diff options
Diffstat (limited to 'magic')
53 files changed, 2132 insertions, 441 deletions
diff --git a/magic/Magdir/android b/magic/Magdir/android index a9cfb3575a1b..1265d95925a7 100644 --- a/magic/Magdir/android +++ b/magic/Magdir/android @@ -1,6 +1,6 @@ #------------------------------------------------------------ -# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $ +# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $ # Various android related magic entries #------------------------------------------------------------ @@ -18,8 +18,11 @@ # Android bootimg format # From https://android.googlesource.com/\ # platform/system/core/+/master/mkbootimg/bootimg.h +# https://github.com/djrbliss/loki/blob/master/loki.h#L43 0 string ANDROID! Android bootimg ->1024 string LOKI\01 \b, LOKI'd +>1024 string LOKI \b, LOKI'd +>>1028 lelong 0 \b (boot) +>>1028 lelong 1 \b (recovery) >8 lelong >0 \b, kernel >>12 lelong >0 \b (0x%x) >16 lelong >0 \b, ramdisk @@ -47,7 +50,7 @@ 0 string/b ANDROID\ BACKUP\n Android Backup # maybe look for some more characteristics like linefeed '\n' or version #>16 string \n -# No mime-type defined offically +# No mime-type defined officially !:mime application/x-google-ab !:ext ab # on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) @@ -178,3 +181,10 @@ # RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), # which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 0 lelong 0x00080003 Android binary XML + +# Android cryptfs footer +# From https://android.googlesource.com/\ +# platform/system/vold/+/refs/heads/master/cryptfs.h +0 lelong 0xd0b5b1c4 Android cryptfs footer +>4 leshort x \b, version: %d +>6 leshort x \b.%d diff --git a/magic/Magdir/animation b/magic/Magdir/animation index aaf32dd4c43c..62145b976ede 100644 --- a/magic/Magdir/animation +++ b/magic/Magdir/animation @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $ +# $File: animation,v 1.74 2019/10/29 01:06:20 christos Exp $ # animation: file(1) magic for animation/movie formats # # animation formats @@ -445,52 +445,43 @@ # modified by Joerg Jenderek # GRR the original test are too common for many DOS files # so don't accept as MP3 until we've tested the rate +# But also beat GEMDOS fonts 0 beshort&0xFFFE 0xFFFA # rates ->2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +>2 byte&0xF0 !0 +>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 +!:strength +20 !:mime audio/mpeg +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 40 kbps +>2 byte&0xF0 0x30 \b, 48 kbps +>2 byte&0xF0 0x40 \b, 56 kbps +>2 byte&0xF0 0x50 \b, 64 kbps +>2 byte&0xF0 0x60 \b, 80 kbps +>2 byte&0xF0 0x70 \b, 96 kbps +>2 byte&0xF0 0x80 \b, 112 kbps +>2 byte&0xF0 0x90 \b, 128 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 192 kbps +>2 byte&0xF0 0xC0 \b, 224 kbps +>2 byte&0xF0 0xD0 \b, 256 kbps +>2 byte&0xF0 0xE0 \b, 320 kbps # timing ->2 byte&0x0C 0x00 \b, 44.1 kHz ->2 byte&0x0C 0x04 \b, 48 kHz ->2 byte&0x0C 0x08 \b, 32 kHz +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz # channels/options ->3 byte&0xC0 0x00 \b, Stereo ->3 byte&0xC0 0x40 \b, JntStereo ->3 byte&0xC0 0x80 \b, 2x Monaural ->3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 @@ -887,6 +878,9 @@ # Vivo video (Wolfram Kleff) 3 string \x0D\x0AVersion:Vivo Vivo video data +# ABC (alembic.io 3d models) +0 string 0gawa ABC 3d model + # VRML (Virtual Reality Modelling Language) 0 string/w #VRML\ V1.0\ ascii VRML 1 file !:mime model/vrml @@ -970,8 +964,7 @@ # Extension: .bik # URL: https://wiki.multimedia.cx/index.php?title=Bink_Container # From: <hoehle@users.sourceforge.net> 2008-07-18 -0 string BIK Bink Video ->3 regex =[a-z] rev.%s +0 name bik #>4 ulelong x size %d >20 ulelong x \b, %d >24 ulelong x \bx%d @@ -988,6 +981,14 @@ #>>51 byte&0x10 0 FFT #>>51 byte&0x10 !0 DCT +0 string BIK +>3 regex =[bdfghi] Bink Video rev.%s +>>0 use bik + +0 string KB2 +>3 regex =[adfghi] Bink Video 2 rev.%s +>>0 use bik + # Type: NUT Container # URL: https://wiki.multimedia.cx/index.php?title=NUT # From: Adam Buchbinder <adam.buchbinder@gmail.com> diff --git a/magic/Magdir/apple b/magic/Magdir/apple index 4ac10fc5be92..e0617454cd95 100644 --- a/magic/Magdir/apple +++ b/magic/Magdir/apple @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ +# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @@ -75,33 +75,45 @@ >>>>0xb06 pstring x \b, Volume %s: >>>>0xb0e leshort x \b, %u Blocks >>>>0xb10 leshort x \b, %u Files +# +# Diversi Dos boot loader? +0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD +>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector # Type: Apple Emulator 2IMG format # From: Radek Vokal <rvokal@redhat.com> # Update: Greg Wildman <greg@apple2.org.za> -0 string 2IMG Apple ][ 2IMG Disk Image ->4 clear x ->4 string XGS! \b, XGS ->4 string CTKG \b, Catakig ->4 string ShIm \b, Sheppy's ImageMaker ->4 string SHEP \b, Sheppy's ImageMaker ->4 string WOOF \b, Sweet 16 ->4 string B2TR \b, Bernie ][ the Rescue ->4 string \!nfc \b, ASIMOV2 ->4 string \>BD\< \b, Brutal Deluxe's Cadius ->4 string CdrP \b, CiderPress ->4 string Vi][ \b, Virtual ][ ->4 string PRFS \b, ProFUSE ->4 string FISH \b, FishWings ->4 string RVLW \b, Revival for Windows ->4 default x ->>4 string x \b, Creator tag "%-4.4s" ->0xc byte 00 \b, DOS 3.3 sector order ->>0x10 byte 00 \b, Volume 254 ->>0x10 byte&0x7f x \b, Volume %u ->0xc byte 01 \b, ProDOS sector order ->>0x14 short x \b, %u Blocks ->0xc byte 02 \b, NIB data +0 string 2IMG Apple ][ 2IMG Disk Image +>4 clear x +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string SHEP \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string \!nfc \b, ASIMOV2 +>4 string \>BD\< \b, Brutal Deluxe's Cadius +>4 string CdrP \b, CiderPress +>4 string Vi][ \b, Virtual ][ +>4 string PRFS \b, ProFUSE +>4 string FISH \b, FishWings +>4 string RVLW \b, Revival for Windows +>4 default x +>>4 string x \b, Creator tag "%-4.4s" +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +# Detect Volume Directory block ($02) + 2mg header offset +>>0x440 string \x00\x00\x03\x00 +>>>0x444 byte &0xF0 +>>>>0x445 string x \b, Volume /%s +>>>>0x469 leshort x \b, %u Blocks +>0xc byte 02 \b, NIB data # magic for Newton PDA package formats # from Ruda Moura <ruda@helllabs.org> diff --git a/magic/Magdir/archive b/magic/Magdir/archive index cd0213fa9f3c..6ec5b6d3c389 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $ +# $File: archive,v 1.133 2019/11/15 21:03:14 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -263,7 +263,7 @@ # NL terminated original package length >>>>>&1 string x \b, unsplitted size %s # NL terminated part length ->>>>>>&1 string x \b, part lenght %s +>>>>>>&1 string x \b, part length %s # NL terminated package part like n/m >>>>>>>&1 string x \b, part %s # NL terminated package architecture like armhf since dpkg 1.16.1 or later @@ -439,6 +439,34 @@ # skip keyword with low entropy >12 default x TTComp archive, binary, 4K dictionary # (version 5.25) labeled the above entry as "TTComp archive data" +# From: Joerg Jenderek +# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification +# reference: http://nulib.com/library/FTN.e00005.htm +0x52 ubeshort 0x0100 +# test for disk size equal or above 400k +>0x40 ubelong >409599 Apple DiskCopy 4.2 image +#!:mime application/octet-stream +!:apple dCpydImg +!:ext image/dc42 +# image pascal name padded with NULs like Microsoft Mail +>>00 pstring/B x %s +# data size in bytes like 409600 +>>0x40 ubelong x \b, %u bytes +# tag size in bytes +>>0x44 ubelong >0 \b, 0x%x tag size +# data checksum +#>>0x48 ubelong x \b, 0x%x checksum +# tag checksum +#>>0x4c ubelong x \b, 0x%x tag checksum +# disk encoding +>>0x50 ubyte 0 \b, GCR CLV ssdd (400k) +>>0x50 ubyte 1 \b, GCR CLV dsdd (800k) +>>0x50 ubyte 2 \b, MFM CAV dsdd (720k) +>>0x50 ubyte 3 \b, MFM CAV dshd (1440k) +>>0x50 ubyte >3 \b, 0x%x encoding +# format byte +>>0x51 ubyte x \b, 0x%x format +#>>0x54 ubequad x \b, data 0x%16.16llx # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack @@ -1168,17 +1196,31 @@ >>50 string epub+zip EPUB document !:mime application/epub+zip +# From: Joerg Jenderek +# URL: http://en.wikipedia.org/wiki/CorelDRAW +# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based +>>50 string x-vnd.corel. Corel +>>>62 string draw.document+zip Draw drawing, version 14-16 +!:mime application/x-vnd.corel.draw.document+zip +!:ext cdr +>>>62 string draw.template+zip Draw template, version 14-16 +!:mime application/x-vnd.corel.draw.template+zip +!:ext cdrt +>>>62 string zcf.draw.document+zip Draw drawing, version 17-21 +!:mime application/x-vnd.corel.zcf.draw.document+zip +!:ext cdr +>>>62 string zcf.draw.template+zip Draw template, version 17-21 +!:mime application/x-vnd.corel.zcf.draw.template+zip +!:ext cdt/cdrt + # Catch other ZIP-with-mimetype formats # In a ZIP file, the bytes immediately after a member's contents are # always "PK". The 2 regex rules here print the "mimetype" member's # contents up to the first 'P'. Luckily, most MIME types don't contain # any capital 'P's. This is a kludge. # (mimetype contains "application/<OTHER>") ->>50 string !epub+zip ->>>50 string !vnd.oasis.opendocument. ->>>>50 string !vnd.sun.xml. ->>>>>50 string !vnd.kde. ->>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +>>50 default x Zip data +>>>38 regex [!-OQ-~]+ (MIME type "%s"?) !:mime application/zip # (mimetype contents other than "application/*") >26 string \x8\0\0\0mimetype @@ -1290,6 +1332,10 @@ # Durval Menezes, <jmgthbfile at durval dot com> 0 string d13:announce-list BitTorrent file !:mime application/x-bittorrent +0 string d7:comment BitTorrent file +!:mime application/x-bittorrent +0 string d4:info BitTorrent file +!:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 0 beshort 0x0e0f Atari MSA archive data diff --git a/magic/Magdir/audio b/magic/Magdir/audio index 5492635dfc1d..448f000a38bc 100644 --- a/magic/Magdir/audio +++ b/magic/Magdir/audio @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $ +# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $ # audio: file(1) magic for sound formats (see also "iff") # # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), @@ -139,6 +139,11 @@ 0x2c string SCRM ScreamTracker III Module sound data >0 string >\0 Title: "%s" +!:mime audio/x-s3m + +# .stm before it got above .s3m extension +0x16 string \!Scream\! ScreamTracker Module sound data +>0 string >\0 Title: "%s" # Gravis UltraSound patches # From <ache@nagual.ru> @@ -553,6 +558,8 @@ >21 byte x \b.%u >20 byte x \b.%u +0 string CC2x CheeseCutter 2 song + 0 string RAWADATA RdosPlay RAW 1068 string RoR AMUSIC Adlib Tracker @@ -614,7 +621,13 @@ 1 string [licq] LICQ configuration file # Atari ST audio files by Dirk Jagdmann <doj@cubic.org> -0 string ICE! SNDH Atari ST music +# NOTE: Most SNDH music is packed using ICE, which has +# magic numbers "ICE!" and "Ice!". Some SNDH music is +# not packed, so we check for both packed and unpacked. +12 string SNDH SNDH Atari ST music +0 belong&0xFFDFDFFF 0x49434521 +>14 search/40 NDH SNDH Atari ST music +>14 search/40 TITL SNDH Atari ST music 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music # musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> @@ -743,6 +756,8 @@ >>>>0x78 ubyte 0x03 AY-3-8930, >>>>0x78 ubyte 0x10 YM2149, >>>>0x78 ubyte 0x11 YM3439, +>>>>0x78 ubyte 0x12 YMZ284, +>>>>0x78 ubyte 0x13 YMZ294, # VGM 1.61 >>0x34 ulelong >0x4C >>>0x80 ulelong >0 DMG, @@ -993,17 +1008,27 @@ # Used for audio rips for various consoles. # http://fileformats.archiveteam.org/wiki/Portable_Sound_Format # Added by David Korth <gerbilsoft@gerbilsoft.com> -0 string PSF Portable Sound Format +0 string PSF +>3 byte 0x01 +>3 byte 0x02 +>3 byte 0x11 +>3 byte 0x12 +>3 byte 0x13 +>3 byte 0x21 +>3 byte 0x22 +>3 byte 0x23 +>3 byte 0x41 +>>0 string PSF Portable Sound Format !:mime audio/x-psf ->3 byte 0x01 (Sony PlayStation) ->3 byte 0x02 (Sony PlayStation 2) ->3 byte 0x11 (Sega Saturn) ->3 byte 0x12 (Sega Dreamcast) ->3 byte 0x13 (Sega Mega Drive) ->3 byte 0x21 (Nintendo 64) ->3 byte 0x22 (Game Boy Advance) ->3 byte 0x23 (Super NES) ->3 byte 0x41 (Capcom QSound) +>>>3 byte 0x01 (Sony PlayStation) +>>>3 byte 0x02 (Sony PlayStation 2) +>>>3 byte 0x11 (Sega Saturn) +>>>3 byte 0x12 (Sega Dreamcast) +>>>3 byte 0x13 (Sega Mega Drive) +>>>3 byte 0x21 (Nintendo 64) +>>>3 byte 0x22 (Game Boy Advance) +>>>3 byte 0x23 (Super NES) +>>>3 byte 0x41 (Capcom QSound) # Atari 8-bit SAP audio format # http://asap.sourceforge.net/sap-format.html diff --git a/magic/Magdir/bsi b/magic/Magdir/bsi index 51a62891c2c8..20a17d9c2d0d 100644 --- a/magic/Magdir/bsi +++ b/magic/Magdir/bsi @@ -1,4 +1,4 @@ -# Chiasmus is a encryption standard developed by the German Federal +# Chiasmus is an encryption standard developed by the German Federal # Office for Information Security (Bundesamt fuer Sicherheit in der # Informationstechnik). diff --git a/magic/Magdir/c-lang b/magic/Magdir/c-lang index becf6b02ecca..9356e82ed9e2 100644 --- a/magic/Magdir/c-lang +++ b/magic/Magdir/c-lang @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $ +# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $ # c-lang: file(1) magic for C and related languages programs # # The strength is to beat standard HTML @@ -11,7 +11,7 @@ !:mime text/x-bcpl # C -# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength +# Check for class if include is found, otherwise class is beaten by include because of lowered strength 0 search/8192 #include >0 regex \^#include C >>0 regex \^class[[:space:]]+ diff --git a/magic/Magdir/cad b/magic/Magdir/cad index 48a76d14c976..509cab319844 100644 --- a/magic/Magdir/cad +++ b/magic/Magdir/cad @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $ +# $File: cad,v 1.20 2019/08/10 13:34:17 christos Exp $ # autocad: file(1) magic for cad files # @@ -18,29 +18,162 @@ # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 # https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F -0 string \010\011\376 Microstation ->3 string \002 ->>30 string \026\105 DGNFile ->>30 string \034\105 DGNFile ->>30 string \073\107 DGNFile ->>30 string \073\110 DGNFile ->>30 string \106\107 DGNFile ->>30 string \110\103 DGNFile ->>30 string \120\104 DGNFile ->>30 string \172\104 DGNFile ->>30 string \172\105 DGNFile ->>30 string \172\106 DGNFile ->>30 string \234\106 DGNFile ->>30 string \273\105 DGNFile ->>30 string \306\106 DGNFile ->>30 string \310\104 DGNFile ->>30 string \341\104 DGNFile ->>30 string \372\103 DGNFile ->>30 string \372\104 DGNFile ->>30 string \372\106 DGNFile ->>30 string \376\103 DGNFile ->4 string \030\000\000 CITFile ->4 string \030\000\003 CITFile +# +# URL: https://en.wikipedia.org/wiki/MicroStation +# reference: http://dgnlib.maptools.org/dgn.html +# http://dgnlib.maptools.org/dl/ref18.pdf +# Update: Joerg Jenderek +# Note: verfied by command like `dgndump seed2d_b.dgn` +# test for level 8 and type 5 or 9 +0 beshort&0x3F73 0x0801 +# level of element like 8 +#>0 ubyte&0x3F x \b, level %u +#>0 ubyte &0x80 \b, complex +#>0 ubyte &0x40 \b, reserved +# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements +#>1 ubyte&0x7F x \b, type %u +# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT +#>2 uleshort x \b, words 0x%4.4x to follow +# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) +#>508 ubelong x \b, RESERVED %8.8x +>508 ubelong&0xFFffFF00 =0 +# test for level 8 and type 9 for INGR raster image +>>0 beshort 0x0809 +# test for length of 1st element is multiple of blocks a 512 bytes +>>>2 ubyte 0xfe +>>>>0 use ingr-image +# test for DGN or CEL by jump words (uleshort) forward to next element +>(2.s*2) ulong x +# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT +#>>&1 ubyte&0x7F x \b, 2nd type %u +# DGN +>>&1 ubyte&0x7F 8 +>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing +!:mime application/x-bentley-dgn +!:ext dgn +# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 +>>>>1214 ubyte &0x40 3D +>>>>1214 ubyte ^0x40 2D +# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 +>>>>1120 string x \b, units %-.2s +# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 +>>>>1122 string >\0 %-.2s +#>>>>1120 ubelong x \b, units 0x%8.8x +# element range low,high x y z like xlow=0 08010000h 01080000h +#>>>>4 ubelong !0 \b, xlow %8.8x +#>>>>8 ubelong !0 \b, ylow %8.8x +#>>>>12 ubelong !0 \b, zlow %8.8x +#>>>>16 ubelong !0 \b, xhigh %8.8x +#>>>>20 ubelong !0 \b, yhigh %8.8x +#>>>>24 ubelong !0 \b, zhigh %8.8x +# graphic group number; all other elements in that group have same non-0 number +#>>>>28 leshort x \b, grphgrp 0x%4.4x +# words to optional attribute linkage +#>>>>30 ubyte x \b, attindx \%o +#>>>>31 ubyte x \b\%o +# >>30 string \026\105 DGNFile +# >>30 string \034\105 DGNFile +# >>30 string \073\107 DGNFile +# >>30 string \073\110 DGNFile +# >>30 string \106\107 DGNFile +# >>30 string \110\103 DGNFile +# >>30 string \120\104 DGNFile +# >>30 string \172\104 DGNFile +# >>30 string \172\105 DGNFile +# >>30 string \172\106 DGNFile +# >>30 string \234\106 DGNFile +# >>30 string \273\105 DGNFile +# >>30 string \306\106 DGNFile +# >>30 string \310\104 DGNFile +# >>30 string \341\104 DGNFile +# >>30 string \372\103 DGNFile +# >>30 string \372\104 DGNFile +# >>30 string \372\106 DGNFile +# >>30 string \376\103 DGNFile +# elements properties indicator +#>>>>32 uleshort !0 \b, properties 0x%4.4x +# class 0~Primary +#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x +# Symbology +#>>>>>34 uleshort x \b, Symbology 0x%4.4x +# test for 2nd element type 1~library cell header +>>&1 ubyte&0x7F 1 +# test for 1st element with level 8 and type 5 for cell library +>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library +!:mime application/x-bentley-cel +!:ext cel +# +# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster +# reference: https://web.archive.org/web/20140903185431/ +# http://oreilly.com/www/centers/gff/formats/ingr/index.htm +# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` +# display information for intergraph raster bitmap +0 name ingr-image +# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" +# DataTypeCode indicates format, depth of the pixel data and used compression +>4 uleshort x Intergraph raster image +>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit +!:mime image/x-intergraph-rle +!:ext rel +>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit +!:mime image/x-intergraph-cit +!:ext cit +>>4 uleshort 27 \b, Adaptive RLE RGB +!:mime image/x-intergraph-rgb +!:ext rgb +>>4 default x +>>>4 uleshort x \b, Type %u +!:mime image/x-intergraph +# TODO: +#>4 uleshort 0 \b, no data +# ... +#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) +# ApplicationType: 0~generic raster image 3~drawing, scanning +# 8~I/IMAGE and MicroStation Imager 9~ModelView +>6 uleshort !0 \b, ApplicationType %u +#>6 uleshort x \b, ApplicationType %u +# XViewOrigin; Raster grid data X origin +#>8 ulequad !0 \b, XViewOrigin %llx +# PixelsPerLine is the number of pixels in a scan line of bitmapp +>184 ulelong x \b, %u x +# NumberOfLines is height of the raster data in scanlines +>188 ulelong x %u +# DeviceResolution; resolution of scanning device +# positive indicates number of micros between lines; negative indicates DPI +#>192 leshort x \b, DeviceResolution %d +# ScanlineOrient indicates the origin and the orientation of the scan lines +#>194 ubyte x \b, ScanlineOrient %x +>194 ubyte x \b, orientation +>194 ubyte &0x01 right +>194 ubyte ^0x01 left +>194 ubyte &0x02 down +>194 ubyte ^0x02 top +>194 ubyte &0x04 horizontal +>194 ubyte ^0x04 vertical +# ScannableFlag; Scanline indexing method used +#>195 ubyte !0 \b, ScannableFlag 0x%x +# RotationAngle; Rotation angle of raster data +#>196 ubequad !0 \b, RotationAngle 0x%llx +# SkewAngle; Skew angle of raster data +#>204 ubequad !0 \b, SkewAngle %llx +# DataTypeModifier; Additional raster data format info +#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x +# DesignFile[66]; Name of the design file +>214 string >\0 \b, DesignFile %-.66s +# DatabaseFile[66]; Name of the database file +>280 string >\0 \b, DatabaseFile %-.66s +# ParentGridFile[66]; Name of parent grid file +>346 string >\0 \b, ParentGridFile %-.66s +# FileDescription[80]; Text description of file and contents +>412 string >\0 \b, FileDescription %-.80s +# MinValue +#>492 ubequad !0 \b, MinValue 0x%llx +# MaxValue +#>500 ubequad !0 \b, MaxValue 0x%llx +# Reserved[3]; Unused (always 0) +#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x +# GridFileVersion; Grid File Version like 2 3 +#>511 ubyte x \b, GridFileVersion %x # AutoCAD # Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg @@ -140,12 +273,6 @@ # Phillip Griffith <phillip dot griffith at gmail dot com> # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. # -0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library -0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD -0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD -0 beshort 0x0809 Bentley/Intergraph MicroStation ->0x02 byte 0xfe ->>0x04 beshort 0x1800 CIT raster CAD # 3DS (3d Studio files) 0 leshort 0x4d4d diff --git a/magic/Magdir/commands b/magic/Magdir/commands index 1120c7d06f6b..faa94ae98692 100644 --- a/magic/Magdir/commands +++ b/magic/Magdir/commands @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $ +# $File: commands,v 1.61 2019/10/30 03:16:43 christos Exp $ # commands: file(1) magic for various shells and interpreters # #0 string/w : shell archive or script for antique kernel text @@ -35,6 +35,9 @@ !:mime text/x-shellscript 0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable !:mime text/x-shellscript +0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript + 0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable !:mime text/x-shellscript 0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable diff --git a/magic/Magdir/compress b/magic/Magdir/compress index 7520eb4ab0f1..c700b5a45803 100644 --- a/magic/Magdir/compress +++ b/magic/Magdir/compress @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $ +# $File: compress,v 1.77 2019/10/08 20:25:13 christos Exp $ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. @@ -58,11 +58,11 @@ >>>13 string 09 \b, version 9 # other gzipped binary like gzipped tar, VirtualBox extension package,... >>10 default x gzip compressed data +!:mime application/gzip >>>0 use gzip-info # size of the original (uncompressed) input data modulo 2^32 >>>-4 ulelong x \b, original size modulo 2^32 %u # gzipped TAR or VirtualBox extension package -!:mime application/gzip #!:mime application/x-compressed-tar #!:mime application/x-virtualbox-vbox-extpack # https://www.w3.org/TR/SVG/mimereg.html @@ -308,25 +308,25 @@ # Zstandard compressed data # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 0 lelong 0xFD2FB522 Zstandard compressed data (v0.2) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB523 Zstandard compressed data (v0.3) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB524 Zstandard compressed data (v0.4) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB525 Zstandard compressed data (v0.5) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB526 Zstandard compressed data (v0.6) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB527 Zstandard compressed data (v0.7) -!:mime application/x-zstd +!:mime application/zstd >4 use zstd-dictionary-id 0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) -!:mime application/x-zstd +!:mime application/zstd >4 use zstd-dictionary-id # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 0 lelong 0xEC30A437 Zstandard dictionary -!:mime application/x-zstd-dictionary +!:mime application/x-std-dictionary >4 lelong x (ID %u) # AFX compressed files (Wolfram Kleff) diff --git a/magic/Magdir/console b/magic/Magdir/console index 5e5e5816ecc9..28cc3681d5e7 100644 --- a/magic/Magdir/console +++ b/magic/Magdir/console @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $ +# $File: console,v 1.49 2019/05/27 01:33:32 christos Exp $ # Console game magic # Toby Deshane <hac@shoelace.digivill.net> @@ -508,6 +508,8 @@ #------------------------------------------------------------------------------ # Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 0 string XBEH Microsoft Xbox executable +!:mime audio/x-xbox-executable +!:ext xbe # expect base address of 0x10000 >0x0104 ulelong =0x10000 >>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" @@ -546,25 +548,90 @@ 0 name xbox-360-xex-execution-id >(0.L+0xC) byte x (%c >(0.L+0xD) byte x \b%c ->(0.L+0xE) beshort x \b-%04u) +>(0.L+0xE) beshort x \b-%04u, media ID: +>(0.L) belong x %08X) + +# Region code (part of Security Info) +0 name xbox-360-xex-region-code +>0 ubelong 0xFFFFFFFF \b, all regions +>0 ubelong !0xFFFFFFFF +>>0 ubelong >0 (regions: +>>0 ubelong&0x000000FF 0x000000FF USA +>>0 ubelong&0x00000100 0x00000100 Japan +>>0 ubelong&0x00000200 0x00000200 China +>>0 ubelong&0x0000FC00 0x0000FC00 Asia +>>0 ubelong&0x00FF0000 0x00FF0000 PAL +>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] +>>0 ubelong&0x00FF0000 0x00010000 AU/NZ +>>0 ubelong&0xFF000000 0xFF000000 Other +>>0 ubelong >0 \b) 0 string XEX2 Microsoft Xbox 360 executable +!:mime audio/x-xbox360-executable +!:ext xex >0x18 search/0x100 \x00\x04\x00\x06 >>&0 use xbox-360-xex-execution-id ->(0x010.L+0x178) ubelong 0xFFFFFFFF \b, all regions ->(0x010.L+0x178) ubelong !0xFFFFFFFF ->>(0x010.L+0x178) ubelong >0 (regions: ->>(0x010.L+0x178) ubelong&0x000000FF 0x000000FF USA ->>(0x010.L+0x178) ubelong&0x00000100 0x00000100 Japan ->>(0x010.L+0x178) ubelong&0x00000200 0x00000200 China ->>(0x010.L+0x178) ubelong&0x0000FC00 0x0000FC00 Asia ->>(0x010.L+0x178) ubelong&0x00FF0000 0x00FF0000 PAL ->>(0x010.L+0x178) ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] ->>(0x010.L+0x178) ubelong&0x00FF0000 0x00010000 AU/NZ ->>(0x010.L+0x178) ubelong&0xFF000000 0xFF000000 Other ->>(0x010.L+0x178) ubelong >0 \b) +>(0x010.L+0x178) use xbox-360-xex-region-code + +0 string XEX1 Microsoft Xbox 360 executable (XEX1) +!:mime audio/x-xbox360-executable +!:ext xex +>0x18 search/0x100 \x00\x04\x00\x06 +>>&0 use xbox-360-xex-execution-id +>(0x010.L+0x154) use xbox-360-xex-region-code + +#------------------------------------------------------------------------------ +# Microsoft Xbox 360 packages +# From: David Korth <gerbilsoft@gerbilsoft.com> +# References: +# - https://free60project.github.io/wiki/STFS.html +# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h + +# TODO: More information for console-signed packages. +0 name xbox-360-package +>0x360 byte x (%c +>0x361 byte x \b%c +>0x362 beshort x \b-%04u, media ID: +>0x354 belong x %08X) +>0x344 belong x \b, content type: +>>0x344 belong 0x1 Saved Game +>>0x344 belong 0x2 Marketplace Content +>>0x344 belong 0x3 Publisher +>>0x344 belong 0x1000 Xbox 360 Title +>>0x344 belong 0x2000 IPTV Pause Buffer +>>0x344 belong 0x4000 Installed Game +>>0x344 belong 0x5000 Original Xbox Game +>>0x344 belong 0x9000 Avatar Item +>>0x344 belong 0x10000 Profile +>>0x344 belong 0x20000 Gamer Picture +>>0x344 belong 0x30000 Theme +>>0x344 belong 0x40000 Cache File +>>0x344 belong 0x50000 Storage Download +>>0x344 belong 0x60000 Xbox Saved Game +>>0x344 belong 0x70000 Xbox Download +>>0x344 belong 0x80000 Game Demo +>>0x344 belong 0x90000 Video +>>0x344 belong 0xA0000 Game +>>0x344 belong 0xB0000 Installer +>>0x344 belong 0xC0000 Game Trailer +>>0x344 belong 0xD0000 Arcade Title +>>0x344 belong 0xE0000 XNA +>>0x344 belong 0xF0000 License Store +>>0x344 belong 0x100000 Movie +>>0x344 belong 0x200000 TV +>>0x344 belong 0x300000 Music Video +>>0x344 belong 0x400000 Game Video +>>0x344 belong 0x500000 Podcast Video +>>0x344 belong 0x600000 Viral Video +>>0x344 belong 0x2000000 Community Game +0 string CON\x20 Microsoft Xbox 360 package (console-signed) +>0 use xbox-360-package +0 string PIRS Microsoft Xbox 360 package (non-Xbox Live) +>0 use xbox-360-package +0 string LIVE Microsoft Xbox 360 package (Xbox Live) +>0 use xbox-360-package # Atari Lynx cartridge dump (EXE/BLL header) # From: "Stefan A. Haubenthal" <polluks@web.de> diff --git a/magic/Magdir/database b/magic/Magdir/database index 071a1156485b..9578c0fc3321 100644 --- a/magic/Magdir/database +++ b/magic/Magdir/database @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $ +# $File: database,v 1.56 2019/06/14 20:12:00 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -149,7 +149,6 @@ # updated by Joerg Jenderek at Feb 2013 # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm # https://www.clicketyclick.dk/databases/xbase/format/dbf.html -# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 # skip Infocom game Z-machine @@ -339,7 +338,7 @@ # next free block index is positive >>>0 ulelong >0 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size ->>>>17 ubelong&0xFFfdFE00 0x00000000 +>>>>17 ubelong&0xFFfdFEff 0x00000000 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h >>>>>20 ubelong&0xFF01209B 0x00000000 # dBASE III @@ -355,36 +354,34 @@ >>>>>>>>>6 ubeshort >0 # skip emacs.PIF >>>>>>>>>>4 ushort 0 ->>>>>>>>>>>0 use foxpro-memo-print +# check for valid FoxPro field type +>>>>>>>>>>>512 ubelong <3 +>>>>>>>>>>>>0 use foxpro-memo-print # dBASE III DBT , garbage ->>>>>>>>>6 ubeshort 0 -# skip MM*DD*.bin by test for for reserved NULL byte ->>>>>>>>>>510 ubeshort 0 -# skip TK-DOS11.img image by looking for memo text ->>>>>>>>>>>512 ubelong <0xfeffff03 -# skip EFI executables by looking for memo text ->>>>>>>>>>>>512 ubelong >0x1F202020 ->>>>>>>>>>>>>513 ubyte >0 +# skip WORD1XW.DOC with improbably high free block index +>>>>>>>>>0 lelong <2205083 # unusual dBASE III DBT like adressen.dbt ->>>>>>>>>>>>>>0 use dbase3-memo-print +>>>>>>>>>>0 use dbase3-memo-print # dBASE III DBT like angest.dbt, or garbage PCX DBF >>>>>>>>8 ubelong !0 # skip PCX and some DBF by test for for reserved NULL bytes >>>>>>>>>510 ubeshort 0 -# skip some DBF by test of invalid version ->>>>>>>>>>0 ubyte >5 ->>>>>>>>>>>0 ubyte <48 ->>>>>>>>>>>>0 use dbase3-memo-print +# skip AI070GEP.EPS with improbably high free block index +>>>>>>>>>>0 lelong <458766 +>>>>>>>>>>>0 use dbase3-memo-print # dBASE IV DBT with positive block size >>>>>>>20 uleshort >0 # dBASE IV DBT with valid block length like 512, 1024 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero ->>>>>>>>20 uleshort&0x800f 0 +# skip also 3600h 3E00h size +>>>>>>>>20 uleshort&0xE00f 0 >>>>>>>>>0 use dbase4-memo-print # Print the information of dBase III DBT memo file 0 name dbase3-memo-print >0 ubyte x dBase III DBT +!:mime application/x-dbt +!:ext dbt # instead 3 as version number 0 for unusual examples like biblio.dbt >16 ubyte !3 \b, version number %u # Number of next available block for appending data @@ -395,6 +392,7 @@ >20 uleshort !0 \b, block length %u # dBase III memo field terminated by \032\032 >512 string >\0 \b, 1st item "%s" +# https://www.clicketyclick.dk/databases/xbase/format/dbt.html # Print the information of dBase IV DBT memo file 0 name dbase4-memo-print >0 lelong x dBase IV DBT @@ -433,9 +431,12 @@ # length of memo field >>4 lelong x \b, field length %d >>>8 string >\0 \b, 1st used item "%s" +# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm # Print the information of FoxPro FPT memo file 0 name foxpro-memo-print >0 belong x FoxPro FPT +!:mime application/x-fpt +!:ext fpt # Size of blocks for FoxPro ( 64,256 ) >6 ubeshort x \b, blocks size %u # next available block diff --git a/magic/Magdir/elf b/magic/Magdir/elf index 85eda78a2931..b5a2e00b3726 100644 --- a/magic/Magdir/elf +++ b/magic/Magdir/elf @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $ +# $File: elf,v 1.79 2019/12/16 04:24:01 christos Exp $ # elf: file(1) magic for ELF executables # # We have to check the byte order flag to see what byte order all the @@ -38,7 +38,7 @@ >0 lelong&0x3 2 relaxed memory ordering, 0 name elf-pa-risc ->2 leshort 0x0208 1.0 +>2 leshort 0x020b 1.0 >2 leshort 0x0210 1.1 >2 leshort 0x0214 2.0 >0 leshort &0x0008 (LP64) @@ -50,9 +50,8 @@ !:mime application/x-object >16 leshort 2 executable, !:mime application/x-executable ->16 leshort 3 ${x?pie