>>>>>8 default x
# Print the information of dBase DBT or FoxPro FPT memo files
0 name xbase-memo-print
>0 ubyte x
# test version
# memo file
>>16 ubyte 3 dBase III DBT
>>16 ubyte 0
>>>512 ubelong <0x00000003 FoxPro FPT
# Size of blocks for FoxPro
>>>>6 ubeshort x \b, blocks size %lu
# Number of next available block for appending data for FoxPro
>>>>0 ubelong =0 \b, next free block index %lu
>>>>0 ubelong !0 \b, next free block index %lu
>>>512 default x dBase IV DBT
# DBF file name without extention
>>>>8 string >\0 \b of %-.8s.DBF
# size of blocks ; not reliable 0x2020204C
#>>>>4 ulelong =0 \b, blocks size %lu
>>>>4 ulelong !0 \b, blocks size %lu
# Block length found 0 , 512
#>>>>20 uleshort =0 \b, block length %u
>>>>20 uleshort !0 \b, block length %u
# Number of next available block for appending data
>>>>0 ulelong =0 \b, next free block index %lu
>>>>0 ulelong !0 \b, next free block index %lu
>>512 ubelong x
>>>512 ubelong =0xFFFF0800
>>>>520 string >\0 \b, 1st used item "%s"
# FoxPro
>>>512 ubelong <3
# FoxPro memo
>>>>512 ubelong =1
>>>>520 string >\0 \b, 1st used item "%s"
>>>512 default x
# may be deleted memo field
>>>>512 string >\0 \b, 1st item "%s"
# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
## End of XBase database stuff
# MS Access database
4 string Standard\ Jet\ DB Microsoft Access Database
@ -271,14 +421,6 @@
>48 lequad x \b, rnum=%lld
>56 lequad x \b, fsiz=%lld
# G-IR database made by gobject-introspect toolset,
# http://live.gnome.org/GObjectIntrospection
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
>16 byte x \b, v%d
>17 byte x \b.%d
>20 leshort x \b, %d entries
>22 leshort x \b/%d local
# Type: QDBM Quick Database Manager
# From: Benoit Sibaud <bsibaud@april.org>
0 string \\[depot\\]\n\f Quick Database Manager, little endian
@ -290,7 +432,7 @@
0 string ToKyO\ CaBiNeT\n TokyoCabinet database
>14 string x (version %s)
# From: Stéphane Blondon http://www.yaal.fr
# From: Stephane Blondon http://www.yaal.fr
# Database file for Zope (done by FileStorage)
0 string FS21 Zope Object Database File Storage (data)
# Cache file for the database of Zope (done by ClientStorage)

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: digital,v 1.10 2011/05/03 01:44:17 christos Exp $
# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
@ -8,20 +8,20 @@
#
0 leshort 0603
>>24 leshort 0410 COFF format alpha pure
>>24 leshort 0413 COFF format alpha demand paged
>>>22 leshort&030000 !020000 executable
>>>22 leshort&020000 !0 dynamically linked
>>>16 lelong !0 not stripped
>>>16 lelong 0 stripped
>>>27 byte x - version %d
>>>26 byte x \b.%d
>>>28 byte x \b-%d
>>24 leshort 0407 COFF format alpha object
>>>22 leshort&030000 020000 shared library
>>>27 byte x - version %d
>>>26 byte x \b.%d
>>>28 byte x \b-%d
>24 leshort 0410 COFF format alpha pure
>24 leshort 0413 COFF format alpha demand paged
>>22 leshort&030000 !020000 executable
>>22 leshort&020000 !0 dynamically linked
>>16 lelong !0 not stripped
>>16 lelong 0 stripped
>>27 byte x - version %d
>>26 byte x \b.%d
>>28 byte x \b-%d
>24 leshort 0407 COFF format alpha object
>>22 leshort&030000 020000 shared library
>>27 byte x - version %d
>>26 byte x \b.%d
>>28 byte x \b-%d
# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.24 2012/08/26 10:32:10 christos Exp $
# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -16,8 +16,15 @@
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
# X11 font files in SNF (Server Natural Format) format
# updated by Joerg Jenderek at Feb 2013
# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
0 belong 00000004 X11 SNF font data, MSB first
0 lelong 00000004 X11 SNF font data, LSB first
#>104 belong 00000004 X11 SNF font data, MSB first
!:mime application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
0 lelong 00000004
>104 lelong 00000004 X11 SNF font data, LSB first
!:mime application/x-font-sfn
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 search/1 STARTFONT\ X11 BDF font text
@ -75,7 +82,7 @@
0 string OTTO OpenType font data
!:mime application/vnd.ms-opentype
# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 string SplineFontDB: Spline Font Database
!:mime application/vnd.font-fontforge-sfd
>14 string x version %s

View File

@ -0,0 +1,59 @@
#------------------------------------------------------------------------------
# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $
# GNOME related files
# Contributed by Josh Triplett
# FIXME: Could be simplified if pstring supported two-byte counts
0 string GnomeKeyring\n\r\0\n GNOME keyring
>&0 ubyte 0 \b, major version 0
>>&0 ubyte 0 \b, minor version 0
>>>&0 ubyte 0 \b, crypto type 0 (AES)
>>>&0 ubyte >0 \b, crypto type %hhu (unknown)
>>>&1 ubyte 0 \b, hash type 0 (MD5)
>>>&1 ubyte >0 \b, hash type %hhu (unknown)
>>>&2 ubelong 0xFFFFFFFF \b, name NULL
>>>&2 ubelong !0xFFFFFFFF
>>>>&-4 ubelong >255 \b, name too long for file's pstring type
>>>>&-4 ubelong <256
>>>>>&-1 pstring x \b, name "%s"
>>>>>>&0 ubeqdate x \b, last modified %s
>>>>>>&8 ubeqdate x \b, created %s
>>>>>>&16 ubelong &1
>>>>>>>&0 ubelong x \b, locked if idle for %u seconds
>>>>>>&16 ubelong ^1 \b, not locked if idle
>>>>>>&24 ubelong x \b, hash iterations %u
>>>>>>&28 ubequad x \b, salt %llu
>>>>>>&52 ubelong x \b, %u item(s)
# From: Alex Beregszaszi <alex@fsn.hu>
4 string gtktalog GNOME Catalogue (gtktalog)
>13 string >\0 version %s
# Summary: GStreamer binary registry
# Extension: .bin
# Submitted by: Josh Triplett <josh@joshtriplett.org>
0 belong 0xc0def00d GStreamer binary registry
>4 string x \b, version %s
# GVariant Database file
# By Elan Ruusamae <glen@delfi.ee>
# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
# It's always "GVariant", it's byte swapped on incompatible archs
# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
# file_builder_serialise()
# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
0 string GVariant GVariant Database file,
# version is never filled. probably future extension
>8 lelong x version %d
# not sure are these usable, so commented out
#>>16 lelong x start %d,
#>>>20 lelong x end %d
# G-IR database made by gobject-introspect toolset,
# http://live.gnome.org/GObjectIntrospection
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
>16 byte x \b, v%d
>17 byte x \b.%d
>20 leshort x \b, %d entries
>22 leshort x \b/%d local

