file 4.08: bugfixes 'n more magic 'n stuff

This commit is contained in:
pooka 2004-03-23 08:31:19 +00:00
parent 246c4b1ac6
commit e3a02bec05
46 changed files with 937 additions and 246 deletions

50
dist/file/ChangeLog vendored
View File

@ -1,5 +1,55 @@
2004-03-22 15:25 Christos Zoulas <christos@zoulas.com>
* Lots of mime fixes
(Joerg Ostertag) <ostertag@rechengilde.de>
* FreeBSD ELF version handling
(Edwin Groothuis) <edwin@mavetju.org>
* correct cleanup in all cases; don't just close the file.
(Christos Zoulas) <christos@zoulas.com>
* add gettext message catalogue support
(Michael Piefel) <piefel@debian.org>
* better printout for unreadable files
(Michael Piefel) <piefel@debian.org>
* compensate for missing MAXPATHLEN
(Michael Piefel) <piefel@debian.org>
* add wide character string length computation
(Michael Piefel) <piefel@debian.org>
* Avoid infinite loops caused by bad elf alignments
or name and description note sizes. Reported by
(Mikael Magnusson) <mmikael@comhem.se>
2004-03-09 13:55 Christos Zoulas <christos@zoulas.com>
* Fix possible memory leak on error and add missing regfree
(Dmitry V. Levin) <ldv@altlinux.org>
2003-12-23 12:12 Christos Zoulas <christos@zoulas.com>
* fix -k flag (Maciej W. Rozycki)
2003-11-18 14:10 Christos Zoulas <christos@zoulas.com>
* Try to give us much info as possible on corrupt elf files.
(Willy Tarreau) <willy@w.ods.org>
* Updated python bindings (Brett Funderburg)
<brettf@deepfile.com>
2003-11-11 15:03 Christos Zoulas <christos@zoulas.com>
* Include file.h first, because it includes config.h
breaks largefile test macros otherwise.
(Paul Eggert <eggert@CS.UCLA.EDU> via
Lars Hecking <lhecking@nmrc.ie>)
2003-10-14 21:39 Christos Zoulas <christos@zoulas.com>
* Python bindings (Brett Funderburg) <brettf@deepfile.com>
* Don't lookup past the end of the buffer
(Chad Hanson) <chanson@tcs-sec.com>

View File

@ -43,6 +43,7 @@ Magdir/blender \
Magdir/blit \
Magdir/bout \
Magdir/bsdi \
Magdir/cad \
Magdir/c-lang \
Magdir/c64 \
Magdir/cddb \
@ -58,6 +59,7 @@ Magdir/compress \
Magdir/console \
Magdir/convex \
Magdir/ctags \
Magdir/dact \
Magdir/database \
Magdir/diamond \
Magdir/diff \
@ -77,6 +79,7 @@ Magdir/frame \
Magdir/freebsd \
Magdir/fsav \
Magdir/games \
Magdir/geos \
Magdir/gcc \
Magdir/gimp \
Magdir/gnu \
@ -140,6 +143,7 @@ Magdir/pdp \
Magdir/perl \
Magdir/pgp \
Magdir/pkgadd \
Magdir/plan9 \
Magdir/plus5 \
Magdir/printer \
Magdir/project \

View File

@ -33,9 +33,10 @@
0 string ARP. The Holy Noise Module sound file
0 string BeEp\0 JamCracker Module sound file
0 string COSO\0 Hippel-COSO Module sound file
26 string V.3 Brian Postma's Soundmon Module sound file v3
26 string BPSM Brian Postma's Soundmon Module sound file v3
26 string V.2 Brian Postma's Soundmon Module sound file v2
# Too simple (short, pure ASCII, deep), MPi
#26 string V.3 Brian Postma's Soundmon Module sound file v3
#26 string BPSM Brian Postma's Soundmon Module sound file v3
#26 string V.2 Brian Postma's Soundmon Module sound file v2
# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
0 beshort 0x0f00 AmigaOS bitmap font
@ -55,3 +56,15 @@
>35 byte 3 os: Unix
0 belong 0x000003fa AmigaOS shared library
# Amiga disk types
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk
0 string DOS\1 Amiga FFS disk
0 string DOS\2 Amiga Inter DOS disk
0 string DOS\3 Amiga Inter FFS disk
0 string DOS\4 Amiga Fastdir DOS disk
0 string DOS\5 Amiga Fastdir FFS disk
0 string KICK Kickstart disk

View File

@ -121,7 +121,7 @@
#From: Johan Gade <jgade@diku.dk>
# MPEG-4 Advanced Audio Coding (AAC) file (perhaps also MPEG-2 ACC?)
16 string M4A MPEG-4 Advanced Audio Coding file (ACC)
16 string M4A MPEG-4 Advanced Audio Coding file (AAC)
# FLI animation format
@ -163,10 +163,19 @@
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
# SGI and Apple formats
# SGI formats
0 string MOVI Silicon Graphics movie file
# Apple Quicktime: Scan for all known top-level QT atom markers
4 string moov Apple QuickTime movie file (moov)
4 string mdat Apple QuickTime movie file (mdat)
4 string ftyp Apple QuickTime movie file (ftyp)
4 string free Apple QuickTime movie file (free)
4 string junk Apple QuickTime movie file (junk)
4 string pnot Apple QuickTime movie file (pnot)
4 string skip Apple QuickTime movie file (skip)
4 string wide Apple QuickTime movie file (wide)
4 string pict Apple QuickTime movie file (pict)
# iso 13818 transport stream
#
@ -216,3 +225,16 @@
# VRML (Virtual Reality Modelling Language)
0 string/b #VRML\ V1.0\ ascii VRML 1 file
0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
#
0 string HVQM4 %s
>6 string >\0 v%s
>0 byte x GameCube movie,
>0x34 ubeshort x %d x
>0x36 ubeshort x %d,
>0x26 ubeshort x %dµs,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio

View File

@ -35,7 +35,7 @@
>68 string >\0 (format %s)
>81 string bz2 \b, uses bzip2 compression
>84 string gz \b, uses gzip compression
>136 ledate x created: %s
#>136 ledate x created: %s
# other archives
0 long 0177555 very old archive
@ -241,9 +241,11 @@
# Microsoft cabinets
# by David Necas (Yeti) <yeti@physics.muni.cz>
0 string MSCF\0\0\0\0 Microsoft cabinet file data,
>25 byte x v%d
>24 byte x \b.%d
#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
#>25 byte x v%d
#>24 byte x \b.%d
# MPi: All CABs have version 1.3, so this is pointless.
# Better magic in debian-additions.
# GTKtalog catalogs
# by David Necas (Yeti) <yeti@physics.muni.cz>

View File

@ -10,7 +10,7 @@
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0 string /* C or REXX program text
0 string // C++ program text
#0 string // C++ program text
# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data

36
dist/file/magic/magdir/cad vendored Normal file
View File

@ -0,0 +1,36 @@
#------------------------------------------------------------------------------
# autocad: file(1) magic for cad files
#
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
0 string \101\103\061\060\061 AutoCAD
>5 string \062\000\000\000\000 DWG ver. R13
>5 string \064\000\000\000\000 DWG ver. R14
# Microstation DGN/CIT Files (www.bentley.com)
# Written October 30, 2003 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0 string \010\011\376 Microstation
>3 string \002
>>30 string \372\104 DGN File
>>30 string \172\104 DGN File
>>30 string \026\105 DGN File
>4 string \030\000\000 CIT File
# AutoCad, from Nahuel Greco
0 string AC1012 AutoCad (release 12)
0 string AC1014 AutoCad (release 14)