executable:shared object}, - -!:mime application/x-${x?pie-executable:sharedlib} +>16 leshort 3 shared object, +!:mime application/x-sharedlib >16 leshort 4 core file, !:mime application/x-coredump # OS-specific diff --git a/magic/Magdir/espressif b/magic/Magdir/espressif index 72a0ec9b4f34..7a8616a1a48c 100644 --- a/magic/Magdir/espressif +++ b/magic/Magdir/espressif @@ -1,5 +1,5 @@ -# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $ +# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $ # configuration dump of Tasmota firmware for ESP8266 based devices by Espressif # URL: https://github.com/arendst/Sonoff-Tasmota/ # Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ @@ -8,7 +8,7 @@ # # cfg_holder=4617=0x1209 0 uleshort 4617 -# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e +# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e >0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) !:mime application/x-tasmota-dmp !:ext dmp diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems index 1920e562a67c..b1c8d0bfb3cc 100644 --- a/magic/Magdir/filesystems +++ b/magic/Magdir/filesystems @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ +# $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $ # filesystems: file(1) magic for different filesystems # 0 name partid @@ -2057,10 +2057,6 @@ >0x10040 lelong 2 yura hash >0x10040 lelong 3 r5 hash -# JFFS - russell@coker.com.au -0 lelong 0x34383931 Linux Journalled Flash File system, little endian -0 belong 0x34383931 Linux Journalled Flash File system, big endian - # EST flat binary format (which isn't, but anyway) # From: Mark Brown <broonie@sirena.org.uk> 0 string ESTFBINR EST flat binary @@ -2122,6 +2118,7 @@ >29 byte 23 \bDesignWare ARC, >29 byte 24 \bx86_64, >29 byte 25 \bXtensa, +>29 byte 26 \bRISC-V, >30 byte 0 Invalid Image >30 byte 1 Standalone Program >30 byte 2 OS Kernel Image @@ -2144,55 +2141,48 @@ # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian +0 beshort 0x1984 Linux old jffs2 filesystem data big endian 0 leshort 0x1985 Linux jffs2 filesystem data little endian +0 beshort 0x1985 Linux jffs2 filesystem data big endian # Squashfs -0 string sqsh Squashfs filesystem, big endian, +0 name squashfs >28 beshort x version %d. ->30 beshort x \b%d, +>30 beshort x \b%d, +>20 beshort 0 uncompressed, +>20 beshort 1 zlib +>20 beshort 2 lzma +>20 beshort 3 lzo +>20 beshort 4 xz +>20 beshort 5 lz4 +>20 beshort 6 zstd +>20 beshort >0 compressed, >28 beshort <3 >>8 belong x %d bytes, >28 beshort >2 ->>28 beshort <4 +>>28 beshort <4 >>>63 bequad x %lld bytes, ->>28 beshort >3 +>>28 beshort >3 >>>40 bequad x %lld bytes, #>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort >1 ->>28 beshort <4 +>>28 beshort <4 >>>51 belong x blocksize: %d bytes, ->>28 beshort >3 +>>28 beshort >3 >>>12 belong x blocksize: %d bytes, ->28 beshort <4 +>28 beshort <4 >>39 bedate x created: %s ->28 beshort >3 +>28 beshort >3 >>8 bedate x created: %s + +0 string sqsh Squashfs filesystem, big endian, +>0 use squashfs + 0 string hsqs Squashfs filesystem, little endian, ->28 leshort x version %d. ->30 leshort x \b%d, ->28 leshort <3 ->>8 lelong x %d bytes, ->28 leshort >2 ->>28 leshort <4 ->>>63 lequad x %lld bytes, ->>28 leshort >3 ->>>40 lequad x %lld bytes, -#>>63 lelong x %d bytes, ->4 lelong x %d inodes, ->28 leshort <2 ->>32 leshort x blocksize: %d bytes, ->28 leshort >1 ->>28 leshort <4 ->>>51 lelong x blocksize: %d bytes, ->>28 leshort >3 ->>>12 lelong x blocksize: %d bytes, ->28 leshort <4 ->>39 ledate x created: %s ->28 leshort >3 ->>8 ledate x created: %s +>0 use ^squashfs # AFS Dump Magic # From: Ty Sarna <tsarna@sarna.org> diff --git a/magic/Magdir/fonts b/magic/Magdir/fonts index f47736f4e4f4..b0b40083a5d7 100644 --- a/magic/Magdir/fonts +++ b/magic/Magdir/fonts @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $ +# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $ # fonts: file(1) magic for font data # 0 search/1 FONT ASCII vfont text @@ -133,51 +133,55 @@ # Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt # # usual case with lightening mask and skewing mask 5555h~UU -62 ulelong 0x55555555 ->0 use gdos-font +#62 ulelong 0x55555555 +# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 +#>2 uleshort <73 +#>>0 use gdos-font # BOX18.GFT COWBOY30.GFT ROYALK30.GFT -62 ulelong 0 +#62 ulelong 0 # skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size ->2 uleshort >2 -# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48 ->>2 uleshort <49 -# skip MS Windows ICO ./msdos by looking for valid face name ->>>4 ubeshort >0x1F00 -# skip DOS executable BACKM212.COM by looking for horizontal offset table after header -#>>>>68 ulelong >87 OFFSET_OK ->>>>0 use gdos-font +#>2 uleshort >2 +# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 +#>>2 uleshort <73 +# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE +#>>>4 ulelong >0x001F1f1F +# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data +#>>>>76 ulelong >83 +#>>>>>0 use gdos-font 0 name gdos-font >0 uleshort x GEM GDOS font !:mime application/x-font-gdos # also .eps found like AA070GEP.EPS AI360GEP.EPS !:ext fnt/gtf -# font name like University Bold +# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE >4 string x %.32s -# face size in points 3-48 +# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT >2 uleshort x %u # face ID (must be unique) >0 uleshort x \b, ID 0x%4.4x -# lowest character index in face (usually 32 for disk-loaded fonts). -#>36 uleshort x \b, low character index %u -# width of the widest character +# lowest character index in face (4 but usually 32 for disk-loaded fonts) +#>36 uleshort !32 \b, unusual character index %u +# width of the widest character like 0 8 10 12 16 24 32 #>50 uleshort x \b, %u char width -# width of the widest character cell +# width of the widest character cell like 8 11 12 14 15 16 33 67 #>52 uleshort x \b, %u cell width -# thickening size +# thickening size in pixel like 0 1 2 3 4 5 6 7 8 #>58 uleshort x \b, %u thick # lightening mask to eliminate pixels, usually 5555h >62 uleshort !0x5555 \b, lightening mask 0x%x # skewing mask to determine when to perform additional rotation when skewing, usually 5555h >64 uleshort !0x5555 \b, skewing mask 0x%x -# offset to horizontal offset table 58h~88 5eh -#>68 ulelong >88 \b, 0x%x horizontal table offset -# offset character offset table +# offset to optional horizontal offset table 0 58h~88 5eh 252h +#>68 ulelong x \b, 0x%x horizontal table offset +# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h #>72 ulelong x \b, 0x%x coffset -# offset to font data -#>72 ulelong x \b, 0x%x foffset -# form width in bytes +# offset to font data like 116h 118h 158 20Ah 20Eh +>76 ulelong x \b, 0x%x foffset +# form width in bytes like 58 67 156 190 227 317 345 #>80 uleshort x \b, %u fwidth -# pointer to the next font, set by GDOS after loading +# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 +#>82 uleshort x \b, %u fheight +# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h #>84 ulelong x \b, 0x%x noffset # downloadable fonts for browser (prints type) anthon@mnt.org diff --git a/magic/Magdir/forth b/magic/Magdir/forth new file mode 100644 index 000000000000..cfbcef55482b --- /dev/null +++ b/magic/Magdir/forth @@ -0,0 +1,80 @@ + +#------------------------------------------------------------------------------ +# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $ +# forth: file(1) magic for various Forth environments +# From: Lubomir Rintel <lkundrak@v3.sk> +# + +# Has a FORTH stack diagram and something that looks very much like a FORTH +# multi-line word definition. Probably a FORTH source. +0 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\) +>0 regex \^:\[[:space:]] +>>0 regex \^;$ FORTH program +!:mime text/x-forth + +# Inline word definition complete with a stack diagram +0 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program +!:mime text/x-forth + +# Various dictionary images used by OpenFirware FORTH environent + +0 lelong 0xe1a00000 +>8 lelong 0xe1a00000 ARM OpenFirmware FORTH Dictionary, +>>24 lelong x Text length: %d bytes, +>>28 lelong x Data length: %d bytes, +>>32 lelong x Text Relocation Table length: %d bytes, +>>36 lelong x Data Relocation Table length: %d bytes, +>>40 lelong x Entry Point: 0x%08X, +>>44 lelong x BSS length: %d bytes + +0 string MP +>28 lelong 1 x86 OpenFirmware FORTH Dictionary, +>>4 leshort x %d blocks +>>2 leshort x + %d bytes, +>>6 leshort x %d relocations, +>>8 leshort x Header length: %d paragraphs, +>>10 leshort x Data Size: %d +>>12 leshort x - %d 4K pages, +>>14 lelong x Initial Stack Pointer: 0x%08X, +>>20 lelong x Entry Point: 0x%08X, +>>24 lelong x First Relocation Item: %d, +>>26 lelong x Overlay Number: %d, +>>18 leshort x Checksum: 0x%08X + +0 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary, +>4 belong x Text length: %d bytes, +>8 belong x Data length: %d bytes, +>12 belong x BSS length: %d bytes, +>16 belong x Symbol Table length: %d bytes, +>20 belong x Entry Point: 0x%08X, +>24 belong x Text Relocation Table length: %d bytes, +>28 belong x Data Relocation Table length: %d bytes + +0 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary, +>4 lelong x Text length: %d bytes, +>8 lelong x Data length: %d bytes, +>12 lelong x BSS length: %d bytes, +>16 lelong x Symbol Table length: %d bytes, +>20 lelong x Entry Point: 0x%08X, +>24 lelong x Text Relocation Table length: %d bytes, +>28 lelong x Data Relocation Table length: %d bytes + +# Dictionary images used by minimal C FORTH environments, any platform, +# using native byte order. + +# Weak. +#0 short 0x5820 cForth 16-bit Dictionary, +#>2 short x Serial: 0x%08X, +#>4 short x Dictionary Start: 0x%08X, +#>6 short x Dictionary Size: %d bytes, +#>8 short x User Area Start: 0x%08X, +#>10 short x User Area Size: %d bytes, +#>12 short x Entry Point: 0x%08X + +0 long 0x581120 cForth 32-bit Dictionary, +>4 long x Serial: 0x%08X, +>8 long x Dictionary Start: 0x%08X, +>12 long x Dictionary Size: %d bytes, +>16 long x User Area Start: 0x%08X, +>20 long x User Area Size: %d bytes, +>24 long x Entry Point: 0x%08X diff --git a/magic/Magdir/frame b/magic/Magdir/frame index 08f884d0ea56..c0fd840a46fa 100644 --- a/magic/Magdir/frame +++ b/magic/Magdir/frame @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $ +# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is @@ -18,12 +18,24 @@ >11 string 2.0 (2.0 >11 string 1.0 (1.0 >14 byte x %c) +# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format +# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf +# Update: Joerg Jenderek 2019 Nov 0 string \<MIFFile FrameMaker MIF (ASCII) file -!:mime application/x-mif ->9 string 4.0 (4.0) ->9 string 3.0 (3.0) ->9 string 2.0 (2.0) ->9 string 1.0 (1.x) +# https://www.iana.org/assignments/media-types/application/vnd.mif +!:mime application/vnd.mif +# mif most but also find bookTOC.framemif +!:ext mif/framemif +# followed by space~20h +#>8 ubyte 0x20 \b, space before version +# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ... +>9 string x (%.3s +# if not greater sign then display 4th character of version +>12 ubyte =0x3e \b) +>12 ubyte !0x3e \b%c) +# comment starting with # shows the name+version number of generating program +>13 search/3 # +>>&0 string x "%s" 0 search/1 \<MakerDictionary FrameMaker Dictionary text !:mime application/x-mif >17 string 3.0 (3.0) diff --git a/magic/Magdir/games b/magic/Magdir/games index 30e6159a1746..f5506ae6573d 100644 --- a/magic/Magdir/games +++ b/magic/Magdir/games @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $ +# $File: games,v 1.18 2019/11/10 19:19:58 christos Exp $ # games: file(1) for games # Fabio Bonelli <fabiobonelli@libero.it> @@ -299,3 +299,7 @@ >12 lelong !0 \b, names: %i >28 lelong !0 \b, imports: %i >20 lelong !0 \b, exports: %i + +0 string ESVG +>4 lelong 0x00160000 +>10 string TOC\020 Empire Deluxe for DOS saved game diff --git a/magic/Magdir/gimp b/magic/Magdir/gimp index 516abb25a1fe..e763cbec83a9 100644 --- a/magic/Magdir/gimp +++ b/magic/Magdir/gimp @@ -1,22 +1,33 @@ #------------------------------------------------------------------------------ -# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $ +# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $ # GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) # by Federico Mena <federico@nuclecu.unam.mx> 0 string/t GIMP\ Gradient GIMP gradient data +#!:mime text/plain +!:mime text/x-gimp-ggr +!:ext ggr # GIMP palette (.gpl) # From: Markus Heidelberg <markus.heidelberg@web.de> 0 string/t GIMP\ Palette GIMP palette data +# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html +# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette +#!:mime text/plain +!:mime text/x-gimp-gpl +!:ext gpl #------------------------------------------------------------------------------ # XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed # by Spencer Kimball and Peter Mattis # ('Bucky' LaDieu, nega@vt.edu) +# URL: https://en.wikipedia.org/wiki/XCF_(file_format) +# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt 0 string gimp\ xcf GIMP XCF image data, !:mime image/x-xcf +!:ext xcf >9 string file version 0, >9 string v version >>10 string >\0 %s, @@ -32,8 +43,11 @@ # by Spencer Kimball and Peter Mattis # ('Bucky' LaDieu, nega@vt.edu) +# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern 20 string GPAT GIMP pattern data, >24 string x %s +!:mime image/x-gimp-pat +!:ext pat #------------------------------------------------------------------------------ # XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed @@ -41,7 +55,23 @@ # ('Bucky' LaDieu, nega@vt.edu) 20 string GIMP GIMP brush data +# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush +!:mime image/x-gimp-gbr +# some sources also list gpb +!:ext gbr + +# From: Joerg Jenderek +# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html +# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush +# share\gimp\2.0\brushes\Legacy\confetti.gih +0 search/21/b \040ncells: GIMP animated brush data +!:mime image/x-gimp-gih +!:ext gih # GIMP Curves File # From: "Nelson A. de Oliveira" <naoliv@gmail.com> 0 string #\040GIMP\040Curves\040File GIMP curve file +#!:mime text/plain +!:mime text/x-gimp-curve +!:ext /txt + diff --git a/magic/Magdir/git b/magic/Magdir/git new file mode 100644 index 000000000000..4087fcd8de4b --- /dev/null +++ b/magic/Magdir/git @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $ +# git: file(1) magic for Git objects + +0 string blob\040 +>5 regex [0-9]+ Git blob %s + +0 string tree\040 +>5 regex [0-9]+ Git tree %s + +0 string commit\040 +>7 regex [0-9]+ Git commit %s diff --git a/magic/Magdir/icc b/magic/Magdir/icc index 55583b7b4f26..a8b57864bf0d 100644 --- a/magic/Magdir/icc +++ b/magic/Magdir/icc @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $ +# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $ # icc: file(1) magic for International Color Consortium file formats # @@ -54,7 +54,7 @@ !:mime application/vnd.iccprofile # for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found >>>8 ubyte =2 -# do not use empty message text to a avoid error like +# do not use empty message text to avoid error like # icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type # file.exe: could not find any valid magic files! >>>>9 ubyte !0 \ble diff --git a/magic/Magdir/images b/magic/Magdir/images index 0e314adecb18..08435eeaefe9 100644 --- a/magic/Magdir/images +++ b/magic/Magdir/images @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $ +# $File: images,v 1.171 2019/11/23 16:19:47 christos Exp $ # images: file(1) magic for image formats (see also "iff", and "c-lang" for # XPM bitmaps) # @@ -498,7 +498,31 @@ >12 lelong >0 %d-bit # Magick Image File Format -0 string id=ImageMagick MIFF image data +# URL: https://imagemagick.org/script/miff.php +# Reference: http://fileformats.archiveteam.org/wiki/MIFF +# Update: Joerg Jenderek +# http://www.nationalarchives.gov.uk/pronom/fmt/930 +0 search/256/bc id=imagemagick +# skip bad ASCII text by following new line~0x0A or space~0x20 character +#>&0 ubyte x \b, next character 0x%x +# called by TriD ImageMagick Machine independent File Format bitmap +>&0 ubyte&0xD5 0 MIFF image data +# https://reposcope.com/mimetype/image/miff +#!:mime image/miff +!:mime image/x-miff +!:ext miff/mif +# examples with standard file(1) magic +#>>0 string =id=ImageMagick with standard magic +# examples with unusual file(1) magic like +>>0 string !id=ImageMagick starting with +# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF +>>>0 ubyte =0x7b comment +# skip second character which is often a newline and show comment +>>>>2 string x "%s" +# does not start with comment, probably letters with other case like Id=ImageMagick +# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff +>>>0 ubyte !0x7b +>>>>0 string >\0 '%-.14s' # Artisan 0 long 1123028772 Artisan image data @@ -572,20 +596,115 @@ # PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) # https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ # 28bitmap_information_header.29 +# Note: variant starting direct with DIB header see +# http://fileformats.archiveteam.org/wiki/BMP +# verified by ImageMagick version 6.8.9-8 command `identify *.dib` +0 leshort 40 +# skip bad samples like GAME by looking for valid number of color planes +>12 uleshort 1 Device independent bitmap graphic +!:mime image/bmp +!:apple ????BMPp +!:ext dib +>>4 lelong x \b, %d x +>>8 lelong x %d x +>>14 leshort x %d +# number of color planes (must be 1) +#>>12 uleshort >1 \b, %u color planes +# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D +#>>16 ulelong 3 \b, Huffman 1D compression +>>16 ulelong >0 \b, %u compression +# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps +>>20 ulelong x \b, image size %u +# horizontal and vertical resolution of the image (pixel per metre, signed integer) +>>24 lelong >0 \b, resolution %d x +>>>28 lelong x %d px/m +# number of colors in palette, or 0 to default to 2**n +#>>32 ulelong >0 \b, %u colors +# number of important colors used, or 0 when every color is important +>>36 ulelong >0 \b, %u important colors 0 string BM >14 leshort 12 PC bitmap, OS/2 1.x format !:mime image/x-ms-bmp >>18 leshort x \b, %d x >>20 leshort x %d >14 leshort 64 PC bitmap, OS/2 2.x format -!:mime image/x-ms-bmp ->>18 leshort x \b, %d x ->>20 leshort x %d ->14 leshort 40 PC bitmap, Windows 3.x format -!:mime image/x-ms-bmp +!:mime image/bmp +!:apple ????BMPp +!:ext bmp +# image width and height fields are unsigned integers for OS/2 +>>18 ulelong x \b, %u x +>>22 ulelong x %u +# number of bits per pixel (color depth); found 1 4 8 +>>28 uleshort >1 x %u +# x, y coordinates of the hotspot +>>6 uleshort >0 \b, hotspot %ux +>>>8 uleshort x \b%u +>>26 uleshort >1 \b, %u color planes +# cbSize; size of file or headers +>>2 ulelong x \b, cbSize %u +#>>2 ulelong x \b, cbSize 0x%x +# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh +>>10 ulelong x \b, bits offset %u +#>>10 ulelong x \b, bits offset 0x%x +#>>(10.l) ubequad !0 \b, bits 0x%16.16llx +# BITMAPV2INFOHEADER adds RGB bit masks +>14 leshort 52 PC bitmap, Adobe Photoshop +!:mime image/bmp +!:apple ????BMPp +!:ext bmp >>18 lelong x \b, %d x >>22 lelong x %d x >>28 leshort x %d +# BITMAPV3INFOHEADER adds alpha channel bit mask +>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask +!:mime image/bmp +!:apple ????BMPp +!:ext bmp +>>18 lelong x \b, %d x +>>22 lelong x %d x +>>28 leshort x %d +>14 leshort 40 +# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib +>>(2.l-4) ulong x PC bitmap, Windows 3.x format +!:mime image/bmp +!:apple ????BMPp +>>>18 lelong x \b, %d x +>>>22 lelong x %d +# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS +>>>18 ulequad =0x0000019000000140 x +!:ext bmp/sys +>>>18 ulequad !0x0000019000000140 +# compression method 2~RLE 4-bit/pixel implies also extension rle +>>>>30 ulelong 2 x +!:ext bmp/rle +>>>>30 default x x +!:ext bmp +# number of bits per pixel (color depth); found 1 2 4 8 16 24 32 +>>>28 leshort x %d +# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0 +#>>>6 uleshort >0 \b, hotspot %ux +#>>>>8 uleshort x \b%u +# number of color planes (must be 1), except badplanes.bmp for testing +#>>>26 uleshort >1 \b, %u color planes +# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks +#>>>30 ulelong 3 \b, Huffman 1D compression +>>>30 ulelong >0 \b, %u compression +# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps +>>>34 ulelong >0 \b, image size %u +# horizontal and vertical resolution of the image (pixel per metre, signed integer) +>>>38 lelong >0 \b, resolution %d x +>>>>42 lelong x %d px/m +# number of colors in palette 16 256, or 0 to default to 2**n +#>>>46 ulelong >0 \b, %u colors +# number of important colors used, or 0 when every color is important +>>>50 ulelong >0 \b, %u important colors +# cbSize; often size of file +>>>2 ulelong x \b, cbSize %u +#>>>2 ulelong x \b, cbSize 0x%x +# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h +>>>10 ulelong x \b, bits offset %u +#>>>10 ulelong x \b, bits offset 0x%x +#>>>(10.l) ubequad !0 \b, bits 0x%16.16llxd >14 leshort 124 PC bitmap, Windows 98/2000 and newer format !:mime image/x-ms-bmp >>18 lelong x \b, %d x @@ -601,13 +720,143 @@ >>18 lelong x \b, %d x >>22 lelong x %d x >>28 leshort x %d -# Too simple - MPi -#0 string IC PC icon data +# Update: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon +# Reference: http://www.fileformat.info +# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm +# Note: verified by command like `deark -l -d3 OS2MEMU.ICO` +0 string IC +# skip Lotus smart icon *.smi by looking for valid hotspot coordinates +>6 ulelong&0xFF00FF00 =0 OS/2 icon +# jump 4 bytes before end of header/file and test for accessibility +#>>(2.l-4) ubelong x End of header is OK! +!:mime image/x-os2-ico +!:ext ico +# cbSize; size of header or file in bytes like 1ah 120h 420h +>>2 ulelong x \b, cbSize %u +# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32 +>>6 uleshort x \b, hotspot %ux +>>8 uleshort x \b%u +# offBits; offset in bytes to the beginning of the bit-map pel data like 20h +>>10 ulelong x \b, bits offset %u +#>>(10.l) ubequad x \b, bits 0x%16.16llx #0 string PI PC pointer image data #0 string CI PC color icon data +0 string CI +# test also for valid dib header sizes 12 or 64 +>14 ulelong <65 OS/2 +# test also for valid hotspot coordinates +#>>6 ulelong&0xFE00FE00 =0 OS/2 +!:mime image/x-os2-ico +!:ext ico +>>14 ulelong 12 1.x color icon +# image width and height fields are unsigned integers for OS/2 +>>>18 uleshort x %u x +# stored height = 2 * real height +>>>20 uleshort/2 x %u +# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found +>>>24 uleshort >1 x %u +# color planes; must be 1 +#>>>22 uleshort >1 \b, %u color planes +>>14 ulelong 64 2.x color icon +# image width and height +>>>18 ulelong x %u x +# stored height = 2 * real height +>>>22 ulelong/2 x %u +# number of bits per pixel (color depth). only 1 found +>>>28 uleshort >1 x %u +#>>>26 uleshort >1 \b, %u color planes +# compression method: 0~no 3~Huffman 1D +>>>30 ulelong 3 \b, Huffman 1D compression +#>>>30 ulelong >0 \b, %u compression +# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64 +>>6 uleshort x \b, hotspot %ux +>>8 uleshort x \b%u +# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh +>>2 ulelong x \b, cbSize %u +#>>2 ulelong x \b, cbSize %x +# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h +>>10 ulelong x \b, bits offset %u +#>>10 ulelong x \b, bits offset 0x%x +#>>(10.l) ubequad !0 \b, bits 0x%16.16llx +# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x +#>>14 ulelong x \b, dib header size %u #0 string CP PC color pointer image data +# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer +# Reference: http://www.fileformat.info/format/os2bmp/egff.htm +0 string CP +# skip CPU-Z Report by checking for valid dib header sizes 12 or 64 +>14 ulelong <65 OS/2 +# http://extension.nirsoft.net/PTR +!:mime image/x-ibm-pointer +!:ext ptr +>>14 ulelong 12 1.x color pointer +# image width and height fields are unsigned integers for OS/2 +>>>18 uleshort x %u x +# stored height = 2 * real height +>>>20 uleshort/2 x %u +# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found +>>>24 uleshort >1 x %u +# color planes; must be 1 +#>>>22 uleshort >1 \b, %u color planes +>>14 ulelong 64 2.x color pointer +# image width and height +>>>18 ulelong x %u x +# stored height = 2 * real height +>>>22 ulelong/2 x %u +# number of bits per pixel (color depth). only 1 found +>>>28 uleshort >1 x %u +#>>>26 uleshort >1 \b, %u color planes +# compression method: 0~no 3~Huffman 1D +>>>30 ulelong 3 \b, Huffman 1D compression +#>>>30 ulelong >0 \b, %u compression +# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31 +>>6 uleshort x \b, hotspot %ux +>>8 uleshort x \b%u +# cbSize; size of header or maybe file in bytes like 1Ah 4Eh +>>2 ulelong x \b, cbSize %u +#>>2 ulelong x \b, cbSize %x +# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h +>>10 ulelong x \b, bits offset %u +#>>10 ulelong x \b, bits offset 0x%x +#>>(10.l) ubequad !0 \b, bits 0x%16.16llx +# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x +#>>14 ulelong x \b, dib header size %u # Conflicts with other entries [BABYL] +# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array +# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM" #0 string BA PC bitmap array data +0 string BA +# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size +>2 ulelong <0x004c5942 OS/2 graphic array +!:mime image/x-os2-graphics +#!:apple ????BMPf +# cbSize; size of header like 28h 5Ch +>>2 ulelong x \b, cbSize %u +#>>2 ulelong x \b, cbSize 0x%x +# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h +>>6 ulelong >0 \b, data offset %u +#>>6 ulelong >0 \b, data offset 0x%x +#>>(6.l) ubequad !0 \b, data 0x%16.16llx +# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768 +>>10 uleshort >0 \b, display %u +>>>12 uleshort >0 x %u +# usType of first array element +#>>14 string x \b, usType %2.2s +# 1 space char after "1st" +# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342 +>>14 string BM \b; 1st +!:ext bmp/bga +>>14 string CI \b; 1st +!:ext ico +>>14 string CP \b; 1st +!:ext ico +>>14 string IC \b; 1st +!:ext ico +# no white-black pointer found +#>>14 string PT \b; 1st +#!:ext +>>14 indirect x # XPM icons (Greg Roelofs, newt@uchicago.edu) 0 search/1 /*\ XPM\ */ X pixmap image text @@ -1960,3 +2209,26 @@ 0 string XPR0 Microsoft Xbox XPR0 texture >0x19 byte x \b, format: >>0x19 use xbox-xpr-pixel-format + +# ILDA Image Data Transfer Format +# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf +# +# Updated by Chuck Hein (laser@geekdude.com) +# +0 string ILDA ILDA Image Data Transfer Format +>7 byte 0x00 3D Coordinates with Indexed Color +>7 byte 0x01 2D Coordinates with Indexed Color +>7 byte 0x02 Color Palette +>7 byte 0x04 3D Coordinates with True Color +>7 byte 0x05 2D Coordinates with True Color +>8 string >0 \b, palette %s +>16 string >0 \b, company %s +>24 beshort >0 \b, number of records %d +>>26 beshort x \b, palette number %d +>>28 beshort >0 \b, number of frames %d +>>30 byte >0 \b, projector number %d + +# Dropbox "lepton" compressed jpeg format +# https://github.com/dropbox/lepton +0 belong&0xfffff0ff 0xcf84005a Lepton image file +>2 byte x (version %d) diff --git a/magic/Magdir/javascript b/magic/Magdir/javascript index 8f664533a1fb..7fa9d9d404ca 100644 --- a/magic/Magdir/javascript +++ b/magic/Magdir/javascript @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ +# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $ # javascript: magic for javascript and node.js scripts. # 0 search/1/w #!/bin/node Node.js script text executable @@ -15,3 +15,8 @@ !:mime application/javascript 0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable !:mime application/javascript +# Hermes by Facebook https://hermesengine.dev/ +# https://github.com/facebook/hermes/blob/master/include/hermes/\ +# BCGen/HBC/BytecodeFileFormat.h#L24 +0 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode +>8 lelong x \b, version %d diff --git a/magic/Magdir/kml b/magic/Magdir/kml index dcdf64cf454f..904f3b5d5f13 100644 --- a/magic/Magdir/kml +++ b/magic/Magdir/kml @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $ +# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $ # Type: Google KML, formerly Keyhole Markup Language # Future development of this format has been handed # over to the Open Geospatial Consortium. @@ -8,7 +8,7 @@ # From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 0 string/t \<?xml >20 search/400 \ xmlns= ->>&0 regex ['"]https://earth.google.com/kml Google KML document +>>&0 regex ['"]http://earth.google.com/kml Google KML document !:mime application/vnd.google-earth.kml+xml >>>&1 string 2.0' \b, version 2.0 >>>&1 string 2.1' \b, version 2.1 @@ -20,7 +20,7 @@ # Open Geospatial Consortium. # https://www.opengeospatial.org/standards/kml/ # From: Asbjoern Sloth Toennesen <asbjorn@lila.io> ->>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document +>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document !:mime application/vnd.google-earth.kml+xml >>>&1 string/t 2.2 \b, version 2.2 diff --git a/magic/Magdir/linux b/magic/Magdir/linux index ed7dcd10a251..e2e84348cd9a 100644 --- a/magic/Magdir/linux +++ b/magic/Magdir/linux @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $ +# $File: linux,v 1.68 2019/09/11 21:20:56 christos Exp $ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> @@ -494,3 +494,8 @@ >207 string >\0 \b, version %s >272 string >\0 \b, machine %s >337 string >\0 \b, domain %s + +# Device Tree files +0 search/1024 /dts-v1/ Device Tree File (v1) +# beat c code +!:strength +14 diff --git a/magic/Magdir/macintosh b/magic/Magdir/macintosh index 2a9f7a7b9897..218a844dbefd 100644 --- a/magic/Magdir/macintosh +++ b/magic/Magdir/macintosh @@ -1,13 +1,46 @@ #------------------------------------------------------------------------------ -# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $ +# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $ # macintosh description # # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@yggdrasil.com -11 string must\ be\ converted\ with\ BinHex BinHex binary text +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/BinHex +# Reference: http://fileformats.archiveteam.org/wiki/BinHex +# Note: only tested with version 4.0 and hqx extension +# Any text/binary before the characteristic comment sentence is to be ignored like in +# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx +0 search/1602 (This\ file\ +>&0 use binhex +# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx +0 search/2652/b (This\ file\ +>&0 use binhex +0 name binhex +# keep splitted search string format similar like in version 5.37 +>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version +# http://www.macdisk.com/binhexen.php3 +!:apple BNHQTEXT +# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ +>>&0 string 1.0 1.0 +!:mime application/mac-binhex +!:ext hex +>>&0 string 2.0 2.0 +!:mime application/mac-binhex +!:ext hcx +# BinHex 3.0 never existed +>>&0 string 4.0 4.0 !:mime application/mac-binhex40 ->41 string x \b, version %.3s +!:ext hqx +# BinHex 5.0 also MacBinary I +>>&0 string 5.0 5.0 +!:mime application/mac-binhex40 +!:ext hqx +# this should never happen +>>&0 default x +>>>&0 string x %.3s +!:mime application/mac-binhex +!:ext hqx # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@tuns.ca) diff --git a/magic/Magdir/mail.news b/magic/Magdir/mail.news index c58b3710af28..006fe923a860 100644 --- a/magic/Magdir/mail.news +++ b/magic/Magdir/mail.news @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $ +# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $ # mail.news: file(1) magic for mail and news # # Unfortunately, saved netnews also has From line added in some news software. @@ -26,7 +26,16 @@ !:mime message/rfc822 0 string/t Article saved news text !:mime message/news -0 string/t BABYL Emacs RMAIL text +# Reference: http://quimby.gnus.org/notes/BABYL +# Update: Joerg Jenderek +# Note: used by Rmail in Emacs version 22 and before +# is not text because of characters like Control-L Control-_ +0 string/b BABYL\ OPTIONS: Emacs RMAIL +#0 string/t BABYL Emacs RMAIL text +# https://reposcope.com/mimetype/message/x-gnu-rmail +!:mime message/x-gnu-rmail +# ~/RMAIL +!:ext / 0 string/t Received: RFC 822 mail text !:mime message/rfc822 0 string/t MIME-Version: MIME entity text diff --git a/magic/Magdir/map b/magic/Magdir/map index af5f24ef02b4..460746bab227 100644 --- a/magic/Magdir/map +++ b/magic/Magdir/map @@ -1,7 +1,7 @@ #------------------------------------------------------------------------------ -# $File: map,v 1.7 2019/04/30 04:02:04 christos Exp $ +# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $ # map: file(1) magic for Map data # @@ -316,6 +316,83 @@ # LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh >>0 uleshort x \b, header length 0x%x +# URL: https://www.memotech.franken.de/FileFormats/ +# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf +# From: Joerg Jenderek +0 string KpGr Garmin update +# format version like: 0064h~1.0 +>0x4 uleshort !0x0064 +>>4 uleshort/100 x \b, version %u +>>4 uleshort%100 x \b.