diff options
| author | David E. O'Brien <obrien@FreeBSD.org> | 2011-10-06 06:01:12 +0000 |
|---|---|---|
| committer | David E. O'Brien <obrien@FreeBSD.org> | 2011-10-06 06:01:12 +0000 |
| commit | dacc26abaa8ab61168c45f0716bea144fa8afd14 (patch) | |
| tree | d25590ff6bfc3386fbca9494d26b8761e3d33410 /Magdir | |
| parent | b873e82fedb8026ff397a976c38d4182a21da706 (diff) | |
Diffstat (limited to 'Magdir')
232 files changed, 2674 insertions, 673 deletions
diff --git a/Magdir/acorn b/Magdir/acorn index 5acb31ee2043..4202be912419 100644 --- a/Magdir/acorn +++ b/Magdir/acorn @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ # acorn: file(1) magic for files found on Acorn systems # diff --git a/Magdir/adi b/Magdir/adi index 12d7da59bcde..2fe79d443119 100644 --- a/Magdir/adi +++ b/Magdir/adi @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ # adi: file(1) magic for ADi's objects # From Gregory McGarry <g.mcgarry@ieee.org> # diff --git a/Magdir/adventure b/Magdir/adventure index 7b30c496144e..febc2077f129 100644 --- a/Magdir/adventure +++ b/Magdir/adventure @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: adventure,v 1.13 2010/12/31 16:32:54 christos Exp $ # adventure: file(1) magic for Adventure game files # # from Allen Garvin <earendil@faeryland.tamu-commerce.edu> @@ -16,18 +17,26 @@ # Infocom (see z-machine) #------------------------------------------------------------------------------ # Z-machine: file(1) magic for Z-machine binaries. +# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> # -# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which -# appears to be a version-0 Z-machine binary. +#http://www.gnelson.demon.co.uk/zspec/sect11.html +#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt +#http://en.wikipedia.org/wiki/Z-machine +# The first byte is the Z-machine revision; it is always between 1 and 8. We +# had false matches (for instance, inbig5.ocp from the Omega TeX extension as +# well as an occasional MP3 file), so we sanity-check the version number. # -# The (false match) message is to correct that behavior. Perhaps it is -# not needed. +# It might be possible to sanity-check the release number as well, as it seems +# (at least in classic Infocom games) to always be a relatively small number, +# always under 150 or so, but as this isn't rigorous, we'll wait on that until +# it becomes clear that it's needed. # -16 belong&0xfe00f0f0 0x3030 Infocom game data ->0 ubyte 0 (false match) ->0 ubyte >0 (Z-machine %d, ->>2 ubeshort x Release %d / ->>18 string >\0 Serial %.6s) +0 ubyte >0 +>0 ubyte <9 +>>16 belong&0xfe00f0f0 0x3030 Infocom game data +>>>0 ubyte x (Z-machine %d, +>>>>2 ubeshort x Release %d / +>>>>18 string >\0 Serial %.6s) #------------------------------------------------------------------------------ # Glulx: file(1) magic for Glulx binaries. @@ -45,10 +54,9 @@ # For Quetzal and blorb magic see iff -# TADS (Text Adventure Development System) +# TADS (Text Adventure Development System) version 2 # All files are machine-independent (games compile to byte-code) and are tagged -# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is -# on the way). +# with a version string of the form "V2.<digit>.<digit>\0". # Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 0 string TADS2\ bin TADS >9 belong !0x0A0D1A00 game data, CORRUPTED @@ -73,6 +81,19 @@ >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data +# TADS (Text Adventure Development System) version 3 +# Game files start with "T3-image\015\012\032" +0 string T3-image\015\012\032 +>11 leshort x TADS 3 game data (format version %d) +# Saved game files start with "T3-state-v####\015\012\032" +# where #### is a format version number +0 string T3-state-v +>14 string \015\012\032 TADS 3 saved game data (format version +>>10 byte x %c +>>11 byte x \b%c +>>12 byte x \b%c +>>13 byte x \b%c) + # Danny Milosavljevic <danny.milo@gmx.net> # this are adrift (adventure game standard) game files, extension .taf # depending on version magic continues with 0x93453E6139FA (V 4.0) diff --git a/Magdir/allegro b/Magdir/allegro index 41f4ad6cd236..b937c9cb0254 100644 --- a/Magdir/allegro +++ b/Magdir/allegro @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ # allegro: file(1) magic for Allegro datafiles # Toby Deshane <hac@shoelace.digivill.net> # diff --git a/Magdir/alliant b/Magdir/alliant index 69cf4b44d742..962020238e17 100644 --- a/Magdir/alliant +++ b/Magdir/alliant @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ # alliant: file(1) magic for Alliant FX series a.out files # # If the FX series is the one that had a processor with a 68K-derived diff --git a/Magdir/alpha b/Magdir/alpha deleted file mode 100644 index c0191fb931e4..000000000000 --- a/Magdir/alpha +++ /dev/null @@ -1,30 +0,0 @@ -#------------------------------------------------------------------------------ -# alpha architecture description -# - -0 leshort 0603 COFF format alpha ->22 leshort&030000 !020000 executable ->24 leshort 0410 pure ->24 leshort 0413 paged ->22 leshort&020000 !0 dynamically linked ->16 lelong !0 not stripped ->16 lelong 0 stripped ->22 leshort&030000 020000 shared library ->24 leshort 0407 object ->27 byte x - version %d ->26 byte x .%d ->28 byte x -%d - -# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> -# -# The actual magic number is just "Core", followed by a 2-byte version -# number; however, treating any file that begins with "Core" as a Digital -# UNIX core dump file may produce too many false hits, so we include one -# byte of the version number as well; DU 5.0 appears only to be up to -# version 2. -# -0 string Core\001 Alpha COFF format core dump (Digital UNIX) ->24 string >\0 \b, from '%s' -0 string Core\002 Alpha COFF format core dump (Digital UNIX) ->24 string >\0 \b, from '%s' - diff --git a/Magdir/amanda b/Magdir/amanda index 2b9565083ee0..395ef545c2ba 100644 --- a/Magdir/amanda +++ b/Magdir/amanda @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ # amanda: file(1) magic for amanda file format # 0 string AMANDA:\ AMANDA diff --git a/Magdir/amigaos b/Magdir/amigaos index bb98299d89ff..f4c9cf265317 100644 --- a/Magdir/amigaos +++ b/Magdir/amigaos @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $ # amigaos: file(1) magic for AmigaOS binary formats: # diff --git a/Magdir/animation b/Magdir/animation index 46b23ecd507c..c09a26ac85e3 100644 --- a/Magdir/animation +++ b/Magdir/animation @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: animation,v 1.45 2011/09/06 11:00:06 christos Exp $ # animation: file(1) magic for animation/movie formats # # animation formats @@ -29,7 +30,7 @@ #!:mime image/x-quicktime 4 string pckg Apple QuickTime compressed archive !:mime application/x-quicktime-player -4 string/B jP JPEG 2000 image +4 string/W jP JPEG 2000 image !:mime image/jp2 4 string ftyp ISO Media >8 string isom \b, MPEG v4 system, version 1 @@ -41,10 +42,18 @@ !:mime video/mp4 >8 string mp7t \b, MPEG v4 system, MPEG v7 XML >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML ->8 string/B jp2 \b, JPEG 2000 +>8 string/W jp2 \b, JPEG 2000 !:mime image/jp2 +>8 string 3ge \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3gg \b, MPEG v4 system, 3GPP +!:mime video/3gpp >8 string 3gp \b, MPEG v4 system, 3GPP !:mime video/3gpp +>8 string 3gs \b, MPEG v4 system, 3GPP +!:mime video/3gpp +>8 string 3g2 \b, MPEG v4 system, 3GPP2 +!:mime video/3gpp2 >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) @@ -52,13 +61,13 @@ !:mime video/mp4 >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC !:mime video/3gpp ->8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC !:mime audio/mp4 ->8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC +>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC !:mime video/mp4 ->8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted ->8 string/B M4B \b, MPEG v4 system, iTunes bookmarked ->8 string/B qt \b, Apple QuickTime movie +>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted +>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked +>8 string/W qt \b, Apple QuickTime movie !:mime video/quicktime # MPEG sequences @@ -71,6 +80,7 @@ >>7 byte x \b @ L %u 0 belong&0xFFFFFF00 0x00000100 >3 byte 0xBA MPEG sequence +!:mime video/mpeg >>4 byte &0x40 \b, v2, program multiplex >>4 byte ^0x40 \b, v1, system multiplex >3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) @@ -80,6 +90,7 @@ >>4 byte 88 \b, extended >>6 byte x \b @ L %u >3 byte 0xB0 MPEG sequence, v4 +!:mime video/mpeg4-generic >>5 belong 0x000001B5 >>>9 byte &0x80 >>>>10 byte&0xF0 16 \b, video @@ -149,6 +160,7 @@ >>4 byte 252 \b, FGS @ L4 >>4 byte 253 \b, FGS @ L5 >3 byte 0xB5 MPEG sequence, v4 +!:mime video/mpeg4-generic >>4 byte &0x80 >>>5 byte&0xF0 16 \b, video (missing profile header) >>>5 byte&0xF0 32 \b, still texture (missing profile header) @@ -159,6 +171,7 @@ >>4 byte&0xF8 24 \b, mesh (missing profile header) >>4 byte&0xF8 32 \b, face (missing profile header) >3 byte 0xB3 MPEG sequence +!:mime video/mpeg >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B5 \b, v2, @@ -469,6 +482,7 @@ # MPA, M2A 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 +!:mime audio/mpeg # rate >2 byte&0xF0 0x10 \b, 32 kbps >2 byte&0xF0 0x20 \b, 48 kbps @@ -503,6 +517,7 @@ # MP3, M25A 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 +!:mime audio/mpeg # rate >2 byte&0xF0 0x10 \b, 8 kbps >2 byte&0xF0 0x20 \b, 16 kbps @@ -697,6 +712,7 @@ # Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 0 belong 0x3026b275 Microsoft ASF +!:mime video/x-ms-asf # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 0 string \x8aMNG MNG video data, @@ -718,16 +734,16 @@ 3 string \x0D\x0AVersion:Vivo Vivo video data # VRML (Virtual Reality Modelling Language) -0 string/b #VRML\ V1.0\ ascii VRML 1 file +0 string/w #VRML\ V1.0\ ascii VRML 1 file !:mime model/vrml -0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file +0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file !:mime model/vrml # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] # From Michel Briand <michelbriand@free.fr> -0 string \<?xml\ version=" +0 string/t \<?xml\ version=" !:strength +1 ->20 search/1000/cb \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text +>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text !:mime model/x3d #--------------------------------------------------------------------------- @@ -794,7 +810,8 @@ !:mime video/h264 # Type: Bink Video -# URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container +# Extension: .bik +# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container # From: <hoehle@users.sourceforge.net> 2008-07-18 0 string BIK Bink Video >3 regex =[a-z] rev.%s @@ -813,3 +830,66 @@ >>51 byte&0x20 !0 stereo #>>51 byte&0x10 0 FFT #>>51 byte&0x10 !0 DCT + +# Type: NUT Container +# URL: http://wiki.multimedia.cx/index.php?title=NUT +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string nut/multimedia\ container\0 NUT multimedia container + +# Type: Nullsoft Video (NSV) +# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video +# From: Mike Melanson <mike@multimedia.cx> +0 string NSVf Nullsoft Video + +# Type: REDCode Video +# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode +# From: Mike Melanson <mike@multimedia.cx> +4 string RED1 REDCode Video + +# Type: MTV Multimedia File +# URL: http://wiki.multimedia.cx/index.php?title=MTV +# From: Mike Melanson <mike@multimedia.cx> +0 string AMVS MTV Multimedia File + +# Type: ARMovie +# URL: http://wiki.multimedia.cx/index.php?title=ARMovie +# From: Mike Melanson <mike@multimedia.cx> +0 string ARMovie\012 ARMovie + +# Type: Interplay MVE Movie +# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE +# From: Mike Melanson <mike@multimedia.cx> +0 string Interplay\040MVE\040File\032 Interplay MVE Movie + +# Type: Windows Television DVR File +# URL: http://wiki.multimedia.cx/index.php?title=WTV +# From: Mike Melanson <mike@mutlimedia.cx> +# This takes the form of a Windows-style GUID +0 bequad 0xB7D800203749DA11 +>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media + +# Type: Sega FILM/CPK Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM +# From: Mike Melanson <mike@multimedia.cx> +0 string FILM Sega FILM/CPK Multimedia, +>32 belong x %d x +>28 belong x %d + +# Type: Nintendo THP Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=THP +# From: Mike Melanson <mike@multimedia.cx> +0 string THP\0 Nintendo THP Multimedia + +# Type: BBC Dirac Video +# URL: http://wiki.multimedia.cx/index.php?title=Dirac +# From: Mike Melanson <mike@multimedia.cx> +0 string BBCD BBC Dirac Video + +# Type: RAD Game Tools Smacker Multimedia +# URL: http://wiki.multimedia.cx/index.php?title=Smacker +# From: Mike Melanson <mike@multimedia.cx> +0 string SMK RAD Game Tools Smacker Multimedia +>3 byte x version %c, +>4 lelong x %d x +>8 lelong x %d, +>12 lelong x %d frames diff --git a/Magdir/apl b/Magdir/apl index 040043191938..d717e377dc3e 100644 --- a/Magdir/apl +++ b/Magdir/apl @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL # workspaces) # diff --git a/Magdir/apple b/Magdir/apple index 669ab04dcc6f..dad3eee9258d 100644 --- a/Magdir/apple +++ b/Magdir/apple @@ -1,7 +1,9 @@ + #------------------------------------------------------------------------------ +# $File: apple,v 1.24 2010/11/25 15:00:12 christos Exp $ # apple: file(1) magic for Apple file formats # -0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text +0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data diff --git a/Magdir/applix b/Magdir/applix index 9d348d152450..f3f362eec773 100644 --- a/Magdir/applix +++ b/Magdir/applix @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ # applix: file(1) magic for Applixware # From: Peter Soos <sp@osb.hu> # diff --git a/Magdir/archive b/Magdir/archive index b75fac0838b5..45ccfd721bc1 100644 --- a/Magdir/archive +++ b/Magdir/archive @@ -1,4 +1,5 @@ #------------------------------------------------------------------------------ +# $File: archive,v 1.68 2011/09/07 15:47:51 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -243,13 +244,13 @@ # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # updated by Joerg Jenderek ->9 string \0 ->>0 string KWAJ +>9 string \0 +>>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes ->>>>18 ubyte >0x65 ->>>>>18 string x \b, was %.8s ->>>>>(10.b-4) string x \b.%.3s +>>>>18 ubyte >0x65 +>>>>>18 string x \b, was %.8s +>>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET @@ -274,7 +275,7 @@ # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield -0 string \x13\x5d\x65\x8c InstallShield Z archive Data +0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA @@ -533,7 +534,7 @@ >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data -2 string -lz LZS archive data +2 string -lz LZS archive data 2 string -sw1- Swag archive data # RAR archiver (Greg Roelofs, newt@uchicago.edu) @@ -560,79 +561,140 @@ # [JW] see exe section for self-extracting version 0 string UC2\x1a UC2 archive data -# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) -0 string PK\003\004 ->4 byte 0x00 Zip archive data -!:mime application/zip ->4 byte 0x09 Zip archive data, at least v0.9 to extract -!:mime application/zip ->4 byte 0x0a Zip archive data, at least v1.0 to extract -!:mime application/zip ->4 byte 0x0b Zip archive data, at least v1.1 to extract -!:mime application/zip ->0x161 string WINZIP Zip archive data, WinZIP self-extracting -!:mime application/zip ->4 byte 0x14 ->>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract +# PKZIP multi-volume archive +0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract !:mime application/zip -# OpenOffice.org / KOffice / StarOffice documents -# Listed here because they ARE zip files -# -# From: Abel Cheung <abel@oaka.org> ->4 byte 0x14 ->>30 string mimetype +# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) +0 string PK\003\004 + +# Specialised zip formats which start with a member named 'mimetype' +# (stored uncompressed, with no 'extra field') containing the file's MIME type. +# Check for have 8-byte name, 0-byte extra field, name "mimetype", and +# contents starting with "application/": +>26 string \x8\0\0\0mimetypeapplication/ -# KOffice (1.2 or above) formats ->>>50 string vnd.kde. KOffice (>=1.2) ->>>>58 string karbon Karbon document ->>>>58 string kchart KChart document ->>>>58 string kformula KFormula document ->>>>58 string kivio Kivio document ->>>>58 string kontour Kontour document ->>>>58 string kpresenter KPresenter document ->>>>58 string kspread KSpread document ->>>>58 string kword KWord document +# KOffice / OpenOffice & StarOffice / OpenDocument formats +# From: Abel Cheung <abel@oaka.org> -# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) ->>>50 string vnd.sun.xml. OpenOffice.org 1.x ->>>>62 string writer Writer ->>>>>68 byte !0x2e document ->>>>>68 string .template template ->>>>>68 string .global global document ->>>>62 string calc Calc ->>>>>66 byte !0x2e spreadsheet ->>>>>66 string .template template ->>>>62 string draw Draw ->>>>>66 byte !0x2e document ->>>>>66 string .template template ->>>>62 string impress Impress ->>>>>69 byte !0x2e presentation ->>>>>69 string .template template ->>>>62 string math Math document ->>>>62 string base Database file +# KOffice (1.2 or above) formats +# (mimetype contains "application/vnd.kde.<SUBTYPE>") +>>50 string vnd.kde. KOffice (>=1.2) +>>>58 string karbon Karbon document +>>>58 string kchart KChart document +>>>58 string kformula KFormula document +>>>58 string kivio Kivio document +>>>58 string kontour Kontour document +>>>58 string kpresenter KPresenter document +>>>58 string kspread KSpread document +>>>58 string kword KWord document -# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) -# http://lists.oasis-open.org/archives/office/200505/msg00006.html ->>>50 string vnd.oasis.opendocument. OpenDocument ->>>>73 string text ->>>>>77 byte !0x2d Text +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") +>>50 string vnd.sun.xml. OpenOffice.org 1.x +>>>62 string writer Writer +>>>>68 byte !0x2e document +>>>>68 string .template template +>>>>68 string .global global document +>>>62 string calc Calc +>>>>66 byte !0x2e spreadsheet +>>>>66 string .template template +>>>62 string draw Draw +>>>>66 byte !0x2e document +>>>>66 string .template template +>>>62 string impress Impress +>>>>69 byte !0x2e presentation +>>>>69 string .template template +>>>62 string math Math document +>>>62 string base Database file + +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# http://lists.oasis-open.org/archives/office/200505/msg00006.html +# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") +>>50 string vnd.oasis.opendocument. OpenDocument +>>>73 string text +>>>>77 byte !0x2d Text !:mime application/vnd.oasis.opendocument.text ->>>>>77 string -template Text Template ->>>>>77 string -web HTML Document Template ->>>>>77 string -master Master Document ->>>>73 string graphics Drawing ->>>>>81 string -template Template ->>>>73 string presentation Presentation ->>>>>85 string -template Template ->>>>73 string spreadsheet Spreadsheet ->>>>>84 string -template Template ->>>>73 string chart Chart ->>>>>78 string -template Template ->>>>73 string formula Formula ->>>>>80 string -template Template ->>>>73 string database Database ->>>>73 string image Image +>>>>77 string -template Text Template +!:mime application/vnd.oasis.opendocument.text-template +>>>>77 string -web HTML Document Template +!:mime application/vnd.oasis.opendocument.text-web +>>>>77 string -master Master Document +!:mime application/vnd.oasis.opendocument.text-master +>>>73 string graphics +>>>>81 byte !0x2d Drawing +!:mime application/vnd.oasis.opendocument.graphics +>>>>81 string -template Template +!:mime application/vnd.oasis.opendocument.graphics-template +>>>73 string presentation +>>>>85 byte !0x2d Presentation +!:mime application/vnd.oasis.opendocument.presentation +>>>>85 string -template Template +!:mime application/vnd.oasis.opendocument.presentation-template +>>>73 string spreadsheet +>>>>84 byte !0x2d Spreadsheet +!:mime application/vnd.oasis.opendocument.spreadsheet +>>>>84 string -template Template +!:mime application/vnd.oasis.opendocument.spreadsheet-template +>>>73 string chart +>>>>78 byte !0x2d Chart +!:mime application/vnd.oasis.opendocument.chart +>>>>78 string -template Template +!:mime application/vnd.oasis.opendocument.chart-template +>>>73 string formula +>>>>80 byte !0x2d Formula +!:mime application/vnd.oasis.opendocument.formula +>>>>80 string -template Template +!:mime application/vnd.oasis.opendocument.formula-template +>>>73 string database Database +!:mime application/vnd.oasis.opendocument.database +>>>73 string image +>>>>78 byte !0x2d Image +!:mime application/vnd.oasis.opendocument.image +>>>>78 string -template Template +!:mime application/vnd.oasis.opendocument.image-template + +# EPUB (OEBPS) books using OCF (OEBPS Container Format) +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. +# (mimetype contains "application/epub+zip") +>>50 string epub+zip EPUB ebook data +!:mime application/epub+zip + +# Catch other ZIP-with-mimetype formats +# In a ZIP file, the bytes immediately after a member's contents are +# always "PK". The 2 regex rules here print the "mimetype" member's +# contents up to the first 'P'. Luckily, most MIME types don't contain +# any capital 'P's. This is a kludge. +# (mimetype contains "application/<OTHER>") +>>50 string !epub+zip +>>>50 string !vnd.oasis.opendocument. +>>>>50 string !vnd.sun.xml. +>>>>>50 string !vnd.kde. +>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +!:mime application/zip +# (mimetype contents other than "application/*") +>26 string \x8\0\0\0mimetype +>>38 string !application/ +>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +!:mime application/zip + +# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) +# Next line excludes specialized formats: +>26 string !\x8\0\0\0mimetype Zip archive data +!:mime application/zip +>>4 byte 0x09 \b, at least v0.9 to extract +>>4 byte 0x0a \b, at least v1.0 to extract +>>4 byte 0x0b \b, at least v1.1 to extract +>>4 byte 0x14 \b, at least v2.0 to extract +>>4 byte 0x2d \b, at least v3.0 to extract +>>0x161 string WINZIP \b, WinZIP self-extracting + +# StarView Metafile +# From Pierre Ducroquet <pinaraf@pinaraf.info> +0 string VCLMTF StarView MetaFile +>6 beshort x \b, version %d +>8 belong x \b, size %d # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data @@ -651,7 +713,7 @@ !:mime application/octet-stream # -# LBR. NB: May conflict with the questionable +# LBR. NB: May conflict with the questionable # "binary Computer Graphics Metafile" format. # 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data @@ -667,10 +729,10 @@ # From Rafael Laboissiere <rafael@laboissiere.net> # The Project Revision Control System (see # http://prcs.sourceforge.net) generates a packaged project -# file which is recognized by the following entry: +# file which is recognized by the following entry: 0 leshort 0xeb81 PRCS packaged project -# Microsoft cabinets +# Microsoft cabinets # by David Necas (Yeti) <yeti@physics.muni.cz> #0 string MSCF\0\0\0\0 Microsoft cabinet file data, #>25 byte x v%d @@ -678,7 +740,7 @@ # MPi: All CABs have version 1.3, so this is pointless. # Better magic in debian-additions. -# GTKtalog catalogs +# GTKtalog catalogs # by David Necas (Yeti) <yeti@physics.muni.cz> 4 string gtktalog\ GTKtalog catalog data, >13 string 3 version 3 @@ -697,12 +759,12 @@ !:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> -0 beshort 0x0e0f Atari MSA archive data ->2 beshort x \b, %d sectors per track ->4 beshort 0 \b, 1 sided ->4 beshort 1 \b, 2 sided ->6 beshort x \b, starting track: %d ->8 beshort x \b, ending track: %d +0 beshort 0x0e0f Atari MSA archive data +>2 beshort x \b, %d sectors per track +>4 beshort 0 \b, 1 sided +>4 beshort 1 \b, 2 sided +>6 beshort x \b, starting track: %d +>8 beshort x \b, ending track: %d # Alternate ZIP string (amc@arwen.cs.berkeley.edu) 0 string PK00PK\003\004 Zip archive data @@ -747,7 +809,7 @@ # DR-DOS 7.03 Packed File *.??