View File

@ -119,9 +119,37 @@
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
0 beshort 0x4142 MSX game cartridge dump
# Too simple - MPi
#0 beshort 0x4142 MSX game cartridge dump
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0 string PS-X\ EXE Sony Playstation executable
# Area:
>113 string x (%s)
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
0 string XBEH XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
>>&2 ulelong =0x0
>>>&2 ulelong =0x0 \b, not signed
>0x0004 ulelong >0
>>&2 ulelong >0
>>>&2 ulelong >0 \b, signed
# expect base address of 0x10000
>0x0104 ulelong =0x10000
>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
>>>(0x0118-0x0FF60) ulelong >0 (regions:
>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
>>>(0x0118-0x0FF60) ulelong >0 \b)
# --------------------------------
# Microsoft Xbox data file formats
0 string XIP0 XIP, Microsoft Xbox data
0 string XTF0 XTF, Microsoft Xbox data

10
dist/file/magic/magdir/dact vendored Normal file
View File

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# dact: file(1) magic for DACT compressed files
#
0 long 0x444354C3 DACT compressed data
>4 byte >-1 (version %i.
>5 byte >-1 $BS%i.
>6 byte >-1 $BS%i)
>7 long >0 $BS, original size: %i bytes
>15 long >30 $BS, block size: %i bytes

View File

@ -192,4 +192,12 @@
2 string ICE ICE authority data
# X11 Xauthority file (Wolfram Kleff)
10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data

View File

@ -332,3 +332,6 @@
>4 string PPCBoot
>>12 string x version %s
# JFFS2 file system
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
0 lelong 0xe0011985 Linux jffs2 filesystem data little endian

View File

@ -8,6 +8,8 @@
#
0 string FWS Macromedia Flash data,
>3 byte x version %d
0 string CWS Macromedia Flash data (compressed),
>3 byte x version %d
#
# From Dave Wilson
0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document

View File

@ -24,3 +24,134 @@
>4 long 0x2E III Map file (BSP)
0 string IDS2 Quake II SP2 sprite file
#---------------------------------------------------------------------------
# Doom and Quake
# submitted by Nicolas Patrois
# DOOM
0 string IWAD DOOM or DOOM ][ world
0 string PWAD DOOM or DOOM ][ extension world
0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
24 string LxD\ 203 Linuxdoom save
>0 string x , name=%s
>44 string x , world=%s
# Quake
0 string PACK Quake I or II world or extension
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#0 string 5\x0a Quake I save
# The levels
# Quake 1
0 string 5\x0aIntroduction Quake I save: start Introduction
0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
0 string 5\x0athe_Installation Quake I save: e2m1 The installation
0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
# Quake DeathMatch levels
0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
# Scourge of Armagon
0 string 5\x0aCommand_HQ Quake I save: start Command HQ
0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
# Malice
0 string 5\x0aThe_Academy Quake I save: start The academy
0 string 5\x0aThe_Lab Quake I save: d1 The lab
0 string 5\x0aArea_33 Quake I save: d1b Area 33
0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
0 string 5\x0aArea44 Quake I save: d1c Area 44
0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
0 string 5\x0aThe_Flood Quake I save: d5 The flood
0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
# Malice DeathMatch levels
0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
0 string 5\x0aDOMINO Quake I save: ddm6 Domino
0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
0 string MComprHD MAME CHD compressed hard disk image,
>12 belong x version %lu

19
dist/file/magic/magdir/geos vendored Normal file
View File

@ -0,0 +1,19 @@
#------------------------------------------------------------------------------
# GEOS files (Vidar Madsen, vidar@gimp.org)
# semi-commonly used in embedded and handheld systems.
0 belong 0xc745c153 GEOS
>40 byte 1 executable
>40 byte 2 VMFile
>40 byte 3 binary
>40 byte 4 directory label
>40 byte <1 unknown
>40 byte >4 unknown
>4 string >\0 \b, name "%s"
#>44 short x \b, version %d
#>46 short x \b.%d
#>48 short x \b, rev %d
#>50 short x \b.%d
#>52 short x \b, proto %d
#>54 short x \br%d
#>168 string >\0 \b, copyright "%s"

View File

@ -10,3 +10,33 @@
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* Nazgul style compiled message catalog
>8 lelong >0 \b, version %ld
# GnuPG
# The format is very similar to pgp
0 string \001gpg GPG key trust database
>4 byte x version %d
0 beshort 0x9901 GPG key public ring
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.
# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
#------------------------------------------------------------------------------
# gcc: file(1) magic for GCC special files
#
0 string gpch GCC precompiled header
# The version field is annoying. It's 3 characters, not zero-terminated.
>5 byte x (version %c
>6 byte x \b%c
>7 byte x \b%c)
# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>4 byte 67 for C
>4 byte 111 for Objective C
>4 byte 43 for C++
>4 byte 79 for Objective C++

View File

@ -1,25 +1,25 @@
#------------------------------------------------------------------------------
# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
0 string HU Human68k
>68 string LZX LZX compressed
>>72 string >\0 (version %s)
>(8.L+74) string LZX LZX compressed
>>(8.L+78) string >\0 (version %s)
>60 belong >0 binded
>(8.L+66) string #HUPAIR hupair
>0 string HU X executable
>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
>4 belong >0 - base address 0x%x
>28 belong >0 not stripped
>32 belong >0 with debug information
0 beshort 0x601a Human68k Z executable
0 beshort 0x6000 Human68k object file
0 belong 0xd1000000 Human68k ar binary archive
0 belong 0xd1010000 Human68k ar ascii archive
0 beshort 0x0068 Human68k lib archive
4 string LZX Human68k LZX compressed
>8 string >\0 (version %s)
>4 string LZX R executable
2 string #HUPAIR Human68k hupair R executable
# Magic too short!
#0 string HU Human68k
#>68 string LZX LZX compressed
#>>72 string >\0 (version %s)
#>(8.L+74) string LZX LZX compressed
#>>(8.L+78) string >\0 (version %s)
#>60 belong >0 binded
#>(8.L+66) string #HUPAIR hupair
#>0 string HU X executable
#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
#>4 belong >0 - base address 0x%x
#>28 belong >0 not stripped
#>32 belong >0 with debug information
#0 beshort 0x601a Human68k Z executable
#0 beshort 0x6000 Human68k object file
#0 belong 0xd1000000 Human68k ar binary archive
#0 belong 0xd1010000 Human68k ar ascii archive
#0 beshort 0x0068 Human68k lib archive
#4 string LZX Human68k LZX compressed
#>8 string >\0 (version %s)
#>4 string LZX R executable
#2 string #HUPAIR Human68k hupair R executable

