1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@astron.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83# From: Joerg Jenderek
84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
86# GRR: line below is too general as it matches also "Git pack" in ./revision
870	string	PACK\0
88# check for valid compression method 0-4
89>5	ulelong	<5
90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
91# To skip "Git pack" version 0 test for root directory object like
92# ADFS::RPC.$.websitezip.FONTFIX
93>>9	string	>ADFS\  PackDir archive (RISC OS)
94# TrID labels above as "Acorn PackDir compressed Archive"
95# compression mode y (0 - 4) for GIF LZW with a maximum n bits
96# (y~n,0~12,1~13,2~14,3~15,4~16)
97>>>5	ulelong+12 x	\b, LZW %u-bits compression
98# https://www.filebase.org.uk/filetypes
99# !Packdir compressed archive has three hexadecimal digits code 68E
100!:mime	application/x-acorn-68E
101!:ext	pkd/bin
102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
103>>>9	string	x	\b, root "%s"
104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
105>>>>&1	ulelong	x	\b, load address 0x%x
106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
107>>>>&5	ulelong	x	\b, exec address 0x%x
108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
109>>>>&9	ulelong	x	\b, attributes 0x%x
110# number of entries in this directory. for root dir 0
111#>>>&13	ulelong	x	\b, entries 0x%x
112# the entries start here with object name
113>>>>&17	string	x	\b, 1st object "%s"
114
115
116#------------------------------------------------------------------------------
117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
118# adi: file(1) magic for ADi's objects
119# From Gregory McGarry <g.mcgarry@ieee.org>
120#
1210	leshort		0x521c		COFF DSP21k
122>18	lelong		&02		executable,
123>18	lelong		^02
124>>18	lelong		&01		static object,
125>>18	lelong		^01		relocatable object,
126>18	lelong		&010		stripped
127>18	lelong		^010		not stripped
128
129#------------------------------------------------------------------------------
130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
131# adventure: file(1) magic for Adventure game files
132#
133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
136#
137# ALAN
138# I assume there are other, lower versions, but these are the only ones I
139# saw in the archive.
1400	beshort	0x0206	ALAN game data
141>2	byte	<10	version 2.6%d
142
143
144# Infocom (see z-machine)
145#------------------------------------------------------------------------------
146# Z-machine:  file(1) magic for Z-machine binaries.
147# Sanity checks by David Griffith <dave@661.org>
148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
149#
150#http://www.gnelson.demon.co.uk/zspec/sect11.html
151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
152#https://en.wikipedia.org/wiki/Z-machine
153# The first byte is the Z-machine revision; it is always between 1 and 8. We
154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
155# well as an occasional MP3 file), so we sanity-check the version number.
156#
157# It might be possible to sanity-check the release number as well, as it seems
158# (at least in classic Infocom games) to always be a relatively small number,
159# always under 150 or so, but as this isn't rigorous, we'll wait on that until
160# it becomes clear that it's needed.
161#
1620	ubyte			>0
163>0	ubyte			<9
164>>16	belong&0xfe00f0f0	0x3030
165>>>0	ubyte			< 10
166>>>>2	ubeshort		x
167>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
168>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
169>>>>>>>2	ubeshort	x 	\b, Release %d
170>>>>>>>>18	string		>\0	\b, Serial %.6s
171>>>>>>>>18	string		x	\b)
172!:strength + 40
173!:mime	application/x-zmachine
174
175#------------------------------------------------------------------------------
176# Glulx:  file(1) magic for Glulx binaries.
177#
178# David Griffith <dave@661.org>
179# I haven't checked for false matches yet.
180#
1810	string			Glul	Glulx game data
182>4	beshort			x	(Version %d
183>>6	byte			x	\b.%d
184>>8	byte			x	\b.%d)
185>36	string			Info	Compiled by Inform
186!:mime	application/x-glulx
187
188
189# For Quetzal and blorb magic see iff
190
191
192# TADS (Text Adventure Development System) version 2
193#  All files are machine-independent (games compile to byte-code) and are tagged
194#  with a version string of the form "V2.<digit>.<digit>\0".
195#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1960	string	TADS2\ bin	TADS
197>9	belong  !0x0A0D1A00	game data, CORRUPTED
198>9	belong	 0x0A0D1A00
199>>13	string	>\0		%s game data
200!:mime	application/x-tads
201#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
2020	string	TADS2\ rsc	TADS
203>9	belong  !0x0A0D1A00	resource data, CORRUPTED
204>9	belong	 0x0A0D1A00
205>>13	string	>\0		%s resource data
206!:mime	application/x-tads
207#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
208#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
209# "TADS2 save\n\r\032\0" and the interpreter version.
2100	string	TADS2\ save/g	TADS
211>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
212>12	belong	 0x0A0D1A00
213>>(16.s+32) string >\0		%s saved game data
214!:mime	application/x-tads
215#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
216#  version.
2170	string	TADS2\ save	TADS
218>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
219>10	belong	 0x0A0D1A00
220>>14	string	>\0		%s saved game data
221!:mime	application/x-tads
222
223# TADS (Text Adventure Development System) version 3
224#  Game files start with "T3-image\015\012\032"
2250	string	T3-image\015\012\032
226>11	leshort	x		TADS 3 game data (format version %d)
227#  Saved game files start with "T3-state-v####\015\012\032"
228#  where #### is a format version number
2290	string	T3-state-v
230>14	string	\015\012\032	TADS 3 saved game data (format version
231>>10	byte	x		%c
232>>11	byte	x		\b%c
233>>12	byte	x		\b%c
234>>13	byte	x		\b%c)
235!:mime	application/x-t3vm-image
236
237# edited by David Griffith <dave@661.org>
238# Danny Milosavljevic <danny.milo@gmx.net>
239# These are ADRIFT (adventure game standard) game files, extension .taf
240# Checked from source at (http://www.adrift.co/) and various taf files
241# found at the Interactive Fiction Archive (https://ifarchive.org/)
2420	belong  0x3C423FC9
243>4	belong  0x6A87C2CF	Adrift game file version
244>>8	belong  0x94453661	3.80
245>>8	belong  0x94453761	3.90
246>>8	belong  0x93453E61	4.0
247>>8	belong  0x92453E61	5.0
248>>8	default x		unknown
249!:mime	application/x-adrift
250
251#------------------------------------------------------------------------------
252# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $
253# algol68:  file(1) magic for Algol 68 source
254#
2550	search/8192	(input,			Algol 68 source text
256!:mime	text/x-Algol68
2570	regex/1024	\^PROC			Algol 68 source text
258!:mime	text/x-Algol68
2590	regex/1024	\bMODE[\t\ ]		Algol 68 source text
260!:mime	text/x-Algol68
2610	regex/1024	\bREF[\t\ ]		Algol 68 source text
262!:mime	text/x-Algol68
2630	regex/1024	\bFLEX[\t\ ]\*\\[	Algol 68 source text
264!:mime	text/x-Algol68
265#0	regex          	[\t\ ]OD		Algol 68 source text
266#!:mime	text/x-Algol68
267#0	regex          	[\t\ ]FI		Algol 68 source text
268#!:mime	text/x-Algol68
269
270#------------------------------------------------------------------------------
271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
272# allegro:  file(1) magic for Allegro datafiles
273# Toby Deshane <hac@shoelace.digivill.net>
274#
2750 belong 0x736C6821   Allegro datafile (packed)
2760 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2770 belong 0x736C682B   Allegro datafile (appended exe data)
278
279#------------------------------------------------------------------------------
280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
281# alliant:  file(1) magic for Alliant FX series a.out files
282#
283# If the FX series is the one that had a processor with a 68K-derived
284# instruction set, the "short" should probably become "beshort" and the
285# "long" should probably become "belong".
286# If it's the i860-based one, they should probably become either the
287# big-endian or little-endian versions, depending on the mode they ran
288# the 860 in....
289#
2900	short		0420		0420 Alliant virtual executable
291>2	short		&0x0020		common library
292>16	long		>0		not stripped
2930	short		0421		0421 Alliant compact executable
294>2	short		&0x0020		common library
295>16	long		>0		not stripped
296
297#------------------------------------------------------------------------------
298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
299# amanda:  file(1) magic for amanda file format
300#
3010	string	AMANDA:\ 		AMANDA
302>8	string	TAPESTART\ DATE		tape header file,
303>>23	string	X
304>>>25	string	>\ 			Unused %s
305>>23	string	>\ 			DATE %s
306>8	string	FILE\ 			dump file,
307>>13	string	>\ 			DATE %s
308
309#------------------------------------------------------------------------------
310# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $
311# amigaos:  file(1) magic for AmigaOS binary formats:
312
313#
314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
315#
3160	belong		0x000003fa	AmigaOS shared library
3170	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
3180	belong		0x000003e7	AmigaOS object/library data
319#
3200	beshort		0xe310		Amiga Workbench
321>2	beshort		1
322>>48	byte		1		disk icon
323>>48	byte		2		drawer icon
324>>48	byte		3		tool icon
325>>48	byte		4		project icon
326>>48	byte		5		garbage icon
327>>48	byte		6		device icon
328>>48	byte		7		kickstart icon
329>>48	byte		8		workbench application icon
330>2	beshort		>1		icon, vers. %d
331#
332# various sound formats from the Amiga
333# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
334#
3350	string		FC14		Future Composer 1.4 Module sound file
3360	string		SMOD		Future Composer 1.3 Module sound file
3370	string		AON4artofnoise	Art Of Noise Module sound file
3381	string		MUGICIAN/SOFTEYES Mugician Module sound file
33958	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3400	string		Synth4.0	Synthesis Module sound file
3410	string		ARP.		The Holy Noise Module sound file
3420	string		BeEp\0		JamCracker Module sound file
3430	string		COSO\0		Hippel-COSO Module sound file
344# Too simple (short, pure ASCII, deep), MPi
345#26	string		V.3		Brian Postma's Soundmon Module sound file v3
346#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
347#26	string		V.2		Brian Postma's Soundmon Module sound file v2
348
349# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3500	beshort		0x0f00		AmigaOS bitmap font
3510	beshort		0x0f03		AmigaOS outline font
3520	belong		0x80001001	AmigaOS outline tag
3530	string		##\ version	catalog translation
3540	string		EMOD\0		Amiga E module
3558	string		ECXM\0		ECX module
3560	string/c	@database	AmigaGuide file
357
358# Amiga disk types
359#
3600	string		RDSK		Rigid Disk Block
361>160	string		x		on %.24s
3620	string		DOS\0		Amiga DOS disk
3630	string		DOS\1		Amiga FFS disk
3640	string		DOS\2		Amiga Inter DOS disk
3650	string		DOS\3		Amiga Inter FFS disk
3660	string		DOS\4		Amiga Fastdir DOS disk
3670	string		DOS\5		Amiga Fastdir FFS disk
3680	string		KICK		Kickstart disk
369
370# From: Alex Beregszaszi <alex@fsn.hu>
3710	string		LZX		LZX compressed archive (Amiga)
372
373# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3740	string 		.KEY		AmigaDOS script
3750	string 		.key		AmigaDOS script
376
377# AMOS Basic file formats
378# https://www.exotica.org.uk/wiki/AMOS_file_formats
3790	string		AMOS\040Basic\040 	AMOS Basic source code
380>11	byte		=0x56 			\b, tested
381>11	byte		=0x76 			\b, untested
3820 	string		AMOS\040Pro		AMOS Basic source code
383>11	byte		=0x56 			\b, tested
384>11	byte		=0x76 			\b, untested
3850	string		AmSp			AMOS Basic sprite bank
386>4	beshort		x			\b, %d sprites
3870	string		AmIc			AMOS Basic icon bank
388>4	beshort		x			\b, %d icons
3890	string		AmBk			AMOS Basic memory bank
390>4	beshort		x			\b, bank number %d
391>8	belong&0xFFFFFFF	x		\b, length %d
392>12	regex		.{8}			\b, type %s
3930	string		AmBs			AMOS Basic memory banks
394>4	beshort		x			\b, %d banks
395
396#------------------------------------------------------------
397# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $
398# Various android related magic entries
399#------------------------------------------------------------
400
401# Dalvik .dex format. http://retrodev.com/android/dexformat.html
402# From <mkf@google.com> "Mike Fleming"
403# Fixed to avoid regexec 17 errors on some dex files
404# From <diff@lookout.com> "Tim Strazzere"
4050	string	dex\n
406>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
407>4	string	>000			version %s
4080	string	dey\n
409>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
410>4	string	>000			version %s
411
412# Android bootimg format
413# From https://android.googlesource.com/\
414# platform/system/core/+/master/mkbootimg/bootimg.h
415# https://github.com/djrbliss/loki/blob/master/loki.h#L43
4160		string	ANDROID!	Android bootimg
417>1024	string	LOKI		\b, LOKI'd
418>>1028	lelong	0			\b (boot)
419>>1028	lelong	1			\b (recovery)
420>8		lelong	>0			\b, kernel
421>>12	lelong	>0			\b (0x%x)
422>16		lelong	>0			\b, ramdisk
423>>20	lelong	>0			\b (0x%x)
424>24		lelong	>0			\b, second stage
425>>28	lelong	>0			\b (0x%x)
426>36		lelong	>0			\b, page size: %d
427>38		string	>0			\b, name: %s
428>64		string	>0		 	\b, cmdline (%s)
429
430# Android Backup archive
431# From: Ariel Shkedi
432# Update: Joerg Jenderek
433# URL: https://github.com/android/platform_frameworks_base/blob/\
434# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
435# android/server/BackupManagerService.java#L2367
436# Reference: https://sourceforge.net/projects/adbextractor/
437#            android-backup-extractor/perl/backupencrypt.pl
438# Note:	only unix line feeds "\n" found
439# After the header comes a tar file
440# If compressed, the entire tar file is compressed with JAVA deflate
441#
442# Include the version number hardcoded with the magic string to avoid
443# false positives
4440	string/b	ANDROID\ BACKUP\n	Android Backup
445# maybe look for some more characteristics like linefeed '\n' or version
446#>16	string		\n
447# No mime-type defined officially
448!:mime	application/x-google-ab
449!:ext	ab
450# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
451>15	string		>\0			\b, version %s
452# "1" on 3rd line means compressed
453>17	string		0\n			\b, Not-Compressed
454>17	string		1\n			\b, Compressed
455# The 4th line is encryption "none" or "AES-256"
456# any string as long as it's not the word none (which is matched below)
457>19	string		none\n			\b, Not-Encrypted
458# look for backup content after line with encryption info
459#>>19	search/7	\n
460# data part after header for not encrypted Android Backup
461#>>>&0	ubequad		x	\b, content 0x%16.16llx...
462# look for zlib compressed by ./compress after message with 1 space at end
463#>>>&0	indirect	x	\b; contains
464# look for tar archive block by ./archive for package name manifest
465>>288	string		ustar	\b; contains
466>>>31	use	tar-file
467# look for zip/jar archive by ./archive ./zip after message with 1 space at end
468#>>2079	search/1025/s	PK\003\004	\b; contains
469#>>>&0	indirect	x
470>19	string		!none
471>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
472# Commented out because they don't seem useful to print
473# (but they are part of the header - the tar file comes after them):
474# The 5th line is User Password Salt (128 Hex)
475# string length too high with standard src configuration
476#>>>&1		string	>\0	\b, PASSWORD salt: "%-128.128s"
477#>>>&1		regex/1l .*	\b, Password salt: %s
478# The 6th line is Master Key Checksum Salt (128 Hex)
479#>>>>&1		regex/1l .*	\b, Master salt: %s
480# The 7th line is Number of PBDKF2 Rounds (10000)
481#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
482# The 8th line is User key Initialization Vector (IV) (32 Hex)
483#>>>>>>&1	regex/1l .*	\b, IV: %s
484#>>>>>>&1	regex/1l .*	\b, IV: %s
485# The 9th line is Master IV+Key+Checksum (192 Hex)
486#>>>>>>>&1	regex/1l .*	\b, Key: %s
487# look for new line separator char after line number 9
488#>>>0x204	ubyte	0x0a	NL found
489#>>>>&1		ubequad	x	\b, Content magic %16.16llx
490
491# *.pit files by Joerg Jenderek
492# https://forum.xda-developers.com/showthread.php?p=9122369
493# https://forum.xda-developers.com/showthread.php?t=816449
494# Partition Information Table for Samsung's smartphone with Android
495# used by flash software Odin
4960		ulelong			0x12349876
497# 1st pit entry marker
498>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
499# minimal 13 and maximal 18 PIT entries found
500>>4		ulelong			<128	Partition Information Table for Samsung smartphone
501>>>4		ulelong			x	\b, %d entries
502# 1. pit entry
503>>>4		ulelong			>0	\b; #1
504>>>0x01C	use				PIT-entry
505>>>4		ulelong			>1	\b; #2
506>>>0x0A0	use				PIT-entry
507>>>4		ulelong			>2	\b; #3
508>>>0x124	use				PIT-entry
509>>>4		ulelong			>3	\b; #4
510>>>0x1A8	use				PIT-entry
511>>>4		ulelong			>4	\b; #5
512>>>0x22C	use				PIT-entry
513>>>4		ulelong			>5	\b; #6
514>>>0x2B0	use				PIT-entry
515>>>4		ulelong			>6	\b; #7
516>>>0x334	use				PIT-entry
517>>>4		ulelong			>7 	\b; #8
518>>>0x3B8	use				PIT-entry
519>>>4		ulelong			>8 	\b; #9
520>>>0x43C	use				PIT-entry
521>>>4		ulelong			>9	\b; #10
522>>>0x4C0	use				PIT-entry
523>>>4		ulelong			>10	\b; #11
524>>>0x544	use				PIT-entry
525>>>4		ulelong			>11	\b; #12
526>>>0x5C8	use				PIT-entry
527>>>4		ulelong			>12	\b; #13
528>>>>0x64C	use				PIT-entry
529# 14. pit entry
530>>>4		ulelong			>13	\b; #14
531>>>>0x6D0	use				PIT-entry
532>>>4		ulelong			>14	\b; #15
533>>>0x754	use				PIT-entry
534>>>4		ulelong			>15	\b; #16
535>>>0x7D8	use				PIT-entry
536>>>4		ulelong			>16	\b; #17
537>>>0x85C	use				PIT-entry
538# 18. pit entry
539>>>4		ulelong			>17	\b; #18
540>>>0x8E0	use				PIT-entry
541
5420	name			PIT-entry
543# garbage value implies end of pit entries
544>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
545# skip empty partition name
546>>0x24		ubyte				!0
547# partition name
548>>>0x24		string				>\0			%-.32s
549# flags
550>>>0x0C		ulelong&0x00000002		2			\b+RW
551# partition ID:
552# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
553# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
554>>>0x08	ulelong		x			(0x%x)
555# filename
556>>>0x44		string				>\0			"%-.64s"
557#>>>0x18	ulelong				>0
558# blocksize in 512 byte units ?
559#>>>>0x18	ulelong				x			\b, %db
560# partition size in blocks ?
561#>>>>0x22	ulelong				x			\b*%d
562
563# Android sparse img format
564# From https://android.googlesource.com/\
565# platform/system/core/+/master/libsparse/sparse_format.h
5660		lelong	0xed26ff3a		Android sparse image
567>4		leshort	x			\b, version: %d
568>6		leshort	x			\b.%d
569>16		lelong	x			\b, Total of %d
570>12		lelong	x			\b %d-byte output blocks in
571>20		lelong	x			\b %d input chunks.