241
external/bsd/file/dist/magic/magdir/gpt vendored Normal file
View File

@ -0,0 +1,241 @@
#------------------------------------------------------------------------------
# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
# Note that a GPT-formatted disk must contain an MBR as well.
#
# The initial segment (up to >>>>>>>>422) was copied from the X86
# partition table code (aka MBR).
# This is kept separate, so that MBR partitions are not reported as well.
# (use -k if you do want them as well)
# First, detect the MBR partiton table
# If more than one GPT protective MBR partition exists, don't print anything
# (the other MBR detection code will then just print the MBR partition table)
0x1FE leshort 0xAA55
>3 string !MS
>>3 string !SYSLINUX
>>>3 string !MTOOL
>>>>3 string !NEWLDR
>>>>>5 string !DOS
# not FAT (32 bit)
>>>>>>82 string !FAT32
#not Linux kernel
>>>>>>>514 string !HdrS
#not BeOS
>>>>>>>>422 string !Be\ Boot\ Loader
# GPT with protective MBR entry in partition 1 (only)
>>>>>>>>>450 ubyte 0xee
>>>>>>>>>>466 ubyte !0xee
>>>>>>>>>>>482 ubyte !0xee
>>>>>>>>>>>>498 ubyte !0xee
#>>>>>>>>>>>>>446 use gpt-mbr-partition
>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART
>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART
>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART
>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
# GPT with protective MBR entry in partition 2 (only)
>>>>>>>>>450 ubyte !0xee
>>>>>>>>>>466 ubyte 0xee
>>>>>>>>>>>482 ubyte !0xee
>>>>>>>>>>>>498 ubyte !0xee
#>>>>>>>>>>>>>462 use gpt-mbr-partition
>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART
>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART
>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART
>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
# GPT with protective MBR entry in partition 3 (only)
>>>>>>>>>450 ubyte !0xee
>>>>>>>>>>466 ubyte !0xee
>>>>>>>>>>>482 ubyte 0xee
>>>>>>>>>>>>498 ubyte !0xee
#>>>>>>>>>>>>>478 use gpt-mbr-partition
>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART
>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART
>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART
>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
# GPT with protective MBR entry in partition 4 (only)
>>>>>>>>>450 ubyte !0xee
>>>>>>>>>>466 ubyte !0xee
>>>>>>>>>>>482 ubyte !0xee
>>>>>>>>>>>>498 ubyte 0xee
#>>>>>>>>>>>>>494 use gpt-mbr-partition
>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes
>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART
>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes
>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART
>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes
>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART
>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>>>>>&-8 use gpt-table
>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes
# The following code does GPT detection and processing, including
# sector size detection.
# It has to be duplicated above because the top-level pattern
# (i.e. not called using 'use') must print *something* for file
# to count it as a match. Text only printed in named patterns is
# not counted, and causes file to continue, and try and match
# other patterns.
#
# Unfortunately, when assuming sector sizes >=16k, if the sector size
# happens to be 512 instead, we may find confusing data after the GPT
# table... If the GPT table has less than 128 entries, this may even
# happen for assumed sector sizes as small as 4k
# This could be solved by checking for the presence of the backup GPT
# header as well, but that makes the logic extremely complex
##0 name gpt-mbr-partition
##>(8.l*8192) string EFI\ PART
##>>(8.l*8192) use gpt-mbr-type
##>>&-8 use gpt-table
##>>0 ubyte x of 8192 bytes
##>(8.l*8192) string !EFI\ PART
##>>(8.l*4096) string EFI\ PART GPT partition table
##>>>0 use gpt-mbr-type
##>>>&-8 use gpt-table
##>>>0 ubyte x of 4096 bytes
##>>(8.l*4096) string !EFI\ PART
##>>>(8.l*2048) string EFI\ PART GPT partition table
##>>>>0 use gpt-mbr-type
##>>>>&-8 use gpt-table
##>>>>0 ubyte x of 2048 bytes
##>>>(8.l*2048) string !EFI\ PART
##>>>>(8.l*1024) string EFI\ PART GPT partition table
##>>>>>0 use gpt-mbr-type
##>>>>>&-8 use gpt-table
##>>>>>0 ubyte x of 1024 bytes
##>>>>(8.l*1024) string !EFI\ PART
##>>>>>(8.l*512) string EFI\ PART GPT partition table
##>>>>>>0 use gpt-mbr-type
##>>>>>>&-8 use gpt-table
##>>>>>>0 ubyte x of 512 bytes
# Print details of MBR type for a GPT-disk
# Calling code ensures that there is only one 0xee partition.
0 name gpt-mbr-type
# GPT with protective MBR entry in partition 1
>450 ubyte 0xee
>>454 ulelong 1
>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>454 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 2
>466 ubyte 0xee
>>470 ulelong 1
>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>470 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 3
>482 ubyte 0xee
>>486 ulelong 1
>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>486 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 4
>498 ubyte 0xee
>>502 ulelong 1
>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>502 ulelong !1 \b (nonstandard: not at LBA 1)
# Print the information from a GPT partition table structure
0 name gpt-table
>10 uleshort x \b, version %u
>8 uleshort x \b.%u
# a GUID is just like a UUID, except it's displayed mixed-endian.
>56 ulelong x \b, GUID: %08x
>60 uleshort x \b-%04x
>62 uleshort x \b-%04x
>64 ubeshort x \b-%04x
>66 ubeshort x \b-%04x
>68 ubelong x \b%08x
#>80 uleshort x \b, %d partition entries
>32 ulequad+1 x \b, disk size: %lld sectors
# In case a GPT data-structure is at LBA 0, report it as well
# This covers systems which are not GPT-aware, and which show
# and allow access to the protective partition. This code will
# detect the contents of such a partition.
0 string EFI\ PART GPT data structure (nonstandard: at LBA 0)
>0 use gpt-table
>0 ubyte x (sector size unknown)

View File

@ -1,11 +1,14 @@
#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $
# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
# below test line conflicts with 2nd NTFS filesystem sector
0 beshort 0x0500 Hitachi SH big-endian COFF
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF
>18 beshort&0x0002 =0x0000 object
>18 beshort&0x0002 =0x0002 executable
>18 beshort&0x0008 =0x0008 \b, stripped

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ibm6000,v 1.10 2012/08/10 15:06:07 christos Exp $
# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
@ -21,6 +21,7 @@
0 beshort 0x01f7 64-bit XCOFF executable or object module
>20 belong 0 not stripped
4 belong &0x0feeddb0 AIX core file
>1 byte &0x01 fulldump
>7 byte &0x01 32-bit
>>0x6e0 string >\0 \b, %s
>7 byte &0x02 64-bit

51
external/bsd/file/dist/magic/magdir/icc vendored Normal file
View File

@ -0,0 +1,51 @@
#------------------------------------------------------------------------------
# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
# Color profiles as per the ICC's "Image technology colour management -
# Architecture, profile format, and data structure" specification.
# See
#
# http://www.color.org/specification/ICC1v43_2010-12.pdf
#
# for Specification ICC.1:2010 (Profile version 4.3.0.0).
#
# Bytes 36 to 39 contain a generic profile file signature of "acsp";
# bytes 40 to 43 "may be used to identify the primary platform/operating
# system framework for which the profile was created".
#
# There are other fields that might be worth dumping as well.
#
# This appears to be what's used for Apple ColorSync profiles.
# Instead of adding that, Apple just changed the generic "acsp" entry
# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
# Management System, ICC Profile".
# Yes, it's "APPL", not "AAPL"; see the spec.
36 string acspAPPL ColorSync ICC Profile
!:mime application/vnd.iccprofile
# Microsoft ICM color profile
36 string acspMSFT Microsoft ICM Color Profile
!:mime application/vnd.iccprofile
# Yes, that's a blank after "SGI".
36 string acspSGI\ SGI ICC Profile
!:mime application/vnd.iccprofile
# XXX - is this what's used for the Sun KCMS or not? The standard file
# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
# and there *is* an identified "primary platform" value of SUNW.
36 string acspSUNW Sun KCMS ICC Profile
!:mime application/vnd.iccprofile
# Any other profile.
# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
# and use "acsp" for everything else and dump the "primary platform"
# string in those cases?
36 string acsp ICC Profile
!:mime application/vnd.iccprofile

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: images,v 1.79 2012/12/18 17:28:44 christos Exp $
# $File: images,v 1.81 2013/03/09 22:36:00 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@ -427,7 +427,7 @@
>5 byte 0x00 (white background)
>5 byte 0xFF (black background)
# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
0 leshort 0x0296 Atari ATR image
@ -454,26 +454,37 @@
# PCX image files
# From: Dan Fandrich <dan@coneharvesters.com>
0 beshort 0x0a00 PCX ver. 2.5 image data
0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
0 beshort 0x0a04 PCX for Windows image data
0 beshort 0x0a05 PCX ver. 3.0 image data
>4 leshort x bounding box [%hd,
>6 leshort x %hd] -
>8 leshort x [%hd,
>10 leshort x %hd],
>65 byte >1 %d planes each of
>3 byte x %hhd-bit
>68 byte 0 image,
>68 byte 1 colour,
>68 byte 2 grayscale,
>68 byte >2 image,
>68 byte <0 image,
>12 leshort >0 %hd x
>>14 leshort x %hd dpi,
>2 byte 0 uncompressed
>2 byte 1 RLE compressed
# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
0 ubelong&0xffF8fe00 0x0a000000
# for PCX bit depth > 0
>3 ubyte >0
# test for valid versions
>>1 ubyte <6
>>>1 ubyte !1 PCX
!:mime image/x-pcx
#!:mime image/pcx
>>>>1 ubyte 0 ver. 2.5 image data
>>>>1 ubyte 2 ver. 2.8 image data, with palette
>>>>1 ubyte 3 ver. 2.8 image data, without palette
>>>>1 ubyte 4 for Windows image data
>>>>1 ubyte 5 ver. 3.0 image data
>>>>4 uleshort x bounding box [%hd,
>>>>6 uleshort x %d] -
>>>>8 uleshort x [%d,
>>>>10 uleshort x %d],
>>>>65 ubyte >1 %d planes each of
>>>>3 ubyte x %d-bit
>>>>68 byte 1 colour,
>>>>68 byte 2 grayscale,
# this should not happen
>>>>68 default x image,
>>>>12 leshort >0 %d x
>>>>>14 uleshort x %d dpi,
>>>>2 byte 0 uncompressed
>>>>2 byte 1 RLE compressed
# Adobe Photoshop
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: intel,v 1.10 2011/03/30 19:51:00 christos Exp $
# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
@ -37,7 +37,7 @@
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 beshort 0x55AA BIOS (ia32) ROM Ext.
>5 string USB USB
>7 string LDR UNDI image

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: java,v 1.13 2011/12/08 12:12:46 rrt Exp $
# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
@ -27,3 +27,13 @@
# Java source
0 regex ^import.*;$ Java source
!:mime text/x-java
# http://android.stackexchange.com/questions/23357/\
# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
# 23608#23608
0 string ANDROID\040BACKUP\n Android Backup
>15 string 1\n \b, version 1
>17 string 0\n \b, uncompressed
>17 string 1\n \b, compressed
>19 string none\n \b, unencrypted
>19 string AES-256\n \b, encrypted AES-256