_ 0 string Packed\ File\ Personal NetWare Packed File ->12 string x \b, was "%.12s" +>12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck <tilman@code-monkey.de> @@ -803,3 +865,38 @@ >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum +# Type: Parity Archive +# From: Daniel van Eeden <daniel_e@dds.nl> +0 string PAR2 Parity Archive Volume Set + +# Bacula volume format. (Volumes always start with a block header.) +# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +12 string BB02 Bacula volume +>20 bedate x \b, started %s + +# ePub is XHTML + XML inside a ZIP archive. The first member of the +# archive must be an uncompressed file called 'mimetype' with contents +# 'application/epub+zip' + +# start by checking that this is a ZIP archive, then check for the +# proper mimetype file +# From: Ralf Brown <ralf.brown@gmail.com> +0 string PK\003\004 +>0x1E string mimetypeapplication/epub+zip EPUB document +!:mime application/epub+zip + +# From: "MichaÅ‚ Górny" <mgorny@gentoo.org> +# ZPAQ: http://mattmahoney.net/dc/zpaq.html +0 string zPQ ZPAQ stream +>3 byte x \b, level %d + +# BBeB ebook, unencrypted (LRF format) +# URL: http://www.sven.de/librie/Librie/LrfFormat +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted +>8 beshort x \b, version %d +>36 byte 1 \b, front-to-back +>36 byte 16 \b, back-to-front +>42 beshort x \b, (%dx, +>44 beshort x %d) diff --git a/Magdir/asterix b/Magdir/asterix index d89504a2407f..a9ea885cdb8c 100644 --- a/Magdir/asterix +++ b/Magdir/asterix @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ # asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character # strings as "long" - we assume they're just strings: # From: guy@netapp.com (Guy Harris) diff --git a/Magdir/att3b b/Magdir/att3b index 884ad4aa4332..96880111e057 100644 --- a/Magdir/att3b +++ b/Magdir/att3b @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ # att3b: file(1) magic for AT&T 3B machines # # The `versions' should be un-commented if they work for you. diff --git a/Magdir/audio b/Magdir/audio index 04f80eb47ca3..328a12c333b1 100644 --- a/Magdir/audio +++ b/Magdir/audio @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: audio,v 1.63 2011/09/06 11:00:06 christos Exp $ # audio: file(1) magic for sound formats (see also "iff") # # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), @@ -116,7 +118,7 @@ # Real Audio (Magic .ra\0375) 0 belong 0x2e7261fd RealAudio sound file !:mime audio/x-pn-realaudio -0 string .RMF RealMedia file +0 string .RMF\0\0\0 RealMedia file !:mime application/vnd.rn-realmedia #video/x-pn-realvideo #video/vnd.rn-realvideo @@ -250,12 +252,17 @@ >0x36 string >\0 author: "%s" >0x56 string >\0 copyright: "%s" -# IRCAM <mpruett@sgi.com> -# VAX and MIPS files are little-endian; Sun and NeXT are big-endian -0 belong 0x64a30100 IRCAM file (VAX) -0 belong 0x64a30200 IRCAM file (Sun) +# IRCAM sound files - Michael Pruett <michael@68k.org> +# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html +0 belong 0x64a30100 IRCAM file (VAX little-endian) +0 belong 0x0001a364 IRCAM file (VAX big-endian) +0 belong 0x64a30200 IRCAM file (Sun big-endian) +0 belong 0x0002a364 IRCAM file (Sun little-endian) 0 belong 0x64a30300 IRCAM file (MIPS little-endian) -0 belong 0x64a30400 IRCAM file (NeXT) +0 belong 0x0003a364 IRCAM file (MIPS big-endian) +0 belong 0x64a30400 IRCAM file (NeXT big-endian) +0 belong 0x64a30400 IRCAM file (NeXT big-endian) +0 belong 0x0004a364 IRCAM file (NeXT little-endian) # NIST SPHERE <mpruett@sgi.com> 0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file @@ -276,8 +283,8 @@ >21 ubyte <128 note %d, >22 byte =0 replay 5.485 KHz >22 byte =1 replay 8.084 KHz ->22 byte =2 replay 10.971 Khz ->22 byte =3 replay 16.168 Khz +>22 byte =2 replay 10.971 KHz +>22 byte =3 replay 16.168 KHz >22 byte =4 replay 21.942 KHz >22 byte =5 replay 32.336 KHz >22 byte =6 replay 43.885 KHz @@ -306,6 +313,15 @@ >122 byte&0x1 =1 PAL >122 byte&0x1 =0 NTSC +# Type: SNES SPC700 sound files +# From: Josh Triplett <josh@freedesktop.org> +0 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file +>&0 string 0.30 \b, version %s +>>0x23 byte 0x1B \b, without ID666 tag +>>0x23 byte 0x1A \b, with ID666 tag +>>>0x2E string >\0 \b, song "%.32s" +>>>0x4E string >\0 \b, game "%.32s" + # Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - !:mime audio/x-mod @@ -604,3 +620,18 @@ # URL: http://filext.com/detaillist.php?extdetail=AMR # From: Russell Coker <russell@coker.com.au> 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) + +# Type: SuperCollider 3 Synth Definition File Format +# From: Mario Lang <mlang@debian.org> +0 string SCgf SuperCollider3 Synth Definition file, +>4 belong x version %d + +# Type: True Audio Lossless Audio +# URL: http://wiki.multimedia.cx/index.php?title=True_Audio +# From: Mike Melanson <mike@multimedia.cx> +0 string TTA1 True Audio Lossless Audio + +# Type: WavPack Lossless Audio +# URL: http://wiki.multimedia.cx/index.php?title=WavPack +# From: Mike Melanson <mike@multimedia.cx> +0 string wvpk WavPack Lossless Audio diff --git a/Magdir/basis b/Magdir/basis index 1813c0e0f0a7..128aa4c77c2d 100644 --- a/Magdir/basis +++ b/Magdir/basis @@ -1,4 +1,6 @@ + #---------------------------------------------------------------- +# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ # basis: file(1) magic for BBx/Pro5-files # Oliver Dammer <dammer@olida.de> 2005/11/07 # http://www.basis.com business-basic-files. diff --git a/Magdir/bflt b/Magdir/bflt index 5e288d130b07..03eb59d34ae1 100644 --- a/Magdir/bflt +++ b/Magdir/bflt @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ # bFLT: file(1) magic for BFLT uclinux binary files # # From Philippe De Muyter <phdm@macqel.be> diff --git a/Magdir/blcr b/Magdir/blcr new file mode 100644 index 000000000000..70ea563e182d --- /dev/null +++ b/Magdir/blcr @@ -0,0 +1,25 @@ +# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files +# http://ftg.lbl.gov/checkpoint +0 string C\0\0\0R\0\0\0 BLCR +>16 lelong 1 x86 +>16 lelong 3 alpha +>16 lelong 5 x86-64 +>16 lelong 7 ARM +>8 lelong x context data (little endian, version %d) +# Uncomment the following only of your "file" program supports "search" +#>0 search/1024 VMA\06 for kernel +#>>&1 byte x %d. +#>>&2 byte x %d. +#>>&3 byte x %d +0 string \0\0\0C\0\0\0R BLCR +>16 belong 2 SPARC +>16 belong 4 ppc +>16 belong 6 ppc64 +>16 belong 7 ARMEB +>16 belong 8 SPARC64 +>8 belong x context data (big endian, version %d) +# Uncomment the following only of your "file" program supports "search" +#>0 search/1024 VMA\06 for kernel +#>>&1 byte x %d. +#>>&2 byte x \b%d. +#>>&3 byte x \b%d diff --git a/Magdir/blender b/Magdir/blender index 6ef79507ef9b..1814738ab4a2 100644 --- a/Magdir/blender +++ b/Magdir/blender @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ # blender: file(1) magic for Blender 3D related files # # Native format rule v1.2. For questions use the developers list diff --git a/Magdir/blit b/Magdir/blit index 7a470ed4a669..d5b687fce60b 100644 --- a/Magdir/blit +++ b/Magdir/blit @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine # # Note that this 0407 conflicts with several other a.out formats... diff --git a/Magdir/bout b/Magdir/bout index 4cd6f76ef540..693cc2a4bd81 100644 --- a/Magdir/bout +++ b/Magdir/bout @@ -1,4 +1,6 @@ -# + +#------------------------------------------------------------------------------ +# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ # i80960 b.out objects and archives # 0 long 0x10d i960 b.out relocatable object diff --git a/Magdir/bsdi b/Magdir/bsdi index ad547599ba83..be16e3a1a23b 100644 --- a/Magdir/bsdi +++ b/Magdir/bsdi @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $ # bsdi: file(1) magic for BSD/OS (from BSDI) objects # diff --git a/Magdir/bsi b/Magdir/bsi new file mode 100644 index 000000000000..51a62891c2c8 --- /dev/null +++ b/Magdir/bsi @@ -0,0 +1,9 @@ +# Chiasmus is a encryption standard developed by the German Federal +# Office for Information Security (Bundesamt fuer Sicherheit in der +# Informationstechnik). + +# Extension: .xia +0 string XIA1 Chiasmus encrypted data + +# Extension: .xis +0 string XIS Chiasmus key diff --git a/Magdir/btsnoop b/Magdir/btsnoop index 85d867a446d4..d72daad877d7 100644 --- a/Magdir/btsnoop +++ b/Magdir/btsnoop @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ # BTSnoop: file(1) magic for BTSnoop files # # From <marcel@holtmann.org> diff --git a/Magdir/c-lang b/Magdir/c-lang index 895e37f656bc..cb6d10abccad 100644 --- a/Magdir/c-lang +++ b/Magdir/c-lang @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: c-lang,v 1.14 2009/09/19 16:28:08 christos Exp $ # c-lang: file(1) magic for C programs (or REXX) # diff --git a/Magdir/c64 b/Magdir/c64 index f8a8b76c6b3b..eea3e319101a 100644 --- a/Magdir/c64 +++ b/Magdir/c64 @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ # c64: file(1) magic for various commodore 64 related files # # From: Dirk Jagdmann <doj@cubic.org> diff --git a/Magdir/cad b/Magdir/cad index 757dab6be089..8069b1d47e10 100644 --- a/Magdir/cad +++ b/Magdir/cad @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: cad,v 1.10 2010/12/25 14:33:43 christos Exp $ # autocad: file(1) magic for cad files # @@ -50,9 +51,54 @@ # AutoCad, from Nahuel Greco # AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) -0 string AC1012 AutoCad (release 12) -0 string AC1013 AutoCad (release 13) -0 string AC1014 AutoCad (release 14) +0 string AC1012 DWG AutoDesk AutoCad (release 12) +0 string AC1013 DWG AutoDesk AutoCad (release 13) +0 string AC1014 DWG AutoDesk AutoCad (release 14) +# A new version of AutoCAD DWG +# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, +# ICQ 358572321) +# From various sources like: +# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html +0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 +0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 +0 string AC1024 DWG AutoDesk AutoCAD 2010/2011 + +# KOMPAS 2D drawing from ASCON +# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor +# gathered nor specification +# ASCON http://ascon.net/main/ in English, +# http://ascon.ru/ main site in Russian +# Extension is CDW for drawing and FRW for fragment of drawing +# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, +# ICQ 358572321, http://vkontakte.ru/id16076543) +# From: +# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 +# (in russian) and my experiments +0 string KF +>2 belong 0x4E00000C Kompas drawing 12.0 SP1 +>2 belong 0x4D00000C Kompas drawing 12.0 +>2 belong 0x3200000B Kompas drawing 11.0 SP1 +>2 belong 0x3100000B Kompas drawing 11.0 +>2 belong 0x2310000A Kompas drawing 10.0 SP1 +>2 belong 0x2110000A Kompas drawing 10.0 +>2 belong 0x08000009 Kompas drawing 9.0 SP1 +>2 belong 0x05000009 Kompas drawing 9.0 +>2 belong 0x33010008 Kompas drawing 8+ +>2 belong 0x1A000008 Kompas drawing 8.0 +>2 belong 0x2C010107 Kompas drawing 7+ +>2 belong 0x05000007 Kompas drawing 7.0 +>2 belong 0x32000006 Kompas drawing 6+ +>2 belong 0x09000006 Kompas drawing 6.0 +>2 belong 0x5C009005 Kompas drawing 5.11R03 +>2 belong 0x54009005 Kompas drawing 5.11R02 +>2 belong 0x51009005 Kompas drawing 5.11R01 +>2 belong 0x22009005 Kompas drawing 5.10R03 +>2 belong 0x22009005 Kompas drawing 5.10R02 mar +>2 belong 0x21009005 Kompas drawing 5.10R02 febr +>2 belong 0x19009005 Kompas drawing 5.10R01 +>2 belong 0xF4008005 Kompas drawing 5.9R01.003 +>2 belong 0x1C008005 Kompas drawing 5.9R01.002 +>2 belong 0x11008005 Kompas drawing 5.8R01.003 # CAD: file(1) magic for computer aided design files # Phillip Griffith <phillip dot griffith at gmail dot com> diff --git a/Magdir/cafebabe b/Magdir/cafebabe index e25c974dd55b..6400e2f3b0e2 100644 --- a/Magdir/cafebabe +++ b/Magdir/cafebabe @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: cafebabe,v 1.8 2009/09/19 16:28:08 christos Exp $ # Cafe Babes unite! # # Since Java bytecode and Mach-O fat-files have the same magic number, the test diff --git a/Magdir/cddb b/Magdir/cddb index 42ca416bd89b..5d8a8517e276 100644 --- a/Magdir/cddb +++ b/Magdir/cddb @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ # CDDB: file(1) magic for CDDB(tm) format CD text data files # # From <steve@gracenote.com> @@ -7,4 +9,4 @@ # CDDB-enabled CD player applications. # -0 search/1/b #\040xmcd CDDB(tm) format CD text data +0 search/1/w #\040xmcd CDDB(tm) format CD text data diff --git a/Magdir/chord b/Magdir/chord index 3639f3c4917e..00d0bec65a5e 100644 --- a/Magdir/chord +++ b/Magdir/chord @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ # chord: file(1) magic for Chord music sheet typesetting utility input files # # From Philippe De Muyter <phdm@macqel.be> @@ -7,3 +8,8 @@ # 0 string {title Chord text file +# Type: PowerTab file format +# URL: http://www.power-tab.net/ +# From: Jelmer Vernooij <jelmer@samba.org> +0 string ptab\003\000 Power-Tab v3 Tablature File +0 string ptab\004\000 Power-Tab v4 Tablature File diff --git a/Magdir/cisco b/Magdir/cisco index 77e3efb5e39d..0279bbb5b5af 100644 --- a/Magdir/cisco +++ b/Magdir/cisco @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ # cisco: file(1) magic for cisco Systems routers # # Most cisco file-formats are covered by the generic elf code diff --git a/Magdir/citrus b/Magdir/citrus index 6d4479455391..ff2471ea75ac 100644 --- a/Magdir/citrus +++ b/Magdir/citrus @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ # citrus locale declaration # diff --git a/Magdir/clarion b/Magdir/clarion index 5f5f6e75613c..cff7a3bdd0e0 100644 --- a/Magdir/clarion +++ b/Magdir/clarion @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ # clarion: file(1) magic for # Clarion Personal/Professional Developer # (v2 and above) # From: Julien Blache <jb@jblache.org> diff --git a/Magdir/claris b/Magdir/claris index 368b473260ec..a2b120a834c5 100644 --- a/Magdir/claris +++ b/Magdir/claris @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: claris,v 1.5 2009/09/19 16:28:08 christos Exp $ # claris: file(1) magic for claris # "H. Nanosecond" <aldomel@ix.netcom.com> # Claris Works a word processor, etc. diff --git a/Magdir/clipper b/Magdir/clipper index c325cb8f7c7d..9f4753405906 100644 --- a/Magdir/clipper +++ b/Magdir/clipper @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. # # XXX - what byte order does the Clipper use? diff --git a/Magdir/commands b/Magdir/commands index 0942802d9101..caba6541372e 100644 --- a/Magdir/commands +++ b/Magdir/commands @@ -1,69 +1,74 @@ #------------------------------------------------------------------------------ +# $File: commands,v 1.41 2011/05/02 12:36:41 christos Exp $ # commands: file(1) magic for various shells and interpreters # -#0 string : shell archive or script for antique kernel text -0 string/b #!\ /bin/sh POSIX shell script text executable +#0 string/w : shell archive or script for antique kernel text +0 string/wt #!\ /bin/sh POSIX shell script text executable !:mime text/x-shellscript -0 string/b #!\ /bin/csh C shell script text executable +0 string/wt #!\ /bin/csh C shell script text executable !:mime text/x-shellscript # korn shell magic, sent by George Wu, gwu@clyde.att.com -0 string/b #!\ /bin/ksh Korn shell script text executable +0 string/wt #!\ /bin/ksh Korn shell script text executable !:mime text/x-shellscript -0 string/b #!\ /bin/tcsh Tenex C shell script text executable +0 string/wt #!\ /bin/tcsh Tenex C shell script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable +0 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable +0 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable !:mime text/x-shellscript # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) -0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable +0 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +0 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable +0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable +0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable !:mime text/x-shellscript -0 string/b #!\ /bin/nawk new awk script text executable +0 string/wt #!\ /bin/nawk new awk script text executable !:mime text/x-nawk -0 string/b #!\ /usr/bin/nawk new awk script text executable +0 string/wt #!\ /usr/bin/nawk new awk script text executable !:mime text/x-nawk -0 string/b #!\ /usr/local/bin/nawk new awk script text executable +0 string/wt #!\ /usr/local/bin/nawk new awk script text executable !:mime text/x-nawk -0 string/b #!\ /bin/gawk GNU awk script text executable +0 string/wt #!\ /bin/gawk GNU awk script text executable !:mime text/x-gawk -0 string/b #!\ /usr/bin/gawk GNU awk script text executable +0 string/wt #!\ /usr/bin/gawk GNU awk script text executable !:mime text/x-gawk -0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable +0 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable !:mime text/x-gawk # -0 string/b #!\ /bin/awk awk script text executable +0 string/wt #!\ /bin/awk awk script text executable !:mime text/x-awk -0 string/b #!\ /usr/bin/awk awk script text executable +0 string/wt #!\ /usr/bin/awk awk script text executable !:mime text/x-awk -# update to distinguish from *.vcf files -# this is broken because postscript has /EBEGIN{ for example. -#0 search/Bb BEGIN { awk script text +0 regex =^\\s*BEGIN\\s*[{] awk script text # AT&T Bell Labs' Plan 9 shell -0 string/b #!\ /bin/rc Plan 9 rc shell script text executable +0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) -0 string/b #!\ /bin/bash Bourne-Again shell script text executable +0 string/wt #!\ /bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable !:mime text/x-shellscript -0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable +0 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable !:mime text/x-shellscript # using env -0 string #!/usr/bin/env a ->15 string >\0 %s script text executable -0 string #!\ /usr/bin/env a ->16 string >\0 %s script text executable +0 string/t #!/usr/bin/env a +>15 string/t >\0 %s script text executable +0 string/t #!\ /usr/bin/env a +>16 string/t >\0 %s script text executable # PHP scripts # Ulf Harnhammar <ulfh@update.uu.se> @@ -73,11 +78,21 @@ !:mime text/x-php 0 search/1 =<?\r PHP script text !:mime text/x-php -0 search/1/b #!\ /usr/local/bin/php PHP script text executable +0 search/1/w #!\ /usr/local/bin/php PHP script text executable !:mime text/x-php -0 search/1/b #!\ /usr/bin/php PHP script text executable +0 search/1/w #!\ /usr/bin/php PHP script text executable +!:mime text/x-php +# Smarty compiled template, http://www.smarty.net/ +# Elan Ruusamäe <glen@delfi.ee> +0 string =<?php\ /*\ Smarty\ version Smarty compiled template +>24 regex [0-9.]+ \b, version %s !:mime text/x-php 0 string Zend\x00 PHP script Zend Optimizer data -0 string $! DCL command file +0 string/t $! DCL command file + +# Type: Pdmenu +# URL: http://packages.debian.org/pdmenu +# From: Edward Betts <edward@debian.org> +0 string #!/usr/bin/pdmenu Pdmenu configuration file text diff --git a/Magdir/communications b/Magdir/communications index 81417ec08371..8e1d908b6759 100644 --- a/Magdir/communications +++ b/Magdir/communications @@ -1,5 +1,6 @@ #---------------------------------------------------------------------------- +# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ # communication # TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. diff --git a/Magdir/compress b/Magdir/compress index 5e18de0b8b71..98d2e091d0c4 100644 --- a/Magdir/compress +++ b/Magdir/compress @@ -1,5 +1,5 @@ - #------------------------------------------------------------------------------ +# $File: compress,v 1.47 2011/03/08 00:39:46 christos Exp $ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. @@ -19,7 +19,7 @@ # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 # * Original filename is only at offset 10 if "extra field" absent # * Produce shorter output - notably, only report compression methods -# other than 8 ("deflate", the only method defined in RFC 1952). +# other than 8 ("deflate", the only method defined in RFC 1952). 0 string \037\213 gzip compressed data !:mime application/x-gzip >2 byte <8 \b, reserved method @@ -182,23 +182,29 @@ >4 belong 0x090A0C0D best compression # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) -# http://www.7-zip.org or DOC/7zFormat.txt +# http://www.7-zip.org or DOC/7zFormat.txt # 0 string 7z\274\257\047\034 7-zip archive data, >6 byte x version %d >7 byte x \b.%d +!:mime application/x-7z-compressed # Type: LZMA -# URL: http://www.7-zip.org/sdk.html -# From: Robert Millan <rmh@aybabtu.com> and Reuben Thomas <rrt@sc3d.org> -# Commented out because apparently not reliable (according to Debian -# bug #364260) -#0 string ]\000\000\200\000 LZMA compressed data +0 lelong 0x8000005d LZMA compressed data, +>5 lequad =0xffffffffffffffff streamed +>5 lequad !0xffffffffffffffff non-streamed, size %lld +!:mime application/x-lzma # http://tukaani.org/xz/xz-file-format.txt -0 ustring \xFD7zXZ\x00 xz compressed data +0 ustring \xFD7zXZ\x00 XZ compressed data !:mime application/x-xz +# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt +0 string LRZI LRZIP compressed data +>4 byte x - version %d +>5 byte x \b.%d +!:mime application/x-lrzip + # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data @@ -213,7 +219,12 @@ >5 byte x \b.%d >6 belong x (%d bytes) -# Type: XZ -# URL: http://tukaani.org/xz/ -0 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data -!:mime application/x-xz +0 string ArC\x01 FreeArc archive <http://freearc.org> + +# Type: DACT compressed files +0 long 0x444354C3 DACT compressed data +>4 byte >-1 (version %i. +>5 byte >-1 %i. +>6 byte >-1 %i) +>7 long >0 , original size: %i bytes +>15 long >30 , block size: %i bytes diff --git a/Magdir/console b/Magdir/console index 2af6575499ac..573dd15fd582 100644 --- a/Magdir/console +++ b/Magdir/console @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: console,v 1.18 2010/09/20 19:19:17 rrt Exp $ # Console game magic # Toby Deshane <hac@shoelace.digivill.net> # ines: file(1) magic for Marat's iNES Nintendo Entertainment System @@ -163,9 +165,13 @@ # Atari Lynx cartridge dump (EXE/BLL header) # From: "Stefan A. Haubenthal" <polluks@web.de> -0 beshort 0x8008 Lynx cartridge, ->2 beshort x RAM start $%04x ->6 string BS93 +# Double-check that the image type matches too, 0x8008 conflicts with +# 8 character OMF-86 object file headers. +0 beshort 0x8008 +>6 string BS93 Lynx homebrew cartridge +>>2 beshort x \b, RAM start $%04x +>6 string LYNX Lynx cartridge +>>2 beshort x \b, RAM start $%04x # Opera file system that is used on the 3DO console # From: Serge van den Boom <svdb@stack.nl> @@ -252,3 +258,7 @@ >>>(0x18.l-26) lelong x CRC32 0x%08x >>>(0x18.l-23) string x "%s" +# Type: scummVM savegame files +# From: Sven Hartge <debian@ds9.argh.org> +0 string SCVM ScummVM savegame +>12 string >\0 "%s" diff --git a/Magdir/convex b/Magdir/convex index b1235d7e79a8..6141a82bba08 100644 --- a/Magdir/convex +++ b/Magdir/convex @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $ # convex: file(1) magic for Convex boxes # # Convexes are big-endian. diff --git a/Magdir/cracklib b/Magdir/cracklib index a1a5a275532e..167659670d93 100644 --- a/Magdir/cracklib +++ b/Magdir/cracklib @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ # cracklib: file (1) magic for cracklib v2.7 0 lelong 0x70775631 Cracklib password index, little endian diff --git a/Magdir/ctags b/Magdir/ctags index f326cf5cf96f..f480d32338bd 100644 --- a/Magdir/ctags +++ b/Magdir/ctags @@ -1,4 +1,6 @@ + # ---------------------------------------------------------------------------- +# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 0 search/1 =!_TAG Exuberant Ctags tag file text diff --git a/Magdir/dact b/Magdir/dact index 5cca8d961601..04627c970389 100644 --- a/Magdir/dact +++ b/Magdir/dact @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ # dact: file(1) magic for DACT compressed files # 0 long 0x444354C3 DACT compressed data diff --git a/Magdir/database b/Magdir/database index 0134355f3816..956a53ba4cf1 100644 --- a/Magdir/database +++ b/Magdir/database @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: database,v 1.28 2011/09/16 19:40:40 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -267,3 +268,28 @@ >40 lequad x \b, bnum=%lld >48 lequad x \b, rnum=%lld >56 lequad x \b, fsiz=%lld + +# G-IR database made by gobject-introspect toolset, +# http://live.gnome.org/GObjectIntrospection +0 string GOBJ\nMETADATA\r\n\032 G-IR binary database +>16 byte x \b, v%d +>17 byte x \b.%d +>20 leshort x \b, %d entries +>22 leshort x \b/%d local + +# Type: QDBM Quick Database Manager +# From: Benoit Sibaud <bsibaud@april.org> +0 string \\[depot\\]\n\f Quick Database Manager, little endian +0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian + +# Type: TokyoCabinet database +# URL: http://tokyocabinet.sourceforge.net/ +# From: Benoit Sibaud <bsibaud@april.org> +0 string ToKyO\ CaBiNeT\n TokyoCabinet database +>14 string x (version %s) + +# From: Stéphane Blondon http://www.yaal.fr +# Database file for Zope (done by FileStorage) +0 string FS21 Zope Object Database File Storage (data) +# Cache file for the database of Zope (done by ClientStorage) +0 string ZEC3 Zope Object Database Client Cache File (data) diff --git a/Magdir/diamond b/Magdir/diamond index 1abd01e0300f..39d1ed6258b2 100644 --- a/Magdir/diamond +++ b/Magdir/diamond @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ # diamond: file(1) magic for Diamond system # # ... diamond is a multi-media mail and electronic conferencing system.... diff --git a/Magdir/diff b/Magdir/diff index 291bae67f55e..73f0135df86a 100644 --- a/Magdir/diff +++ b/Magdir/diff @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: diff,v 1.12 2010/12/07 16:52:52 christos Exp $ # diff: file(1) magic for diff(1) output # 0 search/1 diff\ diff output text @@ -12,3 +14,16 @@ 0 search/1 Index: RCS/CVS diff output text !:mime text/x-diff + +# bsdiff: file(1) magic for bsdiff(1) output +0 string/t BSDIFF40 bsdiff(1) patch file + + +# unified diff +0 search/4096 ---\ +>&0 search/1024 \n +>>&0 search/1 +++\ +>>>&0 search/1024 \n +>>>>&0 search/1 @@ unified diff output text +!:mime text/x-diff +!:strength + 90 diff --git a/Magdir/digital b/Magdir/digital index 615ef7a58cda..b1b77dd8c75f 100644 --- a/Magdir/digital +++ b/Magdir/digital @@ -1,23 +1,40 @@ + +#------------------------------------------------------------------------------ +# $File: digital,v 1.10 2011/05/03 01:44:17 christos Exp $ # Digital UNIX - Info # 0 string =!<arch>\n________64E Alpha archive >22 string X -- out of date # -# Alpha COFF Based Executables -# The stripped stuff really needs to be an 8 byte (64 bit) compare, -# but this works -0 leshort 0x183 COFF format alpha ->22 leshort&020000 &010000 sharable library, ->22 leshort&020000 ^010000 dynamically linked, ->24 leshort 0410 pure ->24 leshort 0413 demand paged ->8 lelong >0 executable or object module, not stripped ->8 lelong 0 ->>12 lelong 0 executable or object module, stripped ->>12 lelong >0 executable or object module, not stripped ->27 byte >0 - version %d. ->26 byte >0 %d- ->28 leshort >0 %d + +0 leshort 0603 +>>24 leshort 0410 COFF format alpha pure +>>24 leshort 0413 COFF format alpha demand paged +>>>22 leshort&030000 !020000 executable +>>>22 leshort&020000 !0 dynamically linked +>>>16 lelong !0 not stripped +>>>16 lelong 0 stripped +>>>27 byte x - version %d +>>>26 byte x \b.%d +>>>28 byte x \b-%d +>>24 leshort 0407 COFF format alpha object +>>>22 leshort&030000 020000 shared library +>>>27 byte x - version %d +>>>26 byte x \b.