572
573# Android binary XML magic
574# In include/androidfw/ResourceTypes.h:
575# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
576# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
5770	lelong	0x00080003	Android binary XML
578
579# Android cryptfs footer
580# From https://android.googlesource.com/\
581# platform/system/vold/+/refs/heads/master/cryptfs.h
5820	lelong	0xd0b5b1c4	Android cryptfs footer
583>4	leshort	x	\b, version: %d
584>6	leshort	x	\b.%d
585
586#------------------------------------------------------------------------------
587# $File: animation,v 1.77 2020/04/26 15:23:43 christos Exp $
588# animation:  file(1) magic for animation/movie formats
589#
590# animation formats
591# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
592# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
593
594# SGI and Apple formats
5950	string		MOVI		Silicon Graphics movie file
596!:mime	video/x-sgi-movie
5974       string          moov            Apple QuickTime
598!:mime	video/quicktime
599>12     string          mvhd            \b movie (fast start)
600>12     string          mdra            \b URL
601>12     string          cmov            \b movie (fast start, compressed header)
602>12     string          rmra            \b multiple URLs
6034       string          mdat            Apple QuickTime movie (unoptimized)
604!:mime	video/quicktime
605#4       string          wide            Apple QuickTime movie (unoptimized)
606#!:mime	video/quicktime
607#4       string          skip            Apple QuickTime movie (modified)
608#!:mime	video/quicktime
609#4       string          free            Apple QuickTime movie (modified)
610#!:mime	video/quicktime
6114       string          idsc            Apple QuickTime image (fast start)
612!:mime	image/x-quicktime
613#4       string          idat            Apple QuickTime image (unoptimized)
614#!:mime	image/x-quicktime
6154       string          pckg            Apple QuickTime compressed archive
616!:mime	application/x-quicktime-player
6174	string/W	jP		JPEG 2000 image
618!:mime	image/jp2
619# https://www.ftyps.com/ with local additions
6204	string		ftyp		ISO Media
621# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
622>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
623>>96	string		x		\b, Audio "%.4s"
624>>118	beshort		x		at %dHz
625>>140	string		x		\b, Video "%.4s"
626>>168	beshort		x		%d
627>>170	beshort		x		\bx%d
628>8	string		3g2		\b, MPEG v4 system, 3GPP2
629!:mime	video/3gpp2
630>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
631>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
632>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
633# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
634# Section 8.1.1, corresponds to a, b, c
635>>11	byte		0x61		\b C.S0050-0 V1.0
636>>11	byte		0x62		\b C.S0050-0-A V1.0.0
637>>11	byte		0x63		\b C.S0050-0-B V1.0
638>8	string		3ge		\b, MPEG v4 system, 3GPP
639!:mime	video/3gpp
640>>11	byte		6		\b, Release 6 MBMS Extended Presentations
641>>11	byte		7		\b, Release 7 MBMS Extended Presentations
642>8	string		3gg		\b, MPEG v4 system, 3GPP
643!:mime	video/3gpp
644>>11	byte		6		\b, Release 6 General Profile
645>8	string		3gp		\b, MPEG v4 system, 3GPP
646!:mime	video/3gpp
647>>11	byte		1		\b, Release %d (non existent)
648>>11	byte		2		\b, Release %d (non existent)
649>>11	byte		3		\b, Release %d (non existent)
650>>11	byte		4		\b, Release %d
651>>11	byte		5		\b, Release %d
652>>11	byte		6		\b, Release %d
653>>11	byte		7		\b, Release %d Streaming Servers
654>8	string		3gs		\b, MPEG v4 system, 3GPP
655!:mime	video/3gpp
656>>11	byte		7		\b, Release %d Streaming Servers
657>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
658!:mime	video/mp4
659>8	string/W	qt		\b, Apple QuickTime movie
660!:mime	video/quicktime
661>8	string		CAEP		\b, Canon Digital Camera
662>8	string		caqv		\b, Casio Digital Camera
663>8	string		CDes		\b, Convergent Design
664>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
665>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
666>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
667>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
668>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
669>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
670>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
671>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
672>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
673!:mime	video/mp4
674>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
675>8	string		dmpf		\b, Digital Media Project
676>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
677>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
678>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
679>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
680>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
681>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
682>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
683>8	string		dvr1		\b, DVB (.DVB) over RTP
684!:mime	video/vnd.dvb.file
685>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
686!:mime	video/vnd.dvb.file
687>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
688!:mime	video/mp4
689>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
690!:mime	video/mp4
691>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
692!:mime	audio/mp4
693>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
694!:mime	audio/mp4
695>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
696#	?/enc-isoff-generic
697>8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
698!:mime	video/mp4
699>8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
700!:mime	video/mp4
701>8	string/W	jp2		\b, JPEG 2000
702!:mime	image/jp2
703>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
704!:mime	image/jp2
705>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
706>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
707!:mime	image/jpm
708>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
709!:mime	image/jpx
710>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
711!:mime	video/3gpp2
712>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
713!:mime	audio/x-m4a
714>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
715!:mime	audio/mp4
716>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
717!:mime	video/mp4
718>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
719!:mime	video/x-m4v
720>8	string		M4VH		\b, Apple TV (.M4V)
721!:mime	video/x-m4v
722>8	string		M4VP		\b, Apple iPhone (.M4V)
723!:mime	video/x-m4v
724>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
725!:mime	video/mj2
726>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
727!:mime	video/mj2
728>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
729!:mime	video/mp4
730>8	string		mobi		\b, MPEG-4, MOBI format
731!:mime	video/mp4
732>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
733>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
734!:mime	video/mp4
735>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
736!:mime	video/mp4
737>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
738>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
739>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
740>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
741!:mime	video/mp4
742>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
743>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
744!:mime	video/quicktime
745>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
746!:mime	video/mp4
747>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
748!:mime	audio/mp4
749>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
750!:mime	video/mp4
751>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
752!:mime	video/mp4
753>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
754!:mime	video/mp4
755>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
756!:mime	video/mp4
757>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
758!:mime	video/mp4
759>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
760!:mime	video/mp4
761>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
762!:mime	video/mp4
763>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
764!:mime	video/mp4
765>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
766!:mime	video/mp4
767>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
768!:mime	video/mp4
769>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
770>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
771>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
772>8	string		pana		\b, Panasonic Digital Camera
773>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
774!:mime	video/quicktime
775# HEIF image format
776# see https://nokiatech.github.io/heif/technical.html
777>8	string		mif1		\b, HEIF Image
778!:mime image/heif
779>8	string		msf1		\b, HEIF Image Sequence
780!:mime image/heif-sequence
781>8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
782!:mime image/heic
783>8	string		heix		\b, HEIF Image HEVC Main 10 Profile
784!:mime image/heic
785>8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
786!:mime image/heic-sequence
787>8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
788!:mime image/heic-sequence
789# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
790# but used in the reference implementation:
791# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
792>8	string		heim		\b, HEIF Image L-HEVC
793!:mime image/heif
794>8	string		heis		\b, HEIF Image L-HEVC
795!:mime image/heif
796>8	string		avic		\b, HEIF Image AVC
797!:mime image/heif
798>8	string		hevm		\b, HEIF Image Sequence L-HEVC
799!:mime image/heif-sequence
800>8	string		hevs		\b, HEIF Image Sequence L-HEVC
801!:mime image/heif-sequence
802>8	string		avcs		\b, HEIF Image Sequence AVC
803!:mime image/heif-sequence
804
805>8	string		ROSS		\b, Ross Video
806>8	string		sdv		\b, SD Memory Card Video
807>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
808>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
809
810# MPEG sequences
811# Scans for all common MPEG header start codes
8120	 belong		    0x00000001
813>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
814>>5      byte               66             \b, baseline
815>>5      byte               77             \b, main
816>>5      byte               88             \b, extended
817>>7      byte               x              \b @ L %u
8180        belong&0xFFFFFF00  0x00000100
819>3       byte               0xBA           MPEG sequence
820!:mime  video/mpeg
821>>4      byte               &0x40          \b, v2, program multiplex
822>>4      byte               ^0x40          \b, v1, system multiplex
823>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
824>3       byte&0x1F          0x07           MPEG sequence, H.264 video
825>>4      byte               66             \b, baseline
826>>4      byte               77             \b, main
827>>4      byte               88             \b, extended
828>>6      byte               x              \b @ L %u
829# GRR too general as it catches also FoxPro Memo example NG.FPT
830>3       byte               0xB0           MPEG sequence, v4
831# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
832#>>4      byte               !0             MPEG sequence, v4
833!:mime  video/mpeg4-generic
834>>5      belong             0x000001B5
835>>>9     byte               &0x80
836>>>>10   byte&0xF0          16             \b, video
837>>>>10   byte&0xF0          32             \b, still texture
838>>>>10   byte&0xF0          48             \b, mesh
839>>>>10   byte&0xF0          64             \b, face
840>>>9     byte&0xF8          8              \b, video
841>>>9     byte&0xF8          16             \b, still texture
842>>>9     byte&0xF8          24             \b, mesh
843>>>9     byte&0xF8          32             \b, face
844>>4      byte               1              \b, simple @ L1
845>>4      byte               2              \b, simple @ L2
846>>4      byte               3              \b, simple @ L3
847>>4      byte               4              \b, simple @ L0
848>>4      byte               17             \b, simple scalable @ L1
849>>4      byte               18             \b, simple scalable @ L2
850>>4      byte               33             \b, core @ L1
851>>4      byte               34             \b, core @ L2
852>>4      byte               50             \b, main @ L2
853>>4      byte               51             \b, main @ L3
854>>4      byte               53             \b, main @ L4
855>>4      byte               66             \b, n-bit @ L2
856>>4      byte               81             \b, scalable texture @ L1
857>>4      byte               97             \b, simple face animation @ L1
858>>4      byte               98             \b, simple face animation @ L2
859>>4      byte               99             \b, simple face basic animation @ L1
860>>4      byte               100            \b, simple face basic animation @ L2
861>>4      byte               113            \b, basic animation text @ L1
862>>4      byte               114            \b, basic animation text @ L2
863>>4      byte               129            \b, hybrid @ L1
864>>4      byte               130            \b, hybrid @ L2
865>>4      byte               145            \b, advanced RT simple @ L!
866>>4      byte               146            \b, advanced RT simple @ L2
867>>4      byte               147            \b, advanced RT simple @ L3
868>>4      byte               148            \b, advanced RT simple @ L4
869>>4      byte               161            \b, core scalable @ L1
870>>4      byte               162            \b, core scalable @ L2
871>>4      byte               163            \b, core scalable @ L3
872>>4      byte               177            \b, advanced coding efficiency @ L1
873>>4      byte               178            \b, advanced coding efficiency @ L2
874>>4      byte               179            \b, advanced coding efficiency @ L3
875>>4      byte               180            \b, advanced coding efficiency @ L4
876>>4      byte               193            \b, advanced core @ L1
877>>4      byte               194            \b, advanced core @ L2
878>>4      byte               209            \b, advanced scalable texture @ L1
879>>4      byte               210            \b, advanced scalable texture @ L2
880>>4      byte               211            \b, advanced scalable texture @ L3
881>>4      byte               225            \b, simple studio @ L1
882>>4      byte               226            \b, simple studio @ L2
883>>4      byte               227            \b, simple studio @ L3
884>>4      byte               228            \b, simple studio @ L4
885>>4      byte               229            \b, core studio @ L1
886>>4      byte               230            \b, core studio @ L2
887>>4      byte               231            \b, core studio @ L3
888>>4      byte               232            \b, core studio @ L4
889>>4      byte               240            \b, advanced simple @ L0
890>>4      byte               241            \b, advanced simple @ L1
891>>4      byte               242            \b, advanced simple @ L2
892>>4      byte               243            \b, advanced simple @ L3
893>>4      byte               244            \b, advanced simple @ L4
894>>4      byte               245            \b, advanced simple @ L5
895>>4      byte               247            \b, advanced simple @ L3b
896>>4      byte               248            \b, FGS @ L0
897>>4      byte               249            \b, FGS @ L1
898>>4      byte               250            \b, FGS @ L2
899>>4      byte               251            \b, FGS @ L3
900>>4      byte               252            \b, FGS @ L4
901>>4      byte               253            \b, FGS @ L5
902>3       byte               0xB5           MPEG sequence, v4
903!:mime  video/mpeg4-generic
904>>4      byte               &0x80
905>>>5     byte&0xF0          16             \b, video (missing profile header)
906>>>5     byte&0xF0          32             \b, still texture (missing profile header)
907>>>5     byte&0xF0          48             \b, mesh (missing profile header)
908>>>5     byte&0xF0          64             \b, face (missing profile header)
909>>4      byte&0xF8          8              \b, video (missing profile header)
910>>4      byte&0xF8          16             \b, still texture (missing profile header)
911>>4      byte&0xF8          24             \b, mesh (missing profile header)
912>>4      byte&0xF8          32             \b, face (missing profile header)
913>3       byte               0xB3           MPEG sequence
914!:mime  video/mpeg
915>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
916>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
917>>12     belong             0x000001B5     \b, v2,
918>>>16    byte&0x0F          1              \b HP
919>>>16    byte&0x0F          2              \b Spt
920>>>16    byte&0x0F          3              \b SNR
921>>>16    byte&0x0F          4              \b MP
922>>>16    byte&0x0F          5              \b SP
923>>>17    byte&0xF0          64             \b@HL
924>>>17    byte&0xF0          96             \b@H-14
925>>>17    byte&0xF0          128            \b@ML
926>>>17    byte&0xF0          160            \b@LL
927>>>17    byte               &0x08          \b progressive
928>>>17    byte               ^0x08          \b interlaced
929>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
930>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
931>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
932>>11     byte               &0x02
933>>>75    byte               &0x01
934>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
935>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
936>>>>140  belong             0x000001B5     \b, v2,
937>>>>>144 byte&0x0F          1              \b HP
938>>>>>144 byte&0x0F          2              \b Spt
939>>>>>144 byte&0x0F          3              \b SNR
940>>>>>144 byte&0x0F          4              \b MP
941>>>>>144 byte&0x0F          5              \b SP
942>>>>>145 byte&0xF0          64             \b@HL
943>>>>>145 byte&0xF0          96             \b@H-14
944>>>>>145 byte&0xF0          128            \b@ML
945>>>>>145 byte&0xF0          160            \b@LL
946>>>>>145 byte               &0x08          \b progressive
947>>>>>145 byte               ^0x08          \b interlaced
948>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
949>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
950>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
951>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
952>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
953>>76    belong             0x000001B5     \b, v2,
954>>>80   byte&0x0F          1              \b HP
955>>>80   byte&0x0F          2              \b Spt
956>>>80   byte&0x0F          3              \b SNR
957>>>80   byte&0x0F          4              \b MP
958>>>80   byte&0x0F          5              \b SP
959>>>81   byte&0xF0          64             \b@HL
960>>>81   byte&0xF0          96             \b@H-14
961>>>81   byte&0xF0          128            \b@ML
962>>>81   byte&0xF0          160            \b@LL
963>>>81   byte               &0x08          \b progressive
964>>>81   byte               ^0x08          \b interlaced
965>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
966>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
967>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
968>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
969>>>7     byte&0xF0          0x10           \b, 16:9
970>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
971>>>7     byte&0xF0          0x10           \b, 16:9
972>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
973>>>7     byte&0xF0          0x10           \b, 4:3
974>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
975>>>5     beshort&0x0FFF     0x01E0         \b NTSC
976>>>5     beshort&0x0FFF     0x0240         \b PAL
977>>>7     byte&0xF0          0x20           \b, 4:3
978>>>7     byte&0xF0          0x30           \b, 16:9
979>>>7     byte&0xF0          0x40           \b, 11:5
980>>>7     byte&0xF0          0x80           \b, PAL 4:3
981>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
982>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
983>>>7     byte&0xF0          0x10           \b, 4:3
984>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
985>>>7     byte&0xF0          0x10           \b, 4:3
986>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
987>>>7     byte&0xF0          0x10           \b, 4:3
988>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
989>>>7     byte&0xF0          0x10           \b, 4:3
990>>4      beshort&0xFFF0     0x1600         \b, CIF
991>>>5     beshort&0x0FFF     0x00F0         \b NTSC
992>>>5     beshort&0x0FFF     0x0120         \b PAL
993>>>7     byte&0xF0          0x20           \b, 4:3
994>>>7     byte&0xF0          0x30           \b, 16:9
995>>>7     byte&0xF0          0x40           \b, 11:5
996>>>7     byte&0xF0          0x80           \b, PAL 4:3
997>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
998>>>5     beshort&0x0FFF     0x0240         \b PAL 625
999>>>>7    byte&0xF0          0x20           \b, 4:3
1000>>>>7    byte&0xF0          0x30           \b, 16:9
1001>>>>7    byte&0xF0          0x40           \b, 11:5
1002>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
1003>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1004>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1005>>>7     byte&0xF0          0x20           \b, 4:3
1006>>>7     byte&0xF0          0x30           \b, 16:9
1007>>>7     byte&0xF0          0x40           \b, 11:5
1008>>4      beshort&0xFFF0     0x1E00         \b, SVCD
1009>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
1010>>>5     beshort&0x0FFF     0x0240         \b PAL 625
1011>>>7     byte&0xF0          0x20           \b, 4:3
1012>>>7     byte&0xF0          0x30           \b, 16:9
1013>>>7     byte&0xF0          0x40           \b, 11:5
1014>>7      byte&0x0F          1              \b, 23.976 fps
1015>>7      byte&0x0F          2              \b, 24 fps
1016>>7      byte&0x0F          3              \b, 25 fps
1017>>7      byte&0x0F          4              \b, 29.97 fps
1018>>7      byte&0x0F          5              \b, 30 fps
1019>>7      byte&0x0F          6              \b, 50 fps
1020>>7      byte&0x0F          7              \b, 59.94 fps
1021>>7      byte&0x0F          8              \b, 60 fps
1022>>11     byte               &0x04          \b, Constrained
1023
1024# MPEG ADTS Audio (*.mpx/mxa/aac)
1025# from dreesen@math.fu-berlin.de
1026# modified to fully support MPEG ADTS
1027
1028# MP3, M1A
1029# modified by Joerg Jenderek
1030# GRR the original test are too common for many DOS files
1031# so don't accept as MP3 until we've tested the rate
1032# But also beat GEMDOS fonts
10330       beshort&0xFFFE  0xFFFA
1034# rates
1035>2	byte&0xF0	!0
1036>>2	byte&0xF0	!0xF0		MPEG ADTS, layer III, v1
1037!:strength +20
1038!:mime	audio/mpeg
1039>2	byte&0xF0	0x10		\b, 32 kbps
1040>2	byte&0xF0	0x20		\b, 40 kbps
1041>2	byte&0xF0	0x30		\b, 48 kbps
1042>2	byte&0xF0	0x40		\b, 56 kbps
1043>2	byte&0xF0	0x50		\b, 64 kbps
1044>2	byte&0xF0	0x60		\b, 80 kbps
1045>2	byte&0xF0	0x70		\b, 96 kbps
1046>2	byte&0xF0	0x80		\b, 112 kbps
1047>2	byte&0xF0	0x90		\b, 128 kbps
1048>2	byte&0xF0	0xA0		\b, 160 kbps
1049>2	byte&0xF0	0xB0		\b, 192 kbps
1050>2	byte&0xF0	0xC0		\b, 224 kbps
1051>2	byte&0xF0	0xD0		\b, 256 kbps
1052>2	byte&0xF0	0xE0		\b, 320 kbps
1053# timing
1054>2	byte&0x0C	0x00		\b, 44.1 kHz
1055>2	byte&0x0C	0x04		\b, 48 kHz
1056>2	byte&0x0C	0x08		\b, 32 kHz
1057# channels/options
1058>3	byte&0xC0	0x00		\b, Stereo
1059>3	byte&0xC0	0x40		\b, JntStereo
1060>3	byte&0xC0	0x80		\b, 2x Monaural
1061>3	byte&0xC0	0xC0		\b, Monaural
1062#>1	byte		^0x01		\b, Data Verify
1063#>2	byte		&0x02		\b, Packet Pad
1064#>2	byte		&0x01		\b, Custom Flag
1065#>3	byte		&0x08		\b, Copyrighted
1066#>3	byte		&0x04		\b, Original Source
1067#>3	byte&0x03	1		\b, NR: 50/15 ms
1068#>3	byte&0x03	3		\b, NR: CCIT J.17
1069
1070# MP2, M1A
10710       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
1072!:mime	audio/mpeg
1073# rates