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: jpeg,v 1.18 2012/08/01 12:12:36 christos Exp $
# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@ -12,7 +12,7 @@
0 beshort 0xffd8 JPEG image data
!:mime image/jpeg
!:apple 8BIMJPEG
!:strength +1
!:strength +2
>6 string JFIF \b, JFIF standard
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF. Note that these

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.45 2012/10/29 17:36:49 christos Exp $
# $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -94,10 +94,11 @@
#
# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
# and Nicolás Lichtmaier <nick@debian.org>
# and Nicolas Lichtmaier <nick@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514 string HdrS Linux kernel
!:strength + 5
>510 leshort 0xAA55 x86 boot executable
>>518 leshort >0x1ff
>>>529 byte 0 zImage,
@ -117,10 +118,10 @@
>0x1e3 string Loading version 1.3.79 or older
>0x1e9 string Loading from prehistoric times
# System.map files - Nicolás Lichtmaier <nick@debian.org>
# System.map files - Nicolas Lichtmaier <nick@debian.org>
8 search/1 \ A\ _text Linux kernel symbol map text
# LSM entries - Nicolás Lichtmaier <nick@debian.org>
# LSM entries - Nicolas Lichtmaier <nick@debian.org>
0 search/1 Begin3 Linux Software Map entry text
0 search/1 Begin4 Linux Software Map entry text (new format)

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: llvm,v 1.5 2010/09/20 18:55:20 rrt Exp $
# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
# llvm: file(1) magic for LLVM byte-codes
# URL: http://llvm.org/docs/BitCodeFormat.html
# From: Al Stone <ahs3@fc.hp.com>
@ -9,5 +9,13 @@
0 string llvc0 LLVM byte-codes, null compression
0 string llvc1 LLVM byte-codes, gzip compression
0 string llvc2 LLVM byte-codes, bzip2 compression
0 string \xde\xc0\x17\x0b LLVM bitcode, wrapper
0 string BC\xc0\xde LLVM bitcode
0 lelong 0x0b17c0de LLVM bitcode, wrapper
# Are these Mach-O ABI values? They appear to be.
>16 lelong 0x01000007 x86_64
>16 lelong 0x00000007 i386
>16 lelong 0x00000012 ppc
>16 lelong 0x01000012 ppc64
>16 lelong 0x0000000c arm
0 string BC\xc0\xde LLVM IR bitcode

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $
# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
# lua: file(1) magic for Lua scripting language
# URL: http://www.lua.org/
# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
@ -19,3 +19,4 @@
0 string \033Lua Lua bytecode,
>4 byte 0x50 version 5.0
>4 byte 0x51 version 5.1
>4 byte 0x52 version 5.2