%d +>>>28 byte x \b-%d + +# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> +# +# The actual magic number is just "Core", followed by a 2-byte version +# number; however, treating any file that begins with "Core" as a Digital +# UNIX core dump file may produce too many false hits, so we include one +# byte of the version number as well; DU 5.0 appears only to be up to +# version 2. +# +0 string Core\001 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' +0 string Core\002 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' # # The next is incomplete, we could tell more about this format, # but its not worth it. diff --git a/Magdir/dolby b/Magdir/dolby index 230f738a209d..fee287ccf13b 100644 --- a/Magdir/dolby +++ b/Magdir/dolby @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: dolby,v 1.5 2009/09/19 16:28:08 christos Exp $ # ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> # from http://www.atsc.org/standards/a_52a.pdf # corrections, additions, etc. are always welcome! diff --git a/Magdir/dump b/Magdir/dump index cef191a2de48..1ac91e22010c 100644 --- a/Magdir/dump +++ b/Magdir/dump @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: dump,v 1.11 2009/09/19 16:28:09 christos Exp $ # dump: file(1) magic for dump file format--for new and old dump filesystems # # We specify both byte orders in order to recognize byte-swapped dumps. diff --git a/Magdir/dyadic b/Magdir/dyadic index e8a9d25d8c0f..c1a2c3c53e39 100644 --- a/Magdir/dyadic +++ b/Magdir/dyadic @@ -1,8 +1,9 @@ #------------------------------------------------------------------------------ +# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $ # Dyadic: file(1) magic for Dyalog APL. # -0 byte 0xaa +0 byte 0xaa >1 byte <4 Dyalog APL >>1 byte 0x00 incomplete workspace >>1 byte 0x01 component file @@ -10,3 +11,36 @@ >>1 byte 0x03 workspace >>2 byte x version %d >>3 byte x .%d + +0 beshort 0xaa03 Dyalog APL +>2 byte x workspace type %d +>3 byte x subtype %d +>7 byte&0x28 0x00 32-bit +>7 byte&0x28 0x20 64-bit +>7 byte&0x0c 0x00 classic +>7 byte&0x0c 0x04 unicode +>7 byte&0x88 0x00 big-endian +>7 byte&0x88 0x80 little-endian + +0 byte 0xaa Dyalog APL +>1 byte 0x00 aplcore +>1 byte 0x01 component file 32-bit non-journaled non-checksummed +>1 byte 0x02 external variable exclusive +>1 byte 0x06 external variable shared +>1 byte 0x07 session +>1 byte 0x08 mapped file 32-bit +>1 byte 0x09 component file 64-bit non-journaled non-checksummed +>1 byte 0x0a mapped file 64-bit +>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed +>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed +>1 byte 0x0d component file 32-bit level 1 journaled checksummed +>1 byte 0x0e component file 64-bit level 1 journaled checksummed +>1 byte 0x0f component file 32-bit level 2 journaled checksummed +>1 byte 0x10 component file 64-bit level 2 journaled checksummed +>1 byte 0x11 component file 32-bit level 3 journaled checksummed +>1 byte 0x12 component file 64-bit level 3 journaled checksummed +>1 byte 0x13 component file 32-bit non-journaled checksummed +>1 byte 0x14 component file 64-bit non-journaled checksummed +>1 byte 0x80 DDB + +0 short 0x6060 Dyalog APL transfer diff --git a/Magdir/ebml b/Magdir/ebml new file mode 100644 index 000000000000..d5d174329a52 --- /dev/null +++ b/Magdir/ebml @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ +# ebml: file(1) magic for various Extensible Binary Meta Language +# http://www.matroska.org/technical/specs/index.html#track +0 belong 0x1a45dfa3 EBML file +>4 search/b/100 \102\202 +>>&1 string x \b, creator %.8s diff --git a/Magdir/editors b/Magdir/editors index 0b15bf820ab6..4c5b8a669957 100644 --- a/Magdir/editors +++ b/Magdir/editors @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ # T602 editor documents # by David Necas <yeti@physics.muni.cz> 0 string @CT\ T602 document data, diff --git a/Magdir/efi b/Magdir/efi index 4eec2eb93779..7335c5cefd51 100644 --- a/Magdir/efi +++ b/Magdir/efi @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ # efi: file(1) magic for Universal EFI binaries 0 lelong 0x0ef1fab9 diff --git a/Magdir/elf b/Magdir/elf index c605495429a8..f4e7af52b950 100644 --- a/Magdir/elf +++ b/Magdir/elf @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: elf,v 1.53 2009/09/19 16:28:09 christos Exp $ # elf: file(1) magic for ELF executables # # We have to check the byte order flag to see what byte order all the diff --git a/Magdir/encore b/Magdir/encore index 63cb5d4f9f42..ef82eed64b0c 100644 --- a/Magdir/encore +++ b/Magdir/encore @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ # encore: file(1) magic for Encore machines # # XXX - needs to have the byte order specified (NS32K was little-endian, diff --git a/Magdir/epoc b/Magdir/epoc index 80229c47f38f..c67a8b66e7b6 100644 --- a/Magdir/epoc +++ b/Magdir/epoc @@ -1,11 +1,53 @@ + #------------------------------------------------------------------------------ +# $File: epoc,v 1.7 2009/09/19 16:28:09 christos Exp $ # EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] -# Stefan Praszalowicz (hpicollo@worldnet.fr) +# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> # Useful information for improving this file can be found at: # http://software.frodo.looijaard.name/psiconv/formats/Index.html -0 lelong 0x10000037 +#------------------------------------------------------------------------------ +0 lelong 0x10000037 Psion Series 5 +>4 lelong 0x10000039 font file +>4 lelong 0x1000003A printer driver +>4 lelong 0x1000003B clipboard +>4 lelong 0x10000042 multi-bitmap image +!:mime image/x-epoc-mbm +>4 lelong 0x1000006A application information file >4 lelong 0x1000006D ->>8 lelong 0x1000007F Psion Word ->>8 lelong 0x10000088 Psion Sheet ->>8 lelong 0x1000007D Psion Sketch ->>8 lelong 0x10000085 Psion TextEd +>>8 lelong 0x1000007D Sketch image +!:mime image/x-epoc-sketch +>>8 lelong 0x1000007E voice note +>>8 lelong 0x1000007F Word file +!:mime application/x-epoc-word +>>8 lelong 0x10000085 OPL program (TextEd) +!:mime application/x-epoc-opl +>>8 lelong 0x10000088 Sheet file +!:mime application/x-epoc-sheet +>>8 lelong 0x100001C4 EasyFax initialisation file +>4 lelong 0x10000073 OPO module +!:mime application/x-epoc-opo +>4 lelong 0x10000074 OPL application +!:mime application/x-epoc-app +>4 lelong 0x1000008A exported multi-bitmap image + +0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image + +0 lelong 0x10000050 Psion Series 5 +>4 lelong 0x1000006D database +>4 lelong 0x100000E4 ini file + +0 lelong 0x10000079 Psion Series 5 binary: +>4 lelong 0x00000000 DLL +>4 lelong 0x10000049 comms hardware library +>4 lelong 0x1000004A comms protocol library +>4 lelong 0x1000005D OPX +>4 lelong 0x1000006C application +>4 lelong 0x1000008D DLL +>4 lelong 0x100000AC logical device driver +>4 lelong 0x100000AD physical device driver +>4 lelong 0x100000E5 file transfer protocol +>4 lelong 0x100000E5 file transfer protocol +>4 lelong 0x10000140 printer definition +>4 lelong 0x10000141 printer definition + +0 lelong 0x1000007A Psion Series 5 executable diff --git a/Magdir/erlang b/Magdir/erlang index 6b2c4dcc3c66..b604a06828f1 100644 --- a/Magdir/erlang +++ b/Magdir/erlang @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ # erlang: file(1) magic for Erlang JAM and BEAM files # URL: http://www.erlang.org/faq/x779.html#AEN812 @@ -16,3 +17,5 @@ 79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 + +0 bequad 0x0000000000ABCDEF Erlang DETS file diff --git a/Magdir/esri b/Magdir/esri index 35c34923e056..e070e4f83f45 100644 --- a/Magdir/esri +++ b/Magdir/esri @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ # ESRI Shapefile format (.shp .shx .dbf=DBaseIII) # Based on info from # <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> diff --git a/Magdir/fcs b/Magdir/fcs index ac4b02c81cf8..613437f842c3 100644 --- a/Magdir/fcs +++ b/Magdir/fcs @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ # fcs: file(1) magic for FCS (Flow Cytometry Standard) data files # From Roger Leigh <roger@whinlatter.uklinux.net> 0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 diff --git a/Magdir/filesystems b/Magdir/filesystems index 93da429432aa..af9695b9a42a 100644 --- a/Magdir/filesystems +++ b/Magdir/filesystems @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: filesystems,v 1.61 2011/01/10 14:01:10 christos Exp $ # filesystems: file(1) magic for different filesystems # 0 string \366\366\366\366 PC formatted floppy with no filesystem @@ -202,7 +203,7 @@ # http://www.bcdwb.de/bcdw/index_e.htm >3 string BCDL >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) -# mbr partion table entries +# mbr partition table entries # OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs >3 string !MS >>3 string !SYSLINUX @@ -256,7 +257,7 @@ #>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d >>>>>>>>>>>>502 ulelong x \b, startsector %u >>>>>>>>>>>>506 ulelong x \b, %u sectors -# mbr partion table entries end +# mbr partition table entries end # http://www.acronis.de/ #FAT label=ACRONIS\ SZ #OEM-ID=BOOTWIZ0 @@ -882,13 +883,41 @@ # Minix filesystems - Juan Cespedes <cespedes@debian.org> -0x410 leshort 0x137f Minix filesystem -0x410 beshort 0x137f Minix filesystem (big endian) ->0x402 beshort !0 \b, %d zones +0x410 leshort 0x137f +!:strength / 2 +>0x402 beshort < 100 Minix filesystem, V1, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x137f +!:strength / 2 +>0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x138f +!:strength / 2 +>0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x138f +!:strength / 2 +>0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x2468 +>0x402 beshort < 100 Minix filesystem, V2, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x2468 +>0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones +>0x1e string minix \b, bootable + +0x410 leshort 0x2478 +>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x2478 +>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones +>0x1e string minix \b, bootable +0x410 beshort 0x2478 +>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones +>0x1e string minix \b, bootable +0x410 leshort 0x4d5a +>0x402 beshort !0 Minix filesystem, V3, %d zones >0x1e string minix \b, bootable -0x410 leshort 0x138f Minix filesystem, 30 char names -0x410 leshort 0x2468 Minix filesystem, version 2 -0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names # romfs filesystems - Juan Cespedes <cespedes@debian.org> 0 string -rom1fs- romfs filesystem, version 1 @@ -1084,6 +1113,8 @@ # ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> # ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> +# volume label and UUID Russell Coker +# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d >0x43e leshort x \b.%d @@ -1099,25 +1130,32 @@ # else large RO_COMPAT? >>>0x464 lelong >0x0000007 ext4 filesystem data # else large INCOMPAT? ->>0x460 lelong >0x000003f ext4 filesystem data +>>0x460 lelong >0x000003f ext4 filesystem data +>0x468 belong x \b, UUID=%08x +>0x46c beshort x \b-%04x +>0x46e beshort x \b-%04x +>0x470 beshort x \b-%04x +>0x472 belong x \b-%08x +>0x476 beshort x \b%04x +>0x478 string >0 \b, volume name "%s" # General flags for any ext* fs ->0x460 lelong &0x0000004 (needs journal recovery) ->0x43a leshort &0x0000002 (errors) +>0x460 lelong &0x0000004 (needs journal recovery) +>0x43a leshort &0x0000002 (errors) # INCOMPAT flags ->0x460 lelong &0x0000001 (compressed) -#>0x460 lelong &0x0000002 (filetype) -#>0x460 lelong &0x0000010 (meta bg) ->0x460 lelong &0x0000040 (extents) ->0x460 lelong &0x0000080 (64bit) -#>0x460 lelong &0x0000100 (mmp) -#>0x460 lelong &0x0000200 (flex bg) +>0x460 lelong &0x0000001 (compressed) +#>0x460 lelong &0x0000002 (filetype) +#>0x460 lelong &0x0000010 (meta bg) +>0x460 lelong &0x0000040 (extents) +>0x460 lelong &0x0000080 (64bit) +#>0x460 lelong &0x0000100 (mmp) +#>0x460 lelong &0x0000200 (flex bg) # RO_INCOMPAT flags -#>0x464 lelong &0x0000001 (sparse super) ->0x464 lelong &0x0000002 (large files) ->0x464 lelong &0x0000008 (huge files) -#>0x464 lelong &0x0000010 (gdt checksum) -#>0x464 lelong &0x0000020 (many subdirs) -#>0x463 lelong &0x0000040 (extra isize) +#>0x464 lelong &0x0000001 (sparse super) +>0x464 lelong &0x0000002 (large files) +>0x464 lelong &0x0000008 (huge files) +#>0x464 lelong &0x0000010 (gdt checksum) +#>0x464 lelong &0x0000020 (many subdirs) +#>0x463 lelong &0x0000040 (extra isize) # SGI disk labels - Nathan Scott <nathans@debian.org> 0 belong 0x0BE5A941 SGI disk label (volume header) @@ -1195,7 +1233,7 @@ # CDROM Filesystems # Modified for UDF by gerardo.cacciari@gmail.com -32769 string CD001 +32769 string CD001 # !:mime application/x-iso9660-image >38913 string !NSR0 ISO 9660 CD-ROM filesystem data >38913 string NSR0 UDF filesystem data @@ -1211,6 +1249,9 @@ !:mime application/x-iso9660-image 32776 string CDROM High Sierra CD-ROM filesystem data +# .cso files +0 string CISO Compressed ISO CD image + # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian >4 lelong x size %lu @@ -1235,6 +1276,7 @@ # reiserfs - russell@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 0x10034 string ReIsEr2Fs ReiserFS V3.6 +0x10034 string ReIsEr3Fs ReiserFS V3.6.19 >0x1002c leshort x block size %d >0x10032 leshort &2 (mounted or unclean) >0x10000 lelong x num blocks %d @@ -1255,11 +1297,70 @@ 0 string VoIP\ Startup\ and Aculab VoIP firmware >35 string x format %s -# u-boot/PPCBoot image file -# From: Mark Brown <broonie@sirena.org.uk> -0 belong 0x27051956 u-boot/PPCBoot image ->4 string PPCBoot ->>12 string x version %s +# From: Mark Brown <broonie@sirena.org.uk> [old] +# From: Behan Webster <behanw@websterwood.com> +0 belong 0x27051956 u-boot legacy uImage, +>32 string x %s, +>28 byte 0 Invalid os/ +>28 byte 1 OpenBSD/ +>28 byte 2 NetBSD/ +>28 byte 3 FreeBSD/ +>28 byte 4 4.4BSD/ +>28 byte 5 Linux/ +>28 byte 6 SVR4/ +>28 byte 7 Esix/ +>28 byte 8 Solaris/ +>28 byte 9 Irix/ +>28 byte 10 SCO/ +>28 byte 11 Dell/ +>28 byte 12 NCR/ +>28 byte 13 LynxOS/ +>28 byte 14 VxWorks/ +>28 byte 15 pSOS/ +>28 byte 16 QNX/ +>28 byte 17 Firmware/ +>28 byte 18 RTEMS/ +>28 byte 19 ARTOS/ +>28 byte 20 Unity OS/ +>28 byte 21 INTEGRITY/ +>29 byte 0 \bInvalid CPU, +>29 byte 1 \bAlpha, +>29 byte 2 \bARM, +>29 byte 3 \bIntel x86, +>29 byte 4 \bIA64, +>29 byte 5 \bMIPS, +>29 byte 6 \bMIPS 64-bit, +>29 byte 7 \bPowerPC, +>29 byte 8 \bIBM S390, +>29 byte 9 \bSuperH, +>29 byte 10 \bSparc, +>29 byte 11 \bSparc 64-bit, +>29 byte 12 \bM68K, +>29 byte 13 \bNios-32, +>29 byte 14 \bMicroBlaze, +>29 byte 15 \bNios-II, +>29 byte 16 \bBlackfin, +>29 byte 17 \bAVR32, +>29 byte 18 \bSTMicroelectronics ST200, +>30 byte 0 Invalid Image +>30 byte 1 Standalone Program +>30 byte 2 OS Kernel Image +>30 byte 3 RAMDisk Image +>30 byte 4 Multi-File Image +>30 byte 5 Firmware Image +>30 byte 6 Script File +>30 byte 7 Filesystem Image (any type) +>30 byte 8 Binary Flat Device Tree BLOB +>31 byte 0 (Not compressed), +>31 byte 1 (gzip), +>31 byte 2 (bzip2), +>31 byte 3 (lzma), +>12 belong x %d bytes, +>8 bedate x %s, +>16 belong x Load Address: 0x%08X, +>20 belong x Entry Point: 0x%08X, +>4 belong x Header CRC: 0x%08X, +>24 belong x Data CRC: 0x%08X # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian @@ -1272,28 +1373,46 @@ >28 beshort <3 >>8 belong x %d bytes, >28 beshort >2 ->>63 bequad x %lld bytes, +>>28 beshort <4 +>>>63 bequad x %lld bytes, +>>28 beshort >3 +>>>40 bequad x %lld bytes, #>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort >1 ->>51 belong x blocksize: %d bytes, ->39 bedate x created: %s +>>28 beshort <4 +>>>51 belong x blocksize: %d bytes, +>>28 beshort >3 +>>>12 belong x blocksize: %d bytes, +>28 beshort <4 +>>39 bedate x created: %s +>28 beshort >3 +>>8 bedate x created: %s 0 string hsqs Squashfs filesystem, little endian, >28 leshort x version %d. >30 leshort x \b%d, >28 leshort <3 >>8 lelong x %d bytes, >28 leshort >2 ->>63 lequad x %lld bytes, +>>28 leshort <4 +>>>63 lequad x %lld bytes, +>>28 leshort >3 +>>>40 lequad x %lld bytes, #>>63 lelong x %d bytes, >4 lelong x %d inodes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort >1 ->>51 lelong x blocksize: %d bytes, ->39 ledate x created: %s +>>28 leshort <4 +>>>51 lelong x blocksize: %d bytes, +>>28 leshort >3 +>>>12 lelong x blocksize: %d bytes, +>28 leshort <4 +>>39 ledate x created: %s +>28 leshort >3 +>>8 ledate x created: %s 0 string td\000 floppy image data (TeleDisk) @@ -1312,6 +1431,10 @@ >>>>>>>>&0 bedate !0 incremental since: %s #---------------------------------------------------------- +#delta ISO Daniel Novotny (dnovotny@redhat.com) +0 string DISO Delta ISO data +>4 belong x version %d + # VMS backup savesets - gerardo.cacciari@gmail.com # 4 string \x01\x00\x01\x00\x01\x00 @@ -1356,13 +1479,17 @@ 0 string CPQRFBLO Compaq/HP RILOE floppy image #------------------------------------------------------------------------------ -# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com -# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is -# mapped to VBN 2 of [000000]INDEXF.SYS;1 +# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). +# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, +# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com # -1008 string DECFILE11B Files-11 On-Disk Structure +1008 string DECFILE11 Files-11 On-Disk Structure >525 byte x Level %d ->525 byte x (ODS-%d OpenVMS file system), +>525 byte x (ODS-%d); +>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; +>1017 string B +>>525 byte 2 VAX/VMS or OpenVMS file system; +>>525 byte 5 OpenVMS Alpha or Itanium file system; >984 string x volume label is '%-12.12s' # From: Thomas Klausner <wiz@NetBSD.org> @@ -1377,9 +1504,13 @@ # From Eric Sandeen # GFS2 -0x10000 belong 0x01161970 GFS2 Filesystem ->0x10024 belong x (blocksize %d, ->0x10060 string >\0 lockproto %s) +0x10000 belong 0x01161970 +>0x10018 belong 0x0000051d GFS1 Filesystem +>>0x10024 belong x (blocksize %d, +>>0x10060 string >\0 lockproto %s) +>0x10018 belong 0x00000709 GFS2 Filesystem +>>0x10024 belong x (blocksize %d, +>>0x10060 string >\0 lockproto %s) # BTRFS 0x10040 string _BHRfS_M BTRFS Filesystem @@ -1392,3 +1523,49 @@ # dvdisaster's .ecc # From: "Nelson A. de Oliveira" <naoliv@gmail.com> 0 string *dvdisaster* dvdisaster error correction file + +# xfs metadump image +# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog +# but can we do the << ? For now it's always 512 (0x200) anyway. +0 string XFSM +>0x200 string XFSB XFS filesystem metadump image + +# Type: CROM filesystem +# From: Werner Fink <werner@suse.de> +0 string CROMFS CROMFS +>6 string >\0 \b version %2.2s, +>8 ulequad >0 \b block data at %lld, +>16 ulequad >0 \b fblock table at %lld, +>24 ulequad >0 \b inode table at %lld, +>32 ulequad >0 \b root at %lld, +>40 ulelong >0 \b fblock size = %ld, +>44 ulelong >0 \b block size = %ld, +>48 ulequad >0 \b bytes = %lld + +# Type: xfs metadump image +# From: Daniel Novotny <dnovotny@redhat.com> +# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog +# but can we do the << ? For now it's always 512 (0x200) anyway. +0 string XFSM +>0x200 string XFSB XFS filesystem metadump image + +# Type: delta ISO +# From: Daniel Novotny <dnovotny@redhat.com> +0 string DISO Delta ISO data, +>4 belong x version %d + +# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) +# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0x8000 string JFS1 +# Because it's text-only magic, check a binary value (version) to be sure. +# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be +# mountable. +>&0 lelong <3 JFS2 filesystem image +# Label is followed by a UUID; we have to limit string length to avoid +# appending the UUID in the case of a 16-byte label. +>>&144 regex [\x20-\x7E]{1,16} (label "%s") +>>&0 lequad x \b, %lld blocks +>>&8 lelong x \b, blocksize %d +>>&32 lelong&0x00000006 >0 (dirty) +>>&36 lelong >0 (compressed) diff --git a/Magdir/flash b/Magdir/flash index 0b985f22b7c8..dea35aed0bde 100644 --- a/Magdir/flash +++ b/Magdir/flash @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ # flash: file(1) magic for Macromedia Flash file format # # See @@ -17,5 +18,8 @@ !:mime video/x-flv # +# Yosu Gomez +0 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document +0 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document # From Dave Wilson 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document diff --git a/Magdir/fonts b/Magdir/fonts index 31ff8a2c8b1e..917d372e6ef6 100644 --- a/Magdir/fonts +++ b/Magdir/fonts @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: fonts,v 1.23 2010/09/20 18:55:20 rrt Exp $ # fonts: file(1) magic for font data # 0 search/1 FONT ASCII vfont text @@ -9,6 +11,9 @@ 0 string %!PS-AdobeFont-1. PostScript Type 1 font text >20 string >\0 (%s) 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data +0 string %!FontType1 PostScript Type 1 font program data +6 string %!FontType1 PostScript Type 1 font program data +0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text # X11 font files in SNF (Server Natural Format) format 0 belong 00000004 X11 SNF font data, MSB first @@ -51,15 +56,30 @@ # True Type fonts 0 string \000\001\000\000\000 TrueType font data +!:mime application/x-font-ttf 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font +# TrueType/OpenType font collections (.ttc) +# http://www.microsoft.com/typography/otspec/otff.htm 0 string ttcf TrueType font collection data +>4 belong 0x00010000 \b, 1.0 +>>8 belong >0 \b, %d fonts +>4 belong 0x00020000 \b, 2.0 +>>8 belong >0 \b, %d fonts +# 0x44454947 = 'DSIG' +>>>16 belong 0x44534947 \b, digitally signed # Opentype font data from Avi Bercovich -0 string OTTO OpenType font data +0 string OTTO OpenType font data +!:mime application/vnd.ms-opentype # Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 0 string SplineFontDB: Spline Font Database +!:mime application/vnd.font-fontforge-sfd >14 string x version %s + +# EOT +34 string LP Embedded OpenType (EOT) +!:mime application/vnd.ms-fontobject diff --git a/Magdir/fortran b/Magdir/fortran index f42c7c8a8d52..e2ef0cdb754c 100644 --- a/Magdir/fortran +++ b/Magdir/fortran @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: fortran,v 1.6 2009/09/19 16:28:09 christos Exp $ # FORTRAN source 0 regex/100 \^[Cc][\ \t] FORTRAN program !:mime text/x-fortran diff --git a/Magdir/frame b/Magdir/frame index 3699b44223fb..babe89027156 100644 --- a/Magdir/frame +++ b/Magdir/frame @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is diff --git a/Magdir/freebsd b/Magdir/freebsd index be304177702a..a01ac4a28575 100644 --- a/Magdir/freebsd +++ b/Magdir/freebsd @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ # freebsd: file(1) magic for FreeBSD objects # # All new-style FreeBSD magic numbers are in host byte order (i.e., diff --git a/Magdir/fsav b/Magdir/fsav index ccc6d596c21a..0a7a7f802056 100644 --- a/Magdir/fsav +++ b/Magdir/fsav @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $ # fsav: file(1) magic for datafellows fsav virus definition files # Anthon van der Neut (anthon@mnt.org) diff --git a/Magdir/fusecompress b/Magdir/fusecompress new file mode 100644 index 000000000000..165cf3c7720a --- /dev/null +++ b/Magdir/fusecompress @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ +# fusecompress: file(1) magic for fusecompress +0 string \037\135\211 FuseCompress(ed) data +>3 byte 0x00 (none format) +>3 byte 0x01 (bz2 format) +>3 byte 0x02 (gz format) +>3 byte 0x03 (lzo format) +>3 byte 0x04 (xor format) +>3 byte >0x04 (unknown format) +>4 long x uncompressed size: %d diff --git a/Magdir/games b/Magdir/games index 32ccdfeaab0c..3bd13f1030cf 100644 --- a/Magdir/games +++ b/Magdir/games @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: games,v 1.12 2010/11/25 15:00:12 christos Exp $ # games: file(1) for games # Fabio Bonelli <fabiobonelli@libero.it> @@ -33,6 +35,7 @@ # Quake 0 string PACK Quake I or II world or extension +>8 lelong >0 \b, %d entries #0 string -1\x0a Quake I demo #>30 string x version %.4s @@ -152,6 +155,11 @@ 0 string =PWAD doom patch PWAD data >4 lelong x containing %d lumps +# Build engine group files (Duke Nukem, Shadow Warrior, ...) +# Extension: .grp +# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> +0 string KenSilverman Build engine group file +>12 lelong x containing %d files # Summary: Warcraft 3 save # Extension: .w3g @@ -172,7 +180,7 @@ # Modified by (1): Abel Cheung (regex, more game format) # FIXME: Some games don't have GM (game type) 0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format ->2 search/0x200 GM[ +>2 search/0x200/b GM[ >>&0 string 1] (Go) >>&0 string 2] (Othello) >>&0 string 3] (chess) @@ -214,13 +222,6 @@ >>&0 string 39] (Gipf) >>&0 string 40] (Kropki) - -# Summary: Civilization 4 video -# Extension: .bik -# Created by: Abel Cheung <abelcheung@gmail.com> -0 string BIKi Civilization 4 Video - - ############################################## # NetImmerse/Gamebryo game engine entries @@ -243,3 +244,14 @@ >&0 string n\ NetImmerse game engine file >>&0 regex [0-9a-z.]+ \b, version %s +# Type: SGF Smart Game Format +# URL: http://www.red-bean.com/sgf/ +# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> +2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format +>2 regex/c GM\\[1\\] - Go Game +>2 regex/c GM\\[6\\] - BackGammon Game +>2 regex/c GM\\[11\\] - Hex Game +>2 regex/c GM\\[18\\] - Amazons Game +>2 regex/c GM\\[19\\] - Octi Game +>2 regex/c GM\\[20\\] - Gess Game +>2 regex/c GM\\[21\\] - twix Game diff --git a/Magdir/gcc b/Magdir/gcc index ee726f3a5ade..893d0d91e692 100644 --- a/Magdir/gcc +++ b/Magdir/gcc @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ # gcc: file(1) magic for GCC special files # 0 string gpch GCC precompiled header diff --git a/Magdir/geo b/Magdir/geo new file mode 100644 index 000000000000..924c71e93562 --- /dev/null +++ b/Magdir/geo @@ -0,0 +1,105 @@ + +#------------------------------------------------------------------------------ +# $File: geo,v 1.1 2010/02/23 23:40:07 christos Exp $ +# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> + +###################################################################### +# +# Acoustic Doppler Current Profilers (ADCP) +# +###################################################################### + +0 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) + +###################################################################### +# +# Metadata +# +###################################################################### + +0 string Identification_Information FGDC ASCII metadata + +###################################################################### +# +# Seimsic / Subbottom +# +###################################################################### + +# Knudsen subbottom chirp profiler - Binary File Format: B9 +# KEB D409-03167 V1.75 Huffman +0 string KEB\ Knudsen seismic KEL binary (KEB) - +>4 regex [-A-Z0-9]* Software: %s +>>&1 regex V[0-9]*\.