View File

@ -164,10 +164,11 @@
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
0 string IC PC icon data
0 string PI PC pointer image data
0 string CI PC color icon data
0 string CP PC color pointer image data
# Too simple - MPi
#0 string IC PC icon data
#0 string PI PC pointer image data
#0 string CI PC color icon data
#0 string CP PC color pointer image data
# Conflicts with other entries [BABYL]
#0 string BA PC bitmap array data
@ -479,3 +480,24 @@
>0x0020 string >0.6.1 file version %s
>0x0020 string <0.6.1 file version %s
# DCX is multi-page PCX, using a simple header of up to 1024
# offsets for the respective PCX components.
# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
0 lelong 987654321 DCX multi-page PCX image data
# Simon Walton <simonw@matteworld.com>
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0 lelong 0xd75f2a80 Cineon image data
>200 belong >0 \b, %ld x
>204 belong >0 %ld
# Bio-Rad .PIC is an image format used by microscope control systems
# and related image processing software used by biologists.
# From: Vebjorn Ljosa <vebjorn@ljosa.com>
54 leshort 12345 Bio-Rad .PIC Image File
>0 leshort >0 %hd x
>2 leshort >0 %hd,
>4 leshort =1 1 image in file
>4 leshort >1 %hd images in file

View File

@ -33,3 +33,15 @@
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0 beshort 0x55AA BIOS (ia32) ROM Ext.
>5 string USB USB
>7 string LDR UNDI image
>30 string IBM IBM comp. Video
>26 string Adaptec Adaptec
>28 string Adaptec Adaptec
>42 string PROMISE Promise
>2 byte x (%d*512)

View File

@ -19,9 +19,9 @@
>11 byte x \b %d.
>12 byte x \b%02d
# Next, the resolution or aspect ratio of the image:
>13 byte 0 \b, aspect ratio
>13 byte 1 \b, resolution (DPI)
>13 byte 2 \b, resolution (DPCM)
#>13 byte 0 \b, aspect ratio
#>13 byte 1 \b, resolution (DPI)
#>13 byte 2 \b, resolution (DPCM)
#>4 beshort x \b, segment length %d
# Next, show thumbnail info, if it exists:
>18 byte !0 \b, thumbnail %dx
@ -54,8 +54,8 @@
# I've commented-out quantisation table reporting. I doubt anyone cares yet.
#>(4.S+5) byte 0xDB \b, quantisation table
#>>(4.S+6) beshort x \b length=%d
>14 beshort x \b, %d x
>16 beshort x \b %d
#>14 beshort x \b, %d x
#>16 beshort x \b %d
# HSI is Handmade Software's proprietary JPEG encoding scheme
0 string hsi1 JPEG image data, HSI proprietary

View File

@ -44,11 +44,6 @@
# this can be overridden by the DOS executable (COM) entry
2 string LILO Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
>8 byte 0x0a old Debian Binary Package
>>3 byte >0 \b, created by dpkg 0.9%c
>>4 byte >0 pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0 leshort 0x0436 Linux/i386 PC Screen Font data,
>2 byte 0 256 characters, no directory,
@ -102,10 +97,10 @@
>0x1e3 string Loading version 1.3.79 or older
>0x1e9 string Loading from prehistoric times
# System.map files - Nicol=EF=BF=BDs Lichtmaier <nick@debian.org>
# System.map files - Nicolás Lichtmaier <nick@debian.org>
8 string \ A\ _text Linux kernel symbol map text
# LSM entries - Nicol=EF=BF=BDs Lichtmaier <nick@debian.org>
# LSM entries - Nicolás Lichtmaier <nick@debian.org>
0 string Begin3 Linux Software Map entry text
0 string Begin4 Linux Software Map entry text (new format)