View File

@ -1,118 +1,195 @@
#------------------------------------------------------------
# $File: mach,v 1.12 2012/11/01 04:26:40 christos Exp $
# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
# The "feedface" ones are handled herein.
#------------------------------------------------------------
# if set, it's for the 64-bit version of the architecture
# yes, this is separate from the low-order magic number bit
# it's also separate from the "64-bit libraries" bit in the
# upper 8 bits of the CPU subtype
0 name mach-o-bed
0 name mach-o-cpu
>0 belong&0x01000000 0
#
# 32-bit ABIs.
#
# 1 vax
>>0 belong&0x00ffffff 1
>>>4 belong&0x00ffffff 0 vax
>>>4 belong&0x00ffffff 1 vax11/780
>>>4 belong&0x00ffffff 2 vax11/785
>>>4 belong&0x00ffffff 3 vax11/750
>>>4 belong&0x00ffffff 4 vax11/730
>>>4 belong&0x00ffffff 5 uvaxI
>>>4 belong&0x00ffffff 6 uvaxII
>>>4 belong&0x00ffffff 7 vax8200
>>>4 belong&0x00ffffff 8 vax8500
>>>4 belong&0x00ffffff 9 vax8600
>>>4 belong&0x00ffffff 10 vax8650
>>>4 belong&0x00ffffff 11 vax8800
>>>4 belong&0x00ffffff 12 uvaxIII
>>>4 belong&0x00ffffff >12 vax subarchitecture=%ld
>>0 belong&0x00ffffff 2 romp
>>0 belong&0x00ffffff 3 architecture=3
>>0 belong&0x00ffffff 4 ns32032
>>0 belong&0x00ffffff 5 ns32332
>>0 belong&0x00ffffff 6 m68k
# 7 x86
>>0 belong&0x00ffffff 7
>>>4 belong&0x0000000f 3 i386
>>>4 belong&0x0000000f 4 i486
>>>>4 belong&0x00fffff0 0
>>>>4 belong&0x00fffff0 0x80 \bsx
>>>4 belong&0x0000000f 5 i586
>>>4 belong&0x0000000f 6
>>>>4 belong&0x00fffff0 0 p6
>>>>4 belong&0x00fffff0 0x10 pentium_pro
>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20
>>>>4 belong&0x00fffff0 0x30 pentium_2_m3
>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
>>>>4 belong&0x00fffff0 0x50 pentium_2_m5
>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx
>>>4 belong&0x0000000f 7 celeron
>>>>4 belong&0x00fffff0 0x00 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x10 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x20 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x30 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x40 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x50 \b_m0x%lx
>>>>4 belong&0x00fffff0 0x60
>>>>4 belong&0x00fffff0 0x70 \b_mobile
>>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx
>>>4 belong&0x0000000f 8 pentium_3
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
>>>>4 belong&0x00fffff0 0x20 \b_xeon
>>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx
>>>4 belong&0x0000000f 9 pentiumM
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx
>>>4 belong&0x0000000f 10 pentium_4
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
>>>4 belong&0x0000000f 11 itanium
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_2
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
>>>4 belong&0x0000000f 12 xeon
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_mp
>>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
>>>4 belong&0x0000000f >12 ia32 family=%ld
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 >0x00 model=%lx
>>0 belong&0x00ffffff 8 mips
>>>4 belong&0x00ffffff 1 R2300
>>>4 belong&0x00ffffff 2 R2600
>>>4 belong&0x00ffffff 3 R2800
>>>4 belong&0x00ffffff 4 R2000a
>>>4 belong&0x00ffffff 5 R2000
>>>4 belong&0x00ffffff 6 R3000a
>>>4 belong&0x00ffffff 7 R3000
>>>4 belong&0x00ffffff >7 subarchitecture=%ld
>>0 belong&0x00ffffff 9 ns32532
>>0 belong&0x00ffffff 10 mc98000
>>0 belong&0x00ffffff 11 hppa
>>>4 belong&0x00ffffff 0 7100
>>>4 belong&0x00ffffff 1 7100LC
>>>4 belong&0x00ffffff >1 subarchitecture=%ld
>>0 belong&0x00ffffff 12 arm
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 subarchitecture=%ld
>>>4 belong&0x00ffffff 2 subarchitecture=%ld
>>>4 belong&0x00ffffff 3 subarchitecture=%ld
>>>4 belong&0x00ffffff 4 subarchitecture=%ld
>>>4 belong&0x00ffffff 5 \b_v4t
>>>4 belong&0x00ffffff 6 \b_v6
>>>4 belong&0x00ffffff 7 \b_v5tej
>>>4 belong&0x00ffffff 8 \b_xscale
>>>4 belong&0x00ffffff 9 \b_v7
>>>4 belong&0x00ffffff 10 \b_v7f
>>>4 belong&0x00ffffff 11 subarchitecture=%ld
>>>4 belong&0x00ffffff 12 \b_v7k
>>>4 belong&0x00ffffff >12 subarchitecture=%ld
# 13 m88k
>>0 belong&0x00ffffff 13
>>>4 belong&0x00ffffff 0 mc88000
>>>4 belong&0x00ffffff 1 mc88100
>>>4 belong&0x00ffffff 2 mc88110
>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld
>>0 belong&0x00ffffff 14 sparc
>>0 belong&0x00ffffff 15 i860g
>>0 belong&0x00ffffff 16 alpha
>>0 belong&0x00ffffff 17 rs6000
>>0 belong&0x00ffffff 18 ppc
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \b_601
>>>4 belong&0x00ffffff 2 \b_602
>>>4 belong&0x00ffffff 3 \b_603
>>>4 belong&0x00ffffff 4 \b_603e
>>>4 belong&0x00ffffff 5 \b_603ev
>>>4 belong&0x00ffffff 6 \b_604
>>>4 belong&0x00ffffff 7 \b_604e
>>>4 belong&0x00ffffff 8 \b_620
>>>4 belong&0x00ffffff 9 \b_650
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%ld
>>0 belong&0x00ffffff >18 architecture=%ld
>0 belong&0x01000000 0x01000000
#
# 64-bit ABIs.
#
>>0 belong&0x00ffffff 0 64-bit architecture=%ld
>>0 belong&0x00ffffff 1 64-bit architecture=%ld
>>0 belong&0x00ffffff 2 64-bit architecture=%ld
>>0 belong&0x00ffffff 3 64-bit architecture=%ld
>>0 belong&0x00ffffff 4 64-bit architecture=%ld
>>0 belong&0x00ffffff 5 64-bit architecture=%ld
>>0 belong&0x00ffffff 6 64-bit architecture=%ld
>>0 belong&0x00ffffff 7 x86_64
>>>4 belong&0x00ffffff 0 subarchitecture=%ld
>>>4 belong&0x00ffffff 1 subarchitecture=%ld
>>>4 belong&0x00ffffff 2 subarchitecture=%ld
>>>4 belong&0x00ffffff 3
>>>4 belong&0x00ffffff 4 \b_arch1
>>>4 belong&0x00ffffff >4 subarchitecture=%ld
>>0 belong&0x00ffffff 8 64-bit architecture=%ld
>>0 belong&0x00ffffff 9 64-bit architecture=%ld
>>0 belong&0x00ffffff 10 64-bit architecture=%ld
>>0 belong&0x00ffffff 11 64-bit architecture=%ld
>>0 belong&0x00ffffff 12 64-bit architecture=%ld
>>0 belong&0x00ffffff 13 64-bit architecture=%ld
>>0 belong&0x00ffffff 14 64-bit architecture=%ld
>>0 belong&0x00ffffff 15 64-bit architecture=%ld
>>0 belong&0x00ffffff 16 64-bit architecture=%ld
>>0 belong&0x00ffffff 17 64-bit architecture=%ld
>>0 belong&0x00ffffff 18 ppc64
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \b_601
>>>4 belong&0x00ffffff 2 \b_602
>>>4 belong&0x00ffffff 3 \b_603
>>>4 belong&0x00ffffff 4 \b_603e
>>>4 belong&0x00ffffff 5 \b_603ev
>>>4 belong&0x00ffffff 6 \b_604
>>>4 belong&0x00ffffff 7 \b_604e
>>>4 belong&0x00ffffff 8 \b_620
>>>4 belong&0x00ffffff 9 \b_650
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%ld
>>0 belong&0x00ffffff >18 64-bit architecture=%ld
0 name mach-o-be
>0 byte 0xcf 64-bit
>4 belong <0
>>4 belong x architecture=%ld
>4 belong 1
>>8 belong 0 vax
>>8 belong 1 vax11/780
>>8 belong 2 vax11/785
>>8 belong 3 vax11/750
>>8 belong 4 vax11/730
>>8 belong 5 uvaxI
>>8 belong 6 uvaxII
>>8 belong 7 vax8200
>>8 belong 8 vax8500
>>8 belong 9 vax8600
>>8 belong 10 vax8650
>>8 belong 11 vax8800
>>8 belong 12 uvaxIII
>4 belong 2 romp
>4 belong 3 architecture=3
>4 belong 4 ns32032
>4 belong 5 ns32332
>4 belong 6 m68k
>4 belong 7
>>8 belong 3 i386
>>8 belong 4 i486
>>8 belong 132 i486sx
>>8 belong 5 i586
>>8 belong 8 pentium_3
>>8 belong 9 pentiumM
>>8 belong 10 pentiumIV
>>8 belong 11 itanium
>>8 belong 12 xeon
>>8 belong 14 pentiumIV_M
>>8 belong 15 itanium2
>>8 belong 21 pentiumpro
>>8 belong 23 pentiumIII
>>8 belong 24 pentium_3_M
>>8 belong 25 pentiumV
>>8 belong 26 xeon_mp
>>8 belong 40 pentium_3_xeon
>>8 belong 113 celeron
>>8 belong 119 celeron_mobile
>4 belong 8 mips
>>8 belong 1 R2300
>>8 belong 2 R2600
>>8 belong 3 R2800
>>8 belong 4 R2000a
>>8 belong 5 R2000
>>8 belong 6 R3000a
>>8 belong 7 R3000
>4 belong 9 ns32532
>4 belong 10 mc98000
>4 belong 11 hppa
>>8 belong 0 7100
>>8 belong 1 7100LC
>4 belong 12
>>8 belong 0 arm
>>8 belong 1 arm_v4t
>>8 belong 2 arm_v6
>>8 belong 3 arm_v5tej
>>8 belong 4 arm_xscale
>>8 belong 5 arm_v7
>>8 belong 6 arm_v7f
>>8 belong 7 arm_v7k
>4 belong 13
>>8 belong 0 mc88000
>>8 belong 1 mc88100
>>8 belong 2 mc88110
>4 belong 14 sparc
>4 belong 15 i860g
>4 belong 16 alpha
>4 belong 17 rs6000
>4 belong 18
>>8 belong 0 ppc
>>8 belong 1 ppc_601
>>8 belong 2 ppc_602
>>8 belong 3 ppc_603
>>8 belong 4 ppc_603e
>>8 belong 5 ppc_603ev
>>8 belong 6 ppc_604
>>8 belong 7 ppc_604e
>>8 belong 8 ppc_620
>>8 belong 9 ppc_650
>>8 belong 10 ppc_7400
>>8 belong 11 ppc_7450
>>8 belong 100 ppc_970
>4 belong 16777223
>>8 belong 3 x86_64
>>8 belong 4 x86_64_arch1
>4 belong 16777234
>>8 belong 0 ppc64
>>8 belong 1 ppc64_601
>>8 belong 2 ppc64_602
>>8 belong 3 ppc64_603
>>8 belong 4 ppc64_603e
>>8 belong 5 ppc64_603ev
>>8 belong 6 ppc64_604
>>8 belong 7 ppc64_604e
>>8 belong 8 ppc64_620
>>8 belong 9 ppc64_650
>>8 belong 10 ppc64_7400
>>8 belong 11 ppc64_7450
>>8 belong 100 ppc64_970
>4 belong >16777234
>>4 belong x architecture=%ld
>4 use mach-o-cpu
>12 belong 1 object
>12 belong 2 executable
>12 belong 3 fixed virtual memory shared library
@ -122,12 +199,16 @@
>12 belong 7 dynamic linker
>12 belong 8 bundle
>12 belong 9 dynamically linked shared library stub
>12 belong >9
>12 belong 10 dSYM companion file
>12 belong 11 kext bundle
>12 belong >11
>>12 belong x filetype=%ld
#
0 lelong&0xfffffffe 0xfeedface Mach-O
0 lelong&0xfffffffe 0xfeedface Mach-O
!:strength +1
>0 use \^mach-o-be
0 belong&0xfffffffe 0xfeedface Mach-O
0 belong&0xfffffffe 0xfeedface Mach-O
!:strength +1
>0 use mach-o-be

View File

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: mail.news,v 1.21 2012/06/21 01:44:52 christos Exp $
# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
@ -14,9 +14,9 @@
!:mime message/rfc822
0 string/t Pipe\ to mail piping text
!:mime message/rfc822
0 string/t Delivered-To: SMTP mail text
0 string/tc delivered-to: SMTP mail text
!:mime message/rfc822
0 string/t Return-Path: SMTP mail text
0 string/tc return-path: SMTP mail text
!:mime message/rfc822
0 string/t Path: news text
!:mime message/news

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $
# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
@ -33,7 +33,7 @@
# that is {VERSION major_version miunor_version computer_type version_string}
0 string {VERSION\ Maple worksheet
>9 string >\0 version %.1s.
>>>11 string >\0 %.1s
>>11 string >\0 %.1s
# .mps
0 string \0\0\001$ Maple something

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: matroska,v 1.7 2012/08/26 10:06:15 christos Exp $
# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
# matroska: file(1) magic for Matroska files
#
# See http://www.matroska.org/
@ -9,7 +9,7 @@
# EBML id:
0 belong 0x1a45dfa3
# DocType id:
>0 search/4096 \x42\x82
>4 search/4096 \x42\x82
# DocType contents:
>>&1 string webm WebM
!:mime video/webm

View File

@ -1,32 +1,8 @@
#------------------------------------------------------------------------------
# $File: mips,v 1.7 2011/05/03 01:44:17 christos Exp $
# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
# Dec Ultrix (MIPS)
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
# kbd file definitions
0 string kbd!map kbd map file
>8 byte >0 Ver %d:
>10 short >0 with %d table(s)
0 belong 0407 old SGI 68020 executable
0 belong 0410 old SGI 68020 pure executable
0 beshort 0x8765 disk quotas file
0 beshort 0x0506 IRIS Showcase file
>2 byte 0x49 -
>3 byte x - version %ld
0 beshort 0x0226 IRIS Showcase template
>2 byte 0x63 -
>3 byte x - version %ld
0 belong 0x5343464d IRIS Showcase file
>4 byte x - version %ld
0 belong 0x5443464d IRIS Showcase template
>4 byte x - version %ld
0 belong 0xdeadbabe IRIX Parallel Arena
>8 belong >0 - version %ld
# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
# and DEC Ultrix
#
0 beshort 0x0160 MIPSEB ECOFF executable
>20 beshort 0407 (impure)
@ -142,41 +118,3 @@
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL-BE Ucode
# 32bit core file
0 belong 0xdeadadb0 IRIX core dump
>4 belong 1 of
>16 string >\0 '%s'
# 64bit core file
0 belong 0xdeadad40 IRIX 64-bit core dump
>4 belong 1 of
>16 string >\0 '%s'
# N32bit core file
0 belong 0xbabec0bb IRIX N32 core dump
>4 belong 1 of
>16 string >\0 '%s'
# New style crash dump file
0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
>36 string >\0 '%s'
# Trusted IRIX info
0 string SGIAUDIT SGI Audit file
>8 byte x - version %d
>9 byte x \b.%ld
#
0 string WNGZWZSC Wingz compiled script
0 string WNGZWZSS Wingz spreadsheet
0 string WNGZWZHP Wingz help file
#
0 string #Inventor V IRIS Inventor 1.0 file
0 string #Inventor V2 Open Inventor 2.0 file
# GLF is OpenGL stream encoding
0 string glfHeadMagic(); GLF_TEXT
4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
!:strength -30
4 belong 0x0000007d GLF_BINARY_MSB_FIRST
!:strength -30
# GLS is OpenGL stream encoding; GLS is the successor of GLF
0 string glsBeginGLS( GLS_TEXT
4 belong 0x10000000 GLS_BINARY_LSB_FIRST
!:strength -30
4 belong 0x00000010 GLS_BINARY_MSB_FIRST
!:strength -30

