1 2#------------------------------------------------------------------------------ 3# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ 4# acorn: file(1) magic for files found on Acorn systems 5# 6 7# RISC OS Chunk File Format 8# From RISC OS Programmer's Reference Manual, Appendix D 9# We guess the file type from the type of the first chunk. 100 lelong 0xc3cbc6c5 RISC OS Chunk data 11>12 string OBJ_ \b, AOF object 12>12 string LIB_ \b, ALF library 13 14# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 1516 lelong 0xef000011 RISC OS AIF executable 16 17# RISC OS Draw files 18# From RISC OS Programmer's Reference Manual, Appendix E 190 string Draw RISC OS Draw file data 20 21# RISC OS new format font files 22# From RISC OS Programmer's Reference Manual, Appendix E 230 string FONT\0 RISC OS outline font data, 24>5 byte x version %d 250 string FONT\1 RISC OS 1bpp font data, 26>5 byte x version %d 270 string FONT\4 RISC OS 4bpp font data 28>5 byte x version %d 29 30# RISC OS Music files 31# From RISC OS Programmer's Reference Manual, Appendix E 320 string Maestro\r RISC OS music file 33>8 byte x version %d 34 35>8 byte x type %d 36 37# Digital Symphony data files 38# From: Bernard Jungen (bern8817@euphonynet.be) 390 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 40>8 byte x version %d, 41>9 pstring x named "%s", 42>(9.b+19) byte =0 8-bit logarithmic 43>(9.b+19) byte =1 LZW-compressed linear 44>(9.b+19) byte =2 8-bit linear signed 45>(9.b+19) byte =3 16-bit linear signed 46>(9.b+19) byte =4 SigmaDelta-compressed linear 47>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 48>(9.b+19) byte >5 unknown format 49 500 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 51>8 byte x version %d, 52>9 byte =1 1 voice, 53>9 byte !1 %d voices, 54>10 leshort =1 1 track, 55>10 leshort !1 %d tracks, 56>12 leshort =1 1 pattern 57>12 leshort !1 %d patterns 58 590 string \x02\x01\x13\x13\x10\x14\x12\x0e 60>9 byte =0 Digital Symphony sequence (RISC OS), 61>>8 byte x version %d, 62>>10 byte =1 1 line, 63>>10 byte !1 %d lines, 64>>11 leshort =1 1 position 65>>11 leshort !1 %d positions 66>9 byte =1 Digital Symphony pattern data (RISC OS), 67>>8 byte x version %d, 68>>10 leshort =1 1 pattern 69>>10 leshort !1 %d patterns 70 71#------------------------------------------------------------------------------ 72# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 73# adi: file(1) magic for ADi's objects 74# From Gregory McGarry <g.mcgarry@ieee.org> 75# 760 leshort 0x521c COFF DSP21k 77>18 lelong &02 executable, 78>18 lelong ^02 79>>18 lelong &01 static object, 80>>18 lelong ^01 relocatable object, 81>18 lelong &010 stripped 82>18 lelong ^010 not stripped 83 84#------------------------------------------------------------------------------ 85# $File: adventure,v 1.10 2009/09/19 16:28:07 christos Exp $ 86# adventure: file(1) magic for Adventure game files 87# 88# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 89# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 90# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 91# 92# ALAN 93# I assume there are other, lower versions, but these are the only ones I 94# saw in the archive. 950 beshort 0x0206 ALAN game data 96>2 byte <10 version 2.6%d 97 98 99# Infocom (see z-machine) 100#------------------------------------------------------------------------------ 101# Z-machine: file(1) magic for Z-machine binaries. 102# 103# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which 104# appears to be a version-0 Z-machine binary. 105# 106# The (false match) message is to correct that behavior. Perhaps it is 107# not needed. 108# 10916 belong&0xfe00f0f0 0x3030 Infocom game data 110>0 ubyte 0 (false match) 111>0 ubyte >0 (Z-machine %d, 112>>2 ubeshort x Release %d / 113>>18 string >\0 Serial %.6s) 114 115#------------------------------------------------------------------------------ 116# Glulx: file(1) magic for Glulx binaries. 117# 118# I haven't checked for false matches yet. 119# 1200 string Glul Glulx game data 121>4 beshort x (Version %d 122>>6 byte x \b.%d 123>>8 byte x \b.%d) 124>36 string Info Compiled by Inform 125 126 127 128# For Quetzal and blorb magic see iff 129 130 131# TADS (Text Adventure Development System) 132# All files are machine-independent (games compile to byte-code) and are tagged 133# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is 134# on the way). 135# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1360 string TADS2\ bin TADS 137>9 belong !0x0A0D1A00 game data, CORRUPTED 138>9 belong 0x0A0D1A00 139>>13 string >\0 %s game data 140# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1410 string TADS2\ rsc TADS 142>9 belong !0x0A0D1A00 resource data, CORRUPTED 143>9 belong 0x0A0D1A00 144>>13 string >\0 %s resource data 145# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 146# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 147# "TADS2 save\n\r\032\0" and the interpreter version. 1480 string TADS2\ save/g TADS 149>12 belong !0x0A0D1A00 saved game data, CORRUPTED 150>12 belong 0x0A0D1A00 151>>(16.s+32) string >\0 %s saved game data 152# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 153# version. 1540 string TADS2\ save TADS 155>10 belong !0x0A0D1A00 saved game data, CORRUPTED 156>10 belong 0x0A0D1A00 157>>14 string >\0 %s saved game data 158 159# Danny Milosavljevic <danny.milo@gmx.net> 160# this are adrift (adventure game standard) game files, extension .taf 161# depending on version magic continues with 0x93453E6139FA (V 4.0) 162# 0x9445376139FA (V 3.90) 163# 0x9445366139FA (V 3.80) 164# this is from source (http://www.adrift.org.uk/) and I have some taf 165# files, and checked them. 166#0 belong 0x3C423FC9 167#>4 belong 0x6A87C2CF Adrift game file 168#!:mime application/x-adrift 169 170#------------------------------------------------------------------------------ 171# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 172# allegro: file(1) magic for Allegro datafiles 173# Toby Deshane <hac@shoelace.digivill.net> 174# 1750 belong 0x736C6821 Allegro datafile (packed) 1760 belong 0x736C682E Allegro datafile (not packed/autodetect) 1770 belong 0x736C682B Allegro datafile (appended exe data) 178 179#------------------------------------------------------------------------------ 180# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 181# alliant: file(1) magic for Alliant FX series a.out files 182# 183# If the FX series is the one that had a processor with a 68K-derived 184# instruction set, the "short" should probably become "beshort" and the 185# "long" should probably become "belong". 186# If it's the i860-based one, they should probably become either the 187# big-endian or little-endian versions, depending on the mode they ran 188# the 860 in.... 189# 1900 short 0420 0420 Alliant virtual executable 191>2 short &0x0020 common library 192>16 long >0 not stripped 1930 short 0421 0421 Alliant compact executable 194>2 short &0x0020 common library 195>16 long >0 not stripped 196 197#------------------------------------------------------------------------------ 198# $File: alpha,v 1.7 2009/09/19 16:28:07 christos Exp $ 199# alpha architecture description 200# 201 2020 leshort 0603 COFF format alpha 203>22 leshort&030000 !020000 executable 204>24 leshort 0410 pure 205>24 leshort 0413 paged 206>22 leshort&020000 !0 dynamically linked 207>16 lelong !0 not stripped 208>16 lelong 0 stripped 209>22 leshort&030000 020000 shared library 210>24 leshort 0407 object 211>27 byte x - version %d 212>26 byte x .%d 213>28 byte x -%d 214 215# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 216# 217# The actual magic number is just "Core", followed by a 2-byte version 218# number; however, treating any file that begins with "Core" as a Digital 219# UNIX core dump file may produce too many false hits, so we include one 220# byte of the version number as well; DU 5.0 appears only to be up to 221# version 2. 222# 2230 string Core\001 Alpha COFF format core dump (Digital UNIX) 224>24 string >\0 \b, from '%s' 2250 string Core\002 Alpha COFF format core dump (Digital UNIX) 226>24 string >\0 \b, from '%s' 227 228 229#------------------------------------------------------------------------------ 230# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $ 231# amanda: file(1) magic for amanda file format 232# 2330 string AMANDA:\ AMANDA 234>8 string TAPESTART\ DATE tape header file, 235>>23 string X 236>>>25 string >\ Unused %s 237>>23 string >\ DATE %s 238>8 string FILE\ dump file, 239>>13 string >\ DATE %s 240 241#------------------------------------------------------------------------------ 242# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $ 243# amigaos: file(1) magic for AmigaOS binary formats: 244 245# 246# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 247# 2480 belong 0x000003fa AmigaOS shared library 2490 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2500 belong 0x000003e7 AmigaOS object/library data 251# 2520 beshort 0xe310 Amiga Workbench 253>2 beshort 1 254>>48 byte 1 disk icon 255>>48 byte 2 drawer icon 256>>48 byte 3 tool icon 257>>48 byte 4 project icon 258>>48 byte 5 garbage icon 259>>48 byte 6 device icon 260>>48 byte 7 kickstart icon 261>>48 byte 8 workbench application icon 262>2 beshort >1 icon, vers. %d 263# 264# various sound formats from the Amiga 265# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 266# 2670 string FC14 Future Composer 1.4 Module sound file 2680 string SMOD Future Composer 1.3 Module sound file 2690 string AON4artofnoise Art Of Noise Module sound file 2701 string MUGICIAN/SOFTEYES Mugician Module sound file 27158 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 2720 string Synth4.0 Synthesis Module sound file 2730 string ARP. The Holy Noise Module sound file 2740 string BeEp\0 JamCracker Module sound file 2750 string COSO\0 Hippel-COSO Module sound file 276# Too simple (short, pure ASCII, deep), MPi 277#26 string V.3 Brian Postma's Soundmon Module sound file v3 278#26 string BPSM Brian Postma's Soundmon Module sound file v3 279#26 string V.2 Brian Postma's Soundmon Module sound file v2 280 281# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 2820 beshort 0x0f00 AmigaOS bitmap font 2830 beshort 0x0f03 AmigaOS outline font 2840 belong 0x80001001 AmigaOS outline tag 2850 string ##\ version catalog translation 2860 string EMOD\0 Amiga E module 2878 string ECXM\0 ECX module 2880 string/c @database AmigaGuide file 289 290# Amiga disk types 291# 2920 string RDSK Rigid Disk Block 293>160 string x on %.24s 2940 string DOS\0 Amiga DOS disk 2950 string DOS\1 Amiga FFS disk 2960 string DOS\2 Amiga Inter DOS disk 2970 string DOS\3 Amiga Inter FFS disk 2980 string DOS\4 Amiga Fastdir DOS disk 2990 string DOS\5 Amiga Fastdir FFS disk 3000 string KICK Kickstart disk 301 302# From: Alex Beregszaszi <alex@fsn.hu> 3030 string LZX LZX compressed archive (Amiga) 304 305 306#------------------------------------------------------------------------------ 307# $File: animation,v 1.39 2009/09/27 19:02:12 christos Exp $ 308# animation: file(1) magic for animation/movie formats 309# 310# animation formats 311# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 312# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 313 314# SGI and Apple formats 3150 string MOVI Silicon Graphics movie file 316!:mime video/x-sgi-movie 3174 string moov Apple QuickTime 318!:mime video/quicktime 319>12 string mvhd \b movie (fast start) 320>12 string mdra \b URL 321>12 string cmov \b movie (fast start, compressed header) 322>12 string rmra \b multiple URLs 3234 string mdat Apple QuickTime movie (unoptimized) 324!:mime video/quicktime 325#4 string wide Apple QuickTime movie (unoptimized) 326#!:mime video/quicktime 327#4 string skip Apple QuickTime movie (modified) 328#!:mime video/quicktime 329#4 string free Apple QuickTime movie (modified) 330#!:mime video/quicktime 3314 string idsc Apple QuickTime image (fast start) 332!:mime image/x-quicktime 333#4 string idat Apple QuickTime image (unoptimized) 334#!:mime image/x-quicktime 3354 string pckg Apple QuickTime compressed archive 336!:mime application/x-quicktime-player 3374 string/W jP JPEG 2000 image 338!:mime image/jp2 3394 string ftyp ISO Media 340>8 string isom \b, MPEG v4 system, version 1 341!:mime video/mp4 342>8 string iso2 \b, MPEG v4 system, part 12 revision 343>8 string mp41 \b, MPEG v4 system, version 1 344!:mime video/mp4 345>8 string mp42 \b, MPEG v4 system, version 2 346!:mime video/mp4 347>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 348>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 349>8 string/W jp2 \b, JPEG 2000 350!:mime image/jp2 351>8 string 3gp \b, MPEG v4 system, 3GPP 352!:mime video/3gpp 353>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 354>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 355>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 356>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 357!:mime video/mp4 358>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC 359!:mime video/3gpp 360>8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC 361!:mime audio/mp4 362>8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC 363!:mime video/mp4 364>8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted 365>8 string/W M4B \b, MPEG v4 system, iTunes bookmarked 366>8 string/W qt \b, Apple QuickTime movie 367!:mime video/quicktime 368 369# MPEG sequences 370# Scans for all common MPEG header start codes 3710 belong 0x00000001 372>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 373>>5 byte 66 \b, baseline 374>>5 byte 77 \b, main 375>>5 byte 88 \b, extended 376>>7 byte x \b @ L %u 3770 belong&0xFFFFFF00 0x00000100 378>3 byte 0xBA MPEG sequence 379!:mime video/mpeg 380>>4 byte &0x40 \b, v2, program multiplex 381>>4 byte ^0x40 \b, v1, system multiplex 382>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 383>3 byte&0x1F 0x07 MPEG sequence, H.264 video 384>>4 byte 66 \b, baseline 385>>4 byte 77 \b, main 386>>4 byte 88 \b, extended 387>>6 byte x \b @ L %u 388>3 byte 0xB0 MPEG sequence, v4 389!:mime video/mpeg4-generic 390>>5 belong 0x000001B5 391>>>9 byte &0x80 392>>>>10 byte&0xF0 16 \b, video 393>>>>10 byte&0xF0 32 \b, still texture 394>>>>10 byte&0xF0 48 \b, mesh 395>>>>10 byte&0xF0 64 \b, face 396>>>9 byte&0xF8 8 \b, video 397>>>9 byte&0xF8 16 \b, still texture 398>>>9 byte&0xF8 24 \b, mesh 399>>>9 byte&0xF8 32 \b, face 400>>4 byte 1 \b, simple @ L1 401>>4 byte 2 \b, simple @ L2 402>>4 byte 3 \b, simple @ L3 403>>4 byte 4 \b, simple @ L0 404>>4 byte 17 \b, simple scalable @ L1 405>>4 byte 18 \b, simple scalable @ L2 406>>4 byte 33 \b, core @ L1 407>>4 byte 34 \b, core @ L2 408>>4 byte 50 \b, main @ L2 409>>4 byte 51 \b, main @ L3 410>>4 byte 53 \b, main @ L4 411>>4 byte 66 \b, n-bit @ L2 412>>4 byte 81 \b, scalable texture @ L1 413>>4 byte 97 \b, simple face animation @ L1 414>>4 byte 98 \b, simple face animation @ L2 415>>4 byte 99 \b, simple face basic animation @ L1 416>>4 byte 100 \b, simple face basic animation @ L2 417>>4 byte 113 \b, basic animation text @ L1 418>>4 byte 114 \b, basic animation text @ L2 419>>4 byte 129 \b, hybrid @ L1 420>>4 byte 130 \b, hybrid @ L2 421>>4 byte 145 \b, advanced RT simple @ L! 422>>4 byte 146 \b, advanced RT simple @ L2 423>>4 byte 147 \b, advanced RT simple @ L3 424>>4 byte 148 \b, advanced RT simple @ L4 425>>4 byte 161 \b, core scalable @ L1 426>>4 byte 162 \b, core scalable @ L2 427>>4 byte 163 \b, core scalable @ L3 428>>4 byte 177 \b, advanced coding efficiency @ L1 429>>4 byte 178 \b, advanced coding efficiency @ L2 430>>4 byte 179 \b, advanced coding efficiency @ L3 431>>4 byte 180 \b, advanced coding efficiency @ L4 432>>4 byte 193 \b, advanced core @ L1 433>>4 byte 194 \b, advanced core @ L2 434>>4 byte 209 \b, advanced scalable texture @ L1 435>>4 byte 210 \b, advanced scalable texture @ L2 436>>4 byte 211 \b, advanced scalable texture @ L3 437>>4 byte 225 \b, simple studio @ L1 438>>4 byte 226 \b, simple studio @ L2 439>>4 byte 227 \b, simple studio @ L3 440>>4 byte 228 \b, simple studio @ L4 441>>4 byte 229 \b, core studio @ L1 442>>4 byte 230 \b, core studio @ L2 443>>4 byte 231 \b, core studio @ L3 444>>4 byte 232 \b, core studio @ L4 445>>4 byte 240 \b, advanced simple @ L0 446>>4 byte 241 \b, advanced simple @ L1 447>>4 byte 242 \b, advanced simple @ L2 448>>4 byte 243 \b, advanced simple @ L3 449>>4 byte 244 \b, advanced simple @ L4 450>>4 byte 245 \b, advanced simple @ L5 451>>4 byte 247 \b, advanced simple @ L3b 452>>4 byte 248 \b, FGS @ L0 453>>4 byte 249 \b, FGS @ L1 454>>4 byte 250 \b, FGS @ L2 455>>4 byte 251 \b, FGS @ L3 456>>4 byte 252 \b, FGS @ L4 457>>4 byte 253 \b, FGS @ L5 458>3 byte 0xB5 MPEG sequence, v4 459>>4 byte &0x80 460>>>5 byte&0xF0 16 \b, video (missing profile header) 461>>>5 byte&0xF0 32 \b, still texture (missing profile header) 462>>>5 byte&0xF0 48 \b, mesh (missing profile header) 463>>>5 byte&0xF0 64 \b, face (missing profile header) 464>>4 byte&0xF8 8 \b, video (missing profile header) 465>>4 byte&0xF8 16 \b, still texture (missing profile header) 466>>4 byte&0xF8 24 \b, mesh (missing profile header) 467>>4 byte&0xF8 32 \b, face (missing profile header) 468>3 byte 0xB3 MPEG sequence 469>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 470>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 471>>12 belong 0x000001B5 \b, v2, 472>>>16 byte&0x0F 1 \b HP 473>>>16 byte&0x0F 2 \b Spt 474>>>16 byte&0x0F 3 \b SNR 475>>>16 byte&0x0F 4 \b MP 476>>>16 byte&0x0F 5 \b SP 477>>>17 byte&0xF0 64 \b@HL 478>>>17 byte&0xF0 96 \b@H-14 479>>>17 byte&0xF0 128 \b@ML 480>>>17 byte&0xF0 160 \b@LL 481>>>17 byte &0x08 \b progressive 482>>>17 byte ^0x08 \b interlaced 483>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 484>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 485>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 486>>11 byte &0x02 487>>>75 byte &0x01 488>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 489>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 490>>>>140 belong 0x000001B5 \b, v2, 491>>>>>144 byte&0x0F 1 \b HP 492>>>>>144 byte&0x0F 2 \b Spt 493>>>>>144 byte&0x0F 3 \b SNR 494>>>>>144 byte&0x0F 4 \b MP 495>>>>>144 byte&0x0F 5 \b SP 496>>>>>145 byte&0xF0 64 \b@HL 497>>>>>145 byte&0xF0 96 \b@H-14 498>>>>>145 byte&0xF0 128 \b@ML 499>>>>>145 byte&0xF0 160 \b@LL 500>>>>>145 byte &0x08 \b progressive 501>>>>>145 byte ^0x08 \b interlaced 502>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 503>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 504>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 505>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 506>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 507>>76 belong 0x000001B5 \b, v2, 508>>>80 byte&0x0F 1 \b HP 509>>>80 byte&0x0F 2 \b Spt 510>>>80 byte&0x0F 3 \b SNR 511>>>80 byte&0x0F 4 \b MP 512>>>80 byte&0x0F 5 \b SP 513>>>81 byte&0xF0 64 \b@HL 514>>>81 byte&0xF0 96 \b@H-14 515>>>81 byte&0xF0 128 \b@ML 516>>>81 byte&0xF0 160 \b@LL 517>>>81 byte &0x08 \b progressive 518>>>81 byte ^0x08 \b interlaced 519>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 520>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 521>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 522>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 523>>>7 byte&0xF0 0x10 \b, 16:9 524>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 525>>>7 byte&0xF0 0x10 \b, 16:9 526>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 527>>>7 byte&0xF0 0x10 \b, 4:3 528>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 529>>>5 beshort&0x0FFF 0x01E0 \b NTSC 530>>>5 beshort&0x0FFF 0x0240 \b PAL 531>>>7 byte&0xF0 0x20 \b, 4:3 532>>>7 byte&0xF0 0x30 \b, 16:9 533>>>7 byte&0xF0 0x40 \b, 11:5 534>>>7 byte&0xF0 0x80 \b, PAL 4:3 535>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 536>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 537>>>7 byte&0xF0 0x10 \b, 4:3 538>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 539>>>7 byte&0xF0 0x10 \b, 4:3 540>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 541>>>7 byte&0xF0 0x10 \b, 4:3 542>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 543>>>7 byte&0xF0 0x10 \b, 4:3 544>>4 beshort&0xFFF0 0x1600 \b, CIF 545>>>5 beshort&0x0FFF 0x00F0 \b NTSC 546>>>5 beshort&0x0FFF 0x0120 \b PAL 547>>>7 byte&0xF0 0x20 \b, 4:3 548>>>7 byte&0xF0 0x30 \b, 16:9 549>>>7 byte&0xF0 0x40 \b, 11:5 550>>>7 byte&0xF0 0x80 \b, PAL 4:3 551>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 552>>>5 beshort&0x0FFF 0x0240 \b PAL 625 553>>>>7 byte&0xF0 0x20 \b, 4:3 554>>>>7 byte&0xF0 0x30 \b, 16:9 555>>>>7 byte&0xF0 0x40 \b, 11:5 556>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 557>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 558>>>5 beshort&0x0FFF 0x0240 \b PAL 625 559>>>7 byte&0xF0 0x20 \b, 4:3 560>>>7 byte&0xF0 0x30 \b, 16:9 561>>>7 byte&0xF0 0x40 \b, 11:5 562>>4 beshort&0xFFF0 0x1E00 \b, SVCD 563>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 564>>>5 beshort&0x0FFF 0x0240 \b PAL 625 565>>>7 byte&0xF0 0x20 \b, 4:3 566>>>7 byte&0xF0 0x30 \b, 16:9 567>>>7 byte&0xF0 0x40 \b, 11:5 568>>7 byte&0x0F 1 \b, 23.976 fps 569>>7 byte&0x0F 2 \b, 24 fps 570>>7 byte&0x0F 3 \b, 25 fps 571>>7 byte&0x0F 4 \b, 29.97 fps 572>>7 byte&0x0F 5 \b, 30 fps 573>>7 byte&0x0F 6 \b, 50 fps 574>>7 byte&0x0F 7 \b, 59.94 fps 575>>7 byte&0x0F 8 \b, 60 fps 576>>11 byte &0x04 \b, Constrained 577 578# MPEG ADTS Audio (*.mpx/mxa/aac) 579# from dreesen@math.fu-berlin.de 580# modified to fully support MPEG ADTS 581 582# MP3, M1A 583# modified by Joerg Jenderek 584# GRR the original test are too common for many DOS files 585# so don't accept as MP3 until we've tested the rate 5860 beshort&0xFFFE 0xFFFA 587# rates 588>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 589!:mime audio/mpeg 590>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 591!:mime audio/mpeg 592>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 593!:mime audio/mpeg 594>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 595!:mime audio/mpeg 596>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 597!:mime audio/mpeg 598>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 599!:mime audio/mpeg 600>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 601!:mime audio/mpeg 602>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 603!:mime audio/mpeg 604>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 605!:mime audio/mpeg 606>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 607!:mime audio/mpeg 608>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 609!:mime audio/mpeg 610>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 611!:mime audio/mpeg 612>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 613!:mime audio/mpeg 614>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 615!:mime audio/mpeg 616# timing 617>2 byte&0x0C 0x00 \b, 44.1 kHz 618>2 byte&0x0C 0x04 \b, 48 kHz 619>2 byte&0x0C 0x08 \b, 32 kHz 620# channels/options 621>3 byte&0xC0 0x00 \b, Stereo 622>3 byte&0xC0 0x40 \b, JntStereo 623>3 byte&0xC0 0x80 \b, 2x Monaural 624>3 byte&0xC0 0xC0 \b, Monaural 625#>1 byte ^0x01 \b, Data Verify 626#>2 byte &0x02 \b, Packet Pad 627#>2 byte &0x01 \b, Custom Flag 628#>3 byte &0x08 \b, Copyrighted 629#>3 byte &0x04 \b, Original Source 630#>3 byte&0x03 1 \b, NR: 50/15 ms 631#>3 byte&0x03 3 \b, NR: CCIT J.17 632 633# MP2, M1A 6340 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 635!:mime audio/mpeg 636# rates 637>2 byte&0xF0 0x10 \b, 32 kbps 638>2 byte&0xF0 0x20 \b, 48 kbps 639>2 byte&0xF0 0x30 \b, 56 kbps 640>2 byte&0xF0 0x40 \b, 64 kbps 641>2 byte&0xF0 0x50 \b, 80 kbps 642>2 byte&0xF0 0x60 \b, 96 kbps 643>2 byte&0xF0 0x70 \b, 112 kbps 644>2 byte&0xF0 0x80 \b, 128 kbps 645>2 byte&0xF0 0x90 \b, 160 kbps 646>2 byte&0xF0 0xA0 \b, 192 kbps 647>2 byte&0xF0 0xB0 \b, 224 kbps 648>2 byte&0xF0 0xC0 \b, 256 kbps 649>2 byte&0xF0 0xD0 \b, 320 kbps 650>2 byte&0xF0 0xE0 \b, 384 kbps 651# timing 652>2 byte&0x0C 0x00 \b, 44.1 kHz 653>2 byte&0x0C 0x04 \b, 48 kHz 654>2 byte&0x0C 0x08 \b, 32 kHz 655# channels/options 656>3 byte&0xC0 0x00 \b, Stereo 657>3 byte&0xC0 0x40 \b, JntStereo 658>3 byte&0xC0 0x80 \b, 2x Monaural 659>3 byte&0xC0 0xC0 \b, Monaural 660#>1 byte ^0x01 \b, Data Verify 661#>2 byte &0x02 \b, Packet Pad 662#>2 byte &0x01 \b, Custom Flag 663#>3 byte &0x08 \b, Copyrighted 664#>3 byte &0x04 \b, Original Source 665#>3 byte&0x03 1 \b, NR: 50/15 ms 666#>3 byte&0x03 3 \b, NR: CCIT J.17 667 668# MPA, M1A 669# updated by Joerg Jenderek 670# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 671# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 672# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 673#0 beshort&0xFFFE 0xFFFE 674#>2 ubyte&0xF0 >0x0F 675#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 676## rate 677#>>>2 byte&0xF0 0x10 \b, 32 kbps 678#>>>2 byte&0xF0 0x20 \b, 64 kbps 679#>>>2 byte&0xF0 0x30 \b, 96 kbps 680#>>>2 byte&0xF0 0x40 \b, 128 kbps 681#>>>2 byte&0xF0 0x50 \b, 160 kbps 682#>>>2 byte&0xF0 0x60 \b, 192 kbps 683#>>>2 byte&0xF0 0x70 \b, 224 kbps 684#>>>2 byte&0xF0 0x80 \b, 256 kbps 685#>>>2 byte&0xF0 0x90 \b, 288 kbps 686#>>>2 byte&0xF0 0xA0 \b, 320 kbps 687#>>>2 byte&0xF0 0xB0 \b, 352 kbps 688#>>>2 byte&0xF0 0xC0 \b, 384 kbps 689#>>>2 byte&0xF0 0xD0 \b, 416 kbps 690#>>>2 byte&0xF0 0xE0 \b, 448 kbps 691## timing 692#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 693#>>>2 byte&0x0C 0x04 \b, 48 kHz 694#>>>2 byte&0x0C 0x08 \b, 32 kHz 695## channels/options 696#>>>3 byte&0xC0 0x00 \b, Stereo 697#>>>3 byte&0xC0 0x40 \b, JntStereo 698#>>>3 byte&0xC0 0x80 \b, 2x Monaural 699#>>>3 byte&0xC0 0xC0 \b, Monaural 700##>1 byte ^0x01 \b, Data Verify 701##>2 byte &0x02 \b, Packet Pad 702##>2 byte &0x01 \b, Custom Flag 703##>3 byte &0x08 \b, Copyrighted 704##>3 byte &0x04 \b, Original Source 705##>3 byte&0x03 1 \b, NR: 50/15 ms 706##>3 byte&0x03 3 \b, NR: CCIT J.17 707 708# MP3, M2A 7090 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 710!:mime audio/mpeg 711# rate 712>2 byte&0xF0 0x10 \b, 8 kbps 713>2 byte&0xF0 0x20 \b, 16 kbps 714>2 byte&0xF0 0x30 \b, 24 kbps 715>2 byte&0xF0 0x40 \b, 32 kbps 716>2 byte&0xF0 0x50 \b, 40 kbps 717>2 byte&0xF0 0x60 \b, 48 kbps 718>2 byte&0xF0 0x70 \b, 56 kbps 719>2 byte&0xF0 0x80 \b, 64 kbps 720>2 byte&0xF0 0x90 \b, 80 kbps 721>2 byte&0xF0 0xA0 \b, 96 kbps 722>2 byte&0xF0 0xB0 \b, 112 kbps 723>2 byte&0xF0 0xC0 \b, 128 kbps 724>2 byte&0xF0 0xD0 \b, 144 kbps 725>2 byte&0xF0 0xE0 \b, 160 kbps 726# timing 727>2 byte&0x0C 0x00 \b, 22.05 kHz 728>2 byte&0x0C 0x04 \b, 24 kHz 729>2 byte&0x0C 0x08 \b, 16 kHz 730# channels/options 731>3 byte&0xC0 0x00 \b, Stereo 732>3 byte&0xC0 0x40 \b, JntStereo 733>3 byte&0xC0 0x80 \b, 2x Monaural 734>3 byte&0xC0 0xC0 \b, Monaural 735#>1 byte ^0x01 \b, Data Verify 736#>2 byte &0x02 \b, Packet Pad 737#>2 byte &0x01 \b, Custom Flag 738#>3 byte &0x08 \b, Copyrighted 739#>3 byte &0x04 \b, Original Source 740#>3 byte&0x03 1 \b, NR: 50/15 ms 741#>3 byte&0x03 3 \b, NR: CCIT J.17 742 743# MP2, M2A 7440 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 745# rate 746>2 byte&0xF0 0x10 \b, 8 kbps 747>2 byte&0xF0 0x20 \b, 16 kbps 748>2 byte&0xF0 0x30 \b, 24 kbps 749>2 byte&0xF0 0x40 \b, 32 kbps 750>2 byte&0xF0 0x50 \b, 40 kbps 751>2 byte&0xF0 0x60 \b, 48 kbps 752>2 byte&0xF0 0x70 \b, 56 kbps 753>2 byte&0xF0 0x80 \b, 64 kbps 754>2 byte&0xF0 0x90 \b, 80 kbps 755>2 byte&0xF0 0xA0 \b, 96 kbps 756>2 byte&0xF0 0xB0 \b, 112 kbps 757>2 byte&0xF0 0xC0 \b, 128 kbps 758>2 byte&0xF0 0xD0 \b, 144 kbps 759>2 byte&0xF0 0xE0 \b, 160 kbps 760# timing 761>2 byte&0x0C 0x00 \b, 22.05 kHz 762>2 byte&0x0C 0x04 \b, 24 kHz 763>2 byte&0x0C 0x08 \b, 16 kHz 764# channels/options 765>3 byte&0xC0 0x00 \b, Stereo 766>3 byte&0xC0 0x40 \b, JntStereo 767>3 byte&0xC0 0x80 \b, 2x Monaural 768>3 byte&0xC0 0xC0 \b, Monaural 769#>1 byte ^0x01 \b, Data Verify 770#>2 byte &0x02 \b, Packet Pad 771#>2 byte &0x01 \b, Custom Flag 772#>3 byte &0x08 \b, Copyrighted 773#>3 byte &0x04 \b, Original Source 774#>3 byte&0x03 1 \b, NR: 50/15 ms 775#>3 byte&0x03 3 \b, NR: CCIT J.17 776 777# MPA, M2A 7780 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 779!:mime audio/mpeg 780# rate 781>2 byte&0xF0 0x10 \b, 32 kbps 782>2 byte&0xF0 0x20 \b, 48 kbps 783>2 byte&0xF0 0x30 \b, 56 kbps 784>2 byte&0xF0 0x40 \b, 64 kbps 785>2 byte&0xF0 0x50 \b, 80 kbps 786>2 byte&0xF0 0x60 \b, 96 kbps 787>2 byte&0xF0 0x70 \b, 112 kbps 788>2 byte&0xF0 0x80 \b, 128 kbps 789>2 byte&0xF0 0x90 \b, 144 kbps 790>2 byte&0xF0 0xA0 \b, 160 kbps 791>2 byte&0xF0 0xB0 \b, 176 kbps 792>2 byte&0xF0 0xC0 \b, 192 kbps 793>2 byte&0xF0 0xD0 \b, 224 kbps 794>2 byte&0xF0 0xE0 \b, 256 kbps 795# timing 796>2 byte&0x0C 0x00 \b, 22.05 kHz 797>2 byte&0x0C 0x04 \b, 24 kHz 798>2 byte&0x0C 0x08 \b, 16 kHz 799# channels/options 800>3 byte&0xC0 0x00 \b, Stereo 801>3 byte&0xC0 0x40 \b, JntStereo 802>3 byte&0xC0 0x80 \b, 2x Monaural 803>3 byte&0xC0 0xC0 \b, Monaural 804#>1 byte ^0x01 \b, Data Verify 805#>2 byte &0x02 \b, Packet Pad 806#>2 byte &0x01 \b, Custom Flag 807#>3 byte &0x08 \b, Copyrighted 808#>3 byte &0x04 \b, Original Source 809#>3 byte&0x03 1 \b, NR: 50/15 ms 810#>3 byte&0x03 3 \b, NR: CCIT J.17 811 812# MP3, M25A 8130 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 814!:mime audio/mpeg 815# rate 816>2 byte&0xF0 0x10 \b, 8 kbps 817>2 byte&0xF0 0x20 \b, 16 kbps 818>2 byte&0xF0 0x30 \b, 24 kbps 819>2 byte&0xF0 0x40 \b, 32 kbps 820>2 byte&0xF0 0x50 \b, 40 kbps 821>2 byte&0xF0 0x60 \b, 48 kbps 822>2 byte&0xF0 0x70 \b, 56 kbps 823>2 byte&0xF0 0x80 \b, 64 kbps 824>2 byte&0xF0 0x90 \b, 80 kbps 825>2 byte&0xF0 0xA0 \b, 96 kbps 826>2 byte&0xF0 0xB0 \b, 112 kbps 827>2 byte&0xF0 0xC0 \b, 128 kbps 828>2 byte&0xF0 0xD0 \b, 144 kbps 829>2 byte&0xF0 0xE0 \b, 160 kbps 830# timing 831>2 byte&0x0C 0x00 \b, 11.025 kHz 832>2 byte&0x0C 0x04 \b, 12 kHz 833>2 byte&0x0C 0x08 \b, 8 kHz 834# channels/options 835>3 byte&0xC0 0x00 \b, Stereo 836>3 byte&0xC0 0x40 \b, JntStereo 837>3 byte&0xC0 0x80 \b, 2x Monaural 838>3 byte&0xC0 0xC0 \b, Monaural 839#>1 byte ^0x01 \b, Data Verify 840#>2 byte &0x02 \b, Packet Pad 841#>2 byte &0x01 \b, Custom Flag 842#>3 byte &0x08 \b, Copyrighted 843#>3 byte &0x04 \b, Original Source 844#>3 byte&0x03 1 \b, NR: 50/15 ms 845#>3 byte&0x03 3 \b, NR: CCIT J.17 846 847# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 848 849# Stored AAC streams (instead of the MP4 format) 8500 string ADIF MPEG ADIF, AAC 851!:mime audio/x-hx-aac-adif 852>4 byte &0x80 853>>13 byte &0x10 \b, VBR 854>>13 byte ^0x10 \b, CBR 855>>16 byte&0x1E 0x02 \b, single stream 856>>16 byte&0x1E 0x04 \b, 2 streams 857>>16 byte&0x1E 0x06 \b, 3 streams 858>>16 byte &0x08 \b, 4 or more streams 859>>16 byte &0x10 \b, 8 or more streams 860>>4 byte &0x80 \b, Copyrighted 861>>13 byte &0x40 \b, Original Source 862>>13 byte &0x20 \b, Home Flag 863>4 byte ^0x80 864>>4 byte &0x10 \b, VBR 865>>4 byte ^0x10 \b, CBR 866>>7 byte&0x1E 0x02 \b, single stream 867>>7 byte&0x1E 0x04 \b, 2 streams 868>>7 byte&0x1E 0x06 \b, 3 streams 869>>7 byte &0x08 \b, 4 or more streams 870>>7 byte &0x10 \b, 8 or more streams 871>>4 byte &0x40 \b, Original Stream(s) 872>>4 byte &0x20 \b, Home Source 873 874# Live or stored single AAC stream (used with MPEG-2 systems) 8750 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 876!:mime audio/x-hx-aac-adts 877>1 byte &0x08 \b, v2 878>1 byte ^0x08 \b, v4 879# profile 880>>2 byte &0xC0 \b LTP 881>2 byte&0xc0 0x00 \b Main 882>2 byte&0xc0 0x40 \b LC 883>2 byte&0xc0 0x80 \b SSR 884# timing 885>2 byte&0x3c 0x00 \b, 96 kHz 886>2 byte&0x3c 0x04 \b, 88.2 kHz 887>2 byte&0x3c 0x08 \b, 64 kHz 888>2 byte&0x3c 0x0c \b, 48 kHz 889>2 byte&0x3c 0x10 \b, 44.1 kHz 890>2 byte&0x3c 0x14 \b, 32 kHz 891>2 byte&0x3c 0x18 \b, 24 kHz 892>2 byte&0x3c 0x1c \b, 22.05 kHz 893>2 byte&0x3c 0x20 \b, 16 kHz 894>2 byte&0x3c 0x24 \b, 12 kHz 895>2 byte&0x3c 0x28 \b, 11.025 kHz 896>2 byte&0x3c 0x2c \b, 8 kHz 897# channels 898>2 beshort&0x01c0 0x0040 \b, monaural 899>2 beshort&0x01c0 0x0080 \b, stereo 900>2 beshort&0x01c0 0x00c0 \b, stereo + center 901>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 902>2 beshort&0x01c0 0x0140 \b, surround 903>2 beshort&0x01c0 0x0180 \b, surround + LFE 904>2 beshort &0x01C0 \b, surround + side 905#>1 byte ^0x01 \b, Data Verify 906#>2 byte &0x02 \b, Custom Flag 907#>3 byte &0x20 \b, Original Stream 908#>3 byte &0x10 \b, Home Source 909#>3 byte &0x08 \b, Copyrighted 910 911# Live MPEG-4 audio streams (instead of RTP FlexMux) 9120 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 913!:mime audio/x-mp4a-latm 914#>1 beshort&0x1FFF x \b, %u byte packet 915>3 byte&0xE0 0x40 916>>4 byte&0x3C 0x04 \b, single stream 917>>4 byte&0x3C 0x08 \b, 2 streams 918>>4 byte&0x3C 0x0C \b, 3 streams 919>>4 byte &0x08 \b, 4 or more streams 920>>4 byte &0x20 \b, 8 or more streams 921>3 byte&0xC0 0 922>>4 byte&0x78 0x08 \b, single stream 923>>4 byte&0x78 0x10 \b, 2 streams 924>>4 byte&0x78 0x18 \b, 3 streams 925>>4 byte &0x20 \b, 4 or more streams 926>>4 byte &0x40 \b, 8 or more streams 927# This magic isn't strong enough (matches plausible ISO-8859-1 text) 928#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 929#!:mime audio/x-mp4a-latm 930 931# Summary: FLI animation format 932# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 933# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9344 leshort 0xAF11 935# standard FLI always has 320x200 resolution and 8 bit color 936>8 leshort 320 937>>10 leshort 200 938>>>12 leshort 8 FLI animation, 320x200x8 939!:mime video/x-fli 940>>>>6 leshort x \b, %d frames 941# frame speed is multiple of 1/70s 942>>>>16 leshort x \b, %d/70s per frame 943 944# Summary: FLC animation format 945# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 946# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 9474 leshort 0xAF12 948# standard FLC always use 8 bit color 949>12 leshort 8 FLC animation 950!:mime video/x-flc 951>>8 leshort x \b, %d 952>>10 leshort x \bx%dx8 953>>6 uleshort x \b, %d frames 954>>16 uleshort x \b, %dms per frame 955 956# DL animation format 957# XXX - collision with most `mips' magic 958# 959# I couldn't find a real magic number for these, however, this 960# -appears- to work. Note that it might catch other files, too, so be 961# careful! 962# 963# Note that title and author appear in the two 20-byte chunks 964# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 965# 255 (hex FF)! The DL format is really bad. 966# 967#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 968#!:mime video/x-unknown 969#>42 byte x - %d screens, 970#>43 byte x %d commands 971#0 byte 2 DL version 2 972#!:mime video/x-unknown 973#>1 byte 1 - large format (320x200,1 image/screen), 974#>1 byte 2 - medium format (160x100,4 images/screen), 975#>1 byte >2 - unknown format, 976#>42 byte x %d screens, 977#>43 byte x %d commands 978# Based on empirical evidence, DL version 3 have several nulls following the 979# \003. Most of them start with non-null values at hex offset 0x34 or so. 980#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 981 982# iso 13818 transport stream 983# 984# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 985# (the following is a little bit restrictive and works fine for a stream 986# that starts with PAT properly. it won't work for stream data, that is 987# cut from an input device data right in the middle, but this shouldn't 988# disturb) 989# syncbyte 8 bit 0x47 990# error_ind 1 bit - 991# payload_start 1 bit 1 992# priority 1 bit - 993# PID 13 bit 0x0000 994# scrambling 2 bit - 995# adaptfld_ctrl 2 bit 1 or 3 996# conti_count 4 bit 0 9970 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data 998>188 byte !0x47 CORRUPTED 999 1000# DIF digital video file format <mpruett@sgi.com> 10010 belong&0xffffff00 0x1f070000 DIF 1002>4 byte &0x01 (DVCPRO) movie file 1003>4 byte ^0x01 (DV) movie file 1004>3 byte &0x80 (PAL) 1005>3 byte ^0x80 (NTSC) 1006 1007# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 10080 belong 0x3026b275 Microsoft ASF 1009!:mime video/x-ms-asf 1010 1011# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10120 string \x8aMNG MNG video data, 1013!:mime video/x-mng 1014>4 belong !0x0d0a1a0a CORRUPTED, 1015>4 belong 0x0d0a1a0a 1016>>16 belong x %ld x 1017>>20 belong x %ld 1018 1019# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 10200 string \x8bJNG JNG video data, 1021!:mime video/x-jng 1022>4 belong !0x0d0a1a0a CORRUPTED, 1023>4 belong 0x0d0a1a0a 1024>>16 belong x %ld x 1025>>20 belong x %ld 1026 1027# Vivo video (Wolfram Kleff) 10283 string \x0D\x0AVersion:Vivo Vivo video data 1029 1030# VRML (Virtual Reality Modelling Language) 10310 string/w #VRML\ V1.0\ ascii VRML 1 file 1032!:mime model/vrml 10330 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1034!:mime model/vrml 1035 1036# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1037# From Michel Briand <michelbriand@free.fr> 10380 string \<?xml\ version=" 1039!:strength +1 1040>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1041!:mime model/x3d 1042 1043#--------------------------------------------------------------------------- 1044# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1045# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1046# 10470 string HVQM4 %s 1048>6 string >\0 v%s 1049>0 byte x GameCube movie, 1050>0x34 ubeshort x %d x 1051>0x36 ubeshort x %d, 1052>0x26 ubeshort x %dµs, 1053>0x42 ubeshort 0 no audio 1054>0x42 ubeshort >0 %dHz audio 1055 1056# From: "Stefan A. Haubenthal" <polluks@web.de> 10570 string DVDVIDEO-VTS Video title set, 1058>0x21 byte x v%x 10590 string DVDVIDEO-VMG Video manager, 1060>0x21 byte x v%x 1061 1062# From: Behan Webster <behanw@websterwood.com> 1063# NuppelVideo used by Mythtv (*.nuv) 1064# Note: there are two identical stanzas here differing only in the 1065# initial string matched. It used to be done with a regex, but we're 1066# trying to get rid of those. 10670 string NuppelVideo MythTV NuppelVideo 1068>12 string x v%s 1069>20 lelong x (%d 1070>24 lelong x \bx%d), 1071>36 string P \bprogressive, 1072>36 string I \binterlaced, 1073>40 ledouble x \baspect:%.2f, 1074>48 ledouble x \bfps:%.2f 10750 string MythTV MythTV NuppelVideo 1076>12 string x v%s 1077>20 lelong x (%d 1078>24 lelong x \bx%d), 1079>36 string P \bprogressive, 1080>36 string I \binterlaced, 1081>40 ledouble x \baspect:%.2f, 1082>48 ledouble x \bfps:%.2f 1083 1084# MPEG file 1085# MPEG sequences 1086# FIXME: This section is from the old magic.mime file and needs integrating with the rest 10870 belong 0x000001BA 1088>4 byte &0x40 1089!:mime video/mp2p 1090>4 byte ^0x40 1091!:mime video/mpeg 10920 belong 0x000001BB 1093!:mime video/mpeg 10940 belong 0x000001B0 1095!:mime video/mp4v-es 10960 belong 0x000001B5 1097!:mime video/mp4v-es 10980 belong 0x000001B3 1099!:mime video/mpv 11000 belong&0xFF5FFF1F 0x47400010 1101!:mime video/mp2t 11020 belong 0x00000001 1103>4 byte&0x1F 0x07 1104!:mime video/h264 1105 1106# Type: Bink Video 1107# URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container 1108# From: <hoehle@users.sourceforge.net> 2008-07-18 11090 string BIK Bink Video 1110>3 regex =[a-z] rev.%s 1111#>4 ulelong x size %d 1112>20 ulelong x \b, %d 1113>24 ulelong x \bx%d 1114>8 ulelong x \b, %d frames 1115>32 ulelong x at rate %d/ 1116>28 ulelong >1 \b%d 1117>40 ulelong =0 \b, no audio 1118>40 ulelong !0 \b, %d audio track 1119>>40 ulelong !1 \bs 1120# follow properties of the first audio track only 1121>>48 uleshort x %dHz 1122>>51 byte&0x20 0 mono 1123>>51 byte&0x20 !0 stereo 1124#>>51 byte&0x10 0 FFT 1125#>>51 byte&0x10 !0 DCT 1126 1127#------------------------------------------------------------------------------ 1128# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1129# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1130# workspaces) 1131# 11320 long 0100554 APL workspace (Ken's original?) 1133 1134#------------------------------------------------------------------------------ 1135# $File: apple,v 1.23 2009/09/19 16:28:08 christos Exp $ 1136# apple: file(1) magic for Apple file formats 1137# 11380 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 11390 string \x0aGL Binary II (apple ][) data 11400 string \x76\xff Squeezed (apple ][) data 11410 string NuFile NuFile archive (apple ][) data 11420 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 11430 belong 0x00051600 AppleSingle encoded Macintosh file 11440 belong 0x00051607 AppleDouble encoded Macintosh file 1145 1146# Type: Apple Emulator 2IMG format 1147# From: Radek Vokal <rvokal@redhat.com> 11480 string 2IMG Apple ][ 2IMG Disk Image 1149>4 string XGS! \b, XGS 1150>4 string CTKG \b, Catakig 1151>4 string ShIm \b, Sheppy's ImageMaker 1152>4 string WOOF \b, Sweet 16 1153>4 string B2TR \b, Bernie ][ the Rescue 1154>4 string !nfc \b, ASIMOV2 1155>4 string x \b, Unknown Format 1156>0xc byte 00 \b, DOS 3.3 sector order 1157>>0x10 byte 00 \b, Volume 254 1158>>0x10 byte&0x7f x \b, Volume %u 1159>0xc byte 01 \b, ProDOS sector order 1160>>0x14 short x \b, %u Blocks 1161>0xc byte 02 \b, NIB data 1162 1163# magic for Newton PDA package formats 1164# from Ruda Moura <ruda@helllabs.org> 11650 string package0 Newton package, NOS 1.x, 1166>12 belong &0x80000000 AutoRemove, 1167>12 belong &0x40000000 CopyProtect, 1168>12 belong &0x10000000 NoCompression, 1169>12 belong &0x04000000 Relocation, 1170>12 belong &0x02000000 UseFasterCompression, 1171>16 belong x version %d 1172 11730 string package1 Newton package, NOS 2.x, 1174>12 belong &0x80000000 AutoRemove, 1175>12 belong &0x40000000 CopyProtect, 1176>12 belong &0x10000000 NoCompression, 1177>12 belong &0x04000000 Relocation, 1178>12 belong &0x02000000 UseFasterCompression, 1179>16 belong x version %d 1180 11810 string package4 Newton package, 1182>8 byte 8 NOS 1.x, 1183>8 byte 9 NOS 2.x, 1184>12 belong &0x80000000 AutoRemove, 1185>12 belong &0x40000000 CopyProtect, 1186>12 belong &0x10000000 NoCompression, 1187 1188# The following entries for the Apple II are for files that have 1189# been transferred as raw binary data from an Apple, without having 1190# been encapsulated by any of the above archivers. 1191# 1192# In general, Apple II formats are hard to identify because Apple DOS 1193# and especially Apple ProDOS have strong typing in the file system and 1194# therefore programmers never felt much need to include type information 1195# in the files themselves. 1196# 1197# Eric Fischer <enf@pobox.com> 1198 1199# AppleWorks word processor: 1200# 1201# This matches the standard tab stops for an AppleWorks file, but if 1202# a file has a tab stop set in the first four columns this will fail. 1203# 1204# The "O" is really the magic number, but that's so common that it's 1205# necessary to check the tab stops that follow it to avoid false positives. 1206 12074 string O==== AppleWorks word processor data 1208>85 byte&0x01 >0 \b, zoomed 1209>90 byte&0x01 >0 \b, paginated 1210>92 byte&0x01 >0 \b, with mail merge 1211#>91 byte x \b, left margin %d 1212 1213# AppleWorks database: 1214# 1215# This isn't really a magic number, but it's the closest thing to one 1216# that I could find. The 1 and 2 really mean "order in which you defined 1217# categories" and "left to right, top to bottom," respectively; the D and R 1218# mean that the cursor should move either down or right when you press Return. 1219 1220#30 string \x01D AppleWorks database data 1221#30 string \x02D AppleWorks database data 1222#30 string \x01R AppleWorks database data 1223#30 string \x02R AppleWorks database data 1224 1225# AppleWorks spreadsheet: 1226# 1227# Likewise, this isn't really meant as a magic number. The R or C means 1228# row- or column-order recalculation; the A or M means automatic or manual 1229# recalculation. 1230 1231#131 string RA AppleWorks spreadsheet data 1232#131 string RM AppleWorks spreadsheet data 1233#131 string CA AppleWorks spreadsheet data 1234#131 string CM AppleWorks spreadsheet data 1235 1236# Applesoft BASIC: 1237# 1238# This is incredibly sloppy, but will be true if the program was 1239# written at its usual memory location of 2048 and its first line 1240# number is less than 256. Yuck. 1241 12420 belong&0xff00ff 0x80000 Applesoft BASIC program data 1243#>2 leshort x \b, first line number %d 1244 1245# ORCA/EZ assembler: 1246# 1247# This will not identify ORCA/M source files, since those have 1248# some sort of date code instead of the two zero bytes at 6 and 7 1249# XXX Conflicts with ELF 1250#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1251#>5 byte x \b, build number %d 1252 1253# Broderbund Fantavision 1254# 1255# I don't know what these values really mean, but they seem to recur. 1256# Will they cause too many conflicts? 1257 1258# Probably :-) 1259#2 belong&0xFF00FF 0x040008 Fantavision movie data 1260 1261# Some attempts at images. 1262# 1263# These are actually just bit-for-bit dumps of the frame buffer, so 1264# there's really no reasonably way to distinguish them except for their 1265# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1266# or, occasionally, 8184. 1267# 1268# Nevertheless this will manage to catch a lot of images that happen 1269# to have a solid-colored line at the bottom of the screen. 1270 1271# GRR: Magic too weak 1272#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1273#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1274#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1275#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1276#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1277 1278# Beagle Bros. Apple Mechanic fonts 1279 12800 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1281 1282# Apple Universal Disk Image Format (UDIF) - dmg files. 1283# From Johan Gade. 1284# These entries are disabled for now until we fix the following issues. 1285# 1286# Note there might be some problems with the "VAX COFF executable" 1287# entry. Note this entry should be placed before the mac filesystem section, 1288# particularly the "Apple Partition data" entry. 1289# 1290# The intended meaning of these tests is, that the file is only of the 1291# specified type if both of the lines are correct - i.e. if the first 1292# line matches and the second doesn't then it is not of that type. 1293# 1294#0 long 0x7801730d 1295#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1296# 1297# Note that this entry is recognized correctly by the "Apple Partition 1298# data" entry - however since this entry is more specific - this 1299# information seems to be more useful. 1300#0 long 0x45520200 1301#>0x410 string disk\ image UDIF read/write image (UDRW) 1302 1303# From: Toby Peterson <toby@apple.com> 13040 string bplist00 Apple binary property list 1305 1306# Apple binary property list (bplist) 1307# Assumes version bytes are hex. 1308# Provides content hints for version 0 files. Assumes that the root 1309# object is the first object (true for CoreFoundation implementation). 1310# From: David Remahl <dremahl@apple.com> 13110 string bplist 1312>6 byte x \bCoreFoundation binary property list data, version 0x%c 1313>>7 byte x \b%c 1314>6 string 00 \b 1315>>8 byte&0xF0 0x00 \b 1316>>>8 byte&0x0F 0x00 \b, root type: null 1317>>>8 byte&0x0F 0x08 \b, root type: false boolean 1318>>>8 byte&0x0F 0x09 \b, root type: true boolean 1319>>8 byte&0xF0 0x10 \b, root type: integer 1320>>8 byte&0xF0 0x20 \b, root type: real 1321>>8 byte&0xF0 0x30 \b, root type: date 1322>>8 byte&0xF0 0x40 \b, root type: data 1323>>8 byte&0xF0 0x50 \b, root type: ascii string 1324>>8 byte&0xF0 0x60 \b, root type: unicode string 1325>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1326>>8 byte&0xF0 0xa0 \b, root type: array 1327>>8 byte&0xF0 0xd0 \b, root type: dictionary 1328 1329# Apple/NeXT typedstream data 1330# Serialization format used by NeXT and Apple for various 1331# purposes in YellowStep/Cocoa, including some nib files. 1332# From: David Remahl <dremahl@apple.com> 13332 string typedstream NeXT/Apple typedstream data, big endian 1334>0 byte x \b, version %hhd 1335>0 byte <5 \b 1336>>13 byte 0x81 \b 1337>>>14 ubeshort x \b, system %hd 13382 string streamtyped NeXT/Apple typedstream data, little endian 1339>0 byte x \b, version %hhd 1340>0 byte <5 \b 1341>>13 byte 0x81 \b 1342>>>14 uleshort x \b, system %hd 1343 1344#------------------------------------------------------------------------------ 1345# CAF: Apple CoreAudio File Format 1346# 1347# Container format for high-end audio purposes. 1348# From: David Remahl <dremahl@apple.com> 1349# 13500 string caff CoreAudio Format audio file 1351>4 beshort <10 version %d 1352>6 beshort x 1353 1354 1355#------------------------------------------------------------------------------ 1356# Keychain database files 13570 string kych Mac OS X Keychain File 1358 1359#------------------------------------------------------------------------------ 1360# Code Signing related file types 13610 belong 0xfade0c00 Mac OS X Code Requirement 1362>8 belong 1 (opExpr) 1363>4 belong x - %d bytes 1364 13650 belong 0xfade0c01 Mac OS X Code Requirement Set 1366>8 belong >1 containing %d items 1367>4 belong x - %d bytes 1368 13690 belong 0xfade0c02 Mac OS X Code Directory 1370>8 belong x version %x 1371>12 belong >0 flags 0x%x 1372>4 belong x - %d bytes 1373 13740 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1375>4 belong x - %d bytes 1376 13770 belong 0xfade0cc1 Mac OS X Detached Code Signature 1378>8 belong >1 (%d elements) 1379>4 belong x - %d bytes 1380 1381# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1382# .vdi 13834 string innotek\ VirtualBox\ Disk\ Image %s 1384 1385#------------------------------------------------------------------------------ 1386# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 1387# applix: file(1) magic for Applixware 1388# From: Peter Soos <sp@osb.hu> 1389# 13900 string *BEGIN Applixware 1391>7 string WORDS Words Document 1392>7 string GRAPHICS Graphic 1393>7 string RASTER Bitmap 1394>7 string SPREADSHEETS Spreadsheet 1395>7 string MACRO Macro 1396>7 string BUILDER Builder Object 1397 1398#------------------------------------------------------------------------------ 1399# $File: archive,v 1.55 2009/12/04 15:00:47 christos Exp $ 1400# archive: file(1) magic for archive formats (see also "msdos" for self- 1401# extracting compressed archives) 1402# 1403# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 1404# pre-POSIX "tar" archives are handled in the C code. 1405 1406# POSIX tar archives 1407257 string ustar\0 POSIX tar archive 1408!:mime application/x-tar # encoding: posix 1409257 string ustar\040\040\0 GNU tar archive 1410!:mime application/x-tar # encoding: gnu 1411 1412# cpio archives 1413# 1414# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 1415# The idea is to indicate archives produced on machines with the same 1416# byte order as the machine running "file" with "cpio archive", and 1417# to indicate archives produced on machines with the opposite byte order 1418# from the machine running "file" with "byte-swapped cpio archive". 1419# 1420# The SVR4 "cpio(4)" hints that there are additional formats, but they 1421# are defined as "short"s; I think all the new formats are 1422# character-header formats and thus are strings, not numbers. 14230 short 070707 cpio archive 1424!:mime application/x-cpio 14250 short 0143561 byte-swapped cpio archive 1426!:mime application/x-cpio # encoding: swapped 14270 string 070707 ASCII cpio archive (pre-SVR4 or odc) 14280 string 070701 ASCII cpio archive (SVR4 with no CRC) 14290 string 070702 ASCII cpio archive (SVR4 with CRC) 1430 1431# Debian package (needs to go before regular portable archives) 1432# 14330 string =!<arch>\ndebian 1434!:mime application/x-debian-package 1435>8 string debian-split part of multipart Debian package 1436>8 string debian-binary Debian binary package 1437>8 string !debian 1438>68 string >\0 (format %s) 1439# These next two lines do not work, because a bzip2 Debian archive 1440# still uses gzip for the control.tar (first in the archive). Only 1441# data.tar varies, and the location of its filename varies too. 1442# file/libmagic does not current have support for ascii-string based 1443# (offsets) as of 2005-09-15. 1444#>81 string bz2 \b, uses bzip2 compression 1445#>84 string gz \b, uses gzip compression 1446#>136 ledate x created: %s 1447 1448# other archives 14490 long 0177555 very old archive 14500 short 0177555 very old PDP-11 archive 14510 long 0177545 old archive 14520 short 0177545 old PDP-11 archive 14530 long 0100554 apl workspace 14540 string =<ar> archive 1455!:mime application/x-archive 1456 1457# MIPS archive (needs to go before regular portable archives) 1458# 14590 string =!<arch>\n__________E MIPS archive 1460>20 string U with MIPS Ucode members 1461>21 string L with MIPSEL members 1462>21 string B with MIPSEB members 1463>19 string L and an EL hash table 1464>19 string B and an EB hash table 1465>22 string X -- out of date 1466 14670 search/1 -h- Software Tools format archive text 1468 1469# 1470# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 1471# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 1472# 1473# 0 string =!<arch> current ar archive 1474# 0 long 0x213c6172 archive file 1475# 1476# and for SVR1 archives, we have: 1477# 1478# 0 string \<ar> System V Release 1 ar archive 1479# 0 string =<ar> archive 1480# 1481# XXX - did Aegis really store shared libraries, breakpointed modules, 1482# and absolute code program modules in the same format as new-style 1483# "ar" archives? 1484# 14850 string =!<arch> current ar archive 1486!:mime application/x-archive 1487>8 string __.SYMDEF random library 1488>0 belong =65538 - pre SR9.5 1489>0 belong =65539 - post SR9.5 1490>0 beshort 2 - object archive 1491>0 beshort 3 - shared library module 1492>0 beshort 4 - debug break-pointed module 1493>0 beshort 5 - absolute code program module 14940 string \<ar> System V Release 1 ar archive 14950 string =<ar> archive 1496# 1497# XXX - from "vax", which appears to collect a bunch of byte-swapped 1498# thingies, to help you recognize VAX files on big-endian machines; 1499# with "leshort", "lelong", and "string", that's no longer necessary.... 1500# 15010 belong 0x65ff0000 VAX 3.0 archive 15020 belong 0x3c61723e VAX 5.0 archive 1503# 15040 long 0x213c6172 archive file 15050 lelong 0177555 very old VAX archive 15060 leshort 0177555 very old PDP-11 archive 1507# 1508# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 1509# be a random library (it said 0xff65 rather than 0177545). 1510# 15110 lelong 0177545 old VAX archive 1512>8 string __.SYMDEF random library 15130 leshort 0177545 old PDP-11 archive 1514>8 string __.SYMDEF random library 1515# 1516# From "pdp" (but why a 4-byte quantity?) 1517# 15180 lelong 0x39bed PDP-11 old archive 15190 lelong 0x39bee PDP-11 4.0 archive 1520 1521# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 1522# 1523# The first byte is the magic (0x1a), byte 2 is the compression type for 1524# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 1525# filename of the first file (null terminated). Since some types collide 1526# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 1527# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 15280 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 1529!:mime application/x-arc 15300 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 1531!:mime application/x-arc 15320 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 1533!:mime application/x-arc 15340 lelong&0x8080ffff 0x0000031a ARC archive data, packed 1535!:mime application/x-arc 15360 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 1537!:mime application/x-arc 15380 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 1539!:mime application/x-arc 1540# [JW] stuff taken from idarc, obviously ARC successors: 15410 lelong&0x8080ffff 0x00000a1a PAK archive data 1542!:mime application/x-arc 15430 lelong&0x8080ffff 0x0000141a ARC+ archive data 1544!:mime application/x-arc 15450 lelong&0x8080ffff 0x0000481a HYP archive data 1546!:mime application/x-arc 1547 1548# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 1549# I can't create either SPARK or ArcFS archives so I have not tested this stuff 1550# [GRR: the original entries collide with ARC, above; replaced with combined 1551# version (not tested)] 1552#0 byte 0x1a RISC OS archive (spark format) 15530 string \032archive RISC OS archive (ArcFS format) 15540 string Archive\000 RISC OS archive (ArcFS format) 1555 1556# All these were taken from idarc, many could not be verified. Unfortunately, 1557# there were many low-quality sigs, i.e. easy to trigger false positives. 1558# Please notify me of any real-world fishy/ambiguous signatures and I'll try 1559# to get my hands on the actual archiver and see if I find something better. [JW] 1560# probably many can be enhanced by finding some 0-byte or control char near the start 1561 1562# idarc calls this Crush/Uncompressed... *shrug* 15630 string CRUSH Crush archive data 1564# Squeeze It (.sqz) 15650 string HLSQZ Squeeze It archive data 1566# SQWEZ 15670 string SQWEZ SQWEZ archive data 1568# HPack (.hpk) 15690 string HPAK HPack archive data 1570# HAP 15710 string \x91\x33HF HAP archive data 1572# MD/MDCD 15730 string MDmd MDCD archive data 1574# LIM 15750 string LIM\x1a LIM archive data 1576# SAR 15773 string LH5 SAR archive data 1578# BSArc/BS2 15790 string \212\3SB \0 BSArc/BS2 archive data 1580# MAR 15812 string =-ah MAR archive data 1582# ACB 15830 belong&0x00f800ff 0x00800000 ACB archive data 1584# CPZ 1585# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 1586# JRC 15870 string JRchive JRC archive data 1588# Quantum 15890 string DS\0 Quantum archive data 1590# ReSOF 15910 string PK\3\6 ReSOF archive data 1592# QuArk 15930 string 7\4 QuArk archive data 1594# YAC 159514 string YC YAC archive data 1596# X1 15970 string X1 X1 archive data 15980 string XhDr X1 archive data 1599# CDC Codec (.dqt) 16000 belong&0xffffe000 0x76ff2000 CDC Codec archive data 1601# AMGC 16020 string \xad6" AMGC archive data 1603# NuLIB 16040 string NõFélå NuLIB archive data 1605# PakLeo 16060 string LEOLZW PAKLeo archive data 1607# ChArc 16080 string SChF ChArc archive data 1609# PSA 16100 string PSA PSA archive data 1611# CrossePAC 16120 string DSIGDCC CrossePAC archive data 1613# Freeze 16140 string \x1f\x9f\x4a\x10\x0a Freeze archive data 1615# KBoom 16160 string ¨MP¨ KBoom archive data 1617# NSQ, must go after CDC Codec 16180 string \x76\xff NSQ archive data 1619# DPA 16200 string Dirk\ Paehl DPA archive data 1621# BA 1622# TODO: idarc says "bytes 0-2 == bytes 3-5" 1623# TTComp 16240 string \0\6 TTComp archive data 1625# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 16260 string ESP ESP archive data 1627# ZPack 16280 string \1ZPK\1 ZPack archive data 1629# Sky 16300 string \xbc\x40 Sky archive data 1631# UFA 16320 string UFA UFA archive data 1633# Dry 16340 string =-H2O DRY archive data 1635# FoxSQZ 16360 string FOXSQZ FoxSQZ archive data 1637# AR7 16380 string ,AR7 AR7 archive data 1639# PPMZ 16400 string PPMZ PPMZ archive data 1641# MS Compress 16424 string \x88\xf0\x27 MS Compress archive data 1643# updated by Joerg Jenderek 1644>9 string \0 1645>>0 string KWAJ 1646>>>7 string \321\003 MS Compress archive data 1647>>>>14 ulong >0 \b, original size: %ld bytes 1648>>>>18 ubyte >0x65 1649>>>>>18 string x \b, was %.8s 1650>>>>>(10.b-4) string x \b.%.3s 1651# MP3 (archiver, not lossy audio compression) 16520 string MP3\x1a MP3-Archiver archive data 1653# ZET 16540 string OZÝ ZET archive data 1655# TSComp 16560 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 1657# ARQ 16580 string gW\4\1 ARQ archive data 1659# Squash 16603 string OctSqu Squash archive data 1661# Terse 16620 string \5\1\1\0 Terse archive data 1663# PUCrunch 16640 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 1665# UHarc 16660 string UHA UHarc archive data 1667# ABComp 16680 string \2AB ABComp archive data 16690 string \3AB2 ABComp archive data 1670# CMP 16710 string CO\0 CMP archive data 1672# Splint 16730 string \x93\xb9\x06 Splint archive data 1674# InstallShield 16750 string \x13\x5d\x65\x8c InstallShield Z archive Data 1676# Gather 16771 string GTH Gather archive data 1678# BOA 16790 string BOA BOA archive data 1680# RAX 16810 string ULEB\xa RAX archive data 1682# Xtreme 16830 string ULEB\0 Xtreme archive data 1684# Pack Magic 16850 string @â\1\0 Pack Magic archive data 1686# BTS 16870 belong&0xfeffffff 0x1a034465 BTS archive data 1688# ELI 5750 16890 string Ora\ ELI 5750 archive data 1690# QFC 16910 string \x1aFC\x1a QFC archive data 16920 string \x1aQF\x1a QFC archive data 1693# PRO-PACK 16940 string RNC PRO-PACK archive data 1695# 777 16960 string 777 777 archive data 1697# LZS221 16980 string sTaC LZS221 archive data 1699# HPA 17000 string HPA HPA archive data 1701# Arhangel 17020 string LG Arhangel archive data 1703# EXP1, uses bzip2 17040 string 0123456789012345BZh EXP1 archive data 1705# IMP 17060 string IMP\xa IMP archive data 1707# NRV 17080 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 1709# Squish 17100 string \x73\xb2\x90\xf4 Squish archive data 1711# Par 17120 string PHILIPP Par archive data 17130 string PAR Par archive data 1714# HIT 17150 string UB HIT archive data 1716# SBX 17170 belong&0xfffff000 0x53423000 SBX archive data 1718# NaShrink 17190 string NSK NaShrink archive data 1720# SAPCAR 17210 string #\ CAR\ archive\ header SAPCAR archive data 17220 string CAR\ 2.00RG SAPCAR archive data 1723# Disintegrator 17240 string DST Disintegrator archive data 1725# ASD 17260 string ASD ASD archive data 1727# InstallShield CAB 17280 string ISc( InstallShield CAB 1729# TOP4 17300 string T4\x1a TOP4 archive data 1731# BatComp left out: sig looks like COM executable 1732# so TODO: get real 4dos batcomp file and find sig 1733# BlakHole 17340 string BH\5\7 BlakHole archive data 1735# BIX 17360 string BIX0 BIX archive data 1737# ChiefLZA 17380 string ChfLZ ChiefLZA archive data 1739# Blink 17400 string Blink Blink archive data 1741# Logitech Compress 17420 string \xda\xfa Logitech Compress archive data 1743# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 17441 string (C)\ STEPANYUK ARS-Sfx archive data 1745# AKT/AKT32 17460 string AKT32 AKT32 archive data 17470 string AKT AKT archive data 1748# NPack 17490 string MSTSM NPack archive data 1750# PFT 17510 string \0\x50\0\x14 PFT archive data 1752# SemOne 17530 string SEM SemOne archive data 1754# PPMD 17550 string \x8f\xaf\xac\x84 PPMD archive data 1756# FIZ 17570 string FIZ FIZ archive data 1758# MSXiE 17590 belong&0xfffff0f0 0x4d530000 MSXiE archive data 1760# DeepFreezer 17610 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 1762# DC 17630 string =<DC- DC archive data 1764# TPac 17650 string \4TPAC\3 TPac archive data 1766# Ai 17670 string Ai\1\1\0 Ai archive data 17680 string Ai\1\0\0 Ai archive data 1769# Ai32 17700 string Ai\2\0 Ai32 archive data 17710 string Ai\2\1 Ai32 archive data 1772# SBC 17730 string SBC SBC archive data 1774# Ybs 17750 string YBS Ybs archive data 1776# DitPack 17770 string \x9e\0\0 DitPack archive data 1778# DMS 17790 string DMS! DMS archive data 1780# EPC 17810 string \x8f\xaf\xac\x8c EPC archive data 1782# VSARC 17830 string VS\x1a VSARC archive data 1784# PDZ 17850 string PDZ PDZ archive data 1786# ReDuq 17870 string rdqx ReDuq archive data 1788# GCA 17890 string GCAX GCA archive data 1790# PPMN 17910 string pN PPMN archive data 1792# WinImage 17933 string WINIMAGE WinImage archive data 1794# Compressia 17950 string CMP0CMP Compressia archive data 1796# UHBC 17970 string UHB UHBC archive data 1798# WinHKI 17990 string \x61\x5C\x04\x05 WinHKI archive data 1800# WWPack data file 18010 string WWP WWPack archive data 1802# BSN (BSA, PTS-DOS) 18030 string \xffBSG BSN archive data 18041 string \xffBSG BSN archive data 18053 string \xffBSG BSN archive data 18061 string \0\xae\2 BSN archive data 18071 string \0\xae\3 BSN archive data 18081 string \0\xae\7 BSN archive data 1809# AIN 18100 string \x33\x18 AIN archive data 18110 string \x33\x17 AIN archive data 1812# XPA32 18130 string xpa\0\1 XPA32 archive data 1814# SZip (TODO: doesn't catch all versions) 18150 string SZ\x0a\4 SZip archive data 1816# XPack DiskImage 18170 string jm XPack DiskImage archive data 1818# XPack Data 18190 string xpa XPack archive data 1820# XPack Single Data 18210 string Í\ jm XPack single archive data 1822 1823# TODO: missing due to unknown magic/magic at end of file: 1824#DWC 1825#ARG 1826#ZAR 1827#PC/3270 1828#InstallIt 1829#RKive 1830#RK 1831#XPack Diskimage 1832 1833# These were inspired by idarc, but actually verified 1834# Dzip archiver (.dz) 18350 string DZ Dzip archive data 1836>2 byte x \b, version %i 1837>3 byte x \b.%i 1838# ZZip archiver (.zz) 18390 string ZZ\ \0\0 ZZip archive data 18400 string ZZ0 ZZip archive data 1841# PAQ archiver (.paq) 18420 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 18430 string PAQ PAQ archive data 1844>3 byte&0xf0 0x30 1845>>3 byte x (v%c) 1846# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 18470xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 18480 string JARCS JAR (ARJ Software, Inc.) archive data 1849 1850# ARJ archiver (jason@jarthur.Claremont.EDU) 18510 leshort 0xea60 ARJ archive data 1852!:mime application/x-arj 1853>5 byte x \b, v%d, 1854>8 byte &0x04 multi-volume, 1855>8 byte &0x10 slash-switched, 1856>8 byte &0x20 backup, 1857>34 string x original name: %s, 1858>7 byte 0 os: MS-DOS 1859>7 byte 1 os: PRIMOS 1860>7 byte 2 os: Unix 1861>7 byte 3 os: Amiga 1862>7 byte 4 os: Macintosh 1863>7 byte 5 os: OS/2 1864>7 byte 6 os: Apple ][ GS 1865>7 byte 7 os: Atari ST 1866>7 byte 8 os: NeXT 1867>7 byte 9 os: VAX/VMS 1868>3 byte >0 %d] 1869# [JW] idarc says this is also possible 18702 leshort 0xea60 ARJ archive data 1871 1872# HA archiver (Greg Roelofs, newt@uchicago.edu) 1873# This is a really bad format. A file containing HAWAII will match this... 1874#0 string HA HA archive data, 1875#>2 leshort =1 1 file, 1876#>2 leshort >1 %u files, 1877#>4 byte&0x0f =0 first is type CPY 1878#>4 byte&0x0f =1 first is type ASC 1879#>4 byte&0x0f =2 first is type HSC 1880#>4 byte&0x0f =0x0e first is type DIR 1881#>4 byte&0x0f =0x0f first is type SPECIAL 1882# suggestion: at least identify small archives (<1024 files) 18830 belong&0xffff00fc 0x48410000 HA archive data 1884>2 leshort =1 1 file, 1885>2 leshort >1 %u files, 1886>4 byte&0x0f =0 first is type CPY 1887>4 byte&0x0f =1 first is type ASC 1888>4 byte&0x0f =2 first is type HSC 1889>4 byte&0x0f =0x0e first is type DIR 1890>4 byte&0x0f =0x0f first is type SPECIAL 1891 1892# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 18930 string HPAK HPACK archive data 1894 1895# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 18960 string \351,\001JAM\ JAM archive, 1897>7 string >\0 version %.4s 1898>0x26 byte =0x27 - 1899>>0x2b string >\0 label %.11s, 1900>>0x27 lelong x serial %08x, 1901>>0x36 string >\0 fstype %.8s 1902 1903# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 19042 string -lh0- LHarc 1.x/ARX archive data [lh0] 1905!:mime application/x-lharc 19062 string -lh1- LHarc 1.x/ARX archive data [lh1] 1907!:mime application/x-lharc 19082 string -lz4- LHarc 1.x archive data [lz4] 1909!:mime application/x-lharc 19102 string -lz5- LHarc 1.x archive data [lz5] 1911!:mime application/x-lharc 1912# [never seen any but the last; -lh4- reported in comp.compression:] 19132 string -lzs- LHa/LZS archive data [lzs] 1914!:mime application/x-lha 19152 string -lh\40- LHa 2.x? archive data [lh ] 1916!:mime application/x-lha 19172 string -lhd- LHa 2.x? archive data [lhd] 1918!:mime application/x-lha 19192 string -lh2- LHa 2.x? archive data [lh2] 1920!:mime application/x-lha 19212 string -lh3- LHa 2.x? archive data [lh3] 1922!:mime application/x-lha 19232 string -lh4- LHa (2.x) archive data [lh4] 1924!:mime application/x-lha 19252 string -lh5- LHa (2.x) archive data [lh5] 1926!:mime application/x-lha 19272 string -lh6- LHa (2.x) archive data [lh6] 1928!:mime application/x-lha 19292 string -lh7- LHa (2.x)/LHark archive data [lh7] 1930!:mime application/x-lha 1931>20 byte x - header level %d 1932# taken from idarc [JW] 19332 string -lZ PUT archive data 19342 string -lz LZS archive data 19352 string -sw1- Swag archive data 1936 1937# RAR archiver (Greg Roelofs, newt@uchicago.edu) 19380 string Rar! RAR archive data, 1939!:mime application/x-rar 1940>44 byte x v%0x, 1941>10 byte >0 flags: 1942>>10 byte &0x01 Archive volume, 1943>>10 byte &0x02 Commented, 1944>>10 byte &0x04 Locked, 1945>>10 byte &0x08 Solid, 1946>>10 byte &0x20 Authenticated, 1947>35 byte 0 os: MS-DOS 1948>35 byte 1 os: OS/2 1949>35 byte 2 os: Win32 1950>35 byte 3 os: Unix 1951# some old version? idarc says: 19520 string RE\x7e\x5e RAR archive data 1953 1954# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 19550 string SQSH squished archive data (Acorn RISCOS) 1956 1957# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 1958# [JW] see exe section for self-extracting version 19590 string UC2\x1a UC2 archive data 1960 1961# PKZIP multi-volume archive 19620 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 1963!:mime application/zip 1964 1965# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 19660 string PK\003\004 1967>30 ubelong !0x6d696d65 1968>>4 byte 0x00 Zip archive data 1969!:mime application/zip 1970>>4 byte 0x09 Zip archive data, at least v0.9 to extract 1971!:mime application/zip 1972>>4 byte 0x0a Zip archive data, at least v1.0 to extract 1973!:mime application/zip 1974>>4 byte 0x0b Zip archive data, at least v1.1 to extract 1975!:mime application/zip 1976>>0x161 string WINZIP Zip archive data, WinZIP self-extracting 1977!:mime application/zip 1978>>4 byte 0x14 Zip archive data, at least v2.0 to extract 1979!:mime application/zip 1980>>4 byte 0x2d Zip64 archive data, at least v3.0 to extract 1981!:mime application/zip 1982 1983# OpenOffice.org / KOffice / StarOffice documents 1984# Listed here because they ARE zip files 1985# 1986# From: Abel Cheung <abel@oaka.org> 1987>30 string mimetype 1988 1989# KOffice (1.2 or above) formats 1990>>50 string vnd.kde. KOffice (>=1.2) 1991>>>58 string karbon Karbon document 1992>>>58 string kchart KChart document 1993>>>58 string kformula KFormula document 1994>>>58 string kivio Kivio document 1995>>>58 string kontour Kontour document 1996>>>58 string kpresenter KPresenter document 1997>>>58 string kspread KSpread document 1998>>>58 string kword KWord document 1999 2000# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2001>>50 string vnd.sun.xml. OpenOffice.org 1.x 2002>>>62 string writer Writer 2003>>>>68 byte !0x2e document 2004>>>>68 string .template template 2005>>>>68 string .global global document 2006>>>62 string calc Calc 2007>>>>66 byte !0x2e spreadsheet 2008>>>>66 string .template template 2009>>>62 string draw Draw 2010>>>>66 byte !0x2e document 2011>>>>66 string .template template 2012>>>62 string impress Impress 2013>>>>69 byte !0x2e presentation 2014>>>>69 string .template template 2015>>>62 string math Math document 2016>>>62 string base Database file 2017 2018# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2019# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2020>>50 string vnd.oasis.opendocument. OpenDocument 2021>>>73 string text 2022>>>>77 byte !0x2d Text 2023!:mime application/vnd.oasis.opendocument.text 2024>>>>77 string -template Text Template 2025!:mime application/vnd.oasis.opendocument.text-template 2026>>>>77 string -web HTML Document Template 2027!:mime application/vnd.oasis.opendocument.text-web 2028>>>>77 string -master Master Document 2029!:mime application/vnd.oasis.opendocument.text-master 2030>>>73 string graphics 2031>>>>81 byte !0x2d Drawing 2032!:mime application/vnd.oasis.opendocument.graphics 2033>>>>81 string -template Template 2034!:mime application/vnd.oasis.opendocument.graphics-template 2035>>>73 string presentation 2036>>>>85 byte !0x2d Presentation 2037!:mime application/vnd.oasis.opendocument.presentation 2038>>>>85 string -template Template 2039!:mime application/vnd.oasis.opendocument.presentation-template 2040>>>73 string spreadsheet 2041>>>>84 byte !0x2d Spreadsheet 2042!:mime application/vnd.oasis.opendocument.spreadsheet 2043>>>>84 string -template Template 2044!:mime application/vnd.oasis.opendocument.spreadsheet-template 2045>>>73 string chart 2046>>>>78 byte !0x2d Chart 2047!:mime application/vnd.oasis.opendocument.chart 2048>>>>78 string -template Template 2049!:mime application/vnd.oasis.opendocument.chart-template 2050>>>73 string formula 2051>>>>80 byte !0x2d Formula 2052!:mime application/vnd.oasis.opendocument.formula 2053>>>>80 string -template Template 2054!:mime application/vnd.oasis.opendocument.formula-template 2055>>>73 string database Database 2056!:mime application/vnd.oasis.opendocument.database 2057>>>73 string image 2058>>>>78 byte !0x2d Image 2059!:mime application/vnd.oasis.opendocument.image 2060>>>>78 string -template Template 2061!:mime application/vnd.oasis.opendocument.image-template 2062 2063# Zoo archiver 206420 lelong 0xfdc4a7dc Zoo archive data 2065!:mime application/x-zoo 2066>4 byte >48 \b, v%c. 2067>>6 byte >47 \b%c 2068>>>7 byte >47 \b%c 2069>32 byte >0 \b, modify: v%d 2070>>33 byte x \b.%d+ 2071>42 lelong 0xfdc4a7dc \b, 2072>>70 byte >0 extract: v%d 2073>>>71 byte x \b.%d+ 2074 2075# Shell archives 207610 string #\ This\ is\ a\ shell\ archive shell archive text 2077!:mime application/octet-stream 2078 2079# 2080# LBR. NB: May conflict with the questionable 2081# "binary Computer Graphics Metafile" format. 2082# 20830 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 2084# 2085# PMA (CP/M derivative of LHA) 2086# 20872 string -pm0- PMarc archive data [pm0] 20882 string -pm1- PMarc archive data [pm1] 20892 string -pm2- PMarc archive data [pm2] 20902 string -pms- PMarc SFX archive (CP/M, DOS) 20915 string -pc1- PopCom compressed executable (CP/M) 2092 2093# From Rafael Laboissiere <rafael@laboissiere.net> 2094# The Project Revision Control System (see 2095# http://prcs.sourceforge.net) generates a packaged project 2096# file which is recognized by the following entry: 20970 leshort 0xeb81 PRCS packaged project 2098 2099# Microsoft cabinets 2100# by David Necas (Yeti) <yeti@physics.muni.cz> 2101#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 2102#>25 byte x v%d 2103#>24 byte x \b.%d 2104# MPi: All CABs have version 1.3, so this is pointless. 2105# Better magic in debian-additions. 2106 2107# GTKtalog catalogs 2108# by David Necas (Yeti) <yeti@physics.muni.cz> 21094 string gtktalog\ GTKtalog catalog data, 2110>13 string 3 version 3 2111>>14 beshort 0x677a (gzipped) 2112>>14 beshort !0x677a (not gzipped) 2113>13 string >3 version %s 2114 2115############################################################################ 2116# Parity archive reconstruction file, the 'par' file format now used on Usenet. 21170 string PAR\0 PARity archive data 2118>48 leshort =0 - Index file 2119>48 leshort >0 - file number %d 2120 2121# Felix von Leitner <felix-file@fefe.de> 21220 string d8:announce BitTorrent file 2123!:mime application/x-bittorrent 2124 2125# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 21260 beshort 0x0e0f Atari MSA archive data 2127>2 beshort x \b, %d sectors per track 2128>4 beshort 0 \b, 1 sided 2129>4 beshort 1 \b, 2 sided 2130>6 beshort x \b, starting track: %d 2131>8 beshort x \b, ending track: %d 2132 2133# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 21340 string PK00PK\003\004 Zip archive data 2135 2136# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 2137# by Stefan `Sec` Zehl <sec@42.org> 21387 string **ACE** ACE archive data 2139>15 byte >0 version %d 2140>16 byte =0x00 \b, from MS-DOS 2141>16 byte =0x01 \b, from OS/2 2142>16 byte =0x02 \b, from Win/32 2143>16 byte =0x03 \b, from Unix 2144>16 byte =0x04 \b, from MacOS 2145>16 byte =0x05 \b, from WinNT 2146>16 byte =0x06 \b, from Primos 2147>16 byte =0x07 \b, from AppleGS 2148>16 byte =0x08 \b, from Atari 2149>16 byte =0x09 \b, from Vax/VMS 2150>16 byte =0x0A \b, from Amiga 2151>16 byte =0x0B \b, from Next 2152>14 byte x \b, version %d to extract 2153>5 leshort &0x0080 \b, multiple volumes, 2154>>17 byte x \b (part %d), 2155>5 leshort &0x0002 \b, contains comment 2156>5 leshort &0x0200 \b, sfx 2157>5 leshort &0x0400 \b, small dictionary 2158>5 leshort &0x0800 \b, multi-volume 2159>5 leshort &0x1000 \b, contains AV-String 2160>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 2161>5 leshort &0x2000 \b, with recovery record 2162>5 leshort &0x4000 \b, locked 2163>5 leshort &0x8000 \b, solid 2164# Date in MS-DOS format (whatever that is) 2165#>18 lelong x Created on 2166 2167# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 2168# <doj@cubic.org> 21690x1A string sfArk sfArk compressed Soundfont 2170>0x15 string 2 2171>>0x1 string >\0 Version %s 2172>>0x2A string >\0 : %s 2173 2174# DR-DOS 7.03 Packed File *.??_ 21750 string Packed\ File\ Personal NetWare Packed File 2176>12 string x \b, was "%.12s" 2177 2178# EET archive 2179# From: Tilman Sauerbeck <tilman@code-monkey.de> 21800 belong 0x1ee7ff00 EET archive 2181!:mime application/x-eet 2182 2183# rzip archives 21840 string RZIP rzip compressed data 2185>4 byte x - version %d 2186>5 byte x \b.%d 2187>6 belong x (%d bytes) 2188 2189# From: "Robert Dale" <robdale@gmail.com> 21900 belong 123 dar archive, 2191>4 belong x label "%.8x 2192>>8 belong x %.8x 2193>>>12 beshort x %.4x" 2194>14 byte 0x54 end slice 2195>14 beshort 0x4e4e multi-part 2196>14 beshort 0x4e53 multi-part, with -S 2197 2198# Symbian installation files 2199# http://www.thouky.co.uk/software/psifs/sis.html 2200# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 22018 lelong 0x10000419 Symbian installation file 2202!:mime application/vnd.symbian.install 2203>4 lelong 0x1000006D (EPOC release 3/4/5) 2204>4 lelong 0x10003A12 (EPOC release 6) 22050 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 2206!:mime x-epoc/x-sisx-app 2207 2208# From "Nelson A. de Oliveira" <naoliv@gmail.com> 22090 string MPQ\032 MoPaQ (MPQ) archive 2210 2211# From: Dirk Jagdmann <doj@cubic.org> 2212# xar archive format: http://code.google.com/p/xar/ 22130 string xar! xar archive 2214>6 beshort x - version %ld 2215 2216# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2217# .kgb 22180 string KGB_arch KGB Archiver file 2219>10 string x with compression level %.1s 2220 2221# xar (eXtensible ARchiver) archive 2222# From: "David Remahl" <dremahl@apple.com> 22230 string xar! xar archive 2224#>4 beshort x header size %d 2225>6 beshort x version %d, 2226#>8 quad x compressed TOC: %d, 2227#>16 quad x uncompressed TOC: %d, 2228>24 belong 0 no checksum 2229>24 belong 1 SHA-1 checksum 2230>24 belong 2 MD5 checksum 2231 2232#------------------------------------------------------------------------------ 2233# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2234# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 2235# strings as "long" - we assume they're just strings: 2236# From: guy@netapp.com (Guy Harris) 2237# 22380 string *STA Aster*x 2239>7 string WORD Words Document 2240>7 string GRAP Graphic 2241>7 string SPRE Spreadsheet 2242>7 string MACR Macro 22430 string 2278 Aster*x Version 2 2244>29 byte 0x36 Words Document 2245>29 byte 0x35 Graphic 2246>29 byte 0x32 Spreadsheet 2247>29 byte 0x38 Macro 2248 2249 2250#------------------------------------------------------------------------------ 2251# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ 2252# att3b: file(1) magic for AT&T 3B machines 2253# 2254# The `versions' should be un-commented if they work for you. 2255# (Was the problem just one of endianness?) 2256# 2257# 3B20 2258# 2259# The 3B20 conflicts with SCCS. 2260#0 beshort 0550 3b20 COFF executable 2261#>12 belong >0 not stripped 2262#>22 beshort >0 - version %ld 2263#0 beshort 0551 3b20 COFF executable (TV) 2264#>12 belong >0 not stripped 2265#>22 beshort >0 - version %ld 2266# 2267# WE32K 2268# 22690 beshort 0560 WE32000 COFF 2270>18 beshort ^00000020 object 2271>18 beshort &00000020 executable 2272>12 belong >0 not stripped 2273>18 beshort ^00010000 N/A on 3b2/300 w/paging 2274>18 beshort &00020000 32100 required 2275>18 beshort &00040000 and MAU hardware required 2276>20 beshort 0407 (impure) 2277>20 beshort 0410 (pure) 2278>20 beshort 0413 (demand paged) 2279>20 beshort 0443 (target shared library) 2280>22 beshort >0 - version %ld 22810 beshort 0561 WE32000 COFF executable (TV) 2282>12 belong >0 not stripped 2283#>18 beshort &00020000 - 32100 required 2284#>18 beshort &00040000 and MAU hardware required 2285#>22 beshort >0 - version %ld 2286# 2287# core file for 3b2 22880 string \000\004\036\212\200 3b2 core file 2289>364 string >\0 of '%s' 2290 2291#------------------------------------------------------------------------------ 2292# $File: audio,v 1.59 2009/11/04 17:27:37 christos Exp $ 2293# audio: file(1) magic for sound formats (see also "iff") 2294# 2295# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 2296# and others 2297# 2298 2299# Sun/NeXT audio data 23000 string .snd Sun/NeXT audio data: 2301>12 belong 1 8-bit ISDN mu-law, 2302!:mime audio/basic 2303>12 belong 2 8-bit linear PCM [REF-PCM], 2304!:mime audio/basic 2305>12 belong 3 16-bit linear PCM, 2306!:mime audio/basic 2307>12 belong 4 24-bit linear PCM, 2308!:mime audio/basic 2309>12 belong 5 32-bit linear PCM, 2310!:mime audio/basic 2311>12 belong 6 32-bit IEEE floating point, 2312!:mime audio/basic 2313>12 belong 7 64-bit IEEE floating point, 2314!:mime audio/basic 2315>12 belong 8 Fragmented sample data, 2316>12 belong 10 DSP program, 2317>12 belong 11 8-bit fixed point, 2318>12 belong 12 16-bit fixed point, 2319>12 belong 13 24-bit fixed point, 2320>12 belong 14 32-bit fixed point, 2321>12 belong 18 16-bit linear with emphasis, 2322>12 belong 19 16-bit linear compressed, 2323>12 belong 20 16-bit linear with emphasis and compression, 2324>12 belong 21 Music kit DSP commands, 2325>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2326!:mime audio/x-adpcm 2327>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2328>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2329>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2330>12 belong 27 8-bit A-law (CCITT G.711), 2331>20 belong 1 mono, 2332>20 belong 2 stereo, 2333>20 belong 4 quad, 2334>16 belong >0 %d Hz 2335 2336# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 2337# that uses little-endian encoding and has a different magic number 23380 lelong 0x0064732E DEC audio data: 2339>12 lelong 1 8-bit ISDN mu-law, 2340!:mime audio/x-dec-basic 2341>12 lelong 2 8-bit linear PCM [REF-PCM], 2342!:mime audio/x-dec-basic 2343>12 lelong 3 16-bit linear PCM, 2344!:mime audio/x-dec-basic 2345>12 lelong 4 24-bit linear PCM, 2346!:mime audio/x-dec-basic 2347>12 lelong 5 32-bit linear PCM, 2348!:mime audio/x-dec-basic 2349>12 lelong 6 32-bit IEEE floating point, 2350!:mime audio/x-dec-basic 2351>12 lelong 7 64-bit IEEE floating point, 2352!:mime audio/x-dec-basic 2353>12 belong 8 Fragmented sample data, 2354>12 belong 10 DSP program, 2355>12 belong 11 8-bit fixed point, 2356>12 belong 12 16-bit fixed point, 2357>12 belong 13 24-bit fixed point, 2358>12 belong 14 32-bit fixed point, 2359>12 belong 18 16-bit linear with emphasis, 2360>12 belong 19 16-bit linear compressed, 2361>12 belong 20 16-bit linear with emphasis and compression, 2362>12 belong 21 Music kit DSP commands, 2363>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2364!:mime audio/x-dec-basic 2365>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2366>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2367>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2368>12 belong 27 8-bit A-law (CCITT G.711), 2369>20 lelong 1 mono, 2370>20 lelong 2 stereo, 2371>20 lelong 4 quad, 2372>16 lelong >0 %d Hz 2373 2374# Creative Labs AUDIO stuff 23750 string MThd Standard MIDI data 2376!:mime audio/midi 2377>8 beshort x (format %d) 2378>10 beshort x using %d track 2379>10 beshort >1 \bs 2380>12 beshort&0x7fff x at 1/%d 2381>12 beshort&0x8000 >0 SMPTE 2382 23830 string CTMF Creative Music (CMF) data 2384!:mime audio/x-unknown 23850 string SBI SoundBlaster instrument data 2386!:mime audio/x-unknown 23870 string Creative\ Voice\ File Creative Labs voice data 2388!:mime audio/x-unknown 2389# is this next line right? it came this way... 2390>19 byte 0x1A 2391>23 byte >0 - version %d 2392>22 byte >0 \b.%d 2393 2394# first entry is also the string "NTRK" 23950 belong 0x4e54524b MultiTrack sound data 2396>4 belong x - version %ld 2397 2398# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 2399# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 24000 string EMOD Extended MOD sound data, 2401>4 byte&0xf0 x version %d 2402>4 byte&0x0f x \b.%d, 2403>45 byte x %d instruments 2404>83 byte 0 (module) 2405>83 byte 1 (song) 2406 2407# Real Audio (Magic .ra\0375) 24080 belong 0x2e7261fd RealAudio sound file 2409!:mime audio/x-pn-realaudio 24100 string .RMF RealMedia file 2411!:mime application/vnd.rn-realmedia 2412#video/x-pn-realvideo 2413#video/vnd.rn-realvideo 2414#application/vnd.rn-realmedia 2415# sigh, there are many mimes for that but the above are the most common. 2416 2417# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 2418# Oct 31, 1995 2419# fixed by <doj@cubic.org> 2003-06-24 2420# Too short... 