View File

@ -88,7 +88,8 @@
# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
# be 0x81. This works for the files I have, but maybe not for everyone's.
122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
# Unfortunately, this magic is quite weak - MPi
#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
# MacBinary I doesn't have the version number field at all, but MacBinary II
# has been in use since 1987 so I hope there aren't many really old files
@ -111,117 +112,117 @@
# >73 byte&0x10 0x40 \b, invisible
# >73 byte&0x10 0x80 \b, locked
>65 string x \b, type "%4.4s"
#>65 string x \b, type "%4.4s"
>65 string 8BIM (PhotoShop)
>65 string ALB3 (PageMaker 3)
>65 string ALB4 (PageMaker 4)
>65 string ALT3 (PageMaker 3)
>65 string APPL (application)
>65 string AWWP (AppleWorks word processor)
>65 string CIRC (simulated circuit)
>65 string DRWG (MacDraw)
>65 string EPSF (Encapsulated PostScript)
>65 string FFIL (font suitcase)
>65 string FKEY (function key)
>65 string FNDR (Macintosh Finder)
>65 string GIFf (GIF image)
>65 string Gzip (GNU gzip)
>65 string INIT (system extension)
>65 string LIB\ (library)
>65 string LWFN (PostScript font)
>65 string MSBC (Microsoft BASIC)
>65 string PACT (Compact Pro archive)
>65 string PDF\ (Portable Document Format)
>65 string PICT (picture)
>65 string PNTG (MacPaint picture)
>65 string PREF (preferences)
>65 string PROJ (Think C project)
>65 string QPRJ (Think Pascal project)
>65 string SCFL (Defender scores)
>65 string SCRN (startup screen)
>65 string SITD (StuffIt Deluxe)
>65 string SPn3 (SuperPaint)
>65 string STAK (HyperCard stack)
>65 string Seg\ (StuffIt segment)
>65 string TARF (Unix tar archive)
>65 string TEXT (ASCII)
>65 string TIFF (TIFF image)
>65 string TOVF (Eudora table of contents)
>65 string WDBN (Microsoft Word word processor)
>65 string WORD (MacWrite word processor)
>65 string XLS\ (Microsoft Excel)
>65 string ZIVM (compress (.Z))
>65 string ZSYS (Pre-System 7 system file)
>65 string acf3 (Aldus FreeHand)
>65 string cdev (control panel)
>65 string dfil (Desk Acessory suitcase)
>65 string libr (library)
>65 string nX^d (WriteNow word processor)
>65 string nX^w (WriteNow dictionary)
>65 string rsrc (resource)
>65 string scbk (Scrapbook)
>65 string shlb (shared library)
>65 string ttro (SimpleText read-only)
>65 string zsys (system file)
#>65 string 8BIM (PhotoShop)
#>65 string ALB3 (PageMaker 3)
#>65 string ALB4 (PageMaker 4)
#>65 string ALT3 (PageMaker 3)
#>65 string APPL (application)
#>65 string AWWP (AppleWorks word processor)
#>65 string CIRC (simulated circuit)
#>65 string DRWG (MacDraw)
#>65 string EPSF (Encapsulated PostScript)
#>65 string FFIL (font suitcase)
#>65 string FKEY (function key)
#>65 string FNDR (Macintosh Finder)
#>65 string GIFf (GIF image)
#>65 string Gzip (GNU gzip)
#>65 string INIT (system extension)
#>65 string LIB\ (library)
#>65 string LWFN (PostScript font)
#>65 string MSBC (Microsoft BASIC)
#>65 string PACT (Compact Pro archive)
#>65 string PDF\ (Portable Document Format)
#>65 string PICT (picture)
#>65 string PNTG (MacPaint picture)
#>65 string PREF (preferences)
#>65 string PROJ (Think C project)
#>65 string QPRJ (Think Pascal project)
#>65 string SCFL (Defender scores)
#>65 string SCRN (startup screen)
#>65 string SITD (StuffIt Deluxe)
#>65 string SPn3 (SuperPaint)
#>65 string STAK (HyperCard stack)
#>65 string Seg\ (StuffIt segment)
#>65 string TARF (Unix tar archive)
#>65 string TEXT (ASCII)
#>65 string TIFF (TIFF image)
#>65 string TOVF (Eudora table of contents)
#>65 string WDBN (Microsoft Word word processor)
#>65 string WORD (MacWrite word processor)
#>65 string XLS\ (Microsoft Excel)
#>65 string ZIVM (compress (.Z))
#>65 string ZSYS (Pre-System 7 system file)
#>65 string acf3 (Aldus FreeHand)
#>65 string cdev (control panel)
#>65 string dfil (Desk Acessory suitcase)
#>65 string libr (library)
#>65 string nX^d (WriteNow word processor)
#>65 string nX^w (WriteNow dictionary)
#>65 string rsrc (resource)
#>65 string scbk (Scrapbook)
#>65 string shlb (shared library)
#>65 string ttro (SimpleText read-only)
#>65 string zsys (system file)
>69 string x \b, creator "%4.4s"
#>69 string x \b, creator "%4.4s"
# Somewhere, Apple has a repository of registered Creator IDs. These are
# just the ones that I happened to have files from and was able to identify.
>69 string 8BIM (Adobe Photoshop)
>69 string ALD3 (PageMaker 3)
>69 string ALD4 (PageMaker 4)
>69 string ALFA (Alpha editor)
>69 string APLS (Apple Scanner)
>69 string APSC (Apple Scanner)
>69 string BRKL (Brickles)
>69 string BTFT (BitFont)
>69 string CCL2 (Common Lisp 2)
>69 string CCL\ (Common Lisp)
>69 string CDmo (The Talking Moose)
>69 string CPCT (Compact Pro)
>69 string CSOm (Eudora)
>69 string DMOV (Font/DA Mover)
>69 string DSIM (DigSim)
>69 string EDIT (Macintosh Edit)
>69 string ERIK (Macintosh Finder)
>69 string EXTR (self-extracting archive)
>69 string Gzip (GNU gzip)
>69 string KAHL (Think C)
>69 string LWFU (LaserWriter Utility)
>69 string LZIV (compress)
>69 string MACA (MacWrite)
>69 string MACS (Macintosh operating system)
>69 string MAcK (MacKnowledge terminal emulator)
>69 string MLND (Defender)
>69 string MPNT (MacPaint)
>69 string MSBB (Microsoft BASIC (binary))
>69 string MSWD (Microsoft Word)
>69 string NCSA (NCSA Telnet)
>69 string PJMM (Think Pascal)
>69 string PSAL (Hunt the Wumpus)
>69 string PSI2 (Apple File Exchange)
>69 string R*ch (BBEdit)
>69 string RMKR (Resource Maker)
>69 string RSED (Resource Editor)
>69 string Rich (BBEdit)
>69 string SIT! (StuffIt)
>69 string SPNT (SuperPaint)
>69 string Unix (NeXT Mac filesystem)
>69 string VIM! (Vim editor)
>69 string WILD (HyperCard)
>69 string XCEL (Microsoft Excel)
>69 string aCa2 (Fontographer)
>69 string aca3 (Aldus FreeHand)
>69 string dosa (Macintosh MS-DOS file system)
>69 string movr (Font/DA Mover)
>69 string nX^n (WriteNow)
>69 string pdos (Apple ProDOS file system)
>69 string scbk (Scrapbook)
>69 string ttxt (SimpleText)
>69 string ufox (Foreign File Access)
#>69 string 8BIM (Adobe Photoshop)
#>69 string ALD3 (PageMaker 3)
#>69 string ALD4 (PageMaker 4)
#>69 string ALFA (Alpha editor)
#>69 string APLS (Apple Scanner)
#>69 string APSC (Apple Scanner)
#>69 string BRKL (Brickles)
#>69 string BTFT (BitFont)
#>69 string CCL2 (Common Lisp 2)
#>69 string CCL\ (Common Lisp)
#>69 string CDmo (The Talking Moose)
#>69 string CPCT (Compact Pro)
#>69 string CSOm (Eudora)
#>69 string DMOV (Font/DA Mover)
#>69 string DSIM (DigSim)
#>69 string EDIT (Macintosh Edit)
#>69 string ERIK (Macintosh Finder)
#>69 string EXTR (self-extracting archive)
#>69 string Gzip (GNU gzip)
#>69 string KAHL (Think C)
#>69 string LWFU (LaserWriter Utility)
#>69 string LZIV (compress)
#>69 string MACA (MacWrite)
#>69 string MACS (Macintosh operating system)
#>69 string MAcK (MacKnowledge terminal emulator)
#>69 string MLND (Defender)
#>69 string MPNT (MacPaint)
#>69 string MSBB (Microsoft BASIC (binary))
#>69 string MSWD (Microsoft Word)
#>69 string NCSA (NCSA Telnet)
#>69 string PJMM (Think Pascal)
#>69 string PSAL (Hunt the Wumpus)
#>69 string PSI2 (Apple File Exchange)
#>69 string R*ch (BBEdit)
#>69 string RMKR (Resource Maker)
#>69 string RSED (Resource Editor)
#>69 string Rich (BBEdit)
#>69 string SIT! (StuffIt)
#>69 string SPNT (SuperPaint)
#>69 string Unix (NeXT Mac filesystem)
#>69 string VIM! (Vim editor)
#>69 string WILD (HyperCard)
#>69 string XCEL (Microsoft Excel)
#>69 string aCa2 (Fontographer)
#>69 string aca3 (Aldus FreeHand)
#>69 string dosa (Macintosh MS-DOS file system)
#>69 string movr (Font/DA Mover)
#>69 string nX^n (WriteNow)
#>69 string pdos (Apple ProDOS file system)
#>69 string scbk (Scrapbook)
#>69 string ttxt (SimpleText)
#>69 string ufox (Foreign File Access)
# Just in case...
@ -236,6 +237,14 @@
>24 string CATALOG catalog
>24 string INDEX data file index
>24 string VIEW data view
# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
#
0x54 string SAS SAS 7+
>0x9C string DATA data file
>0x9C string CATALOG catalog
>0x9C string INDEX data file index
>0x9C string VIEW data view
# spss magic for SPSS system and portable files,
# from Bruce Foster (bef@nwu.edu).
@ -267,19 +276,20 @@
>0x412 beshort x number of blocks: %d,
>0x424 pstring x volume name: %s
0x400 beshort 0x4244 Macintosh HFS data
>0 beshort 0x4C4B (bootable)
>0x40a beshort &0x8000 (locked)
>0x40a beshort ^0x0100 (mounted)
>0x40a beshort &0x0200 (spared blocks)
>0x40a beshort &0x0800 (unclean)
>0x47C beshort 0x482B (Embedded HFS+ Volume)
>0x402 beldate-0x7C25B080 x created: %s,
>0x406 beldate-0x7C25B080 x last modified: %s,
>0x440 beldate-0x7C25B080 >0 last backup: %s,
>0x414 belong x block size: %d,
>0x412 beshort x number of blocks: %d,
>0x424 pstring x volume name: %s
# "BD" is has many false positives
#0x400 beshort 0x4244 Macintosh HFS data
#>0 beshort 0x4C4B (bootable)
#>0x40a beshort &0x8000 (locked)
#>0x40a beshort ^0x0100 (mounted)
#>0x40a beshort &0x0200 (spared blocks)
#>0x40a beshort &0x0800 (unclean)
#>0x47C beshort 0x482B (Embedded HFS+ Volume)
#>0x402 beldate-0x7C25B080 x created: %s,
#>0x406 beldate-0x7C25B080 x last modified: %s,
#>0x440 beldate-0x7C25B080 >0 last backup: %s,
#>0x414 belong x block size: %d,
#>0x412 beshort x number of blocks: %d,
#>0x424 pstring x volume name: %s
0x400 beshort 0x482B Macintosh HFS Extended
>&0 beshort x version %d data

