diff options
| author | Mike Pritchard <mpp@FreeBSD.org> | 1997-03-18 18:00:03 +0000 |
|---|---|---|
| committer | Mike Pritchard <mpp@FreeBSD.org> | 1997-03-18 18:00:03 +0000 |
| commit | 094f1e246b7f57c4b0ef697463626598a9f096b2 (patch) | |
| tree | 242f53c3de28b074fc8111bd3719097383a78279 | |
| parent | 8356464a861a6f4246dd1be789103f9591135aa8 (diff) | |
| download | src-094f1e246b7f57c4b0ef697463626598a9f096b2.tar.gz src-094f1e246b7f57c4b0ef697463626598a9f096b2.zip | |
Upgrade to file version 3.22.
Obtained from: ftp://ftp.deshaw.com/pub/file/file-3.22.tar.gz
Notes
Notes:
svn path=/vendor/file/dist/; revision=23988
52 files changed, 1714 insertions, 307 deletions
diff --git a/usr.bin/file/Magdir/alpha b/usr.bin/file/Magdir/alpha new file mode 100644 index 000000000000..42e19176c98a --- /dev/null +++ b/usr.bin/file/Magdir/alpha @@ -0,0 +1,21 @@ +#------------------------------------------------------------------------------ +# alpha architecture description +# + +0 leshort 0603 COFF format alpha +>22 leshort&030000 !020000 executable +>24 leshort 0410 pure +>24 leshort 0413 paged +>22 leshort&020000 !0 dynamically linked +>16 lelong !0 not stripped +>16 lelong 0 stripped +>22 leshort&030000 020000 shared library +>24 leshort 0407 object +>27 byte x - version %d +>26 byte x .%d +>28 byte x -%d + +# Basic recognition of OSF/1 core dumps - Mike Bremford <mike@opac.bl.uk> +# +0 string Core\001 COFF format core dump (OSF/1) +>24 string >\0 generated by '%s' diff --git a/usr.bin/file/Magdir/amanda b/usr.bin/file/Magdir/amanda new file mode 100644 index 000000000000..57c4359fc169 --- /dev/null +++ b/usr.bin/file/Magdir/amanda @@ -0,0 +1,7 @@ +#------------------------------------------------------------------------------ +# amanda: file(1) magic for amanda file format +# +0 string AMANDA:\ TAPESTART\ DATE AMANDA dump header file, +>23 string X +>>25 string >\ Unused %s +>23 string >\ DATE %s diff --git a/usr.bin/file/Magdir/amigaos b/usr.bin/file/Magdir/amigaos new file mode 100644 index 000000000000..6073936e17bd --- /dev/null +++ b/usr.bin/file/Magdir/amigaos @@ -0,0 +1,10 @@ +#------------------------------------------------------------------------------ +# amigaos: file(1) magic for AmigaOS binary formats: + +# +# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) +# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG +# (the others should be seperate, anyway) +# +0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary +0 belong 0x000003e7 AmigaOS object/library data diff --git a/usr.bin/file/Magdir/archive b/usr.bin/file/Magdir/archive index bd400815444a..f266b199808c 100644 --- a/usr.bin/file/Magdir/archive +++ b/usr.bin/file/Magdir/archive @@ -45,8 +45,6 @@ >19 string B and an EB hash table >22 string X -- out of date -0 string !<arch> archive ->8 string __.SYMDEF random library 0 string -h- Software Tools format archive text # @@ -56,11 +54,10 @@ # 0 string !<arch> current ar archive # 0 long 0x213c6172 archive file # -# and for SVR3.1 archives, we have: +# and for SVR1 archives, we have: # # 0 string \<ar> System V Release 1 ar archive # 0 string =<ar> archive -# 0 string =<ar> archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style @@ -68,6 +65,8 @@ # 0 string !<arch> current ar archive >8 string __.SYMDEF random library +>8 string debian-split part of multipart Debian package +>8 string debian-binary Debian binary package >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive @@ -96,14 +95,10 @@ 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # -0 string =<ar> archive -# -# From "pdp": +# From "pdp" (but why a 4-byte quantity?) # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive -# -0 string -h- Software Tools format archive text # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # diff --git a/usr.bin/file/Magdir/asterix b/usr.bin/file/Magdir/asterix new file mode 100644 index 000000000000..d89504a2407f --- /dev/null +++ b/usr.bin/file/Magdir/asterix @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character +# strings as "long" - we assume they're just strings: +# From: guy@netapp.com (Guy Harris) +# +0 string *STA Aster*x +>7 string WORD Words Document +>7 string GRAP Graphic +>7 string SPRE Spreadsheet +>7 string MACR Macro +0 string 2278 Aster*x Version 2 +>29 byte 0x36 Words Document +>29 byte 0x35 Graphic +>29 byte 0x32 Spreadsheet +>29 byte 0x38 Macro + diff --git a/usr.bin/file/Magdir/audio b/usr.bin/file/Magdir/audio index 4dc9dddd6614..a370dc2ae3a1 100644 --- a/usr.bin/file/Magdir/audio +++ b/usr.bin/file/Magdir/audio @@ -16,6 +16,10 @@ >12 belong 6 32-bit IEEE floating point, >12 belong 7 64-bit IEEE floating point, >12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), +>12 belong 24 compressed (8-bit G.722 ADPCM) +>12 belong 25 compressed (3-bit G.723 ADPCM), +>12 belong 26 compressed (5-bit G.723 ADPCM), +>12 belong 27 8-bit A-law, >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, @@ -54,14 +58,15 @@ >4 belong x - version %ld # Microsoft WAVE format (*.wav) -# [GRR 950115: probably all of the shorts and longs should be leshort/lelong] 0 string RIFF Microsoft RIFF >8 string WAVE \b, WAVE audio data ->34 short >0 \b, %d bit ->22 short =1 \b, mono ->22 short =2 \b, stereo ->22 short >2 \b, %d channels ->24 long >0 %d Hz +>>34 leshort >0 \b, %d bit +>>22 leshort =1 \b, mono +>>22 leshort =2 \b, stereo +>>22 leshort >2 \b, %d channels +>>24 lelong >0 %d Hz +# AVI == Audio Video Interleave +>8 string AVI\ \b, AVI data # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] @@ -71,3 +76,15 @@ >45 byte x %d instruments >83 byte 0 (module) >83 byte 1 (song) + +# Real Audio (Magic .ra\0375) +0 belong 0x2e7261fd realaudio sound file + +# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] +# Oct 31, 1995 +0 string MTM MultiTracker Module sound file +0 string if Composer 669 Module sound data +0 string FAR Module sound data +0 string MAS_U ULT(imate) Module sound data +0x2c string SCRM ScreamTracker III Module sound data +0 string Extended Module Extended Module sound data diff --git a/usr.bin/file/Magdir/bsdi b/usr.bin/file/Magdir/bsdi index faf0a6039272..2e3b646f6bd0 100644 --- a/usr.bin/file/Magdir/bsdi +++ b/usr.bin/file/Magdir/bsdi @@ -1,2 +1,7 @@ -# BSDI BSD/386 -0 long 0314 BSD/386 demand paged (first page unmapped) pure executable + +#------------------------------------------------------------------------------ +# bsdi: file(1) magic for BSD/OS (from BSDI) objects +# +0 lelong 000000314 BSD/OS i386 compact demand paged executable +>16 lelong >0 not stripped +>32 byte 0x6a (uses shared libs) diff --git a/usr.bin/file/Magdir/compress b/usr.bin/file/Magdir/compress index 2cf8d195f594..a797f8fff5d8 100644 --- a/usr.bin/file/Magdir/compress +++ b/usr.bin/file/Magdir/compress @@ -79,8 +79,14 @@ # # This will cause very short GSM files to be declared as data and # mismatches to be declared as data too! -#0 byte&0xF0 0xd0 data +#0 byte&0xF0 0xd0 data #>33 byte&0xF0 0xd0 #>66 byte&0xF0 0xd0 #>99 byte&0xF0 0xd0 -#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio +#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio + +# Bzip from ulmo@Q.Net +0 string BZ bzip compressed data, +>2 byte x format v. %c, +>3 byte x block size indicator %c + diff --git a/usr.bin/file/Magdir/convex b/usr.bin/file/Magdir/convex index 14ed86742da2..b1235d7e79a8 100644 --- a/usr.bin/file/Magdir/convex +++ b/usr.bin/file/Magdir/convex @@ -1,7 +1,69 @@ - #------------------------------------------------------------------------------ # convex: file(1) magic for Convex boxes # # Convexes are big-endian. # -0 long 0513 Convex executable +# /*\ +# * Below are the magic numbers and tests added for Convex. +# * Added at beginning, because they are expected to be used most. +# \*/ +0 belong 0507 Convex old-style object +>16 belong >0 not stripped +0 belong 0513 Convex old-style demand paged executable +>16 belong >0 not stripped +0 belong 0515 Convex old-style pre-paged executable +>16 belong >0 not stripped +0 belong 0517 Convex old-style pre-paged, non-swapped executable +>16 belong >0 not stripped +0 belong 0x011257 Core file +# +# The following are a series of dump format magic numbers. Each one +# corresponds to a drastically different dump format. The first on is +# the original dump format on a 4.1 BSD or earlier file system. The +# second marks the change between the 4.1 file system and the 4.2 file +# system. The Third marks the changing of the block size from 1K +# to 2K to be compatible with an IDC file system. The fourth indicates +# a dump that is dependent on Convex Storage Manager, because data in +# secondary storage is not physically contained within the dump. +# The restore program uses these number to determine how the data is +# to be extracted. +# +24 belong =60011 dump format, 4.1 BSD or earlier +24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC +24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) +24 belong =60014 dump format, Convex Storage Manager by-reference dump +# +# what follows is a bunch of bit-mask checks on the flags field of the opthdr. +# If there is no `=' sign, assume just checking for whether the bit is set? +# +0 belong 0601 Convex SOFF +>88 belong&0x000f0000 =0x00000000 c1 +>88 belong &0x00010000 c2 +>88 belong &0x00020000 c2mp +>88 belong &0x00040000 parallel +>88 belong &0x00080000 intrinsic +>88 belong &0x00000001 demand paged +>88 belong &0x00000002 pre-paged +>88 belong &0x00000004 non-swapped +>88 belong &0x00000008 POSIX +# +>84 belong &0x80000000 executable +>84 belong &0x40000000 object +>84 belong&0x20000000 =0 not stripped +>84 belong&0x18000000 =0x00000000 native fpmode +>84 belong&0x18000000 =0x10000000 ieee fpmode +>84 belong&0x18000000 =0x18000000 undefined fpmode +# +0 belong 0605 Convex SOFF core +# +0 belong 0607 Convex SOFF checkpoint +>88 belong&0x000f0000 =0x00000000 c1 +>88 belong &0x00010000 c2 +>88 belong &0x00020000 c2mp +>88 belong &0x00040000 parallel +>88 belong &0x00080000 intrinsic +>88 belong &0x00000008 POSIX +# +>84 belong&0x18000000 =0x00000000 native fpmode +>84 belong&0x18000000 =0x10000000 ieee fpmode +>84 belong&0x18000000 =0x18000000 undefined fpmode diff --git a/usr.bin/file/Magdir/database b/usr.bin/file/Magdir/database index 692ce6b31536..146c3108e1ed 100644 --- a/usr.bin/file/Magdir/database +++ b/usr.bin/file/Magdir/database @@ -17,16 +17,18 @@ >8 belong 1234 Little Endian, >8 belong 4321 Big Endian, >12 belong x Bucket Size %d, ->16 belong x Directory Size %d, ->20 belong x Segment Size %d, ->24 belong x Segment Shift %d, ->28 belong x Overflow Point %d, ->32 belong x Last Freed %d, ->36 belong x Max Bucket %d, ->40 belong x High Mask 0x%x, ->44 belong x Low Mask 0x%x, ->48 belong x Fill Factor %d, ->52 belong x Number of Keys %d) +>16 belong x Bucket Shift %d, +>20 belong x Directory Size %d, +>24 belong x Segment Size %d, +>28 belong x Segment Shift %d, +>32 belong x Overflow Point %d, +>36 belong x Last Freed %d, +>40 belong x Max Bucket %d, +>44 belong x High Mask 0x%x, +>48 belong x Low Mask 0x%x, +>52 belong x Fill Factor %d, +>56 belong x Number of Keys %d) +# # 0 belong 0x053162 Berkeley DB Btree file >4 belong >0 (Version %d, diff --git a/usr.bin/file/Magdir/digital b/usr.bin/file/Magdir/digital new file mode 100644 index 000000000000..f4ebbff985bd --- /dev/null +++ b/usr.bin/file/Magdir/digital @@ -0,0 +1,41 @@ +# Digital UNIX - Info +# +0 string ^!