[0-9]* version %s + +###################################################################### +# +# LIDAR - Laser altimetry or bathy +# +###################################################################### + + +# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data +0 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar +>4 regex [0-9]*\.[0-9]* version %s + +0 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data +>3 byte x version %d . +>4 byte x %d + + +###################################################################### +# +# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ +# +###################################################################### + +# GeoAcoustics - GeoSwath Plus +4 beshort 0x2002 GeoSwath RDF +0 string Start:- GeoSwatch auf text file + +# Seabeam 2100 +# mbsystem code mb41 +0 string SB2100 SeaBeam 2100 multibeam sonar +0 string SB2100DR SeaBeam 2100 DR multibeam sonar +0 string SB2100PR SeaBeam 2100 PR multibeam sonar + +# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor +# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. +0 string $HSF XSE multibeam + +# mb121 http://www.saic.com/maritime/gsf/ +8 string GSF-v SAIC generic sensor format (GSF) sonar data, +>&0 regex [0-9]*\.[0-9]* version %s + +# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm +# mb161 +9 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format + +# MBSystem processing caches the mbinfo output +1 string Swath\ Data\ File: mbsystem info cache + +# Caris John Hughes Clark format +0 string HDCS Caris multibeam sonar related data +1 string Start/Stop\ parameter\ header: Caris ASCII project summary + +###################################################################### +# +# Visualization and 3D modeling +# +###################################################################### + +# IVS - IVS3d.com Tagged Data Represetation +0 string %%\ TDR\ 2.0 IVS Fledermaus TDR file + +# http://www.ecma-international.org/publications/standards/Ecma-363.htm +# 3D in PDFs +0 string U3D ECMA-363, Universal 3D + +###################################################################### +# +# Support files +# +###################################################################### + +# https://midas.psi.ch/elog/ +0 string $@MID@$ elog journal entry diff --git a/Magdir/geos b/Magdir/geos index af1df7b71945..66c2bd1a2904 100644 --- a/Magdir/geos +++ b/Magdir/geos @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ # GEOS files (Vidar Madsen, vidar@gimp.org) # semi-commonly used in embedded and handheld systems. 0 belong 0xc745c153 GEOS diff --git a/Magdir/gimp b/Magdir/gimp index 674bbfba62e2..a360bd8e124b 100644 --- a/Magdir/gimp +++ b/Magdir/gimp @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: gimp,v 1.7 2010/09/20 18:55:20 rrt Exp $ # GIMP Gradient: file(1) magic for the GIMP's gradient data files # by Federico Mena <federico@nuclecu.unam.mx> @@ -10,6 +12,7 @@ # ('Bucky' LaDieu, nega@vt.edu) 0 string gimp\ xcf GIMP XCF image data, +!:mime image/x-xcf >9 string file version 0, >9 string v version >>10 string >\0 %s, diff --git a/Magdir/gnome-keyring b/Magdir/gnome-keyring index 80a4f882c167..463688fe7dcb 100644 --- a/Magdir/gnome-keyring +++ b/Magdir/gnome-keyring @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: gnome-keyring,v 1.2 2009/09/19 16:28:09 christos Exp $ # GNOME keyring # Contributed by Josh Triplett # FIXME: Could be simplified if pstring supported two-byte counts diff --git a/Magdir/gnu b/Magdir/gnu index 66c670c55fa7..55df7b74582f 100644 --- a/Magdir/gnu +++ b/Magdir/gnu @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: gnu,v 1.11 2009/09/19 16:28:09 christos Exp $ # gnu: file(1) magic for various GNU tools # # GNU nlsutils message catalog file format diff --git a/Magdir/gnumeric b/Magdir/gnumeric index 76dfa90684eb..928ad3eed12a 100644 --- a/Magdir/gnumeric +++ b/Magdir/gnumeric @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ # gnumeric: file(1) magic for Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so # they will ordinarily reported as "compressed", but at least -z helps diff --git a/Magdir/grace b/Magdir/grace index a5f143359ec3..25bd759edca7 100644 --- a/Magdir/grace +++ b/Magdir/grace @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ # ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE # # ACE/gr binary diff --git a/Magdir/graphviz b/Magdir/graphviz index 831a00259506..b944d4637c6b 100644 --- a/Magdir/graphviz +++ b/Magdir/graphviz @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ # graphviz: file(1) magic for http://www.graphviz.org/ # FIXME: These patterns match too generally. For example, the first diff --git a/Magdir/gringotts b/Magdir/gringotts index 6e833a3e1d1b..2bfef1b7f7de 100644 --- a/Magdir/gringotts +++ b/Magdir/gringotts @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ # gringotts: file(1) magic for Gringotts # http://devel.pluto.linux.it/projects/Gringotts/ # author: Germano Rizzo <mano@pluto.linux.it> diff --git a/Magdir/hitachi-sh b/Magdir/hitachi-sh index a096eebf1f19..96067e9ba524 100644 --- a/Magdir/hitachi-sh +++ b/Magdir/hitachi-sh @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $ # hitach-sh: file(1) magic for Hitachi Super-H # # Super-H COFF diff --git a/Magdir/hp b/Magdir/hp index 2d064cc9971a..3201c1567c8a 100644 --- a/Magdir/hp +++ b/Magdir/hp @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ # hp: file(1) magic for Hewlett Packard machines (see also "printer") # # XXX - somebody should figure out whether any byte order needs to be diff --git a/Magdir/human68k b/Magdir/human68k index d8070f725d04..b3d66ce5d089 100644 --- a/Magdir/human68k +++ b/Magdir/human68k @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats # Magic too short! #0 string HU Human68k diff --git a/Magdir/ibm370 b/Magdir/ibm370 index 8cd9da27ae6a..37d17bd8a549 100644 --- a/Magdir/ibm370 +++ b/Magdir/ibm370 @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ # ibm370: file(1) magic for IBM 370 and compatibles. # # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". diff --git a/Magdir/ibm6000 b/Magdir/ibm6000 index 6870c3121ade..72755fafc498 100644 --- a/Magdir/ibm6000 +++ b/Magdir/ibm6000 @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: ibm6000,v 1.9 2009/09/19 16:28:09 christos Exp $ # ibm6000: file(1) magic for RS/6000 and the RT PC. # 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module diff --git a/Magdir/iff b/Magdir/iff index 4d2a832c6e95..b991ab749306 100644 --- a/Magdir/iff +++ b/Magdir/iff @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $ # iff: file(1) magic for Interchange File Format (see also "audio" & "images") # # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic @@ -51,6 +52,13 @@ >8 string AMFF \b, AMFF AmigaMetaFile format >8 string WZRD \b, WZRD StormWIZARD resource >8 string DOC\ \b, DOC desktop publishing document +>8 string WVQA \b, Westwood Studios VQA Multimedia, +>>24 leshort x %d video frames, +>>26 leshort x %d x +>>28 leshort x %d +>8 string MOVE \b, Wing Commander III Video +>>12 string _PC_ \b, PC version +>>12 string 3DO_ \b, 3DO version # These go at the end of the iff rules # diff --git a/Magdir/images b/Magdir/images index 7eacf862fa04..d4e2e752b471 100644 --- a/Magdir/images +++ b/Magdir/images @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: images,v 1.70 2010/11/25 15:00:12 christos Exp $ # images: file(1) magic for image formats (see also "iff", and "c-lang" for # XPM bitmaps) # @@ -32,7 +34,7 @@ # The next byte following the magic is always whitespace. 0 search/1 P1 Netpbm PBM image text !:mime image/x-portable-bitmap -0 search/1 P2 Netpbm PGM image text +0 search/1b P2 Netpbm PGM image text !:mime image/x-portable-greymap 0 search/1 P3 Netpbm PPM image text !:mime image/x-portable-pixmap @@ -61,6 +63,25 @@ 0 string IIN1 NIFF image data !:mime image/x-niff +# Canon RAW version 1 (CRW) files are a type of Canon Image File Format +# (CIFF) file. These are apparently all little-endian. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html +0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data +!:mime image/x-canon-crw +>16 leshort x \b, version %d. +>14 leshort x \b%d + +# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic +# number. Put this above the TIFF test to make sure we detect them. +# These are apparently all little-endian. +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 +0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data +!:mime image/x-canon-cr2 +>10 byte x \b, version %d. +>11 byte x \b%d + # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) # The second word of TIFF files is the TIFF version number, 42, which has # never changed. The TIFF specification recommends testing for it. @@ -75,7 +96,7 @@ # # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... # -0 string \x89PNG\x0d\x0a\x1a\x0a PNG image +0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data !:mime image/png >16 belong x \b, %ld x >20 belong x %ld, @@ -308,11 +329,20 @@ # As described in /usr/X11R6/include/X11/XWDFile.h # used by the xwd program. # Bradford Castalia, idaeim, 1/01 -4 belong 7 XWD X Window Dump image data ->100 string >\0 \b, "%s" ->16 belong x \b, %dx ->20 belong x \b%dx ->12 belong x \b%d +# updated by Adam Buchbinder, 2/09 +# The following assumes version 7 of the format; the first long is the length +# of the header, which is at least 25 4-byte longs, and the one at offset 8 +# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, +# which is a maximum of 32. +0 belong >100 +>8 belong <3 +>>12 belong <33 +>>>4 belong 7 XWD X Window Dump image data +!:mime image/x-xwindowdump +>>>>100 string >\0 \b, "%s" +>>>>16 belong x \b, %dx +>>>>20 belong x \b%dx +>>>>12 belong x \b%d # PDS - Planetary Data System # These files use Parameter Value Language in the header section. @@ -400,8 +430,28 @@ >2 byte 1 RLE compressed # Adobe Photoshop +# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 0 string 8BPS Adobe Photoshop Image !:mime image/vnd.adobe.photoshop +>4 beshort 2 (PSB) +>18 belong x \b, %d x +>14 belong x %d, +>24 beshort 0 bitmap +>24 beshort 1 grayscale +>>12 beshort 2 with alpha +>24 beshort 2 indexed +>24 beshort 3 RGB +>>12 beshort 4 \bA +>24 beshort 4 CMYK +>>12 beshort 5 \bA +>24 beshort 7 multichannel +>24 beshort 8 duotone +>24 beshort 9 lab +>12 beshort > 1 +>>12 beshort x \b, %dx +>12 beshort 1 \b, +>22 beshort x %d-bit channel +>12 beshort > 1 \bs # XV thumbnail indicator (ThMO) 0 string P7\ 332 XV thumbnail image data @@ -529,11 +579,16 @@ # Bio-Rad .PIC is an image format used by microscope control systems # and related image processing software used by biologists. # From: Vebjorn Ljosa <vebjorn@ljosa.com> -54 leshort 12345 Bio-Rad .PIC Image File ->0 leshort >0 %hd x ->2 leshort >0 %hd, ->4 leshort =1 1 image in file ->4 leshort >1 %hd images in file +# BOOL values are two-byte integers; use them to rule out false positives. +# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt +# Samples: http://www.loci.wisc.edu/software/sample-data +14 leshort <2 +>62 leshort <2 +>>54 leshort 12345 Bio-Rad .PIC Image File +>>>0 leshort >0 %hd x +>>>2 leshort >0 %hd, +>>>4 leshort =1 1 image in file +>>>4 leshort >1 %hd images in file # From Jan "Yenya" Kasprzak <kas@fi.muni.cz> # The description of *.mrw format can be found at @@ -546,11 +601,14 @@ # Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> # Modified by (1): Abel Cheung <abelcheung@gmail.com> 0 string AT&TFORM -!:mime image/vnd.djvu >12 string DJVM DjVu multiple page document +!:mime image/vnd.djvu >12 string DJVU DjVu image or single page document +!:mime image/vnd.djvu >12 string DJVI DjVu shared document +!:mime image/vnd.djvu >12 string THUM DjVu page thumbnails +!:mime image/vnd.djvu # From Marc Espie @@ -565,7 +623,7 @@ # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data !:mime application/x-hdf -0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data +0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data !:mime application/x-hdf # From: Tobias Burnus <burnus@net-b.de> @@ -605,3 +663,68 @@ # JPEG 2000 Code Stream Bitmap # From Petr Splichal <psplicha@redhat.com> 0 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data + +# From: Rick Richardson <rick.richardson@comcast.net> +0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file + +# Type: Ulead Photo Explorer5 (.pe5) +# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) +# From: Simon Horman <horms@debian.org> +0 string IIO2H Ulead Photo Explorer5 + +# Type: X11 cursor +# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup +# From: Mathias Brodala <info@noctus.net> +0 string Xcur X11 cursor + +# Type: Olympus ORF raw images. +# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string MMOR Olympus ORF raw image data, big-endian +!:mime image/x-olympus-orf +0 string IIRO Olympus ORF raw image data, little-endian +!:mime image/x-olympus-orf +0 string IIRS Olympus ORF raw image data, little-endian +!:mime image/x-olympus-orf + +# Type: files used in modern AVCHD camcoders to store clip information +# Extension: .cpi +# From: Alexander Danilov <alexander.a.danilov@gmail.com> +0 string HDMV0100 AVCHD Clip Information + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ +# Radiance HDR; usually has .pic or .hdr extension. +0 string #?RADIANCE\n Radiance HDR image data +#!mime image/vnd.radiance + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf +# Used by the pfstools packages. The regex matches for the image size could +# probably use some work. The MIME type is made up; if there's one in +# actual common use, it should replace the one below. +0 string PFS1\x0a PFS HDR image data +#!mime image/x-pfs +>1 regex [0-9]*\ \b, %s +>>1 regex \ [0-9]{4} \bx%s + +# Type: Foveon X3F +# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# Note that the MIME type isn't defined anywhere that I can find; if +# there's a canonical type for this format, it should replace this one. +0 string FOVb Foveon X3F raw image data +!:mime image/x-x3f +>6 leshort x \b, version %d. +>4 leshort x \b%d +>28 lelong x \b, %dx +>32 lelong x \b%d + +# Paint.NET file +# From Adam Buchbinder <adam.buchbinder@gmail.com> +0 string PDN3 Paint.NET image data +!:mime image/x-paintnet + +# Not really an image. +# From: "Tano M. Fotang" <mfotang@quanteq.com> +0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) diff --git a/Magdir/inform b/Magdir/inform index ba35d61e046c..fe518ece9160 100644 --- a/Magdir/inform +++ b/Magdir/inform @@ -1,8 +1,9 @@ #------------------------------------------------------------------------------ +# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ # inform: file(1) magic for Inform interactive fiction language # URL: http://www.inform-fiction.org/ # From: Reuben Thomas <rrt@sc3d.org> -0 search/cB/100 constant\ story Inform source text +0 search/100/cW constant\ story Inform source text diff --git a/Magdir/intel b/Magdir/intel index 00942c2b2e0a..47812a0ea351 100644 --- a/Magdir/intel +++ b/Magdir/intel @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: intel,v 1.10 2011/03/30 19:51:00 christos Exp $ # intel: file(1) magic for x86 Unix # # Various flavors of x86 UNIX executable/object (other than Xenix, which @@ -45,3 +46,8 @@ >28 string Adaptec Adaptec >42 string PROMISE Promise >2 byte x (%d*512) + +# Flash descriptors for Intel SPI flash roms. +# From Dr. Jesus <j@hug.gs> +0 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step +16 lelong 0x0ff0a55a Intel serial flash for PCH ROM diff --git a/Magdir/interleaf b/Magdir/interleaf index 3eea3cff2690..8e3aaf57da5e 100644 --- a/Magdir/interleaf +++ b/Magdir/interleaf @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ # interleaf: file(1) magic for InterLeaf TPS: # 0 string =\210OPS Interleaf saved data diff --git a/Magdir/island b/Magdir/island index 9903cddf9217..f40521a0367f 100644 --- a/Magdir/island +++ b/Magdir/island @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ # island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 # "/etc/magic": # From: guy@netapp.com (Guy Harris) diff --git a/Magdir/ispell b/Magdir/ispell index 592f064ed63c..57a6e9e78988 100644 --- a/Magdir/ispell +++ b/Magdir/ispell @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ # ispell: file(1) magic for ispell # # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic diff --git a/Magdir/isz b/Magdir/isz new file mode 100644 index 000000000000..316bbd4acf69 --- /dev/null +++ b/Magdir/isz @@ -0,0 +1,15 @@ + +#------------------------------------------------------------------------------ +# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $ +# ISO Zipped file format +# http://www.ezbsystems.com/isz/iszspec.txt +0 string IsZ! ISO Zipped file +>4 byte x \b, header size %u +>5 byte x \b, version %u +>8 lelong x \b, serial %u +#12 leshort x \b, sector size %u +#>16 lelong x \b, total sectors %u +>17 byte >0 \b, password protected +#>24 lequad x \b, segment size %llu +#>32 lelong x \b, blocks %u +#>36 lelong x \b, block size %u diff --git a/Magdir/java b/Magdir/java index cca5542c1f69..9d8b488e0f2d 100644 --- a/Magdir/java +++ b/Magdir/java @@ -1,4 +1,6 @@ + #------------------------------------------------------------ +# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $ # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the # same magic number, 0xcafebabe, so they are both handled # in the entry called "cafebabe". diff --git a/Magdir/jpeg b/Magdir/jpeg index 4470be4adf9a..7814245add34 100644 --- a/Magdir/jpeg +++ b/Magdir/jpeg @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: jpeg,v 1.16 2011/01/04 19:29:32 rrt Exp $ # JPEG images # SunOS 5.5.1 had # @@ -126,13 +127,8 @@ # And if there was some sort of looping construct to do searches, plus a few # named accumulators, it would be even more effective... # At least we can show a comment if no other segments got inserted before: ->(4.S+5) byte 0xFE ->>(4.S+8) string >\0 \b, comment: "%s" -# FIXME: When we can do non-byte counted strings, we can use that to get -# the string's count, and fix Debian bug #283760 -#>(4.S+5) byte 0xFE \b, comment -#>>(4.S+6) beshort x \b length=%d -#>>(4.S+8) string >\0 \b, "%s" +>(4.S+5) byte 0xFE \b, comment: +>>(4.S+6) pstring/HJ x "%s" # Or, we can show the encoding type (I've included only the three most common) # and image dimensions if we are lucky and the SOFn (image segment) is here: >(4.S+5) byte 0xC0 \b, baseline diff --git a/Magdir/karma b/Magdir/karma index 89e77727ea4e..007a4b74b220 100644 --- a/Magdir/karma +++ b/Magdir/karma @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ # karma: file(1) magic for Karma data files # # From <rgooch@atnf.csiro.au> diff --git a/Magdir/kde b/Magdir/kde index d81ee693fd5e..dda5819a9bad 100644 --- a/Magdir/kde +++ b/Magdir/kde @@ -1,10 +1,11 @@ #------------------------------------------------------------------------------ +# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ # kde: file(1) magic for KDE -0 string [KDE\ Desktop\ Entry] KDE desktop entry +0 string/t [KDE\ Desktop\ Entry] KDE desktop entry !:mime application/x-kdelnk -0 string #\ KDE\ Config\ File KDE config file +0 string/t #\ KDE\ Config\ File KDE config file !:mime application/x-kdelnk -0 string #\ xmcd xmcd database file for kscd +0 string/t #\ xmcd xmcd database file for kscd !:mime text/x-xmcd diff --git a/Magdir/kml b/Magdir/kml index 5b59b9e55501..ed0f42ed8533 100644 --- a/Magdir/kml +++ b/Magdir/kml @@ -1,10 +1,12 @@ + #------------------------------------------------------------------------------ +# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $ # Type: Google KML, formerly Keyhole Markup Language # Future development of this format has been handed # over to the Open Geospatial Consortium. # http://www.opengeospatial.org/standards/kml/ # From: Asbjoern Sloth Toennesen <asbjorn@lila.io> -0 string \<?xml +0 string/t \<?xml >20 search/400 \ xmlns= >>&0 regex ['"]http://earth.google.com/kml Google KML document !:mime application/vnd.google-earth.kml+xml @@ -20,7 +22,7 @@ # From: Asbjoern Sloth Toennesen <asbjorn@lila.io> >>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document !:mime application/vnd.google-earth.kml+xml ->>>&1 string 2.2 \b, version 2.2 +>>>&1 string/t 2.2 \b, version 2.2 #------------------------------------------------------------------------------ # Type: Google KML Archive (ZIP based) diff --git a/Magdir/lecter b/Magdir/lecter index 87c186bab363..6ae87c12c0a6 100644 --- a/Magdir/lecter +++ b/Magdir/lecter @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ # DEC SRC Virtual Paper: Lectern files # Karl M. Hegbloom <karlheg@inetarena.com> 0 string lect DEC SRC Virtual Paper Lectern file diff --git a/Magdir/lex b/Magdir/lex index eae9b107c231..cc9fac5e1fa7 100644 --- a/Magdir/lex +++ b/Magdir/lex @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ # lex: file(1) magic for lex # # derived empirically, your offsets may vary! diff --git a/Magdir/lif b/Magdir/lif index cf20e4997d83..a7a0a8abe776 100644 --- a/Magdir/lif +++ b/Magdir/lif @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ # lif: file(1) magic for lif # # (Daniel Quinlan <quinlan@yggdrasil.com>) diff --git a/Magdir/linux b/Magdir/linux index 83d4305d0a1f..9b9b86c02a30 100644 --- a/Magdir/linux +++ b/Magdir/linux @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: linux,v 1.41 2011/04/20 18:57:10 christos Exp $ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> @@ -43,38 +45,49 @@ # this can be overridden by the DOS executable (COM) entry 2 string LILO Linux/i386 LILO boot/chain loader # +# Linux make config build file, from Ole Aamot <oka@oka.no> +28 string make\ config Linux make config build file +# # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> -0 leshort 0x0436 Linux/i386 PC Screen Font data, ->2 byte 0 256 characters, no directory, ->2 byte 1 512 characters, no directory, ->2 byte 2 256 characters, Unicode directory, ->2 byte 3 512 characters, Unicode directory, +# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> +# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html +0 leshort 0x0436 Linux/i386 PC Screen Font v1 data, +>2 byte&0x01 0 256 characters, +>2 byte&0x01 !0 512 characters, +>2 byte&0x02 0 no directory, +>2 byte&0x02 !0 Unicode directory, >3 byte >0 8x%d +0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, +>16 lelong x %d characters, +>12 lelong&0x01 0 no directory, +>12 lelong&0x01 !0 Unicode directory, +>24 lelong x %d +>28 lelong x \bx%d + # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file # From: Jeff Bailey <jbailey@ubuntu.com> # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image +# From: James Hunt <james.hunt@ubuntu.com> +4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) # according to man page of mkswap (8) March 1999 -4086 string SWAPSPACE2 Linux/i386 swap file (new style) ->0x400 long x %d (4K pages) ->0x404 long x size %d pages ->>4086 string SWAPSPACE2 ->>>1052 string >\0 Label %s -# ECOFF magic for OSF/1 and Linux (only tested under Linux though) -# -# from Erik Troan (ewt@redhat.com) examining od dumps, so this -# could be wrong -# updated by David Mosberger (davidm@azstarnet.com) based on -# GNU BFD and MIPS info found below. -# -0 leshort 0x0183 ECOFF alpha ->24 leshort 0407 executable ->24 leshort 0410 pure ->24 leshort 0413 demand paged ->8 long >0 not stripped ->8 long 0 stripped ->23 leshort >0 - version %ld. +# volume label and UUID Russell Coker +# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ +4086 string SWAPSPACE2 Linux/i386 swap file (new style), +>0x400 long x version %d (4K pages), +>0x404 long x size %d pages, +>1052 string \0 no label, +>1052 string >\0 LABEL=%s, +>0x40c belong x UUID=%08x +>0x410 beshort x \b-%04x +>0x412 beshort x \b-%04x +>0x414 beshort x \b-%04x +>0x416 belong x \b-%08x +>0x41a beshort x \b%04x +# From Daniel Novotny <dnovotny@redhat.com> +# swap file for PowerPC +65526 string SWAPSPACE2 Linux/ppc swap file # # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> @@ -154,6 +167,22 @@ >0x1e6 belong !0x454c4b53 style boot sector ############################################################################ +# Linux S390 kernel image +# Created by: Jan Kaluza <jkaluza@redhat.com> +8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 +>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc +# 64bit +>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel +>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel +>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel +>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel +# 32bit +>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel +>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel +>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel +>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel + +############################################################################ # Linux 8086 executable 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless >5 string . @@ -217,19 +246,55 @@ # # 0x200 seems to be the common case -0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) # read the offset to add to the start of the header, and the header # start in 0x200 ->(0x214.l+0x200) string >\0 , UUID: %s +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld -0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) ->(0x014.l) string >\0 , UUID: %s +0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld -0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) ->(0x414.l+0x400) string >\0 , UUID: %s +0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld -0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) ->(0x614.l+0x600) string >\0 , UUID: %s +0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) +>&(&-12.l-0x21) byte x +# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) +>>&0x0 string >\x2f \b, UUID: %.6s +>>&0x6 string >\x2f \b-%.4s +>>&0xa string >\x2f \b-%.4s +>>&0xe string >\x2f \b-%.4s +>>&0x12 string >\x2f \b-%.4s +>>&0x16 string >\x2f \b-%.4s +>>&0x1a string >\x2f \b-%.6s +>>&0x20 lequad x \b, size: %lld # LVM snapshot # from Jason Farrel @@ -262,3 +327,9 @@ >20 search/256 (name >>&1 string x (name %s) +# Type: Xen, the virtual machine monitor +# From: Radek Vokal <rvokal@redhat.com> +0 string LinuxGuestRecord Xen saved domain +#>2 regex \(name\ [^)]*\) %s +>20 search/256 (name (name +>>&1 string x %s...) diff --git a/Magdir/lisp b/Magdir/lisp index c6f31dae4238..110988020ecd 100644 --- a/Magdir/lisp +++ b/Magdir/lisp @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) @@ -11,8 +13,6 @@ #>2 search/4096 !