View File

@ -20,9 +20,9 @@
0 string \<PACKAGE= Maple help file
0 string \<HELP\ NAME= Maple help file
0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
0 string #\ Newton Maple help file, old style
#0 string #\ Newton Maple help file, old style
0 string #\ daub Maple help file, old style
0 string #=========== Maple help file, old style
#0 string #=========== Maple help file, old style
# .mws
0 string \000\000\001\044\000\221 Maple worksheet

View File

@ -181,9 +181,6 @@
# Help files
0 string ?_\3\0 MS Windows Help Data
# Microsoft CAB distribution format Dale Worley <root@dworley.ny.mediaone.net>
0 string MSCF\000\000\000\000 Microsoft CAB file
# DeIsL1.isu what this is I don't know
0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
@ -239,11 +236,6 @@
>>8 byte >0 \b, %d-colors
# True Type fonts currently misidentified as raw G3 data
0 string \000\001\000\000\000 MS-Windows true type font .ttf
# .chr files
0 string PK\010\010BGI Borland font
>4 string >\0 %s
@ -279,7 +271,8 @@
0 string DCU1 Borland Delphi .DCU file
0 string !<spell> MKS Spell hash list (old format)
0 string !<spell2> MKS Spell hash list
0 string AH Halo(TM) bitmapped font file
# Too simple - MPi
#0 string AH Halo(TM) bitmapped font file
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
@ -326,3 +319,42 @@
>>0x8ad string UPX [compressed w/%s
>>>&1 string >\0 %.4s]
>>0x1c string pmodedj stubbed with %s
# QDOS
4 belong 0x4AFB QDOS executable
>9 pstring x '%s'
0 beshort 0xFB01 QDOS object
>2 pstring x '%s'
#------------------------------------------------------------------------------
# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
# Microsoft Cabinet files
0 string MSCF\0\0\0\0 Microsoft Cabinet file
>8 lelong x \b, %u bytes
>28 leshort 1 \b, 1 file
>28 leshort >1 \b, %u files
# InstallShield Cabinet files
0 string ISc( InstallShield Cabinet file
>5 byte&0xf0 =0x60 version 6,
>5 byte&0xf0 !0x60 version 4/5,
>(12.l+40) lelong x %u files
# Windows CE package files
0 string MSCE\0\0\0\0 Microsoft WinCE install header
>20 lelong 0 \b, architecture-independent
>20 lelong 103 \b, Hitachi SH3
>20 lelong 104 \b, Hitachi SH4
>20 lelong 0xA11 \b, StrongARM
>20 lelong 4000 \b, MIPS R4000
>20 lelong 10003 \b, Hitachi SH3
>20 lelong 10004 \b, Hitachi SH3E
>20 lelong 10005 \b, Hitachi SH4
>20 lelong 70001 \b, ARM 7TDMI
>52 leshort 1 \b, 1 file
>52 leshort >1 \b, %u files
>56 leshort 1 \b, 1 registry entry
>56 leshort >1 \b, %u registry entries
# Outlook Personal Folders
0 lelong 0x4E444221 Microsoft Outlook binary email folder

View File

@ -8,6 +8,9 @@
# Netscape Address book .nab
0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
# Netscape Communicator address book
0 string \000\017\102\111 Netscape Communicator address book
# .snm Caches
0 string #\ Netscape\ folder\ cache Netscape folder cache
0 string \000\036\204\220\000 Netscape folder cache

View File

@ -11,16 +11,16 @@
# OS/2 URL objects
# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
0 string http: OS/2 URL object text
>5 string >\ (WWW) <http:%s>
0 string mailto: OS/2 URL object text
>7 string >\ (email) <%s>
0 string news: OS/2 URL object text
>5 string >\ (Usenet) <%s>
0 string ftp: OS/2 URL object text
>4 string >\ (FTP) <ftp:%s>
0 string file: OS/2 URL object text
>5 string >\ (Local file) <%s>
#0 string http: OS/2 URL object text
#>5 string >\ (WWW) <http:%s>
#0 string mailto: OS/2 URL object text
#>7 string >\ (email) <%s>
#0 string news: OS/2 URL object text
#>5 string >\ (Usenet) <%s>
#0 string ftp: OS/2 URL object text
#>4 string >\ (FTP) <ftp:%s>
#0 string file: OS/2 URL object text
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
# Carl Hauser (chauser.parc@xerox.com) and

View File

@ -65,7 +65,7 @@
# annotations.
# For other versions, just outputs version.
#
0x3C string zTXT A GutenPalm zTXT e-book
60 string zTXT A GutenPalm zTXT e-book
>0 string >\0 "%s"
>(0x4E.L) byte 0
>>(0x4E.L+1) byte x (v0.%02d)
@ -81,7 +81,11 @@
>>(0x4E.L+1) byte x %02d)
# Palm OS .prc file types
0x3C string libr Palm OS dynamic library data
60 string libr Palm OS dynamic library data
>0 string >\0 "%s"
0x3C string ptch Palm OS operating system patch data
60 string ptch Palm OS operating system patch data
>0 string >\0 "%s"
# Mobipocket (www.mobipocket.com), donated by Carl Witty
60 string BOOKMOBI Mobipocket E-book
>0 string >\0 "%s"

4
dist/file/magic/magdir/plan9 vendored Normal file
View File

@ -0,0 +1,4 @@
#------------------------------------------------------------------------------
# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
#
0 belong 0x000001EB Plan 9 executable

View File

@ -11,4 +11,4 @@
0 belong 0x87c60d0a python 2.0 byte-compiled
0 belong 0x2aeb0d0a python 2.1 byte-compiled
0 belong 0x2ded0d0a python 2.2 byte-compiled
#0 belong 0x31f20d0a python 2.3 byte-compiled
0 belong 0x3bf20d0a python 2.3 byte-compiled

View File

@ -13,7 +13,7 @@
>>8 beshort 4 MIPS
>>8 beshort 5 PowerPC
>>8 beshort 6 68000
>>8 beshort 7 SGI
>>8 beshort 7 SGI
>>8 beshort 8 RS6000
>>8 beshort 9 IA64
>>8 beshort 10 Sparc64

View File

@ -4,7 +4,7 @@
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
0 string/cB \<!doctype\ html HTML document text
0 string/cB \<!DOCTYPE\ html HTML document text
0 string/cb \<head HTML document text
0 string/cb \<title HTML document text
0 string/cb \<html HTML document text
@ -13,6 +13,7 @@
# from Marc Prud'hommeaux (marc@apocalypse.org)
0 string/cb \<?xml XML document text
0 string \<?xml\ version " XML
0 string \<?xml\ version=" XML
>15 string >\0 %.3s document text
>>23 string \<xsl:stylesheet (XSL stylesheet)
>>24 string \<xsl:stylesheet (XSL stylesheet)