View File

@ -1,6 +1,6 @@
#-----------------------------------------------------------------------------
# $File: misctools,v 1.12 2010/09/29 18:36:49 rrt Exp $
# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
@ -9,16 +9,6 @@
0 string/c BEGIN:VCARD vCard visiting card
!:mime text/x-vcard
# From: Alex Beregszaszi <alex@fsn.hu>
4 string gtktalog GNOME Catalogue (gtktalog)
>13 string >\0 version %s
# Summary: GStreamer binary registry
# Extension: .bin
# Submitted by: Josh Triplett <josh@joshtriplett.org>
0 belong 0xc0def00d GStreamer binary registry
>4 string x \b, version %s
# Summary: Libtool library file
# Extension: .la
# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msdos,v 1.83 2012/11/13 14:55:44 christos Exp $
# $File: msdos,v 1.85 2013/03/09 22:36:00 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
@ -313,7 +313,7 @@
>5 ubyte >0
>>8 string x \b, name=%-.2s
0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\360 MS-DOS KEYBoard Layout file
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
@ -645,16 +645,8 @@
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
# WARNING: below line conflicts with Infocom game data Z-machine 3
0 byte 0x03
>0x02 byte <0x13 DBase 3 data file
>>0x04 lelong 0 (no records)
>>0x04 lelong >0 (%ld records)
0 byte 0x83
>0x02 byte <0x13 DBase 3 data file with memo(s)
>>0x04 lelong 0 (no records)
>>0x04 lelong >0 (%ld records)
0 leshort 0x0006 DBase 3 index file
# tests for DBase files moved, updated and merged to database
0 string PMCC Windows 3.x .GRP file
1 string RDC-meg MegaDots
>8 byte >0x2F version %c

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msooxml,v 1.1 2011/01/25 18:36:19 christos Exp $
# $File: msooxml,v 1.2 2013/01/25 23:04:37 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
@ -23,11 +23,13 @@
>>>&26 search/1000 PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have
# Correct the mimetype with the registered ones:
# http://technet.microsoft.com/en-us/library/cc179224.aspx
>>>>&26 string word/ Microsoft Word 2007+
!:mime application/msword
!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
>>>>&26 string ppt/ Microsoft PowerPoint 2007+
!:mime application/vnd.ms-powerpoint
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
>>>>&26 string xl/ Microsoft Excel 2007+
!:mime application/vnd.ms-excel
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
>>>>&26 default x Microsoft OOXML
!:strength +10

View File

@ -1,10 +1,10 @@
#-----------------------------------------------------------------------------
# $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $
# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
# natinst: file(1) magic for National Instruments Code Files
#
# From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
# version 1
# Many formats still missing, we use, for the moment LabVIEW
# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing

View File

@ -1,16 +1,14 @@
#------------------------------------------------------------------------------
# $File: netbsd,v 1.19 2011/10/31 17:23:34 christos Exp $
# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
# The old-style magic numbers are indistinguishable from the same magic
# numbers used in other systems, and are handled, for all those systems,
# in aout.
#
0 lelong 000000407 a.out NetBSD little-endian object file
>16 lelong >0 not stripped
0 belong 000000407 a.out NetBSD big-endian object file
>16 belong >0 not stripped
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: python,v 1.21 2012/06/21 01:12:51 christos Exp $
# $File: python,v 1.22 2013/03/18 12:49:55 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
@ -22,6 +22,7 @@
0 belong 0x3b0c0d0a python 3.0 byte-compiled
0 belong 0x4f0c0d0a python 3.1 byte-compiled
0 belong 0x6c0c0d0a python 3.2 byte-compiled
0 belong 0x9e0c0d0a python 3.3 byte-compiled
0 search/1/w #!\ /usr/bin/python Python script text executable
!:mime text/x-python

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: revision,v 1.8 2010/11/25 15:00:12 christos Exp $
# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
# file(1) magic for revision control files
# From Hendrik Scholz <hendrik@scholz.net>
0 string/t /1\ :pserver: cvs password text file
@ -29,7 +29,7 @@
>4 belong =2 \b, version 2
# Type: Git index file
# From: Frédéric Brière <fbriere@fbriere.net>
# From: Frederic Briare <fbriere@fbriere.net>
0 string DIRC Git index
>4 belong >0 \b, version %d
>>8 belong >0 \b, %d entries

View File

@ -1,12 +1,12 @@
#------------------------------------------------------------------------------
# $File: riff,v 1.22 2011/09/06 11:00:06 christos Exp $
# $File: riff,v 1.23 2013/02/06 14:18:52 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
# http://www.seanet.com/users/matts/riffmci/riffmci.htm
#
# AVI section extended by Patrik Rĺdman <patrik+file-magic@iki.fi>
# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
#
0 string RIFF RIFF (little-endian) data
# RIFF Palette format
@ -247,7 +247,7 @@
#------------------------------------------------------------------------------
# MBWF/RF64
# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio
!:mime audio/x-wav
>40 search/256 fmt\x20 \b

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: rpm,v 1.11 2011/06/14 12:47:41 christos Exp $
# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
#
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
#
@ -31,22 +31,15 @@
>>8 beshort 255 noarch
#delta RPM Daniel Novotny (dnovotny@redhat.com)
0 string drpm Delta RPM
0 string drpm Delta RPM
!:mime application/x-rpm
>12 string x %s
>>>8 beshort 11 MIPSel
>>>8 beshort 12 ARM
>>>8 beshort 13 MiNT
>>>8 beshort 14 S/390
>>>8 beshort 15 S/390x
>>>8 beshort 16 PowerPC64
>>>8 beshort 17 SuperH
>>>8 beshort 18 Xtensa
>>8 beshort 11 MIPSel
>>8 beshort 12 ARM
>>8 beshort 13 MiNT
>>8 beshort 14 S/390
>>8 beshort 15 S/390x
>>8 beshort 16 PowerPC64
>>8 beshort 17 SuperH
>>8 beshort 18 Xtensa
>>10 string x %s
# Type: Delta RPM
# From: Daniel Novotny (dnovotny@redhat.com)
0 string drpm Delta RPM
!:mime application/x-rpm
>12 string x %s

View File

@ -1,7 +1,74 @@
#------------------------------------------------------------------------------
# $File: sgi,v 1.18 2010/11/25 15:00:12 christos Exp $
# sgi: file(1) magic for Silicon Graphics applications
# $File: sgi,v 1.19 2013/01/12 03:09:51 christos Exp $
# sgi: file(1) magic for Silicon Graphics operating systems and applications
#
# Executable images are handled either in aout (for old-style a.out
# files for 68K; they are indistinguishable from other big-endian 32-bit
# a.out files) or in mips (for MIPS ECOFF and Ucode files)
#
# kbd file definitions
0 string kbd!map kbd map file
>8 byte >0 Ver %d:
>10 short >0 with %d table(s)
0 beshort 0x8765 disk quotas file
0 beshort 0x0506 IRIS Showcase file
>2 byte 0x49 -
>3 byte x - version %ld
0 beshort 0x0226 IRIS Showcase template
>2 byte 0x63 -
>3 byte x - version %ld
0 belong 0x5343464d IRIS Showcase file
>4 byte x - version %ld
0 belong 0x5443464d IRIS Showcase template
>4 byte x - version %ld
0 belong 0xdeadbabe IRIX Parallel Arena
>8 belong >0 - version %ld
# core files
#
# 32bit core file
0 belong 0xdeadadb0 IRIX core dump
>4 belong 1 of
>16 string >\0 '%s'
# 64bit core file
0 belong 0xdeadad40 IRIX 64-bit core dump
>4 belong 1 of
>16 string >\0 '%s'
# N32bit core file
0 belong 0xbabec0bb IRIX N32 core dump
>4 belong 1 of
>16 string >\0 '%s'
# New style crash dump file
0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
>36 string >\0 '%s'
# Trusted IRIX info
0 string SGIAUDIT SGI Audit file
>8 byte x - version %d
>9 byte x \b.%ld
#
0 string WNGZWZSC Wingz compiled script
0 string WNGZWZSS Wingz spreadsheet
0 string WNGZWZHP Wingz help file
#
0 string #Inventor V IRIS Inventor 1.0 file
0 string #Inventor V2 Open Inventor 2.0 file
# GLF is OpenGL stream encoding
0 string glfHeadMagic(); GLF_TEXT
4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
!:strength -30
4 belong 0x0000007d GLF_BINARY_MSB_FIRST
!:strength -30
# GLS is OpenGL stream encoding; GLS is the successor of GLF
0 string glsBeginGLS( GLS_TEXT
4 belong 0x10000000 GLS_BINARY_LSB_FIRST
!:strength -30
4 belong 0x00000010 GLS_BINARY_MSB_FIRST
!:strength -30
#
#