%u +# 1st Garmin entry +>6 use garmin-entry +# 2nd Garmin entry +>(0x6.l+10) ubyte x +>>&0 use garmin-entry +# 3rd entry +>(0x6.l+10) ubyte x +>>&(&0.l+4) ubyte x +>>>&0 use garmin-entry +# look again at version to use default clause +>0x4 uleshort x +# test for region content by looking for +# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales" +# 1 space after equal sign +>>0x3a search/5/s GARMIN\ BITMAP \b= +!:mime image/x-garmin-exe +!:ext exe +>>>&0 indirect x +# if not bitmap *.srf then region; 1 space after equal sign +>>0x3a default x \b= +!:mime application/x-garmin-rgn +!:ext rgn +# recursiv embedded +>>>0x3a search/5/s KpGrd +>>>>&0 indirect x +# look for ZIP or JAR archive by ./archive and ./zip +>>>0x3a search/5/s PK\003\004 +>>>>&0 indirect x +# TODO: other garmin RGN record content like foo +#>>0x3a search/5/s bar BAR +# display information of Garmin RGN record +0 name garmin-entry +# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region +#>0 ulelong x \b, length 0x%x +# data record (ID='D') with version content like 0064h~1.0 +>4 ubyte =0x44 +>>5 uleshort !0x0064 \b; Data +>>>5 uleshort/100 x \b, version %u +>>>5 uleshort%100 x \b.%u +# Application Record (ID='A') +>4 ubyte =0x41 \b; App +# version content like 00c8h~2.0 +>>5 uleshort !0x00C8 +>>>5 uleshort/100 x \b, version %u +>>>5 uleshort%100 x \b.%u +# builder name like: SQA sqa build hales +>>7 string x \b, build by %s +# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009 +>>>&1 string x %s +# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01 +>>>>&1 string x %s +# region record (ID='R') +>4 ubyte =0x52 \b; Region +# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP +>>5 uleshort x ID=%u +# delay in ms: like 0, 500 +>>7 ulelong !0 \b, %u ms +# region size (is record length - 10) +#>>11 ulelong x \b, length 0x%x +# region content like: +# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive +#>>15 string x \b, content "%s" +>>15 ubequad x \b, content 0x%llx... +# This does NOT WORK! +#>>15 indirect x \b; contains +>4 default x \b; other +# garmin Record ID Identifies the record content like: D A R +>>4 ubyte x ID '%c' + # TOM TOM GPS watches ttbin files: # https://github.com/ryanbinns/ttwatch/tree/master/ttbin # From: Daniel Lenski diff --git a/magic/Magdir/modulefile b/magic/Magdir/modulefile new file mode 100644 index 000000000000..46c3baf2a0dd --- /dev/null +++ b/magic/Magdir/modulefile @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $ +# modulefile: file(1) magic for user's environment modulefile +# URL: http://modules.sourceforge.net/ +# Reference: https://modules.readthedocs.io/en/stable/modulefile.html +# From: Xavier Delaruelle <xavier.delaruelle@cea.fr> +0 string #%Module modulefile +!:mime text/x-modulefile diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index eda0ddbb0d8e..3013bf9102ac 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $ +# $File: msdos,v 1.134 2019/10/18 15:16:18 christos Exp $ # msdos: file(1) magic for MS-DOS files # @@ -61,28 +61,24 @@ #>>0x18 leshort 0x1c (Borland compiler) #>>0x18 leshort 0x1e (MS compiler) -# If the relocation table is 0x40 or more bytes into the file, it's definitely -# not a DOS EXE. ->0x18 leshort >0x3f - # Maybe it's a PE? ->>(0x3c.l) string PE\0\0 PE +>(0x3c.l) string PE\0\0 PE !:mime application/x-dosexec ->>>(0x3c.l+24) leshort 0x010b \b32 executable ->>>(0x3c.l+24) leshort 0x020b \b32+ executable ->>>(0x3c.l+24) leshort 0x0107 ROM image ->>>(0x3c.l+24) default x Unknown PE signature ->>>>&0 leshort x 0x%x ->>>(0x3c.l+22) leshort&0x2000 >0 (DLL) ->>>(0x3c.l+92) leshort 1 +>>(0x3c.l+24) leshort 0x010b \b32 executable +>>(0x3c.l+24) leshort 0x020b \b32+ executable +>>(0x3c.l+24) leshort 0x0107 ROM image +>>(0x3c.l+24) default x Unknown PE signature +>>>&0 leshort x 0x%x +>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>(0x3c.l+92) leshort 1 # Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the # drivers in Windows/System32/drivers/*.sys. ->>>>(0x3c.l+22) leshort&0x2000 >0 (native) +>>>(0x3c.l+22) leshort&0x2000 >0 (native) !:ext dll/sys ->>>>(0x3c.l+22) leshort&0x2000 0 (native) +>>>(0x3c.l+22) leshort&0x2000 0 (native) !:ext exe/sys ->>>(0x3c.l+92) leshort 2 ->>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) +>>(0x3c.l+92) leshort 2 +>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) # These could probably be at least partially distinguished from one another by # looking for specific exported functions. # CPL: Control Panel item @@ -92,80 +88,95 @@ # AX: DirectShow source filter # IME: Input method editor !:ext dll/cpl/tlb/ocx/acm/ax/ime ->>>>(0x3c.l+22) leshort&0x2000 0 (GUI) +>>>(0x3c.l+22) leshort&0x2000 0 (GUI) # Screen savers typically include code from the scrnsave.lib static library, but # that's not guaranteed. !:ext exe/scr ->>>(0x3c.l+92) leshort 3 ->>>>(0x3c.l+22) leshort&0x2000 >0 (console) +>>(0x3c.l+92) leshort 3 +>>>(0x3c.l+22) leshort&0x2000 >0 (console) !:ext dll/cpl/tlb/ocx/acm/ax/ime ->>>>(0x3c.l+22) leshort&0x2000 0 (console) +>>>(0x3c.l+22) leshort&0x2000 0 (console) !:ext exe/com ->>>(0x3c.l+92) leshort 7 (POSIX) ->>>(0x3c.l+92) leshort 9 (Windows CE) ->>>(0x3c.l+92) leshort 10 (EFI application) ->>>(0x3c.l+92) leshort 11 (EFI boot service driver) ->>>(0x3c.l+92) leshort 12 (EFI runtime driver) ->>>(0x3c.l+92) leshort 13 (EFI ROM) ->>>(0x3c.l+92) leshort 14 (XBOX) ->>>(0x3c.l+92) leshort 15 (Windows boot application) ->>>(0x3c.l+92) default x (Unknown subsystem ->>>>&0 leshort x 0x%x) ->>>(0x3c.l+4) leshort 0x14c Intel 80386 ->>>(0x3c.l+4) leshort 0x166 MIPS R4000 ->>>(0x3c.l+4) leshort 0x168 MIPS R10000 ->>>(0x3c.l+4) leshort 0x184 Alpha ->>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 ->>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 ->>>(0x3c.l+4) leshort 0x1c0 ARM ->>>(0x3c.l+4) leshort 0x1c2 ARM Thumb ->>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb ->>>(0x3c.l+4) leshort 0x1f0 PowerPC ->>>(0x3c.l+4) leshort 0x200 Intel Itanium ->>>(0x3c.l+4) leshort 0x266 MIPS16 ->>>(0x3c.l+4) leshort 0x268 Motorola 68000 ->>>(0x3c.l+4) leshort 0x290 PA-RISC ->>>(0x3c.l+4) leshort 0x366 MIPSIV ->>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU ->>>(0x3c.l+4) leshort 0xebc EFI byte code ->>>(0x3c.l+4) leshort 0x8664 x86-64 ->>>(0x3c.l+4) leshort 0xc0ee MSIL ->>>(0x3c.l+4) default x Unknown processor type ->>>>&0 leshort x 0x%x ->>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) ->>>(0x3c.l+22) leshort&0x1000 >0 system file ->>>(0x3c.l+24) leshort 0x010b ->>>>(0x3c.l+232) lelong >0 Mono/.Net assembly ->>>(0x3c.l+24) leshort 0x020b ->>>>(0x3c.l+248) lelong >0 Mono/.Net assembly +# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format +>>(0x3c.l+92) leshort 7 (POSIX) +>>(0x3c.l+92) leshort 9 (Windows CE) +>>(0x3c.l+92) leshort 10 (EFI application) +>>(0x3c.l+92) leshort 11 (EFI boot service driver) +>>(0x3c.l+92) leshort 12 (EFI runtime driver) +>>(0x3c.l+92) leshort 13 (EFI ROM) +>>(0x3c.l+92) leshort 14 (XBOX) +>>(0x3c.l+92) leshort 15 (Windows boot application) +>>(0x3c.l+92) default x (Unknown subsystem +>>>&0 leshort x 0x%x) +>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>(0x3c.l+4) leshort 0x168 MIPS R10000 +>>(0x3c.l+4) leshort 0x184 Alpha +>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 +>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP +>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 +>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 +>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 +>>(0x3c.l+4) leshort 0x1c0 ARM +>>(0x3c.l+4) leshort 0x1c2 ARM Thumb +>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb +>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 +>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU +>>(0x3c.l+4) leshort 0x200 Intel Itanium +>>(0x3c.l+4) leshort 0x266 MIPS16 +>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>(0x3c.l+4) leshort 0x290 PA-RISC +>>(0x3c.l+4) leshort 0x366 MIPSIV +>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU +>>(0x3c.l+4) leshort 0xebc EFI byte code +>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit +>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit +>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit +>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R +>>(0x3c.l+4) leshort 0x8664 x86-64 +>>(0x3c.l+4) leshort 0xaa64 Aarch64 +>>(0x3c.l+4) leshort 0xc0ee MSIL +>>(0x3c.l+4) default x Unknown processor type +>>>&0 leshort x 0x%x +>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) +>>(0x3c.l+22) leshort&0x1000 >0 system file +>>(0x3c.l+24) leshort 0x010b +>>>(0x3c.l+232) lelong >0 Mono/.Net assembly +>>(0x3c.l+24) leshort 0x020b +>>>(0x3c.l+248) lelong >0 Mono/.Net assembly # hooray, there's a DOS extender using the PE format, with a valid PE # executable inside (which just prints a message and exits if run in win) ->>>(8.s*16) string 32STUB \b, 32rtm DOS extender ->>>(8.s*16) string !32STUB \b, for MS Windows ->>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed ->>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed ->>>(0x3c.l+0xf8) search/0x140 UPX2 ->>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) ->>>(0x3c.l+0xf8) search/0x140 .idata ->>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) ->>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive ->>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive ->>>(0x3c.l+0xf8) search/0x140 .rsrc ->>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive ->>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive ->>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive ->>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive ->>>(0x3c.l+0xf8) search/0x140 .data ->>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive ->>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed ->>>>(0x3c.l+0xf7) byte x ->>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive ->>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive ->>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive ->>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) ->>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive ->>>0x30 string Inno \b, InnoSetup self-extracting archive +>>(8.s*16) string 32STUB \b, 32rtm DOS extender +>>(8.s*16) string !32STUB \b, for MS Windows +>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed +>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed +>>(0x3c.l+0xf8) search/0x140 UPX2 +>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>(0x3c.l+0xf8) search/0x140 .idata +>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive +>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive +>>(0x3c.l+0xf8) search/0x140 .rsrc +>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive +>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive +>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive +>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive +>>(0x3c.l+0xf8) search/0x140 .data +>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive +>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed +>>>(0x3c.l+0xf7) byte x +>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive +>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive +>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive +>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) +>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive +>>0x30 string Inno \b, InnoSetup self-extracting archive + +# If the relocation table is 0x40 or more bytes into the file, it's definitely +# not a DOS EXE. +>0x18 leshort >0x3f # Hmm, not a PE but the relocation table is too high for a traditional DOS exe, # must be one of the unusual subformats. @@ -647,16 +658,84 @@ >30 byte 12 (4kB sectors) # Popular applications -2080 string Microsoft\ Word\ 6.0\ Document %s -!:mime application/msword -2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data -!:mime application/msword -# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) -2112 string MSWordDoc Microsoft Word document data -!:mime application/msword # -0 belong 0x31be0000 Microsoft Word Document +# Update: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/DOC +# Reference: https://web.archive.org/web/20170206041048/ +# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 +# wIdent+dty +0 belong 0x31be0000 +# skip droid skeleton like x-fmt-274-signature-id-488.doc +>128 ubyte >0 Microsoft +>>96 uleshort =0 Word !:mime application/msword +!:apple MSWDWDBN +# DCX is used in the Unix version. +!:ext doc/dcx +>>>0x6E ulequad =0 1.0-4.0 +>>>0x6E ulequad !0 5.0-6.0 +>>>0x6E ulequad x (DOS) Document +# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt +>>96 uleshort !0 Write 3.0 (Windows) Document +!:mime application/x-mswrite +!:apple MSWDWDBN +# sometimes also doc like in splitter.doc srchtest.doc +!:ext wri/doc +# wTool must be 0125400 octal +#>>4 uleshort !0xAB00 \b, wTool %o +# reserved; must be zero +#>>6 ulelong !0 \b, reserved %u +# block pointer to the block containing optional file manager information +#>>0x1C uleshort x \b, at 0x%x info block +# jump to File manager information block +>>(0x1C.s*128) uleshort x +# test for valid information start; maybe also 0012h +>>>&-2 uleshort =0x0014 +# Document ASCIIZ name +>>>>&0x12 string x %s +# author name +>>>>>&1 string x \b, author %s +# reviser name +>>>>>>&1 string x \b, reviser %s +# keywords +>>>>>>>&1 string x \b, keywords %s +# comment +>>>>>>>>&1 string x \b, comment %s +# version number +>>>>>>>>>&1 string x \b, version %s +# date of last change MM/DD/YY +>>>>>>>>>>&1 string x \b, %-.8s +# creation date MM/DD/YY +>>>>>>>>>>&9 string x created %-.8s +# file name of print format like NORMAL.STY +>>0x1E string >0 \b, formatted by %-.66s +# count of pages in whole file for write variant; maybe some times wrong +>>96 uleshort >0 \b, %u pages +# name of the printer driver like HPLASMS +>>0x62 string >0 \b, %-.8s printer +# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 +>>0x6A uleshort >0 \b, %u blocks +# bit field for corrected text areas +#>>0x6C uleshort x \b, 0x%x bit field +# text of document; some times start with 4 non printable characters like CR LF +>>128 ubyte x \b, +>>>128 ubyte >0x1F +>>>>128 string x %s +>>>128 ubyte <0x20 +>>>>129 ubyte >0x1F +>>>>>129 string x %s +>>>>129 ubyte <0x20 +>>>>>130 ubyte >0x1F +>>>>>>130 string x %s +>>>>>130 ubyte <0x20 +>>>>>>131 ubyte >0x1F +>>>>>>>131 string x %s +>>>>>>131 ubyte <0x20 +>>>>>>>132 ubyte >0x1F +>>>>>>>>132 string x %s +>>>>>>>132 ubyte <0x20 +>>>>>>>>133 ubyte >0x1F +>>>>>>>>>133 string x %s # 0 string/b PO^Q` Microsoft Word 6.0 Document !:mime application/msword @@ -686,23 +765,15 @@ 0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document !:mime