\r Lisp/Scheme program text #>2 search/4096 \r Windows INF file -0 search/4096 (if\ Lisp/Scheme program text -!:mime text/x-lisp 0 search/4096 (setq\ Lisp/Scheme program text !:mime text/x-lisp 0 search/4096 (defvar\ Lisp/Scheme program text diff --git a/Magdir/llvm b/Magdir/llvm index 8c1610cd10e6..44a40094036c 100644 --- a/Magdir/llvm +++ b/Magdir/llvm @@ -1,10 +1,13 @@ #------------------------------------------------------------------------------ +# $File: llvm,v 1.5 2010/09/20 18:55:20 rrt Exp $ # llvm: file(1) magic for LLVM byte-codes -# URL: http://llvm.cs.uiuc.edu/docs/BytecodeFormat.html#signature +# URL: http://llvm.org/docs/BitCodeFormat.html # From: Al Stone <ahs3@fc.hp.com> 0 string llvm LLVM byte-codes, uncompressed 0 string llvc0 LLVM byte-codes, null compression 0 string llvc1 LLVM byte-codes, gzip compression 0 string llvc2 LLVM byte-codes, bzip2 compression +0 string \xde\xc0\x17\x0b LLVM bitcode, wrapper +0 string BC\xc0\xde LLVM bitcode diff --git a/Magdir/lua b/Magdir/lua index 9aa87b159c22..61e69a63b547 100644 --- a/Magdir/lua +++ b/Magdir/lua @@ -1,12 +1,14 @@ + #------------------------------------------------------------------------------ +# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $ # lua: file(1) magic for Lua scripting language # URL: http://www.lua.org/ # From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> # Lua scripts -0 search/1/b #!\ /usr/bin/lua Lua script text executable +0 search/1/w #!\ /usr/bin/lua Lua script text executable !:mime text/x-lua -0 search/1/b #!\ /usr/local/bin/lua Lua script text executable +0 search/1/w #!\ /usr/local/bin/lua Lua script text executable !:mime text/x-lua 0 search/1 #!/usr/bin/env\ lua Lua script text executable !:mime text/x-lua diff --git a/Magdir/luks b/Magdir/luks index 2ab23935ef69..6ecc40aff19a 100644 --- a/Magdir/luks +++ b/Magdir/luks @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ # luks: file(1) magic for Linux Unified Key Setup # URL: http://luks.endorphin.org/spec # From: Anthon van der Neut <anthon@mnt.org> diff --git a/Magdir/mach b/Magdir/mach index e53be0737d92..8d03f1ae4a28 100644 --- a/Magdir/mach +++ b/Magdir/mach @@ -1,4 +1,6 @@ + #------------------------------------------------------------ +# $File: mach,v 1.9 2009/09/19 16:28:10 christos Exp $ # Mach has two magic numbers, 0xcafebabe and 0xfeedface. # Unfortunately the first, cafebabe, is shared with # Java ByteCode, so they are both handled in the file "cafebabe". diff --git a/Magdir/macintosh b/Magdir/macintosh index ca665ded8cb8..b9933b1b4976 100644 --- a/Magdir/macintosh +++ b/Magdir/macintosh @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: macintosh,v 1.22 2011/05/17 17:40:31 rrt Exp $ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") @@ -284,7 +285,7 @@ >0x412 beshort x number of blocks: %d, >0x424 pstring x volume name: %s -# "BD" is has many false positives +# "BD" gives many false positives #0x400 beshort 0x4244 Macintosh HFS data #>0 beshort 0x4C4B (bootable) #>0x40a beshort &0x8000 (locked) @@ -375,3 +376,15 @@ # From: Remi Mommsen <mommsen@slac.stanford.edu> 0 string BOMStore Mac OS X bill of materials (BOM) file + +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# URL: http://en.wikipedia.org/wiki/Datafork_TrueType +# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is +# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I +# don't know what they mean. +0 belong 0x100 +>(0x4.L+24) beshort x +>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType +>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' +>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' +>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript diff --git a/Magdir/magic b/Magdir/magic index 3bf4e2ee7acb..0de332aa3bfb 100644 --- a/Magdir/magic +++ b/Magdir/magic @@ -1,8 +1,9 @@ #------------------------------------------------------------------------------ +# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ # magic: file(1) magic for magic files # -0 string #\ Magic magic text file for file(1) cmd +0 string/t #\ Magic magic text file for file(1) cmd 0 lelong 0xF11E041C magic binary file for file(1) cmd >4 lelong x (version %d) (little endian) 0 belong 0xF11E041C magic binary file for file(1) cmd diff --git a/Magdir/mail.news b/Magdir/mail.news index 0b9d90a4e20a..205d6c673413 100644 --- a/Magdir/mail.news +++ b/Magdir/mail.news @@ -1,34 +1,36 @@ + #------------------------------------------------------------------------------ +# $File: mail.news,v 1.19 2011/01/25 13:55:57 christos Exp $ # mail.news: file(1) magic for mail and news # # Unfortunately, saved netnews also has From line added in some news software. #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. -0 string Relay-Version: old news text +0 string/t Relay-Version: old news text !:mime message/rfc822 -0 string #!\ rnews batched news text +0 string/t #!\ rnews batched news text !:mime message/rfc822 -0 string N#!\ rnews mailed, batched news text +0 string/t N#!\ rnews mailed, batched news text !:mime message/rfc822 -0 string Forward\ to mail forwarding text +0 string/t Forward\ to mail forwarding text !:mime message/rfc822 -0 string Pipe\ to mail piping text +0 string/t Pipe\ to mail piping text !:mime message/rfc822 -0 string Return-Path: smtp mail text +0 string/t Return-Path: smtp mail text !:mime message/rfc822 -0 string Path: news text +0 string/t Path: news text !:mime message/news -0 string Xref: news text +0 string/t Xref: news text !:mime message/news -0 string From: news or mail text +0 string/t From: news or mail text !:mime message/rfc822 -0 string Article saved news text +0 string/t Article saved news text !:mime message/news -0 string BABYL Emacs RMAIL text -0 string Received: RFC 822 mail text +0 string/t BABYL Emacs RMAIL text +0 string/t Received: RFC 822 mail text !:mime message/rfc822 -0 string MIME-Version: MIME entity text -#0 string Content- MIME entity text +0 string/t MIME-Version: MIME entity text +#0 string/t Content- MIME entity text # TNEF files... 0 lelong 0x223E9F78 Transport Neutral Encapsulation Format @@ -51,3 +53,14 @@ #>4 leshort >0 (%d messages) #0 string \<!--\ MHonArc text/html; x-type=mhonarc + +# Cyrus: file(1) magic for compiled Cyrus sieve scripts +# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php +# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master +# From: Philipp Hahn <hahn@univention.de> + +# Compiled Cyrus sieve script +0 string CyrSBytecode Cyrus sieve bytecode data, +>12 belong =1 version 1, big-endian +>12 lelong =1 version 1, little-endian +>12 belong x version %d, network-endian diff --git a/Magdir/maple b/Magdir/maple index 6bc75628fc26..4a263e084691 100644 --- a/Magdir/maple +++ b/Magdir/maple @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $ # maple: file(1) magic for maple files # "H. Nanosecond" <aldomel@ix.netcom.com> # Maple V release 4, a multi-purpose math program diff --git a/Magdir/marc21 b/Magdir/marc21 new file mode 100644 index 000000000000..83f7959e0580 --- /dev/null +++ b/Magdir/marc21 @@ -0,0 +1,28 @@ +#-------------------------------------------- +# marc21: file(1) magic for MARC 21 Format +# +# Kevin Ford (kefo@loc.gov) +# +# MARC21 formats are for the representation and communication +# of bibliographic and related information in machine-readable +# form. For more info, see http://www.loc.gov/marc/ + + +# leader position 20-21 must be 45 +20 string 45 + +# leader starts with 5 digits, followed by codes specific to MARC format +>0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic +!:mime application/marc +>0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority +!:mime application/marc +>0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings +!:mime application/marc +0 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification +!:mime application/marc +>0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community +!:mime application/marc + +# leader position 22-23, should be "00" but is it? +>0 regex/1 (^.{21})([^0]{2}) (non-conforming) +!:mime application/marc diff --git a/Magdir/mathcad b/Magdir/mathcad index 41801968888e..b186641f7da2 100644 --- a/Magdir/mathcad +++ b/Magdir/mathcad @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ # mathcad: file(1) magic for Mathcad documents # URL: http://www.mathsoft.com/ # From: Josh Triplett <josh@freedesktop.org> diff --git a/Magdir/mathematica b/Magdir/mathematica index abbc1125e0b0..3c10a57db5c8 100644 --- a/Magdir/mathematica +++ b/Magdir/mathematica @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ # mathematica: file(1) magic for mathematica files # "H. Nanosecond" <aldomel@ix.netcom.com> # Mathematica a multi-purpose math program diff --git a/Magdir/matroska b/Magdir/matroska index ca00db4b2068..62299d21f9b9 100644 --- a/Magdir/matroska +++ b/Magdir/matroska @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: matroska,v 1.6 2010/09/20 21:11:35 rrt Exp $ # matroska: file(1) magic for Matroska files # # See http://www.matroska.org/ @@ -11,4 +12,12 @@ >5 beshort 0x4282 # DocType contents: >>8 string matroska Matroska data +!:mime video/x-matroska +# EBML id: +0 belong 0x1a45dfa3 +# DocType id: +>0 search/4096 \x42\x82 +# DocType contents: +>>&1 string webm WebM +!:mime video/webm diff --git a/Magdir/mcrypt b/Magdir/mcrypt index e862f59d7494..9c66af48b2a2 100644 --- a/Magdir/mcrypt +++ b/Magdir/mcrypt @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ # Mavroyanopoulos Nikos <nmav@hellug.gr> # mcrypt: file(1) magic for mcrypt 2.2.x; 0 string \0m\3 mcrypt 2.5 encrypted data, diff --git a/Magdir/mercurial b/Magdir/mercurial index 3f1bdfc8f9cc..8bc5a5471516 100644 --- a/Magdir/mercurial +++ b/Magdir/mercurial @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ # mercurial: file(1) magic for Mercurial changeset bundles # http://www.selenic.com/mercurial/wiki/ # diff --git a/Magdir/metastore b/Magdir/metastore new file mode 100644 index 000000000000..285c3cfa0cca --- /dev/null +++ b/Magdir/metastore @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $ +# metastore: file(1) magic for metastore files +# From: Thomas Wissen +# see http://david.hardeman.nu/software.php#metastore +0 string MeTaSt00r3 Metastore data file, +>10 bequad x version %0llx diff --git a/Magdir/mime b/Magdir/mime index 2219094f676c..42ca52dc6b58 100644 --- a/Magdir/mime +++ b/Magdir/mime @@ -1,7 +1,9 @@ + #------------------------------------------------------------------------------ +# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $ # mime: file(1) magic for MIME encoded files # -0 string Content-Type:\ +0 string/t Content-Type:\ >14 string >\0 %s -0 string Content-Type: +0 string/t Content-Type: >13 string >\0 %s diff --git a/Magdir/mips b/Magdir/mips index 634eff4106be..b49fecd24e90 100644 --- a/Magdir/mips +++ b/Magdir/mips @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mips,v 1.7 2011/05/03 01:44:17 christos Exp $ # mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) # Dec Ultrix (MIPS) # all of SGI's *current* machines and OSes run in big-endian mode on the @@ -34,7 +35,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld ->23 byte x .%ld +>23 byte x \b.%ld # 0 beshort 0x0162 MIPSEL-BE ECOFF executable >20 beshort 0407 (impure) @@ -43,7 +44,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %d ->22 byte x .%ld +>22 byte x \b.%ld # 0 beshort 0x6001 MIPSEB-LE ECOFF executable >20 beshort 03401 (impure) @@ -52,7 +53,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %d ->22 byte x .%ld +>22 byte x \b.%ld # 0 beshort 0x6201 MIPSEL ECOFF executable >20 beshort 03401 (impure) @@ -61,7 +62,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->22 byte x .%ld +>22 byte x \b.%ld # # MIPS 2 additions # @@ -72,7 +73,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld ->23 byte x .%ld +>23 byte x \b.%ld # 0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable >20 beshort 0407 (impure) @@ -81,7 +82,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld ->23 byte x .%ld +>23 byte x \b.%ld # 0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable >20 beshort 03401 (impure) @@ -90,7 +91,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->22 byte x .%ld +>22 byte x \b.%ld # 0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable >20 beshort 03401 (impure) @@ -99,7 +100,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->22 byte x .%ld +>22 byte x \b.%ld # # MIPS 3 additions # @@ -110,7 +111,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld ->23 byte x .%ld +>23 byte x \b.%ld # 0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable >20 beshort 0407 (impure) @@ -119,7 +120,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld ->23 byte x .%ld +>23 byte x \b.%ld # 0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable >20 beshort 03401 (impure) @@ -128,7 +129,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->22 byte x .%ld +>22 byte x \b.%ld # 0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable >20 beshort 03401 (impure) @@ -137,7 +138,7 @@ >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld ->22 byte x .%ld +>22 byte x \b.%ld # 0 beshort 0x180 MIPSEB Ucode 0 beshort 0x182 MIPSEL-BE Ucode @@ -159,7 +160,7 @@ # Trusted IRIX info 0 string SGIAUDIT SGI Audit file >8 byte x - version %d ->9 byte x .%ld +>9 byte x \b.%ld # 0 string WNGZWZSC Wingz compiled script 0 string WNGZWZSS Wingz spreadsheet @@ -170,8 +171,12 @@ # GLF is OpenGL stream encoding 0 string glfHeadMagic(); GLF_TEXT 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST +!:strength -30 4 belong 0x0000007d GLF_BINARY_MSB_FIRST +!:strength -30 # GLS is OpenGL stream encoding; GLS is the successor of GLF 0 string glsBeginGLS( GLS_TEXT 4 belong 0x10000000 GLS_BINARY_LSB_FIRST +!:strength -30 4 belong 0x00000010 GLS_BINARY_MSB_FIRST +!:strength -30 diff --git a/Magdir/mirage b/Magdir/mirage index 73c3747bb7fd..cdeb3fcbc2bb 100644 --- a/Magdir/mirage +++ b/Magdir/mirage @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ # mirage: file(1) magic for Mirage executables # # XXX - byte order? diff --git a/Magdir/misctools b/Magdir/misctools index 9a43e7b4e390..394706564ed7 100644 --- a/Magdir/misctools +++ b/Magdir/misctools @@ -1,8 +1,11 @@ + #----------------------------------------------------------------------------- +# $File: misctools,v 1.12 2010/09/29 18:36:49 rrt Exp $ # misctools: file(1) magic for miscellaneous UNIX tools. # 0 search/1 %%!! X-Post-It-Note text 0 string/c BEGIN:VCALENDAR vCalendar calendar file +!:mime text/calendar 0 string/c BEGIN:VCARD vCard visiting card !:mime text/x-vcard @@ -10,6 +13,12 @@ 4 string gtktalog GNOME Catalogue (gtktalog) >13 string >\0 version %s +# Summary: GStreamer binary registry +# Extension: .bin +# Submitted by: Josh Triplett <josh@joshtriplett.org> +0 belong 0xc0def00d GStreamer binary registry +>4 string x \b, version %s + # Summary: Libtool library file # Extension: .la # Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> @@ -19,3 +28,6 @@ # Extension: .lo # Submitted by: Abel Cheung <abelcheung@gmail.com> 0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file + +# From: Daniel Novotny <dnovotny@redhat.com> +0 string MDMP\x93\xA7 MDMP crash report data diff --git a/Magdir/mkid b/Magdir/mkid index dfb2d93f4389..faad3966c0d0 100644 --- a/Magdir/mkid +++ b/Magdir/mkid @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ # mkid: file(1) magic for mkid(1) databases # # ID is the binary tags database produced by mkid(1). diff --git a/Magdir/mlssa b/Magdir/mlssa index 21ab61e1d85d..3c8875eb3d84 100644 --- a/Magdir/mlssa +++ b/Magdir/mlssa @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ # mlssa: file(1) magic for MLSSA datafiles # 0 lelong 0xffffabcd MLSSA datafile, diff --git a/Magdir/mmdf b/Magdir/mmdf index 72cd9f32581b..5576a6627789 100644 --- a/Magdir/mmdf +++ b/Magdir/mmdf @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ # mmdf: file(1) magic for MMDF mail files # 0 string \001\001\001\001 MMDF mailbox diff --git a/Magdir/modem b/Magdir/modem index 73e747e161dc..84bdb2877686 100644 --- a/Magdir/modem +++ b/Magdir/modem @@ -1,10 +1,12 @@ + #------------------------------------------------------------------------------ +# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $ # modem: file(1) magic for modem programs # # From: Florian La Roche <florian@knorke.saar.de> -4 string Research, Digifax-G3-File ->29 byte 1 , fine resolution ->29 byte 0 , normal resolution +1 string PC\ Research,\ Inc Digifax-G3-File +>29 byte 1 \b, fine resolution +>29 byte 0 \b, normal resolution 0 short 0x0100 raw G3 data, byte-padded 0 short 0x1400 raw G3 data diff --git a/Magdir/motorola b/Magdir/motorola index bfe7ea030ee8..b56e5e483a45 100644 --- a/Magdir/motorola +++ b/Magdir/motorola @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ # motorola: file(1) magic for Motorola 68K and 88K binaries # # 68K diff --git a/Magdir/mozilla b/Magdir/mozilla index 069886064fbc..1f89589aa1bc 100644 --- a/Magdir/mozilla +++ b/Magdir/mozilla @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ # mozilla: file(1) magic for Mozilla XUL fastload files # (XUL.mfasl and XPC.mfasl) # URL: http://www.mozilla.org/ diff --git a/Magdir/msdos b/Magdir/msdos index a44533b43735..716e266dcb3e 100644 --- a/Magdir/msdos +++ b/Magdir/msdos @@ -1,25 +1,28 @@ #------------------------------------------------------------------------------ +# $File: msdos,v 1.75 2011/08/08 08:56:17 christos Exp $ # msdos: file(1) magic for MS-DOS files # # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) -# updated by Joerg Jenderek at Oct 2008 -0 string @ ->1 string/cB \ echo\ off DOS batch file text +# updated by Joerg Jenderek at Oct 2008,Apr 2011 +0 string/t @ +>1 string/cW \ echo\ off DOS batch file text !:mime text/x-msdos-batch ->1 string/cB echo\ off DOS batch file text +>1 string/cW echo\ off DOS batch file text !:mime text/x-msdos-batch ->1 string/cB rem\ DOS batch file text +>1 string/cW rem DOS batch file text !:mime text/x-msdos-batch ->1 string/cB set\ DOS batch file text +>1 string/cW set\ DOS batch file text !:mime text/x-msdos-batch # OS/2 batch files are REXX. the second regex is a bit generic, oh well # the matched commands seem to be common in REXX and uncommon elsewhere -100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text -100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text +100 search/0xffff rxfuncadd +>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text +100 search/0xffff say +>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 0 leshort 0x14c MS Windows COFF Intel 80386 object file #>4 ledate x stamp %s @@ -34,114 +37,111 @@ 0 leshort 0x290 MS Windows COFF PA-RISC object file #>4 ledate x stamp %s -# XXX - according to Microsoft's spec, at an offset of 0x3c in a -# PE-format executable is the offset in the file of the PE header; -# unfortunately, that's a little-endian offset, and there's no way -# to specify an indirect offset with a specified byte order. -# So, for now, we assume the standard MS-DOS stub, which puts the -# PE header at 0x80 = 128. -# -# Required OS version and subsystem version were 4.0 on some NT 3.51 -# executables built with Visual C++ 4.0, so it's not clear that -# they're interesting. The user version was 0.0, but there's -# probably some linker directive to set it. The linker version was -# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). +# Tests for various EXE types. # -# many of the compressed formats were extraced from IDARC 1.23 source code +# Many of the compressed formats were extraced from IDARC 1.23 source code. # 0 string MZ !:mime application/x-dosexec ->0x18 leshort <0x40 MS-DOS executable ->0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows ->>&18 leshort&0x2000 >0 (DLL) ->>&88 leshort 0 (unknown subsystem) ->>&88 leshort 1 (native) ->>&88 leshort 2 (GUI) ->>&88 leshort 3 (console) ->>&88 leshort 7 (POSIX) ->>&0 leshort 0x0 unknown processor ->>&0 leshort 0x14c Intel 80386 ->>&0 leshort 0x166 MIPS R4000 ->>&0 leshort 0x184 Alpha ->>&0 leshort 0x268 Motorola 68000 ->>&0 leshort 0x1f0 PowerPC ->>&0 leshort 0x290 PA-RISC ->>&18 leshort&0x0100 >0 32-bit ->>&18 leshort&0x1000 >0 system file ->>&0xf4 search/0x140 \x0\x40\x1\x0 ->>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive ->30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive -!:mime application/zip -# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. ->30 string PKLITE\ Copr. Self-extracting PKZIP archive -!:mime application/zip +# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. +>0x18 leshort <0x40 MS-DOS executable +# These traditional tests usually work but not always. When test quality support is +# implemented these can be turned on. +#>>0x18 leshort 0x1c (Borland compiler) +#>>0x18 leshort 0x1e (MS compiler) +# If the relocation table is 0x40 or more bytes into the file, it's definitely +# not a DOS EXE. >0x18 leshort >0x3f + +# Maybe it's a PE? >>(0x3c.l) string PE\0\0 PE ->>>(0x3c.l+25) byte 1 \b32 executable ->>>(0x3c.l+25) byte 2 \b32+ executable -# hooray, there's a DOS extender using the PE format, with a valid PE -# executable inside (which just prints a message and exits if run in win) ->>>(0x3c.l+92) leshort <10 ->>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender ->>>>(8.s*16) string !32STUB for MS Windows ->>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) ->>>>>(0x3c.l+92) leshort 0 (unknown subsystem) ->>>>>(0x3c.l+92) leshort 1 (native) ->>>>>(0x3c.l+92) leshort 2 (GUI) ->>>>>(0x3c.l+92) leshort 3 (console) ->>>>>(0x3c.l+92) leshort 7 (POSIX) +>>>(0x3c.l+24) leshort 0x010b \b32 executable +>>>(0x3c.l+24) leshort 0x020b \b32+ executable +>>>(0x3c.l+24) leshort 0x0107 ROM image +>>>(0x3c.l+24) default x Unknown PE signature +>>>>&0 leshort x 0x%x +>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>(0x3c.l+92) leshort 1 (native) +>>>(0x3c.l+92) leshort 2 (GUI) +>>>(0x3c.l+92) leshort 3 (console) +>>>(0x3c.l+92) leshort 7 (POSIX) +>>>(0x3c.l+92) leshort 9 (Windows CE) >>>(0x3c.l+92) leshort 10 (EFI application) >>>(0x3c.l+92) leshort 11 (EFI boot service driver) >>>(0x3c.l+92) leshort 12 (EFI runtime driver) ->>>(0x3c.l+92) leshort 13 (XBOX) ->>>(0x3c.l+4) leshort 0x0 unknown processor +>>>(0x3c.l+92) leshort 13 (EFI ROM) +>>>(0x3c.l+92) leshort 14 (XBOX) +>>>(0x3c.l+92) leshort 15 (Windows boot application) +>>>(0x3c.l+92) default x (Unknown subsystem +>>>>&0 leshort x 0x%x) >>>(0x3c.l+4) leshort 0x14c Intel 80386 >>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>(0x3c.l+4) leshort 0x168 MIPS R10000 >>>(0x3c.l+4) leshort 0x184 Alpha ->>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 +>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 +>>>(0x3c.l+4) leshort 0x1c0 ARM +>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb >>>(0x3c.l+4) leshort 0x1f0 PowerPC ->>>(0x3c.l+4) leshort 0x290 PA-RISC >>>(0x3c.l+4) leshort 0x200 Intel Itanium ->>>(0x3c.l+22) leshort&0x0100 >0 32-bit +>>>(0x3c.l+4) leshort 0x266 MIPS16 +>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>(0x3c.l+4) leshort 0x366 MIPSIV +>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU +>>>(0x3c.l+4) leshort 0xebc EFI byte code +>>>(0x3c.l+4) leshort 0x8664 x86-64 +>>>(0x3c.l+4) leshort 0xc0ee MSIL +>>>(0x3c.l+4) default x Unknown processor type +>>>>&0 leshort x 0x%x +>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) >>>(0x3c.l+22) leshort&0x1000 >0 system file ->>>(0x3c.l+232) lelong >0 Mono/.Net assembly - ->>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed ->>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed ->>>>(0x3c.l+0xf8) search/0x140 UPX2 ->>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) ->>>>(0x3c.l+0xf8) search/0x140 .idata ->>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) ->>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive ->>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .rsrc ->>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive ->>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive ->>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive ->>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .data ->>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed ->>>>>(0x3c.l+0xf7) byte x ->>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive ->>>>(0x3c.l+0xf8) search/0x140 .reloc ->>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) +>>>(0x3c.l+24) leshort 0x010b +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly +>>>(0x3c.l+24) leshort 