2421#0 string MTM MultiTracker Module sound file 2422#0 string if Composer 669 Module sound data 2423#0 string JN Composer 669 Module sound data (extended format) 24240 string MAS_U ULT(imate) Module sound data 2425 2426#0 string FAR Module sound data 2427#>4 string >\15 Title: "%s" 2428 24290x2c string SCRM ScreamTracker III Module sound data 2430>0 string >\0 Title: "%s" 2431 2432# Gravis UltraSound patches 2433# From <ache@nagual.ru> 2434 24350 string GF1PATCH110\0ID#000002\0 GUS patch 24360 string GF1PATCH100\0ID#000002\0 Old GUS patch 2437 2438# mime types according to http://www.geocities.com/nevilo/mod.htm: 2439# audio/it .it 2440# audio/x-zipped-it .itz 2441# audio/xm fasttracker modules 2442# audio/x-s3m screamtracker modules 2443# audio/s3m screamtracker modules 2444# audio/x-zipped-mod mdz 2445# audio/mod mod 2446# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 2447 2448# 2449# Taken from loader code from mikmod version 2.14 2450# by Steve McIntyre (stevem@chiark.greenend.org.uk) 2451# <doj@cubic.org> added title printing on 2003-06-24 24520 string MAS_UTrack_V00 2453>14 string >/0 ultratracker V1.%.1s module sound data 2454!:mime audio/x-mod 2455#audio/x-tracker-module 2456 24570 string UN05 MikMod UNI format module sound data 2458 24590 string Extended\ Module: Fasttracker II module sound data 2460!:mime audio/x-mod 2461#audio/x-tracker-module 2462>17 string >\0 Title: "%s" 2463 246421 string/c =!SCREAM! Screamtracker 2 module sound data 2465!:mime audio/x-mod 2466#audio/x-screamtracker-module 246721 string BMOD2STM Screamtracker 2 module sound data 2468!:mime audio/x-mod 2469#audio/x-screamtracker-module 24701080 string M.K. 4-channel Protracker module sound data 2471!:mime audio/x-mod 2472#audio/x-protracker-module 2473>0 string >\0 Title: "%s" 24741080 string M!K! 4-channel Protracker module sound data 2475!:mime audio/x-mod 2476#audio/x-protracker-module 2477>0 string >\0 Title: "%s" 24781080 string FLT4 4-channel Startracker module sound data 2479!:mime audio/x-mod 2480#audio/x-startracker-module 2481>0 string >\0 Title: "%s" 24821080 string FLT8 8-channel Startracker module sound data 2483!:mime audio/x-mod 2484#audio/x-startracker-module 2485>0 string >\0 Title: "%s" 24861080 string 4CHN 4-channel Fasttracker module sound data 2487!:mime audio/x-mod 2488#audio/x-fasttracker-module 2489>0 string >\0 Title: "%s" 24901080 string 6CHN 6-channel Fasttracker module sound data 2491!:mime audio/x-mod 2492#audio/x-fasttracker-module 2493>0 string >\0 Title: "%s" 24941080 string 8CHN 8-channel Fasttracker module sound data 2495!:mime audio/x-mod 2496#audio/x-fasttracker-module 2497>0 string >\0 Title: "%s" 24981080 string CD81 8-channel Octalyser module sound data 2499!:mime audio/x-mod 2500#audio/x-octalysertracker-module 2501>0 string >\0 Title: "%s" 25021080 string OKTA 8-channel Octalyzer module sound data 2503!:mime audio/x-mod 2504#audio/x-octalysertracker-module 2505>0 string >\0 Title: "%s" 2506# Not good enough. 2507#1082 string CH 2508#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 25091080 string 16CN 16-channel Taketracker module sound data 2510!:mime audio/x-mod 2511#audio/x-taketracker-module 2512>0 string >\0 Title: "%s" 25131080 string 32CN 32-channel Taketracker module sound data 2514!:mime audio/x-mod 2515#audio/x-taketracker-module 2516>0 string >\0 Title: "%s" 2517 2518# TOC sound files -Trevor Johnson <trevor@jpj.net> 2519# 25200 string TOC TOC sound file 2521 2522# sidfiles <pooka@iki.fi> 2523# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 25240 string SIDPLAY\ INFOFILE Sidplay info file 2525 25260 string PSID PlaySID v2.2+ (AMIGA) sidtune 2527>4 beshort >0 w/ header v%d, 2528>14 beshort =1 single song, 2529>14 beshort >1 %d songs, 2530>16 beshort >0 default song: %d 2531>0x16 string >\0 name: "%s" 2532>0x36 string >\0 author: "%s" 2533>0x56 string >\0 copyright: "%s" 2534 25350 string RSID RSID sidtune PlaySID compatible 2536>4 beshort >0 w/ header v%d, 2537>14 beshort =1 single song, 2538>14 beshort >1 %d songs, 2539>16 beshort >0 default song: %d 2540>0x16 string >\0 name: "%s" 2541>0x36 string >\0 author: "%s" 2542>0x56 string >\0 copyright: "%s" 2543 2544# IRCAM <mpruett@sgi.com> 2545# VAX and MIPS files are little-endian; Sun and NeXT are big-endian 25460 belong 0x64a30100 IRCAM file (VAX) 25470 belong 0x64a30200 IRCAM file (Sun) 25480 belong 0x64a30300 IRCAM file (MIPS little-endian) 25490 belong 0x64a30400 IRCAM file (NeXT) 2550 2551# NIST SPHERE <mpruett@sgi.com> 25520 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 2553 2554# Sample Vision <mpruett@sgi.com> 25550 string SOUND\ SAMPLE\ DATA\ Sample Vision file 2556 2557# Audio Visual Research <tonigonenstein@users.sourceforge.net> 25580 string 2BIT Audio Visual Research file, 2559>12 beshort =0 mono, 2560>12 beshort =-1 stereo, 2561>14 beshort x %d bits 2562>16 beshort =0 unsigned, 2563>16 beshort =-1 signed, 2564>22 belong&0x00ffffff x %d Hz, 2565>18 beshort =0 no loop, 2566>18 beshort =-1 loop, 2567>21 ubyte <128 note %d, 2568>22 byte =0 replay 5.485 KHz 2569>22 byte =1 replay 8.084 KHz 2570>22 byte =2 replay 10.971 KHz 2571>22 byte =3 replay 16.168 KHz 2572>22 byte =4 replay 21.942 KHz 2573>22 byte =5 replay 32.336 KHz 2574>22 byte =6 replay 43.885 KHz 2575>22 byte =7 replay 47.261 KHz 2576 2577# SGI SoundTrack <mpruett@sgi.com> 25780 string _SGI_SoundTrack SGI SoundTrack project file 2579# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 25800 string ID3 Audio file with ID3 version 2 2581>3 byte x \b.%d 2582>4 byte x \b.%d 2583>>5 byte &0x80 \b, unsynchronized frames 2584>>5 byte &0x40 \b, extended header 2585>>5 byte &0x20 \b, experimental 2586>>5 byte &0x10 \b, footer present 2587>(6.I) indirect x \b, contains: 2588 2589# NSF (NES sound file) magic 25900 string NESM\x1a NES Sound File 2591>14 string >\0 ("%s" by 2592>46 string >\0 %s, copyright 2593>78 string >\0 %s), 2594>5 byte x version %d, 2595>6 byte x %d tracks, 2596>122 byte&0x2 =1 dual PAL/NTSC 2597>122 byte&0x1 =1 PAL 2598>122 byte&0x1 =0 NTSC 2599 2600# Impulse tracker module (audio/x-it) 26010 string IMPM Impulse Tracker module sound data - 2602!:mime audio/x-mod 2603>4 string >\0 "%s" 2604>40 leshort !0 compatible w/ITv%x 2605>42 leshort !0 created w/ITv%x 2606 2607# Imago Orpheus module (audio/x-imf) 260860 string IM10 Imago Orpheus module sound data - 2609>0 string >\0 "%s" 2610 2611# From <collver1@attbi.com> 2612# These are the /etc/magic entries to decode modules, instruments, and 2613# samples in Impulse Tracker's native format. 2614 26150 string IMPS Impulse Tracker Sample 2616>18 byte &2 16 bit 2617>18 byte ^2 8 bit 2618>18 byte &4 stereo 2619>18 byte ^4 mono 26200 string IMPI Impulse Tracker Instrument 2621>28 leshort !0 ITv%x 2622>30 byte !0 %d samples 2623 2624# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 2625# From <collver1@attbi.com> 26260 string LM8953 Yamaha TX Wave 2627>22 byte 0x49 looped 2628>22 byte 0xC9 non-looped 2629>23 byte 1 33kHz 2630>23 byte 2 50kHz 2631>23 byte 3 16kHz 2632 2633# scream tracker: file(1) magic for Scream Tracker sample files 2634# 2635# From <collver1@attbi.com> 263676 string SCRS Scream Tracker Sample 2637>0 byte 1 sample 2638>0 byte 2 adlib melody 2639>0 byte >2 adlib drum 2640>31 byte &2 stereo 2641>31 byte ^2 mono 2642>31 byte &4 16bit little endian 2643>31 byte ^4 8bit 2644>30 byte 0 unpacked 2645>30 byte 1 packed 2646 2647# audio 2648# From: Cory Dikkers <cdikkers@swbell.net> 26490 string MMD0 MED music file, version 0 26500 string MMD1 OctaMED Pro music file, version 1 26510 string MMD3 OctaMED Soundstudio music file, version 3 26520 string OctaMEDCmpr OctaMED Soundstudio compressed file 26530 string MED MED_Song 26540 string SymM Symphonie SymMOD music file 2655# 26560 string THX AHX version 2657>3 byte =0 1 module data 2658>3 byte =1 2 module data 2659# 26600 string OKTASONG Oktalyzer module data 2661# 26620 string DIGI\ Booster\ module\0 %s 2663>20 byte >0 %c 2664>>21 byte >0 \b%c 2665>>>22 byte >0 \b%c 2666>>>>23 byte >0 \b%c 2667>610 string >\0 \b, "%s" 2668# 26690 string DBM0 DIGI Booster Pro Module 2670>4 byte >0 V%X. 2671>>5 byte x \b%02X 2672>16 string >\0 \b, "%s" 2673# 26740 string FTMN FaceTheMusic module 2675>16 string >\0d \b, "%s" 2676 2677# From: <doj@cubic.org> 2003-06-24 26780 string AMShdr\32 Velvet Studio AMS Module v2.2 26790 string Extreme Extreme Tracker AMS Module v1.3 26800 string DDMF Xtracker DMF Module 2681>4 byte x v%i 2682>0xD string >\0 Title: "%s" 2683>0x2B string >\0 Composer: "%s" 26840 string DSM\32 Dynamic Studio Module DSM 26850 string SONG DigiTrekker DTM Module 26860 string DMDL DigiTrakker MDL Module 26870 string PSM\32 Protracker Studio PSM Module 268844 string PTMF Poly Tracker PTM Module 2689>0 string >\32 Title: "%s" 26900 string MT20 MadTracker 2.0 Module MT2 26910 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 26920 string RTMM RTM Module 26930x426 string MaDoKaN96 XMS Adlib Module 2694>0 string >\0 Composer: "%s" 26950 string AMF AMF Module 2696>4 string >\0 Title: "%s" 26970 string MODINFO1 Open Cubic Player Module Inforation MDZ 26980 string Extended\40Instrument: Fast Tracker II Instrument 2699 2700# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 2701# NOA Nancy Codec file 27020 string \210NOA\015\012\032 NOA Nancy Codec Movie file 2703# Yamaha SMAF format 27040 string MMMD Yamaha SMAF file 2705# Sharp Jisaku Melody format for PDC 27060 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 2707>20 string Ver01.00 Ver. 1.00 2708>>32 byte x , %d tracks 2709 2710# Free lossless audio codec <http://flac.sourceforge.net> 2711# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 27120 string fLaC FLAC audio bitstream data 2713!:mime audio/x-flac 2714>4 byte&0x7f >0 \b, unknown version 2715>4 byte&0x7f 0 \b 2716# some common bits/sample values 2717>>20 beshort&0x1f0 0x030 \b, 4 bit 2718>>20 beshort&0x1f0 0x050 \b, 6 bit 2719>>20 beshort&0x1f0 0x070 \b, 8 bit 2720>>20 beshort&0x1f0 0x0b0 \b, 12 bit 2721>>20 beshort&0x1f0 0x0f0 \b, 16 bit 2722>>20 beshort&0x1f0 0x170 \b, 24 bit 2723>>20 byte&0xe 0x0 \b, mono 2724>>20 byte&0xe 0x2 \b, stereo 2725>>20 byte&0xe 0x4 \b, 3 channels 2726>>20 byte&0xe 0x6 \b, 4 channels 2727>>20 byte&0xe 0x8 \b, 5 channels 2728>>20 byte&0xe 0xa \b, 6 channels 2729>>20 byte&0xe 0xc \b, 7 channels 2730>>20 byte&0xe 0xe \b, 8 channels 2731# some common sample rates 2732>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 2733>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 2734>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 2735>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 2736>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 2737>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 2738>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 2739>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 2740>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 2741>>17 belong&0xfffff0 0x177000 \b, 96 kHz 2742>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 2743>>21 byte&0xf >0 \b, >4G samples 2744>>21 byte&0xf 0 \b 2745>>>22 belong >0 \b, %u samples 2746>>>22 belong 0 \b, length unknown 2747 2748# (ISDN) VBOX voice message file (Wolfram Kleff) 27490 string VBOX VBOX voice message data 2750 2751# ReBorn Song Files (.rbs) 2752# David J. Singer <doc@deadvirgins.org.uk> 27538 string RB40 RBS Song file 2754>29 string ReBorn created by ReBorn 2755>37 string Propellerhead created by ReBirth 2756 2757# Synthesizer Generator and Kimwitu share their file format 27580 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 2759# Kimwitu++ uses a slightly different magic 27600 string A#S#C#S#S#L#HUB Kimwitu++ data 2761 2762# From "Simon Hosie 27630 string TFMX-SONG TFMX module sound data 2764 2765# Monkey's Audio compressed audio format (.ape) 2766# From danny.milo@gmx.net (Danny Milosavljevic) 2767# New version from Abel Cheung <abel (@) oaka.org> 27680 string MAC\040 Monkey's Audio compressed format 2769>4 uleshort >0x0F8B version %d 2770>>(0x08.l) uleshort =1000 with fast compression 2771>>(0x08.l) uleshort =2000 with normal compression 2772>>(0x08.l) uleshort =3000 with high compression 2773>>(0x08.l) uleshort =4000 with extra high compression 2774>>(0x08.l) uleshort =5000 with insane compression 2775>>(0x08.l+18) uleshort =1 \b, mono 2776>>(0x08.l+18) uleshort =2 \b, stereo 2777>>(0x08.l+20) ulelong x \b, sample rate %d 2778>4 uleshort <0x0F8C version %d 2779>>6 uleshort =1000 with fast compression 2780>>6 uleshort =2000 with normal compression 2781>>6 uleshort =3000 with high compression 2782>>6 uleshort =4000 with extra high compression 2783>>6 uleshort =5000 with insane compression 2784>>10 uleshort =1 \b, mono 2785>>10 uleshort =2 \b, stereo 2786>>12 ulelong x \b, sample rate %d 2787 2788# adlib sound files 2789# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 27900 string RAWADATA RdosPlay RAW 2791 27921068 string RoR AMUSIC Adlib Tracker 2793 27940 string JCH EdLib 2795 27960 string mpu401tr MPU-401 Trakker 2797 27980 string SAdT Surprise! Adlib Tracker 2799>4 byte x Version %d 2800 28010 string XAD! eXotic ADlib 2802 28030 string ofTAZ! eXtra Simple Music 2804 2805# Spectrum 128 tunes (.ay files). 2806# From: Emanuel Haupt <ehaupt@critical.ch> 28070 string ZXAYEMUL Spectrum 128 tune 2808 28090 string \0BONK BONK, 2810#>5 byte x version %d 2811>14 byte x %d channel(s), 2812>15 byte =1 lossless, 2813>15 byte =0 lossy, 2814>16 byte x mid-side 2815 2816384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 2817 2818# format VQF (proprietary codec for sound) 2819# some infos on the header file available at : 2820# http://www.twinvq.org/english/technology_format.html 28210 string TWIN97012000 VQF data 2822>27 short 0 \b, Mono 2823>27 short 1 \b, Stereo 2824>31 short >0 \b, %d kbit/s 2825>35 short >0 \b, %d kHz 2826 2827# Nelson A. de Oliveira (naoliv@gmail.com) 2828# .eqf 28290 string Winamp\ EQ\ library\ file %s 2830# it will match only versions like v<digit>.<digit> 2831# Since I saw only eqf files with version v1.1 I think that it's OK 2832>23 string x \b%.4s 2833# .preset 28340 string [Equalizer\ preset] XMMS equalizer preset 2835# .m3u 28360 search/1 #EXTM3U M3U playlist text 2837# .pls 28380 search/1 [playlist] PLS playlist text 2839# licq.conf 28401 string [licq] LICQ configuration file 2841 2842# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 28430 string ICE! SNDH Atari ST music 28440 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 2845 2846# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 28470 string MP+ Musepack audio 2848>3 byte 255 \b, SV pre8 2849>3 byte&0xF 0x6 \b, SV 6 2850>3 byte&0xF 0x8 \b, SV 8 2851>3 byte&0xF 0x7 \b, SV 7 2852>>3 byte&0xF0 0x0 \b.0 2853>>3 byte&0xF0 0x10 \b.1 2854>>3 byte&0xF0 240 \b.15 2855>>10 byte&0xF0 0x0 \b, no profile 2856>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 2857>>10 byte&0xF0 0x50 \b, quality 0 2858>>10 byte&0xF0 0x60 \b, quality 1 2859>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 2860>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 2861>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 2862>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 2863>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 2864>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 2865>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 2866>>10 byte&0xF0 0xE0 \b, quality 9 2867>>10 byte&0xF0 0xF0 \b, quality 10 2868>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 2869>>27 byte 102 \b, Beta 1.02 2870>>27 byte 104 \b, Beta 1.04 2871>>27 byte 105 \b, Alpha 1.05 2872>>27 byte 106 \b, Beta 1.06 2873>>27 byte 110 \b, Release 1.1 2874>>27 byte 111 \b, Alpha 1.11 2875>>27 byte 112 \b, Beta 1.12 2876>>27 byte 113 \b, Alpha 1.13 2877>>27 byte 114 \b, Beta 1.14 2878>>27 byte 115 \b, Alpha 1.15 2879 2880# IMY 2881# from http://filext.com/detaillist.php?extdetail=IMY 2882# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 2883# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 2884# http://www.wx800.com/msg/download/irda/iMelody.pdf 28850 string BEGIN:IMELODY iMelody Ringtone Format 2886 2887# From: "Mateus Caruccio" <mateus@caruccio.com> 2888# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 28890 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 2890 2891# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 289260 string SONG SoundFX Module sound file 2893 2894# Type: Adaptive Multi-Rate Codec 2895# URL: http://filext.com/detaillist.php?extdetail=AMR 2896# From: Russell Coker <russell@coker.com.au> 28970 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 2898 2899#---------------------------------------------------------------- 2900# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 2901# basis: file(1) magic for BBx/Pro5-files 2902# Oliver Dammer <dammer@olida.de> 2005/11/07 2903# http://www.basis.com business-basic-files. 2904# 29050 string \074\074bbx\076\076 BBx 2906>7 string \000 indexed file 2907>7 string \001 serial file 2908>7 string \002 keyed file 2909>>13 short 0 (sort) 2910>7 string \004 program 2911>>18 byte x (LEVEL %d) 2912>>>23 string >\000 psaved 2913>7 string \006 mkeyed file 2914>>13 short 0 (sort) 2915>>8 string \000 (mkey) 2916 2917#------------------------------------------------------------------------------ 2918# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ 2919# bFLT: file(1) magic for BFLT uclinux binary files 2920# 2921# From Philippe De Muyter <phdm@macqel.be> 2922# 29230 string bFLT BFLT executable 2924>4 belong x - version %ld 2925>4 belong 4 2926>>36 belong&0x1 0x1 ram 2927>>36 belong&0x2 0x2 gotpic 2928>>36 belong&0x4 0x4 gzip 2929>>36 belong&0x8 0x8 gzdata 2930 2931#------------------------------------------------------------------------------ 2932# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ 2933# blender: file(1) magic for Blender 3D related files 2934# 2935# Native format rule v1.2. For questions use the developers list 2936# http://lists.blender.org/mailman/listinfo/bf-committers 2937# GLOB chunk was moved near start and provides subversion info since 2.42 2938 29390 string =BLENDER Blender3D, 2940>7 string =_ saved as 32-bits 2941>>8 string =v little endian 2942>>>9 byte x with version %c. 2943>>>10 byte x \b%c 2944>>>11 byte x \b%c 2945>>>0x40 string =GLOB \b. 2946>>>>0x58 leshort x \b%.4d 2947>>8 string =V big endian 2948>>>9 byte x with version %c. 2949>>>10 byte x \b%c 2950>>>11 byte x \b%c 2951>>>0x40 string =GLOB \b. 2952>>>>0x58 beshort x \b%.4d 2953>7 string =- saved as 64-bits 2954>>8 string =v little endian 2955>>9 byte x with version %c. 2956>>10 byte x \b%c 2957>>11 byte x \b%c 2958>>0x44 string =GLOB \b. 2959>>>0x60 leshort x \b%.4d 2960>>8 string =V big endian 2961>>>9 byte x with version %c. 2962>>>10 byte x \b%c 2963>>>11 byte x \b%c 2964>>>0x44 string =GLOB \b. 2965>>>>0x60 beshort x \b%.4d 2966 2967# Scripts that run in the embeded Python interpreter 29680 string #!BPY Blender3D BPython script 2969 2970#------------------------------------------------------------------------------ 2971# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 2972# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 2973# 2974# Note that this 0407 conflicts with several other a.out formats... 2975# 2976# XXX - should this be redone with "be" and "le", so that it works on 2977# little-endian machines as well? If so, what's the deal with 2978# "VAX-order" and "VAX-order2"? 2979# 2980#0 long 0407 68K Blit (standalone) executable 2981#0 short 0407 VAX-order2 68K Blit (standalone) executable 29820 short 03401 VAX-order 68K Blit (standalone) executable 29830 long 0406 68k Blit mpx/mux executable 29840 short 0406 VAX-order2 68k Blit mpx/mux executable 29850 short 03001 VAX-order 68k Blit mpx/mux executable 2986# Need more values for WE32 DMD executables. 2987# Note that 0520 is the same as COFF 2988#0 short 0520 tty630 layers executable 2989 2990#------------------------------------------------------------------------------ 2991# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 2992# i80960 b.out objects and archives 2993# 29940 long 0x10d i960 b.out relocatable object 2995>16 long >0 not stripped 2996# 2997# b.out archive (hp-rt on i960) 29980 string =!<bout> b.out archive 2999>8 string __.SYMDEF random library 3000 3001#------------------------------------------------------------------------------ 3002# $File: bsdi,v 1.5 2009/09/19 16:28:08 christos Exp $ 3003# bsdi: file(1) magic for BSD/OS (from BSDI) objects 3004# 3005 30060 lelong 0314 386 compact demand paged pure executable 3007>16 lelong >0 not stripped 3008>32 byte 0x6a (uses shared libs) 3009 30100 lelong 0407 386 executable 3011>16 lelong >0 not stripped 3012>32 byte 0x6a (uses shared libs) 3013 30140 lelong 0410 386 pure executable 3015>16 lelong >0 not stripped 3016>32 byte 0x6a (uses shared libs) 3017 30180 lelong 0413 386 demand paged pure executable 3019>16 lelong >0 not stripped 3020>32 byte 0x6a (uses shared libs) 3021 3022# same as in SunOS 4.x, except for static shared libraries 30230 belong&077777777 0600413 sparc demand paged 3024>0 byte &0x80 3025>>20 belong <4096 shared library 3026>>20 belong =4096 dynamically linked executable 3027>>20 belong >4096 dynamically linked executable 3028>0 byte ^0x80 executable 3029>16 belong >0 not stripped 3030>36 belong 0xb4100001 (uses shared libs) 3031 30320 belong&077777777 0600410 sparc pure 3033>0 byte &0x80 dynamically linked executable 3034>0 byte ^0x80 executable 3035>16 belong >0 not stripped 3036>36 belong 0xb4100001 (uses shared libs) 3037 30380 belong&077777777 0600407 sparc 3039>0 byte &0x80 dynamically linked executable 3040>0 byte ^0x80 executable 3041>16 belong >0 not stripped 3042>36 belong 0xb4100001 (uses shared libs) 3043 3044#------------------------------------------------------------------------------ 3045# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 3046# BTSnoop: file(1) magic for BTSnoop files 3047# 3048# From <marcel@holtmann.org> 30490 string btsnoop\0 BTSnoop 3050>8 belong x version %d, 3051>12 belong 1001 Unencapsulated HCI 3052>12 belong 1002 HCI UART (H4) 3053>12 belong 1003 HCI BCSP 3054>12 belong 1004 HCI Serial (H5) 3055>>12 belong x type %d 3056 3057#------------------------------------------------------------------------------ 3058# $File: c-lang,v 1.14 2009/09/19 16:28:08 christos Exp $ 3059# c-lang: file(1) magic for C programs (or REXX) 3060# 3061 3062# XPM icons (Greg Roelofs, newt@uchicago.edu) 3063# if you uncomment "/*" for C/REXX below, also uncomment this entry 3064#0 string /*\ XPM\ */ X pixmap image data 3065#!:mime image/x-xpmi 3066 3067# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 3068#16 beshort 0x3d3d image/x-3ds 3069 3070# this first will upset you if you're a PL/1 shop... 3071# in which case rm it; ascmagic will catch real C programs 3072#0 search/1 /* C or REXX program text 3073#0 search/1 // C++ program text 3074 3075# From: Mikhail Teterin <mi@aldan.algebra.com> 30760 string cscope cscope reference data 3077>7 string x version %.2s 3078# We skip the path here, because it is often long (so file will 3079# truncate it) and mostly redundant. 3080# The inverted index functionality was added some time betwen 3081# versions 11 and 15, so look for -q if version is above 14: 3082>7 string >14 3083>>10 search/100 \ -q\ with inverted index 3084>10 search/100 \ -c\ text (non-compressed) 3085 3086#------------------------------------------------------------------------------ 3087# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ 3088# c64: file(1) magic for various commodore 64 related files 3089# 3090# From: Dirk Jagdmann <doj@cubic.org> 3091 30920x16500 belong 0x12014100 D64 Image 30930x16500 belong 0x12014180 D71 Image 30940x61800 belong 0x28034400 D81 Image 30950 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 30960 belong 0x43154164 X64 Image 3097 30980 string GCR-1541 GCR Image 3099>8 byte x version: %i 3100>9 byte x tracks: %i 3101 31029 string PSUR ARC archive (c64) 31032 string -LH1- LHA archive (c64) 3104 31050 string C64File PC64 Emulator file 3106>8 string >\0 "%s" 31070 string C64Image PC64 Freezer Image 3108 31090 beshort 0x38CD C64 PCLink Image 31100 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 3111 31120 belong 0xFF424CFF WRAptor packer (c64) 3113 31140 string C64S\x20tape\x20file T64 tape Image 3115>32 leshort x Version:0x%x 3116>36 leshort !0 Entries:%i 3117>40 string x Name:%.24s 3118 31190 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3120>32 leshort x Version:0x%x 3121>36 leshort !0 Entries:%i 3122>40 string x Name:%.24s 3123 31240 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3125>32 leshort x Version:0x%x 3126>36 leshort !0 Entries:%i 3127>40 string x Name:%.24s 3128 3129#------------------------------------------------------------------------------ 3130# $File: cad,v 1.9 2009/09/19 16:28:08 christos Exp $ 3131# autocad: file(1) magic for cad files 3132# 3133 3134# AutoCAD DWG versions R13/R14 (www.autodesk.com) 3135# Written December 01, 2003 by Lester Hightower 3136# Based on the DWG File Format Specifications at http://www.opendwg.org/ 31370 string \101\103\061\060\061 AutoCAD 3138>5 string \062\000\000\000\000 DWG ver. R13 3139>5 string \064\000\000\000\000 DWG ver. R14 3140 3141# Microstation DGN/CIT Files (www.bentley.com) 3142# Last updated July 29, 2005 by Lester Hightower 3143# DGN is the default file extension of Microstation/Intergraph CAD files. 3144# CIT is the proprietary raster format (similar to TIFF) used to attach 3145# raster underlays to Microstation DGN (vector) drawings. 3146# 3147# http://www.wotsit.org/search.asp 3148# http://filext.com/detaillist.php?extdetail=DGN 3149# http://filext.com/detaillist.php?extdetail=CIT 3150# 3151# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 3152# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 3153# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 3154# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 31550 string \010\011\376 Microstation 3156>3 string \002 3157>>30 string \026\105 DGNFile 3158>>30 string \034\105 DGNFile 3159>>30 string \073\107 DGNFile 3160>>30 string \073\110 DGNFile 3161>>30 string \106\107 DGNFile 3162>>30 string \110\103 DGNFile 3163>>30 string \120\104 DGNFile 3164>>30 string \172\104 DGNFile 3165>>30 string \172\105 DGNFile 3166>>30 string \172\106 DGNFile 3167>>30 string \234\106 DGNFile 3168>>30 string \273\105 DGNFile 3169>>30 string \306\106 DGNFile 3170>>30 string \310\104 DGNFile 3171>>30 string \341\104 DGNFile 3172>>30 string \372\103 DGNFile 3173>>30 string \372\104 DGNFile 3174>>30 string \372\106 DGNFile 3175>>30 string \376\103 DGNFile 3176>4 string \030\000\000 CITFile 3177>4 string \030\000\003 CITFile 3178 3179# AutoCad, from Nahuel Greco 3180# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 31810 string AC1012 AutoCad (release 12) 31820 string AC1013 AutoCad (release 13) 31830 string AC1014 AutoCad (release 14) 3184 3185# CAD: file(1) magic for computer aided design files 3186# Phillip Griffith <phillip dot griffith at gmail dot com> 3187# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 3188# 31890 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 31900 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 31910 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 31920 beshort 0x0809 Bentley/Intergraph MicroStation 3193>0x02 byte 0xfe 3194>>0x04 beshort 0x1800 CIT raster CAD 31950 string AC1012 AutoDesk AutoCAD R13 31960 string AC1014 AutoDesk AutoCAD R14 31970 string AC1015 AutoDesk AutoCAD R2000 3198 3199#------------------------------------------------------------------------------ 3200# $File: cafebabe,v 1.8 2009/09/19 16:28:08 christos Exp $ 3201# Cafe Babes unite! 3202# 3203# Since Java bytecode and Mach-O fat-files have the same magic number, the test 3204# must be performed in the same "magic" sequence to get both right. The long 3205# at offset 4 in a mach-O fat file tells the number of architectures; the short at 3206# offset 4 in a Java bytecode file is the JVM minor version and the 3207# short at offset 6 is the JVM major version. Since there are only 3208# only 18 labeled Mach-O architectures at current, and the first released 3209# Java class format was version 43.0, we can safely choose any number 3210# between 18 and 39 to test the number of architectures against 3211# (and use as a hack). Let's not use 18, because the Mach-O people 3212# might add another one or two as time goes by... 3213# 32140 belong 0xcafebabe 3215!:mime application/x-java-applet 3216>4 belong >30 compiled Java class data, 3217>>6 beshort x version %d. 3218>>4 beshort x \b%d 3219# Which is which? 3220#>>4 belong 0x032d (Java 1.0) 3221#>>4 belong 0x032d (Java 1.1) 3222>>4 belong 0x002e (Java 1.2) 3223>>4 belong 0x002f (Java 1.3) 3224>>4 belong 0x0030 (Java 1.4) 3225>>4 belong 0x0031 (Java 1.5) 3226>>4 belong 0x0032 (Java 1.6) 3227 3228 32290 belong 0xcafebabe 3230>4 belong 1 Mach-O fat file with 1 architecture 3231>4 belong >1 3232>>4 belong <20 Mach-O fat file with %ld architectures 3233 32340 belong 0xcafed00d JAR compressed with pack200, 3235>>5 byte x version %d. 3236>>4 byte x \b%d 3237!:mime application/x-java-pack200 3238 3239#------------------------------------------------------------------------------ 3240# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 3241# CDDB: file(1) magic for CDDB(tm) format CD text data files 3242# 3243# From <steve@gracenote.com> 3244# 3245# This is the /etc/magic entry to decode datafiles as used by 3246# CDDB-enabled CD player applications. 3247# 3248 32490 search/1/w #\040xmcd CDDB(tm) format CD text data 3250 3251#------------------------------------------------------------------------------ 3252# $File: chord,v 1.4 2009/09/19 16:28:08 christos Exp $ 3253# chord: file(1) magic for Chord music sheet typesetting utility input files 3254# 3255# From Philippe De Muyter <phdm@macqel.be> 3256# File format is actually free, but many distributed files begin with `{title' 3257# 32580 string {title Chord text file 3259 3260 3261#------------------------------------------------------------------------------ 3262# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 3263# cisco: file(1) magic for cisco Systems routers 3264# 3265# Most cisco file-formats are covered by the generic elf code 3266# 3267# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 32680 belong&0xffffff00 0x85011400 cisco IOS microcode 3269>7 string >\0 for '%s' 32700 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 3271>7 string >\0 for '%s' 3272 3273#------------------------------------------------------------------------------ 3274# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 3275# citrus locale declaration 3276# 3277 32780 string RuneCT Citrus locale declaration for LC_CTYPE 3279 3280 3281#------------------------------------------------------------------------------ 3282# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ 3283# clarion: file(1) magic for # Clarion Personal/Professional Developer 3284# (v2 and above) 3285# From: Julien Blache <jb@jblache.org> 3286 3287# Database files 3288# signature 32890 leshort 0x3343 Clarion Developer (v2 and above) data file 3290# attributes 3291>2 leshort &0x0001 \b, locked 3292>2 leshort &0x0004 \b, encrypted 3293>2 leshort &0x0008 \b, memo file exists 3294>2 leshort &0x0010 \b, compressed 3295>2 leshort &0x0040 \b, read only 3296# number of records 3297>5 lelong x \b, %ld records 3298 3299# Memo files 33000 leshort 0x334d Clarion Developer (v2 and above) memo data 3301 3302# Key/Index files 3303# No magic? :( 3304 3305# Help files 33060 leshort 0x49e0 Clarion Developer (v2 and above) help data 3307 3308#------------------------------------------------------------------------------ 3309# $File: claris,v 1.5 2009/09/19 16:28:08 christos Exp $ 3310# claris: file(1) magic for claris 3311# "H. Nanosecond" <aldomel@ix.netcom.com> 3312# Claris Works a word processor, etc. 3313# Version 3.0 3314 3315# .pct claris works clip art files 3316#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 3317#* 3318#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 3319#null to byte 1000 octal 3320514 string \377\377\377\377\000 Claris clip art? 3321>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 3322514 string \377\377\377\377\001 Claris clip art? 3323>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 3324 3325# Claris works files 3326# .cwk 33270 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 3328# .plt 33290 string \020\341\000\000\010\010 Claris Works pallete files .plt 3330 3331# .msp a dictionary file I am not sure about this I have only one .msp file 33320 string \002\271\262\000\040\002\000\164 Claris works dictionary 3333 3334# .usp are user dictionary bits 3335# I am not sure about a magic header: 3336#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 3337# soh S p f 8 U D sp ^ S cr nl p o d i 3338#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 3339# a t r i s t sp ^ S cr nl d i v sp # 3340 3341# .mth Thesaurus 3342# starts with \0 but no magic header 3343 3344# .chy Hyphenation file 3345# I am not sure: 000 210 034 000 000 3346 3347# other claris files 3348#./windows/claris/useng.ndx: data 3349#./windows/claris/xtndtran.l32: data 3350#./windows/claris/xtndtran.lst: data 3351#./windows/claris/clworks.lbl: data 3352#./windows/claris/clworks.prf: data 3353#./windows/claris/userd.spl: data 3354 3355#------------------------------------------------------------------------------ 3356# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ 3357# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 3358# 3359# XXX - what byte order does the Clipper use? 3360# 3361# XXX - what's the "!" stuff: 3362# 3363# >18 short !074000,000000 C1 R1 3364# >18 short !074000,004000 C2 R1 3365# >18 short !074000,010000 C3 R1 3366# >18 short !074000,074000 TEST 3367# 3368# I shall assume it's ANDing the field with the first value and 3369# comparing it with the second, and rewrite it as: 3370# 3371# >18 short&074000 000000 C1 R1 3372# >18 short&074000 004000 C2 R1 3373# >18 short&074000 010000 C3 R1 3374# >18 short&074000 074000 TEST 3375# 3376# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 3377# sort, nor does SunOS 4.x, so either it's something Intergraph added 3378# in CLIX, or something AT&T added in SVR3.2 or later, or something 3379# somebody else thought was a good idea; it's not documented in the 3380# man page for this version of "magic", nor does it appear to be 3381# implemented (at least not after I blew off the bogus code to turn 3382# old-style "&"s into new-style "&"s, which just didn't work at all). 3383# 33840 short 0575 CLIPPER COFF executable (VAX #) 3385>20 short 0407 (impure) 3386>20 short 0410 (5.2 compatible) 3387>20 short 0411 (pure) 3388>20 short 0413 (demand paged) 3389>20 short 0443 (target shared library) 3390>12 long >0 not stripped 3391>22 short >0 - version %ld 33920 short 0577 CLIPPER COFF executable 3393>18 short&074000 000000 C1 R1 3394>18 short&074000 004000 C2 R1 3395>18 short&074000 010000 C3 R1 3396>18 short&074000 074000 TEST 3397>20 short 0407 (impure) 3398>20 short 0410 (pure) 3399>20 short 0411 (separate I&D) 3400>20 short 0413 (paged) 3401>20 short 0443 (target shared library) 3402>12 long >0 not stripped 3403>22 short >0 - version %ld 3404>48 long&01 01 alignment trap enabled 3405>52 byte 1 -Ctnc 3406>52 byte 2 -Ctsw 3407>52 byte 3 -Ctpw 3408>52 byte 4 -Ctcb 3409>53 byte 1 -Cdnc 3410>53 byte 2 -Cdsw 3411>53 byte 3 -Cdpw 3412>53 byte 4 -Cdcb 3413>54 byte 1 -Csnc 3414>54 byte 2 -Cssw 3415>54 byte 3 -Cspw 3416>54 byte 4 -Cscb 34174 string pipe CLIPPER instruction trace 34184 string prof CLIPPER instruction profile 3419 3420#------------------------------------------------------------------------------ 3421# $File: commands,v 1.36 2010/01/24 18:41:11 christos Exp $ 3422# commands: file(1) magic for various shells and interpreters 3423# 3424#0 string : shell archive or script for antique kernel text 34250 string/w #!\ /bin/sh POSIX shell script text executable 3426!:mime text/x-shellscript 34270 string/w #!\ /bin/csh C shell script text executable 3428!:mime text/x-shellscript 3429# korn shell magic, sent by George Wu, gwu@clyde.att.com 34300 string/w #!\ /bin/ksh Korn shell script text executable 3431!:mime text/x-shellscript 34320 string/w #!\ /bin/tcsh Tenex C shell script text executable 3433!:mime text/x-shellscript 34340 string/w #!\ /usr/local/tcsh Tenex C shell script text executable 3435!:mime text/x-shellscript 34360 string/w #!\ /usr/local/bin/tcsh Tenex C shell script text executable 3437!:mime text/x-shellscript 3438 3439# 3440# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 34410 string/w #!\ /bin/zsh Paul Falstad's zsh script text executable 3442!:mime text/x-shellscript 34430 string/w #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 3444!:mime text/x-shellscript 34450 string/w #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 3446!:mime text/x-shellscript 34470 string/w #!\ /usr/local/bin/ash Neil Brown's ash script text executable 3448!:mime text/x-shellscript 34490 string/w #!\ /usr/local/bin/ae Neil Brown's ae script text executable 3450!:mime text/x-shellscript 34510 string/w #!\ /bin/nawk new awk script text executable 3452!:mime text/x-nawk 34530 string/w #!\ /usr/bin/nawk new awk script text executable 3454!:mime text/x-nawk 34550 string/w #!\ /usr/local/bin/nawk new awk script text executable 3456!:mime text/x-nawk 34570 string/w #!\ /bin/gawk GNU awk script text executable 3458!:mime text/x-gawk 34590 string/w #!\ /usr/bin/gawk GNU awk script text executable 3460!:mime text/x-gawk 34610 string/w #!\ /usr/local/bin/gawk GNU awk script text executable 3462!:mime text/x-gawk 3463# 34640 string/w #!\ /bin/awk awk script text executable 3465!:mime text/x-awk 34660 string/w #!\ /usr/bin/awk awk script text executable 3467!:mime text/x-awk 3468# update to distinguish from *.vcf files 3469# this is broken because postscript has /EBEGIN{ for example. 3470#0 search/Ww BEGIN { awk script text 3471 3472# AT&T Bell Labs' Plan 9 shell 34730 string/w #!\ /bin/rc Plan 9 rc shell script text executable 3474 3475# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 34760 string/w #!\ /bin/bash Bourne-Again shell script text executable 3477!:mime text/x-shellscript 34780 string/w #!\ /usr/local/bin/bash Bourne-Again shell script text executable 3479!:mime text/x-shellscript 3480 3481# using env 34820 string/t #!/usr/bin/env a 3483>15 string/t >\0 %s script text executable 34840 string/t #!\ /usr/bin/env a 3485>16 string/t >\0 %s script text executable 3486 3487# PHP scripts 3488# Ulf Harnhammar <ulfh@update.uu.se> 34890 search/1/c =<?php PHP script text 3490!:mime text/x-php 34910 search/1 =<?\n PHP script text 3492!:mime text/x-php 34930 search/1 =<?\r PHP script text 3494!:mime text/x-php 34950 search/1/w #!\ /usr/local/bin/php PHP script text executable 3496!:mime text/x-php 34970 search/1/w #!\ /usr/bin/php PHP script text executable 3498!:mime text/x-php 3499 35000 string Zend\x00 PHP script Zend Optimizer data 3501 35020 string $! DCL command file 3503 3504#---------------------------------------------------------------------------- 3505# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 3506# communication 3507 3508# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 3509# It is used for conformance testing of communication protocols. 3510# Added by W. Borgert <debacle@debian.org>. 35110 string $Suite TTCN Abstract Test Suite 3512>&1 string $SuiteId 3513>>&1 string >\n %s 3514>&2 string $SuiteId 3515>>&1 string >\n %s 3516>&3 string $SuiteId 3517>>&1 string >\n %s 3518 3519# MSC (message sequence charts) are a formal description technique, 3520# described in ITU-T Z.120, mainly used for communication protocols. 3521# Added by W. Borgert <debacle@debian.org>. 35220 string mscdocument Message Sequence Chart (document) 35230 string msc Message Sequence Chart (chart) 35240 string submsc Message Sequence Chart (subchart) 3525 3526#------------------------------------------------------------------------------ 3527# $File: compress,v 1.42 2009/09/19 16:28:08 christos Exp $ 3528# compress: file(1) magic for pure-compression formats (no archives) 3529# 3530# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 3531# 3532# Formats for various forms of compressed data 3533# Formats for "compress" proper have been moved into "compress.c", 3534# because it tries to uncompress it to figure out what's inside. 3535 3536# standard unix compress 35370 string \037\235 compress'd data 3538!:mime application/x-compress 3539!:apple LZIVZIVU 3540>2 byte&0x80 >0 block compressed 3541>2 byte&0x1f x %d bits 3542 3543# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 3544# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 3545# * Original filename is only at offset 10 if "extra field" absent 3546# * Produce shorter output - notably, only report compression methods 3547# other than 8 ("deflate", the only method defined in RFC 1952). 35480 string \037\213 gzip compressed data 3549!:mime application/x-gzip 3550>2 byte <8 \b, reserved method 3551>2 byte >8 \b, unknown method 3552>3 byte &0x01 \b, ASCII 3553>3 byte &0x02 \b, has CRC 3554>3 byte &0x04 \b, extra field 3555>3 byte&0xC =0x08 3556>>10 string x \b, was "%s" 3557>3 byte &0x10 \b, has comment 3558>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 3559>9 byte =0x01 \b, from Amiga 3560>9 byte =0x02 \b, from VMS 3561>9 byte =0x03 \b, from Unix 3562>9 byte =0x04 \b, from VM/CMS 3563>9 byte =0x05 \b, from Atari 3564>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 3565>9 byte =0x07 \b, from MacOS 3566>9 byte =0x08 \b, from Z-System 3567>9 byte =0x09 \b, from CP/M 3568>9 byte =0x0A \b, from TOPS/20 3569>9 byte =0x0B \b, from NTFS filesystem (NT) 3570>9 byte =0x0C \b, from QDOS 3571>9 byte =0x0D \b, from Acorn RISCOS 3572>3 byte &0x10 \b, comment 3573>3 byte &0x20 \b, encrypted 3574>4 ledate >0 \b, last modified: %s 3575>8 byte 2 \b, max compression 3576>8 byte 4 \b, max speed 3577 3578# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 35790 string \037\036 packed data 3580!:mime application/octet-stream 3581>2 belong >1 \b, %d characters originally 3582>2 belong =1 \b, %d character originally 3583# 3584# This magic number is byte-order-independent. 35850 short 0x1f1f old packed data 3586!:mime application/octet-stream 3587 3588# XXX - why *two* entries for "compacted data", one of which is 3589# byte-order independent, and one of which is byte-order dependent? 3590# 35910 short 0x1fff compacted data 3592!:mime application/octet-stream 3593# This string is valid for SunOS (BE) and a matching "short" is listed 3594# in the Ultrix (LE) magic file. 35950 string \377\037 compacted data 3596!:mime application/octet-stream 35970 short 0145405 huf output 3598!:mime application/octet-stream 3599 3600# bzip2 36010 string BZh bzip2 compressed data 3602!:mime application/x-bzip2 3603>3 byte >47 \b, block size = %c00k 3604 3605# lzip 36060 string LZIP lzip compressed data 3607!:mime application/x-lzip 3608>4 byte x \b, version: %d 3609 3610# squeeze and crunch 3611# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 36120 beshort 0x76FF squeezed data, 3613>4 string x original name %s 36140 beshort 0x76FE crunched data, 3615>2 string x original name %s 36160 beshort 0x76FD LZH compressed data, 3617>2 string x original name %s 3618 3619# Freeze 36200 string \037\237 frozen file 2.1 36210 string \037\236 frozen file 1.0 (or gzip 0.5) 3622 3623# SCO compress -H (LZH) 36240 string \037\240 SCO compress -H (LZH) data 3625 3626# European GSM 06.10 is a provisional standard for full-rate speech 3627# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 3628# excitation/long term prediction) coding at 13 kbit/s. 3629# 3630# There's only a magic nibble (4 bits); that nibble repeats every 33 3631# bytes. This isn't suited for use, but maybe we can use it someday. 3632# 3633# This will cause very short GSM files to be declared as data and 3634# mismatches to be declared as data too! 3635#0 byte&0xF0 0xd0 data 3636#>33 byte&0xF0 0xd0 3637#>66 byte&0xF0 0xd0 3638#>99 byte&0xF0 0xd0 3639#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 3640 3641# bzip a block-sorting file compressor 3642# by Julian Seward <sewardj@cs.man.ac.uk> and others 3643# 3644#0 string BZ bzip compressed data 3645#>2 byte x \b, version: %c 3646#>3 string =1 \b, compression block size 100k 3647#>3 string =2 \b, compression block size 200k 3648#>3 string =3 \b, compression block size 300k 3649#>3 string =4 \b, compression block size 400k 3650#>3 string =5 \b, compression block size 500k 3651#>3 string =6 \b, compression block size 600k 3652#>3 string =7 \b, compression block size 700k 3653#>3 string =8 \b, compression block size 800k 3654#>3 string =9 \b, compression block size 900k 3655 3656# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 36570 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 3658>9 beshort <0x0940 3659>>9 byte&0xf0 =0x00 - version 0. 3660>>9 beshort&0x0fff x \b%03x, 3661>>13 byte 1 LZO1X-1, 3662>>13 byte 2 LZO1X-1(15), 3663>>13 byte 3 LZO1X-999, 3664## >>22 bedate >0 last modified: %s, 3665>>14 byte =0x00 os: MS-DOS 3666>>14 byte =0x01 os: Amiga 3667>>14 byte =0x02 os: VMS 3668>>14 byte =0x03 os: Unix 3669>>14 byte =0x05 os: Atari 3670>>14 byte =0x06 os: OS/2 3671>>14 byte =0x07 os: MacOS 3672>>14 byte =0x0A os: Tops/20 3673>>14 byte =0x0B os: WinNT 3674>>14 byte =0x0E os: Win32 3675>9 beshort >0x0939 3676>>9 byte&0xf0 =0x00 - version 0. 3677>>9 byte&0xf0 =0x10 - version 1. 3678>>9 byte&0xf0 =0x20 - version 2. 3679>>9 beshort&0x0fff x \b%03x, 3680>>15 byte 1 LZO1X-1, 3681>>15 byte 2 LZO1X-1(15), 3682>>15 byte 3 LZO1X-999, 3683## >>25 bedate >0 last modified: %s, 3684>>17 byte =0x00 os: MS-DOS 3685>>17 byte =0x01 os: Amiga 3686>>17 byte =0x02 os: VMS 3687>>17 byte =0x03 os: Unix 3688>>17 byte =0x05 os: Atari 3689>>17 byte =0x06 os: OS/2 3690>>17 byte =0x07 os: MacOS 3691>>17 byte =0x0A os: Tops/20 3692>>17 byte =0x0B os: WinNT 3693>>17 byte =0x0E os: Win32 3694 3695# 4.3BSD-Quasijarus Strong Compression 3696# http://minnie.tuhs.org/Quasijarus/compress.html 36970 string \037\241 Quasijarus strong compressed data 3698 3699# From: Cory Dikkers <cdikkers@swbell.net> 37000 string XPKF Amiga xpkf.library compressed data 37010 string PP11 Power Packer 1.1 compressed data 37020 string PP20 Power Packer 2.0 compressed data, 3703>4 belong 0x09090909 fast compression 3704>4 belong 0x090A0A0A mediocre compression 3705>4 belong 0x090A0B0B good compression 3706>4 belong 0x090A0C0C very good compression 3707>4 belong 0x090A0C0D best compression 3708 3709# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 3710# http://www.7-zip.org or DOC/7zFormat.txt 3711# 37120 string 7z\274\257\047\034 7-zip archive data, 3713>6 byte x version %d 3714>7 byte x \b.%d 3715 3716# Type: LZMA 3717# URL: http://www.7-zip.org/sdk.html 3718# From: Robert Millan <rmh@aybabtu.com> and Reuben Thomas <rrt@sc3d.org> 3719# Commented out because apparently not reliable (according to Debian 3720# bug #364260) 3721#0 string ]\000\000\200\000 LZMA compressed data 3722 3723# Type: LZMA 37240 lelong&0xffffff =0x5d 3725>12 leshort =0xff LZMA compressed data, 3726>>5 lequad =0xffffffffffffffff streamed 3727>>5 lequad !0xffffffffffffffff non-streamed, size %lld 3728!:mime application/x-lzma 3729 3730# http://tukaani.org/xz/xz-file-format.txt 37310 ustring \xFD7zXZ\x00 xz compressed data 3732!:mime application/x-xz 3733 3734# AFX compressed files (Wolfram Kleff) 37352 string -afx- AFX compressed file data 3736 3737# Supplementary magic data for the file(1) command to support 3738# rzip(1). The format is described in magic(5). 3739# 3740# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 3741# this file. 3742# 37430 string RZIP rzip compressed data 3744>4 byte x - version %d 3745>5 byte x \b.%d 3746>6 belong x (%d bytes) 3747 3748# Type: XZ 3749# URL: http://tukaani.org/xz/ 37500 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data 3751!:mime application/x-xz 3752 3753#------------------------------------------------------------------------------ 3754# $File: console,v 1.16 2009/09/19 16:28:08 christos Exp $ 3755# Console game magic 3756# Toby Deshane <hac@shoelace.digivill.net> 3757# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 3758# ROM dump format 3759 37600 string NES\032 iNES ROM dump, 3761>4 byte x %dx16k PRG 3762>5 byte x \b, %dx8k CHR 3763>6 byte&0x01 =0x1 \b, [Vert.] 3764>6 byte&0x01 =0x0 \b, [Horiz.] 3765>6 byte&0x02 =0x2 \b, [SRAM] 3766>6 byte&0x04 =0x4 \b, [Trainer] 3767>6 byte&0x04 =0x8 \b, [4-Scr] 3768 3769#------------------------------------------------------------------------------ 3770# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 3771# 37720x104 belong 0xCEED6666 Gameboy ROM: 3773>0x134 string >\0 "%.16s" 3774>0x146 byte 0x03 \b,[SGB] 3775>0x147 byte 0x00 \b, [ROM ONLY] 3776>0x147 byte 0x01 \b, [ROM+MBC1] 3777>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 3778>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 3779>0x147 byte 0x05 \b, [ROM+MBC2] 3780>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 3781>0x147 byte 0x08 \b, [ROM+RAM] 3782>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 3783>0x147 byte 0x0B \b, [ROM+MMM01] 3784>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 3785>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 3786>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 3787>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 3788>0x147 byte 0x11 \b, [ROM+MBC3] 3789>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 3790>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 3791>0x147 byte 0x19 \b, [ROM+MBC5] 3792>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 3793>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 3794>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 3795>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 3796>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 3797>0x147 byte 0x1F \b, [Pocket Camera] 3798>0x147 byte 0xFD \b, [Bandai TAMA5] 3799>0x147 byte 0xFE \b, [Hudson HuC-3] 3800>0x147 byte 0xFF \b, [Hudson HuC-1] 3801 3802>0x148 byte 0 \b, ROM: 256Kbit 3803>0x148 byte 1 \b, ROM: 512Kbit 3804>0x148 byte 2 \b, ROM: 1Mbit 3805>0x148 byte 3 \b, ROM: 2Mbit 3806>0x148 byte 4 \b, ROM: 4Mbit 3807>0x148 byte 5 \b, ROM: 8Mbit 3808>0x148 byte 6 \b, ROM: 16Mbit 3809>0x148 byte 0x52 \b, ROM: 9Mbit 3810>0x148 byte 0x53 \b, ROM: 10Mbit 3811>0x148 byte 0x54 \b, ROM: 12Mbit 3812 3813>0x149 byte 1 \b, RAM: 16Kbit 3814>0x149 byte 2 \b, RAM: 64Kbit 3815>0x149 byte 3 \b, RAM: 128Kbit 3816>0x149 byte 4 \b, RAM: 1Mbit 3817 3818#>0x14e long x \b, CRC: %x 3819 3820#------------------------------------------------------------------------------ 3821# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 3822# 38230x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 3824>0x120 string >\0 Name: "%.16s" 3825>0x110 string >\0 %.16s 3826>0x1B0 string RA with SRAM 3827 3828#------------------------------------------------------------------------------ 3829# genesis: file(1) magic for the Super MegaDrive ROM dump format 3830# 38310x280 string EAGN Super MagicDrive ROM dump 3832>0 byte x %dx16k blocks 3833>2 byte 0 \b, last in series or standalone 3834>2 byte >0 \b, split ROM 3835>8 byte 0xAA 3836>9 byte 0xBB 3837 3838#------------------------------------------------------------------------------ 3839# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 3840# 38410x280 string EAMG Super MagicDrive ROM dump 3842>0 byte x %dx16k blocks 3843>2 byte x \b, last in series or standalone 3844>8 byte 0xAA 3845>9 byte 0xBB 3846 3847#------------------------------------------------------------------------------ 3848# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 3849# 3850# Does not detect all images. Very preliminary guesswork. Need more data 3851# on format. 3852# 3853# FIXME: need a little more info...;P 3854# 3855#0 byte 0xF3 3856#>1 byte 0xED Sega Master System/Game Gear ROM dump 3857#>1 byte 0x31 Sega Master System/Game Gear ROM dump 3858#>1 byte 0xDB Sega Master System/Game Gear ROM dump 3859#>1 byte 0xAF Sega Master System/Game Gear ROM dump 3860#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 3861 3862#------------------------------------------------------------------------------ 3863# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 3864# 38650 belong 0x21068028 Sega Dreamcast VMU game image 38660 string LCDi Dream Animator file 3867 3868#------------------------------------------------------------------------------ 3869# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 3870# 38710 belong 0x37804012 V64 Nintendo 64 ROM dump 3872 3873# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3874# Nintendo .nds 3875192 string \044\377\256Qi\232 Nintendo DS Game ROM Image 3876# Nintendo .gba 38770 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image 3878 3879#------------------------------------------------------------------------------ 3880# msx: file(1) magic for MSX game cartridge dumps 3881# Too simple - MPi 3882#0 beshort 0x4142 MSX game cartridge dump 3883 3884#------------------------------------------------------------------------------ 3885# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 38860 string PS-X\ EXE Sony Playstation executable 3887# Area: 3888>113 string x (%s) 3889 3890#------------------------------------------------------------------------------ 3891# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>) 38920 string XBEH XBE, Microsoft Xbox executable 3893# probabilistic checks whether signed or not 3894>0x0004 ulelong =0x0 3895>>&2 ulelong =0x0 3896>>>&2 ulelong =0x0 \b, not signed 3897>0x0004 ulelong >0 3898>>&2 ulelong >0 3899>>>&2 ulelong >0 \b, signed 3900# expect base address of 0x10000 3901>0x0104 ulelong =0x10000 3902>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 3903>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 3904>>>(0x0118-0x0FF60) ulelong >0 (regions: 3905>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 3906>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 3907>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 3908>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 3909>>>(0x0118-0x0FF60) ulelong >0 \b) 3910 3911# -------------------------------- 3912# Microsoft Xbox data file formats 39130 string XIP0 XIP, Microsoft Xbox data 39140 string XTF0 XTF, Microsoft Xbox data 3915 3916# Atari Lynx cartridge dump (EXE/BLL header) 3917# From: "Stefan A. Haubenthal" <polluks@web.de> 3918 39190 beshort 0x8008 Lynx cartridge, 3920>2 beshort x RAM start $%04x 3921>6 string BS93 3922 3923# Opera file system that is used on the 3DO console 3924# From: Serge van den Boom <svdb@stack.nl> 39250 string \x01ZZZZZ\x01 3DO "Opera" file system 3926 3927# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 39280 string GBS Nintendo Gameboy Music/Audio Data 392912 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 3930 3931# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 39320 string PPF30 Playstation Patch File version 3.0 3933>5 byte 0 \b, PPF 1.0 patch 3934>5 byte 1 \b, PPF 2.0 patch 3935>5 byte 2 \b, PPF 3.0 patch 3936>>56 byte 0 \b, Imagetype BIN (any) 3937>>56 byte 1 \b, Imagetype GI (PrimoDVD) 3938>>57 byte 0 \b, Blockcheck disabled 3939>>57 byte 1 \b, Blockcheck enabled 3940>>58 byte 0 \b, Undo data not available 3941>>58 byte 1 \b, Undo data available 3942>6 string x \b, description: %s 3943 39440 string PPF20 Playstation Patch File version 2.0 3945>5 byte 0 \b, PPF 1.0 patch 3946>5 byte 1 \b, PPF 2.0 patch 3947>>56 lelong >0 \b, size of file to patch %d 3948>6 string x \b, description: %s 3949 39500 string PPF10 Playstation Patch File version 1.0 3951>5 byte 0 \b, Simple Encoding 3952>6 string x \b, description: %s 3953 3954# From: Daniel Dawson <ddawson@icehouse.net> 3955# SNES9x .smv "movie" file format. 39560 string SMV\x1A SNES9x input recording 3957>0x4 lelong x \b, version %d 3958# version 4 is latest so far 3959>0x4 lelong <5 3960>>0x8 ledate x \b, recorded at %s 3961>>0xc lelong >0 \b, rerecorded %d times 3962>>0x10 lelong x \b, %d frames long 3963>>0x14 byte >0 \b, data for controller(s): 3964>>>0x14 byte &0x1 #1 3965>>>0x14 byte &0x2 #2 3966>>>0x14 byte &0x4 #3 3967>>>0x14 byte &0x8 #4 3968>>>0x14 byte &0x10 #5 3969>>0x15 byte ^0x1 \b, begins from snapshot 3970>>0x15 byte &0x1 \b, begins from reset 3971>>0x15 byte ^0x2 \b, NTSC standard 3972>>0x15 byte &0x2 \b, PAL standard 3973>>0x17 byte &0x1 \b, settings: 3974# WIP1Timing not used as of version 4 3975>>>0x4 lelong <4 3976>>>>0x17 byte &0x2 WIP1Timing 3977>>>0x17 byte &0x4 Left+Right 3978>>>0x17 byte &0x8 VolumeEnvX 3979>>>0x17 byte &0x10 FakeMute 3980>>>0x17 byte &0x20 SyncSound 3981# New flag as of version 4 3982>>>0x4 lelong >3 3983>>>>0x17 byte &0x80 NoCPUShutdown 3984>>0x4 lelong <4 3985>>>0x18 lelong >0x23 3986>>>>0x20 leshort !0 3987>>>>>0x20 lestring16 x \b, metadata: "%s" 3988>>0x4 lelong >3 3989>>>0x24 byte >0 \b, port 1: 3990>>>>0x24 byte 1 joypad 3991>>>>0x24 byte 2 mouse 3992>>>>0x24 byte 3 SuperScope 3993>>>>0x24 byte 4 Justifier 3994>>>>0x24 byte 5 multitap 3995>>>0x24 byte >0 \b, port 2: 3996>>>>0x25 byte 1 joypad 3997>>>>0x25 byte 2 mouse 3998>>>>0x25 byte 3 SuperScope 3999>>>>0x25 byte 4 Justifier 4000>>>>0x25 byte 5 multitap 4001>>>0x18 lelong >0x43 4002>>>>0x40 leshort !0 4003>>>>>0x40 lestring16 x \b, metadata: "%s" 4004>>0x17 byte &0x40 \b, ROM: 4005>>>(0x18.l-26) lelong x CRC32 0x%08x 4006>>>(0x18.l-23) string x "%s" 4007 4008 4009#------------------------------------------------------------------------------ 4010# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $ 4011# convex: file(1) magic for Convex boxes 4012# 4013# Convexes are big-endian. 4014# 4015# /*\ 4016# * Below are the magic numbers and tests added for Convex. 4017# * Added at beginning, because they are expected to be used most. 4018# \*/ 40190 belong 0507 Convex old-style object 4020>16 belong >0 not stripped 40210 belong 0513 Convex old-style demand paged executable 4022>16 belong >0 not stripped 40230 belong 0515 Convex old-style pre-paged executable 4024>16 belong >0 not stripped 40250 belong 0517 Convex old-style pre-paged, non-swapped executable 4026>16 belong >0 not stripped 40270 belong 0x011257 Core file 4028# 4029# The following are a series of dump format magic numbers. Each one 4030# corresponds to a drastically different dump format. The first on is 4031# the original dump format on a 4.1 BSD or earlier file system. The 4032# second marks the change between the 4.1 file system and the 4.2 file 4033# system. The Third marks the changing of the block size from 1K 4034# to 2K to be compatible with an IDC file system. The fourth indicates 4035# a dump that is dependent on Convex Storage Manager, because data in 4036# secondary storage is not physically contained within the dump. 4037# The restore program uses these number to determine how the data is 4038# to be extracted. 4039# 404024 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 404124 belong =60014 dump format, Convex Storage Manager by-reference dump 4042# 4043# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 4044# If there is no `=' sign, assume just checking for whether the bit is set? 4045# 40460 belong 0601 Convex SOFF 4047>88 belong&0x000f0000 =0x00000000 c1 4048>88 belong &0x00010000 c2 4049>88 belong &0x00020000 c2mp 4050>88 belong &0x00040000 parallel 4051>88 belong &0x00080000 intrinsic 4052>88 belong &0x00000001 demand paged 4053>88 belong &0x00000002 pre-paged 4054>88 belong &0x00000004 non-swapped 4055>88 belong &0x00000008 POSIX 4056# 4057>84 belong &0x80000000 executable 4058>84 belong &0x40000000 object 4059>84 belong&0x20000000 =0 not stripped 4060>84 belong&0x18000000 =0x00000000 native fpmode 4061>84 belong&0x18000000 =0x10000000 ieee fpmode 4062>84 belong&0x18000000 =0x18000000 undefined fpmode 4063# 40640 belong 0605 Convex SOFF core 4065# 40660 belong 0607 Convex SOFF checkpoint 4067>88 belong&0x000f0000 =0x00000000 c1 4068>88 belong &0x00010000 c2 4069>88 belong &0x00020000 c2mp 4070>88 belong &0x00040000 parallel 4071>88 belong &0x00080000 intrinsic 4072>88 belong &0x00000008 POSIX 4073# 4074>84 belong&0x18000000 =0x00000000 native fpmode 4075>84 belong&0x18000000 =0x10000000 ieee fpmode 4076>84 belong&0x18000000 =0x18000000 undefined fpmode 4077 4078#------------------------------------------------------------------------------ 4079# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 4080# cracklib: file (1) magic for cracklib v2.7 4081 40820 lelong 0x70775631 Cracklib password index, little endian 4083>4 long >0 (%i words) 4084>4 long 0 ("64-bit") 4085>>8 long >-1 (%i words) 40860 belong 0x70775631 Cracklib password index, big endian 4087>4 belong >-1 (%i words) 4088# really bellong 0x0000000070775631 40890 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 4090>12 belong >0 (%i words) 4091 4092# ---------------------------------------------------------------------------- 4093# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 4094# ctags: file (1) magic for Exuberant Ctags files 4095# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 40960 search/1 =!_TAG Exuberant Ctags tag file text 4097 4098#------------------------------------------------------------------------------ 4099# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 4100# dact: file(1) magic for DACT compressed files 4101# 41020 long 0x444354C3 DACT compressed data 4103>4 byte >-1 (version %i. 4104>5 byte >-1 $BS%i. 4105>6 byte >-1 $BS%i) 4106>7 long >0 $BS, original size: %i bytes 4107>15 long >30 $BS, block size: %i bytes 4108 4109#------------------------------------------------------------------------------ 4110# $File: database,v 1.24 2009/09/19 16:28:08 christos Exp $ 4111# database: file(1) magic for various databases 4112# 4113# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 4114# 4115# 4116# GDBM magic numbers 4117# Will be maintained as part of the GDBM distribution in the future. 4118# <downsj@teeny.org> 41190 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 4120!:mime application/x-gdbm 41210 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 4122!:mime application/x-gdbm 41230 string GDBM GNU dbm 2.x database 4124!:mime application/x-gdbm 4125# 4126# Berkeley DB 4127# 4128# Ian Darwin's file /etc/magic files: big/little-endian version. 4129# 4130# Hash 1.85/1.86 databases store metadata in network byte order. 4131# Btree 1.85/1.86 databases store the metadata in host byte order. 4132# Hash and Btree 2.X and later databases store the metadata in host byte order. 4133 41340 long 0x00061561 Berkeley DB 4135!:mime application/x-dbm 4136>8 belong 4321 4137>>4 belong >2 1.86 4138>>4 belong <3 1.85 4139>>4 belong >0 (Hash, version %d, native byte-order) 4140>8 belong 1234 4141>>4 belong >2 1.86 4142>>4 belong <3 1.85 4143>>4 belong >0 (Hash, version %d, little-endian) 4144 41450 belong 0x00061561 Berkeley DB 4146>8 belong 4321 4147>>4 belong >2 1.86 4148>>4 belong <3 1.85 4149>>4 belong >0 (Hash, version %d, big-endian) 4150>8 belong 1234 4151>>4 belong >2 1.86 4152>>4 belong <3 1.85 4153>>4 belong >0 (Hash, version %d, native byte-order) 4154 41550 long 0x00053162 Berkeley DB 1.85/1.86 4156>4 long >0 (Btree, version %d, native byte-order) 41570 belong 0x00053162 Berkeley DB 1.85/1.86 4158>4 belong >0 (Btree, version %d, big-endian) 41590 lelong 0x00053162 Berkeley DB 1.85/1.86 4160>4 lelong >0 (Btree, version %d, little-endian) 4161 416212 long 0x00061561 Berkeley DB 4163>16 long >0 (Hash, version %d, native byte-order) 416412 belong 0x00061561 Berkeley DB 4165>16 belong >0 (Hash, version %d, big-endian) 416612 lelong 0x00061561 Berkeley DB 4167>16 lelong >0 (Hash, version %d, little-endian) 4168 416912 long 0x00053162 Berkeley DB 4170>16 long >0 (Btree, version %d, native byte-order) 417112 belong 0x00053162 Berkeley DB 4172>16 belong >0 (Btree, version %d, big-endian) 417312 lelong 0x00053162 Berkeley DB 4174>16 lelong >0 (Btree, version %d, little-endian) 4175 417612 long 0x00042253 Berkeley DB 4177>16 long >0 (Queue, version %d, native byte-order) 417812 belong 0x00042253 Berkeley DB 4179>16 belong >0 (Queue, version %d, big-endian) 418012 lelong 0x00042253 Berkeley DB 4181>16 lelong >0 (Queue, version %d, little-endian) 4182 4183# From Max Bowsher. 418412 long 0x00040988 Berkeley DB 4185>16 long >0 (Log, version %d, native byte-order) 418612 belong 0x00040988 Berkeley DB 4187>16 belong >0 (Log, version %d, big-endian) 418812 lelong 0x00040988 Berkeley DB 4189>16 lelong >0 (Log, version %d, little-endian) 4190 4191# 4192# 4193# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 41940 string/b RRD\0 RRDTool DB 4195>4 string/b x version %s 4196#---------------------------------------------------------------------- 4197# ROOT: file(1) magic for ROOT databases 4198# 41990 string root\0 ROOT file 4200>4 belong x Version %d 4201>33 belong x (Compression: %d) 4202 4203# XXX: Weak magic. 4204# Alex Ott <ott@jet.msk.su> 4205## Paradox file formats 4206#2 leshort 0x0800 Paradox 4207#>0x39 byte 3 v. 3.0 4208#>0x39 byte 4 v. 3.5 4209#>0x39 byte 9 v. 4.x 4210#>0x39 byte 10 v. 5.x 4211#>0x39 byte 11 v. 5.x 4212#>0x39 byte 12 v. 7.x 4213#>>0x04 byte 0 indexed .DB data file 4214#>>0x04 byte 1 primary index .PX file 4215#>>0x04 byte 2 non-indexed .DB data file 4216#>>0x04 byte 3 non-incrementing secondary index .Xnn file 4217#>>0x04 byte 4 secondary index .Ynn file 4218#>>0x04 byte 5 incrementing secondary index .Xnn file 4219#>>0x04 byte 6 non-incrementing secondary index .XGn file 4220#>>0x04 byte 7 secondary index .YGn file 4221#>>>0x04 byte 8 incrementing secondary index .XGn file 4222 4223## XBase database files 4224#0 byte 0x02 4225#>8 leshort >0 4226#>>12 leshort 0 FoxBase 4227#!:mime application/x-dbf 4228#>>>0x04 lelong 0 (no records) 4229#>>>0x04 lelong >0 (%ld records) 4230# 4231#0 byte 0x03 4232#!:mime application/x-dbf 4233#>8 leshort >0 4234#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo 4235#>>>0x04 lelong 0 (no records) 4236#>>>0x04 lelong >0 (%ld records) 4237# 4238#0 byte 0x04 4239#!:mime application/x-dbf 4240#>8 leshort >0 4241#>>12 leshort 0 dBASE IV no memo file 4242#>>>0x04 lelong 0 (no records) 4243#>>>0x04 lelong >0 (%ld records) 4244# 4245#0 byte 0x05 4246#!:mime application/x-dbf 4247#>8 leshort >0 4248#>>12 leshort 0 dBASE V no memo file 4249#>>>0x04 lelong 0 (no records) 4250#>>>0x04 lelong >0 (%ld records) 4251# 4252#0 byte 0x30 4253#!:mime application/x-dbf 4254#>8 leshort >0 4255#>>12 leshort 0 Visual FoxPro 4256#>>>0x04 lelong 0 (no records) 4257#>>>0x04 lelong >0 (%ld records) 4258# 4259#0 byte 0x43 4260#!:mime application/x-dbf 4261#>8 leshort >0 4262#>>12 leshort 0 FlagShip with memo var size 4263#>>>0x04 lelong 0 (no records) 4264#>>>0x04 lelong >0 (%ld records) 4265# 4266#0 byte 0x7b 4267#!:mime application/x-dbf 4268#>8 leshort >0 4269#>>12 leshort 0 dBASEIV with memo 4270#>>>0x04 lelong 0 (no records) 4271#>>>0x04 lelong >0 (%ld records) 4272# 4273#0 byte 0x83 4274#!:mime application/x-dbf 4275#>8 leshort >0 4276#>>12 leshort 0 FoxBase+, dBaseIII+ with memo 4277#>>>0x04 lelong 0 (no records) 4278#>>>0x04 lelong >0 (%ld records) 4279# 4280#0 byte 0x8b 4281#!:mime application/x-dbf 4282#>8 leshort >0 4283#>>12 leshort 0 dBaseIV with memo 4284#>>>0x04 lelong 0 (no records) 4285#>>>0x04 lelong >0 (%ld records) 4286# 4287#0 byte 0x8e 4288#!:mime application/x-dbf 4289#>8 leshort >0 4290#>>12 leshort 0 dBaseIV with SQL Table 4291#>>>0x04 lelong 0 (no records) 4292#>>>0x04 lelong >0 (%ld records) 4293# 4294#0 byte 0xb3 4295#!:mime application/x-dbf 4296#>8 leshort >0 4297#>>12 leshort 0 FlagShip with .dbt memo 4298#>>>0x04 lelong 0 (no records) 4299#>>>0x04 lelong >0 (%ld records) 4300# 4301#0 byte 0xf5 4302#!:mime application/x-dbf 4303#>8 leshort >0 4304#>>12 leshort 0 FoxPro with memo 4305#>>>0x04 lelong 0 (no records) 4306#>>>0x04 lelong >0 (%ld records) 4307# 4308#0 leshort 0x0006 DBase 3 index file 4309 4310# MS Access database 43114 string Standard\ Jet\ DB Microsoft Access Database 4312!:mime application/x-msaccess 4313 4314# TDB database from Samba et al - Martin Pool <mbp@samba.org> 43150 string TDB\ file TDB database 4316>32 lelong 0x2601196D version 6, little-endian 4317>>36 lelong x hash size %d bytes 4318 4319# SE Linux policy database 43200 lelong 0xf97cff8c SE Linux policy 4321>16 lelong x v%d 4322>20 lelong 1 MLS 4323>24 lelong x %d symbols 4324>28 lelong x %d ocons 4325 4326# ICE authority file data (Wolfram Kleff) 43272 string ICE ICE authority data 4328 4329# X11 Xauthority file (Wolfram Kleff) 433010 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433111 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433212 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433313 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433414 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433515 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433616 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433717 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 433818 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 4339 4340# From: Maxime Henrion <mux@FreeBSD.org> 4341# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 43420 string PGDMP PostgreSQL custom database dump 4343>5 byte x - v%d 4344>6 byte x \b.%d 4345>5 beshort <0x101 \b-0 4346>5 beshort >0x100 4347>>7 byte x \b-%d 4348 4349# Type: Advanced Data Format (ADF) database 4350# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 4351# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 43520 string @(#)ADF\ Database CGNS Advanced Data Format 4353 4354# Tokyo Cabinet magic data 4355# http://tokyocabinet.sourceforge.net/index.html 43560 string ToKyO\ CaBiNeT\n Tokyo Cabinet 4357>14 string x \b (%s) 4358>32 byte 0 \b, Hash 4359!:mime application/x-tokyocabinet-hash 4360>32 byte 1 \b, B+ tree 4361!:mime application/x-tokyocabinet-btree 4362>32 byte 2 \b, Fixed-length 4363!:mime application/x-tokyocabinet-fixed 4364>32 byte 3 \b, Table 4365!:mime application/x-tokyocabinet-table 4366>33 byte &1 \b, [open] 4367>33 byte &2 \b, [fatal] 4368>34 byte x \b, apow=%d 4369>35 byte x \b, fpow=%d 4370>36 byte &0x01 \b, [large] 4371>36 byte &0x02 \b, [deflate] 4372>36 byte &0x04 \b, [bzip] 4373>36 byte &0x08 \b, [tcbs] 4374>36 byte &0x10 \b, [excodec] 4375>40 lequad x \b, bnum=%lld 4376>48 lequad x \b, rnum=%lld 4377>56 lequad x \b, fsiz=%lld 4378 4379#------------------------------------------------------------------------------ 4380# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 4381# diamond: file(1) magic for Diamond system 4382# 4383# ... diamond is a multi-media mail and electronic conferencing system.... 4384# 4385# XXX - I think it was either renamed Slate, or replaced by Slate.... 4386# 4387# The full deal is too long... 4388#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 43890 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 4390 4391#------------------------------------------------------------------------------ 4392# $File: diff,v 1.10 2009/09/19 16:28:08 christos Exp $ 4393# diff: file(1) magic for diff(1) output 4394# 43950 search/1 diff\ diff output text 4396!:mime text/x-diff 43970 search/1 ***\ diff output text 4398!:mime text/x-diff 43990 search/1 Only\ in\ diff output text 4400!:mime text/x-diff 44010 search/1 Common\ subdirectories:\ diff output text 4402!:mime text/x-diff 4403 44040 search/1 Index: RCS/CVS diff output text 4405!:mime text/x-diff 4406 4407# bsdiff: file(1) magic for bsdiff(1) output 44080 string BSDIFF40 bsdiff(1) patch file 4409 4410# unified diff 44110 search/4096 ---\ 4412>&0 search/1024 \n 4413>>&0 search/1 +++\ 4414>>>&0 search/1024 \n 4415>>>>&0 search/1 @@ unified diff output text 4416!:mime text/x-diff 4417!:strength + 30 4418#------------------------------------------------------------------------------ 4419# $File: digital,v 1.8 2009/09/19 16:28:08 christos Exp $ 4420# Digital UNIX - Info 4421# 44220 string =!<arch>\n________64E Alpha archive 4423>22 string X -- out of date 4424# 4425# Alpha COFF Based Executables 4426# The stripped stuff really needs to be an 8 byte (64 bit) compare, 4427# but this works 44280 leshort 0x183 COFF format alpha 4429>22 leshort&020000 &010000 sharable library, 4430>22 leshort&020000 ^010000 dynamically linked, 4431>24 leshort 0410 pure 4432>24 leshort 0413 demand paged 4433>8 lelong >0 executable or object module, not stripped 4434>8 lelong 0 4435>>12 lelong 0 executable or object module, stripped 4436>>12 lelong >0 executable or object module, not stripped 4437>27 byte >0 - version %d. 4438>26 byte >0 %d- 4439>28 leshort >0 %d 4440# 4441# The next is incomplete, we could tell more about this format, 4442# but its not worth it. 44430 leshort 0x188 Alpha compressed COFF 44440 leshort 0x18f Alpha u-code object 4445# 4446# 4447# Some other interesting Digital formats, 44480 string \377\377\177 ddis/ddif 44490 string \377\377\174 ddis/dots archive 44500 string \377\377\176 ddis/dtif table data 44510 string \033c\033 LN03 output 44520 long 04553207 X image 4453# 44540 string =!<PDF>!\n profiling data file 4455# 4456# Locale data tables (MIPS and Alpha). 4457# 44580 short 0x0501 locale data table 4459>6 short 0x24 for MIPS 4460>6 short 0x40 for Alpha 4461 4462#------------------------------------------------------------------------------ 4463# $File: dolby,v 1.5 2009/09/19 16:28:08 christos Exp $ 4464# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 4465# from http://www.atsc.org/standards/a_52a.pdf 4466# corrections, additions, etc. are always welcome! 4467# 4468# syncword 44690 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 4470# fscod 4471>4 byte&0xc0 0x00 48 kHz, 4472>4 byte&0xc0 0x40 44.1 kHz, 4473>4 byte&0xc0 0x80 32 kHz, 4474# is this one used for 96 kHz? 4475>4 byte&0xc0 0xc0 reserved frequency, 4476# 4477>5 byte&7 = 0 \b, complete main (CM) 4478>5 byte&7 = 1 \b, music and effects (ME) 4479>5 byte&7 = 2 \b, visually impaired (VI) 4480>5 byte&7 = 3 \b, hearing impaired (HI) 4481>5 byte&7 = 4 \b, dialogue (D) 4482>5 byte&7 = 5 \b, commentary (C) 4483>5 byte&7 = 6 \b, emergency (E) 4484# acmod 4485>6 byte&0xe0 0x00 1+1 front, 4486>6 byte&0xe0 0x20 1 front/0 rear, 4487>6 byte&0xe0 0x40 2 front/0 rear, 4488>6 byte&0xe0 0x60 3 front/0 rear, 4489>6 byte&0xe0 0x80 2 front/1 rear, 4490>6 byte&0xe0 0xa0 3 front/1 rear, 4491>6 byte&0xe0 0xc0 2 front/2 rear, 4492>6 byte&0xe0 0xe0 3 front/2 rear, 4493# lfeon (these may be incorrect) 4494>7 byte&0x40 0x00 LFE off, 4495>7 byte&0x40 0x40 LFE on, 4496# 4497>4 byte&0x3e = 0x00 \b, 32 kbit/s 4498>4 byte&0x3e = 0x02 \b, 40 kbit/s 4499>4 byte&0x3e = 0x04 \b, 48 kbit/s 4500>4 byte&0x3e = 0x06 \b, 56 kbit/s 4501>4 byte&0x3e = 0x08 \b, 64 kbit/s 4502>4 byte&0x3e = 0x0a \b, 80 kbit/s 4503>4 byte&0x3e = 0x0c \b, 96 kbit/s 4504>4 byte&0x3e = 0x0e \b, 112 kbit/s 4505>4 byte&0x3e = 0x10 \b, 128 kbit/s 4506>4 byte&0x3e = 0x12 \b, 160 kbit/s 4507>4 byte&0x3e = 0x14 \b, 192 kbit/s 4508>4 byte&0x3e = 0x16 \b, 224 kbit/s 4509>4 byte&0x3e = 0x18 \b, 256 kbit/s 4510>4 byte&0x3e = 0x1a \b, 320 kbit/s 4511>4 byte&0x3e = 0x1c \b, 384 kbit/s 4512>4 byte&0x3e = 0x1e \b, 448 kbit/s 4513>4 byte&0x3e = 0x20 \b, 512 kbit/s 4514>4 byte&0x3e = 0x22 \b, 576 kbit/s 4515>4 byte&0x3e = 0x24 \b, 640 kbit/s 4516# dsurmod (these may be incorrect) 4517>6 beshort&0x0180 0x0000 Dolby Surround not indicated 4518>6 beshort&0x0180 0x0080 not Dolby Surround encoded 4519>6 beshort&0x0180 0x0100 Dolby Surround encoded 4520>6 beshort&0x0180 0x0180 reserved Dolby Surround mode 4521 4522#------------------------------------------------------------------------------ 4523# $File: dump,v 1.11 2009/09/19 16:28:09 christos Exp $ 4524# dump: file(1) magic for dump file format--for new and old dump filesystems 4525# 4526# We specify both byte orders in order to recognize byte-swapped dumps. 4527# 452824 belong 60012 new-fs dump file (big endian), 4529>4 bedate x Previous dump %s, 4530>8 bedate x This dump %s, 4531>12 belong >0 Volume %ld, 4532>692 belong 0 Level zero, type: 4533>692 belong >0 Level %d, type: 4534>0 belong 1 tape header, 4535>0 belong 2 beginning of file record, 4536>0 belong 3 map of inodes on tape, 4537>0 belong 4 continuation of file record, 4538>0 belong 5 end of volume, 4539>0 belong 6 map of inodes deleted, 4540>0 belong 7 end of medium (for floppy), 4541>676 string >\0 Label %s, 4542>696 string >\0 Filesystem %s, 4543>760 string >\0 Device %s, 4544>824 string >\0 Host %s, 4545>888 belong >0 Flags %x 4546 454724 belong 60011 old-fs dump file (big endian), 4548#>4 bedate x Previous dump %s, 4549#>8 bedate x This dump %s, 4550>12 belong >0 Volume %ld, 4551>692 belong 0 Level zero, type: 4552>692 belong >0 Level %d, type: 4553>0 belong 1 tape header, 4554>0 belong 2 beginning of file record, 4555>0 belong 3 map of inodes on tape, 4556>0 belong 4 continuation of file record, 4557>0 belong 5 end of volume, 4558>0 belong 6 map of inodes deleted, 4559>0 belong 7 end of medium (for floppy), 4560>676 string >\0 Label %s, 4561>696 string >\0 Filesystem %s, 4562>760 string >\0 Device %s, 4563>824 string >\0 Host %s, 4564>888 belong >0 Flags %x 4565 456624 lelong 60012 new-fs dump file (little endian), 4567>4 ledate x This dump %s, 4568>8 ledate x Previous dump %s, 4569>12 lelong >0 Volume %ld, 4570>692 lelong 0 Level zero, type: 4571>692 lelong >0 Level %d, type: 4572>0 lelong 1 tape header, 4573>0 lelong 2 beginning of file record, 4574>0 lelong 3 map of inodes on tape, 4575>0 lelong 4 continuation of file record, 4576>0 lelong 5 end of volume, 4577>0 lelong 6 map of inodes deleted, 4578>0 lelong 7 end of medium (for floppy), 4579>676 string >\0 Label %s, 4580>696 string >\0 Filesystem %s, 4581>760 string >\0 Device %s, 4582>824 string >\0 Host %s, 4583>888 lelong >0 Flags %x 4584 458524 lelong 60011 old-fs dump file (little endian), 4586#>4 ledate x Previous dump %s, 4587#>8 ledate x This dump %s, 4588>12 lelong >0 Volume %ld, 4589>692 lelong 0 Level zero, type: 4590>692 lelong >0 Level %d, type: 4591>0 lelong 1 tape header, 4592>0 lelong 2 beginning of file record, 4593>0 lelong 3 map of inodes on tape, 4594>0 lelong 4 continuation of file record, 4595>0 lelong 5 end of volume, 4596>0 lelong 6 map of inodes deleted, 4597>0 lelong 7 end of medium (for floppy), 4598>676 string >\0 Label %s, 4599>696 string >\0 Filesystem %s, 4600>760 string >\0 Device %s, 4601>824 string >\0 Host %s, 4602>888 lelong >0 Flags %x 4603 460418 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 4605>2 medate x Previous dump %s, 4606>6 medate x This dump %s, 4607>10 leshort >0 Volume %ld, 4608>0 leshort 1 tape header. 4609>0 leshort 2 beginning of file record. 4610>0 leshort 3 map of inodes on tape. 4611>0 leshort 4 continuation of file record. 4612>0 leshort 5 end of volume. 4613>0 leshort 6 map of inodes deleted. 4614>0 leshort 7 end of medium (for floppy). 4615 461624 belong 0x19540119 new-fs dump file (ufs2, big endian), 4617>896 beqdate x Previous dump %s, 4618>904 beqdate x This dump %s, 4619>12 belong >0 Volume %ld, 4620>692 belong 0 Level zero, type: 4621>692 belong >0 Level %d, type: 4622>0 belong 1 tape header, 4623>0 belong 2 beginning of file record, 4624>0 belong 3 map of inodes on tape, 4625>0 belong 4 continuation of file record, 4626>0 belong 5 end of volume, 4627>0 belong 6 map of inodes deleted, 4628>0 belong 7 end of medium (for floppy), 4629>676 string >\0 Label %s, 4630>696 string >\0 Filesystem %s, 4631>760 string >\0 Device %s, 4632>824 string >\0 Host %s, 4633>888 belong >0 Flags %x 4634 463524 lelong 0x19540119 new-fs dump file (ufs2, little endian), 4636>896 leqdate x This dump %s, 4637>904 leqdate x Previous dump %s, 4638>12 lelong >0 Volume %ld, 4639>692 lelong 0 Level zero, type: 4640>692 lelong >0 Level %d, type: 4641>0 lelong 1 tape header, 4642>0 lelong 2 beginning of file record, 4643>0 lelong 3 map of inodes on tape, 4644>0 lelong 4 continuation of file record, 4645>0 lelong 5 end of volume, 4646>0 lelong 6 map of inodes deleted, 4647>0 lelong 7 end of medium (for floppy), 4648>676 string >\0 Label %s, 4649>696 string >\0 Filesystem %s, 4650>760 string >\0 Device %s, 4651>824 string >\0 Host %s, 4652>888 lelong >0 Flags %x 4653 4654#------------------------------------------------------------------------------ 4655# $File: dyadic,v 1.4 2009/09/19 16:28:09 christos Exp $ 4656# Dyadic: file(1) magic for Dyalog APL. 4657# 46580 byte 0xaa 4659>1 byte <4 Dyalog APL 4660>>1 byte 0x00 incomplete workspace 4661>>1 byte 0x01 component file 4662>>1 byte 0x02 external variable 4663>>1 byte 0x03 workspace 4664>>2 byte x version %d 4665>>3 byte x .%d 4666 4667#------------------------------------------------------------------------------ 4668# $File: editors,v 1.8 2009/09/19 16:28:09 christos Exp $ 4669# T602 editor documents 4670# by David Necas <yeti@physics.muni.cz> 46710 string @CT\ T602 document data, 4672>4 string 0 Kamenicky 4673>4 string 1 CP 852 4674>4 string 2 KOI8-CS 4675>4 string >2 unknown encoding 4676 4677# Vi IMproved Encrypted file 4678# by David Necas <yeti@physics.muni.cz> 46790 string VimCrypt~ Vim encrypted file data 4680# Vi IMproved Swap file 4681# by Sven Wegener <swegener@gentoo.org> 46820 string b0VIM\ Vim swap file 4683>&0 string >\0 \b, version %s 4684 4685#------------------------------------------------------------------------------ 4686# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ 4687# efi: file(1) magic for Universal EFI binaries 4688 46890 lelong 0x0ef1fab9 4690>4 lelong 1 Universal EFI binary with 1 architecture 4691>>&0 lelong 7 \b, i386 4692>>&0 lelong 0x01000007 \b, x86_64 4693>4 lelong 2 Universal EFI binary with 2 architectures 4694>>&0 lelong 7 \b, i386 4695>>&0 lelong 0x01000007 \b, x86_64 4696>>&20 lelong 7 \b, i386 4697>>&20 lelong 0x01000007 \b, x86_64 4698>4 lelong >2 Universal EFI binary with %ld architectures 4699 4700#------------------------------------------------------------------------------ 4701# $File: elf,v 1.53 2009/09/19 16:28:09 christos Exp $ 4702# elf: file(1) magic for ELF executables 4703# 4704# We have to check the byte order flag to see what byte order all the 4705# other stuff in the header is in. 4706# 4707# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 4708# 4709# Created by: unknown 4710# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 4711# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 4712# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 4713# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 4714# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 47150 string \177ELF ELF 4716>4 byte 0 invalid class 4717>4 byte 1 32-bit 4718>4 byte 2 64-bit 4719>5 byte 0 invalid byte order 4720>5 byte 1 LSB 4721>>16 leshort 0 no file type, 4722!:strength *2 4723!:mime application/octet-stream 4724>>16 leshort 1 relocatable, 4725!:mime application/x-object 4726>>16 leshort 2 executable, 4727!:mime application/x-executable 4728>>16 leshort 3 shared object, 4729!:mime application/x-sharedlib 4730>>16 leshort 4 core file 4731!:mime application/x-coredump 4732# Core file detection is not reliable. 4733#>>>(0x38+0xcc) string >\0 of '%s' 4734#>>>(0x38+0x10) lelong >0 (signal %d), 4735>>16 leshort &0xff00 processor-specific, 4736>>18 leshort 0 no machine, 4737>>18 leshort 1 AT&T WE32100 - invalid byte order, 4738>>18 leshort 2 SPARC - invalid byte order, 4739>>18 leshort 3 Intel 80386, 4740>>18 leshort 4 Motorola 4741>>>36 lelong &0x01000000 68000 - invalid byte order, 4742>>>36 lelong &0x00810000 CPU32 - invalid byte order, 4743>>>36 lelong 0 68020 - invalid byte order, 4744>>18 leshort 5 Motorola 88000 - invalid byte order, 4745>>18 leshort 6 Intel 80486, 4746>>18 leshort 7 Intel 80860, 4747# The official e_machine number for MIPS is now #8, regardless of endianness. 4748# The second number (#10) will be deprecated later. For now, we still 4749# say something if #10 is encountered, but only gory details for #8. 