1074>2      byte&0xF0       0x10           \b,  32 kbps
1075>2      byte&0xF0       0x20           \b,  48 kbps
1076>2      byte&0xF0       0x30           \b,  56 kbps
1077>2      byte&0xF0       0x40           \b,  64 kbps
1078>2      byte&0xF0       0x50           \b,  80 kbps
1079>2      byte&0xF0       0x60           \b,  96 kbps
1080>2      byte&0xF0       0x70           \b, 112 kbps
1081>2      byte&0xF0       0x80           \b, 128 kbps
1082>2      byte&0xF0       0x90           \b, 160 kbps
1083>2      byte&0xF0       0xA0           \b, 192 kbps
1084>2      byte&0xF0       0xB0           \b, 224 kbps
1085>2      byte&0xF0       0xC0           \b, 256 kbps
1086>2      byte&0xF0       0xD0           \b, 320 kbps
1087>2      byte&0xF0       0xE0           \b, 384 kbps
1088# timing
1089>2      byte&0x0C       0x00           \b, 44.1 kHz
1090>2      byte&0x0C       0x04           \b, 48 kHz
1091>2      byte&0x0C       0x08           \b, 32 kHz
1092# channels/options
1093>3      byte&0xC0       0x00           \b, Stereo
1094>3      byte&0xC0       0x40           \b, JntStereo
1095>3      byte&0xC0       0x80           \b, 2x Monaural
1096>3      byte&0xC0       0xC0           \b, Monaural
1097#>1     byte            ^0x01          \b, Data Verify
1098#>2     byte            &0x02          \b, Packet Pad
1099#>2     byte            &0x01          \b, Custom Flag
1100#>3     byte            &0x08          \b, Copyrighted
1101#>3     byte            &0x04          \b, Original Source
1102#>3     byte&0x03       1              \b, NR: 50/15 ms
1103#>3     byte&0x03       3              \b, NR: CCIT J.17
1104
1105# MPA, M1A
1106# updated by Joerg Jenderek
1107# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
1108# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
1109# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
1110#0	beshort&0xFFFE		0xFFFE
1111#>2	ubyte&0xF0	>0x0F
1112#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
1113## rate
1114#>>>2      byte&0xF0       0x10           \b,  32 kbps
1115#>>>2      byte&0xF0       0x20           \b,  64 kbps
1116#>>>2      byte&0xF0       0x30           \b,  96 kbps
1117#>>>2      byte&0xF0       0x40           \b, 128 kbps
1118#>>>2      byte&0xF0       0x50           \b, 160 kbps
1119#>>>2      byte&0xF0       0x60           \b, 192 kbps
1120#>>>2      byte&0xF0       0x70           \b, 224 kbps
1121#>>>2      byte&0xF0       0x80           \b, 256 kbps
1122#>>>2      byte&0xF0       0x90           \b, 288 kbps
1123#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1124#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1125#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1126#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1127#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1128## timing
1129#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1130#>>>2      byte&0x0C       0x04           \b, 48 kHz
1131#>>>2      byte&0x0C       0x08           \b, 32 kHz
1132## channels/options
1133#>>>3      byte&0xC0       0x00           \b, Stereo
1134#>>>3      byte&0xC0       0x40           \b, JntStereo
1135#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1136#>>>3      byte&0xC0       0xC0           \b, Monaural
1137##>1     byte            ^0x01          \b, Data Verify
1138##>2     byte            &0x02          \b, Packet Pad
1139##>2     byte            &0x01          \b, Custom Flag
1140##>3     byte            &0x08          \b, Copyrighted
1141##>3     byte            &0x04          \b, Original Source
1142##>3     byte&0x03       1              \b, NR: 50/15 ms
1143##>3     byte&0x03       3              \b, NR: CCIT J.17
1144
1145# MP3, M2A
11460       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1147!:mime	audio/mpeg
1148# rate
1149>2      byte&0xF0       0x10           \b,   8 kbps
1150>2      byte&0xF0       0x20           \b,  16 kbps
1151>2      byte&0xF0       0x30           \b,  24 kbps
1152>2      byte&0xF0       0x40           \b,  32 kbps
1153>2      byte&0xF0       0x50           \b,  40 kbps
1154>2      byte&0xF0       0x60           \b,  48 kbps
1155>2      byte&0xF0       0x70           \b,  56 kbps
1156>2      byte&0xF0       0x80           \b,  64 kbps
1157>2      byte&0xF0       0x90           \b,  80 kbps
1158>2      byte&0xF0       0xA0           \b,  96 kbps
1159>2      byte&0xF0       0xB0           \b, 112 kbps
1160>2      byte&0xF0       0xC0           \b, 128 kbps
1161>2      byte&0xF0       0xD0           \b, 144 kbps
1162>2      byte&0xF0       0xE0           \b, 160 kbps
1163# timing
1164>2      byte&0x0C       0x00           \b, 22.05 kHz
1165>2      byte&0x0C       0x04           \b, 24 kHz
1166>2      byte&0x0C       0x08           \b, 16 kHz
1167# channels/options
1168>3      byte&0xC0       0x00           \b, Stereo
1169>3      byte&0xC0       0x40           \b, JntStereo
1170>3      byte&0xC0       0x80           \b, 2x Monaural
1171>3      byte&0xC0       0xC0           \b, Monaural
1172#>1     byte            ^0x01          \b, Data Verify
1173#>2     byte            &0x02          \b, Packet Pad
1174#>2     byte            &0x01          \b, Custom Flag
1175#>3     byte            &0x08          \b, Copyrighted
1176#>3     byte            &0x04          \b, Original Source
1177#>3     byte&0x03       1              \b, NR: 50/15 ms
1178#>3     byte&0x03       3              \b, NR: CCIT J.17
1179
1180# MP2, M2A
11810       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1182!:mime	audio/mpeg
1183# rate
1184>2      byte&0xF0       0x10           \b,   8 kbps
1185>2      byte&0xF0       0x20           \b,  16 kbps
1186>2      byte&0xF0       0x30           \b,  24 kbps
1187>2      byte&0xF0       0x40           \b,  32 kbps
1188>2      byte&0xF0       0x50           \b,  40 kbps
1189>2      byte&0xF0       0x60           \b,  48 kbps
1190>2      byte&0xF0       0x70           \b,  56 kbps
1191>2      byte&0xF0       0x80           \b,  64 kbps
1192>2      byte&0xF0       0x90           \b,  80 kbps
1193>2      byte&0xF0       0xA0           \b,  96 kbps
1194>2      byte&0xF0       0xB0           \b, 112 kbps
1195>2      byte&0xF0       0xC0           \b, 128 kbps
1196>2      byte&0xF0       0xD0           \b, 144 kbps
1197>2      byte&0xF0       0xE0           \b, 160 kbps
1198# timing
1199>2      byte&0x0C       0x00           \b, 22.05 kHz
1200>2      byte&0x0C       0x04           \b, 24 kHz
1201>2      byte&0x0C       0x08           \b, 16 kHz
1202# channels/options
1203>3      byte&0xC0       0x00           \b, Stereo
1204>3      byte&0xC0       0x40           \b, JntStereo
1205>3      byte&0xC0       0x80           \b, 2x Monaural
1206>3      byte&0xC0       0xC0           \b, Monaural
1207#>1     byte            ^0x01          \b, Data Verify
1208#>2     byte            &0x02          \b, Packet Pad
1209#>2     byte            &0x01          \b, Custom Flag
1210#>3     byte            &0x08          \b, Copyrighted
1211#>3     byte            &0x04          \b, Original Source
1212#>3     byte&0x03       1              \b, NR: 50/15 ms
1213#>3     byte&0x03       3              \b, NR: CCIT J.17
1214
1215# MPA, M2A
12160       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1217!:mime	audio/mpeg
1218# rate
1219>2      byte&0xF0       0x10           \b,  32 kbps
1220>2      byte&0xF0       0x20           \b,  48 kbps
1221>2      byte&0xF0       0x30           \b,  56 kbps
1222>2      byte&0xF0       0x40           \b,  64 kbps
1223>2      byte&0xF0       0x50           \b,  80 kbps
1224>2      byte&0xF0       0x60           \b,  96 kbps
1225>2      byte&0xF0       0x70           \b, 112 kbps
1226>2      byte&0xF0       0x80           \b, 128 kbps
1227>2      byte&0xF0       0x90           \b, 144 kbps
1228>2      byte&0xF0       0xA0           \b, 160 kbps
1229>2      byte&0xF0       0xB0           \b, 176 kbps
1230>2      byte&0xF0       0xC0           \b, 192 kbps
1231>2      byte&0xF0       0xD0           \b, 224 kbps
1232>2      byte&0xF0       0xE0           \b, 256 kbps
1233# timing
1234>2      byte&0x0C       0x00           \b, 22.05 kHz
1235>2      byte&0x0C       0x04           \b, 24 kHz
1236>2      byte&0x0C       0x08           \b, 16 kHz
1237# channels/options
1238>3      byte&0xC0       0x00           \b, Stereo
1239>3      byte&0xC0       0x40           \b, JntStereo
1240>3      byte&0xC0       0x80           \b, 2x Monaural
1241>3      byte&0xC0       0xC0           \b, Monaural
1242#>1     byte            ^0x01          \b, Data Verify
1243#>2     byte            &0x02          \b, Packet Pad
1244#>2     byte            &0x01          \b, Custom Flag
1245#>3     byte            &0x08          \b, Copyrighted
1246#>3     byte            &0x04          \b, Original Source
1247#>3     byte&0x03       1              \b, NR: 50/15 ms
1248#>3     byte&0x03       3              \b, NR: CCIT J.17
1249
1250# MP3, M25A
12510       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1252!:mime	audio/mpeg
1253# rate
1254>2      byte&0xF0       0x10           \b,   8 kbps
1255>2      byte&0xF0       0x20           \b,  16 kbps
1256>2      byte&0xF0       0x30           \b,  24 kbps
1257>2      byte&0xF0       0x40           \b,  32 kbps
1258>2      byte&0xF0       0x50           \b,  40 kbps
1259>2      byte&0xF0       0x60           \b,  48 kbps
1260>2      byte&0xF0       0x70           \b,  56 kbps
1261>2      byte&0xF0       0x80           \b,  64 kbps
1262>2      byte&0xF0       0x90           \b,  80 kbps
1263>2      byte&0xF0       0xA0           \b,  96 kbps
1264>2      byte&0xF0       0xB0           \b, 112 kbps
1265>2      byte&0xF0       0xC0           \b, 128 kbps
1266>2      byte&0xF0       0xD0           \b, 144 kbps
1267>2      byte&0xF0       0xE0           \b, 160 kbps
1268# timing
1269>2      byte&0x0C       0x00           \b, 11.025 kHz
1270>2      byte&0x0C       0x04           \b, 12 kHz
1271>2      byte&0x0C       0x08           \b, 8 kHz
1272# channels/options
1273>3      byte&0xC0       0x00           \b, Stereo
1274>3      byte&0xC0       0x40           \b, JntStereo
1275>3      byte&0xC0       0x80           \b, 2x Monaural
1276>3      byte&0xC0       0xC0           \b, Monaural
1277#>1     byte            ^0x01          \b, Data Verify
1278#>2     byte            &0x02          \b, Packet Pad
1279#>2     byte            &0x01          \b, Custom Flag
1280#>3     byte            &0x08          \b, Copyrighted
1281#>3     byte            &0x04          \b, Original Source
1282#>3     byte&0x03       1              \b, NR: 50/15 ms
1283#>3     byte&0x03       3              \b, NR: CCIT J.17
1284
1285# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1286
1287# Stored AAC streams (instead of the MP4 format)
12880       string          ADIF           MPEG ADIF, AAC
1289!:mime	audio/x-hx-aac-adif
1290>4      byte            &0x80
1291>>13    byte            &0x10          \b, VBR
1292>>13    byte            ^0x10          \b, CBR
1293>>16    byte&0x1E       0x02           \b, single stream
1294>>16    byte&0x1E       0x04           \b, 2 streams
1295>>16    byte&0x1E       0x06           \b, 3 streams
1296>>16    byte            &0x08          \b, 4 or more streams
1297>>16    byte            &0x10          \b, 8 or more streams
1298>>4    byte            &0x80          \b, Copyrighted
1299>>13   byte            &0x40          \b, Original Source
1300>>13   byte            &0x20          \b, Home Flag
1301>4      byte            ^0x80
1302>>4     byte            &0x10          \b, VBR
1303>>4     byte            ^0x10          \b, CBR
1304>>7     byte&0x1E       0x02           \b, single stream
1305>>7     byte&0x1E       0x04           \b, 2 streams
1306>>7     byte&0x1E       0x06           \b, 3 streams
1307>>7     byte            &0x08          \b, 4 or more streams
1308>>7     byte            &0x10          \b, 8 or more streams
1309>>4    byte            &0x40          \b, Original Stream(s)
1310>>4    byte            &0x20          \b, Home Source
1311
1312# Live or stored single AAC stream (used with MPEG-2 systems)
13130       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1314!:mime	audio/x-hx-aac-adts
1315>1      byte            &0x08          \b, v2
1316>1      byte            ^0x08          \b, v4
1317# profile
1318>>2     byte            &0xC0          \b LTP
1319>2      byte&0xc0       0x00           \b Main
1320>2      byte&0xc0       0x40           \b LC
1321>2      byte&0xc0       0x80           \b SSR
1322# timing
1323>2      byte&0x3c       0x00           \b, 96 kHz
1324>2      byte&0x3c       0x04           \b, 88.2 kHz
1325>2      byte&0x3c       0x08           \b, 64 kHz
1326>2      byte&0x3c       0x0c           \b, 48 kHz
1327>2      byte&0x3c       0x10           \b, 44.1 kHz
1328>2      byte&0x3c       0x14           \b, 32 kHz
1329>2      byte&0x3c       0x18           \b, 24 kHz
1330>2      byte&0x3c       0x1c           \b, 22.05 kHz
1331>2      byte&0x3c       0x20           \b, 16 kHz
1332>2      byte&0x3c       0x24           \b, 12 kHz
1333>2      byte&0x3c       0x28           \b, 11.025 kHz
1334>2      byte&0x3c       0x2c           \b, 8 kHz
1335# channels
1336>2      beshort&0x01c0  0x0040         \b, monaural
1337>2      beshort&0x01c0  0x0080         \b, stereo
1338>2      beshort&0x01c0  0x00c0         \b, stereo + center
1339>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1340>2      beshort&0x01c0  0x0140         \b, surround
1341>2      beshort&0x01c0  0x0180         \b, surround + LFE
1342>2      beshort         &0x01C0        \b, surround + side
1343#>1     byte            ^0x01           \b, Data Verify
1344#>2     byte            &0x02           \b, Custom Flag
1345#>3     byte            &0x20           \b, Original Stream
1346#>3     byte            &0x10           \b, Home Source
1347#>3     byte            &0x08           \b, Copyrighted
1348
1349# Live MPEG-4 audio streams (instead of RTP FlexMux)
13500       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1351!:mime	audio/x-mp4a-latm
1352#>1     beshort&0x1FFF  x              \b, %hu byte packet
1353>3      byte&0xE0       0x40
1354>>4     byte&0x3C       0x04           \b, single stream
1355>>4     byte&0x3C       0x08           \b, 2 streams
1356>>4     byte&0x3C       0x0C           \b, 3 streams
1357>>4     byte            &0x08          \b, 4 or more streams
1358>>4     byte            &0x20          \b, 8 or more streams
1359>3      byte&0xC0       0
1360>>4     byte&0x78       0x08           \b, single stream
1361>>4     byte&0x78       0x10           \b, 2 streams
1362>>4     byte&0x78       0x18           \b, 3 streams
1363>>4     byte            &0x20          \b, 4 or more streams
1364>>4     byte            &0x40          \b, 8 or more streams
1365# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1366#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1367#!:mime	audio/x-mp4a-latm
1368
1369# Summary: FLI animation format
1370# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1371# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13724	leshort		0xAF11
1373# standard FLI always has 320x200 resolution and 8 bit color
1374>8	leshort		320
1375>>10	leshort		200
1376>>>12	leshort		8			FLI animation, 320x200x8
1377!:mime	video/x-fli
1378>>>>6	leshort		x			\b, %d frames
1379# frame speed is multiple of 1/70s
1380>>>>16	leshort		x			\b, %d/70s per frame
1381
1382# Summary: FLC animation format
1383# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1384# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13854	leshort		0xAF12
1386# standard FLC always use 8 bit color
1387>12	leshort		8			FLC animation
1388!:mime	video/x-flc
1389>>8	leshort		x			\b, %d
1390>>10	leshort		x			\bx%dx8
1391>>6	uleshort	x			\b, %d frames
1392>>16	uleshort	x			\b, %dms per frame
1393
1394# DL animation format
1395# XXX - collision with most `mips' magic
1396#
1397# I couldn't find a real magic number for these, however, this
1398# -appears- to work.  Note that it might catch other files, too, so be
1399# careful!
1400#
1401# Note that title and author appear in the two 20-byte chunks
1402# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1403# 255 (hex FF)!  The DL format is really bad.
1404#
1405#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1406#!:mime	video/x-unknown
1407#>42	byte	x	- %d screens,
1408#>43	byte	x	%d commands
1409#0	byte	2	DL version 2
1410#!:mime	video/x-unknown
1411#>1	byte	1	- large format (320x200,1 image/screen),
1412#>1	byte	2	- medium format (160x100,4 images/screen),
1413#>1	byte	>2	- unknown format,
1414#>42	byte	x	%d screens,
1415#>43	byte	x	%d commands
1416# Based on empirical evidence, DL version 3 have several nulls following the
1417# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1418#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1419
1420# iso 13818 transport stream
1421#
1422# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1423# syncbyte      8 bit	0x47
1424# error_ind     1 bit	-
1425# payload_start 1 bit	1
1426# priority      1 bit	-
1427# PID          13 bit	0x0000
1428# scrambling    2 bit	-
1429# adaptfld_ctrl 2 bit	1 or 3
1430# conti_count   4 bit	-
14310	belong&0xFF5FFF10	0x47400010
1432>188	byte			0x47		MPEG transport stream data
1433!:mime  video/MP2T
1434
1435# DIF digital video file format <mpruett@sgi.com>
14360	belong&0xffffff00	0x1f070000      DIF
1437>4	byte			&0x01		(DVCPRO) movie file
1438>4	byte			^0x01		(DV) movie file
1439>3	byte			&0x80		(PAL)
1440>3	byte			^0x80		(NTSC)
1441
1442# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
14430	string			\x8aMNG		MNG video data,
1444!:mime	video/x-mng
1445>4	belong			!0x0d0a1a0a	CORRUPTED,
1446>4	belong			0x0d0a1a0a
1447>>16    belong	x				%d x
1448>>20    belong	x				%d
1449
1450# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
14510	string			\x8bJNG		JNG video data,
1452!:mime	video/x-jng
1453>4	belong			!0x0d0a1a0a	CORRUPTED,
1454>4	belong			0x0d0a1a0a
1455>>16    belong	x				%d x
1456>>20    belong	x				%d
1457
1458# Vivo video (Wolfram Kleff)
14593	string		\x0D\x0AVersion:Vivo	Vivo video data
1460
1461# ABC (alembic.io 3d models)
14620	string	0gawa		ABC 3d model
1463
1464# VRML (Virtual Reality Modelling Language)
14650       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1466!:mime	model/vrml
14670	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1468!:mime	model/vrml
1469
1470# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd]
1471# From Michel Briand <michelbriand@free.fr>
1472# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
1473# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
14740	string/w	\<?xml\ version=
1475!:strength + 5
1476>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1477!:mime model/x3d+xml
1478
1479#---------------------------------------------------------------------------
1480# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1481# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1482#
14830	string		HVQM4		%s
1484>6	string		>\0		v%s
1485>0	byte		x		GameCube movie,
1486>0x34	ubeshort	x		%d x
1487>0x36	ubeshort	x		%d,
1488>0x26	ubeshort	x		%dus,
1489>0x42	ubeshort	0		no audio
1490>0x42	ubeshort	>0		%dHz audio
1491
1492# From: "Stefan A. Haubenthal" <polluks@web.de>
14930	string		DVDVIDEO-VTS	Video title set,
1494>0x21	byte		x		v%x
14950	string		DVDVIDEO-VMG	Video manager,
1496>0x21	byte		x		v%x
1497
1498# From: Behan Webster <behanw@websterwood.com>
1499# NuppelVideo used by Mythtv (*.nuv)
1500# Note: there are two identical stanzas here differing only in the
1501# initial string matched. It used to be done with a regex, but we're
1502# trying to get rid of those.
15030	string		NuppelVideo	MythTV NuppelVideo
1504>12	string		x		v%s
1505>20	lelong		x		(%d
1506>24	lelong		x		\bx%d),
1507>36	string		P		\bprogressive,
1508>36	string		I		\binterlaced,
1509>40	ledouble	x		\baspect:%.2f,
1510>48	ledouble	x		\bfps:%.2f
15110	string		MythTV		MythTV NuppelVideo
1512>12	string		x		v%s
1513>20	lelong		x		(%d
1514>24	lelong		x		\bx%d),
1515>36	string		P		\bprogressive,
1516>36	string		I		\binterlaced,
1517>40	ledouble	x		\baspect:%.2f,
1518>48	ledouble	x		\bfps:%.2f
1519
1520#						MPEG file
1521# MPEG sequences
1522# FIXME: This section is from the old magic.mime file and needs
1523# integrating with the rest
1524#0       belong             0x000001BA
1525#>4      byte               &0x40
1526#!:mime	video/mp2p
1527#>4      byte               ^0x40
1528#!:mime	video/mpeg
1529#0       belong             0x000001BB
1530#!:mime	video/mpeg
1531#0       belong             0x000001B0
1532#!:mime	video/mp4v-es
1533#0       belong             0x000001B5
1534#!:mime	video/mp4v-es
1535#0       belong             0x000001B3
1536#!:mime	video/mpv
1537#0       belong&0xFF5FFF10  0x47400010
1538#!:mime	video/mp2t
1539#0       belong             0x00000001
1540#>4      byte&0x1F	   0x07
1541#!:mime	video/h264
1542
1543# Type: Bink Video
1544# Extension: .bik
1545# URL:  https://wiki.multimedia.cx/index.php?title=Bink_Container
1546# From: <hoehle@users.sourceforge.net>  2008-07-18
15470	name		bik
1548#>4	ulelong		x	size %d
1549>20	ulelong		x	\b, %d
1550>24	ulelong		x	\bx%d
1551>8	ulelong		x	\b, %d frames
1552>32	ulelong		x	at rate %d/
1553>28	ulelong		>1	\b%d
1554>40	ulelong		=0	\b, no audio
1555>40	ulelong		!0	\b, %d audio track
1556>>40	ulelong		!1	\bs
1557# follow properties of the first audio track only
1558>>48	uleshort	x	%dHz
1559>>51	byte&0x20	0	mono
1560>>51	byte&0x20	!0	stereo
1561#>>51	byte&0x10	0	FFT
1562#>>51	byte&0x10	!0	DCT
1563
15640	string		BIK
1565>3	regex		=[bdfghi]	Bink Video rev.%s
1566>>0	use		bik
1567
15680	string		KB2
1569>3	regex		=[adfghi]	Bink Video 2 rev.%s
1570>>0	use		bik
1571
1572# Type:	NUT Container
1573# URL:	https://wiki.multimedia.cx/index.php?title=NUT
1574# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
15750	string	nut/multimedia\ container\0	NUT multimedia container
1576
1577# Type: Nullsoft Video (NSV)
1578# URL:  https://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1579# From: Mike Melanson <mike@multimedia.cx>
15800	string	NSVf	Nullsoft Video
1581
1582# Type: REDCode Video
1583# URL:  https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode
1584# From: Mike Melanson <mike@multimedia.cx>
15854	string	RED1	REDCode Video
1586
1587# Type: MTV Multimedia File
1588# URL:  https://wiki.multimedia.cx/index.php?title=MTV
1589# From: Mike Melanson <mike@multimedia.cx>
15900	string	AMVS	MTV Multimedia File
1591
1592# Type: ARMovie
1593# URL:  https://wiki.multimedia.cx/index.php?title=ARMovie
1594# From: Mike Melanson <mike@multimedia.cx>
15950	string	ARMovie\012	ARMovie
1596
1597# Type: Interplay MVE Movie
1598# URL:  https://wiki.multimedia.cx/index.php?title=Interplay_MVE
1599# From: Mike Melanson <mike@multimedia.cx>
16000	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1601
1602# Type: Windows Television DVR File
1603# URL:  https://wiki.multimedia.cx/index.php?title=WTV
1604# From: Mike Melanson <mike@mutlimedia.cx>
1605# This takes the form of a Windows-style GUID
16060	bequad	0xB7D800203749DA11
1607>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1608
1609# Type: Sega FILM/CPK Multimedia
1610# URL:  https://wiki.multimedia.cx/index.php?title=Sega_FILM
1611# From: Mike Melanson <mike@multimedia.cx>
16120	string	FILM	Sega FILM/CPK Multimedia,
1613>32	belong	x	%d x
1614>28	belong	x	%d
1615
1616# Type: Nintendo THP Multimedia
1617# URL:  https://wiki.multimedia.cx/index.php?title=THP
1618# From: Mike Melanson <mike@multimedia.cx>
16190	string	THP\0	Nintendo THP Multimedia
1620
1621# Type: BBC Dirac Video
1622# URL:  https://wiki.multimedia.cx/index.php?title=Dirac
1623# From: Mike Melanson <mike@multimedia.cx>
16240	string	BBCD	BBC Dirac Video
1625
1626# Type: RAD Game Tools Smacker Multimedia
1627# URL:  https://wiki.multimedia.cx/index.php?title=Smacker
1628# From: Mike Melanson <mike@multimedia.cx>
16290	string	SMK	RAD Game Tools Smacker Multimedia
1630>3	byte	x	version %c,
1631>4	lelong	x	%d x
1632>8	lelong	x	%d,
1633>12	lelong	x	%d frames
1634
1635# Material Exchange Format
1636# More information:
1637# https://en.wikipedia.org/wiki/Material_Exchange_Format
1638# http://www.freemxf.org/
16390	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1640!:ext	mxf
1641!:mime	application/mxf
1642
1643# Recognize LucasArts Smush video files (cf.