<arch>\n_______64E Alpha archive +>22 string X -- out of date +# +# Alpha COFF Based Executables +# The stripped stuff really needs to be an 8 byte (64 bit) compare, +# but this works +0 leshort 0x183 COFF format alpha +>22 leshort&020000 &010000 sharable library, +>22 leshort&020000 ^010000 dynamically linked, +>24 leshort 0410 pure +>24 leshort 0413 demand paged +>8 lelong >0 executable or object module, not stripped +>8 lelong 0 +>>12 lelong 0 executable or object module, stripped +>>12 lelong >0 executable or object module, not stripped +>27 byte >0 - version %d. +>26 byte >0 %d- +>28 leshort >0 %d +# +# The next is incomplete, we could tell more about this format, +# but its not worth it. +0 leshort 0x188 Alpha compressed COFF +0 leshort 0x18f Alpha u-code object +# +# +# Some other interesting Digital formats, +0 string \377\377\177 ddis/ddif +0 string \377\377\174 ddis/dots archive +0 string \377\377\176 ddis/dtif table data +0 string \033c\033 LN03 output +0 long 04553207 X image +# +0 string !<PDF>!\n profiling data file +# +# Locale data tables (MIPS and Alpha). +# +0 short 0x0501 locale data table +>6 short 0x24 for MIPS +>6 short 0x40 for Alpha diff --git a/usr.bin/file/Magdir/dump b/usr.bin/file/Magdir/dump index 955275b8c74f..628ead86c613 100644 --- a/usr.bin/file/Magdir/dump +++ b/usr.bin/file/Magdir/dump @@ -43,8 +43,8 @@ >888 belong >0 Flags %x 24 lelong 60012 new-fs dump file (little endian), ->4 ledate x Previous dump %s, ->8 ledate x This dump %s, +>4 ledate x This dump %s, +>8 ledate x Previous dump %s, >12 lelong >0 Volume %ld, >692 lelong 0 Level zero, type: >692 lelong >0 Level %d, type: diff --git a/usr.bin/file/Magdir/elf b/usr.bin/file/Magdir/elf index f99712feba66..82636f93dafc 100644 --- a/usr.bin/file/Magdir/elf +++ b/usr.bin/file/Magdir/elf @@ -5,8 +5,8 @@ # We have to check the byte order flag to see what byte order all the # other stuff in the header is in. # -# Byte order is probably big-endian for MIPS RS3000 and Amdahl. # MIPS RS3000 may also be for MIPS RS2000. +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? # # updated by Daniel Quinlan (quinlan@yggdrasil.com) 0 string \177ELF ELF @@ -19,7 +19,9 @@ >>16 leshort 1 relocatable, >>16 leshort 2 executable, >>16 leshort 3 shared object, ->>16 leshort 4 core file, +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> +>>16 leshort 4 core file +>>>400 lelong >0 (signal %d), >>16 leshort &0xff00 processor-specific, >>18 leshort 0 no machine, >>18 leshort 1 AT&T WE32100 - invalid byte order, @@ -29,8 +31,16 @@ >>18 leshort 5 Motorola 88000 - invalid byte order, >>18 leshort 6 Intel 80486, >>18 leshort 7 Intel 80860, ->>18 leshort 8 MIPS RS3000, ->>18 leshort 9 Amdahl, +>>18 leshort 8 MIPS RS3000_BE - invalid byte order, +>>18 leshort 9 Amdahl - invalid byte order, +>>18 leshort 10 MIPS RS3000_LE, +>>18 leshort 11 RS6000 - invalid byte order, +>>18 leshort 15 PA_RISC - invalid byte order, +>>18 leshort 16 nCUBE, +>>18 leshort 17 VPP500, +>>18 leshort 18 SPARC32PLUS, +>>18 leshort 20 PowerPC, +>>18 leshort 0x9026 Alpha, >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required @@ -40,6 +50,7 @@ >>16 beshort 2 executable, >>16 beshort 3 shared object, >>16 beshort 4 core file, +>>>400 lelong >0 (signal %d), >>16 beshort &0xff00 processor-specific, >>18 beshort 0 no machine, >>18 beshort 1 AT&T WE32100, @@ -49,8 +60,16 @@ >>18 beshort 5 Motorola 88000, >>18 beshort 6 Intel 80486 - invalid byte order, >>18 beshort 7 Intel 80860, ->>18 beshort 8 MIPS RS3000, ->>18 leshort 9 Amdahl, +>>18 beshort 8 MIPS RS3000_BE, +>>18 beshort 9 Amdahl, +>>18 beshort 10 MIPS RS3000_LE - invalid byte order, +>>18 beshort 11 RS6000, +>>18 beshort 15 PA_RISC, +>>18 beshort 16 nCUBE, +>>18 beshort 17 VPP500, +>>18 beshort 18 SPARC32PLUS, +>>18 beshort 20 PowerPC, +>>18 beshort 0x9026 Alpha, >>20 belong 0 invalid version >>20 belong 1 version 1 >>36 belong 1 MathCoPro/FPU/MAU Required diff --git a/usr.bin/file/Magdir/freebsd b/usr.bin/file/Magdir/freebsd new file mode 100644 index 000000000000..2370c257841e --- /dev/null +++ b/usr.bin/file/Magdir/freebsd @@ -0,0 +1,130 @@ + +#------------------------------------------------------------------------------ +# freebsd: file(1) magic for FreeBSD objects +# +# All new-style FreeBSD magic numbers are in host byte order (i.e., +# little-endian on x86). +# +# XXX - this comes from the file "freebsd" in a recent FreeBSD version of +# "file"; it, and the NetBSD stuff in "netbsd", appear to use different +# schemes for distinguishing between executable images, shared libraries, +# and object files. +# +# FreeBSD says: +# +# Regardless of whether it's pure, demand-paged, or none of the +# above: +# +# if the entry point is < 4096, then it's a shared library if +# the "has run-time loader information" bit is set, and is +# position-independent if the "is position-independent" bit +# is set; +# +# if the entry point is >= 4096 (or >4095, same thing), then it's +# an executable, and is dynamically-linked if the "has run-time +# loader information" bit is set. +# +# On x86, NetBSD says: +# +# If it's neither pure nor demand-paged: +# +# if it has the "has run-time loader information" bit set, it's +# a dynamically-linked executable; +# +# if it doesn't have that bit set, then: +# +# if it has the "is position-independent" bit set, it's +# position-independent; +# +# if the entry point is non-zero, it's an executable, otherwise +# it's an object file. +# +# If it's pure: +# +# if it has the "has run-time loader information" bit set, it's +# a dynamically-linked executable, otherwise it's just an +# executable. +# +# If it's demand-paged: +# +# if it has the "has run-time loader information" bit set, +# then: +# +# if the entry point is < 4096, it's a shared library; +# +# if the entry point is = 4096 or > 4096 (i.e., >= 4096), +# it's a dynamically-linked executable); +# +# if it doesn't have the "has run-time loader information" bit +# set, then it's just an executable. +# +# (On non-x86, NetBSD does much the same thing, except that it uses +# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K +# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's +# had 8K pages; dunno about MIPS.) +# +# I suspect the two will differ only in perverse and uninteresting cases +# ("shared" libraries that aren't demand-paged and whose pages probably +# won't actually be shared, executables with entry points <4096). +# +# I leave it to those more familiar with FreeBSD and NetBSD to figure out +# what the right answer is (although using ">4095", FreeBSD-style, is +# probably better than separately checking for "=4096" and ">4096", +# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged +# executables using the NetBSD technique.) +# +0 lelong&0377777777 041400407 FreeBSD/i386 +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400410 FreeBSD/i386 pure +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400413 FreeBSD/i386 demand paged +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged +>20 lelong <4096 +>>3 byte&0xC0 &0x80 shared library +>>3 byte&0xC0 0x40 PIC object +>>3 byte&0xC0 0x00 object +>20 lelong >4095 +>>3 byte&0x80 0x80 dynamically linked executable +>>3 byte&0x80 0x00 executable +>16 lelong >0 not stripped + +# XXX gross hack to identify core files +# cores start with a struct tss; we take advantage of the following: +# byte 7: highest byte of the kernel stack pointer, always 0xfe +# 8/9: kernel (ring 0) ss value, always 0x0010 +# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 +# 28: low order byte of the current PTD entry, always 0 since the +# PTD is page-aligned +# +7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file +>1039 string >\0 from '%s' + +# /var/run/ld.so.hints +# What are you laughing about? +0 lelong 011421044151 ld.so hints file +>4 lelong >0 (version %d) diff --git a/usr.bin/file/Magdir/hp b/usr.bin/file/Magdir/hp index 82d11306c0a8..e1efdbde82ed 100644 --- a/usr.bin/file/Magdir/hp +++ b/usr.bin/file/Magdir/hp @@ -6,12 +6,6 @@ # applied to the "TML" stuff; I'm assuming the Apollo stuff is # big-endian as it was mostly 68K-based. # -# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I -# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first -# showed up in the 700 series, although later 800 series machines are, -# I think, based on the PA7100 which implements HP-PA 1.1) are flagged -# as big-endian. -# # I think the 500 series was the old stack-based machines, running a # UNIX environment atop the "SUN kernel"; dunno whether it was # big-endian or little-endian. @@ -21,10 +15,23 @@ # HP magic is useful for reference, but using "long" magic is a better # practice in order to avoid collisions. # +# Guy Harris (guy@netapp.com): some additions to this list came from +# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, +# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 +# "/etc/magic", though, except for the "archive file relocatable library" +# stuff, and the 68030 and 68040 stuff isn't there at all - are they not +# used in executables, or have they just not yet updated "/etc/magic" +# completely? +# # 0 beshort 200 hp200 (68010) BSD binary # 0 beshort 300 hp300 (68020+68881) BSD binary # 0 beshort 0x20c hp200/300 HP-UX binary -# 0 beshort 0x20b hp800 HP-UX binary +# 0 beshort 0x20d hp400 (68030) HP-UX binary +# 0 beshort 0x20e hp400 (68040?) HP-UX binary +# 0 beshort 0x20b PA-RISC1.0 HP-UX binary +# 0 beshort 0x210 PA-RISC1.1 HP-UX binary +# 0 beshort 0x211 PA-RISC1.2 HP-UX binary +# 0 beshort 0x214 PA-RISC2.0 HP-UX binary # # The "misc" stuff needs a byte order; the archives look suspiciously @@ -41,49 +48,58 @@ 0 long 01702407010 TML 1032 byte-order format 0 long 01003405017 TML 2301 byte-order format 0 long 01602007412 TML 3210 byte-order format -#### HPPA -0 belong 0x02100106 HPPA-RISC1.1 relocatable object -0 belong 0x02100107 HPPA-RISC1.1 executable +#### PA-RISC +0 belong 0x02100106 PA-RISC1.1 relocatable object +0 belong 0x02100107 PA-RISC1.1 executable +>168 belong &=0x00000004 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x02100108 HPPA-RISC1.1 shared executable +0 belong 0x02100108 PA-RISC1.1 shared executable +>168 belong&0x4 0x4 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x0210010b HPPA-RISC1.1 demand-load executable +0 belong 0x0210010b PA-RISC1.1 demand-load executable +>168 belong&0x4 0x4 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x0210010e HPPA-RISC1.1 shared library +0 belong 0x0210010e PA-RISC1.1 shared library >96 belong >0 - not stripped -0 belong 0x0210010d HPPA-RISC1.1 dynamic load library +0 belong 0x0210010d PA-RISC1.1 dynamic load library >96 belong >0 - not stripped #### 800 -0 belong 0x020b0106 HP s800 relocatable object +0 belong 0x020b0106 PA-RISC1.0 relocatable object -0 belong 0x020b0107 HP s800 executable +0 belong 0x020b0107 PA-RISC1.0 executable +>168 belong&0x4 0x4 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x020b0108 HP s800 shared executable +0 belong 0x020b0108 PA-RISC1.0 shared executable +>168 belong&0x4 0x4 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x020b010b HP s800 demand-load executable +0 belong 0x020b010b PA-RISC1.0 demand-load executable +>168 belong&0x4 0x4 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped -0 belong 0x020b010e HP s800 shared library +0 belong 0x020b010e PA-RISC1.0 shared library >96 belong >0 - not stripped -0 belong 0x020b010d HP s800 dynamic load library +0 belong 0x020b010d PA-RISC1.0 dynamic load library >96 belong >0 - not stripped 0 belong 0x213c6172 archive file ->68 belong 0x020b0619 - HP s800 relocatable library +>68 belong 0x020b0619 - PA-RISC1.0 relocatable library +>68 belong 0x02100619 - PA-RISC1.1 relocatable library +>68 belong 0x02110619 - PA-RISC1.2 relocatable library +>68 belong 0x02140619 - PA-RISC2.0 relocatable library #### 500 0 long 0x02080106 HP s500 relocatable executable @@ -156,7 +172,7 @@ 0 string IMGfile CIS compimg HP Bitmapfile # XXX - see "lif" -0 short 0x8000 lif file +#0 short 0x8000 lif file 0 long 0x020c010c compiled Lisp 0 string msgcat01 HP NLS message catalog, diff --git a/usr.bin/file/Magdir/ibm370 b/usr.bin/file/Magdir/ibm370 index 32d6becd33dd..8cd9da27ae6a 100644 --- a/usr.bin/file/Magdir/ibm370 +++ b/usr.bin/file/Magdir/ibm370 @@ -4,7 +4,35 @@ # # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". # What the heck *is* "USS/370"? +# AIX 4.1's "/etc/magic" has # +# 0 short 0535 370 sysV executable +# >12 long >0 not stripped +# >22 short >0 - version %d +# >30 long >0 - 5.2 format +# 0 short 0530 370 sysV pure executable +# >12 long >0 not stripped +# >22 short >0 - version %d +# >30 long >0 - 5.2 format +# +# instead of the "USS/370" versions of the same magic numbers. +# +0 beshort 0537 370 XA sysV executable +>12 belong >0 not stripped +>22 beshort >0 - version %d +>30 belong >0 - 5.2 format +0 beshort 0532 370 XA sysV pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %d +>30 belong >0 - 5.2 format +0 beshort 054001 370 sysV pure executable +>12 belong >0 not stripped +0 beshort 055001 370 XA sysV pure executable +>12 belong >0 not stripped +0 beshort 056401 370 sysV executable +>12 belong >0 not stripped +0 beshort 057401 370 XA sysV executable +>12 belong >0 not stripped 0 beshort 0531 SVR2 executable (Amdahl-UTS) >12 belong >0 not stripped >24 belong >0 - version %ld diff --git a/usr.bin/file/Magdir/ibm6000 b/usr.bin/file/Magdir/ibm6000 index 7b8e4948cb70..8e1077b9b8c8 100644 --- a/usr.bin/file/Magdir/ibm6000 +++ b/usr.bin/file/Magdir/ibm6000 @@ -12,5 +12,6 @@ 0 beshort 0x0104 shared library 0 beshort 0x0105 ctab data 0 beshort 0xfe04 structured file -0 string 0xabcdef message catalog -#0 string <aiaff> archive +0 string 0xabcdef AIX message catalog +0 belong 0x000001f9 AIX compiled message catalog +0 string \<aiaff> archive diff --git a/usr.bin/file/Magdir/images b/usr.bin/file/Magdir/images index 4ff082489b3a..271b169ca5a9 100644 --- a/usr.bin/file/Magdir/images +++ b/usr.bin/file/Magdir/images @@ -53,14 +53,14 @@ >6 leshort >0 %hd x >8 leshort >0 %hd, #>10 byte &0x80 color mapped, ->10 byte&0x07 =0x00 2 colors ->10 byte&0x07 =0x01 4 colors ->10 byte&0x07 =0x02 8 colors ->10 byte&0x07 =0x03 16 colors ->10 byte&0x07 =0x04 32 colors ->10 byte&0x07 =0x05 64 colors ->10 byte&0x07 =0x06 128 colors ->10 byte&0x07 =0x07 256 colors +#>10 byte&0x07 =0x00 2 colors +#>10 byte&0x07 =0x01 4 colors +#>10 byte&0x07 =0x02 8 colors +#>10 byte&0x07 =0x03 16 colors +#>10 byte&0x07 =0x04 32 colors +#>10 byte&0x07 =0x05 64 colors +#>10 byte&0x07 =0x06 128 colors +#>10 byte&0x07 =0x07 256 colors # ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, # 1 plane, no encoding. @@ -116,6 +116,13 @@ >29 byte 1 \b, fine resolution (204x196 DPI) # JPEG images +# SunOS 5.5.1 had +# +# 0 string \377\330\377\340 JPEG file +# 0 string \377\330\377\356 JPG file +# +# both of which turn into "JPEG image data" here. +# 0 beshort 0xffd8 JPEG image data >6 string JFIF \b, JFIF standard # HSI is Handmade Software's proprietary JPEG encoding scheme @@ -222,3 +229,8 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 0 string !! Bennet Yee's "face" format + +# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image +# stuff. +# +0 beshort 0x1010 PEX Binary Archive diff --git a/usr.bin/file/Magdir/island b/usr.bin/file/Magdir/island new file mode 100644 index 000000000000..9903cddf9217 --- /dev/null +++ b/usr.bin/file/Magdir/island @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 +# "/etc/magic": +# From: guy@netapp.com (Guy Harris) +# +4 string pgscriptver IslandWrite document +13 string DrawFile IslandDraw document + diff --git a/usr.bin/file/Magdir/java b/usr.bin/file/Magdir/java new file mode 100644 index 000000000000..51bbccccade0 --- /dev/null +++ b/usr.bin/file/Magdir/java @@ -0,0 +1,5 @@ +#------------------------------------------------------------ +# Java ByteCode +# From Larry Schwimmer (schwim@cs.stanford.edu) +0 belong 0xcafebabe +>4 belong 0x0003002d Java bytecode diff --git a/usr.bin/file/Magdir/linux b/usr.bin/file/Magdir/linux index a6e7520140db..75a2a2b98b6d 100644 --- a/usr.bin/file/Magdir/linux +++ b/usr.bin/file/Magdir/linux @@ -24,7 +24,7 @@ 0 string \007\001\000 Linux/i386 object file >20 lelong >0x1020 \b, DLL library # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> -0 string *nazgul* compiled message catalog +0 string *nazgul* Linux compiled message catalog >8 lelong >0 \b, version %ld # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 216 lelong 0421 Linux/i386 core file @@ -49,7 +49,25 @@ >3 byte >0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file -# From: Erik Troan <ewt@redhat.com> -0 leshort 0x00070183 ECOFF (Linux/OSF) Alpha binary ->10 leshort 0x0001 not stripped ->10 leshort 0x0000 stripped +# ECOFF magic for OSF/1 and Linux (only tested under Linux though) +# +# from Erik Troan (ewt@redhat.com) examining od dumps, so this +# could be wrong +# updated by David Mosberger (davidm@azstarnet.com) based on +# GNU BFD and MIPS info found below. +# +0 leshort 0x0183 ECOFF alpha +>24 leshort 0407 executable +>24 leshort 0410 pure +>24 leshort 0413 demand paged +>8 long >0 not stripped +>8 long 0 stripped +>23 leshort >0 - version %ld. +# linux Kernel images version 1.3.80 - ? +# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> +0 belong 0xb8c0078e Linux/x86 kernel image, +>0x048c byte 0x31 +>>0x048c string x version %s +>0x0493 byte 0x31 +>>0x0493 string x version %s +# diff --git a/usr.bin/file/Magdir/mach b/usr.bin/file/Magdir/mach new file mode 100644 index 000000000000..308325ee4e4e --- /dev/null +++ b/usr.bin/file/Magdir/mach @@ -0,0 +1,38 @@ +#------------------------------------------------------------------------------ +# mach file description +# +0 belong 0xcafebabe mach-o fat file +>4 belong 1 with 1 architecture +>4 belong >1 +>>4 belong x with %ld architectures +# +0 belong 0xfeedface mach-o +>12 belong 1 object +>12 belong 2 executable +>12 belong 3 shared library +>12 belong 4 core +>12 belong 5 preload executable +>12 belong >5 +>>12 belong x filetype=%ld +>4 belong <0 +>>4 belong x architecture=%ld +>4 belong 1 vax +>4 belong 2 romp +>4 belong 3 architecture=3 +>4 belong 4 ns32032 +>4 belong 5 ns32332 +>4 belong 6 for m68k architecture +>4 belong 7 i386 +>4 belong 8 mips +>4 belong 9 ns32532 +>4 belong 10 architecture=10 +>4 belong 11 hp pa-risc +>4 belong 12 acorn +>4 belong 13 m88k +>4 belong 14 sparc +>4 belong 15 i860-big +>4 belong 16 i860 +>4 belong 17 rs6000 +>4 belong 18 powerPC +>4 belong >18 +>>4 belong x architecture=%ld diff --git a/usr.bin/file/Magdir/mail.news b/usr.bin/file/Magdir/mail.news index 64c4e1c328c4..bd3fd2de43a9 100644 --- a/usr.bin/file/Magdir/mail.news +++ b/usr.bin/file/Magdir/mail.news @@ -16,3 +16,6 @@ 0 string From: news or mail text 0 string Article saved news text 0 string BABYL Emacs RMAIL text +0 string Received: RFC 822 mail text +0 string MIME-Version: MIME entity text +0 string Content- MIME entity text diff --git a/usr.bin/file/Magdir/motorola b/usr.bin/file/Magdir/motorola index d9fa2261ce6d..efed159746ed 100644 --- a/usr.bin/file/Magdir/motorola +++ b/usr.bin/file/Magdir/motorola @@ -27,3 +27,6 @@ # Motorola/88Open BCS # 0 beshort 0555 88K BCS executable +# +# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> +0 string S0 Motorola S-Record; binary data in text format diff --git a/usr.bin/file/Magdir/netbsd b/usr.bin/file/Magdir/netbsd index ea948bd77ed5..7d92ef536798 100644 --- a/usr.bin/file/Magdir/netbsd +++ b/usr.bin/file/Magdir/netbsd @@ -4,12 +4,6 @@ # # All new-style magic numbers are in network byte order. # -0 lelong 000000413 386BSD demand paged executable ->16 lelong >0 not stripped -0 lelong 000000314 BSDI demand paged executable ->16 lelong >0 not stripped ->32 byte 0x6a (uses shared libs) - 0 lelong 000000407 NetBSD little-endian object file >16 lelong >0 not stripped @@ -163,6 +157,15 @@ 0 belong&0377777777 043000507 NetBSD/vax core >12 string >\0 from '%s' +# NetBSD/alpha does not support (and has never supported) a.out objects, +# so no rules are provided for them. NetBSD/alpha ELF objects are +# dealt with in "elf". +0 leshort 0x00070185 ECOFF NetBSD/alpha binary +>10 leshort 0x0001 not stripped +>10 leshort 0x0000 stripped +0 belong&0377777777 043200507 NetBSD/alpha core +>12 string >\0 from '%s' + 0 belong&0377777777 043400413 NetBSD/mips demand paged >0 byte &0x80 >>20 belong <8192 shared library @@ -183,3 +186,24 @@ >16 belong >0 not stripped 0 belong&0377777777 043400507 NetBSD/mips core >12 string >\0 from '%s' + +0 belong&0377777777 043600413 NetBSD/arm32 demand paged +>0 byte &0x80 +>>20 lelong <8192 shared library +>>20 lelong =8192 dynamically linked executable +>>20 lelong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600410 NetBSD/arm32 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600407 NetBSD/arm32 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 043600507 NetBSD/arm32 core +>12 string >\0 from '%s' diff --git a/usr.bin/file/Magdir/osf1 b/usr.bin/file/Magdir/osf1 new file mode 100644 index 000000000000..d2868c3dd7d4 --- /dev/null +++ b/usr.bin/file/Magdir/osf1 @@ -0,0 +1,10 @@ +# +# Mach magic number info +# +0 long 0xefbe OSF/Rose object +# I386 magic number info +# +0 short 0565 i386 COFF object +# +0 string Core Alpha Digital UNIX core file +>24 string >\0 \b, generated from '%s' diff --git a/usr.bin/file/Magdir/pdf b/usr.bin/file/Magdir/pdf index 3cea0de3457f..a1aef1339372 100644 --- a/usr.bin/file/Magdir/pdf +++ b/usr.bin/file/Magdir/pdf @@ -1,7 +1,7 @@ - #------------------------------------------------------------------------------ # pdf: file(1) magic for Portable Document Format # 0 string %PDF- PDF document ->5 string x \b, version %.3s +>5 byte x \b, version %c +>7 byte x \b.%c diff --git a/usr.bin/file/Magdir/pgp b/usr.bin/file/Magdir/pgp index aaff0e9b4bbc..038d098ee4ac 100644 --- a/usr.bin/file/Magdir/pgp +++ b/usr.bin/file/Magdir/pgp @@ -5,6 +5,7 @@ 0 beshort 0x9900 PGP key public ring 0 beshort 0x9501 PGP key security ring 0 beshort 0x9500 PGP key security ring +0 beshort 0xa600 PGP encrypted data 0 string -----BEGIN\040PGP PGP armored data >15 string PUBLIC\040KEY\040BLOCK- public key block >15 string MESSAGE- message diff --git a/usr.bin/file/Magdir/printer b/usr.bin/file/Magdir/printer index 2d12bc5e4543..d20330f42916 100644 --- a/usr.bin/file/Magdir/printer +++ b/usr.bin/file/Magdir/printer @@ -21,7 +21,7 @@ # HP Printer Job Language 0 string \033%-12345X@PJL HP Printer Job Language data >15 string \ ENTER\ LANGUAGE\ = ->31 string PostScript Postscript +>31 string PostScript PostScript # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 0 string \033E\033 HP PCL printer data diff --git a/usr.bin/file/Magdir/rpm b/usr.bin/file/Magdir/rpm index 7b89c682cf4c..14ad6db93642 100644 --- a/usr.bin/file/Magdir/rpm +++ b/usr.bin/file/Magdir/rpm @@ -9,6 +9,9 @@ >>6 beshort 1 src >>8 beshort 1 i386 >>8 beshort 2 Alpha ->>8 beshort 3 PowerPC ->>8 beshort 4 Sparc +>>8 beshort 3 Sparc +>>8 beshort 4 MIPS +>>8 beshort 5 PowerPC +>>8 beshort 6 68000 +>>8 beshort 7 SGI >>10 string x %s diff --git a/usr.bin/file/Magdir/sgi b/usr.bin/file/Magdir/sgi index a73cfcf0b3cb..ce9dbc8b2744 100644 --- a/usr.bin/file/Magdir/sgi +++ b/usr.bin/file/Magdir/sgi @@ -1,12 +1,16 @@ #------------------------------------------------------------------------------ # sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) -# +# Dec Ultrix (MIPS) # all of SGI's *current* machines and OSes run in big-endian mode on the # MIPS machines, as far as I know. # # XXX - what is the blank "-" line? # +# kbd file definitions +0 string kbd!map kbd map file +>8 byte >0 Ver %d: +>10 short >0 with %d table(s) 0 belong 0407 old SGI 68020 executable 0 belong 0410 old SGI 68020 pure executable 0 beshort 0x8765 disk quotas file @@ -47,8 +51,8 @@ >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped ->22 byte x - version %d ->23 byte x .%ld +>23 byte x - version %d +>22 byte x .%ld # 0 beshort 0x6201 MIPSEL-LE COFF executable >20 beshort 03401 (impure) @@ -56,8 +60,8 @@ >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld +>23 byte x - version %ld +>22 byte x .