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $
# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
@ -17,6 +17,7 @@
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
>6 leshort >4 (type %d)
#
# Microsoft Network Monitor 2.x capture files.
@ -29,6 +30,12 @@
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
>6 leshort 5 (IP-over-IEEE 1394)
>6 leshort 6 (802.11)
>6 leshort 7 (Raw IP)
>6 leshort 8 (Raw IP)
>6 leshort 9 (Raw IP)
>6 leshort >9 (type %d)
#
# Network General Sniffer capture files.
@ -57,6 +64,7 @@
# Sorry, make that "Network Associates Sniffer Basic, and Windows
# Sniffer Pro", capture files."
# Sorry, make that "Network General Sniffer capture files."
# Sorry, make that "NetScout Sniffer capture files."
#
0 string XCP\0 NetXRay capture file
>4 string >\0 - version %s
@ -73,8 +81,7 @@
# the main program that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
!:mime application/vnd.tcpdump.pcap
0 name pcap-be
>4 beshort x - version %d
>6 beshort x \b.%d
>20 belong 0 (No link-layer encapsulation
@ -116,8 +123,10 @@
>20 belong 127 (802.11 with radiotap header
>20 belong 129 (Linux ARCNET
>20 belong 138 (Apple IP over IEEE 1394
>20 belong 139 (MTP2 with pseudo-header
>20 belong 140 (MTP2
>20 belong 141 (MTP3
>20 belong 142 (SCCP
>20 belong 143 (DOCSIS
>20 belong 144 (IrDA
>20 belong 147 (Private use 0
@ -137,72 +146,53 @@
>20 belong 161 (Private use 14
>20 belong 162 (Private use 15
>20 belong 163 (802.11 with AVS header
>20 belong 165 (BACnet MS/TP
>20 belong 166 (PPPD
>20 belong 169 (GPRS LLC
>20 belong 177 (Linux LAPD
>20 belong 187 (Bluetooth HCI H4
>20 belong 189 (Linux USB
>20 belong 192 (PPI
>20 belong 195 (802.15.4
>20 belong 196 (SITA
>20 belong 197 (Endace ERF
>20 belong 201 (Bluetooth HCI H4 with pseudo-header
>20 belong 202 (AX.25 with KISS header
>20 belong 203 (LAPD
>20 belong 204 (PPP with direction pseudo-header
>20 belong 205 (Cisco HDLC with direction pseudo-header
>20 belong 206 (Frame Relay with direction pseudo-header
>20 belong 209 (Linux IPMB
>20 belong 215 (802.15.4 with non-ASK PHY header
>20 belong 220 (Memory-mapped Linux USB
>20 belong 224 (Fibre Channel FC-2
>20 belong 225 (Fibre Channel FC-2 with frame delimiters
>20 belong 226 (Solaris IPNET
>20 belong 227 (SocketCAN
>20 belong 228 (Raw IPv4
>20 belong 229 (Raw IPv6
>20 belong 230 (802.15.4 without FCS
>20 belong 231 (D-Bus messages
>20 belong 235 (DVB-CI
>20 belong 236 (MUX27010
>20 belong 237 (STANAG 5066 D_PDUs
>20 belong 239 (Linux netlink NFLOG messages
>20 belong 240 (Hilscher netAnalyzer
>20 belong 241 (Hilscher netAnalyzer with delimiters
>20 belong 242 (IP-over-Infiniband
>20 belong 243 (MPEG-2 Transport Stream packets
>20 belong 244 (ng4t ng40
>20 belong 245 (NFC LLCP
>20 belong 247 (Infiniband
>20 belong 248 (SCTP
>16 belong x \b, capture length %d)
0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
!:mime application/vnd.tcpdump.pcap
>0 use pcap-be
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
!:mime application/vnd.tcpdump.pcap
>4 leshort x - version %d
>6 leshort x \b.%d
>20 lelong 0 (No link-layer encapsulation
>20 lelong 1 (Ethernet
>20 lelong 2 (3Mb Ethernet
>20 lelong 3 (AX.25
>20 lelong 4 (ProNET
>20 lelong 5 (CHAOS
>20 lelong 6 (Token Ring
>20 lelong 7 (ARCNET
>20 lelong 8 (SLIP
>20 lelong 9 (PPP
>20 lelong 10 (FDDI
>20 lelong 11 (RFC 1483 ATM
>20 lelong 12 (raw IP
>20 lelong 13 (BSD/OS SLIP
>20 lelong 14 (BSD/OS PPP
>20 lelong 19 (Linux ATM Classical IP
>20 lelong 50 (PPP or Cisco HDLC
>20 lelong 51 (PPP-over-Ethernet
>20 lelong 99 (Symantec Enterprise Firewall
>20 lelong 100 (RFC 1483 ATM
>20 lelong 101 (raw IP
>20 lelong 102 (BSD/OS SLIP
>20 lelong 103 (BSD/OS PPP
>20 lelong 104 (BSD/OS Cisco HDLC
>20 lelong 105 (802.11
>20 lelong 106 (Linux Classical IP over ATM
>20 lelong 107 (Frame Relay
>20 lelong 108 (OpenBSD loopback
>20 lelong 109 (OpenBSD IPsec encrypted
>20 lelong 112 (Cisco HDLC
>20 lelong 113 (Linux "cooked"
>20 lelong 114 (LocalTalk
>20 lelong 117 (OpenBSD PFLOG
>20 lelong 119 (802.11 with Prism header
>20 lelong 122 (RFC 2625 IP over Fibre Channel
>20 lelong 123 (SunATM
>20 lelong 127 (802.11 with radiotap header
>20 lelong 129 (Linux ARCNET
>20 lelong 138 (Apple IP over IEEE 1394
>20 lelong 140 (MTP2
>20 lelong 141 (MTP3
>20 lelong 143 (DOCSIS
>20 lelong 144 (IrDA
>20 lelong 147 (Private use 0
>20 lelong 148 (Private use 1
>20 lelong 149 (Private use 2
>20 lelong 150 (Private use 3
>20 lelong 151 (Private use 4
>20 lelong 152 (Private use 5
>20 lelong 153 (Private use 6
>20 lelong 154 (Private use 7
>20 lelong 155 (Private use 8
>20 lelong 156 (Private use 9
>20 lelong 157 (Private use 10
>20 lelong 158 (Private use 11
>20 lelong 159 (Private use 12
>20 lelong 160 (Private use 13
>20 lelong 161 (Private use 14
>20 lelong 162 (Private use 15
>20 lelong 163 (802.11 with AVS header
>16 lelong x \b, capture length %d)
>0 use \^pcap-be
#
# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
@ -211,43 +201,9 @@
# that use "libpcap", or that use the same capture file format.)
#
0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
>4 beshort x - version %d
>6 beshort x \b.%d
>20 belong 0 (No link-layer encapsulation
>20 belong 1 (Ethernet
>20 belong 2 (3Mb Ethernet
>20 belong 3 (AX.25
>20 belong 4 (ProNET
>20 belong 5 (CHAOS
>20 belong 6 (Token Ring
>20 belong 7 (ARCNET
>20 belong 8 (SLIP
>20 belong 9 (PPP
>20 belong 10 (FDDI
>20 belong 11 (RFC 1483 ATM
>20 belong 12 (raw IP
>20 belong 13 (BSD/OS SLIP
>20 belong 14 (BSD/OS PPP
>16 belong x \b, capture length %d)
>0 use pcap-be
0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
>4 leshort x - version %d
>6 leshort x \b.%d
>20 lelong 0 (No link-layer encapsulation
>20 lelong 1 (Ethernet
>20 lelong 2 (3Mb Ethernet
>20 lelong 3 (AX.25
>20 lelong 4 (ProNET
>20 lelong 5 (CHAOS
>20 lelong 6 (Token Ring
>20 lelong 7 (ARCNET
>20 lelong 8 (SLIP
>20 lelong 9 (PPP
>20 lelong 10 (FDDI
>20 lelong 11 (RFC 1483 ATM
>20 lelong 12 (raw IP
>20 lelong 13 (BSD/OS SLIP
>20 lelong 14 (BSD/OS PPP
>16 lelong x \b, capture length %d)
>0 use \^pcap-be
#
# "pcap-ng" capture files.
@ -295,9 +251,9 @@
>8 lelong x \b, %d stations found
#
# EtherPeek/AiroPeek "version 9" capture files.
# *Peek tagged capture files.
#
0 string \177ver EtherPeek/AiroPeek capture file
0 string \177ver EtherPeek/AiroPeek/OmniPeek capture file
#
# Visual Networks traffic capture files.