View File

@ -9,23 +9,25 @@
# Microsoft Network Monitor 1.x capture files.
#
0 string RTSS NetMon capture file
>4 byte x - version %d
>5 byte x \b.%d
>5 byte x - version %d
>4 byte x \b.%d
>6 leshort 0 (Unknown)
>6 leshort 1 (Ethernet)
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
#
# Microsoft Network Monitor 2.x capture files.
#
0 string GMBU NetMon capture file
>4 byte x - version %d
>5 byte x \b.%d
>5 byte x - version %d
>4 byte x \b.%d
>6 leshort 0 (Unknown)
>6 leshort 1 (Ethernet)
>6 leshort 2 (Token Ring)
>6 leshort 3 (FDDI)
>6 leshort 4 (ATM)
#
# Network General Sniffer capture files.
@ -58,6 +60,9 @@
>44 leshort 0 (Ethernet)
>44 leshort 1 (Token Ring)
>44 leshort 2 (FDDI)
>44 leshort 3 (WAN)
>44 leshort 8 (ATM)
>44 leshort 9 (802.11)
#
# "libpcap" capture files.
@ -75,7 +80,7 @@
>20 belong 4 (ProNET
>20 belong 5 (CHAOS
>20 belong 6 (Token Ring
>20 belong 7 (ARCNET
>20 belong 7 (BSD ARCNET
>20 belong 8 (SLIP
>20 belong 9 (PPP
>20 belong 10 (FDDI
@ -92,10 +97,21 @@
>20 belong 104 (BSD/OS Cisco HDLC
>20 belong 105 (802.11
>20 belong 106 (Linux Classical IP over ATM
>20 belong 107 (Frame Relay
>20 belong 108 (OpenBSD loopback
>20 belong 109 (OpenBSD IPSEC encrypted
>20 belong 109 (OpenBSD IPsec encrypted
>20 belong 112 (Cisco HDLC
>20 belong 113 (Linux "cooked"
>20 belong 114 (LocalTalk
>20 belong 117 (OpenBSD PFLOG
>20 belong 119 (802.11 with Prism header
>20 belong 123 (SunATM
>20 belong 127 (802.11 with radiotap header
>20 belong 129 (Linux ARCNET
>20 belong 140 (MTP2
>20 belong 141 (MTP3
>20 belong 143 (DOCSIS
>20 belong 144 (IrDA
>16 belong x \b, capture length %d)
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
>4 leshort x - version %d
@ -124,10 +140,21 @@
>20 lelong 104 (BSD/OS Cisco HDLC
>20 lelong 105 (802.11
>20 lelong 106 (Linux Classical IP over ATM
>20 lelong 107 (Frame Relay
>20 lelong 108 (OpenBSD loopback
>20 lelong 109 (OpenBSD IPSEC encrypted
>20 lelong 112 (Cisco HDLC
>20 lelong 113 (Linux "cooked"
>20 lelong 114 (LocalTalk
>20 lelong 117 (OpenBSD PFLOG
>20 lelong 119 (802.11 with Prism header
>20 lelong 123 (SunATM
>20 lelong 127 (802.11 with radiotap header
>20 lelong 129 (Linux ARCNET
>20 lelong 140 (MTP2
>20 lelong 141 (MTP3
>20 lelong 143 (DOCSIS
>20 lelong 144 (IrDA
>16 lelong x \b, capture length %d)
#
@ -178,6 +205,7 @@
#
# AIX "iptrace" capture files.
#
0 string iptrace\ 1.0 "iptrace" capture file
0 string iptrace\ 2.0 "iptrace" capture file
#

View File

@ -106,3 +106,18 @@
36 string acspMSFT Microsoft ICM Color Profile
# Sun KCMS
36 string acsp Kodak Color Management System, ICC Profile
#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
# lead Sun/Cobalt developer) who agrees that they are good and worthy of
# inclusion.
# Boot ROM images for Sun/Cobalt Linux server appliances
0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
>38 string x V%.4s
# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
# at the very end where file(1) can't get it.
0 string CRfs COBALT boot rom data (Flat boot rom or file system)

View File

@ -1,5 +1,5 @@
# ------------------------------------------------------------------------
# ti-8x: file(1) magic for the TI-8x and TI-92 Graphing Calculators.
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
#
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
#

View File

@ -3,10 +3,10 @@
# VMware specific files (deducted from version 1.1 and log file entries)
# Anthon van der Neut (anthon@mnt.org)
0 belong 0x4d52564e VMware nvram
0 belong 0x434f5744
>8 byte 3 VMware virtual disk
0 belong 0x434f5744 VMware
>4 byte 3 virtual disk
>>32 lelong x (%d/
>>36 lelong x \b%d/
>>40 lelong x \b%d)
>8 byte 2 VMware undoable disk
>4 byte 2 undoable disk
>>32 string >\0 (%s)

View File

@ -17,11 +17,11 @@
##>4 byte 0 revision 0
>4 byte 0
##>>14 lelong x (Serial %lX)
# --- First vorbis packet - general header ---
>>28 string \x01vorbis \b, Vorbis audio,
# non-Vorbis content: FLAC (Free Loss-lessy Audio Codec,
# http://flac.sourceforge.net)
>>28 string fLaC \b, FLAC audio
# --- First vorbis packet - general header ---
>>28 string \x01vorbis \b, Vorbis audio,
>>>35 lelong !0 UNKNOWN VERSION %lu,
##>>>35 lelong 0 version 0,
>>>35 lelong 0

View File

@ -102,3 +102,10 @@
>8 long 18219264 WordPerfect graphic image (1.0)
>8 long 18219520 WordPerfect graphic image (2.0)
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
# Hangul (Korean) Word Processor File
0 string HWP\ Document\ File Hangul (Korean) Word Processor File
# CosmicBook, from Benoît Rouits
0 string CSBK Ted Neslson's CosmicBook hypertext file