1644# https://wiki.multimedia.cx/index.php/Smush)
16450	string	ANIM
1646>8	string	AHDR	LucasArts Smush Animation Format (SAN) video
16470	string	SANM
1648>8	string	SHDR	LucasArts Smush v2 (SANM) video
1649
1650# Type: Scaleform video
1651# Extension: .usm
1652# URL:  https://wiki.multimedia.cx/index.php/USM
1653# From: David Korth <gerbilsoft@gerbilsoft.com>
16540	string	CRID
1655>32	string	@UTF	Scaleform video
1656
1657#------------------------------------------------------------------------------
1658# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1659# aout:  file(1) magic for a.out executable/object/etc entries that
1660# handle executables on multiple platforms.
1661#
1662
1663#
1664# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1665# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1666#
1667# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1668# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1669# works only for binaries using shared libraries.  Grabbing the entry
1670# point from the a.out header, using it to find the first code executed
1671# in the program, and looking at that might help.
1672#
16730	lelong		0407		a.out little-endian 32-bit executable
1674>16	lelong		>0		not stripped
1675>32	byte		0x6a		(uses BSD/OS shared libs)
1676
16770	lelong		0410		a.out little-endian 32-bit pure executable
1678>16	lelong		>0		not stripped
1679>32	byte		0x6a		(uses BSD/OS shared libs)
1680
16810	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1682>16	lelong		>0		not stripped
1683>32	byte		0x6a		(uses BSD/OS shared libs)
1684
1685#
1686# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1687# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1688#
1689# XXX - is there anything we can look at to distinguish old SunOS 68010
1690# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1691# the first instruction or instructions in the program.
1692#
16930	belong		0407		a.out big-endian 32-bit executable
1694>16	belong		>0		not stripped
1695
16960	belong		0410		a.out big-endian 32-bit pure executable
1697>16	belong		>0		not stripped
1698
16990	belong		0413		a.out big-endian 32-bit demand paged executable
1700>16	belong		>0		not stripped
1701
1702
1703#------------------------------------------------------------------------------
1704# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
1705# apache: file(1) magic for Apache Big Data formats
1706
1707# Avro files
17080	string		Obj		Apache Avro
1709>3	byte		x		version %d
1710
1711# ORC files
1712# Important information is in file footer, which we can't index to :(
17130	string		ORC		Apache ORC
1714
1715# Parquet files
17160	string		PAR1		Apache Parquet
1717
1718# Hive RC files
17190	string		RCF		Apache Hive RC file
1720>3	byte		x		version %d
1721
1722# Sequence files (and the careless first version of RC file)
1723
17240	string		SEQ
1725>3	byte		<6		Apache Hadoop Sequence file version %d
1726>3	byte		>6		Apache Hadoop Sequence file version %d
1727>3	byte		=6
1728>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
1729>>3	default		x		Apache Hadoop Sequence file version 6
1730
1731#------------------------------------------------------------------------------
1732# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1733# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1734#       workspaces)
1735#
17360	long		0100554		APL workspace (Ken's original?)
1737
1738#------------------------------------------------------------------------------
1739# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $
1740# apple:  file(1) magic for Apple file formats
1741#
17420	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
17430	string		\x0aGL			Binary II (apple ][) data
17440	string		\x76\xff		Squeezed (apple ][) data
17450	string		NuFile			NuFile archive (apple ][) data
17460	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
17470	belong		0x00051600		AppleSingle encoded Macintosh file
17480	belong		0x00051607		AppleDouble encoded Macintosh file
1749
1750# Type: Apple Emulator WOZ format
1751# From: Greg Wildman <greg@apple2.org.za>
1752# Ref: https://applesaucefdc.com/woz/reference/
1753# Ref: https://applesaucefdc.com/woz/reference2/
1754#
1755# Note: The following test are mostly identical. I would rather not
1756# use a regex to identify the WOZ format number.
17570	string		WOZ1
1758>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
1759>12	string		INFO
1760>>21	byte		01			\b, 5.25 inch
1761>>21	byte		02			\b, 3.5 inch
1762>>22	byte		01			\b, write protected
1763>>23	byte		01			\b, cross track synchronized
1764>>25	string/T	x			\b, %.32s
17650	string		WOZ2
1766>4	string		\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
1767>12	string		INFO
1768>>21	byte		01			\b, 5.25 inch
1769>>21	byte		02			\b, 3.5 inch
1770>>22	byte		01			\b, write protected
1771>>23	byte		01			\b, cross track synchronized
1772>>25	string/T	x			\b, %.32s
1773
1774# Type: Apple Emulator disk images
1775# From: Greg Wildman <greg@apple2.org.za>
1776# ProDOS boot loader?
17770		string	\x01\x38\xB0\x03\x4C	Apple ProDOS Image
1778# Detect Volume Directory block ($02)
1779>0x400		string	\x00\x00\x03\x00
1780>>0x404		byte	&0xF0
1781>>>0x405	string	x			\b, Volume /%s
1782>>>0x429	leshort	x			\b, %u Blocks
1783# ProDOS ordered ?
1784>0xb00		string	\x00\x00\x03\x00
1785>>0xb04		byte	&0xF0
1786>>>0xb05	string	x			\b, Volume /%s
1787>>>0xb29	leshort	x			\b, %u Blocks
1788#
1789# DOS3.3 boot loader?
17900		string	\x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
1791>0x11001	string	\x11\x0F\x03	Apple DOS 3.3 Image
1792>>0x11006	byte	x		\b, Volume %u
1793>>0x11034	byte	x		\b, %u Tracks
1794>>0x11035	byte	x		\b, %u Sectors
1795>>0x11036	leshort	x		\b, %u bytes per sector
1796# DOS3.2 ?
1797>0x11001	string	\x11\x0C\x02	Apple DOS 3.2 Image
1798>>0x11006	byte	x		\b, Volume %u
1799>>0x11034	byte	x		\b, %u Tracks
1800>>0x11035	byte	x		\b, %u Sectors
1801>>0x11036	leshort	x		\b, %u bytes per sector
1802# DOS3.1 ?
1803>0x11001	string	\x11\x0C\x01
1804>>0x11c00	string	\x00\x11\x0B	Apple DOS 3.1 Image
1805#
1806# Pascal boot loader?
18070		string	\x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
1808>0xd6		pstring SYSTEM.APPLE
1809>>0xb00		leshort	0x0000
1810>>>0xb04	leshort 0x0000		Apple Pascal Image
1811>>>>0xb06	pstring x		\b, Volume %s:
1812>>>>0xb0e	leshort x		\b, %u Blocks
1813>>>>0xb10	leshort x		\b, %u Files
1814#
1815# Diversi Dos boot loader?
18160		string	\x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
1817>0x11001	string	\x11\x0F\x03	Apple Diversi Dos Image
1818>>0x11006	byte	x		\b, Volume %u
1819>>0x11034	byte	x		\b, %u Tracks
1820>>0x11035	byte	x		\b, %u Sectors
1821>>0x11036	leshort	x		\b, %u bytes per sector
1822
1823# Type: Apple Emulator 2IMG format
1824# From: Radek Vokal <rvokal@redhat.com>
1825# Update: Greg Wildman <greg@apple2.org.za>
18260		string	2IMG		Apple ][ 2IMG Disk Image
1827>4		clear	x
1828>4		string	XGS!		\b, XGS
1829>4		string	CTKG		\b, Catakig
1830>4		string	ShIm		\b, Sheppy's ImageMaker
1831>4		string	SHEP		\b, Sheppy's ImageMaker
1832>4		string	WOOF		\b, Sweet 16
1833>4		string	B2TR		\b, Bernie ][ the Rescue
1834>4		string	\!nfc		\b, ASIMOV2
1835>4		string	\>BD\<		\b, Brutal Deluxe's Cadius
1836>4		string	CdrP		\b, CiderPress
1837>4		string	Vi][		\b, Virtual ][
1838>4		string	PRFS		\b, ProFUSE
1839>4		string	FISH		\b, FishWings
1840>4		string	RVLW		\b, Revival for Windows
1841>4		default	x
1842>>4		string	x		\b, Creator tag "%-4.4s"
1843>0xc		byte	00		\b, DOS 3.3 sector order
1844>>0x10		byte	00		\b, Volume 254
1845>>0x10		byte&0x7f x		\b, Volume %u
1846>0xc		byte	01		\b, ProDOS sector order
1847# Detect Volume Directory block ($02) + 2mg header offset
1848>>0x440		string	\x00\x00\x03\x00
1849>>>0x444	byte	&0xF0
1850>>>>0x445	string	x		\b, Volume /%s
1851>>>>0x469	leshort	x		\b, %u Blocks
1852>0xc		byte	02		\b, NIB data
1853
1854# magic for Newton PDA package formats
1855# from Ruda Moura <ruda@helllabs.org>
18560	string	package0	Newton package, NOS 1.x,
1857>12	belong	&0x80000000	AutoRemove,
1858>12	belong	&0x40000000	CopyProtect,
1859>12	belong	&0x10000000	NoCompression,
1860>12	belong	&0x04000000	Relocation,
1861>12	belong	&0x02000000	UseFasterCompression,
1862>16	belong	x		version %d
1863
18640	string	package1	Newton package, NOS 2.x,
1865>12	belong	&0x80000000	AutoRemove,
1866>12	belong	&0x40000000	CopyProtect,
1867>12	belong	&0x10000000	NoCompression,
1868>12	belong	&0x04000000	Relocation,
1869>12	belong	&0x02000000	UseFasterCompression,
1870>16	belong	x		version %d
1871
18720	string	package4	Newton package,
1873>8	byte	8		NOS 1.x,
1874>8	byte	9		NOS 2.x,
1875>12	belong	&0x80000000	AutoRemove,
1876>12	belong	&0x40000000	CopyProtect,
1877>12	belong	&0x10000000	NoCompression,
1878
1879# The following entries for the Apple II are for files that have
1880# been transferred as raw binary data from an Apple, without having
1881# been encapsulated by any of the above archivers.
1882#
1883# In general, Apple II formats are hard to identify because Apple DOS
1884# and especially Apple ProDOS have strong typing in the file system and
1885# therefore programmers never felt much need to include type information
1886# in the files themselves.
1887#
1888# Eric Fischer <enf@pobox.com>
1889
1890# AppleWorks word processor:
1891# URL: https://en.wikipedia.org/wiki/AppleWorks
1892# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
1893# Update: Joerg Jenderek
1894# NOTE:
1895# The "O" is really the magic number, but that's so common that it's
1896# necessary to check the tab stops that follow it to avoid false positives.
1897# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
1898# the newer AppleWorks is from claris with extension CWK
18994	string		O
1900# test for unused bits of zoom- , paginated-boolean bytes
1901>84	ubequad		^0x00Fe00000000Fe00
1902# look for tabstop definitions "=" no tab, "|" no tab
1903# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
1904# unofficial "!" other , "\x8a" other
1905# official only if SFMinVers is nonzero
1906>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
1907# AppleWorks Word Processor File (Apple II)
1908# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
1909# application/x-appleworks is mime type for claris version with cwk extension
1910!:mime	application/x-appleworks3
1911# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
1912# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
1913# $70 $1A $F8 $FF is this the apple type ?
1914#:apple pdosp^Z\xf8\xff
1915!:ext awp
1916# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
1917>>>183	ubyte		30	3.0
1918>>>183	ubyte		!30
1919>>>>183	ubyte		!0	0x%x
1920# usual tabstop start sequence "=====<"
1921>>>5	string		x	\b, tabstop ruler "%6.6s"
1922# tabstop ruler
1923#>>>5	string		>\0	\b, tabstops "%-79s"
1924# zoom switch
1925>>>85	  byte&0x01	>0	\b, zoomed
1926# whether paginated
1927>>>90	  byte&0x01	>0	\b, paginated
1928# contains any mail-merge commands
1929>>>92	  byte&0x01	>0	\b, with mail merge
1930# left margin in 1/10 inches ( normally 0 or 10 )
1931>>>91	ubyte		>0
1932>>>>91	ubyte		x	\b, %d/10 inch left margin
1933
1934# AppleWorks database:
1935#
1936# This isn't really a magic number, but it's the closest thing to one
1937# that I could find.  The 1 and 2 really mean "order in which you defined
1938# categories" and "left to right, top to bottom," respectively; the D and R
1939# mean that the cursor should move either down or right when you press Return.
1940
1941#30	string		\x01D	AppleWorks database data
1942#30	string		\x02D	AppleWorks database data
1943#30	string		\x01R	AppleWorks database data
1944#30	string		\x02R	AppleWorks database data
1945
1946# AppleWorks spreadsheet:
1947#
1948# Likewise, this isn't really meant as a magic number.  The R or C means
1949# row- or column-order recalculation; the A or M means automatic or manual
1950# recalculation.
1951
1952#131	string		RA	AppleWorks spreadsheet data
1953#131	string		RM	AppleWorks spreadsheet data
1954#131	string		CA	AppleWorks spreadsheet data
1955#131	string		CM	AppleWorks spreadsheet data
1956
1957# Applesoft BASIC:
1958#
1959# This is incredibly sloppy, but will be true if the program was
1960# written at its usual memory location of 2048 and its first line
1961# number is less than 256.  Yuck.
1962# update by Joerg Jenderek at Feb 2013
1963
1964# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1965#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
19660	belong&0x00ff00ff	0x00080000
1967# assuming that line number must be positive
1968>2	leshort			>0		Applesoft BASIC program data, first line number %d
1969#>2     leshort         x       \b, first line number %d
1970
1971# ORCA/EZ assembler:
1972#
1973# This will not identify ORCA/M source files, since those have
1974# some sort of date code instead of the two zero bytes at 6 and 7
1975# XXX Conflicts with ELF
1976#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1977#>5      byte                    x               \b, build number %d
1978
1979# Broderbund Fantavision
1980#
1981# I don't know what these values really mean, but they seem to recur.
1982# Will they cause too many conflicts?
1983
1984# Probably :-)
1985#2	belong&0xFF00FF		0x040008	Fantavision movie data
1986
1987# Some attempts at images.
1988#
1989# These are actually just bit-for-bit dumps of the frame buffer, so
1990# there's really no reasonably way to distinguish them except for their
1991# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1992# or, occasionally, 8184.
1993#
1994# Nevertheless this will manage to catch a lot of images that happen
1995# to have a solid-colored line at the bottom of the screen.
1996
1997# GRR: Magic too weak
1998#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1999#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
2000#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
2001#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
2002#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
2003
2004# Beagle Bros. Apple Mechanic fonts
2005
20060	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
2007
2008# Apple Universal Disk Image Format (UDIF) - dmg files.
2009# From Johan Gade.
2010# These entries are disabled for now until we fix the following issues.
2011#
2012# Note there might be some problems with the "VAX COFF executable"
2013# entry. Note this entry should be placed before the mac filesystem section,
2014# particularly the "Apple Partition data" entry.
2015#
2016# The intended meaning of these tests is, that the file is only of the
2017# specified type if both of the lines are correct - i.e. if the first
2018# line matches and the second doesn't then it is not of that type.
2019#
2020#0	long	0x7801730d
2021#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
2022#
2023# Note that this entry is recognized correctly by the "Apple Partition
2024# data" entry - however since this entry is more specific - this
2025# information seems to be more useful.
2026#0	long	0x45520200
2027#>0x410	string	disk\ image	UDIF read/write image (UDRW)
2028
2029# From: Toby Peterson <toby@apple.com>
20300	string	bplist00	Apple binary property list
2031
2032# Apple binary property list (bplist)
2033#  Assumes version bytes are hex.
2034#  Provides content hints for version 0 files. Assumes that the root
2035#  object is the first object (true for CoreFoundation implementation).
2036# From: David Remahl <dremahl@apple.com>
20370		string	bplist
2038>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
2039>>7		byte	x	\b%c
2040>6		string		00		\b
2041>>8		byte&0xF0	0x00	\b
2042>>>8	byte&0x0F	0x00	\b, root type: null
2043>>>8	byte&0x0F	0x08	\b, root type: false boolean
2044>>>8	byte&0x0F	0x09	\b, root type: true boolean
2045>>8		byte&0xF0	0x10	\b, root type: integer
2046>>8		byte&0xF0	0x20	\b, root type: real
2047>>8		byte&0xF0	0x30	\b, root type: date
2048>>8		byte&0xF0	0x40    \b, root type: data
2049>>8		byte&0xF0	0x50	\b, root type: ascii string
2050>>8		byte&0xF0	0x60	\b, root type: unicode string
2051>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
2052>>8		byte&0xF0	0xa0	\b, root type: array
2053>>8		byte&0xF0	0xd0	\b, root type: dictionary
2054
2055# Apple/NeXT typedstream data
2056#  Serialization format used by NeXT and Apple for various
2057#  purposes in YellowStep/Cocoa, including some nib files.
2058# From: David Remahl <dremahl@apple.com>
20592		string		typedstream	NeXT/Apple typedstream data, big endian
2060>0		byte		x		\b, version %d
2061>0		byte		<5		\b
2062>>13	byte		0x81	\b
2063>>>14	ubeshort	x		\b, system %d
20642		string		streamtyped NeXT/Apple typedstream data, little endian
2065>0		byte		x		\b, version %d
2066>0		byte		<5		\b
2067>>13	byte		0x81	\b
2068>>>14	uleshort	x		\b, system %d
2069
2070#------------------------------------------------------------------------------
2071# CAF: Apple CoreAudio File Format
2072#
2073# Container format for high-end audio purposes.
2074# From: David Remahl <dremahl@apple.com>
2075#
20760	string		caff		CoreAudio Format audio file
2077>4	beshort		<10		version %d
2078>6	beshort		x
2079
2080
2081#------------------------------------------------------------------------------
2082# Keychain database files
20830	string		kych		Mac OS X Keychain File
2084
2085#------------------------------------------------------------------------------
2086# Code Signing related file types
20870	belong		0xfade0c00	Mac OS X Code Requirement
2088>8	belong		1			(opExpr)
2089>4	belong		x			- %d bytes
2090
20910	belong		0xfade0c01	Mac OS X Code Requirement Set
2092>8	belong		>1			containing %d items
2093>4	belong		x			- %d bytes
2094
20950	belong		0xfade0c02	Mac OS X Code Directory
2096>8	belong		x			version %x
2097>12	belong		>0			flags 0x%x
2098>4	belong		x			- %d bytes
2099
21000	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
2101>4	belong		x			- %d bytes
2102
21030	belong		0xfade0cc1	Mac OS X Detached Code Signature
2104>8	belong		>1			(%d elements)
2105>4	belong		x			- %d bytes
2106
2107# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
2108# .vdi
21094	string innotek\ VirtualBox\ Disk\ Image %s
2110
2111# Apple disk partition stuff
2112# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2113# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
2114# Update: Joerg Jenderek
2115# "ER" is APPLE_DRVR_MAP_MAGIC signature
21160	beshort	0x4552
2117# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
2118#!:strength +0
2119# strengthen the magic by looking for used blocksizes 512 2048
2120>2	ubeshort&0xf1FF		0	Apple Driver Map
2121# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
2122#>>504	ubequad&0x0000FFffFFff0000	0
2123!:mime	application/x-apple-diskimage
2124!:apple	????devr
2125# https://en.wikipedia.org/wiki/Apple_Disk_Image
2126!:ext	dmg/iso
2127# sbBlkSize for driver descriptor map 512 2048
2128>>2	beshort	x			\b, blocksize %d
2129# sbBlkCount sometimes garbish like
2130# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
2131# 0xf2720100 for bunziped Firefox 48.0-2.dmg
2132# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
2133# 0x00009090 by syslinux-6.03/utils/isohybrid.c
2134>>4	ubelong	x			\b, blockcount %u
2135# following device/driver information not very useful
2136# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2137>>8	ubeshort	x		\b, devtype %u
2138# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2139>>10	ubeshort	x		\b, devid %u
2140# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2141>>12	ubelong		>0
2142>>>12	ubelong		x		\b, driver data %u
2143# number of driver descriptors sbDrvrCount <= 61
2144# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
2145>>16	ubeshort	x		\b, driver count %u
2146# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
2147# >>18	use		apple-driver-map
2148# >>26	use		apple-driver-map
2149# # ...