View File

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: sql,v 1.8 2012/12/09 17:11:08 christos Exp $
# $File: sql,v 1.11 2013/02/21 15:27:01 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
# Recognize some MySQL files.
# Elan Ruusamäe <glen@delfi.ee>, added MariaDB signatures
# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
#
0 beshort 0xfe01 MySQL table definition file
@ -56,3 +56,10 @@
>60 string _MTN Monotone source repository
>60 belong !0 SQLite 3.x database, user version %u
>60 belong 0 SQLite 3.x database
# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/
# pceditor_V2003.jar
0 string PSDB\0 Panasonic channel list database
>126 string SQLite\ format\ 3
>>&-15 indirect x \b; contains

View File

@ -1,12 +1,15 @@
#------------------------------------------------------------------------------
# $File: sun,v 1.22 2011/02/10 01:52:51 christos Exp $
# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $
# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases. (5.x uses ELF.)
# releases. (5.x uses ELF.) Entries for executables without an
# architecture type, used before the 68020-based Sun-3's came out,
# are in aout, as they're indistinguishable from other big-endian
# 32-bit a.out files.
#
0 belong&077777777 0600413 sparc demand paged
0 belong&077777777 0600413 a.out SunOS sparc demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@ -14,17 +17,17 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600410 sparc pure
0 belong&077777777 0600410 a.out SunOS sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600407 sparc
0 belong&077777777 0600407 a.out SunOS sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400413 mc68020 demand paged
0 belong&077777777 0400413 a.out SunOS mc68020 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@ -32,17 +35,17 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400410 mc68020 pure
0 belong&077777777 0400410 a.out SunOS mc68020 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400407 mc68020
0 belong&077777777 0400407 a.out SunOS mc68020
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200413 mc68010 demand paged
0 belong&077777777 0200413 a.out SunOS mc68010 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
@ -50,24 +53,16 @@
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200410 mc68010 pure
0 belong&077777777 0200410 a.out SunOS mc68010 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200407 mc68010
0 belong&077777777 0200407 a.out SunOS mc68010
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
# reworked these to avoid anything beginning with zero becoming "old sun-2"
0 belong 0407 old sun-2 executable
>16 belong >0 not stripped
0 belong 0410 old sun-2 pure executable
>16 belong >0 not stripped
0 belong 0413 old sun-2 demand paged executable
>16 belong >0 not stripped
#
# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
@ -96,7 +91,10 @@
# Sun SunPC
0 long 0xfa33c08e SunPC 4.0 Hard Disk
0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
# Sun snoop (see RFC 1761, which describes the capture file format).
# Sun snoop (see RFC 1761, which describes the capture file format,
# RFC 3827, which describes some additional datalink types, and
# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
# which is the IANA registry of Snoop datalink types)
#
0 string snoop Snoop capture file
>8 belong >0 - version %ld
@ -109,14 +107,25 @@
>12 belong 6 (Character synchronous)
>12 belong 7 (IBM channel-to-channel adapter)
>12 belong 8 (FDDI)
>12 belong 9 (Unknown)
# Microsoft ICM color profile
36 string acspMSFT Microsoft ICM Color Profile
!:mime application/vnd.iccprofile
# Sun KCMS
36 string acsp Kodak Color Management System, ICC Profile
!:mime application/vnd.iccprofile
>12 belong 9 (Other)
>12 belong 10 (type %ld)
>12 belong 11 (type %ld)
>12 belong 12 (type %ld)
>12 belong 13 (type %ld)
>12 belong 14 (type %ld)
>12 belong 15 (type %ld)
>12 belong 16 (Fibre Channel)
>12 belong 17 (ATM)
>12 belong 18 (ATM Classical IP)
>12 belong 19 (type %ld)
>12 belong 20 (type %ld)
>12 belong 21 (type %ld)
>12 belong 22 (type %ld)
>12 belong 23 (type %ld)
>12 belong 24 (type %ld)
>12 belong 25 (type %ld)
>12 belong 26 (IP over Infiniband)
>12 belong >26 (type %ld)
#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
@ -130,5 +139,3 @@
# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
# at the very end where file(1) can't get it.
0 string CRfs COBALT boot rom data (Flat boot rom or file system)

View File

@ -1,35 +1,34 @@
#------------------------------------------------------------------------------
# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $
# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
# unknown: file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
# (executable, pure, and split I&D, respectively), but the PDP-11 version
# doesn't have the "version %ld", which may be a bogus COFFism (I don't
# think there was ever COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
# long, as it would be on a VAX. In any case, that could collide with
# VAX demand-paged files, as the magic number is little-endian on those
# binaries, so the first 16 bits of the file would contain 0x10B.
#
# 0x10C is 0414 and 0x10E is 416; those *are* unknown.
# Therefore, those entries are commented out.
#
0 short 0x107 unknown machine executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x108 unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x109 PDP-11 separate I&D
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x10b unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
#
#0 short 0x107 unknown machine executable
#>8 short >0 not stripped
#>15 byte >0 - version %ld
#0 short 0x108 unknown pure executable
#>8 short >0 not stripped
#>15 byte >0 - version %ld
#0 short 0x109 PDP-11 separate I&D
#>8 short >0 not stripped
#>15 byte >0 - version %ld
#0 short 0x10b unknown pure executable
#>8 short >0 not stripped
#>15 byte >0 - version %ld
0 long 0x10c unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10e unknown readable demand paged pure executable

View File

@ -1,30 +1,22 @@
#------------------------------------------------------------------------------
# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $
# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
0 lelong 0101556 VAX double precision APL workspace
#
# VAX a.out (32V, BSD)
# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
# executables, and are handled in aout)
#
0 lelong 0407 VAX executable
>16 lelong >0 not stripped
0 lelong 0410 VAX pure executable
>16 lelong >0 not stripped
0 lelong 0413 VAX demand paged pure executable
>16 lelong >0 not stripped
0 lelong 0420 VAX demand paged (first page unmapped) pure executable
0 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable
>16 lelong >0 not stripped
#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# The `versions' were commented out, but have been un-commented out.
# (Was the problem just one of endianness?)
#
0 leshort 0570 VAX COFF executable

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $
# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
@ -24,5 +24,7 @@
# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
0 belong 0x03000000 VMS Alpha executable
>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# GRR this test is still too general as it catches example adressen.dbt
0 belong 0x03000000
>8 ubelong 0xec020000 VMS Alpha executable
>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: wordprocessors,v 1.16 2012/10/29 17:36:49 christos Exp $
# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $
# wordprocessors: file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
@ -110,7 +110,7 @@
512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
!:mime application/x-hwp
# CosmicBook, from Benoît Rouits
# CosmicBook, from Benoit Rouits
0 string CSBK Ted Neslson's CosmicBook hypertext file
2 string EYWR AmigaWriter file

View File

@ -1,11 +1,11 @@
#------------------------------------------------------------------------------
# $File: wsdl,v 1.1 2011/01/19 19:34:50 christos Exp $
# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
# Cache format extracted from source:
# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
# By Elan Ruusamäe <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
0 string wsdl PHP WSDL cache,
>4 byte x version 0x%02x
>6 ledate x \b, created %s

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $
# $File: xilinx,v 1.5 2013/01/08 03:06:50 christos Exp $
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic@RevRagnarok.com
# Got the info from FPGA-FAQ 0026
@ -33,3 +33,6 @@
>>>>>>>>&1 byte 0x00
>>>>>>>>&2 string e
>>>>>>>>&4 belong x - data length 0x%lx
# Raw bitstream files
0 long 0xffffffff
>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)

View File

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: xwindows,v 1.7 2011/05/03 01:44:17 christos Exp $
# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
# Compiled X Keymap
@ -10,7 +10,7 @@
>0 byte =0 obsolete
0 string xkm Compiled XKB Keymap: msb,
>3 byte >0 version %d
>0 byte =0 obsolete
>3 byte =0 obsolete
# xfsdump archive
0 string xFSdump0 xfsdump archive

View File

@ -21,3 +21,10 @@ libmagic_la_LIBADD = $(LTLIBOBJS) $(MINGWLIBS)
file_SOURCES = file.c
file_LDADD = libmagic.la
CLEANFILES = magic.h
EXTRA_DIST = magic.h.in
HDR= $(top_srcdir)/src/magic.h.in
BUILT_SOURCES = magic.h
magic.h: ${HDR}
sed -e "s/X.YY/$$(echo @VERSION@ | tr -d .)/" < ${HDR} > $@

View File

@ -1,4 +1,4 @@
/* $NetBSD: elfclass.h,v 1.1.1.3 2011/09/16 20:37:39 christos Exp $ */
/* $NetBSD: elfclass.h,v 1.1.1.4 2013/03/23 15:49:16 christos Exp $ */
/*
* Copyright (c) Christos Zoulas 2008.
@ -61,7 +61,8 @@
(off_t)elf_getu(swap, elfhdr.e_shoff),
elf_getu16(swap, elfhdr.e_shnum),
(size_t)elf_getu16(swap, elfhdr.e_shentsize),
fsize, &flags, elf_getu16(swap, elfhdr.e_machine)) == -1)
fsize, &flags, elf_getu16(swap, elfhdr.e_machine),
(int)elf_getu16(swap, elfhdr.e_shstrndx)) == -1)
return -1;
break;