4750>>18 leshort 8 MIPS, 4751>>>36 lelong &0x20 N32 4752>>18 leshort 10 MIPS, 4753>>>36 lelong &0x20 N32 4754>>18 leshort 8 4755# only for 32-bit 4756>>>4 byte 1 4757>>>>36 lelong&0xf0000000 0x00000000 MIPS-I 4758>>>>36 lelong&0xf0000000 0x10000000 MIPS-II 4759>>>>36 lelong&0xf0000000 0x20000000 MIPS-III 4760>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV 4761>>>>36 lelong&0xf0000000 0x40000000 MIPS-V 4762>>>>36 lelong&0xf0000000 0x50000000 MIPS32 4763>>>>36 lelong&0xf0000000 0x60000000 MIPS64 4764>>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 4765>>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 4766# only for 64-bit 4767>>>4 byte 2 4768>>>>48 lelong&0xf0000000 0x00000000 MIPS-I 4769>>>>48 lelong&0xf0000000 0x10000000 MIPS-II 4770>>>>48 lelong&0xf0000000 0x20000000 MIPS-III 4771>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV 4772>>>>48 lelong&0xf0000000 0x40000000 MIPS-V 4773>>>>48 lelong&0xf0000000 0x50000000 MIPS32 4774>>>>48 lelong&0xf0000000 0x60000000 MIPS64 4775>>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 4776>>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 4777>>18 leshort 9 Amdahl - invalid byte order, 4778>>18 leshort 10 MIPS (deprecated), 4779>>18 leshort 11 RS6000 - invalid byte order, 4780>>18 leshort 15 PA-RISC - invalid byte order, 4781>>>50 leshort 0x0214 2.0 4782>>>48 leshort &0x0008 (LP64), 4783>>18 leshort 16 nCUBE, 4784>>18 leshort 17 Fujitsu VPP500, 4785>>18 leshort 18 SPARC32PLUS - invalid byte order, 4786>>18 leshort 20 PowerPC, 4787>>18 leshort 22 IBM S/390, 4788>>18 leshort 36 NEC V800, 4789>>18 leshort 37 Fujitsu FR20, 4790>>18 leshort 38 TRW RH-32, 4791>>18 leshort 39 Motorola RCE, 4792>>18 leshort 40 ARM, 4793>>18 leshort 41 Alpha, 4794>>18 leshort 0xa390 IBM S/390 (obsolete), 4795>>18 leshort 42 Renesas SH, 4796>>18 leshort 43 SPARC V9 - invalid byte order, 4797>>18 leshort 44 Siemens Tricore Embedded Processor, 4798>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 4799>>18 leshort 46 Renesas H8/300, 4800>>18 leshort 47 Renesas H8/300H, 4801>>18 leshort 48 Renesas H8S, 4802>>18 leshort 49 Renesas H8/500, 4803>>18 leshort 50 IA-64, 4804>>18 leshort 51 Stanford MIPS-X, 4805>>18 leshort 52 Motorola Coldfire, 4806>>18 leshort 53 Motorola M68HC12, 4807>>18 leshort 54 Fujitsu MMA, 4808>>18 leshort 55 Siemens PCP, 4809>>18 leshort 56 Sony nCPU, 4810>>18 leshort 57 Denso NDR1, 4811>>18 leshort 58 Start*Core, 4812>>18 leshort 59 Toyota ME16, 4813>>18 leshort 60 ST100, 4814>>18 leshort 61 Tinyj emb., 4815>>18 leshort 62 x86-64, 4816>>18 leshort 63 Sony DSP, 4817>>18 leshort 66 FX66, 4818>>18 leshort 67 ST9+ 8/16 bit, 4819>>18 leshort 68 ST7 8 bit, 4820>>18 leshort 69 MC68HC16, 4821>>18 leshort 70 MC68HC11, 4822>>18 leshort 71 MC68HC08, 4823>>18 leshort 72 MC68HC05, 4824>>18 leshort 73 SGI SVx, 4825>>18 leshort 74 ST19 8 bit, 4826>>18 leshort 75 Digital VAX, 4827>>18 leshort 76 Axis cris, 4828>>18 leshort 77 Infineon 32-bit embedded, 4829>>18 leshort 78 Element 14 64-bit DSP, 4830>>18 leshort 79 LSI Logic 16-bit DSP, 4831>>18 leshort 80 MMIX, 4832>>18 leshort 81 Harvard machine-independent, 4833>>18 leshort 82 SiTera Prism, 4834>>18 leshort 83 Atmel AVR 8-bit, 4835>>18 leshort 84 Fujitsu FR30, 4836>>18 leshort 85 Mitsubishi D10V, 4837>>18 leshort 86 Mitsubishi D30V, 4838>>18 leshort 87 NEC v850, 4839>>18 leshort 88 Renesas M32R, 4840>>18 leshort 89 Matsushita MN10300, 4841>>18 leshort 90 Matsushita MN10200, 4842>>18 leshort 91 picoJava, 4843>>18 leshort 92 OpenRISC, 4844>>18 leshort 93 ARC Cores Tangent-A5, 4845>>18 leshort 94 Tensilica Xtensa, 4846>>18 leshort 97 NatSemi 32k, 4847>>18 leshort 106 Analog Devices Blackfin, 4848>>18 leshort 113 Altera Nios II, 4849>>18 leshort 0xae META, 4850>>18 leshort 0x3426 OpenRISC (obsolete), 4851>>18 leshort 0x8472 OpenRISC (obsolete), 4852>>18 leshort 0x9026 Alpha (unofficial), 4853>>20 lelong 0 invalid version 4854>>20 lelong 1 version 1 4855>>36 lelong 1 MathCoPro/FPU/MAU Required 4856>5 byte 2 MSB 4857>>16 beshort 0 no file type, 4858!:mime application/octet-stream 4859>>16 beshort 1 relocatable, 4860!:mime application/x-object 4861>>16 beshort 2 executable, 4862!:mime application/x-executable 4863>>16 beshort 3 shared object, 4864!:mime application/x-sharedlib 4865>>16 beshort 4 core file, 4866!:mime application/x-coredump 4867#>>>(0x38+0xcc) string >\0 of '%s' 4868#>>>(0x38+0x10) belong >0 (signal %d), 4869>>16 beshort &0xff00 processor-specific, 4870>>18 beshort 0 no machine, 4871>>18 beshort 1 AT&T WE32100, 4872>>18 beshort 2 SPARC, 4873>>18 beshort 3 Intel 80386 - invalid byte order, 4874>>18 beshort 4 Motorola 4875>>>36 belong &0x01000000 68000, 4876>>>36 belong &0x00810000 CPU32, 4877>>>36 belong 0 68020, 4878>>18 beshort 5 Motorola 88000, 4879>>18 beshort 6 Intel 80486 - invalid byte order, 4880>>18 beshort 7 Intel 80860, 4881# only for MIPS - see comment in little-endian section above. 4882>>18 beshort 8 MIPS, 4883>>>36 belong &0x20 N32 4884>>18 beshort 10 MIPS, 4885>>>36 belong &0x20 N32 4886>>18 beshort 8 4887# only for 32-bit 4888>>>4 byte 1 4889>>>>36 belong&0xf0000000 0x00000000 MIPS-I 4890>>>>36 belong&0xf0000000 0x10000000 MIPS-II 4891>>>>36 belong&0xf0000000 0x20000000 MIPS-III 4892>>>>36 belong&0xf0000000 0x30000000 MIPS-IV 4893>>>>36 belong&0xf0000000 0x40000000 MIPS-V 4894>>>>36 belong&0xf0000000 0x50000000 MIPS32 4895>>>>36 belong&0xf0000000 0x60000000 MIPS64 4896>>>>36 belong&0xf0000000 0x70000000 MIPS32 rel2 4897>>>>36 belong&0xf0000000 0x80000000 MIPS64 rel2 4898# only for 64-bit 4899>>>4 byte 2 4900>>>>48 belong&0xf0000000 0x00000000 MIPS-I 4901>>>>48 belong&0xf0000000 0x10000000 MIPS-II 4902>>>>48 belong&0xf0000000 0x20000000 MIPS-III 4903>>>>48 belong&0xf0000000 0x30000000 MIPS-IV 4904>>>>48 belong&0xf0000000 0x40000000 MIPS-V 4905>>>>48 belong&0xf0000000 0x50000000 MIPS32 4906>>>>48 belong&0xf0000000 0x60000000 MIPS64 4907>>>>48 belong&0xf0000000 0x70000000 MIPS32 rel2 4908>>>>48 belong&0xf0000000 0x80000000 MIPS64 rel2 4909>>18 beshort 9 Amdahl, 4910>>18 beshort 10 MIPS (deprecated), 4911>>18 beshort 11 RS6000, 4912>>18 beshort 15 PA-RISC 4913>>>50 beshort 0x0214 2.0 4914>>>48 beshort &0x0008 (LP64) 4915>>18 beshort 16 nCUBE, 4916>>18 beshort 17 Fujitsu VPP500, 4917>>18 beshort 18 SPARC32PLUS, 4918>>>36 belong&0xffff00 0x000100 V8+ Required, 4919>>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 4920>>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required, 4921>>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 4922>>18 beshort 20 PowerPC or cisco 4500, 4923>>18 beshort 21 64-bit PowerPC or cisco 7500, 4924>>18 beshort 22 IBM S/390, 4925>>18 beshort 23 Cell SPU, 4926>>18 beshort 24 cisco SVIP, 4927>>18 beshort 25 cisco 7200, 4928>>18 beshort 36 NEC V800 or cisco 12000, 4929>>18 beshort 37 Fujitsu FR20, 4930>>18 beshort 38 TRW RH-32, 4931>>18 beshort 39 Motorola RCE, 4932>>18 beshort 40 ARM, 4933>>18 beshort 41 Alpha, 4934>>18 beshort 42 Renesas SH, 4935>>18 beshort 43 SPARC V9, 4936>>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 4937>>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required, 4938>>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 4939>>>48 belong&0x3 0 total store ordering, 4940>>>48 belong&0x3 1 partial store ordering, 4941>>>48 belong&0x3 2 relaxed memory ordering, 4942>>18 beshort 44 Siemens Tricore Embedded Processor, 4943>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 4944>>18 beshort 46 Renesas H8/300, 4945>>18 beshort 47 Renesas H8/300H, 4946>>18 beshort 48 Renesas H8S, 4947>>18 beshort 49 Renesas H8/500, 4948>>18 beshort 50 IA-64, 4949>>18 beshort 51 Stanford MIPS-X, 4950>>18 beshort 52 Motorola Coldfire, 4951>>18 beshort 53 Motorola M68HC12, 4952>>18 beshort 73 Cray NV1, 4953>>18 beshort 75 Digital VAX, 4954>>18 beshort 88 Renesas M32R, 4955>>18 leshort 92 OpenRISC, 4956>>18 leshort 0x3426 OpenRISC (obsolete), 4957>>18 leshort 0x8472 OpenRISC (obsolete), 4958>>18 beshort 94 Tensilica Xtensa, 4959>>18 beshort 97 NatSemi 32k, 4960>>18 beshort 0x18ad AVR32 (unofficial), 4961>>18 beshort 0x9026 Alpha (unofficial), 4962>>18 beshort 0xa390 IBM S/390 (obsolete), 4963>>20 belong 0 invalid version 4964>>20 belong 1 version 1 4965>>36 belong 1 MathCoPro/FPU/MAU Required 4966# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed 4967# like proper ELF, but extracting the string had bad results. 4968>4 byte <0x80 4969>>8 string >\0 (%s) 4970>8 string \0 4971>>7 byte 0 (SYSV) 4972>>7 byte 1 (HP-UX) 4973>>7 byte 2 (NetBSD) 4974>>7 byte 3 (GNU/Linux) 4975>>7 byte 4 (GNU/Hurd) 4976>>7 byte 5 (86Open) 4977>>7 byte 6 (Solaris) 4978>>7 byte 7 (Monterey) 4979>>7 byte 8 (IRIX) 4980>>7 byte 9 (FreeBSD) 4981>>7 byte 10 (Tru64) 4982>>7 byte 11 (Novell Modesto) 4983>>7 byte 12 (OpenBSD) 4984>8 string \2 4985>>7 byte 13 (OpenVMS) 4986>>7 byte 97 (ARM) 4987>>7 byte 255 (embedded) 4988 4989#------------------------------------------------------------------------------ 4990# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ 4991# encore: file(1) magic for Encore machines 4992# 4993# XXX - needs to have the byte order specified (NS32K was little-endian, 4994# dunno whether they run the 88K in little-endian mode or not). 4995# 49960 short 0x154 Encore 4997>20 short 0x107 executable 4998>20 short 0x108 pure executable 4999>20 short 0x10b demand-paged executable 5000>20 short 0x10f unsupported executable 5001>12 long >0 not stripped 5002>22 short >0 - version %ld 5003>22 short 0 - 5004#>4 date x stamp %s 50050 short 0x155 Encore unsupported executable 5006>12 long >0 not stripped 5007>22 short >0 - version %ld 5008>22 short 0 - 5009#>4 date x stamp %s 5010 5011#------------------------------------------------------------------------------ 5012# $File: epoc,v 1.7 2009/09/19 16:28:09 christos Exp $ 5013# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 5014# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 5015# Useful information for improving this file can be found at: 5016# http://software.frodo.looijaard.name/psiconv/formats/Index.html 5017#------------------------------------------------------------------------------ 50180 lelong 0x10000037 Psion Series 5 5019>4 lelong 0x10000039 font file 5020>4 lelong 0x1000003A printer driver 5021>4 lelong 0x1000003B clipboard 5022>4 lelong 0x10000042 multi-bitmap image 5023!:mime image/x-epoc-mbm 5024>4 lelong 0x1000006A application information file 5025>4 lelong 0x1000006D 5026>>8 lelong 0x1000007D Sketch image 5027!:mime image/x-epoc-sketch 5028>>8 lelong 0x1000007E voice note 5029>>8 lelong 0x1000007F Word file 5030!:mime application/x-epoc-word 5031>>8 lelong 0x10000085 OPL program (TextEd) 5032!:mime application/x-epoc-opl 5033>>8 lelong 0x10000088 Sheet file 5034!:mime application/x-epoc-sheet 5035>>8 lelong 0x100001C4 EasyFax initialisation file 5036>4 lelong 0x10000073 OPO module 5037!:mime application/x-epoc-opo 5038>4 lelong 0x10000074 OPL application 5039!:mime application/x-epoc-app 5040>4 lelong 0x1000008A exported multi-bitmap image 5041 50420 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 5043 50440 lelong 0x10000050 Psion Series 5 5045>4 lelong 0x1000006D database 5046>4 lelong 0x100000E4 ini file 5047 50480 lelong 0x10000079 Psion Series 5 binary: 5049>4 lelong 0x00000000 DLL 5050>4 lelong 0x10000049 comms hardware library 5051>4 lelong 0x1000004A comms protocol library 5052>4 lelong 0x1000005D OPX 5053>4 lelong 0x1000006C application 5054>4 lelong 0x1000008D DLL 5055>4 lelong 0x100000AC logical device driver 5056>4 lelong 0x100000AD physical device driver 5057>4 lelong 0x100000E5 file transfer protocol 5058>4 lelong 0x100000E5 file transfer protocol 5059>4 lelong 0x10000140 printer definition 5060>4 lelong 0x10000141 printer definition 5061 50620 lelong 0x1000007A Psion Series 5 executable 5063 5064#------------------------------------------------------------------------------ 5065# $File: erlang,v 1.5 2009/09/19 16:28:09 christos Exp $ 5066# erlang: file(1) magic for Erlang JAM and BEAM files 5067# URL: http://www.erlang.org/faq/x779.html#AEN812 5068 5069# OTP R3-R4 50700 string \0177BEAM! Old Erlang BEAM file 5071>6 short >0 - version %d 5072 5073# OTP R5 and onwards 50740 string FOR1 5075>8 string BEAM Erlang BEAM file 5076 5077# 4.2 version may have a copyright notice! 50784 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 507979 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 5080 50814 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 5082 5083#------------------------------------------------------------------------------ 5084# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 5085# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 5086# Based on info from 5087# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 50880 belong 9994 ESRI Shapefile 5089>4 belong =0 5090>8 belong =0 5091>12 belong =0 5092>16 belong =0 5093>20 belong =0 5094>28 lelong x version %d 5095>24 belong x length %d 5096>32 lelong =0 type Null Shape 5097>32 lelong =1 type Point 5098>32 lelong =3 type PolyLine 5099>32 lelong =5 type Polygon 5100>32 lelong =8 type MultiPoint 5101>32 lelong =11 type PointZ 5102>32 lelong =13 type PolyLineZ 5103>32 lelong =15 type PolygonZ 5104>32 lelong =18 type MultiPointZ 5105>32 lelong =21 type PointM 5106>32 lelong =23 type PolyLineM 5107>32 lelong =25 type PolygonM 5108>32 lelong =28 type MultiPointM 5109>32 lelong =31 type MultiPatch 5110 5111#------------------------------------------------------------------------------ 5112# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 5113# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 5114# From Roger Leigh <roger@whinlatter.uklinux.net> 51150 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 51160 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 51170 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 5118 5119 5120#------------------------------------------------------------------------------ 5121# $File: filesystems,v 1.55 2010/01/16 17:45:12 chl Exp $ 5122# filesystems: file(1) magic for different filesystems 5123# 51240 string \366\366\366\366 PC formatted floppy with no filesystem 5125# Sun disk labels 5126# From /usr/include/sun/dklabel.h: 51270774 beshort 0xdabe 5128# modified by Joerg Jenderek, because original test 5129# succeeds for Cabinet archive dao360.dl_ with negative blocks 5130>0770 long >0 Sun disk label 5131>>0 string x '%s 5132>>>31 string >\0 \b%s 5133>>>>63 string >\0 \b%s 5134>>>>>95 string >\0 \b%s 5135>>0 string x \b' 5136>>0734 short >0 %d rpm, 5137>>0736 short >0 %d phys cys, 5138>>0740 short >0 %d alts/cyl, 5139>>0746 short >0 %d interleave, 5140>>0750 short >0 %d data cyls, 5141>>0752 short >0 %d alt cyls, 5142>>0754 short >0 %d heads/partition, 5143>>0756 short >0 %d sectors/track, 5144>>0764 long >0 start cyl %ld, 5145>>0770 long x %ld blocks 5146# Is there a boot block written 1 sector in? 5147>512 belong&077777777 0600407 \b, boot block present 5148# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc 5149# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 51500 string SBMBAKUP_ Smart Boot Manager backup file 5151>9 string x \b, version %-5.5s 5152>>14 string =_ 5153>>>15 string x %-.1s 5154>>>>16 string =_ \b. 5155>>>>>17 string x \b%-.1s 5156>>>>>>18 string =_ \b. 5157>>>>>>>19 string x \b%-.1s 5158>>>22 ubyte 0 5159>>>>21 ubyte x \b, from drive 0x%x 5160>>>22 ubyte >0 5161>>>>21 string x \b, from drive %s 5162 5163# Joerg Jenderek 5164# DOS Emulator image is 128 byte, null right padded header + harddisc image 51650 string DOSEMU\0 5166>0x27E leshort 0xAA55 5167#offset is 128 5168>>19 ubyte 128 5169>>>(19.b-1) ubyte 0x0 DOS Emulator image 5170>>>>7 ulelong >0 \b, %u heads 5171>>>>11 ulelong >0 \b, %d sectors/track 5172>>>>15 ulelong >0 \b, %d cylinders 5173 5174# updated by Joerg Jenderek at Sep 2007 5175# only for sector sizes with 512 or more Bytes 51760x1FE leshort 0xAA55 x86 boot sector 5177# to do also for sectors < than 512 Bytes and some other files, GRR 5178#30 search/481 \x55\xAA x86 boot sector 5179# not for BeOS floppy 1440k, MBRs 5180#(11.s-2) uleshort 0xAA55 x86 boot sector 5181>2 string OSBS \b, OS/BS MBR 5182# J\xf6rg Jenderek <joerg dot jenderek at web dot de> 5183>0x8C string Invalid\ partition\ table \b, MS-DOS MBR 5184# dr-dos with some upper-, lowercase variants 5185>0x9D string Invalid\ partition\ table$ 5186>>181 string No\ Operating\ System$ 5187>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 5188>0x9D string Invalid\ partition\ table$ 5189>>181 string No\ operating\ system$ 5190>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 5191>342 string Invalid\ partition\ table$ 5192>>366 string No\ operating\ system$ 5193>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 5194>295 string NEWLDR\0 5195>>302 string Bad\ PT\ $ 5196>>>310 string No\ OS\ $ 5197>>>>317 string OS\ load\ err$ 5198>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 5199>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 5200>>>>>>>387 string Copyright\ (c)\ 1984,1998 5201>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 5202>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 5203>>0x1B8 ubelong >0 \b, Serial 0x%-.4x 5204>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 5205>271 string Invalid\ partition\ table\0 5206>>295 string Error\ loading\ operating\ system\0 5207>>>326 string Missing\ operating\ system\0 \b, mbr 5208# 5209>139 string Invalid\ partition\ table\0 5210>>163 string Error\ loading\ operating\ system\0 5211>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr 5212# http://www.heise.de/ct/05/09/006/ page 184 5213#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes 5214>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x 5215>300 string Invalid\ partition\ table\0 5216>>324 string Error\ loading\ operating\ system\0 5217>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR 5218#??>>>389 string Invalid\ system\ disk 5219>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 5220>300 string Ung\201ltige\ Partitionstabelle 5221#split string to avoid error: String too long 5222>>328 string Fehler\ beim\ Laden\ 5223>>>346 string des\ Betriebssystems 5224>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) 5225>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 5226#>0x145 string Default:\ F \b, FREE-DOS MBR 5227#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 5228>0x145 search/7 Default:\ F \b, FREE-DOS MBR 5229#>>313 string F0\ .\ .\ . 5230#>>>322 string disk\ 1 5231#>>>>382 string FAT3 5232>64 string no\ active\ partition\ found 5233>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 5234# Ranish Partition Manager http://www.ranish.com/part/ 5235>387 search/4 \0\ Error!\r 5236>>378 search/7 Virus! 5237>>>397 search/4 Booting\ 5238>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 5239>>>>>416 string Writing\ changes... \b2.37 5240>>>>>>438 ubyte x \b,0x%x dots 5241>>>>>>440 ubyte >0 \b,virus check 5242>>>>>>441 ubyte >0 \b,partition %c 5243#2.38,2.42,2.44 5244>>>>>416 string !Writing\ changes... \b 5245>>>>>>418 ubyte 1 \bvirus check, 5246>>>>>>419 ubyte x \b0x%x seconds 5247>>>>>>420 ubyte&0x0F >0 \b,partition 5248>>>>>>>420 ubyte&0x0F <5 \b %x 5249>>>>>>>420 ubyte&0x0F 0Xf \b ask 5250>>>>>420 ubyte x \b) 5251# 5252>271 string Operating\ system\ loading 5253>>296 string error\r \b, SYSLINUX MBR (2.10) 5254# http://www.acronis.de/ 5255>362 string MBR\ Error\ \0\r 5256>>376 string ress\ any\ key\ to\ 5257>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 5258# added by Joerg Jenderek 5259# http://www.visopsys.org/ 5260# http://partitionlogic.org.uk/ 5261>309 string No\ bootable\ partition\ found\r 5262>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 5263>349 string No\ bootable\ partition\ found\r 5264>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 5265# bootloader, bootmanager 5266>0x40 string SBML 5267# label with 11 characters of FAT 12 bit filesystem 5268>>43 string SMART\ BTMGR 5269>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 5270# OEM-ID not always "SBM" 5271#>>>>3 strings SBM 5272>>>>6 string >\0 \b, version %s 5273>382 string XOSLLOADXCF \b, eXtended Operating System Loader 5274>6 string LILO \b, LInux i386 boot LOader 5275>>120 string LILO \b, version 22.3.4 SuSe 5276>>172 string LILO \b, version 22.5.8 Debian 5277# updated by Joerg Jenderek at Oct 2008 5278# variables according to grub-0.97/stage1/stage1.S or 5279# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 5280# usual values are marked with comments to get only informations of strange GRUB loaders 5281>342 search/60 \0Geom\0 5282#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 5283>>0x41 ubyte <2 5284>>>0x3E ubyte >2 \b; GRand Unified Bootloader 5285# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 5286>>>>0x3E ubyte x \b, stage1 version 0x%x 5287#If it is 0xFF, use a drive passed by BIOS 5288>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 5289# in most case 0,1,0x2e for GRUB 0.5.95 5290>>>>0x41 ubyte >0 \b, LBA flag 0x%x 5291>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 5292#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 5293>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 5294#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 5295>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 5296>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 5297#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 5298>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 5299>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 5300>>>>>394 string stage1 \b, GRUB version 0.5.95 5301>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 5302>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 5303>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 5304>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 5305>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 5306>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 5307>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 5308>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 5309#unkown version 5310>>>343 string Geom\0Read\0\ Error\0 5311>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 5312>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 5313>>>>374 string GRUB\ \0 \b, GRUB version n.m 5314# http://syslinux.zytor.com/ 5315>478 string Boot\ failed\r 5316>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) 5317>480 string Boot\ failed\r 5318>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) 5319>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) 5320>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 5321# http://www.bcdwb.de/bcdw/index_e.htm 5322>3 string BCDL 5323>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 5324# mbr partition table entries 5325# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs 5326>3 string !MS 5327>>3 string !SYSLINUX 5328>>>3 string !MTOOL 5329>>>>3 string !NEWLDR 5330>>>>>5 string !DOS 5331# not FAT (32 bit) 5332>>>>>>82 string !FAT32 5333#not Linux kernel 5334>>>>>>>514 string !HdrS 5335#not BeOS 5336>>>>>>>>422 string !Be\ Boot\ Loader 5337# active flag 0 or 0x80 and type > 0 5338>>>>>>>>>446 ubyte <0x81 5339>>>>>>>>>>446 ubyte&0x7F 0 5340>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 5341>>>>>>>>>>>>446 ubyte 0x80 \b, active 5342>>>>>>>>>>>>447 ubyte x \b, starthead %u 5343#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 5344#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 5345>>>>>>>>>>>>454 ulelong x \b, startsector %u 5346>>>>>>>>>>>>458 ulelong x \b, %u sectors 5347# 5348>>>>>>>>>462 ubyte <0x81 5349>>>>>>>>>>462 ubyte&0x7F 0 5350>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 5351>>>>>>>>>>>>462 ubyte 0x80 \b, active 5352>>>>>>>>>>>>463 ubyte x \b, starthead %u 5353#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 5354#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 5355>>>>>>>>>>>>470 ulelong x \b, startsector %u 5356>>>>>>>>>>>>474 ulelong x \b, %u sectors 5357# 5358>>>>>>>>>478 ubyte <0x81 5359>>>>>>>>>>478 ubyte&0x7F 0 5360>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 5361>>>>>>>>>>>>478 ubyte 0x80 \b, active 5362>>>>>>>>>>>>479 ubyte x \b, starthead %u 5363#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 5364#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 5365#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 5366>>>>>>>>>>>>486 ulelong x \b, startsector %u 5367>>>>>>>>>>>>490 ulelong x \b, %u sectors 5368# 5369>>>>>>>>>494 ubyte <0x81 5370>>>>>>>>>>494 ubyte&0x7F 0 5371>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 5372>>>>>>>>>>>>494 ubyte 0x80 \b, active 5373>>>>>>>>>>>>495 ubyte x \b, starthead %u 5374#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 5375#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 5376>>>>>>>>>>>>502 ulelong x \b, startsector %u 5377>>>>>>>>>>>>506 ulelong x \b, %u sectors 5378# mbr partition table entries end 5379# http://www.acronis.de/ 5380#FAT label=ACRONIS\ SZ 5381#OEM-ID=BOOTWIZ0 5382>442 string Non-system\ disk,\ 5383>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 5384# DOS names like F11.SYS are 8 right space padded bytes+3 bytes 5385>>>477 ubyte&0xDF >0 5386>>>>477 string x \b %-.3s 5387>>>>>480 ubyte&0xDF >0 5388>>>>>>480 string x \b%-.5s 5389>>>>485 ubyte&0xDF >0 5390>>>>>485 string x \b.%-.3s 5391# 5392>185 string FDBOOT\ Version\ 5393>>204 string \rNo\ Systemdisk.\ 5394>>>220 string Booting\ from\ harddisk.\n\r 5395>>>245 string Cannot\ load\ from\ harddisk.\n\r 5396>>>>273 string Insert\ Systemdisk\ 5397>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 5398>>>>>>200 string >\0 \b, version %-3s 5399>242 string Bootsector\ from\ C.H.\ Hochst\204 5400>>278 string No\ Systemdisk.\ 5401>>>293 string Booting\ from\ harddisk.\n\r 5402>>>441 string Cannot\ load\ from\ harddisk.\n\r 5403>>>>469 string Insert\ Systemdisk\ 5404>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader 5405>>>>>>209 string >\0 \b, version %-4.4s 5406>(1.b+2) ubyte 0xe 5407>>(1.b+3) ubyte 0x1f 5408>>>(1.b+4) ubyte 0xbe 5409>>>>(1.b+5) ubyte 0x77 5410>>>>(1.b+6) ubyte 0x7c 5411>>>>>(1.b+7) ubyte 0xac 5412>>>>>>(1.b+8) ubyte 0x22 5413>>>>>>>(1.b+9) ubyte 0xc0 5414>>>>>>>>(1.b+10) ubyte 0x74 5415>>>>>>>>>(1.b+11) ubyte 0xb 5416>>>>>>>>>>(1.b+12) ubyte 0x56 5417>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 5418>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 5419#>>244 string from\ dosemu-freedos-*-bin.tgz\r 5420#>>>170 string Sorry,\ could\ not\ load\ an\ 5421#>>>>195 string operating\ system.\r\n 5422# 5423>103 string This\ is\ not\ a\ bootable\ disk.\ 5424>>132 string Please\ insert\ a\ bootable\ 5425>>>157 string floppy\ and\r\n 5426>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 5427# 5428>66 string Solaris\ Boot\ Sector 5429>>99 string Incomplete\ MDBoot\ load. 5430>>>89 string Version \b, Sun Solaris Bootloader 5431>>>>97 byte x version %c 5432# 5433>408 string OS/2\ !!\ SYS01475\r\0 5434>>429 string OS/2\ !!\ SYS02025\r\0 5435>>>450 string OS/2\ !!\ SYS02027\r\0 5436>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 5437# 5438>409 string OS/2\ !!\ SYS01475\r\0 5439>>430 string OS/2\ !!\ SYS02025\r\0 5440>>>451 string OS/2\ !!\ SYS02027\r\0 5441>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 5442>112 string This\ disk\ is\ not\ bootable\r 5443>>142 string If\ you\ wish\ to\ make\ it\ bootable 5444>>>176 string run\ the\ DOS\ program\ SYS\ 5445>>>200 string after\ the\r 5446>>>>216 string system\ has\ been\ loaded\r\n 5447>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 5448>>>>>271 string into\r\n\ the\ drive\ and\ 5449>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 5450# XP 5451>430 string NTLDR\ is\ missing\xFF\r\n 5452>>449 string Disk\ error\xFF\r\n 5453>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 5454# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 5455>>>>417 ubyte&0xDF >0 5456>>>>>417 string x %-.5s 5457>>>>>>422 ubyte&0xDF >0 5458>>>>>>>422 string x \b%-.3s 5459>>>>>425 ubyte&0xDF >0 5460>>>>>>425 string >\ \b.%-.3s 5461# 5462>>>>371 ubyte >0x20 5463>>>>>368 ubyte&0xDF >0 5464>>>>>>368 string x %-.5s 5465>>>>>>>373 ubyte&0xDF >0 5466>>>>>>>>373 string x \b%-.3s 5467>>>>>>376 ubyte&0xDF >0 5468>>>>>>>376 string x \b.%-.3s 5469# 5470>430 string NTLDR\ nicht\ gefunden\xFF\r\n 5471>>453 string Datentr\204gerfehler\xFF\r\n 5472>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 5473>>>>417 ubyte&0xDF >0 5474>>>>>417 string x %-.5s 5475>>>>>>422 ubyte&0xDF >0 5476>>>>>>>422 string x \b%-.3s 5477>>>>>425 ubyte&0xDF >0 5478>>>>>>425 string >\ \b.%-.3s 5479# offset variant 5480>>>>379 string \0 5481>>>>>368 ubyte&0xDF >0 5482>>>>>>368 string x %-.5s 5483>>>>>>>373 ubyte&0xDF >0 5484>>>>>>>>373 string x \b%-.3s 5485# 5486>430 string NTLDR\ fehlt\xFF\r\n 5487>>444 string Datentr\204gerfehler\xFF\r\n 5488>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 5489>>>>417 ubyte&0xDF >0 5490>>>>>417 string x %-.5s 5491>>>>>>422 ubyte&0xDF >0 5492>>>>>>>422 string x \b%-.3s 5493>>>>>425 ubyte&0xDF >0 5494>>>>>>425 string >\ \b.%-.3s 5495# variant 5496>>>>371 ubyte >0x20 5497>>>>>368 ubyte&0xDF >0 5498>>>>>>368 string x %-.5s 5499>>>>>>>373 ubyte&0xDF >0 5500>>>>>>>>373 string x \b%-.3s 5501>>>>>>376 ubyte&0xDF >0 5502>>>>>>>376 string x \b.%-.3s 5503# 5504>430 string NTLDR\ fehlt\xFF\r\n 5505>>444 string Medienfehler\xFF\r\n 5506>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 5507>>>>371 ubyte >0x20 5508>>>>>368 ubyte&0xDF >0 5509>>>>>>368 string x %-.5s 5510>>>>>>>373 ubyte&0xDF >0 5511>>>>>>>>373 string x \b%-.3s 5512>>>>>>376 ubyte&0xDF >0 5513>>>>>>>376 string x \b.%-.3s 5514# variant 5515>>>>417 ubyte&0xDF >0 5516>>>>>417 string x %-.5s 5517>>>>>>422 ubyte&0xDF >0 5518>>>>>>>422 string x \b%-.3s 5519>>>>>425 ubyte&0xDF >0 5520>>>>>>425 string >\ \b.%-.3s 5521# 5522>430 string Datentr\204ger\ entfernen\xFF\r\n 5523>>454 string Medienfehler\xFF\r\n 5524>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 5525>>>>379 string \0 5526>>>>>368 ubyte&0xDF >0 5527>>>>>>368 string x %-.5s 5528>>>>>>>373 ubyte&0xDF >0 5529>>>>>>>>373 string x \b%-.3s 5530>>>>>>376 ubyte&0xDF >0 5531>>>>>>>376 string x \b.%-.3s 5532# variant 5533>>>>417 ubyte&0xDF >0 5534>>>>>417 string x %-.5s 5535>>>>>>422 ubyte&0xDF >0 5536>>>>>>>422 string x \b%-.3s 5537>>>>>425 ubyte&0xDF >0 5538>>>>>>425 string >\ \b.%-.3s 5539# 5540 5541#>3 string NTFS\ \ \ \ 5542>389 string Fehler\ beim\ Lesen\ 5543>>407 string des\ Datentr\204gers 5544>>>426 string NTLDR\ fehlt 5545>>>>440 string NTLDR\ ist\ komprimiert 5546>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 5547#>3 string NTFS\ \ \ \ 5548>313 string A\ disk\ read\ error\ occurred.\r 5549>>345 string A\ kernel\ file\ is\ missing\ 5550>>>370 string from\ the\ disk.\r 5551>>>>484 string NTLDR\ is\ compressed 5552>>>>>429 string Insert\ a\ system\ diskette\ 5553>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 5554# DOS loader variants different languages,offsets 5555>472 ubyte&0xDF >0 5556>>389 string Invalid\ system\ disk\xFF\r\n 5557>>>411 string Disk\ I/O\ error 5558>>>>428 string Replace\ the\ disk,\ and\ 5559>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 5560#IO.SYS 5561>>>>>>472 ubyte&0xDF >0 5562>>>>>>>472 string x \b %-.2s 5563>>>>>>>>474 ubyte&0xDF >0 5564>>>>>>>>>474 string x \b%-.5s 5565>>>>>>>>>>479 ubyte&0xDF >0 5566>>>>>>>>>>>479 string x \b%-.1s 5567>>>>>>>480 ubyte&0xDF >0 5568>>>>>>>>480 string x \b.%-.3s 5569#MSDOS.SYS 5570>>>>>>>483 ubyte&0xDF >0 \b+ 5571>>>>>>>>483 string x \b%-.5s 5572>>>>>>>>>488 ubyte&0xDF >0 5573>>>>>>>>>>488 string x \b%-.3s 5574>>>>>>>>491 ubyte&0xDF >0 5575>>>>>>>>>491 string x \b.%-.3s 5576# 5577>>390 string Invalid\ system\ disk\xFF\r\n 5578>>>412 string Disk\ I/O\ error\xFF\r\n 5579>>>>429 string Replace\ the\ disk,\ and\ 5580>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 5581>>388 string Ungueltiges\ System\ \xFF\r\n 5582>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 5583>>>>427 string Datentraeger\ wechseln\ und\ 5584>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 5585#WINBOOT.SYS only not spaces (0xDF) 5586>>>>>>497 ubyte&0xDF >0 5587>>>>>>>497 string x %-.5s 5588>>>>>>>>502 ubyte&0xDF >0 5589>>>>>>>>>502 string x \b%-.1s 5590>>>>>>>>>>503 ubyte&0xDF >0 5591>>>>>>>>>>>503 string x \b%-.1s 5592>>>>>>>>>>>>504 ubyte&0xDF >0 5593>>>>>>>>>>>>>504 string x \b%-.1s 5594>>>>>>505 ubyte&0xDF >0 5595>>>>>>>505 string x \b.%-.3s 5596#IO.SYS 5597>>>>>>472 ubyte&0xDF >0 or 5598>>>>>>>472 string x \b %-.2s 5599>>>>>>>>474 ubyte&0xDF >0 5600>>>>>>>>>474 string x \b%-.5s 5601>>>>>>>>>>479 ubyte&0xDF >0 5602>>>>>>>>>>>479 string x \b%-.1s 5603>>>>>>>480 ubyte&0xDF >0 5604>>>>>>>>480 string x \b.%-.3s 5605#MSDOS.SYS 5606>>>>>>>483 ubyte&0xDF >0 \b+ 5607>>>>>>>>483 string x \b%-.5s 5608>>>>>>>>>488 ubyte&0xDF >0 5609>>>>>>>>>>488 string x \b%-.3s 5610>>>>>>>>491 ubyte&0xDF >0 5611>>>>>>>>>491 string x \b.%-.3s 5612# 5613>>390 string Ungueltiges\ System\ \xFF\r\n 5614>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 5615>>>>429 string Datentraeger\ wechseln\ und\ 5616>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 5617#WINBOOT.SYS only not spaces (0xDF) 5618>>>>>>497 ubyte&0xDF >0 5619>>>>>>>497 string x %-.7s 5620>>>>>>>>504 ubyte&0xDF >0 5621>>>>>>>>>504 string x \b%-.1s 5622>>>>>>505 ubyte&0xDF >0 5623>>>>>>>505 string x \b.%-.3s 5624#IO.SYS 5625>>>>>>472 ubyte&0xDF >0 or 5626>>>>>>>472 string x \b %-.2s 5627>>>>>>>>474 ubyte&0xDF >0 5628>>>>>>>>>474 string x \b%-.6s 5629>>>>>>>480 ubyte&0xDF >0 5630>>>>>>>>480 string x \b.%-.3s 5631#MSDOS.SYS 5632>>>>>>>483 ubyte&0xDF >0 \b+ 5633>>>>>>>>483 string x \b%-.5s 5634>>>>>>>>>488 ubyte&0xDF >0 5635>>>>>>>>>>488 string x \b%-.3s 5636>>>>>>>>491 ubyte&0xDF >0 5637>>>>>>>>>491 string x \b.%-.3s 5638# 5639>>389 string Ungueltiges\ System\ \xFF\r\n 5640>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 5641>>>>428 string Datentraeger\ wechseln\ und\ 5642>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 5643# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 5644>>>>>>472 string x %-.2s 5645>>>>>>>474 ubyte&0xDF >0 5646>>>>>>>>474 string x \b%-.5s 5647>>>>>>>>479 ubyte&0xDF >0 5648>>>>>>>>>479 string x \b%-.1s 5649>>>>>>480 ubyte&0xDF >0 5650>>>>>>>480 string x \b.%-.3s 5651>>>>>>483 ubyte&0xDF >0 \b+ 5652>>>>>>>483 string x \b%-.5s 5653>>>>>>>488 ubyte&0xDF >0 5654>>>>>>>>488 string x \b%-.2s 5655>>>>>>>>490 ubyte&0xDF >0 5656>>>>>>>>>490 string x \b%-.1s 5657>>>>>>>491 ubyte&0xDF >0 5658>>>>>>>>491 string x \b.%-.3s 5659>479 ubyte&0xDF >0 5660>>416 string Kein\ System\ oder\ 5661>>>433 string Laufwerksfehler 5662>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 5663#IO.SYS 5664>>>>>479 string x \b %-.2s 5665>>>>>>481 ubyte&0xDF >0 5666>>>>>>>481 string x \b%-.6s 5667>>>>>487 ubyte&0xDF >0 5668>>>>>>487 string x \b.%-.3s 5669#MSDOS.SYS 5670>>>>>>490 ubyte&0xDF >0 \b+ 5671>>>>>>>490 string x \b%-.5s 5672>>>>>>>>495 ubyte&0xDF >0 5673>>>>>>>>>495 string x \b%-.3s 5674>>>>>>>498 ubyte&0xDF >0 5675>>>>>>>>498 string x \b.%-.3s 5676# 5677>376 search/41 Non-System\ disk\ or\ 5678>>395 search/41 disk\ error\r 5679>>>407 search/41 Replace\ and\ 5680>>>>419 search/41 press\ \b, 5681>>>>419 search/41 strike\ \b, old 5682>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 5683#449 Disk\ Boot\ failure\r MS 3.21 5684#466 Boot\ Failure\r MS 3.30 5685>>>>>468 search/18 \0 5686#IO.SYS,IBMBIO.COM 5687>>>>>>&0 string x \b %-.2s 5688>>>>>>>&-20 ubyte&0xDF >0 5689>>>>>>>>&-1 string x \b%-.4s 5690>>>>>>>>>&-16 ubyte&0xDF >0 5691>>>>>>>>>>&-1 string x \b%-.2s 5692>>>>>>&8 ubyte&0xDF >0 \b. 5693>>>>>>>&-1 string x \b%-.3s 5694#MSDOS.SYS,IBMDOS.COM 5695>>>>>>&11 ubyte&0xDF >0 \b+ 5696>>>>>>>&-1 string x \b%-.5s 5697>>>>>>>>&-6 ubyte&0xDF >0 5698>>>>>>>>>&-1 string x \b%-.1s 5699>>>>>>>>>>&-5 ubyte&0xDF >0 5700>>>>>>>>>>>&-1 string x \b%-.2s 5701>>>>>>>&7 ubyte&0xDF >0 \b. 5702>>>>>>>>&-1 string x \b%-.3s 5703>441 string Cannot\ load\ from\ harddisk.\n\r 5704>>469 string Insert\ Systemdisk\ 5705>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 5706#>43 string \224R-LOADER\ \ SYS =label 5707>54 string SYS 5708>>324 string VASKK 5709>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 5710# 5711>98 string Press\ a\ key\ to\ retry\0\r 5712>>120 string Cannot\ find\ file\ \0\r 5713>>>139 string Disk\ read\ error\0\r 5714>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 5715#DRBIOS.SYS 5716>>>>>44 ubyte&0xDF >0 5717>>>>>>44 string x \b %-.6s 5718>>>>>>>50 ubyte&0xDF >0 5719>>>>>>>>50 string x \b%-.2s 5720>>>>>>52 ubyte&0xDF >0 5721>>>>>>>52 string x \b.%-.3s 5722# 5723>70 string IBMBIO\ \ COM 5724>>472 string Cannot\ load\ DOS!\ 5725>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 5726>>471 string Cannot\ load\ DOS\ 5727>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 5728#?? 5729>444 string KERNEL\ \ SYS 5730>>314 string BOOT\ error! \b, FREE-DOS Bootloader 5731>499 string KERNEL\ \ SYS 5732>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 5733>449 string KERNEL\ \ SYS 5734>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 5735# 5736>449 string Loading\ FreeDOS 5737>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 5738>>>497 ubyte&0xDF >0 5739>>>>497 string x \b %-.6s 5740>>>>>503 ubyte&0xDF >0 5741>>>>>>503 string x \b%-.1s 5742>>>>>>>504 ubyte&0xDF >0 5743>>>>>>>>504 string x \b%-.1s 5744>>>>505 ubyte&0xDF >0 5745>>>>>505 string x \b.%-.3s 5746# 5747>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 5748# 5749>125 string Loading\ FreeDOS...\r 5750>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 5751>>>441 ubyte&0xDF >0 5752>>>>441 string x \b %-.6s 5753>>>>>447 ubyte&0xDF >0 5754>>>>>>447 string x \b%-.1s 5755>>>>>>>448 ubyte&0xDF >0 5756>>>>>>>>448 string x \b%-.1s 5757>>>>449 ubyte&0xDF >0 5758>>>>>449 string x \b.%-.3s 5759>124 string FreeDOS\0 5760>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 5761# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 5762>>>497 ubyte&0xDF >0 5763>>>>497 string x \b %-.6s 5764>>>>>503 ubyte&0xDF >0 5765>>>>>>503 string x \b%-.1s 5766>>>>>>>504 ubyte&0xDF >0 5767>>>>>>>>504 string x \b%-.1s 5768>>>>505 ubyte&0xDF >0 5769>>>>>505 string x \b.%-.3s 5770>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 5771>>>497 ubyte&0xDF >0 5772>>>>497 string x \b %-.6s 5773>>>>>503 ubyte&0xDF >0 5774>>>>>>503 string x \b%-.1s 5775>>>>>>>504 ubyte&0xDF >0 5776>>>>>>>>504 string x \b%-.1s 5777>>>>505 ubyte&0xDF >0 5778>>>>>505 string x \b.%-.3s 5779>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 5780>>>497 ubyte&0xDF >0 5781>>>>497 string x \b %-.6s 5782>>>>>503 ubyte&0xDF >0 5783>>>>>>503 string x \b%-.1s 5784>>>>>>>504 ubyte&0xDF >0 5785>>>>>>>>504 string x \b%-.1s 5786>>>>505 ubyte&0xDF >0 5787>>>>>505 string x \b.%-.3s 5788>336 string Error!\ 5789>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 5790>>>497 ubyte&0xDF >0 5791>>>>497 string x \b %-.6s 5792>>>>>503 ubyte&0xDF >0 5793>>>>>>503 string x \b%-.1s 5794>>>>>>>504 ubyte&0xDF >0 5795>>>>>>>>504 string x \b%-.1s 5796>>>>505 ubyte&0xDF >0 5797>>>>>505 string x \b.%-.3s 5798# added by Joerg Jenderek 5799# http://www.visopsys.org/ 5800# http://partitionlogic.org.uk/ 5801# OEM-ID=Visopsys 5802>478 ulelong 0 5803>>(1.b+326) string I/O\ Error\ reading\ 5804>>>(1.b+344) string Visopsys\ loader\r 5805>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 5806# http://alexfru.chat.ru/epm.html#bootprog 5807>494 ubyte >0x4D 5808>>495 string >E 5809>>>495 string <S 5810#OEM-ID is not reliable 5811>>>>3 string BootProg 5812# It just looks for a program file name at the root directory 5813# and loads corresponding file with following execution. 5814# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 5815>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 5816>>>>>499 string x \b %-.1s 5817>>>>>>500 ubyte&0xDF >0 5818>>>>>>>500 string x \b%-.1s 5819>>>>>>>>501 ubyte&0xDF >0 5820>>>>>>>>>501 string x \b%-.1s 5821>>>>>>>>>>502 ubyte&0xDF >0 5822>>>>>>>>>>>502 string x \b%-.1s 5823>>>>>>>>>>>>503 ubyte&0xDF >0 5824>>>>>>>>>>>>>503 string x \b%-.1s 5825>>>>>>>>>>>>>>504 ubyte&0xDF >0 5826>>>>>>>>>>>>>>>504 string x \b%-.1s 5827>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 5828>>>>>>>>>>>>>>>>>505 string x \b%-.1s 5829>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 5830>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 5831#name extension 5832>>>>>507 ubyte&0xDF >0 \b. 5833>>>>>>507 string x \b%-.1s 5834>>>>>>>508 ubyte&0xDF >0 5835>>>>>>>>508 string x \b%-.1s 5836>>>>>>>>>509 ubyte&0xDF >0 5837>>>>>>>>>>509 string x \b%-.1s 5838#If the boot sector fails to read any other sector, 5839#it prints a very short message ("RE") to the screen and hangs the computer. 5840#If the boot sector fails to find needed program in the root directory, 5841#it also hangs with another message ("NF"). 5842>>>>>492 string RENF \b, FAT (12 bit) 5843>>>>>495 string RENF \b, FAT (16 bit) 5844# http://alexfru.chat.ru/epm.html#bootprog 5845>494 ubyte >0x4D 5846>>495 string >E 5847>>>495 string <S 5848#OEM-ID is not reliable 5849>>>>3 string BootProg 5850# It just looks for a program file name at the root directory 5851# and loads corresponding file with following execution. 5852# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 5853>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 5854>>>>>499 string x \b %-.1s 5855>>>>>>500 ubyte&0xDF >0 5856>>>>>>>500 string x \b%-.1s 5857>>>>>>>>501 ubyte&0xDF >0 5858>>>>>>>>>501 string x \b%-.1s 5859>>>>>>>>>>502 ubyte&0xDF >0 5860>>>>>>>>>>>502 string x \b%-.1s 5861>>>>>>>>>>>>503 ubyte&0xDF >0 5862>>>>>>>>>>>>>503 string x \b%-.1s 5863>>>>>>>>>>>>>>504 ubyte&0xDF >0 5864>>>>>>>>>>>>>>>504 string x \b%-.1s 5865>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 5866>>>>>>>>>>>>>>>>>505 string x \b%-.1s 5867>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 5868>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 5869#name extension 5870>>>>>507 ubyte&0xDF >0 \b. 5871>>>>>>507 string x \b%-.1s 5872>>>>>>>508 ubyte&0xDF >0 5873>>>>>>>>508 string x \b%-.1s 5874>>>>>>>>>509 ubyte&0xDF >0 5875>>>>>>>>>>509 string x \b%-.1s 5876#If the boot sector fails to read any other sector, 5877#it prints a very short message ("RE") to the screen and hangs the computer. 5878#If the boot sector fails to find needed program in the root directory, 5879#it also hangs with another message ("NF"). 5880>>>>>492 string RENF \b, FAT (12 bit) 5881>>>>>495 string RENF \b, FAT (16 bit) 5882# x86 bootloader end 5883# updated by Joerg Jenderek at Sep 2007 5884>3 ubyte 0 5885#no active flag 5886>>446 ubyte 0 5887# partition 1 not empty 5888>>>450 ubyte >0 5889# partitions 3,4 empty 5890>>>>482 ubyte 0 5891>>>>>498 ubyte 0 5892# partition 2 ID=0,5,15 5893>>>>>>466 ubyte <0x10 5894>>>>>>>466 ubyte 0x05 \b, extended partition table 5895>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 5896>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 5897# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 5898# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD 5899# older drives may use Near JuMP instruction E9 xx xx 5900>0 lelong&0x009000EB 0x009000EB 5901>0 lelong&0x000000E9 0x000000E9 5902# minimal short forward jump found 03cx?? 5903# maximal short forward jump is 07fx 5904>1 ubyte <0xff \b, code offset 0x%x 5905# mtools-3.9.8/msdos.h 5906# usual values are marked with comments to get only informations of strange FAT systems 5907# valid sectorsize must be a power of 2 from 32 to 32768 5908>>11 uleshort&0x000f x 5909>>>11 uleshort <32769 5910>>>>11 uleshort >31 5911>>>>>21 ubyte&0xf0 0xF0 5912>>>>>>3 string >\0 \b, OEM-ID "%8.8s" 5913#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 5914>>>>>>>8 string IHC \b cached by Windows 9M 5915>>>>>>11 uleshort >512 \b, Bytes/sector %u 5916#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 5917>>>>>>11 uleshort <512 \b, Bytes/sector %u 5918>>>>>>13 ubyte >1 \b, sectors/cluster %u 5919#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 5920>>>>>>14 uleshort >32 \b, reserved sectors %u 5921#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 5922#>>>>>>14 uleshort >1 \b, reserved sectors %u 5923#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 5924>>>>>>14 uleshort <1 \b, reserved sectors %u 5925>>>>>>16 ubyte >2 \b, FATs %u 5926#>>>>>>16 ubyte =2 \b, FATs %u (usual) 5927>>>>>>16 ubyte =1 \b, FAT %u 5928>>>>>>16 ubyte >0 5929>>>>>>17 uleshort >0 \b, root entries %u 5930#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 5931>>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 5932#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 5933>>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 5934#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 5935>>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 5936>>>>>>22 uleshort >0 \b, sectors/FAT %u 5937#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 5938>>>>>>26 ubyte >2 \b, heads %u 5939#>>>>>>26 ubyte =2 \b, heads %u (usual floppy) 5940>>>>>>26 ubyte =1 \b, heads %u 5941#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 5942>>>>>>38 ubyte !0x70 5943>>>>>>>28 ulelong >0 \b, hidden sectors %u 5944#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 5945>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 5946#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 5947# FAT<32 specific 5948>>>>>>82 string !FAT32 5949#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 5950#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 5951>>>>>>>36 ubyte !0x80 5952>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 5953>>>>>>>37 ubyte >0 \b, reserved 0x%x 5954#>>>>>>>37 ubyte =0 \b, reserved 0x%x 5955>>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 5956>>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 5957>>>>>>>38 ubyte =0x29 5958>>>>>>>>39 ulelong x \b, serial number 0x%x 5959>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 5960>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 5961>>>>>>>>43 string =NO\ NAME \b, unlabeled 5962>>>>>>>54 string FAT \b, FAT 5963>>>>>>>>54 string FAT12 \b (12 bit) 5964>>>>>>>>54 string FAT16 \b (16 bit) 5965# FAT32 specific 5966>>>>>>82 string FAT32 \b, FAT (32 bit) 5967>>>>>>>36 ulelong x \b, sectors/FAT %u 5968>>>>>>>40 uleshort >0 \b, extension flags %u 5969#>>>>>>>40 uleshort =0 \b, extension flags %u 5970>>>>>>>42 uleshort >0 \b, fsVersion %u 5971#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 5972>>>>>>>44 ulelong >2 \b, rootdir cluster %u 5973#>>>>>>>44 ulelong =2 \b, rootdir cluster %u 5974#>>>>>>>44 ulelong =1 \b, rootdir cluster %u 5975>>>>>>>48 uleshort >1 \b, infoSector %u 5976#>>>>>>>48 uleshort =1 \b, infoSector %u (usual) 5977>>>>>>>48 uleshort <1 \b, infoSector %u 5978>>>>>>>50 uleshort >6 \b, Backup boot sector %u 5979#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 5980>>>>>>>50 uleshort <6 \b, Backup boot sector %u 5981>>>>>>>54 ulelong >0 \b, reserved1 0x%x 5982>>>>>>>58 ulelong >0 \b, reserved2 0x%x 5983>>>>>>>62 ulelong >0 \b, reserved3 0x%x 5984# same structure as FAT1X 5985>>>>>>>64 ubyte >0x80 \b, physical drive 0x%x 5986#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 5987>>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x 5988#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 5989>>>>>>>65 ubyte >0 \b, reserved 0x%x 5990>>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 5991>>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 5992>>>>>>>66 ubyte =0x29 5993>>>>>>>>67 ulelong x \b, serial number 0x%x 5994>>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 5995>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 5996>>>>>>>71 string =NO\ NAME \b, unlabeled 5997### FATs end 5998>0x200 lelong 0x82564557 \b, BSD disklabel 5999# FATX 60000 string FATX FATX filesystem data 6001 6002 6003# Minix filesystems - Juan Cespedes <cespedes@debian.org> 60040x410 leshort 0x137f 6005!:strength / 2 6006>0x402 beshort < 100 6007>0x402 beshort > -1 Minix filesystem, V1, %d zones 6008>0x1e string minix \b, bootable 60090x410 beshort 0x137f 6010!:strength / 2 6011>0x402 beshort < 100 6012>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 6013>0x1e string minix \b, bootable 60140x410 leshort 0x138f 6015!:strength / 2 6016>0x402 beshort < 100 6017>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 6018>0x1e string minix \b, bootable 60190x410 beshort 0x138f 6020!:strength / 2 6021>0x402 beshort < 100 6022>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 6023>0x1e string minix \b, bootable 60240x410 leshort 0x2468 6025>0x402 beshort < 100 6026>>0x402 beshort > -1 Minix filesystem, V2, %d zones 6027>0x1e string minix \b, bootable 60280x410 beshort 0x2468 6029>0x402 beshort < 100 6030>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 6031>0x1e string minix \b, bootable 6032 60330x410 leshort 0x2478 6034>0x402 beshort < 100 6035>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 6036>0x1e string minix \b, bootable 60370x410 leshort 0x2478 6038>0x402 beshort < 100 6039>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 6040>0x1e string minix \b, bootable 60410x410 beshort 0x2478 6042>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 6043>0x1e string minix \b, bootable 60440x410 leshort 0x4d5a 6045>0x402 beshort !0 Minix filesystem, V3, %d zones 6046>0x1e string minix \b, bootable 6047 6048# romfs filesystems - Juan Cespedes <cespedes@debian.org> 60490 string -rom1fs- romfs filesystem, version 1 6050>8 belong x %d bytes, 6051>16 string x named %s. 6052 6053# netboot image - Juan Cespedes <cespedes@debian.org> 60540 lelong 0x1b031336L Netboot image, 6055>4 lelong&0xFFFFFF00 0 6056>>4 lelong&0x100 0x000 mode 2 6057>>4 lelong&0x100 0x100 mode 3 6058>4 lelong&0xFFFFFF00 !0 unknown mode 6059 60600x18b string OS/2 OS/2 Boot Manager 6061 6062# updated by Joerg Jenderek at Oct 2008!! 6063# http://syslinux.zytor.com/iso.php 60640 ulelong 0x7c40eafa isolinux Loader 6065# http://syslinux.zytor.com/pxe.php 60660 ulelong 0x007c05ea pxelinux Loader 60670 ulelong 0x60669c66 pxelinux Loader 6068 6069# added by Joerg Jenderek 6070# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 6071# grub-1.94/kern/i386/pc/startup.S 6072# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6073# usual values are marked with comments to get only informations of strange GRUB loaders 60740x200 uleshort 0x70EA 6075# found only version 3.{1,2} 6076>0x206 ubeshort >0x0300 6077# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 6078>>0x212 ubyte >0x29 6079>>>0x213 ubyte >0x29 6080# not iso9660_stage1_5 6081#>>>0 ulelong&0x00BE5652 0x00BE5652 6082>>>>0x213 ubyte >0x29 GRand Unified Bootloader 6083# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 6084>>>>0x217 ubyte 0xFF stage1_5 6085>>>>0x217 ubyte <0xFF stage2 6086>>>>0x206 ubyte x \b version %u 6087>>>>0x207 ubyte x \b.%u 6088# module_size for 1.94 6089>>>>0x208 ulelong <0xffffff \b, installed partition %u 6090#>>>>0x208 ulelong =0xffffff \b, %u (default) 6091>>>>0x208 ulelong >0xffffff \b, installed partition %u 6092# GRUB 0.5.95 unofficial 6093>>>>0x20C ulelong&0x2E300000 0x2E300000 6094# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6095>>>>>0x20C ubyte x \b, identifier 0x%x 6096#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 6097>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 6098# GRUB version as string 6099>>>>>0x20E string >\0 \b, GRUB version %-s 6100# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6101>>>>>>0x215 ulong 0xffffffff 6102>>>>>>>0x219 string >\0 \b, configuration file %-s 6103>>>>>>0x215 ulong !0xffffffff 6104>>>>>>>0x215 string >\0 \b, configuration file %-s 6105# newer GRUB versions 6106>>>>0x20C ulelong&0x2E300000 !0x2E300000 6107##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 6108>>>>>0x20C ulelong >0 \b, saved entry %d 6109# for 1.94 contains kernel image size 6110# for 0.93,0.94,0.96,0.97 6111# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 6112>>>>>0x210 ubyte x \b, identifier 0x%x 6113# The flag for LBA forcing is in most cases 0 6114#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 6115>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 6116# GRUB version as string 6117>>>>>0x212 string >\0 \b, GRUB version %-s 6118# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 6119>>>>>0x217 ulong 0xffffffff 6120>>>>>>0x21b string >\0 \b, configuration file %-s 6121>>>>>0x217 ulong !0xffffffff 6122>>>>>>0x217 string >\0 \b, configuration file %-s 6123 61249564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 6125>8404 string x last mounted on %s, 6126#>9504 ledate x last checked at %s, 6127>8224 ledate x last written at %s, 6128>8401 byte x clean flag %d, 6129>8228 lelong x number of blocks %d, 6130>8232 lelong x number of data blocks %d, 6131>8236 lelong x number of cylinder groups %d, 6132>8240 lelong x block size %d, 6133>8244 lelong x fragment size %d, 6134>8252 lelong x minimum percentage of free blocks %d, 6135>8256 lelong x rotational delay %dms, 6136>8260 lelong x disk rotational speed %drps, 6137>8320 lelong 0 TIME optimization 6138>8320 lelong 1 SPACE optimization 6139 614042332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 6141>&-1164 string x last mounted on %s, 6142>&-696 string >\0 volume name %s, 6143>&-304 leqldate x last written at %s, 6144>&-1167 byte x clean flag %d, 6145>&-1168 byte x readonly flag %d, 6146>&-296 lequad x number of blocks %lld, 6147>&-288 lequad x number of data blocks %lld, 6148>&-1332 lelong x number of cylinder groups %d, 6149>&-1328 lelong x block size %d, 6150>&-1324 lelong x fragment size %d, 6151>&-180 lelong x average file size %d, 6152>&-176 lelong x average number of files in dir %d, 6153>&-272 lequad x pending blocks to free %lld, 6154>&-264 lelong x pending inodes to free %ld, 6155>&-664 lequad x system-wide uuid %0llx, 6156>&-1316 lelong x minimum percentage of free blocks %d, 6157>&-1248 lelong 0 TIME optimization 6158>&-1248 lelong 1 SPACE optimization 6159 616066908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 6161>&-1164 string x last mounted on %s, 6162>&-696 string >\0 volume name %s, 6163>&-304 leqldate x last written at %s, 6164>&-1167 byte x clean flag %d, 6165>&-1168 byte x readonly flag %d, 6166>&-296 lequad x number of blocks %lld, 6167>&-288 lequad x number of data blocks %lld, 6168>&-1332 lelong x number of cylinder groups %d, 6169>&-1328 lelong x block size %d, 6170>&-1324 lelong x fragment size %d, 6171>&-180 lelong x average file size %d, 6172>&-176 lelong x average number of files in dir %d, 6173>&-272 lequad x pending blocks to free %lld, 6174>&-264 lelong x pending inodes to free %ld, 6175>&-664 lequad x system-wide uuid %0llx, 6176>&-1316 lelong x minimum percentage of free blocks %d, 6177>&-1248 lelong 0 TIME optimization 6178>&-1248 lelong 1 SPACE optimization 6179 61809564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 6181>7168 belong 0x4c41424c Apple UFS Volume 6182>>7186 string x named %s, 6183>>7176 belong x volume label version %d, 6184>>7180 bedate x created on %s, 6185>8404 string x last mounted on %s, 6186#>9504 bedate x last checked at %s, 6187>8224 bedate x last written at %s, 6188>8401 byte x clean flag %d, 6189>8228 belong x number of blocks %d, 6190>8232 belong x number of data blocks %d, 6191>8236 belong x number of cylinder groups %d, 6192>8240 belong x block size %d, 6193>8244 belong x fragment size %d, 6194>8252 belong x minimum percentage of free blocks %d, 6195>8256 belong x rotational delay %dms, 6196>8260 belong x disk rotational speed %drps, 6197>8320 belong 0 TIME optimization 6198>8320 belong 1 SPACE optimization 6199 620042332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 6201>&-1164 string x last mounted on %s, 6202>&-696 string >\0 volume name %s, 6203>&-304 beqldate x last written at %s, 6204>&-1167 byte x clean flag %d, 6205>&-1168 byte x readonly flag %d, 6206>&-296 bequad x number of blocks %lld, 6207>&-288 bequad x number of data blocks %lld, 6208>&-1332 belong x number of cylinder groups %d, 6209>&-1328 belong x block size %d, 6210>&-1324 belong x fragment size %d, 6211>&-180 belong x average file size %d, 6212>&-176 belong x average number of files in dir %d, 6213>&-272 bequad x pending blocks to free %lld, 6214>&-264 belong x pending inodes to free %ld, 6215>&-664 bequad x system-wide uuid %0llx, 6216>&-1316 belong x minimum percentage of free blocks %d, 6217>&-1248 belong 0 TIME optimization 6218>&-1248 belong 1 SPACE optimization 6219 622066908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 6221>&-1164 string x last mounted on %s, 6222>&-696 string >\0 volume name %s, 6223>&-304 beqldate x last written at %s, 6224>&-1167 byte x clean flag %d, 6225>&-1168 byte x readonly flag %d, 6226>&-296 bequad x number of blocks %lld, 6227>&-288 bequad x number of data blocks %lld, 6228>&-1332 belong x number of cylinder groups %d, 6229>&-1328 belong x block size %d, 6230>&-1324 belong x fragment size %d, 6231>&-180 belong x average file size %d, 6232>&-176 belong x average number of files in dir %d, 6233>&-272 bequad x pending blocks to free %lld, 6234>&-264 belong x pending inodes to free %ld, 6235>&-664 bequad x system-wide uuid %0llx, 6236>&-1316 belong x minimum percentage of free blocks %d, 6237>&-1248 belong 0 TIME optimization 6238>&-1248 belong 1 SPACE optimization 6239 6240# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 6241# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 62420x438 leshort 0xEF53 Linux 6243>0x44c lelong x rev %d 6244>0x43e leshort x \b.%d 6245# No journal? ext2 6246>0x45c lelong ^0x0000004 ext2 filesystem data 6247>>0x43a leshort ^0x0000001 (mounted or unclean) 6248# Has a journal? ext3 or ext4 6249>0x45c lelong &0x0000004 6250# and small INCOMPAT? 6251>>0x460 lelong <0x0000040 6252# and small RO_COMPAT? 6253>>>0x464 lelong <0x0000008 ext3 filesystem data 6254# else large RO_COMPAT? 6255>>>0x464 lelong >0x0000007 ext4 filesystem data 6256# else large INCOMPAT? 6257>>0x460 lelong >0x000003f ext4 filesystem data 6258# General flags for any ext* fs 6259>0x460 lelong &0x0000004 (needs journal recovery) 6260>0x43a leshort &0x0000002 (errors) 6261# INCOMPAT flags 6262>0x460 lelong &0x0000001 (compressed) 6263#>0x460 lelong &0x0000002 (filetype) 6264#>0x460 lelong &0x0000010 (meta bg) 6265>0x460 lelong &0x0000040 (extents) 6266>0x460 lelong &0x0000080 (64bit) 6267#>0x460 lelong &0x0000100 (mmp) 6268#>0x460 lelong &0x0000200 (flex bg) 6269# RO_INCOMPAT flags 6270#>0x464 lelong &0x0000001 (sparse super) 6271>0x464 lelong &0x0000002 (large files) 6272>0x464 lelong &0x0000008 (huge files) 6273#>0x464 lelong &0x0000010 (gdt checksum) 6274#>0x464 lelong &0x0000020 (many subdirs) 6275#>0x463 lelong &0x0000040 (extra isize) 6276 6277# SGI disk labels - Nathan Scott <nathans@debian.org> 62780 belong 0x0BE5A941 SGI disk label (volume header) 6279 6280# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 62810 belong 0x58465342 SGI XFS filesystem data 6282>0x4 belong x (blksz %d, 6283>0x68 beshort x inosz %d, 6284>0x64 beshort ^0x2004 v1 dirs) 6285>0x64 beshort &0x2004 v2 dirs) 6286 6287############################################################################ 6288# Minix-ST kernel floppy 62890x800 belong 0x46fc2700 Atari-ST Minix kernel image 6290>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 6291>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 6292 6293############################################################################ 6294# Hmmm, is this a better way of detecting _standard_ floppy images ? 629519 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 6296>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 629719 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 6298>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 629919 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 6300>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 6301 630219 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 6303>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 630419 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 6305>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 6306 630719 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 630819 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 6309 6310# Valid media descriptor bytes for MS-DOS: 6311# 6312# Byte Capacity Media Size and Type 6313# ------------------------------------------------- 6314# 6315# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 6316# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 6317# F9 720K 3.5-inch, 2-sided, 9-sector 6318# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 6319# FD 360K 5.25-inch, 2-sided, 9-sector 6320# FF 320K 5.25-inch, 2-sided, 8-sector 6321# FC 180K 5.25-inch, 1-sided, 9-sector 6322# FE 160K 5.25-inch, 1-sided, 8-sector 6323# FE 250K 8-inch, 1-sided, single-density 6324# FD 500K 8-inch, 2-sided, single-density 6325# FE 1.2 MB 8-inch, 2-sided, double-density 6326# F8 ----- Fixed disk 6327# 6328# FC xxxK Apricot 70x1x9 boot disk. 6329# 6330# Originally a bitmap: 6331# xxxxxxx0 Not two sided 6332# xxxxxxx1 Double sided 6333# xxxxxx0x Not 8 SPT 6334# xxxxxx1x 8 SPT 6335# xxxxx0xx Not Removable drive 6336# xxxxx1xx Removable drive 6337# 11111xxx Must be one. 6338# 6339# But now it's rather random: 6340# 111111xx Low density disk 6341# 00 SS, Not 8 SPT 6342# 01 DS, Not 8 SPT 6343# 10 SS, 8 SPT 6344# 11 DS, 8 SPT 6345# 6346# 11111001 Double density 3 floppy disk, high density 5 6347# 11110000 High density 3 floppy disk 6348# 11111000 Hard disk any format 6349# 6350 6351# CDROM Filesystems 6352# Modified for UDF by gerardo.cacciari@gmail.com 635332769 string CD001 6354!:mime application/x-iso9660-image 6355>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 6356>38913 string NSR0 UDF filesystem data 6357>>38917 string 1 (version 1.0) 6358>>38917 string 2 (version 1.5) 6359>>38917 string 3 (version 2.0) 6360>>38917 byte >0x33 (unknown version, ID 0x%X) 6361>>38917 byte <0x31 (unknown version, ID 0x%X) 6362# "application id" which appears to be used as a volume label 6363#>32808 string/T >\0 '%s' 6364>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 636537633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 6366!:mime application/x-iso9660-image 636732776 string CDROM High Sierra CD-ROM filesystem data 6368 6369# .cso files 63700 string CISO Compressed ISO CD image 6371 6372# cramfs filesystem - russell@coker.com.au 63730 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 6374>4 lelong x size %lu 6375>8 lelong &1 version #2 6376>8 lelong &2 sorted_dirs 6377>8 lelong &4 hole_support 6378>32 lelong x CRC 0x%x, 6379>36 lelong x edition %lu, 6380>40 lelong x %lu blocks, 6381>44 lelong x %lu files 6382 63830 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 6384>4 belong x size %lu 6385>8 belong &1 version #2 6386>8 belong &2 sorted_dirs 6387>8 belong &4 hole_support 6388>32 belong x CRC 0x%x, 6389>36 belong x edition %lu, 6390>40 belong x %lu blocks, 6391>44 belong x %lu files 6392 6393# reiserfs - russell@coker.com.au 63940x10034 string ReIsErFs ReiserFS V3.5 63950x10034 string ReIsEr2Fs ReiserFS V3.6 6396>0x1002c leshort x block size %d 6397>0x10032 leshort &2 (mounted or unclean) 6398>0x10000 lelong x num blocks %d 6399>0x10040 lelong 1 tea hash 6400>0x10040 lelong 2 yura hash 6401>0x10040 lelong 3 r5 hash 6402 6403# JFFS - russell@coker.com.au 64040 lelong 0x34383931 Linux Journalled Flash File system, little endian 64050 belong 0x34383931 Linux Journalled Flash File system, big endian 6406 6407# EST flat binary format (which isn't, but anyway) 6408# From: Mark Brown <broonie@sirena.org.uk> 64090 string ESTFBINR EST flat binary 6410 6411# Aculab VoIP firmware 6412# From: Mark Brown <broonie@sirena.org.uk> 64130 string VoIP\ Startup\ and Aculab VoIP firmware 6414>35 string x format %s 6415 6416# From: Mark Brown <broonie@sirena.org.uk> [old] 6417# From: Behan Webster <behanw@websterwood.com> 64180 belong 0x27051956 u-boot legacy uImage, 6419>32 string x %s, 6420>28 byte 0 Invalid os/ 6421>28 byte 1 OpenBSD/ 6422>28 byte 2 NetBSD/ 6423>28 byte 3 FreeBSD/ 6424>28 byte 4 4.4BSD/ 6425>28 byte 5 Linux/ 6426>28 byte 6 SVR4/ 6427>28 byte 7 Esix/ 6428>28 byte 8 Solaris/ 6429>28 byte 9 Irix/ 6430>28 byte 10 SCO/ 6431>28 byte 11 Dell/ 6432>28 byte 12 NCR/ 6433>28 byte 13 LynxOS/ 6434>28 byte 14 VxWorks/ 6435>28 byte 15 pSOS/ 6436>28 byte 16 QNX/ 6437>28 byte 17 Firmware/ 6438>28 byte 18 RTEMS/ 6439>28 byte 19 ARTOS/ 6440>28 byte 20 Unity OS/ 6441>28 byte 21 INTEGRITY/ 6442>29 byte 0 \bInvalid CPU, 6443>29 byte 1 \bAlpha, 6444>29 byte 2 \bARM, 6445>29 byte 3 \bIntel x86, 6446>29 byte 4 \bIA64, 6447>29 byte 5 \bMIPS, 6448>29 byte 6 \bMIPS 64-bit, 6449>29 byte 7 \bPowerPC, 6450>29 byte 8 \bIBM S390, 6451>29 byte 9 \bSuperH, 6452>29 byte 10 \bSparc, 6453>29 byte 11 \bSparc 64-bit, 6454>29 byte 12 \bM68K, 6455>29 byte 13 \bNios-32, 6456>29 byte 14 \bMicroBlaze, 6457>29 byte 15 \bNios-II, 6458>29 byte 16 \bBlackfin, 6459>29 byte 17 \bAVR32, 6460>29 byte 18 \bSTMicroelectronics ST200, 6461>30 byte 0 Invalid Image 6462>30 byte 1 Standalone Program 6463>30 byte 2 OS Kernel Image 6464>30 byte 3 RAMDisk Image 6465>30 byte 4 Multi-File Image 6466>30 byte 5 Firmware Image 6467>30 byte 6 Script File 6468>30 byte 7 Filesystem Image (any type) 6469>30 byte 8 Binary Flat Device Tree BLOB 6470>31 byte 0 (Not compressed), 6471>31 byte 1 (gzip), 6472>31 byte 2 (bzip2), 6473>31 byte 3 (lzma), 6474>12 belong x %d bytes, 6475>8 bedate x %s, 6476>16 belong x Load Address: 0x%08X, 6477>20 belong x Entry Point: 0x%08X, 6478>4 belong x Header CRC: 0x%08X, 6479>24 belong x Data CRC: 0x%08X 6480 6481# JFFS2 file system 64820 leshort 0x1984 Linux old jffs2 filesystem data little endian 64830 leshort 0x1985 Linux jffs2 filesystem data little endian 6484 6485# Squashfs 64860 string sqsh Squashfs filesystem, big endian, 6487>28 beshort x version %d. 6488>30 beshort x \b%d, 6489>28 beshort <3 6490>>8 belong x %d bytes, 6491>28 beshort >2 6492>>28 beshort <4 6493>>>63 bequad x %lld bytes, 6494>>28 beshort >3 6495>>>40 bequad x %lld bytes, 6496#>>67 belong x %d bytes, 6497>4 belong x %d inodes, 6498>28 beshort <2 6499>>32 beshort x blocksize: %d bytes, 6500>28 beshort >1 6501>>28 beshort <4 6502>>>51 belong x blocksize: %d bytes, 6503>>28 beshort >3 6504>>>12 belong x blocksize: %d bytes, 6505>28 beshort <4 6506>>39 bedate x created: %s 6507>28 beshort >3 6508>>8 bedate x created: %s 65090 string hsqs Squashfs filesystem, little endian, 6510>28 leshort x version %d. 6511>30 leshort x \b%d, 6512>28 leshort <3 6513>>8 lelong x %d bytes, 6514>28 leshort >2 6515>>28 leshort <4 6516>>>63 lequad x %lld bytes, 6517>>28 leshort >3 6518>>>40 lequad x %lld bytes, 6519#>>63 lelong x %d bytes, 6520>4 lelong x %d inodes, 6521>28 leshort <2 6522>>32 leshort x blocksize: %d bytes, 6523>28 leshort >1 6524>>28 leshort <4 6525>>>51 lelong x blocksize: %d bytes, 6526>>28 leshort >3 6527>>>12 lelong x blocksize: %d bytes, 6528>28 leshort <4 6529>>39 ledate x created: %s 6530>28 leshort >3 6531>>8 ledate x created: %s 6532 65330 string td\000 floppy image data (TeleDisk) 6534 6535# AFS Dump Magic 6536# From: Ty Sarna <tsarna@sarna.org> 65370 string \x01\xb3\xa1\x13\x22 AFS Dump 6538>&0 belong x (v%d) 6539>>&0 byte 0x76 6540>>>&0 belong x Vol %d, 6541>>>>&0 byte 0x6e 6542>>>>>&0 string x %s 6543>>>>>>&1 byte 0x74 6544>>>>>>>&0 beshort 2 6545>>>>>>>>&4 bedate x on: %s 6546>>>>>>>>&0 bedate =0 full dump 6547>>>>>>>>&0 bedate !0 incremental since: %s 6548 6549#---------------------------------------------------------- 6550#delta ISO Daniel Novotny (dnovotny@redhat.com) 65510 string DISO Delta ISO data 6552>4 belong x version %d 6553 6554# VMS backup savesets - gerardo.cacciari@gmail.com 6555# 65564 string \x01\x00\x01\x00\x01\x00 6557>(0.s+16) string \x01\x01 6558>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 6559>>>40 lelong x (block size %d, 6560>>>49 string >\0 original name '%s', 6561>>>2 short 1024 VAX generated) 6562>>>2 short 2048 AXP generated) 6563>>>2 short 4096 I64 generated) 6564 6565# Summary: Oracle Clustered Filesystem 6566# Created by: Aaron Botsis <redhat@digitalmafia.org> 65678 string OracleCFS Oracle Clustered Filesystem, 6568>4 long x rev %d 6569>0 long x \b.%d, 6570>560 string x label: %.64s, 6571>136 string x mountpoint: %.128s 6572 6573# Summary: Oracle ASM tagged volume 6574# Created by: Aaron Botsis <redhat@digitalmafia.org> 657532 string ORCLDISK Oracle ASM Volume, 6576>40 string x Disk Name: %0.12s 657732 string ORCLCLRD Oracle ASM Volume (cleared), 6578>40 string x Disk Name: %0.12s 6579 6580# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 65818 string OracleCFS Oracle Clustered Filesystem, 6582>4 long x rev %d 6583>0 long x \b.%d, 6584>560 string x label: %.64s, 6585>136 string x mountpoint: %.128s 6586 6587# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 658832 string ORCLDISK Oracle ASM Volume, 6589>40 string x Disk Name: %0.12s 659032 string ORCLCLRD Oracle ASM Volume (cleared), 6591>40 string x Disk Name: %0.12s 6592 6593# Compaq/HP RILOE floppy image 6594# From: Dirk Jagdmann <doj@cubic.org> 65950 string CPQRFBLO Compaq/HP RILOE floppy image 6596 6597#------------------------------------------------------------------------------ 6598# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com 6599# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is 6600# mapped to VBN 2 of [000000]INDEXF.SYS;1 6601# 66021008 string DECFILE11B Files-11 On-Disk Structure 6603>525 byte x Level %d 6604>525 byte x (ODS-%d OpenVMS file system), 6605>984 string x volume label is '%-12.12s' 6606 6607# From: Thomas Klausner <wiz@NetBSD.org> 6608# http://filext.com/file-extension/DAA 6609# describes the daa file format. The magic would be: 66100 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 6611 6612# From Albert Cahalan <acahalan@gmail.com> 6613# really le32 operation,destination,payloadsize (but quite predictable) 6614# 01 00 00 00 00 00 00 c0 00 02 00 00 66150 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 6616 6617# From Eric Sandeen 6618# GFS2 66190x10000 belong 0x01161970 Linux 6620>0x10018 belong 0x0000051d GFS1 Filesystem 6621>>0x10024 belong x (blocksize %d, 6622>>0x10060 string >\0 lockproto %s) 6623>0x10018 belong 0x00000709 GFS2 Filesystem 6624>>0x10024 belong x (blocksize %d, 6625>>0x10060 string >\0 lockproto %s) 6626 6627# BTRFS 66280x10040 string _BHRfS_M BTRFS Filesystem 6629>0x1012b string >\0 (label "%s", 6630>0x10090 lelong x sectorsize %d, 6631>0x10094 lelong x nodesize %d, 6632>0x10098 lelong x leafsize %d) 6633 6634 6635# dvdisaster's .ecc 6636# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 66370 string *dvdisaster* dvdisaster error correction file 6638 6639# xfs metadump image 6640# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 6641# but can we do the << ? For now it's always 512 (0x200) anyway. 66420 string XFSM 6643>0x200 string XFSB XFS filesystem metadump image 6644 6645 6646#------------------------------------------------------------------------------ 6647# $File: filesystems,v 1.55 2010/01/16 17:45:12 chl Exp $ 6648# filesystems: file(1) magic for different filesystems 6649# 66500 string \366\366\366\366 PC formatted floppy with no filesystem 6651# Sun disk labels 6652# From /usr/include/sun/dklabel.h: 66530774 beshort 0xdabe 6654# modified by Joerg Jenderek, because original test 6655# succeeds for Cabinet archive dao360.dl_ with negative blocks 6656>0770 long >0 Sun disk label 6657>>0 string x '%s 6658>>>31 string >\0 \b%s 6659>>>>63 string >\0 \b%s 6660>>>>>95 string >\0 \b%s 6661>>0 string x \b' 6662>>0734 short >0 %d rpm, 6663>>0736 short >0 %d phys cys, 6664>>0740 short >0 %d alts/cyl, 6665>>0746 short >0 %d interleave, 6666>>0750 short >0 %d data cyls, 6667>>0752 short >0 %d alt cyls, 6668>>0754 short >0 %d heads/partition, 6669>>0756 short >0 %d sectors/track, 6670>>0764 long >0 start cyl %ld, 6671>>0770 long x %ld blocks 6672# Is there a boot block written 1 sector in? 6673>512 belong&077777777 0600407 \b, boot block present 6674# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc 6675# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 66760 string SBMBAKUP_ Smart Boot Manager backup file 6677>9 string x \b, version %-5.5s 6678>>14 string =_ 6679>>>15 string x %-.1s 6680>>>>16 string =_ \b. 6681>>>>>17 string x \b%-.1s 6682>>>>>>18 string =_ \b. 6683>>>>>>>19 string x \b%-.1s 6684>>>22 ubyte 0 6685>>>>21 ubyte x \b, from drive 0x%x 6686>>>22 ubyte >0 6687>>>>21 string x \b, from drive %s 6688 6689# Joerg Jenderek 6690# DOS Emulator image is 128 byte, null right padded header + harddisc image 66910 string DOSEMU\0 6692>0x27E leshort 0xAA55 6693#offset is 128 6694>>19 ubyte 128 6695>>>(19.b-1) ubyte 0x0 DOS Emulator image 6696>>>>7 ulelong >0 \b, %u heads 6697>>>>11 ulelong >0 \b, %d sectors/track 6698>>>>15 ulelong >0 \b, %d cylinders 6699 6700# updated by Joerg Jenderek at Sep 2007 6701# only for sector sizes with 512 or more Bytes 67020x1FE leshort 0xAA55 x86 boot sector 6703# to do also for sectors < than 512 Bytes and some other files, GRR 6704#30 search/481 \x55\xAA x86 boot sector 6705# not for BeOS floppy 1440k, MBRs 6706#(11.s-2) uleshort 0xAA55 x86 boot sector 6707>2 string OSBS \b, OS/BS MBR 6708# J\xf6rg Jenderek <joerg dot jenderek at web dot de> 6709>0x8C string Invalid\ partition\ table \b, MS-DOS MBR 6710# dr-dos with some upper-, lowercase variants 6711>0x9D string Invalid\ partition\ table$ 6712>>181 string No\ Operating\ System$ 6713>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6714>0x9D string Invalid\ partition\ table$ 6715>>181 string No\ operating\ system$ 6716>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6717>342 string Invalid\ partition\ table$ 6718>>366 string No\ operating\ system$ 6719>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 6720>295 string NEWLDR\0 6721>>302 string Bad\ PT\ $ 6722>>>310 string No\ OS\ $ 6723>>>>317 string OS\ load\ err$ 6724>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 6725>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 6726>>>>>>>387 string Copyright\ (c)\ 1984,1998 6727>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 6728>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 6729>>0x1B8 ubelong >0 \b, Serial 0x%-.4x 6730>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 6731>271 string Invalid\ partition\ table\0 6732>>295 string Error\ loading\ operating\ system\0 6733>>>326 string Missing\ operating\ system\0 \b, mbr 6734# 6735>139 string Invalid\ partition\ table\0 6736>>163 string Error\ loading\ operating\ system\0 6737>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr 6738# http://www.heise.de/ct/05/09/006/ page 184 6739#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes 6740>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x 6741>300 string Invalid\ partition\ table\0 6742>>324 string Error\ loading\ operating\ system\0 6743>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR 6744#??>>>389 string Invalid\ system\ disk 6745>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 6746>300 string Ung\201ltige\ Partitionstabelle 6747#split string to avoid error: String too long 6748>>328 string Fehler\ beim\ Laden\ 6749>>>346 string des\ Betriebssystems 6750>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) 6751>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x 6752#>0x145 string Default:\ F \b, FREE-DOS MBR 6753#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 6754>0x145 search/7 Default:\ F \b, FREE-DOS MBR 6755#>>313 string F0\ .\ .\ . 6756#>>>322 string disk\ 1 6757#>>>>382 string FAT3 6758>64 string no\ active\ partition\ found 6759>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 6760# Ranish Partition Manager http://www.ranish.com/part/ 6761>387 search/4 \0\ Error!\r 6762>>378 search/7 Virus! 6763>>>397 search/4 Booting\ 6764>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 6765>>>>>416 string Writing\ changes... \b2.37 6766>>>>>>438 ubyte x \b,0x%x dots 6767>>>>>>440 ubyte >0 \b,virus check 6768>>>>>>441 ubyte >0 \b,partition %c 6769#2.38,2.42,2.44 6770>>>>>416 string !Writing\ changes... \b 6771>>>>>>418 ubyte 1 \bvirus check, 6772>>>>>>419 ubyte x \b0x%x seconds 6773>>>>>>420 ubyte&0x0F >0 \b,partition 6774>>>>>>>420 ubyte&0x0F <5 \b %x 6775>>>>>>>420 ubyte&0x0F 0Xf \b ask 6776>>>>>420 ubyte x \b) 6777# 6778>271 string Operating\ system\ loading 6779>>296 string error\r \b, SYSLINUX MBR (2.10) 6780# http://www.acronis.de/ 6781>362 string MBR\ Error\ \0\r 6782>>376 string ress\ any\ key\ to\ 6783>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 6784# added by Joerg Jenderek 6785# http://www.visopsys.org/ 6786# http://partitionlogic.org.uk/ 6787>309 string No\ bootable\ partition\ found\r 6788>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 6789>349 string No\ bootable\ partition\ found\r 6790>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 6791# bootloader, bootmanager 6792>0x40 string SBML 6793# label with 11 characters of FAT 12 bit filesystem 6794>>43 string SMART\ BTMGR 6795>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 6796# OEM-ID not always "SBM" 6797#>>>>3 strings SBM 6798>>>>6 string >\0 \b, version %s 6799>382 string XOSLLOADXCF \b, eXtended Operating System Loader 6800>6 string LILO \b, LInux i386 boot LOader 6801>>120 string LILO \b, version 22.3.4 SuSe 6802>>172 string LILO \b, version 22.5.8 Debian 6803# updated by Joerg Jenderek at Oct 2008 6804# variables according to grub-0.97/stage1/stage1.S or 6805# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 6806# usual values are marked with comments to get only informations of strange GRUB loaders 6807>342 search/60 \0Geom\0 6808#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 6809>>0x41 ubyte <2 6810>>>0x3E ubyte >2 \b; GRand Unified Bootloader 6811# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 6812>>>>0x3E ubyte x \b, stage1 version 0x%x 6813#If it is 0xFF, use a drive passed by BIOS 6814>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 6815# in most case 0,1,0x2e for GRUB 0.5.95 6816>>>>0x41 ubyte >0 \b, LBA flag 0x%x 6817>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 6818#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 6819>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 6820#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 6821>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 6822>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 6823#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 6824>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 6825>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 6826>>>>>394 string stage1 \b, GRUB version 0.5.95 6827>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 6828>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 6829>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 6830>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 6831>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 6832>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 6833>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 6834>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 6835#unkown version 6836>>>343 string Geom\0Read\0\ Error\0 6837>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 6838>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 6839>>>>374 string GRUB\ \0 \b, GRUB version n.m 6840# http://syslinux.zytor.com/ 6841>478 string Boot\ failed\r 6842>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) 6843>480 string Boot\ failed\r 6844>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) 6845>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) 6846>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 6847# http://www.bcdwb.de/bcdw/index_e.htm 6848>3 string BCDL 6849>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 6850# mbr partition table entries 6851# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs 6852>3 string !MS 6853>>3 string !SYSLINUX 6854>>>3 string !MTOOL 6855>>>>3 string !NEWLDR 6856>>>>>5 string !DOS 6857# not FAT (32 bit) 6858>>>>>>82 string !FAT32 6859#not Linux kernel 6860>>>>>>>514 string !HdrS 6861#not BeOS 6862>>>>>>>>422 string !Be\ Boot\ Loader 6863# active flag 0 or 0x80 and type > 0 6864>>>>>>>>>446 ubyte <0x81 6865>>>>>>>>>>446 ubyte&0x7F 0 6866>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x 6867>>>>>>>>>>>>446 ubyte 0x80 \b, active 6868>>>>>>>>>>>>447 ubyte x \b, starthead %u 6869#>>>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x 6870#>>>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d 6871>>>>>>>>>>>>454 ulelong x \b, startsector %u 6872>>>>>>>>>>>>458 ulelong x \b, %u sectors 6873# 6874>>>>>>>>>462 ubyte <0x81 6875>>>>>>>>>>462 ubyte&0x7F 0 6876>>>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x 6877>>>>>>>>>>>>462 ubyte 0x80 \b, active 6878>>>>>>>>>>>>463 ubyte x \b, starthead %u 6879#>>>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x 6880#>>>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d 6881>>>>>>>>>>>>470 ulelong x \b, startsector %u 6882>>>>>>>>>>>>474 ulelong x \b, %u sectors 6883# 6884>>>>>>>>>478 ubyte <0x81 6885>>>>>>>>>>478 ubyte&0x7F 0 6886>>>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x 6887>>>>>>>>>>>>478 ubyte 0x80 \b, active 6888>>>>>>>>>>>>479 ubyte x \b, starthead %u 6889#>>>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x 6890#>>>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x 6891#>>>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d 6892>>>>>>>>>>>>486 ulelong x \b, startsector %u 6893>>>>>>>>>>>>490 ulelong x \b, %u sectors 6894# 6895>>>>>>>>>494 ubyte <0x81 6896>>>>>>>>>>494 ubyte&0x7F 0 6897>>>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x 6898>>>>>>>>>>>>494 ubyte 0x80 \b, active 6899>>>>>>>>>>>>495 ubyte x \b, starthead %u 6900#>>>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x 6901#>>>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d 6902>>>>>>>>>>>>502 ulelong x \b, startsector %u 6903>>>>>>>>>>>>506 ulelong x \b, %u sectors 6904# mbr partition table entries end 6905# http://www.acronis.de/ 6906#FAT label=ACRONIS\ SZ 6907#OEM-ID=BOOTWIZ0 6908>442 string Non-system\ disk,\ 6909>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 6910# DOS names like F11.SYS are 8 right space padded bytes+3 bytes 6911>>>477 ubyte&0xDF >0 6912>>>>477 string x \b %-.3s 6913>>>>>480 ubyte&0xDF >0 6914>>>>>>480 string x \b%-.5s 6915>>>>485 ubyte&0xDF >0 6916>>>>>485 string x \b.%-.3s 6917# 6918>185 string FDBOOT\ Version\ 6919>>204 string \rNo\ Systemdisk.\ 6920>>>220 string Booting\ from\ harddisk.\n\r 6921>>>245 string Cannot\ load\ from\ harddisk.\n\r 6922>>>>273 string Insert\ Systemdisk\ 6923>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 6924>>>>>>200 string >\0 \b, version %-3s 6925>242 string Bootsector\ from\ C.H.\ Hochst\204 6926>>278 string No\ Systemdisk.\ 6927>>>293 string Booting\ from\ harddisk.\n\r 6928>>>441 string Cannot\ load\ from\ harddisk.\n\r 6929>>>>469 string Insert\ Systemdisk\ 6930>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader 6931>>>>>>209 string >\0 \b, version %-4.4s 6932>(1.b+2) ubyte 0xe 6933>>(1.b+3) ubyte 0x1f 6934>>>(1.b+4) ubyte 0xbe 6935>>>>(1.b+5) ubyte 0x77 6936>>>>(1.b+6) ubyte 0x7c 6937>>>>>(1.b+7) ubyte 0xac 6938>>>>>>(1.b+8) ubyte 0x22 6939>>>>>>>(1.b+9) ubyte 0xc0 6940>>>>>>>>(1.b+10) ubyte 0x74 6941>>>>>>>>>(1.b+11) ubyte 0xb 6942>>>>>>>>>>(1.b+12) ubyte 0x56 6943>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 6944>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 6945#>>244 string from\ dosemu-freedos-*-bin.tgz\r 6946#>>>170 string Sorry,\ could\ not\ load\ an\ 6947#>>>>195 string operating\ system.\r\n 6948# 6949>103 string This\ is\ not\ a\ bootable\ disk.\ 6950>>132 string Please\ insert\ a\ bootable\ 6951>>>157 string floppy\ and\r\n 6952>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 6953# 6954>66 string Solaris\ Boot\ Sector 6955>>99 string Incomplete\ MDBoot\ load. 6956>>>89 string Version \b, Sun Solaris Bootloader 6957>>>>97 byte x version %c 6958# 6959>408 string OS/2\ !!\ SYS01475\r\0 6960>>429 string OS/2\ !!\ SYS02025\r\0 6961>>>450 string OS/2\ !!\ SYS02027\r\0 6962>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 6963# 6964>409 string OS/2\ !!\ SYS01475\r\0 6965>>430 string OS/2\ !!\ SYS02025\r\0 6966>>>451 string OS/2\ !!\ SYS02027\r\0 6967>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 6968>112 string This\ disk\ is\ not\ bootable\r 6969>>142 string If\ you\ wish\ to\ make\ it\ bootable 6970>>>176 string run\ the\ DOS\ program\ SYS\ 6971>>>200 string after\ the\r 6972>>>>216 string system\ has\ been\ loaded\r\n 6973>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 6974>>>>>271 string into\r\n\ the\ drive\ and\ 6975>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 6976# XP 6977>430 string NTLDR\ is\ missing\xFF\r\n 6978>>449 string Disk\ error\xFF\r\n 6979>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 6980# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 6981>>>>417 ubyte&0xDF >0 6982>>>>>417 string x %-.5s 6983>>>>>>422 ubyte&0xDF >0 6984>>>>>>>422 string x \b%-.3s 6985>>>>>425 ubyte&0xDF >0 6986>>>>>>425 string >\ \b.%-.3s 6987# 6988>>>>371 ubyte >0x20 6989>>>>>368 ubyte&0xDF >0 6990>>>>>>368 string x %-.5s 6991>>>>>>>373 ubyte&0xDF >0 6992>>>>>>>>373 string x \b%-.3s 6993>>>>>>376 ubyte&0xDF >0 6994>>>>>>>376 string x \b.%-.3s 6995# 6996>430 string NTLDR\ nicht\ gefunden\xFF\r\n 6997>>453 string Datentr\204gerfehler\xFF\r\n 6998>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 6999>>>>417 ubyte&0xDF >0 7000>>>>>417 string x %-.5s 7001>>>>>>422 ubyte&0xDF >0 7002>>>>>>>422 string x \b%-.3s 7003>>>>>425 ubyte&0xDF >0 7004>>>>>>425 string >\ \b.%-.3s 7005# offset variant 7006>>>>379 string \0 7007>>>>>368 ubyte&0xDF >0 7008>>>>>>368 string x %-.5s 7009>>>>>>>373 ubyte&0xDF >0 7010>>>>>>>>373 string x \b%-.3s 7011# 7012>430 string NTLDR\ fehlt\xFF\r\n 7013>>444 string Datentr\204gerfehler\xFF\r\n 7014>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 7015>>>>417 ubyte&0xDF >0 7016>>>>>417 string x %-.5s 7017>>>>>>422 ubyte&0xDF >0 7018>>>>>>>422 string x \b%-.3s 7019>>>>>425 ubyte&0xDF >0 7020>>>>>>425 string >\ \b.%-.3s 7021# variant 7022>>>>371 ubyte >0x20 7023>>>>>368 ubyte&0xDF >0 7024>>>>>>368 string x %-.5s 7025>>>>>>>373 ubyte&0xDF >0 7026>>>>>>>>373 string x \b%-.3s 7027>>>>>>376 ubyte&0xDF >0 7028>>>>>>>376 string x \b.