application/msword # -2080 string Microsoft\ Excel\ 5.0\ Worksheet %s -!:mime application/vnd.ms-excel -# 0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document !:mime application/msword -2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s -!:mime application/vnd.ms-excel # -# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) -2114 string Biff5 Microsoft Excel 5.0 Worksheet -!:mime application/vnd.ms-excel -# Italian MS-Excel -2121 string Biff5 Microsoft Excel 5.0 Worksheet -!:mime application/vnd.ms-excel 0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet !:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php +!:apple XCELXLS4 +!:ext xls # # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 @@ -901,10 +972,6 @@ # windows zips files .dmf 0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file - -#ico files -0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows - # Windows icons # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/CUR_(file_format) @@ -1397,9 +1464,6 @@ 0 string/b \224\246\056 Microsoft Word Document !:mime application/msword -512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document -!:mime application/msword - # From: "Nelson A. de Oliveira" <naoliv@gmail.com> # Magic type for Dell's BIOS .hdr files # Dell's .hdr diff --git a/magic/Magdir/msooxml b/magic/Magdir/msooxml index 194cf53fe249..620d5e132f04 100644 --- a/magic/Magdir/msooxml +++ b/magic/Magdir/msooxml @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: msooxml,v 1.12 2019/04/19 00:42:27 christos Exp $ +# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $ # msooxml: file(1) magic for Microsoft Office XML # From: Ralf Brown <ralf.brown@gmail.com> @@ -19,6 +19,8 @@ !:mime application/vnd.openxmlformats-officedocument.presentationml.presentation >0 string xl/ Microsoft Excel 2007+ !:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet +0 string visio/ Microsoft Visio 2013+ +!:mime application/vnd.ms-visio.drawing.main+xml # start by checking for ZIP local file header signature 0 string PK\003\004 diff --git a/magic/Magdir/ole2compounddocs b/magic/Magdir/ole2compounddocs index f4046cc97fc0..a59b023f4f54 100644 --- a/magic/Magdir/ole2compounddocs +++ b/magic/Magdir/ole2compounddocs @@ -1,33 +1,471 @@ #------------------------------------------------------------------------------ -# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $ +# $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $ # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) # Additional tests for OLE 2 Compound Documents should be under this recipe. +# reference: https://www.openoffice.org/sc/compdocfileformat.pdf -0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document +0 string \320\317\021\340\241\261\032\341 +# https://digital-preservation.github.io/droid/ +# skip droid skeleton like fmt-39-signature-id-128.doc by valid version +>0x1A ushort !0xABAB OLE 2 Compound Document +#>0x1C uleshort x \b, endnian 0x%4.4x +# big endian not tested +>>0x1C ubeshort =0xfffe \b, big-endian +>>>546 string jbjb : Microsoft Word Document +!:mime application/msword +!:apple MSWDWDBN +!:ext doc +# Byte Order 0xFFFE means little-endian found in real world applications +#>>0x1C uleshort =0xfffe \b, little-endian +>>0x1C uleshort =0xfffe +# From: Joerg Jenderek +# Major Version 3 or 4 +>>>0x1A uleshort x \b, v%u +# Minor Version 32h=50 3Bh=59 3Eh=62 +>>>0x18 uleshort x \b.%u +# SecID of first sector of the directory stream is often 1 but high like 3144h +>>>48 ulelong x \b, SecID 0x%x +# pointer to root entry only works with standard configuration for SecID ~< 800h +# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls +# "ORLEN Factbook 2017.xls" XnView_metadata.doc +# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized +>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB +# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 +>>>0x1E uleshort 0xc \b, blocksize 4096 +# jump to one block (4096 bytes per block) before root storage block +>>>>(48.l*4096) ubyte x +>>>>>&4095 use ole2-directory +#>>>0x1E uleshort 9 \b, blocksize 512 +>>>0x1E uleshort 9 +# jump to one block (512 bytes per block) before root storage block +# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h +>>>>(48.l*512) ubyte x +>>>>>&511 use ole2-directory +# check directory entry structure and display types by GUID +0 name ole2-directory +# directory entry name like "Root Entry" +#>0 lestring16 x \b, 1st %.10s +# type of the entry; 5~Root storage +#>66 ubyte x \b, type %x +# node colour of the entry: 00H ~ Red 01H ~ Black +#>67 ubyte x \b, color %x +# the DirIDs of the child nodes. Should both be –1 in the root storage entry +#>68 bequad !0xffffffffffffffff \b, DirIDs %llx +# second directory entry name like VisioDocument Control000 +#>128 lestring16 x \b, 2nd %.20s +# third directory entry like WordDocument +#>256 lestring16 x \b, 3rd %.20s +# forth +#>384 lestring16 x \b, 4th %.10s +# 5th +#>512 lestring16 x \b, 5th %.10s +# 6th +#>640 lestring16 x \b, 6th %.10s +# 7th +#>768 lestring16 x \b, 7th %.10s +# https://wikileaks.org/ciav7p1/cms/page_13762814.html +# https://m.blog.naver.com/superman4u/40047693679 +# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt +# http://www.windowstricks.in/online-windows-guid-converter +#>80 ubequad !0 \b, clsid 0x%16.16llx +#>>88 ubequad x \b%16.16llx +# test for "Root Entry" inside directory by type 5 value +>66 ubyte 5 +# look for CLSID GUID 0 +>>88 ubequad 0x0 +>>>80 ubequad 0x0 # - Microstation V8 DGN files (www.bentley.com) +# URL: https://en.wikipedia.org/wiki/MicroStation # Last update on 10/23/2006 by Lester Hightower -> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN +# 07/24/2019 by Joerg Jenderek +# Second directory entry name like Dgn~H Dgn~S +>>>>128 lestring16 Dgn~ : Microstation V8 CAD +#!:mime application/x-ole-storage +!:mime application/x-bentley-dgn +# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn +!:ext dgn +# +# URL: http://fileformats.archiveteam.org/wiki/WordPerfect +# Second directory entry name PerfectOffice_ +>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic +!:mime application/vnd.wordperfect +# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd +!:apple ????WPC7 +!:ext mst/wpd/wpg +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +# Second directory entry name MatOST_ +>>>>128 lestring16 MatOST : Microsoft Works 3.0 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet +# 3rd directory entry name WksSSWorkBook +>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet +!:mime application/vnd.ms-works +!:apple ????AWSS +!:ext xlr +# +# URL: http://fileformats.archiveteam.org/wiki/XLS +# what is the difference to {00020820-0000-0000-c000-000000000046} ? +# Second directory entry name Workbook +>>>>128 lestring16 Workbook +>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 +!:apple ????XLS9 +!:ext xls +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +# Second directory entry name Object1 Object12 Object35 +>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt +# +# URL: https://www.msoutlook.info/question/164 +# Second directory entry name __CollDataStm +>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-srs +# %APPDATA%\Microsoft\Outlook\Outlook.srs +!:ext srs +# +# URL: https://www.file-extensions.org/cag-file-extension +# Second directory entry name Category +>>>>128 lestring16 Category : Microsoft Clip Art Gallery +#!:mime application/x-ole-storage +!:mime application/x-ms-cag +!:apple MScgCGdb +!:ext cag/ +# +# URL: https://www.filesuffix.com/de/extension/rra +# 3rd directory entry name StrIndex_StringTable +>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer +#!:mime application/x-ole-storage +!:mime application/x-ms-rra +!:ext rra +# +# URL: https://www.forensicswiki.org/wiki/Jump_Lists +# 3rd directory entry name DestList +>>>>256 lestring16 DestList : Windows jump list +#!:mime application/x-ole-storage +!:mime application/x-ms-jumplist +# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms +!:ext automaticDestinations-ms +# +# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache +# Second directory entry name 256_ +>>>>128 lestring16 256_ : Windows thumbnail database 256 +#!:mime application/x-ole-storage +!:mime application/x-ms-thumbnail +# Thumbs.db +!:ext db +>>>>128 lestring16 96_ : Windows thumbnail database 96 +!:mime application/x-ms-thumbnail +!:ext db +# 3rd directory entry name Catalog_ +>>>>256 lestring16 Catalog : Windows thumbnail database +!:mime application/x-ms-thumbnail +!:ext db +# +# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches +# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based +# Second directory entry name Control000 +>>>>128 lestring16 Control000 : Microsoft old Systeminfo +#!:mime application/x-ole-storage +!:mime application/x-ms-info +!:ext nfo +# +# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House +# Second directory entry name Thumbnail +>>>>128 lestring16 Thumbnail : Corel PrintHouse image +#!:mime application/x-ole-storage +!:mime application/x-corel-cph +!:ext cph +# 3rd directory entry name Thumbnail +>>>>256 lestring16 Thumbnail : Corel PrintHouse image +!:mime application/x-corel-cph +!:ext cph +# +# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) +# Note: "HWP Document File" signature found in FileHeader +# Second directory entry name FileHeader hint for Thinkfree Office document +>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File +#!:mime application/haansofthwp +!:mime application/x-hwp +# https://example-files.online-convert.com/document/hwp/example.hwp +!:ext hwp +# +# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ +# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 +>>>>128 lestring16 dd2 : StarOffice Gallery view +#!:mime application/x-ole-storage +!:mime application/x-star-sdv +!:ext sdv +# remaining null clsid +>>>>128 default x : UNKNOWN +!:mime application/x-ole-storage +# look for known clsid GUID # - Visio documents -# Last update on 10/23/2006 by Lester Hightower -> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document - -# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017 -# Update: Joerg Jenderek -# from https://filext.com by Derek M Jones <derek@knosof.co.uk> -# False positive with PPT (also currently this string is too long) -#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer -#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document -#>48 byte 0x1B Excel Document -#!:mime application/vnd.ms-excel ->546 string bjbj : Microsoft Word Document +# URL: http://fileformats.archiveteam.org/wiki/Visio +# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek +>>88 ubequad 0xc000000000000046 : Microsoft +>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template +!:mime application/vnd.visio +# VSD~Drawing VSS~Stencil VST~Template +!:ext vsd/vss/vst +>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template +!:mime application/vnd.visio +!:ext vsd/vss/vst +# +# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer +>>>80 ubequad 0x84100c0000000000 Windows Installer Package +!:mime application/x-msi +#!:mime application/x-ms-win-installer +!:ext msi +>>>80 ubequad 0x86100c0000000000 Windows Installer Patch +# ?? +!:mime application/x-wine-extension-msp +#!:mime application/x-ms-msp +!:ext msp +# +# URL: http://fileformats.archiveteam.org/wiki/DOC +>>>80 ubequad 0x0009020000000000 Word 6-95 document or template !:mime application/msword -# https://www.macdisk.com/macsigen.php +# for template MSWDW8TN !:apple MSWDWDBN !:ext doc/dot ->546 string jbjb : Microsoft Word Document +>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template !:mime application/msword !:apple MSWDWDBN -!:ext doc +# dot for template; no extension on Macintosh +!:ext doc/dot/ +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0x0213020000000000 Works 3-4 document or template +!:mime application/vnd.ms-works +!:apple ????AWWP +# ps for template https://filext.com/file-extension/PS bps for backup +!:ext wps/ps/bps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database +>>>80 ubequad 0x0313020000000000 Works 3-4 database or template +!:mime application/vnd.ms-works-db +# https://www.macdisk.com/macsigen.php +!:apple ????AWDB +# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup +!:ext wdb/db/bdb +# +# URL: https://en.wikipedia.org/wiki/Microsoft_Excel +>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php +!:apple ????XLS5 +# worksheet/addin/template/no extension on Macintosh +!:ext xls/xla/xlt/ +# +>>>80 ubequad 0x2008020000000000 Excel 97-2003 +!:mime application/vnd.ms-excel +# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 +!:apple ????XLS9 +# 3nd directory entry name +>>>>256 lestring16 _VBA_PROJECT_CUR addin +!:ext xla/ +# 4th directory entry name +>>>>384 lestring16 _VBA_PROJECT_CUR addin +!:ext xla +#!:ext xla/ +>>>>256 default x worksheet or template +!:ext xls/xlt +#!:ext xls/xlt/ +# +# URL: http://fileformats.archiveteam.org/wiki/OLE2 +>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item +#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-msg +!:ext msg +# URL: https://wiki.fileformat.com/email/oft/ +>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template +#!:mime application/vnd.ms-outlook +!:mime application/x-ms-oft +!:ext oft +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt +#?? +# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ +>>88 ubequad 0xa29a00aa004a1a72 : Microsoft +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +# +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database +>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database +!:mime application/vnd.ms-works-db +!:apple ????AWDB +!:ext wdb/bdb +#?? +>>88 ubequad 0xa40700c04fb932ba : Microsoft +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document +!:mime application/vnd.ms-works +!:apple ????AWWP +!:ext wps +#?? +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher +>>88 ubequad 0x00c0000000000046 : Microsoft +>>>80 ubequad 0x0112020000000000 Publisher +!:mime application/vnd.ms-publisher +!:ext pub +# +# URL: http://fileformats.archiveteam.org/wiki/PPT +#?? +>>88 ubequad 0xa90300aa00510ea3 : Microsoft +>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation +!:mime application/vnd.ms-powerpoint +# https://www.macdisk.com/macsigen.php +!:apple ????PPT3 +!:ext ppt/pot +#?? +>>88 ubequad 0x86ea00aa00b929e8 : Microsoft +>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template +!:mime application/vnd.ms-powerpoint +!:apple ????PPT3 +# /autostart/template +!:ext ppt/pps/pot +# +# URL: https://en.wikipedia.org/wiki/Microsoft_Project +#?? +>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft +>>>80 ubequad 0x3a8fb774c8c8d111 Project +!:mime application/vnd.ms-project +!:ext mpp +# +# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) +#??? +>>88 ubequad 0x99ae04021c007002 : WordPerfect +>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation +!:mime application/x-corelpresentations +#!:mime application/x-shw-viewer +#!:mime image/x-presentations +!:ext shw +# +# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ +>>>80 ubequad 0x60fe2e4099191b10 9 Graphic +#!:mime application/x-wpg +#!:mime image/x-wordperfect-graphics +!:mime image/x-wpg +# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd +!:apple ????WPC9 +!:ext wpg +# +# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats +>>88 ubequad 0x996104021c007002 : StarOffice +>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template +# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html +!:mime application/x-starwriter +!:ext sdw/vor +# +>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template +!:mime application/x-starcalc +!:ext sdc/vor +# +>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template +!:mime application/x-starimpress +#!:mime application/x-stardraw +# sda ?? +!:ext sdd/sda/vor +#?? +>>88 ubequad 0x89cb008029e4b0b1 : StarOffice +>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template +!:mime application/x-starcalc +!:ext sdc/vor +# +>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template +!:mime application/vnd.stardivision.cal +!:ext sdc/vor +# +>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template +!:mime application/x-starimpress +!:ext sdd/vor +#?? +>>88 ubequad 0xb12a04021c007002 : StarOffice +>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 +!:mime application/x-starmath +!:ext smf +#?? +>>88 ubequad 0x8e2c00001b4cc711 : StarOffice +>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 +!:mime application/x-starchart +!:ext sds +#?? +>>88 ubequad 0xa45e00a0249d57b1 : StarOffice +>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template +!:mime application/x-starwriter +!:ext sdw/vor +#?? +>>88 ubequad 0x89ca008029e4b0b1 : StarOffice +>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 +!:mime application/x-starmath +!:ext smf +# +>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 +!:mime application/x-starchart +!:ext sds +#?? +>>88 ubequad 0xa53f00a0249d57b1 : StarOffice +>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document +!:mime application/x-starwriter-global +!:ext sgl +#?? +>>88 ubequad 0x89d0008029e4b0b1 : StarOffice +>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 +!:mime application/vnd.stardivision.math +!:ext smf +# +>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template +!:mime application/vnd.stardivision.draw +!:ext sda/vor +# +>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template +!:mime application/vnd.stardivision.impress +# sda is used for what? +!:ext sdd/vor/sda +# +>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 +!:mime application/vnd.stardivision.chart +!:ext sds +# ?? +>>88 ubequad 0xaab4006097da561a : StarOffice +>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template +!:mime application/vnd.stardivision.writer +!:ext sdw/vor +# +>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document +!:mime application/vnd.stardivision.writer-global +!:ext sgl +#?? +# URL: http://fileformats.archiveteam.org/wiki/FlashPix +>>88 ubequad 0x855300aa00a1f95b : Kodak +>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image +!:mime image/vnd.fpx +!:apple ????FPix +!:ext fpx +# remaining non null clsid +>>88 default x : UNKNOWN +!:mime application/x-ole-storage +>>>80 ubequad !0 \b, clsid 0x%16.16llx +>>>88 ubequad x \b%16.16llx diff --git a/magic/Magdir/openfst b/magic/Magdir/openfst new file mode 100644 index 000000000000..8df9b56b85e8 --- /dev/null +++ b/magic/Magdir/openfst @@ -0,0 +1,17 @@ + +#------------------------------------------------------------------------------ +# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $ +# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library) + +0 long 0x7eb2fdd6 OpenFst binary FST data +>&0 pstring/l x \b, fst type: %s +>>&0 pstring/l x \b, arc type: %s +>>>&0 long x \b, version: %d +>>>>&20 quad x \b, num states: %lld +>>>>>&0 quad >0 \b, num arcs: %lld + +0 long 0x56515c OpenFst binary FAR data, far type: stlist +>4 long x \b, version: %d + +0 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable +>4 long x \b, version: %d diff --git a/magic/Magdir/opentimestamps b/magic/Magdir/opentimestamps new file mode 100644 index 000000000000..f2f0e3ec1109 --- /dev/null +++ b/magic/Magdir/opentimestamps @@ -0,0 +1,16 @@ + +#------------------------------------------------------------ +# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $ +# OpenTimestamps related magic entries +# https://opentimestamps.org/ +# https://en.wikipedia.org/wiki/OpenTimestamps +# "Emanuele Cisbani" <emanuele.cisbani@gmail.com> +#------------------------------------------------------------ + +# OpenTimestamps Proof .ots format. +# Magic is defined here: +# https://github.com/opentimestamps/python-opentimestamps/\ +# blob/master/opentimestamps/core/timestamp.py#L273 + +0 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps +>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof diff --git a/magic/Magdir/pdf b/magic/Magdir/pdf index 0a06dc9d5a54..5a67e86b5c35 100644 --- a/magic/Magdir/pdf +++ b/magic/Magdir/pdf @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $ +# $File: pdf,v 1.11 2019/09/12 15:53:49 christos Exp $ # pdf: file(1) magic for Portable Document Format # @@ -16,6 +16,12 @@ >6 byte x \b, version %c >8 byte x \b.%c +0 string \xef\xbb\xbf%PDF- PDF document (UTF-8) +!:mime application/pdf +!:strength +60 +>6 byte x \b, version %c +>8 byte x \b.%c + # From: Nick Schmalenberger <nick@schmalenberger.us> # Forms Data Format 0 string %FDF- FDF document diff --git a/magic/Magdir/pmem b/magic/Magdir/pmem new file mode 100644 index 000000000000..4c36275ea96f --- /dev/null +++ b/magic/Magdir/pmem @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $ +# pmem: file(1) magic for Persistent Memory Development Kit pool files +# +0 string PMEM +>4 string POOLSET Persistent Memory Poolset file +>>11 search REPLICA with replica +>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s, +>>8 lelong >0 version: 0x%x, +>>12 lelong x compat: 0x%x, +>>16 lelong x incompat: 0x%x, +>>20 lelong x ro_compat: 0x%x, + + +>>120 leqldate x crtime: %s, +>>128 lequad x alignment_desc: 0x%016llx, + +>>136 clear x +>>136 byte 2 machine_class: 64-bit, +>>136 default x machine_class: unknown +>>>136 byte x (0x%d), + +>>137 clear x +>>137 byte 1 data: little-endian, +>>137 byte 2 data: big-endian, +>>137 default x data: unknown +>>>137 byte x (0x%d), + +>>138 byte !0 reserved[0]: %d, +>>139 byte !0 reserved[1]: %d, +>>140 byte !0 reserved[2]: %d, +>>141 byte !0 reserved[3]: %d, + +>>142 clear x +>>142 leshort 62 machine: x86_64 +>>142 leshort 183 machine: aarch64 +>>142 default x machine: unknown +>>>142 leshort x (0x%d) + +>4 string BLK +>>4096 lelong x \b, blk.bsize: %d + +>4 string OBJ +>>4096 string >0 \b, obj.layout: '%s' +>>4096 string <0 \b, obj.layout: NULL diff --git a/magic/Magdir/python b/magic/Magdir/python index acf05dddbaaf..4af3ffcf1f94 100644 --- a/magic/Magdir/python +++ b/magic/Magdir/python @@ -1,31 +1,44 @@ #------------------------------------------------------------------------------ -# $File: python,v 1.36 2019/04/09 18:28:25 christos Exp $ +# $File: python,v 1.37 2019/10/21 19:40:58 christos Exp $ # python: file(1) magic for python # # Outlook puts """ too for urgent messages # From: David Necas <yeti@physics.muni.cz> # often the module starts with a multiline string 0 string/t """ Python script text executable -# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming -# that Py_UnicodeFlag is off for Python 2) +# MAGIC as specified in Python/import.c (1.0 to 3.7) # two bytes of magic followed by "\r\n" in little endian order -0 belong 0x994e0d0a python 1.5/1.6 byte-compiled +0 belong 0x02099900 python 1.0 byte-compiled +0 belong 0x03099900 python 1.1/1.2 byte-compiled +0 belong 0x892e0d0a python 1.3 byte-compiled +0 belong 0x04170d0a python 1.4 byte-compiled +0 belong 0x994e0d0a python 1.5 byte-compiled +0 belong 0xfcc40d0a python 1.6 byte-compiled +0 belong 0xfdc40d0a python 1.6 byte-compiled 0 belong 0x87c60d0a python 2.0 byte-compiled +0 belong 0x88c60d0a python 2.0 byte-compiled 0 belong 0x2aeb0d0a python 2.1 byte-compiled +0 belong 0x2beb0d0a python 2.1 byte-compiled 0 belong 0x2ded0d0a python 2.2 byte-compiled +0 belong 0x2eed0d0a python 2.2 byte-compiled 0 belong 0x3bf20d0a python 2.3 byte-compiled +0 belong 0x3cf20d0a python 2.3 byte-compiled 0 belong 0x6df20d0a python 2.4 byte-compiled +0 belong 0x6ef20d0a python 2.4 byte-compiled 0 belong 0xb3f20d0a python 2.5 byte-compiled +0 belong 0xb4f20d0a python 2.5 byte-compiled 0 belong 0xd1f20d0a python 2.6 byte-compiled +0 belong 0xd2f20d0a python 2.6 byte-compiled 0 belong 0x03f30d0a python 2.7 byte-compiled +0 belong 0x04f30d0a python 2.7 byte-compiled 0 belong 0x3b0c0d0a python 3.0 byte-compiled 0 belong 0x4f0c0d0a python 3.1 byte-compiled 0 belong 0x6c0c0d0a python 3.2 byte-compiled 0 belong 0x9e0c0d0a python 3.3 byte-compiled 0 belong 0xee0c0d0a python 3.4 byte-compiled -0 belong 0x160d0d0a python 3.5.1- byte-compiled -0 belong 0x170d0d0a python 3.5.2+ byte-compiled +0 belong 0x160d0d0a python 3.5.2- byte-compiled +0 belong 0x170d0d0a python 3.5.3+ byte-compiled 0 belong 0x330d0d0a python 3.6 byte-compiled 0 belong 0x420d0d0a python 3.7 byte-compiled diff --git a/magic/Magdir/rpi b/magic/Magdir/rpi index ac1be941d2b1..58e6dfde70a5 100644 --- a/magic/Magdir/rpi +++ b/magic/Magdir/rpi @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $ +# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $ # rpi: file(1) magic for Raspberry Pi images -44 lelong 0 >4 lelong 0 @@ -13,3 +13,17 @@ >>>>>>>32 lelong 44 >>>>>>>>36 lelong 4 >>>>>>>>>40 string RPTL Raspberry PI kernel image + +-56 lelong 0 +>4 lelong 0 +>>8 lelong 1 +>>12 lelong 4 +>>>16 string 283x +>>>>20 lelong 1 +>>>>>24 lelong 4 +>>>>>>28 string DTOK +>>>>>>>32 lelong 1 +>>>>>>>>36 lelong 4 +>>>>>>>>>40 string DDTK8 +>>>>>>>>>>48 lelong 4 +>>>>>>>>>>>52 string RPTL Raspberry PI kernel image diff --git a/magic/Magdir/rst b/magic/Magdir/rst new file mode 100644 index 000000000000..f9437ec32012 --- /dev/null +++ b/magic/Magdir/rst @@ -0,0 +1,11 @@ + +#------------------------------------------------------------------------------ +# $File: rst,v 1.2 2019/11/02 18:41:26 christos Exp $ +# rst: ReStructuredText http://docutils.sourceforge.net/rst.html +0 search/256 \=\= +!:strength + 30 +>&0 regex/256 \^[\=]+$ +>>&0 search/512 :Author: ReStructuredText file +>>&0 default x +>>>&0 regex/512 \^\.\.[A-Za-z] ReStructuredText file +!:ext rst diff --git a/magic/Magdir/ruby b/magic/Magdir/ruby index 87af47d933fa..9e67a3e22dc8 100644 --- a/magic/Magdir/ruby +++ b/magic/Magdir/ruby @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: ruby,v 1.9 2019/04/19 00:42:27 christos Exp $ +# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $ # ruby: file(1) magic for Ruby scripting language # URL: https://www.ruby-lang.org/ # From: Reuben Thomas <rrt@sc3d.org> @@ -23,7 +23,7 @@ # (modules and such) # From: Lubomir Rintel <lkundrak@v3.sk> 0 search/8192 require ->0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' +>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' >>0 regex def\ [a-z]|\ do$ >>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text !:strength + 30 @@ -48,7 +48,7 @@ !:mime text/x-ruby 0 search/8192 require ->0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text +>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text !:mime text/x-ruby 0 search/8192 include >0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text diff --git a/magic/Magdir/sgml b/magic/Magdir/sgml index 987fe10e08d6..8bfe9beb427a 100644 --- a/magic/Magdir/sgml +++ b/magic/Magdir/sgml @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: sgml,v 1.39 2019/04/19 00:42:27 christos Exp $ +# $File: sgml,v 1.40 2019/09/30 15:44:22 christos Exp $ # Type: SVG Vectorial Graphics # From: Noel Torres <tecnico@ejerciciosresueltos.com> 0 string \<?xml\ version= @@ -10,7 +10,7 @@ >>19 search/4096 \<gnc-v2 GnuCash file !:mime application/x-gnucash 0 string \<svg SVG Scalable Vector Graphics image -!:mime image/svg +!:mime image/svg+xml # Sitemap file 0 string/t \<?xml\ version= @@ -142,4 +142,4 @@ 0 string \<?xml\ version= >14 regex ['"\ \t]*[0-9.]+['"\ \t]* >>19 search/4096 \<pef Portable Embosser Format -!:mime application/x-pef+xml
\ No newline at end of file +!:mime application/x-pef+xml diff --git a/magic/Magdir/sniffer b/magic/Magdir/sniffer index 14a23ab5d69d..a7f6471b110e 100644 --- a/magic/Magdir/sniffer +++ b/magic/Magdir/sniffer @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $ +# $File: sniffer,v 1.27 2019/12/08 18:22:24 christos Exp $ # sniffer: file(1) magic for packet capture files # # From: guy@alum.mit.edu (Guy Harris) @@ -99,7 +99,7 @@ >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM ->20 belong 12 (raw IP +>20 belong 12 (Raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP >20 belong 19 (Linux ATM Classical IP @@ -107,7 +107,7 @@ >20 belong 51 (PPP-over-Ethernet >20 belong 99 (Symantec Enterprise Firewall >20 belong 100 (RFC 1483 ATM ->20 belong 101 (raw IP +>20 belong 101 (Raw IP >20 belong 102 (BSD/OS SLIP >20 belong 103 (BSD/OS PPP >20 belong 104 (BSD/OS Cisco HDLC @@ -262,6 +262,8 @@ >20 belong 279 (Elektrobit High Speed Capture and Replay (EBHSCR) >20 belong 281 (Broadcom tag >20 belong 282 (Broadcom tag (prepended) +>20 belong 284 (Marvell DSA +>20 belong 285 (Marvell EDSA # print default match >20 default x >>20 belong x (linktype#%u diff --git a/magic/Magdir/sosi b/magic/Magdir/sosi new file mode 100644 index 000000000000..cfac5a3e2730 --- /dev/null +++ b/magic/Magdir/sosi @@ -0,0 +1,40 @@ + +#------------------------------------------------------------------------------ +# $File: sosi,v 1.1 2019/05/20 17:25:09 christos Exp $ +# SOSI +# Summary: Systematic Organization of Spatial Information +# Long description: Norwegian text based map format +# File extension: .sos +# Full name: Petter Reinholdtsen (pere@hungry.com) +# Reference: https://en.wikipedia.org/wiki/SOSI +# +# Example SOSI files available from +# https://trac.osgeo.org/gdal/ticket/3638 +# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/ +# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/ +# +# Start with optional comments (from "!" to the next line end) +# followed by ".HODE" and end with "\n.SLUTT" followed by an optional +# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at +# the start and following ".HODE" near the start there is "..OMR=C3=85DE" +# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on +# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a +# separator, as well as "..SOSI-VERSJON " followed by the format +# version and a separator. +# +# FIXME figure out how to accept any of [space], [tab], [newline] and +# [carrige return] as separators, not only line end. + +# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8 +# character sets +0 search ..OMR +>0 search ..TRANSPAR +>>0 search .HODE SOSI map data +>>>&0 search ..SOSI-VERSJON +>>>>&1 string x \b, version %s +# FIXME could not figure out way to make a match for .SLUTT at the end required +#>-7 string \n.SLUTT slutt +#>-8 string \n.SLUTT\n slutt-nl +#>-9 string \n.SLUTT\r\n slutt-crnl2 +!:mime text/vnd.sosi +!:ext sos diff --git a/magic/Magdir/ssh b/magic/Magdir/ssh index ca645644a782..9337ba7ab06a 100644 --- a/magic/Magdir/ssh +++ b/magic/Magdir/ssh @@ -11,3 +11,9 @@ 0 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 0 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 0 string ssh-ed25519 OpenSSH ED25519 public key + +0 string SSHKRL\n\0 +>8 ubelong 1 OpenSSH key/certificate revocation list, format %u +>>12 ubequad x \b, version %llx +>>>20 beqdate x \b, generated %s + diff --git a/magic/Magdir/uuencode b/magic/Magdir/uuencode index c00ddabbde36..7844468484c2 100644 --- a/magic/Magdir/uuencode +++ b/magic/Magdir/uuencode @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ +# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $ # uuencode: file(1) magic for ASCII-encoded files # @@ -23,9 +23,4 @@ # Greg Roelofs, newt@uchicago.edu 0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text -# BinHex is the Macintosh ASCII-encoded file format (see also "apple") -# Daniel Quinlan, quinlan@yggdrasil.com -11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text ->41 search/1 x \b, version %.3s - # GRR: handle BASE64 diff --git a/magic/Magdir/varied.script b/magic/Magdir/varied.script index 11e6eb56bb9e..ff893882b01e 100644 --- a/magic/Magdir/varied.script +++ b/magic/Magdir/varied.script @@ -1,30 +1,38 @@ #------------------------------------------------------------------------------ -# $File: varied.script,v 1.12 2019/04/19 00:42:27 christos Exp $ +# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $ # varied.script: file(1) magic for various interpreter scripts 0 string/t #!\ / a >3 string >\0 %s script text executable +!:strength / 2 0 string/b #!