0x020b +>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly ->>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) ->>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive ->>>>0x30 string Inno \b, InnoSetup self-extracting archive +# hooray, there's a DOS extender using the PE format, with a valid PE +# executable inside (which just prints a message and exits if run in win) +>>>(8.s*16) string 32STUB \b, 32rtm DOS extender +>>>(8.s*16) string !32STUB \b, for MS Windows +>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed +>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed +>>>(0x3c.l+0xf8) search/0x140 UPX2 +>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>(0x3c.l+0xf8) search/0x140 .idata +>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive +>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .rsrc +>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive +>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive +>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive +>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .data +>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed +>>>>(0x3c.l+0xf7) byte x +>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive +>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive +>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) +>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive +>>>0x30 string Inno \b, InnoSetup self-extracting archive +# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, +# must be one of the unusual subformats. >>(0x3c.l) string !PE\0\0 MS-DOS executable >>(0x3c.l) string NE \b, NE ->>>(0x3c.l+0x36) byte 0 (unknown OS) >>>(0x3c.l+0x36) byte 1 for OS/2 1.x >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x >>>(0x3c.l+0x36) byte 3 for MS-DOS ->>>(0x3c.l+0x36) byte >3 (unknown OS) +>>>(0x3c.l+0x36) byte 4 for Windows 386 +>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services +>>>(0x3c.l+0x36) default x +>>>>(0x3c.l+0x36) byte x (unknown OS %x) >>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender >>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) >>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) @@ -225,16 +225,32 @@ >(8.s*16) string $WdX \b, WDos/X DOS extender -# .EXE formats (Greg Roelofs, newt@uchicago.edu) +# By now an executable type should have been printed out. The executable +# may be a self-uncompressing archive, so look for evidence of that and +# print it out. +# +# Some signatures below from Greg Roelofs, newt@uchicago.edu. # >0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed ->0xe7 string LH/2\ Self-Extract \b, %s ->0x1c string diet \b, diet compressed ->0x1c string LZ09 \b, LZEXE v0.90 compressed ->0x1c string LZ91 \b, LZEXE v0.91 compressed ->0x1c string tz \b, TinyProg compressed ->0x1e string PKLITE \b, %s compressed ->0x64 string W\ Collis\0\0 \b, Compack compressed +>0xe7 string LH/2\ Self-Extract \b, %s +>0x1c string UC2X \b, UCEXE compressed +>0x1c string WWP\ \b, WWPACK compressed +>0x1c string RJSX \b, ARJ self-extracting archive +>0x1c string diet \b, diet compressed +>0x1c string LZ09 \b, LZEXE v0.90 compressed +>0x1c string LZ91 \b, LZEXE v0.91 compressed +>0x1c string tz \b, TinyProg compressed +>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive +!:mime application/zip +# Yes, this really is "Copr", not "Corp." +>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive +!:mime application/zip +# winarj stores a message in the stub instead of the sig in the MZ header +>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive +>0x20 string AIN +>>0x23 string 2 \b, AIN 2.x compressed +>>0x23 string <2 \b, AIN 1.x compressed +>>0x23 string >2 \b, AIN 1.x compressed >0x24 string LHa's\ SFX \b, LHa self-extracting archive !:mime application/x-lha >0x24 string LHA's\ SFX \b, LHa self-extracting archive @@ -242,18 +258,17 @@ >0x24 string \ $ARX \b, ARX self-extracting archive >0x24 string \ $LHarc \b, LHarc self-extracting archive >0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive +>0x64 string W\ Collis\0\0 \b, Compack compressed +>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive +>>&0xf4 search/0x140 \x0\x40\x1\x0 +>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive >1638 string -lh5- \b, LHa self-extracting archive v2.13S >0x17888 string Rar! \b, RAR self-extracting archive ->0x40 string aPKG \b, aPackage self-extracting archive - ->32 string AIN ->>35 string 2 \b, AIN 2.x compressed ->>35 string <2 \b, AIN 1.x compressed ->>35 string >2 \b, AIN 1.x compressed ->28 string UC2X \b, UCEXE compressed ->28 string WWP\ \b, WWPACK compressed -# skip to the end of the exe +# Skip to the end of the EXE. This will usually work fine in the PE case +# because the MZ image is hardcoded into the toolchain and almost certainly +# won't match any of these signatures. >(4.s*512) long x >>&(2.s-517) byte x >>>&0 string PK\3\4 \b, ZIP self-extracting archive @@ -265,13 +280,8 @@ >>>&7 search/400 **ACE** \b, ACE self-extracting archive >>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive ->0x1c string RJSX \b, ARJ self-extracting archive -# winarj stores a message in the stub instead of the sig in the MZ header ->0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive - # a few unknown ZIP sfxes, no idea if they are needed or if they are # already captured by the generic patterns above ->122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive >(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) # TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive # @@ -281,6 +291,29 @@ >>49824 leshort =1 \b, 1 file >>49824 leshort >1 \b, %u files +# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc +# and http://www.freedos.org/software/?prog=kpdos +# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD +0 string KCF FreeDOS KEYBoard Layout collection +# only version=0x100 found +>3 uleshort x \b, version 0x%x +# length of string containing author,info and special characters +>6 ubyte >0 +#>>6 pstring x \b, name=%s +>>7 string >\0 \b, author=%-.14s +>>7 search/254 \xff \b, info= +#>>>&0 string x \b%-s +>>>&0 string x \b%-.15s +# for FreeDOS *.KL files +0 string KLF FreeDOS KEYBoard Layout file +# only version=0x100 or 0x101 found +>3 uleshort x \b, version 0x%x +# stringlength +>5 ubyte >0 +>>8 string x \b, name=%-.2s +0 string \xffKEYB\ \ \ \0\0\0\0 +>12 string \0\0\0\0`\360 MS-DOS KEYBoard Layout file + # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least @@ -289,27 +322,79 @@ 0 byte 0xe9 DOS executable (COM) >0x1FE leshort 0xAA55 \b, boot code >6 string SFX\ of\ LHarc (%s) -0 belong 0xffffffff DOS executable (device driver) -#CMD640X2.SYS ->10 string >\x23 ->>10 string !\x2e ->>>17 string <\x5B ->>>>10 string x \b, name: %.8s -#UDMA.SYS KEYB.SYS CMD640X2.SYS ->10 string <\x41 ->>12 string >\x40 ->>>10 string !$ ->>>>12 string x \b, name: %.8s -#BTCDROM.SYS ASPICD.SYS ->22 string >\x40 ->>22 string <\x5B ->>>23 string <\x5B ->>>>22 string x \b, name: %.8s -#ATAPICD.SYS ->76 string \0 ->>77 string >\x40 ->>>77 string <\x5B ->>>>77 string x \b, name: %.8s + +# DOS device driver updated by Joerg Jenderek at May 2011 +# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 +0 ulequad&0x07a0ffffffff 0xffffffff DOS executable ( +>40 search/7 UPX! \bUPX compressed +# DOS device driver attributes +>4 uleshort&0x8000 0x0000 \bblock device driver +# character device +>4 uleshort&0x8000 0x8000 \b +>>4 uleshort&0x0008 0x0008 \bclock +# fast video output by int 29h +>>4 uleshort&0x0010 0x0010 \bfast +# standard input/output device +>>4 uleshort&0x0003 >0 \bstandard +>>>4 uleshort&0x0001 0x0001 \binput +>>>4 uleshort&0x0003 0x0003 \b/ +>>>4 uleshort&0x0002 0x0002 \boutput +>>4 uleshort&0x8000 0x8000 \bcharacter device driver +>0 ubyte x +# upx compressed device driver has garbage instead of real in name field of header +>>40 search/7 UPX! +>>40 default x +# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped +>>>12 ubyte >0x27 \b +>>>>10 ubyte >0x20 +>>>>>10 ubyte !0x2E +>>>>>>10 ubyte !0x2A \b%c +>>>>11 ubyte >0x20 +>>>>>11 ubyte !0x2E \b%c +>>>>12 ubyte >0x20 +>>>>>12 ubyte !0x39 +>>>>>>12 ubyte !0x2E \b%c +>>>13 ubyte >0x20 +>>>>13 ubyte !0x2E \b%c +>>>>14 ubyte >0x20 +>>>>>14 ubyte !0x2E \b%c +>>>>15 ubyte >0x20 +>>>>>15 ubyte !0x2E \b%c +>>>>16 ubyte >0x20 +>>>>>16 ubyte !0x2E +>>>>>>16 ubyte <0xCB \b%c +>>>>17 ubyte >0x20 +>>>>>17 ubyte !0x2E +>>>>>>17 ubyte <0x90 \b%c +# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field +>>>4 uleshort&0x8000 0x8000 +>>>>12 ubyte <0x2F +# they have their real name at offset 22 +>>>>>22 string >\0 \b%-.5s +>4 uleshort&0x8000 0x0000 +# 32 bit sector adressing ( > 32 MB) for block devices +>>4 uleshort&0x0002 0x0002 \b,32-bit sector- +# support by driver functions 13h, 17h, 18h +>4 uleshort&0x0040 0x0040 \b,IOCTL- +# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh +>4 uleshort&0x0800 0x0800 \b,close media- +# output until busy support by int 10h for character device driver +>4 uleshort&0x8000 0x8000 +>>4 uleshort&0x2000 0x2000 \b,until busy- +# direct read/write support by driver functions 03h,0Ch +>4 uleshort&0x4000 0x4000 \b,control strings- +>4 uleshort&0x8000 0x8000 +>>4 uleshort&0x6840 >0 \bsupport +>4 uleshort&0x8000 0x0000 +>>4 uleshort&0x4842 >0 \bsupport +>0 ubyte x \b) +# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header +# Too weak, matches files that only contain 0's +#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable ( +#>4 uleshort&0x8000 0x8000 \bcharacter device driver +#>>10 string x %-.8s +#>4 uleshort&0x4000 0x4000 \b,control strings-support) + # test too generic ? 0 byte 0x8c DOS executable (COM) # updated by Joerg Jenderek at Oct 2008 @@ -333,6 +418,13 @@ # start with assembler instructions mov eax,21cd4cffh 0 uleshort&0xc0ff 0xc0b8 >1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) +# syslinux:doc/comboot.txt +# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov +# eax,21cd4cfeh) as a magic number. +0 string \xb8\xfe\x4c\xcd\x21 COM executable (COM32R) +# start with assembler instructions mov eax,21cd4cfeh +0 uleshort&0xc0ff 0xc0b8 +>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable) 0 string \x81\xfc >4 string \x77\x02\xcd\x20\xb9 >>36 string UPX! FREE-DOS executable (COM), UPX compressed @@ -480,7 +572,7 @@ # Windows icons (Ian Springer <ips@fpk.hp.com>) 0 string \000\000\001\000 MS Windows icon resource -!:mime image/x-ico +!:mime image/x-icon >4 byte 1 - 1 icon >4 byte >1 - %d icons >>6 byte >0 \b, %dx @@ -518,6 +610,13 @@ # Acroread or something files wrongly identified as G3 .pfm # these have the form \000 \001 any? \002 \000 \000 # or \000 \001 any? \022 \000 \000 +0 belong&0xffff00ff 0x00010012 PFM data +>4 string \000\000 +>6 string >\060 - %s + +0 belong&0xffff00ff 0x00010002 PFM data +>4 string \000\000 +>6 string >\060 - %s #0 string \000\001 pfm? #>3 string \022\000\000Copyright\ yes #>3 string \002\000\000Copyright\ yes @@ -539,12 +638,14 @@ 0 lelong 0x08084b50 TurboC Font file # WARNING: below line conflicts with Infocom game data Z-machine 3 -0 byte 0x03 DBase 3 data file ->0x04 lelong 0 (no records) ->0x04 lelong >0 (%ld records) -0 byte 0x83 DBase 3 data file with memo(s) ->0x04 lelong 0 (no records) ->0x04 lelong >0 (%ld records) +0 byte 0x03 +>0x02 byte <0x13 DBase 3 data file +>>0x04 lelong 0 (no records) +>>0x04 lelong >0 (%ld records) +0 byte 0x83 +>0x02 byte <0x13 DBase 3 data file with memo(s) +>>0x04 lelong 0 (no records) +>>0x04 lelong >0 (%ld records) 0 leshort 0x0006 DBase 3 index file 0 string PMCC Windows 3.x .GRP file 1 string RDC-meg MegaDots @@ -553,6 +654,39 @@ 0 lelong 0x4C >4 lelong 0x00021401 Windows shortcut file +# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm +# only for windows versions equal or greater 3.0 +0x171 string MICROSOFT\ PIFEX\0 Windows Program Information File +!:mime application/x-dosexec +#>2 string >\0 \b, Title:%.30s +>0x24 string >\0 \b for %.63s +>0x65 string >\0 \b, directory=%.64s +>0xA5 string >\0 \b, parameters=%.64s +#>0x181 leshort x \b, offset %x +#>0x183 leshort x \b, offsetdata %x +#>0x185 leshort x \b, section length %x +>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 +>>&0x5e ubyte >0 +>>>&-1 string <PIFMGR.DLL \b, icon=%s +#>>>&-1 string PIFMGR.DLL \b, icon=%s +>>>&-1 string >PIFMGR.DLL \b, icon=%s +>>&0xF0 ubyte >0 +>>>&-1 string <Terminal \b, font=%.32s +#>>>&-1 string =Terminal \b, font=%.32s +>>>&-1 string >Terminal \b, font=%.32s +>>&0x110 ubyte >0 +>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s +#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s +>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s +#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style +#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style +>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style +#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style +>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS +#>>&06 string x \b:%s +>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT +#>>&06 string x \b:%s + # DOS EPS Binary File Header # From: Ed Sznyter <ews@Black.Market.NET> 0 belong 0xC5D0D3C6 DOS EPS Binary File @@ -628,43 +762,58 @@ #-------------------------------------------------------------------- # Qemu Emulator Images # Lines written by Friedrich Schwittay (f.schwittay@yousable.de) -# Made by reading sources and doing trial and error on existing -# qcow files -0 string QFI Qemu Image, Format: Qcow +# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) +# Made by reading sources, reading documentation, and doing trial and error +# on existing QCOW files +0 string QFI\xFB QEMU QCOW Image # Uncomment the following line to display Magic (only used for debugging # this magic number) #>0 string x , Magic: %s -# There are currently 2 Versions: "1" and "2" -# I do not use Version 2 and therefor branch here -# but can assure: it works (tested on both versions) -# Also my Qemu 0.9.0 which uses this Version 2 refuses -# to start in its bios ->0x04 belong 2 , Version: 2 ->0x04 belong 1 , Version: 1 +# There are currently 2 Versions: "1" and "2". +# http://www.gnome.org/~markmc/qcow-image-format-version-1.html +>4 belong 1 (v1) -# Using the existence of the Backing File Offset to Branch or not +# Using the existence of the Backing File Offset to determine whether # to read Backing File Information ->>0xc belong >0 , Backing File( Offset: %lu ->>>(0xc.L) string >\0 , Path: %s - -# Didn't get the trick here how qemu stores the "Size" at this Position -# There is actually something stored but nothing makes sense -# The header in the sources talks about it -#>>>16 lelong x , Size: %lu +>>12 belong >0 \b, has backing file ( +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. +>>>(12.L) string >\0 \bpath %s # Modification time of the Backing File # Really useful if you want to know if your backing # file is still usable together with this image ->>>20 bedate x , Mtime: %s ) +>>>>20 bedate >0 \b, mtime %s) +>>>>20 default x \b) -# Don't know how to calculate in Magicfiles -# Also: this Information is not reliably -# stored in image-files ->>24 lelong x , Disk Size could be: %d * 256 bytes +# Size is stored in bytes in a big-endian u64. +>>24 bequad x \b, %lld bytes -0 string QEVM QEMU's suspend to disk image +# 1 for AES encryption, 0 for none. +>>36 belong 1 \b, AES-encrypted + +# http://www.gnome.org/~markmc/qcow-image-format.html +>4 belong 2 (v2) +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>8 bequad >0 \b, has backing file +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. Also, since there's no +# .Q modifier, we just use the bottom four bytes as an offset. Note that if +# the file is over 4G, and the backing file path is stored after the first 4G, +# the wrong filename will be printed. (This should be (8.Q), when that syntax +# is introduced.) +>>>(12.L) string >\0 (path %s) +>>24 bequad x \b, %lld bytes +>>32 belong 1 \b, AES-encrypted + +>4 default x (unknown version) + +0 string QEVM QEMU suspend to disk image 0 string Bochs\ Virtual\ HD\ Image Bochs disk image, >32 string x type %s, @@ -694,7 +843,12 @@ # Dell's .hdr 0 string $RBU >23 string Dell %s system BIOS ->48 string x version %.3s +>5 byte 2 +>>48 byte x version %d. +>>49 byte x \b%d. +>>50 byte x \b%d +>5 byte <2 +>>48 string x version %.3s # Type: Microsoft DirectDraw Surface # URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp @@ -713,3 +867,10 @@ 0 string ITOLITLS Microsoft Reader eBook Data >8 lelong x \b, version %u !:mime application/x-ms-reader + +# Windows CE Binary Image Data Format +# From: Dr. Jesus <j@hug.gs> +0 string B000FF\n Windows Embedded CE binary image + +# Windows Imaging (WIM) Image +0 string MSWIM\000\000\000 Windows imaging (WIM) image diff --git a/Magdir/msooxml b/Magdir/msooxml new file mode 100644 index 000000000000..6ccebf641bfc --- /dev/null +++ b/Magdir/msooxml @@ -0,0 +1,33 @@ + +#------------------------------------------------------------------------------ +# $File: msooxml,v 1.1 2011/01/25 18:36:19 christos Exp $ +# msooxml: file(1) magic for Microsoft Office XML +# From: Ralf Brown <ralf.brown@gmail.com> + +# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP +# archive. The first member file is normally "[Content_Types].xml". +# Since MSOOXML doesn't have anything like the uncompressed "mimetype" +# file of ePub or OpenDocument, we'll have to scan for a filename +# which can distinguish between the three types + +# start by checking for ZIP local file header signature +0 string PK\003\004 +# make sure the first file is correct +>0x1E string [Content_Types].xml +# skip to the second local file header +# since some documents include a 520-byte extra field following the file +# header, we need to scan for the next header +>>(18.l+49) search/2000 PK\003\004 +# now skip to the *third* local file header; again, we need to scan due to a +# 520-byte extra field following the file header +>>>&26 search/1000 PK\003\004 +# and check the subdirectory name to determine which type of OOXML +# file we have +>>>>&26 string word/ Microsoft Word 2007+ +!:mime application/msword +>>>>&26 string ppt/ Microsoft PowerPoint 2007+ +!:mime application/vnd.ms-powerpoint +>>>>&26 string xl/ Microsoft Excel 2007+ +!:mime application/vnd.ms-excel +>>>>&26 default x Microsoft OOXML +!:strength +10 diff --git a/Magdir/msvc b/Magdir/msvc index 95853fec9b37..1095d05109ae 100644 --- a/Magdir/msvc +++ b/Magdir/msvc @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ # msvc: file(1) magic for msvc # "H. Nanosecond" <aldomel@ix.netcom.com> # Microsoft visual C diff --git a/Magdir/mup b/Magdir/mup index f1022e39b0b3..5060c01dd8bf 100644 --- a/Magdir/mup +++ b/Magdir/mup @@ -1,4 +1,6 @@ + # ------------------------------------------------------------------------ +# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ # mup: file(1) magic for Mup (Music Publisher) input file. # # From: Abel Cheung <abel (@) oaka.org> diff --git a/Magdir/natinst b/Magdir/natinst index 5deb9dedf779..7c319801260a 100644 --- a/Magdir/natinst +++ b/Magdir/natinst @@ -1,5 +1,6 @@ #----------------------------------------------------------------------------- +# $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $ # natinst: file(1) magic for National Instruments Code Files # diff --git a/Magdir/ncr b/Magdir/ncr index 2faf98ada725..4067596f592e 100644 --- a/Magdir/ncr +++ b/Magdir/ncr @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ # ncr: file(1) magic for NCR Tower objects # # contributed by diff --git a/Magdir/netbsd b/Magdir/netbsd index b6aae1ac623e..a889a31ecc5e 100644 --- a/Magdir/netbsd +++ b/Magdir/netbsd @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: netbsd,v 1.18 2009/09/19 16:28:11 christos Exp $ # netbsd: file(1) magic for NetBSD objects # # All new-style magic numbers are in network byte order. diff --git a/Magdir/netscape b/Magdir/netscape index f14227db76cb..942f08adb1cb 100644 --- a/Magdir/netscape +++ b/Magdir/netscape @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ # netscape: file(1) magic for Netscape files # "H. Nanosecond" <aldomel@ix.netcom.com> # version 3 and 4 I think diff --git a/Magdir/netware b/Magdir/netware index fbc16054a32b..c3f57e83819a 100644 --- a/Magdir/netware +++ b/Magdir/netware @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ # netware: file(1) magic for NetWare Loadable Modules (NLMs) # From: Mads Martin Joergensen <mmj@suse.de> diff --git a/Magdir/news b/Magdir/news index 0ac4fa269748..eea8aed765f7 100644 --- a/Magdir/news +++ b/Magdir/news @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") # 0 string StartFontMetrics ASCII font metrics diff --git a/Magdir/nitpicker b/Magdir/nitpicker index c40daecef3ca..d1a66287fd5d 100644 --- a/Magdir/nitpicker +++ b/Magdir/nitpicker @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ # nitpicker: file(1) magic for Flowfiles. # From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 0 string NPFF NItpicker Flow File diff --git a/Magdir/oasis b/Magdir/oasis new file mode 100644 index 000000000000..e527185fd1c4 --- /dev/null +++ b/Magdir/oasis @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $ +# OASIS +# Summary: OASIS stream file +# Long descripton: Open Artwork System Interchange Standard +# File extension: .oas +# Full name: Ben Cowley (bcowley@broadcom.com) +# Philip Dixon (pdixon@broadcom.com) +# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf +# (see page 3) +0 string %SEMI-OASIS\r\n OASIS Stream file diff --git a/Magdir/ocaml b/Magdir/ocaml index f8ba976272e6..3ec3100c6de0 100644 --- a/Magdir/ocaml +++ b/Magdir/ocaml @@ -1,7 +1,8 @@ #------------------------------------------------------------------------------ +# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ # ocaml: file(1) magic for Objective Caml files. -0 string Caml1999 Objective caml +0 string Caml1999 OCaml >8 string X exec file >8 string I interface file (.cmi) >8 string O object file (.cmo) @@ -10,4 +11,4 @@ >8 string Z native library file (.cmxa) >8 string M abstract syntax tree implementation file >8 string N abstract syntax tree interface file ->9 string >\0 (Version %3.3s). +>9 string >\0 (Version %3.3s) diff --git a/Magdir/octave b/Magdir/octave index 309314820e45..49ea3e73e072 100644 --- a/Magdir/octave +++ b/Magdir/octave @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ # octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 0 string Octave-1-L Octave binary data (little endian) 0 string Octave-1-B Octave binary data (big endian) diff --git a/Magdir/ole2compounddocs b/Magdir/ole2compounddocs index ee07514ec5bb..383948ba0e1a 100644 --- a/Magdir/ole2compounddocs +++ b/Magdir/ole2compounddocs @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured # storage (http://en.wikipedia.org/wiki/Structured_Storage) # Additional tests for OLE 2 Compound Documents should be under this recipe. diff --git a/Magdir/olf b/Magdir/olf index e698c36a49ee..6ae3fc04e5ec 100644 --- a/Magdir/olf +++ b/Magdir/olf @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ # olf: file(1) magic for OLF executables # # We have to check the byte order flag to see what byte order all the diff --git a/Magdir/os2 b/Magdir/os2 index 35f79ef4ba6f..8643adc0a91f 100644 --- a/Magdir/os2 +++ b/Magdir/os2 @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ # os2: file(1) magic for OS/2 files # diff --git a/Magdir/os400 b/Magdir/os400 index 3dc05bf906e7..6a05f083eb0d 100644 --- a/Magdir/os400 +++ b/Magdir/os400 @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ # os400: file(1) magic for IBM OS/400 files # # IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com diff --git a/Magdir/os9 b/Magdir/os9 index ed2ed2ca4b26..52b04be3059c 100644 --- a/Magdir/os9 +++ b/Magdir/os9 @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $ # # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. # @@ -9,13 +12,6 @@ # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. -# 3. All advertising materials mentioning features or use of this software -# must display the following acknowledgement: -# This product includes software developed by Ignatios Souvatzis for -# the NetBSD project. -# 4. The name of the author may not be used to endorse or promote products -# derived from this software without specific prior written permission. -# # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES diff --git a/Magdir/osf1 b/Magdir/osf1 index 31166c1f34b7..4e9147196d83 100644 --- a/Magdir/osf1 +++ b/Magdir/osf1 @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ # # Mach magic number info # diff --git a/Magdir/palm b/Magdir/palm index e57e119b5419..a9d42bf6ae1e 100644 --- a/Magdir/palm +++ b/Magdir/palm @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: palm,v 1.7 2009/09/19 16:28:11 christos Exp $ # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks # # Brian Lalor <blalor@hcirisc.cs.binghamton.edu> diff --git a/Magdir/parix b/Magdir/parix index 09965d122ccb..221f4917ea4e 100644 --- a/Magdir/parix +++ b/Magdir/parix @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ # # Parix COFF executables # From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> diff --git a/Magdir/parrot b/Magdir/parrot new file mode 100644 index 000000000000..24e9236da429 --- /dev/null +++ b/Magdir/parrot @@ -0,0 +1,22 @@ +#------------------------------------------------------------------------------ +# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ +# parrot: file(1) magic for Parrot Virtual Machine +# URL: http://www.lua.org/ +# From: Lubomir Rintel <lkundrak@v3.sk> + +# Compiled Parrot byte code +0 string \376PBC\r\n\032\n Parrot bytecode +>64 byte x %d. +>72 byte x \b%d, +>8 byte >0 %d byte words, +>16 byte 0 little-endian, +>16 byte 1 big-endian, +>32 byte 0 IEEE-754 8 byte double floats, +>32 byte 1 x86 12 byte long double floats, +>32 byte 2 IEEE-754 16 byte long double floats, +>32 byte 3 MIPS 16 byte long double floats, +>32 byte 4 AIX 16 byte long double floats, +>32 byte 5 4-byte floats, +>40 byte x Parrot %d. +>48 byte x \b%d. +>56 byte x \b%d diff --git a/Magdir/pbm b/Magdir/pbm index 98c15f79485c..40ecf4911491 100644 --- a/Magdir/pbm +++ b/Magdir/pbm @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ # pbm: file(1) magic for Portable Bitmap files # # XXX - byte order? diff --git a/Magdir/pdf b/Magdir/pdf index 8a4d2e7eba75..ccde22f2c15f 100644 --- a/Magdir/pdf +++ b/Magdir/pdf @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $ # pdf: file(1) magic for Portable Document Format # diff --git a/Magdir/pdp b/Magdir/pdp index 545200529d8b..fa4b82b6a896 100644 --- a/Magdir/pdp +++ b/Magdir/pdp @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $ # pdp: file(1) magic for PDP-11 executable/object and APL workspace # 0 lelong 0101555 PDP-11 single precision APL workspace diff --git a/Magdir/perl b/Magdir/perl index 4c22ecc9b5b0..118683397909 100644 --- a/Magdir/perl +++ b/Magdir/perl @@ -1,18 +1,20 @@ + #------------------------------------------------------------------------------ +# $File: perl,v 1.16 2009/09/19 16:28:11 christos Exp $ # perl: file(1) magic for Larry Wall's perl language. # # The `eval' lines recognizes an outrageously clever hack. # Keith Waclena <keith@cerberus.uchicago.edu> # Send additions to <perl5-porters@perl.org> -0 search/1/b #!