%ld # # MIPS 2 additions # @@ -86,7 +90,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->23 byte x .%ld +>22 byte x .%ld # 0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable >20 beshort 03401 (impure) @@ -95,7 +99,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->23 byte x .%ld +>22 byte x .%ld # # MIPS 3 additions # @@ -124,7 +128,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->23 byte x .%ld +>22 byte x .%ld # 0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable >20 beshort 03401 (impure) @@ -133,7 +137,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->23 byte x .%ld +>22 byte x .%ld # 0 beshort 0x180 MIPSEB Ucode 0 beshort 0x182 MIPSEL Ucode @@ -157,7 +161,8 @@ 0 string WNGZWZSS Wingz spreadsheet 0 string WNGZWZHP Wingz help file # -0 string \#Inventor V IRIS Inventor file +0 string \#Inventor V IRIS Inventor 1.0 file +0 string \#Inventor V2 Open Inventor 2.0 file # XXX - I don't know what next thing is! It is likely to be an image # (or movie) format 0 string glfHeadMagic(); GLF_TEXT diff --git a/usr.bin/file/Magdir/sniffer b/usr.bin/file/Magdir/sniffer new file mode 100644 index 000000000000..861ec8c85dd3 --- /dev/null +++ b/usr.bin/file/Magdir/sniffer @@ -0,0 +1,63 @@ + +#------------------------------------------------------------------------------ +# sniffer: file(1) magic for packet captured files +# +# From: guy@netapp.com (Guy Harris) +# +# Microsoft NetMon (packet capture/display program) capture files. +# +0 string RTSS NetMon capture file +>4 byte x - version %d +>5 byte x \b.%d +# +# Network General Sniffer capture files (the Sniffer software does, +# after all, run under MS-DOS...). +# +0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file +>23 leshort x - version %d +>25 leshort x \b.%d +>33 byte x (Format %d, +>32 byte 0 Token ring) +>32 byte 1 Ethernet) +>32 byte 2 ARCnet) +>32 byte 3 StarLAN) +>32 byte 4 PC Network broadband) +>32 byte 5 LocalTalk) +>32 byte 6 Znet) +# +# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is +# the main program that uses that format, but there's also "tcpview", +# and there may be others in the future.) +# +0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) +>4 beshort x - version %d +>6 beshort x \b.%d +>20 belong 0 (No link-layer encapsulation +>20 belong 1 (Ethernet +>20 belong 2 (3Mb Ethernet +>20 belong 3 (AX.25 +>20 belong 4 (ProNet +>20 belong 5 (Chaos +>20 belong 6 (IEEE 802.x network +>20 belong 7 (ARCnet +>20 belong 8 (SLIP +>20 belong 9 (PPP +>20 belong 10 (FDDI +>20 belong 11 (RFC 1483 ATM +>16 belong x \b, capture length %d) +0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) +>4 leshort x - version %d +>6 leshort x \b.%d +>20 lelong 0 (No link-layer encapsulation +>20 lelong 1 (Ethernet +>20 lelong 2 (3Mb Ethernet +>20 lelong 3 (AX.25 +>20 lelong 4 (ProNet +>20 lelong 5 (Chaos +>20 lelong 6 (IEEE 802.x network +>20 lelong 7 (ARCnet +>20 lelong 8 (SLIP +>20 lelong 9 (PPP +>20 lelong 10 (FDDI +>20 lelong 11 (RFC 1483 ATM +>16 lelong x \b, capture length %d) diff --git a/usr.bin/file/Magdir/sun b/usr.bin/file/Magdir/sun index f6695f1faa27..2f0336a91b82 100644 --- a/usr.bin/file/Magdir/sun +++ b/usr.bin/file/Magdir/sun @@ -84,3 +84,27 @@ >>128 string >\0 from '%s' >4 belong 456 (SPARC 4.x BCP) >>152 string >\0 from '%s' +# Sun SunPC +0 long 0xfa33c08e SunPC 4.0 Hard Disk +0 string #SUNPC_CONFIG SunPC 4.0 Properties Values +# Sun snoop +# +# XXX - are numbers stored in big-endian format, or in host byte order? +# They're the same on SPARC, but not the same on x86. +# +0 string snoop Snoop capture file +>8 long >0 - version %ld +>12 long 0 (IEEE 802.3) +>12 long 1 (IEEE 802.4) +>12 long 2 (IEEE 802.5) +>12 long 3 (IEEE 802.6) +>12 long 4 (Ethernet) +>12 long 5 (HDLC) +>12 long 6 (Character synchronous) +>12 long 7 (IBM channel-to-channel adapter) +>12 long 8 (FDDI) +>12 long 9 (Unknown) +# Sun KCMS +36 string acsp Kodak Color Management System, ICC Profile + + diff --git a/usr.bin/file/Magdir/varied.out b/usr.bin/file/Magdir/varied.out index 2d1c95658305..9245cfcbcc34 100644 --- a/usr.bin/file/Magdir/varied.out +++ b/usr.bin/file/Magdir/varied.out @@ -13,3 +13,6 @@ 0 beshort 0160007 amd 29k coff archive # Cray 6 beshort 0407 unicos (cray) executable +# Ultrix 4.3 +596 string \130\337\377\377 Ultrix core file +>600 string >\0 '%s' diff --git a/usr.bin/file/Magdir/xenix b/usr.bin/file/Magdir/xenix new file mode 100644 index 000000000000..1acadec62a01 --- /dev/null +++ b/usr.bin/file/Magdir/xenix @@ -0,0 +1,72 @@ + +#------------------------------------------------------------------------------ +# xenix: file(1) magic for Microsoft Xenix +# +# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small +# model" lifted from "magic.xenix", with comment "derived empirically; +# treat as folklore until proven" +# +# "small model", "large model", "huge model" stuff lifted from XXX +# +# XXX - "x.out" collides with PDP-11 archives +# +0 string core core file (Xenix) +0 byte 0x80 8086 relocatable (Microsoft) +0 leshort 0xff65 x.out +>2 string __.SYMDEF randomized +>0 byte x archive +0 leshort 0x206 Microsoft a.out +>8 leshort 1 Middle model +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x8 fixed-stack +>0x1c byte &0x80 byte-swapped +>0x1c byte &0x40 word-swapped +>0x10 lelong >0 not-stripped +>0x1e leshort ^0xc000 pre-SysV +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 +>0x1c byte &0x4 86 +>0x1c byte &0xb 186 +>0x1c byte &0x9 286 +>0x1c byte &0xa 386 +>0x1f byte <0x040 small model +>0x1f byte =0x048 large model +>0x1f byte =0x049 huge model +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x40 Large Text +>0x1e leshort &0x20 Large Data +>0x1e leshort &0x120 Huge Objects Enabled +>0x10 lelong >0 not stripped + +0 leshort 0x140 old Microsoft 8086 x.out +>0x3 byte &0x4 separate +>0x3 byte &0x2 pure +>0 byte &0x1 executable +>0 byte ^0x1 relocatable +>0x14 lelong >0 not stripped + +0 lelong 0x206 b.out +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 +>0x1c byte &0x4 86 +>0x1c byte &0xb 186 +>0x1c byte &0x9 286 +>0x1c byte &0x29 286 +>0x1c byte &0xa 386 +>0x1e leshort &0x4 Large Text +>0x1e leshort &0x2 Large Data +>0x1e leshort &0x102 Huge Objects Enabled + +0 leshort 0x580 XENIX 8086 relocatable or 80286 small model diff --git a/usr.bin/file/Makefile b/usr.bin/file/Makefile index 624ab9eed407..fde51c975a7f 100644 --- a/usr.bin/file/Makefile +++ b/usr.bin/file/Makefile @@ -1,6 +1,6 @@ # Makefile for file(1) cmd. # Copyright (c) Ian F. Darwin 86/09/01 - see LEGAL.NOTICE. -# @(#)$Id: Makefile,v 1.49 1995/10/27 23:12:33 christos Exp $ +# @(#)$Id: Makefile,v 1.55 1997/01/15 17:23:24 christos Exp $ # # This software is not subject to any license of the American Telephone # and Telegraph Company or of the Regents of the University of California. @@ -21,11 +21,11 @@ # ever read sources, credits must appear in the documentation. # # 4. This notice may not be removed or altered. -VERSION = 3.19 +VERSION = 3.22 SHELL = /bin/sh #MAGIC = /etc/magic MAGIC = /usr/local/etc/magic -DEFS = -DMAGIC='"$(MAGIC)"' # -Dvoid=int +DEFS = -DMAGIC='"$(MAGIC)"' -DBUILTIN_ELF # -Dvoid=int CC = cc COPTS = -O -g # newer compilers allow both; else drop -O # For truly antique environments, use this for (dummy) include files: @@ -70,10 +70,10 @@ LOCALOBJS = # localsrc/getopt.o localsrc/strtol.o \ LOCALINC = # localinc/*.h localinc/sys/*.h SRCS = file.c apprentice.c fsmagic.c softmagic.c ascmagic.c \ - compress.c is_tar.c \ + compress.c is_tar.c readelf.c internat.c \ print.c $(LOCALSRCS) $(LOCALINC) OBJS = file.o apprentice.o fsmagic.o softmagic.o ascmagic.o \ - compress.o is_tar.o \ + compress.o is_tar.o readelf.o internat.o \ print.o $(LOCALOBJS) ALLSRC = LEGAL.NOTICE README MAINT PORTING $(SRCS) *.h \ @@ -121,12 +121,14 @@ magic.${MANFEXT} : Makefile magic.man @rm -f $@ sed -e s@__CSECTION__@${MANCEXT}@g \ -e s@__FSECTION__@${MANFEXT}@g \ + -e s@__VERSION__@${VERSION}@g \ -e s@__MAGIC__@${MAGIC}@g magic.man > $@ file.${MANCEXT} : Makefile file.man @rm -f $@ sed -e s@__CSECTION__@${MANCEXT}@g \ -e s@__FSECTION__@${MANFEXT}@g \ + -e s@__VERSION__@${VERSION}@g \ -e s@__MAGIC__@${MAGIC}@g file.man > $@ send: dist diff --git a/usr.bin/file/README b/usr.bin/file/README index 2ee8e6777a40..f88f185f49c5 100644 --- a/usr.bin/file/README +++ b/usr.bin/file/README @@ -1,11 +1,9 @@ ** README for file(1) Command ** -@(#) $Id: README,v 1.20 1993/09/23 21:47:01 christos Exp $ +@(#) $Id: README,v 1.21 1997/01/15 17:23:24 christos Exp $ This is Release 3.x of Ian Darwin's (copyright but distributable) -file(1) command. Release 3.x is scheduled for inclusion in the -4.4 BSD (Berkeley Software Distribution) of UNIX-like -software, and is the standard "file" command for Linux, 386bsd, -and other systems. (See "patchlevel.h" for the exact release number). +file(1) command. This version is the standard "file" command for Linux, +*BSD, and other systems. (See "patchlevel.h" for the exact release number). UNIX is a trademark of UNIX System Laboratories. @@ -58,15 +56,29 @@ magic.4 - man page for the magic file, courtesy Guy Harris. file.c - main program file.h - header file fsmagic.c - first set of tests the program runs, based on filesystem info -is_tar.c - knows about tarchives (courtesy John Gilmore). +is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore). magdir - directory of /etc/magic pieces magdir/Makefile - ADJUST THIS FOR YOUR CONFIGURATION names.h - header file for ascmagic.c softmagic.c - 2nd set of tests, based on /etc/magic -strtok.c, getopt.c - in case you them (courtesy of Henry Spencer). -strtol.c, strchr.c - in case you need them - public domain. -tst - simple test suite, built from tst/Makefile +readelf.[ch] - Standalone elf parsing code. +compress.c - on-the-fly decompression. +internat.c - recognize international `text' files. +print.c - print results, errors, warnings. +If your gzip sometimes fails to decompress things complaining about a short +file, apply this patch [which is going to be in the next version of gzip]: +*** - Tue Oct 29 02:06:35 1996 +--- util.c Sun Jul 21 21:51:38 1996 +*** 106,111 **** +--- 108,114 ---- + + if (insize == 0) { + if (eof_ok) return EOF; ++ flush_window(); + read_error(); + } + bytes_in += (ulg)insize; E-mail: christos@deshaw.com, moraes@deshaw.com diff --git a/usr.bin/file/apprentice.c b/usr.bin/file/apprentice.c index d637399d58e2..7d8d9e2e8acd 100644 --- a/usr.bin/file/apprentice.c +++ b/usr.bin/file/apprentice.c @@ -34,7 +34,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: apprentice.c,v 1.23 1995/10/27 23:12:01 christos Exp $"; + "@(#)$Id: apprentice.c,v 1.25 1997/01/15 17:23:24 christos Exp $"; #endif /* lint */ #define EATAB {while (isascii((unsigned char) *l) && \ @@ -133,10 +133,10 @@ int check; /* non-zero? checking-only run. */ /* * extend the sign bit if the comparison is to be signed */ -unsigned long +uint32 signextend(m, v) struct magic *m; -unsigned long v; +uint32 v; { if (!