View File

@ -100,7 +100,7 @@
#MP3 with ID3 tag
0 string ID3 audio/mpeg
# Ogg/Vorbis
0 string OggS application/ogg
0 string OggS audio/ogg
#------------------------------------------------------------------------------
# c-lang: file(1) magic for C programs or various scripts
@ -405,6 +405,7 @@
0 string Forward\ to message/rfc822 7bit
0 string Pipe\ to message/rfc822 7bit
0 string Return-Path: message/rfc822 7bit
0 string Received: message/rfc822
0 string Path: message/news 8bit
0 string Xref: message/news 8bit
0 string From: message/rfc822 7bit
@ -464,8 +465,8 @@
#>34 string >\0 (%s)
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
#0 string \\input\ texinfo Texinfo source text
#0 string This\ is\ Info\ file GNU Info text
0 string \\input\ texinfo text/x-texinfo
0 string This\ is\ Info\ file text/x-info
# correct TeX magic for Linux (and maybe more)
# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
@ -623,3 +624,164 @@
#>>12 leshort 0 application/x-dbf
#
#0 leshort 0x0006 application/x-dbt
# Debian has entries for the old PGP formats:
# pgp: file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
0 beshort 0x9900 text/PGP key public ring
0 beshort 0x9501 text/PGP key security ring
0 beshort 0x9500 text/PGP key security ring
0 beshort 0xa600 text/PGP encrypted data
0 string -----BEGIN\040PGP text/PGP armored data
>15 string PUBLIC\040KEY\040BLOCK- public key block
>15 string MESSAGE- message
>15 string SIGNED\040MESSAGE- signed message
>15 string PGP\040SIGNATURE- signature
0 beshort 0x8501 data
#
# GnuPG Magic:
#
0 beshort 0x9901 text/GnuPG key public ring
0 beshort 0x8501 text/OpenPGP data
# flash: file(1) magic for Macromedia Flash file format
#
# See
#
# http://www.macromedia.com/software/flash/open/
#
0 string FWS
>3 byte x application/x-shockwave-flash
# The following paramaters are created for Namazu.
# <http://www.namazu.org/>
#
# 1999/08/13
#0 string \<!--\ MHonArc text/html; x-type=mhonarc
0 string BZh application/x-bzip2
# 1999/09/09
# VRML (suggested by Masao Takaku)
0 string #VRML\ V1.0\ ascii model/vrml
0 string #VRML\ V2.0\ utf8 model/vrml
#------------------------------------------------------------------------------
# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
#
# Contributor kenzo-:
# Reversed-engineered JS Ichitaro magic numbers
#
0 string DOC
>43 byte 0x14 application/ichitaro4
>144 string JDASH application/ichitaro4
0 string DOC
>43 byte 0x15 application/ichitaro5
0 string DOC
>43 byte 0x16 application/ichitaro6
#------------------------------------------------------------------------------
# office97: file(1) magic for MicroSoft Office files
#
# Contributor kenzo-:
# Reversed-engineered MS Office magic numbers
#
#0 string \320\317\021\340\241\261\032\341
#>48 byte 0x1B application/excel
2080 string Microsoft\ Excel\ 5.0\ Worksheet application/excel
2114 string Biff5 application/excel
0 string \224\246\056 application/msword
0 belong 0x31be0000 application/msword
0 string PO^Q` application/msword
0 string \320\317\021\340\241\261\032\341
>546 string bjbj application/msword
>546 string jbjb application/msword
512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y application/msword
2080 string Microsoft\ Word\ 6.0\ Document application/msword
2080 string Documento\ Microsoft\ Word\ 6 application/msword
2112 string MSWordDoc application/msword
#0 string \320\317\021\340\241\261\032\341 application/powerpoint
0 string \320\317\021\340\241\261\032\341 application/msword
0 string #\ PaCkAgE\ DaTaStReAm application/x-svr4-package
# WinNT/WinCE PE files (Warner Losh, imp@village.org)
#
128 string PE\000\000 application/octet-stream
0 string PE\000\000 application/octet-stream
# miscellaneous formats
0 string LZ application/octet-stream
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ
>24 string @ application/octet-stream
0 string MZ
>30 string Copyright\ 1989-1990\ PKWARE\ Inc. application/x-zip
0 string MZ
>30 string PKLITE\ Copr. application/x-zip
0 string MZ
>36 string LHa's\ SFX application/x-lha
0 string MZ application/octet-stream
# LHA archiver
2 string -lh
>6 string - application/x-lha
# Zoo archiver
20 lelong 0xfdc4a7dc application/x-zoo
# ARC archiver
0 lelong&0x8080ffff 0x0000081a application/x-arc
0 lelong&0x8080ffff 0x0000091a application/x-arc
0 lelong&0x8080ffff 0x0000021a application/x-arc
0 lelong&0x8080ffff 0x0000031a application/x-arc
0 lelong&0x8080ffff 0x0000041a application/x-arc
0 lelong&0x8080ffff 0x0000061a application/x-arc
# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
0 lelong 0x223e9f78 application/ms-tnef
#
# QuickTime format
# Contributer: Peter Breton
#
0 string MOVI video/quicktime
4 string moov video/quicktime
4 string mdat video/quicktime
# Video Formate
0 string RIFF
# AVI == Audio Video Interleave
>8 string AVI\
#>0xbc string >\0 video/x-%s
>>0xbc string DIV3 video/x-DivX-3
>>0xbc string div3 video/x-divX-3
>>0xbc string DIV4 video/x-DivX-4
>>0x70 string DX50 video/x-DIVX-5
>>0x70 string MP4 video/x-MPEG-4
>>0xbc string DIVX video/x-DivX
>8 string WAVE audio/x-wav

View File

@ -12,4 +12,4 @@ libmagic_la_SOURCES = magic.c apprentice.c softmagic.c ascmagic.c \
libmagic_la_LDFLAGS = -version-info 1:0:0
file_SOURCES = file.c
file_LDFLAGS = -lmagic
file_LDADD = libmagic.la

View File

@ -1,4 +1,4 @@
/* $NetBSD: apptype.c,v 1.1.1.3 2003/10/27 16:14:21 pooka Exp $ */
/* $NetBSD: apptype.c,v 1.1.1.4 2004/03/23 08:31:41 pooka Exp $ */
/*
* Adapted from: apptype.c, Written by Eberhard Mattes and put into the
@ -26,17 +26,18 @@
*
*/
#include "file.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "file.h"
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: apptype.c,v 1.5 2003/10/14 19:29:55 christos Exp")
FILE_RCSID("@(#)Id: apptype.c,v 1.6 2003/11/11 20:01:45 christos Exp")
#else
__RCSID("$NetBSD: apptype.c,v 1.1.1.3 2003/10/27 16:14:21 pooka Exp $");
__RCSID("$NetBSD: apptype.c,v 1.1.1.4 2004/03/23 08:31:41 pooka Exp $");
#endif
#endif /* lint */

View File

@ -1,4 +1,4 @@
/* $NetBSD: ascmagic.c,v 1.1.1.2 2003/05/25 21:27:41 pooka Exp $ */
/* $NetBSD: ascmagic.c,v 1.1.1.3 2004/03/23 08:31:42 pooka Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -43,8 +43,8 @@
* international characters, now subsumed into this file.
*/
#include "magic.h"
#include "file.h"
#include "magic.h"
#include <stdio.h>
#include <string.h>
#include <memory.h>
@ -57,9 +57,9 @@
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: ascmagic.c,v 1.38 2003/05/23 21:31:58 christos Exp")
FILE_RCSID("@(#)Id: ascmagic.c,v 1.40 2003/11/20 00:25:39 christos Exp")
#else
__RCSID("$NetBSD: ascmagic.c,v 1.1.1.2 2003/05/25 21:27:41 pooka Exp $");
__RCSID("$NetBSD: ascmagic.c,v 1.1.1.3 2004/03/23 08:31:42 pooka Exp $");
#endif
#endif /* lint */
@ -176,8 +176,10 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes)
while (ISSPC(*tp))
++tp; /* skip leading whitespace */
if ((tp[0] == '\\' && tp[1] == '\"') ||
(isascii(tp[0]) && isalnum(tp[0]) &&
isascii(tp[1]) && isalnum(tp[1]) &&
(isascii((unsigned char)tp[0]) &&
isalnum((unsigned char)tp[0]) &&
isascii((unsigned char)tp[1]) &&
isalnum((unsigned char)tp[1]) &&
ISSPC(tp[2]))) {
subtype_mime = "text/troff";
subtype = "troff or preprocessor input";