%-.3s 7029# 7030>430 string NTLDR\ fehlt\xFF\r\n 7031>>444 string Medienfehler\xFF\r\n 7032>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 7033>>>>371 ubyte >0x20 7034>>>>>368 ubyte&0xDF >0 7035>>>>>>368 string x %-.5s 7036>>>>>>>373 ubyte&0xDF >0 7037>>>>>>>>373 string x \b%-.3s 7038>>>>>>376 ubyte&0xDF >0 7039>>>>>>>376 string x \b.%-.3s 7040# variant 7041>>>>417 ubyte&0xDF >0 7042>>>>>417 string x %-.5s 7043>>>>>>422 ubyte&0xDF >0 7044>>>>>>>422 string x \b%-.3s 7045>>>>>425 ubyte&0xDF >0 7046>>>>>>425 string >\ \b.%-.3s 7047# 7048>430 string Datentr\204ger\ entfernen\xFF\r\n 7049>>454 string Medienfehler\xFF\r\n 7050>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 7051>>>>379 string \0 7052>>>>>368 ubyte&0xDF >0 7053>>>>>>368 string x %-.5s 7054>>>>>>>373 ubyte&0xDF >0 7055>>>>>>>>373 string x \b%-.3s 7056>>>>>>376 ubyte&0xDF >0 7057>>>>>>>376 string x \b.%-.3s 7058# variant 7059>>>>417 ubyte&0xDF >0 7060>>>>>417 string x %-.5s 7061>>>>>>422 ubyte&0xDF >0 7062>>>>>>>422 string x \b%-.3s 7063>>>>>425 ubyte&0xDF >0 7064>>>>>>425 string >\ \b.%-.3s 7065# 7066 7067#>3 string NTFS\ \ \ \ 7068>389 string Fehler\ beim\ Lesen\ 7069>>407 string des\ Datentr\204gers 7070>>>426 string NTLDR\ fehlt 7071>>>>440 string NTLDR\ ist\ komprimiert 7072>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 7073#>3 string NTFS\ \ \ \ 7074>313 string A\ disk\ read\ error\ occurred.\r 7075>>345 string A\ kernel\ file\ is\ missing\ 7076>>>370 string from\ the\ disk.\r 7077>>>>484 string NTLDR\ is\ compressed 7078>>>>>429 string Insert\ a\ system\ diskette\ 7079>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 7080# DOS loader variants different languages,offsets 7081>472 ubyte&0xDF >0 7082>>389 string Invalid\ system\ disk\xFF\r\n 7083>>>411 string Disk\ I/O\ error 7084>>>>428 string Replace\ the\ disk,\ and\ 7085>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 7086#IO.SYS 7087>>>>>>472 ubyte&0xDF >0 7088>>>>>>>472 string x \b %-.2s 7089>>>>>>>>474 ubyte&0xDF >0 7090>>>>>>>>>474 string x \b%-.5s 7091>>>>>>>>>>479 ubyte&0xDF >0 7092>>>>>>>>>>>479 string x \b%-.1s 7093>>>>>>>480 ubyte&0xDF >0 7094>>>>>>>>480 string x \b.%-.3s 7095#MSDOS.SYS 7096>>>>>>>483 ubyte&0xDF >0 \b+ 7097>>>>>>>>483 string x \b%-.5s 7098>>>>>>>>>488 ubyte&0xDF >0 7099>>>>>>>>>>488 string x \b%-.3s 7100>>>>>>>>491 ubyte&0xDF >0 7101>>>>>>>>>491 string x \b.%-.3s 7102# 7103>>390 string Invalid\ system\ disk\xFF\r\n 7104>>>412 string Disk\ I/O\ error\xFF\r\n 7105>>>>429 string Replace\ the\ disk,\ and\ 7106>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 7107>>388 string Ungueltiges\ System\ \xFF\r\n 7108>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 7109>>>>427 string Datentraeger\ wechseln\ und\ 7110>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 7111#WINBOOT.SYS only not spaces (0xDF) 7112>>>>>>497 ubyte&0xDF >0 7113>>>>>>>497 string x %-.5s 7114>>>>>>>>502 ubyte&0xDF >0 7115>>>>>>>>>502 string x \b%-.1s 7116>>>>>>>>>>503 ubyte&0xDF >0 7117>>>>>>>>>>>503 string x \b%-.1s 7118>>>>>>>>>>>>504 ubyte&0xDF >0 7119>>>>>>>>>>>>>504 string x \b%-.1s 7120>>>>>>505 ubyte&0xDF >0 7121>>>>>>>505 string x \b.%-.3s 7122#IO.SYS 7123>>>>>>472 ubyte&0xDF >0 or 7124>>>>>>>472 string x \b %-.2s 7125>>>>>>>>474 ubyte&0xDF >0 7126>>>>>>>>>474 string x \b%-.5s 7127>>>>>>>>>>479 ubyte&0xDF >0 7128>>>>>>>>>>>479 string x \b%-.1s 7129>>>>>>>480 ubyte&0xDF >0 7130>>>>>>>>480 string x \b.%-.3s 7131#MSDOS.SYS 7132>>>>>>>483 ubyte&0xDF >0 \b+ 7133>>>>>>>>483 string x \b%-.5s 7134>>>>>>>>>488 ubyte&0xDF >0 7135>>>>>>>>>>488 string x \b%-.3s 7136>>>>>>>>491 ubyte&0xDF >0 7137>>>>>>>>>491 string x \b.%-.3s 7138# 7139>>390 string Ungueltiges\ System\ \xFF\r\n 7140>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 7141>>>>429 string Datentraeger\ wechseln\ und\ 7142>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 7143#WINBOOT.SYS only not spaces (0xDF) 7144>>>>>>497 ubyte&0xDF >0 7145>>>>>>>497 string x %-.7s 7146>>>>>>>>504 ubyte&0xDF >0 7147>>>>>>>>>504 string x \b%-.1s 7148>>>>>>505 ubyte&0xDF >0 7149>>>>>>>505 string x \b.%-.3s 7150#IO.SYS 7151>>>>>>472 ubyte&0xDF >0 or 7152>>>>>>>472 string x \b %-.2s 7153>>>>>>>>474 ubyte&0xDF >0 7154>>>>>>>>>474 string x \b%-.6s 7155>>>>>>>480 ubyte&0xDF >0 7156>>>>>>>>480 string x \b.%-.3s 7157#MSDOS.SYS 7158>>>>>>>483 ubyte&0xDF >0 \b+ 7159>>>>>>>>483 string x \b%-.5s 7160>>>>>>>>>488 ubyte&0xDF >0 7161>>>>>>>>>>488 string x \b%-.3s 7162>>>>>>>>491 ubyte&0xDF >0 7163>>>>>>>>>491 string x \b.%-.3s 7164# 7165>>389 string Ungueltiges\ System\ \xFF\r\n 7166>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 7167>>>>428 string Datentraeger\ wechseln\ und\ 7168>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 7169# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 7170>>>>>>472 string x %-.2s 7171>>>>>>>474 ubyte&0xDF >0 7172>>>>>>>>474 string x \b%-.5s 7173>>>>>>>>479 ubyte&0xDF >0 7174>>>>>>>>>479 string x \b%-.1s 7175>>>>>>480 ubyte&0xDF >0 7176>>>>>>>480 string x \b.%-.3s 7177>>>>>>483 ubyte&0xDF >0 \b+ 7178>>>>>>>483 string x \b%-.5s 7179>>>>>>>488 ubyte&0xDF >0 7180>>>>>>>>488 string x \b%-.2s 7181>>>>>>>>490 ubyte&0xDF >0 7182>>>>>>>>>490 string x \b%-.1s 7183>>>>>>>491 ubyte&0xDF >0 7184>>>>>>>>491 string x \b.%-.3s 7185>479 ubyte&0xDF >0 7186>>416 string Kein\ System\ oder\ 7187>>>433 string Laufwerksfehler 7188>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 7189#IO.SYS 7190>>>>>479 string x \b %-.2s 7191>>>>>>481 ubyte&0xDF >0 7192>>>>>>>481 string x \b%-.6s 7193>>>>>487 ubyte&0xDF >0 7194>>>>>>487 string x \b.%-.3s 7195#MSDOS.SYS 7196>>>>>>490 ubyte&0xDF >0 \b+ 7197>>>>>>>490 string x \b%-.5s 7198>>>>>>>>495 ubyte&0xDF >0 7199>>>>>>>>>495 string x \b%-.3s 7200>>>>>>>498 ubyte&0xDF >0 7201>>>>>>>>498 string x \b.%-.3s 7202# 7203>376 search/41 Non-System\ disk\ or\ 7204>>395 search/41 disk\ error\r 7205>>>407 search/41 Replace\ and\ 7206>>>>419 search/41 press\ \b, 7207>>>>419 search/41 strike\ \b, old 7208>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 7209#449 Disk\ Boot\ failure\r MS 3.21 7210#466 Boot\ Failure\r MS 3.30 7211>>>>>468 search/18 \0 7212#IO.SYS,IBMBIO.COM 7213>>>>>>&0 string x \b %-.2s 7214>>>>>>>&-20 ubyte&0xDF >0 7215>>>>>>>>&-1 string x \b%-.4s 7216>>>>>>>>>&-16 ubyte&0xDF >0 7217>>>>>>>>>>&-1 string x \b%-.2s 7218>>>>>>&8 ubyte&0xDF >0 \b. 7219>>>>>>>&-1 string x \b%-.3s 7220#MSDOS.SYS,IBMDOS.COM 7221>>>>>>&11 ubyte&0xDF >0 \b+ 7222>>>>>>>&-1 string x \b%-.5s 7223>>>>>>>>&-6 ubyte&0xDF >0 7224>>>>>>>>>&-1 string x \b%-.1s 7225>>>>>>>>>>&-5 ubyte&0xDF >0 7226>>>>>>>>>>>&-1 string x \b%-.2s 7227>>>>>>>&7 ubyte&0xDF >0 \b. 7228>>>>>>>>&-1 string x \b%-.3s 7229>441 string Cannot\ load\ from\ harddisk.\n\r 7230>>469 string Insert\ Systemdisk\ 7231>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 7232#>43 string \224R-LOADER\ \ SYS =label 7233>54 string SYS 7234>>324 string VASKK 7235>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 7236# 7237>98 string Press\ a\ key\ to\ retry\0\r 7238>>120 string Cannot\ find\ file\ \0\r 7239>>>139 string Disk\ read\ error\0\r 7240>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 7241#DRBIOS.SYS 7242>>>>>44 ubyte&0xDF >0 7243>>>>>>44 string x \b %-.6s 7244>>>>>>>50 ubyte&0xDF >0 7245>>>>>>>>50 string x \b%-.2s 7246>>>>>>52 ubyte&0xDF >0 7247>>>>>>>52 string x \b.%-.3s 7248# 7249>70 string IBMBIO\ \ COM 7250>>472 string Cannot\ load\ DOS!\ 7251>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 7252>>471 string Cannot\ load\ DOS\ 7253>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 7254#?? 7255>444 string KERNEL\ \ SYS 7256>>314 string BOOT\ error! \b, FREE-DOS Bootloader 7257>499 string KERNEL\ \ SYS 7258>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 7259>449 string KERNEL\ \ SYS 7260>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 7261# 7262>449 string Loading\ FreeDOS 7263>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 7264>>>497 ubyte&0xDF >0 7265>>>>497 string x \b %-.6s 7266>>>>>503 ubyte&0xDF >0 7267>>>>>>503 string x \b%-.1s 7268>>>>>>>504 ubyte&0xDF >0 7269>>>>>>>>504 string x \b%-.1s 7270>>>>505 ubyte&0xDF >0 7271>>>>>505 string x \b.%-.3s 7272# 7273>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 7274# 7275>125 string Loading\ FreeDOS...\r 7276>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 7277>>>441 ubyte&0xDF >0 7278>>>>441 string x \b %-.6s 7279>>>>>447 ubyte&0xDF >0 7280>>>>>>447 string x \b%-.1s 7281>>>>>>>448 ubyte&0xDF >0 7282>>>>>>>>448 string x \b%-.1s 7283>>>>449 ubyte&0xDF >0 7284>>>>>449 string x \b.%-.3s 7285>124 string FreeDOS\0 7286>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 7287# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 7288>>>497 ubyte&0xDF >0 7289>>>>497 string x \b %-.6s 7290>>>>>503 ubyte&0xDF >0 7291>>>>>>503 string x \b%-.1s 7292>>>>>>>504 ubyte&0xDF >0 7293>>>>>>>>504 string x \b%-.1s 7294>>>>505 ubyte&0xDF >0 7295>>>>>505 string x \b.%-.3s 7296>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 7297>>>497 ubyte&0xDF >0 7298>>>>497 string x \b %-.6s 7299>>>>>503 ubyte&0xDF >0 7300>>>>>>503 string x \b%-.1s 7301>>>>>>>504 ubyte&0xDF >0 7302>>>>>>>>504 string x \b%-.1s 7303>>>>505 ubyte&0xDF >0 7304>>>>>505 string x \b.%-.3s 7305>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 7306>>>497 ubyte&0xDF >0 7307>>>>497 string x \b %-.6s 7308>>>>>503 ubyte&0xDF >0 7309>>>>>>503 string x \b%-.1s 7310>>>>>>>504 ubyte&0xDF >0 7311>>>>>>>>504 string x \b%-.1s 7312>>>>505 ubyte&0xDF >0 7313>>>>>505 string x \b.%-.3s 7314>336 string Error!\ 7315>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 7316>>>497 ubyte&0xDF >0 7317>>>>497 string x \b %-.6s 7318>>>>>503 ubyte&0xDF >0 7319>>>>>>503 string x \b%-.1s 7320>>>>>>>504 ubyte&0xDF >0 7321>>>>>>>>504 string x \b%-.1s 7322>>>>505 ubyte&0xDF >0 7323>>>>>505 string x \b.%-.3s 7324# added by Joerg Jenderek 7325# http://www.visopsys.org/ 7326# http://partitionlogic.org.uk/ 7327# OEM-ID=Visopsys 7328>478 ulelong 0 7329>>(1.b+326) string I/O\ Error\ reading\ 7330>>>(1.b+344) string Visopsys\ loader\r 7331>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 7332# http://alexfru.chat.ru/epm.html#bootprog 7333>494 ubyte >0x4D 7334>>495 string >E 7335>>>495 string <S 7336#OEM-ID is not reliable 7337>>>>3 string BootProg 7338# It just looks for a program file name at the root directory 7339# and loads corresponding file with following execution. 7340# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 7341>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 7342>>>>>499 string x \b %-.1s 7343>>>>>>500 ubyte&0xDF >0 7344>>>>>>>500 string x \b%-.1s 7345>>>>>>>>501 ubyte&0xDF >0 7346>>>>>>>>>501 string x \b%-.1s 7347>>>>>>>>>>502 ubyte&0xDF >0 7348>>>>>>>>>>>502 string x \b%-.1s 7349>>>>>>>>>>>>503 ubyte&0xDF >0 7350>>>>>>>>>>>>>503 string x \b%-.1s 7351>>>>>>>>>>>>>>504 ubyte&0xDF >0 7352>>>>>>>>>>>>>>>504 string x \b%-.1s 7353>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 7354>>>>>>>>>>>>>>>>>505 string x \b%-.1s 7355>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 7356>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 7357#name extension 7358>>>>>507 ubyte&0xDF >0 \b. 7359>>>>>>507 string x \b%-.1s 7360>>>>>>>508 ubyte&0xDF >0 7361>>>>>>>>508 string x \b%-.1s 7362>>>>>>>>>509 ubyte&0xDF >0 7363>>>>>>>>>>509 string x \b%-.1s 7364#If the boot sector fails to read any other sector, 7365#it prints a very short message ("RE") to the screen and hangs the computer. 7366#If the boot sector fails to find needed program in the root directory, 7367#it also hangs with another message ("NF"). 7368>>>>>492 string RENF \b, FAT (12 bit) 7369>>>>>495 string RENF \b, FAT (16 bit) 7370# http://alexfru.chat.ru/epm.html#bootprog 7371>494 ubyte >0x4D 7372>>495 string >E 7373>>>495 string <S 7374#OEM-ID is not reliable 7375>>>>3 string BootProg 7376# It just looks for a program file name at the root directory 7377# and loads corresponding file with following execution. 7378# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 7379>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 7380>>>>>499 string x \b %-.1s 7381>>>>>>500 ubyte&0xDF >0 7382>>>>>>>500 string x \b%-.1s 7383>>>>>>>>501 ubyte&0xDF >0 7384>>>>>>>>>501 string x \b%-.1s 7385>>>>>>>>>>502 ubyte&0xDF >0 7386>>>>>>>>>>>502 string x \b%-.1s 7387>>>>>>>>>>>>503 ubyte&0xDF >0 7388>>>>>>>>>>>>>503 string x \b%-.1s 7389>>>>>>>>>>>>>>504 ubyte&0xDF >0 7390>>>>>>>>>>>>>>>504 string x \b%-.1s 7391>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 7392>>>>>>>>>>>>>>>>>505 string x \b%-.1s 7393>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 7394>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s 7395#name extension 7396>>>>>507 ubyte&0xDF >0 \b. 7397>>>>>>507 string x \b%-.1s 7398>>>>>>>508 ubyte&0xDF >0 7399>>>>>>>>508 string x \b%-.1s 7400>>>>>>>>>509 ubyte&0xDF >0 7401>>>>>>>>>>509 string x \b%-.1s 7402#If the boot sector fails to read any other sector, 7403#it prints a very short message ("RE") to the screen and hangs the computer. 7404#If the boot sector fails to find needed program in the root directory, 7405#it also hangs with another message ("NF"). 7406>>>>>492 string RENF \b, FAT (12 bit) 7407>>>>>495 string RENF \b, FAT (16 bit) 7408# x86 bootloader end 7409# updated by Joerg Jenderek at Sep 2007 7410>3 ubyte 0 7411#no active flag 7412>>446 ubyte 0 7413# partition 1 not empty 7414>>>450 ubyte >0 7415# partitions 3,4 empty 7416>>>>482 ubyte 0 7417>>>>>498 ubyte 0 7418# partition 2 ID=0,5,15 7419>>>>>>466 ubyte <0x10 7420>>>>>>>466 ubyte 0x05 \b, extended partition table 7421>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 7422>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 7423# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 7424# http://mirror.href.com/thestarman/asm/2bytejumps.htmm#FWD 7425# older drives may use Near JuMP instruction E9 xx xx 7426>0 lelong&0x009000EB 0x009000EB 7427>0 lelong&0x000000E9 0x000000E9 7428# minimal short forward jump found 03cx?? 7429# maximal short forward jump is 07fx 7430>1 ubyte <0xff \b, code offset 0x%x 7431# mtools-3.9.8/msdos.h 7432# usual values are marked with comments to get only informations of strange FAT systems 7433# valid sectorsize must be a power of 2 from 32 to 32768 7434>>11 uleshort&0x000f x 7435>>>11 uleshort <32769 7436>>>>11 uleshort >31 7437>>>>>21 ubyte&0xf0 0xF0 7438>>>>>>3 string >\0 \b, OEM-ID "%8.8s" 7439#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 7440>>>>>>>8 string IHC \b cached by Windows 9M 7441>>>>>>11 uleshort >512 \b, Bytes/sector %u 7442#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 7443>>>>>>11 uleshort <512 \b, Bytes/sector %u 7444>>>>>>13 ubyte >1 \b, sectors/cluster %u 7445#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 7446>>>>>>14 uleshort >32 \b, reserved sectors %u 7447#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 7448#>>>>>>14 uleshort >1 \b, reserved sectors %u 7449#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 7450>>>>>>14 uleshort <1 \b, reserved sectors %u 7451>>>>>>16 ubyte >2 \b, FATs %u 7452#>>>>>>16 ubyte =2 \b, FATs %u (usual) 7453>>>>>>16 ubyte =1 \b, FAT %u 7454>>>>>>16 ubyte >0 7455>>>>>>17 uleshort >0 \b, root entries %u 7456#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) 7457>>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 7458#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) 7459>>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 7460#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 7461>>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 7462>>>>>>22 uleshort >0 \b, sectors/FAT %u 7463#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) 7464>>>>>>26 ubyte >2 \b, heads %u 7465#>>>>>>26 ubyte =2 \b, heads %u (usual floppy) 7466>>>>>>26 ubyte =1 \b, heads %u 7467#skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk 7468>>>>>>38 ubyte !0x70 7469>>>>>>>28 ulelong >0 \b, hidden sectors %u 7470#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 7471>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 7472#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 7473# FAT<32 specific 7474>>>>>>82 string !FAT32 7475#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 7476#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 7477>>>>>>>36 ubyte !0x80 7478>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 7479>>>>>>>37 ubyte >0 \b, reserved 0x%x 7480#>>>>>>>37 ubyte =0 \b, reserved 0x%x 7481>>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 7482>>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 7483>>>>>>>38 ubyte =0x29 7484>>>>>>>>39 ulelong x \b, serial number 0x%x 7485>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 7486>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 7487>>>>>>>>43 string =NO\ NAME \b, unlabeled 7488>>>>>>>54 string FAT \b, FAT 7489>>>>>>>>54 string FAT12 \b (12 bit) 7490>>>>>>>>54 string FAT16 \b (16 bit) 7491# FAT32 specific 7492>>>>>>82 string FAT32 \b, FAT (32 bit) 7493>>>>>>>36 ulelong x \b, sectors/FAT %u 7494>>>>>>>40 uleshort >0 \b, extension flags %u 7495#>>>>>>>40 uleshort =0 \b, extension flags %u 7496>>>>>>>42 uleshort >0 \b, fsVersion %u 7497#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 7498>>>>>>>44 ulelong >2 \b, rootdir cluster %u 7499#>>>>>>>44 ulelong =2 \b, rootdir cluster %u 7500#>>>>>>>44 ulelong =1 \b, rootdir cluster %u 7501>>>>>>>48 uleshort >1 \b, infoSector %u 7502#>>>>>>>48 uleshort =1 \b, infoSector %u (usual) 7503>>>>>>>48 uleshort <1 \b, infoSector %u 7504>>>>>>>50 uleshort >6 \b, Backup boot sector %u 7505#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 7506>>>>>>>50 uleshort <6 \b, Backup boot sector %u 7507>>>>>>>54 ulelong >0 \b, reserved1 0x%x 7508>>>>>>>58 ulelong >0 \b, reserved2 0x%x 7509>>>>>>>62 ulelong >0 \b, reserved3 0x%x 7510# same structure as FAT1X 7511>>>>>>>64 ubyte >0x80 \b, physical drive 0x%x 7512#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 7513>>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x 7514#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 7515>>>>>>>65 ubyte >0 \b, reserved 0x%x 7516>>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) 7517>>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) 7518>>>>>>>66 ubyte =0x29 7519>>>>>>>>67 ulelong x \b, serial number 0x%x 7520>>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 7521>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 7522>>>>>>>71 string =NO\ NAME \b, unlabeled 7523### FATs end 7524>0x200 lelong 0x82564557 \b, BSD disklabel 7525# FATX 75260 string FATX FATX filesystem data 7527 7528 7529# Minix filesystems - Juan Cespedes <cespedes@debian.org> 75300x410 leshort 0x137f 7531!:strength / 2 7532>0x402 beshort < 100 Minix filesystem, V1, %d zones 7533>0x1e string minix \b, bootable 75340x410 beshort 0x137f 7535!:strength / 2 7536>0x402 beshort < 100 Minix filesystem, V1 (big endian), %d zones 7537>0x1e string minix \b, bootable 75380x410 leshort 0x138f 7539!:strength / 2 7540>0x402 beshort < 100 Minix filesystem, V1, 30 char names, %d zones 7541>0x1e string minix \b, bootable 75420x410 beshort 0x138f 7543!:strength / 2 7544>0x402 beshort < 100 Minix filesystem, V1, 30 char names (big endian), %d zones 7545>0x1e string minix \b, bootable 75460x410 leshort 0x2468 7547>0x402 beshort < 100 Minix filesystem, V2, %d zones 7548>0x1e string minix \b, bootable 75490x410 beshort 0x2468 7550>0x402 beshort < 100 Minix filesystem, V2 (big endian), %d zones 7551>0x1e string minix \b, bootable 7552 75530x410 leshort 0x2478 7554>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones 7555>0x1e string minix \b, bootable 75560x410 leshort 0x2478 7557>0x402 beshort < 100 Minix filesystem, V2, 30 char names, %d zones 7558>0x1e string minix \b, bootable 75590x410 beshort 0x2478 7560>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 7561>0x1e string minix \b, bootable 75620x410 leshort 0x4d5a 7563>0x402 beshort !0 Minix filesystem, V3, %d zones 7564>0x1e string minix \b, bootable 7565 7566# romfs filesystems - Juan Cespedes <cespedes@debian.org> 75670 string -rom1fs- romfs filesystem, version 1 7568>8 belong x %d bytes, 7569>16 string x named %s. 7570 7571# netboot image - Juan Cespedes <cespedes@debian.org> 75720 lelong 0x1b031336L Netboot image, 7573>4 lelong&0xFFFFFF00 0 7574>>4 lelong&0x100 0x000 mode 2 7575>>4 lelong&0x100 0x100 mode 3 7576>4 lelong&0xFFFFFF00 !0 unknown mode 7577 75780x18b string OS/2 OS/2 Boot Manager 7579 7580# updated by Joerg Jenderek at Oct 2008!! 7581# http://syslinux.zytor.com/iso.php 75820 ulelong 0x7c40eafa isolinux Loader 7583# http://syslinux.zytor.com/pxe.php 75840 ulelong 0x007c05ea pxelinux Loader 75850 ulelong 0x60669c66 pxelinux Loader 7586 7587# added by Joerg Jenderek 7588# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 7589# grub-1.94/kern/i386/pc/startup.S 7590# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 7591# usual values are marked with comments to get only informations of strange GRUB loaders 75920x200 uleshort 0x70EA 7593# found only version 3.{1,2} 7594>0x206 ubeshort >0x0300 7595# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 7596>>0x212 ubyte >0x29 7597>>>0x213 ubyte >0x29 7598# not iso9660_stage1_5 7599#>>>0 ulelong&0x00BE5652 0x00BE5652 7600>>>>0x213 ubyte >0x29 GRand Unified Bootloader 7601# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 7602>>>>0x217 ubyte 0xFF stage1_5 7603>>>>0x217 ubyte <0xFF stage2 7604>>>>0x206 ubyte x \b version %u 7605>>>>0x207 ubyte x \b.%u 7606# module_size for 1.94 7607>>>>0x208 ulelong <0xffffff \b, installed partition %u 7608#>>>>0x208 ulelong =0xffffff \b, %u (default) 7609>>>>0x208 ulelong >0xffffff \b, installed partition %u 7610# GRUB 0.5.95 unofficial 7611>>>>0x20C ulelong&0x2E300000 0x2E300000 7612# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 7613>>>>>0x20C ubyte x \b, identifier 0x%x 7614#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 7615>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 7616# GRUB version as string 7617>>>>>0x20E string >\0 \b, GRUB version %-s 7618# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7619>>>>>>0x215 ulong 0xffffffff 7620>>>>>>>0x219 string >\0 \b, configuration file %-s 7621>>>>>>0x215 ulong !0xffffffff 7622>>>>>>>0x215 string >\0 \b, configuration file %-s 7623# newer GRUB versions 7624>>>>0x20C ulelong&0x2E300000 !0x2E300000 7625##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 7626>>>>>0x20C ulelong >0 \b, saved entry %d 7627# for 1.94 contains kernel image size 7628# for 0.93,0.94,0.96,0.97 7629# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 7630>>>>>0x210 ubyte x \b, identifier 0x%x 7631# The flag for LBA forcing is in most cases 0 7632#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 7633>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 7634# GRUB version as string 7635>>>>>0x212 string >\0 \b, GRUB version %-s 7636# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7637>>>>>0x217 ulong 0xffffffff 7638>>>>>>0x21b string >\0 \b, configuration file %-s 7639>>>>>0x217 ulong !0xffffffff 7640>>>>>>0x217 string >\0 \b, configuration file %-s 7641 76429564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 7643>8404 string x last mounted on %s, 7644#>9504 ledate x last checked at %s, 7645>8224 ledate x last written at %s, 7646>8401 byte x clean flag %d, 7647>8228 lelong x number of blocks %d, 7648>8232 lelong x number of data blocks %d, 7649>8236 lelong x number of cylinder groups %d, 7650>8240 lelong x block size %d, 7651>8244 lelong x fragment size %d, 7652>8252 lelong x minimum percentage of free blocks %d, 7653>8256 lelong x rotational delay %dms, 7654>8260 lelong x disk rotational speed %drps, 7655>8320 lelong 0 TIME optimization 7656>8320 lelong 1 SPACE optimization 7657 765842332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7659>&-1164 string x last mounted on %s, 7660>&-696 string >\0 volume name %s, 7661>&-304 leqldate x last written at %s, 7662>&-1167 byte x clean flag %d, 7663>&-1168 byte x readonly flag %d, 7664>&-296 lequad x number of blocks %lld, 7665>&-288 lequad x number of data blocks %lld, 7666>&-1332 lelong x number of cylinder groups %d, 7667>&-1328 lelong x block size %d, 7668>&-1324 lelong x fragment size %d, 7669>&-180 lelong x average file size %d, 7670>&-176 lelong x average number of files in dir %d, 7671>&-272 lequad x pending blocks to free %lld, 7672>&-264 lelong x pending inodes to free %ld, 7673>&-664 lequad x system-wide uuid %0llx, 7674>&-1316 lelong x minimum percentage of free blocks %d, 7675>&-1248 lelong 0 TIME optimization 7676>&-1248 lelong 1 SPACE optimization 7677 767866908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 7679>&-1164 string x last mounted on %s, 7680>&-696 string >\0 volume name %s, 7681>&-304 leqldate x last written at %s, 7682>&-1167 byte x clean flag %d, 7683>&-1168 byte x readonly flag %d, 7684>&-296 lequad x number of blocks %lld, 7685>&-288 lequad x number of data blocks %lld, 7686>&-1332 lelong x number of cylinder groups %d, 7687>&-1328 lelong x block size %d, 7688>&-1324 lelong x fragment size %d, 7689>&-180 lelong x average file size %d, 7690>&-176 lelong x average number of files in dir %d, 7691>&-272 lequad x pending blocks to free %lld, 7692>&-264 lelong x pending inodes to free %ld, 7693>&-664 lequad x system-wide uuid %0llx, 7694>&-1316 lelong x minimum percentage of free blocks %d, 7695>&-1248 lelong 0 TIME optimization 7696>&-1248 lelong 1 SPACE optimization 7697 76989564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 7699>7168 belong 0x4c41424c Apple UFS Volume 7700>>7186 string x named %s, 7701>>7176 belong x volume label version %d, 7702>>7180 bedate x created on %s, 7703>8404 string x last mounted on %s, 7704#>9504 bedate x last checked at %s, 7705>8224 bedate x last written at %s, 7706>8401 byte x clean flag %d, 7707>8228 belong x number of blocks %d, 7708>8232 belong x number of data blocks %d, 7709>8236 belong x number of cylinder groups %d, 7710>8240 belong x block size %d, 7711>8244 belong x fragment size %d, 7712>8252 belong x minimum percentage of free blocks %d, 7713>8256 belong x rotational delay %dms, 7714>8260 belong x disk rotational speed %drps, 7715>8320 belong 0 TIME optimization 7716>8320 belong 1 SPACE optimization 7717 771842332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7719>&-1164 string x last mounted on %s, 7720>&-696 string >\0 volume name %s, 7721>&-304 beqldate x last written at %s, 7722>&-1167 byte x clean flag %d, 7723>&-1168 byte x readonly flag %d, 7724>&-296 bequad x number of blocks %lld, 7725>&-288 bequad x number of data blocks %lld, 7726>&-1332 belong x number of cylinder groups %d, 7727>&-1328 belong x block size %d, 7728>&-1324 belong x fragment size %d, 7729>&-180 belong x average file size %d, 7730>&-176 belong x average number of files in dir %d, 7731>&-272 bequad x pending blocks to free %lld, 7732>&-264 belong x pending inodes to free %ld, 7733>&-664 bequad x system-wide uuid %0llx, 7734>&-1316 belong x minimum percentage of free blocks %d, 7735>&-1248 belong 0 TIME optimization 7736>&-1248 belong 1 SPACE optimization 7737 773866908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 7739>&-1164 string x last mounted on %s, 7740>&-696 string >\0 volume name %s, 7741>&-304 beqldate x last written at %s, 7742>&-1167 byte x clean flag %d, 7743>&-1168 byte x readonly flag %d, 7744>&-296 bequad x number of blocks %lld, 7745>&-288 bequad x number of data blocks %lld, 7746>&-1332 belong x number of cylinder groups %d, 7747>&-1328 belong x block size %d, 7748>&-1324 belong x fragment size %d, 7749>&-180 belong x average file size %d, 7750>&-176 belong x average number of files in dir %d, 7751>&-272 bequad x pending blocks to free %lld, 7752>&-264 belong x pending inodes to free %ld, 7753>&-664 bequad x system-wide uuid %0llx, 7754>&-1316 belong x minimum percentage of free blocks %d, 7755>&-1248 belong 0 TIME optimization 7756>&-1248 belong 1 SPACE optimization 7757 7758# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 7759# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 77600x438 leshort 0xEF53 Linux 7761>0x44c lelong x rev %d 7762>0x43e leshort x \b.%d 7763# No journal? ext2 7764>0x45c lelong ^0x0000004 ext2 filesystem data 7765>>0x43a leshort ^0x0000001 (mounted or unclean) 7766# Has a journal? ext3 or ext4 7767>0x45c lelong &0x0000004 7768# and small INCOMPAT? 7769>>0x460 lelong <0x0000040 7770# and small RO_COMPAT? 7771>>>0x464 lelong <0x0000008 ext3 filesystem data 7772# else large RO_COMPAT? 7773>>>0x464 lelong >0x0000007 ext4 filesystem data 7774# else large INCOMPAT? 7775>>0x460 lelong >0x000003f ext4 filesystem data 7776# General flags for any ext* fs 7777>0x460 lelong &0x0000004 (needs journal recovery) 7778>0x43a leshort &0x0000002 (errors) 7779# INCOMPAT flags 7780>0x460 lelong &0x0000001 (compressed) 7781#>0x460 lelong &0x0000002 (filetype) 7782#>0x460 lelong &0x0000010 (meta bg) 7783>0x460 lelong &0x0000040 (extents) 7784>0x460 lelong &0x0000080 (64bit) 7785#>0x460 lelong &0x0000100 (mmp) 7786#>0x460 lelong &0x0000200 (flex bg) 7787# RO_INCOMPAT flags 7788#>0x464 lelong &0x0000001 (sparse super) 7789>0x464 lelong &0x0000002 (large files) 7790>0x464 lelong &0x0000008 (huge files) 7791#>0x464 lelong &0x0000010 (gdt checksum) 7792#>0x464 lelong &0x0000020 (many subdirs) 7793#>0x463 lelong &0x0000040 (extra isize) 7794 7795# SGI disk labels - Nathan Scott <nathans@debian.org> 77960 belong 0x0BE5A941 SGI disk label (volume header) 7797 7798# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 77990 belong 0x58465342 SGI XFS filesystem data 7800>0x4 belong x (blksz %d, 7801>0x68 beshort x inosz %d, 7802>0x64 beshort ^0x2004 v1 dirs) 7803>0x64 beshort &0x2004 v2 dirs) 7804 7805############################################################################ 7806# Minix-ST kernel floppy 78070x800 belong 0x46fc2700 Atari-ST Minix kernel image 7808>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy 7809>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy 7810 7811############################################################################ 7812# Hmmm, is this a better way of detecting _standard_ floppy images ? 781319 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k 7814>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 781519 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k 7816>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 781719 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 7818>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 7819 782019 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM 7821>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 782219 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs 7823>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 7824 782519 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 782619 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k 7827 7828# Valid media descriptor bytes for MS-DOS: 7829# 7830# Byte Capacity Media Size and Type 7831# ------------------------------------------------- 7832# 7833# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 7834# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 7835# F9 720K 3.5-inch, 2-sided, 9-sector 7836# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 7837# FD 360K 5.25-inch, 2-sided, 9-sector 7838# FF 320K 5.25-inch, 2-sided, 8-sector 7839# FC 180K 5.25-inch, 1-sided, 9-sector 7840# FE 160K 5.25-inch, 1-sided, 8-sector 7841# FE 250K 8-inch, 1-sided, single-density 7842# FD 500K 8-inch, 2-sided, single-density 7843# FE 1.2 MB 8-inch, 2-sided, double-density 7844# F8 ----- Fixed disk 7845# 7846# FC xxxK Apricot 70x1x9 boot disk. 7847# 7848# Originally a bitmap: 7849# xxxxxxx0 Not two sided 7850# xxxxxxx1 Double sided 7851# xxxxxx0x Not 8 SPT 7852# xxxxxx1x 8 SPT 7853# xxxxx0xx Not Removable drive 7854# xxxxx1xx Removable drive 7855# 11111xxx Must be one. 7856# 7857# But now it's rather random: 7858# 111111xx Low density disk 7859# 00 SS, Not 8 SPT 7860# 01 DS, Not 8 SPT 7861# 10 SS, 8 SPT 7862# 11 DS, 8 SPT 7863# 7864# 11111001 Double density 3 floppy disk, high density 5 7865# 11110000 High density 3 floppy disk 7866# 11111000 Hard disk any format 7867# 7868 7869# CDROM Filesystems 7870# Modified for UDF by gerardo.cacciari@gmail.com 787132769 string CD001 7872!:mime application/x-iso9660-image 7873>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 7874>38913 string NSR0 UDF filesystem data 7875>>38917 string 1 (version 1.0) 7876>>38917 string 2 (version 1.5) 7877>>38917 string 3 (version 2.0) 7878>>38917 byte >0x33 (unknown version, ID 0x%X) 7879>>38917 byte <0x31 (unknown version, ID 0x%X) 7880# "application id" which appears to be used as a volume label 7881>32808 string >\0 '%s' 7882>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 788337633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 7884!:mime application/x-iso9660-image 788532776 string CDROM High Sierra CD-ROM filesystem data 7886 7887# .cso files 78880 string CISO Compressed ISO CD image 7889 7890# cramfs filesystem - russell@coker.com.au 78910 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 7892>4 lelong x size %lu 7893>8 lelong &1 version #2 7894>8 lelong &2 sorted_dirs 7895>8 lelong &4 hole_support 7896>32 lelong x CRC 0x%x, 7897>36 lelong x edition %lu, 7898>40 lelong x %lu blocks, 7899>44 lelong x %lu files 7900 79010 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 7902>4 belong x size %lu 7903>8 belong &1 version #2 7904>8 belong &2 sorted_dirs 7905>8 belong &4 hole_support 7906>32 belong x CRC 0x%x, 7907>36 belong x edition %lu, 7908>40 belong x %lu blocks, 7909>44 belong x %lu files 7910 7911# reiserfs - russell@coker.com.au 79120x10034 string ReIsErFs ReiserFS V3.5 79130x10034 string ReIsEr2Fs ReiserFS V3.6 7914>0x1002c leshort x block size %d 7915>0x10032 leshort &2 (mounted or unclean) 7916>0x10000 lelong x num blocks %d 7917>0x10040 lelong 1 tea hash 7918>0x10040 lelong 2 yura hash 7919>0x10040 lelong 3 r5 hash 7920 7921# JFFS - russell@coker.com.au 79220 lelong 0x34383931 Linux Journalled Flash File system, little endian 79230 belong 0x34383931 Linux Journalled Flash File system, big endian 7924 7925# EST flat binary format (which isn't, but anyway) 7926# From: Mark Brown <broonie@sirena.org.uk> 79270 string ESTFBINR EST flat binary 7928 7929# Aculab VoIP firmware 7930# From: Mark Brown <broonie@sirena.org.uk> 79310 string VoIP\ Startup\ and Aculab VoIP firmware 7932>35 string x format %s 7933 7934# From: Mark Brown <broonie@sirena.org.uk> [old] 7935# From: Behan Webster <behanw@websterwood.com> 79360 belong 0x27051956 u-boot legacy uImage, 7937>32 string x %s, 7938>28 byte 0 Invalid os/ 7939>28 byte 1 OpenBSD/ 7940>28 byte 2 NetBSD/ 7941>28 byte 3 FreeBSD/ 7942>28 byte 4 4.4BSD/ 7943>28 byte 5 Linux/ 7944>28 byte 6 SVR4/ 7945>28 byte 7 Esix/ 7946>28 byte 8 Solaris/ 7947>28 byte 9 Irix/ 7948>28 byte 10 SCO/ 7949>28 byte 11 Dell/ 7950>28 byte 12 NCR/ 7951>28 byte 13 LynxOS/ 7952>28 byte 14 VxWorks/ 7953>28 byte 15 pSOS/ 7954>28 byte 16 QNX/ 7955>28 byte 17 Firmware/ 7956>28 byte 18 RTEMS/ 7957>28 byte 19 ARTOS/ 7958>28 byte 20 Unity OS/ 7959>28 byte 21 INTEGRITY/ 7960>29 byte 0 \bInvalid CPU, 7961>29 byte 1 \bAlpha, 7962>29 byte 2 \bARM, 7963>29 byte 3 \bIntel x86, 7964>29 byte 4 \bIA64, 7965>29 byte 5 \bMIPS, 7966>29 byte 6 \bMIPS 64-bit, 7967>29 byte 7 \bPowerPC, 7968>29 byte 8 \bIBM S390, 7969>29 byte 9 \bSuperH, 7970>29 byte 10 \bSparc, 7971>29 byte 11 \bSparc 64-bit, 7972>29 byte 12 \bM68K, 7973>29 byte 13 \bNios-32, 7974>29 byte 14 \bMicroBlaze, 7975>29 byte 15 \bNios-II, 7976>29 byte 16 \bBlackfin, 7977>29 byte 17 \bAVR32, 7978>29 byte 18 \bSTMicroelectronics ST200, 7979>30 byte 0 Invalid Image 7980>30 byte 1 Standalone Program 7981>30 byte 2 OS Kernel Image 7982>30 byte 3 RAMDisk Image 7983>30 byte 4 Multi-File Image 7984>30 byte 5 Firmware Image 7985>30 byte 6 Script File 7986>30 byte 7 Filesystem Image (any type) 7987>30 byte 8 Binary Flat Device Tree BLOB 7988>31 byte 0 (Not compressed), 7989>31 byte 1 (gzip), 7990>31 byte 2 (bzip2), 7991>31 byte 3 (lzma), 7992>12 belong x %d bytes, 7993>8 bedate x %s, 7994>16 belong x Load Address: 0x%08X, 7995>20 belong x Entry Point: 0x%08X, 7996>4 belong x Header CRC: 0x%08X, 7997>24 belong x Data CRC: 0x%08X 7998 7999# JFFS2 file system 80000 leshort 0x1984 Linux old jffs2 filesystem data little endian 80010 leshort 0x1985 Linux jffs2 filesystem data little endian 8002 8003# Squashfs 80040 string sqsh Squashfs filesystem, big endian, 8005>28 beshort x version %d. 8006>30 beshort x \b%d, 8007>28 beshort <3 8008>>8 belong x %d bytes, 8009>28 beshort >2 8010>>28 beshort <4 8011>>>63 bequad x %lld bytes, 8012>>28 beshort >3 8013>>>40 bequad x %lld bytes, 8014#>>67 belong x %d bytes, 8015>4 belong x %d inodes, 8016>28 beshort <2 8017>>32 beshort x blocksize: %d bytes, 8018>28 beshort >1 8019>>28 beshort <4 8020>>>51 belong x blocksize: %d bytes, 8021>>28 beshort >3 8022>>>12 belong x blocksize: %d bytes, 8023>28 beshort <4 8024>>39 bedate x created: %s 8025>28 beshort >3 8026>>8 bedate x created: %s 80270 string hsqs Squashfs filesystem, little endian, 8028>28 leshort x version %d. 8029>30 leshort x \b%d, 8030>28 leshort <3 8031>>8 lelong x %d bytes, 8032>28 leshort >2 8033>>28 leshort <4 8034>>>63 lequad x %lld bytes, 8035>>28 leshort >3 8036>>>40 lequad x %lld bytes, 8037#>>63 lelong x %d bytes, 8038>4 lelong x %d inodes, 8039>28 leshort <2 8040>>32 leshort x blocksize: %d bytes, 8041>28 leshort >1 8042>>28 leshort <4 8043>>>51 lelong x blocksize: %d bytes, 8044>>28 leshort >3 8045>>>12 lelong x blocksize: %d bytes, 8046>28 leshort <4 8047>>39 ledate x created: %s 8048>28 leshort >3 8049>>8 ledate x created: %s 8050 80510 string td\000 floppy image data (TeleDisk) 8052 8053# AFS Dump Magic 8054# From: Ty Sarna <tsarna@sarna.org> 80550 string \x01\xb3\xa1\x13\x22 AFS Dump 8056>&0 belong x (v%d) 8057>>&0 byte 0x76 8058>>>&0 belong x Vol %d, 8059>>>>&0 byte 0x6e 8060>>>>>&0 string x %s 8061>>>>>>&1 byte 0x74 8062>>>>>>>&0 beshort 2 8063>>>>>>>>&4 bedate x on: %s 8064>>>>>>>>&0 bedate =0 full dump 8065>>>>>>>>&0 bedate !0 incremental since: %s 8066 8067#---------------------------------------------------------- 8068#delta ISO Daniel Novotny (dnovotny@redhat.com) 80690 string DISO Delta ISO data 8070>4 belong x version %d 8071 8072# VMS backup savesets - gerardo.cacciari@gmail.com 8073# 80744 string \x01\x00\x01\x00\x01\x00 8075>(0.s+16) string \x01\x01 8076>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 8077>>>40 lelong x (block size %d, 8078>>>49 string >\0 original name '%s', 8079>>>2 short 1024 VAX generated) 8080>>>2 short 2048 AXP generated) 8081>>>2 short 4096 I64 generated) 8082 8083# Summary: Oracle Clustered Filesystem 8084# Created by: Aaron Botsis <redhat@digitalmafia.org> 80858 string OracleCFS Oracle Clustered Filesystem, 8086>4 long x rev %d 8087>0 long x \b.%d, 8088>560 string x label: %.64s, 8089>136 string x mountpoint: %.128s 8090 8091# Summary: Oracle ASM tagged volume 8092# Created by: Aaron Botsis <redhat@digitalmafia.org> 809332 string ORCLDISK Oracle ASM Volume, 8094>40 string x Disk Name: %0.12s 809532 string ORCLCLRD Oracle ASM Volume (cleared), 8096>40 string x Disk Name: %0.12s 8097 8098# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 80998 string OracleCFS Oracle Clustered Filesystem, 8100>4 long x rev %d 8101>0 long x \b.%d, 8102>560 string x label: %.64s, 8103>136 string x mountpoint: %.128s 8104 8105# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 810632 string ORCLDISK Oracle ASM Volume, 8107>40 string x Disk Name: %0.12s 810832 string ORCLCLRD Oracle ASM Volume (cleared), 8109>40 string x Disk Name: %0.12s 8110 8111# Compaq/HP RILOE floppy image 8112# From: Dirk Jagdmann <doj@cubic.org> 81130 string CPQRFBLO Compaq/HP RILOE floppy image 8114 8115#------------------------------------------------------------------------------ 8116# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com 8117# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is 8118# mapped to VBN 2 of [000000]INDEXF.SYS;1 8119# 81201008 string DECFILE11B Files-11 On-Disk Structure 8121>525 byte x Level %d 8122>525 byte x (ODS-%d OpenVMS file system), 8123>984 string x volume label is '%-12.12s' 8124 8125# From: Thomas Klausner <wiz@NetBSD.org> 8126# http://filext.com/file-extension/DAA 8127# describes the daa file format. The magic would be: 81280 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 8129 8130# From Albert Cahalan <acahalan@gmail.com> 8131# really le32 operation,destination,payloadsize (but quite predictable) 8132# 01 00 00 00 00 00 00 c0 00 02 00 00 81330 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 8134 8135# From Eric Sandeen 8136# GFS2 81370x10000 belong 0x01161970 Linux 8138>0x10018 belong 0x0000051d GFS1 Filesystem 8139>>0x10024 belong x (blocksize %d, 8140>>0x10060 string >\0 lockproto %s) 8141>0x10018 belong 0x00000709 GFS2 Filesystem 8142>>0x10024 belong x (blocksize %d, 8143>>0x10060 string >\0 lockproto %s) 8144 8145# BTRFS 81460x10040 string _BHRfS_M BTRFS Filesystem 8147>0x1012b string >\0 (label "%s", 8148>0x10090 lelong x sectorsize %d, 8149>0x10094 lelong x nodesize %d, 8150>0x10098 lelong x leafsize %d) 8151 8152 8153# dvdisaster's .ecc 8154# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 81550 string *dvdisaster* dvdisaster error correction file 8156 8157# xfs metadump image 8158# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 8159# but can we do the << ? For now it's always 512 (0x200) anyway. 81600 string XFSM 8161>0x200 string XFSB XFS filesystem metadump image 8162 8163 8164#------------------------------------------------------------------------------ 8165# $File: flash,v 1.9 2009/11/08 01:30:01 christos Exp $ 8166# flash: file(1) magic for Macromedia Flash file format 8167# 8168# See 8169# 8170# http://www.macromedia.com/software/flash/open/ 8171# 81720 string FWS Macromedia Flash data, 8173>3 byte x version %d 8174!:mime application/x-shockwave-flash 81750 string CWS Macromedia Flash data (compressed), 8176!:mime application/x-shockwave-flash 8177>3 byte x version %d 8178# From: Cal Peake <cp@absolutedigital.net> 81790 string FLV Macromedia Flash Video 8180!:mime video/x-flv 8181 8182# 8183# Yosu Gomez 81840 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 81850 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 8186# From Dave Wilson 81870 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 8188 8189#------------------------------------------------------------------------------ 8190# $File: fonts,v 1.21 2009/12/06 23:17:52 rrt Exp $ 8191# fonts: file(1) magic for font data 8192# 81930 search/1 FONT ASCII vfont text 81940 short 0436 Berkeley vfont data 81950 short 017001 byte-swapped Berkeley vfont data 8196 8197# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 81980 string %!PS-AdobeFont-1. PostScript Type 1 font text 8199>20 string >\0 (%s) 82006 string %!PS-AdobeFont-1. PostScript Type 1 font program data 82010 string %!FontType1 PostScript Type 1 font program data 82026 string %!FontType1 PostScript Type 1 font program data 82030 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 8204 8205# X11 font files in SNF (Server Natural Format) format 82060 belong 00000004 X11 SNF font data, MSB first 82070 lelong 00000004 X11 SNF font data, LSB first 8208 8209# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 82100 search/1 STARTFONT\ X11 BDF font text 8211 8212# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 8213# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 82140 string \001fcp X11 Portable Compiled Font data 8215>12 byte 0x02 \b, LSB first 8216>12 byte 0x0a \b, MSB first 82170 string D1.0\015 X11 Speedo font data 8218 8219#------------------------------------------------------------------------------ 8220# FIGlet fonts and controlfiles 8221# From figmagic supplied with Figlet version 2.2 8222# "David E. O'Brien" <obrien@FreeBSD.ORG> 82230 string flf FIGlet font 8224>3 string >2a version %-2.2s 82250 string flc FIGlet controlfile 8226>3 string >2a version %-2.2s 8227 8228# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 8229# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 82300 belong 0x14025919 libGrx font data, 8231>8 leshort x %dx 8232>10 leshort x \b%d 8233>40 string x %s 8234# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 82350 belong 0xff464f4e DOS code page font data collection 82367 belong 0x00454741 DOS code page font data 82377 belong 0x00564944 DOS code page font data (from Linux?) 82384098 string DOSFONT DOSFONT2 encrypted font data 8239 8240# downloadable fonts for browser (prints type) anthon@mnt.org 82410 string PFR1 PFR1 font 8242>102 string >0 \b: %s 8243 8244# True Type fonts 82450 string \000\001\000\000\000 TrueType font data 8246!:mime application/x-font-ttf 8247 82480 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 82490 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 8250 82510 string ttcf TrueType font collection data 8252 8253# Opentype font data from Avi Bercovich 82540 string OTTO OpenType font data 8255!:mime application/vnd.ms-opentype 8256 8257# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 82580 string SplineFontDB: Spline Font Database 8259!:mime application/vnd.font-fontforge-sfd 8260>14 string x version %s 8261 8262#------------------------------------------------------------------------------ 8263# $File: fortran,v 1.6 2009/09/19 16:28:09 christos Exp $ 8264# FORTRAN source 82650 regex/100 \^[Cc][\ \t] FORTRAN program 8266!:mime text/x-fortran 8267 8268#------------------------------------------------------------------------------ 8269# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ 8270# frame: file(1) magic for FrameMaker files 8271# 8272# This stuff came on a FrameMaker demo tape, most of which is 8273# copyright, but this file is "published" as witness the following: 8274# 8275# Note that this is the Framemaker Maker Interchange Format, not the 8276# Normal format which would be application/vnd.framemaker. 8277# 82780 string \<MakerFile FrameMaker document 8279!:mime application/x-mif 8280>11 string 5.5 (5.5 8281>11 string 5.0 (5.0 8282>11 string 4.0 (4.0 8283>11 string 3.0 (3.0 8284>11 string 2.0 (2.0 8285>11 string 1.0 (1.0 8286>14 byte x %c) 82870 string \<MIFFile FrameMaker MIF (ASCII) file 8288!:mime application/x-mif 8289>9 string 4.0 (4.0) 8290>9 string 3.0 (3.0) 8291>9 string 2.0 (2.0) 8292>9 string 1.0 (1.x) 82930 search/1 \<MakerDictionary FrameMaker Dictionary text 8294!:mime application/x-mif 8295>17 string 3.0 (3.0) 8296>17 string 2.0 (2.0) 8297>17 string 1.0 (1.x) 82980 string \<MakerScreenFont FrameMaker Font file 8299!:mime application/x-mif 8300>17 string 1.01 (%s) 83010 string \<MML FrameMaker MML file 8302!:mime application/x-mif 83030 string \<BookFile FrameMaker Book file 8304!:mime application/x-mif 8305>10 string 3.0 (3.0 8306>10 string 2.0 (2.0 8307>10 string 1.0 (1.0 8308>13 byte x %c) 8309# XXX - this book entry should be verified, if you find one, uncomment this 8310#0 string \<Book\ FrameMaker Book (ASCII) file 8311#!:mime application/x-mif 8312#>6 string 3.0 (3.0) 8313#>6 string 2.0 (2.0) 8314#>6 string 1.0 (1.0) 83150 string \<Maker Intermediate Print File FrameMaker IPL file 8316!:mime application/x-mif 8317 8318#------------------------------------------------------------------------------ 8319# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 8320# freebsd: file(1) magic for FreeBSD objects 8321# 8322# All new-style FreeBSD magic numbers are in host byte order (i.e., 8323# little-endian on x86). 8324# 8325# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 8326# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 8327# schemes for distinguishing between executable images, shared libraries, 8328# and object files. 8329# 8330# FreeBSD says: 8331# 8332# Regardless of whether it's pure, demand-paged, or none of the 8333# above: 8334# 8335# if the entry point is < 4096, then it's a shared library if 8336# the "has run-time loader information" bit is set, and is 8337# position-independent if the "is position-independent" bit 8338# is set; 8339# 8340# if the entry point is >= 4096 (or >4095, same thing), then it's 8341# an executable, and is dynamically-linked if the "has run-time 8342# loader information" bit is set. 8343# 8344# On x86, NetBSD says: 8345# 8346# If it's neither pure nor demand-paged: 8347# 8348# if it has the "has run-time loader information" bit set, it's 8349# a dynamically-linked executable; 8350# 8351# if it doesn't have that bit set, then: 8352# 8353# if it has the "is position-independent" bit set, it's 8354# position-independent; 8355# 8356# if the entry point is non-zero, it's an executable, otherwise 8357# it's an object file. 8358# 8359# If it's pure: 8360# 8361# if it has the "has run-time loader information" bit set, it's 8362# a dynamically-linked executable, otherwise it's just an 8363# executable. 8364# 8365# If it's demand-paged: 8366# 8367# if it has the "has run-time loader information" bit set, 8368# then: 8369# 8370# if the entry point is < 4096, it's a shared library; 8371# 8372# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 8373# it's a dynamically-linked executable); 8374# 8375# if it doesn't have the "has run-time loader information" bit 8376# set, then it's just an executable. 8377# 8378# (On non-x86, NetBSD does much the same thing, except that it uses 8379# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 8380# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 8381# had 8K pages; dunno about MIPS.) 8382# 8383# I suspect the two will differ only in perverse and uninteresting cases 8384# ("shared" libraries that aren't demand-paged and whose pages probably 8385# won't actually be shared, executables with entry points <4096). 8386# 8387# I leave it to those more familiar with FreeBSD and NetBSD to figure out 8388# what the right answer is (although using ">4095", FreeBSD-style, is 8389# probably better than separately checking for "=4096" and ">4096", 8390# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 8391# executables using the NetBSD technique.) 8392# 83930 lelong&0377777777 041400407 FreeBSD/i386 8394>20 lelong <4096 8395>>3 byte&0xC0 &0x80 shared library 8396>>3 byte&0xC0 0x40 PIC object 8397>>3 byte&0xC0 0x00 object 8398>20 lelong >4095 8399>>3 byte&0x80 0x80 dynamically linked executable 8400>>3 byte&0x80 0x00 executable 8401>16 lelong >0 not stripped 8402 84030 lelong&0377777777 041400410 FreeBSD/i386 pure 8404>20 lelong <4096 8405>>3 byte&0xC0 &0x80 shared library 8406>>3 byte&0xC0 0x40 PIC object 8407>>3 byte&0xC0 0x00 object 8408>20 lelong >4095 8409>>3 byte&0x80 0x80 dynamically linked executable 8410>>3 byte&0x80 0x00 executable 8411>16 lelong >0 not stripped 8412 84130 lelong&0377777777 041400413 FreeBSD/i386 demand paged 8414>20 lelong <4096 8415>>3 byte&0xC0 &0x80 shared library 8416>>3 byte&0xC0 0x40 PIC object 8417>>3 byte&0xC0 0x00 object 8418>20 lelong >4095 8419>>3 byte&0x80 0x80 dynamically linked executable 8420>>3 byte&0x80 0x00 executable 8421>16 lelong >0 not stripped 8422 84230 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 8424>20 lelong <4096 8425>>3 byte&0xC0 &0x80 shared library 8426>>3 byte&0xC0 0x40 PIC object 8427>>3 byte&0xC0 0x00 object 8428>20 lelong >4095 8429>>3 byte&0x80 0x80 dynamically linked executable 8430>>3 byte&0x80 0x00 executable 8431>16 lelong >0 not stripped 8432 8433# XXX gross hack to identify core files 8434# cores start with a struct tss; we take advantage of the following: 8435# byte 7: highest byte of the kernel stack pointer, always 0xfe 8436# 8/9: kernel (ring 0) ss value, always 0x0010 8437# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 8438# 28: low order byte of the current PTD entry, always 0 since the 8439# PTD is page-aligned 8440# 84417 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 8442>1039 string >\0 from '%s' 8443 8444# /var/run/ld.so.hints 8445# What are you laughing about? 84460 lelong 011421044151 ld.so hints file (Little Endian 8447>4 lelong >0 \b, version %d) 8448>4 belong <1 \b) 84490 belong 011421044151 ld.so hints file (Big Endian 8450>4 belong >0 \b, version %d) 8451>4 belong <1 \b) 8452 8453# 8454# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 8455# 84560 string SCRSHOT_ scrshot(1) screenshot, 8457>8 byte x version %d, 8458>9 byte 2 %d bytes in header, 8459>>10 byte x %d chars wide by 8460>>11 byte x %d chars high 8461 8462#------------------------------------------------------------------------------ 8463# $File: fsav,v 1.11 2009/09/19 16:28:09 christos Exp $ 8464# fsav: file(1) magic for datafellows fsav virus definition files 8465# Anthon van der Neut (anthon@mnt.org) 8466 8467# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 84680 beshort 0x1575 fsav macro virus signatures 8469>8 leshort >0 (%d- 8470>11 byte >0 \b%02d- 8471>10 byte >0 \b%02d) 8472# ftp://ftp.f-prot.com/pub/sign.zip 8473#10 ubyte <12 8474#>9 ubyte <32 8475#>>8 ubyte 0x0a 8476#>>>12 ubyte 0x07 8477#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 8478#>>>>10 byte 0 \b01- 8479#>>>>10 byte 1 \b02- 8480#>>>>10 byte 2 \b03- 8481#>>>>10 byte 3 \b04- 8482#>>>>10 byte 4 \b05- 8483#>>>>10 byte 5 \b06- 8484#>>>>10 byte 6 \b07- 8485#>>>>10 byte 7 \b08- 8486#>>>>10 byte 8 \b09- 8487#>>>>10 byte 9 \b10- 8488#>>>>10 byte 10 \b11- 8489#>>>>10 byte 11 \b12- 8490#>>>>9 ubyte >0 \b%02d) 8491# ftp://ftp.f-prot.com/pub/sign2.zip 8492#0 ubyte 0x62 8493#>1 ubyte 0xF5 8494#>>2 ubyte 0x1 8495#>>>3 ubyte 0x1 8496#>>>>4 ubyte 0x0e 8497#>>>>>13 ubyte >0 fsav virus signatures 8498#>>>>>>11 ubyte x size 0x%02x 8499#>>>>>>12 ubyte x \b%02x 8500#>>>>>>13 ubyte x \b%02x bytes 8501 8502# Joerg Jenderek: joerg dot jenderek at web dot de 8503# http://www.clamav.net/doc/latest/html/node45.html 8504# .cvd files start with a 512 bytes colon separated header 8505# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 8506# + gzipped tarball files 85070 string ClamAV-VDB: 8508>11 string >\0 Clam AntiVirus database %-.23s 8509>>34 string : 8510>>>35 string !: \b, version 8511>>>>35 string x \b%-.1s 8512>>>>>36 string !: 8513>>>>>>36 string x \b%-.1s 8514>>>>>>>37 string !: 8515>>>>>>>>37 string x \b%-.1s 8516>>>>>>>>>38 string !: 8517>>>>>>>>>>38 string x \b%-.1s 8518>512 string \037\213 \b, gzipped 8519>769 string ustar\0 \b, tarred 8520 8521# Type: Grisoft AVG AntiVirus 8522# From: David Newgas <david@newgas.net> 85230 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 8524 8525#------------------------------------------------------------------------------ 8526# $File: games,v 1.8 2009/09/19 16:28:09 christos Exp $ 8527# games: file(1) for games 8528 8529# Fabio Bonelli <fabiobonelli@libero.it> 8530# Quake II - III data files 85310 string IDP2 Quake II 3D Model file, 8532>20 long x %lu skin(s), 8533>8 long x (%lu x 8534>12 long x %lu), 8535>40 long x %lu frame(s), 8536>16 long x Frame size %lu bytes, 8537>24 long x %lu vertices/frame, 8538>28 long x %lu texture coordinates, 8539>32 long x %lu triangles/frame 8540 85410 string IBSP Quake 8542>4 long 0x26 II Map file (BSP) 8543>4 long 0x2E III Map file (BSP) 8544 85450 string IDS2 Quake II SP2 sprite file 8546 8547#--------------------------------------------------------------------------- 8548# Doom and Quake 8549# submitted by Nicolas Patrois 8550 85510 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 8552# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 8553 855424 string LxD\ 203 Linuxdoom save 8555>0 string x , name=%s 8556>44 string x , world=%s 8557 8558# Quake 8559 85600 string PACK Quake I or II world or extension 8561 8562#0 string -1\x0a Quake I demo 8563#>30 string x version %.4s 8564#>61 string x level %s 8565 8566#0 string 5\x0a Quake I save 8567 8568# The levels 8569 8570# Quake 1 8571 85720 string 5\x0aIntroduction Quake I save: start Introduction 85730 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 85740 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 85750 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 85760 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 85770 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 85780 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 85790 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 85800 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 85810 string 5\x0athe_Installation Quake I save: e2m1 The installation 85820 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 85830 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 85840 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 85850 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 85860 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 85870 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 85880 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 85890 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 85900 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 85910 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 85920 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 85930 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 85940 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 85950 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 85960 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 85970 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 85980 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 85990 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 86000 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 86010 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 86020 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 86030 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 8604 8605# Quake DeathMatch levels 8606 86070 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 86080 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 86090 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 86100 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 86110 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 86120 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 8613 8614# Scourge of Armagon 8615 86160 string 5\x0aCommand_HQ Quake I save: start Command HQ 86170 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 86180 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 86190 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 86200 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 86210 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 86220 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 86230 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 86240 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 86250 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 86260 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 86270 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 86280 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 86290 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 86300 string 5\x0aLimbo Quake I save: hip3m3 Limbo 86310 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 86320 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 86330 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 8634 8635# Malice 8636 86370 string 5\x0aThe_Academy Quake I save: start The academy 86380 string 5\x0aThe_Lab Quake I save: d1 The lab 86390 string 5\x0aArea_33 Quake I save: d1b Area 33 86400 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 86410 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 86420 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 86430 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 86440 string 5\x0aArea44 Quake I save: d1c Area 44 86450 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 86460 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 86470 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 86480 string 5\x0aThe_Flood Quake I save: d5 The flood 86490 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 86500 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 86510 string 5\x0aThe_Foundry Quake I save: d7b The foundry 86520 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 86530 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 86540 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 86550 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 86560 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 86570 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 8658 8659# Malice DeathMatch levels 8660 86610 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 86620 string 5\x0aSub_Station Quake I save: ddm2 Sub station 86630 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 86640 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 86650 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 86660 string 5\x0aDOMINO Quake I save: ddm6 Domino 86670 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 8668 8669 86700 string MComprHD MAME CHD compressed hard disk image, 8671>12 belong x version %lu 8672 8673# doom - submitted by Jon Dowland 8674 86750 string =IWAD doom main IWAD data 8676>4 lelong x containing %d lumps 86770 string =PWAD doom patch PWAD data 8678>4 lelong x containing %d lumps 8679 8680 8681# Summary: Warcraft 3 save 8682# Extension: .w3g 8683# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 86840 string Warcraft\ III\ recorded\ game %s 8685 8686 8687# Summary: Warcraft 3 map 8688# Extension: .w3m 8689# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 86900 string HM3W Warcraft III map file 8691 8692 8693# Summary: SGF Smart Game Format 8694# Extension: .sgf 8695# Reference: http://www.red-bean.com/sgf/ 8696# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 8697# Modified by (1): Abel Cheung (regex, more game format) 8698# FIXME: Some games don't have GM (game type) 86990 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 8700>2 search/0x200 GM[ 8701>>&0 string 1] (Go) 8702>>&0 string 2] (Othello) 8703>>&0 string 3] (chess) 8704>>&0 string 4] (Gomoku+Renju) 8705>>&0 string 5] (Nine Men's Morris) 8706>>&0 string 6] (Backgammon) 8707>>&0 string 7] (Chinese chess) 8708>>&0 string 8] (Shogi) 8709>>&0 string 9] (Lines of Action) 8710>>&0 string 10] (Ataxx) 8711>>&0 string 11] (Hex) 8712>>&0 string 12] (Jungle) 8713>>&0 string 13] (Neutron) 8714>>&0 string 14] (Philosopher's Football) 8715>>&0 string 15] (Quadrature) 8716>>&0 string 16] (Trax) 8717>>&0 string 17] (Tantrix) 8718>>&0 string 18] (Amazons) 8719>>&0 string 19] (Octi) 8720>>&0 string 20] (Gess) 8721>>&0 string 21] (Twixt) 8722>>&0 string 22] (Zertz) 8723>>&0 string 23] (Plateau) 8724>>&0 string 24] (Yinsh) 8725>>&0 string 25] (Punct) 8726>>&0 string 26] (Gobblet) 8727>>&0 string 27] (hive) 8728>>&0 string 28] (Exxit) 8729>>&0 string 29] (Hnefatal) 8730>>&0 string 30] (Kuba) 8731>>&0 string 31] (Tripples) 8732>>&0 string 32] (Chase) 8733>>&0 string 33] (Tumbling Down) 8734>>&0 string 34] (Sahara) 8735>>&0 string 35] (Byte) 8736>>&0 string 36] (Focus) 8737>>&0 string 37] (Dvonn) 8738>>&0 string 38] (Tamsk) 8739>>&0 string 39] (Gipf) 8740>>&0 string 40] (Kropki) 8741 8742 8743# Summary: Civilization 4 video 8744# Extension: .bik 8745# Created by: Abel Cheung <abelcheung@gmail.com> 87460 string BIKi Civilization 4 Video 8747 8748 8749############################################## 8750# NetImmerse/Gamebryo game engine entries 8751 8752# Summary: Gamebryo game engine file 8753# Extension: .nif, .kf 8754# Created by: Abel Cheung <abelcheung@gmail.com> 87550 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 8756>&0 regex [0-9a-z.]+ \b, version %s 8757 8758# Summary: Gamebryo game engine file 8759# Extension: .kfm 8760# Created by: Abel Cheung <abelcheung@gmail.com> 87610 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 8762>&0 regex [0-9a-z.]+ \b, version %s 8763 8764# Summary: NetImmerse game engine file 8765# Extension .nif 8766# Created by: Abel Cheung <abelcheung@gmail.com> 87670 string NetImmerse\ File\ Format,\ Versio 8768>&0 string n\ NetImmerse game engine file 8769>>&0 regex [0-9a-z.]+ \b, version %s 8770 8771 8772#------------------------------------------------------------------------------ 8773# $File: gcc,v 1.4 2009/09/19 16:28:09 christos Exp $ 8774# gcc: file(1) magic for GCC special files 8775# 87760 string gpch GCC precompiled header 8777 8778# The version field is annoying. It's 3 characters, not zero-terminated. 8779>5 byte x (version %c 8780>6 byte x \b%c 8781>7 byte x \b%c) 8782 8783# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 8784>4 byte 67 for C 8785>4 byte 111 for Objective C 8786>4 byte 43 for C++ 8787>4 byte 79 for Objective C++ 8788 8789#------------------------------------------------------------------------------ 8790# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 8791# GEOS files (Vidar Madsen, vidar@gimp.org) 8792# semi-commonly used in embedded and handheld systems. 87930 belong 0xc745c153 GEOS 8794>40 byte 1 executable 8795>40 byte 2 VMFile 8796>40 byte 3 binary 8797>40 byte 4 directory label 8798>40 byte <1 unknown 8799>40 byte >4 unknown 8800>4 string >\0 \b, name "%s" 8801#>44 short x \b, version %d 8802#>46 short x \b.%d 8803#>48 short x \b, rev %d 8804#>50 short x \b.%d 8805#>52 short x \b, proto %d 8806#>54 short x \br%d 8807#>168 string >\0 \b, copyright "%s" 8808 8809#------------------------------------------------------------------------------ 8810# $File: gimp,v 1.6 2009/09/19 16:28:09 christos Exp $ 8811# GIMP Gradient: file(1) magic for the GIMP's gradient data files 8812# by Federico Mena <federico@nuclecu.unam.mx> 8813 88140 string GIMP\ Gradient GIMP gradient data 8815 8816#------------------------------------------------------------------------------ 8817# XCF: file(1) magic for the XCF image format used in the GIMP developed 8818# by Spencer Kimball and Peter Mattis 8819# ('Bucky' LaDieu, nega@vt.edu) 8820 88210 string gimp\ xcf GIMP XCF image data, 8822>9 string file version 0, 8823>9 string v version 8824>>10 string >\0 %s, 8825>14 belong x %lu x 8826>18 belong x %lu, 8827>22 belong 0 RGB Color 8828>22 belong 1 Greyscale 8829>22 belong 2 Indexed Color 8830>22 belong >2 Unknown Image Type. 8831 8832#------------------------------------------------------------------------------ 8833# XCF: file(1) magic for the patterns used in the GIMP, developed 8834# by Spencer Kimball and Peter Mattis 8835# ('Bucky' LaDieu, nega@vt.edu) 8836 883720 string GPAT GIMP pattern data, 8838>24 string x %s 8839 8840#------------------------------------------------------------------------------ 8841# XCF: file(1) magic for the brushes used in the GIMP, developed 8842# by Spencer Kimball and Peter Mattis 8843# ('Bucky' LaDieu, nega@vt.edu) 8844 884520 string GIMP GIMP brush data 8846 8847# GIMP Curves File 8848# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 88490 string #\040GIMP\040Curves\040File GIMP curve file 8850 8851#------------------------------------------------------------------------------ 8852# $File: gnome-keyring,v 1.2 2009/09/19 16:28:09 christos Exp $ 8853# GNOME keyring 8854# Contributed by Josh Triplett 8855# FIXME: Could be simplified if pstring supported two-byte counts 88560 string GnomeKeyring\n\r\0\n GNOME keyring 8857>&0 ubyte 0 \b, major version 0 8858>>&0 ubyte 0 \b, minor version 0 8859>>>&0 ubyte 0 \b, crypto type 0 (AEL) 8860>>>&0 ubyte >0 \b, crypto type %hhu (unknown) 8861>>>&1 ubyte 0 \b, hash type 0 (MD5) 8862>>>&1 ubyte >0 \b, hash type %hhu (unknown) 8863>>>&2 ubelong 0xFFFFFFFF \b, name NULL 8864>>>&2 ubelong !0xFFFFFFFF 8865>>>>&-4 ubelong >255 \b, name too long for file's pstring type 8866>>>>&-4 ubelong <256 8867>>>>>&-1 pstring x \b, name "%s" 8868>>>>>>&0 ubeqdate x \b, last modified %s 8869>>>>>>&8 ubeqdate x \b, created %s 8870>>>>>>&16 ubelong &1 8871>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 8872>>>>>>&16 ubelong ^1 \b, not locked if idle 8873>>>>>>&24 ubelong x \b, hash iterations %u 8874>>>>>>&28 ubequad x \b, salt %llu 8875>>>>>>&52 ubelong x \b, %u item(s) 8876 8877#------------------------------------------------------------------------------ 8878# $File: gnu,v 1.11 2009/09/19 16:28:09 christos Exp $ 8879# gnu: file(1) magic for various GNU tools 8880# 8881# GNU nlsutils message catalog file format 8882# 88830 string \336\22\4\225 GNU message catalog (little endian), 8884>4 lelong x revision %d, 8885>8 lelong x %d messages 88860 string \225\4\22\336 GNU message catalog (big endian), 8887>4 belong x revision %d, 8888>8 belong x %d messages 8889# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 88900 string *nazgul* Nazgul style compiled message catalog 8891>8 lelong >0 \b, version %ld 8892 8893# GnuPG 8894# The format is very similar to pgp 88950 string \001gpg GPG key trust database 8896>4 byte x version %d 8897# Note: magic.mime had 0x8501 for the next line instead of 0x8502 88980 beshort 0x8502 GPG encrypted data 8899!:mime text/PGP # encoding: data 8900 8901# This magic is not particularly good, as the keyrings don't have true 8902# magic. Nevertheless, it covers many keyrings. 89030 beshort 0x9901 GPG key public ring 8904!:mime application/x-gnupg-keyring 8905 8906# Gnumeric spreadsheet 8907# This entry is only semi-helpful, as Gnumeric compresses its files, so 8908# they will ordinarily reported as "compressed", but at least -z helps 890939 string =<gmr:Workbook Gnumeric spreadsheet 8910 8911# From: James Youngman <jay@gnu.org> 8912# gnu find magic 89130 string \0LOCATE GNU findutils locate database data 8914>7 string >\0 \b, format %s 8915>7 string 02 \b (frcode) 8916 8917# Files produced by GNU gettext 89180 long 0xDE120495 GNU-format message catalog data 89190 long 0x950412DE GNU-format message catalog data 8920 8921#------------------------------------------------------------------------------ 8922# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 8923# gnumeric: file(1) magic for Gnumeric spreadsheet 8924# This entry is only semi-helpful, as Gnumeric compresses its files, so 8925# they will ordinarily reported as "compressed", but at least -z helps 892639 string =<gmr:Workbook Gnumeric spreadsheet 8927!:mime application/x-gnumeric 8928 8929#------------------------------------------------------------------------------ 8930# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 8931# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 8932# 8933# ACE/gr binary 89340 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 8935>39 byte >0 - version %c 8936# ACE/gr ascii 89370 string #\ xvgr\ parameter\ file ACE/gr ascii file 89380 string #\ xmgr\ parameter\ file ACE/gr ascii file 89390 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 8940# Grace projects 89410 string #\ Grace\ project\ file Grace project file 8942>23 string @version\ (version 8943>>32 byte >0 %c 8944>>33 string >\0 \b.%.2s 8945>>35 string >\0 \b.%.2s) 8946# ACE/gr fit description files 89470 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 8948# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 8949 8950#------------------------------------------------------------------------------ 8951# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ 8952# graphviz: file(1) magic for http://www.graphviz.org/ 8953 8954# FIXME: These patterns match too generally. For example, the first 8955# line matches a LaTeX file containing the word "graph" (with a { 8956# following later) and the second line matches this file. 8957#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 8958#!:mime text/vnd.graphviz 8959#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 8960#!:mime text/vnd.graphviz 8961 8962#------------------------------------------------------------------------------ 8963# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $ 8964# gringotts: file(1) magic for Gringotts 8965# http://devel.pluto.linux.it/projects/Gringotts/ 8966# author: Germano Rizzo <mano@pluto.linux.it> 8967#GRG3????Y 89680 string GRG Gringotts data file 8969#file format 1 8970>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 8971#file format 2 8972>3 string 2 v.2, MCRYPT S2K, 8973>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 8974>>8 byte&0x70 0x10 SERPENT crypt, 8975>>8 byte&0x70 0x20 TWOFISH crypt, 8976>>8 byte&0x70 0x30 CAST-256 crypt, 8977>>8 byte&0x70 0x40 SAFER+ crypt, 8978>>8 byte&0x70 0x50 LOKI97 crypt, 8979>>8 byte&0x70 0x60 3DES crypt, 8980>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 8981>>8 byte&0x08 0x00 SHA1 hash, 8982>>8 byte&0x08 0x08 RIPEMD-160 hash, 8983>>8 byte&0x04 0x00 ZLib 8984>>8 byte&0x04 0x04 BZip2 8985>>8 byte&0x03 0x00 lvl.0 8986>>8 byte&0x03 0x01 lvl.3 8987>>8 byte&0x03 0x02 lvl.6 8988>>8 byte&0x03 0x03 lvl.9 8989#file format 3 8990>3 string 3 v.3, OpenPGP S2K, 8991>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 8992>>8 byte&0x70 0x10 SERPENT crypt, 8993>>8 byte&0x70 0x20 TWOFISH crypt, 8994>>8 byte&0x70 0x30 CAST-256 crypt, 8995>>8 byte&0x70 0x40 SAFER+ crypt, 8996>>8 byte&0x70 0x50 LOKI97 crypt, 8997>>8 byte&0x70 0x60 3DES crypt, 8998>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 8999>>8 byte&0x08 0x00 SHA1 hash, 9000>>8 byte&0x08 0x08 RIPEMD-160 hash, 9001>>8 byte&0x04 0x00 ZLib 9002>>8 byte&0x04 0x04 BZip2 9003>>8 byte&0x03 0x00 lvl.0 9004>>8 byte&0x03 0x01 lvl.3 9005>>8 byte&0x03 0x02 lvl.6 9006>>8 byte&0x03 0x03 lvl.9 9007#file format >3 9008>3 string >3 v.%.1s (unknown details) 9009 9010#------------------------------------------------------------------------------ 9011# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $ 9012# hitach-sh: file(1) magic for Hitachi Super-H 9013# 9014# Super-H COFF 9015# 90160 beshort 0x0500 Hitachi SH big-endian COFF 9017>18 beshort&0x0002 =0x0000 object 9018>18 beshort&0x0002 =0x0002 executable 9019>18 beshort&0x0008 =0x0008 \b, stripped 9020>18 beshort&0x0008 =0x0000 \b, not stripped 9021# 90220 leshort 0x0550 Hitachi SH little-endian COFF 9023>18 leshort&0x0002 =0x0000 object 9024>18 leshort&0x0002 =0x0002 executable 9025>18 leshort&0x0008 =0x0008 \b, stripped 9026>18 leshort&0x0008 =0x0000 \b, not stripped 9027 9028 9029#------------------------------------------------------------------------------ 9030# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ 9031# hp: file(1) magic for Hewlett Packard machines (see also "printer") 9032# 9033# XXX - somebody should figure out whether any byte order needs to be 9034# applied to the "TML" stuff; I'm assuming the Apollo stuff is 9035# big-endian as it was mostly 68K-based. 9036# 9037# I think the 500 series was the old stack-based machines, running a 9038# UNIX environment atop the "SUN kernel"; dunno whether it was 9039# big-endian or little-endian. 9040# 9041# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 9042# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 9043# HP magic is useful for reference, but using "long" magic is a better 9044# practice in order to avoid collisions. 9045# 9046# Guy Harris (guy@netapp.com): some additions to this list came from 9047# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 9048# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 9049# "/etc/magic", though, except for the "archive file relocatable library" 9050# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 9051# used in executables, or have they just not yet updated "/etc/magic" 9052# completely? 9053# 9054# 0 beshort 200 hp200 (68010) BSD binary 9055# 0 beshort 300 hp300 (68020+68881) BSD binary 9056# 0 beshort 0x20c hp200/300 HP-UX binary 9057# 0 beshort 0x20d hp400 (68030) HP-UX binary 9058# 0 beshort 0x20e hp400 (68040?) HP-UX binary 9059# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 9060# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 9061# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 9062# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 9063 9064# 9065# The "misc" stuff needs a byte order; the archives look suspiciously 9066# like the old 177545 archives (0xff65 = 0177545). 9067# 9068#### Old Apollo stuff 90690 beshort 0627 Apollo m68k COFF executable 9070>18 beshort ^040000 not stripped 9071>22 beshort >0 - version %ld 90720 beshort 0624 apollo a88k COFF executable 9073>18 beshort ^040000 not stripped 9074>22 beshort >0 - version %ld 90750 long 01203604016 TML 0123 byte-order format 90760 long 01702407010 TML 1032 byte-order format 90770 long 01003405017 TML 2301 byte-order format 90780 long 01602007412 TML 3210 byte-order format 9079#### PA-RISC 1.1 90800 belong 0x02100106 PA-RISC1.1 relocatable object 90810 belong 0x02100107 PA-RISC1.1 executable 9082>168 belong &0x00000004 dynamically linked 9083>(144) belong 0x054ef630 dynamically linked 9084>96 belong >0 - not stripped 9085 90860 belong 0x02100108 PA-RISC1.1 shared executable 9087>168 belong&0x4 0x4 dynamically linked 9088>(144) belong 0x054ef630 dynamically linked 9089>96 belong >0 - not stripped 9090 90910 belong 0x0210010b PA-RISC1.1 demand-load executable 9092>168 belong&0x4 0x4 dynamically linked 9093>(144) belong 0x054ef630 dynamically linked 9094>96 belong >0 - not stripped 9095 90960 belong 0x0210010e PA-RISC1.1 shared library 9097>96 belong >0 - not stripped 9098 90990 belong 0x0210010d PA-RISC1.1 dynamic load library 9100>96 belong >0 - not stripped 9101 9102#### PA-RISC 2.0 91030 belong 0x02140106 PA-RISC2.0 relocatable object 9104 91050 belong 0x02140107 PA-RISC2.0 executable 9106>168 belong &0x00000004 dynamically linked 9107>(144) belong 0x054ef630 dynamically linked 9108>96 belong >0 - not stripped 9109 91100 belong 0x02140108 PA-RISC2.0 shared executable 9111>168 belong &0x00000004 dynamically linked 9112>(144) belong 0x054ef630 dynamically linked 9113>96 belong >0 - not stripped 9114 91150 belong 0x0214010b PA-RISC2.0 demand-load executable 9116>168 belong &0x00000004 dynamically linked 9117>(144) belong 0x054ef630 dynamically linked 9118>96 belong >0 - not stripped 9119 91200 belong 0x0214010e PA-RISC2.0 shared library 9121>96 belong >0 - not stripped 9122 91230 belong 0x0214010d PA-RISC2.0 dynamic load library 9124>96 belong >0 - not stripped 9125 9126#### 800 91270 belong 0x020b0106 PA-RISC1.0 relocatable object 9128 91290 belong 0x020b0107 PA-RISC1.0 executable 9130>168 belong&0x4 0x4 dynamically linked 9131>(144) belong 0x054ef630 dynamically linked 9132>96 belong >0 - not stripped 9133 91340 belong 0x020b0108 PA-RISC1.0 shared executable 9135>168 belong&0x4 0x4 dynamically linked 9136>(144) belong 0x054ef630 dynamically linked 9137>96 belong >0 - not stripped 9138 91390 belong 0x020b010b PA-RISC1.0 demand-load executable 9140>168 belong&0x4 0x4 dynamically linked 9141>(144) belong 0x054ef630 dynamically linked 9142>96 belong >0 - not stripped 9143 91440 belong 0x020b010e PA-RISC1.0 shared library 9145>96 belong >0 - not stripped 9146 91470 belong 0x020b010d PA-RISC1.0 dynamic load library 9148>96 belong >0 - not stripped 9149 91500 belong 0x213c6172 archive file 9151>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 9152>68 belong 0x02100619 - PA-RISC1.1 relocatable library 9153>68 belong 0x02110619 - PA-RISC1.2 relocatable library 9154>68 belong 0x02140619 - PA-RISC2.0 relocatable library 9155 9156#### 500 91570 long 0x02080106 HP s500 relocatable executable 9158>16 long >0 - version %ld 9159 91600 long 0x02080107 HP s500 executable 9161>16 long >0 - version %ld 9162 91630 long 0x02080108 HP s500 pure executable 9164>16 long >0 - version %ld 9165 9166#### 200 91670 belong 0x020c0108 HP s200 pure executable 9168>4 beshort >0 - version %ld 9169>8 belong &0x80000000 save fp regs 9170>8 belong &0x40000000 dynamically linked 9171>8 belong &0x20000000 debuggable 9172>36 belong >0 not stripped 9173 91740 belong 0x020c0107 HP s200 executable 9175>4 beshort >0 - version %ld 9176>8 belong &0x80000000 save fp regs 9177>8 belong &0x40000000 dynamically linked 9178>8 belong &0x20000000 debuggable 9179>36 belong >0 not stripped 9180 91810 belong 0x020c010b HP s200 demand-load executable 9182>4 beshort >0 - version %ld 9183>8 belong &0x80000000 save fp regs 9184>8 belong &0x40000000 dynamically linked 9185>8 belong &0x20000000 debuggable 9186>36 belong >0 not stripped 9187 91880 belong 0x020c0106 HP s200 relocatable executable 9189>4 beshort >0 - version %ld 9190>6 beshort >0 - highwater %d 9191>8 belong &0x80000000 save fp regs 9192>8 belong &0x20000000 debuggable 9193>8 belong &0x10000000 PIC 9194 91950 belong 0x020a0108 HP s200 (2.x release) pure executable 9196>4 beshort >0 - version %ld 9197>36 belong >0 not stripped 9198 91990 belong 0x020a0107 HP s200 (2.x release) executable 9200>4 beshort >0 - version %ld 9201>36 belong >0 not stripped 9202 92030 belong 0x020c010e HP s200 shared library 9204>4 beshort >0 - version %ld 9205>6 beshort >0 - highwater %d 9206>36 belong >0 not stripped 9207 92080 belong 0x020c010d HP s200 dynamic load library 9209>4 beshort >0 - version %ld 9210>6 beshort >0 - highwater %d 9211>36 belong >0 not stripped 9212 9213#### MISC 92140 long 0x0000ff65 HP old archive 92150 long 0x020aff65 HP s200 old archive 92160 long 0x020cff65 HP s200 old archive 92170 long 0x0208ff65 HP s500 old archive 9218 92190 long 0x015821a6 HP core file 9220 92210 long 0x4da7eee8 HP-WINDOWS font 9222>8 byte >0 - version %ld 92230 string Bitmapfile HP Bitmapfile 9224 92250 string IMGfile CIS compimg HP Bitmapfile 9226# XXX - see "lif" 9227#0 short 0x8000 lif file 92280 long 0x020c010c compiled Lisp 9229 92300 string msgcat01 HP NLS message catalog, 9231>8 long >0 %d messages 9232 9233# Summary: HP-48/49 calculator 9234# Created by: phk@data.fls.dk 9235# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 9236# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 92370 string HPHP HP 9238>4 string 48 48 binary 9239>4 string 49 49 binary 9240>7 byte >64 - Rev %c 9241>8 leshort 0x2911 (ADR) 9242>8 leshort 0x2933 (REAL) 9243>8 leshort 0x2955 (LREAL) 9244>8 leshort 0x2977 (COMPLX) 9245>8 leshort 0x299d (LCOMPLX) 9246>8 leshort 0x29bf (CHAR) 9247>8 leshort 0x29e8 (ARRAY) 9248>8 leshort 0x2a0a (LNKARRAY) 9249>8 leshort 0x2a2c (STRING) 9250>8 leshort 0x2a4e (HXS) 9251>8 leshort 0x2a74 (LIST) 9252>8 leshort 0x2a96 (DIR) 9253>8 leshort 0x2ab8 (ALG) 9254>8 leshort 0x2ada (UNIT) 9255>8 leshort 0x2afc (TAGGED) 9256>8 leshort 0x2b1e (GROB) 9257>8 leshort 0x2b40 (LIB) 9258>8 leshort 0x2b62 (BACKUP) 9259>8 leshort 0x2b88 (LIBDATA) 9260>8 leshort 0x2d9d (PROG) 9261>8 leshort 0x2dcc (CODE) 9262>8 leshort 0x2e48 (GNAME) 9263>8 leshort 0x2e6d (LNAME) 9264>8 leshort 0x2e92 (XLIB) 9265 92660 string %%HP: HP text 9267>6 string T(0) - T(0) 9268>6 string T(1) - T(1) 9269>6 string T(2) - T(2) 9270>6 string T(3) - T(3) 9271>10 string A(D) A(D) 9272>10 string A(R) A(R) 9273>10 string A(G) A(G) 9274>14 string F(.) F(.); 9275>14 string F(,) F(,); 9276 9277 9278# Summary: HP-38/39 calculator 9279# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 92800 string HP3 9281>3 string 8 HP 38 9282>3 string 9 HP 39 9283>4 string Bin binary 9284>4 string Asc ASCII 9285>7 string A (Directory List) 9286>7 string B (Zaplet) 9287>7 string C (Note) 9288>7 string D (Program) 9289>7 string E (Variable) 9290>7 string F (List) 9291>7 string G (Matrix) 9292>7 string H (Library) 9293>7 string I (Target List) 9294>7 string J (ASCII Vector specification) 9295>7 string K (wildcard) 9296 9297# Summary: HP-38/39 calculator 9298# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 92990 string HP3 9300>3 string 8 HP 38 9301>3 string 9 HP 39 9302>4 string Bin binary 9303>4 string Asc ASCII 9304>7 string A (Directory List) 9305>7 string B (Zaplet) 9306>7 string C (Note) 9307>7 string D (Program) 9308>7 string E (Variable) 9309>7 string F (List) 9310>7 string G (Matrix) 9311>7 string H (Library) 9312>7 string I (Target List) 9313>7 string J (ASCII Vector specification) 9314>7 string K (wildcard) 9315 9316# hpBSD magic numbers 93170 beshort 200 hp200 (68010) BSD 9318>2 beshort 0407 impure binary 9319>2 beshort 0410 read-only binary 9320>2 beshort 0413 demand paged binary 93210 beshort 300 hp300 (68020+68881) BSD 9322>2 beshort 0407 impure binary 9323>2 beshort 0410 read-only binary 9324>2 beshort 0413 demand paged binary 9325# 9326# From David Gero <dgero@nortelnetworks.com> 9327# HP-UX 10.20 core file format from /usr/include/sys/core.h 9328# Unfortunately, HP-UX uses corehead blocks without specifying the order 9329# There are four we care about: 9330# CORE_KERNEL, which starts with the string "HP-UX" 9331# CORE_EXEC, which contains the name of the command 9332# CORE_PROC, which contains the signal number that caused the core dump 9333# CORE_FORMAT, which contains the version of the core file format (== 1) 9334# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 9335# but we include all 6 variations of the order of the first 3, and 9336# assume that PROC will always be last 9337# Order 1: KERNEL, EXEC, FORMAT, PROC 93380x10 string HP-UX 9339>0 belong 2 9340>>0xC belong 0x3C 9341>>>0x4C belong 0x100 9342>>>>0x58 belong 0x44 9343>>>>>0xA0 belong 1 9344>>>>>>0xAC belong 4 9345>>>>>>>0xB0 belong 1 9346>>>>>>>>0xB4 belong 4 core file 9347>>>>>>>>>0x90 string >\0 from '%s' 9348>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9349>>>>>>>>>0xC4 belong 4 - received SIGILL 9350>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9351>>>>>>>>>0xC4 belong 6 - received SIGABRT 9352>>>>>>>>>0xC4 belong 7 - received SIGEMT 9353>>>>>>>>>0xC4 belong 8 - received SIGFPE 9354>>>>>>>>>0xC4 belong 10 - received SIGBUS 9355>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9356>>>>>>>>>0xC4 belong 12 - received SIGSYS 9357>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9358>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9359# Order 2: KERNEL, FORMAT, EXEC, PROC 9360>>>0x4C belong 1 9361>>>>0x58 belong 4 9362>>>>>0x5C belong 1 9363>>>>>>0x60 belong 0x100 9364>>>>>>>0x6C belong 0x44 9365>>>>>>>>0xB4 belong 4 core file 9366>>>>>>>>>0xA4 string >\0 from '%s' 9367>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9368>>>>>>>>>0xC4 belong 4 - received SIGILL 9369>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9370>>>>>>>>>0xC4 belong 6 - received SIGABRT 9371>>>>>>>>>0xC4 belong 7 - received SIGEMT 9372>>>>>>>>>0xC4 belong 8 - received SIGFPE 9373>>>>>>>>>0xC4 belong 10 - received SIGBUS 9374>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9375>>>>>>>>>0xC4 belong 12 - received SIGSYS 9376>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9377>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9378# Order 3: FORMAT, KERNEL, EXEC, PROC 93790x24 string HP-UX 9380>0 belong 1 9381>>0xC belong 4 9382>>>0x10 belong 1 9383>>>>0x14 belong 2 9384>>>>>0x20 belong 0x3C 9385>>>>>>0x60 belong 0x100 9386>>>>>>>0x6C belong 0x44 9387>>>>>>>>0xB4 belong 4 core file 9388>>>>>>>>>0xA4 string >\0 from '%s' 9389>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9390>>>>>>>>>0xC4 belong 4 - received SIGILL 9391>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9392>>>>>>>>>0xC4 belong 6 - received SIGABRT 9393>>>>>>>>>0xC4 belong 7 - received SIGEMT 9394>>>>>>>>>0xC4 belong 8 - received SIGFPE 9395>>>>>>>>>0xC4 belong 10 - received SIGBUS 9396>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9397>>>>>>>>>0xC4 belong 12 - received SIGSYS 9398>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9399>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9400# Order 4: EXEC, KERNEL, FORMAT, PROC 94010x64 string HP-UX 9402>0 belong 0x100 9403>>0xC belong 0x44 9404>>>0x54 belong 2 9405>>>>0x60 belong 0x3C 9406>>>>>0xA0 belong 1 9407>>>>>>0xAC belong 4 9408>>>>>>>0xB0 belong 1 9409>>>>>>>>0xB4 belong 4 core file 9410>>>>>>>>>0x44 string >\0 from '%s' 9411>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9412>>>>>>>>>0xC4 belong 4 - received SIGILL 9413>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9414>>>>>>>>>0xC4 belong 6 - received SIGABRT 9415>>>>>>>>>0xC4 belong 7 - received SIGEMT 9416>>>>>>>>>0xC4 belong 8 - received SIGFPE 9417>>>>>>>>>0xC4 belong 10 - received SIGBUS 9418>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9419>>>>>>>>>0xC4 belong 12 - received SIGSYS 9420>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9421>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9422# Order 5: FORMAT, EXEC, KERNEL, PROC 94230x78 string HP-UX 9424>0 belong 1 9425>>0xC belong 4 9426>>>0x10 belong 1 9427>>>>0x14 belong 0x100 9428>>>>>0x20 belong 0x44 9429>>>>>>0x68 belong 2 9430>>>>>>>0x74 belong 0x3C 9431>>>>>>>>0xB4 belong 4 core file 9432>>>>>>>>>0x58 string >\0 from '%s' 9433>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9434>>>>>>>>>0xC4 belong 4 - received SIGILL 9435>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9436>>>>>>>>>0xC4 belong 6 - received SIGABRT 9437>>>>>>>>>0xC4 belong 7 - received SIGEMT 9438>>>>>>>>>0xC4 belong 8 - received SIGFPE 9439>>>>>>>>>0xC4 belong 10 - received SIGBUS 9440>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9441>>>>>>>>>0xC4 belong 12 - received SIGSYS 9442>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9443>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9444# Order 6: EXEC, FORMAT, KERNEL, PROC 9445>0 belong 0x100 9446>>0xC belong 0x44 9447>>>0x54 belong 1 9448>>>>0x60 belong 4 9449>>>>>0x64 belong 1 9450>>>>>>0x68 belong 2 9451>>>>>>>0x74 belong 0x2C 9452>>>>>>>>0xB4 belong 4 core file 9453>>>>>>>>>0x44 string >\0 from '%s' 9454>>>>>>>>>0xC4 belong 3 - received SIGQUIT 9455>>>>>>>>>0xC4 belong 4 - received SIGILL 9456>>>>>>>>>0xC4 belong 5 - received SIGTRAP 9457>>>>>>>>>0xC4 belong 6 - received SIGABRT 9458>>>>>>>>>0xC4 belong 7 - received SIGEMT 9459>>>>>>>>>0xC4 belong 8 - received SIGFPE 9460>>>>>>>>>0xC4 belong 10 - received SIGBUS 9461>>>>>>>>>0xC4 belong 11 - received SIGSEGV 9462>>>>>>>>>0xC4 belong 12 - received SIGSYS 9463>>>>>>>>>0xC4 belong 33 - received SIGXCPU 9464>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 9465 9466 9467 9468#------------------------------------------------------------------------------ 9469# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 9470# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 9471# Magic too short! 