(m->flag & UNSIGNED)) switch(m->type) { @@ -159,7 +159,7 @@ unsigned long v; case LONG: case BELONG: case LELONG: - v = (long) v; + v = (int32) v; break; case STRING: break; @@ -210,6 +210,10 @@ int *ndx, check; ++l; /* step over */ m->flag |= INDIR; } + if (m->cont_level != 0 && *l == '&') { + ++l; /* step over */ + m->flag |= ADD; + } /* get offset, then skip over it */ m->offset = (int) strtoul(l,&t,0); @@ -491,21 +495,16 @@ int plen, *slen; *p++ = (char)val; break; - /* \x and up to 3 hex digits */ + /* \x and up to 2 hex digits */ case 'x': val = 'x'; /* Default if no digits */ c = hextoint(*s++); /* Get next char */ if (c >= 0) { val = c; c = hextoint(*s++); - if (c >= 0) { + if (c >= 0) val = (val << 4) + c; - c = hextoint(*s++); - if (c >= 0) { - val = (val << 4) + c; - } else - --s; - } else + else --s; } else --s; diff --git a/usr.bin/file/ascmagic.c b/usr.bin/file/ascmagic.c index 600d468b7da7..7ba9ae1c9891 100644 --- a/usr.bin/file/ascmagic.c +++ b/usr.bin/file/ascmagic.c @@ -36,7 +36,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: ascmagic.c,v 1.20 1995/05/20 22:09:21 christos Exp $"; + "@(#)$Id: ascmagic.c,v 1.21 1997/01/15 17:23:24 christos Exp $"; #endif /* lint */ /* an optimisation over plain strcmp() */ @@ -88,6 +88,13 @@ int nbytes; /* size actually read */ return 1; } + + /* Make sure we are dealing with ascii text before looking for tokens */ + for (i = 0; i < nbytes; i++) { + if (!isascii(buf[i])) + return 0; /* not all ASCII */ + } + /* look for tokens from names.h - this is expensive! */ /* make a copy of the buffer here because strtok() will destroy it */ s = (unsigned char*) memcpy(nbuf, buf, nbytes); @@ -106,12 +113,6 @@ int nbytes; /* size actually read */ } } - - for (i = 0; i < nbytes; i++) { - if (!isascii(buf[i])) - return 0; /* not all ASCII */ - } - /* all else fails, but it is ASCII... */ ckfputs("ASCII text", stdout); if (has_escapes) { diff --git a/usr.bin/file/file.1 b/usr.bin/file/file.1 index a1d33202ec4b..9c5cfb0fe3be 100644 --- a/usr.bin/file/file.1 +++ b/usr.bin/file/file.1 @@ -1,5 +1,5 @@ .TH FILE __CSECTION__ "Copyright but distributable" -.\" $Id: file.man,v 1.26 1995/10/27 23:12:01 christos Exp $ +.\" $Id: file.man,v 1.28 1997/01/15 17:23:24 christos Exp $ .SH NAME file \- determine file type @@ -16,7 +16,10 @@ namefile ] magicfiles ] file ... .SH DESCRIPTION -.I File +This manual page documents version __VERSION__ of the +.B file +command. +.B File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. @@ -26,8 +29,11 @@ test that succeeds causes the file type to be printed. .PP The type printed will usually contain one of the words .B text -(the file contains only ASCII characters and is -probably safe to read on an ASCII terminal), +(the file contains only +.SM ASCII +characters and is probably safe to read on an +.SM ASCII +terminal), .B executable (the file contains the result of compiling a program in a form understandable to some \s-1UNIX\s0 kernel or another), @@ -46,7 +52,7 @@ Don't do as Berkeley did \- change ``shell commands text'' to ``shell script''. .PP The filesystem tests are based on examining the return from a -.IR stat (2) +.BR stat (2) system call. The program checks to see if the file is empty, or if it's some sort of special file. @@ -55,16 +61,16 @@ Any known file types appropriate to the system you are running on implement them) are intuited if they are defined in the system header file -.BR sys/stat.h . +.IR sys/stat.h . .PP The magic number tests are used to check for files with data in particular fixed formats. The canonical example of this is a binary executable (compiled program) -.B a.out +.I a.out file, whose format is defined in -.B a.out.h +.I a.out.h and possibly -.B exec.h +.I exec.h in the standard include directory. These files have a `magic number' stored in a particular place near the beginning of the file that tells the \s-1UNIX\s0 operating system @@ -78,21 +84,23 @@ The information in these files is read from the magic file If an argument appears to be an .SM ASCII file, -.I file +.B file attempts to guess its language. -The language tests look for particular strings (cf \fInames.h\fP) +The language tests look for particular strings (cf +.IR names.h ) that can appear anywhere in the first few blocks of a file. For example, the keyword .B .br -indicates that the file is most likely a troff input file, -just as the keyword +indicates that the file is most likely a +.BR troff (1) +input file, just as the keyword .B struct indicates a C program. These tests are less reliable than the previous two groups, so they are performed last. The language test routines also test for some miscellany (such as -.I tar +.BR tar (1) archives) and determine whether an unknown file should be labelled as `ascii text' or `data'. .SH OPTIONS @@ -125,7 +133,7 @@ to test the standard input, use ``-'' as a filename argument. .TP 8 .B \-L option causes symlinks to be followed, as the like-named option in -.IR ls (1). +.BR ls (1). (on systems that support symbolic links). .SH FILES .I __MAGIC__ @@ -135,10 +143,10 @@ The environment variable .B MAGIC can be used to set the default magic number files. .SH SEE ALSO -.IR magic (__FSECTION__) +.BR magic (__FSECTION__) \- description of magic file format. .br -.IR Strings (1), " od" (1) +.BR strings (1), " od" (1) \- tools for examining non-textfiles. .SH STANDARDS CONFORMANCE This program is believed to exceed the System V Interface Definition @@ -171,7 +179,7 @@ in an existing magic file would have to be changed to .br .PP SunOS releases 3.2 and later from Sun Microsystems include a -.IR file (1) +.BR file (1) command derived from the System V one, but with some extensions. My version differs from Sun's only in minor ways. It includes the extension of the `&' operator, used as, @@ -190,15 +198,15 @@ The order of entries in the magic file is significant. Depending on what system you are using, the order that they are put together may be incorrect. If your old -.I file +.B file command uses a magic file, keep the old magic file around for comparison purposes (rename it to .IR __MAGIC__.orig ). .SH HISTORY There has been a -.I file -command in every UNIX since at least Research Version 6 +.B file +command in every \s-1UNIX\s0 since at least Research Version 6 (man page dated January, 1975). The System V version introduced one significant major change: the external list of magic number types. @@ -227,7 +235,7 @@ put the ``old-style'' `&' operator back the way it was, because 1) Rob McMahon's change broke the previous style of usage, 2) the SunOS ``new-style'' `&' operator, which this version of -.I file +.B file supports, also handles `x&y op z', and 3) Rob's change wasn't documented in any case; .PP @@ -236,11 +244,11 @@ put in multiple levels of `>'; put in ``beshort'', ``leshort'', etc. keywords to look at numbers in the file in a specific byte order, rather than in the native byte order of the process running -.IR file . +.BR file . .RE .PP Changes by Ian Darwin and various authors including -Christos Zoulas (christos@ee.cornell.edu), 1990-1992. +Christos Zoulas (christos@deshaw.com), 1990-1992. .SH LEGAL NOTICE Copyright (c) Ian F. Darwin, Toronto, Canada, 1986, 1987, 1988, 1989, 1990, 1991, 1992, 1993. @@ -284,33 +292,42 @@ The files and .I is_tar.c were written by John Gilmore from his public-domain -.I tar +.B tar program, and are not covered by the above restrictions. .SH BUGS There must be a better way to automate the construction of the Magic file from all the glop in Magdir. What is it? Better yet, the magic file should be compiled into binary (say, -.IR ndbm (3) -or, better yet, fixed-length ASCII strings -for use in heterogenous network environments) for faster startup. +.BR ndbm (3) +or, better yet, fixed-length +.SM ASCII +strings for use in heterogenous network environments) for faster startup. Then the program would run as fast as the Version 7 program of the same name, with the flexibility of the System V version. .PP -.I File +.B File uses several algorithms that favor speed over accuracy, -thus it can be misled about the contents of ASCII files. +thus it can be misled about the contents of +.SM ASCII +files. .PP -The support for ASCII files (primarily for programming languages) +The support for +.SM ASCII +files (primarily for programming languages) is simplistic, inefficient and requires recompilation to update. .PP There should be an ``else'' clause to follow a series of continuation lines. .PP The magic file and keywords should have regular expression support. -Their use of ASCII TAB as a field delimiter is ugly and makes +Their use of +.SM "ASCII TAB" +as a field delimiter is ugly and makes it hard to edit the files, but is entrenched. .PP It might be advisable to allow upper-case letters in keywords -for e.g., troff commands vs man page macros. +for e.g., +.BR troff (1) +commands vs man page macros. Regular expression support would make this easy. .PP The program doesn't grok \s-2FORTRAN\s0. @@ -343,6 +360,6 @@ This manual page, and particularly this section, is too long. .SH AVAILABILITY You can obtain the original author's latest version by anonymous FTP on -.B tesla.ee.cornell.edu +.B ftp.deshaw.com in the directory -.BR /pub/file-X.YY.tar.gz +.I /pub/file/file-X.YY.tar.gz diff --git a/usr.bin/file/file.c b/usr.bin/file/file.c index 0b617e16dd87..aa8e663f8640 100644 --- a/usr.bin/file/file.c +++ b/usr.bin/file/file.c @@ -26,7 +26,7 @@ */ #ifndef lint static char *moduleid = - "@(#)$Id: file.c,v 1.34 1995/10/27 23:12:01 christos Exp $"; + "@(#)$Id: file.c,v 1.38 1997/01/15 19:28:35 christos Exp $"; #endif /* lint */ #include <stdio.h> @@ -37,15 +37,17 @@ static char *moduleid = #include <sys/stat.h> #include <fcntl.h> /* for open() */ #if (__COHERENT__ >= 0x420) -#include <sys/utime.h> +# include <sys/utime.h> #else -#include <utime.h> +# ifdef USE_UTIMES +# include <sys/time.h> +# else +# include <utime.h> +# endif #endif #include <unistd.h> /* for read() */ -#ifdef __ELF__ -#include <elf.h> -#endif +#include <netinet/in.h> /* for byte swapping */ #include "patchlevel.h" #include "file.h" @@ -76,7 +78,11 @@ char *progname; /* used throughout */ int lineno; /* line number in the magic file */ -static void unwrap __P((char *fn)); +static void unwrap __P((char *fn)); +#if 0 +static int byteconv4 __P((int, int, int)); +static short byteconv2 __P((int, int, int)); +#endif /* * main - parse arguments and handle options @@ -180,18 +186,23 @@ char *fn; FILE *f; int wid = 0, cwid; - if ((f = fopen(fn, "r")) == NULL) { - error("Cannot open `%s' (%s).\n", fn, strerror(errno)); - /*NOTREACHED*/ - } + if (strcmp("-", fn) == 0) { + f = stdin; + wid = 1; + } else { + if ((f = fopen(fn, "r")) == NULL) { + error("Cannot open `%s' (%s).\n", fn, strerror(errno)); + /*NOTREACHED*/ + } - while (fgets(buf, MAXPATHLEN, f) != NULL) { - cwid = strlen(buf) - 1; - if (cwid > wid) - wid = cwid; - } + while (fgets(buf, MAXPATHLEN, f) != NULL) { + cwid = strlen(buf) - 1; + if (cwid > wid) + wid = cwid; + } - rewind(f); + rewind(f); + } while (fgets(buf, MAXPATHLEN, f) != NULL) { buf[strlen(buf)-1] = '\0'; @@ -202,6 +213,71 @@ char *fn; } +#if 0 +/* + * byteconv4 + * Input: + * from 4 byte quantity to convert + * same whether to perform byte swapping + * big_endian whether we are a big endian host + */ +static int +byteconv4(from, same, big_endian) + int from; + int same; + int big_endian; +{ + if (same) + return from; + else if (big_endian) /* lsb -> msb conversion on msb */ + { + union { + int i; + char c[4]; + } retval, tmpval; + + tmpval.i = from; + retval.c[0] = tmpval.c[3]; + retval.c[1] = tmpval.c[2]; + retval.c[2] = tmpval.c[1]; + retval.c[3] = tmpval.c[0]; + + return retval.i; + } + else + return ntohl(from); /* msb -> lsb conversion on lsb */ +} + +/* + * byteconv2 + * Same as byteconv4, but for shorts + */ +static short +byteconv2(from, same, big_endian) + int from; + int same; + int big_endian; +{ + if (same) + return from; + else if (big_endian) /* lsb -> msb conversion on msb */ + { + union { + short s; + char c[2]; + } retval, tmpval; + + tmpval.s = (short) from; + retval.c[0] = tmpval.c[1]; + retval.c[1] = tmpval.c[0]; + + return retval.s; + } + else + return ntohs(from); /* msb -> lsb conversion on lsb */ +} +#endif + /* * process - process input file */ @@ -213,7 +289,6 @@ int wid; int fd = 0; static const char stdname[] = "standard input"; unsigned char buf[HOWMANY+1]; /* one extra for terminating '\0' */ - struct utimbuf utbuf; struct stat sb; int nbytes = 0; /* number of bytes read from a datafile */ char match = '\0'; @@ -265,61 +340,31 @@ int wid; buf[nbytes++] = '\0'; /* null-terminate it */ match = tryit(buf, nbytes, zflag); } -#ifdef __ELF__ - /* - * ELF executables have multiple section headers in arbitrary - * file locations and thus file(1) cannot determine it from easily. - * Instead we traverse thru all section headers until a symbol table - * one is found or else the binary is stripped. - * XXX: This will not work for binaries of a different byteorder. - * Should come up with a better fix. - */ - if (match == 's' && nbytes > sizeof (Elf32_Ehdr) && - buf[EI_MAG0] == ELFMAG0 && - buf[EI_MAG1] == ELFMAG1 && - buf[EI_MAG2] == ELFMAG2 && - buf[EI_MAG3] == ELFMAG3) { - - union { - long l; - char c[sizeof (long)]; - } u; - Elf32_Ehdr elfhdr; - int stripped = 1; - - u.l = 1; - (void) memcpy(&elfhdr, buf, sizeof elfhdr); - - /* - * If the system byteorder does not equal the object byteorder - * then don't test. - */ - if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) { - if (lseek(fd, elfhdr.e_shoff, SEEK_SET)<0) - error("lseek failed (%s).