View File

@ -1,4 +1,4 @@
/* $NetBSD: compress.c,v 1.1.1.3 2003/10/27 16:14:21 pooka Exp $ */
/* $NetBSD: compress.c,v 1.1.1.4 2004/03/23 08:31:42 pooka Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -39,8 +39,8 @@
* uncompress(method, old, n, newch) - uncompress old into new,
* using method, return sizeof new
*/
#include "magic.h"
#include "file.h"
#include "magic.h"
#include <stdio.h>
#include <stdlib.h>
#ifdef HAVE_UNISTD_H
@ -59,9 +59,9 @@
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: compress.c,v 1.34 2003/10/14 19:29:55 christos Exp")
FILE_RCSID("@(#)Id: compress.c,v 1.36 2004/03/22 19:11:54 christos Exp")
#else
__RCSID("$NetBSD: compress.c,v 1.1.1.3 2003/10/27 16:14:21 pooka Exp $");
__RCSID("$NetBSD: compress.c,v 1.1.1.4 2004/03/23 08:31:42 pooka Exp $");
#endif
#endif
@ -363,9 +363,21 @@ uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old,
default: /* parent */
(void) close(fdin[0]);
(void) close(fdout[1]);
if (swrite(fdin[1], old, n) != (ssize_t)n) {
n = 0;
goto err;
/* fork again, to avoid blocking because both pipes filled */
switch (fork()) {
case 0: /* child */
(void)close(fdout[0]);
if (swrite(fdin[1], old, n) != n)
exit(1);
exit(0);
/*NOTREACHED*/
case -1:
exit(1);
/*NOTREACHED*/
default: /* parent */
break;
}
(void) close(fdin[1]);
fdin[1] = -1;
@ -375,7 +387,8 @@ uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old,
}
if ((r = sread(fdout[0], *newch, HOWMANY)) <= 0) {
free(*newch);
r = 0;
n = 0;
newch[0] = '\0';
goto err;
} else {
n = r;
@ -386,7 +399,12 @@ err:
if (fdin[1] != -1)
(void) close(fdin[1]);
(void) close(fdout[0]);
(void) wait(NULL);
#ifdef WNOHANG
while (waitpid(-1, NULL, WNOHANG) != -1)
continue;
#else
(void)wait(NULL);
#endif
return n;
}
}

11
dist/file/src/funcs.c vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: funcs.c,v 1.1.1.4 2003/10/27 16:14:22 pooka Exp $ */
/* $NetBSD: funcs.c,v 1.1.1.5 2004/03/23 08:31:43 pooka Exp $ */
/*
* Copyright (c) Christos Zoulas 2003.
@ -28,13 +28,20 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include "magic.h"
#include "file.h"
#include "magic.h"
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: funcs.c,v 1.11 2003/11/11 20:01:46 christos Exp")
#else
__RCSID("$NetBSD: funcs.c,v 1.1.1.5 2004/03/23 08:31:43 pooka Exp $");
#endif
#endif /* lint */
/*
* Like printf, only we print to a buffer and advance it.
*/

View File

@ -1,4 +1,4 @@
/* $NetBSD: is_tar.c,v 1.1.1.3 2003/10/27 16:14:22 pooka Exp $ */
/* $NetBSD: is_tar.c,v 1.1.1.4 2004/03/23 08:31:43 pooka Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -44,8 +44,8 @@
* for file command by Ian Darwin.
*/
#include "magic.h"
#include "file.h"
#include "magic.h"
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
@ -53,9 +53,9 @@
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: is_tar.c,v 1.23 2003/10/14 19:29:55 christos Exp")
FILE_RCSID("@(#)Id: is_tar.c,v 1.24 2003/11/11 20:01:46 christos Exp")
#else
__RCSID("$NetBSD: is_tar.c,v 1.1.1.3 2003/10/27 16:14:22 pooka Exp $");
__RCSID("$NetBSD: is_tar.c,v 1.1.1.4 2004/03/23 08:31:43 pooka Exp $");
#endif
#endif

View File

@ -1,4 +1,4 @@
/* $NetBSD: names.h,v 1.1.1.2 2003/10/27 16:14:23 pooka Exp $ */
/* $NetBSD: names.h,v 1.1.1.3 2004/03/23 08:31:43 pooka Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -39,7 +39,7 @@
* appear at fixed offsets into the file. Don't make HOWMANY
* too high unless you have a very fast CPU.
*
* Id: names.h,v 1.23 2003/10/14 19:29:55 christos Exp
* Id: names.h,v 1.24 2004/03/22 19:09:12 christos Exp
*/
/*
@ -62,6 +62,7 @@
#define L_HTML 11 /* HTML */
#define L_BCPL 12 /* BCPL */
#define L_M4 13 /* M4 */
#define L_PO 14 /* PO */
static const struct {
const char *human;
@ -73,7 +74,7 @@ static const struct {
{ "make commands", "text/x-makefile" },
{ "PL/1 program", "text/x-pl1" },
{ "assembler program", "text/x-asm" },
{ "English", "text/plain, English" },
{ "English", "text/plain" },
{ "Pascal program", "text/x-pascal" },
{ "mail", "text/x-mail" },
{ "news", "text/x-news" },
@ -81,6 +82,7 @@ static const struct {
{ "HTML document", "text/html", },
{ "BCPL program", "text/x-bcpl" },
{ "M4 macro language pre-processor", "text/x-m4" },
{ "PO (gettext message catalogue)", "text/x-po" },
{ "cannot happen error on names.h/types", "error/x-error" },
{ 0, 0}
};
@ -127,6 +129,7 @@ static struct names {
} names[] = {
/* These must be sorted by eye for optimal hit rate */
/* Add to this list only after substantial meditation */
{"msgid", L_PO},
{"dnl", L_M4},
{"import", L_JAVA},
{"\"libhdr\"", L_BCPL},

View File

@ -1,13 +1,19 @@
/* $NetBSD: patchlevel.h,v 1.1.1.4 2003/10/27 16:14:23 pooka Exp $ */
/* $NetBSD: patchlevel.h,v 1.1.1.5 2004/03/23 08:31:43 pooka Exp $ */
#define FILE_VERSION_MAJOR 4
#define patchlevel 6
#define patchlevel 8
/*
* Patchlevel file for Ian Darwin's MAGIC command.
* Id: patchlevel.h,v 1.49 2003/10/15 02:08:27 christos Exp
* Id: patchlevel.h,v 1.51 2004/03/22 21:17:11 christos Exp
*
* Log: patchlevel.h,v
* Revision 1.51 2004/03/22 21:17:11 christos
* welcome to 4.08.
*
* Revision 1.50 2003/12/23 17:34:04 christos
* 4.07
*
* Revision 1.49 2003/10/15 02:08:27 christos
* welcome to 4.06
*

View File

@ -1,4 +1,4 @@
/* $NetBSD: softmagic.c,v 1.1.1.4 2003/10/27 16:14:25 pooka Exp $ */
/* $NetBSD: softmagic.c,v 1.1.1.5 2004/03/23 08:31:45 pooka Exp $ */
/*
* Copyright (c) Ian F. Darwin 1986-1995.
@ -47,9 +47,9 @@
#ifndef lint
#if 0
FILE_RCSID("@(#)Id: softmagic.c,v 1.63 2003/10/15 01:51:24 christos Exp")
FILE_RCSID("@(#)Id: softmagic.c,v 1.65 2004/03/09 18:49:58 christos Exp")
#else
__RCSID("$NetBSD: softmagic.c,v 1.1.1.4 2003/10/27 16:14:25 pooka Exp $");
__RCSID("$NetBSD: softmagic.c,v 1.1.1.5 2004/03/23 08:31:45 pooka Exp $");
#endif
#endif /* lint */
@ -139,7 +139,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
* main entry didn't match,
* flush its continuations
*/
while (magindex < nmagic &&
while (magindex < nmagic - 1 &&
magic[magindex + 1].cont_level != 0)
magindex++;
continue;
@ -1118,6 +1118,7 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
return -1;
} else {
rc = regexec(&rx, p->buf, 0, 0, 0);
regfree(&rx);
free(p->buf);
return !rc;
}