9472#0 string HU Human68k 9473#>68 string LZX LZX compressed 9474#>>72 string >\0 (version %s) 9475#>(8.L+74) string LZX LZX compressed 9476#>>(8.L+78) string >\0 (version %s) 9477#>60 belong >0 binded 9478#>(8.L+66) string #HUPAIR hupair 9479#>0 string HU X executable 9480#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 9481#>4 belong >0 - base address 0x%x 9482#>28 belong >0 not stripped 9483#>32 belong >0 with debug information 9484#0 beshort 0x601a Human68k Z executable 9485#0 beshort 0x6000 Human68k object file 9486#0 belong 0xd1000000 Human68k ar binary archive 9487#0 belong 0xd1010000 Human68k ar ascii archive 9488#0 beshort 0x0068 Human68k lib archive 9489#4 string LZX Human68k LZX compressed 9490#>8 string >\0 (version %s) 9491#>4 string LZX R executable 9492#2 string #HUPAIR Human68k hupair R executable 9493 9494#------------------------------------------------------------------------------ 9495# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ 9496# ibm370: file(1) magic for IBM 370 and compatibles. 9497# 9498# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 9499# What the heck *is* "USS/370"? 9500# AIX 4.1's "/etc/magic" has 9501# 9502# 0 short 0535 370 sysV executable 9503# >12 long >0 not stripped 9504# >22 short >0 - version %d 9505# >30 long >0 - 5.2 format 9506# 0 short 0530 370 sysV pure executable 9507# >12 long >0 not stripped 9508# >22 short >0 - version %d 9509# >30 long >0 - 5.2 format 9510# 9511# instead of the "USS/370" versions of the same magic numbers. 9512# 95130 beshort 0537 370 XA sysV executable 9514>12 belong >0 not stripped 9515>22 beshort >0 - version %d 9516>30 belong >0 - 5.2 format 95170 beshort 0532 370 XA sysV pure executable 9518>12 belong >0 not stripped 9519>22 beshort >0 - version %d 9520>30 belong >0 - 5.2 format 95210 beshort 054001 370 sysV pure executable 9522>12 belong >0 not stripped 95230 beshort 055001 370 XA sysV pure executable 9524>12 belong >0 not stripped 95250 beshort 056401 370 sysV executable 9526>12 belong >0 not stripped 95270 beshort 057401 370 XA sysV executable 9528>12 belong >0 not stripped 95290 beshort 0531 SVR2 executable (Amdahl-UTS) 9530>12 belong >0 not stripped 9531>24 belong >0 - version %ld 95320 beshort 0534 SVR2 pure executable (Amdahl-UTS) 9533>12 belong >0 not stripped 9534>24 belong >0 - version %ld 95350 beshort 0530 SVR2 pure executable (USS/370) 9536>12 belong >0 not stripped 9537>24 belong >0 - version %ld 95380 beshort 0535 SVR2 executable (USS/370) 9539>12 belong >0 not stripped 9540>24 belong >0 - version %ld 9541 9542#------------------------------------------------------------------------------ 9543# $File: ibm6000,v 1.9 2009/09/19 16:28:09 christos Exp $ 9544# ibm6000: file(1) magic for RS/6000 and the RT PC. 9545# 95460 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 9547>12 belong >0 not stripped 9548# Breaks sun4 statically linked execs. 9549#0 beshort 0x0103 executable (RT Version 2) or obj module 9550#>2 byte 0x50 pure 9551#>28 belong >0 not stripped 9552#>6 beshort >0 - version %ld 95530 beshort 0x0104 shared library 95540 beshort 0x0105 ctab data 95550 beshort 0xfe04 structured file 95560 string 0xabcdef AIX message catalog 95570 belong 0x000001f9 AIX compiled message catalog 95580 string \<aiaff> archive 95590 string \<bigaf> archive (big format) 9560 9561 9562#------------------------------------------------------------------------------ 9563# $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $ 9564# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 9565# 9566# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 9567# Arts for file interchange. It has also been used by Apple, SGI, and 9568# especially Commodore-Amiga. 9569# 9570# IFF files begin with an 8 byte FORM header, followed by a 4 character 9571# FORM type, which is followed by the first chunk in the FORM. 9572 95730 string FORM IFF data 9574#>4 belong x \b, FORM is %d bytes long 9575# audio formats 9576>8 string AIFF \b, AIFF audio 9577!:mime audio/x-aiff 9578>8 string AIFC \b, AIFF-C compressed audio 9579!:mime audio/x-aiff 9580>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 9581!:mime audio/x-aiff 9582>8 string 16SV \b, 16SV 16-bit sampled sound voice 9583>8 string SAMP \b, SAMP sampled audio 9584>8 string MAUD \b, MAUD MacroSystem audio 9585>8 string SMUS \b, SMUS simple music 9586>8 string CMUS \b, CMUS complex music 9587# image formats 9588>8 string ILBMBMHD \b, ILBM interleaved image 9589>>20 beshort x \b, %d x 9590>>22 beshort x %d 9591>8 string RGBN \b, RGBN 12-bit RGB image 9592>8 string RGB8 \b, RGB8 24-bit RGB image 9593>8 string DEEP \b, DEEP TVPaint/XiPaint image 9594>8 string DR2D \b, DR2D 2-D object 9595>8 string TDDD \b, TDDD 3-D rendering 9596>8 string LWOB \b, LWOB 3-D object 9597>8 string LWO2 \b, LWO2 3-D object, v2 9598>8 string LWLO \b, LWLO 3-D layered object 9599>8 string REAL \b, REAL Real3D rendering 9600>8 string MC4D \b, MC4D MaxonCinema4D rendering 9601>8 string ANIM \b, ANIM animation 9602>8 string YAFA \b, YAFA animation 9603>8 string SSA\ \b, SSA super smooth animation 9604>8 string ACBM \b, ACBM continuous image 9605>8 string FAXX \b, FAXX fax image 9606# other formats 9607>8 string FTXT \b, FTXT formatted text 9608>8 string CTLG \b, CTLG message catalog 9609>8 string PREF \b, PREF preferences 9610>8 string DTYP \b, DTYP datatype description 9611>8 string PTCH \b, PTCH binary patch 9612>8 string AMFF \b, AMFF AmigaMetaFile format 9613>8 string WZRD \b, WZRD StormWIZARD resource 9614>8 string DOC\ \b, DOC desktop publishing document 9615 9616# These go at the end of the iff rules 9617# 9618# I don't see why these might collide with anything else. 9619# 9620# Interactive Fiction related formats 9621# 9622>8 string IFRS \b, Blorb Interactive Fiction 9623>>24 string Exec with executable chunk 9624>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 9625 9626#------------------------------------------------------------------------------ 9627# $File: images,v 1.64 2009/12/06 00:38:50 christos Exp $ 9628# images: file(1) magic for image formats (see also "iff", and "c-lang" for 9629# XPM bitmaps) 9630# 9631# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 9632# additions by janl@ifi.uio.no as well as others. Jan also suggested 9633# merging several one- and two-line files into here. 9634# 9635# little magic: PCX (first byte is 0x0a) 9636 9637# Targa - matches `povray', `ppmtotga' and `xv' outputs 9638# by Philippe De Muyter <phdm@macqel.be> 9639# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 9640# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 9641# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 9642# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 9643# `tgatoppm' recognizes a superset (Index may be anything) 96441 belong&0xfff7ffff 0x01010000 Targa image data - Map 9645>2 byte&8 8 - RLE 9646>12 leshort >0 %hd x 9647>14 leshort >0 %hd 96481 belong&0xfff7ffff 0x00020000 Targa image data - RGB 9649>2 byte&8 8 - RLE 9650>12 leshort >0 %hd x 9651>14 leshort >0 %hd 96521 belong&0xfff7ffff 0x00030000 Targa image data - Mono 9653>2 byte&8 8 - RLE 9654>12 leshort >0 %hd x 9655>14 leshort >0 %hd 9656 9657# PBMPLUS images 9658# The next byte following the magic is always whitespace. 9659# strength is changed to try these patterns before "x86 boot sector" 96600 search/1 P1 9661>3 regex =[0-9]*\ [0-9]* Netpbm PBM image text 9662>3 regex =[0-9]+\ \b, size = %sx 9663>>3 regex =\ [0-9]+ \b%s 9664!:strength + 45 9665!:mime image/x-portable-bitmap 96660 search/1 P2 9667>3 regex =[0-9]*\ [0-9]* Netpbm PGM image text 9668>3 regex =[0-9]+\ \b, size = %sx 9669>>3 regex =\ [0-9]+ \b%s 9670!:strength + 45 9671!:mime image/x-portable-greymap 96720 search/1 P3 9673>3 regex =[0-9]*\ [0-9]* Netpbm PPM image text 9674>3 regex =[0-9]+\ \b, size = %sx 9675>>3 regex =\ [0-9]+ \b%s 9676!:strength + 45 9677!:mime image/x-portable-pixmap 96780 string P4 9679>3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data 9680>3 regex =[0-9]+\ \b, size = %sx 9681>>3 regex =\ [0-9]+ \b%s 9682!:strength + 45 9683!:mime image/x-portable-bitmap 96840 string P5 9685>3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data 9686>3 regex =[0-9]+\ \b, size = %sx 9687>>3 regex =\ [0-9]+ \b%s 9688!:strength + 45 9689!:mime image/x-portable-greymap 96900 string P6 9691>3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data 9692>3 regex =[0-9]+\ \b, size = %sx 9693>>3 regex =\ [0-9]+ \b%s 9694!:strength + 45 9695!:mime image/x-portable-pixmap 96960 string P7 Netpbm PAM image file 9697!:mime image/x-portable-pixmap 9698 9699# From: bryanh@giraffe-data.com (Bryan Henderson) 97000 string \117\072 Solitaire Image Recorder format 9701>4 string \013 MGI Type 11 9702>4 string \021 MGI Type 17 97030 string .MDA MicroDesign data 9704>21 byte 48 version 2 9705>21 byte 51 version 3 97060 string .MDP MicroDesign page data 9707>21 byte 48 version 2 9708>21 byte 51 version 3 9709 9710# NIFF (Navy Interchange File Format, a modification of TIFF) images 9711# [GRR: this *must* go before TIFF] 97120 string IIN1 NIFF image data 9713!:mime image/x-niff 9714 9715# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 9716# The second word of TIFF files is the TIFF version number, 42, which has 9717# never changed. The TIFF specification recommends testing for it. 97180 string MM\x00\x2a TIFF image data, big-endian 9719!:mime image/tiff 97200 string II\x2a\x00 TIFF image data, little-endian 9721!:mime image/tiff 9722 9723# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 9724# (Greg Roelofs, newt@uchicago.edu) 9725# (Albert Cahalan, acahalan@cs.uml.edu) 9726# 9727# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 9728# 97290 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 9730!:mime image/png 9731>16 belong x \b, %ld x 9732>20 belong x %ld, 9733>24 byte x %d-bit 9734>25 byte 0 grayscale, 9735>25 byte 2 \b/color RGB, 9736>25 byte 3 colormap, 9737>25 byte 4 gray+alpha, 9738>25 byte 6 \b/color RGBA, 9739#>26 byte 0 deflate/32K, 9740>28 byte 0 non-interlaced 9741>28 byte 1 interlaced 9742 9743# possible GIF replacements; none yet released! 9744# (Greg Roelofs, newt@uchicago.edu) 9745# 9746# GRR 950115: this was mine ("Zip GIF"): 97470 string GIF94z ZIF image (GIF+deflate alpha) 9748!:mime image/x-unknown 9749# 9750# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 9751# 97520 string FGF95a FGF image (GIF+deflate beta) 9753!:mime image/x-unknown 9754# 9755# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 9756# (best; not yet implemented): 9757# 97580 string PBF PBF image (deflate compression) 9759!:mime image/x-unknown 9760 9761# GIF 97620 string GIF8 GIF image data 9763!:mime image/gif 9764!:apple 8BIMGIFf 9765>4 string 7a \b, version 8%s, 9766>4 string 9a \b, version 8%s, 9767>6 leshort >0 %hd x 9768>8 leshort >0 %hd 9769#>10 byte &0x80 color mapped, 9770#>10 byte&0x07 =0x00 2 colors 9771#>10 byte&0x07 =0x01 4 colors 9772#>10 byte&0x07 =0x02 8 colors 9773#>10 byte&0x07 =0x03 16 colors 9774#>10 byte&0x07 =0x04 32 colors 9775#>10 byte&0x07 =0x05 64 colors 9776#>10 byte&0x07 =0x06 128 colors 9777#>10 byte&0x07 =0x07 256 colors 9778 9779# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 9780# 1 plane, no encoding. 97810 string \361\0\100\273 CMU window manager raster image data 9782>4 lelong >0 %d x 9783>8 lelong >0 %d, 9784>12 lelong >0 %d-bit 9785 9786# Magick Image File Format 97870 string id=ImageMagick MIFF image data 9788 9789# Artisan 97900 long 1123028772 Artisan image data 9791>4 long 1 \b, rectangular 24-bit 9792>4 long 2 \b, rectangular 8-bit with colormap 9793>4 long 3 \b, rectangular 32-bit (24-bit with matte) 9794 9795# FIG (Facility for Interactive Generation of figures), an object-based format 97960 search/1 #FIG FIG image text 9797>5 string x \b, version %.3s 9798 9799# PHIGS 98000 string ARF_BEGARF PHIGS clear text archive 98010 string @(#)SunPHIGS SunPHIGS 9802# version number follows, in the form m.n 9803>40 string SunBin binary 9804>32 string archive archive 9805 9806# GKS (Graphics Kernel System) 98070 string GKSM GKS Metafile 9808>24 string SunGKS \b, SunGKS 9809 9810# CGM image files 98110 string BEGMF clear text Computer Graphics Metafile 9812 9813# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 98140 string yz MGR bitmap, modern format, 8-bit aligned 98150 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 98160 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 98170 string yx MGR bitmap, modern format, squeezed 9818 9819# Fuzzy Bitmap (FBM) images 98200 string %bitmap\0 FBM image data 9821>30 long 0x31 \b, mono 9822>30 long 0x33 \b, color 9823 9824# facsimile data 98251 string PC\ Research,\ Inc group 3 fax data 9826>29 byte 0 \b, normal resolution (204x98 DPI) 9827>29 byte 1 \b, fine resolution (204x196 DPI) 9828# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 98290 string Sfff structured fax file 9830 9831 9832# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 98330 string BM 9834>14 leshort 12 PC bitmap, OS/2 1.x format 9835!:mime image/x-ms-bmp 9836>>18 leshort x \b, %d x 9837>>20 leshort x %d 9838>14 leshort 64 PC bitmap, OS/2 2.x format 9839!:mime image/x-ms-bmp 9840>>18 leshort x \b, %d x 9841>>20 leshort x %d 9842>14 leshort 40 PC bitmap, Windows 3.x format 9843!:mime image/x-ms-bmp 9844>>18 lelong x \b, %d x 9845>>22 lelong x %d x 9846>>28 leshort x %d 9847>14 leshort 128 PC bitmap, Windows NT/2000 format 9848!:mime image/x-ms-bmp 9849>>18 lelong x \b, %d x 9850>>22 lelong x %d x 9851>>28 leshort x %d 9852# Too simple - MPi 9853#0 string IC PC icon data 9854#0 string PI PC pointer image data 9855#0 string CI PC color icon data 9856#0 string CP PC color pointer image data 9857# Conflicts with other entries [BABYL] 9858#0 string BA PC bitmap array data 9859 9860# XPM icons (Greg Roelofs, newt@uchicago.edu) 9861# note possible collision with C/REXX entry in c-lang; currently commented out 98620 search/1 /*\ XPM\ */ X pixmap image text 9863 9864# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 98650 leshort 0xcc52 RLE image data, 9866>6 leshort x %d x 9867>8 leshort x %d 9868>2 leshort >0 \b, lower left corner: %d 9869>4 leshort >0 \b, lower right corner: %d 9870>10 byte&0x1 =0x1 \b, clear first 9871>10 byte&0x2 =0x2 \b, no background 9872>10 byte&0x4 =0x4 \b, alpha channel 9873>10 byte&0x8 =0x8 \b, comment 9874>11 byte >0 \b, %d color channels 9875>12 byte >0 \b, %d bits per pixel 9876>13 byte >0 \b, %d color map channels 9877 9878# image file format (Robert Potter, potter@cs.rochester.edu) 98790 string Imagefile\ version- iff image data 9880# this adds the whole header (inc. version number), informative but longish 9881>10 string >\0 %s 9882 9883# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 98840 belong 0x59a66a95 Sun raster image data 9885>4 belong >0 \b, %d x 9886>8 belong >0 %d, 9887>12 belong >0 %d-bit, 9888#>16 belong >0 %d bytes long, 9889>20 belong 0 old format, 9890#>20 belong 1 standard, 9891>20 belong 2 compressed, 9892>20 belong 3 RGB, 9893>20 belong 4 TIFF, 9894>20 belong 5 IFF, 9895>20 belong 0xffff reserved for testing, 9896>24 belong 0 no colormap 9897>24 belong 1 RGB colormap 9898>24 belong 2 raw colormap 9899#>28 belong >0 colormap is %d bytes long 9900 9901# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 9902# 9903# See 9904# http://reality.sgi.com/grafica/sgiimage.html 9905# 99060 beshort 474 SGI image data 9907#>2 byte 0 \b, verbatim 9908>2 byte 1 \b, RLE 9909#>3 byte 1 \b, normal precision 9910>3 byte 2 \b, high precision 9911>4 beshort x \b, %d-D 9912>6 beshort x \b, %d x 9913>8 beshort x %d 9914>10 beshort x \b, %d channel 9915>10 beshort !1 \bs 9916>80 string >0 \b, "%s" 9917 99180 string IT01 FIT image data 9919>4 belong x \b, %d x 9920>8 belong x %d x 9921>12 belong x %d 9922# 99230 string IT02 FIT image data 9924>4 belong x \b, %d x 9925>8 belong x %d x 9926>12 belong x %d 9927# 99282048 string PCD_IPI Kodak Photo CD image pack file 9929>0xe02 byte&0x03 0x00 , landscape mode 9930>0xe02 byte&0x03 0x01 , portrait mode 9931>0xe02 byte&0x03 0x02 , landscape mode 9932>0xe02 byte&0x03 0x03 , portrait mode 99330 string PCD_OPA Kodak Photo CD overview pack file 9934 9935# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 9936# FITS is the Flexible Image Transport System, the de facto standard for 9937# data and image transfer, storage, etc., for the astronomical community. 9938# (FITS floating point formats are big-endian.) 99390 string SIMPLE\ \ = FITS image data 9940>109 string 8 \b, 8-bit, character or unsigned binary integer 9941>108 string 16 \b, 16-bit, two's complement binary integer 9942>107 string \ 32 \b, 32-bit, two's complement binary integer 9943>107 string -32 \b, 32-bit, floating point, single precision 9944>107 string -64 \b, 64-bit, floating point, double precision 9945 9946# other images 99470 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 9948 9949# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 9950# stuff. 9951# 99520 beshort 0x1010 PEX Binary Archive 9953 9954# DICOM medical imaging data 9955128 string DICM DICOM medical imaging data 9956!:mime application/dicom 9957 9958# XWD - X Window Dump file. 9959# As described in /usr/X11R6/include/X11/XWDFile.h 9960# used by the xwd program. 9961# Bradford Castalia, idaeim, 1/01 99624 belong 7 XWD X Window Dump image data 9963>100 string >\0 \b, "%s" 9964>16 belong x \b, %dx 9965>20 belong x \b%dx 9966>12 belong x \b%d 9967 9968# PDS - Planetary Data System 9969# These files use Parameter Value Language in the header section. 9970# Unfortunately, there is no certain magic, but the following 9971# strings have been found to be most likely. 99720 string NJPL1I00 PDS (JPL) image data 99732 string NJPL1I PDS (JPL) image data 99740 string CCSD3ZF PDS (CCSD) image data 99752 string CCSD3Z PDS (CCSD) image data 99760 string PDS_ PDS image data 99770 string LBLSIZE= PDS (VICAR) image data 9978 9979# pM8x: ATARI STAD compressed bitmap format 9980# 9981# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 9982# p M 8 5/6 xx yy zz data... 9983# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 9984# bytes either run horizontally (pM85) or vertically (pM86). yy is the 9985# most frequent byte, xx and zz are runlength escape codes, where xx is 9986# used for runs of yy. 9987# 99880 string pM85 Atari ST STAD bitmap image data (hor) 9989>5 byte 0x00 (white background) 9990>5 byte 0xFF (black background) 99910 string pM86 Atari ST STAD bitmap image data (vert) 9992>5 byte 0x00 (white background) 9993>5 byte 0xFF (black background) 9994 9995# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 9996# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 99970 leshort 0x0296 Atari ATR image 9998 9999# XXX: 10000# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 10001# magic. 10002# SGI RICE image file <mpruett@sgi.com> 10003#0 beshort 0x5249 RICE image 10004#>2 beshort x v%d 10005#>4 beshort x (%d x 10006#>6 beshort x %d) 10007#>8 beshort 0 8 bit 10008#>8 beshort 1 10 bit 10009#>8 beshort 2 12 bit 10010#>8 beshort 3 13 bit 10011#>10 beshort 0 4:2:2 10012#>10 beshort 1 4:2:2:4 10013#>10 beshort 2 4:4:4 10014#>10 beshort 3 4:4:4:4 10015#>12 beshort 1 RGB 10016#>12 beshort 2 CCIR601 10017#>12 beshort 3 RP175 10018#>12 beshort 4 YUV 10019 10020#------------------------------------------------------------------------------ 10021# 10022# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format 10023# for the EPOC operating system, which is used with PDAs like those from Psion 10024# 10025# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description 10026# of various EPOC file formats 10027 100280 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file 10029 10030# PCX image files 10031# From: Dan Fandrich <dan@coneharvesters.com> 100320 beshort 0x0a00 PCX ver. 2.5 image data 100330 beshort 0x0a02 PCX ver. 2.8 image data, with palette 100340 beshort 0x0a03 PCX ver. 2.8 image data, without palette 100350 beshort 0x0a04 PCX for Windows image data 100360 beshort 0x0a05 PCX ver. 3.0 image data 10037>4 leshort x bounding box [%hd, 10038>6 leshort x %hd] - 10039>8 leshort x [%hd, 10040>10 leshort x %hd], 10041>65 byte >1 %d planes each of 10042>3 byte x %hhd-bit 10043>68 byte 0 image, 10044>68 byte 1 colour, 10045>68 byte 2 grayscale, 10046>68 byte >2 image, 10047>68 byte <0 image, 10048>12 leshort >0 %hd x 10049>>14 leshort x %hd dpi, 10050>2 byte 0 uncompressed 10051>2 byte 1 RLE compressed 10052 10053# Adobe Photoshop 10054# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 100550 string 8BPS Adobe Photoshop Image 10056!:mime image/vnd.adobe.photoshop 10057>4 beshort 2 (PSB) 10058>18 belong x \b, %d x 10059>14 belong x %d, 10060>24 beshort 0 bitmap 10061>24 beshort 1 grayscale 10062>>12 beshort 2 with alpha 10063>24 beshort 2 indexed 10064>24 beshort 3 RGB 10065>>12 beshort 4 \bA 10066>24 beshort 4 CMYK 10067>>12 beshort 5 \bA 10068>24 beshort 7 multichannel 10069>24 beshort 8 duotone 10070>24 beshort 9 lab 10071>12 beshort > 1 10072>>12 beshort x \b, %dx 10073>12 beshort 1 \b, 10074>22 beshort x %d-bit channel 10075>12 beshort > 1 \bs 10076 10077# XV thumbnail indicator (ThMO) 100780 string P7\ 332 XV thumbnail image data 10079 10080# NITF is defined by United States MIL-STD-2500A 100810 string NITF National Imagery Transmission Format 10082>25 string >\0 dated %.14s 10083 10084# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 100850 belong 0x00010008 GEM Image data 10086>12 beshort x %d x 10087>14 beshort x %d, 10088>4 beshort x %d planes, 10089>8 beshort x %d x 10090>10 beshort x %d pixelsize 10091 10092# GEM Metafile (Wolfram Kleff) 100930 lelong 0x0018FFFF GEM Metafile data 10094>4 leshort x version %d 10095 10096# 10097# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 10098# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 10099# 101000 string \0\nSMJPEG SMJPEG 10101>8 belong x %d.x data 10102# According to the specification you could find any number of _TXT 10103# headers here, but I can't think of any way of handling that. None of 10104# the SMJPEG files I tried it on used this feature. Even if such a 10105# file is encountered the output should still be reasonable. 10106>16 string _SND \b, 10107>>24 beshort >0 %d Hz 10108>>26 byte 8 8-bit 10109>>26 byte 16 16-bit 10110>>28 string NONE uncompressed 10111# >>28 string APCM ADPCM compressed 10112>>27 byte 1 mono 10113>>28 byte 2 stereo 10114# Help! Isn't there any way to avoid writing this part twice? 10115>>32 string _VID \b, 10116# >>>48 string JFIF JPEG 10117>>>40 belong >0 %d frames 10118>>>44 beshort >0 (%d x 10119>>>46 beshort >0 %d) 10120>16 string _VID \b, 10121# >>32 string JFIF JPEG 10122>>24 belong >0 %d frames 10123>>28 beshort >0 (%d x 10124>>30 beshort >0 %d) 10125 101260 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 10127 10128# "thumbnail file" (icon) 10129# descended from "xv", but in use by other applications as well (Wolfram Kleff) 101300 string P7\ 332 XV "thumbnail file" (icon) data 10131 10132# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 101330 string KiSS KISS/GS 10134>4 byte 16 color 10135>>5 byte x %d bit 10136>>8 leshort x %d colors 10137>>10 leshort x %d groups 10138>4 byte 32 cell 10139>>5 byte x %d bit 10140>>8 leshort x %d x 10141>>10 leshort x %d 10142>>12 leshort x +%d 10143>>14 leshort x +%d 10144 10145# Webshots (www.webshots.com), by John Harrison 101460 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 10147 10148# Hercules DASD image files 10149# From Jan Jaeger <jj@septa.nl> 101500 string CKD_P370 Hercules CKD DASD image file 10151>8 long x \b, %d heads per cylinder 10152>12 long x \b, track size %d bytes 10153>16 byte x \b, device type 33%2.2X 10154 101550 string CKD_C370 Hercules compressed CKD DASD image file 10156>8 long x \b, %d heads per cylinder 10157>12 long x \b, track size %d bytes 10158>16 byte x \b, device type 33%2.2X 10159 101600 string CKD_S370 Hercules CKD DASD shadow file 10161>8 long x \b, %d heads per cylinder 10162>12 long x \b, track size %d bytes 10163>16 byte x \b, device type 33%2.2X 10164 10165# Squeak images and programs - etoffi@softhome.net 101660 string \146\031\0\0 Squeak image data 101670 search/1 'From\040Squeak Squeak program text 10168 10169# partimage: file(1) magic for PartImage files (experimental, incomplete) 10170# Author: Hans-Joachim Baader <hjb@pro-linux.de> 101710 string PaRtImAgE-VoLuMe PartImage 10172>0x0020 string 0.6.1 file version %s 10173>>0x0060 lelong >-1 volume %ld 10174#>>0x0064 8 byte identifier 10175#>>0x007c reserved 10176>>0x0200 string >\0 type %s 10177>>0x1400 string >\0 device %s, 10178>>0x1600 string >\0 original filename %s, 10179# Some fields omitted 10180>>0x2744 lelong 0 not compressed 10181>>0x2744 lelong 1 gzip compressed 10182>>0x2744 lelong 2 bzip2 compressed 10183>>0x2744 lelong >2 compressed with unknown algorithm 10184>0x0020 string >0.6.1 file version %s 10185>0x0020 string <0.6.1 file version %s 10186 10187# DCX is multi-page PCX, using a simple header of up to 1024 10188# offsets for the respective PCX components. 10189# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 101900 lelong 987654321 DCX multi-page PCX image data 10191 10192# Simon Walton <simonw@matteworld.com> 10193# Kodak Cineon format for scanned negatives 10194# http://www.kodak.com/US/en/motion/support/dlad/ 101950 lelong 0xd75f2a80 Cineon image data 10196>200 belong >0 \b, %ld x 10197>204 belong >0 %ld 10198 10199 10200# Bio-Rad .PIC is an image format used by microscope control systems 10201# and related image processing software used by biologists. 10202# From: Vebjorn Ljosa <vebjorn@ljosa.com> 10203# BOOL values are two-byte integers; use them to rule out false positives. 10204# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 10205# Samples: http://www.loci.wisc.edu/software/sample-data 1020614 leshort <2 10207>62 leshort <2 10208>>54 leshort 12345 Bio-Rad .PIC Image File 10209>>>0 leshort >0 %hd x 10210>>>2 leshort >0 %hd, 10211>>>4 leshort =1 1 image in file 10212>>>4 leshort >1 %hd images in file 10213 10214# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 10215# The description of *.mrw format can be found at 10216# http://www.dalibor.cz/minolta/raw_file_format.htm 102170 string \000MRM Minolta Dimage camera raw image data 10218 10219# Summary: DjVu image / document 10220# Extension: .djvu 10221# Reference: http://djvu.org/docs/DjVu3Spec.djvu 10222# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 10223# Modified by (1): Abel Cheung <abelcheung@gmail.com> 102240 string AT&TFORM 10225>12 string DJVM DjVu multiple page document 10226!:mime image/vnd.djvu 10227>12 string DJVU DjVu image or single page document 10228!:mime image/vnd.djvu 10229>12 string DJVI DjVu shared document 10230!:mime image/vnd.djvu 10231>12 string THUM DjVu page thumbnails 10232!:mime image/vnd.djvu 10233 10234 10235# From Marc Espie 102360 lelong 20000630 OpenEXR image data 10237 10238# From: Tom Hilinski <tom.hilinski@comcast.net> 10239# http://www.unidata.ucar.edu/packages/netcdf/ 102400 string CDF\001 NetCDF Data Format data 10241 10242#----------------------------------------------------------------------- 10243# Hierarchical Data Format, used to facilitate scientific data exchange 10244# specifications at http://hdf.ncsa.uiuc.edu/ 102450 belong 0x0e031301 Hierarchical Data Format (version 4) data 10246!:mime application/x-hdf 102470 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data 10248!:mime application/x-hdf 10249 10250# From: Tobias Burnus <burnus@net-b.de> 10251# Xara (for a while: Corel Xara) is a graphic package, see 10252# http://www.xara.com/ for Windows and as GPL application for Linux 102530 string XARA\243\243 Xara graphics file 10254 10255# http://www.cartesianinc.com/Tech/ 102560 string CPC\262 Cartesian Perceptual Compression image 10257!:mime image/x-cpi 10258 10259# From Albert Cahalan <acahalan@gmail.com> 10260# puredigital used it for the CVS disposable camcorder 10261#8 lelong 4 ZBM bitmap image data 10262#>4 leshort x %u x 10263#>6 leshort x %u 10264 10265# From Albert Cahalan <acahalan@gmail.com> 10266# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 102670 string C565 OLPC firmware icon image data 10268>4 leshort x %u x 10269>6 leshort x %u 10270 10271# Applied Images - Image files from Cytovision 10272# Gustavo Junior Alves <gjalves@gjalves.com.br> 102730 string \xce\xda\xde\xfa Cytovision Metaphases file 102740 string \xed\xad\xef\xac Cytovision Karyotype file 102750 string \x0b\x00\x03\x00 Cytovision FISH Probe file 102760 string \xed\xfe\xda\xbe Cytovision FLEX file 102770 string \xed\xab\xed\xfe Cytovision FLEX file 102780 string \xad\xfd\xea\xad Cytovision RATS file 10279 10280# Wavelet Scalar Quantization format used in gray-scale fingerprint images 10281# From Tano M Fotang <mfotang@quanteq.com> 102820 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 10283 10284# JPEG 2000 Code Stream Bitmap 10285# From Petr Splichal <psplicha@redhat.com> 102860 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data 10287 10288#------------------------------------------------------------------------------ 10289# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 10290# inform: file(1) magic for Inform interactive fiction language 10291 10292# URL: http://www.inform-fiction.org/ 10293# From: Reuben Thomas <rrt@sc3d.org> 10294 102950 search/100/cW constant\ story Inform source text 10296 10297#------------------------------------------------------------------------------ 10298# $File: intel,v 1.8 2009/09/19 16:28:10 christos Exp $ 10299# intel: file(1) magic for x86 Unix 10300# 10301# Various flavors of x86 UNIX executable/object (other than Xenix, which 10302# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 10303# Windows as well. 10304# 10305# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 10306# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 10307# as well, if, as, and when IBM makes it portable. 10308# 10309# The `versions' should be un-commented if they work for you. 10310# (Was the problem just one of endianness?) 10311# 103120 leshort 0502 basic-16 executable 10313>12 lelong >0 not stripped 10314#>22 leshort >0 - version %ld 103150 leshort 0503 basic-16 executable (TV) 10316>12 lelong >0 not stripped 10317#>22 leshort >0 - version %ld 103180 leshort 0510 x86 executable 10319>12 lelong >0 not stripped 103200 leshort 0511 x86 executable (TV) 10321>12 lelong >0 not stripped 103220 leshort =0512 iAPX 286 executable small model (COFF) 10323>12 lelong >0 not stripped 10324#>22 leshort >0 - version %ld 103250 leshort =0522 iAPX 286 executable large model (COFF) 10326>12 lelong >0 not stripped 10327#>22 leshort >0 - version %ld 10328# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 103290 leshort =0514 80386 COFF executable 10330>12 lelong >0 not stripped 10331>22 leshort >0 - version %ld 10332 10333# rom: file(1) magic for BIOS ROM Extensions found in intel machines 10334# mapped into memory between 0xC0000 and 0xFFFFF 10335# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu 103360 beshort 0x55AA BIOS (ia32) ROM Ext. 10337>5 string USB USB 10338>7 string LDR UNDI image 10339>30 string IBM IBM comp. Video 10340>26 string Adaptec Adaptec 10341>28 string Adaptec Adaptec 10342>42 string PROMISE Promise 10343>2 byte x (%d*512) 10344 10345#------------------------------------------------------------------------------ 10346# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 10347# interleaf: file(1) magic for InterLeaf TPS: 10348# 103490 string =\210OPS Interleaf saved data 103500 string =<!OPS Interleaf document text 10351>5 string ,\ Version\ = \b, version 10352>>17 string >\0 %.3s 10353 10354#------------------------------------------------------------------------------ 10355# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 10356# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 10357# "/etc/magic": 10358# From: guy@netapp.com (Guy Harris) 10359# 103604 string pgscriptver IslandWrite document 1036113 string DrawFile IslandDraw document 10362 10363 10364#------------------------------------------------------------------------------ 10365# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 10366# ispell: file(1) magic for ispell 10367# 10368# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 10369# will match 0x9600 through 0x9603 in *both* little endian and big endian. 10370# (No other current magic entries collide.) 10371# 10372# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 10373# 103740 leshort&0xFFFC 0x9600 little endian ispell 10375>0 byte 0 hash file (?), 10376>0 byte 1 3.0 hash file, 10377>0 byte 2 3.1 hash file, 10378>0 byte 3 hash file (?), 10379>2 leshort 0x00 8-bit, no capitalization, 26 flags 10380>2 leshort 0x01 7-bit, no capitalization, 26 flags 10381>2 leshort 0x02 8-bit, capitalization, 26 flags 10382>2 leshort 0x03 7-bit, capitalization, 26 flags 10383>2 leshort 0x04 8-bit, no capitalization, 52 flags 10384>2 leshort 0x05 7-bit, no capitalization, 52 flags 10385>2 leshort 0x06 8-bit, capitalization, 52 flags 10386>2 leshort 0x07 7-bit, capitalization, 52 flags 10387>2 leshort 0x08 8-bit, no capitalization, 128 flags 10388>2 leshort 0x09 7-bit, no capitalization, 128 flags 10389>2 leshort 0x0A 8-bit, capitalization, 128 flags 10390>2 leshort 0x0B 7-bit, capitalization, 128 flags 10391>2 leshort 0x0C 8-bit, no capitalization, 256 flags 10392>2 leshort 0x0D 7-bit, no capitalization, 256 flags 10393>2 leshort 0x0E 8-bit, capitalization, 256 flags 10394>2 leshort 0x0F 7-bit, capitalization, 256 flags 10395>4 leshort >0 and %d string characters 103960 beshort&0xFFFC 0x9600 big endian ispell 10397>1 byte 0 hash file (?), 10398>1 byte 1 3.0 hash file, 10399>1 byte 2 3.1 hash file, 10400>1 byte 3 hash file (?), 10401>2 beshort 0x00 8-bit, no capitalization, 26 flags 10402>2 beshort 0x01 7-bit, no capitalization, 26 flags 10403>2 beshort 0x02 8-bit, capitalization, 26 flags 10404>2 beshort 0x03 7-bit, capitalization, 26 flags 10405>2 beshort 0x04 8-bit, no capitalization, 52 flags 10406>2 beshort 0x05 7-bit, no capitalization, 52 flags 10407>2 beshort 0x06 8-bit, capitalization, 52 flags 10408>2 beshort 0x07 7-bit, capitalization, 52 flags 10409>2 beshort 0x08 8-bit, no capitalization, 128 flags 10410>2 beshort 0x09 7-bit, no capitalization, 128 flags 10411>2 beshort 0x0A 8-bit, capitalization, 128 flags 10412>2 beshort 0x0B 7-bit, capitalization, 128 flags 10413>2 beshort 0x0C 8-bit, no capitalization, 256 flags 10414>2 beshort 0x0D 7-bit, no capitalization, 256 flags 10415>2 beshort 0x0E 8-bit, capitalization, 256 flags 10416>2 beshort 0x0F 7-bit, capitalization, 256 flags 10417>4 beshort >0 and %d string characters 10418# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 10419# Ispell 4.0 104200 string ISPL ispell 10421>4 long x hash file version %d, 10422>8 long x lexletters %d, 10423>12 long x lexsize %d, 10424>16 long x hashsize %d, 10425>20 long x stblsize %d 10426 10427#------------------------------------------------------------ 10428# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $ 10429# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 10430# same magic number, 0xcafebabe, so they are both handled 10431# in the entry called "cafebabe". 10432#------------------------------------------------------------ 10433# Java serialization 10434# From Martin Pool (m.pool@pharos.com.au) 104350 beshort 0xaced Java serialization data 10436>2 beshort >0x0004 \b, version %d 10437 104380 belong 0xfeedfeed Java KeyStore 10439!:mime application/x-java-keystore 104400 belong 0xcececece Java JCE KeyStore 10441!:mime application/x-java-jce-keystore 10442 10443# Dalvik .dex format. http://retrodev.com/android/dexformat.html 10444# From <mkf@google.com> "Mike Fleming" 104450 string dex\n 10446>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file 10447>4 string >000 version %s 104480 string dey\n 10449>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host) 10450>4 string >000 version %s 10451 10452 10453#------------------------------------------------------------------------------ 10454# $File: jpeg,v 1.15 2009/09/19 16:28:10 christos Exp $ 10455# JPEG images 10456# SunOS 5.5.1 had 10457# 10458# 0 string \377\330\377\340 JPEG file 10459# 0 string \377\330\377\356 JPG file 10460# 10461# both of which turn into "JPEG image data" here. 10462# 104630 beshort 0xffd8 JPEG image data 10464!:mime image/jpeg 10465!:apple 8BIMJPEG 10466!:strength +1 10467>6 string JFIF \b, JFIF standard 10468# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 10469# in a vain attempt to add image size reporting for JFIF. Note that these 10470# tests are not fool-proof since some perfectly valid JPEGs are currently 10471# impossible to specify in magic(4) format. 10472# First, a little JFIF version info: 10473>>11 byte x \b %d. 10474>>12 byte x \b%02d 10475# Next, the resolution or aspect ratio of the image: 10476#>>13 byte 0 \b, aspect ratio 10477#>>13 byte 1 \b, resolution (DPI) 10478#>>13 byte 2 \b, resolution (DPCM) 10479#>>4 beshort x \b, segment length %d 10480# Next, show thumbnail info, if it exists: 10481>>18 byte !0 \b, thumbnail %dx 10482>>>19 byte x \b%d 10483 10484# EXIF moved down here to avoid reporting a bogus version number, 10485# and EXIF version number printing added. 10486# - Patrik R=E5dman <patrik+file-magic@iki.fi> 10487>6 string Exif \b, EXIF standard 10488# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. 10489# All possible combinations of entries have to be enumerated, since no looping 10490# is possible. And both endians are possible... 10491# The combinations included below are from real-world JPEGs. 10492# Little-endian 10493>>12 string II 10494# IFD 0 Entry #5: 10495>>>70 leshort 0x8769 10496# EXIF IFD Entry #1: 10497>>>>(78.l+14) leshort 0x9000 10498>>>>>(78.l+23) byte x %c 10499>>>>>(78.l+24) byte x \b.%c 10500>>>>>(78.l+25) byte !0x30 \b%c 10501# IFD 0 Entry #9: 10502>>>118 leshort 0x8769 10503# EXIF IFD Entry #3: 10504>>>>(126.l+38) leshort 0x9000 10505>>>>>(126.l+47) byte x %c 10506>>>>>(126.l+48) byte x \b.%c 10507>>>>>(126.l+49) byte !0x30 \b%c 10508# IFD 0 Entry #10 10509>>>130 leshort 0x8769 10510# EXIF IFD Entry #3: 10511>>>>(138.l+38) leshort 0x9000 10512>>>>>(138.l+47) byte x %c 10513>>>>>(138.l+48) byte x \b.%c 10514>>>>>(138.l+49) byte !0x30 \b%c 10515# EXIF IFD Entry #4: 10516>>>>(138.l+50) leshort 0x9000 10517>>>>>(138.l+59) byte x %c 10518>>>>>(138.l+60) byte x \b.%c 10519>>>>>(138.l+61) byte !0x30 \b%c 10520# EXIF IFD Entry #5: 10521>>>>(138.l+62) leshort 0x9000 10522>>>>>(138.l+71) byte x %c 10523>>>>>(138.l+72) byte x \b.%c 10524>>>>>(138.l+73) byte !0x30 \b%c 10525# IFD 0 Entry #11 10526>>>142 leshort 0x8769 10527# EXIF IFD Entry #3: 10528>>>>(150.l+38) leshort 0x9000 10529>>>>>(150.l+47) byte x %c 10530>>>>>(150.l+48) byte x \b.%c 10531>>>>>(150.l+49) byte !0x30 \b%c 10532# EXIF IFD Entry #4: 10533>>>>(150.l+50) leshort 0x9000 10534>>>>>(150.l+59) byte x %c 10535>>>>>(150.l+60) byte x \b.%c 10536>>>>>(150.l+61) byte !0x30 \b%c 10537# EXIF IFD Entry #5: 10538>>>>(150.l+62) leshort 0x9000 10539>>>>>(150.l+71) byte x %c 10540>>>>>(150.l+72) byte x \b.%c 10541>>>>>(150.l+73) byte !0x30 \b%c 10542# Big-endian 10543>>12 string MM 10544# IFD 0 Entry #9: 10545>>>118 beshort 0x8769 10546# EXIF IFD Entry #1: 10547>>>>(126.L+14) beshort 0x9000 10548>>>>>(126.L+23) byte x %c 10549>>>>>(126.L+24) byte x \b.%c 10550>>>>>(126.L+25) byte !0x30 \b%c 10551# EXIF IFD Entry #3: 10552>>>>(126.L+38) beshort 0x9000 10553>>>>>(126.L+47) byte x %c 10554>>>>>(126.L+48) byte x \b.%c 10555>>>>>(126.L+49) byte !0x30 \b%c 10556# IFD 0 Entry #10 10557>>>130 beshort 0x8769 10558# EXIF IFD Entry #3: 10559>>>>(138.L+38) beshort 0x9000 10560>>>>>(138.L+47) byte x %c 10561>>>>>(138.L+48) byte x \b.%c 10562>>>>>(138.L+49) byte !0x30 \b%c 10563# EXIF IFD Entry #5: 10564>>>>(138.L+62) beshort 0x9000 10565>>>>>(138.L+71) byte x %c 10566>>>>>(138.L+72) byte x \b.%c 10567>>>>>(138.L+73) byte !0x30 \b%c 10568# IFD 0 Entry #11 10569>>>142 beshort 0x8769 10570# EXIF IFD Entry #4: 10571>>>>(150.L+50) beshort 0x9000 10572>>>>>(150.L+59) byte x %c 10573>>>>>(150.L+60) byte x \b.%c 10574>>>>>(150.L+61) byte !0x30 \b%c 10575# Here things get sticky. We can do ONE MORE marker segment with 10576# indirect addressing, and that's all. It would be great if we could 10577# do pointer arithemetic like in an assembler language. Christos? 10578# And if there was some sort of looping construct to do searches, plus a few 10579# named accumulators, it would be even more effective... 10580# At least we can show a comment if no other segments got inserted before: 10581>(4.S+5) byte 0xFE 10582>>(4.S+8) string >\0 \b, comment: "%s" 10583# FIXME: When we can do non-byte counted strings, we can use that to get 10584# the string's count, and fix Debian bug #283760 10585#>(4.S+5) byte 0xFE \b, comment 10586#>>(4.S+6) beshort x \b length=%d 10587#>>(4.S+8) string >\0 \b, "%s" 10588# Or, we can show the encoding type (I've included only the three most common) 10589# and image dimensions if we are lucky and the SOFn (image segment) is here: 10590>(4.S+5) byte 0xC0 \b, baseline 10591>>(4.S+6) byte x \b, precision %d 10592>>(4.S+7) beshort x \b, %dx 10593>>(4.S+9) beshort x \b%d 10594>(4.S+5) byte 0xC1 \b, extended sequential 10595>>(4.S+6) byte x \b, precision %d 10596>>(4.S+7) beshort x \b, %dx 10597>>(4.S+9) beshort x \b%d 10598>(4.S+5) byte 0xC2 \b, progressive 10599>>(4.S+6) byte x \b, precision %d 10600>>(4.S+7) beshort x \b, %dx 10601>>(4.S+9) beshort x \b%d 10602# I've commented-out quantisation table reporting. I doubt anyone cares yet. 10603#>(4.S+5) byte 0xDB \b, quantisation table 10604#>>(4.S+6) beshort x \b length=%d 10605#>14 beshort x \b, %d x 10606#>16 beshort x \b %d 10607 10608# HSI is Handmade Software's proprietary JPEG encoding scheme 106090 string hsi1 JPEG image data, HSI proprietary 10610 10611# From: David Santinoli <david@santinoli.com> 106120 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data 10613 10614# Type: JPEG 2000 codesream 10615# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 106160 belong 0xff4fff51 JPEG 2000 codestream 1061745 beshort 0xff52 10618 10619#------------------------------------------------------------------------------ 10620# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ 10621# karma: file(1) magic for Karma data files 10622# 10623# From <rgooch@atnf.csiro.au> 10624 106250 string KarmaRHD Version Karma Data Structure Version 10626>16 belong x %lu 10627 10628#------------------------------------------------------------------------------ 10629# $File: kde,v 1.4 2009/09/19 16:28:10 christos Exp $ 10630# kde: file(1) magic for KDE 10631 106320 string [KDE\ Desktop\ Entry] KDE desktop entry 10633!:mime application/x-kdelnk 106340 string #\ KDE\ Config\ File KDE config file 10635!:mime application/x-kdelnk 106360 string #\ xmcd xmcd database file for kscd 10637!:mime text/x-xmcd 10638 10639#------------------------------------------------------------------------------ 10640# $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $ 10641# Type: Google KML, formerly Keyhole Markup Language 10642# Future development of this format has been handed 10643# over to the Open Geospatial Consortium. 10644# http://www.opengeospatial.org/standards/kml/ 10645# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 106460 string \<?xml 10647>20 search/400 \ xmlns= 10648>>&0 regex ['"]http://earth.google.com/kml Google KML document 10649!:mime application/vnd.google-earth.kml+xml 10650>>>&1 string 2.0' \b, version 2.0 10651>>>&1 string 2.1' \b, version 2.1 10652>>>&1 string 2.2' \b, version 2.2 10653 10654#------------------------------------------------------------------------------ 10655# Type: OpenGIS KML, formerly Keyhole Markup Language 10656# This standard is maintained by the 10657# Open Geospatial Consortium. 10658# http://www.opengeospatial.org/standards/kml/ 10659# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 10660>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 10661!:mime application/vnd.google-earth.kml+xml 10662>>>&1 string 2.2 \b, version 2.2 10663 10664#------------------------------------------------------------------------------ 10665# Type: Google KML Archive (ZIP based) 10666# http://code.google.com/apis/kml/documentation/kml_tut.html 10667# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 106680 string PK\003\004 10669>4 byte 0x14 10670>>30 string doc.kml Compressed Google KML Document, including resources. 10671!:mime application/vnd.google-earth.kmz 10672 10673#------------------------------------------------------------------------------ 10674# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 10675# DEC SRC Virtual Paper: Lectern files 10676# Karl M. Hegbloom <karlheg@inetarena.com> 106770 string lect DEC SRC Virtual Paper Lectern file 10678 10679#------------------------------------------------------------------------------ 10680# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 10681# lex: file(1) magic for lex 10682# 10683# derived empirically, your offsets may vary! 106840 search/100 yyprevious C program text (from lex) 10685>3 search/1 >\0 for %s 10686# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 106870 search/100 generated\ by\ flex C program text (from flex) 10688# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 106890 search/1 %{ lex description text 10690 10691#------------------------------------------------------------------------------ 10692# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 10693# lif: file(1) magic for lif 10694# 10695# (Daniel Quinlan <quinlan@yggdrasil.com>) 10696# 106970 beshort 0x8000 lif file 10698 10699#------------------------------------------------------------------------------ 10700# $File: linux,v 1.33 2009/10/23 16:44:59 christos Exp $ 10701# linux: file(1) magic for Linux files 10702# 10703# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 10704# The following basic Linux magic is useful for reference, but using 10705# "long" magic is a better practice in order to avoid collisions. 10706# 10707# 2 leshort 100 Linux/i386 10708# >0 leshort 0407 impure executable (OMAGIC) 10709# >0 leshort 0410 pure executable (NMAGIC) 10710# >0 leshort 0413 demand-paged executable (ZMAGIC) 10711# >0 leshort 0314 demand-paged executable (QMAGIC) 10712# 107130 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 10714>16 lelong 0 \b, stripped 107150 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 10716>16 lelong 0 \b, stripped 107170 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 10718>16 lelong 0 \b, stripped 107190 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 10720>16 lelong 0 \b, stripped 10721# 107220 string \007\001\000 Linux/i386 object file 10723>20 lelong >0x1020 \b, DLL library 10724# Linux-8086 stuff: 107250 string \01\03\020\04 Linux-8086 impure executable 10726>28 long !0 not stripped 107270 string \01\03\040\04 Linux-8086 executable 10728>28 long !0 not stripped 10729# 107300 string \243\206\001\0 Linux-8086 object file 10731# 107320 string \01\03\020\20 Minix-386 impure executable 10733>28 long !0 not stripped 107340 string \01\03\040\20 Minix-386 executable 10735>28 long !0 not stripped 10736# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 10737216 lelong 0421 Linux/i386 core file 10738>220 string >\0 of '%s' 10739>200 lelong >0 (signal %d) 10740# 10741# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 10742# this can be overridden by the DOS executable (COM) entry 107432 string LILO Linux/i386 LILO boot/chain loader 10744# 10745# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 107460 leshort 0x0436 Linux/i386 PC Screen Font data, 10747>2 byte 0 256 characters, no directory, 10748>2 byte 1 512 characters, no directory, 10749>2 byte 2 256 characters, Unicode directory, 10750>2 byte 3 512 characters, Unicode directory, 10751>3 byte >0 8x%d 10752# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 107534086 string SWAP-SPACE Linux/i386 swap file 10754# From: Jeff Bailey <jbailey@ubuntu.com> 10755# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 107564076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 10757# according to man page of mkswap (8) March 1999 107584086 string SWAPSPACE2 Linux/i386 swap file (new style) 10759>0x400 long x %d (4K pages) 10760>0x404 long x size %d pages 10761>>4086 string SWAPSPACE2 10762>>>1052 string >\0 Label %s 10763# From Daniel Novotny <dnovotny@redhat.com> 10764# swap file for PowerPC 1076565526 string SWAPSPACE2 Linux/ppc swap file 1076616374 string SWAPSPACE2 Linux/ia64 swap file 10767# ECOFF magic for OSF/1 and Linux (only tested under Linux though) 10768# 10769# from Erik Troan (ewt@redhat.com) examining od dumps, so this 10770# could be wrong 10771# updated by David Mosberger (davidm@azstarnet.com) based on 10772# GNU BFD and MIPS info found below. 10773# 107740 leshort 0x0183 ECOFF alpha 10775>24 leshort 0407 executable 10776>24 leshort 0410 pure 10777>24 leshort 0413 demand paged 10778>8 long >0 not stripped 10779>8 long 0 stripped 10780>23 leshort >0 - version %ld. 10781# 10782# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 10783# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 10784# and Nicols Lichtmaier <nick@debian.org> 10785# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 10786# Linux kernel boot images (i386 arch) (Wolfram Kleff) 10787514 string HdrS Linux kernel 10788>510 leshort 0xAA55 x86 boot executable 10789>>518 leshort >0x1ff 10790>>>529 byte 0 zImage, 10791>>>529 byte 1 bzImage, 10792>>>(526.s+0x200) string >\0 version %s, 10793>>498 leshort 1 RO-rootFS, 10794>>498 leshort 0 RW-rootFS, 10795>>508 leshort >0 root_dev 0x%X, 10796>>502 leshort >0 swap_dev 0x%X, 10797>>504 leshort >0 RAMdisksize %u KB, 10798>>506 leshort 0xFFFF Normal VGA 10799>>506 leshort 0xFFFE Extended VGA 10800>>506 leshort 0xFFFD Prompt for Videomode 10801>>506 leshort >0 Video mode %d 10802# This also matches new kernels, which were caught above by "HdrS". 108030 belong 0xb8c0078e Linux kernel 10804>0x1e3 string Loading version 1.3.79 or older 10805>0x1e9 string Loading from prehistoric times 10806 10807# System.map files - Nicols Lichtmaier <nick@debian.org> 108088 search/1 \ A\ _text Linux kernel symbol map text 10809 10810# LSM entries - Nicols Lichtmaier <nick@debian.org> 108110 search/1 Begin3 Linux Software Map entry text 108120 search/1 Begin4 Linux Software Map entry text (new format) 10813 10814# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 108150 belong 0x4f4f4f4d User-mode Linux COW file 10816>4 belong <3 \b, version %d 10817>>8 string >\0 \b, backing file %s 10818>4 belong >2 \b, version %d 10819>>32 string >\0 \b, backing file %s 10820 10821############################################################################ 10822# Linux kernel versions 10823 108240 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 10825>497 leshort 0 x86 boot sector 10826>>514 belong 0x8e of a kernel from the dawn of time! 10827>>514 belong 0x908ed8b4 version 0.99-1.1.42 10828>>514 belong 0x908ed8b8 for memtest86 10829 10830>497 leshort !0 x86 kernel 10831>>504 leshort >0 RAMdisksize=%u KB 10832>>502 leshort >0 swap=0x%X 10833>>508 leshort >0 root=0x%X 10834>>>498 leshort 1 \b-ro 10835>>>498 leshort 0 \b-rw 10836>>506 leshort 0xFFFF vga=normal 10837>>506 leshort 0xFFFE vga=extended 10838>>506 leshort 0xFFFD vga=ask 10839>>506 leshort >0 vga=%d 10840>>514 belong 0x908ed881 version 1.1.43-1.1.45 10841>>514 belong 0x15b281cd 10842>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 10843>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 10844>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 10845>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 10846>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 10847>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 10848>>514 string HdrS 10849>>>518 leshort >0x1FF 10850>>>>529 byte 0 \b, zImage 10851>>>>529 byte 1 \b, bzImage 10852>>>>(526.s+0x200) string >\0 \b, version %s 10853 10854# Linux boot sector thefts. 108550 belong 0xb8c0078e Linux 10856>0x1e6 belong 0x454c4b53 ELKS Kernel 10857>0x1e6 belong !0x454c4b53 style boot sector 10858 10859############################################################################ 10860# Linux S390 executable 108618 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 10862>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 10863# 64bit 10864>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 10865>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 10866>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 10867>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 10868# 32bit 10869>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 10870>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 10871>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 10872>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 10873 10874############################################################################ 10875# Linux 8086 executable 108760 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 10877>5 string . 10878>>4 string >\0 \b, libc version %s 10879 108800 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 10881>2 byte&0x01 !0 \b, unmapped zero page 10882>2 byte&0x20 0 \b, impure 10883>2 byte&0x20 !0 10884>>2 byte&0x10 !0 \b, A_EXEC 10885>2 byte&0x02 !0 \b, A_PAL 10886>2 byte&0x04 !0 \b, A_NSYM 10887>2 byte&0x08 !0 \b, A_STAND 10888>2 byte&0x40 !0 \b, A_PURE 10889>2 byte&0x80 !0 \b, A_TOVLY 10890>28 long !0 \b, not stripped 10891>37 string . 10892>>36 string >\0 \b, libc version %s 10893 10894# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 10895# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 10896# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 10897# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 10898 10899# SYSLINUX boot logo files (from 'ppmtolss16' sources) 10900# http://syslinux.zytor.com/ 10901# 109020 lelong =0x1413f33d SYSLINUX' LSS16 image data 10903>4 leshort x \b, width %d 10904>6 leshort x \b, height %d 10905 109060 string OOOM User-Mode-Linux's Copy-On-Write disk image 10907>4 belong x version %d 10908 10909# SE Linux policy database 10910# From: Mike Frysinger <vapier@gentoo.org> 109110 lelong 0xf97cff8c SE Linux policy 10912>16 lelong x v%d 10913>20 lelong 1 MLS 10914>24 lelong x %d symbols 10915>28 lelong x %d ocons 10916 10917# Linux Logical Volume Manager (LVM) 10918# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 10919# 10920# System ID, UUID and volume group name are 128 bytes long 10921# but they should never be full and initialized with zeros... 10922# 10923# LVM1 10924# 109250x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 10926>0x12c string >\0 , System ID: %s 10927 109280x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 10929>0x12c string >\0 , System ID: %s 10930 10931# LVM2 10932# 10933# It seems that the label header can be in one the four first sector 10934# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 10935# 10936# 0x200 seems to be the common case 10937 109380x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 10939# read the offset to add to the start of the header, and the header 10940# start in 0x200 10941>(0x214.l+0x200) string >\0 , UUID: %s 10942 109430x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 10944>(0x014.l) string >\0 , UUID: %s 10945 109460x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 10947>(0x414.l+0x400) string >\0 , UUID: %s 10948 109490x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 10950>(0x614.l+0x600) string >\0 , UUID: %s 10951 10952# LVM snapshot 10953# from Jason Farrel 109540 string SnAp LVM Snapshot (CopyOnWrite store) 10955>4 lelong !0 - valid, 10956>4 lelong 0 - invalid, 10957>8 lelong x version %d, 10958>12 lelong x chunk_size %d 10959 10960# SE Linux policy database 109610 lelong 0xf97cff8c SE Linux policy 10962>16 lelong x v%d 10963>20 lelong 1 MLS 10964>24 lelong x %d symbols 10965>28 lelong x %d ocons 10966 10967# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 10968# Anthon van der Neut (anthon@mnt.org) 109690 string LUKS\xba\xbe LUKS encrypted file, 10970>6 beshort x ver %d 10971>8 string x [%s, 10972>40 string x %s, 10973>72 string x %s] 10974>168 string x UUID: %s 10975 10976 10977# Summary: Xen saved domain file 10978# Created by: Radek Vokal <rvokal@redhat.com> 109790 string LinuxGuestRecord Xen saved domain 10980>20 search/256 (name 10981>>&1 string x (name %s) 10982 10983 10984#------------------------------------------------------------------------------ 10985# $File: linux,v 1.33 2009/10/23 16:44:59 christos Exp $ 10986# linux: file(1) magic for Linux files 10987# 10988# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 10989# The following basic Linux magic is useful for reference, but using 10990# "long" magic is a better practice in order to avoid collisions. 10991# 10992# 2 leshort 100 Linux/i386 10993# >0 leshort 0407 impure executable (OMAGIC) 10994# >0 leshort 0410 pure executable (NMAGIC) 10995# >0 leshort 0413 demand-paged executable (ZMAGIC) 10996# >0 leshort 0314 demand-paged executable (QMAGIC) 10997# 109980 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 10999>16 lelong 0 \b, stripped 110000 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 11001>16 lelong 0 \b, stripped 110020 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 11003>16 lelong 0 \b, stripped 110040 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 11005>16 lelong 0 \b, stripped 11006# 110070 string \007\001\000 Linux/i386 object file 11008>20 lelong >0x1020 \b, DLL library 11009# Linux-8086 stuff: 110100 string \01\03\020\04 Linux-8086 impure executable 11011>28 long !0 not stripped 110120 string \01\03\040\04 Linux-8086 executable 11013>28 long !0 not stripped 11014# 110150 string \243\206\001\0 Linux-8086 object file 11016# 110170 string \01\03\020\20 Minix-386 impure executable 11018>28 long !0 not stripped 110190 string \01\03\040\20 Minix-386 executable 11020>28 long !0 not stripped 11021# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 11022216 lelong 0421 Linux/i386 core file 11023>220 string >\0 of '%s' 11024>200 lelong >0 (signal %d) 11025# 11026# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 11027# this can be overridden by the DOS executable (COM) entry 110282 string LILO Linux/i386 LILO boot/chain loader 11029# 11030# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 110310 leshort 0x0436 Linux/i386 PC Screen Font data, 11032>2 byte 0 256 characters, no directory, 11033>2 byte 1 512 characters, no directory, 11034>2 byte 2 256 characters, Unicode directory, 11035>2 byte 3 512 characters, Unicode directory, 11036>3 byte >0 8x%d 11037# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 110384086 string SWAP-SPACE Linux/i386 swap file 11039# From: Jeff Bailey <jbailey@ubuntu.com> 11040# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 110414076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 11042# according to man page of mkswap (8) March 1999 110434086 string SWAPSPACE2 Linux/i386 swap file (new style) 11044>0x400 long x %d (4K pages) 11045>0x404 long x size %d pages 11046>>4086 string SWAPSPACE2 11047>>>1052 string >\0 Label %s 11048# From Daniel Novotny <dnovotny@redhat.com> 11049# swap file for PowerPC 1105065526 string SWAPSPACE2 Linux/ppc swap file 11051# ECOFF magic for OSF/1 and Linux (only tested under Linux though) 11052# 11053# from Erik Troan (ewt@redhat.com) examining od dumps, so this 11054# could be wrong 11055# updated by David Mosberger (davidm@azstarnet.com) based on 11056# GNU BFD and MIPS info found below. 11057# 110580 leshort 0x0183 ECOFF alpha 11059>24 leshort 0407 executable 11060>24 leshort 0410 pure 11061>24 leshort 0413 demand paged 11062>8 long >0 not stripped 11063>8 long 0 stripped 11064>23 leshort >0 - version %ld. 11065# 11066# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 11067# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 11068# and Nicols Lichtmaier <nick@debian.org> 11069# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 11070# Linux kernel boot images (i386 arch) (Wolfram Kleff) 11071514 string HdrS Linux kernel 11072>510 leshort 0xAA55 x86 boot executable 11073>>518 leshort >0x1ff 11074>>>529 byte 0 zImage, 11075>>>529 byte 1 bzImage, 11076>>>(526.s+0x200) string >\0 version %s, 11077>>498 leshort 1 RO-rootFS, 11078>>498 leshort 0 RW-rootFS, 11079>>508 leshort >0 root_dev 0x%X, 11080>>502 leshort >0 swap_dev 0x%X, 11081>>504 leshort >0 RAMdisksize %u KB, 11082>>506 leshort 0xFFFF Normal VGA 11083>>506 leshort 0xFFFE Extended VGA 11084>>506 leshort 0xFFFD Prompt for Videomode 11085>>506 leshort >0 Video mode %d 11086# This also matches new kernels, which were caught above by "HdrS". 110870 belong 0xb8c0078e Linux kernel 11088>0x1e3 string Loading version 1.3.79 or older 11089>0x1e9 string Loading from prehistoric times 11090 11091# System.map files - Nicols Lichtmaier <nick@debian.org> 110928 search/1 \ A\ _text Linux kernel symbol map text 11093 11094# LSM entries - Nicols Lichtmaier <nick@debian.org> 110950 search/1 Begin3 Linux Software Map entry text 110960 search/1 Begin4 Linux Software Map entry text (new format) 11097 11098# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 110990 belong 0x4f4f4f4d User-mode Linux COW file 11100>4 belong <3 \b, version %d 11101>>8 string >\0 \b, backing file %s 11102>4 belong >2 \b, version %d 11103>>32 string >\0 \b, backing file %s 11104 11105############################################################################ 11106# Linux kernel versions 11107 111080 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 11109>497 leshort 0 x86 boot sector 11110>>514 belong 0x8e of a kernel from the dawn of time! 11111>>514 belong 0x908ed8b4 version 0.99-1.1.42 11112>>514 belong 0x908ed8b8 for memtest86 11113 11114>497 leshort !0 x86 kernel 11115>>504 leshort >0 RAMdisksize=%u KB 11116>>502 leshort >0 swap=0x%X 11117>>508 leshort >0 root=0x%X 11118>>>498 leshort 1 \b-ro 11119>>>498 leshort 0 \b-rw 11120>>506 leshort 0xFFFF vga=normal 11121>>506 leshort 0xFFFE vga=extended 11122>>506 leshort 0xFFFD vga=ask 11123>>506 leshort >0 vga=%d 11124>>514 belong 0x908ed881 version 1.1.43-1.1.45 11125>>514 belong 0x15b281cd 11126>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 11127>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 11128>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 11129>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 11130>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 11131>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 11132>>514 string HdrS 11133>>>518 leshort >0x1FF 11134>>>>529 byte 0 \b, zImage 11135>>>>529 byte 1 \b, bzImage 11136>>>>(526.s+0x200) string >\0 \b, version %s 11137 11138# Linux boot sector thefts. 111390 belong 0xb8c0078e Linux 11140>0x1e6 belong 0x454c4b53 ELKS Kernel 11141>0x1e6 belong !0x454c4b53 style boot sector 11142 11143############################################################################ 11144# Linux 8086 executable 111450 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 11146>5 string . 11147>>4 string >\0 \b, libc version %s 11148 111490 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 11150>2 byte&0x01 !0 \b, unmapped zero page 11151>2 byte&0x20 0 \b, impure 11152>2 byte&0x20 !0 11153>>2 byte&0x10 !0 \b, A_EXEC 11154>2 byte&0x02 !0 \b, A_PAL 11155>2 byte&0x04 !0 \b, A_NSYM 11156>2 byte&0x08 !0 \b, A_STAND 11157>2 byte&0x40 !0 \b, A_PURE 11158>2 byte&0x80 !0 \b, A_TOVLY 11159>28 long !0 \b, not stripped 11160>37 string . 11161>>36 string >\0 \b, libc version %s 11162 11163# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 11164# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 11165# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 11166# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 11167 11168# SYSLINUX boot logo files (from 'ppmtolss16' sources) 11169# http://syslinux.zytor.com/ 11170# 111710 lelong =0x1413f33d SYSLINUX' LSS16 image data 11172>4 leshort x \b, width %d 11173>6 leshort x \b, height %d 11174 111750 string OOOM User-Mode-Linux's Copy-On-Write disk image 11176>4 belong x version %d 11177 11178# SE Linux policy database 11179# From: Mike Frysinger <vapier@gentoo.org> 111800 lelong 0xf97cff8c SE Linux policy 11181>16 lelong x v%d 11182>20 lelong 1 MLS 11183>24 lelong x %d symbols 11184>28 lelong x %d ocons 11185 11186# Linux Logical Volume Manager (LVM) 11187# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 11188# 11189# System ID, UUID and volume group name are 128 bytes long 11190# but they should never be full and initialized with zeros... 11191# 11192# LVM1 11193# 111940x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 11195>0x12c string >\0 , System ID: %s 11196 111970x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 11198>0x12c string >\0 , System ID: %s 11199 11200# LVM2 11201# 11202# It seems that the label header can be in one the four first sector 11203# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 11204# 11205# 0x200 seems to be the common case 11206 112070x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 11208# read the offset to add to the start of the header, and the header 11209# start in 0x200 11210>(0x214.l+0x200) string >\0 , UUID: %s 11211 112120x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 11213>(0x014.l) string >\0 , UUID: %s 11214 112150x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 11216>(0x414.l+0x400) string >\0 , UUID: %s 11217 112180x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 11219>(0x614.l+0x600) string >\0 , UUID: %s 11220 11221# LVM snapshot 11222# from Jason Farrel 112230 string SnAp LVM Snapshot (CopyOnWrite store) 11224>4 lelong !0 - valid, 11225>4 lelong 0 - invalid, 11226>8 lelong x version %d, 11227>12 lelong x chunk_size %d 11228 11229# SE Linux policy database 112300 lelong 0xf97cff8c SE Linux policy 11231>16 lelong x v%d 11232>20 lelong 1 MLS 11233>24 lelong x %d symbols 11234>28 lelong x %d ocons 11235 11236# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 11237# Anthon van der Neut (anthon@mnt.org) 112380 string LUKS\xba\xbe LUKS encrypted file, 11239>6 beshort x ver %d 11240>8 string x [%s, 11241>40 string x %s, 11242>72 string x %s] 11243>168 string x UUID: %s 11244 11245 11246# Summary: Xen saved domain file 11247# Created by: Radek Vokal <rvokal@redhat.com> 112480 string LinuxGuestRecord Xen saved domain 11249>20 search/256 (name 11250>>&1 string x (name %s) 11251 11252 11253#------------------------------------------------------------------------------ 11254# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $ 11255# lisp: file(1) magic for lisp programs 11256# 11257# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 11258 11259# updated by Joerg Jenderek 11260# GRR: This lot is too weak 11261#0 string ;; 11262# windows INF files often begin with semicolon and use CRLF as line end 11263# lisp files are mainly created on unix system with LF as line end 11264#>2 search/4096 !\r Lisp/Scheme program text 11265#>2 search/4096 \r Windows INF file 11266 112670 search/4096 (setq\ Lisp/Scheme program text 11268!:mime text/x-lisp 112690 search/4096 (defvar\ Lisp/Scheme program text 11270!:mime text/x-lisp 112710 search/4096 (defparam\ Lisp/Scheme program text 11272!:mime text/x-lisp 112730 search/4096 (defun\ Lisp/Scheme program text 11274!:mime text/x-lisp 112750 search/4096 (autoload\ Lisp/Scheme program text 11276!:mime text/x-lisp 112770 search/4096 (custom-set-variables\ Lisp/Scheme program text 11278!:mime text/x-lisp 11279 11280# Emacs 18 - this is always correct, but not very magical. 112810 string \012( Emacs v18 byte-compiled Lisp data 11282!:mime application/x-elc 11283# Emacs 19+ - ver. recognition added by Ian Springer 11284# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 11285# - Chris Chittleborough <cchittleborough@yahoo.com.au> 112860 string ;ELC 11287>4 byte >18 11288>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 11289!:mime application/x-elc 11290 11291# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 112920 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 112930 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 11294 112950 long 0x70768BD2 CLISP memory image data 112960 long 0xD28B7670 CLISP memory image data, other endian 11297 11298#.com and .bin for MIT scheme 112990 string \372\372\372\372 MIT scheme (library?) 11300 11301# From: David Allouche <david@allouche.net> 113020 search/1 \<TeXmacs| TeXmacs document text 11303!:mime text/texmacs 11304 11305#------------------------------------------------------------------------------ 11306# $File: llvm,v 1.4 2009/09/19 16:28:10 christos Exp $ 11307# llvm: file(1) magic for LLVM byte-codes 11308# URL: http://llvm.cs.uiuc.edu/docs/BytecodeFormat.html#signature 11309# From: Al Stone <ahs3@fc.hp.com> 11310 113110 string llvm LLVM byte-codes, uncompressed 113120 string llvc0 LLVM byte-codes, null compression 113130 string llvc1 LLVM byte-codes, gzip compression 113140 string llvc2 LLVM byte-codes, bzip2 compression 11315 11316#------------------------------------------------------------------------------ 11317# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $ 11318# lua: file(1) magic for Lua scripting language 11319# URL: http://www.lua.org/ 11320# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 11321 11322# Lua scripts 113230 search/1/w #!\ /usr/bin/lua Lua script text executable 11324!:mime text/x-lua 113250 search/1/w #!\ /usr/local/bin/lua Lua script text executable 11326!:mime text/x-lua 113270 search/1 #!/usr/bin/env\ lua Lua script text executable 11328!:mime text/x-lua 113290 search/1 #!\ /usr/bin/env\ lua Lua script text executable 11330!:mime text/x-lua 11331 11332# Lua bytecode 113330 string \033Lua Lua bytecode, 11334>4 byte 0x50 version 5.0 11335>4 byte 0x51 version 5.1 11336 11337#------------------------------------------------------------------------------ 11338# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 11339# luks: file(1) magic for Linux Unified Key Setup 11340# URL: http://luks.endorphin.org/spec 11341# From: Anthon van der Neut <anthon@mnt.org> 11342 113430 string LUKS\xba\xbe LUKS encrypted file, 11344>6 beshort x ver %d 11345>8 string x [%s, 11346>40 string x %s, 11347>72 string x %s] 11348>168 string x UUID: %s 11349 11350#------------------------------------------------------------ 11351# $File: mach,v 1.9 2009/09/19 16:28:10 christos Exp $ 11352# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 11353# Unfortunately the first, cafebabe, is shared with 11354# Java ByteCode, so they are both handled in the file "cafebabe". 11355# The "feedface" ones are handled herein. 11356#------------------------------------------------------------ 113570 lelong&0xfffffffe 0xfeedface Mach-O 11358>0 byte 0xcf 64-bit 11359>12 lelong 1 object 11360>12 lelong 2 executable 11361>12 lelong 3 fixed virtual memory shared library 11362>12 lelong 4 core 11363>12 lelong 5 preload executable 11364>12 lelong 6 dynamically linked shared library 11365>12 lelong 7 dynamic linker 11366>12 lelong 8 bundle 11367>12 lelong 9 dynamically linked shared library stub 11368>12 lelong >9 11369>>12 lelong x filetype=%ld 11370>4 lelong <0 11371>>4 lelong x architecture=%ld 11372>4 lelong 1 vax 11373>4 lelong 2 romp 11374>4 lelong 3 architecture=3 11375>4 lelong 4 ns32032 11376>4 lelong 5 ns32332 11377>4 lelong 6 m68k 11378>4 lelong 7 i386 11379>4 lelong 8 mips 11380>4 lelong 9 ns32532 11381>4 lelong 10 architecture=10 11382>4 lelong 11 hppa 11383>4 lelong 12 acorn 11384>4 lelong 13 m88k 11385>4 lelong 14 sparc 11386>4 lelong 15 i860-big 11387>4 lelong 16 i860 11388>4 lelong 17 rs6000 11389>4 lelong 18 ppc 11390>4 lelong 16777234 ppc64 11391>4 lelong >16777234 11392>>4 lelong x architecture=%ld 11393# 113940 belong&0xfffffffe 0xfeedface Mach-O 11395>3 byte 0xcf 64-bit 11396>12 belong 1 object 11397>12 belong 2 executable 11398>12 belong 3 fixed virtual memory shared library 11399>12 belong 4 core 11400>12 belong 5 preload executable 11401>12 belong 6 dynamically linked shared library 11402>12 belong 7 dynamic linker 11403>12 belong 8 bundle 11404>12 belong 9 dynamically linked shared library stub 11405>12 belong >9 11406>>12 belong x filetype=%ld 11407>4 belong <0 11408>>4 belong x architecture=%ld 11409>4 belong 1 vax 11410>4 belong 2 romp 11411>4 belong 3 architecture=3 11412>4 belong 4 ns32032 11413>4 belong 5 ns32332 11414>4 belong 6 for m68k architecture 11415# from NeXTstep 3.0 <mach/machine.h> 11416# i.e. mc680x0_all, ignore 11417# >>8 belong 1 (mc68030) 11418>>8 belong 2 (mc68040) 11419>>8 belong 3 (mc68030 only) 11420>4 belong 7 i386 11421>4 belong 8 mips 11422>4 belong 9 ns32532 11423>4 belong 10 architecture=10 11424>4 belong 11 hppa 11425>4 belong 12 acorn 11426>4 belong 13 m88k 11427>4 belong 14 sparc 11428>4 belong 15 i860-big 11429>4 belong 16 i860 11430>4 belong 17 rs6000 11431>4 belong 18 ppc 11432>4 belong 16777234 ppc64 11433>4 belong >16777234 11434>>4 belong x architecture=%ld 11435 11436#------------------------------------------------------------------------------ 11437# $File: macintosh,v 1.20 2009/09/19 16:28:10 christos Exp $ 11438# macintosh description 11439# 11440# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 11441# Daniel Quinlan, quinlan@yggdrasil.com 1144211 string must\ be\ converted\ with\ BinHex BinHex binary text 11443!:mime application/mac-binhex40 11444>41 string x \b, version %.3s 11445 11446# Stuffit archives are the de facto standard of compression for Macintosh 11447# files obtained from most archives. (franklsm@tuns.ca) 114480 string SIT! StuffIt Archive (data) 11449!:mime application/x-stuffit 11450!:apple SIT!SIT! 11451>2 string x : %s 114520 string SITD StuffIt Deluxe (data) 11453>2 string x : %s 114540 string Seg StuffIt Deluxe Segment (data) 11455>2 string x : %s 11456 11457# Newer StuffIt archives (grant@netbsd.org) 114580 string StuffIt StuffIt Archive 11459!:mime application/x-stuffit 11460!:apple SIT!SIT! 11461#>162 string >0 : %s 11462 11463# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 11464# GRR: Too weak 11465#0 string APPL Macintosh Application (data) 11466#>2 string x \b: %s 11467 11468# Macintosh System files (franklsm@tuns.ca) 11469# GRR: Too weak 11470#0 string zsys Macintosh System File (data) 11471#0 string FNDR Macintosh Finder (data) 11472#0 string libr Macintosh Library (data) 11473#>2 string x : %s 11474#0 string shlb Macintosh Shared Library (data) 11475#>2 string x : %s 11476#0 string cdev Macintosh Control Panel (data) 11477#>2 string x : %s 11478#0 string INIT Macintosh Extension (data) 11479#>2 string x : %s 11480#0 string FFIL Macintosh Truetype Font (data) 11481#>2 string x : %s 11482#0 string LWFN Macintosh Postscript Font (data) 11483#>2 string x : %s 11484 11485# Additional Macintosh Files (franklsm@tuns.ca) 11486# GRR: Too weak 11487#0 string PACT Macintosh Compact Pro Archive (data) 11488#>2 string x : %s 11489#0 string ttro Macintosh TeachText File (data) 11490#>2 string x : %s 11491#0 string TEXT Macintosh TeachText File (data) 11492#>2 string x : %s 11493#0 string PDF Macintosh PDF File (data) 11494#>2 string x : %s 11495 11496# MacBinary format (Eric Fischer, enf@pobox.com) 11497# 11498# Unfortunately MacBinary doesn't really have a magic number prior 11499# to the MacBinary III format. The checksum is really the way to 11500# do it, but the magic file format isn't up to the challenge. 11501# 11502# 0 byte 0 11503# 1 byte # filename length 11504# 2 string # filename 11505# 65 string # file type 11506# 69 string # file creator 11507# 73 byte # Finder flags 11508# 74 byte 0 11509# 75 beshort # vertical posn in window 11510# 77 beshort # horiz posn in window 11511# 79 beshort # window or folder ID 11512# 81 byte # protected? 11513# 82 byte 0 11514# 83 belong # length of data segment 11515# 87 belong # length of resource segment 11516# 91 belong # file creation date 11517# 95 belong # file modification date 11518# 99 beshort # length of comment after resource 11519# 101 byte # new Finder flags 11520# 102 string mBIN # (only in MacBinary III) 11521# 106 byte # char. code of file name 11522# 107 byte # still more Finder flags 11523# 116 belong # total file length 11524# 120 beshort # length of add'l header 11525# 122 byte 129 # for MacBinary II 11526# 122 byte 130 # for MacBinary III 11527# 123 byte 129 # minimum version that can read fmt 11528# 124 beshort # checksum 11529# 11530# This attempts to use the version numbers as a magic number, requiring 11531# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 11532# be 0x81. This works for the files I have, but maybe not for everyone's. 11533 11534# Unfortunately, this magic is quite weak - MPi 11535#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 11536 11537# MacBinary I doesn't have the version number field at all, but MacBinary II 11538# has been in use since 1987 so I hope there aren't many really old files 11539# floating around that this will miss. The original spec calls for using 11540# the nulls in 0, 74, and 82 as the magic number. 11541# 11542# Another possibility, that would also work for MacBinary I, is to use 11543# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 11544# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 11545# and that 74 will be 0. So something like 11546# 11547# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 11548# 11549# >73 byte&0x01 0x01 \b, inited 11550# >73 byte&0x02 0x02 \b, changed 11551# >73 byte&0x04 0x04 \b, busy 11552# >73 byte&0x08 0x08 \b, bozo 11553# >73 byte&0x10 0x10 \b, system 11554# >73 byte&0x10 0x20 \b, bundle 11555# >73 byte&0x10 0x40 \b, invisible 11556# >73 byte&0x10 0x80 \b, locked 11557 11558#>65 string x \b, type "%4.4s" 11559 11560#>65 string 8BIM (PhotoShop) 11561#>65 string ALB3 (PageMaker 3) 11562#>65 string ALB4 (PageMaker 4) 11563#>65 string ALT3 (PageMaker 3) 11564#>65 string APPL (application) 11565#>65 string AWWP (AppleWorks word processor) 11566#>65 string CIRC (simulated circuit) 11567#>65 string DRWG (MacDraw) 11568#>65 string EPSF (Encapsulated PostScript) 11569#>65 string FFIL (font suitcase) 11570#>65 string FKEY (function key) 11571#>65 string FNDR (Macintosh Finder) 11572#>65 string GIFf (GIF image) 11573#>65 string Gzip (GNU gzip) 11574#>65 string INIT (system extension) 11575#>65 string LIB\ (library) 11576#>65 string LWFN (PostScript font) 11577#>65 string MSBC (Microsoft BASIC) 11578#>65 string PACT (Compact Pro archive) 11579#>65 string PDF\ (Portable Document Format) 11580#>65 string PICT (picture) 11581#>65 string PNTG (MacPaint picture) 11582#>65 string PREF (preferences) 11583#>65 string PROJ (Think C project) 11584#>65 string QPRJ (Think Pascal project) 11585#>65 string SCFL (Defender scores) 11586#>65 string SCRN (startup screen) 11587#>65 string SITD (StuffIt Deluxe) 11588#>65 string SPn3 (SuperPaint) 11589#>65 string STAK (HyperCard stack) 11590#>65 string Seg\ (StuffIt segment) 11591#>65 string TARF (Unix tar archive) 11592#>65 string TEXT (ASCII) 11593#>65 string TIFF (TIFF image) 11594#>65 string TOVF (Eudora table of contents) 11595#>65 string WDBN (Microsoft Word word processor) 11596#>65 string WORD (MacWrite word processor) 11597#>65 string XLS\ (Microsoft Excel) 11598#>65 string ZIVM (compress (.Z)) 11599#>65 string ZSYS (Pre-System 7 system file) 11600#>65 string acf3 (Aldus FreeHand) 11601#>65 string cdev (control panel) 11602#>65 string dfil (Desk Acessory suitcase) 11603#>65 string libr (library) 11604#>65 string nX^d (WriteNow word processor) 11605#>65 string nX^w (WriteNow dictionary) 11606#>65 string rsrc (resource) 11607#>65 string scbk (Scrapbook) 11608#>65 string shlb (shared library) 11609#>65 string ttro (SimpleText read-only) 11610#>65 string zsys (system file) 11611 11612#>69 string x \b, creator "%4.4s" 11613 11614# Somewhere, Apple has a repository of registered Creator IDs. These are 11615# just the ones that I happened to have files from and was able to identify. 