2150# >>500	use		apple-driver-map
2151# number of partitions is always same in every partition (map block count)
2152#>>0x0204	ubelong		x	\b, %u partitions
2153>>0x0204	ubelong		>0	\b, contains[@0x200]:
2154>>>0x0200	use		apple-apm
2155>>0x0204	ubelong		>1	\b, contains[@0x400]:
2156>>>0x0400	use		apple-apm
2157>>0x0204	ubelong		>2	\b, contains[@0x600]:
2158>>>0x0600	use		apple-apm
2159>>0x0204	ubelong		>3	\b, contains[@0x800]:
2160>>>0x0800	use		apple-apm
2161>>0x0204	ubelong		>4	\b, contains[@0xA00]:
2162>>>0x0A00	use		apple-apm
2163>>0x0204	ubelong		>5	\b, contains[@0xC00]:
2164>>>0x0C00	use		apple-apm
2165>>0x0204	ubelong		>6	\b, contains[@0xE00]:
2166>>>0x0E00	use		apple-apm
2167>>0x0204	ubelong		>7	\b, contains[@0x1000]:
2168>>>0x1000	use		apple-apm
2169#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
21700	name				apple-driver-map
2171>0	ubequad		!0
2172# descBlock first block of driver
2173>>0	ubelong	x			\b, driver start block %u
2174# descSize driver size in blocks
2175>>4	ubeshort	x		\b, size %u
2176# descType driver system type 1 701h F8FFh FFFFh
2177>>6	ubeshort	x		\b, type 0x%x
2178
2179# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2180# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
2181# Update: Joerg Jenderek
2182# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
2183# magic stronger.
2184# for apple partition map stored as a single file
21850	belong	0x504d0000
2186# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
2187#!:strength +0
2188>0	use		apple-apm
2189# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
2190# file: could not find any valid magic files!
2191#!:ext	bin
2192#	display apple partition map. Normally called after Apple driver map
21930	name				apple-apm
2194>0	belong	0x504d0000		Apple Partition Map
2195# number of partitions
2196>>4	ubelong	x			\b, map block count %u
2197# logical block (512 bytes) start of partition
2198>>8	ubelong	x			\b, start block %u
2199>>12	ubelong	x			\b, block count %u
2200>>16	string >0			\b, name %s
2201>>48	string >0			\b, type %s
2202# processor type dpme_process_id[16] e.g. "68000" "68020"
2203>>120	string >0			\b, processor %s
2204# A/UX boot arguments BootArgs[128]
2205>>136	string >0			\b, boot arguments %s
2206# status of partition dpme_flags
2207>>88	belong	& 1			\b, valid
2208>>88	belong	& 2			\b, allocated
2209>>88	belong	& 4			\b, in use
2210>>88	belong	& 8			\b, has boot info
2211>>88	belong	& 16			\b, readable
2212>>88	belong	& 32			\b, writable
2213>>88	belong	& 64			\b, pic boot code
2214>>88	belong	& 128			\b, chain compatible driver
2215>>88	belong	& 256			\b, real driver
2216>>88	belong	& 512			\b, chain driver
2217# mount automatically at startup APPLE_PS_AUTO_MOUNT
2218>>88	ubelong	&0x40000000		\b, mount at startup
2219# is the startup partition APPLE_PS_STARTUP
2220>>88	ubelong	&0x80000000		\b, is the startup partition
2221
2222#https://wiki.mozilla.org/DS_Store_File_Format
2223#https://en.wikipedia.org/wiki/.DS_Store
22240	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
2225
2226# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
2227# Usually not in separate files, but have either filename rsrc with
2228# no extension, or a filename corresponding to another file, with
2229# extensions rsr/rsrc
22300	string  \000\000\001\000
2231>4	leshort 0
2232>>16	lelong  0			Apple HFS/HFS+ resource fork
2233
2234#https://en.wikipedia.org/wiki/AppleScript
22350	string	FasdUAS			AppleScript compiled
2236
2237# AppleWorks/ClarisWorks
2238# https://github.com/joshenders/appleworks_format
2239# http://fileformats.archiveteam.org/wiki/AppleWorks
22400	name			appleworks
2241>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2242>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2243>0	default			x
2244>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2245>0	byte			x		\b, version %d
2246>30	beshort			x		\b, %d
2247>32	beshort			x		\bx%d
2248!:ext cwk
2249
22504	string	BOBO
2251>0	byte	>4
2252>>12	belong	0
2253>>>26	belong	0
2254>>>>0	use	appleworks
2255>0	belong	0x0481ad00
2256>>0	use 	appleworks
2257
2258# magic for Apple File System (APFS)
2259# from Alex Myczko <alex@aiei.ch>
226032		string	NXSB		Apple File System (APFS)
2261>36		ulelong	x		\b, blocksize %u
2262
2263# iTunes cover art (versions 1 and 2)
22644		string	itch
2265>24		string	artw
2266>>0x1e8		string	data		iTunes cover art
2267>>>0x1ed	string	PNG		(PNG)
2268>>>0x1ec	beshort 0xffd8		(JPEG)
2269
2270# MacPaint image
227165		string	PNTGMPNT	MacPaint image data
2272#0		belong	2		MacPaint image data
2273
2274#------------------------------------------------------------------------------
2275# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2276# application:  file(1) magic for applications on small devices
2277#
2278# Pebble Application
22790	string	PBLAPP\000\000	Pebble application
2280
2281#------------------------------------------------------------------------------
2282# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2283# applix:  file(1) magic for Applixware
2284# From: Peter Soos <sp@osb.hu>
2285#
22860	string		*BEGIN		Applixware
2287>7	string		WORDS			Words Document
2288>7	string		GRAPHICS		Graphic
2289>7	string		RASTER			Bitmap
2290>7	string		SPREADSHEETS		Spreadsheet
2291>7	string		MACRO			Macro
2292>7	string		BUILDER			Builder Object
2293
2294#------------------------------------------------------------------------------
2295# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2296# apt: file(1) magic for APT Cache files
2297# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2298# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2299
2300# before version 10 ("old format"), data was in arch-specific long/short
2301
2302# old format 64 bit
23030   	name		apt-cache-64bit-be
2304>12	beshort		1		\b, dirty
2305>40 	bequad		x		\b, %llu packages
2306>48 	bequad		x		\b, %llu versions
2307
2308# old format 32 bit
23090   	name    	apt-cache-32bit-be
2310>8  	beshort 	1		\b, dirty
2311>40 	belong  	x		\b, %u packages
2312>44 	belong  	x		\b, %u versions
2313
2314# new format
23150	name		apt-cache-be
2316>6	byte    	1		\b, dirty
2317>24	belong  	x		\b, %u packages
2318>28	belong		x		\b, %u versions
2319
23200	bequad		0x98FE76DC
2321>8	ubeshort	<10		APT cache data, version %u
2322>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2323>>0	use		apt-cache-64bit-be
2324
23250	lequad	    	0x98FE76DC
2326>8	uleshort    	<10		APT cache data, version %u
2327>>10	leshort		x		\b.%u, 64 bit little-endian
2328>>0	use		\^apt-cache-64bit-be
2329
23300	belong	    	0x98FE76DC
2331>4	ubeshort    	<10	 	APT cache data, version %u
2332>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2333>>0	use  		apt-cache-32bit-be
2334>4	ubyte	    	>9		APT cache data, version %u
2335>>5	ubyte	    	x		\b.%u, big-endian
2336>>0	use 		apt-cache-be
2337
23380	lelong	    	0x98FE76DC
2339>4	uleshort    	<10		APT cache data, version %u
2340>>6	uleshort   	x		\b.%u, 32 bit little-endian
2341>>0	use 		\^apt-cache-32bit-be
2342>4	ubyte	    	>9		APT cache data, version %u
2343>>5	ubyte	    	x		\b.%u, little-endian
2344>>0	use		\^apt-cache-be
2345#------------------------------------------------------------------------------
2346# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $
2347# archive:  file(1) magic for archive formats (see also "msdos" for self-
2348#           extracting compressed archives)
2349#
2350# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2351# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
2352
2353# POSIX tar archives
2354# URL: https://en.wikipedia.org/wiki/Tar_(computing)
2355# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
2356# header mainly padded with nul bytes
2357500	quad		0
2358!:strength /2
2359# filename or extended attribute printable strings in range space null til umlaut ue
2360>0	ubeshort	>0x1F00
2361>>0	ubeshort	<0xFCFD
2362# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
2363# at https://sourceforge.net/projects/s-tar/files/testscripts/
2364>>>508	ubelong&0x8B9E8DFF	0
2365# nul, space or ascii digit 0-7 at start of mode
2366>>>>100	ubyte&0xC8	=0
2367>>>>>101 ubyte&0xC8	=0
2368# nul, space at end of check sum
2369>>>>>>155 ubyte&0xDF	=0
2370# space or ascii digit 0 at start of check sum
2371>>>>>>>148	ubyte&0xEF	=0x20
2372>>>>>>>>0	use	tar-file
2373#	minimal check and then display tar archive information which can also be
2374#	embedded inside others like Android Backup, Clam AntiVirus database
23750	name		tar-file
2376>257	string		!ustar
2377# header padded with nuls
2378>>257	ulong		=0
2379# GNU tar version 1.29 with non pax format option without refusing
2380# creates misleading V7 header for Long path, Multi-volume, Volume type
2381>>>156	ubyte		0x4c		GNU tar archive
2382!:mime	application/x-gtar
2383!:ext	tar/gtar
2384>>>156	ubyte		0x4d		GNU tar archive
2385!:mime	application/x-gtar
2386!:ext	tar/gtar
2387>>>156	ubyte		0x56		GNU tar archive
2388!:mime	application/x-gtar
2389!:ext	tar/gtar
2390>>>156	default		x		tar archive (V7)
2391!:mime	application/x-tar
2392!:ext	tar
2393# other stuff in padding
2394# some implementations add new fields to the blank area at the end of the header record
2395# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
2396>>257	ulong		!0		tar archive (old)
2397!:mime	application/x-tar
2398!:ext	tar
2399# magic in newer, GNU, posix variants
2400>257	string		=ustar
2401# 2 last char of magic and UStar version because string expression does not work
2402# 2 space characters followed by a null for GNU variant
2403>>261	ubelong		=0x72202000	POSIX tar archive (GNU)
2404!:mime	application/x-gtar
2405!:ext	tar/gtar
2406# UStar version with ASCII "00"
2407>>261	ubelong		0x72003030	POSIX
2408# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
2409>>>156	ubyte		0x67		\b.1-2001
2410>>>156	ubyte		0x78		\b.1-2001
2411>>>156	ubyte		x		tar archive
2412!:mime	application/x-ustar
2413!:ext	tar/ustar
2414# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
2415>>261	ubelong		0x72000000	tar archive (ustar)
2416!:mime	application/x-ustar
2417!:ext	tar/ustar
2418# not seen ustar variant with garbish version
2419>>261	default		x		tar archive (unknown ustar)
2420!:mime	application/x-ustar
2421!:ext	tar/ustar
2422# type flag of 1st tar archive member
2423#>156	ubyte		x		\b, %c-type
2424>156	ubyte		x
2425>>156	ubyte		0		\b, file
2426>>156	ubyte		0x30		\b, file
2427>>156	ubyte		0x31		\b, hard link
2428>>156	ubyte		0x32		\b, symlink
2429>>156	ubyte		0x33		\b, char device
2430>>156	ubyte		0x34		\b, block device
2431>>156	ubyte		0x35		\b, directory
2432>>156	ubyte		0x36		\b, fifo
2433>>156	ubyte		0x37		\b, reserved
2434>>156	ubyte		0x4c		\b, long path
2435>>156	ubyte		0x4d		\b, multi volume
2436>>156	ubyte		0x56		\b, volume
2437>>156	ubyte		0x67		\b, global
2438>>156	ubyte		0x78		\b, extension
2439>>156	default		x		\b, type
2440>>>156	ubyte		x		'%c'
2441# name[100]
2442>0	string		>\0		%-.60s
2443# mode mainly stored as an octal number in ASCII null or space terminated
2444>100	string		>\0		\b, mode %-.7s
2445# user id mainly as octal numbers in ASCII null or space terminated
2446>108	string		>\0		\b, uid %-.7s
2447# group id mainly as octal numbers in ASCII null or space terminated
2448>116	string		>\0		\b, gid %-.7s
2449# size mainly as octal number in ASCII
2450>124	ubyte		<0x38
2451>>124	string		>\0		\b, size %-.12s
2452# coding indicated by setting the high-order bit of the leftmost byte
2453>124	ubyte		>0xEF		\b, size 0x
2454>>124	ubyte		!0xff		\b%2.2x
2455>>125	ubyte		!0xff		\b%2.2x
2456>>126	ubyte		!0xff		\b%2.2x
2457>>127	ubyte		!0xff		\b%2.2x
2458>>128	ubyte		!0xff		\b%2.2x
2459>>129	ubyte		!0xff		\b%2.2x
2460>>130	ubyte		!0xff		\b%2.2x
2461>>131	ubyte		!0xff		\b%2.2x
2462>>132	ubyte		!0xff		\b%2.2x
2463>>133	ubyte		!0xff		\b%2.2x
2464>>134	ubyte		!0xff		\b%2.2x
2465>>135	ubyte		!0xff		\b%2.2x
2466# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
2467>136	string		>\0		\b, seconds %-.11s
2468# header checksum stored as an octal number in ASCII null or space terminated
2469#>148	string		x		\b, cksum %.7s
2470# linkname[100]
2471>157	string		>\0		\b, linkname %-.40s
2472# additional fields for ustar
2473>257	string		=ustar
2474# owner user name null terminated
2475>>265	string		>\0		\b, user %-.32s
2476# group name null terminated
2477>>297	string		>\0		\b, group %-.32s
2478# device major minor if not zero
2479>>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
2480>>>329	string		x		\b, devmaj %-.7s
2481>>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
2482>>>337	string		x		\b, devmin %-.7s
2483# prefix[155]
2484>>345	string		>\0		\b, prefix %-.155s
2485# old non ustar/POSIX tar
2486>257	string		!ustar
2487>>508	string		=tar\0
2488# padding[255] in old star
2489>>>257	string		>\0		\b, padding: %-.40s
2490>>508	default		x
2491# padding[255] in old tar sometimes comment field
2492>>>257	string		>\0		\b, comment: %-.40s
2493
2494# Incremental snapshot gnu-tar format from:
2495# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
24960	string		GNU\ tar-	GNU tar incremental snapshot data
2497>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
2498
2499# cpio archives
2500#
2501# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2502# The idea is to indicate archives produced on machines with the same
2503# byte order as the machine running "file" with "cpio archive", and
2504# to indicate archives produced on machines with the opposite byte order
2505# from the machine running "file" with "byte-swapped cpio archive".
2506#
2507# The SVR4 "cpio(4)" hints that there are additional formats, but they
2508# are defined as "short"s; I think all the new formats are
2509# character-header formats and thus are strings, not numbers.
25100	short		070707		cpio archive
2511!:mime	application/x-cpio
25120	short		0143561		byte-swapped cpio archive
2513!:mime	application/x-cpio # encoding: swapped
25140	string		070707		ASCII cpio archive (pre-SVR4 or odc)
25150	string		070701		ASCII cpio archive (SVR4 with no CRC)
25160	string		070702		ASCII cpio archive (SVR4 with CRC)
2517
2518#
2519# Various archive formats used by various versions of the "ar"
2520# command.
2521#
2522
2523#
2524# Original UNIX archive formats.
2525# They were written with binary values in host byte order, and
2526# the magic number was a host "int", which might have been 16 bits
2527# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2528# been ports to little-endian 16-bit-int or 32-bit-int platforms
2529# (x86?) using some of those formats; if none existed, feel free
2530# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2531# 32-bit.  There might have been big-endian ports of that sort as
2532# well.
2533#
25340	leshort		0177555		very old 16-bit-int little-endian archive
25350	beshort		0177555		very old 16-bit-int big-endian archive
25360	lelong		0177555		very old 32-bit-int little-endian archive
25370	belong		0177555		very old 32-bit-int big-endian archive
2538
25390	leshort		0177545		old 16-bit-int little-endian archive
2540>2	string		__.SYMDEF	random library
25410	beshort		0177545		old 16-bit-int big-endian archive
2542>2	string		__.SYMDEF	random library
25430	lelong		0177545		old 32-bit-int little-endian archive
2544>4	string		__.SYMDEF	random library
25450	belong		0177545		old 32-bit-int big-endian archive
2546>4	string		__.SYMDEF	random library
2547
2548#
2549# From "pdp" (but why a 4-byte quantity?)
2550#
25510	lelong		0x39bed		PDP-11 old archive
25520	lelong		0x39bee		PDP-11 4.0 archive
2553
2554#
2555# XXX - what flavor of APL used this, and was it a variant of
2556# some ar archive format?  It's similar to, but not the same
2557# as, the APL workspace magic numbers in pdp.
2558#
25590	long		0100554		apl workspace
2560
2561#
2562# System V Release 1 portable(?) archive format.
2563#
25640	string		=<ar>		System V Release 1 ar archive
2565!:mime	application/x-archive
2566
2567#
2568# Debian package; it's in the portable archive format, and needs to go
2569# before the entry for regular portable archives, as it's recognized as
2570# a portable archive whose first member has a name beginning with
2571# "debian".
2572#
2573# Update: Joerg Jenderek
2574# URL: https://en.wikipedia.org/wiki/Deb_(file_format)
25750	string		=!<arch>\ndebian
2576# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html
2577>14	string		-split	part of multipart Debian package
2578!:mime	application/vnd.debian.binary-package
2579# udeb is used for stripped down deb file
2580!:ext	deb/udeb
2581>14	string		-binary	Debian binary package
2582!:mime	application/vnd.debian.binary-package
2583# For ipk packager see also https://en.wikipedia.org/wiki/Opkg
2584!:ext	deb/udeb/ipk
2585# This should not happen
2586>14	default		x	Unknown Debian package
2587# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
2588>68	string		>\0		(format %s)
2589#>68	string		!2.0\n
2590#>>68	string		x		(format %.3s)
2591>68	string		=2.0\n
2592# 2nd archive name=control archive name like control.tar.gz or control.tar.xz
2593>>72	string		>\0		\b, with %.14s
2594# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma}
2595>>0	search/0x93e4f	data.tar.	\b, data compression
2596# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised
2597# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb
2598>>>&0	string		x		%.2s
2599# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name
2600>>>&2	ubyte		!0x20
2601>>>>&-1	ubyte		!0x2f
2602# display 3rd character of file name extension like 2 of bz2 or m of lzma
2603>>>>>&-1	ubyte	x		\b%c
2604>>>>>>&0	ubyte	!0x20
2605>>>>>>>&-1	ubyte	!0x2f
2606# display 4th character of file name extension like a of lzma
2607>>>>>>>>&-1	ubyte	x		\b%c
2608# splitted debian package case
2609>68	string		=2.1\n
2610# dpkg-1.18.25/dpkg-split/info.c
2611# NL terminated ASCII package name like ckermit
2612>>&0	string		x		\b, %s
2613# NL terminated package version like 302-5.3
2614>>>&1	string		x		%s
2615# NL terminated MD5 checksum
2616>>>>&1	string		x		\b, MD5 %s
2617# NL terminated original package length
2618>>>>>&1	string		x		\b, unsplitted size %s
2619# NL terminated part length
2620>>>>>>&1	string	x		\b, part length %s
2621# NL terminated package part like n/m
2622>>>>>>>&1	string	x		\b, part %s
2623# NL terminated package architecture like armhf since dpkg 1.16.1 or later
2624>>>>>>>>&1	string	x		\b, %s
2625
2626#
2627# MIPS archive; they're in the portable archive format, and need to go
2628# before the entry for regular portable archives, as it's recognized as
2629# a portable archive whose first member has a name beginning with
2630# "__________E".
2631#
26320	string	=!<arch>\n__________E	MIPS archive
2633!:mime	application/x-archive
2634>20	string	U			with MIPS Ucode members
2635>21	string	L			with MIPSEL members
2636>21	string	B			with MIPSEB members
2637>19	string	L			and an EL hash table
2638>19	string	B			and an EB hash table
2639>22	string	X			-- out of date
2640
2641#
2642# BSD/SVR2-and-later portable archive formats.
2643#
2644# Update: Joerg Jenderek
2645# URL:		http://fileformats.archiveteam.org/wiki/AR
2646# Reference:	https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/
2647# Note:		Mach-O universal binary in ./cafebabe is dependent
2648# TODO:		unify current ar archive, MIPS archive, Debian package
2649#		distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR;
2650#		*.ar packages from *.a libraries. handle empty archive
26510	string		=!<arch>\n		current ar archive
2652# print first and possibly second ar_name[16] for debugging purpose
2653#>8			string	x	\b, 1st "%.16s"
2654#>68			string	x	\b, 2nd "%.16s"
2655!:mime	application/x-archive
2656# a in most case for libraries; lib for Microsoft libraries; ar else cases
2657!:ext	a/lib/ar
2658>8	string		__.SYMDEF	random library
2659# first member with long marked name __.SYMDEF SORTED implies BSD library
2660>68	string		__.SYMDEF\ SORTED	random library
2661# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf
2662# "archive file" entry moved from ./hp
2663# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture
2664# LST header a_magic 0619h~relocatable library
2665>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
2666>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
2667>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
2668>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
2669#EOF for common ar archives
2670
2671#
2672# "Thin" archive, as can be produced by GNU ar.
2673#
26740	string		=!<thin>\n	thin archive with
2675>68	belong		0		no symbol entries
2676>68	belong		1		%d symbol entry
2677>68	belong		>1		%d symbol entries
2678
26790	search/1	-h-		Software Tools format archive text
2680
2681# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2682#
2683# The first byte is the magic (0x1a), byte 2 is the compression type for
2684# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2685# filename of the first file (null terminated).  Since some types collide
2686# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2687# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
26880	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2689!:mime	application/x-arc
26900	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2691!:mime	application/x-arc
26920	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2693!:mime	application/x-arc
26940	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2695!:mime	application/x-arc
26960	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2697!:mime	application/x-arc
26980	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2699!:mime	application/x-arc
2700# [JW] stuff taken from idarc, obviously ARC successors:
27010	lelong&0x8080ffff	0x00000a1a	PAK archive data
2702!:mime	application/x-arc
27030	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2704!:mime	application/x-arc
27050	lelong&0x8080ffff	0x0000481a	HYP archive data
2706!:mime	application/x-arc
2707
2708# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2709# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2710# [GRR:  the original entries collide with ARC, above; replaced with combined
2711#  version (not tested)]
2712#0	byte		0x1a		RISC OS archive (spark format)
27130	string		\032archive	RISC OS archive (ArcFS format)
27140       string          Archive\000     RISC OS archive (ArcFS format)
2715
2716# All these were taken from idarc, many could not be verified. Unfortunately,
2717# there were many low-quality sigs, i.e. easy to trigger false positives.