\n", strerror(errno)); - - for ( ; elfhdr.e_shnum ; elfhdr.e_shnum--) { - if (read(fd, buf, elfhdr.e_shentsize)<0) - error("read failed (%s).\n", strerror(errno)); - if (((Elf32_Shdr *)&buf)->sh_type == SHT_SYMTAB) { - stripped = 0; - break; - } - } - if (stripped) - (void) printf (", stripped"); - } - } +#ifdef BUILTIN_ELF + if (match == 's' && nbytes > 5) + tryelf(fd, buf, nbytes); #endif if (inname != stdname) { +#ifdef RESTORE_TIME /* * Try to restore access, modification times if read it. */ +# ifdef USE_UTIMES + struct timeval utsbuf[2]; + utsbuf[0].tv_sec = sb.st_atime; + utsbuf[1].tv_sec = sb.st_mtime; + + (void) utimes(inname, utsbuf); /* don't care if loses */ +# else + struct utimbuf utbuf; + utbuf.actime = sb.st_atime; utbuf.modtime = sb.st_mtime; (void) utime(inname, &utbuf); /* don't care if loses */ +# endif +#endif (void) close(fd); } (void) putchar('\n'); @@ -343,6 +388,10 @@ int nb, zflag; if (ascmagic(buf, nb)) return 'a'; + /* see if it's international language text */ + if (internatmagic(buf, nb)) + return 'i'; + /* abandon hope, all ye who remain here */ ckfputs("data", stdout); return '\0'; diff --git a/usr.bin/file/file.h b/usr.bin/file/file.h index c0bbf0e00b81..c2b9654757ce 100644 --- a/usr.bin/file/file.h +++ b/usr.bin/file/file.h @@ -1,6 +1,6 @@ /* * file.h - definitions for file(1) program - * @(#)$Id: file.h,v 1.22 1995/05/20 22:09:21 christos Exp $ + * @(#)$Id: file.h,v 1.25 1997/01/15 19:28:35 christos Exp $ * * Copyright (c) Ian F. Darwin, 1987. * Written by Ian F. Darwin. @@ -26,6 +26,12 @@ * 4. This notice may not be removed or altered. */ +#ifndef __file_h__ +#define __file_h__ + +typedef int int32; +typedef unsigned int uint32; + #ifndef HOWMANY # define HOWMANY 8192 /* how much of the file to look at */ #endif @@ -37,12 +43,13 @@ struct magic { short flag; #define INDIR 1 /* if '>(...)' appears, */ #define UNSIGNED 2 /* comparison is unsigned */ +#define ADD 4 /* if '>&' appears, */ short cont_level; /* level of ">" */ struct { char type; /* byte short long */ - long offset; /* offset from indirection */ + int32 offset; /* offset from indirection */ } in; - long offset; /* offset to magic number */ + int32 offset; /* offset to magic number */ unsigned char reln; /* relation (0=eq, '>'=gt, etc) */ char type; /* int, short, long or string. */ char vallen; /* length of string value, if any */ @@ -60,12 +67,12 @@ struct magic { union VALUETYPE { unsigned char b; unsigned short h; - unsigned long l; + uint32 l; char s[MAXstring]; unsigned char hs[2]; /* 2 bytes of a fixed-endian "short" */ unsigned char hl[4]; /* 2 bytes of a fixed-endian "long" */ } value; /* either number or string */ - unsigned long mask; /* mask before comparison with value */ + uint32 mask; /* mask before comparison with value */ char nospflag; /* supress space character */ char desc[MAXDESC]; /* description */ }; @@ -97,8 +104,9 @@ extern int softmagic __P((unsigned char *, int)); extern int tryit __P((unsigned char *, int, int)); extern int zmagic __P((unsigned char *, int)); extern void ckfprintf __P((FILE *, const char *, ...)); -extern unsigned long signextend __P((struct magic *, unsigned long)); - +extern uint32 signextend __P((struct magic *, unsigned int32)); +extern int internatmagic __P((unsigned char *, int)); +extern void tryelf __P((int, char *, int)); extern int errno; /* Some unixes don't define this.. */ @@ -118,7 +126,16 @@ extern int lflag; /* follow symbolic links? */ extern int optind; /* From getopt(3) */ extern char *optarg; -#if !defined(__STDC__) || defined(sun) || defined(__sun__) || defined(__convex__) +#if defined(sun) || defined(__sun__) || defined (__sun) +# if defined(__svr4) || defined (__SVR4) || defined(__svr4__) +# define SOLARIS +# else +# define SUNOS +# endif +#endif + + +#if !defined(__STDC__) || defined(SUNOS) || defined(__convex__) extern int sys_nerr; extern char *sys_errlist[]; #define strerror(e) \ @@ -129,3 +146,5 @@ extern char *sys_errlist[]; #ifndef MAXPATHLEN #define MAXPATHLEN 512 #endif + +#endif /* __file_h__ */ diff --git a/usr.bin/file/fsmagic.c b/usr.bin/file/fsmagic.c index 5e00c4f1146f..dab854e78d55 100644 --- a/usr.bin/file/fsmagic.c +++ b/usr.bin/file/fsmagic.c @@ -31,6 +31,11 @@ #include <sys/stat.h> #include <unistd.h> #include <stdlib.h> +#ifndef major +# if defined(__SVR4) || defined(_SVR4_SOURCE) +# include <sys/mkdev.h> +# endif +#endif #ifndef major /* if `major' not defined in types.h, */ #include <sys/sysmacros.h> /* try this one. */ #endif @@ -46,7 +51,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: fsmagic.c,v 1.23 1995/01/21 21:03:35 christos Exp $"; + "@(#)$Id: fsmagic.c,v 1.25 1997/01/15 19:28:35 christos Exp $"; #endif /* lint */ int @@ -84,12 +89,12 @@ struct stat *sb; ckfputs("directory", stdout); return 1; case S_IFCHR: - (void) printf("character special (%d/%d)", - major(sb->st_rdev), minor(sb->st_rdev)); + (void) printf("character special (%ld/%ld)", + (long) major(sb->st_rdev), (long) minor(sb->st_rdev)); return 1; case S_IFBLK: - (void) printf("block special (%d/%d)", - major(sb->st_rdev), minor(sb->st_rdev)); + (void) printf("block special (%ld/%ld)", + (long) major(sb->st_rdev), (long) minor(sb->st_rdev)); return 1; /* TODO add code to handle V7 MUX and Blit MUX files */ #ifdef S_IFIFO diff --git a/usr.bin/file/internat.c b/usr.bin/file/internat.c new file mode 100644 index 000000000000..59a508a4f75c --- /dev/null +++ b/usr.bin/file/internat.c @@ -0,0 +1,72 @@ +#include "file.h" + +#include <string.h> + +#define F 0 +#define T 1 + +/* + * List of characters that look "reasonable" in international + * language texts. That's almost all characters :), except a + * few in the control range of ASCII (all the known international + * charactersets share the bottom half with ASCII). + */ +static char maybe_internat[256] = { + F, F, F, F, F, F, F, F, T, T, T, T, T, T, F, F, /* 0x0X */ + F, F, F, F, F, F, F, F, F, F, F, T, F, F, F, F, /* 0x1X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x2X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x3X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x4X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x5X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x6X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, F, /* 0x7X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x8X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x9X */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xaX */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xbX */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xcX */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xdX */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xeX */ + T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T /* 0xfX */ +}; + +/* Maximal length of a line we consider "reasonable". */ +#define MAXLINELEN 300 + +int +internatmagic(buf, nbytes) + unsigned char *buf; + int nbytes; +{ + int i; + unsigned char *cp; + + nbytes--; + + /* First, look whether there are "unreasonable" characters. */ + for (i = 0, cp = buf; i < nbytes; i++, cp++) + if (!maybe_internat[*cp]) + return 0; + + /* + * Now, look whether the file consists of lines of + * "reasonable" length. + */ + + for (i = 0; i < nbytes;) { + cp = memchr(buf, '\n', nbytes - i); + if (cp == NULL) { + /* Don't fail if we hit the end of buffer. */ + if (i + MAXLINELEN >= nbytes) + break; + else + return 0; + } + if (cp - buf > MAXLINELEN) + return 0; + i += (cp - buf + 1); + buf = cp + 1; + } + ckfputs("International language text", stdout); + return 1; +} diff --git a/usr.bin/file/is_tar.c b/usr.bin/file/is_tar.c index 5b036be1af8d..865410417539 100644 --- a/usr.bin/file/is_tar.c +++ b/usr.bin/file/is_tar.c @@ -5,7 +5,7 @@ * Pubic Domain version written 26 Aug 1985 John Gilmore (ihnp4!hoptoad!gnu). * * @(#)list.c 1.18 9/23/86 Public Domain - gnu - * $Id: is_tar.c,v 1.8 1993/09/16 21:09:35 christos Exp $ + * $Id: is_tar.c,v 1.9 1997/01/15 17:23:24 christos Exp $ * * Comments changed and some code/comments reformatted * for file command by Ian Darwin. @@ -19,9 +19,9 @@ #define isodigit(c) ( ((c) >= '0') && ((c) <= '7') ) #if defined(__STDC__) || defined(__cplusplus) -static long from_oct(int, char*); /* Decode octal number */ +static int from_oct(int, char*); /* Decode octal number */ #else -static long from_oct(); +static int from_oct(); #endif /* @@ -37,7 +37,7 @@ int nbytes; { register union record *header = (union record *)buf; register int i; - register long sum, recsum; + register int sum, recsum; register char *p; if (nbytes < sizeof(union record)) @@ -75,12 +75,12 @@ int nbytes; * * Result is -1 if the field is invalid (all blank, or nonoctal). */ -static long +static int from_oct(digs, where) register int digs; register char *where; { - register long value; + register int value; while (isspace(*where)) { /* Skip spaces */ where++; diff --git a/usr.bin/file/magic.5 b/usr.bin/file/magic.5 index 2ae8e69996a4..c8e85c445ec3 100644 --- a/usr.bin/file/magic.5 +++ b/usr.bin/file/magic.5 @@ -3,14 +3,17 @@ .SH NAME magic \- file command's magic number file .SH DESCRIPTION -The -.IR file (__CSECTION__) +This manual page documents the format of the magic file as +used by the +.BR file (__CSECTION__) +command, version __VERSION__. The +.B file command identifies the type of a file using, among other tests, a test for whether the file begins with a certain .IR "magic number" . The file -.B __MAGIC__ +.I __MAGIC__ specifies what magic numbers are to be tested for, what message to print if a particular magic number is found, and additional information to extract from the file. @@ -113,7 +116,7 @@ then presumably print that string, by doing .IP message The message to be printed if the comparison succeeds. If the string contains a -.IR printf (3S) +.BR printf (3S) format specification, the value from the file (with any specified masking performed) is printed using the message as the format string. .PP @@ -156,6 +159,15 @@ type specifier. To that number the value of .I y is added and the result is used as an offset in the file. The default type if one is not specified is long. +.PP +Sometimes you do not know the exact offset as this depends on the length of +preceding fields. You can specify an offset relative to the end of the +last uplevel field (of course this may only be done for sublevel tests, i.e. +test beginning with +.B > +). Such a relative offset is specified using +.B & +as a prefix to the offset. .SH BUGS The formats .IR long , @@ -176,7 +188,7 @@ a system on which the lengths are invariant. There is (currently) no support for specified-endian data to be used in indirect offsets. .SH SEE ALSO -.IR file (__CSECTION__) +.BR file (__CSECTION__) \- the command that reads this file. .\" .\" From: guy@sun.uucp (Guy Harris) @@ -191,4 +203,4 @@ indirect offsets. .\" the changes I posted to the S5R2 version. .\" .\" Modified for Ian Darwin's version of the file command. -.