11616 11617#>69 string 8BIM (Adobe Photoshop) 11618#>69 string ALD3 (PageMaker 3) 11619#>69 string ALD4 (PageMaker 4) 11620#>69 string ALFA (Alpha editor) 11621#>69 string APLS (Apple Scanner) 11622#>69 string APSC (Apple Scanner) 11623#>69 string BRKL (Brickles) 11624#>69 string BTFT (BitFont) 11625#>69 string CCL2 (Common Lisp 2) 11626#>69 string CCL\ (Common Lisp) 11627#>69 string CDmo (The Talking Moose) 11628#>69 string CPCT (Compact Pro) 11629#>69 string CSOm (Eudora) 11630#>69 string DMOV (Font/DA Mover) 11631#>69 string DSIM (DigSim) 11632#>69 string EDIT (Macintosh Edit) 11633#>69 string ERIK (Macintosh Finder) 11634#>69 string EXTR (self-extracting archive) 11635#>69 string Gzip (GNU gzip) 11636#>69 string KAHL (Think C) 11637#>69 string LWFU (LaserWriter Utility) 11638#>69 string LZIV (compress) 11639#>69 string MACA (MacWrite) 11640#>69 string MACS (Macintosh operating system) 11641#>69 string MAcK (MacKnowledge terminal emulator) 11642#>69 string MLND (Defender) 11643#>69 string MPNT (MacPaint) 11644#>69 string MSBB (Microsoft BASIC (binary)) 11645#>69 string MSWD (Microsoft Word) 11646#>69 string NCSA (NCSA Telnet) 11647#>69 string PJMM (Think Pascal) 11648#>69 string PSAL (Hunt the Wumpus) 11649#>69 string PSI2 (Apple File Exchange) 11650#>69 string R*ch (BBEdit) 11651#>69 string RMKR (Resource Maker) 11652#>69 string RSED (Resource Editor) 11653#>69 string Rich (BBEdit) 11654#>69 string SIT! (StuffIt) 11655#>69 string SPNT (SuperPaint) 11656#>69 string Unix (NeXT Mac filesystem) 11657#>69 string VIM! (Vim editor) 11658#>69 string WILD (HyperCard) 11659#>69 string XCEL (Microsoft Excel) 11660#>69 string aCa2 (Fontographer) 11661#>69 string aca3 (Aldus FreeHand) 11662#>69 string dosa (Macintosh MS-DOS file system) 11663#>69 string movr (Font/DA Mover) 11664#>69 string nX^n (WriteNow) 11665#>69 string pdos (Apple ProDOS file system) 11666#>69 string scbk (Scrapbook) 11667#>69 string ttxt (SimpleText) 11668#>69 string ufox (Foreign File Access) 11669 11670# Just in case... 11671 11672102 string mBIN MacBinary III data with surprising version number 11673 11674# sas magic from Bruce Foster (bef@nwu.edu) 11675# 11676#0 string SAS SAS 11677#>8 string x %s 116780 string SAS SAS 11679>24 string DATA data file 11680>24 string CATALOG catalog 11681>24 string INDEX data file index 11682>24 string VIEW data view 11683# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 11684# 116850x54 string SAS SAS 7+ 11686>0x9C string DATA data file 11687>0x9C string CATALOG catalog 11688>0x9C string INDEX data file index 11689>0x9C string VIEW data view 11690 11691# spss magic for SPSS system and portable files, 11692# from Bruce Foster (bef@nwu.edu). 11693 116940 long 0xc1e2c3c9 SPSS Portable File 11695>40 string x %s 11696 116970 string $FL2 SPSS System File 11698>24 string x %s 11699 11700# Macintosh filesystem data 11701# From "Tom N Harris" <telliamed@mac.com> 11702# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 11703# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 11704# entries depend on the data arithmetic added after v.35 11705# There's also some Pascal strings in here, ditto... 11706 11707# The boot block signature, according to IM:Files, is 11708# "for HFS volumes, this field always contains the value 0x4C4B." 11709# But if this is true for MFS or HFS+ volumes, I don't know. 11710# Alternatively, the boot block is supposed to be zeroed if it's 11711# unused, so a simply >0 should suffice. 11712 117130x400 beshort 0xD2D7 Macintosh MFS data 11714>0 beshort 0x4C4B (bootable) 11715>0x40a beshort &0x8000 (locked) 11716>0x402 beldate-0x7C25B080 x created: %s, 11717>0x406 beldate-0x7C25B080 >0 last backup: %s, 11718>0x414 belong x block size: %d, 11719>0x412 beshort x number of blocks: %d, 11720>0x424 pstring x volume name: %s 11721 11722# "BD" is has many false positives 11723#0x400 beshort 0x4244 Macintosh HFS data 11724#>0 beshort 0x4C4B (bootable) 11725#>0x40a beshort &0x8000 (locked) 11726#>0x40a beshort ^0x0100 (mounted) 11727#>0x40a beshort &0x0200 (spared blocks) 11728#>0x40a beshort &0x0800 (unclean) 11729#>0x47C beshort 0x482B (Embedded HFS+ Volume) 11730#>0x402 beldate-0x7C25B080 x created: %s, 11731#>0x406 beldate-0x7C25B080 x last modified: %s, 11732#>0x440 beldate-0x7C25B080 >0 last backup: %s, 11733#>0x414 belong x block size: %d, 11734#>0x412 beshort x number of blocks: %d, 11735#>0x424 pstring x volume name: %s 11736 117370x400 beshort 0x482B Macintosh HFS Extended 11738>&0 beshort x version %d data 11739>0 beshort 0x4C4B (bootable) 11740>0x404 belong ^0x00000100 (mounted) 11741>&2 belong &0x00000200 (spared blocks) 11742>&2 belong &0x00000800 (unclean) 11743>&2 belong &0x00008000 (locked) 11744>&6 string x last mounted by: '%.4s', 11745# really, that should be treated as a belong and we print a string 11746# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 11747>&14 beldate-0x7C25B080 x created: %s, 11748# only the creation date is local time, all other timestamps in HFS+ are UTC. 11749>&18 bedate-0x7C25B080 x last modified: %s, 11750>&22 bedate-0x7C25B080 >0 last backup: %s, 11751>&26 bedate-0x7C25B080 >0 last checked: %s, 11752>&38 belong x block size: %d, 11753>&42 belong x number of blocks: %d, 11754>&46 belong x free blocks: %d 11755 11756# I don't think this is really necessary since it doesn't do much and 11757# anything with a valid driver descriptor will also have a valid 11758# partition map 11759#0 beshort 0x4552 Apple Device Driver data 11760#>&24 beshort =1 \b, MacOS 11761 11762# Is that the partition type a cstring or a pstring? Well, IM says "strings 11763# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 11764# cstring. Of course, partitions can contain more than four entries, but 11765# what're you gonna do? 11766# GRR: This magic is too weak, it is just "PM" 11767#0x200 beshort 0x504D Apple Partition data 11768#>0x2 beshort x (block size: %d): 11769#>0x230 string x first type: %s, 11770#>0x210 string x name: %s, 11771#>0x254 belong x number of blocks: %d, 11772#>0x400 beshort 0x504D 11773#>>0x430 string x second type: %s, 11774#>>0x410 string x name: %s, 11775#>>0x454 belong x number of blocks: %d, 11776#>>0x600 beshort 0x504D 11777#>>>0x630 string x third type: %s, 11778#>>>0x610 string x name: %s, 11779#>>>0x654 belong x number of blocks: %d, 11780#>>0x800 beshort 0x504D 11781#>>>0x830 string x fourth type: %s, 11782#>>>0x810 string x name: %s, 11783#>>>0x854 belong x number of blocks: %d, 11784#>>>0xa00 beshort 0x504D 11785#>>>>0xa30 string x fifth type: %s, 11786#>>>>0xa10 string x name: %s, 11787#>>>>0xa54 belong x number of blocks: %d 11788#>>>0xc00 beshort 0x504D 11789#>>>>0xc30 string x sixth type: %s, 11790#>>>>0xc10 string x name: %s, 11791#>>>>0xc54 belong x number of blocks: %d 11792## AFAIK, only the signature is different 11793#0x200 beshort 0x5453 Apple Old Partition data 11794#>0x2 beshort x block size: %d, 11795#>0x230 string x first type: %s, 11796#>0x210 string x name: %s, 11797#>0x254 belong x number of blocks: %d, 11798#>0x400 beshort 0x504D 11799#>>0x430 string x second type: %s, 11800#>>0x410 string x name: %s, 11801#>>0x454 belong x number of blocks: %d, 11802#>>0x800 beshort 0x504D 11803#>>>0x830 string x third type: %s, 11804#>>>0x810 string x name: %s, 11805#>>>0x854 belong x number of blocks: %d, 11806#>>>0xa00 beshort 0x504D 11807#>>>>0xa30 string x fourth type: %s, 11808#>>>>0xa10 string x name: %s, 11809#>>>>0xa54 belong x number of blocks: %d 11810 11811# From: Remi Mommsen <mommsen@slac.stanford.edu> 118120 string BOMStore Mac OS X bill of materials (BOM) file 11813 11814#------------------------------------------------------------------------------ 11815# $File: magic,v 1.9 2009/09/19 16:28:10 christos Exp $ 11816# magic: file(1) magic for magic files 11817# 118180 string #\ Magic magic text file for file(1) cmd 118190 lelong 0xF11E041C magic binary file for file(1) cmd 11820>4 lelong x (version %d) (little endian) 118210 belong 0xF11E041C magic binary file for file(1) cmd 11822>4 belong x (version %d) (big endian) 11823 11824#------------------------------------------------------------------------------ 11825# $File: mail.news,v 1.17 2009/09/19 16:28:10 christos Exp $ 11826# mail.news: file(1) magic for mail and news 11827# 11828# Unfortunately, saved netnews also has From line added in some news software. 11829#0 string From mail text 11830# There are tests to ascmagic.c to cope with mail and news. 118310 string Relay-Version: old news text 11832!:mime message/rfc822 118330 string #!\ rnews batched news text 11834!:mime message/rfc822 118350 string N#!\ rnews mailed, batched news text 11836!:mime message/rfc822 118370 string Forward\ to mail forwarding text 11838!:mime message/rfc822 118390 string Pipe\ to mail piping text 11840!:mime message/rfc822 118410 string Return-Path: smtp mail text 11842!:mime message/rfc822 118430 string Path: news text 11844!:mime message/news 118450 string Xref: news text 11846!:mime message/news 118470 string From: news or mail text 11848!:mime message/rfc822 118490 string Article saved news text 11850!:mime message/news 118510 string BABYL Emacs RMAIL text 118520 string Received: RFC 822 mail text 11853!:mime message/rfc822 118540 string MIME-Version: MIME entity text 11855#0 string Content- MIME entity text 11856 11857# TNEF files... 118580 lelong 0x223E9F78 Transport Neutral Encapsulation Format 11859 11860# From: Kevin Sullivan <ksulliva@psc.edu> 118610 string *mbx* MBX mail folder 11862 11863# From: Simon Matter <simon.matter@invoca.ch> 118640 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 11865 11866# JAM(mbp) Fidonet message area databases 11867# JHR file 118680 string JAM\0 JAM message area header file 11869>12 leshort >0 (%d messages) 11870 11871# Squish Fidonet message area databases 11872# SQD file (requires at least one message in the area) 11873# XXX: Weak magic 11874#256 leshort 0xAFAE4453 Squish message area data file 11875#>4 leshort >0 (%d messages) 11876 11877#0 string \<!--\ MHonArc text/html; x-type=mhonarc 11878 11879#------------------------------------------------------------------------------ 11880# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $ 11881# maple: file(1) magic for maple files 11882# "H. Nanosecond" <aldomel@ix.netcom.com> 11883# Maple V release 4, a multi-purpose math program 11884# 11885 11886# maple library .lib 118870 string \000MVR4\nI MapleVr4 library 11888 11889# .ind 11890# no magic for these :-( 11891# they are compiled indexes for maple files 11892 11893# .hdb 118940 string \000\004\000\000 Maple help database 11895 11896# .mhp 11897# this has the form <PACKAGE=name> 118980 string \<PACKAGE= Maple help file 118990 string \<HELP\ NAME= Maple help file 119000 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 11901#0 string #\ Newton Maple help file, old style 119020 string #\ daub Maple help file, old style 11903#0 string #=========== Maple help file, old style 11904 11905# .mws 119060 string \000\000\001\044\000\221 Maple worksheet 11907#this is anomalous 119080 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 11909# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 11910# that is {VERSION major_version miunor_version computer_type version_string} 119110 string {VERSION\ Maple worksheet 11912>9 string >\0 version %.1s. 11913>>>11 string >\0 %.1s 11914 11915# .mps 119160 string \0\0\001$ Maple something 11917# from byte 4 it is either 'nul E' or 'soh R' 11918# I think 'nul E' means a file that was saved as a different name 11919# a sort of revision marking 11920# 'soh R' means new 11921>4 string \000\105 An old revision 11922>4 string \001\122 The latest save 11923 11924# .mpl 11925# some of these are the same as .mps above 11926#0000000 000 000 001 044 000 105 same as .mps 11927#0000000 000 000 001 044 001 122 same as .mps 11928 119290 string #\n##\ <SHAREFILE= Maple something 119300 string \n#\n##\ <SHAREFILE= Maple something 119310 string ##\ <SHAREFILE= Maple something 119320 string #\r##\ <SHAREFILE= Maple something 119330 string \r#\r##\ <SHAREFILE= Maple something 119340 string #\ \r##\ <DESCRIBE> Maple something anomalous. 11935 11936#------------------------------------------------------------------------------ 11937# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 11938# mathcad: file(1) magic for Mathcad documents 11939# URL: http://www.mathsoft.com/ 11940# From: Josh Triplett <josh@freedesktop.org> 11941 119420 string .MCAD\t Mathcad document 11943 11944#------------------------------------------------------------------------------ 11945# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ 11946# mathematica: file(1) magic for mathematica files 11947# "H. Nanosecond" <aldomel@ix.netcom.com> 11948# Mathematica a multi-purpose math program 11949# versions 2.2 and 3.0 11950 11951#mathematica .mb 119520 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 119530 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 11954 11955# .ma 11956# multiple possibilites: 11957 119580 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 11959#>41 string >\0 %s 11960 11961#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 11962 11963#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 11964#>675 string >\0 %s #doesn't work well 11965 11966# there may be 'cr' instread of 'nl' in some does this matter? 11967 11968# generic: 119690 string (*^\r\r::[\011 Mathematica notebook version 2.x 119700 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 119710 string (*^\015 Mathematica notebook version 2.x 119720 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 119730 string (*^\r::[\011 Mathematica notebook version 2.x 119740 string (*^\r\n::[\011 Mathematica notebook version 2.x 119750 string (*^\n\n::[\011 Mathematica notebook version 2.x 119760 string (*^\n::[\011 Mathematica notebook version 2.x 11977 11978 11979# Mathematica .mx files 11980 11981#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 119820 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 11983#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 11984# >71... is optional 11985>88 string >\0 from %s 11986 11987 11988# Mathematica files PBF: 11989# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 119900 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 11991 11992# .ml files These are menu resources I think 11993# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 11994# how to put that into a magic rule? 119954 string \ A~ MAthematica .ml file 11996 11997# .nb files 11998#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 119990 string (*********************** Mathematica 3.0 notebook 12000 12001# other (* matches it is a comment start in these langs 12002# GRR: Too weak; also matches other languages e.g. ML 12003#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 12004 12005######################### 12006# MatLab v5 120070 string MATLAB Matlab v5 mat-file 12008>126 short 0x494d (big endian) 12009>>124 beshort x version 0x%04x 12010>126 short 0x4d49 (little endian) 12011>>124 leshort x version 0x%04x 12012 12013 12014#------------------------------------------------------------------------------ 12015# $File: matroska,v 1.5 2009/09/27 19:02:12 christos Exp $ 12016# matroska: file(1) magic for Matroska files 12017# 12018# See http://www.matroska.org/ 12019# 12020 12021# EBML id: 120220 belong 0x1a45dfa3 12023# DocType id: 12024>5 beshort 0x4282 12025# DocType contents: 12026>>8 string matroska Matroska data 12027!:mime video/x-matroska 12028 12029# EBML id: 120300 belong 0x1a45dfa3 12031# DocType id: 12032>0 search/4096 \x42\x82 12033# DocType contents: 12034>>&1 string webm WebM 12035!:mime video/webm 12036 12037#------------------------------------------------------------------------------ 12038# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 12039# Mavroyanopoulos Nikos <nmav@hellug.gr> 12040# mcrypt: file(1) magic for mcrypt 2.2.x; 120410 string \0m\3 mcrypt 2.5 encrypted data, 12042>4 string >\0 algorithm: %s, 12043>>&1 leshort >0 keysize: %d bytes, 12044>>>&0 string >\0 mode: %s, 12045 120460 string \0m\2 mcrypt 2.2 encrypted data, 12047>3 byte 0 algorithm: blowfish-448, 12048>3 byte 1 algorithm: DES, 12049>3 byte 2 algorithm: 3DES, 12050>3 byte 3 algorithm: 3-WAY, 12051>3 byte 4 algorithm: GOST, 12052>3 byte 6 algorithm: SAFER-SK64, 12053>3 byte 7 algorithm: SAFER-SK128, 12054>3 byte 8 algorithm: CAST-128, 12055>3 byte 9 algorithm: xTEA, 12056>3 byte 10 algorithm: TWOFISH-128, 12057>3 byte 11 algorithm: RC2, 12058>3 byte 12 algorithm: TWOFISH-192, 12059>3 byte 13 algorithm: TWOFISH-256, 12060>3 byte 14 algorithm: blowfish-128, 12061>3 byte 15 algorithm: blowfish-192, 12062>3 byte 16 algorithm: blowfish-256, 12063>3 byte 100 algorithm: RC6, 12064>3 byte 101 algorithm: IDEA, 12065>4 byte 0 mode: CBC, 12066>4 byte 1 mode: ECB, 12067>4 byte 2 mode: CFB, 12068>4 byte 3 mode: OFB, 12069>4 byte 4 mode: nOFB, 12070>5 byte 0 keymode: 8bit 12071>5 byte 1 keymode: 4bit 12072>5 byte 2 keymode: SHA-1 hash 12073>5 byte 3 keymode: MD5 hash 12074 12075#------------------------------------------------------------------------------ 12076# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 12077# mercurial: file(1) magic for Mercurial changeset bundles 12078# http://www.selenic.com/mercurial/wiki/ 12079# 12080# Jesse Glick (jesse.glick@sun.com) 12081# 12082 120830 string HG10 Mercurial changeset bundle 12084>4 string UN (uncompressed) 12085>4 string GZ (gzip compressed) 12086>4 string BZ (bzip2 compressed) 12087 12088#------------------------------------------------------------------------------ 12089# $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $ 12090# mime: file(1) magic for MIME encoded files 12091# 120920 string Content-Type:\ 12093>14 string >\0 %s 120940 string Content-Type: 12095>13 string >\0 %s 12096 12097#------------------------------------------------------------------------------ 12098# $File: mips,v 1.5 2009/09/19 16:28:10 christos Exp $ 12099# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) 12100# Dec Ultrix (MIPS) 12101# all of SGI's *current* machines and OSes run in big-endian mode on the 12102# MIPS machines, as far as I know. 12103# 12104# XXX - what is the blank "-" line? 12105# 12106# kbd file definitions 121070 string kbd!map kbd map file 12108>8 byte >0 Ver %d: 12109>10 short >0 with %d table(s) 121100 belong 0407 old SGI 68020 executable 121110 belong 0410 old SGI 68020 pure executable 121120 beshort 0x8765 disk quotas file 121130 beshort 0x0506 IRIS Showcase file 12114>2 byte 0x49 - 12115>3 byte x - version %ld 121160 beshort 0x0226 IRIS Showcase template 12117>2 byte 0x63 - 12118>3 byte x - version %ld 121190 belong 0x5343464d IRIS Showcase file 12120>4 byte x - version %ld 121210 belong 0x5443464d IRIS Showcase template 12122>4 byte x - version %ld 121230 belong 0xdeadbabe IRIX Parallel Arena 12124>8 belong >0 - version %ld 12125# 121260 beshort 0x0160 MIPSEB ECOFF executable 12127>20 beshort 0407 (impure) 12128>20 beshort 0410 (swapped) 12129>20 beshort 0413 (paged) 12130>8 belong >0 not stripped 12131>8 belong 0 stripped 12132>22 byte x - version %ld 12133>23 byte x .%ld 12134# 121350 beshort 0x0162 MIPSEL-BE ECOFF executable 12136>20 beshort 0407 (impure) 12137>20 beshort 0410 (swapped) 12138>20 beshort 0413 (paged) 12139>8 belong >0 not stripped 12140>8 belong 0 stripped 12141>23 byte x - version %d 12142>22 byte x .%ld 12143# 121440 beshort 0x6001 MIPSEB-LE ECOFF executable 12145>20 beshort 03401 (impure) 12146>20 beshort 04001 (swapped) 12147>20 beshort 05401 (paged) 12148>8 belong >0 not stripped 12149>8 belong 0 stripped 12150>23 byte x - version %d 12151>22 byte x .%ld 12152# 121530 beshort 0x6201 MIPSEL ECOFF executable 12154>20 beshort 03401 (impure) 12155>20 beshort 04001 (swapped) 12156>20 beshort 05401 (paged) 12157>8 belong >0 not stripped 12158>8 belong 0 stripped 12159>23 byte x - version %ld 12160>22 byte x .%ld 12161# 12162# MIPS 2 additions 12163# 121640 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 12165>20 beshort 0407 (impure) 12166>20 beshort 0410 (swapped) 12167>20 beshort 0413 (paged) 12168>8 belong >0 not stripped 12169>8 belong 0 stripped 12170>22 byte x - version %ld 12171>23 byte x .%ld 12172# 121730 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 12174>20 beshort 0407 (impure) 12175>20 beshort 0410 (swapped) 12176>20 beshort 0413 (paged) 12177>8 belong >0 not stripped 12178>8 belong 0 stripped 12179>22 byte x - version %ld 12180>23 byte x .%ld 12181# 121820 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 12183>20 beshort 03401 (impure) 12184>20 beshort 04001 (swapped) 12185>20 beshort 05401 (paged) 12186>8 belong >0 not stripped 12187>8 belong 0 stripped 12188>23 byte x - version %ld 12189>22 byte x .%ld 12190# 121910 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 12192>20 beshort 03401 (impure) 12193>20 beshort 04001 (swapped) 12194>20 beshort 05401 (paged) 12195>8 belong >0 not stripped 12196>8 belong 0 stripped 12197>23 byte x - version %ld 12198>22 byte x .%ld 12199# 12200# MIPS 3 additions 12201# 122020 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 12203>20 beshort 0407 (impure) 12204>20 beshort 0410 (swapped) 12205>20 beshort 0413 (paged) 12206>8 belong >0 not stripped 12207>8 belong 0 stripped 12208>22 byte x - version %ld 12209>23 byte x .%ld 12210# 122110 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 12212>20 beshort 0407 (impure) 12213>20 beshort 0410 (swapped) 12214>20 beshort 0413 (paged) 12215>8 belong >0 not stripped 12216>8 belong 0 stripped 12217>22 byte x - version %ld 12218>23 byte x .%ld 12219# 122200 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 12221>20 beshort 03401 (impure) 12222>20 beshort 04001 (swapped) 12223>20 beshort 05401 (paged) 12224>8 belong >0 not stripped 12225>8 belong 0 stripped 12226>23 byte x - version %ld 12227>22 byte x .%ld 12228# 122290 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 12230>20 beshort 03401 (impure) 12231>20 beshort 04001 (swapped) 12232>20 beshort 05401 (paged) 12233>8 belong >0 not stripped 12234>8 belong 0 stripped 12235>23 byte x - version %ld 12236>22 byte x .%ld 12237# 122380 beshort 0x180 MIPSEB Ucode 122390 beshort 0x182 MIPSEL-BE Ucode 12240# 32bit core file 122410 belong 0xdeadadb0 IRIX core dump 12242>4 belong 1 of 12243>16 string >\0 '%s' 12244# 64bit core file 122450 belong 0xdeadad40 IRIX 64-bit core dump 12246>4 belong 1 of 12247>16 string >\0 '%s' 12248# N32bit core file 122490 belong 0xbabec0bb IRIX N32 core dump 12250>4 belong 1 of 12251>16 string >\0 '%s' 12252# New style crash dump file 122530 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 12254>36 string >\0 '%s' 12255# Trusted IRIX info 122560 string SGIAUDIT SGI Audit file 12257>8 byte x - version %d 12258>9 byte x .%ld 12259# 122600 string WNGZWZSC Wingz compiled script 122610 string WNGZWZSS Wingz spreadsheet 122620 string WNGZWZHP Wingz help file 12263# 122640 string #Inventor V IRIS Inventor 1.0 file 122650 string #Inventor V2 Open Inventor 2.0 file 12266# GLF is OpenGL stream encoding 122670 string glfHeadMagic(); GLF_TEXT 122684 belong 0x7d000000 GLF_BINARY_LSB_FIRST 122694 belong 0x0000007d GLF_BINARY_MSB_FIRST 12270# GLS is OpenGL stream encoding; GLS is the successor of GLF 122710 string glsBeginGLS( GLS_TEXT 122724 belong 0x10000000 GLS_BINARY_LSB_FIRST 122734 belong 0x00000010 GLS_BINARY_MSB_FIRST 12274 12275#------------------------------------------------------------------------------ 12276# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 12277# mirage: file(1) magic for Mirage executables 12278# 12279# XXX - byte order? 12280# 122810 long 31415 Mirage Assembler m.out executable 12282 12283#----------------------------------------------------------------------------- 12284# $File: misctools,v 1.10 2009/09/19 16:28:10 christos Exp $ 12285# misctools: file(1) magic for miscellaneous UNIX tools. 12286# 122870 search/1 %%!! X-Post-It-Note text 122880 string/c BEGIN:VCALENDAR vCalendar calendar file 122890 string/c BEGIN:VCARD vCard visiting card 12290!:mime text/x-vcard 12291 12292# From: Alex Beregszaszi <alex@fsn.hu> 122934 string gtktalog GNOME Catalogue (gtktalog) 12294>13 string >\0 version %s 12295 12296# Summary: Libtool library file 12297# Extension: .la 12298# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 122990 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 12300 12301# Summary: Libtool object file 12302# Extension: .lo 12303# Submitted by: Abel Cheung <abelcheung@gmail.com> 123040 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 12305 12306# From: Daniel Novotny <dnovotny@redhat.com> 123070 string MDMP\x93\xA7 MDMP crash report data 12308 12309#----------------------------------------------------------------------------- 12310# $File: misctools,v 1.10 2009/09/19 16:28:10 christos Exp $ 12311# misctools: file(1) magic for miscellaneous UNIX tools. 12312# 123130 search/1 %%!! X-Post-It-Note text 123140 string/c BEGIN:VCALENDAR vCalendar calendar file 123150 string/c BEGIN:VCARD vCard visiting card 12316!:mime text/x-vcard 12317 12318# From: Alex Beregszaszi <alex@fsn.hu> 123194 string gtktalog GNOME Catalogue (gtktalog) 12320>13 string >\0 version %s 12321 12322# Summary: Libtool library file 12323# Extension: .la 12324# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 123250 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 12326 12327# Summary: Libtool object file 12328# Extension: .lo 12329# Submitted by: Abel Cheung <abelcheung@gmail.com> 123300 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 12331 12332#------------------------------------------------------------------------------ 12333# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 12334# mkid: file(1) magic for mkid(1) databases 12335# 12336# ID is the binary tags database produced by mkid(1). 12337# 12338# XXX - byte order? 12339# 123400 string \311\304 ID tags data 12341>2 short >0 version %d 12342 12343#------------------------------------------------------------------------------ 12344# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 12345# mlssa: file(1) magic for MLSSA datafiles 12346# 123470 lelong 0xffffabcd MLSSA datafile, 12348>4 leshort x algorithm %d, 12349>10 lelong x %d samples 12350 12351#------------------------------------------------------------------------------ 12352# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 12353# mmdf: file(1) magic for MMDF mail files 12354# 123550 string \001\001\001\001 MMDF mailbox 12356 12357#------------------------------------------------------------------------------ 12358# $File: modem,v 1.4 2009/09/19 16:28:10 christos Exp $ 12359# modem: file(1) magic for modem programs 12360# 12361# From: Florian La Roche <florian@knorke.saar.de> 123624 string Research, Digifax-G3-File 12363>29 byte 1 , fine resolution 12364>29 byte 0 , normal resolution 12365 123660 short 0x0100 raw G3 data, byte-padded 123670 short 0x1400 raw G3 data 12368# 12369# Magic data for vgetty voice formats 12370# (Martin Seine & Marc Eberhard) 12371 12372# 12373# raw modem data version 1 12374# 123750 string RMD1 raw modem data 12376>4 string >\0 (%s / 12377>20 short >0 compression type 0x%04x) 12378 12379# 12380# portable voice format 1 12381# 123820 string PVF1\n portable voice format 12383>5 string >\0 (binary %s) 12384 12385# 12386# portable voice format 2 12387# 123880 string PVF2\n portable voice format 12389>5 string >\0 (ascii %s) 12390 12391 12392#------------------------------------------------------------------------------ 12393# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ 12394# motorola: file(1) magic for Motorola 68K and 88K binaries 12395# 12396# 68K 12397# 123980 beshort 0520 mc68k COFF 12399>18 beshort ^00000020 object 12400>18 beshort &00000020 executable 12401>12 belong >0 not stripped 12402>168 string .lowmem Apple toolbox 12403>20 beshort 0407 (impure) 12404>20 beshort 0410 (pure) 12405>20 beshort 0413 (demand paged) 12406>20 beshort 0421 (standalone) 124070 beshort 0521 mc68k executable (shared) 12408>12 belong >0 not stripped 124090 beshort 0522 mc68k executable (shared demand paged) 12410>12 belong >0 not stripped 12411# 12412# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 12413# 124140 beshort 0554 68K BCS executable 12415# 12416# 88K 12417# 12418# Motorola/88Open BCS 12419# 124200 beshort 0555 88K BCS executable 12421# 12422# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 124230 string S0 Motorola S-Record; binary data in text format 12424 12425# ATARI ST relocatable PRG 12426# 12427# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 12428# (according to Roland Waldi, Oct 21, 1987) 12429# besides the magic 0x601a, the text segment size is checked to be 12430# not larger than 1 MB (which is a lot on ST). 12431# The additional 0x601b distinction I took from Doug Lee's magic. 124320 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 12433>2 belong x (txt=%ld, 12434>6 belong x dat=%ld, 12435>10 belong x bss=%ld, 12436>14 belong x sym=%ld) 124370 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 12438>2 belong x (txt=%ld, 12439>6 belong x dat=%ld, 12440>10 belong x bss=%ld, 12441>14 belong x sym=%ld) 12442 12443# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 124440 beshort 0x601A Atari 68xxx executable, 12445>2 belong x text len %lu, 12446>6 belong x data len %lu, 12447>10 belong x BSS len %lu, 12448>14 belong x symboltab len %lu, 12449>18 belong 0 12450>22 belong &0x01 fastload flag, 12451>22 belong &0x02 may be loaded to alternate RAM, 12452>22 belong &0x04 malloc may be from alternate RAM, 12453>22 belong x flags: 0x%lX, 12454>26 beshort 0 no relocation tab 12455>26 beshort !0 + relocation tab 12456>30 string SFX [Self-Extracting LZH SFX archive] 12457>38 string SFX [Self-Extracting LZH SFX archive] 12458>44 string ZIP! [Self-Extracting ZIP SFX archive] 12459 124600 beshort 0x0064 Atari 68xxx CPX file 12461>8 beshort x (version %04lx) 12462 12463#------------------------------------------------------------------------------ 12464# $File: mozilla,v 1.4 2009/09/19 16:28:11 christos Exp $ 12465# mozilla: file(1) magic for Mozilla XUL fastload files 12466# (XUL.mfasl and XPC.mfasl) 12467# URL: http://www.mozilla.org/ 12468# From: Josh Triplett <josh@freedesktop.org> 12469 124700 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 12471 12472#------------------------------------------------------------------------------ 12473# $File: msdos,v 1.65 2009/09/19 16:28:11 christos Exp $ 12474# msdos: file(1) magic for MS-DOS files 12475# 12476 12477# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 12478# updated by Joerg Jenderek at Oct 2008 124790 string @ 12480>1 string/cW \ echo\ off DOS batch file text 12481!:mime text/x-msdos-batch 12482>1 string/cW echo\ off DOS batch file text 12483!:mime text/x-msdos-batch 12484>1 string/cW rem\ DOS batch file text 12485!:mime text/x-msdos-batch 12486>1 string/cW set\ DOS batch file text 12487!:mime text/x-msdos-batch 12488 12489 12490# OS/2 batch files are REXX. the second regex is a bit generic, oh well 12491# the matched commands seem to be common in REXX and uncommon elsewhere 12492100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 12493100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 12494 124950 leshort 0x14c MS Windows COFF Intel 80386 object file 12496#>4 ledate x stamp %s 124970 leshort 0x166 MS Windows COFF MIPS R4000 object file 12498#>4 ledate x stamp %s 124990 leshort 0x184 MS Windows COFF Alpha object file 12500#>4 ledate x stamp %s 125010 leshort 0x268 MS Windows COFF Motorola 68000 object file 12502#>4 ledate x stamp %s 125030 leshort 0x1f0 MS Windows COFF PowerPC object file 12504#>4 ledate x stamp %s 125050 leshort 0x290 MS Windows COFF PA-RISC object file 12506#>4 ledate x stamp %s 12507 12508# XXX - according to Microsoft's spec, at an offset of 0x3c in a 12509# PE-format executable is the offset in the file of the PE header; 12510# unfortunately, that's a little-endian offset, and there's no way 12511# to specify an indirect offset with a specified byte order. 12512# So, for now, we assume the standard MS-DOS stub, which puts the 12513# PE header at 0x80 = 128. 12514# 12515# Required OS version and subsystem version were 4.0 on some NT 3.51 12516# executables built with Visual C++ 4.0, so it's not clear that 12517# they're interesting. The user version was 0.0, but there's 12518# probably some linker directive to set it. The linker version was 12519# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). 12520# 12521# many of the compressed formats were extraced from IDARC 1.23 source code 12522# 125230 string MZ 12524!:mime application/x-dosexec 12525>0x18 leshort <0x40 MS-DOS executable 12526>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows 12527>>&18 leshort&0x2000 >0 (DLL) 12528>>&88 leshort 0 (unknown subsystem) 12529>>&88 leshort 1 (native) 12530>>&88 leshort 2 (GUI) 12531>>&88 leshort 3 (console) 12532>>&88 leshort 7 (POSIX) 12533>>&0 leshort 0x0 unknown processor 12534>>&0 leshort 0x14c Intel 80386 12535>>&0 leshort 0x166 MIPS R4000 12536>>&0 leshort 0x184 Alpha 12537>>&0 leshort 0x268 Motorola 68000 12538>>&0 leshort 0x1f0 PowerPC 12539>>&0 leshort 0x290 PA-RISC 12540>>&18 leshort&0x0100 >0 32-bit 12541>>&18 leshort&0x1000 >0 system file 12542>>&0xf4 search/0x140 \x0\x40\x1\x0 12543>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 12544>30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 12545!:mime application/zip 12546# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. 12547>30 string PKLITE\ Copr. Self-extracting PKZIP archive 12548!:mime application/zip 12549 12550>0x18 leshort >0x3f 12551>>(0x3c.l) string PE\0\0 PE 12552>>>(0x3c.l+25) byte 1 \b32 executable 12553>>>(0x3c.l+25) byte 2 \b32+ executable 12554# hooray, there's a DOS extender using the PE format, with a valid PE 12555# executable inside (which just prints a message and exits if run in win) 12556>>>(0x3c.l+92) leshort <10 12557>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender 12558>>>>(8.s*16) string !32STUB for MS Windows 12559>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 12560>>>>>(0x3c.l+92) leshort 0 (unknown subsystem) 12561>>>>>(0x3c.l+92) leshort 1 (native) 12562>>>>>(0x3c.l+92) leshort 2 (GUI) 12563>>>>>(0x3c.l+92) leshort 3 (console) 12564>>>>>(0x3c.l+92) leshort 7 (POSIX) 12565>>>(0x3c.l+92) leshort 10 (EFI application) 12566>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 12567>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 12568>>>(0x3c.l+92) leshort 13 (XBOX) 12569>>>(0x3c.l+4) leshort 0x0 unknown processor 12570>>>(0x3c.l+4) leshort 0x14c Intel 80386 12571>>>(0x3c.l+4) leshort 0x166 MIPS R4000 12572>>>(0x3c.l+4) leshort 0x184 Alpha 12573>>>(0x3c.l+4) leshort 0x268 Motorola 68000 12574>>>(0x3c.l+4) leshort 0x1f0 PowerPC 12575>>>(0x3c.l+4) leshort 0x290 PA-RISC 12576>>>(0x3c.l+4) leshort 0x200 Intel Itanium 12577>>>(0x3c.l+22) leshort&0x0100 >0 32-bit 12578>>>(0x3c.l+22) leshort&0x1000 >0 system file 12579>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 12580 12581>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 12582>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 12583>>>>(0x3c.l+0xf8) search/0x140 UPX2 12584>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 12585>>>>(0x3c.l+0xf8) search/0x140 .idata 12586>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 12587>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 12588>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 12589>>>>(0x3c.l+0xf8) search/0x140 .rsrc 12590>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 12591>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 12592>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 12593>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 12594>>>>(0x3c.l+0xf8) search/0x140 .data 12595>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 12596>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 12597>>>>>(0x3c.l+0xf7) byte x 12598>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 12599>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 12600>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 12601>>>>(0x3c.l+0xf8) search/0x140 .reloc 12602>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) 12603 12604>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 12605>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 12606>>>>0x30 string Inno \b, InnoSetup self-extracting archive 12607 12608>>(0x3c.l) string !PE\0\0 MS-DOS executable 12609 12610>>(0x3c.l) string NE \b, NE 12611>>>(0x3c.l+0x36) byte 0 (unknown OS) 12612>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 12613>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 12614>>>(0x3c.l+0x36) byte 3 for MS-DOS 12615>>>(0x3c.l+0x36) byte >3 (unknown OS) 12616>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 12617>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 12618>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 12619>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 12620>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 12621 12622>>(0x3c.l) string LX\0\0 \b, LX 12623>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 12624>>>(0x3c.l+0x0a) leshort 1 for OS/2 12625>>>(0x3c.l+0x0a) leshort 2 for MS Windows 12626>>>(0x3c.l+0x0a) leshort 3 for DOS 12627>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 12628>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 12629>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 12630>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 12631>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 12632>>>(0x3c.l+0x08) leshort 1 i80286 12633>>>(0x3c.l+0x08) leshort 2 i80386 12634>>>(0x3c.l+0x08) leshort 3 i80486 12635>>>(8.s*16) string emx \b, emx 12636>>>>&1 string x %s 12637>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 12638 12639# MS Windows system file, supposedly a collection of LE executables 12640>>(0x3c.l) string W3 \b, W3 for MS Windows 12641 12642>>(0x3c.l) string LE\0\0 \b, LE executable 12643>>>(0x3c.l+0x0a) leshort 1 12644# some DOS extenders use LE files with OS/2 header 12645>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 12646>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 12647>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 12648>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 12649>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 12650>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 12651>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 12652# this is a wild guess; hopefully it is a specific signature 12653>>>>&0x24 lelong <0x50 12654>>>>>(&0x4c.l) string \xfc\xb8WATCOM 12655>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 12656# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 12657#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 12658# fails with DOS-Extenders. 12659>>>(0x3c.l+0x0a) leshort 2 for MS Windows 12660>>>(0x3c.l+0x0a) leshort 3 for DOS 12661>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 12662>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 12663>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 12664 12665# looks like ASCII, probably some embedded copyright message. 12666# and definitely not NE/LE/LX/PE 12667>>0x3c lelong >0x20000000 12668>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 12669# header data too small for extended executable 12670>2 long !0 12671>>0x18 leshort <0x40 12672>>>(4.s*512) leshort !0x014c 12673 12674>>>>&(2.s-514) string !LE 12675>>>>>&-2 string !BW \b, MZ for MS-DOS 12676>>>>&(2.s-514) string LE \b, LE 12677>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 12678# educated guess since indirection is still not capable enough for complex offset 12679# calculations (next embedded executable would be at &(&2*512+&0-2) 12680# I suspect there are only LE executables in these multi-exe files 12681>>>>&(2.s-514) string BW 12682>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) 12683>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS 12684 12685# This sequence skips to the first COFF segment, usually .text 12686>(4.s*512) leshort 0x014c \b, COFF 12687>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 12688>>(8.s*16) string emx 12689>>>&1 string x for DOS, Win or OS/2, emx %s 12690>>&(&0x42.l-3) byte x 12691>>>&0x26 string UPX \b, UPX compressed 12692# and yet another guess: small .text, and after large .data is unusal, could be 32lite 12693>>&0x2c search/0xa0 .text 12694>>>&0x0b lelong <0x2000 12695>>>>&0 lelong >0x6000 \b, 32lite compressed 12696 12697>(8.s*16) string $WdX \b, WDos/X DOS extender 12698 12699# .EXE formats (Greg Roelofs, newt@uchicago.edu) 12700# 12701>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 12702>0xe7 string LH/2\ Self-Extract \b, %s 12703>0x1c string diet \b, diet compressed 12704>0x1c string LZ09 \b, LZEXE v0.90 compressed 12705>0x1c string LZ91 \b, LZEXE v0.91 compressed 12706>0x1c string tz \b, TinyProg compressed 12707>0x1e string PKLITE \b, %s compressed 12708>0x64 string W\ Collis\0\0 \b, Compack compressed 12709>0x24 string LHa's\ SFX \b, LHa self-extracting archive 12710!:mime application/x-lha 12711>0x24 string LHA's\ SFX \b, LHa self-extracting archive 12712!:mime application/x-lha 12713>0x24 string \ $ARX \b, ARX self-extracting archive 12714>0x24 string \ $LHarc \b, LHarc self-extracting archive 12715>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 12716>1638 string -lh5- \b, LHa self-extracting archive v2.13S 12717>0x17888 string Rar! \b, RAR self-extracting archive 12718>0x40 string aPKG \b, aPackage self-extracting archive 12719 12720>32 string AIN 12721>>35 string 2 \b, AIN 2.x compressed 12722>>35 string <2 \b, AIN 1.x compressed 12723>>35 string >2 \b, AIN 1.x compressed 12724>28 string UC2X \b, UCEXE compressed 12725>28 string WWP\ \b, WWPACK compressed 12726 12727# skip to the end of the exe 12728>(4.s*512) long x 12729>>&(2.s-517) byte x 12730>>>&0 string PK\3\4 \b, ZIP self-extracting archive 12731>>>&0 string Rar! \b, RAR self-extracting archive 12732>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 12733>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 12734>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 12735>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 12736>>>&7 search/400 **ACE** \b, ACE self-extracting archive 12737>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 12738 12739>0x1c string RJSX \b, ARJ self-extracting archive 12740# winarj stores a message in the stub instead of the sig in the MZ header 12741>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 12742 12743# a few unknown ZIP sfxes, no idea if they are needed or if they are 12744# already captured by the generic patterns above 12745>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 12746>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 12747# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 12748# 12749 12750# TELVOX Teleinformatica CODEC self-extractor for OS/2: 12751>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 12752>>49824 leshort =1 \b, 1 file 12753>>49824 leshort >1 \b, %u files 12754 12755# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 12756# Uncommenting only the first two lines will cover about 2/3 of COM files, 12757# but it isn't feasible to match all COM files since there must be at least 12758# two dozen different one-byte "magics". 12759# test too generic ? 12760#0 byte 0xe9 DOS executable (COM) 12761#>0x1FE leshort 0xAA55 \b, boot code 12762#>6 string SFX\ of\ LHarc (%s) 12763#0 belong 0xffffffff DOS executable (device driver) 12764#CMD640X2.SYS 12765#>10 string >\x23 12766#>>10 string !\x2e 12767#>>>17 string <\x5B 12768#>>>>10 string CMD640X2.SYS \b, name: %.8s 12769#UDMA.SYS 12770#>10 string <\x41 12771#>>12 string >\x40 12772#>>>10 string !$ 12773#>>>>12 string UDMA.SYS \b, name: %.8s 12774#CMD640X2.SYS 12775#>10 string <\x41 12776#>>12 string >\x40 12777#>>>10 string !$ 12778#>>>>12 string CMD640X2.SYS \b, name: %.8s 12779#KEYB.SYS 12780#>10 string <\x41 12781#>>12 string >\x40 12782#>>>10 string !$ 12783#>>>>12 string KEYB.SYS \b, name: %.8s 12784#BTCDROM.SYS 12785#>22 string >\x40 12786#>>22 string <\x5B 12787#>>>23 string <\x5B 12788#>>>>22 string BTCDROM.SYS \b, name: %.8s 12789#ASPICD.SYS 12790#>22 string >\x40 12791#>>22 string <\x5B 12792#>>>23 string <\x5B 12793#>>>>22 string ASPICD.SYS \b, name: %.8s 12794#ATAPICD.SYS 12795#>76 string \0 12796#>>77 string >\x40 12797#>>>77 string <\x5B 12798#>>>>77 string ATAPICD.SYS \b, name: %.8s 12799# test too generic ? 12800#0 byte 0x8c DOS executable (COM) 12801# updated by Joerg Jenderek at Oct 2008 12802#0 ulelong 0xffff10eb DR-DOS executable (COM) 12803# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 12804#0 ubeshort&0xeb8d >0xeb00 12805# DR-DOS STACKER.COM SCREATE.SYS missed 12806#>0 byte 0xeb DOS executable (COM) 12807#>>0x1FE leshort 0xAA55 \b, boot code 12808#>>85 string UPX \b, UPX compressed 12809#>>4 string \ $ARX \b, ARX self-extracting archive 12810#>>4 string \ $LHarc \b, LHarc self-extracting archive 12811#>>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 12812# updated by Joerg Jenderek at Oct 2008 12813#0 byte 0xb8 COM executable 12814#0 uleshort&0x80ff 0x00b8 12815# modified by Joerg Jenderek 12816#>1 lelong !0x21cd4cff COM executable for DOS 12817# http://syslinux.zytor.com/comboot.php 12818# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 12819# start with assembler instructions mov eax,21cd4cffh 128200 uleshort&0xc0ff 0xc0b8 12821>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 128220 string \x81\xfc 12823>4 string \x77\x02\xcd\x20\xb9 12824>>36 string UPX! FREE-DOS executable (COM), UPX compressed 12825252 string Must\ have\ DOS\ version DR-DOS executable (COM) 12826# added by Joerg Jenderek at Oct 2008 12827# GRR search is not working 12828#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1282934 string UPX! FREE-DOS executable (COM), UPX compressed 1283035 string UPX! FREE-DOS executable (COM), UPX compressed 12831# GRR search is not working 12832#2 search/28 \xcd\x21 COM executable for MS-DOS 12833#WHICHFAT.cOM 12834#2 string \xcd\x21 COM executable for DOS 12835#DELTREE.cOM DELTREE2.cOM 12836#4 string \xcd\x21 COM executable for DOS 12837#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 12838#5 string \xcd\x21 COM executable for DOS 12839#DELTMP.COm HASFAT32.cOM 12840#7 string \xcd\x21 12841#>0 byte !0xb8 COM executable for DOS 12842#COMP.cOM MORE.COm 12843#10 string \xcd\x21 12844#>5 string !\xcd\x21 COM executable for DOS 12845#comecho.com 12846#13 string \xcd\x21 COM executable for DOS 12847#HELP.COm EDIT.coM 12848#18 string \xcd\x21 COM executable for MS-DOS 12849#NWRPLTRM.COm 12850#23 string \xcd\x21 COM executable for MS-DOS 12851#LOADFIX.cOm LOADFIX.cOm 12852#30 string \xcd\x21 COM executable for MS-DOS 12853#syslinux.com 3.11 12854#70 string \xcd\x21 COM executable for DOS 12855# many compressed/converted COMs start with a copy loop instead of a jump 128560x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 128570x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 12858>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 128590x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 12860# FIXME: missing diet .com compression 12861 12862# miscellaneous formats 128630 string LZ MS-DOS executable (built-in) 12864#0 byte 0xf0 MS-DOS program library data 12865# 12866 12867# AAF files: 12868# <stuartc@rd.bbc.co.uk> Stuart Cunningham 128690 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 12870>30 byte 9 (512B sectors) 12871>30 byte 12 (4kB sectors) 128720 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 12873>30 byte 9 (512B sectors) 12874>30 byte 12 (4kB sectors) 12875 12876# Popular applications 128772080 string Microsoft\ Word\ 6.0\ Document %s 12878!:mime application/msword 128792080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 12880!:mime application/msword 12881# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 128822112 string MSWordDoc Microsoft Word document data 12883!:mime application/msword 12884# 128850 belong 0x31be0000 Microsoft Word Document 12886!:mime application/msword 12887# 128880 string PO^Q` Microsoft Word 6.0 Document 12889!:mime application/msword 12890# 128910 string \376\067\0\043 Microsoft Office Document 12892!:mime application/msword 128930 string \333\245-\0\0\0 Microsoft Office Document 12894!:mime application/msword 12895512 string \354\245\301 Microsoft Word Document 12896!:mime application/msword 12897# 128982080 string Microsoft\ Excel\ 5.0\ Worksheet %s 12899!:mime application/vnd.ms-excel 12900 129012080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 12902!:mime application/vnd.ms-excel 12903# 12904# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 129052114 string Biff5 Microsoft Excel 5.0 Worksheet 12906!:mime application/vnd.ms-excel 12907# Italian MS-Excel 129082121 string Biff5 Microsoft Excel 5.0 Worksheet 12909!:mime application/vnd.ms-excel 129100 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 12911!:mime application/vnd.ms-excel 12912# 129130 belong 0x00001a00 Lotus 1-2-3 12914!:mime application/x-123 12915>4 belong 0x00100400 wk3 document data 12916>4 belong 0x02100400 wk4 document data 12917>4 belong 0x07800100 fm3 or fmb document data 12918>4 belong 0x07800000 fm3 or fmb document data 12919# 129200 belong 0x00000200 Lotus 1-2-3 12921!:mime application/x-123 12922>4 belong 0x06040600 wk1 document data 12923>4 belong 0x06800200 fmt document data 129240 string WordPro\0 Lotus WordPro 12925!:mime application/vnd.lotus-wordpro 129260 string WordPro\r\373 Lotus WordPro 12927!:mime application/vnd.lotus-wordpro 12928 12929 12930# Summary: Script used by InstallScield to uninstall applications 12931# Extension: .isu 12932# Submitted by: unknown 12933# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 129340 string \x71\xa8\x00\x00\x01\x02 12935>12 string Stirling\ Technologies, InstallShield Uninstall Script 12936 12937# Winamp .avs 12938#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 129390 string Nullsoft\ AVS\ Preset\ Winamp plug in 12940 12941# Windows Metafont .WMF 129420 string \327\315\306\232 ms-windows metafont .wmf 129430 string \002\000\011\000 ms-windows metafont .wmf 129440 string \001\000\011\000 ms-windows metafont .wmf 12945 12946#tz3 files whatever that is (MS Works files) 129470 string \003\001\001\004\070\001\000\000 tz3 ms-works file 129480 string \003\002\001\004\070\001\000\000 tz3 ms-works file 129490 string \003\003\001\004\070\001\000\000 tz3 ms-works file 12950 12951# PGP sig files .sig 12952#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 129530 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 129540 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 129550 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 129560 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 129570 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 129580 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 12959 12960# windows zips files .dmf 129610 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 12962 12963 12964#ico files 129650 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 12966 12967# Windows icons (Ian Springer <ips@fpk.hp.com>) 129680 string \000\000\001\000 MS Windows icon resource 12969!:mime image/x-ico 12970>4 byte 1 - 1 icon 12971>4 byte >1 - %d icons 12972>>6 byte >0 \b, %dx 12973>>>7 byte >0 \b%d 12974>>8 byte 0 \b, 256-colors 12975>>8 byte >0 \b, %d-colors 12976 12977 12978# .chr files 129790 string PK\010\010BGI Borland font 12980>4 string >\0 %s 12981# then there is a copyright notice 12982 12983 12984# .bgi files 129850 string pk\010\010BGI Borland device 12986>4 string >\0 %s 12987# then there is a copyright notice 12988 12989 12990# Windows Recycle Bin record file (named INFO2) 12991# By Abel Cheung (abelcheung AT gmail dot com) 12992# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 12993# Since Vista uses another structure, INFO2 structure probably won't change 12994# anymore. Detailed analysis in: 12995# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 129960 lelong 0x00000004 12997>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 12998 129990 lelong 0x00000005 13000>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 13001 13002 13003##### put in Either Magic/font or Magic/news 13004# Acroread or something files wrongly identified as G3 .pfm 13005# these have the form \000 \001 any? \002 \000 \000 13006# or \000 \001 any? \022 \000 \000 13007#0 string \000\001 pfm? 13008#>3 string \022\000\000Copyright\ yes 13009#>3 string \002\000\000Copyright\ yes 13010#>3 string >\0 oops, not a font file. Cancel that. 13011#it clashes with ttf files so put it lower down. 13012 13013# From Doug Lee via a FreeBSD pr 130149 string GERBILDOC First Choice document 130159 string GERBILDB First Choice database 130169 string GERBILCLIP First Choice database 130170 string GERBIL First Choice device file 130189 string RABBITGRAPH RabbitGraph file 130190 string DCU1 Borland Delphi .DCU file 130200 string =!<spell> MKS Spell hash list (old format) 130210 string =!<spell2> MKS Spell hash list 13022# Too simple - MPi 13023#0 string AH Halo(TM) bitmapped font file 130240 lelong 0x08086b70 TurboC BGI file 130250 lelong 0x08084b50 TurboC Font file 13026 13027# WARNING: below line conflicts with Infocom game data Z-machine 3 130280 byte 0x03 DBase 3 data file 13029>0x04 lelong 0 (no records) 13030>0x04 lelong >0 (%ld records) 130310 byte 0x83 DBase 3 data file with memo(s) 13032>0x04 lelong 0 (no records) 13033>0x04 lelong >0 (%ld records) 130340 leshort 0x0006 DBase 3 index file 130350 string PMCC Windows 3.x .GRP file 130361 string RDC-meg MegaDots 13037>8 byte >0x2F version %c 13038>9 byte >0x2F \b.%c file 130390 lelong 0x4C 13040>4 lelong 0x00021401 Windows shortcut file 13041 13042# DOS EPS Binary File Header 13043# From: Ed Sznyter <ews@Black.Market.NET> 130440 belong 0xC5D0D3C6 DOS EPS Binary File 13045>4 long >0 Postscript starts at byte %d 13046>>8 long >0 length %d 13047>>>12 long >0 Metafile starts at byte %d 13048>>>>16 long >0 length %d 13049>>>20 long >0 TIFF starts at byte %d 13050>>>>24 long >0 length %d 13051 13052# TNEF magic From "Joomy" <joomy@se-ed.net> 13053# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 130540 leshort 0x223e9f78 TNEF 13055!:mime application/vnd.ms-tnef 13056 13057# HtmlHelp files (.chm) 130580 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 13059 13060# GFA-BASIC (Wolfram Kleff) 130612 string GFA-BASIC3 GFA-BASIC 3 data 13062 13063#------------------------------------------------------------------------------ 13064# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 13065# Microsoft Cabinet files 130660 string MSCF\0\0\0\0 Microsoft Cabinet archive data 13067!:mime application/vnd.ms-cab-compressed 13068>8 lelong x \b, %u bytes 13069>28 leshort 1 \b, 1 file 13070>28 leshort >1 \b, %u files 13071 13072# InstallShield Cabinet files 130730 string ISc( InstallShield Cabinet archive data 13074>5 byte&0xf0 =0x60 version 6, 13075>5 byte&0xf0 !0x60 version 4/5, 13076>(12.l+40) lelong x %u files 13077 13078# Windows CE package files 130790 string MSCE\0\0\0\0 Microsoft WinCE install header 13080>20 lelong 0 \b, architecture-independent 13081>20 lelong 103 \b, Hitachi SH3 13082>20 lelong 104 \b, Hitachi SH4 13083>20 lelong 0xA11 \b, StrongARM 13084>20 lelong 4000 \b, MIPS R4000 13085>20 lelong 10003 \b, Hitachi SH3 13086>20 lelong 10004 \b, Hitachi SH3E 13087>20 lelong 10005 \b, Hitachi SH4 13088>20 lelong 70001 \b, ARM 7TDMI 13089>52 leshort 1 \b, 1 file 13090>52 leshort >1 \b, %u files 13091>56 leshort 1 \b, 1 registry entry 13092>56 leshort >1 \b, %u registry entries 13093 13094 13095# Windows Enhanced Metafile (EMF) 13096# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 13097# for further information. 130980 ulelong 1 13099>40 string \ EMF Windows Enhanced Metafile (EMF) image data 13100>>44 ulelong x version 0x%x 13101 13102# From: Alex Beregszaszi <alex@fsn.hu> 131030 string COWD VMWare3 13104>4 byte 3 disk image 13105>>32 lelong x (%d/ 13106>>36 lelong x \b%d/ 13107>>40 lelong x \b%d) 13108>4 byte 2 undoable disk image 13109>>32 string >\0 (%s) 13110 131110 string VMDK VMware4 disk image 131120 string KDMV VMware4 disk image 13113 13114#-------------------------------------------------------------------- 13115# Qemu Emulator Images 13116# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 13117# Made by reading sources and doing trial and error on existing 13118# qcow files 131190 string QFI Qemu Image, Format: Qcow 13120 13121# Uncomment the following line to display Magic (only used for debugging 13122# this magic number) 13123#>0 string x , Magic: %s 13124 13125# There are currently 2 Versions: "1" and "2" 13126# I do not use Version 2 and therefor branch here 13127# but can assure: it works (tested on both versions) 13128# Also my Qemu 0.9.0 which uses this Version 2 refuses 13129# to start in its bios 13130>0x04 belong 2 , Version: 2 13131>0x04 belong 1 , Version: 1 13132 13133# Using the existence of the Backing File Offset to Branch or not 13134# to read Backing File Information 13135>>0xc belong >0 , Backing File( Offset: %lu 13136>>>(0xc.L) string >\0 , Path: %s 13137 13138# Didn't get the trick here how qemu stores the "Size" at this Position 13139# There is actually something stored but nothing makes sense 13140# The header in the sources talks about it 13141#>>>16 lelong x , Size: %lu 13142 13143# Modification time of the Backing File 13144# Really useful if you want to know if your backing 13145# file is still usable together with this image 13146>>>20 bedate x , Mtime: %s ) 13147 13148# Don't know how to calculate in Magicfiles 13149# Also: this Information is not reliably 13150# stored in image-files 13151>>24 lelong x , Disk Size could be: %d * 256 bytes 13152 13153>4 belong 3 (v3) 13154# Using the existence of the Backing File Offset to determine whether 13155# to read Backing File Information 13156>>8 bequad >0 \b, has backing file 13157# Note that this isn't a null-terminated string; the length is actually 13158# (16.L). Assuming a null-terminated string happens to work usually, but it 13159# may spew junk until it reaches a \0 in some cases. Also, since there's no 13160# .Q modifier, we just use the bottom four bytes as an offset. Note that if 13161# the file is over 4G, and the backing file path is stored after the first 4G, 13162# the wrong filename will be printed. (This should be (8.Q), when that syntax 13163# is introduced.) 13164>>>(12.L) string >\0 (path %s) 13165>>24 bequad x \b, %lld bytes 13166>>32 belong 1 \b, AES-encrypted 13167 131680 string QEVM QEMU's suspend to disk image 13169 13170# QEMU QED Image 13171# http://wiki.qemu.org/Features/QED/Specification 131720 string/b QED\0 QEMU QED Image 13173 13174# VDI Image 1317564 string/b \x7f\x10\xda\xbe VDI Image 13176>68 string/b \x01\x00\x01\x00 version 1.1 13177>0 string >\0 (%s) 13178>368 lequad x \b, %lld bytes 13179 131800 string Bochs\ Virtual\ HD\ Image Bochs disk image, 13181>32 string x type %s, 13182>48 string x subtype %s 13183 131840 lelong 0x02468ace Bochs Sparse disk image 13185 13186# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 13187# False positive with PPT (also currently this string is too long) 13188#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 131890 string \320\317\021\340\241\261\032\341 Microsoft Office Document 13190#>48 byte 0x1B Excel Document 13191#!:mime application/vnd.ms-excel 13192>546 string bjbj Microsoft Word Document 13193!:mime application/msword 13194>546 string jbjb Microsoft Word Document 13195!:mime application/msword 13196 131970 string \224\246\056 Microsoft Word Document 13198!:mime application/msword 13199 13200512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 13201!:mime application/msword 13202 13203# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 13204# Magic type for Dell's BIOS .hdr files 13205# Dell's .hdr 132060 string $RBU 13207>23 string Dell %s system BIOS 13208>5 byte 2 13209>>48 byte x version %d. 13210>>49 byte x \b%d. 13211>>50 byte x \b%d 13212>5 byte <2 13213>>48 string x version %.3s 13214 13215# Type: Microsoft DirectDraw Surface 13216# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 13217# From: Morten Hustveit <morten@debian.org> 132180 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 13219>16 lelong >0 %hd x 13220>12 lelong >0 %hd, 13221>84 string x %.4s 13222 13223# Type: Microsoft Document Imaging Format (.mdi) 13224# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 13225# From: Daniele Sempione <scrows@oziosi.org> 132260 short 0x5045 Microsoft Document Imaging Format 13227 13228# MS eBook format (.lit) 132290 string ITOLITLS Microsoft Reader eBook Data 13230>8 lelong x \b, version %u 13231!:mime application/x-ms-reader 13232 13233#------------------------------------------------------------------------------ 13234# $File: msdos,v 1.65 2009/09/19 16:28:11 christos Exp $ 13235# msdos: file(1) magic for MS-DOS files 13236# 13237 13238# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 13239# updated by Joerg Jenderek at Oct 2008 132400 string @ 13241>1 string/cW \ echo\ off DOS batch file text 13242!:mime text/x-msdos-batch 13243>1 string/cW echo\ off DOS batch file text 13244!:mime text/x-msdos-batch 13245>1 string/cW rem\ DOS batch file text 13246!:mime text/x-msdos-batch 13247>1 string/cW set\ DOS batch file text 13248!:mime text/x-msdos-batch 13249 13250 13251# OS/2 batch files are REXX. the second regex is a bit generic, oh well 13252# the matched commands seem to be common in REXX and uncommon elsewhere 13253100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 13254100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 13255 132560 leshort 0x14c MS Windows COFF Intel 80386 object file 13257#>4 ledate x stamp %s 132580 leshort 0x166 MS Windows COFF MIPS R4000 object file 13259#>4 ledate x stamp %s 132600 leshort 0x184 MS Windows COFF Alpha object file 13261#>4 ledate x stamp %s 132620 leshort 0x268 MS Windows COFF Motorola 68000 object file 13263#>4 ledate x stamp %s 132640 leshort 0x1f0 MS Windows COFF PowerPC object file 13265#>4 ledate x stamp %s 132660 leshort 0x290 MS Windows COFF PA-RISC object file 13267#>4 ledate x stamp %s 13268 13269# XXX - according to Microsoft's spec, at an offset of 0x3c in a 13270# PE-format executable is the offset in the file of the PE header; 13271# unfortunately, that's a little-endian offset, and there's no way 13272# to specify an indirect offset with a specified byte order. 13273# So, for now, we assume the standard MS-DOS stub, which puts the 13274# PE header at 0x80 = 128. 13275# 13276# Required OS version and subsystem version were 4.0 on some NT 3.51 13277# executables built with Visual C++ 4.0, so it's not clear that 13278# they're interesting. The user version was 0.0, but there's 13279# probably some linker directive to set it. The linker version was 13280# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). 13281# 13282# many of the compressed formats were extraced from IDARC 1.23 source code 13283# 132840 string MZ 13285!:mime application/x-dosexec 13286>0x18 leshort <0x40 MS-DOS executable 13287>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows 13288>>&18 leshort&0x2000 >0 (DLL) 13289>>&88 leshort 0 (unknown subsystem) 13290>>&88 leshort 1 (native) 13291>>&88 leshort 2 (GUI) 13292>>&88 leshort 3 (console) 13293>>&88 leshort 7 (POSIX) 13294>>&0 leshort 0x0 unknown processor 13295>>&0 leshort 0x14c Intel 80386 13296>>&0 leshort 0x166 MIPS R4000 13297>>&0 leshort 0x184 Alpha 13298>>&0 leshort 0x268 Motorola 68000 13299>>&0 leshort 0x1f0 PowerPC 13300>>&0 leshort 0x290 PA-RISC 13301>>&18 leshort&0x0100 >0 32-bit 13302>>&18 leshort&0x1000 >0 system file 13303>>&0xf4 search/0x140 \x0\x40\x1\x0 13304>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 13305>30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 13306!:mime application/zip 13307# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. 13308>30 string PKLITE\ Copr. Self-extracting PKZIP archive 13309!:mime application/zip 13310 13311>0x18 leshort >0x3f 13312>>(0x3c.l) string PE\0\0 PE 13313>>>(0x3c.l+25) byte 1 \b32 executable 13314>>>(0x3c.l+25) byte 2 \b32+ executable 13315# hooray, there's a DOS extender using the PE format, with a valid PE 13316# executable inside (which just prints a message and exits if run in win) 13317>>>(0x3c.l+92) leshort <10 13318>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender 13319>>>>(8.s*16) string !32STUB for MS Windows 13320>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 13321>>>>>(0x3c.l+92) leshort 0 (unknown subsystem) 13322>>>>>(0x3c.l+92) leshort 1 (native) 13323>>>>>(0x3c.l+92) leshort 2 (GUI) 13324>>>>>(0x3c.l+92) leshort 3 (console) 13325>>>>>(0x3c.l+92) leshort 7 (POSIX) 13326>>>(0x3c.l+92) leshort 10 (EFI application) 13327>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 13328>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 13329>>>(0x3c.l+92) leshort 13 (XBOX) 13330>>>(0x3c.l+4) leshort 0x0 unknown processor 13331>>>(0x3c.l+4) leshort 0x14c Intel 80386 13332>>>(0x3c.l+4) leshort 0x166 MIPS R4000 13333>>>(0x3c.l+4) leshort 0x184 Alpha 13334>>>(0x3c.l+4) leshort 0x268 Motorola 68000 13335>>>(0x3c.l+4) leshort 0x1f0 PowerPC 13336>>>(0x3c.l+4) leshort 0x290 PA-RISC 13337>>>(0x3c.l+4) leshort 0x200 Intel Itanium 13338>>>(0x3c.l+22) leshort&0x0100 >0 32-bit 13339>>>(0x3c.l+22) leshort&0x1000 >0 system file 13340>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 13341 13342>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 13343>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 13344>>>>(0x3c.l+0xf8) search/0x140 UPX2 13345>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 13346>>>>(0x3c.l+0xf8) search/0x140 .idata 13347>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 13348>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 13349>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 13350>>>>(0x3c.l+0xf8) search/0x140 .rsrc 13351>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 13352>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 13353>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 13354>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 13355>>>>(0x3c.l+0xf8) search/0x140 .data 13356>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 13357>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 13358>>>>>(0x3c.l+0xf7) byte x 13359>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 13360>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 13361>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 13362>>>>(0x3c.l+0xf8) search/0x140 .reloc 13363>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) 13364 13365>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 13366>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 13367>>>>0x30 string Inno \b, InnoSetup self-extracting archive 13368 13369>>(0x3c.l) string !PE\0\0 MS-DOS executable 13370 13371>>(0x3c.l) string NE \b, NE 13372>>>(0x3c.l+0x36) byte 0 (unknown OS) 13373>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 13374>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 13375>>>(0x3c.l+0x36) byte 3 for MS-DOS 13376>>>(0x3c.l+0x36) byte >3 (unknown OS) 13377>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 13378>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 13379>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 13380>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 13381>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 13382 13383>>(0x3c.l) string LX\0\0 \b, LX 13384>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 13385>>>(0x3c.l+0x0a) leshort 1 for OS/2 13386>>>(0x3c.l+0x0a) leshort 2 for MS Windows 13387>>>(0x3c.l+0x0a) leshort 3 for DOS 13388>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 13389>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 13390>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 13391>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 13392>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 13393>>>(0x3c.l+0x08) leshort 1 i80286 13394>>>(0x3c.l+0x08) leshort 2 i80386 13395>>>(0x3c.l+0x08) leshort 3 i80486 13396>>>(8.s*16) string emx \b, emx 13397>>>>&1 string x %s 13398>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 13399 13400# MS Windows system file, supposedly a collection of LE executables 13401>>(0x3c.l) string W3 \b, W3 for MS Windows 13402 13403>>(0x3c.l) string LE\0\0 \b, LE executable 13404>>>(0x3c.l+0x0a) leshort 1 13405# some DOS extenders use LE files with OS/2 header 13406>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13407>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 13408>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 13409>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 13410>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 13411>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 13412>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 13413# this is a wild guess; hopefully it is a specific signature 13414>>>>&0x24 lelong <0x50 13415>>>>>(&0x4c.l) string \xfc\xb8WATCOM 13416>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 13417# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 13418#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 13419# fails with DOS-Extenders. 13420>>>(0x3c.l+0x0a) leshort 2 for MS Windows 13421>>>(0x3c.l+0x0a) leshort 3 for DOS 13422>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 13423>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 13424>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 13425 13426# looks like ASCII, probably some embedded copyright message. 13427# and definitely not NE/LE/LX/PE 13428>>0x3c lelong >0x20000000 13429>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 13430# header data too small for extended executable 13431>2 long !0 13432>>0x18 leshort <0x40 13433>>>(4.s*512) leshort !0x014c 13434 13435>>>>&(2.s-514) string !LE 13436>>>>>&-2 string !BW \b, MZ for MS-DOS 13437>>>>&(2.s-514) string LE \b, LE 13438>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 13439# educated guess since indirection is still not capable enough for complex offset 13440# calculations (next embedded executable would be at &(&2*512+&0-2) 13441# I suspect there are only LE executables in these multi-exe files 13442>>>>&(2.s-514) string BW 13443>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) 13444>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS 13445 13446# This sequence skips to the first COFF segment, usually .text 13447>(4.s*512) leshort 0x014c \b, COFF 13448>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 13449>>(8.s*16) string emx 13450>>>&1 string x for DOS, Win or OS/2, emx %s 13451>>&(&0x42.l-3) byte x 13452>>>&0x26 string UPX \b, UPX compressed 13453# and yet another guess: small .text, and after large .data is unusal, could be 32lite 13454>>&0x2c search/0xa0 .text 13455>>>&0x0b lelong <0x2000 13456>>>>&0 lelong >0x6000 \b, 32lite compressed 13457 13458>(8.s*16) string $WdX \b, WDos/X DOS extender 13459 13460# .EXE formats (Greg Roelofs, newt@uchicago.edu) 13461# 13462>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 13463>0xe7 string LH/2\ Self-Extract \b, %s 13464>0x1c string diet \b, diet compressed 13465>0x1c string LZ09 \b, LZEXE v0.90 compressed 13466>0x1c string LZ91 \b, LZEXE v0.91 compressed 13467>0x1c string tz \b, TinyProg compressed 13468>0x1e string PKLITE \b, %s compressed 13469>0x64 string W\ Collis\0\0 \b, Compack compressed 13470>0x24 string LHa's\ SFX \b, LHa self-extracting archive 13471!:mime application/x-lha 13472>0x24 string LHA's\ SFX \b, LHa self-extracting archive 13473!:mime application/x-lha 13474>0x24 string \ $ARX \b, ARX self-extracting archive 13475>0x24 string \ $LHarc \b, LHarc self-extracting archive 13476>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 13477>1638 string -lh5- \b, LHa self-extracting archive v2.13S 13478>0x17888 string Rar! \b, RAR self-extracting archive 13479>0x40 string aPKG \b, aPackage self-extracting archive 13480 13481>32 string AIN 13482>>35 string 2 \b, AIN 2.x compressed 13483>>35 string <2 \b, AIN 1.x compressed 13484>>35 string >2 \b, AIN 1.x compressed 13485>28 string UC2X \b, UCEXE compressed 13486>28 string WWP\ \b, WWPACK compressed 13487 13488# skip to the end of the exe 13489>(4.s*512) long x 13490>>&(2.s-517) byte x 13491>>>&0 string PK\3\4 \b, ZIP self-extracting archive 13492>>>&0 string Rar! \b, RAR self-extracting archive 13493>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 13494>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 13495>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 13496>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 13497>>>&7 search/400 **ACE** \b, ACE self-extracting archive 13498>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 13499 13500>0x1c string RJSX \b, ARJ self-extracting archive 13501# winarj stores a message in the stub instead of the sig in the MZ header 13502>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 13503 13504# a few unknown ZIP sfxes, no idea if they are needed or if they are 13505# already captured by the generic patterns above 13506>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 13507>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 13508# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 13509# 13510 13511# TELVOX Teleinformatica CODEC self-extractor for OS/2: 13512>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 13513>>49824 leshort =1 \b, 1 file 13514>>49824 leshort >1 \b, %u files 13515 13516# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 13517# Uncommenting only the first two lines will cover about 2/3 of COM files, 13518# but it isn't feasible to match all COM files since there must be at least 13519# two dozen different one-byte "magics". 13520# test too generic ? 135210 byte 0xe9 DOS executable (COM) 13522>0x1FE leshort 0xAA55 \b, boot code 13523>6 string SFX\ of\ LHarc (%s) 135240 belong 0xffffffff DOS executable (device driver) 13525#CMD640X2.SYS 13526>10 string >\x23 13527>>10 string !\x2e 13528>>>17 string <\x5B 13529>>>>10 string x \b, name: %.8s 13530#UDMA.SYS KEYB.SYS CMD640X2.SYS 13531>10 string <\x41 13532>>12 string >\x40 13533>>>10 string !$ 13534>>>>12 string x \b, name: %.8s 13535#BTCDROM.SYS ASPICD.SYS 13536>22 string >\x40 13537>>22 string <\x5B 13538>>>23 string <\x5B 13539>>>>22 string x \b, name: %.8s 13540#ATAPICD.SYS 13541>76 string \0 13542>>77 string >\x40 13543>>>77 string <\x5B 13544>>>>77 string x \b, name: %.8s 13545# test too generic ? 135460 byte 0x8c DOS executable (COM) 13547# updated by Joerg Jenderek at Oct 2008 135480 ulelong 0xffff10eb DR-DOS executable (COM) 13549# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 135500 ubeshort&0xeb8d >0xeb00 13551# DR-DOS STACKER.COM SCREATE.SYS missed 13552>0 byte 0xeb DOS executable (COM) 13553>>0x1FE leshort 0xAA55 \b, boot code 13554>>85 string UPX \b, UPX compressed 13555>>4 string \ $ARX \b, ARX self-extracting archive 13556>>4 string \ $LHarc \b, LHarc self-extracting archive 13557>>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 13558# updated by Joerg Jenderek at Oct 2008 13559#0 byte 0xb8 COM executable 135600 uleshort&0x80ff 0x00b8 13561# modified by Joerg Jenderek 13562>1 lelong !0x21cd4cff COM executable for DOS 13563# http://syslinux.zytor.com/comboot.php 13564# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 13565# start with assembler instructions mov eax,21cd4cffh 135660 uleshort&0xc0ff 0xc0b8 13567>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 135680 string \x81\xfc 13569>4 string \x77\x02\xcd\x20\xb9 13570>>36 string UPX! FREE-DOS executable (COM), UPX compressed 13571252 string Must\ have\ DOS\ version DR-DOS executable (COM) 13572# added by Joerg Jenderek at Oct 2008 13573# GRR search is not working 13574#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1357534 string UPX! FREE-DOS executable (COM), UPX compressed 1357635 string UPX! FREE-DOS executable (COM), UPX compressed 13577# GRR search is not working 13578#2 search/28 \xcd\x21 COM executable for MS-DOS 13579#WHICHFAT.cOM 135802 string \xcd\x21 COM executable for DOS 13581#DELTREE.cOM DELTREE2.cOM 135824 string \xcd\x21 COM executable for DOS 13583#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 135845 string \xcd\x21 COM executable for DOS 13585#DELTMP.COm HASFAT32.cOM 135867 string \xcd\x21 13587>0 byte !0xb8 COM executable for DOS 13588#COMP.cOM MORE.COm 1358910 string \xcd\x21 13590>5 string !\xcd\x21 COM executable for DOS 13591#comecho.com 1359213 string \xcd\x21 COM executable for DOS 13593#HELP.COm EDIT.coM 1359418 string \xcd\x21 COM executable for MS-DOS 13595#NWRPLTRM.COm 1359623 string \xcd\x21 COM executable for MS-DOS 13597#LOADFIX.cOm LOADFIX.cOm 1359830 string \xcd\x21 COM executable for MS-DOS 13599#syslinux.com 3.11 1360070 string \xcd\x21 COM executable for DOS 13601# many compressed/converted COMs start with a copy loop instead of a jump 136020x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 136030x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 13604>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 136050x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 13606# FIXME: missing diet .com compression 13607 13608# miscellaneous formats 136090 string LZ MS-DOS executable (built-in) 13610#0 byte 0xf0 MS-DOS program library data 13611# 13612 13613# AAF files: 13614# <stuartc@rd.bbc.co.uk> Stuart Cunningham 136150 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 13616>30 byte 9 (512B sectors) 13617>30 byte 12 (4kB sectors) 136180 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 13619>30 byte 9 (512B sectors) 13620>30 byte 12 (4kB sectors) 13621 13622# Popular applications 136232080 string Microsoft\ Word\ 6.0\ Document %s 13624!:mime application/msword 136252080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 13626!:mime application/msword 13627# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 136282112 string MSWordDoc Microsoft Word document data 13629!:mime application/msword 13630# 136310 belong 0x31be0000 Microsoft Word Document 13632!:mime application/msword 13633# 136340 string PO^Q` Microsoft Word 6.0 Document 13635!:mime application/msword 13636# 136370 string \376\067\0\043 Microsoft Office Document 13638!:mime application/msword 136390 string \333\245-\0\0\0 Microsoft Office Document 13640!:mime application/msword 13641512 string \354\245\301 Microsoft Word Document 13642!:mime application/msword 13643# 136442080 string Microsoft\ Excel\ 5.0\ Worksheet %s 13645!:mime application/vnd.ms-excel 13646 136472080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 13648!:mime application/vnd.ms-excel 13649# 13650# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 136512114 string Biff5 Microsoft Excel 5.0 Worksheet 13652!:mime application/vnd.ms-excel 13653# Italian MS-Excel 136542121 string Biff5 Microsoft Excel 5.0 Worksheet 13655!:mime application/vnd.ms-excel 136560 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 13657!:mime application/vnd.ms-excel 13658# 136590 belong 0x00001a00 Lotus 1-2-3 13660!:mime application/x-123 13661>4 belong 0x00100400 wk3 document data 13662>4 belong 0x02100400 wk4 document data 13663>4 belong 0x07800100 fm3 or fmb document data 13664>4 belong 0x07800000 fm3 or fmb document data 13665# 136660 belong 0x00000200 Lotus 1-2-3 13667!:mime application/x-123 13668>4 belong 0x06040600 wk1 document data 13669>4 belong 0x06800200 fmt document data 136700 string WordPro\0 Lotus WordPro 13671!:mime application/vnd.lotus-wordpro 136720 string WordPro\r\373 Lotus WordPro 13673!:mime application/vnd.lotus-wordpro 13674 13675 13676# Summary: Script used by InstallScield to uninstall applications 13677# Extension: .isu 13678# Submitted by: unknown 13679# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 136800 string \x71\xa8\x00\x00\x01\x02 13681>12 string Stirling\ Technologies, InstallShield Uninstall Script 13682 13683# Winamp .avs 13684#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 136850 string Nullsoft\ AVS\ Preset\ Winamp plug in 13686 13687# Windows Metafont .WMF 136880 string \327\315\306\232 ms-windows metafont .wmf 136890 string \002\000\011\000 ms-windows metafont .wmf 136900 string \001\000\011\000 ms-windows metafont .wmf 13691 13692#tz3 files whatever that is (MS Works files) 136930 string \003\001\001\004\070\001\000\000 tz3 ms-works file 136940 string \003\002\001\004\070\001\000\000 tz3 ms-works file 136950 string \003\003\001\004\070\001\000\000 tz3 ms-works file 13696 13697# PGP sig files .sig 13698#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 136990 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 137000 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 137010 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 137020 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 137030 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 137040 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 13705 13706# windows zips files .dmf 137070 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 13708 13709 13710#ico files 137110 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 13712 13713# Windows icons (Ian Springer <ips@fpk.hp.com>) 137140 string \000\000\001\000 MS Windows icon resource 13715!:mime image/x-ico 13716>4 byte 1 - 1 icon 13717>4 byte >1 - %d icons 13718>>6 byte >0 \b, %dx 13719>>>7 byte >0 \b%d 13720>>8 byte 0 \b, 256-colors 13721>>8 byte >0 \b, %d-colors 13722 13723 13724# .chr files 137250 string PK\010\010BGI Borland font 13726>4 string >\0 %s 13727# then there is a copyright notice 13728 13729 13730# .bgi files 137310 string pk\010\010BGI Borland device 13732>4 string >\0 %s 13733# then there is a copyright notice 13734 13735 13736# Windows Recycle Bin record file (named INFO2) 13737# By Abel Cheung (abelcheung AT gmail dot com) 13738# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 13739# Since Vista uses another structure, INFO2 structure probably won't change 13740# anymore. Detailed analysis in: 13741# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 137420 lelong 0x00000004 13743>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 13744 137450 lelong 0x00000005 13746>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 13747 13748 13749##### put in Either Magic/font or Magic/news 13750# Acroread or something files wrongly identified as G3 .pfm 13751# these have the form \000 \001 any? \002 \000 \000 13752# or \000 \001 any? \022 \000 \000 13753#0 string \000\001 pfm? 13754#>3 string \022\000\000Copyright\ yes 13755#>3 string \002\000\000Copyright\ yes 13756#>3 string >\0 oops, not a font file. Cancel that. 13757#it clashes with ttf files so put it lower down. 13758 13759# From Doug Lee via a FreeBSD pr 137609 string GERBILDOC First Choice document 137619 string GERBILDB First Choice database 137629 string GERBILCLIP First Choice database 137630 string GERBIL First Choice device file 137649 string RABBITGRAPH RabbitGraph file 137650 string DCU1 Borland Delphi .DCU file 137660 string =!<spell> MKS Spell hash list (old format) 137670 string =!<spell2> MKS Spell hash list 13768# Too simple - MPi 13769#0 string AH Halo(TM) bitmapped font file 137700 lelong 0x08086b70 TurboC BGI file 137710 lelong 0x08084b50 TurboC Font file 13772 13773# WARNING: below line conflicts with Infocom game data Z-machine 3 137740 byte 0x03 DBase 3 data file 13775>0x04 lelong 0 (no records) 13776>0x04 lelong >0 (%ld records) 137770 byte 0x83 DBase 3 data file with memo(s) 13778>0x04 lelong 0 (no records) 13779>0x04 lelong >0 (%ld records) 137800 leshort 0x0006 DBase 3 index file 137810 string PMCC Windows 3.x .GRP file 137821 string RDC-meg MegaDots 13783>8 byte >0x2F version %c 13784>9 byte >0x2F \b.%c file 137850 lelong 0x4C 13786>4 lelong 0x00021401 Windows shortcut file 13787 13788# DOS EPS Binary File Header 13789# From: Ed Sznyter <ews@Black.Market.NET> 137900 belong 0xC5D0D3C6 DOS EPS Binary File 13791>4 long >0 Postscript starts at byte %d 13792>>8 long >0 length %d 13793>>>12 long >0 Metafile starts at byte %d 13794>>>>16 long >0 length %d 13795>>>20 long >0 TIFF starts at byte %d 13796>>>>24 long >0 length %d 13797 13798# TNEF magic From "Joomy" <joomy@se-ed.net> 13799# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 138000 leshort 0x223e9f78 TNEF 13801!:mime application/vnd.ms-tnef 13802 13803# HtmlHelp files (.chm) 138040 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 13805 13806# GFA-BASIC (Wolfram Kleff) 138072 string GFA-BASIC3 GFA-BASIC 3 data 13808 13809#------------------------------------------------------------------------------ 13810# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 13811# Microsoft Cabinet files 138120 string MSCF\0\0\0\0 Microsoft Cabinet archive data 13813!:mime application/vnd.ms-cab-compressed 13814>8 lelong x \b, %u bytes 13815>28 leshort 1 \b, 1 file 13816>28 leshort >1 \b, %u files 13817 13818# InstallShield Cabinet files 138190 string ISc( InstallShield Cabinet archive data 13820>5 byte&0xf0 =0x60 version 6, 13821>5 byte&0xf0 !0x60 version 4/5, 13822>(12.l+40) lelong x %u files 13823 13824# Windows CE package files 138250 string MSCE\0\0\0\0 Microsoft WinCE install header 13826>20 lelong 0 \b, architecture-independent 13827>20 lelong 103 \b, Hitachi SH3 13828>20 lelong 104 \b, Hitachi SH4 13829>20 lelong 0xA11 \b, StrongARM 13830>20 lelong 4000 \b, MIPS R4000 13831>20 lelong 10003 \b, Hitachi SH3 13832>20 lelong 10004 \b, Hitachi SH3E 13833>20 lelong 10005 \b, Hitachi SH4 13834>20 lelong 70001 \b, ARM 7TDMI 13835>52 leshort 1 \b, 1 file 13836>52 leshort >1 \b, %u files 13837>56 leshort 1 \b, 1 registry entry 13838>56 leshort >1 \b, %u registry entries 13839 13840 13841# Windows Enhanced Metafile (EMF) 13842# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 13843# for further information. 138440 ulelong 1 13845>40 string \ EMF Windows Enhanced Metafile (EMF) image data 13846>>44 ulelong x version 0x%x 13847 13848# From: Alex Beregszaszi <alex@fsn.hu> 138490 string COWD VMWare3 13850>4 byte 3 disk image 13851>>32 lelong x (%d/ 13852>>36 lelong x \b%d/ 13853>>40 lelong x \b%d) 13854>4 byte 2 undoable disk image 13855>>32 string >\0 (%s) 13856 138570 string VMDK VMware4 disk image 138580 string KDMV VMware4 disk image 13859 13860#-------------------------------------------------------------------- 13861# Qemu Emulator Images 13862# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 13863# Made by reading sources and doing trial and error on existing 13864# qcow files 138650 string QFI Qemu Image, Format: Qcow 13866 13867# Uncomment the following line to display Magic (only used for debugging 13868# this magic number) 13869#>0 string x , Magic: %s 13870 13871# There are currently 2 Versions: "1" and "2" 13872# I do not use Version 2 and therefor branch here 13873# but can assure: it works (tested on both versions) 13874# Also my Qemu 0.9.0 which uses this Version 2 refuses 13875# to start in its bios 13876>0x04 belong 2 , Version: 2 13877>0x04 belong 1 , Version: 1 13878 13879# Using the existence of the Backing File Offset to Branch or not 13880# to read Backing File Information 13881>>0xc belong >0 , Backing File( Offset: %lu 13882>>>(0xc.L) string >\0 , Path: %s 13883 13884# Didn't get the trick here how qemu stores the "Size" at this Position 13885# There is actually something stored but nothing makes sense 13886# The header in the sources talks about it 13887#>>>16 lelong x , Size: %lu 13888 13889# Modification time of the Backing File 13890# Really useful if you want to know if your backing 13891# file is still usable together with this image 13892>>>20 bedate x , Mtime: %s ) 13893 13894# Don't know how to calculate in Magicfiles 13895# Also: this Information is not reliably 13896# stored in image-files 13897>>24 lelong x , Disk Size could be: %d * 256 bytes 13898 138990 string QEVM QEMU's suspend to disk image 13900 139010 string Bochs\ Virtual\ HD\ Image Bochs disk image, 13902>32 string x type %s, 13903>48 string x subtype %s 13904 139050 lelong 0x02468ace Bochs Sparse disk image 13906 13907# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 13908# False positive with PPT (also currently this string is too long) 13909#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 139100 string \320\317\021\340\241\261\032\341 Microsoft Office Document 13911#>48 byte 0x1B Excel Document 13912#!:mime application/vnd.ms-excel 13913>546 string bjbj Microsoft Word Document 13914!:mime application/msword 13915>546 string jbjb Microsoft Word Document 13916!:mime application/msword 13917 139180 string \224\246\056 Microsoft Word Document 13919!:mime application/msword 13920 13921512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 13922!:mime application/msword 13923 13924# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 13925# Magic type for Dell's BIOS .hdr files 13926# Dell's .hdr 139270 string $RBU 13928>23 string Dell %s system BIOS 13929>48 string x version %.3s 13930 13931# Type: Microsoft DirectDraw Surface 13932# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 13933# From: Morten Hustveit <morten@debian.org> 139340 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 13935>16 lelong >0 %hd x 13936>12 lelong >0 %hd, 13937>84 string x %.4s 13938 13939# Type: Microsoft Document Imaging Format (.mdi) 13940# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 13941# From: Daniele Sempione <scrows@oziosi.org> 139420 short 0x5045 Microsoft Document Imaging Format 13943 13944# MS eBook format (.lit) 139450 string ITOLITLS Microsoft Reader eBook Data 13946>8 lelong x \b, version %u 13947!:mime application/x-ms-reader 13948 13949#------------------------------------------------------------------------------ 13950# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $ 13951# msvc: file(1) magic for msvc 13952# "H. Nanosecond" <aldomel@ix.netcom.com> 13953# Microsoft visual C 13954# 13955# I have version 1.0 13956 13957# .aps 139580 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 13959 13960# .ide 13961#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 139620 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 13963 13964# .res 139650 string \000\000\000\000\040\000\000\000\377 MSVC .res 139660 string \377\003\000\377\001\000\020\020\350 MSVC .res 139670 string \377\003\000\377\001\000\060\020\350 MSVC .res 13968 13969#.lib 139700 string \360\015\000\000 Microsoft Visual C library 139710 string \360\075\000\000 Microsoft Visual C library 139720 string \360\175\000\000 Microsoft Visual C library 13973 13974#.pch 139750 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 13976 13977# .pdb 13978# too long 0 string Microsoft\ C/C++\ program\ database\ 139790 string Microsoft\ C/C++\ MSVC program database 13980>18 string program\ database\ 13981>33 string >\0 ver %s 13982 13983#.sbr 139840 string \000\002\000\007\000 MSVC .sbr 13985>5 string >\0 %s 13986 13987#.bsc 139880 string \002\000\002\001 MSVC .bsc 13989 13990#.wsp 139910 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 13992# these seem to start with the version and contain menus 13993 13994# ------------------------------------------------------------------------ 13995# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $ 13996# mup: file(1) magic for Mup (Music Publisher) input file. 13997# 13998# From: Abel Cheung <abel (@) oaka.org> 13999# 14000# NOTE: This header is mainly proposed in the Arkkra mailing list, 14001# and is not a mandatory header because of old mup input file 14002# compatibility. Noteedit also use mup format, but is not forcing 14003# user to use any header as well. 14004# 140050 search/1 //!Mup Mup music publication program input text 14006>6 string -Arkkra (Arkkra) 14007>>13 string - 14008>>>16 string . 14009>>>>14 string x \b, need V%.4s 14010>>>15 string . 14011>>>>14 string x \b, need V%.3s 14012>6 string - 14013>>9 string . 14014>>>7 string x \b, need V%.4s 14015>>8 string . 14016>>>7 string x \b, need V%.3s 14017 14018#----------------------------------------------------------------------------- 14019# $File: natinst,v 1.4 2009/09/19 16:28:11 christos Exp $ 14020# natinst: file(1) magic for National Instruments Code Files 14021 14022# 14023# From <egamez@fcfm.buap.mx> Enrique Gmez-Flores 14024# version 1 14025# Many formats still missing, we use, for the moment LabVIEW 14026# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 14027# 140280 string RSRC National Instruments, 14029# Check if it's a LabVIEW File 14030>8 string LV LabVIEW File, 14031# Check wich kind of file is 14032>>10 string SB Code Resource File, data 14033>>10 string IN Virtual Instrument Program, data 14034>>10 string AR VI Library, data 14035# This is for Menu Libraries 14036>8 string LMNULBVW Portable File Names, data 14037# This is for General Resources 14038>8 string rsc Resources File, data 14039# This is for VXI Package 140400 string VMAP National Instruments, VXI File, data 14041 14042#------------------------------------------------------------------------------ 14043# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ 14044# ncr: file(1) magic for NCR Tower objects 14045# 14046# contributed by 14047# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 14048# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 14049# 140500 beshort 000610 Tower/XP rel 2 object 14051>12 belong >0 not stripped 14052>20 beshort 0407 executable 14053>20 beshort 0410 pure executable 14054>22 beshort >0 - version %ld 140550 beshort 000615 Tower/XP rel 2 object 14056>12 belong >0 not stripped 14057>20 beshort 0407 executable 14058>20 beshort 0410 pure executable 14059>22 beshort >0 - version %ld 140600 beshort 000620 Tower/XP rel 3 object 14061>12 belong >0 not stripped 14062>20 beshort 0407 executable 14063>20 beshort 0410 pure executable 14064>22 beshort >0 - version %ld 140650 beshort 000625 Tower/XP rel 3 object 14066>12 belong >0 not stripped 14067>20 beshort 0407 executable 14068>20 beshort 0410 pure executable 14069>22 beshort >0 - version %ld 140700 beshort 000630 Tower32/600/400 68020 object 14071>12 belong >0 not stripped 14072>20 beshort 0407 executable 14073>20 beshort 0410 pure executable 14074>22 beshort >0 - version %ld 140750 beshort 000640 Tower32/800 68020 14076>18 beshort &020000 w/68881 object 14077>18 beshort &040000 compatible object 14078>18 beshort &060000 object 14079>20 beshort 0407 executable 14080>20 beshort 0413 pure executable 14081>12 belong >0 not stripped 14082>22 beshort >0 - version %ld 140830 beshort 000645 Tower32/800 68010 14084>18 beshort &040000 compatible object 14085>18 beshort &060000 object 14086>20 beshort 0407 executable 14087>20 beshort 0413 pure executable 14088>12 belong >0 not stripped 14089>22 beshort >0 - version %ld 14090 14091#------------------------------------------------------------------------------ 14092# $File: netbsd,v 1.18 2009/09/19 16:28:11 christos Exp $ 14093# netbsd: file(1) magic for NetBSD objects 14094# 14095# All new-style magic numbers are in network byte order. 14096# 14097 140980 lelong 000000407 a.out NetBSD little-endian object file 14099>16 lelong >0 not stripped 141000 belong 000000407 a.out NetBSD big-endian object file 14101>16 belong >0 not stripped 14102 141030 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 14104>0 byte &0x80 14105>>20 lelong <4096 shared library 14106>>20 lelong =4096 dynamically linked executable 14107>>20 lelong >4096 dynamically linked executable 14108>0 byte ^0x80 executable 14109>16 lelong >0 not stripped 141100 belong&0377777777 041400410 a.out NetBSD/i386 pure 14111>0 byte &0x80 dynamically linked executable 14112>0 byte ^0x80 executable 14113>16 lelong >0 not stripped 141140 belong&0377777777 041400407 a.out NetBSD/i386 14115>0 byte &0x80 dynamically linked executable 14116>0 byte ^0x80 14117>>0 byte &0x40 position independent 14118>>20 lelong !0 executable 14119>>20 lelong =0 object file 14120>16 lelong >0 not stripped 141210 belong&0377777777 041400507 a.out NetBSD/i386 core 14122>12 string >\0 from '%s' 14123>32 lelong !0 (signal %d) 14124 141250 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 14126>0 byte &0x80 14127>>20 belong <8192 shared library 14128>>20 belong =8192 dynamically linked executable 14129>>20 belong >8192 dynamically linked executable 14130>0 byte ^0x80 executable 14131>16 belong >0 not stripped 141320 belong&0377777777 041600410 a.out NetBSD/m68k pure 14133>0 byte &0x80 dynamically linked executable 14134>0 byte ^0x80 executable 14135>16 belong >0 not stripped 141360 belong&0377777777 041600407 a.out NetBSD/m68k 14137>0 byte &0x80 dynamically linked executable 14138>0 byte ^0x80 14139>>0 byte &0x40 position independent 14140>>20 belong !0 executable 14141>>20 belong =0 object file 14142>16 belong >0 not stripped 141430 belong&0377777777 041600507 a.out NetBSD/m68k core 14144>12 string >\0 from '%s' 14145>32 belong !0 (signal %d) 14146 141470 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 14148>0 byte &0x80 14149>>20 belong <4096 shared library 14150>>20 belong =4096 dynamically linked executable 14151>>20 belong >4096 dynamically linked executable 14152>0 byte ^0x80 executable 14153>16 belong >0 not stripped 141540 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 14155>0 byte &0x80 dynamically linked executable 14156>0 byte ^0x80 executable 14157>16 belong >0 not stripped 141580 belong&0377777777 042000407 a.out NetBSD/m68k4k 14159>0 byte &0x80 dynamically linked executable 14160>0 byte ^0x80 14161>>0 byte &0x40 position independent 14162>>20 belong !0 executable 14163>>20 belong =0 object file 14164>16 belong >0 not stripped 141650 belong&0377777777 042000507 a.out NetBSD/m68k4k core 14166>12 string >\0 from '%s' 14167>32 belong !0 (signal %d) 14168 141690 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 14170>0 byte &0x80 14171>>20 lelong <4096 shared library 14172>>20 lelong =4096 dynamically linked executable 14173>>20 lelong >4096 dynamically linked executable 14174>0 byte ^0x80 executable 14175>16 lelong >0 not stripped 141760 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 14177>0 byte &0x80 dynamically linked executable 14178>0 byte ^0x80 executable 14179>16 lelong >0 not stripped 141800 belong&0377777777 042200407 a.out NetBSD/ns32532 14181>0 byte &0x80 dynamically linked executable 14182>0 byte ^0x80 14183>>0 byte &0x40 position independent 14184>>20 lelong !0 executable 14185>>20 lelong =0 object file 14186>16 lelong >0 not stripped 141870 belong&0377777777 042200507 a.out NetBSD/ns32532 core 14188>12 string >\0 from '%s' 14189>32 lelong !0 (signal %d) 14190 141910 belong&0377777777 045200507 a.out NetBSD/powerpc core 14192>12 string >\0 from '%s' 14193 141940 belong&0377777777 042400413 a.out NetBSD/sparc demand paged 14195>0 byte &0x80 14196>>20 belong <8192 shared library 14197>>20 belong =8192 dynamically linked executable 14198>>20 belong >8192 dynamically linked executable 14199>0 byte ^0x80 executable 14200>16 belong >0 not stripped 142010 belong&0377777777 042400410 a.out NetBSD/sparc pure 14202>0 byte &0x80 dynamically linked executable 14203>0 byte ^0x80 executable 14204>16 belong >0 not stripped 142050 belong&0377777777 042400407 a.out NetBSD/sparc 14206>0 byte &0x80 dynamically linked executable 14207>0 byte ^0x80 14208>>0 byte &0x40 position independent 14209>>20 belong !0 executable 14210>>20 belong =0 object file 14211>16 belong >0 not stripped 142120 belong&0377777777 042400507 a.out NetBSD/sparc core 14213>12 string >\0 from '%s' 14214>32 belong !0 (signal %d) 14215 142160 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 14217>0 byte &0x80 14218>>20 lelong <4096 shared library 14219>>20 lelong =4096 dynamically linked executable 14220>>20 lelong >4096 dynamically linked executable 14221>0 byte ^0x80 executable 14222>16 lelong >0 not stripped 142230 belong&0377777777 042600410 a.out NetBSD/pmax pure 14224>0 byte &0x80 dynamically linked executable 14225>0 byte ^0x80 executable 14226>16 lelong >0 not stripped 142270 belong&0377777777 042600407 a.out NetBSD/pmax 14228>0 byte &0x80 dynamically linked executable 14229>0 byte ^0x80 14230>>0 byte &0x40 position independent 14231>>20 lelong !0 executable 14232>>20 lelong =0 object file 14233>16 lelong >0 not stripped 142340 belong&0377777777 042600507 a.out NetBSD/pmax core 14235>12 string >\0 from '%s' 14236>32 lelong !0 (signal %d) 14237 142380 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 14239>0 byte &0x80 14240>>20 lelong <4096 shared library 14241>>20 lelong =4096 dynamically linked executable 14242>>20 lelong >4096 dynamically linked executable 14243>0 byte ^0x80 executable 14244>16 lelong >0 not stripped 142450 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 14246>0 byte &0x80 dynamically linked executable 14247>0 byte ^0x80 executable 14248>16 lelong >0 not stripped 142490 belong&0377777777 043000407 a.out NetBSD/vax 1k 14250>0 byte &0x80 dynamically linked executable 14251>0 byte ^0x80 14252>>0 byte &0x40 position independent 14253>>20 lelong !0 executable 14254>>20 lelong =0 object file 14255>16 lelong >0 not stripped 142560 belong&0377777777 043000507 a.out NetBSD/vax 1k core 14257>12 string >\0 from '%s' 14258>32 lelong !0 (signal %d) 14259 142600 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 14261>0 byte &0x80 14262>>20 lelong <4096 shared library 14263>>20 lelong =4096 dynamically linked executable 14264>>20 lelong >4096 dynamically linked executable 14265>0 byte ^0x80 executable 14266>16 lelong >0 not stripped 142670 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 14268>0 byte &0x80 dynamically linked executable 14269>0 byte ^0x80 executable 14270>16 lelong >0 not stripped 142710 belong&0377777777 045400407 a.out NetBSD/vax 4k 14272>0 byte &0x80 dynamically linked executable 14273>0 byte ^0x80 14274>>0 byte &0x40 position independent 14275>>20 lelong !0 executable 14276>>20 lelong =0 object file 14277>16 lelong >0 not stripped 142780 belong&0377777777 045400507 a.out NetBSD/vax 4k core 14279>12 string >\0 from '%s' 14280>32 lelong !0 (signal %d) 14281 14282# NetBSD/alpha does not support (and has never supported) a.out objects, 14283# so no rules are provided for them. NetBSD/alpha ELF objects are 14284# dealt with in "elf". 142850 lelong 0x00070185 ECOFF NetBSD/alpha binary 14286>10 leshort 0x0001 not stripped 14287>10 leshort 0x0000 stripped 142880 belong&0377777777 043200507 a.out NetBSD/alpha core 14289>12 string >\0 from '%s' 14290>32 lelong !0 (signal %d) 14291 142920 belong&0377777777 043400413 a.out NetBSD/mips demand paged 14293>0 byte &0x80 14294>>20 belong <8192 shared library 14295>>20 belong =8192 dynamically linked executable 14296>>20 belong >8192 dynamically linked executable 14297>0 byte ^0x80 executable 14298>16 belong >0 not stripped 142990 belong&0377777777 043400410 a.out NetBSD/mips pure 14300>0 byte &0x80 dynamically linked executable 14301>0 byte ^0x80 executable 14302>16 belong >0 not stripped 143030 belong&0377777777 043400407 a.out NetBSD/mips 14304>0 byte &0x80 dynamically linked executable 14305>0 byte ^0x80 14306>>0 byte &0x40 position independent 14307>>20 belong !0 executable 14308>>20 belong =0 object file 14309>16 belong >0 not stripped 143100 belong&0377777777 043400507 a.out NetBSD/mips core 14311>12 string >\0 from '%s' 14312>32 belong !0 (signal %d) 14313 143140 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 14315>0 byte &0x80 14316>>20 lelong <4096 shared library 14317>>20 lelong =4096 dynamically linked executable 14318>>20 lelong >4096 dynamically linked executable 14319>0 byte ^0x80 executable 14320>16 lelong >0 not stripped 143210 belong&0377777777 043600410 a.out NetBSD/arm32 pure 14322>0 byte &0x80 dynamically linked executable 14323>0 byte ^0x80 executable 14324>16 lelong >0 not stripped 143250 belong&0377777777 043600407 a.out NetBSD/arm32 14326>0 byte &0x80 dynamically linked executable 14327>0 byte ^0x80 14328>>0 byte &0x40 position independent 14329>>20 lelong !0 executable 14330>>20 lelong =0 object file 14331>16 lelong >0 not stripped 14332# NetBSD/arm26 has always used ELF objects, but it shares a core file 14333# format with NetBSD/arm32. 143340 belong&0377777777 043600507 a.out NetBSD/arm core 14335>12 string >\0 from '%s' 14336>32 lelong !0 (signal %d) 14337 14338#------------------------------------------------------------------------------ 14339# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ 14340# netscape: file(1) magic for Netscape files 14341# "H. Nanosecond" <aldomel@ix.netcom.com> 14342# version 3 and 4 I think 14343# 14344 14345# Netscape Address book .nab 143460 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 14347 14348# Netscape Communicator address book 143490 string \000\017\102\111 Netscape Communicator address book 14350 14351# .snm Caches 143520 string #\ Netscape\ folder\ cache Netscape folder cache 143530 string \000\036\204\220\000 Netscape folder cache 14354# .n2p 14355# Net 2 Phone 14356#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 143570 string SX961999 Net2phone 14358 14359# 14360#This is files ending in .art, FIXME add more rules 143610 string JG\004\016\0\0\0\0 ART 14362 14363#------------------------------------------------------------------------------ 14364# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 14365# netware: file(1) magic for NetWare Loadable Modules (NLMs) 14366# From: Mads Martin Joergensen <mmj@suse.de> 14367 143680 string NetWare\ Loadable\ Module NetWare Loadable Module 14369 14370#------------------------------------------------------------------------------ 14371# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 14372# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 14373# 143740 string StartFontMetrics ASCII font metrics 143750 string StartFont ASCII font bits 143760 belong 0x137A2944 NeWS bitmap font 143770 belong 0x137A2947 NeWS font family 143780 belong 0x137A2950 scalable OpenFont binary 143790 belong 0x137A2951 encrypted scalable OpenFont binary 143808 belong 0x137A2B45 X11/NeWS bitmap font 143818 belong 0x137A2B48 X11/NeWS font family 14382 14383#------------------------------------------------------------------------------ 14384# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $ 14385# nitpicker: file(1) magic for Flowfiles. 14386# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 143870 string NPFF NItpicker Flow File 14388>4 byte x V%d. 14389>5 byte x %d 14390>6 bedate x started: %s 14391>10 bedate x stopped: %s 14392>14 belong x Bytes: %u 14393>18 belong x Bytes1: %u 14394>22 belong x Flows: %u 14395>26 belong x Pkts: %u 14396 14397#------------------------------------------------------------------------------ 14398# $File: ocaml,v 1.4 2009/09/19 16:28:11 christos Exp $ 14399# ocaml: file(1) magic for Objective Caml files. 144000 string Caml1999 Objective caml 14401>8 string X exec file 14402>8 string I interface file (.cmi) 14403>8 string O object file (.cmo) 14404>8 string A library file (.cma) 14405>8 string Y native object file (.cmx) 14406>8 string Z native library file (.cmxa) 14407>8 string M abstract syntax tree implementation file 14408>8 string N abstract syntax tree interface file 14409>9 string >\0 (Version %3.3s). 14410 14411#------------------------------------------------------------------------------ 14412# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 14413# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 144140 string Octave-1-L Octave binary data (little endian) 144150 string Octave-1-B Octave binary data (big endian) 14416 14417#------------------------------------------------------------------------------ 14418# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ 14419# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 14420# storage (http://en.wikipedia.org/wiki/Structured_Storage) 14421# Additional tests for OLE 2 Compound Documents should be under this recipe. 14422 144230 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 14424# - Microstation V8 DGN files (www.bentley.com) 14425# Last update on 10/23/2006 by Lester Hightower 14426> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 14427# - Visio documents 14428# Last update on 10/23/2006 by Lester Hightower 14429> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 14430 14431#------------------------------------------------------------------------------ 14432# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 14433# olf: file(1) magic for OLF executables 14434# 14435# We have to check the byte order flag to see what byte order all the 14436# other stuff in the header is in. 14437# 14438# MIPS R3000 may also be for MIPS R2000. 14439# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 14440# 14441# Created by Erik Theisen <etheisen@openbsd.org> 14442# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 144430 string \177OLF OLF 14444>4 byte 0 invalid class 14445>4 byte 1 32-bit 14446>4 byte 2 64-bit 14447>7 byte 0 invalid os 14448>7 byte 1 OpenBSD 14449>7 byte 2 NetBSD 14450>7 byte 3 FreeBSD 14451>7 byte 4 4.4BSD 14452>7 byte 5 Linux 14453>7 byte 6 SVR4 14454>7 byte 7 esix 14455>7 byte 8 Solaris 14456>7 byte 9 Irix 14457>7 byte 10 SCO 14458>7 byte 11 Dell 14459>7 byte 12 NCR 14460>5 byte 0 invalid byte order 14461>5 byte 1 LSB 14462>>16 leshort 0 no file type, 14463>>16 leshort 1 relocatable, 14464>>16 leshort 2 executable, 14465>>16 leshort 3 shared object, 14466# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 14467# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 14468>>16 leshort 4 core file 14469>>>(0x38+0xcc) string >\0 of '%s' 14470>>>(0x38+0x10) lelong >0 (signal %d), 14471>>16 leshort &0xff00 processor-specific, 14472>>18 leshort 0 no machine, 14473>>18 leshort 1 AT&T WE32100 - invalid byte order, 14474>>18 leshort 2 SPARC - invalid byte order, 14475>>18 leshort 3 Intel 80386, 14476>>18 leshort 4 Motorola 68000 - invalid byte order, 14477>>18 leshort 5 Motorola 88000 - invalid byte order, 14478>>18 leshort 6 Intel 80486, 14479>>18 leshort 7 Intel 80860, 14480>>18 leshort 8 MIPS R3000_BE - invalid byte order, 14481>>18 leshort 9 Amdahl - invalid byte order, 14482>>18 leshort 10 MIPS R3000_LE, 14483>>18 leshort 11 RS6000 - invalid byte order, 14484>>18 leshort 15 PA-RISC - invalid byte order, 14485>>18 leshort 16 nCUBE, 14486>>18 leshort 17 VPP500, 14487>>18 leshort 18 SPARC32PLUS, 14488>>18 leshort 20 PowerPC, 14489>>18 leshort 0x9026 Alpha, 14490>>20 lelong 0 invalid version 14491>>20 lelong 1 version 1 14492>>36 lelong 1 MathCoPro/FPU/MAU Required 14493>8 string >\0 (%s) 14494>5 byte 2 MSB 14495>>16 beshort 0 no file type, 14496>>16 beshort 1 relocatable, 14497>>16 beshort 2 executable, 14498>>16 beshort 3 shared object, 14499>>16 beshort 4 core file, 14500>>>(0x38+0xcc) string >\0 of '%s' 14501>>>(0x38+0x10) belong >0 (signal %d), 14502>>16 beshort &0xff00 processor-specific, 14503>>18 beshort 0 no machine, 14504>>18 beshort 1 AT&T WE32100, 14505>>18 beshort 2 SPARC, 14506>>18 beshort 3 Intel 80386 - invalid byte order, 14507>>18 beshort 4 Motorola 68000, 14508>>18 beshort 5 Motorola 88000, 14509>>18 beshort 6 Intel 80486 - invalid byte order, 14510>>18 beshort 7 Intel 80860, 14511>>18 beshort 8 MIPS R3000_BE, 14512>>18 beshort 9 Amdahl, 14513>>18 beshort 10 MIPS R3000_LE - invalid byte order, 14514>>18 beshort 11 RS6000, 14515>>18 beshort 15 PA-RISC, 14516>>18 beshort 16 nCUBE, 14517>>18 beshort 17 VPP500, 14518>>18 beshort 18 SPARC32PLUS, 14519>>18 beshort 20 PowerPC or cisco 4500, 14520>>18 beshort 21 cisco 7500, 14521>>18 beshort 24 cisco SVIP, 14522>>18 beshort 25 cisco 7200, 14523>>18 beshort 36 cisco 12000, 14524>>18 beshort 0x9026 Alpha, 14525>>20 belong 0 invalid version 14526>>20 belong 1 version 1 14527>>36 belong 1 MathCoPro/FPU/MAU Required 14528 14529#------------------------------------------------------------------------------ 14530# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ 14531# os2: file(1) magic for OS/2 files 14532# 14533 14534# Provided 1998/08/22 by 14535# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 145361 search/1 InternetShortcut MS Windows 95 Internet shortcut text 14537>24 search/1 >\ (URL=<%s>) 14538 14539# OS/2 URL objects 14540# Provided 1998/08/22 by 14541# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 14542#0 string http: OS/2 URL object text 14543#>5 string >\ (WWW) <http:%s> 14544#0 string mailto: OS/2 URL object text 14545#>7 string >\ (email) <%s> 14546#0 string news: OS/2 URL object text 14547#>5 string >\ (Usenet) <%s> 14548#0 string ftp: OS/2 URL object text 14549#>4 string >\ (FTP) <ftp:%s> 14550#0 string file: OS/2 URL object text 14551#>5 string >\ (Local file) <%s> 14552 14553# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 14554# Carl Hauser (chauser.parc@xerox.com) and 14555# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 14556# list the following header format in inf02a.doc: 14557# 14558# int16 ID; // ID magic word (5348h = "HS") 14559# int8 unknown1; // unknown purpose, could be third letter of ID 14560# int8 flags; // probably a flag word... 14561# // bit 0: set if INF style file 14562# // bit 4: set if HLP style file 14563# // patching this byte allows reading HLP files 14564# // using the VIEW command, while help files 14565# // seem to work with INF settings here as well. 14566# int16 hdrsize; // total size of header 14567# int16 unknown2; // unknown purpose 14568# 145690 string HSP\x01\x9b\x00 OS/2 INF 14570>107 string >0 (%s) 145710 string HSP\x10\x9b\x00 OS/2 HLP 14572>107 string >0 (%s) 14573 14574# OS/2 INI (this is a guess) 145750 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 14576 14577#------------------------------------------------------------------------------ 14578# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 14579# os400: file(1) magic for IBM OS/400 files 14580# 14581# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 14582# In spite of its quite variable format (due to internal memory page 14583# length differences between CISC and RISC versions of the OS) the 14584# SAVF structure hasn't suitable offsets to identify the catalog 14585# header in the first descriptor where there are some useful infos, 14586# so we must search in a somewhat large area for a particular string 14587# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 14588# descriptor space) preceded by a two byte constant. 14589# 145901090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 14591>&212 byte 0x01 \b, created with SAVOBJ 14592>&212 byte 0x02 \b, created with SAVLIB 14593>&212 byte 0x07 \b, created with SAVCFG 14594>&212 byte 0x08 \b, created with SAVSECDTA 14595>&212 byte 0x0A \b, created with SAVSECDTA 14596>&212 byte 0x0B \b, created with SAVDLO 14597>&212 byte 0x0D \b, created with SAVLICPGM 14598>&212 byte 0x11 \b, created with SAVCHGOBJ 14599>&213 byte 0x44 \b, at least V5R4 to open 14600>&213 byte 0x43 \b, at least V5R3 to open 14601>&213 byte 0x42 \b, at least V5R2 to open 14602>&213 byte 0x41 \b, at least V5R1 to open 14603>&213 byte 0x40 \b, at least V4R5 to open 14604>&213 byte 0x3F \b, at least V4R4 to open 14605>&213 byte 0x3E \b, at least V4R3 to open 14606>&213 byte 0x3C \b, at least V4R2 to open 14607>&213 byte 0x3D \b, at least V4R1M4 to open 14608>&213 byte 0x3B \b, at least V4R1 to open 14609>&213 byte 0x3A \b, at least V3R7 to open 14610>&213 byte 0x35 \b, at least V3R6 to open 14611>&213 byte 0x36 \b, at least V3R2 to open 14612>&213 byte 0x34 \b, at least V3R1 to open 14613>&213 byte 0x31 \b, at least V3R0M5 to open 14614>&213 byte 0x30 \b, at least V2R3 to open 14615 14616#------------------------------------------------------------------------------ 14617# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $ 14618# 14619# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 14620# 14621# Redistribution and use in source and binary forms, with or without 14622# modification, are permitted provided that the following conditions 14623# are met: 14624# 1. Redistributions of source code must retain the above copyright 14625# notice, this list of conditions and the following disclaimer. 14626# 2. Redistributions in binary form must reproduce the above copyright 14627# notice, this list of conditions and the following disclaimer in the 14628# documentation and/or other materials provided with the distribution. 14629# 3. All advertising materials mentioning features or use of this software 14630# must display the following acknowledgement: 14631# This product includes software developed by Ignatios Souvatzis for 14632# the NetBSD project. 14633# 4. The name of the author may not be used to endorse or promote products 14634# derived from this software without specific prior written permission. 14635# 14636# 14637# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 14638# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 14639# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 14640# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 14641# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 14642# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 14643# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 14644# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 14645# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 14646# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 14647# 14648# 14649# 14650# OS9/6809 module descriptions: 14651# 146520 beshort 0x87CD OS9/6809 module: 14653# 14654>6 byte&0x0f 0x00 non-executable 14655>6 byte&0x0f 0x01 machine language 14656>6 byte&0x0f 0x02 BASIC I-code 14657>6 byte&0x0f 0x03 Pascal P-code 14658>6 byte&0x0f 0x04 C I-code 14659>6 byte&0x0f 0x05 COBOL I-code 14660>6 byte&0x0f 0x06 Fortran I-code 14661# 14662>6 byte&0xf0 0x10 program executable 14663>6 byte&0xf0 0x20 subroutine 14664>6 byte&0xf0 0x30 multi-module 14665>6 byte&0xf0 0x40 data module 14666# 14667>6 byte&0xf0 0xC0 system module 14668>6 byte&0xf0 0xD0 file manager 14669>6 byte&0xf0 0xE0 device driver 14670>6 byte&0xf0 0xF0 device descriptor 14671# 14672# OS9/m68k stuff (to be continued) 14673# 146740 beshort 0x4AFC OS9/68K module: 14675# 14676# attr 14677>0x14 byte&0x80 0x80 re-entrant 14678>0x14 byte&0x40 0x40 ghost 14679>0x14 byte&0x20 0x20 system-state 14680# 14681# lang: 14682# 14683>0x13 byte 1 machine language 14684>0x13 byte 2 BASIC I-code 14685>0x13 byte 3 Pascal P-code 14686>0x13 byte 4 C I-code 14687>0x13 byte 5 COBOL I-code 14688>0x13 byte 6 Fortran I-code 14689# 14690# 14691# type: 14692# 14693>0x12 byte 1 program executable 14694>0x12 byte 2 subroutine 14695>0x12 byte 3 multi-module 14696>0x12 byte 4 data module 14697>0x12 byte 11 trap library 14698>0x12 byte 12 system module 14699>0x12 byte 13 file manager 14700>0x12 byte 14 device driver 14701>0x12 byte 15 device descriptor 14702 14703#------------------------------------------------------------------------------ 14704# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 14705# 14706# Mach magic number info 14707# 147080 long 0xefbe OSF/Rose object 14709# I386 magic number info 14710# 147110 short 0565 i386 COFF object 14712 14713#------------------------------------------------------------------------------ 14714# $File: palm,v 1.7 2009/09/19 16:28:11 christos Exp $ 14715# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 14716# 14717# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 14718 14719# appl 1472060 belong 0x6170706c PalmOS application 14721>0 string >\0 "%s" 14722# TEXt 1472360 belong 0x54455874 AportisDoc file 14724>0 string >\0 "%s" 14725# HACK 1472660 belong 0x4841434b HackMaster hack 14727>0 string >\0 "%s" 14728 14729# Variety of PalmOS document types 14730# Michael-John Turner <mj@debian.org> 14731# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1473260 string BVokBDIC BDicty PalmOS document 14733>0 string >\0 "%s" 1473460 string DB99DBOS DB PalmOS document 14735>0 string >\0 "%s" 1473660 string vIMGView FireViewer/ImageViewer PalmOS document 14737>0 string >\0 "%s" 1473860 string PmDBPmDB HanDBase PalmOS document 14739>0 string >\0 "%s" 1474060 string InfoINDB InfoView PalmOS document 14741>0 string >\0 "%s" 1474260 string ToGoToGo iSilo PalmOS document 14743>0 string >\0 "%s" 1474460 string JfDbJBas JFile PalmOS document 14745>0 string >\0 "%s" 1474660 string JfDbJFil JFile Pro PalmOS document 14747>0 string >\0 "%s" 1474860 string DATALSdb List PalmOS document 14749>0 string >\0 "%s" 1475060 string Mdb1Mdb1 MobileDB PalmOS document 14751>0 string >\0 "%s" 1475260 string PNRdPPrs PeanutPress PalmOS document 14753>0 string >\0 "%s" 1475460 string DataPlkr Plucker PalmOS document 14755>0 string >\0 "%s" 1475660 string DataSprd QuickSheet PalmOS document 14757>0 string >\0 "%s" 1475860 string SM01SMem SuperMemo PalmOS document 14759>0 string >\0 "%s" 1476060 string TEXtTlDc TealDoc PalmOS document 14761>0 string >\0 "%s" 1476260 string InfoTlIf TealInfo PalmOS document 14763>0 string >\0 "%s" 1476460 string DataTlMl TealMeal PalmOS document 14765>0 string >\0 "%s" 1476660 string DataTlPt TealPaint PalmOS document 14767>0 string >\0 "%s" 1476860 string dataTDBP ThinkDB PalmOS document 14769>0 string >\0 "%s" 1477060 string TdatTide Tides PalmOS document 14771>0 string >\0 "%s" 1477260 string ToRaTRPW TomeRaider PalmOS document 14773>0 string >\0 "%s" 14774 14775# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 14776# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 14777# annotations. 14778# For other versions, just outputs version. 14779# 1478060 string zTXT A GutenPalm zTXT e-book 14781>0 string >\0 "%s" 14782>(0x4E.L) byte 0 14783>>(0x4E.L+1) byte x (v0.%02d) 14784>(0x4E.L) byte 1 14785>>(0x4E.L+1) byte x (v1.%02d) 14786>>>(0x4E.L+10) beshort >0 14787>>>>(0x4E.L+10) beshort <2 - 1 bookmark 14788>>>>(0x4E.L+10) beshort >1 - %d bookmarks 14789>>>(0x4E.L+14) beshort >0 14790>>>>(0x4E.L+14) beshort <2 - 1 annotation 14791>>>>(0x4E.L+14) beshort >1 - %d annotations 14792>(0x4E.L) byte >1 (v%d. 14793>>(0x4E.L+1) byte x %02d) 14794 14795# Palm OS .prc file types 1479660 string libr Palm OS dynamic library data 14797>0 string >\0 "%s" 1479860 string ptch Palm OS operating system patch data 14799>0 string >\0 "%s" 14800 14801# Mobipocket (www.mobipocket.com), donated by Carl Witty 1480260 string BOOKMOBI Mobipocket E-book 14803>0 string >\0 "%s" 14804 14805#------------------------------------------------------------------------------ 14806# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 14807# 14808# Parix COFF executables 14809# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 14810# 148110 beshort&0xfff 0xACE PARIX 14812>0 byte&0xf0 0x80 T800 14813>0 byte&0xf0 0x90 T9000 14814>19 byte&0x02 0x02 executable 14815>19 byte&0x02 0x00 object 14816>19 byte&0x0c 0x00 not stripped 14817 14818#------------------------------------------------------------------------------ 14819# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 14820# pbm: file(1) magic for Portable Bitmap files 14821# 14822# XXX - byte order? 14823# 148240 short 0x2a17 "compact bitmap" format (Poskanzer) 14825 14826#------------------------------------------------------------------------------ 14827# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $ 14828# pdf: file(1) magic for Portable Document Format 14829# 14830 148310 string %PDF- PDF document 14832!:mime application/pdf 14833>5 byte x \b, version %c 14834>7 byte x \b.%c 14835 14836# From: Nick Schmalenberger <nick@schmalenberger.us> 14837# Forms Data Format 148380 string %FDF- FDF document 14839>5 byte x \b, version %c 14840>7 byte x \b.%c 14841 14842#------------------------------------------------------------------------------ 14843# $File: pdp,v 1.8 2009/09/19 16:28:11 christos Exp $ 14844# pdp: file(1) magic for PDP-11 executable/object and APL workspace 14845# 148460 lelong 0101555 PDP-11 single precision APL workspace 148470 lelong 0101554 PDP-11 double precision APL workspace 14848# 14849# PDP-11 a.out 14850# 148510 leshort 0407 PDP-11 executable 14852>8 leshort >0 not stripped 14853>15 byte >0 - version %ld 14854 148550 leshort 0401 PDP-11 UNIX/RT ldp 148560 leshort 0405 PDP-11 old overlay 14857 148580 leshort 0410 PDP-11 pure executable 14859>8 leshort >0 not stripped 14860>15 byte >0 - version %ld 14861 148620 leshort 0411 PDP-11 separate I&D executable 14863>8 leshort >0 not stripped 14864>15 byte >0 - version %ld 14865 148660 leshort 0437 PDP-11 kernel overlay 14867 14868# These last three are derived from 2.11BSD file(1) 148690 leshort 0413 PDP-11 demand-paged pure executable 14870>8 leshort >0 not stripped 14871 148720 leshort 0430 PDP-11 overlaid pure executable 14873>8 leshort >0 not stripped 14874 148750 leshort 0431 PDP-11 overlaid separate executable 14876>8 leshort >0 not stripped 14877 14878#------------------------------------------------------------------------------ 14879# $File: perl,v 1.16 2009/09/19 16:28:11 christos Exp $ 14880# perl: file(1) magic for Larry Wall's perl language. 14881# 14882# The `eval' lines recognizes an outrageously clever hack. 14883# Keith Waclena <keith@cerberus.uchicago.edu> 14884# Send additions to <perl5-porters@perl.org> 148850 search/1/w #!\ /bin/perl Perl script text executable 14886!:mime text/x-perl 148870 search/1 eval\ "exec\ /bin/perl Perl script text 14888!:mime text/x-perl 148890 search/1/w #!\ /usr/bin/perl Perl script text executable 14890!:mime text/x-perl 148910 search/1 eval\ "exec\ /usr/bin/perl Perl script text 14892!:mime text/x-perl 148930 search/1/w #!\ /usr/local/bin/perl Perl script text executable 14894!:mime text/x-perl 148950 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text 14896!:mime text/x-perl 148970 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 14898!:mime text/x-perl 14899 14900 14901# by Dmitry V. Levin and Alexey Tourbin 14902# check the first line 149030 search/1 package 14904>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 14905# not 'p', check other lines 149060 search/1 !p 14907>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 14908>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 14909 14910 14911 14912# Perl POD documents 14913# From: Tom Hukins <tom@eborcom.com> 149140 search/1/W \=pod\n Perl POD document text 149150 search/1/W \n\=pod\n Perl POD document text 149160 search/1/W \=head1\ Perl POD document text 149170 search/1/W \n\=head1\ Perl POD document text 149180 search/1/W \=head2\ Perl POD document text 149190 search/1/W \n\=head2\ Perl POD document text 14920 14921# Perl Storable data files. 149220 string perl-store perl Storable (v0.6) data 14923>4 byte >0 (net-order %d) 14924>>4 byte &01 (network-ordered) 14925>>4 byte =3 (major 1) 14926>>4 byte =2 (major 1) 14927 149280 string pst0 perl Storable (v0.7) data 14929>4 byte >0 14930>>4 byte &01 (network-ordered) 14931>>4 byte =5 (major 2) 14932>>4 byte =4 (major 2) 14933>>5 byte >0 (minor %d) 14934 14935#------------------------------------------------------------------------------ 14936# $File: pgp,v 1.9 2009/09/19 16:28:11 christos Exp $ 14937# pgp: file(1) magic for Pretty Good Privacy 14938# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 14939# 149400 beshort 0x9900 PGP key public ring 14941!:mime application/x-pgp-keyring 149420 beshort 0x9501 PGP key security ring 14943!:mime application/x-pgp-keyring 149440 beshort 0x9500 PGP key security ring 14945!:mime application/x-pgp-keyring 149460 beshort 0xa600 PGP encrypted data 14947#!:mime application/pgp-encrypted 14948#0 string -----BEGIN\040PGP text/PGP armored data 14949!:mime text/PGP # encoding: armored data 14950#>15 string PUBLIC\040KEY\040BLOCK- public key block 14951#>15 string MESSAGE- message 14952#>15 string SIGNED\040MESSAGE- signed message 14953#>15 string PGP\040SIGNATURE- signature 14954 149552 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block 14956!:mime application/pgp-keys 149570 string -----BEGIN\040PGP\40MESSAGE- PGP message 14958!:mime application/pgp 149590 string -----BEGIN\040PGP\40SIGNATURE- PGP signature 14960!:mime application/pgp-signature 14961 14962#------------------------------------------------------------------------------ 14963# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 14964# pkgadd: file(1) magic for SysV R4 PKG Datastreams 14965# 149660 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 14967!:mime application/x-svr4-package 14968 14969#------------------------------------------------------------------------------ 14970# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 14971# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 14972# From: "Stefan A. Haubenthal" <polluks@web.de> 14973# 149740 belong 0x00000107 Plan 9 executable, Motorola 68k 149750 belong 0x000001EB Plan 9 executable, Intel 386 149760 belong 0x00000247 Plan 9 executable, Intel 960 149770 belong 0x000002AB Plan 9 executable, SPARC 149780 belong 0x00000407 Plan 9 executable, MIPS R3000 149790 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 149800 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 149810 belong 0x000005AB Plan 9 executable, AMD 29000 149820 belong 0x00000647 Plan 9 executable, ARM 7-something 149830 belong 0x000006EB Plan 9 executable, PowerPC 149840 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 149850 belong 0x0000084B Plan 9 executable, DEC Alpha 14986 14987#------------------------------------------------------------------------------ 14988# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 14989# plus5: file(1) magic for Plus Five's UNIX MUMPS 14990# 14991# XXX - byte order? Paging Hokey.... 14992# 149930 short 0x259 mumps avl global 14994>2 byte >0 (V%d) 14995>6 byte >0 with %d byte name 14996>7 byte >0 and %d byte data cells 149970 short 0x25a mumps blt global 14998>2 byte >0 (V%d) 14999>8 short >0 - %d byte blocks 15000>15 byte 0x00 - P/D format 15001>15 byte 0x01 - P/K/D format 15002>15 byte 0x02 - K/D format 15003>15 byte >0x02 - Bad Flags 15004 15005#------------------------------------------------------------------------------ 15006# $File: printer,v 1.22 2009/09/19 16:28:11 christos Exp $ 15007# printer: file(1) magic for printer-formatted files 15008# 15009 15010# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 150110 string %! PostScript document text 15012!:mime application/postscript 15013!:apple ASPSTEXT 15014>2 string PS-Adobe- conforming 15015>>11 string >\0 DSC level %.3s 15016>>>15 string EPS \b, type %s 15017>>>15 string Query \b, type %s 15018>>>15 string ExitServer \b, type %s 15019>>>15 search/1000 %%LanguageLevel:\ 15020>>>>&0 string >\0 \b, Level %s 15021# Some PCs have the annoying habit of adding a ^D as a document separator 150220 string \004%! PostScript document text 15023!:mime application/postscript 15024!:apple ASPSTEXT 15025>3 string PS-Adobe- conforming 15026>>12 string >\0 DSC level %.3s 15027>>>16 string EPS \b, type %s 15028>>>16 string Query \b, type %s 15029>>>16 string ExitServer \b, type %s 15030>>>16 search/1000 %%LanguageLevel:\ 15031>>>>&0 string >\0 \b, Level %s 150320 string \033%-12345X%!PS PostScript document 15033 15034# DOS EPS Binary File Header 15035# From: Ed Sznyter <ews@Black.Market.NET> 150360 belong 0xC5D0D3C6 DOS EPS Binary File 15037>4 long >0 Postscript starts at byte %d 15038>>8 long >0 length %d 15039>>>12 long >0 Metafile starts at byte %d 15040>>>>16 long >0 length %d 15041>>>20 long >0 TIFF starts at byte %d 15042>>>>24 long >0 length %d 15043 15044# Summary: Adobe's PostScript Printer Description File 15045# Extension: .ppd 15046# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 15047# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 15048# 150490 string *PPD-Adobe:\x20 PPD file 15050>&0 string x \b, version %s 15051 15052# HP Printer Job Language 150530 string \033%-12345X@PJL HP Printer Job Language data 15054# HP Printer Job Language 15055# The header found on Win95 HP plot files is the "Silliest Thing possible" 15056# (TM) 15057# Every driver puts the language at some random position, with random case 15058# (LANGUAGE and Language) 15059# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 15060# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 15061# 150620 string \033%-12345X@PJL HP Printer Job Language data 15063>&0 string >\0 %s 15064>>&0 string >\0 %s 15065>>>&0 string >\0 %s 15066>>>>&0 string >\0 %s 15067#>15 string \ ENTER\ LANGUAGE\ = 15068#>31 string PostScript PostScript 15069 15070# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 150710 string \033E\033 HP PCL printer data 15072>3 string \&l0A - default page size 15073>3 string \&l1A - US executive page size 15074>3 string \&l2A - US letter page size 15075>3 string \&l3A - US legal page size 15076>3 string \&l26A - A4 page size 15077>3 string \&l80A - Monarch envelope size 15078>3 string \&l81A - No. 10 envelope size 15079>3 string \&l90A - Intl. DL envelope size 15080>3 string \&l91A - Intl. C5 envelope size 15081>3 string \&l100A - Intl. B5 envelope size 15082>3 string \&l-81A - No. 10 envelope size (landscape) 15083>3 string \&l-90A - Intl. DL envelope size (landscape) 15084 15085# IMAGEN printer-ready files: 150860 string @document( Imagen printer 15087# this only works if "language xxx" is first item in Imagen header. 15088>10 string language\ impress (imPRESS data) 15089>10 string language\ daisy (daisywheel text) 15090>10 string language\ diablo (daisywheel text) 15091>10 string language\ printer (line printer emulation) 15092>10 string language\ tektronix (Tektronix 4014 emulation) 15093# Add any other languages that your Imagen uses - remember 15094# to keep the word `text' if the file is human-readable. 15095# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 15096# 15097# Now magic for IMAGEN font files... 150980 string Rast RST-format raster font data 15099>45 string >0 face %s 15100# From Jukka Ukkonen 151010 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 15102 15103# From <mike@flyn.org> 15104# These are the /etc/magic entries to decode data sent to an Epson printer. 151050 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 15106 15107 15108#------------------------------------------------------------------------------ 15109# zenographics: file(1) magic for Zenographics ZjStream printer data 15110# Rick Richardson rickr@mn.rr.com 151110 string JZJZ 15112>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 151130 string ZJZJ 15114>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 15115 15116 15117#------------------------------------------------------------------------------ 15118# Oak Technologies printer stream 15119# Rick Richardson <rickr@mn.rr.com> 151200 string OAK 15121>0x07 byte 0 15122>0x0b byte 0 Oak Technologies printer stream 15123 15124# This would otherwise be recognized as PostScript - nick@debian.org 151250 string %!VMF SunClock's Vector Map Format data 15126 15127#------------------------------------------------------------------------------ 15128# HP LaserJet 1000 series downloadable firmware file 151290 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 15130 15131# From: Paolo <oopla@users.sf.net> 15132# Epson ESC/Page, ESC/PageColor 151330 string \x1b\x01@EJL Epson ESC/Page language printer data 15134 15135#------------------------------------------------------------------------------ 15136# $File: project,v 1.4 2009/09/19 16:28:11 christos Exp $ 15137# project: file(1) magic for Project management 15138# 15139# Magic strings for ftnchek project files. Alexander Mai 151400 string FTNCHEK_\ P project file for ftnchek 15141>10 string 1 version 2.7 15142>10 string 2 version 2.8 to 2.10 15143>10 string 3 version 2.11 or later 15144 15145#------------------------------------------------------------------------------ 15146# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $ 15147# psdbms: file(1) magic for psdatabase 15148# 151490 belong&0xff00ffff 0x56000000 ps database 15150>1 string >\0 version %s 15151>4 string >\0 from kernel %s 15152 15153#------------------------------------------------------------------------------ 15154# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 15155# pulsar: file(1) magic for Pulsar POP3 daemon binary files 15156# 15157# http://pulsar.sourceforge.net 15158# mailto:rok.papez@lugos.si 15159# 15160 151610 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 15162>4 ubelong x Version: %d. 15163>8 ubelong x \b%d 15164 15165 15166#------------------------------------------------------------------------------ 15167# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 15168# pyramid: file(1) magic for Pyramids 15169# 15170# XXX - byte order? 15171# 151720 long 0x50900107 Pyramid 90x family executable 151730 long 0x50900108 Pyramid 90x family pure executable 15174>16 long >0 not stripped 151750 long 0x5090010b Pyramid 90x family demand paged pure executable 15176>16 long >0 not stripped 15177 15178#------------------------------------------------------------------------------ 15179# $File: python,v 1.12 2009/10/27 14:49:57 christos Exp $ 15180# python: file(1) magic for python 15181# 15182# From: David Necas <yeti@physics.muni.cz> 15183# often the module starts with a multiline string 151840 string/t """ a python script text executable 15185# MAGIC as specified in Python/import.c (1.5 to 2.6a1 and 3.1a0, assuming 15186# that Py_UnicodeFlag is off for Python 2) 15187# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 151880 belong 0x994e0d0a python 1.5/1.6 byte-compiled 151890 belong 0x87c60d0a python 2.0 byte-compiled 151900 belong 0x2aeb0d0a python 2.1 byte-compiled 151910 belong 0x2ded0d0a python 2.2 byte-compiled 151920 belong 0x3bf20d0a python 2.3 byte-compiled 151930 belong 0x6df20d0a python 2.4 byte-compiled 151940 belong 0xb3f20d0a python 2.5 byte-compiled 151950 belong 0xd1f20d0a python 2.6 byte-compiled 151960 belong 0x3b0c0d0a python 3.0 byte-compiled 151970 belong 0x4f0c0d0a python 3.1 byte-compiled 15198 151990 search/1/w #!\ /usr/bin/python Python script text executable 15200!:mime text/x-python 152010 search/1/w #!\ /usr/local/bin/python Python script text executable 15202!:mime text/x-python 152030 search/1 #!/usr/bin/env\ python Python script text executable 15204!:mime text/x-python 152050 search/1 #!\ /usr/bin/env\ ruby Python script text executable 15206!:mime text/x-python 15207 15208# from module.submodule import func1, func2 152090 regex/ \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable 15210!:strength - 20 15211!:mime text/x-python 15212 15213# def __init__ (self, ...): 152140 search/4096 def\ __init__ 15215>&0 search/64 self Python script text executable 15216!:mime text/x-python 15217 15218# comments 152190 search/4096 ''' 15220>&0 regex .*'''$ Python script text executable 15221!:mime text/x-python 15222 152230 search/4096 """ 15224>&0 regex .*"""$ Python script text executable 15225!:mime text/x-python 15226 15227# try: 15228# except: or finally: 15229# block 152300 search/4096 try: 15231>&0 regex \^\\s*except.*: Python script text executable 15232!:mime text/x-python 152330 search/4096 try: 15234>&0 search/4096 finally: Python script text executable 15235!:mime text/x-python 15236 15237# def name(args, args): 152380 regex \^(\ |\\t)*def\ +[a-zA-Z]+ 15239>&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable 15240!:strength - 20 15241!:mime text/x-python 15242 15243#------------------------------------------------------------------------------ 15244# $File: python,v 1.12 2009/10/27 14:49:57 christos Exp $ 15245# python: file(1) magic for python 15246# 15247# From: David Necas <yeti@physics.muni.cz> 15248# often the module starts with a multiline string 152490 string/t """ a python script text executable 15250# MAGIC as specified in Python/import.c (1.5 to 2.6a1 and 3.1a0, assuming 15251# that Py_UnicodeFlag is off for Python 2) 15252# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 152530 belong 0x994e0d0a python 1.5/1.6 byte-compiled 152540 belong 0x87c60d0a python 2.0 byte-compiled 152550 belong 0x2aeb0d0a python 2.1 byte-compiled 152560 belong 0x2ded0d0a python 2.2 byte-compiled 152570 belong 0x3bf20d0a python 2.3 byte-compiled 152580 belong 0x6df20d0a python 2.4 byte-compiled 152590 belong 0xb3f20d0a python 2.5 byte-compiled 152600 belong 0xd1f20d0a python 2.6 byte-compiled 152610 belong 0x3b0c0d0a python 3.0 byte-compiled 152620 belong 0x4f0c0d0a python 3.1 byte-compiled 15263 152640 search/1/w #!\ /usr/bin/python Python script text executable 15265!:mime text/x-python 152660 search/1/w #!\ /usr/local/bin/python Python script text executable 15267!:mime text/x-python 152680 search/1 #!/usr/bin/env\ python Python script text executable 15269!:mime text/x-python 152700 search/1 #!\ /usr/bin/env\ ruby Python script text executable 15271!:mime text/x-python 15272 15273# from module.submodule import func1, func2 152740 regex/ \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable 15275!:strength - 20 15276!:mime text/x-python 15277 15278# def __init__ (self, ...): 152790 search/4096 def\ __init__ 15280>&0 search/64 self Python script text executable 15281!:mime text/x-python 15282 15283# comments 152840 search/4096 ''' 15285>&0 regex .*'''$ Python script text executable 15286!:mime text/x-python 15287 152880 search/4096 """ 15289>&0 regex .*"""$ Python script text executable 15290!:mime text/x-python 15291 15292# try: 15293# except: or finally: 15294# block 152950 search/4096 try: 15296>&0 regex \^\\s*except.*: Python script text executable 15297!:mime text/x-python 152980 search/4096 try: 15299>&0 search/4096 finally: Python script text executable 15300!:mime text/x-python 15301 15302#------------------------------------------------------------------------------ 15303# $File: revision,v 1.6 2009/09/19 16:28:12 christos Exp $ 15304# file(1) magic for revision control files 15305# From Hendrik Scholz <hendrik@scholz.net> 153060 string /1\ :pserver: cvs password text file 15307 15308# Conary changesets 15309# From: Jonathan Smith <smithj@rpath.com> 153100 belong 0xea3f81bb Conary changeset data 15311 15312# Type: Git bundles (git-bundle) 15313# From: Josh Triplett <josh@freedesktop.org> 153140 string #\ v2\ git\ bundle\n Git bundle 15315 15316# Type: Mercurial bundles 15317# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 153180 string HG10 Mercurial bundle, 15319>4 string UN uncompressed 15320>4 string BZ bzip2 compressed 15321 15322#------------------------------------------------------------------------------ 15323# $File: riff,v 1.18 2009/09/19 16:28:12 christos Exp $ 15324# riff: file(1) magic for RIFF format 15325# See 15326# 15327# http://www.seanet.com/users/matts/riffmci/riffmci.htm 15328# 15329# AVI section extended by Patrik Rdman <patrik+file-magic@iki.fi> 15330# 153310 string RIFF RIFF (little-endian) data 15332# RIFF Palette format 15333>8 string PAL \b, palette 15334>>16 leshort x \b, version %d 15335>>18 leshort x \b, %d entries 15336# RIFF Device Independent Bitmap format 15337>8 string RDIB \b, device-independent bitmap 15338>>16 string BM 15339>>>30 leshort 12 \b, OS/2 1.x format 15340>>>>34 leshort x \b, %d x 15341>>>>36 leshort x %d 15342>>>30 leshort 64 \b, OS/2 2.x format 15343>>>>34 leshort x \b, %d x 15344>>>>36 leshort x %d 15345>>>30 leshort 40 \b, Windows 3.x format 15346>>>>34 lelong x \b, %d x 15347>>>>38 lelong x %d x 15348>>>>44 leshort x %d 15349# RIFF MIDI format 15350>8 string RMID \b, MIDI 15351# RIFF Multimedia Movie File format 15352>8 string RMMP \b, multimedia movie 15353# RIFF wrapper for MP3 15354>8 string RMP3 \b, MPEG Layer 3 audio 15355# Microsoft WAVE format (*.wav) 15356>8 string WAVE \b, WAVE audio 15357!:mime audio/x-wav 15358>>20 leshort 1 \b, Microsoft PCM 15359>>>34 leshort >0 \b, %d bit 15360>>20 leshort 2 \b, Microsoft ADPCM 15361>>20 leshort 6 \b, ITU G.711 A-law 15362>>20 leshort 7 \b, ITU G.711 mu-law 15363>>20 leshort 17 \b, IMA ADPCM 15364>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 15365>>20 leshort 49 \b, GSM 6.10 15366>>20 leshort 64 \b, ITU G.721 ADPCM 15367>>20 leshort 80 \b, MPEG 15368>>20 leshort 85 \b, MPEG Layer 3 15369>>22 leshort =1 \b, mono 15370>>22 leshort =2 \b, stereo 15371>>22 leshort >2 \b, %d channels 15372>>24 lelong >0 %d Hz 15373# Corel Draw Picture 15374>8 string CDRA \b, Corel Draw Picture 15375!:mime image/x-coreldraw 15376# AVI == Audio Video Interleave 15377>8 string AVI\040 \b, AVI 15378!:mime video/x-msvideo 15379>>12 string LIST 15380>>>20 string hdrlavih 15381>>>>&36 lelong x \b, %lu x 15382>>>>&40 lelong x %lu, 15383>>>>&4 lelong >1000000 <1 fps, 15384>>>>&4 lelong 1000000 1.00 fps, 15385>>>>&4 lelong 500000 2.00 fps, 15386>>>>&4 lelong 333333 3.00 fps, 15387>>>>&4 lelong 250000 4.00 fps, 15388>>>>&4 lelong 200000 5.00 fps, 15389>>>>&4 lelong 166667 6.00 fps, 15390>>>>&4 lelong 142857 7.00 fps, 15391>>>>&4 lelong 125000 8.00 fps, 15392>>>>&4 lelong 111111 9.00 fps, 15393>>>>&4 lelong 100000 10.00 fps, 15394# ]9.9,10.1[ 15395>>>>&4 lelong <101010 15396>>>>>&-4 lelong >99010 15397>>>>>>&-4 lelong !100000 ~10 fps, 15398>>>>&4 lelong 83333 12.00 fps, 15399# ]11.9,12.1[ 15400>>>>&4 lelong <84034 15401>>>>>&-4 lelong >82645 15402>>>>>>&-4 lelong !83333 ~12 fps, 15403>>>>&4 lelong 66667 15.00 fps, 15404# ]14.9,15.1[ 15405>>>>&4 lelong <67114 15406>>>>>&-4 lelong >66225 15407>>>>>>&-4 lelong !66667 ~15 fps, 15408>>>>&4 lelong 50000 20.00 fps, 15409>>>>&4 lelong 41708 23.98 fps, 15410>>>>&4 lelong 41667 24.00 fps, 15411# ]23.9,24.1[ 15412>>>>&4 lelong <41841 15413>>>>>&-4 lelong >41494 15414>>>>>>&-4 lelong !41708 15415>>>>>>>&-4 lelong !41667 ~24 fps, 15416>>>>&4 lelong 40000 25.00 fps, 15417# ]24.9,25.1[ 15418>>>>&4 lelong <40161 15419>>>>>&-4 lelong >39841 15420>>>>>>&-4 lelong !40000 ~25 fps, 15421>>>>&4 lelong 33367 29.97 fps, 15422>>>>&4 lelong 33333 30.00 fps, 15423# ]29.9,30.1[ 15424>>>>&4 lelong <33445 15425>>>>>&-4 lelong >33223 15426>>>>>>&-4 lelong !33367 15427>>>>>>>&-4 lelong !33333 ~30 fps, 15428>>>>&4 lelong <32224 >30 fps, 15429##>>>>&4 lelong x (%lu) 15430##>>>>&20 lelong x %lu frames, 15431# Note: The tests below assume that the AVI has 1 or 2 streams, 15432# "vids" optionally followed by "auds". 15433# (Should cover 99.9% of all AVIs.) 15434# assuming avih length = 56 15435>>>88 string LIST 15436>>>>96 string strlstrh 15437>>>>>108 string vids video: 15438>>>>>>&0 lelong 0 uncompressed 15439# skip past vids strh 15440>>>>>>(104.l+108) string strf 15441>>>>>>>(104.l+132) lelong 1 RLE 8bpp 15442>>>>>>>(104.l+132) string/c cvid Cinepak 15443>>>>>>>(104.l+132) string/c i263 Intel I.263 15444>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 15445>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 15446>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 15447>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 15448>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 15449>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 15450>>>>>>>(104.l+132) string/c mjpg Motion JPEG 15451>>>>>>>(104.l+132) string/c div3 DivX 3 15452>>>>>>>>112 string/c div3 Low-Motion 15453>>>>>>>>112 string/c div4 Fast-Motion 15454>>>>>>>(104.l+132) string/c divx DivX 4 15455>>>>>>>(104.l+132) string/c dx50 DivX 5 15456>>>>>>>(104.l+132) string/c xvid XviD 15457>>>>>>>(104.l+132) string/c h264 H.264 15458>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 15459>>>>>>>(104.l+132) string/c h264 X.264 or H.264 15460>>>>>>>(104.l+132) lelong 0 15461##>>>>>>>(104.l+132) string x (%.4s) 15462# skip past first (video) LIST 15463>>>>(92.l+96) string LIST 15464>>>>>(92.l+104) string strlstrh 15465>>>>>>(92.l+116) string auds \b, audio: 15466# auds strh length = 56: 15467>>>>>>>(92.l+172) string strf 15468>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 15469>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 15470>>>>>>>>(92.l+180) leshort 0x0006 aLaw 15471>>>>>>>>(92.l+180) leshort 0x0007 uLaw 15472>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 15473>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 15474>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 15475>>>>>>>>(92.l+180) leshort 0x0161 DivX 15476##>>>>>>>>(92.l+180) leshort x (0x%.4x) 15477>>>>>>>>(92.l+182) leshort 1 (mono, 15478>>>>>>>>(92.l+182) leshort 2 (stereo, 15479>>>>>>>>(92.l+182) leshort >2 (%d channels, 15480>>>>>>>>(92.l+184) lelong x %d Hz) 15481# auds strh length = 64: 15482>>>>>>>(92.l+180) string strf 15483>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 15484>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 15485>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 15486>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 15487>>>>>>>>(92.l+188) leshort 0x0161 DivX 15488##>>>>>>>>(92.l+188) leshort x (0x%.4x) 15489>>>>>>>>(92.l+190) leshort 1 (mono, 15490>>>>>>>>(92.l+190) leshort 2 (stereo, 15491>>>>>>>>(92.l+190) leshort >2 (%d channels, 15492>>>>>>>>(92.l+192) lelong x %d Hz) 15493# Animated Cursor format 15494>8 string ACON \b, animated cursor 15495# SoundFont 2 <mpruett@sgi.com> 15496>8 string sfbk SoundFont/Bank 15497# MPEG-1 wrapped in a RIFF, apparently 15498>8 string CDXA \b, wrapped MPEG-1 (CDXA) 15499>8 string 4XMV \b, 4X Movie file 15500 15501# 15502# XXX - some of the below may only appear in little-endian form. 15503# 15504# Also "MV93" appears to be for one form of Macromedia Director 15505# files, and "GDMF" appears to be another multimedia format. 15506# 155070 string RIFX RIFF (big-endian) data 15508# RIFF Palette format 15509>8 string PAL \b, palette 15510>>16 beshort x \b, version %d 15511>>18 beshort x \b, %d entries 15512# RIFF Device Independent Bitmap format 15513>8 string RDIB \b, device-independent bitmap 15514>>16 string BM 15515>>>30 beshort 12 \b, OS/2 1.x format 15516>>>>34 beshort x \b, %d x 15517>>>>36 beshort x %d 15518>>>30 beshort 64 \b, OS/2 2.x format 15519>>>>34 beshort x \b, %d x 15520>>>>36 beshort x %d 15521>>>30 beshort 40 \b, Windows 3.x format 15522>>>>34 belong x \b, %d x 15523>>>>38 belong x %d x 15524>>>>44 beshort x %d 15525# RIFF MIDI format 15526>8 string RMID \b, MIDI 15527# RIFF Multimedia Movie File format 15528>8 string RMMP \b, multimedia movie 15529# Microsoft WAVE format (*.wav) 15530>8 string WAVE \b, WAVE audio 15531>>20 leshort 1 \b, Microsoft PCM 15532>>>34 leshort >0 \b, %d bit 15533>>22 beshort =1 \b, mono 15534>>22 beshort =2 \b, stereo 15535>>22 beshort >2 \b, %d channels 15536>>24 belong >0 %d Hz 15537# Corel Draw Picture 15538>8 string CDRA \b, Corel Draw Picture 15539# AVI == Audio Video Interleave 15540>8 string AVI\040 \b, AVI 15541# Animated Cursor format 15542>8 string ACON \b, animated cursor 15543# Notation Interchange File Format (big-endian only) 15544>8 string NIFF \b, Notation Interchange File Format 15545# SoundFont 2 <mpruett@sgi.com> 15546>8 string sfbk SoundFont/Bank 15547 15548#------------------------------------------------------------------------------ 15549# $File: rpm,v 1.9 2009/11/06 13:53:52 christos Exp $ 15550# 15551# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 15552# 155530 belong 0xedabeedb RPM 15554!:mime application/x-rpm 15555>4 byte x v%d 15556>5 byte x \b.%d 15557>6 beshort 1 src 15558>6 beshort 0 bin 15559>>8 beshort 1 i386/x86_64 15560>>8 beshort 2 Alpha/Sparc64 15561>>8 beshort 3 Sparc 15562>>8 beshort 4 MIPS 15563>>8 beshort 5 PowerPC 15564>>8 beshort 6 68000 15565>>8 beshort 7 SGI 15566>>8 beshort 8 RS6000 15567>>8 beshort 9 IA64 15568>>8 beshort 10 Sparc64 15569>>8 beshort 11 MIPSel 15570>>8 beshort 12 ARM 15571>>8 beshort 13 MiNT 15572>>8 beshort 14 S/390 15573>>8 beshort 15 S/390x 15574>>8 beshort 16 PowerPC64 15575>>8 beshort 17 SuperH 15576>>8 beshort 18 Xtensa 15577>>8 beshort 255 noarch 15578>>10 string x %s 15579 15580#delta RPM Daniel Novotny (dnovotny@redhat.com) 155810 string drpm Delta RPM 15582!:mime application/x-rpm 15583>12 string x %s 15584 15585>>>8 beshort 11 MIPSel 15586>>>8 beshort 12 ARM 15587>>>8 beshort 13 MiNT 15588>>>8 beshort 14 S/390 15589>>>8 beshort 15 S/390x 15590>>>8 beshort 16 PowerPC64 15591>>>8 beshort 17 SuperH 15592>>>8 beshort 18 Xtensa 15593>>10 string x %s 15594 15595#------------------------------------------------------------------------------ 15596# $File: rpm,v 1.9 2009/11/06 13:53:52 christos Exp $ 15597# 15598# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 15599# 156000 belong 0xedabeedb RPM 15601!:mime application/x-rpm 15602>4 byte x v%d 15603>5 byte x \b.%d 15604>6 beshort 1 src 15605>6 beshort 0 bin 15606>>8 beshort 1 i386/x86_64 15607>>8 beshort 2 Alpha/Sparc64 15608>>8 beshort 3 Sparc 15609>>8 beshort 4 MIPS 15610>>8 beshort 5 PowerPC 15611>>8 beshort 6 68000 15612>>8 beshort 7 SGI 15613>>8 beshort 8 RS6000 15614>>8 beshort 9 IA64 15615>>8 beshort 10 Sparc64 15616>>8 beshort 11 MIPSel 15617>>8 beshort 12 ARM 15618>>8 beshort 13 MiNT 15619>>8 beshort 14 S/390 15620>>8 beshort 15 S/390x 15621>>8 beshort 16 PowerPC64 15622>>8 beshort 17 SuperH 15623>>8 beshort 18 Xtensa 15624>>8 beshort 255 noarch 15625 15626#delta RPM Daniel Novotny (dnovotny@redhat.com) 156270 string drpm Delta RPM 15628!:mime application/x-rpm 15629>12 string x %s 15630 15631>>>8 beshort 11 MIPSel 15632>>>8 beshort 12 ARM 15633>>>8 beshort 13 MiNT 15634>>>8 beshort 14 S/390 15635>>>8 beshort 15 S/390x 15636>>>8 beshort 16 PowerPC64 15637>>>8 beshort 17 SuperH 15638>>>8 beshort 18 Xtensa 15639>>10 string x %s 15640 15641#------------------------------------------------------------------------------ 15642# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 15643# rtf: file(1) magic for Rich Text Format (RTF) 15644# 15645# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 15646# 156470 string {\\rtf Rich Text Format data, 15648!:mime text/rtf 15649>5 string 1 version 1, 15650>>6 string \\ansi ANSI 15651>>6 string \\mac Apple Macintosh 15652>>6 string \\pc IBM PC, code page 437 15653>>6 string \\pca IBM PS/2, code page 850 15654>>6 default x unknown character set 15655>5 default x unknown version 15656 15657#------------------------------------------------------------------------------ 15658# $File: ruby,v 1.3 2009/09/19 16:28:12 christos Exp $ 15659# ruby: file(1) magic for Ruby scripting language 15660# URL: http://www.ruby-lang.org/ 15661# From: Reuben Thomas <rrt@sc3d.org> 15662 15663# Ruby scripts 156640 search/1/w #!\ /usr/bin/ruby Ruby script text executable 15665!:mime text/x-ruby 156660 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 15667!:mime text/x-ruby 156680 search/1 #!/usr/bin/env\ ruby Ruby script text executable 15669!:mime text/x-ruby 156700 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 15671!:mime text/x-ruby 15672 15673# What looks like ruby, but does not have a shebang 15674# (modules and such) 15675# From: Lubomir Rintel <lkundrak@v3.sk> 156760 regex \^[\ \t]*require[\ \t]'[A-Za-z_\/]+' 15677>0 regex include\ [A-Z]|def\ [a-z]|\ do$ 15678>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text 15679!:mime text/x-ruby 156800 regex \^[\ \t]*(class|module)[\ \t][A-Z] 15681>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 15682>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text 15683!:mime text/x-ruby 15684 15685#------------------------------------------------------------------------------ 15686# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 15687# sc: file(1) magic for "sc" spreadsheet 15688# 1568938 string Spreadsheet sc spreadsheet file 15690!:mime application/x-sc 15691 15692#------------------------------------------------------------------------------ 15693# $File: sccs,v 1.6 2009/09/19 16:28:12 christos Exp $ 15694# sccs: file(1) magic for SCCS archives 15695# 15696# SCCS archive structure: 15697# \001h01207 15698# \001s 00276/00000/00000 15699# \001d D 1.1 87/09/23 08:09:20 ian 1 0 15700# \001c date and time created 87/09/23 08:09:20 by ian 15701# \001e 15702# \001u 15703# \001U 15704# ... etc. 15705# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 15706# *Sigh*. And these both came from various parts of the USG. 15707# Maybe we should just switch everybody from SCCS to RCS! 15708# Further, you can't just say '\001h0', because the five-digit number 15709# is a checksum that could (presumably) have any leading digit, 15710# and we don't have regular expression matching yet. 15711# Hence the following official kludge: 157128 string \001s\ SCCS archive data 15713 15714#------------------------------------------------------------------------------ 15715# $File: scientific,v 1.6 2009/09/19 16:28:12 christos Exp $ 15716# scientific: file(1) magic for scientific formats 15717# 15718# From: Joe Krahn <krahn@niehs.nih.gov> 15719 15720######################################################## 15721# CCP4 data and plot files: 157220 string MTZ\040 MTZ reflection file 15723 1572492 string PLOT%%84 Plot84 plotting file 15725>52 byte 1 , Little-endian 15726>55 byte 1 , Big-endian 15727 15728######################################################## 15729# Electron density MAP/MASK formats 15730 157310 string EZD_MAP NEWEZD Electron Density Map 15732109 string MAP\040( Old EZD Electron Density Map 15733 157340 string/c :-)\040Origin BRIX Electron Density Map 15735>170 string >0 , Sigma:%.12s 15736#>4 string >0 %.178s 15737#>4 addr x %.178s 15738 157397 string 18\040!NTITLE XPLOR ASCII Electron Density Map 157409 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 15741 15742208 string MAP\040 CCP4 Electron Density Map 15743# Assumes same stamp for float and double (normal case) 15744>212 byte 17 \b, Big-endian 15745>212 byte 34 \b, VAX format 15746>212 byte 68 \b, Little-endian 15747>212 byte 85 \b, Convex native 15748 15749############################################################ 15750# X-Ray Area Detector images 157510 string R-AXIS4\ \ \ R-Axis Area Detector Image: 15752>796 lelong <20 Little-endian, IP #%d, 15753>>768 lelong >0 Size=%dx 15754>>772 lelong >0 \b%d 15755>796 belong <20 Big-endian, IP #%d, 15756>>768 belong >0 Size=%dx 15757>>772 belong >0 \b%d 15758 157590 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 15760>796 lelong <20 Little-endian, IP #%d, 15761>>768 lelong >0 Size=%dx 15762>>772 lelong >0 \b%d 15763>796 belong <20 Big-endian, IP #%d, 15764>>768 belong >0 Size=%dx 15765>>772 belong >0 \b%d 15766 15767 157681028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 15769>1072 ulong >1 Compressed(%d), 15770>1100 ulong >1 %d headers, 15771>1104 ulong >0 %d x 15772>1108 ulong >0 %d, 15773>1120 ulong >0 %d bits/pixel 15774 15775# Type: GEDCOM genealogical (family history) data 15776# From: Giuseppe Bilotta 157770 search/1/c 0\ HEAD GEDCOM genealogy text 15778>&0 search 1\ GEDC 15779>>&0 search 2\ VERS version 15780>>>&1 search/1 >\0 %s 15781# From: Phil Endecott <phil05@chezphil.org> 157820 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 157830 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 157840 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 157850 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 15786 15787#------------------------------------------------------------------------------ 15788# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 157890 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 157900 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 157910 belong 0xedfeedfe Sun 'jks' Java Keystore File data 15792 157930 string \0volume_key volume_key escrow packet 15794 15795#------------------------------------------------------------------------------ 15796# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $ 15797# sendmail: file(1) magic for sendmail config files 15798# 15799# XXX - byte order? 15800# 158010 byte 046 Sendmail frozen configuration 15802>16 string >\0 - version %s 158030 short 0x271c Sendmail frozen configuration 15804>16 string >\0 - version %s 15805 15806#------------------------------------------------------------------------------ 15807# sendmail: file(1) magic for sendmail m4(1) files 15808# 15809# From Hendrik Scholz <hendrik@scholz.net> 15810# i.e. files in /usr/share/sendmail/cf/ 15811# 158120 string divert(-1)\n sendmail m4 text file 15813 15814 15815#------------------------------------------------------------------------------ 15816# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $ 15817# sequent: file(1) magic for Sequent machines 15818# 15819# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 15820# For Sequent's multiprocessor systems (incomplete). 158210 lelong 0x00ea BALANCE NS32000 .o 15822>16 lelong >0 not stripped 15823>124 lelong >0 version %ld 158240 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 15825>16 lelong >0 not stripped 15826>124 lelong >0 version %ld 158270 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 15828>16 lelong >0 not stripped 15829>124 lelong >0 version %ld 158300 lelong 0x30ea BALANCE NS32000 standalone executable 15831>16 lelong >0 not stripped 15832>124 lelong >0 version %ld 15833# 15834# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 15835# Symmetry magic nums will not be reached if DOS COM comes before them; 15836# byte 0xeb is matched before these get a chance. 158370 leshort 0x12eb SYMMETRY i386 .o 15838>16 lelong >0 not stripped 15839>124 lelong >0 version %ld 158400 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 15841>16 lelong >0 not stripped 15842>124 lelong >0 version %ld 158430 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 15844>16 lelong >0 not stripped 15845>124 lelong >0 version %ld 158460 leshort 0x42eb SYMMETRY i386 standalone executable 15847>16 lelong >0 not stripped 15848>124 lelong >0 version %ld 15849 15850#------------------------------------------------------------------------------ 15851# $File: sgi,v 1.17 2009/09/19 16:28:12 christos Exp $ 15852# sgi: file(1) magic for Silicon Graphics applications 15853 15854# 15855# 15856# Performance Co-Pilot file types 158570 string PmNs PCP compiled namespace (V.0) 158580 string PmN PCP compiled namespace 15859>3 string >\0 (V.%1.1s) 15860#3 lelong 0x84500526 PCP archive 158613 belong 0x84500526 PCP archive 15862>7 byte x (V.%d) 15863#>20 lelong -2 temporal index 15864#>20 lelong -1 metadata 15865#>20 lelong 0 log volume #0 15866#>20 lelong >0 log volume #%ld 15867>20 belong -2 temporal index 15868>20 belong -1 metadata 15869>20 belong 0 log volume #0 15870>20 belong >0 log volume #%ld 15871>24 string >\0 host: %s 158720 string PCPFolio PCP 15873>9 string Version: Archive Folio 15874>18 string >\0 (V.%s) 158750 string #pmchart PCP pmchart view 15876>9 string Version 15877>17 string >\0 (V%-3.3s) 158780 string #kmchart PCP kmchart view 15879>9 string Version 15880>17 string >\0 (V.%s) 158810 string pmview PCP pmview config 15882>7 string Version 15883>15 string >\0 (V%-3.3s) 158840 string #pmlogger PCP pmlogger config 15885>10 string Version 15886>18 string >\0 (V%1.1s) 158870 string #pmdahotproc PCP pmdahotproc config 15888>13 string Version 15889>21 string >\0 (V%-3.3s) 158900 string PcPh PCP Help 15891>4 string 1 Index 15892>4 string 2 Text 15893>5 string >\0 (V.%1.1s) 158940 string #pmieconf-rules PCP pmieconf rules 15895>16 string >\0 (V.%1.1s) 158963 string pmieconf-pmie PCP pmie config 15897>17 string >\0 (V.%1.1s) 15898 15899# SpeedShop data files 159000 lelong 0x13130303 SpeedShop data file 15901 15902# mdbm files 159030 lelong 0x01023962 mdbm file, version 0 (obsolete) 159040 string mdbm mdbm file, 15905>5 byte x version %d, 15906>6 byte x 2^%d pages, 15907>7 byte x pagesize 2^%d, 15908>17 byte x hash %d, 15909>11 byte x dataformat %d 15910 15911# Alias Maya files 159120 string //Maya ASCII Alias Maya Ascii File, 15913>13 string >\0 version %s 159148 string MAYAFOR4 Alias Maya Binary File, 15915>32 string >\0 version %s scene 159168 string MayaFOR4 Alias Maya Binary File, 15917>32 string >\0 version %s scene 159188 string CIMG Alias Maya Image File 159198 string DEEP Alias Maya Image File 15920#------------------------------------------------------------------------------ 15921# $File: sgml,v 1.24 2009/09/19 17:31:35 christos Exp $ 15922# Type: SVG Vectorial Graphics 15923# From: Noel Torres <tecnico@ejerciciosresueltos.com> 159240 string \<?xml\ version=" 15925>15 string >\0 15926>>19 search/4096 \<svg SVG Scalable Vector Graphics image 15927!:mime image/svg+xml 15928>>19 search/4096 \<gnc-v2 GnuCash file 15929!:mime application/x-gnucash 15930 15931# Sitemap file 159320 string \<?xml\ version=" 15933>15 string >\0 15934>>19 search/4096 \<urlset XML Sitemap document text 15935!:mime application/xml-sitemap 15936 15937# xhtml 159380 string \<?xml\ version=" 15939>15 string >\0 15940>>19 search/4096/cWbt \<!doctype\ html xHTML document text 15941!:mime text/html 159420 string \<?xml\ version=' 15943>15 string >\0 15944>>19 search/4096/cWbt \<!doctype\ html xHTML document text 15945!:mime text/html 159460 string \<?xml\ version=" 15947>15 string >\0 15948>>19 search/4096/cWbt \<html broken xHTML document text 15949!:mime text/html 15950 15951#------------------------------------------------------------------------------ 15952# sgml: file(1) magic for Standard Generalized Markup Language 15953# HyperText Markup Language (HTML) is an SGML document type, 15954# from Daniel Quinlan (quinlan@yggdrasil.com) 15955# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 159560 search/1/cb \<!doctype\ html HTML document text 15957!:mime text/html 159580 search/1/cb \<head HTML document text 15959!:mime text/html 159600 search/1/cb \<title HTML document text 15961!:mime text/html 159620 search/1/cb \<html HTML document text 15963!:mime text/html 15964 15965# Extensible markup language (XML), a subset of SGML 15966# from Marc Prud'hommeaux (marc@apocalypse.org) 159670 search/1/cwbt \<?xml XML document text 15968!:mime application/xml 159690 string \<?xml\ version\ " XML 15970!:mime application/xml 159710 string \<?xml\ version=" XML 15972!:mime application/xml 15973>15 search/1 >\0 %.3s document text 15974>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 15975>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 159760 string \<?xml\ version=' XML 15977!:mime application/xml 15978>15 search/1 >\0 %.3s document text 15979>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 15980>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 159810 search/1/wbt \<?xml XML document text 15982!:mime application/xml 15983!:strength - 10 159840 search/1/wbt \<?XML broken XML document text 15985!:mime application/xml 15986!:strength - 10 15987 15988 15989# SGML, mostly from rph@sq 159900 search/1/cb \<!doctype exported SGML document text 159910 search/1/cb \<!subdoc exported SGML subdocument text 159920 search/1/cb \<!-- exported SGML document text 15993 15994# Web browser cookie files 15995# (Mozilla, Galeon, Netscape 4, Konqueror..) 15996# Ulf Harnhammar <ulfh@update.uu.se> 159970 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 159980 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 159990 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 16000 16001#------------------------------------------------------------------------ 16002# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ 16003# file(1) magic for sharc files 16004# 16005# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 16006# FutureGroove Music (dsp@futuregroove.de) 16007 16008#------------------------------------------------------------------------ 16009#0 string Draw RiscOS Drawfile 16010#0 string PACK RiscOS PackdDir archive 16011 16012#------------------------------------------------------------------------ 16013# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 16014 16015#0 string =! Assembler source 16016#0 string Analog ADi asm listing file 160170 string .SYSTEM SHARC architecture file 160180 string .system SHARC architecture file 16019 160200 leshort 0x521C SHARC COFF binary 16021>2 leshort >1 , %hd sections 16022>>12 lelong >0 , not stripped 16023 16024#------------------------------------------------------------------------------ 16025# $File: sinclair,v 1.5 2009/09/19 16:28:12 christos Exp $ 16026# sinclair: file(1) sinclair QL 16027 16028# additions to /etc/magic by Thomas M. Ott (ThMO) 16029 16030# Sinclair QL floppy disk formats (ThMO) 160310 string =QL5 QL disk dump data, 16032>3 string =A 720 KB, 16033>3 string =B 1.44 MB, 16034>3 string =C 3.2 MB, 16035>4 string >\0 label:%.10s 16036 16037# Sinclair QL OS dump (ThMO) 16038# (NOTE: if `file' would be able to use indirect references in a endian format 16039# differing from the natural host format, this could be written more 16040# reliably and faster...) 16041# 16042# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more 16043# than the first 8K of a file... #-( 16044# 16045#0 belong =0x30000 16046#>49124 belong <47104 16047#>>49128 belong <47104 16048#>>>49132 belong <47104 16049#>>>>49136 belong <47104 QL OS dump data, 16050#>>>>>49148 string >\0 type %.3s, 16051#>>>>>49142 string >\0 version %.4s 16052 16053# Sinclair QL firmware executables (ThMO) 160540 string NqNqNq`\004 QL firmware executable (BCPL) 16055 16056# Sinclair QL libraries (was ThMO) 160570 beshort 0xFB01 QDOS object 16058>2 pstring x '%s' 16059 16060# Sinclair QL executables (was ThMO) 160614 belong 0x4AFB QDOS executable 16062>9 pstring x '%s' 16063 16064# Sinclair QL ROM (ThMO) 160650 belong =0x4AFB0001 QL plugin-ROM data, 16066>9 pstring =\0 un-named 16067>9 pstring >\0 named: %s 16068 16069#------------------------------------------------------------------------------ 16070# $File: sketch,v 1.4 2009/09/19 16:28:12 christos Exp $ 16071# Sketch Drawings: http://sketch.sourceforge.net/ 16072# From: Edwin Mons <e@ik.nu> 160730 search/1 ##Sketch Sketch document text 16074 16075#----------------------------------------------- 16076# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 16077# GNU Smalltalk image, starting at version 1.6.2 16078# From: catull_us@yahoo.com 16079# 160800 string GSTIm\0\0 GNU SmallTalk 16081# little-endian 16082>7 byte&1 =0 LE image version 16083>>10 byte x %d. 16084>>9 byte x \b%d. 16085>>8 byte x \b%d 16086#>>12 lelong x , data: %ld 16087#>>16 lelong x , table: %ld 16088#>>20 lelong x , memory: %ld 16089# big-endian 16090>7 byte&1 =1 BE image version 16091>>8 byte x %d. 16092>>9 byte x \b%d. 16093>>10 byte x \b%d 16094#>>12 belong x , data: %ld 16095#>>16 belong x , table: %ld 16096#>>20 belong x , memory: %ld 16097 16098 16099 16100#------------------------------------------------------------------------------ 16101# $File: sniffer,v 1.14 2009/09/19 16:28:12 christos Exp $ 16102# sniffer: file(1) magic for packet capture files 16103# 16104# From: guy@alum.mit.edu (Guy Harris) 16105# 16106 16107# 16108# Microsoft Network Monitor 1.x capture files. 16109# 161100 string RTSS NetMon capture file 16111>5 byte x - version %d 16112>4 byte x \b.%d 16113>6 leshort 0 (Unknown) 16114>6 leshort 1 (Ethernet) 16115>6 leshort 2 (Token Ring) 16116>6 leshort 3 (FDDI) 16117>6 leshort 4 (ATM) 16118 16119# 16120# Microsoft Network Monitor 2.x capture files. 16121# 161220 string GMBU NetMon capture file 16123>5 byte x - version %d 16124>4 byte x \b.%d 16125>6 leshort 0 (Unknown) 16126>6 leshort 1 (Ethernet) 16127>6 leshort 2 (Token Ring) 16128>6 leshort 3 (FDDI) 16129>6 leshort 4 (ATM) 16130 16131# 16132# Network General Sniffer capture files. 16133# Sorry, make that "Network Associates Sniffer capture files." 16134# Sorry, make that "Network General old DOS Sniffer capture files." 16135# 161360 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 16137>33 byte 2 (compressed) 16138>23 leshort x - version %d 16139>25 leshort x \b.%d 16140>32 byte 0 (Token Ring) 16141>32 byte 1 (Ethernet) 16142>32 byte 2 (ARCNET) 16143>32 byte 3 (StarLAN) 16144>32 byte 4 (PC Network broadband) 16145>32 byte 5 (LocalTalk) 16146>32 byte 6 (Znet) 16147>32 byte 7 (Internetwork Analyzer) 16148>32 byte 9 (FDDI) 16149>32 byte 10 (ATM) 16150 16151# 16152# Cinco Networks NetXRay capture files. 16153# Sorry, make that "Network General Sniffer Basic capture files." 16154# Sorry, make that "Network Associates Sniffer Basic capture files." 16155# Sorry, make that "Network Associates Sniffer Basic, and Windows 16156# Sniffer Pro", capture files." 16157# Sorry, make that "Network General Sniffer capture files." 16158# 161590 string XCP\0 NetXRay capture file 16160>4 string >\0 - version %s 16161>44 leshort 0 (Ethernet) 16162>44 leshort 1 (Token Ring) 16163>44 leshort 2 (FDDI) 16164>44 leshort 3 (WAN) 16165>44 leshort 8 (ATM) 16166>44 leshort 9 (802.11) 16167 16168# 16169# "libpcap" capture files. 16170# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 16171# the main program that uses that format, but there are other programs 16172# that use "libpcap", or that use the same capture file format.) 16173# 161740 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 16175>4 beshort x - version %d 16176>6 beshort x \b.%d 16177>20 belong 0 (No link-layer encapsulation 16178>20 belong 1 (Ethernet 16179>20 belong 2 (3Mb Ethernet 16180>20 belong 3 (AX.25 16181>20 belong 4 (ProNET 16182>20 belong 5 (CHAOS 16183>20 belong 6 (Token Ring 16184>20 belong 7 (BSD ARCNET 16185>20 belong 8 (SLIP 16186>20 belong 9 (PPP 16187>20 belong 10 (FDDI 16188>20 belong 11 (RFC 1483 ATM 16189>20 belong 12 (raw IP 16190>20 belong 13 (BSD/OS SLIP 16191>20 belong 14 (BSD/OS PPP 16192>20 belong 19 (Linux ATM Classical IP 16193>20 belong 50 (PPP or Cisco HDLC 16194>20 belong 51 (PPP-over-Ethernet 16195>20 belong 99 (Symantec Enterprise Firewall 16196>20 belong 100 (RFC 1483 ATM 16197>20 belong 101 (raw IP 16198>20 belong 102 (BSD/OS SLIP 16199>20 belong 103 (BSD/OS PPP 16200>20 belong 104 (BSD/OS Cisco HDLC 16201>20 belong 105 (802.11 16202>20 belong 106 (Linux Classical IP over ATM 16203>20 belong 107 (Frame Relay 16204>20 belong 108 (OpenBSD loopback 16205>20 belong 109 (OpenBSD IPsec encrypted 16206>20 belong 112 (Cisco HDLC 16207>20 belong 113 (Linux "cooked" 16208>20 belong 114 (LocalTalk 16209>20 belong 117 (OpenBSD PFLOG 16210>20 belong 119 (802.11 with Prism header 16211>20 belong 122 (RFC 2625 IP over Fibre Channel 16212>20 belong 123 (SunATM 16213>20 belong 127 (802.11 with radiotap header 16214>20 belong 129 (Linux ARCNET 16215>20 belong 138 (Apple IP over IEEE 1394 16216>20 belong 140 (MTP2 16217>20 belong 141 (MTP3 16218>20 belong 143 (DOCSIS 16219>20 belong 144 (IrDA 16220>20 belong 147 (Private use 0 16221>20 belong 148 (Private use 1 16222>20 belong 149 (Private use 2 16223>20 belong 150 (Private use 3 16224>20 belong 151 (Private use 4 16225>20 belong 152 (Private use 5 16226>20 belong 153 (Private use 6 16227>20 belong 154 (Private use 7 16228>20 belong 155 (Private use 8 16229>20 belong 156 (Private use 9 16230>20 belong 157 (Private use 10 16231>20 belong 158 (Private use 11 16232>20 belong 159 (Private use 12 16233>20 belong 160 (Private use 13 16234>20 belong 161 (Private use 14 16235>20 belong 162 (Private use 15 16236>20 belong 163 (802.11 with AVS header 16237>16 belong x \b, capture length %d) 162380 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 16239>4 leshort x - version %d 16240>6 leshort x \b.%d 16241>20 lelong 0 (No link-layer encapsulation 16242>20 lelong 1 (Ethernet 16243>20 lelong 2 (3Mb Ethernet 16244>20 lelong 3 (AX.25 16245>20 lelong 4 (ProNET 16246>20 lelong 5 (CHAOS 16247>20 lelong 6 (Token Ring 16248>20 lelong 7 (ARCNET 16249>20 lelong 8 (SLIP 16250>20 lelong 9 (PPP 16251>20 lelong 10 (FDDI 16252>20 lelong 11 (RFC 1483 ATM 16253>20 lelong 12 (raw IP 16254>20 lelong 13 (BSD/OS SLIP 16255>20 lelong 14 (BSD/OS PPP 16256>20 lelong 19 (Linux ATM Classical IP 16257>20 lelong 50 (PPP or Cisco HDLC 16258>20 lelong 51 (PPP-over-Ethernet 16259>20 lelong 99 (Symantec Enterprise Firewall 16260>20 lelong 100 (RFC 1483 ATM 16261>20 lelong 101 (raw IP 16262>20 lelong 102 (BSD/OS SLIP 16263>20 lelong 103 (BSD/OS PPP 16264>20 lelong 104 (BSD/OS Cisco HDLC 16265>20 lelong 105 (802.11 16266>20 lelong 106 (Linux Classical IP over ATM 16267>20 lelong 107 (Frame Relay 16268>20 lelong 108 (OpenBSD loopback 16269>20 lelong 109 (OpenBSD IPsec encrypted 16270>20 lelong 112 (Cisco HDLC 16271>20 lelong 113 (Linux "cooked" 16272>20 lelong 114 (LocalTalk 16273>20 lelong 117 (OpenBSD PFLOG 16274>20 lelong 119 (802.11 with Prism header 16275>20 lelong 122 (RFC 2625 IP over Fibre Channel 16276>20 lelong 123 (SunATM 16277>20 lelong 127 (802.11 with radiotap header 16278>20 lelong 129 (Linux ARCNET 16279>20 lelong 138 (Apple IP over IEEE 1394 16280>20 lelong 140 (MTP2 16281>20 lelong 141 (MTP3 16282>20 lelong 143 (DOCSIS 16283>20 lelong 144 (IrDA 16284>20 lelong 147 (Private use 0 16285>20 lelong 148 (Private use 1 16286>20 lelong 149 (Private use 2 16287>20 lelong 150 (Private use 3 16288>20 lelong 151 (Private use 4 16289>20 lelong 152 (Private use 5 16290>20 lelong 153 (Private use 6 16291>20 lelong 154 (Private use 7 16292>20 lelong 155 (Private use 8 16293>20 lelong 156 (Private use 9 16294>20 lelong 157 (Private use 10 16295>20 lelong 158 (Private use 11 16296>20 lelong 159 (Private use 12 16297>20 lelong 160 (Private use 13 16298>20 lelong 161 (Private use 14 16299>20 lelong 162 (Private use 15 16300>20 lelong 163 (802.11 with AVS header 16301>16 lelong x \b, capture length %d) 16302 16303# 16304# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 16305# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 16306# the main program that uses that format, but there are other programs 16307# that use "libpcap", or that use the same capture file format.) 16308# 163090 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 16310>4 beshort x - version %d 16311>6 beshort x \b.%d 16312>20 belong 0 (No link-layer encapsulation 16313>20 belong 1 (Ethernet 16314>20 belong 2 (3Mb Ethernet 16315>20 belong 3 (AX.25 16316>20 belong 4 (ProNET 16317>20 belong 5 (CHAOS 16318>20 belong 6 (Token Ring 16319>20 belong 7 (ARCNET 16320>20 belong 8 (SLIP 16321>20 belong 9 (PPP 16322>20 belong 10 (FDDI 16323>20 belong 11 (RFC 1483 ATM 16324>20 belong 12 (raw IP 16325>20 belong 13 (BSD/OS SLIP 16326>20 belong 14 (BSD/OS PPP 16327>16 belong x \b, capture length %d) 163280 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 16329>4 leshort x - version %d 16330>6 leshort x \b.%d 16331>20 lelong 0 (No link-layer encapsulation 16332>20 lelong 1 (Ethernet 16333>20 lelong 2 (3Mb Ethernet 16334>20 lelong 3 (AX.25 16335>20 lelong 4 (ProNET 16336>20 lelong 5 (CHAOS 16337>20 lelong 6 (Token Ring 16338>20 lelong 7 (ARCNET 16339>20 lelong 8 (SLIP 16340>20 lelong 9 (PPP 16341>20 lelong 10 (FDDI 16342>20 lelong 11 (RFC 1483 ATM 16343>20 lelong 12 (raw IP 16344>20 lelong 13 (BSD/OS SLIP 16345>20 lelong 14 (BSD/OS PPP 16346>16 lelong x \b, capture length %d) 16347 16348# 16349# AIX "iptrace" capture files. 16350# 163510 string iptrace\ 1.0 "iptrace" capture file 163520 string iptrace\ 2.0 "iptrace" capture file 16353 16354# 16355# Novell LANalyzer capture files. 16356# 163570 leshort 0x1001 LANalyzer capture file 163580 leshort 0x1007 LANalyzer capture file 16359 16360# 16361# HP-UX "nettl" capture files. 16362# 163630 string \x54\x52\x00\x64\x00 "nettl" capture file 16364 16365# 16366# RADCOM WAN/LAN Analyzer capture files. 16367# 163680 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 16369 16370# 16371# NetStumbler log files. Not really packets, per se, but about as 16372# close as you can get. These are log files from NetStumbler, a 16373# Windows program, that scans for 802.11b networks. 16374# 163750 string NetS NetStumbler log file 16376>8 lelong x \b, %d stations found 16377 16378# 16379# EtherPeek/AiroPeek "version 9" capture files. 16380# 163810 string \177ver EtherPeek/AiroPeek capture file 16382 16383# 16384# Visual Networks traffic capture files. 16385# 163860 string \x05VNF Visual Networks traffic capture file 16387 16388# 16389# Network Instruments Observer capture files. 16390# 163910 string ObserverPktBuffe Network Instruments Observer capture file 16392 16393# 16394# Files from Accellent Group's 5View products. 16395# 163960 string \xaa\xaa\xaa\xaa 5View capture file 16397 16398#------------------------------------------------------------------------------ 16399# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 16400# softquad: file(1) magic for SoftQuad Publishing Software 16401# 16402# Author/Editor and RulesBuilder 16403# 16404# XXX - byte order? 16405# 164060 string \<!SQ\ DTD> Compiled SGML rules file 16407>9 string >\0 Type %s 164080 string \<!SQ\ A/E> A/E SGML Document binary 16409>9 string >\0 Type %s 164100 string \<!SQ\ STS> A/E SGML binary styles file 16411>9 string >\0 Type %s 164120 short 0xc0de Compiled PSI (v1) data 164130 short 0xc0da Compiled PSI (v2) data 16414>3 string >\0 (%s) 16415# Binary sqtroff font/desc files... 164160 short 0125252 SoftQuad DESC or font file binary 16417>2 short >0 - version %d 16418# Bitmaps... 164190 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 16420#0 string SQ\ BITMAP2 SoftQuad Raster Format data 16421# sqtroff intermediate language (replacement for ditroff int. lang.) 164220 string X\ SoftQuad troff Context intermediate 16423>2 string 495 for AT&T 495 laser printer 16424>2 string hp for Hewlett-Packard LaserJet 16425>2 string impr for IMAGEN imPRESS 16426>2 string ps for PostScript 16427 16428# From: Michael Piefel <piefel@debian.org> 16429# sqtroff intermediate language (replacement for ditroff int. lang.) 164300 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 164310 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 164320 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 164330 string X\ ps SoftQuad troff Context intermediate for PostScript 16434 16435#------------------------------------------------------------------------------ 16436# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 16437# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 16438# 16439# Cloyce D. Spradling <cloyce@headgear.org> 16440 164410 string spec SPEC 16442>4 string .cpu CPU 16443>>8 string <: \b%.4s 16444>>12 string . raw result text 16445 1644617 string version=SPECjbb SPECjbb 16447>32 string <: \b%.4s 16448>>37 string <: v%.4s raw result text 16449 164500 string BEGIN\040SPECWEB SPECweb 16451>13 string <: \b%.2s 16452>>15 string _SSL \b_SSL 16453>>>20 string <: v%.4s raw result text 16454>>16 string <: v%.4s raw result text 16455 16456#------------------------------------------------------------------------------ 16457# $File: spectrum,v 1.6 2009/09/19 16:28:12 christos Exp $ 16458# spectrum: file(1) magic for Spectrum emulator files. 16459# 16460# John Elliott <jce@seasip.demon.co.uk> 16461 16462# 16463# Spectrum +3DOS header 16464# 164650 string PLUS3DOS\032 Spectrum +3 data 16466>15 byte 0 - BASIC program 16467>15 byte 1 - number array 16468>15 byte 2 - character array 16469>15 byte 3 - memory block 16470>>16 belong 0x001B0040 (screen) 16471>15 byte 4 - Tasword document 16472>15 string TAPEFILE - ZXT tapefile 16473# 16474# Tape file. This assumes the .TAP starts with a Spectrum-format header, 16475# which nearly all will. 16476# 164770 string \023\000\000 Spectrum .TAP data 16478>4 string x "%-10.10s" 16479>3 byte 0 - BASIC program 16480>3 byte 1 - number array 16481>3 byte 2 - character array 16482>3 byte 3 - memory block 16483>>14 belong 0x001B0040 (screen) 16484 16485# The following three blocks are from pak21-spectrum@srcf.ucam.org 16486# TZX tape images 164870 string ZXTape!\x1a Spectrum .TZX data 16488>8 byte x version %d 16489>9 byte x \b.%d 16490 16491# RZX input recording files 164920 string RZX! Spectrum .RZX data 16493>4 byte x version %d 16494>5 byte x \b.%d 16495 16496# Floppy disk images 164970 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 164980 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 164990 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 165000 string SINCLAIR Spectrum .SCL Betadisk image 16501 16502# Hard disk images 165030 string RS-IDE\x1a Spectrum .HDF hard disk image 16504>7 byte x \b, version 0x%02x 16505 16506#------------------------------------------------------------------------------ 16507# $File: sql,v 1.6 2009/09/19 16:28:12 christos Exp $ 16508# sql: file(1) magic for SQL files 16509# 16510# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 16511# Recognize some MySQL files. 16512# 165130 beshort 0xfe01 MySQL table definition file 16514>2 byte x Version %d 165150 belong&0xffffff00 0xfefe0300 MySQL MISAM index file 16516>3 byte x Version %d 165170 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file 16518>3 byte x Version %d 165190 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 16520>3 byte x Version %d 165210 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 16522>3 byte x Version %d 165230 string \376bin MySQL replication log 16524 16525#------------------------------------------------------------------------------ 16526# iRiver H Series database file 16527# From Ken Guest <ken@linux.ie> 16528# As observed from iRivNavi.iDB and unencoded firmware 16529# 165300 string iRivDB iRiver Database file 16531>11 string >\0 Version %s 16532>39 string iHP-100 [H Series] 16533 16534#------------------------------------------------------------------------------ 16535# SQLite database files 16536# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 16537# 16538# Version 1 used GDBM internally; its files cannot be distinguished 16539# from other GDBM files. 16540# 16541# Version 2 used this format: 165420 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 16543 16544# Version 3 of SQLite allows applications to embed their own "user version" 16545# number in the database. Detect this and distinguish those files. 16546 165470 string SQLite\ format\ 3 16548>60 string _MTN Monotone source repository 16549>60 belong !0 SQLite 3.x database, user version %u 16550>60 belong 0 SQLite 3.x database 16551 16552#------------------------------------------------------------------------------ 16553# $File: sun,v 1.20 2009/09/19 16:28:12 christos Exp $ 16554# sun: file(1) magic for Sun machines 16555# 16556# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 16557# releases. (5.x uses ELF.) 16558# 165590 belong&077777777 0600413 sparc demand paged 16560>0 byte &0x80 16561>>20 belong <4096 shared library 16562>>20 belong =4096 dynamically linked executable 16563>>20 belong >4096 dynamically linked executable 16564>0 byte ^0x80 executable 16565>16 belong >0 not stripped 16566 165670 belong&077777777 0600410 sparc pure 16568>0 byte &0x80 dynamically linked executable 16569>0 byte ^0x80 executable 16570>16 belong >0 not stripped 16571 165720 belong&077777777 0600407 sparc 16573>0 byte &0x80 dynamically linked executable 16574>0 byte ^0x80 executable 16575>16 belong >0 not stripped 16576 165770 belong&077777777 0400413 mc68020 demand paged 16578>0 byte &0x80 16579>>20 belong <4096 shared library 16580>>20 belong =4096 dynamically linked executable 16581>>20 belong >4096 dynamically linked executable 16582>0 byte ^0x80 executable 16583>16 belong >0 not stripped 16584 165850 belong&077777777 0400410 mc68020 pure 16586>0 byte &0x80 dynamically linked executable 16587>0 byte ^0x80 executable 16588>16 belong >0 not stripped 16589 165900 belong&077777777 0400407 mc68020 16591>0 byte &0x80 dynamically linked executable 16592>0 byte ^0x80 executable 16593>16 belong >0 not stripped 16594 165950 belong&077777777 0200413 mc68010 demand paged 16596>0 byte &0x80 16597>>20 belong <4096 shared library 16598>>20 belong =4096 dynamically linked executable 16599>>20 belong >4096 dynamically linked executable 16600>0 byte ^0x80 executable 16601>16 belong >0 not stripped 16602 166030 belong&077777777 0200410 mc68010 pure 16604>0 byte &0x80 dynamically linked executable 16605>0 byte ^0x80 executable 16606>16 belong >0 not stripped 16607 166080 belong&077777777 0200407 mc68010 16609>0 byte &0x80 dynamically linked executable 16610>0 byte ^0x80 executable 16611>16 belong >0 not stripped 16612 16613# reworked these to avoid anything beginning with zero becoming "old sun-2" 166140 belong 0407 old sun-2 executable 16615>16 belong >0 not stripped 166160 belong 0410 old sun-2 pure executable 16617>16 belong >0 not stripped 166180 belong 0413 old sun-2 demand paged executable 16619>16 belong >0 not stripped 16620 16621# 16622# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 16623# binary executed in compatibility mode under SunOS 5.x". 16624# 166250 belong 0x080456 SunOS core file 16626>4 belong 432 (SPARC) 16627>>132 string >\0 from '%s' 16628>>116 belong =3 (quit) 16629>>116 belong =4 (illegal instruction) 16630>>116 belong =5 (trace trap) 16631>>116 belong =6 (abort) 16632>>116 belong =7 (emulator trap) 16633>>116 belong =8 (arithmetic exception) 16634>>116 belong =9 (kill) 16635>>116 belong =10 (bus error) 16636>>116 belong =11 (segmentation violation) 16637>>116 belong =12 (bad argument to system call) 16638>>116 belong =29 (resource lost) 16639>>120 belong x (T=%dK, 16640>>124 belong x D=%dK, 16641>>128 belong x S=%dK) 16642>4 belong 826 (68K) 16643>>128 string >\0 from '%s' 16644>4 belong 456 (SPARC 4.x BCP) 16645>>152 string >\0 from '%s' 16646# Sun SunPC 166470 long 0xfa33c08e SunPC 4.0 Hard Disk 166480 string #SUNPC_CONFIG SunPC 4.0 Properties Values 16649# Sun snoop (see RFC 1761, which describes the capture file format). 16650# 166510 string snoop Snoop capture file 16652>8 belong >0 - version %ld 16653>12 belong 0 (IEEE 802.3) 16654>12 belong 1 (IEEE 802.4) 16655>12 belong 2 (IEEE 802.5) 16656>12 belong 3 (IEEE 802.6) 16657>12 belong 4 (Ethernet) 16658>12 belong 5 (HDLC) 16659>12 belong 6 (Character synchronous) 16660>12 belong 7 (IBM channel-to-channel adapter) 16661>12 belong 8 (FDDI) 16662>12 belong 9 (Unknown) 16663 16664# Microsoft ICM color profile 1666536 string acspMSFT Microsoft ICM Color Profile 16666# Sun KCMS 1666736 string acsp Kodak Color Management System, ICC Profile 16668 16669#--------------------------------------------------------------------------- 16670# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 16671# lead Sun/Cobalt developer) who agrees that they are good and worthy of 16672# inclusion. 16673 16674# Boot ROM images for Sun/Cobalt Linux server appliances 166750 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 16676>38 string x V%.4s 16677 16678# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 16679# at the very end where file(1) can't get it. 166800 string CRfs COBALT boot rom data (Flat boot rom or file system) 16681 16682 16683 16684#------------------------------------------------------------------------ 16685# $File: sysex,v 1.6 2009/09/19 16:28:12 christos Exp $ 16686# sysex: file(1) magic for MIDI sysex files 16687# 16688# 166890 byte 0xF0 SysEx File - 16690 16691# North American Group 16692>1 byte 0x01 Sequential 16693>1 byte 0x02 IDP 16694>1 byte 0x03 OctavePlateau 16695>1 byte 0x04 Moog 16696>1 byte 0x05 Passport 16697>1 byte 0x06 Lexicon 16698>1 byte 0x07 Kurzweil/Future Retro 16699>>3 byte 0x77 777 16700>>4 byte 0x00 Bank 16701>>4 byte 0x01 Song 16702>>5 byte 0x0f 16 16703>>5 byte 0x0e 15 16704>>5 byte 0x0d 14 16705>>5 byte 0x0c 13 16706>>5 byte 0x0b 12 16707>>5 byte 0x0a 11 16708>>5 byte 0x09 10 16709>>5 byte 0x08 9 16710>>5 byte 0x07 8 16711>>5 byte 0x06 7 16712>>5 byte 0x05 6 16713>>5 byte 0x04 5 16714>>5 byte 0x03 4 16715>>5 byte 0x02 3 16716>>5 byte 0x01 2 16717>>5 byte 0x00 1 16718>>5 byte 0x10 (ALL) 16719>>2 byte x \b, Channel %d 16720>1 byte 0x08 Fender 16721>1 byte 0x09 Gulbransen 16722>1 byte 0x0a AKG 16723>1 byte 0x0b Voyce 16724>1 byte 0x0c Waveframe 16725>1 byte 0x0d ADA 16726>1 byte 0x0e Garfield 16727>1 byte 0x0f Ensoniq 16728>1 byte 0x10 Oberheim 16729>>2 byte 0x06 Matrix 6 series 16730>>3 byte 0x0A Dump (All) 16731>>3 byte 0x01 Dump (Bank) 16732>>4 belong 0x0002040E Matrix 1000 16733>>>11 byte <2 User bank %d 16734>>>11 byte >1 Preset bank %d 16735>1 byte 0x11 Apple 16736>1 byte 0x12 GreyMatter 16737>1 byte 0x14 PalmTree 16738>1 byte 0x15 JLCooper 16739>1 byte 0x16 Lowrey 16740>1 byte 0x17 AdamsSmith 16741>1 byte 0x18 E-mu 16742>1 byte 0x19 Harmony 16743>1 byte 0x1a ART 16744>1 byte 0x1b Baldwin 16745>1 byte 0x1c Eventide 16746>1 byte 0x1d Inventronics 16747>1 byte 0x1f Clarity 16748 16749# European Group 16750>1 byte 0x21 SIEL 16751>1 byte 0x22 Synthaxe 16752>1 byte 0x24 Hohner 16753>1 byte 0x25 Twister 16754>1 byte 0x26 Solton 16755>1 byte 0x27 Jellinghaus 16756>1 byte 0x28 Southworth 16757>1 byte 0x29 PPG 16758>1 byte 0x2a JEN 16759>1 byte 0x2b SSL 16760>1 byte 0x2c AudioVertrieb 16761 16762>1 byte 0x2f ELKA 16763>>3 byte 0x09 EK-44 16764 16765>1 byte 0x30 Dynacord 16766>1 byte 0x31 Jomox 16767>1 byte 0x33 Clavia 16768>1 byte 0x39 Soundcraft 16769# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 16770>1 byte 0x3e Waldorf 16771>>2 byte 0x00 microWave 16772>>2 byte 0x0E microwave2 / XT 16773>>2 byte 0x0F Q / Q+ 16774>>3 byte =0 (default id) 16775>>3 byte >0 ( 16776>>>3 byte <0x7F \bdevice %d) 16777>>>3 byte =0x7F \bbroadcast id) 16778>>3 byte 0x7f Microwave I 16779>>>4 byte 0x00 SNDR (Sound Request) 16780>>>4 byte 0x10 SNDD (Sound Dump) 16781>>>4 byte 0x20 SNDP (Sound Parameter Change) 16782>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 16783>>>4 byte 0x70 BOOT (Sound Reserved) 16784>>>4 byte 0x01 MULR (Multi Request) 16785>>>4 byte 0x11 MULD (Multi Dump) 16786>>>4 byte 0x21 MULP (Multi Parameter Change) 16787>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 16788>>>4 byte 0x71 OS (Multi Reserved) 16789>>>4 byte 0x02 DRMR (Drum Map Request) 16790>>>4 byte 0x12 DRMD (Drum Map Dump) 16791>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 16792>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 16793>>>4 byte 0x72 BIN (Drum Map Reserved) 16794>>>4 byte 0x03 PATR (Sequencer Pattern Request) 16795>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 16796>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 16797>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 16798>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 16799>>>4 byte 0x04 GLBR (Global Parameter Request) 16800>>>4 byte 0x14 GLBD (Global Parameter Dump) 16801>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 16802>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 16803>>>4 byte 0x07 MODR (Mode Parameter Request) 16804>>>4 byte 0x17 MODD (Mode Parameter Dump) 16805>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 16806>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 16807>>2 byte 0x10 microQ 16808>>>4 byte 0x00 SNDR (Sound Request) 16809>>>4 byte 0x10 SNDD (Sound Dump) 16810>>>4 byte 0x20 SNDP (Sound Parameter Change) 16811>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 16812>>>4 byte 0x70 (Sound Reserved) 16813>>>4 byte 0x01 MULR (Multi Request) 16814>>>4 byte 0x11 MULD (Multi Dump) 16815>>>4 byte 0x21 MULP (Multi Parameter Change) 16816>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 16817>>>4 byte 0x71 OS (Multi Reserved) 16818>>>4 byte 0x02 DRMR (Drum Map Request) 16819>>>4 byte 0x12 DRMD (Drum Map Dump) 16820>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 16821>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 16822>>>4 byte 0x72 BIN (Drum Map Reserved) 16823>>>4 byte 0x04 GLBR (Global Parameter Request) 16824>>>4 byte 0x14 GLBD (Global Parameter Dump) 16825>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 16826>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 16827>>2 byte 0x11 rackAttack 16828>>>4 byte 0x00 SNDR (Sound Parameter Request) 16829>>>4 byte 0x10 SNDD (Sound Parameter Dump) 16830>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 16831>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 16832>>>4 byte 0x01 PRGR (Program Parameter Request) 16833>>>4 byte 0x11 PRGD (Program Parameter Dump) 16834>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 16835>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 16836>>>4 byte 0x71 OS (Program Parameter Reserved) 16837>>>4 byte 0x03 PATR (Pattern Parameter Request) 16838>>>4 byte 0x13 PATD (Pattern Parameter Dump) 16839>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 16840>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 16841>>>4 byte 0x04 GLBR (Global Parameter Request) 16842>>>4 byte 0x14 GLBD (Global Parameter Dump) 16843>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 16844>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 16845>>>4 byte 0x05 EFXR (FX Parameter Request) 16846>>>4 byte 0x15 EFXD (FX Parameter Dump) 16847>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 16848>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 16849>>>4 byte 0x07 MODR (Mode Command Request) 16850>>>4 byte 0x17 MODD (Mode Command Dump) 16851>>>4 byte 0x27 MODP (Mode Command Parameter Change) 16852>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 16853>>2 byte 0x03 Wave 16854>>>4 byte 0x00 SBPR (Soundprogram) 16855>>>4 byte 0x01 SAPR (Performance) 16856>>>4 byte 0x02 SWAVE (Wave) 16857>>>4 byte 0x03 SWTBL (Wave control table) 16858>>>4 byte 0x04 SVT (Velocity Curve) 16859>>>4 byte 0x05 STT (Tuning Table) 16860>>>4 byte 0x06 SGLB (Global Parameters) 16861>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 16862>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 16863>>>4 byte 0x09 SBPRPAR (Sound Parameter) 16864>>>4 byte 0x0A SARRPAR (Performance Parameter) 16865>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 16866>>>4 byte 0x0F SBULK (Bulk Switch on/off) 16867 16868# Japanese Group 16869>1 byte 0x40 Kawai 16870>>3 byte 0x20 K1 16871>>3 byte 0x22 K4 16872 16873>1 byte 0x41 Roland 16874>>3 byte 0x14 D-50 16875>>3 byte 0x2b U-220 16876>>3 byte 0x02 TR-707 16877 16878>1 byte 0x42 Korg 16879>>3 byte 0x19 M1 16880 16881>1 byte 0x43 Yamaha 16882>1 byte 0x44 Casio 16883>1 byte 0x46 Kamiya 16884>1 byte 0x47 Akai 16885>1 byte 0x48 Victor 16886>1 byte 0x49 Mesosha 16887>1 byte 0x4b Fujitsu 16888>1 byte 0x4c Sony 16889>1 byte 0x4e Teac 16890>1 byte 0x50 Matsushita 16891>1 byte 0x51 Fostex 16892>1 byte 0x52 Zoom 16893>1 byte 0x54 Matsushita 16894>1 byte 0x57 Acoustic tech. lab. 16895 16896>1 belong&0xffffff00 0x00007400 Ta Horng 16897>1 belong&0xffffff00 0x00007500 e-Tek 16898>1 belong&0xffffff00 0x00007600 E-Voice 16899>1 belong&0xffffff00 0x00007700 Midisoft 16900>1 belong&0xffffff00 0x00007800 Q-Sound 16901>1 belong&0xffffff00 0x00007900 Westrex 16902>1 belong&0xffffff00 0x00007a00 Nvidia* 16903>1 belong&0xffffff00 0x00007b00 ESS 16904>1 belong&0xffffff00 0x00007c00 Mediatrix 16905>1 belong&0xffffff00 0x00007d00 Brooktree 16906>1 belong&0xffffff00 0x00007e00 Otari 16907>1 belong&0xffffff00 0x00007f00 Key Electronics 16908>1 belong&0xffffff00 0x00010000 Shure 16909>1 belong&0xffffff00 0x00010100 AuraSound 16910>1 belong&0xffffff00 0x00010200 Crystal 16911>1 belong&0xffffff00 0x00010300 Rockwell 16912>1 belong&0xffffff00 0x00010400 Silicon Graphics 16913>1 belong&0xffffff00 0x00010500 Midiman 16914>1 belong&0xffffff00 0x00010600 PreSonus 16915>1 belong&0xffffff00 0x00010800 Topaz 16916>1 belong&0xffffff00 0x00010900 Cast Lightning 16917>1 belong&0xffffff00 0x00010a00 Microsoft 16918>1 belong&0xffffff00 0x00010b00 Sonic Foundry 16919>1 belong&0xffffff00 0x00010c00 Line 6 16920>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 16921>1 belong&0xffffff00 0x00010e00 Van Koerving 16922>1 belong&0xffffff00 0x00010f00 Altech Systems 16923>1 belong&0xffffff00 0x00011000 S & S Research 16924>1 belong&0xffffff00 0x00011100 VLSI Technology 16925>1 belong&0xffffff00 0x00011200 Chromatic 16926>1 belong&0xffffff00 0x00011300 Sapphire 16927>1 belong&0xffffff00 0x00011400 IDRC 16928>1 belong&0xffffff00 0x00011500 Justonic Tuning 16929>1 belong&0xffffff00 0x00011600 TorComp 16930>1 belong&0xffffff00 0x00011700 Newtek Inc. 16931>1 belong&0xffffff00 0x00011800 Sound Sculpture 16932>1 belong&0xffffff00 0x00011900 Walker Technical 16933>1 belong&0xffffff00 0x00011a00 Digital Harmony 16934>1 belong&0xffffff00 0x00011b00 InVision 16935>1 belong&0xffffff00 0x00011c00 T-Square 16936>1 belong&0xffffff00 0x00011d00 Nemesys 16937>1 belong&0xffffff00 0x00011e00 DBX 16938>1 belong&0xffffff00 0x00011f00 Syndyne 16939>1 belong&0xffffff00 0x00012000 Bitheadz 16940>1 belong&0xffffff00 0x00012100 Cakewalk 16941>1 belong&0xffffff00 0x00012200 Staccato 16942>1 belong&0xffffff00 0x00012300 National Semicon. 16943>1 belong&0xffffff00 0x00012400 Boom Theory 16944>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 16945>1 belong&0xffffff00 0x00012600 Antares 16946>1 belong&0xffffff00 0x00012700 Angel Software 16947>1 belong&0xffffff00 0x00012800 St Louis Music 16948>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 16949>1 belong&0xffffff00 0x00012a00 Ashley Audio 16950>1 belong&0xffffff00 0x00012b00 Vari-Lite 16951>1 belong&0xffffff00 0x00012c00 Summit Audio 16952>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 16953>1 belong&0xffffff00 0x00012e00 SeaSound 16954>1 belong&0xffffff00 0x00012f00 U.S. Robotics 16955>1 belong&0xffffff00 0x00013000 Aurisis 16956>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 16957>1 belong&0xffffff00 0x00013200 FM7 Inc. 16958>1 belong&0xffffff00 0x00013300 Swivel Systems 16959>1 belong&0xffffff00 0x00013400 Hyperactive 16960>1 belong&0xffffff00 0x00013500 MidiLite 16961>1 belong&0xffffff00 0x00013600 Radical 16962>1 belong&0xffffff00 0x00013700 Roger Linn 16963>1 belong&0xffffff00 0x00013800 Helicon 16964>1 belong&0xffffff00 0x00013900 Event 16965>1 belong&0xffffff00 0x00013a00 Sonic Network 16966>1 belong&0xffffff00 0x00013b00 Realtime Music 16967>1 belong&0xffffff00 0x00013c00 Apogee Digital 16968 16969>1 belong&0xffffff00 0x00202b00 Medeli Electronics 16970>1 belong&0xffffff00 0x00202c00 Charlie Lab 16971>1 belong&0xffffff00 0x00202d00 Blue Chip Music 16972>1 belong&0xffffff00 0x00202e00 BEE OH Corp 16973>1 belong&0xffffff00 0x00202f00 LG Semicon America 16974>1 belong&0xffffff00 0x00203000 TESI 16975>1 belong&0xffffff00 0x00203100 EMAGIC 16976>1 belong&0xffffff00 0x00203200 Behringer 16977>1 belong&0xffffff00 0x00203300 Access Music 16978>1 belong&0xffffff00 0x00203400 Synoptic 16979>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 16980>1 belong&0xffffff00 0x00203600 Terratec 16981>1 belong&0xffffff00 0x00203700 Proel SpA 16982>1 belong&0xffffff00 0x00203800 IBK MIDI 16983>1 belong&0xffffff00 0x00203900 IRCAM 16984>1 belong&0xffffff00 0x00203a00 Propellerhead Software 16985>1 belong&0xffffff00 0x00203b00 Red Sound Systems 16986>1 belong&0xffffff00 0x00203c00 Electron ESI AB 16987>1 belong&0xffffff00 0x00203d00 Sintefex Audio 16988>1 belong&0xffffff00 0x00203e00 Music and More 16989>1 belong&0xffffff00 0x00203f00 Amsaro 16990>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 16991>1 belong&0xffffff00 0x00204100 Touched by Sound 16992>1 belong&0xffffff00 0x00204200 DSP Arts 16993>1 belong&0xffffff00 0x00204300 Phil Rees Music 16994>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 16995>1 belong&0xffffff00 0x00204500 Soundart 16996>1 belong&0xffffff00 0x00204600 C-Mexx Software 16997>1 belong&0xffffff00 0x00204700 Klavis Tech. 16998>1 belong&0xffffff00 0x00204800 Noteheads AB 16999 170000 string T707 Roland TR-707 Data 17001 17002#------------------------------------------------------------------------------ 17003# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 17004# teapot: file(1) magic for "teapot" spreadsheet 17005# 170060 string #!teapot\012xdr teapot work sheet (XDR format) 17007 17008#------------------------------------------------------------------------------ 17009# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $ 17010# terminfo: file(1) magic for terminfo 17011# 17012# XXX - byte order for screen images? 17013# 170140 string \032\001 Compiled terminfo entry 170150 short 0433 Curses screen image 170160 short 0434 Curses screen image 17017 17018#------------------------------------------------------------------------------ 17019# $File: tex,v 1.16 2009/09/19 16:28:12 christos Exp $ 17020# tex: file(1) magic for TeX files 17021# 17022# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 17023# 17024# From <conklin@talisman.kaleida.com> 17025 17026# Although we may know the offset of certain text fields in TeX DVI 17027# and font files, we can't use them reliably because they are not 17028# zero terminated. [but we do anyway, christos] 170290 string \367\002 TeX DVI file 17030!:mime application/x-dvi 17031>16 string >\0 (%s) 170320 string \367\203 TeX generic font data 170330 string \367\131 TeX packed font data 17034>3 string >\0 (%s) 170350 string \367\312 TeX virtual font data 170360 search/1 This\ is\ TeX, TeX transcript text 170370 search/1 This\ is\ METAFONT, METAFONT transcript text 17038 17039# There is no way to detect TeX Font Metric (*.tfm) files without 17040# breaking them apart and reading the data. The following patterns 17041# match most *.tfm files generated by METAFONT or afm2tfm. 170422 string \000\021 TeX font metric data 17043!:mime application/x-tex-tfm 17044>33 string >\0 (%s) 170452 string \000\022 TeX font metric data 17046!:mime application/x-tex-tfm 17047>33 string >\0 (%s) 17048 17049# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 170500 search/1 \\input\ texinfo Texinfo source text 17051!:mime text/x-texinfo 170520 search/1 This\ is\ Info\ file GNU Info text 17053!:mime text/x-info 17054 17055# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 170560 search/4096 \\input TeX document text 17057!:mime text/x-tex 17058!:strength - 4 170590 search/4096 \\section LaTeX document text 17060!:mime text/x-tex 17061!:strength - 1 170620 search/4096 \\setlength LaTeX document text 17063!:mime text/x-tex 17064!:strength - 4 170650 search/4096 \\documentstyle LaTeX document text 17066!:mime text/x-tex 17067!:strength - 1 170680 search/4096 \\chapter LaTeX document text 17069!:mime text/x-tex 17070!:strength - 1 170710 search/4096 \\documentclass LaTeX 2e document text 17072!:mime text/x-tex 17073!:strength - 4 170740 search/4096 \\relax LaTeX auxiliary file 17075!:mime text/x-tex 17076!:strength - 4 170770 search/4096 \\contentsline LaTeX table of contents 17078!:mime text/x-tex 17079!:strength - 4 170800 search/4096 %\ -*-latex-*- LaTeX document text 17081!:mime text/x-tex 17082 17083# Tex document, from Hendrik Scholz <hendrik@scholz.net> 170840 search/1 \\ifx TeX document text 17085 17086# Index and glossary files 170870 search/4096 \\indexentry LaTeX raw index file 17088!:strength - 15 170890 search/4096 \\begin{theindex} LaTeX sorted index 17090!:strength - 15 170910 search/4096 \\glossaryentry LaTeX raw glossary 17092!:strength - 15 170930 search/4096 \\begin{theglossary} LaTeX sorted glossary 17094!:strength - 15 170950 search/4096 This\ is\ makeindex Makeindex log file 17096!:strength - 15 17097 17098# End of TeX 17099 17100#------------------------------------------------------------------------------ 17101# file(1) magic for BibTex text files 17102# From Hendrik Scholz <hendrik@scholz.net> 17103 171040 search/1/c @article{ BibTeX text file 171050 search/1/c @book{ BibTeX text file 171060 search/1/c @inbook{ BibTeX text file 171070 search/1/c @incollection{ BibTeX text file 171080 search/1/c @inproceedings{ BibTeX text file 171090 search/1/c @manual{ BibTeX text file 171100 search/1/c @misc{ BibTeX text file 171110 search/1/c @preamble{ BibTeX text file 171120 search/1/c @phdthesis{ BibTeX text file 171130 search/1/c @techreport{ BibTeX text file 171140 search/1/c @unpublished{ BibTeX text file 17115 1711673 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 17117 1711873 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 17119 171200 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 17121 171220 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 17123 171240 search/1 @c\ @mapfile{ TeX font aliases text file 17125 17126#------------------------------------------------------------------------------ 17127# $File: tgif,v 1.5 2009/09/19 16:28:12 christos Exp $ 17128# file(1) magic for tgif(1) files 17129# From Hendrik Scholz <hendrik@scholz.net> 17130 171310 string %TGIF\ x Tgif file version %s 17132 17133 17134#------------------------------------------------------------------------------ 17135# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ 17136# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 17137# 17138# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 17139# 17140# Update: Romain Lievin (roms@lpg.ticalc.org). 17141# 17142# NOTE: This list is not complete. 17143# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 17144# program/group magic numbers in here because I cannot find any. 171450 string **TI80** TI-80 Graphing Calculator File. 171460 string **TI81** TI-81 Graphing Calculator File. 17147# 17148# Magic Numbers for the TI-73 17149# 171500 string **TI73** TI-73 Graphing Calculator 17151>0x00003B byte 0x00 (real number) 17152>0x00003B byte 0x01 (list) 17153>0x00003B byte 0x02 (matrix) 17154>0x00003B byte 0x03 (equation) 17155>0x00003B byte 0x04 (string) 17156>0x00003B byte 0x05 (program) 17157>0x00003B byte 0x06 (assembly program) 17158>0x00003B byte 0x07 (picture) 17159>0x00003B byte 0x08 (gdb) 17160>0x00003B byte 0x0C (complex number) 17161>0x00003B byte 0x0F (window settings) 17162>0x00003B byte 0x10 (zoom) 17163>0x00003B byte 0x11 (table setup) 17164>0x00003B byte 0x13 (backup) 17165 17166# Magic Numbers for the TI-82 17167# 171680 string **TI82** TI-82 Graphing Calculator 17169>0x00003B byte 0x00 (real) 17170>0x00003B byte 0x01 (list) 17171>0x00003B byte 0x02 (matrix) 17172>0x00003B byte 0x03 (Y-variable) 17173>0x00003B byte 0x05 (program) 17174>0x00003B byte 0x06 (protected prgm) 17175>0x00003B byte 0x07 (picture) 17176>0x00003B byte 0x08 (gdb) 17177>0x00003B byte 0x0B (window settings) 17178>0x00003B byte 0x0C (window settings) 17179>0x00003B byte 0x0D (table setup) 17180>0x00003B byte 0x0E (screenshot) 17181>0x00003B byte 0x0F (backup) 17182# 17183# Magic Numbers for the TI-83 17184# 171850 string **TI83** TI-83 Graphing Calculator 17186>0x00003B byte 0x00 (real) 17187>0x00003B byte 0x01 (list) 17188>0x00003B byte 0x02 (matrix) 17189>0x00003B byte 0x03 (Y-variable) 17190>0x00003B byte 0x04 (string) 17191>0x00003B byte 0x05 (program) 17192>0x00003B byte 0x06 (protected prgm) 17193>0x00003B byte 0x07 (picture) 17194>0x00003B byte 0x08 (gdb) 17195>0x00003B byte 0x0B (window settings) 17196>0x00003B byte 0x0C (window settings) 17197>0x00003B byte 0x0D (table setup) 17198>0x00003B byte 0x0E (screenshot) 17199>0x00003B byte 0x13 (backup) 17200# 17201# Magic Numbers for the TI-83+ 17202# 172030 string **TI83F* TI-83+ Graphing Calculator 17204>0x00003B byte 0x00 (real number) 17205>0x00003B byte 0x01 (list) 17206>0x00003B byte 0x02 (matrix) 17207>0x00003B byte 0x03 (equation) 17208>0x00003B byte 0x04 (string) 17209>0x00003B byte 0x05 (program) 17210>0x00003B byte 0x06 (assembly program) 17211>0x00003B byte 0x07 (picture) 17212>0x00003B byte 0x08 (gdb) 17213>0x00003B byte 0x0C (complex number) 17214>0x00003B byte 0x0F (window settings) 17215>0x00003B byte 0x10 (zoom) 17216>0x00003B byte 0x11 (table setup) 17217>0x00003B byte 0x13 (backup) 17218>0x00003B byte 0x15 (application variable) 17219>0x00003B byte 0x17 (group of variable) 17220 17221# 17222# Magic Numbers for the TI-85 17223# 172240 string **TI85** TI-85 Graphing Calculator 17225>0x00003B byte 0x00 (real number) 17226>0x00003B byte 0x01 (complex number) 17227>0x00003B byte 0x02 (real vector) 17228>0x00003B byte 0x03 (complex vector) 17229>0x00003B byte 0x04 (real list) 17230>0x00003B byte 0x05 (complex list) 17231>0x00003B byte 0x06 (real matrix) 17232>0x00003B byte 0x07 (complex matrix) 17233>0x00003B byte 0x08 (real constant) 17234>0x00003B byte 0x09 (complex constant) 17235>0x00003B byte 0x0A (equation) 17236>0x00003B byte 0x0C (string) 17237>0x00003B byte 0x0D (function GDB) 17238>0x00003B byte 0x0E (polar GDB) 17239>0x00003B byte 0x0F (parametric GDB) 17240>0x00003B byte 0x10 (diffeq GDB) 17241>0x00003B byte 0x11 (picture) 17242>0x00003B byte 0x12 (program) 17243>0x00003B byte 0x13 (range) 17244>0x00003B byte 0x17 (window settings) 17245>0x00003B byte 0x18 (window settings) 17246>0x00003B byte 0x19 (window settings) 17247>0x00003B byte 0x1A (window settings) 17248>0x00003B byte 0x1B (zoom) 17249>0x00003B byte 0x1D (backup) 17250>0x00003B byte 0x1E (unknown) 17251>0x00003B byte 0x2A (equation) 17252>0x000032 string ZS4 - ZShell Version 4 File. 17253>0x000032 string ZS3 - ZShell Version 3 File. 17254# 17255# Magic Numbers for the TI-86 17256# 172570 string **TI86** TI-86 Graphing Calculator 17258>0x00003B byte 0x00 (real number) 17259>0x00003B byte 0x01 (complex number) 17260>0x00003B byte 0x02 (real vector) 17261>0x00003B byte 0x03 (complex vector) 17262>0x00003B byte 0x04 (real list) 17263>0x00003B byte 0x05 (complex list) 17264>0x00003B byte 0x06 (real matrix) 17265>0x00003B byte 0x07 (complex matrix) 17266>0x00003B byte 0x08 (real constant) 17267>0x00003B byte 0x09 (complex constant) 17268>0x00003B byte 0x0A (equation) 17269>0x00003B byte 0x0C (string) 17270>0x00003B byte 0x0D (function GDB) 17271>0x00003B byte 0x0E (polar GDB) 17272>0x00003B byte 0x0F (parametric GDB) 17273>0x00003B byte 0x10 (diffeq GDB) 17274>0x00003B byte 0x11 (picture) 17275>0x00003B byte 0x12 (program) 17276>0x00003B byte 0x13 (range) 17277>0x00003B byte 0x17 (window settings) 17278>0x00003B byte 0x18 (window settings) 17279>0x00003B byte 0x19 (window settings) 17280>0x00003B byte 0x1A (window settings) 17281>0x00003B byte 0x1B (zoom) 17282>0x00003B byte 0x1D (backup) 17283>0x00003B byte 0x1E (unknown) 17284>0x00003B byte 0x2A (equation) 17285# 17286# Magic Numbers for the TI-89 17287# 172880 string **TI89** TI-89 Graphing Calculator 17289>0x000048 byte 0x00 (expression) 17290>0x000048 byte 0x04 (list) 17291>0x000048 byte 0x06 (matrix) 17292>0x000048 byte 0x0A (data) 17293>0x000048 byte 0x0B (text) 17294>0x000048 byte 0x0C (string) 17295>0x000048 byte 0x0D (graphic data base) 17296>0x000048 byte 0x0E (figure) 17297>0x000048 byte 0x10 (picture) 17298>0x000048 byte 0x12 (program) 17299>0x000048 byte 0x13 (function) 17300>0x000048 byte 0x14 (macro) 17301>0x000048 byte 0x1C (zipped) 17302>0x000048 byte 0x21 (assembler) 17303# 17304# Magic Numbers for the TI-92 17305# 173060 string **TI92** TI-92 Graphing Calculator 17307>0x000048 byte 0x00 (expression) 17308>0x000048 byte 0x04 (list) 17309>0x000048 byte 0x06 (matrix) 17310>0x000048 byte 0x0A (data) 17311>0x000048 byte 0x0B (text) 17312>0x000048 byte 0x0C (string) 17313>0x000048 byte 0x0D (graphic data base) 17314>0x000048 byte 0x0E (figure) 17315>0x000048 byte 0x10 (picture) 17316>0x000048 byte 0x12 (program) 17317>0x000048 byte 0x13 (function) 17318>0x000048 byte 0x14 (macro) 17319>0x000048 byte 0x1D (backup) 17320# 17321# Magic Numbers for the TI-92+/V200 17322# 173230 string **TI92P* TI-92+/V200 Graphing Calculator 17324>0x000048 byte 0x00 (expression) 17325>0x000048 byte 0x04 (list) 17326>0x000048 byte 0x06 (matrix) 17327>0x000048 byte 0x0A (data) 17328>0x000048 byte 0x0B (text) 17329>0x000048 byte 0x0C (string) 17330>0x000048 byte 0x0D (graphic data base) 17331>0x000048 byte 0x0E (figure) 17332>0x000048 byte 0x10 (picture) 17333>0x000048 byte 0x12 (program) 17334>0x000048 byte 0x13 (function) 17335>0x000048 byte 0x14 (macro) 17336>0x000048 byte 0x1C (zipped) 17337>0x000048 byte 0x21 (assembler) 17338# 17339# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 17340# 173410x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 173420 string **TIFL** TI-XX Graphing Calculator (FLASH) 17343>8 byte >0 - Revision %d 17344>>9 byte x \b.%d, 17345>12 byte >0 Revision date %02x 17346>>13 byte x \b/%02x 17347>>14 beshort x \b/%04x, 17348>17 string >/0 name: '%s', 17349>48 byte 0x74 device: TI-73, 17350>48 byte 0x73 device: TI-83+, 17351>48 byte 0x98 device: TI-89, 17352>48 byte 0x88 device: TI-92+, 17353>49 byte 0x23 type: OS upgrade, 17354>49 byte 0x24 type: application, 17355>49 byte 0x25 type: certificate, 17356>49 byte 0x3e type: license, 17357>74 lelong >0 size: %ld bytes 17358 17359# VTi & TiEmu skins (TI Graphing Calculators). 17360# From: Romain Lievin (roms@lpg.ticalc.org). 17361# Magic Numbers for the VTi skins 173620 string VTI Virtual TI skin 17363>3 string v - Version 17364>>4 byte >0 \b %c 17365>>6 byte x \b.%c 17366# Magic Numbers for the TiEmu skins 173670 string TiEmu TiEmu skin 17368>6 string v - Version 17369>>7 byte >0 \b %c 17370>>9 byte x \b.%c 17371>>10 byte x \b%c 17372 17373#------------------------------------------------------------------------------ 17374# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 17375# timezone: file(1) magic for timezone data 17376# 17377# from Daniel Quinlan (quinlan@yggdrasil.com) 17378# this should work on Linux, SunOS, and maybe others 17379# Added new official magic number for recent versions of the Olson code 173800 string TZif timezone data 17381>4 byte 0 \b, old version 17382>4 byte >0 \b, version %c 17383>20 belong 0 \b, no gmt time flags 17384>20 belong 1 \b, 1 gmt time flag 17385>20 belong >1 \b, %d gmt time flags 17386>24 belong 0 \b, no std time flags 17387>20 belong 1 \b, 1 std time flag 17388>24 belong >1 \b, %d std time flags 17389>28 belong 0 \b, no leap seconds 17390>28 belong 1 \b, 1 leap second 17391>28 belong >1 \b, %d leap seconds 17392>32 belong 0 \b, no transition times 17393>32 belong 1 \b, 1 transition time 17394>32 belong >1 \b, %d transition times 17395>36 belong 0 \b, no abbreviation chars 17396>36 belong 1 \b, 1 abbreviation char 17397>36 belong >1 \b, %d abbreviation chars 173980 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 173990 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 174000 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 174010 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 174020 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 174030 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 17404 17405#------------------------------------------------------------------------------ 17406# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ 17407# troff: file(1) magic for *roff 17408# 17409# updated by Daniel Quinlan (quinlan@yggdrasil.com) 17410 17411# troff input 174120 search/1 .\\" troff or preprocessor input text 17413!:mime text/troff 174140 search/1 '\\" troff or preprocessor input text 17415!:mime text/troff 174160 search/1 '.\\" troff or preprocessor input text 17417!:mime text/troff 174180 search/1 \\" troff or preprocessor input text 17419!:mime text/troff 174200 search/1 ''' troff or preprocessor input text 17421!:mime text/troff 174220 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 17423!:mime text/troff 174240 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 17425!:mime text/troff 17426 17427# ditroff intermediate output text 174280 search/1 x\ T ditroff output text 17429>4 search/1 cat for the C/A/T phototypesetter 17430>4 search/1 ps for PostScript 17431>4 search/1 dvi for DVI 17432>4 search/1 ascii for ASCII 17433>4 search/1 lj4 for LaserJet 4 17434>4 search/1 latin1 for ISO 8859-1 (Latin 1) 17435>4 search/1 X75 for xditview at 75dpi 17436>>7 search/1 -12 (12pt) 17437>4 search/1 X100 for xditview at 100dpi 17438>>8 search/1 -12 (12pt) 17439 17440# output data formats 174410 string \100\357 very old (C/A/T) troff output data 17442 17443#------------------------------------------------------------------------------ 17444# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 17445# tuxedo: file(1) magic for BEA TUXEDO data files 17446# 17447# from Ian Springer <ispringer@hotmail.com> 17448# 174490 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 17450 17451#------------------------------------------------------------------------------ 17452# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 17453# typeset: file(1) magic for other typesetting 17454# 174550 string Interpress/Xerox Xerox InterPress data 17456>16 string / (version 17457>>17 string >\0 %s) 17458 17459#------------------------------------------------------------------------------ 17460# $File: unicode,v 1.5 2009/09/19 16:28:13 christos Exp $ 17461# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 17462# GRR: These types should be recognised in file_ascmagic so these 17463# encodings can be treated by text patterns. 17464# Missing types are already dealt with internally. 17465# 174660 string +/v8 Unicode text, UTF-7 174670 string +/v9 Unicode text, UTF-7 174680 string +/v+ Unicode text, UTF-7 174690 string +/v/ Unicode text, UTF-7 174700 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 174710 string \376\377\000\000 Unicode text, UTF-32, big-endian 174720 string \377\376\000\000 Unicode text, UTF-32, little-endian 174730 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 17474 17475#------------------------------------------------------------------------------ 17476# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $ 17477# unknown: file(1) magic for unknown machines 17478# 17479# XXX - this probably should be pruned, as it'll match PDP-11 and 17480# VAX image formats. 17481# 17482# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, 17483# respectively). 17484# 17485# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't 17486# have the "version %ld", which may be a bogus COFFism (I don't think 17487# there ever was COFF for the PDP-11). 17488# 17489# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 17490# long, as it would be on a VAX. 17491# 17492# 0x10C is 0414 and 0x10E is 416; those *are* unknown. 17493# 174940 short 0x107 unknown machine executable 17495>8 short >0 not stripped 17496>15 byte >0 - version %ld 174970 short 0x108 unknown pure executable 17498>8 short >0 not stripped 17499>15 byte >0 - version %ld 175000 short 0x109 PDP-11 separate I&D 17501>8 short >0 not stripped 17502>15 byte >0 - version %ld 175030 short 0x10b unknown pure executable 17504>8 short >0 not stripped 17505>15 byte >0 - version %ld 175060 long 0x10c unknown demand paged pure executable 17507>16 long >0 not stripped 175080 long 0x10e unknown readable demand paged pure executable 17509 17510#------------------------------------------------------------------------------ 17511# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 17512# uuencode: file(1) magic for ASCII-encoded files 17513# 17514 17515# GRR: the first line of xxencoded files is identical to that in uuencoded 17516# files, but the first character in most subsequent lines is 'h' instead of 17517# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 17518# punctuation and survives BITNET gateways better.) If regular expressions 17519# were supported, this entry could possibly be split into two with 17520# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 175210 search/1 begin\ uuencoded or xxencoded text 17522 17523# btoa(1) is an alternative to uuencode that requires less space. 175240 search/1 xbtoa\ Begin btoa'd text 17525 17526# ship(1) is another, much cooler alternative to uuencode. 17527# Greg Roelofs, newt@uchicago.edu 175280 search/1 $\012ship ship'd binary text 17529 17530# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 17531# Greg Roelofs, newt@uchicago.edu 175320 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 17533 17534# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 17535# Daniel Quinlan, quinlan@yggdrasil.com 1753611 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 17537>41 search/1 x \b, version %.3s 17538 17539# GRR: handle BASE64 17540 17541#------------------------------------------------------------------------------ 17542# $File: varied.out,v 1.21 2009/09/19 16:28:13 christos Exp $ 17543# varied.out: file(1) magic for various USG systems 17544# 17545# Herewith many of the object file formats used by USG systems. 17546# Most have been moved to files for a particular processor, 17547# and deleted if they duplicate other entries. 17548# 175490 short 0610 Perkin-Elmer executable 17550# AMD 29K 175510 beshort 0572 amd 29k coff noprebar executable 175520 beshort 01572 amd 29k coff prebar executable 175530 beshort 0160007 amd 29k coff archive 17554# Cray 175556 beshort 0407 unicos (cray) executable 17556# Ultrix 4.3 17557596 string \130\337\377\377 Ultrix core file 17558>600 string >\0 from '%s' 17559# BeOS and MAcOS PEF executables 17560# From: hplus@zilker.net (Jon Watte) 175610 string Joy!peffpwpc header for PowerPC PEF executable 17562# 17563# ava assembler/linker Uros Platise <uros.platise@ijs.si> 175640 string avaobj AVR assembler object code 17565>7 string >\0 version '%s' 17566# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 175670 string gmon GNU prof performance data 17568>4 long x - version %ld 17569# From: Dave Pearson <davep@davep.org> 17570# Harbour <URL:http://www.harbour-project.org/> HRB files. 175710 string \xc0HRB Harbour HRB file 17572>4 short x version %d 17573 17574# From: Alex Beregszaszi <alex@fsn.hu> 17575# 0 string exec BugOS executable 17576# 0 string pack BugOS archive 17577 17578# From: Jason Spence <jspence@lightconsulting.com> 17579# Generated by the "examples" in STM's ST40 devkit, and derived code. 175800 lelong 0x13a9f17e ST40 component image format 17581>4 string >\0 \b, name '%s' 17582 17583 17584#------------------------------------------------------------------------------ 17585# $File: varied.script,v 1.6 2009/09/19 16:28:13 christos Exp $ 17586# varied.script: file(1) magic for various interpreter scripts 17587 175880 string #!\ / a 17589>3 string >\0 %s script text executable 175900 string #!\t/ a 17591>3 string >\0 %s script text executable 175920 string #!/ a 17593>2 string >\0 %s script text executable 175940 string #!\ script text executable 17595>3 string >\0 for %s 17596 17597# From: arno <arenevier@fdn.fr> 17598# mozilla xpconnect typelib 17599# see http://www.mozilla.org/scriptable/typelib_file.html 176000 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 17601>0x10 byte x version %d 17602>>0x11 byte x \b.%d 17603 17604#------------------------------------------------------------------------------ 17605# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $ 17606# vax: file(1) magic for VAX executable/object and APL workspace 17607# 176080 lelong 0101557 VAX single precision APL workspace 176090 lelong 0101556 VAX double precision APL workspace 17610 17611# 17612# VAX a.out (32V, BSD) 17613# 176140 lelong 0407 VAX executable 17615>16 lelong >0 not stripped 17616 176170 lelong 0410 VAX pure executable 17618>16 lelong >0 not stripped 17619 176200 lelong 0413 VAX demand paged pure executable 17621>16 lelong >0 not stripped 17622 176230 lelong 0420 VAX demand paged (first page unmapped) pure executable 17624>16 lelong >0 not stripped 17625 17626# 17627# VAX COFF 17628# 17629# The `versions' should be un-commented if they work for you. 17630# (Was the problem just one of endianness?) 17631# 176320 leshort 0570 VAX COFF executable 17633>12 lelong >0 not stripped 17634>22 leshort >0 - version %ld 176350 leshort 0575 VAX COFF pure executable 17636>12 lelong >0 not stripped 17637>22 leshort >0 - version %ld 17638 17639#------------------------------------------------------------------------------ 17640# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 17641# vicar: file(1) magic for VICAR files. 17642# 17643# From: Ossama Othman <othman@astrosun.tn.cornell.edu 17644# VICAR is JPL's in-house spacecraft image processing program 17645# VICAR image 176460 string LBLSIZE= VICAR image data 17647>32 string BYTE \b, 8 bits = VAX byte 17648>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 17649>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 17650>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 17651>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 17652>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 17653# VICAR label file 1765443 string SFDU_LABEL VICAR label file 17655 17656#------------------------------------------------------------------------------ 17657# $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $ 17658# From: James Nobis <quel@quelrod.net> 17659# Microsoft hard disk images for: 17660# Virtual Server 17661# Virtual PC 17662# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 17663# .vhd 176640 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 17665 17666# Sun xVM VirtualBox Disk Image 17667# string <<< Sun xVM VirtualBox Disk Image >>> 17668# .vdi 176690 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image 17670 17671 17672 17673#------------------------------------------------------------------------------ 17674# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 17675# Virtutech Compressed Random Access File Format 17676# 17677# From <gustav@virtutech.com> 176780 string \211\277\036\203 Virtutech CRAFF 17679>4 belong x v%d 17680>20 belong 0 uncompressed 17681>20 belong 1 bzipp2ed 17682>20 belong 2 gzipped 17683>24 belong 0 not clean 17684 17685#------------------------------------------------------------------------------ 17686# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 17687# visx: file(1) magic for Visx format files 17688# 176890 short 0x5555 VISX image file 17690>2 byte 0 (zero) 17691>2 byte 1 (unsigned char) 17692>2 byte 2 (short integer) 17693>2 byte 3 (float 32) 17694>2 byte 4 (float 64) 17695>2 byte 5 (signed char) 17696>2 byte 6 (bit-plane) 17697>2 byte 7 (classes) 17698>2 byte 8 (statistics) 17699>2 byte 10 (ascii text) 17700>2 byte 15 (image segments) 17701>2 byte 100 (image set) 17702>2 byte 101 (unsigned char vector) 17703>2 byte 102 (short integer vector) 17704>2 byte 103 (float 32 vector) 17705>2 byte 104 (float 64 vector) 17706>2 byte 105 (signed char vector) 17707>2 byte 106 (bit plane vector) 17708>2 byte 121 (feature vector) 17709>2 byte 122 (feature vector library) 17710>2 byte 124 (chain code) 17711>2 byte 126 (bit vector) 17712>2 byte 130 (graph) 17713>2 byte 131 (adjacency graph) 17714>2 byte 132 (adjacency graph library) 17715>2 string .VISIX (ascii text) 17716 17717#------------------------------------------------------------------------------ 17718# $File: vms,v 1.6 2009/09/19 16:28:13 christos Exp $ 17719# vms: file(1) magic for VMS executables (experimental) 17720# 17721# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 17722 17723# GRR 950122: I'm just guessing on these, based on inspection of the headers 17724# of three executables each for Alpha and VAX architectures. The VAX files 17725# all had headers similar to this: 17726# 17727# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 17728# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 17729# 177300 string \xb0\0\x30\0 VMS VAX executable 17731>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 17732# 17733# The AXP files all looked like this, except that the byte at offset 0x22 17734# was 06 in some of them and 07 in others: 17735# 17736# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 17737# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 17738# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 17739# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 17740# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 17741# 177420 belong 0x03000000 VMS Alpha executable 17743>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 17744 17745#------------------------------------------------------------------------------ 17746# $File: vmware,v 1.7 2009/09/19 16:28:13 christos Exp $ 17747# VMware specific files (deducted from version 1.1 and log file entries) 17748# Anthon van der Neut (anthon@mnt.org) 177490 belong 0x4d52564e VMware nvram 17750 17751#------------------------------------------------------------------------------ 17752# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $ 17753# vorbis: file(1) magic for Ogg/Vorbis files 17754# 17755# From Felix von Leitner <leitner@fefe.de> 17756# Extended by Beni Cherniavsky <cben@crosswinds.net> 17757# Further extended by Greg Wooledge <greg@wooledge.org> 17758# 17759# Most (everything but the number of channels and bitrate) is commented 17760# out with `##' as it's not interesting to the average user. The most 17761# probable things advanced users would want to uncomment are probably 17762# the number of comments and the encoder version. 17763# 17764# FIXME: The first match has been made a search, so that it can skip 17765# over prepended ID3 tags. This will work for MIME type detection, but 17766# won't work for detecting other properties of the file (they all need 17767# to be made relative to the search). In any case, if the file has ID3 17768# tags, the ID3 information will be printed, not the Ogg information, 17769# so until that's fixed, this doesn't matter. 17770# FIXME[2]: Disable the above for now, since search assumes text mode. 17771# 17772# --- Ogg Framing --- 17773#0 search/1000 OggS Ogg data 177740 string OggS Ogg data 17775!:mime application/ogg 17776>4 byte !0 UNKNOWN REVISION %u 17777##>4 byte 0 revision 0 17778>4 byte 0 17779##>>14 lelong x (Serial %lX) 17780# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 17781>>28 string \x7fFLAC \b, FLAC audio 17782# non-Vorbis content: Theora 17783>>28 string \x80theora \b, Theora video 17784# non-Vorbis content: Kate 17785>>28 string \x80kate\0\0\0\0 \b, Kate 17786>>>37 ubyte x v%u 17787>>>38 ubyte x \b.%u, 17788>>>40 byte 0 utf8 encoding, 17789>>>40 byte !0 unknown character encoding, 17790>>>60 string >\0 language %s, 17791>>>60 string \0 no language set, 17792>>>76 string >\0 category %s 17793>>>76 string \0 no category set 17794# non-Vorbis content: Skeleton 17795>>28 string fishead\0 \b, Skeleton 17796>>>36 short x v%u 17797>>>40 short x \b.%u 17798# non-Vorbis content: Speex 17799>>28 string Speex\ \ \ \b, Speex audio 17800# non-Vorbis content: OGM 17801>>28 string \x01video\0\0\0 \b, OGM video 17802>>>37 string/c div3 (DivX 3) 17803>>>37 string/c divx (DivX 4) 17804>>>37 string/c dx50 (DivX 5) 17805>>>37 string/c xvid (XviD) 17806# --- First vorbis packet - general header --- 17807>>28 string \x01vorbis \b, Vorbis audio, 17808>>>35 lelong !0 UNKNOWN VERSION %lu, 17809##>>>35 lelong 0 version 0, 17810>>>35 lelong 0 17811>>>>39 ubyte 1 mono, 17812>>>>39 ubyte 2 stereo, 17813>>>>39 ubyte >2 %u channels, 17814>>>>40 lelong x %lu Hz 17815# Minimal, nominal and maximal bitrates specified when encoding 17816>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 17817# The above tests if at least one of these is specified: 17818>>>>>52 lelong !-1 17819# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 17820# instead of -1. 17821# Vorbis 1.0 uses 0 instead of -1. 17822>>>>>>52 lelong !0 17823>>>>>>>52 lelong !-1000 17824>>>>>>>>52 lelong x <%lu 17825>>>>>48 lelong !-1 17826>>>>>>48 lelong x ~%lu 17827>>>>>44 lelong !-1 17828>>>>>>44 lelong !-1000 17829>>>>>>>44 lelong !0 17830>>>>>>>>44 lelong x >%lu 17831>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 17832# -- Second vorbis header packet - the comments 17833# A kludge to read the vendor string. It's a counted string, not a 17834# zero-terminated one, so file(1) can't read it in a generic way. 17835# libVorbis is the only one existing currently, so I detect specifically 17836# it. The interesting value is the cvs date (8 digits decimal). 17837# Post-RC1 Ogg files have the second header packet (and thus the version) 17838# in a different place, so we must use an indirect offset. 17839>>>(84.b+85) string \x03vorbis 17840>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 17841>>>>>(84.b+120) string >00000000 17842# Map to beta version numbers: 17843>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 17844>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 17845>>>>>>(84.b+120) string >20000508 17846>>>>>>>(84.b+120) string <20001031 (beta2-3) 17847>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 17848>>>>>>(84.b+120) string >20001031 17849>>>>>>>(84.b+120) string <20010225 (beta3-4) 17850>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 17851>>>>>>(84.b+120) string >20010225 17852>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 17853>>>>>>(84.b+120) string 20010615 (1.0 RC1) 17854>>>>>>(84.b+120) string 20010813 (1.0 RC2) 17855>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 17856>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 17857>>>>>>(84.b+120) string 20011217 (1.0 RC3) 17858>>>>>>(84.b+120) string 20011231 (1.0 RC3) 17859# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 17860>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 17861# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 17862>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 17863>>>>>(84.b+117) string >00000000 17864>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 17865>>>>>>(84.b+117) string 20020717 (1.0) 17866>>>>>>(84.b+117) string 20030909 (1.0.1) 17867>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 17868 17869#------------------------------------------------------------------------------ 17870# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 17871# VXL: file(1) magic for VXL binary IO data files 17872# 17873# from Ian Scott <scottim@sf.net> 17874# 17875# VXL is a collection of C++ libraries for Computer Vision. 17876# See the vsl chapter in the VXL Book for more info 17877# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 17878# http:/vxl.sf.net 17879 178802 lelong 0x472b2c4e VXL data file, 17881>0 leshort >0 schema version no %d 17882 17883#------------------------------------------------------------------------------ 17884# $File: warc,v 1.2 2009/09/19 16:28:13 christos Exp $ 17885# warc: file(1) magic for WARC files 17886 178870 string WARC/ WARC Archive 17888>5 string x version %.4s 17889 17890#------------------------------------------------------------------------------ 17891# weak: file(1) magic for very weak magic entries, disabled by default 17892# 17893# These entries are so weak that they might interfere identification of 17894# other formats. Example include: 17895# - Only identify for 1 or 2 bytes 17896# - Match against very wide range of values 17897# - Match against generic word in some spoken languages (e.g. English) 17898 17899# Summary: Computer Graphics Metafile 17900# Extension: .cgm 17901#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 17902#0 beshort 0x3020 character Computer Graphics Metafile 17903 17904#0 string =!! Bennet Yee's "face" format 17905 17906#------------------------------------------------------------------------------ 17907# $File: windows,v 1.4 2009/09/19 16:28:13 christos Exp $ 17908# windows: file(1) magic for Microsoft Windows 17909# 17910# This file is mainly reserved for files where programs 17911# using them are run almost always on MS Windows 3.x or 17912# above, or files only used exclusively in Windows OS, 17913# where there is no better category to allocate for. 17914# For example, even though WinZIP almost run on Windows 17915# only, it is better to treat them as "archive" instead. 17916# For format usable in DOS, such as generic executable 17917# format, please specify under "msdos" file. 17918# 17919 17920 17921# Summary: Outlook Express DBX file 17922# Extension: .dbx 17923# Created by: Christophe Monniez 179240 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 17925>4 byte =0xC5 \b, message database 17926>4 byte =0xC6 \b, folder database 17927>4 byte =0xC7 \b, account information 17928>4 byte =0x30 \b, offline database 17929 17930 17931# Summary: Windows crash dump 17932# Extension: .dmp 17933# Created by: Andreas Schuster (http://computer.forensikblog.de/) 17934# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 17935# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 179360 string PAGE 17937>4 string DUMP MS Windows 32bit crash dump 17938>>0x05c byte 0 \b, no PAE 17939>>0x05c byte 1 \b, PAE 17940>>0xf88 lelong 1 \b, full dump 17941>>0xf88 lelong 2 \b, kernel dump 17942>>0xf88 lelong 3 \b, small dump 17943>>0x068 lelong x \b, %ld pages 17944>4 string DU64 MS Windows 64bit crash dump 17945>>0xf98 lelong 1 \b, full dump 17946>>0xf98 lelong 2 \b, kernel dump 17947>>0xf98 lelong 3 \b, small dump 17948>>0x090 lequad x \b, %lld pages 17949 17950 17951# Summary: Vista Event Log 17952# Extension: .evtx 17953# Created by: Andreas Schuster (http://computer.forensikblog.de/) 17954# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 179550 string ElfFile\0 MS Windows Vista Event Log 17956>0x2a leshort x \b, %d chunks 17957>>0x10 lelong x \b (no. %d in use) 17958>0x18 lelong >1 \b, next record no. %d 17959>0x18 lelong =1 \b, empty 17960>0x78 lelong &1 \b, DIRTY 17961>0x78 lelong &2 \b, FULL 17962 17963 17964# Summary: Windows 3.1 group files 17965# Extension: .grp 17966# Created by: unknown 179670 string \120\115\103\103 MS Windows 3.1 group files 17968 17969 17970# Summary: Old format help files 17971# Extension: .hlp 17972# Created by: Dirk Jagdmann <doj@cubic.org> 179730 lelong 0x00035f3f MS Windows 3.x help file 17974 17975 17976# Summary: Hyper terminal 17977# Extension: .ht 17978# Created by: unknown 179790 string HyperTerminal\ 17980>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 17981 17982 17983# Summary: Windows shortcut 17984# Extension: .lnk 17985# Created by: unknown 179860 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 17987 17988 17989# Summary: Outlook Personal Folders 17990# Created by: unknown 179910 lelong 0x4E444221 Microsoft Outlook email folder 17992>10 leshort 0x0e (<=2002) 17993>10 leshort 0x17 (>=2003) 17994 17995 17996# Summary: Windows help cache 17997# Created by: unknown 179980 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 17999 18000 18001# Summary: IE cache file 18002# Created by: Christophe Monniez 180030 string Client\ UrlCache\ MMF Internet Explorer cache file 18004>20 string >\0 version %s 18005 18006 18007# Summary: Registry files 18008# Created by: unknown 18009# Modified by (1): Joerg Jenderek 180100 string regf MS Windows registry file, NT/2000 or above 180110 string CREG MS Windows 95/98/ME registry file 180120 string SHCC3 MS Windows 3.1 registry file 18013 18014 18015# Summary: Windows Registry text 18016# Extension: .reg 18017# Submitted by: Abel Cheung <abelcheung@gmail.com> 180180 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 180190 string Windows\ Registry\ Editor\ 18020>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 18021 18022 18023# From: Pal Tamas <folti@balabit.hu> 18024# Autorun File 180250 string/c [autorun]\r\n Microsoft Windows Autorun file. 18026!:mime application/x-setupscript. 18027 18028#------------------------------------------------------------------------------ 18029# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 18030# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 18031# 180320 string RGDB CRDA wireless regulatory database file 18033>4 belong 19 (Version 1) 18034 18035#------------------------------------------------------------------------------ 18036# $File: wordprocessors,v 1.14 2009/09/19 16:28:13 christos Exp $ 18037# wordprocessors: file(1) magic fo word processors. 18038# 18039####### PWP file format used on Smith Corona Personal Word Processors: 180402 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 18041>24 byte 2 \b, single spaced 18042>24 byte 3 \b, 1.5 spaced 18043>24 byte 4 \b, double spaced 18044>25 byte 0x42 \b, letter 18045>25 byte 0x54 \b, legal 18046>26 byte 0x46 \b, A4 18047 18048#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 180490 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file 18050>15 byte 0 Optimized for Intel 18051>15 byte 1 Optimized for Non-Intel 180521 string WPC (Corel/WP) 18053>8 short 257 WordPerfect macro 18054>8 short 258 WordPerfect help file 18055>8 short 259 WordPerfect keyboard file 18056>8 short 266 WordPerfect document 18057>8 short 267 WordPerfect dictionary 18058>8 short 268 WordPerfect thesaurus 18059>8 short 269 WordPerfect block 18060>8 short 270 WordPerfect rectangular block 18061>8 short 271 WordPerfect column block 18062>8 short 272 WordPerfect printer data 18063>8 short 275 WordPerfect printer data 18064>8 short 276 WordPerfect driver resource data 18065>8 short 279 WordPerfect hyphenation code 18066>8 short 280 WordPerfect hyphenation data 18067>8 short 281 WordPerfect macro resource data 18068>8 short 283 WordPerfect hyphenation lex 18069>8 short 285 WordPerfect wordlist 18070>8 short 286 WordPerfect equation resource data 18071>8 short 289 WordPerfect spell rules 18072>8 short 290 WordPerfect dictionary rules 18073>8 short 295 WordPerfect spell rules (Microlytics) 18074>8 short 299 WordPerfect settings file 18075>8 short 301 WordPerfect 4.2 document 18076>8 short 325 WordPerfect dialog file 18077>8 short 332 WordPerfect button bar 18078>8 short 513 Shell macro 18079>8 short 522 Shell definition 18080>8 short 769 Notebook macro 18081>8 short 770 Notebook help file 18082>8 short 771 Notebook keyboard file 18083>8 short 778 Notebook definition 18084>8 short 1026 Calculator help file 18085>8 short 1538 Calendar help file 18086>8 short 1546 Calendar data file 18087>8 short 1793 Editor macro 18088>8 short 1794 Editor help file 18089>8 short 1795 Editor keyboard file 18090>8 short 1817 Editor macro resource file 18091>8 short 2049 Macro editor macro 18092>8 short 2050 Macro editor help file 18093>8 short 2051 Macro editor keyboard file 18094>8 short 2305 PlanPerfect macro 18095>8 short 2306 PlanPerfect help file 18096>8 short 2307 PlanPerfect keyboard file 18097>8 short 2314 PlanPerfect worksheet 18098>8 short 2319 PlanPerfect printer definition 18099>8 short 2322 PlanPerfect graphic definition 18100>8 short 2323 PlanPerfect data 18101>8 short 2324 PlanPerfect temporary printer 18102>8 short 2329 PlanPerfect macro resource data 18103>8 byte 11 Mail 18104>8 short 2818 help file 18105>8 short 2821 distribution list 18106>8 short 2826 out box 18107>8 short 2827 in box 18108>8 short 2836 users archived mailbox 18109>8 short 2837 archived message database 18110>8 short 2838 archived attachments 18111>8 short 3083 Printer temporary file 18112>8 short 3330 Scheduler help file 18113>8 short 3338 Scheduler in file 18114>8 short 3339 Scheduler out file 18115>8 short 3594 GroupWise settings file 18116>8 short 3601 GroupWise directory services 18117>8 short 3627 GroupWise settings file 18118>8 short 4362 Terminal resource data 18119>8 short 4363 Terminal resource data 18120>8 short 4395 Terminal resource data 18121>8 short 4619 GUI loadable text 18122>8 short 4620 graphics resource data 18123>8 short 4621 printer settings file 18124>8 short 4622 port definition file 18125>8 short 4623 print queue parameters 18126>8 short 4624 compressed file 18127>8 short 5130 Network service msg file 18128>8 short 5131 Network service msg file 18129>8 short 5132 Async gateway login msg 18130>8 short 5134 GroupWise message file 18131>8 short 7956 GroupWise admin domain database 18132>8 short 7957 GroupWise admin host database 18133>8 short 7959 GroupWise admin remote host database 18134>8 short 7960 GroupWise admin ADS deferment data file 18135>8 short 8458 IntelliTAG (SGML) compiled DTD 18136>8 long 18219264 WordPerfect graphic image (1.0) 18137>8 long 18219520 WordPerfect graphic image (2.0) 18138#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 18139 18140# Hangul (Korean) Word Processor File 181410 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 18142# From: Won-Kyu Park <wkpark@kldp.org> 18143512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 18144!:mime application/x-hwp 18145 18146# CosmicBook, from Benot Rouits 181470 string CSBK Ted Neslson's CosmicBook hypertext file 18148 181492 string EYWR AmigaWriter file 18150 18151# chi: file(1) magic for ChiWriter files 181520 string \\1cw\ ChiWriter file 18153>5 string >\0 version %s 181540 string \\1cw ChiWriter file 18155 18156# Quark Express from http://www.garykessler.net/library/file_sigs.html 181572 string IIXPR3 Intel Quark Express Document (English) 181582 string IIXPRa Intel Quark Express Document (Korean) 181592 string MMXPR3 Motorola Quark Express Document (English) 18160!:mime application/x-quark-xpress-3 181612 string MMXPRa Motorola Quark Express Document (Korean) 18162 18163# adobe indesign (document, whatever...) from querkan 181640 belong 0x0606edf5 Adobe InDesign 18165>16 string DOCUMENT Document 18166 18167#------------------------------------------------------------------------------ 18168# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 18169# 18170# Contributor kenzo-: 18171# Reversed-engineered JS Ichitaro magic numbers 18172# 18173 181740 string DOC 18175>43 byte 0x14 Just System Word Processor Ichitaro v4 18176!:mime application/x-ichitaro4 18177>144 string JDASH application/x-ichitaro4 18178 181790 string DOC 18180>43 byte 0x15 Just System Word Processor Ichitaro v5 18181!:mime application/x-ichitaro5 18182 181830 string DOC 18184>43 byte 0x16 Just System Word Processor Ichitaro v6 18185!:mime application/x-ichitaro6 18186 18187#------------------------------------------------------------------------------ 18188# $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $ 18189# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 18190# 181910 string %XDELTA% XDelta binary patch file 0.14 181920 string %XDZ000% XDelta binary patch file 0.18 181930 string %XDZ001% XDelta binary patch file 0.20 181940 string %XDZ002% XDelta binary patch file 1.0 181950 string %XDZ003% XDelta binary patch file 1.0.4 181960 string %XDZ004% XDelta binary patch file 1.1 18197 18198#------------------------------------------------------------------------------ 18199# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $ 18200# xenix: file(1) magic for Microsoft Xenix 18201# 18202# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 18203# model" lifted from "magic.xenix", with comment "derived empirically; 18204# treat as folklore until proven" 18205# 18206# "small model", "large model", "huge model" stuff lifted from XXX 18207# 18208# XXX - "x.out" collides with PDP-11 archives 18209# 182100 string core core file (Xenix) 182110 byte 0x80 8086 relocatable (Microsoft) 182120 leshort 0xff65 x.out 18213>2 string __.SYMDEF randomized 18214>0 byte x archive 182150 leshort 0x206 Microsoft a.out 18216>8 leshort 1 Middle model 18217>0x1e leshort &0x10 overlay 18218>0x1e leshort &0x2 separate 18219>0x1e leshort &0x4 pure 18220>0x1e leshort &0x800 segmented 18221>0x1e leshort &0x400 standalone 18222>0x1e leshort &0x8 fixed-stack 18223>0x1c byte &0x80 byte-swapped 18224>0x1c byte &0x40 word-swapped 18225>0x10 lelong >0 not-stripped 18226>0x1e leshort ^0xc000 pre-SysV 18227>0x1e leshort &0x4000 V2.3 18228>0x1e leshort &0x8000 V3.0 18229>0x1c byte &0x4 86 18230>0x1c byte &0xb 186 18231>0x1c byte &0x9 286 18232>0x1c byte &0xa 386 18233>0x1f byte <0x040 small model 18234>0x1f byte =0x048 large model 18235>0x1f byte =0x049 huge model 18236>0x1e leshort &0x1 executable 18237>0x1e leshort ^0x1 object file 18238>0x1e leshort &0x40 Large Text 18239>0x1e leshort &0x20 Large Data 18240>0x1e leshort &0x120 Huge Objects Enabled 18241>0x10 lelong >0 not stripped 18242 182430 leshort 0x140 old Microsoft 8086 x.out 18244>0x3 byte &0x4 separate 18245>0x3 byte &0x2 pure 18246>0 byte &0x1 executable 18247>0 byte ^0x1 relocatable 18248>0x14 lelong >0 not stripped 18249 182500 lelong 0x206 b.out 18251>0x1e leshort &0x10 overlay 18252>0x1e leshort &0x2 separate 18253>0x1e leshort &0x4 pure 18254>0x1e leshort &0x800 segmented 18255>0x1e leshort &0x400 standalone 18256>0x1e leshort &0x1 executable 18257>0x1e leshort ^0x1 object file 18258>0x1e leshort &0x4000 V2.3 18259>0x1e leshort &0x8000 V3.0 18260>0x1c byte &0x4 86 18261>0x1c byte &0xb 186 18262>0x1c byte &0x9 286 18263>0x1c byte &0x29 286 18264>0x1c byte &0xa 386 18265>0x1e leshort &0x4 Large Text 18266>0x1e leshort &0x2 Large Data 18267>0x1e leshort &0x102 Huge Objects Enabled 18268 182690 leshort 0x580 XENIX 8086 relocatable or 80286 small model 18270 18271#------------------------------------------------------------------------------ 18272# $File: xilinx,v 1.4 2009/09/19 16:28:13 christos Exp $ 18273# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 18274# Xilinx-Magic@RevRagnarok.com 18275# Got the info from FPGA-FAQ 0026 18276# 18277# First there is the sync header and its length 182780 beshort 0x0009 18279>2 belong =0x0ff00ff0 18280>>&0 belong =0x0ff00ff0 18281>>>&0 beshort =0x0000 18282>>>>&0 pstring a Xilinx BIT data 18283# Next is a Pascal-style string with the NCD name. We want to capture that. 18284>>>>0x0F pstring x - from %s 18285# It is followed by a NUL 18286>>>>>&1 byte 0x00 18287# And then 'b' 18288>>>>>&2 string b 18289# With the part number: 18290#>>>>>&5 string 4v (Virtex4) 18291#>>>>>&5 string 2v (Virtex II 18292#>>>>>>&0 string !p \b) 18293#>>>>>>&0 string p Pro) 18294>>>>>&4 pstring x - for %s 18295# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length 18296>>>>>>&1 byte 0x00 18297>>>>>>&2 string c 18298>>>>>>&4 pstring x - built %s 18299>>>>>>>&1 byte 0x00 18300>>>>>>>&2 string d 18301>>>>>>>&4 pstring x \b(%s) 18302>>>>>>>>&1 byte 0x00 18303>>>>>>>>&2 string e 18304>>>>>>>>&4 belong x - data length 0x%lx 18305 18306#------------------------------------------------------------------------------ 18307# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 18308# xo65 object files 18309# From: "Ullrich von Bassewitz" <uz@cc65.org> 18310# 183110 string \x55\x7A\x6E\x61 xo65 object, 18312>4 leshort x version %d, 18313>6 leshort&0x0001 =0x0001 with debug info 18314>6 leshort&0x0001 =0x0000 no debug info 18315 18316# xo65 library files 183170 string \x6E\x61\x55\x7A xo65 library, 18318>4 leshort x version %d 18319 18320# o65 object files 183210 string \x01\x00\x6F\x36\x35 o65 18322>6 leshort&0x1000 =0x0000 executable, 18323>6 leshort&0x1000 =0x1000 object, 18324>5 byte x version %d, 18325>6 leshort&0x8000 =0x8000 65816, 18326>6 leshort&0x8000 =0x0000 6502, 18327>6 leshort&0x2000 =0x2000 32 bit, 18328>6 leshort&0x2000 =0x0000 16 bit, 18329>6 leshort&0x4000 =0x4000 page reloc, 18330>6 leshort&0x4000 =0x0000 byte reloc, 18331>6 leshort&0x0003 =0x0000 alignment 1 18332>6 leshort&0x0003 =0x0001 alignment 2 18333>6 leshort&0x0003 =0x0002 alignment 4 18334>6 leshort&0x0003 =0x0003 alignment 256 18335 18336#------------------------------------------------------------------------------ 18337# $File: xwindows,v 1.6 2009/09/19 16:28:13 christos Exp $ 18338# xwindows: file(1) magic for various X/Window system file formats. 18339 18340# Compiled X Keymap 18341# XKM (compiled X keymap) files (including version and byte ordering) 183421 string mkx Compiled XKB Keymap: lsb, 18343>0 byte >0 version %d 18344>0 byte =0 obsolete 183450 string xkm Compiled XKB Keymap: msb, 18346>3 byte >0 version %d 18347>0 byte =0 obsolete 18348 18349# xfsdump archive 183500 string xFSdump0 xfsdump archive 18351>8 belong x (version %d) 18352 18353# Jaleo XFS files 183540 long 395726 Jaleo XFS file 18355>4 long x - version %ld 18356>8 long x - [%ld - 18357>20 long x %ldx 18358>24 long x %ldx 18359>28 long 1008 YUV422] 18360>28 long 1000 RGB24] 18361 18362# Xcursor data 18363# X11 mouse cursor format defined in libXcursor, see 18364# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 18365# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 183660 string Xcur Xcursor data 18367!:mime image/x-xcursor 18368>10 leshort x version %hd 18369>>8 leshort x \b.%hd 18370 18371#------------------------------------------------------------------------------ 18372# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 18373# zilog: file(1) magic for Zilog Z8000. 18374# 18375# Was it big-endian or little-endian? My Product Specification doesn't 18376# say. 18377# 183780 long 0xe807 object file (z8000 a.out) 183790 long 0xe808 pure object file (z8000 a.out) 183800 long 0xe809 separate object file (z8000 a.out) 183810 long 0xe805 overlay object file (z8000 a.out) 18382 18383#------------------------------------------------------------------------------ 18384# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 18385# zyxel: file(1) magic for ZyXEL modems 18386# 18387# From <rob@pe1chl.ampr.org> 18388# These are the /etc/magic entries to decode datafiles as used for the 18389# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 18390# ZyXEL-defined standard) 18391 183920 string ZyXEL\002 ZyXEL voice data 18393>10 byte 0 - CELP encoding 18394>10 byte&0x0B 1 - ADPCM2 encoding 18395>10 byte&0x0B 2 - ADPCM3 encoding 18396>10 byte&0x0B 3 - ADPCM4 encoding 18397>10 byte&0x0B 8 - New ADPCM3 encoding 18398>10 byte&0x04 4 with resync 18399