2718# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2719# to get my hands on the actual archiver and see if I find something better. [JW]
2720# probably many can be enhanced by finding some 0-byte or control char near the start
2721
2722# idarc calls this Crush/Uncompressed... *shrug*
27230	string	CRUSH Crush archive data
2724# Squeeze It (.sqz)
27250	string	HLSQZ Squeeze It archive data
2726# SQWEZ
27270	string	SQWEZ SQWEZ archive data
2728# HPack (.hpk)
27290	string	HPAK HPack archive data
2730# HAP
27310	string	\x91\x33HF HAP archive data
2732# MD/MDCD
27330	string	MDmd MDCD archive data
2734# LIM
27350	string	LIM\x1a LIM archive data
2736# SAR
27373	string	LH5 SAR archive data
2738# BSArc/BS2
27390	string	\212\3SB\020\0	BSArc/BS2 archive data
2740# Bethesda Softworks Archive (Oblivion)
27410	string	BSA\0 		BSArc archive data
2742>4	lelong	x		version %d
2743# MAR
27442	string	=-ah MAR archive data
2745# ACB
2746#0	belong&0x00f800ff	0x00800000 ACB archive data
2747# CPZ
2748# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2749# JRC
27500	string	JRchive JRC archive data
2751# Quantum
27520	string	DS\0 Quantum archive data
2753# ReSOF
27540	string	PK\3\6 ReSOF archive data
2755# QuArk
27560	string	7\4 QuArk archive data
2757# YAC
275814	string	YC YAC archive data
2759# X1
27600	string	X1 X1 archive data
27610	string	XhDr X1 archive data
2762# CDC Codec (.dqt)
27630	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2764# AMGC
27650	string	\xad6" AMGC archive data
2766# NuLIB
27670	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2768# PakLeo
27690	string	LEOLZW PAKLeo archive data
2770# ChArc
27710	string	SChF ChArc archive data
2772# PSA
27730	string	PSA PSA archive data
2774# CrossePAC
27750	string	DSIGDCC CrossePAC archive data
2776# Freeze
27770	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
2778# KBoom
27790	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
2780# NSQ, must go after CDC Codec
27810	string	\x76\xff NSQ archive data
2782# DPA
27830	string	Dirk\ Paehl DPA archive data
2784# BA
2785# TODO: idarc says "bytes 0-2 == bytes 3-5"
2786# TTComp
2787# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
2788# Update: Joerg Jenderek
2789# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
27900	string	\0\6
2791# look for first keyword of Panorama database *.pan
2792>12	search/261	DESIGN
2793# skip keyword with low entropy
2794>12	default		x	TTComp archive, binary, 4K dictionary
2795# (version 5.25) labeled the above entry as "TTComp archive data"
2796# From:		Joerg Jenderek
2797# URL:		https://wiki.68kmla.org/DiskCopy_4.2_format_specification
2798# reference:	http://nulib.com/library/FTN.e00005.htm
27990x52	ubeshort	0x0100
2800# test for disk size equal or above 400k
2801>0x40	ubelong		>409599	Apple DiskCopy 4.2 image
2802#!:mime	application/octet-stream
2803!:apple	dCpydImg
2804!:ext	image/dc42
2805# image pascal name padded with NULs like Microsoft Mail
2806>>00	pstring/B	x	%s
2807# data size in bytes like 409600
2808>>0x40	ubelong		x	\b, %u bytes
2809# tag size in bytes
2810>>0x44	ubelong		>0	\b, 0x%x tag size
2811# data checksum
2812#>>0x48	ubelong		x	\b, 0x%x checksum
2813# tag checksum
2814#>>0x4c	ubelong		x	\b, 0x%x tag checksum
2815# disk encoding
2816>>0x50	ubyte		0	\b, GCR CLV ssdd (400k)
2817>>0x50	ubyte		1	\b, GCR CLV dsdd (800k)
2818>>0x50	ubyte		2	\b, MFM CAV dsdd (720k)
2819>>0x50	ubyte		3	\b, MFM CAV dshd (1440k)
2820>>0x50	ubyte		>3	\b, 0x%x encoding
2821# format byte
2822>>0x51	ubyte		x	\b, 0x%x format
2823#>>0x54	ubequad		x	\b, data 0x%16.16llx
2824# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
28250	string	ESP ESP archive data
2826# ZPack
28270	string	\1ZPK\1 ZPack archive data
2828# Sky
28290	string	\xbc\x40 Sky archive data
2830# UFA
28310	string	UFA UFA archive data
2832# Dry
28330	string	=-H2O DRY archive data
2834# FoxSQZ
28350	string	FOXSQZ FoxSQZ archive data
2836# AR7
28370	string	,AR7 AR7 archive data
2838# PPMZ
28390	string	PPMZ PPMZ archive data
2840# MS Compress
2841# Update: Joerg Jenderek
2842# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
2843# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
2844# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
28454	string	\x88\xf0\x27
2846#		KWAJ variant
2847>0	string	KWAJ		MS Compress archive data, KWAJ variant
2848!:mime	application/x-ms-compress-kwaj
2849# extension not working in version 5.32
2850# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
2851# file: line 284: Bad magic entry '   ??_'
2852!:ext	??_
2853# compression method (0-4)
2854>>8	uleshort	x	\b, %u method
2855# offset of compressed data
2856>>10	uleshort	x	\b, 0x%x offset
2857#>>(10.s)	uleshort	x
2858#>>>&-6		string	x	\b, TEST extension %-.3s
2859# header flags to mark header extensions
2860>>12	uleshort	>0	\b, 0x%x flags
2861# 4 bytes: decompressed length of file
2862>>12	uleshort	&0x01
2863>>>14	ulelong		x	\b, original size: %u bytes
2864# 2 bytes: unknown purpose
2865# 2 bytes: length of unknown data + mentioned bytes
2866# 1-9 bytes: null-terminated file name
2867# 1-4 bytes: null-terminated file extension
2868>>12	uleshort	&0x08
2869>>>12	uleshort				^0x01
2870>>>>12		uleshort			^0x02
2871>>>>>12			uleshort		^0x04
2872>>>>>>12			uleshort	^0x10
2873>>>>>>>14				string	x	\b, %-.8s
2874>>>>>>12			uleshort	&0x10
2875>>>>>>>14				string	x	\b, %-.8s
2876>>>>>>>>&1				string	x	\b.%-.3s
2877>>>>>12			uleshort		&0x04
2878>>>>>>12			uleshort	^0x10
2879>>>>>>>(14.s)			uleshort	x
2880>>>>>>>>&14				string	x	\b, %-.8s
2881>>>>>>12			uleshort	&0x10
2882>>>>>>>(14.s)			uleshort	x
2883>>>>>>>>&14				string	x	\b, %-.8s
2884>>>>>>>>>&1				string	x	\b.%-.3s
2885>>>>12		uleshort			&0x02
2886>>>>>12			uleshort		^0x04
2887>>>>>>12			uleshort	^0x10
2888>>>>>>>16				string	x	\b, %-.8s
2889>>>>>>12			uleshort	&0x10
2890>>>>>>>16				string	x	\b, %-.8s
2891>>>>>>>>&1				string	x	\b.%-.3s
2892>>>>>12			uleshort		&0x04
2893>>>>>>12			uleshort	^0x10
2894>>>>>>>(16.s)			uleshort	x
2895>>>>>>>>&16				string	x	\b, %-.8s
2896>>>>>>12			uleshort	&0x10
2897>>>>>>>(16.s)			uleshort	x
2898>>>>>>>&16				string	x	%-.8s
2899>>>>>>>>&1				string	x	\b.%-.3s
2900>>>12	uleshort				&0x01
2901>>>>12		uleshort			^0x02
2902>>>>>12			uleshort		^0x04
2903>>>>>>12			uleshort	^0x10
2904>>>>>>>18				string	x	\b, %-.8s
2905>>>>>>12			uleshort	&0x10
2906>>>>>>>18				string	x	\b, %-.8s
2907>>>>>>>>&1				string	x	\b.%-.3s
2908>>>>>12			uleshort		&0x04
2909>>>>>>12			uleshort	^0x10
2910>>>>>>>(18.s)			uleshort	x
2911>>>>>>>>&18				string	x	\b, %-.8s
2912>>>>>>12			uleshort	&0x10
2913>>>>>>>(18.s)			uleshort	x
2914>>>>>>>>&18				string	x	\b, %-.8s
2915>>>>>>>>>&1				string	x	\b.%-.3s
2916>>>>12		uleshort			&0x02
2917>>>>>12			uleshort		^0x04
2918>>>>>>12			uleshort	^0x10
2919>>>>>>>20				string	x	\b, %-.8s
2920>>>>>>12			uleshort	&0x10
2921>>>>>>>20				string	x	\b, %-.8s
2922>>>>>>>>&1				string	x	\b.%-.3s
2923>>>>>12			uleshort		&0x04
2924>>>>>>12			uleshort	^0x10
2925>>>>>>>(20.s)			uleshort	x
2926>>>>>>>>&20				string	x	\b, %-.8s
2927>>>>>>12			uleshort	&0x10
2928>>>>>>>(20.s)			uleshort	x
2929>>>>>>>>&20				string	x	\b, %-.8s
2930>>>>>>>>>&1				string	x	\b.%-.3s
2931# 2 bytes: length of data + mentioned bytes
2932#
2933#		SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
2934>0	string	SZDD		MS Compress archive data, SZDD variant
2935!:mime	application/x-ms-compress-szdd
2936!:ext	??_
2937# The character missing from the end of the filename (0=unknown)
2938>>9	string	>\0		\b, %-.1s is last character of original name
2939# https://www.betaarchive.com/forum/viewtopic.php?t=26161
2940# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
2941>>8	string	!A		\b, %-.1s method
2942>>10	ulelong	>0		\b, original size: %u bytes
2943#		QBasic SZDD variant
29443	string	\x88\xf0\x27
2945>0	string	SZ\x20		MS Compress archive data, QBasic variant
2946!:mime	application/x-ms-compress-sz
2947!:ext	??$
2948>>8	ulelong	>0		\b, original size: %u bytes
2949
2950# MP3 (archiver, not lossy audio compression)
29510	string	MP3\x1a MP3-Archiver archive data
2952# ZET
29530	string	OZ\xc3\x9d ZET archive data
2954# TSComp
29550	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
2956# ARQ
29570	string	gW\4\1 ARQ archive data
2958# Squash
29593	string	OctSqu Squash archive data
2960# Terse
29610	string	\5\1\1\0 Terse archive data
2962# PUCrunch
29630	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
2964# UHarc
29650	string	UHA UHarc archive data
2966# ABComp
29670	string	\2AB ABComp archive data
29680	string	\3AB2 ABComp archive data
2969# CMP
29700	string	CO\0 CMP archive data
2971# Splint
29720	string	\x93\xb9\x06 Splint archive data
2973# InstallShield
29740	string	\x13\x5d\x65\x8c InstallShield Z archive Data
2975# Gather
29761	string	GTH Gather archive data
2977# BOA
29780	string	BOA BOA archive data
2979# RAX
29800	string	ULEB\xa RAX archive data
2981# Xtreme
29820	string	ULEB\0 Xtreme archive data
2983# Pack Magic
29840	string	@\xc3\xa2\1\0 Pack Magic archive data
2985# BTS
29860	belong&0xfeffffff	0x1a034465 BTS archive data
2987# ELI 5750
29880	string	Ora\  ELI 5750 archive data
2989# QFC
29900	string	\x1aFC\x1a QFC archive data
29910	string	\x1aQF\x1a QFC archive data
2992# PRO-PACK
29930	string	RNC PRO-PACK archive data
2994# 777
29950	string	777 777 archive data
2996# LZS221
29970	string	sTaC LZS221 archive data
2998# HPA
29990	string	HPA HPA archive data
3000# Arhangel
30010	string	LG Arhangel archive data
3002# EXP1, uses bzip2
30030	string	0123456789012345BZh EXP1 archive data
3004# IMP
30050	string	IMP\xa IMP archive data
3006# NRV
30070	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
3008# Squish
30090	string	\x73\xb2\x90\xf4 Squish archive data
3010# Par
30110	string	PHILIPP Par archive data
30120	string	PAR Par archive data
3013# HIT
30140	string	UB HIT archive data
3015# SBX
30160	belong&0xfffff000	0x53423000 SBX archive data
3017# NaShrink
30180	string	NSK NaShrink archive data
3019# SAPCAR
30200	string	#\ CAR\ archive\ header SAPCAR archive data
30210	string	CAR\ 2.00RG SAPCAR archive data
3022# Disintegrator
30230	string	DST Disintegrator archive data
3024# ASD
30250	string	ASD ASD archive data
3026# InstallShield CAB
30270	string	ISc( InstallShield CAB
3028# TOP4
30290	string	T4\x1a TOP4 archive data
3030# BatComp left out: sig looks like COM executable
3031# so TODO: get real 4dos batcomp file and find sig
3032# BlakHole
30330	string	BH\5\7 BlakHole archive data
3034# BIX
30350	string	BIX0 BIX archive data
3036# ChiefLZA
30370	string	ChfLZ ChiefLZA archive data
3038# Blink
30390	string	Blink Blink archive data
3040# Logitech Compress
30410	string	\xda\xfa Logitech Compress archive data
3042# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
30431	string	(C)\ STEPANYUK ARS-Sfx archive data
3044# AKT/AKT32
30450	string	AKT32 AKT32 archive data
30460	string	AKT AKT archive data
3047# NPack
30480	string	MSTSM NPack archive data
3049# PFT
30500	string	\0\x50\0\x14 PFT archive data
3051# SemOne
30520	string	SEM SemOne archive data
3053# PPMD
30540	string	\x8f\xaf\xac\x84 PPMD archive data
3055# FIZ
30560	string	FIZ FIZ archive data
3057# MSXiE
30580	belong&0xfffff0f0	0x4d530000 MSXiE archive data
3059# DeepFreezer
30600	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
3061# DC
30620	string	=<DC- DC archive data
3063# TPac
30640	string	\4TPAC\3 TPac archive data
3065# Ai
30660	string	Ai\1\1\0 Ai archive data
30670	string	Ai\1\0\0 Ai archive data
3068# Ai32
30690	string	Ai\2\0 Ai32 archive data
30700	string	Ai\2\1 Ai32 archive data
3071# SBC
30720	string	SBC SBC archive data
3073# Ybs
30740	string	YBS Ybs archive data
3075# DitPack
30760	string	\x9e\0\0 DitPack archive data
3077# DMS
30780	string	DMS! DMS archive data
3079# EPC
30800	string	\x8f\xaf\xac\x8c EPC archive data
3081# VSARC
30820	string	VS\x1a VSARC archive data
3083# PDZ
30840	string	PDZ PDZ archive data
3085# ReDuq
30860	string	rdqx ReDuq archive data
3087# GCA
30880	string	GCAX GCA archive data
3089# PPMN
30900	string	pN PPMN archive data
3091# WinImage
30923	string	WINIMAGE WinImage archive data
3093# Compressia
30940	string	CMP0CMP Compressia archive data
3095# UHBC
30960	string	UHB UHBC archive data
3097# WinHKI
30980	string	\x61\x5C\x04\x05 WinHKI archive data
3099# WWPack data file
31000	string	WWP WWPack archive data
3101# BSN (BSA, PTS-DOS)
31020	string	\xffBSG BSN archive data
31031	string	\xffBSG BSN archive data
31043	string	\xffBSG BSN archive data
31051	string	\0\xae\2 BSN archive data
31061	string	\0\xae\3 BSN archive data
31071	string	\0\xae\7 BSN archive data
3108# AIN
31090	string	\x33\x18 AIN archive data
31100	string	\x33\x17 AIN archive data
3111# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
3112# SZip (TODO: doesn't catch all versions)
31130	string	SZ\x0a\4 SZip archive data
3114# XPack DiskImage
3115# *.XDI updated by Joerg Jenderek Sep 2015
3116# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
3117# GRR: this test is still too general as it catches also text files starting with jm
31180	string	jm
3119# only found examples with this additional characteristic 2 bytes
3120>2	string	\x2\x4	Xpack DiskImage archive data
3121#!:ext xdi
3122# XPack Data
3123# *.xpa updated by Joerg Jenderek Sep 2015
3124# ftp://ftp.elf.stuba.sk/pub/pc/pack/
31250	string	xpa	XPA
3126!:ext	xpa
3127# XPA32
3128# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
3129# created by XPA32.EXE version 1.0.2 for Windows
3130>0	string	xpa\0\1 \b32 archive data
3131# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
3132>3	ubeshort	!0x0001	\bck archive data
3133# XPack Single Data
3134# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
3135# letter 'I'+ acute accent is equivalent to \xcd
31360	string	\xcd\ jm	Xpack single archive data
3137#!:mime	application/x-xpa-compressed
3138!:ext xpa
3139
3140# TODO: missing due to unknown magic/magic at end of file:
3141#DWC
3142#ARG
3143#ZAR
3144#PC/3270
3145#InstallIt
3146#RKive
3147#RK
3148#XPack Diskimage
3149
3150# These were inspired by idarc, but actually verified
3151# Dzip archiver (.dz)
3152# Update: Joerg Jenderek
3153# URL: http://speeddemosarchive.com/dzip/
3154# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
3155# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
31560	string	DZ
3157# latest version is 2.9 dated 7 may 2003
3158>2	byte	<4 Dzip archive data
3159!:mime	application/x-dzip
3160!:ext	dz
3161>>2	byte	x \b, version %i
3162>>3	byte	x \b.%i
3163>>4	ulelong	x \b, offset 0x%x
3164>>8	ulelong	x \b, %u files
3165# ZZip archiver (.zz)
31660	string	ZZ\ \0\0 ZZip archive data
31670	string	ZZ0 ZZip archive data
3168# PAQ archiver (.paq)
31690	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
31700	string	PAQ PAQ archive data
3171>3	byte&0xf0	0x30
3172>>3	byte	x (v%c)
3173# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
31740xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
31750	string	JARCS JAR (ARJ Software, Inc.) archive data
3176
3177# ARJ archiver (jason@jarthur.Claremont.EDU)
31780	leshort		0xea60		ARJ archive data
3179!:mime	application/x-arj
3180>5	byte		x		\b, v%d,
3181>8	byte		&0x04		multi-volume,
3182>8	byte		&0x10		slash-switched,
3183>8	byte		&0x20		backup,
3184>34	string		x		original name: %s,
3185>7	byte		0		os: MS-DOS
3186>7	byte		1		os: PRIMOS
3187>7	byte		2		os: Unix
3188>7	byte		3		os: Amiga
3189>7	byte		4		os: Macintosh
3190>7	byte		5		os: OS/2
3191>7	byte		6		os: Apple ][ GS
3192>7	byte		7		os: Atari ST
3193>7	byte		8		os: NeXT
3194>7	byte		9		os: VAX/VMS
3195>3	byte		>0		%d]
3196# [JW] idarc says this is also possible
31972	leshort		0xea60		ARJ archive data
3198
3199# HA archiver (Greg Roelofs, newt@uchicago.edu)
3200# This is a really bad format. A file containing HAWAII will match this...
3201#0	string		HA		HA archive data,
3202#>2	leshort		=1		1 file,
3203#>2	leshort		>1		%hu files,
3204#>4	byte&0x0f	=0		first is type CPY
3205#>4	byte&0x0f	=1		first is type ASC
3206#>4	byte&0x0f	=2		first is type HSC
3207#>4	byte&0x0f	=0x0e		first is type DIR
3208#>4	byte&0x0f	=0x0f		first is type SPECIAL
3209# suggestion: at least identify small archives (<1024 files)
32100  belong&0xffff00fc 0x48410000 HA archive data
3211>2	leshort		=1		1 file,
3212>2	leshort		>1		%u files,
3213>4	byte&0x0f	=0		first is type CPY
3214>4	byte&0x0f	=1		first is type ASC
3215>4	byte&0x0f	=2		first is type HSC
3216>4	byte&0x0f	=0x0e		first is type DIR
3217>4	byte&0x0f	=0x0f		first is type SPECIAL
3218
3219# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
32200	string		HPAK		HPACK archive data
3221
3222# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
32230	string		\351,\001JAM\ 		JAM archive,
3224>7	string		>\0			version %.4s
3225>0x26	byte		=0x27			-
3226>>0x2b	string          >\0			label %.11s,
3227>>0x27	lelong		x			serial %08x,
3228>>0x36	string		>\0			fstype %.8s
3229
3230# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
3231# Update: Joerg Jenderek
3232# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3233# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
3234#
3235#	check and display information of lharc (LHa,PMarc) file
32360	name				lharc-file
3237# check 1st character of method id like -lz4- -lh5- or -pm2-
3238>2	string		-
3239# check 5th character of method id
3240>>6	string		-
3241# check header level 0 1 2 3
3242>>>20	ubyte		<4
3243# check 2nd, 3th and 4th character of method id
3244>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b
3245!:mime	application/x-lzh-compressed
3246# creator type "LHA "
3247!:apple	????LHA
3248# display archive type name like "LHa/LZS archive data" or "LArc archive"
3249>>>>>2	string		-lz		\b
3250!:ext	lzs
3251# already known  -lzs- -lz4- -lz5- with old names
3252>>>>>>2	string	-lzs		LHa/LZS archive data
3253>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
3254# missing -lz?- with wikipedia names
3255>>>>>>3	regex	\^lz[2378]	LArc archive
3256# display archive type name like "LHa (2.x) archive data"
3257>>>>>2	string		-lh		\b
3258# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
3259>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
3260# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
3261# FOOBAR archiver use ".foo" as name extension instead usual one
3262# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
3263>>>>>>>2	string	-lh1		\b
3264!:ext lha/lzh/ice
3265>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
3266>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
3267>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
3268>>>>>>>2	string	-lh5		\b
3269# https://en.wikipedia.org/wiki/BIOS
3270# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
3271# bios.rom , kd7_v14.bin, 1010.004, ...