\ / a >3 string >\0 %s script executable (binary data) +!:strength / 2 0 string/t #!\t/ a >3 string >\0 %s script text executable +!:strength / 2 0 string/b #!\t/ a >3 string >\0 %s script executable (binary data) +!:strength / 2 0 string/t #!/ a >2 string >\0 %s script text executable +!:strength / 2 0 string/b #!/ a >2 string >\0 %s script executable (binary data) +!:strength / 2 0 string/t #!\ script text executable >3 string >\0 for %s +!:strength / 2 0 string/b #!\ script executable >3 string >\0 for %s (binary data) +!:strength / 2 # using env 0 string/t #!/usr/bin/env a diff --git a/magic/Magdir/vax b/magic/Magdir/vax index 11de6cef0056..f3deffa59fa3 100644 --- a/magic/Magdir/vax +++ b/magic/Magdir/vax @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $ +# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $ # vax: file(1) magic for VAX executable/object and APL workspace # 0 lelong 0101557 VAX single precision APL workspace @@ -19,9 +19,14 @@ # The `versions' were commented out, but have been un-commented out. # (Was the problem just one of endianness?) # -0 leshort 0570 VAX COFF executable ->12 lelong >0 not stripped ->22 leshort >0 - version %d -0 leshort 0575 VAX COFF pure executable ->12 lelong >0 not stripped ->22 leshort >0 - version %d +0 leshort 0570 +>2 uleshort <100 VAX COFF executable, sections %d +>>4 ledate x \b, created %s +>>12 lelong >0 \b, not stripped +>>22 leshort >0 \b, version %d + +0 leshort 0575 +>2 uleshort <100 VAX COFF pure executable, sections %d +>>4 ledate x \b, created %s +>>12 lelong >0 \b, not stripped +>>22 leshort >0 \b, version %d diff --git a/magic/Magdir/windows b/magic/Magdir/windows index 39ed3e2bec15..812ae1a895e1 100644 --- a/magic/Magdir/windows +++ b/magic/Magdir/windows @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: windows,v 1.26 2019/05/01 17:55:25 christos Exp $ +# $File: windows,v 1.29 2019/11/18 03:11:20 christos Exp $ # windows: file(1) magic for Microsoft Windows # # This file is mainly reserved for files where programs @@ -119,6 +119,94 @@ # 3rd BLOB >>0x480 string >\0 \b, type %-3.8s +# Summary: Windows boot status log BOOTSTAT.DAT +# From: Joerg Jenderek +# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm +# Note: mainly refers to older Windows Vista, sometimes +# BOOTSTAT.DAT only contains nulls or invalid data +# checking for valid version below 5 +0 ulelong <5 +# skip many ISO images by checking for valid 64 KiB file size +>8 ulelong =0x00010000 +>>0 use bootstat-dat +# display information of BOOTSTAT.DAT +0 name bootstat-dat +>0 ulelong x Windows boot log +#!:mime application/octet-stream +!:mime application/x-ms-dat +# BOOTSTAT.DAT in BOOT subdirectory +!:ext dat +# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 +>0 ulelong >2 \b, version %u +# apparently the size of the header: often 10h in older Windows, 14h, 18h +>4 ulelong !0x10 \b, header size 0x%x +#>4 ulelong !0x10 \b, header size %u +# apparently the size of the file: always 0x00010000~64KiB +# the file is acceptable to BOOTMGR only if it is exactly 64 KiB +>8 ulelong !0x00010000 \b, file size 0x%x +# size of valid data, in bytes: C8h 50h 172h 5D5Ch +>0xc ulelong x \b, 0x%x valid bytes +# skip header and jump to first bootstat entry and display information +>(0x4.l-1) ubyte x +>>&0 use bootstat-entry +# jump to first entry again because pointer are bad after "use" +>(0x4.l-1) ubyte x +# by 1st entry size jump to 2nd entry and display information +>>&(&0x18.l-1) ubyte x +>>>&0 use bootstat-entry +# jump to possible 3rd boot entry and display information +# >(0x4.l-1) ubyte x +# >>&(&0x18.l-1) ubyte x +# >>>&(&0x18.l-1) ubyte x +# >>>>&0 use bootstat-entry +# display BOOTSTAT.DAT entry +0 name bootstat-entry +#>0x00 ubequad x \b, ENTRY %16.16llx +# size of entry, in bytes: 40h(init) 78h(launced) 9Ch +#>0x18 ulelong x \b; entry size %u +>0x18 ulelong x \b; entry size 0x%x +# time stamp, in seconds +>0x00 ulelong x \b, 0x%x seconds +# always zero, significance unknown +>0x04 ulelong !0 \b, not null %u +# GUID of event source; but empty if event source is BOOTMGR +>0x08 ubequad !0 \b, GUID 0x%16.16llx +>>0x10 ubequad x \b%16.16llx +# severity code: 1~informational 3~errors +>0x1C ulelong !1 \b, severity 0x%x +# apparently a version number: 2 +>0x20 ulelong !2 \b, version %u +# event identifier 1~log file initialised 11h~boot application launched +#>0x24 ulelong x \b, event 0x%x +>0x24 ulelong !1 +>>0x24 ulelong !0x11 \b, event 0x%x +# entry data; size depends on event identifier +#>0x28 ubequad x \b, data 0x%16.16llx +>0x24 ulelong =0x1 \b, Init +# always 0, significance unknown +>>0x34 uleshort !0 \b, not null %u +# always 7, significance unknown +>>0x36 uleshort !7 \b, not seven %u +# year +>>0x28 uleshort x %u +# month +>>0x2A uleshort x \b-%u +# day +>>0x2C uleshort x \b-%u +# hour +>>0x2E uleshort x %u +# minute +>>0x30 uleshort x \b:%u +# second +>>0x32 uleshort x \b:%u +# boot application launched +>0x24 ulelong =0x11 \b, launched +# type of start: 0 normally, 1 or 2 maybe in a recovery sequence +>>0x38 uleshort !0 \b, type %u +# pathname of boot application, as null-terminated Unicode string; typically +# \Windows\system32\winload.exe \Windows\system32\winload.efi +>>0x3C lestring16 x %s + # Summary: Windows Error Report text files # URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting # Reference: https://www.nirsoft.net/utils/app_crash_view.html @@ -275,7 +363,7 @@ !:apple ????TEXT !:ext cnt # -# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing +# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 0 string tfMR MS Windows help Full Text Search index !:mime application/x-winhelp-fts !:ext fts @@ -477,8 +565,8 @@ # https://en.wikipedia.org/wiki/CONFIG.SYS >>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS # @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE -# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE -# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE +# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE +# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE # dos and w40 used in dual booting scene !:ext sys/dos/w40 # https://support.microsoft.com/kb/118579/ @@ -757,7 +845,7 @@ >0x1c string >\0 \b%.7s # AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... >0xc0 string x %s -# AppId[0x80] is simliar to AppName or +# AppId[0x80] is similar to AppName or # GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace >0x40 ubyte 0x7b >>0x40 string x %-.38s @@ -879,3 +967,27 @@ #>148 ubequad !0 \b,unused 0x%16.16llx # +# From: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml +# Note: called "Windows Easy Transfer migration data" by TrID, +# "Migration Store" or "EasyTransfer file" by Microsoft +0 string 1giM Windows Easy Transfer migration data +#!:mime application/octet-stream +!:mime application/x-ms-mig +!:ext mig +>0x18 string =MRTS without password +# data offset with 1 space at end +>>0x1c ulelong+0x38 x \b, at 0x%x +# look for zlib compressed data by ./compress +>>(0x1c.l+0x38) ubyte x +>>>&-1 indirect x +# in password protected examples MRTS comes some bytes further +>0x18 string !MRTS with password +# look for first MRTS tag +>0x18 search/29/b MRTS +# probably first file name length like 178, ... +#>>&0 ulelong x \b, 1st length %u +# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini +>>&20 lestring16 x \b, 1st %-s + diff --git a/magic/Magdir/wordprocessors b/magic/Magdir/wordprocessors index 4b08c4303102..0f168887f1b6 100644 --- a/magic/Magdir/wordprocessors +++ b/magic/Magdir/wordprocessors @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: wordprocessors,v 1.20 2019/04/19 00:42:27 christos Exp $ +# $File: wordprocessors,v 1.23 2019/10/25 20:15:49 christos Exp $ # wordprocessors: file(1) magic fo word processors. # ####### PWP file format used on Smith Corona Personal Word Processors: @@ -12,6 +12,21 @@ >25 byte 0x54 \b, legal >26 byte 0x46 \b, A4 +# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor +# reference: http://mark0.net/download/triddefs_xml.7z +# /defs/w/wps-works-dos.trid.xml +# From: Joerg Jenderek +# Note: older non OLE 2 Compound based versions +0 ubeshort =0x01FE +>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document +# title like THE GREAT KHAN GAME +>>0x100 string x %s +!:mime application/vnd-ms-works +#!:mime application/x-msworks +# https://www.macdisk.com/macsigen.php +!:apple ????AWWP +!:ext wps + # Corel/WordPerfect 0 string \xffWPC # WordPerfect @@ -196,9 +211,6 @@ # Hangul (Korean) Word Processor File 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 -# From: Won-Kyu Park <wkpark@kldp.org> -512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 -!:mime application/x-hwp # CosmicBook, from Benoit Rouits 0 string CSBK Ted Neslson's CosmicBook hypertext file @@ -260,3 +272,33 @@ # help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek # markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file + +# From: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/StarOffice +# Note: used in Star-, Open- and Libre-Office +# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others +0 ubeshort 0x0400 +#>(2.s+8) ubequad x \b, gap 0x%16.16llx +# test for null value in gap after theme name maybe unreliable +#>(2.s+9) ubyte 0 \b, 0-byte +# look for keyword GALRESRV near the end +# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects +#>0 search/8415 GALRESRV \b, GALRESRV found +# "neues thema6.thm" MorePictures, 315 objects +#>0 search/19299 GALRESRV \b, GALRESRV FOUND +#>2 uleshort x \b, name length %u +# skip file2147.chk by check for positive name length like for sg16.thm "3D" +>2 uleshort >0 StarOffice Gallery theme +!:mime application/x-stargallery-thm +!:ext thm +# gallery name +>>2 pstring/h x %s +# number of objects +>>(2.s+4) ulelong x \b, %u object +# plural s +>>(2.s+4) ulelong !1 \bs +# if available then display first object name +>>(2.s+4) ulelong >0 +# partial file name, URL or internal name like "dd2*" of 1st object or RESRV +>>>(2.s+11) pstring/h x \b, 1st %s + diff --git a/magic/Magdir/zip b/magic/Magdir/zip index f214ad0df550..565085a39099 100644 --- a/magic/Magdir/zip +++ b/magic/Magdir/zip @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: zip,v 1.2 2019/04/09 18:34:15 christos Exp $ +# $File: zip,v 1.3 2019/07/06 19:25:06 christos Exp $ # zip: file(1) magic for zip files; this is not use # Note the version of magic in archive is currently stronger, this is # just an example until negative offsets are supported better @@ -60,4 +60,4 @@ #>10 leshort >1 \b, %d central directories #>12 lelong x \b, %d central directory bytes >(16.l) use zipcd ->20 pstring/l >0 \b, %s +>>20 pstring/l >0 \b, %s diff --git a/magic/Makefile.am b/magic/Makefile.am index a52f522c924d..e5c413fa9526 100644 --- a/magic/Makefile.am +++ b/magic/Makefile.am @@ -1,5 +1,5 @@ # -# $File: Makefile.am,v 1.143 2019/05/09 16:24:36 christos Exp $ +# $File: Makefile.am,v 1.151 2019/11/02 18:37:58 christos Exp $ # MAGIC_FRAGMENT_BASE = Magdir MAGIC_DIR = $(top_srcdir)/magic @@ -99,6 +99,7 @@ $(MAGIC_FRAGMENT_DIR)/finger \ $(MAGIC_FRAGMENT_DIR)/flash \ $(MAGIC_FRAGMENT_DIR)/flif \ $(MAGIC_FRAGMENT_DIR)/fonts \ +$(MAGIC_FRAGMENT_DIR)/forth \ $(MAGIC_FRAGMENT_DIR)/fortran \ $(MAGIC_FRAGMENT_DIR)/frame \ $(MAGIC_FRAGMENT_DIR)/freebsd \ @@ -110,6 +111,7 @@ $(MAGIC_FRAGMENT_DIR)/gconv \ $(MAGIC_FRAGMENT_DIR)/geo \ $(MAGIC_FRAGMENT_DIR)/geos \ $(MAGIC_FRAGMENT_DIR)/gimp \ +$(MAGIC_FRAGMENT_DIR)/git \ $(MAGIC_FRAGMENT_DIR)/glibc \ $(MAGIC_FRAGMENT_DIR)/gnome \ $(MAGIC_FRAGMENT_DIR)/gnu \ @@ -179,6 +181,7 @@ $(MAGIC_FRAGMENT_DIR)/mkid \ $(MAGIC_FRAGMENT_DIR)/mlssa \ $(MAGIC_FRAGMENT_DIR)/mmdf \ $(MAGIC_FRAGMENT_DIR)/modem \ +$(MAGIC_FRAGMENT_DIR)/modulefile \ $(MAGIC_FRAGMENT_DIR)/motorola \ $(MAGIC_FRAGMENT_DIR)/mozilla \ $(MAGIC_FRAGMENT_DIR)/msdos \ @@ -202,6 +205,8 @@ $(MAGIC_FRAGMENT_DIR)/ocaml \ $(MAGIC_FRAGMENT_DIR)/octave \ $(MAGIC_FRAGMENT_DIR)/ole2compounddocs \ $(MAGIC_FRAGMENT_DIR)/olf \ +$(MAGIC_FRAGMENT_DIR)/openfst \ +$(MAGIC_FRAGMENT_DIR)/opentimestamps \ $(MAGIC_FRAGMENT_DIR)/os2 \ $(MAGIC_FRAGMENT_DIR)/os400 \ $(MAGIC_FRAGMENT_DIR)/os9 \ @@ -222,6 +227,7 @@ $(MAGIC_FRAGMENT_DIR)/pgp \ $(MAGIC_FRAGMENT_DIR)/pkgadd \ $(MAGIC_FRAGMENT_DIR)/plan9 \ $(MAGIC_FRAGMENT_DIR)/plus5 \ +$(MAGIC_FRAGMENT_DIR)/pmem \ $(MAGIC_FRAGMENT_DIR)/polyml \ $(MAGIC_FRAGMENT_DIR)/printer \ $(MAGIC_FRAGMENT_DIR)/project \ @@ -238,6 +244,7 @@ $(MAGIC_FRAGMENT_DIR)/rpi \ $(MAGIC_FRAGMENT_DIR)/rpm \ $(MAGIC_FRAGMENT_DIR)/rpmsg \ $(MAGIC_FRAGMENT_DIR)/rtf \ +$(MAGIC_FRAGMENT_DIR)/rst \ $(MAGIC_FRAGMENT_DIR)/ruby \ $(MAGIC_FRAGMENT_DIR)/sc \ $(MAGIC_FRAGMENT_DIR)/sccs \ @@ -257,6 +264,7 @@ $(MAGIC_FRAGMENT_DIR)/smalltalk \ $(MAGIC_FRAGMENT_DIR)/smile \ $(MAGIC_FRAGMENT_DIR)/sniffer \ $(MAGIC_FRAGMENT_DIR)/softquad \ +$(MAGIC_FRAGMENT_DIR)/sosi \ $(MAGIC_FRAGMENT_DIR)/spec \ $(MAGIC_FRAGMENT_DIR)/spectrum \ $(MAGIC_FRAGMENT_DIR)/sql \ diff --git a/magic/Makefile.in b/magic/Makefile.in index bacc6d575ace..a0e79bc79efc 100644 --- a/magic/Makefile.in +++ b/magic/Makefile.in @@ -1,7 +1,7 @@ -# Makefile.in generated by automake 1.15 from Makefile.am. +# Makefile.in generated by automake 1.16.1 from Makefile.am. # @configure_input@ -# Copyright (C) 1994-2014 Free Software Foundation, Inc. +# Copyright (C) 1994-2018 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -193,6 +193,7 @@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ +LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MINGW = @MINGW@ @@ -273,7 +274,7 @@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ # -# $File: Makefile.am,v 1.143 2019/05/09 16:24:36 christos Exp $ +# $File: Makefile.am,v 1.151 2019/11/02 18:37:58 christos Exp $ # MAGIC_FRAGMENT_BASE = Magdir MAGIC_DIR = $(top_srcdir)/magic @@ -371,6 +372,7 @@ $(MAGIC_FRAGMENT_DIR)/finger \ $(MAGIC_FRAGMENT_DIR)/flash \ $(MAGIC_FRAGMENT_DIR)/flif \ $(MAGIC_FRAGMENT_DIR)/fonts \ +$(MAGIC_FRAGMENT_DIR)/forth \ $(MAGIC_FRAGMENT_DIR)/fortran \ $(MAGIC_FRAGMENT_DIR)/frame \ $(MAGIC_FRAGMENT_DIR)/freebsd \ @@ -382,6 +384,7 @@ $(MAGIC_FRAGMENT_DIR)/gconv \ $(MAGIC_FRAGMENT_DIR)/geo \ $(MAGIC_FRAGMENT_DIR)/geos \ $(MAGIC_FRAGMENT_DIR)/gimp \ +$(MAGIC_FRAGMENT_DIR)/git \ $(MAGIC_FRAGMENT_DIR)/glibc \ $(MAGIC_FRAGMENT_DIR)/gnome \ $(MAGIC_FRAGMENT_DIR)/gnu \ @@ -451,6 +454,7 @@ $(MAGIC_FRAGMENT_DIR)/mkid \ $(MAGIC_FRAGMENT_DIR)/mlssa \ $(MAGIC_FRAGMENT_DIR)/mmdf \ $(MAGIC_FRAGMENT_DIR)/modem \ +$(MAGIC_FRAGMENT_DIR)/modulefile \ $(MAGIC_FRAGMENT_DIR)/motorola \ $(MAGIC_FRAGMENT_DIR)/mozilla \ $(MAGIC_FRAGMENT_DIR)/msdos \ @@ -474,6 +478,8 @@ $(MAGIC_FRAGMENT_DIR)/ocaml \ $(MAGIC_FRAGMENT_DIR)/octave \ $(MAGIC_FRAGMENT_DIR)/ole2compounddocs \ $(MAGIC_FRAGMENT_DIR)/olf \ +$(MAGIC_FRAGMENT_DIR)/openfst \ +$(MAGIC_FRAGMENT_DIR)/opentimestamps \ $(MAGIC_FRAGMENT_DIR)/os2 \ $(MAGIC_FRAGMENT_DIR)/os400 \ $(MAGIC_FRAGMENT_DIR)/os9 \ @@ -494,6 +500,7 @@ $(MAGIC_FRAGMENT_DIR)/pgp \ $(MAGIC_FRAGMENT_DIR)/pkgadd \ $(MAGIC_FRAGMENT_DIR)/plan9 \ $(MAGIC_FRAGMENT_DIR)/plus5 \ +$(MAGIC_FRAGMENT_DIR)/pmem \ $(MAGIC_FRAGMENT_DIR)/polyml \ $(MAGIC_FRAGMENT_DIR)/printer \ $(MAGIC_FRAGMENT_DIR)/project \ @@ -510,6 +517,7 @@ $(MAGIC_FRAGMENT_DIR)/rpi \ $(MAGIC_FRAGMENT_DIR)/rpm \ $(MAGIC_FRAGMENT_DIR)/rpmsg \ $(MAGIC_FRAGMENT_DIR)/rtf \ +$(MAGIC_FRAGMENT_DIR)/rst \ $(MAGIC_FRAGMENT_DIR)/ruby \ $(MAGIC_FRAGMENT_DIR)/sc \ $(MAGIC_FRAGMENT_DIR)/sccs \ @@ -529,6 +537,7 @@ $(MAGIC_FRAGMENT_DIR)/smalltalk \ $(MAGIC_FRAGMENT_DIR)/smile \ $(MAGIC_FRAGMENT_DIR)/sniffer \ $(MAGIC_FRAGMENT_DIR)/softquad \ +$(MAGIC_FRAGMENT_DIR)/sosi \ $(MAGIC_FRAGMENT_DIR)/spec \ $(MAGIC_FRAGMENT_DIR)/spectrum \ $(MAGIC_FRAGMENT_DIR)/sql \ @@ -612,8 +621,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ - echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ - cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) @@ -658,7 +667,10 @@ ctags CTAGS: cscope cscopelist: -distdir: $(DISTFILES) +distdir: $(BUILT_SOURCES) + $(MAKE) $(AM_MAKEFLAGS) distdir-am + +distdir-am: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ |