diff options
Diffstat (limited to 'magic.man')
| -rw-r--r-- | magic.man | 104 |
1 files changed, 74 insertions, 30 deletions
diff --git a/magic.man b/magic.man index fb334bc9cfc92..c648ba783ab6d 100644 --- a/magic.man +++ b/magic.man @@ -1,5 +1,5 @@ -.\" $File: magic.man,v 1.59 2008/11/06 23:22:53 christos Exp $ -.Dd August 30, 2008 +.\" $File: magic.man,v 1.69 2011/05/13 22:11:44 christos Exp $ +.Dd April 20, 2011 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -51,9 +51,9 @@ A 64-bit double precision IEEE floating point number in this machine's native by .It Dv string A string of bytes. The string type specification can be optionally followed -by /[Bbc]*. +by /[WwcCtb]*. The -.Dq B +.Dq W flag compacts whitespace in the target, which must contain at least one whitespace character. If the magic has @@ -62,18 +62,55 @@ consecutive blanks, the target needs at least .Dv n consecutive blanks to match. The -.Dq b +.Dq w flag treats every blank in the target as an optional blank. -Finally the +The .Dq c -flag, specifies case insensitive matching: lowercase +flag, specifies case insensitive matching: lower case characters in the magic match both lower and upper case characters in the -target, whereas upper case characters in the magic only match uppercase +target, whereas upper case characters in the magic only match upper case characters in the target. +The +.Dq C +flag, specifies case insensitive matching: upper case +characters in the magic match both lower and upper case characters in the +target, whereas lower case characters in the magic only match upper case +characters in the target. +To do a complete case insensitive match, specify both +.Dq c +and +.Dq C . +The +.Dq t +flag, forces the test to be done for text files, while the +.Dq b +flag, forces the test to be done for binary files. .It Dv pstring -A Pascal-style string where the first byte is interpreted as the an +A Pascal-style string where the first byte/short/int is interpreted as the an unsigned length. +The length defaults to byte and can be specified as a modifier. +The following modifiers are supported: +.Bl -tag -compact -width B +.It B +A byte length (default). +.It H +A 2 byte big endian length. +.It h +A 2 byte big little length. +.It L +A 4 byte big endian length. +.It l +A 4 byte big little length. +.It J +The length includes itself in its count. +.El The string is not NUL terminated. +.Dq J +is used rather than the more +valuable +.Dq I +because this type of length is a feature of the JPEG +format. .It Dv date A four-byte value interpreted as a UNIX date. .It Dv qdate @@ -153,11 +190,12 @@ than UTC. Starting at the given offset, consult the magic database again. .It Dv regex A regular expression match in extended POSIX regular expression syntax -(like egrep). Regular expressions can take exponential time to -process, and their performance is hard to predict, so their use is -discouraged. When used in production environments, their performance -should be carefully checked. The type specification can be optionally -followed by +(like egrep). +Regular expressions can take exponential time to process, and their +performance is hard to predict, so their use is discouraged. +When used in production environments, their performance +should be carefully checked. +The type specification can be optionally followed by .Dv /[c][s] . The .Dq c @@ -176,15 +214,17 @@ and match the beginning and end of individual lines, respectively, not beginning and end of file. .It Dv search -A literal string search starting at the given offset. The same -modifier flags can be used as for string patterns. The modifier flags -(if any) must be followed by +A literal string search starting at the given offset. +The same modifier flags can be used as for string patterns. +The modifier flags (if any) must be followed by .Dv /number the range, that is, the number of positions at which the match will be -attempted, starting from the start offset. This is suitable for +attempted, starting from the start offset. +This is suitable for searching larger binary expressions with variable offsets, using .Dv \e -escapes for special characters. The offset works as for regex. +escapes for special characters. +The offset works as for regex. .It Dv default This is intended to be used with the test .Em x @@ -193,14 +233,18 @@ no other matches. .El .Pp Each top-level magic pattern (see below for an explanation of levels) -is classified as text or binary according to the types used. Types +is classified as text or binary according to the types used. +Types .Dq regex and .Dq search are classified as text tests, unless non-printable characters are used -in the pattern. All other tests are classified as binary. A top-level +in the pattern. +All other tests are classified as binary. +A top-level pattern is considered to be a test text when all its patterns are text -patterns; otherwise, it is considered to be a binary pattern. When +patterns; otherwise, it is considered to be a binary pattern. +When matching a file, binary patterns are tried first; if no match is found, and the file looks like text, then its encoding is determined and the text patterns are tried. @@ -283,7 +327,7 @@ then print the string), with The special test .Em x always evaluates to true. -.Dv message +.It Dv message The message to be printed if the comparison succeeds. If the string contains a .Xr printf 3 @@ -297,14 +341,14 @@ space. .El .Pp An APPLE 4+4 character APPLE creator and type can be specified as: -.Bd -literal -offset indent +.Bd -literal -offset indent !:apple CREATYPE .Ed .Pp A MIME type is given on a separate line, which must be the next non-blank or comment line after the magic line that identifies the file type, and has the following format: -.Bd -literal -offset indent +.Bd -literal -offset indent !:mime MIMETYPE .Ed .Pp @@ -314,13 +358,13 @@ followed by the MIME type. .Pp An optional strength can be supplied on a separate line which refers to the current magic description using the following format: -.Bd -literal -offset indent +.Bd -literal -offset indent !:strength OP VALUE .Ed .Pp The operand .Dv OP -can be: +can be: .Dv + , .Dv - , .Dv * , @@ -344,11 +388,11 @@ on the line indicates the level of the test; a line with no .Em \*[Gt] at the beginning is considered to be at level 0. Tests are arranged in a tree-like hierarchy: -If a the test on a line at level +if the test on a line at level .Em n succeeds, all following tests at level .Em n+1 -are performed, and the messages printed if the tests succeed, untile a line +are performed, and the messages printed if the tests succeed, until a line with level .Em n (or less) appears. @@ -365,7 +409,7 @@ being examined. If the first character following the last .Em \*[Gt] is a -.Em ( +.Em \&( then the string after the parenthesis is interpreted as an indirect offset. That means that the number after the parenthesis is used as an offset in the file. |