3272!:ext lha/lzh/rom/bin
3273# missing -lh?- variants (Joe Jared)
3274>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
3275# UNLHA32 2.67a
3276>>>>>>2	string		-lhx		LHa (UNLHA32) archive
3277# lha archives with standard file name extensions ".lha" ".lzh"
3278>>>>>>3	regex		!\^(lh1|lh5)	\b
3279!:ext lha/lzh
3280# this should not happen if all -lh variants are described
3281>>>>>>2	default		x		LHa (unknown) archive
3282#!:ext	lha
3283# PMarc
3284>>>>>3	regex		\^pm[012]	PMarc archive data
3285!:ext pma
3286# append method id without leading and trailing minus character
3287>>>>>3	string		x		[%3.3s]
3288>>>>>>0	use	lharc-header
3289#
3290#	check and display information of lharc header
32910	name				lharc-header
3292# header size 0x4 , 0x1b-0x61
3293>0	ubyte		x
3294# compressed data size != compressed file size
3295#>7	ulelong		x		\b, data size %d
3296# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
3297#>19	ubyte		x		\b, 19_0x%x
3298# level identifier 0 1 2 3
3299#>20	ubyte		x		\b, level %d
3300# time stamp
3301#>15		ubelong	x		DATE 0x%8.8x
3302# OS ID for level 1
3303>20	ubyte		1
3304# 0x20 types find for *.rom files
3305>>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
3306# ascii type like M for MSDOS
3307>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
3308# OS ID for level 2
3309>20	ubyte		2
3310#>>23	ubyte		x		\b, OS ID 0x%x
3311>>23	ubyte		<0x21		\b, 0x%x OS
3312>>23	ubyte		>0x20		\b, '%c' OS
3313# filename only for level 0 and 1
3314>20	ubyte		<2
3315# length of filename
3316>>21		ubyte	>0		\b, with
3317# filename
3318>>>21		pstring	x		"%s"
3319#
3320#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
3321#!:mime	application/x-lharc
33222	string		-lh0-
3323>0	use	lharc-file
3324#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
3325#!:mime	application/x-lharc
33262	string		-lh1-
3327>0	use	lharc-file
3328# NEW -lz2- ... -lz8-
33292	string		-lz2-
3330>0	use	lharc-file
33312	string		-lz3-
3332>0	use	lharc-file
33332	string		-lz4-
3334>0	use	lharc-file
33352	string		-lz5-
3336>0	use	lharc-file
33372	string		-lz7-
3338>0	use	lharc-file
33392	string		-lz8-
3340>0	use	lharc-file
3341#	[never seen any but the last; -lh4- reported in comp.compression:]
3342#2	string		-lzs-		LHa/LZS archive data [lzs]
33432	string		-lzs-
3344>0	use	lharc-file
3345# According to wikipedia and others such a version does not exist
3346#2	string		-lh\40-		LHa 2.x? archive data [lh ]
3347#2	string		-lhd-		LHa 2.x? archive data [lhd]
33482	string		-lhd-
3349>0	use	lharc-file
3350#2	string		-lh2-		LHa 2.x? archive data [lh2]
33512	string		-lh2-
3352>0	use	lharc-file
3353#2	string		-lh3-		LHa 2.x? archive data [lh3]
33542	string		-lh3-
3355>0	use	lharc-file
3356#2	string		-lh4-		LHa (2.x) archive data [lh4]
33572	string		-lh4-
3358>0	use	lharc-file
3359#2	string		-lh5-		LHa (2.x) archive data [lh5]
33602	string		-lh5-
3361>0	use	lharc-file
3362#2	string		-lh6-		LHa (2.x) archive data [lh6]
33632	string		-lh6-
3364>0	use	lharc-file
3365#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
33662	string		-lh7-
3367# !:mime	application/x-lha
3368# >20	byte		x		- header level %d
3369>0	use	lharc-file
3370# NEW -lh8- ... -lhe- , -lhx-
33712	string		-lh8-
3372>0	use	lharc-file
33732	string		-lh9-
3374>0	use	lharc-file
33752	string		-lha-
3376>0	use	lharc-file
33772	string		-lhb-
3378>0	use	lharc-file
33792	string		-lhc-
3380>0	use	lharc-file
33812	string		-lhe-
3382>0	use	lharc-file
33832	string		-lhx-
3384>0	use	lharc-file
3385# taken from idarc [JW]
33862   string      -lZ         PUT archive data
3387# already done by LHarc magics
3388# this should never happen if all sub types of LZS archive are identified
3389#2   string      -lz         LZS archive data
33902   string      -sw1-       Swag archive data
3391
33920	name		rar-file-header
3393>24	byte		15		\b, v1.5
3394>24	byte		20		\b, v2.0
3395>24	byte		29		\b, v4
3396>15	byte		0		\b, os: MS-DOS
3397>15	byte		1		\b, os: OS/2
3398>15	byte		2		\b, os: Win32
3399>15	byte		3		\b, os: Unix
3400>15	byte		4		\b, os: Mac OS
3401>15	byte		5		\b, os: BeOS
3402
34030	name		rar-archive-header
3404>3	leshort&0x1ff	>0		\b, flags:
3405>>3	leshort		&0x01		ArchiveVolume
3406>>3	leshort		&0x02		Commented
3407>>3	leshort		&0x04		Locked
3408>>3	leshort		&0x10		NewVolumeNaming
3409>>3	leshort		&0x08		Solid
3410>>3	leshort		&0x20		Authenticated
3411>>3	leshort		&0x40		RecoveryRecordPresent
3412>>3	leshort		&0x80		EncryptedBlockHeader
3413>>3	leshort		&0x100		FirstVolume
3414
3415# RAR (Roshal Archive) archive
34160	string		Rar!\x1a\7\0		RAR archive data
3417!:mime	application/x-rar
3418!:ext	rar/cbr
3419# file header
3420>(0xc.l+9)	byte	0x74
3421>>(0xc.l+7)	use	rar-file-header
3422# subblock seems to share information with file header
3423>(0xc.l+9)	byte	0x7a
3424>>(0xc.l+7)	use	rar-file-header
3425>9		byte	0x73
3426>>7		use	rar-archive-header
3427
34280	string		Rar!\x1a\7\1\0		RAR archive data, v5
3429!:mime	application/x-rar
3430!:ext	rar
3431
3432# Very old RAR archive
3433# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
34340	string		RE\x7e\x5e  RAR archive data (<v1.5)
3435!:mime	application/x-rar
3436!:ext	rar/cbr
3437
3438# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
34390	string		SQSH		squished archive data (Acorn RISCOS)
3440
3441# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
3442# [JW] see exe section for self-extracting version
34430	string		UC2\x1a		UC2 archive data
3444
3445# PKZIP multi-volume archive
34460	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
3447!:mime	application/zip
3448!:ext zip/cbz
3449
3450# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
34510	string		PK\005\006	Zip archive data (empty)
3452!:mime application/zip
3453!:ext zip/cbz
3454!:strength +1
34550	string		PK\003\004
3456!:strength +1
3457
3458# Specialised zip formats which start with a member named 'mimetype'
3459# (stored uncompressed, with no 'extra field') containing the file's MIME type.
3460# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
3461#  contents starting with "application/":
3462>26	string		\x8\0\0\0mimetypeapplication/
3463
3464#  KOffice / OpenOffice & StarOffice / OpenDocument formats
3465#    From: Abel Cheung <abel@oaka.org>
3466
3467#   KOffice (1.2 or above) formats
3468#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
3469>>50	string	vnd.kde.		KOffice (>=1.2)
3470>>>58	string	karbon			Karbon document
3471>>>58	string	kchart			KChart document
3472>>>58	string	kformula		KFormula document
3473>>>58	string	kivio			Kivio document
3474>>>58	string	kontour			Kontour document
3475>>>58	string	kpresenter		KPresenter document
3476>>>58	string	kspread			KSpread document
3477>>>58	string	kword			KWord document
3478
3479#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
3480#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
3481# URL:		https://en.wikipedia.org/wiki/OpenOffice.org_XML
3482# reference:	http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML
3483>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
3484>>>62	string	writer			Writer
3485>>>>68	byte	!0x2e			document
3486!:mime	application/vnd.sun.xml.writer
3487!:ext	sxw
3488>>>>68	string	.template		template
3489!:mime	application/vnd.sun.xml.writer.template
3490!:ext	stw
3491>>>>68	string	.web			Web template
3492!:mime	application/vnd.sun.xml.writer.web
3493!:ext	stw
3494>>>>68	string	.global			global document
3495!:mime	application/vnd.sun.xml.writer.global
3496!:ext	sxg
3497>>>62	string	calc			Calc
3498>>>>66	byte	!0x2e			spreadsheet
3499!:mime	application/vnd.sun.xml.calc
3500!:ext	sxc
3501>>>>66	string	.template		template
3502!:mime	application/vnd.sun.xml.calc.template
3503!:ext	stc
3504>>>62	string	draw			Draw
3505>>>>66	byte	!0x2e			document
3506!:mime	application/vnd.sun.xml.draw
3507!:ext	sxd
3508>>>>66	string	.template		template
3509!:mime	application/vnd.sun.xml.draw.template
3510!:ext	std
3511>>>62	string	impress			Impress
3512>>>>69	byte	!0x2e			presentation
3513!:mime	application/vnd.sun.xml.impress
3514!:ext	sxi
3515>>>>69	string	.template		template
3516!:mime	application/vnd.sun.xml.impress.template
3517!:ext	sti
3518>>>62	string	math			Math document
3519!:mime	application/vnd.sun.xml.math
3520!:ext	sxm
3521>>>62	string	base			Database file
3522!:mime	application/vnd.sun.xml.base
3523!:ext	sdb
3524
3525#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
3526#   URL: http://fileformats.archiveteam.org/wiki/OpenDocument
3527#    https://lists.oasis-open.org/archives/office/200505/msg00006.html
3528#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
3529>>50	string	vnd.oasis.opendocument.	OpenDocument
3530>>>73	string	text
3531>>>>77	byte	!0x2d			Text
3532!:mime	application/vnd.oasis.opendocument.text
3533!:ext	odt
3534>>>>77	string	-template		Text Template
3535!:mime	application/vnd.oasis.opendocument.text-template
3536!:ext	ott
3537>>>>77	string	-web			HTML Document Template
3538!:mime	application/vnd.oasis.opendocument.text-web
3539!:ext	oth
3540>>>>77	string	-master			Master Document
3541!:mime	application/vnd.oasis.opendocument.text-master
3542!:ext	odm
3543>>>73	string	graphics
3544>>>>81	byte	!0x2d			Drawing
3545!:mime	application/vnd.oasis.opendocument.graphics
3546!:ext	odg
3547>>>>81	string	-template		Drawing Template
3548!:mime	application/vnd.oasis.opendocument.graphics-template
3549!:ext	otg
3550>>>73	string	presentation
3551>>>>85	byte	!0x2d			Presentation
3552!:mime	application/vnd.oasis.opendocument.presentation
3553!:ext	odp
3554>>>>85	string	-template		Presentation Template
3555!:mime	application/vnd.oasis.opendocument.presentation-template
3556!:ext	otp
3557>>>73	string	spreadsheet
3558>>>>84	byte	!0x2d			Spreadsheet
3559!:mime	application/vnd.oasis.opendocument.spreadsheet
3560!:ext	ods
3561>>>>84	string	-template		Spreadsheet Template
3562!:mime	application/vnd.oasis.opendocument.spreadsheet-template
3563!:ext	ots
3564>>>73	string	chart
3565>>>>78	byte	!0x2d			Chart
3566!:mime	application/vnd.oasis.opendocument.chart
3567!:ext	odc
3568>>>>78	string	-template		Chart Template
3569!:mime	application/vnd.oasis.opendocument.chart-template
3570!:ext	otc
3571>>>73	string	formula
3572>>>>80	byte	!0x2d			Formula
3573!:mime	application/vnd.oasis.opendocument.formula
3574!:ext	odf
3575>>>>80	string	-template		Formula Template
3576!:mime	application/vnd.oasis.opendocument.formula-template
3577!:ext	otf
3578# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml
3579>>>73	string	database		Database
3580!:mime	application/vnd.oasis.opendocument.database
3581!:ext	odb
3582# Valid for LibreOffice Base 6.0.1.1 at least
3583>>>73	string	base 			Database
3584# https://bugs.documentfoundation.org/show_bug.cgi?id=45854
3585!:mime	application/vnd.oasis.opendocument.database
3586#!:mime	application/vnd.oasis.opendocument.base
3587!:ext	odb
3588>>>73	string	image
3589>>>>78	byte	!0x2d			Image
3590!:mime	application/vnd.oasis.opendocument.image
3591!:ext	odi
3592>>>>78	string	-template		Image Template
3593!:mime	application/vnd.oasis.opendocument.image-template
3594!:ext	oti
3595
3596#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
3597#    https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
3598#    From: Ralf Brown <ralf.brown@gmail.com>
3599>>50	string	epub+zip	EPUB document
3600!:mime application/epub+zip
3601
3602# From:	Joerg Jenderek
3603# URL:	http://en.wikipedia.org/wiki/CorelDRAW
3604# NOTE:	version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
3605>>50	string	x-vnd.corel.	 Corel
3606>>>62	string	draw.document+zip	Draw drawing, version 14-16
3607!:mime	application/x-vnd.corel.draw.document+zip
3608!:ext	cdr
3609>>>62	string	draw.template+zip	Draw template, version 14-16
3610!:mime	application/x-vnd.corel.draw.template+zip
3611!:ext	cdrt
3612>>>62	string	zcf.draw.document+zip	Draw drawing, version 17-22
3613!:mime	application/x-vnd.corel.zcf.draw.document+zip
3614!:ext	cdr
3615>>>62	string	zcf.draw.template+zip	Draw template, version 17-22
3616!:mime	application/x-vnd.corel.zcf.draw.template+zip
3617!:ext	cdt/cdrt
3618# URL:	http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html
3619>>>62	string	zcf.pattern+zip		Draw pattern, version 22
3620!:mime	application/x-vnd.corel.zcf.pattern+zip
3621!:ext	pat
3622# URL:		https://en.wikipedia.org/wiki/Corel_Designer
3623# Reference:	http://fileformats.archiveteam.org/wiki/Corel_Designer
3624# Note:		called by TrID "Corel DESIGN graphics"
3625>>>62	string	designer.document+zip		DESIGNER graphics, version 14-16
3626!:mime	application/x-vnd.corel.designer.document+zip
3627!:ext	des
3628>>>62	string	zcf.designer.document+zip	DESIGNER graphics, version 17-21
3629!:mime	application/x-vnd.corel.zcf.designer.document+zip
3630!:ext	des
3631# URL:	http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/
3632#	CorelDRAW-Corel-Symbol-Library-CSL.html
3633>>>62	string	symbol.library+zip		Symbol Library, version 6-16.3
3634!:mime	application/x-vnd.corel.symbol.library+zip
3635!:ext	csl
3636>>>62	string	zcf.symbol.library+zip		Symbol Library, version 17-22
3637!:mime	application/x-vnd.corel.zcf.symbol.library+zip
3638!:ext	csl
3639
3640#  Catch other ZIP-with-mimetype formats
3641#	In a ZIP file, the bytes immediately after a member's contents are
3642#	always "PK". The 2 regex rules here print the "mimetype" member's
3643#	contents up to the first 'P'. Luckily, most MIME types don't contain
3644#	any capital 'P's. This is a kludge.
3645#    (mimetype contains "application/<OTHER>")
3646>>50		default	x			Zip data
3647>>>38		regex	[!-OQ-~]+		(MIME type "%s"?)
3648!:mime	application/zip
3649#    (mimetype contents other than "application/*")
3650>26		string	\x8\0\0\0mimetype
3651>>38		string	!application/
3652>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3653!:mime	application/zip
3654
3655# Java Jar files
3656>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
3657!:mime	application/java-archive
3658
3659# iOS App
3660>(26.s+30)	leshort	!0xcafe
3661>>26		string	!\x8\0\0\0mimetype
3662>>>30		string	Payload/
3663>>>>38		search/64       .app/   iOS App
3664!:mime application/x-ios-app
3665
3666>30	search/100/b application/epub+zip	EPUB document
3667!:mime application/epub+zip
3668
3669# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
3670#   Next line excludes specialized formats:
3671>(26.s+30)	leshort	!0xcafe
3672>>30	search/100/b !application/epub+zip
3673>>>26    string          !\x8\0\0\0mimetype	Zip archive data
3674!:mime	application/zip
3675>>>>4	beshort		x			\b, at least
3676>>>>4	use		zipversion
3677>>>>4	beshort		x			to extract
3678>>>>0x161	string		WINZIP		\b, WinZIP self-extracting
3679
3680# StarView Metafile
3681# From Pierre Ducroquet <pinaraf@pinaraf.info>
36820	string	VCLMTF	StarView MetaFile
3683>6	beshort	x	\b, version %d
3684>8	belong	x	\b, size %d
3685
3686# Zoo archiver
368720	lelong		0xfdc4a7dc	Zoo archive data
3688!:mime	application/x-zoo
3689>4	byte		>48		\b, v%c.
3690>>6	byte		>47		\b%c
3691>>>7	byte		>47		\b%c
3692>32	byte		>0		\b, modify: v%d
3693>>33	byte		x		\b.%d+
3694>42	lelong		0xfdc4a7dc	\b,
3695>>70	byte		>0		extract: v%d
3696>>>71	byte		x		\b.%d+
3697
3698# Shell archives
369910	string		#\ This\ is\ a\ shell\ archive	shell archive text
3700!:mime	application/octet-stream
3701
3702#
3703# LBR. NB: May conflict with the questionable
3704#          "binary Computer Graphics Metafile" format.
3705#
37060       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
3707#
3708# PMA (CP/M derivative of LHA)
3709# Update: Joerg Jenderek
3710# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3711#
3712#2       string          -pm0-           PMarc archive data [pm0]
37132	string		-pm0-
3714>0	use	lharc-file
3715#2       string          -pm1-           PMarc archive data [pm1]
37162	string		-pm1-
3717>0	use	lharc-file
3718#2       string          -pm2-           PMarc archive data [pm2]
37192	string		-pm2-
3720>0	use	lharc-file
37212       string          -pms-           PMarc SFX archive (CP/M, DOS)
3722#!:mime	application/x-foobar-exec
3723!:ext com
37245       string          -pc1-           PopCom compressed executable (CP/M)
3725#!:mime	application/x-
3726#!:ext com
3727
3728# From Rafael Laboissiere <rafael@laboissiere.net>
3729# The Project Revision Control System (see
3730# http://prcs.sourceforge.net) generates a packaged project
3731# file which is recognized by the following entry:
37320	leshort		0xeb81	PRCS packaged project
3733
3734# Microsoft cabinets
3735# by David Necas (Yeti) <yeti@physics.muni.cz>
3736#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
3737#>25	byte	x		v%d
3738#>24	byte	x		\b.%d
3739# MPi: All CABs have version 1.3, so this is pointless.
3740# Better magic in debian-additions.
3741
3742# GTKtalog catalogs
3743# by David Necas (Yeti) <yeti@physics.muni.cz>
37444	string	gtktalog\ 	GTKtalog catalog data,
3745>13	string	3		version 3
3746>>14	beshort	0x677a		(gzipped)
3747>>14	beshort	!0x677a		(not gzipped)
3748>13	string	>3		version %s
3749
3750############################################################################
3751# Parity archive reconstruction file, the 'par' file format now used on Usenet.