View File

@ -1,4 +1,4 @@
/* $NetBSD: file.c,v 1.1.1.4 2013/01/03 16:27:53 christos Exp $ */
/* $NetBSD: file.c,v 1.1.1.5 2013/03/23 15:49:16 christos Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -35,9 +35,9 @@
#ifndef lint
#if 0
FILE_RCSID("@(#)$File: file.c,v 1.148 2012/11/21 16:27:39 christos Exp $")
FILE_RCSID("@(#)$File: file.c,v 1.149 2013/01/07 18:20:19 christos Exp $")
#else
__RCSID("$NetBSD: file.c,v 1.1.1.4 2013/01/03 16:27:53 christos Exp $");
__RCSID("$NetBSD: file.c,v 1.1.1.5 2013/03/23 15:49:16 christos Exp $");
#endif
#endif /* lint */
@ -282,6 +282,11 @@ main(int argc, char *argv[])
if (e)
return e;
if (MAGIC_VERSION != magic_version())
(void)fprintf(stderr, "%s: compiled magic version [%d] "
"does not match with shared library magic version [%d]\n",
progname, MAGIC_VERSION, magic_version());
switch(action) {
case FILE_CHECK:
case FILE_COMPILE:

View File

@ -1,4 +1,4 @@
/* $NetBSD: getline.c,v 1.1.1.2 2012/02/22 17:48:20 christos Exp $ */
/* $NetBSD: getline.c,v 1.1.1.3 2013/03/23 15:49:15 christos Exp $ */
/* NetBSD: fgetln.c,v 1.9 2008/04/29 06:53:03 martin Exp */
@ -39,7 +39,7 @@
#include <errno.h>
#include <string.h>
ssize_t
public ssize_t
getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
{
char *ptr, *eptr;

View File

@ -1,4 +1,4 @@
/* $NetBSD: magic.h,v 1.1.1.3 2012/02/22 17:48:18 christos Exp $ */
/* $NetBSD: magic.h,v 1.1.1.4 2013/03/23 15:49:14 christos Exp $ */
/*
* Copyright (c) Christos Zoulas 2003.
@ -76,6 +76,8 @@
#define MAGIC_NO_CHECK_FORTRAN 0x000000 /* Don't check ascii/fortran */
#define MAGIC_NO_CHECK_TROFF 0x000000 /* Don't check ascii/troff */
#define MAGIC_VERSION 514 /* This implementation */
#ifdef __cplusplus
extern "C" {
@ -93,6 +95,7 @@ const char *magic_buffer(magic_t, const void *, size_t);
const char *magic_error(magic_t);
int magic_setflags(magic_t, int);
int magic_version(void);
int magic_load(magic_t, const char *);
int magic_compile(magic_t, const char *);
int magic_check(magic_t, const char *);

107
external/bsd/file/dist/src/magic.h.in vendored Normal file
View File

@ -0,0 +1,107 @@
/*
* Copyright (c) Christos Zoulas 2003.
* All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice immediately at the beginning of the file, without modification,
* this list of conditions, and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#ifndef _MAGIC_H
#define _MAGIC_H
#include <sys/types.h>
#define MAGIC_NONE 0x000000 /* No flags */
#define MAGIC_DEBUG 0x000001 /* Turn on debugging */
#define MAGIC_SYMLINK 0x000002 /* Follow symlinks */
#define MAGIC_COMPRESS 0x000004 /* Check inside compressed files */
#define MAGIC_DEVICES 0x000008 /* Look at the contents of devices */
#define MAGIC_MIME_TYPE 0x000010 /* Return the MIME type */
#define MAGIC_CONTINUE 0x000020 /* Return all matches */
#define MAGIC_CHECK 0x000040 /* Print warnings to stderr */
#define MAGIC_PRESERVE_ATIME 0x000080 /* Restore access time on exit */
#define MAGIC_RAW 0x000100 /* Don't translate unprintable chars */
#define MAGIC_ERROR 0x000200 /* Handle ENOENT etc as real errors */
#define MAGIC_MIME_ENCODING 0x000400 /* Return the MIME encoding */
#define MAGIC_MIME (MAGIC_MIME_TYPE|MAGIC_MIME_ENCODING)
#define MAGIC_APPLE 0x000800 /* Return the Apple creator and type */
#define MAGIC_NO_CHECK_COMPRESS 0x001000 /* Don't check for compressed files */
#define MAGIC_NO_CHECK_TAR 0x002000 /* Don't check for tar files */
#define MAGIC_NO_CHECK_SOFT 0x004000 /* Don't check magic entries */
#define MAGIC_NO_CHECK_APPTYPE 0x008000 /* Don't check application type */
#define MAGIC_NO_CHECK_ELF 0x010000 /* Don't check for elf details */
#define MAGIC_NO_CHECK_TEXT 0x020000 /* Don't check for text files */
#define MAGIC_NO_CHECK_CDF 0x040000 /* Don't check for cdf files */
#define MAGIC_NO_CHECK_TOKENS 0x100000 /* Don't check tokens */
#define MAGIC_NO_CHECK_ENCODING 0x200000 /* Don't check text encodings */
/* No built-in tests; only consult the magic file */
#define MAGIC_NO_CHECK_BUILTIN ( \
MAGIC_NO_CHECK_COMPRESS | \
MAGIC_NO_CHECK_TAR | \
/* MAGIC_NO_CHECK_SOFT | */ \
MAGIC_NO_CHECK_APPTYPE | \
MAGIC_NO_CHECK_ELF | \
MAGIC_NO_CHECK_TEXT | \
MAGIC_NO_CHECK_CDF | \
MAGIC_NO_CHECK_TOKENS | \
MAGIC_NO_CHECK_ENCODING | \
)
/* Defined for backwards compatibility (renamed) */
#define MAGIC_NO_CHECK_ASCII MAGIC_NO_CHECK_TEXT
/* Defined for backwards compatibility; do nothing */
#define MAGIC_NO_CHECK_FORTRAN 0x000000 /* Don't check ascii/fortran */
#define MAGIC_NO_CHECK_TROFF 0x000000 /* Don't check ascii/troff */
#define MAGIC_VERSION X.YY /* This implementation */
#ifdef __cplusplus
extern "C" {
#endif
typedef struct magic_set *magic_t;
magic_t magic_open(int);
void magic_close(magic_t);
const char *magic_getpath(const char *, int);
const char *magic_file(magic_t, const char *);
const char *magic_descriptor(magic_t, int);
const char *magic_buffer(magic_t, const void *, size_t);
const char *magic_error(magic_t);
int magic_setflags(magic_t, int);
int magic_version(void);
int magic_load(magic_t, const char *);
int magic_compile(magic_t, const char *);
int magic_check(magic_t, const char *);
int magic_list(magic_t, const char *);
int magic_errno(magic_t);
#ifdef __cplusplus
};
#endif
#endif /* _MAGIC_H */

20
external/bsd/file/dist/src/pread.c vendored Normal file
View File

@ -0,0 +1,20 @@
/* $NetBSD: pread.c,v 1.1.1.1 2013/03/23 15:49:15 christos Exp $ */
#include "file.h"
#ifndef lint
#if 0
FILE_RCSID("@(#)$File: pread.c,v 1.1 2013/02/18 15:40:59 christos Exp $")
#else
__RCSID("$NetBSD: pread.c,v 1.1.1.1 2013/03/23 15:49:15 christos Exp $");
#endif
#endif /* lint */
#include <fcntl.h>
#include <unistd.h>
ssize_t
pread(int fd, void *buf, ssize_t len, off_t off) {
if (lseek(fd, off, SEEK_SET) == (off_t)-1)
return -1;
return read(fd, buf, len);
}

View File

@ -1,4 +1,4 @@
/* $NetBSD: readelf.h,v 1.1.1.2 2011/09/16 20:37:39 christos Exp $ */
/* $NetBSD: readelf.h,v 1.1.1.3 2013/03/23 15:49:15 christos Exp $ */
/*
* Copyright (c) Christos Zoulas 2003.
@ -46,17 +46,9 @@ typedef uint16_t Elf32_Half;
typedef uint32_t Elf32_Word;
typedef uint8_t Elf32_Char;
#if SIZEOF_LONG_LONG != 8
#define USE_ARRAY_FOR_64BIT_TYPES
typedef uint32_t Elf64_Addr[2];
typedef uint32_t Elf64_Off[2];
typedef uint32_t Elf64_Xword[2];
#else
#undef USE_ARRAY_FOR_64BIT_TYPES
typedef uint64_t Elf64_Addr;
typedef uint64_t Elf64_Off;
typedef uint64_t Elf64_Xword;
#endif
typedef uint16_t Elf64_Half;
typedef uint32_t Elf64_Word;
typedef uint8_t Elf64_Char;