\ /bin/perl Perl script text executable +0 search/1/w #!\ /bin/perl Perl script text executable !:mime text/x-perl 0 search/1 eval\ "exec\ /bin/perl Perl script text !:mime text/x-perl -0 search/1/b #!\ /usr/bin/perl Perl script text executable +0 search/1/w #!\ /usr/bin/perl Perl script text executable !:mime text/x-perl 0 search/1 eval\ "exec\ /usr/bin/perl Perl script text !:mime text/x-perl -0 search/1/b #!\ /usr/local/bin/perl Perl script text executable +0 search/1/w #!\ /usr/local/bin/perl Perl script text executable !:mime text/x-perl 0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text !:mime text/x-perl @@ -33,12 +35,12 @@ # Perl POD documents # From: Tom Hukins <tom@eborcom.com> -0 search/1/B \=pod\n Perl POD document text -0 search/1/B \n\=pod\n Perl POD document text -0 search/1/B \=head1\ Perl POD document text -0 search/1/B \n\=head1\ Perl POD document text -0 search/1/B \=head2\ Perl POD document text -0 search/1/B \n\=head2\ Perl POD document text +0 search/1/W \=pod\n Perl POD document text +0 search/1/W \n\=pod\n Perl POD document text +0 search/1/W \=head1\ Perl POD document text +0 search/1/W \n\=head1\ Perl POD document text +0 search/1/W \=head2\ Perl POD document text +0 search/1/W \n\=head2\ Perl POD document text # Perl Storable data files. 0 string perl-store perl Storable (v0.6) data diff --git a/Magdir/pgp b/Magdir/pgp index 63042adeef82..a8d3c9a133d9 100644 --- a/Magdir/pgp +++ b/Magdir/pgp @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ # pgp: file(1) magic for Pretty Good Privacy # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html # diff --git a/Magdir/pkgadd b/Magdir/pkgadd index 876dacd79cd4..7dfb28691dc7 100644 --- a/Magdir/pkgadd +++ b/Magdir/pkgadd @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ # pkgadd: file(1) magic for SysV R4 PKG Datastreams # 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) diff --git a/Magdir/plan9 b/Magdir/plan9 index 58fb071c7bf2..da5eb66650ac 100644 --- a/Magdir/plan9 +++ b/Magdir/plan9 @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables # From: "Stefan A. Haubenthal" <polluks@web.de> # diff --git a/Magdir/plus5 b/Magdir/plus5 index acf3bf4037b6..795cca1f1181 100644 --- a/Magdir/plus5 +++ b/Magdir/plus5 @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ # plus5: file(1) magic for Plus Five's UNIX MUMPS # # XXX - byte order? Paging Hokey.... diff --git a/Magdir/printer b/Magdir/printer index e25d03e977f5..d9d39eefc830 100644 --- a/Magdir/printer +++ b/Magdir/printer @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $ # printer: file(1) magic for printer-formatted files # @@ -63,6 +64,10 @@ #>15 string \ ENTER\ LANGUAGE\ = #>31 string PostScript PostScript +# From: Stefan Thurner <thurners@nicsys.de> +0 string \033%-12345X@PJL +>&0 search/10000 %! PJL encapsulated PostScript document text + # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 0 string \033E\033 HP PCL printer data >3 string \&l0A - default page size diff --git a/Magdir/project b/Magdir/project index 04e8865c2eca..efa5d40f7afe 100644 --- a/Magdir/project +++ b/Magdir/project @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ # project: file(1) magic for Project management # # Magic strings for ftnchek project files. Alexander Mai diff --git a/Magdir/psdbms b/Magdir/psdbms index f36121fcbcd4..09c733fddf75 100644 --- a/Magdir/psdbms +++ b/Magdir/psdbms @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ # psdbms: file(1) magic for psdatabase # 0 belong&0xff00ffff 0x56000000 ps database diff --git a/Magdir/psion b/Magdir/psion deleted file mode 100644 index 7aa2d74520a7..000000000000 --- a/Magdir/psion +++ /dev/null @@ -1,43 +0,0 @@ -#------------------------------------------------------------------------------ -# psion: file(1) magic for Psion handhelds data -# from: Peter Breitenlohner <peb@mppmu.mpg.de> -# -0 lelong 0x10000037 Psion Series 5 ->4 lelong 0x10000039 font file ->4 lelong 0x1000003A printer driver ->4 lelong 0x1000003B clipboard ->4 lelong 0x10000042 multi-bitmap image ->4 lelong 0x1000006A application information file ->4 lelong 0x1000006D ->>8 lelong 0x1000007D sketch image -!:mime image/x-psion-sketch ->>8 lelong 0x1000007E voice note ->>8 lelong 0x1000007F word file ->>8 lelong 0x10000085 OPL program ->>8 lelong 0x10000088 sheet file ->>8 lelong 0x100001C4 EasyFax initialisation file ->4 lelong 0x10000073 OPO module ->4 lelong 0x10000074 OPL application ->4 lelong 0x1000008A exported multi-bitmap image - -0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image - -0 lelong 0x10000050 Psion Series 5 ->4 lelong 0x1000006D database ->4 lelong 0x100000E4 ini file - -0 lelong 0x10000079 Psion Series 5 binary: ->4 lelong 0x00000000 DLL ->4 lelong 0x10000049 comms hardware library ->4 lelong 0x1000004A comms protocol library ->4 lelong 0x1000005D OPX ->4 lelong 0x1000006C application ->4 lelong 0x1000008D DLL ->4 lelong 0x100000AC logical device driver ->4 lelong 0x100000AD physical device driver ->4 lelong 0x100000E5 file transfer protocol ->4 lelong 0x100000E5 file transfer protocol ->4 lelong 0x10000140 printer definition ->4 lelong 0x10000141 printer definition - -0 lelong 0x1000007A Psion Series 5 executable diff --git a/Magdir/pulsar b/Magdir/pulsar index a4a5c21d3d53..7cb6f18bdaee 100644 --- a/Magdir/pulsar +++ b/Magdir/pulsar @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ # pulsar: file(1) magic for Pulsar POP3 daemon binary files # # http://pulsar.sourceforge.net diff --git a/Magdir/pyramid b/Magdir/pyramid index fe16608436b8..ee47c807670a 100644 --- a/Magdir/pyramid +++ b/Magdir/pyramid @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ # pyramid: file(1) magic for Pyramids # # XXX - byte order? diff --git a/Magdir/python b/Magdir/python index 4803203dcfa8..68befe16a1d7 100644 --- a/Magdir/python +++ b/Magdir/python @@ -1,11 +1,13 @@ #------------------------------------------------------------------------------ +# $File: python,v 1.18 2011/02/26 02:33:38 christos Exp $ # python: file(1) magic for python # # From: David Necas <yeti@physics.muni.cz> # often the module starts with a multiline string -0 string """ a python script text executable -# MAGIC as specified in Python/import.c (1.5 to 2.3.0a) +0 string/t """ a python script text executable +# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming +# that Py_UnicodeFlag is off for Python 2) # 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 0 belong 0x994e0d0a python 1.5/1.6 byte-compiled 0 belong 0x87c60d0a python 2.0 byte-compiled @@ -15,7 +17,44 @@ 0 belong 0x6df20d0a python 2.4 byte-compiled 0 belong 0xb3f20d0a python 2.5 byte-compiled 0 belong 0xd1f20d0a python 2.6 byte-compiled +0 belong 0x03f30d0a python 2.7 byte-compiled +0 belong 0x3b0c0d0a python 3.0 byte-compiled +0 belong 0x4f0c0d0a python 3.1 byte-compiled +0 belong 0x6c0c0d0a python 3.2 byte-compiled +0 search/1/w #!\ /usr/bin/python Python script text executable +!:mime text/x-python +0 search/1/w #!\ /usr/local/bin/python Python script text executable +!:mime text/x-python +0 search/1 #!/usr/bin/env\ python Python script text executable +!:mime text/x-python +0 search/1 #!\ /usr/bin/env\ python Python script text executable +!:mime text/x-python -0 string/b #!\ /usr/bin/python python script text executable +# from module.submodule import func1, func2 +0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable +!:mime text/x-python + +# def __init__ (self, ...): +0 search/4096 def\ __init__ +>&0 search/64 self Python script text executable +!:mime text/x-python + +# comments +0 search/4096 ''' +>&0 regex .*'''$ Python script text executable +!:mime text/x-python + +0 search/4096 """ +>&0 regex .*"""$ Python script text executable +!:mime text/x-python + +# try: +# except: or finally: +# block +0 search/4096 try: +>&0 regex \^\\s*except.*: Python script text executable +!:mime text/x-python +>&0 search/4096 finally: Python script text executable +!:mime text/x-python diff --git a/Magdir/revision b/Magdir/revision index a809cb9e6034..b337ee3b2d7b 100644 --- a/Magdir/revision +++ b/Magdir/revision @@ -1,8 +1,9 @@ #------------------------------------------------------------------------------ +# $File: revision,v 1.8 2010/11/25 15:00:12 christos Exp $ # file(1) magic for revision control files # From Hendrik Scholz <hendrik@scholz.net> -0 string /1\ :pserver: cvs password text file +0 string/t /1\ :pserver: cvs password text file # Conary changesets # From: Jonathan Smith <smithj@rpath.com> @@ -12,8 +13,40 @@ # From: Josh Triplett <josh@freedesktop.org> 0 string #\ v2\ git\ bundle\n Git bundle +# Type: Git pack +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, +# those have a little-endian offset immediately following the magic 'PACK', +# the first byte of which is never 0, while the first byte of the Git pack +# version, since it's a tiny number stored in big-endian format, is always 0. +0 string PACK\0 Git pack +>4 belong >0 \b, version %d +>>8 belong >0 \b, %d objects + +# Type: Git pack index +# From: Adam Buchbinder <adam.buchbinder@gmail.com> +0 string \377tOc Git pack index +>4 belong =2 \b, version 2 + +# Type: Git index file +# From: Frédéric Brière <fbriere@fbriere.net> +0 string DIRC Git index +>4 belong >0 \b, version %d +>>8 belong >0 \b, %d entries + # Type: Mercurial bundles # From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 0 string HG10 Mercurial bundle, >4 string UN uncompressed >4 string BZ bzip2 compressed + +# Type: Subversion (SVN) dumps +# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> +0 string SVN-fs-dump-format-version: Subversion dumpfile +>28 string >\0 (version: %s) + +# Type: Bazaar revision bundles and merge requests +# URL: http://www.bazaar-vcs.org/ +# From: Jelmer Vernooij <jelmer@samba.org> +0 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle +0 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive diff --git a/Magdir/riff b/Magdir/riff index c6e3070b56ff..4fffafacf31f 100644 --- a/Magdir/riff +++ b/Magdir/riff @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: riff,v 1.22 2011/09/06 11:00:06 christos Exp $ # riff: file(1) magic for RIFF format # See # @@ -39,12 +40,14 @@ >>20 leshort 2 \b, Microsoft ADPCM >>20 leshort 6 \b, ITU G.711 A-law >>20 leshort 7 \b, ITU G.711 mu-law +>>20 leshort 8 \b, Microsoft DTS >>20 leshort 17 \b, IMA ADPCM >>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) >>20 leshort 49 \b, GSM 6.10 >>20 leshort 64 \b, ITU G.721 ADPCM >>20 leshort 80 \b, MPEG >>20 leshort 85 \b, MPEG Layer 3 +>>20 leshort 0x2001 \b, DTS >>22 leshort =1 \b, mono >>22 leshort =2 \b, stereo >>22 leshort >2 \b, %d channels @@ -176,6 +179,8 @@ # MPEG-1 wrapped in a RIFF, apparently >8 string CDXA \b, wrapped MPEG-1 (CDXA) >8 string 4XMV \b, 4X Movie file +# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV +>8 string AMV\040 \b, AMV # # XXX - some of the below may only appear in little-endian form. @@ -223,3 +228,31 @@ >8 string NIFF \b, Notation Interchange File Format # SoundFont 2 <mpruett@sgi.com> >8 string sfbk SoundFont/Bank + +#------------------------------------------------------------------------------ +# Sony Wave64 +# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf +# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian +0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data +# 128 bit + total file size (64 bits) so 24 bytes +# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } +>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio +!:mime audio/x-w64 +# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } +>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b +>>>&10 leshort =1 \b, mono +>>>&10 leshort =2 \b, stereo +>>>&10 leshort >2 \b, %d channels +>>>&12 lelong >0 %d Hz + +#------------------------------------------------------------------------------ +# MBWF/RF64 +# see EBU – TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf +0 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio +!:mime audio/x-wav +>40 search/256 fmt\x20 \b +>>&6 leshort =1 \b, mono +>>&6 leshort =2 \b, stereo +>>&6 leshort >2 \b, %d channels +>>&8 lelong >0 %d Hz + diff --git a/Magdir/rinex b/Magdir/rinex new file mode 100644 index 000000000000..c5f2bcbd31e1 --- /dev/null +++ b/Magdir/rinex @@ -0,0 +1,44 @@ + +#------------------------------------------------------------------------------ +# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $ +# rinex: file(1) magic for RINEX files +# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt +# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf +# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data +60 string RINEX +>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/broadcast +>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/observation +>80 search/256 XXRINEXC RINEX Data, Clock +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/clock +>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXL RINEX Data, Galileo Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXM RINEX Data, Meteorological +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/meteorological +>80 search/256 XXRINEXN RINEX Data, Navigation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/navigation +>80 search/256 XXRINEXO RINEX Data, Observation +>>&32 string x \b, date %15.15s +>>5 string x \b, version %6.6s +!:mime rinex/observation diff --git a/Magdir/rpm b/Magdir/rpm index 6d7e850bb7df..85232c6cd160 100644 --- a/Magdir/rpm +++ b/Magdir/rpm @@ -1,15 +1,17 @@ + #------------------------------------------------------------------------------ +# $File: rpm,v 1.11 2011/06/14 12:47:41 christos Exp $ # # RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) # -0 beshort 0xedab ->2 beshort 0xeedb RPM +0 belong 0xedabeedb RPM !:mime application/x-rpm ->>4 byte x v%d ->>6 beshort 0 bin ->>6 beshort 1 src ->>8 beshort 1 i386 ->>8 beshort 2 Alpha +>4 byte x v%d +>5 byte x \b.%d +>6 beshort 1 src +>6 beshort 0 bin +>>8 beshort 1 i386/x86_64 +>>8 beshort 2 Alpha/Sparc64 >>8 beshort 3 Sparc >>8 beshort 4 MIPS >>8 beshort 5 PowerPC @@ -20,4 +22,31 @@ >>8 beshort 10 Sparc64 >>8 beshort 11 MIPSel >>8 beshort 12 ARM +>>8 beshort 13 MiNT +>>8 beshort 14 S/390 +>>8 beshort 15 S/390x +>>8 beshort 16 PowerPC64 +>>8 beshort 17 SuperH +>>8 beshort 18 Xtensa +>>8 beshort 255 noarch + +#delta RPM Daniel Novotny (dnovotny@redhat.com) +0 string drpm Delta RPM +!:mime application/x-rpm +>12 string x %s + +>>>8 beshort 11 MIPSel +>>>8 beshort 12 ARM +>>>8 beshort 13 MiNT +>>>8 beshort 14 S/390 +>>>8 beshort 15 S/390x +>>>8 beshort 16 PowerPC64 +>>>8 beshort 17 SuperH +>>>8 beshort 18 Xtensa >>10 string x %s + +# Type: Delta RPM +# From: Daniel Novotny (dnovotny@redhat.com) +0 string drpm Delta RPM +!:mime application/x-rpm +>12 string x %s diff --git a/Magdir/rtf b/Magdir/rtf index 8e5bfe0e32ee..dca31956235f 100644 --- a/Magdir/rtf +++ b/Magdir/rtf @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ # rtf: file(1) magic for Rich Text Format (RTF) # # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk diff --git a/Magdir/ruby b/Magdir/ruby index de6f2a0974cd..26630f3a8202 100644 --- a/Magdir/ruby +++ b/Magdir/ruby @@ -1,10 +1,28 @@ + #------------------------------------------------------------------------------ -# ruby: file(1) magic for Lua scripting language +# $File: ruby,v 1.5 2010/07/21 16:47:17 christos Exp $ +# ruby: file(1) magic for Ruby scripting language # URL: http://www.ruby-lang.org/ # From: Reuben Thomas <rrt@sc3d.org> # Ruby scripts -0 search/1/b #!\ /usr/bin/ruby Ruby script text executable -0 search/1/b #!\ /usr/local/bin/ruby Ruby script text executable +0 search/1/w #!\ /usr/bin/ruby Ruby script text executable +!:mime text/x-ruby +0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable +!:mime text/x-ruby 0 search/1 #!/usr/bin/env\ ruby Ruby script text executable +!:mime text/x-ruby 0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable +!:mime text/x-ruby + +# What looks like ruby, but does not have a shebang +# (modules and such) +# From: Lubomir Rintel <lkundrak@v3.sk> +0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' +>0 regex include\ [A-Z]|def\ [a-z]|\ do$ +>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text +!:mime text/x-ruby +0 regex \^[\ \t]*(class|module)[\ \t][A-Z] +>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] +>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text +!:mime text/x-ruby diff --git a/Magdir/sc b/Magdir/sc index 72027d69ebff..dc6d6c83d7a5 100644 --- a/Magdir/sc +++ b/Magdir/sc @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ # sc: file(1) magic for "sc" spreadsheet # 38 string Spreadsheet sc spreadsheet file diff --git a/Magdir/sccs b/Magdir/sccs index 11d50b23c003..95b3a5db128d 100644 --- a/Magdir/sccs +++ b/Magdir/sccs @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ # sccs: file(1) magic for SCCS archives # # SCCS archive structure: diff --git a/Magdir/scientific b/Magdir/scientific index f7aedaebd248..7418f1ba54ac 100644 --- a/Magdir/scientific +++ b/Magdir/scientific @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: scientific,v 1.7 2010/09/20 19:19:17 rrt Exp $ # scientific: file(1) magic for scientific formats # # From: Joe Krahn <krahn@niehs.nih.gov> @@ -69,3 +71,36 @@ 0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data + +# PDB: Protein Data Bank files +# Adam Buchbinder <adam.buchbinder@gmail.com> +# +# http://www.wwpdb.org/documentation/format32/sect2.html +# http://www.ch.ic.ac.uk/chemime/ +# +# The PDB file format is fixed-field, 80 columns. From the spec: +# +# COLS DATA +# 1 - 6 "HEADER" +# 11 - 50 String(40) +# 51 - 59 Date +# 63 - 66 IDcode +# +# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the +# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and +# uppercase letters. However, examples have been seen without the date string, +# e.g., the example on the chemime site. +0 string HEADER\ \ \ \ +>&0 regex/1 \^.{40} +>>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} +>>>&0 regex/1s [A-Z0-9]{4}.{14}$ +>>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s +!:mime chemical/x-pdb +>>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s + +# Type: GDSII Stream file +0 belong 0x00060002 GDSII Stream file +>4 byte 0x00 +>>5 byte x version %d.0 +>4 byte >0x00 version %d +>>5 byte x \b.%d diff --git a/Magdir/securitycerts b/Magdir/securitycerts index aa55d2188fc1..8785dd883fdc 100644 --- a/Magdir/securitycerts +++ b/Magdir/securitycerts @@ -1,3 +1,6 @@ + +#------------------------------------------------------------------------------ +# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 0 belong 0xedfeedfe Sun 'jks' Java Keystore File data diff --git a/Magdir/selinux b/Magdir/selinux new file mode 100644 index 000000000000..5f2294654349 --- /dev/null +++ b/Magdir/selinux @@ -0,0 +1,24 @@ +# Type: SE Linux policy modules *.pp reference policy +# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. +# URL: http://doc.coker.com.au/computers/selinux-magic +# From: Russell Coker <russell@coker.com.au> + +0 lelong 0xf97cff8f SE Linux modular policy +>4 lelong x version %d, +>8 lelong x %d sections, +>>(12.l) lelong 0xf97cff8d +>>>(12.l+27) lelong x mod version %d, +>>>(12.l+31) lelong 0 Not MLS, +>>>(12.l+31) lelong 1 MLS, +>>>(12.l+23) lelong 2 +>>>>(12.l+47) string >\0 module name %s +>>>(12.l+23) lelong 1 base + +1 string policy_module( SE Linux policy module source +2 string policy_module( SE Linux policy module source + +0 string ##\ <summary> SE Linux policy interface source + +#0 search gen_context( SE Linux policy file contexts + +#0 search gen_sens( SE Linux policy MLS constraints source diff --git a/Magdir/sendmail b/Magdir/sendmail index 7880ab510e62..aeb620314269 100644 --- a/Magdir/sendmail +++ b/Magdir/sendmail @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ # sendmail: file(1) magic for sendmail config files # # XXX - byte order? diff --git a/Magdir/sequent b/Magdir/sequent index e6f7b52aacb1..0ce6bf2c796a 100644 --- a/Magdir/sequent +++ b/Magdir/sequent @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ # sequent: file(1) magic for Sequent machines # # Sequent information updated by Don Dwiggins <atsun!dwiggins>. diff --git a/Magdir/sgi b/Magdir/sgi index 5b540278c8b1..2a8af1faf14c 100644 --- a/Magdir/sgi +++ b/Magdir/sgi @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sgi,v 1.18 2010/11/25 15:00:12 christos Exp $ # sgi: file(1) magic for Silicon Graphics applications # @@ -60,7 +61,7 @@ >11 byte x dataformat %d # Alias Maya files -0 string //Maya ASCII Alias Maya Ascii File, +0 string/t //Maya ASCII Alias Maya Ascii File, >13 string >\0 version %s 8 string MAYAFOR4 Alias Maya Binary File, >32 string >\0 version %s scene diff --git a/Magdir/sgml b/Magdir/sgml index 7e3391b09b8c..6843e332d77b 100644 --- a/Magdir/sgml +++ b/Magdir/sgml @@ -1,40 +1,63 @@ #------------------------------------------------------------------------------ +# $File: sgml,v 1.26 2011/04/16 15:20:04 christos Exp $ # Type: SVG Vectorial Graphics # From: Noel Torres <tecnico@ejerciciosresueltos.com> 0 string \<?xml\ version=" >15 string >\0 ->>23 search/400 \<svg SVG Scalable Vector Graphics image +>>19 search/4096 \<svg SVG Scalable Vector Graphics image !:mime image/svg+xml ->>23 search/400 \<gnc-v2 GnuCash file +>>19 search/4096 \<gnc-v2 GnuCash file !:mime application/x-gnucash # Sitemap file -0 string \<?xml\ version=" +0 string/t \<?xml\ version=" >15 string >\0 ->>23 search/400 \<urlset XML Sitemap document text +>>19 search/4096 \<urlset XML Sitemap document text !:mime application/xml-sitemap +# xhtml +0 string/t \<?xml\ version=" +>15 string >\0 +>>19 search/4096/cWbt \<!doctype\ html xHTML document text +!:mime text/html +0 string/t \<?xml\ version=' +>15 string >\0 +>>19 search/4096/cWbt \<!doctype\ html xHTML document text +!:mime text/html +0 string/t \<?xml\ version=" +>15 string >\0 +>>19 search/4096/cWbt \<html broken xHTML document text +!:mime text/html + #------------------------------------------------------------------------------ # sgml: file(1) magic for Standard Generalized Markup Language # HyperText Markup Language (HTML) is an SGML document type, # from Daniel Quinlan (quinlan@yggdrasil.com) # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) -0 search/1/cB \<!doctype\ html HTML document text +0 search/4096/cWt \<!doctype\ html HTML document text +!:mime text/html +0 search/4096/cwt \<head HTML document text +!:mime text/html +0 search/4096/cwt \<title HTML document text +!:mime text/html +0 search/4096/cwt \<html HTML document text +!:mime text/html +0 search/4096/cwt \<script HTML document text !:mime text/html -0 search/1/cb \<head HTML document text +0 search/4096/cwt \<style HTML document text !:mime text/html -0 search/1/cb \<title HTML document text +0 search/4096/cwt \<table HTML document text !:mime text/html -0 search/1/cb \<html HTML document text +0 search/4096/cwt \<a\ href= HTML document text !:mime text/html # Extensible markup language (XML), a subset of SGML # from Marc Prud'hommeaux (marc@apocalypse.org) -0 search/1/cb \<?xml XML document text +0 search/1/cwt \<?xml XML document text !:mime application/xml -0 string \<?xml\ version\ " XML +0 string/t \<?xml\ version\ " XML !:mime application/xml -0 string \<?xml\ version=" XML +0 string/t \<?xml\ version=" XML !:mime application/xml >15 search/1 >\0 %.3s document text >>23 search/1 \<xsl:stylesheet (XSL stylesheet) @@ -44,16 +67,19 @@ >15 search/1 >\0 %.3s document text >>23 search/1 \<xsl:stylesheet (XSL stylesheet) >>24 search/1 \<xsl:stylesheet (XSL stylesheet) -0 search/1/b \<?xml XML document text +0 search/1/wbt \<?xml XML document text !:mime application/xml -0 search/1/b \<?XML broken XML document text +!:strength - 10 +0 search/1/wt \<?XML broken XML document text !:mime application/xml +!:strength - 10 # SGML, mostly from rph@sq -0 search/1/cb \<!doctype exported SGML document text -0 search/1/cb \<!subdoc exported SGML subdocument text -0 search/1/cb \<!-- exported SGML document text +0 search/4096/cwt \<!doctype exported SGML document text +0 search/4096/cwt \<!subdoc exported SGML subdocument text +0 search/4096/cwt \<!