\" @(#)$Id: magic.man,v 1.12 1995/01/21 21:03:35 christos Exp $ +.\" @(#)$Id: magic.man,v 1.14 1996/06/22 22:05:07 christos Exp $ diff --git a/usr.bin/file/names.h b/usr.bin/file/names.h index 86633dd0d075..54d1cbb12513 100644 --- a/usr.bin/file/names.h +++ b/usr.bin/file/names.h @@ -10,22 +10,24 @@ * * See LEGAL.NOTICE * - * $Id: names.h,v 1.12 1995/04/28 17:29:13 christos Exp $ + * $Id: names.h,v 1.13 1997/01/15 17:23:24 christos Exp $ */ /* these types are used to index the table 'types': keep em in sync! */ #define L_C 0 /* first and foremost on UNIX */ -#define L_FORT 1 /* the oldest one */ -#define L_MAKE 2 /* Makefiles */ -#define L_PLI 3 /* PL/1 */ -#define L_MACH 4 /* some kinda assembler */ -#define L_ENG 5 /* English */ -#define L_PAS 6 /* Pascal */ -#define L_MAIL 7 /* Electronic mail */ -#define L_NEWS 8 /* Usenet Netnews */ +#define L_CC 1 /* Bjarne's postincrement */ +#define L_FORT 2 /* the oldest one */ +#define L_MAKE 3 /* Makefiles */ +#define L_PLI 4 /* PL/1 */ +#define L_MACH 5 /* some kinda assembler */ +#define L_ENG 6 /* English */ +#define L_PAS 7 /* Pascal */ +#define L_MAIL 8 /* Electronic mail */ +#define L_NEWS 9 /* Usenet Netnews */ static char *types[] = { "C program text", + "C++ program text", "FORTRAN program text", "make commands text" , "PL/1 program text", @@ -43,6 +45,12 @@ static struct names { } names[] = { /* These must be sorted by eye for optimal hit rate */ /* Add to this list only after substantial meditation */ + {"//", L_CC}, + {"template", L_CC}, + {"virtual", L_CC}, + {"class", L_CC}, + {"public:", L_CC}, + {"private:", L_CC}, {"/*", L_C}, /* must precede "The", "the", etc. */ {"#include", L_C}, {"char", L_C}, diff --git a/usr.bin/file/patchlevel.h b/usr.bin/file/patchlevel.h index 2da80f9f204e..387ac2ca029a 100644 --- a/usr.bin/file/patchlevel.h +++ b/usr.bin/file/patchlevel.h @@ -1,11 +1,33 @@ #define FILE_VERSION_MAJOR 3 -#define patchlevel 19 +#define patchlevel 22 /* * Patchlevel file for Ian Darwin's MAGIC command. - * $Id: patchlevel.h,v 1.19 1995/10/27 23:14:46 christos Exp $ + * $Id: patchlevel.h,v 1.22 1997/01/15 17:23:24 christos Exp $ * * $Log: patchlevel.h,v $ + * Revision 1.22 1997/01/15 17:23:24 christos + * - add support for elf core files: find the program name under SVR4 [Ken Pizzini] + * - print strings only up to the first carriage return [various] + * - freebsd international ascii support [J Wunsch] + * - magic fixes and additions [Guy Harris] + * - 64 bit fixes [Larry Schwimmer] + * - support for both utime and utimes, but don't restore file access times + * by default [various] + * - \xXX only takes 2 hex digits, not 3. + * - re-implement support for core files [Guy Harris] + * + * Revision 1.21 1996/10/05 18:15:29 christos + * Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF + * More magic fixes + * + * Revision 1.20 1996/06/22 22:15:52 christos + * - support relative offsets of the form >& + * - fix bug with truncating magic strings that contain \n + * - file -f - did not read from stdin as documented + * - support elf file parsing using our own elf support. + * - as always magdir fixes and additions. + * * Revision 1.19 1995/10/27 23:14:46 christos * Ability to parse colon separated list of magic files * New LEGAL.NOTICE diff --git a/usr.bin/file/print.c b/usr.bin/file/print.c index 17e1136a0559..15042ff3f424 100644 --- a/usr.bin/file/print.c +++ b/usr.bin/file/print.c @@ -40,7 +40,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: print.c,v 1.22 1995/05/20 22:09:21 christos Exp $"; + "@(#)$Id: print.c,v 1.23 1997/01/15 19:28:35 christos Exp $"; #endif /* lint */ #define SZOF(a) (sizeof(a) / sizeof(a[0])) @@ -58,7 +58,7 @@ struct magic *m; m->offset); if (m->flag & INDIR) - (void) fprintf(stderr, "(%s,%ld),", + (void) fprintf(stderr, "(%s,%d),", (m->in.type >= 0 && m->in.type < SZOF(typ)) ? typ[(unsigned char) m->in.type] : "*bad*", @@ -69,7 +69,7 @@ struct magic *m; typ[(unsigned char) m->type] : "*bad*"); if (m->mask != ~0L) - (void) fprintf(stderr, " & %.8lx", m->mask); + (void) fprintf(stderr, " & %.8x", m->mask); (void) fprintf(stderr, ",%c", m->reln); @@ -82,7 +82,7 @@ struct magic *m; case LELONG: case BESHORT: case BELONG: - (void) fprintf(stderr, "%ld", m->value.l); + (void) fprintf(stderr, "%d", m->value.l); break; case STRING: showstr(stderr, m->value.s, -1); diff --git a/usr.bin/file/readelf.c b/usr.bin/file/readelf.c new file mode 100644 index 000000000000..a007cca3ca57 --- /dev/null +++ b/usr.bin/file/readelf.c @@ -0,0 +1,314 @@ + +#ifdef BUILTIN_ELF +#include <sys/types.h> +#include <string.h> +#include <stdio.h> +#include <ctype.h> +#include <stdlib.h> +#include <unistd.h> +#include <errno.h> + +#include "readelf.h" +#include "file.h" + +static void +doshn(fd, off, num, size, buf) + int fd; + off_t off; + int num; + size_t size; + char *buf; +{ + /* + * This works for both 32-bit and 64-bit ELF formats, + * because it looks only at the "sh_type" field, which is + * always 32 bits, and is preceded only by the "sh_name" + * field which is also always 32 bits, and because it uses + * the shdr size from the ELF header rather than using + * the size of an "Elf32_Shdr". + */ + Elf32_Shdr *sh = (Elf32_Shdr *) buf; + + if (lseek(fd, off, SEEK_SET) == -1) + error("lseek failed (%s).\n", strerror(errno)); + + for ( ; num; num--) { + if (read(fd, buf, size) == -1) + error("read failed (%s).\n", strerror(errno)); + if (sh->sh_type == SHT_SYMTAB) { + (void) printf (", not stripped"); + return; + } + } + (void) printf (", stripped"); +} + +/* + * Look through the program headers of an executable image, searching + * for a PT_INTERP section; if one is found, it's dynamically linked, + * otherwise it's statically linked. + */ +static void +dophn_exec(fd, off, num, size, buf) + int fd; + off_t off; + int num; + size_t size; + char *buf; +{ + /* I am not sure if this works for 64 bit elf formats */ + Elf32_Phdr *ph = (Elf32_Phdr *) buf; + + if (lseek(fd, off, SEEK_SET) == -1) + error("lseek failed (%s).\n", strerror(errno)); + + for ( ; num; num--) { + if (read(fd, buf, size) == -1) + error("read failed (%s).\n", strerror(errno)); + if (ph->p_type == PT_INTERP) { + /* + * Has an interpreter - must be a dynamically-linked + * executable. + */ + printf(", dynamically linked"); + return; + } + } + printf(", statically linked"); +} + +size_t prpsoffsets[] = { + 100, /* SunOS 5.x */ + 32, /* Linux */ +}; + +#define NOFFSETS (sizeof prpsoffsets / sizeof prpsoffsets[0]) + +/* + * Look through the program headers of an executable image, searching + * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE"; if one + * is found, try looking in various places in its contents for a 16-character + * string containing only printable characters - if found, that string + * should be the name of the program that dropped core. + * Note: right after that 16-character string is, at least in SunOS 5.x + * (and possibly other SVR4-flavored systems) and Linux, a longer string + * (80 characters, in 5.x, probably other SVR4-flavored systems, and Linux) + * containing the start of the command line for that program. + */ +static void +dophn_core(fd, off, num, size, buf) + int fd; + off_t off; + int num; + size_t size; + char *buf; +{ + /* + * This doesn't work for 64-bit ELF, as the "p_offset" field is + * 64 bits in 64-bit ELF. + */ + /* + * This doesn't work for 64-bit ELF, as the "p_offset" field is + * 64 bits in 64-bit ELF. + */ + Elf32_Phdr *ph = (Elf32_Phdr *) buf; + Elf32_Nhdr *nh; + size_t offset, noffset, reloffset; + unsigned char c; + int i, j; + char nbuf[BUFSIZ]; + int bufsize; + + for ( ; num; num--) { + if (lseek(fd, off, SEEK_SET) == -1) + error("lseek failed (%s).\n", strerror(errno)); + if (read(fd, buf, size) == -1) + error("read failed (%s).\n", strerror(errno)); + off += size; + if (ph->p_type != PT_NOTE) + continue; + if (lseek(fd, ph->p_offset, SEEK_SET) == -1) + error("lseek failed (%s).\n", strerror(errno)); + bufsize = read(fd, nbuf, BUFSIZ); + if (bufsize == -1) + error("read failed (%s).\n", strerror(errno)); + offset = 0; + for (;;) { + if (offset >= bufsize) + break; + nh = (Elf32_Nhdr *)&nbuf[offset]; + offset += sizeof *nh; + + /* + * If this note isn't an NT_PRPSINFO note, it's + * not what we're looking for. + */ + if (nh->n_type != NT_PRPSINFO) { + offset += nh->n_namesz; + offset = ((offset + 3)/4)*4; + offset += nh->n_descsz; + offset = ((offset + 3)/4)*4; + continue; + } + + /* + * Make sure this note has the name "CORE". + */ + if (offset + nh->n_namesz >= bufsize) { + /* + * We're past the end of the buffer. + */ + break; + } + if (nh->n_namesz != 5 + || strcmp(&nbuf[offset], "CORE") != 0) + continue; + offset += nh->n_namesz; + offset = ((offset + 3)/4)*4; + + /* + * Extract the program name. We assume it to be + * 16 characters (that's what it is in SunOS 5.x + * and Linux). + * + * Unfortunately, it's at a different offset in + * SunOS 5.x and Linux, so try multiple offsets. + * If the characters aren't all printable, reject + * it. + */ + for (i = 0; i < NOFFSETS; i++) { + reloffset = prpsoffsets[i]; + noffset = offset + reloffset; + for (j = 0; j < 16; + j++, noffset++, reloffset++) { + /* + * Make sure we're not past the end + * of the buffer; if we are, just + * give up. + */ + if (noffset >= bufsize) + return; + + /* + * Make sure we're not past the + * end of the contents; if we + * are, this obviously isn't + * the right offset. + */ + if (reloffset >= nh->n_descsz) + goto tryanother; + + c = nbuf[noffset]; + if (c != '\0' && !isprint(c)) + goto tryanother; + } + + /* + * Well, that worked. + */ + printf(", from '%.16s'", + &nbuf[offset + prpsoffsets[i]]); + return; + + tryanother: + ; + } + offset += nh->n_descsz; + offset = ((offset + 3)/4)*4; + } + } +} + +void +tryelf(fd, buf, nbytes) + int fd; + char *buf; + int nbytes; +{ + union { + int32 l; + char c[sizeof (int32)]; + } u; + + /* + * ELF executables have multiple section headers in arbitrary + * file locations and thus file(1) cannot determine it from easily. + * Instead we traverse thru all section headers until a symbol table + * one is found or else the binary is stripped. + */ + if (buf[EI_MAG0] != ELFMAG0 || buf[EI_MAG1] != ELFMAG1 + || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3) + return; + + + if (buf[4] == ELFCLASS32) { + Elf32_Ehdr elfhdr; + if (nbytes <= sizeof (Elf32_Ehdr)) + return; + + + u.l = 1; + (void) memcpy(&elfhdr, buf, sizeof elfhdr); + /* + * If the system byteorder does not equal the + * object byteorder then don't test. + * XXX - we could conceivably fix up the "dophn_XXX()" and + * "doshn()" routines to extract stuff in the right + * byte order.... + */ + if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) { + if (elfhdr.e_type == ET_CORE) + dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum, + elfhdr.e_phentsize, buf); + else { + if (elfhdr.e_type == ET_EXEC) { + dophn_exec(fd, elfhdr.e_phoff, + elfhdr.e_phnum, + elfhdr.e_phentsize, buf); + } + doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum, + elfhdr.e_shentsize, buf); + } + } + return; + } + + if (buf[4] == ELFCLASS64) { + Elf64_Ehdr elfhdr; + if (nbytes <= sizeof (Elf64_Ehdr)) + return; + + + u.l = 1; + (void) memcpy(&elfhdr, buf, sizeof elfhdr); + + /* + * If the system byteorder does not equal the + * object byteorder then don't test. + * XXX - we could conceivably fix up the "dophn_XXX()" and + * "doshn()" routines to extract stuff in the right + * byte order.... + */ + if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) { +#ifdef notyet + if (elfhdr.e_type == ET_CORE) + dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum, + elfhdr.e_phentsize, buf); + else +#endif + { +#ifdef notyet + if (elfhdr.e_type == ET_EXEC) { + dophn_exec(fd, elfhdr.e_phoff, + elfhdr.e_phnum, + elfhdr.e_phentsize, buf); + } +#endif + doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum, + elfhdr.e_shentsize, buf); + } + } + return; + } +} +#endif diff --git a/usr.bin/file/readelf.h b/usr.bin/file/readelf.h new file mode 100644 index 000000000000..c4b42d7eb13f --- /dev/null +++ b/usr.bin/file/readelf.h @@ -0,0 +1,167 @@ +/* + * readelf.h + * @(#)$Id: readelf.h,v 1.4 1997/01/15 17:23:24 christos Exp $ + * + * Provide elf data structures for non-elf machines, allowing file + * non-elf hosts to determine if an elf binary is stripped. + * Note: cobbled from the linux header file, with modifications + */ +#ifndef __fake_elf_h__ +#define __fake_elf_h__ + +typedef unsigned int Elf32_Addr; +typedef unsigned short Elf32_Half; +typedef unsigned int Elf32_Off; +typedef unsigned int Elf32_Word; +typedef unsigned char Elf32_Char; + +/* XXX: We need 64 bit numbers here */ +typedef unsigned int Elf64_Addr[2]; +typedef unsigned short Elf64_Half; +typedef unsigned int Elf64_Off[2]; +typedef unsigned int Elf64_Word; +typedef unsigned char Elf64_Char; + +#define EI_NIDENT 16 + +typedef struct { + Elf32_Char e_ident[EI_NIDENT]; + Elf32_Half e_type; + Elf32_Half e_machine; + Elf32_Word e_version; + Elf32_Addr e_entry; /* Entry point */ + Elf32_Off e_phoff; + Elf32_Off e_shoff; + Elf32_Word e_flags; + Elf32_Half e_ehsize; + Elf32_Half e_phentsize; + Elf32_Half e_phnum; + Elf32_Half e_shentsize; + Elf32_Half e_shnum; + Elf32_Half e_shstrndx; +} Elf32_Ehdr; + +typedef struct { + Elf64_Char e_ident[EI_NIDENT]; + Elf64_Half e_type; + Elf64_Half e_machine; + Elf64_Word e_version; + Elf64_Addr e_entry; /* Entry point */ + Elf64_Off e_phoff; + Elf64_Off e_shoff; + Elf64_Word e_flags; + Elf64_Half e_ehsize; + Elf64_Half e_phentsize; + Elf64_Half e_phnum; + Elf64_Half e_shentsize; + Elf64_Half e_shnum; + Elf64_Half e_shstrndx; +} Elf64_Ehdr; + +/* e_type */ +#define ET_EXEC 2 +#define ET_CORE 4 + +/* sh_type */ +#define SHT_SYMTAB 2 +#define SHT_NOTE 7 + +/* elf type */ +#define ELFDATANONE 0 /* e_ident[EI_DATA] */ +#define ELFDATA2LSB 1 +#define ELFDATA2MSB 2 + +/* elf class */ +#define ELFCLASSNONE 0 +#define ELFCLASS32 1 +#define ELFCLASS64 2 + +/* magic number */ +#define EI_MAG0 0 /* e_ident[] indexes */ +#define EI_MAG1 1 +#define EI_MAG2 2 +#define EI_MAG3 3 +#define EI_CLASS 4 +#define EI_DATA 5 +#define EI_VERSION 6 +#define EI_PAD 7 + +#define ELFMAG0 0x7f /* EI_MAG */ +#define ELFMAG1 'E' +#define ELFMAG2 'L' +#define ELFMAG3 'F' +#define ELFMAG "\177ELF" + +typedef struct { + Elf32_Word p_type; + Elf32_Off p_offset; + Elf32_Addr p_vaddr; + Elf32_Addr p_paddr; + Elf32_Word p_filesz; + Elf32_Word p_memsz; + Elf32_Word p_flags; + Elf32_Word p_align; +} Elf32_Phdr; + +#define PT_NULL 0 /* p_type */ +#define PT_LOAD 1 +#define PT_DYNAMIC 2 +#define PT_INTERP 3 +#define PT_NOTE 4 +#define PT_SHLIB 5 +#define PT_PHDR 6 +#define PT_NUM 7 + +typedef struct { + Elf32_Word sh_name; + Elf32_Word sh_type; + Elf32_Word sh_flags; + Elf32_Addr sh_addr; + Elf32_Off sh_offset; + Elf32_Word sh_size; + Elf32_Word sh_link; + Elf32_Word sh_info; + Elf32_Word sh_addralign; + Elf32_Word sh_entsize; +} Elf32_Shdr; + +typedef struct { + Elf64_Word sh_name; + Elf64_Word sh_type; + Elf64_Off sh_flags; + Elf64_Addr sh_addr; + Elf64_Off sh_offset; + Elf64_Off sh_size; + Elf64_Word sh_link; + Elf64_Word sh_info; + Elf64_Off sh_addralign; + Elf64_Off sh_entsize; +} Elf64_Shdr; + +/* Notes used in ET_CORE */ +#define NT_PRSTATUS 1 +#define NT_PRFPREG 2 +#define NT_PRPSINFO 3 +#define NT_TASKSTRUCT 4 + +/* Note header in a PT_NOTE section */ +typedef struct elf_note { + Elf32_Word n_namesz; /* Name size */ + Elf32_Word n_descsz; /* Content size */ + Elf32_Word n_type; /* Content type */ +} Elf32_Nhdr; + +typedef struct { + Elf64_Word n_namesz; + Elf64_Word n_descsz; + Elf64_Word n_type; +} Elf64_Nhdr; + +#define NT_PRSTATUS 1 +#define NT_PRFPREG 2 +#define NT_PRPSINFO 3 +#define NT_PRXREG 4 +#define NT_PLATFORM 5 +#define NT_AUXV 6 + +#endif diff --git a/usr.bin/file/softmagic.c b/usr.bin/file/softmagic.c index 76fd6d811541..ab621d2afe49 100644 --- a/usr.bin/file/softmagic.c +++ b/usr.bin/file/softmagic.c @@ -27,6 +27,7 @@ #include <stdio.h> #include <string.h> +#include <stdlib.h> #include <time.h> #include <sys/types.h> @@ -34,15 +35,15 @@ #ifndef lint static char *moduleid = - "@(#)$Id: softmagic.c,v 1.30 1995/05/20 22:09:21 christos Exp $"; + "@(#)$Id: softmagic.c,v 1.34 1997/01/15 19:28:35 christos Exp $"; #endif /* lint */ static int match __P((unsigned char *, int)); static int mget __P((union VALUETYPE *, unsigned char *, struct magic *, int)); static int mcheck __P((union VALUETYPE *, struct magic *)); -static void mprint __P((union VALUETYPE *, struct magic *)); -static void mdebug __P((long, char *, int)); +static int32 mprint __P((union VALUETYPE *, struct magic *)); +static void mdebug __P((int32, char *, int)); static int mconvert __P((union VALUETYPE *, struct magic *)); /* @@ -98,6 +99,13 @@ int nbytes; int cont_level = 0; int need_separator = 0; union VALUETYPE p; + static int32 *tmpoff = NULL; + static size_t tmplen = 0; + int32 oldoff = 0; + + if (tmpoff == NULL) + if ((tmpoff = (int32 *) malloc(tmplen = 20)) == NULL) + error("out of memory\n"); for (magindex = 0; magindex < nmagic; magindex++) { /* if main entry matches, print it... */ @@ -113,7 +121,7 @@ int nbytes; continue; } - mprint(&p, &magic[magindex]); + tmpoff[cont_level] = mprint(&p, &magic[magindex]); /* * If we printed something, we'll need to print * a blank before we print something else. @@ -121,7 +129,10 @@ int nbytes; if (magic[magindex].desc[0]) need_separator = 1; /* and any continuations that match */ - cont_level++; + if (++cont_level >= tmplen) + if ((tmpoff = (int32 *) realloc(tmpoff, + tmplen += 20)) == NULL) + error("out of memory\n"); while (magic[magindex+1].cont_level != 0 && ++magindex < nmagic) { if (cont_level >= magic[magindex].cont_level) { @@ -132,6 +143,10 @@ int nbytes; */ cont_level = magic[magindex].cont_level; } + if (magic[magindex].flag & ADD) { + oldoff=magic[magindex].offset; + magic[magindex].offset += tmpoff[cont_level-1]; + } if (mget(&p, s, &magic[magindex], nbytes) && mcheck(&p, &magic[magindex])) { /* @@ -149,7 +164,7 @@ int nbytes; (void) putchar(' '); need_separator = 0; } - mprint(&p, &magic[magindex]); + tmpoff[cont_level] = mprint(&p, &magic[magindex]); if (magic[magindex].desc[0]) need_separator = 1; @@ -158,7 +173,14 @@ int nbytes; * at a higher level, * process them. */ - cont_level++; + if (++cont_level >= tmplen) + if ((tmpoff = + (int32 *) realloc(tmpoff, + tmplen += 20)) == NULL) + error("out of memory\n"); + } + if (magic[magindex].flag & ADD) { + magic[magindex].offset = oldoff; } } } @@ -167,13 +189,14 @@ int nbytes; return 0; /* no match at all */ } -static void +static int32 mprint(p, m) union VALUETYPE *p; struct magic *m; { char *pp, *rt; - unsigned long v; + uint32 v; + int32 t=0 ; switch (m->type) { @@ -181,6 +204,7 @@ struct magic *m; v = p->b; v = signextend(m, v) & m->mask; (void) printf(m->desc, (unsigned char) v); + t = m->offset + sizeof(char); break; case SHORT: @@ -189,6 +213,7 @@ struct magic *m; v = p->h; v = signextend(m, v) & m->mask; (void) printf(m->desc, (unsigned short) v); + t = m->offset + sizeof(short); break; case LONG: @@ -196,17 +221,25 @@ struct magic *m; case LELONG: v = p->l; v = signextend(m, v) & m->mask; - (void) printf(m->desc, (unsigned long) v); + (void) printf(m->desc, (uint32) v); + t = m->offset + sizeof(int32); break; case STRING: if (m->reln == '=') { (void) printf(m->desc, m->value.s); + t = m->offset + strlen(m->value.s); } else { + if (*m->value.s == '\0') { + char *cp = strchr(p->s,'\n'); + if (cp) + *cp = '\0'; + } (void) printf(m->desc, p->s); + t = m->offset + strlen(p->s); } - return; + break; case DATE: case BEDATE: @@ -215,11 +248,14 @@ struct magic *m; if ((rt = strchr(pp, '\n')) != NULL) *rt = '\0'; (void) printf(m->desc, pp); - return; + t = m->offset + sizeof(time_t); + break; + default: error("invalid m->type (%d) in mprint().\n", m->type); /*NOTREACHED*/ } + return(t); } /* @@ -230,8 +266,6 @@ mconvert(p, m) union VALUETYPE *p; struct magic *m; { - char *rt; - switch (m->type) { case BYTE: case SHORT: @@ -239,17 +273,21 @@ struct magic *m; case DATE: return 1; case STRING: - /* Null terminate and eat the return */ - p->s[sizeof(p->s) - 1] = '\0'; - if ((rt = strchr(p->s, '\n')) != NULL) - *rt = '\0'; - return 1; + { + char *ptr; + + /* Null terminate and eat the return */ + p->s[sizeof(p->s) - 1] = '\0'; + if ((ptr = strchr(p->s, '\n')) != NULL) + *ptr = '\0'; + return 1; + } case BESHORT: p->h = (short)((p->hs[0]<<8)|(p->hs[1])); return 1; case BELONG: case BEDATE: - p->l = (long) + p->l = (int32) ((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3])); return 1; case LESHORT: @@ -257,7 +295,7 @@ struct magic *m; return 1; case LELONG: case LEDATE: - p->l = (long) + p->l = (int32) ((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0])); return 1; default: @@ -269,11 +307,11 @@ struct magic *m; static void mdebug(offset, str, len) -long offset; +int32 offset; char *str; int len; { - (void) fprintf(stderr, "mget @%ld: ", offset); + (void) fprintf(stderr, "mget @%d: ", offset); showstr(stderr, (char *) str, len); (void) fputc('\n', stderr); (void) fputc('\n', stderr); @@ -286,7 +324,7 @@ unsigned char *s; struct magic *m; int nbytes; { - long offset = m->offset; + int32 offset = m->offset; if (offset + sizeof(union VALUETYPE) <= nbytes) memcpy(p, s + offset, sizeof(union VALUETYPE)); @@ -295,7 +333,7 @@ int nbytes; * the usefulness of padding with zeroes eludes me, it * might even cause problems */ - long have = nbytes - offset; + int32 have = nbytes - offset; memset(p, 0, sizeof(union VALUETYPE)); if (have > 0) memcpy(p, s + offset, have); @@ -345,8 +383,8 @@ mcheck(p, m) union VALUETYPE* p; struct magic *m; { - register unsigned long l = m->value.l; - register unsigned long v; + register uint32 l = m->value.l; + register uint32 v; int matched; if ( (m->value.s[0] == 'x') && (m->value.s[1] == '\0') ) { @@ -389,7 +427,7 @@ struct magic *m; register int len = m->vallen; while (--len >= 0) - if ((v = *b++ - *a++) != 0) + if ((v = *b++ - *a++) != '\0') break; } break; @@ -403,21 +441,21 @@ struct magic *m; switch (m->reln) { case 'x': if (debug) - (void) fprintf(stderr, "%lu == *any* = 1\n", v); + (void) fprintf(stderr, "%u == *any* = 1\n", v); matched = 1; break; case '!': matched = v != l; if (debug) - (void) fprintf(stderr, "%lu != %lu = %d\n", + (void) fprintf(stderr, "%u != %u = %d\n", v, l, matched); break; case '=': matched = v == l; if (debug) - (void) fprintf(stderr, "%lu == %lu = %d\n", + (void) fprintf(stderr, "%u == %u = %d\n", v, l, matched); break; @@ -425,13 +463,13 @@ struct magic *m; if (m->flag & UNSIGNED) { matched = v > l; if (debug) - (void) fprintf(stderr, "%lu > %lu = %d\n", + (void) fprintf(stderr, "%u > %u = %d\n", v, l, matched); } else { - matched = (long) v > (long) l; + matched = (int32) v > (int32) l; if (debug) - (void) fprintf(stderr, "%ld > %ld = %d\n", + (void) fprintf(stderr, "%d > %d = %d\n", v, l, matched); } break; @@ -440,13 +478,13 @@ struct magic *m; if (m->flag & UNSIGNED) { matched = v < l; if (debug) - (void) fprintf(stderr, "%lu < %lu = %d\n", + (void) fprintf(stderr, "%u < %u = %d\n", v, l, matched); } else { - matched = (long) v < (long) l; + matched = (int32) v < (int32) l; if (debug) - (void) fprintf(stderr, "%ld < %ld = %d\n", + (void) fprintf(stderr, "%d < %d = %d\n", v, l, matched); } break; @@ -454,14 +492,14 @@ struct magic *m; case '&': matched = (v & l) == l; if (debug) - (void) fprintf(stderr, "((%lx & %lx) == %lx) = %d\n", + (void) fprintf(stderr, "((%x & %x) == %x) = %d\n", v, l, l, matched); break; case '^': matched = (v & l) != l; if (debug) - (void) fprintf(stderr, "((%lx & %lx) != %lx) = %d\n", + (void) fprintf(stderr, "((%x & %x) != %x) = %d\n", v, l, l, matched); break; |