-- exported SGML document text +!:strength - 10 # Web browser cookie files # (Mozilla, Galeon, Netscape 4, Konqueror..) diff --git a/Magdir/sharc b/Magdir/sharc index 0e0e4e38db6e..d5f360460b6a 100644 --- a/Magdir/sharc +++ b/Magdir/sharc @@ -1,5 +1,6 @@ #------------------------------------------------------------------------ +# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ # file(1) magic for sharc files # # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by diff --git a/Magdir/sinclair b/Magdir/sinclair index fbad852c50fa..5882a64f579f 100644 --- a/Magdir/sinclair +++ b/Magdir/sinclair @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ # sinclair: file(1) sinclair QL # additions to /etc/magic by Thomas M. Ott (ThMO) diff --git a/Magdir/sisu b/Magdir/sisu new file mode 100644 index 000000000000..ba7104fa1698 --- /dev/null +++ b/Magdir/sisu @@ -0,0 +1,18 @@ +# Type: SiSU Markup Language +# URL: http://www.sisudoc.org/ +# From: Ralph Amissah <ralph.amissah@gmail.com> + +0 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert +>5 regex [0-9.]+ %s + +0 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master +>5 regex [0-9.]+ %s + +0 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text +>5 regex [0-9.]+ %s + +0 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text +>5 regex [0-9.]+ %s + +0 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text +>5 regex [0-9.]+ %s diff --git a/Magdir/sketch b/Magdir/sketch index a14803ebefbb..82dacb8f06dc 100644 --- a/Magdir/sketch +++ b/Magdir/sketch @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ # Sketch Drawings: http://sketch.sourceforge.net/ # From: Edwin Mons <e@ik.nu> 0 search/1 ##Sketch Sketch document text diff --git a/Magdir/smalltalk b/Magdir/smalltalk index b8827598c185..9ff2c6b0c0ab 100644 --- a/Magdir/smalltalk +++ b/Magdir/smalltalk @@ -1,5 +1,6 @@ #----------------------------------------------- +# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ # GNU Smalltalk image, starting at version 1.6.2 # From: catull_us@yahoo.com # diff --git a/Magdir/smile b/Magdir/smile new file mode 100644 index 000000000000..d196de50d171 --- /dev/null +++ b/Magdir/smile @@ -0,0 +1,34 @@ + +#------------------------------------------------------------------------------ +# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ +# smile: file(1) magic for Smile serialization +# +# The Smile serialization format uses a 4-byte header: +# +# Constant byte #0: 0x3A (ASCII ':') +# Constant byte #1: 0x29 (ASCII ')') +# Constant byte #2: 0x0A (ASCII linefeed, '\n') +# Variable byte #3, consisting of bits: +# Bits 4-7 (4 MSB): 4-bit version number +# Bits 3: Reserved +# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content +# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false +# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true +# +# Reference: http://wiki.fasterxml.com/SmileFormatSpec +# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> + +# Detection +0 string :)\n Smile binary data + +# Versioning +>3 byte&0xF0 x version %d: + +# Properties +>3 byte&0x04 0x04 binary raw, +>3 byte&0x04 0x00 binary encoded, +>3 byte&0x02 0x02 shared String values enabled, +>3 byte&0x02 0x00 shared String values disabled, +>3 byte&0x01 0x01 shared field names enabled +>3 byte&0x01 0x00 shared field names disabled + diff --git a/Magdir/sniffer b/Magdir/sniffer index 282c44fec454..47f5798bd6e5 100644 --- a/Magdir/sniffer +++ b/Magdir/sniffer @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $ # sniffer: file(1) magic for packet capture files # # From: guy@alum.mit.edu (Guy Harris) @@ -73,6 +74,7 @@ # that use "libpcap", or that use the same capture file format.) # 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) +!:mime application/vnd.tcpdump.pcap >4 beshort x - version %d >6 beshort x \b.%d >20 belong 0 (No link-layer encapsulation @@ -137,6 +139,7 @@ >20 belong 163 (802.11 with AVS header >16 belong x \b, capture length %d) 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) +!:mime application/vnd.tcpdump.pcap >4 leshort x - version %d >6 leshort x \b.%d >20 lelong 0 (No link-layer encapsulation @@ -247,6 +250,21 @@ >16 lelong x \b, capture length %d) # +# "pcap-ng" capture files. +# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html +# Pcap-ng files can contain multiple sections. Printing the endianness, +# snaplen, or other information from the first SHB may be misleading. +# +0 ubelong 0x0a0d0d0a +>8 ubelong 0x1a2b3c4d pcap-ng capture file +>>12 beshort x - version %d +>>14 beshort x \b.%d +0 ulelong 0x0a0d0d0a +>8 ulelong 0x1a2b3c4d pcap-ng capture file +>>12 leshort x - version %d +>>14 leshort x \b.%d + +# # AIX "iptrace" capture files. # 0 string iptrace\ 1.0 "iptrace" capture file diff --git a/Magdir/softquad b/Magdir/softquad index ac7891d736aa..06c1f018f8cb 100644 --- a/Magdir/softquad +++ b/Magdir/softquad @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ # softquad: file(1) magic for SoftQuad Publishing Software # # Author/Editor and RulesBuilder diff --git a/Magdir/spec b/Magdir/spec index bfda30642c73..c504b1fd1944 100644 --- a/Magdir/spec +++ b/Magdir/spec @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ # spec: file(1) magic for SPEC raw results (*.raw, *.rsf) # # Cloyce D. Spradling <cloyce@headgear.org> diff --git a/Magdir/spectrum b/Magdir/spectrum index a48ac41357e9..d2c414b96776 100644 --- a/Magdir/spectrum +++ b/Magdir/spectrum @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $ # spectrum: file(1) magic for Spectrum emulator files. # # John Elliott <jce@seasip.demon.co.uk> @@ -19,13 +20,17 @@ # Tape file. This assumes the .TAP starts with a Spectrum-format header, # which nearly all will. # -0 string \023\000\000 Spectrum .TAP data ->4 string x "%-10.10s" ->3 byte 0 - BASIC program ->3 byte 1 - number array ->3 byte 2 - character array ->3 byte 3 - memory block ->>14 belong 0x001B0040 (screen) +# Update: Sanity-check string contents to be printable. +# -Adam Buchbinder <adam.buchbinder@gmail.com> +# +0 string \023\000\000 +>4 string >\0 +>>4 string <\177 Spectrum .TAP data "%-10.10s" +>>>3 byte 0 - BASIC program +>>>3 byte 1 - number array +>>>3 byte 2 - character array +>>>3 byte 3 - memory block +>>>>14 belong 0x001B0040 (screen) # The following three blocks are from pak21-spectrum@srcf.ucam.org # TZX tape images diff --git a/Magdir/sql b/Magdir/sql index 21c6e515e945..cce5550fef42 100644 --- a/Magdir/sql +++ b/Magdir/sql @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sql,v 1.6 2009/09/19 16:28:12 christos Exp $ # sql: file(1) magic for SQL files # # From: "Marty Leisner" <mleisner@eng.mc.xerox.com> diff --git a/Magdir/ssh b/Magdir/ssh new file mode 100644 index 000000000000..c87f388303d6 --- /dev/null +++ b/Magdir/ssh @@ -0,0 +1,8 @@ +# Type: OpenSSH key files +# From: Nicolas Collignon <tsointsoin@gmail.com> + +0 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, +>28 string >\0 version %s + +0 string ssh-dss\ OpenSSH DSA public key +0 string ssh-rsa\ OpenSSH RSA public key diff --git a/Magdir/ssl b/Magdir/ssl new file mode 100644 index 000000000000..4d8706e2b8ca --- /dev/null +++ b/Magdir/ssl @@ -0,0 +1,7 @@ +# Type: OpenSSL certificates/key files +# From: Nicolas Collignon <tsointsoin@gmail.com> + +0 string -----BEGIN\ CERTIFICATE----- PEM certificate +0 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request +0 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key +0 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key diff --git a/Magdir/sun b/Magdir/sun index 871071e9996b..1fd37ede65bd 100644 --- a/Magdir/sun +++ b/Magdir/sun @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: sun,v 1.22 2011/02/10 01:52:51 christos Exp $ # sun: file(1) magic for Sun machines # # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x @@ -112,8 +113,10 @@ # Microsoft ICM color profile 36 string acspMSFT Microsoft ICM Color Profile +!:mime application/vnd.iccprofile # Sun KCMS 36 string acsp Kodak Color Management System, ICC Profile +!:mime application/vnd.iccprofile #--------------------------------------------------------------------------- # The following entries have been tested by Duncan Laurie <duncan@sun.com> (a diff --git a/Magdir/sysex b/Magdir/sysex index 03d6cdd6b78a..70b5b1cf24a1 100644 --- a/Magdir/sysex +++ b/Magdir/sysex @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------ +# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $ # sysex: file(1) magic for MIDI sysex files # # diff --git a/Magdir/tcl b/Magdir/tcl new file mode 100644 index 000000000000..223f93b58c19 --- /dev/null +++ b/Magdir/tcl @@ -0,0 +1,29 @@ +#------------------------------------------------------------------------------ +# file: file(1) magic for Tcl scripting language +# URL: http://www.tcl.tk/ +# From: gustaf neumann + +# Tcl scripts +0 search/1/w #!\ /usr/bin/tcl Tcl script text executable +!:mime text/x-lua +0 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable +!:mime text/x-tcl +0 search/1 #!/usr/bin/env\ tcl Tcl script text executable +!:mime text/x-tcl +0 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable +!:mime text/x-tcl +0 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable +!:mime text/x-tcl +0 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable +!:mime text/x-tcl + +# check the first line +0 search/1 package\ req +>0 regex \^package[\ \t]+req Tcl script +# not 'p', check other lines +0 search/1 !p +>0 regex \^package[\ \t]+req Tcl script diff --git a/Magdir/teapot b/Magdir/teapot index d9554bfb738e..b6577b6f2856 100644 --- a/Magdir/teapot +++ b/Magdir/teapot @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ # teapot: file(1) magic for "teapot" spreadsheet # 0 string #!teapot\012xdr teapot work sheet (XDR format) diff --git a/Magdir/terminfo b/Magdir/terminfo index 2226ce8cee53..97ea42929914 100644 --- a/Magdir/terminfo +++ b/Magdir/terminfo @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ # terminfo: file(1) magic for terminfo # # XXX - byte order for screen images? diff --git a/Magdir/tex b/Magdir/tex index 5416db17463e..e8d2e8762a8c 100644 --- a/Magdir/tex +++ b/Magdir/tex @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: tex,v 1.18 2011/02/08 13:45:15 christos Exp $ # tex: file(1) magic for TeX files # # XXX - needs byte-endian stuff (big-endian and little-endian DVI?) @@ -35,34 +37,42 @@ !:mime text/x-info # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) -0 search/400 \\input TeX document text +0 search/4096 \\input TeX document text !:mime text/x-tex -0 search/400 \\section LaTeX document text +!:strength + 15 +0 search/4096 \\section LaTeX document text !:mime text/x-tex -0 search/400 \\setlength LaTeX document text +!:strength + 18 +0 search/4096 \\setlength LaTeX document text !:mime text/x-tex -0 search/400 \\documentstyle LaTeX document text +!:strength + 15 +0 search/4096 \\documentstyle LaTeX document text !:mime text/x-tex -0 search/400 \\chapter LaTeX document text +!:strength + 18 +0 search/4096 \\chapter LaTeX document text !:mime text/x-tex -0 search/400 \\documentclass LaTeX 2e document text +!:strength + 18 +0 search/4096 \\documentclass LaTeX 2e document text !:mime text/x-tex -0 search/400 \\relax LaTeX auxiliary file +!:strength + 15 +0 search/4096 \\relax LaTeX auxiliary file !:mime text/x-tex -0 search/400 \\contentsline LaTeX table of contents +!:strength + 15 +0 search/4096 \\contentsline LaTeX table of contents !:mime text/x-tex -0 search/400 %\ -*-latex-*- LaTeX document text +!:strength + 15 +0 search/4096 %\ -*-latex-*- LaTeX document text !:mime text/x-tex # Tex document, from Hendrik Scholz <hendrik@scholz.net> 0 search/1 \\ifx TeX document text # Index and glossary files -0 search/400 \\indexentry LaTeX raw index file -0 search/400 \\begin{theindex} LaTeX sorted index -0 search/400 \\glossaryentry LaTeX raw glossary -0 search/400 \\begin{theglossary} LaTeX sorted glossary -0 search/400 This\ is\ makeindex Makeindex log file +0 search/4096 \\indexentry LaTeX raw index file +0 search/4096 \\begin{theindex} LaTeX sorted index +0 search/4096 \\glossaryentry LaTeX raw glossary +0 search/4096 \\begin{theglossary} LaTeX sorted glossary +0 search/4096 This\ is\ makeindex Makeindex log file # End of TeX @@ -91,3 +101,5 @@ 0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 0 search/1 @c\ @mapfile{ TeX font aliases text file + +0 string #LyX LyX document text diff --git a/Magdir/tgif b/Magdir/tgif index 779883ac8488..e80b3a76cb32 100644 --- a/Magdir/tgif +++ b/Magdir/tgif @@ -1,6 +1,7 @@ + #------------------------------------------------------------------------------ +# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ # file(1) magic for tgif(1) files # From Hendrik Scholz <hendrik@scholz.net> - -0 string %TGIF\ x Tgif file version %s - +0 string %TGIF\ Tgif file version +>6 string x %s diff --git a/Magdir/ti-8x b/Magdir/ti-8x index 89e220401c52..d7903febcb07 100644 --- a/Magdir/ti-8x +++ b/Magdir/ti-8x @@ -1,4 +1,6 @@ -# ------------------------------------------------------------------------ + +#------------------------------------------------------------------------------ +# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ # ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. # # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). diff --git a/Magdir/timezone b/Magdir/timezone index c9ce02582ce0..9381a0cdd3f9 100644 --- a/Magdir/timezone +++ b/Magdir/timezone @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ # timezone: file(1) magic for timezone data # # from Daniel Quinlan (quinlan@yggdrasil.com) diff --git a/Magdir/troff b/Magdir/troff index 73731a89b3fc..b24ea0a49862 100644 --- a/Magdir/troff +++ b/Magdir/troff @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ # troff: file(1) magic for *roff # # updated by Daniel Quinlan (quinlan@yggdrasil.com) diff --git a/Magdir/tuxedo b/Magdir/tuxedo index 119afa6a6bab..191501decf2e 100644 --- a/Magdir/tuxedo +++ b/Magdir/tuxedo @@ -1,5 +1,6 @@ -# + #------------------------------------------------------------------------------ +# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ # tuxedo: file(1) magic for BEA TUXEDO data files # # from Ian Springer <ispringer@hotmail.com> diff --git a/Magdir/typeset b/Magdir/typeset index 2eda7c3e413f..e99fe3731b03 100644 --- a/Magdir/typeset +++ b/Magdir/typeset @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ # typeset: file(1) magic for other typesetting # 0 string Interpress/Xerox Xerox InterPress data diff --git a/Magdir/unicode b/Magdir/unicode index 5f4a576470f0..f7eb5a2108aa 100644 --- a/Magdir/unicode +++ b/Magdir/unicode @@ -1,4 +1,6 @@ -#--------------------------------------------------------------------------- + +#------------------------------------------------------------------------------ +# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> # GRR: These types should be recognised in file_ascmagic so these # encodings can be treated by text patterns. @@ -9,6 +11,6 @@ 0 string +/v+ Unicode text, UTF-7 0 string +/v/ Unicode text, UTF-7 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC -0 string \376\377\000\000 Unicode text, UTF-32, big-endian +0 string \000\000\376\377 Unicode text, UTF-32, big-endian 0 string \377\376\000\000 Unicode text, UTF-32, little-endian 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) diff --git a/Magdir/unknown b/Magdir/unknown index 910cea48e079..82ac2ad164f3 100644 --- a/Magdir/unknown +++ b/Magdir/unknown @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $ # unknown: file(1) magic for unknown machines # # XXX - this probably should be pruned, as it'll match PDP-11 and diff --git a/Magdir/uuencode b/Magdir/uuencode index 982cba9046f0..c00ddabbde36 100644 --- a/Magdir/uuencode +++ b/Magdir/uuencode @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ # uuencode: file(1) magic for ASCII-encoded files # diff --git a/Magdir/varied.out b/Magdir/varied.out index 6df6fd93a41f..3d8aa9219a4b 100644 --- a/Magdir/varied.out +++ b/Magdir/varied.out @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $ # varied.out: file(1) magic for various USG systems # # Herewith many of the object file formats used by USG systems. @@ -27,9 +28,12 @@ 0 string gmon GNU prof performance data >4 long x - version %ld # From: Dave Pearson <davep@davep.org> -# Harbour <URL:http://www.harbour-project.org/> HRB files. +# Harbour <URL:http://harbour-project.org/> HRB files. 0 string \xc0HRB Harbour HRB file ->4 short x version %d +>4 leshort x version %d +# Harbour HBV files +0 string \xc0HBV Harbour variable dump file +>4 leshort x version %d # From: Alex Beregszaszi <alex@fsn.hu> # 0 string exec BugOS executable diff --git a/Magdir/varied.script b/Magdir/varied.script index 61f935cdcd81..1f5eee58cb56 100644 --- a/Magdir/varied.script +++ b/Magdir/varied.script @@ -1,13 +1,15 @@ + #------------------------------------------------------------------------------ +# $File: varied.script,v 1.7 2010/11/25 15:00:12 christos Exp $ # varied.script: file(1) magic for various interpreter scripts -0 string #!\ / a +0 string/t #!\ / a >3 string >\0 %s script text executable -0 string #!\t/ a +0 string/t #!\t/ a >3 string >\0 %s script text executable -0 string #!/ a +0 string/t #!/ a >2 string >\0 %s script text executable -0 string #!\ script text executable +0 string/t #!\ script text executable >3 string >\0 for %s # From: arno <arenevier@fdn.fr> diff --git a/Magdir/vax b/Magdir/vax index 7dd86ccf53e1..31a35123dd4b 100644 --- a/Magdir/vax +++ b/Magdir/vax @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $ # vax: file(1) magic for VAX executable/object and APL workspace # 0 lelong 0101557 VAX single precision APL workspace diff --git a/Magdir/vicar b/Magdir/vicar index ab216eeea816..59d843d7caf5 100644 --- a/Magdir/vicar +++ b/Magdir/vicar @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ # vicar: file(1) magic for VICAR files. # # From: Ossama Othman <othman@astrosun.tn.cornell.edu diff --git a/Magdir/virtual b/Magdir/virtual new file mode 100644 index 000000000000..ba29c17cb81e --- /dev/null +++ b/Magdir/virtual @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $ +# From: James Nobis <quel@quelrod.net> +# Microsoft hard disk images for: +# Virtual Server +# Virtual PC +# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx +# .vhd +0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC + +# Sun xVM VirtualBox Disk Image +# string <<< Sun xVM VirtualBox Disk Image >>> +# .vdi +0 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image + + diff --git a/Magdir/virtutech b/Magdir/virtutech index cea8443b2e60..410ab9ee4b6c 100644 --- a/Magdir/virtutech +++ b/Magdir/virtutech @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ # Virtutech Compressed Random Access File Format # # From <gustav@virtutech.com> diff --git a/Magdir/visx b/Magdir/visx index 491996426091..fe5c827d947b 100644 --- a/Magdir/visx +++ b/Magdir/visx @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ # visx: file(1) magic for Visx format files # 0 short 0x5555 VISX image file diff --git a/Magdir/vms b/Magdir/vms index c91186f68c3e..d114dfd79e5b 100644 --- a/Magdir/vms +++ b/Magdir/vms @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $ # vms: file(1) magic for VMS executables (experimental) # # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) diff --git a/Magdir/vmware b/Magdir/vmware index 28e19e57a899..b6b6a619b3ee 100644 --- a/Magdir/vmware +++ b/Magdir/vmware @@ -1,5 +1,6 @@ -# ----------------------------------------------------------- +#------------------------------------------------------------------------------ +# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ # VMware specific files (deducted from version 1.1 and log file entries) # Anthon van der Neut (anthon@mnt.org) 0 belong 0x4d52564e VMware nvram diff --git a/Magdir/vorbis b/Magdir/vorbis index cbef5fdff695..ed6c040c3092 100644 --- a/Magdir/vorbis +++ b/Magdir/vorbis @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ # vorbis: file(1) magic for Ogg/Vorbis files # # From Felix von Leitner <leitner@fefe.de> diff --git a/Magdir/vxl b/Magdir/vxl index d3f55619ebb7..0fdc68a7f066 100644 --- a/Magdir/vxl +++ b/Magdir/vxl @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ # VXL: file(1) magic for VXL binary IO data files # # from Ian Scott <scottim@sf.net> diff --git a/Magdir/warc b/Magdir/warc index 968e2679248f..f4ba079a1a9d 100644 --- a/Magdir/warc +++ b/Magdir/warc @@ -1,6 +1,16 @@ #------------------------------------------------------------------------------ +# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ # warc: file(1) magic for WARC files 0 string WARC/ WARC Archive >5 string x version %.4s +!:mime application/warc + +#------------------------------------------------------------------------------ +# Arc File Format from Internet Archive +# see http://www.archive.org/web/researcher/ArcFileFormat.php +0 string filedesc:// Internet Archive File +!:mime application/x-ia-arc +>11 search/256 \x0A \b +>>&0 ubyte >0 \b version %c diff --git a/Magdir/weak b/Magdir/weak index 21324ea494f5..6dc1793c927e 100644 --- a/Magdir/weak +++ b/Magdir/weak @@ -1,3 +1,4 @@ + #------------------------------------------------------------------------------ # weak: file(1) magic for very weak magic entries, disabled by default # diff --git a/Magdir/windows b/Magdir/windows index 8d7680732160..cd760ec767ec 100644 --- a/Magdir/windows +++ b/Magdir/windows @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $ # windows: file(1) magic for Microsoft Windows # # This file is mainly reserved for files where programs diff --git a/Magdir/wireless b/Magdir/wireless index aaae5a58fb67..badb73bb85ff 100644 --- a/Magdir/wireless +++ b/Magdir/wireless @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ # wireless-regdb: file(1) magic for CRDA wireless-regdb file format # 0 string RGDB CRDA wireless regulatory database file diff --git a/Magdir/wordprocessors b/Magdir/wordprocessors index 8965d3387bbb..0ee4723a4299 100644 --- a/Magdir/wordprocessors +++ b/Magdir/wordprocessors @@ -1,4 +1,6 @@ + #------------------------------------------------------------------------------ +# $File: wordprocessors,v 1.15 2010/09/20 19:19:17 rrt Exp $ # wordprocessors: file(1) magic fo word processors. # ####### PWP file format used on Smith Corona Personal Word Processors: @@ -148,3 +150,14 @@ 0 string DOC >43 byte 0x16 Just System Word Processor Ichitaro v6 !:mime application/x-ichitaro6 + +# Type: Freemind mindmap documents +# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> +0 string/w \<map\ version Freemind document +!:mime application/x-freemind + +# Type: Scribus +# From: Werner Fink <werner@suse.de> +0 string \<SCRIBUSUTF8\ Version Scribus Document +0 string \<SCRIBUSUTF8NEW\ Version Scribus Document +!:mime application/x-scribus diff --git a/Magdir/wsdl b/Magdir/wsdl new file mode 100644 index 000000000000..63865bd7e201 --- /dev/null +++ b/Magdir/wsdl @@ -0,0 +1,23 @@ + +#------------------------------------------------------------------------------ +# $File: wsdl,v 1.1 2011/01/19 19:34:50 christos Exp $ +# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php +# Cache format extracted from source: +# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup +# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html +# By Elan Ruusamäe <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 +0 string wsdl PHP WSDL cache, +>4 byte x version 0x%02x +>6 ledate x \b, created %s + +# uri +>10 lelong <0x7fffffff +>>10 pstring/l x \b, uri: "%s" + +# source +>>>&0 lelong <0x7fffffff +>>>>&-4 pstring/l x \b, source: "%s" + +# target_ns +>>>>>&0 lelong <0x7fffffff +>>>>>>&-4 pstring/l x \b, target_ns: "%s" diff --git a/Magdir/xdelta b/Magdir/xdelta index 80c92dac035f..fde1d26e1355 100644 --- a/Magdir/xdelta +++ b/Magdir/xdelta @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ # file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> # 0 string %XDELTA% XDelta binary patch file 0.14 @@ -8,3 +9,5 @@ 0 string %XDZ002% XDelta binary patch file 1.0 0 string %XDZ003% XDelta binary patch file 1.0.4 0 string %XDZ004% XDelta binary patch file 1.1 + +0 string \xD6\xC3\xC4\x00 VCDIFF binary diff diff --git a/Magdir/xenix b/Magdir/xenix index 1acadec62a01..3d238df39fbd 100644 --- a/Magdir/xenix +++ b/Magdir/xenix @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ # xenix: file(1) magic for Microsoft Xenix # # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small diff --git a/Magdir/xilinx b/Magdir/xilinx index 8f411ce21ddf..26efb1baebf3 100644 --- a/Magdir/xilinx +++ b/Magdir/xilinx @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $ # This is Aaron's attempt at a MAGIC file for Xilinx .bit files. # Xilinx-Magic@RevRagnarok.com # Got the info from FPGA-FAQ 0026 diff --git a/Magdir/xo65 b/Magdir/xo65 index 1020cee58c7b..7b38818e090b 100644 --- a/Magdir/xo65 +++ b/Magdir/xo65 @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ # xo65 object files # From: "Ullrich von Bassewitz" <uz@cc65.org> # diff --git a/Magdir/xwindows b/Magdir/xwindows index cae45a780dab..93126fbaa885 100644 --- a/Magdir/xwindows +++ b/Magdir/xwindows @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: xwindows,v 1.7 2011/05/03 01:44:17 christos Exp $ # xwindows: file(1) magic for various X/Window system file formats. # Compiled X Keymap @@ -19,10 +20,10 @@ 0 long 395726 Jaleo XFS file >4 long x - version %ld >8 long x - [%ld - ->20 long x %ldx ->24 long x %ldx ->28 long 1008 YUV422] ->28 long 1000 RGB24] +>20 long x \b%ldx +>24 long x \b%ldx +>28 long 1008 \bYUV422] +>28 long 1000 \bRGB24] # Xcursor data # X11 mouse cursor format defined in libXcursor, see diff --git a/Magdir/zilog b/Magdir/zilog index b746e204f5b9..1c861fb283c9 100644 --- a/Magdir/zilog +++ b/Magdir/zilog @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ # zilog: file(1) magic for Zilog Z8000. # # Was it big-endian or little-endian? My Product Specification doesn't diff --git a/Magdir/zyxel b/Magdir/zyxel index 12a6abd5de8c..d3a43e4878ea 100644 --- a/Magdir/zyxel +++ b/Magdir/zyxel @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ +# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ # zyxel: file(1) magic for ZyXEL modems # # From <rob@pe1chl.ampr.org> |