37520       string          PAR\0	PARity archive data
3753>48	leshort		=0	- Index file
3754>48	leshort		>0	- file number %d
3755
3756# Felix von Leitner <felix-file@fefe.de>
37570	string	d8:announce	BitTorrent file
3758!:mime	application/x-bittorrent
3759# Durval Menezes, <jmgthbfile at durval dot com>
37600	string	d13:announce-list	BitTorrent file
3761!:mime	application/x-bittorrent
37620	string	d7:comment	BitTorrent file
3763!:mime	application/x-bittorrent
37640	string	d4:info		BitTorrent file
3765!:mime	application/x-bittorrent
3766
3767# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
37680	beshort 0x0e0f		Atari MSA archive data
3769>2	beshort x		\b, %d sectors per track
3770>4	beshort 0		\b, 1 sided
3771>4	beshort 1		\b, 2 sided
3772>6	beshort x		\b, starting track: %d
3773>8	beshort x		\b, ending track: %d
3774
3775# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
37760	string	PK00PK\003\004	Zip archive data
3777!:mime	application/zip
3778!:ext zip/cbz
3779
3780# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
3781# by Stefan `Sec` Zehl <sec@42.org>
37827	string		**ACE**		ACE archive data
3783>15	byte	>0		version %d
3784>16	byte	=0x00		\b, from MS-DOS
3785>16	byte	=0x01		\b, from OS/2
3786>16	byte	=0x02		\b, from Win/32
3787>16	byte	=0x03		\b, from Unix
3788>16	byte	=0x04		\b, from MacOS
3789>16	byte	=0x05		\b, from WinNT
3790>16	byte	=0x06		\b, from Primos
3791>16	byte	=0x07		\b, from AppleGS
3792>16	byte	=0x08		\b, from Atari
3793>16	byte	=0x09		\b, from Vax/VMS
3794>16	byte	=0x0A		\b, from Amiga
3795>16	byte	=0x0B		\b, from Next
3796>14	byte	x		\b, version %d to extract
3797>5	leshort &0x0080		\b, multiple volumes,
3798>>17	byte	x		\b (part %d),
3799>5	leshort &0x0002		\b, contains comment
3800>5	leshort	&0x0200		\b, sfx
3801>5	leshort	&0x0400		\b, small dictionary
3802>5	leshort	&0x0800		\b, multi-volume
3803>5	leshort	&0x1000		\b, contains AV-String
3804>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
3805>5	leshort &0x2000		\b, with recovery record
3806>5	leshort &0x4000		\b, locked
3807>5	leshort &0x8000		\b, solid
3808# Date in MS-DOS format (whatever that is)
3809#>18	lelong	x		Created on
3810
3811# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
3812# <doj@cubic.org>
38130x1A	string	sfArk		sfArk compressed Soundfont
3814>0x15	string	2
3815>>0x1	string	>\0		Version %s
3816>>0x2A	string	>\0		: %s
3817
3818# DR-DOS 7.03 Packed File *.??_
38190	string	Packed\ File\ 	Personal NetWare Packed File
3820>12	string	x		\b, was "%.12s"
3821
3822# EET archive
3823# From: Tilman Sauerbeck <tilman@code-monkey.de>
38240	belong	0x1ee7ff00	EET archive
3825!:mime	application/x-eet
3826
3827# rzip archives
38280	string	RZIP		rzip compressed data
3829>4	byte	x		- version %d
3830>5	byte	x		\b.%d
3831>6	belong	x		(%d bytes)
3832
3833# From:		Joerg Jenderek
3834# URL:		https://help.foxitsoftware.com/kb/install-fzip-file.php
3835# reference:	http://mark0.net/download/triddefs_xml.7z/
3836#		defs/f/fzip.trid.xml
3837# Note: unknown compression; No "PK" zip magic; normally in directory like
3838#	"%APPDATA%\Foxit Software\Addon\Foxit Reader\Install"
38390	ubequad	0x2506781901010000	Foxit add-on/update
3840!:mime	application/x-fzip
3841!:ext	fzip
3842
3843# From: "Robert Dale" <robdale@gmail.com>
38440	belong	123		dar archive,
3845>4	belong	x		label "%.8x
3846>>8	belong	x		%.8x
3847>>>12	beshort	x		%.4x"
3848>14	byte	0x54		end slice
3849>14	beshort	0x4e4e		multi-part
3850>14	beshort	0x4e53		multi-part, with -S
3851
3852# Symbian installation files
3853#  https://www.thouky.co.uk/software/psifs/sis.html
3854#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
38558	lelong	0x10000419	Symbian installation file
3856!:mime	application/vnd.symbian.install
3857>4	lelong	0x1000006D	(EPOC release 3/4/5)
3858>4	lelong	0x10003A12	(EPOC release 6)
38590	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
3860!:mime	x-epoc/x-sisx-app
3861
3862# From "Nelson A. de Oliveira" <naoliv@gmail.com>
38630	string	MPQ\032		MoPaQ (MPQ) archive
3864
3865# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3866# .kgb
38670	string KGB_arch		KGB Archiver file
3868>10	string x		with compression level %.1s
3869
3870# xar (eXtensible ARchiver) archive
3871# URL: https://en.wikipedia.org/wiki/Xar_(archiver)
3872# xar archive format: https://code.google.com/p/xar/
3873# From: "David Remahl" <dremahl@apple.com>
3874# Update: Joerg Jenderek
3875# TODO: lzma compression; X509Data for pkg and xip
3876# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or
3877# 7z t -txar Xcode_10.2_beta_4.xip`
38780	string	xar!		xar archive
3879!:mime	application/x-xar
3880# pkg for Mac OSX installer package like FullBundleUpdate.pkg
3881# xip for signed Apple software like Xcode_10.2_beta_4.xip
3882!:ext	xar/pkg/xip
3883# always 28 in older archives
3884>4	ubeshort >28		\b, header size %u
3885# currently there exit only version 1 since about 2014
3886>6	ubeshort >1		version %u,
3887>8	ubequad	x		compressed TOC: %llu,
3888#>16	ubequad	x		uncompressed TOC: %llu,
3889# cksum_alg 0-2 in older and also 3-4 in newer
3890>24	belong	0		no checksum
3891>24	belong	1		SHA-1 checksum
3892>24	belong	2		MD5 checksum
3893>24	belong	3		SHA-256 checksum
3894>24	belong	4		SHA-512 checksum
3895>24	belong	>4		unknown 0x%x checksum
3896#>24	belong	>4		checksum
3897#			For no compression jump 0 bytes
3898>24	belong	0
3899>>0		ubyte	x
3900# jump more bytes forward by header size
3901>>>&(4.S)	ubyte	x
3902# jump more bytes forward by compressed table of contents size
3903#>>>>&(8.Q)	ubequad	x	\b, heap data 0x%llx
3904>>>>&(8.Q)	ubyte	x
3905# look for data by ./compress after message with 1 space at end
3906>>>>>&-3	indirect x	\b, contains
3907#			For SHA-1 jump 20 minus 2 bytes
3908>24	belong	1
3909>>18		ubyte	x
3910# jump more bytes forward by header size
3911>>>&(4.S)	ubyte	x
3912# jump more bytes forward by compressed table of contents size
3913>>>>&(8.Q)	ubyte	x
3914# data compressed by gzip, bzip, lzma or none
3915>>>>>&-1	indirect x	\b, contains
3916#			For SHA-256 jump 32 minus 2 bytes
3917>24	belong	3
3918>>30		ubyte	x
3919# jump more bytes forward by header size
3920>>>&(4.S)	ubyte	x
3921# jump more bytes forward by compressed table of contents size
3922>>>>&(8.Q)	ubyte	x
3923>>>>>&-1	indirect x	\b, contains
3924#			For SHA-512 jump 64 minus 2 bytes
3925>24	belong	4
3926>>62		ubyte	x
3927# jump more bytes forward by header size
3928>>>&(4.S)	ubyte	x
3929# jump more bytes forward by compressed table of contents size
3930>>>>&(8.Q)	ubyte	x
3931>>>>>&-1	indirect x	\b, contains
3932
3933# Type: Parity Archive
3934# From: Daniel van Eeden <daniel_e@dds.nl>
39350	string	PAR2		Parity Archive Volume Set
3936
3937# Bacula volume format. (Volumes always start with a block header.)
3938# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
3939# From: Adam Buchbinder <adam.buchbinder@gmail.com>
394012	string	BB02		Bacula volume
3941>20	bedate	x		\b, started %s
3942
3943# ePub is XHTML + XML inside a ZIP archive.  The first member of the
3944#   archive must be an uncompressed file called 'mimetype' with contents
3945#   'application/epub+zip'
3946
3947
3948# From: "Michael Gorny" <mgorny@gentoo.org>
3949# ZPAQ: http://mattmahoney.net/dc/zpaq.html
39500	string	zPQ	ZPAQ stream
3951>3	byte	x	\b, level %d
3952# From: Barry Carter <carter.barry@gmail.com>
3953# https://encode.ru/threads/456-zpaq-updates/page32
39540	string	7kSt	ZPAQ file
3955
3956# BBeB ebook, unencrypted (LRF format)
3957# URL: https://www.sven.de/librie/Librie/LrfFormat
3958# From: Adam Buchbinder <adam.buchbinder@gmail.com>
39590	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
3960>8	beshort	x		\b, version %d
3961>36	byte	1		\b, front-to-back
3962>36	byte	16		\b, back-to-front
3963>42	beshort	x		\b, (%dx,
3964>44	beshort	x		%d)
3965
3966# Symantec GHOST image by Joerg Jenderek at May 2014
3967# https://us.norton.com/ghost/
3968# https://www.garykessler.net/library/file_sigs.html
39690		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
3970# *.GHO
3971>2		ubyte&0x08		0x00		\b, first file
3972# *.GHS or *.[0-9] with cns program option
3973>2		ubyte&0x08		0x08		\b, split file
3974# part of split index interesting for *.ghs
3975>>4		ubyte			x		id=0x%x
3976# compression tag minus one equals numeric compression command line switch z[1-9]
3977>3		ubyte			0		\b, no compression
3978>3		ubyte			2		\b, fast compression (Z1)
3979>3		ubyte			3		\b, medium compression (Z2)
3980>3		ubyte			>3
3981>>3		ubyte			<11		\b, compression (Z%d-1)
3982>2		ubyte&0x08		0x00
3983# ~ 30 byte password field only for *.gho
3984>>12		ubequad			!0		\b, password protected
3985>>44		ubyte			!1
3986# 1~Image All, sector-by-sector only for *.gho
3987>>>10		ubyte			1		\b, sector copy
3988# 1~Image Boot track only for *.gho
3989>>>43		ubyte			1		\b, boot track
3990# 1~Image Disc only for *.gho implies Image Boot track and sector copy
3991>>44		ubyte			1		\b, disc sector copy
3992# optional image description only *.gho
3993>>0xff		string			>\0		"%-.254s"
3994# look for DOS sector end sequence
3995>0xE08	search/7776		\x55\xAA
3996>>&-512	indirect		x		\b; contains
3997
3998# Google Chrome extensions
3999# https://developer.chrome.com/extensions/crx
4000# https://developer.chrome.com/extensions/hosting
40010	string	Cr24	Google Chrome extension
4002!:mime	application/x-chrome-extension
4003>4	ulong	x	\b, version %u
4004
4005# SeqBox - Sequenced container
4006# ext: sbx, seqbox
4007# Marco Pontello marcopon@gmail.com
4008# reference: https://github.com/MarcoPon/SeqBox
40090	string	SBx	SeqBox,
4010>3	byte	x	version %d
4011
4012# LyNX archive
401356	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
4014
4015# From: Joerg Jenderek
4016# URL: https://www.acronis.com/
4017# Reference: https://en.wikipedia.org/wiki/TIB_(file_format)
4018# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110
40190	ubequad		0xce24b9a220000000	Acronis True Image backup
4020!:mime	application/x-acronis-tib
4021!:ext	tib
4022# 01000000
4023#>20	ubelong		x			\b, at 20 0x%x
4024# 20000000
4025#>28	ubelong		x			\b, at 28 0x%x
4026# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0"
4027# ???
4028# strings like "\Device\0000011e" "\Device\0000015a"
4029#>0	search/0x6852300/cs	\\Device\\
4030#>>&-1	pstring		x			\b, %s
4031# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39"
4032#>>>&1	search/180/cs	\\Device\\
4033#>>>>&-1	pstring		x			\b, %s
4034#>>>>>&0	search/29/cs	\0\0\xc8\0
4035# disk label
4036#>>>>>>&10	lestring16	x		\b, disk label %11.11s
4037#>>>>>>&9	plestring16	x		\b, disk label "%11.11s"
4038#>>>>>>&10	ubequad	x			%16.16llx
4039
4040
4041# Gentoo XPAK binary package
4042# by Michal Gorny <mgorny@gentoo.org>
4043# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
4044-4	string	STOP
4045>-16	string	XPAKSTOP	Gentoo binary package (XPAK)
4046
4047# From:		Joerg Jenderek
4048# URL:		https://kodi.wiki/view/TexturePacker
4049# Reference:	https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz
4050# /xbmc-Krypton/xbmc/guilib/XBTF.h
4051# /xbmc-Krypton/xbmc/guilib/XBTF.cpp
40520	string	XBTF
4053# skip ASCII text by looking for terminating \0 of path
4054>264	ubyte	0		XBMC texture package
4055!:mime	application/x-xbmc-xbt
4056!:ext	xbt
4057# XBTF_VERSION 2
4058>>4	string	!2		\b, version %-.1s
4059# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp
4060>>5	ulelong	x		\b, %u file
4061# plural s
4062>>5	ulelong	>1		\bs
4063# path[CXBTFFile[MaximumPathLength=256]
4064>>9	string	x		\b, 1st %s
4065
4066
4067#------------------------------------------------------------------------------
4068# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $
4069# asf:  file(1) magic for Microsoft Advanced Systems Format (ASF) files
4070# http://www.staroceans.org/e-book/ASF_Specification.pdf
4071
40720	name	asf-name
4073# ASF_Data_Object
4074#>0	guid	75B22636-668E-11CF-A6D9-00AA0062CE6C
4075#>16	lequad	>0
4076#>>(16.q)	use	asf-object
4077# ASF_Simple_Index_Object
4078>0	guid	33000890-E5B1-11CF-89F4-00A0C90349CB
4079>0	guid	D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
4080>0	guid	FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
4081>0	guid	3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
4082
4083# ASF_File_Properties_Object
4084>0	guid	8CABDCA1-A947-11CF-8EE4-00C00C205365
4085
4086# ASF_Stream_Properties_Object
4087>0	guid	B7DC0791-A9B7-11CF-8EE6-00C00C205365
4088#>>56	lequad	x		Time Offset %lld
4089#>>64	lelong	x		Type-Specicic Data Length %d
4090#>>68	lelong	x		Error Correction Data Length %d
4091#>>72	leshort	x		Flags 0x%x
4092#>>74	lelong	x		Reserved %x
4093# ASF_Audio_Media
4094>>24	guid	F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media (
4095>>>78	leshort	x	\bCodec Id %d
4096>>>80	leshort	x	\b, Number of channels %d
4097>>>82	lelong	x	\b, Samples Per Second %d
4098>>>86	lelong	x	\b, Average Number of Bytes Per Second %d
4099>>>90	lelong	x	\b, Block Alignment %d
4100>>>94	leshort	x	\b, Bits Per Sample %d
4101# ASF_Video_Media
4102>>24	guid	BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media (
4103>>>78	lelong	x	\bEncoded Image Width %d
4104>>>82	lelong	x	\b, Encoded Image Height %d
4105#>>>85	leshort	x	\b, Format Data Size %x
4106>>>93	lelong	x	\b, Image Width %d
4107>>>97	lelong	x	\b, Image Height %d
4108#>>>101	leshort	x	\b, Reserved 0x%x
4109>>>103	leshort	x	\b, Bits Per Pixel Count %d
4110#>>>105	lelong	x 	\b, Compression ID %d
4111#>>>109	lelong	x	\b, Image Size %d
4112#>>>113	lelong	x	\b, Horizontal Pixels Per Meter %d
4113#>>>117	lelong	x	\b, Vertical Pixels Per Meter %d
4114#>>>121	lelong	x	\b, Colors Used Count %d
4115#>>>125	lelong	x	\b, Important Colors Count %d
4116>>0	lelong	x	\b, Error correction type
4117>>40	use	asf-name
4118>>0	lelong	x	\b)
4119#ASF_Header_Extension_Object
4120>0	guid	5FBF03B5-A92E-11CF-8EE3-00C00C205365
4121# ASF_Codec_List_Object
4122>0	guid	86D15240-311D-11D0-A3A4-00A0C90348F6
4123>0	guid	1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
4124>0	guid	F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
4125>0	guid	D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
4126>0	guid	75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
4127# ASF_Content_Description_Object
4128>0	guid	75B22633-668E-11CF-A6D9-00AA0062CE6C
4129#>>24	leshort	title length %d
4130#>>26	leshort	author length %d
4131#>>28	leshort	copyright length %d
4132#>>30	leshort	descriptor length %d
4133#>>32	leshort	rating length %d
4134>0	guid	D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object
4135>0	guid	2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object
4136>0	guid	7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object
4137>0	guid	2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object
4138>0	guid	298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
4139>0	guid	2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
4140# ASF_Padding_Object
4141>0	guid	1806D474-CADF-4509-A4BA-9AABCB96AAE8
4142>0	guid	14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
4143>0	guid	A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
4144>0	guid	D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object
4145>0	guid	D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object
4146>0	guid	A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object
4147>0	guid	7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object
4148>0	guid	C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object
4149>0	guid	44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object
4150>0	guid	D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object
4151>0	guid	6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object
4152>0	guid	F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object
4153>0	guid	26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object
4154>0	guid	43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object
4155>0	guid	59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media
4156>0	guid	B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media
4157>0	guid	35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media
4158>0	guid	91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media
4159>0	guid	3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media
4160>0	guid	776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype
4161>0	guid	DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format
4162>0	guid	20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction
4163>0	guid	BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread
4164>0	guid	ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1
4165>0	guid	7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM
4166# _Network_Devices
4167>0	guid	86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2
4168>0	guid	4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3
4169>0	guid	4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4
4170>0	guid	D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language
4171>0	guid	D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate
4172>0	guid	D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown
4173>0	guid	AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive
4174>0	guid	AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial
4175>0	guid	399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode
4176>0	guid	E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name
4177>0	guid	D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type
4178>0	guid	1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio
4179>0	guid	C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration
4180>0	guid	6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID
4181>0	guid	00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG
4182
41830	name	asf-object
4184>0	use	asf-name
4185#>>16	lequad	>0					(size %lld) [
4186>>16	lequad	>0
4187>>>(16.q)	use	asf-object
4188#>>16	lequad	0	]
4189
4190# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
41910	guid	75B22630-668E-11CF-A6D9-00AA0062CE6C	Microsoft ASF
4192!:mime  video/x-ms-asf
4193#>16	lequad	>0					(size %lld
4194#>>24	lelong	x					\b, %d header objects)
4195>16	lequad	>0
4196>>30	use	asf-object
4197>>(16.q)	use	asf-object
4198#------------------------------------------------------------------------------
4199# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
4200# make:  file(1) magic for assembler source
4201#
42020	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
4203!:mime	text/x-asm
42040	regex	\^[\040\t]{0,50}\\.byte		assembler source text
4205!:mime	text/x-asm
42060	regex	\^[\040\t]{0,50}\\.even		assembler source text
4207!:mime	text/x-asm
42080	regex	\^[\040\t]{0,50}\\.globl		assembler source text
4209!:mime	text/x-asm
42100	regex	\^[\040\t]{0,50}\\.text		assembler source text
4211!:mime	text/x-asm
42120	regex	\^[\040\t]{0,50}\\.file		assembler source text
4213!:mime	text/x-asm
42140	regex	\^[\040\t]{0,50}\\.type		assembler source text
4215!:mime	text/x-asm
4216
4217#------------------------------------------------------------------------------
4218# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
4219# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
4220# strings as "long" - we assume they're just strings:
4221# From: guy@netapp.com (Guy Harris)
4222#
42230	string		*STA		Aster*x
4224>7	string		WORD			Words Document
4225>7	string		GRAP			Graphic
4226>7	string		SPRE			Spreadsheet
4227>7	string		MACR			Macro
42280	string		2278		Aster*x Version 2
4229>29	byte		0x36			Words Document
4230>29	byte		0x35			Graphic
4231>29	byte		0x32			Spreadsheet
4232>29	byte		0x38			Macro
4233
4234
4235#------------------------------------------------------------------------------
4236# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
4237# att3b:  file(1) magic for AT&T 3B machines
4238#
4239# The `versions' should be un-commented if they work for you.
4240# (Was the problem just one of endianness?)
4241#
4242# 3B20
4243#
4244# The 3B20 conflicts with SCCS.
4245#0	beshort		0550		3b20 COFF executable
4246#>12	belong		>0		not stripped
4247#>22	beshort		>0		- version %d
4248#0	beshort		0551		3b20 COFF executable (TV)
4249#>12	belong		>0		not stripped
4250#>22	beshort		>0		- version %d
4251#
4252# WE32K
4253#
42540	beshort		0560		WE32000 COFF
4255>18	beshort		^00000020	object
4256>18	beshort		&00000020	executable
4257>12	belong		>0		not stripped
4258>18	beshort		^00010000	N/A on 3b2/300 w/paging
4259>18	beshort		&00020000	32100 required
4260>18	beshort		&00040000	and MAU hardware required
4261>20	beshort		0407		(impure)
4262>20	beshort		0410		(pure)
4263>20	beshort		0413		(demand paged)
4264>20	beshort		0443		(target shared library)
4265>22	beshort		>0		- version %d
42660	beshort		0561		WE32000 COFF executable (TV)
4267>12	belong		>0		not stripped
4268#>18	beshort		&00020000	- 32100 required
4269#>18	beshort		&00040000	and MAU hardware required
4270#>22	beshort		>0		- version %d
4271#
4272# core file for 3b2
42730	string		\000\004\036\212\200	3b2 core file
4274>364	string		>\0		of '%s'
4275
4276#------------------------------------------------------------------------------
4277# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $
4278# audio:  file(1) magic for sound formats (see also "iff")
4279#
4280# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
4281# and others
4282#
4283
4284# Sun/NeXT audio data
42850	string		.snd		Sun/NeXT audio data:
4286>12	belong		1		8-bit ISDN mu-law,
4287!:mime	audio/basic
4288>12	belong		2		8-bit linear PCM [REF-PCM],
4289!:mime	audio/basic
4290>12	belong		3		16-bit linear PCM,
4291!:mime	audio/basic
4292>12	belong		4		24-bit linear PCM,
4293!:mime	audio/basic
4294>12	belong		5		32-bit linear PCM,
4295!:mime	audio/basic
4296>12	belong		6		32-bit IEEE floating point,
4297!:mime	audio/basic
4298>12	belong		7		64-bit IEEE floating point,
4299!:mime	audio/basic
4300>12	belong		8		Fragmented sample data,
4301>12	belong		10		DSP program,
4302>12	belong		11		8-bit fixed point,
4303>12	belong		12		16-bit fixed point,
4304>12	belong		13		24-bit fixed point,
4305>12	belong		14		32-bit fixed point,
4306>12	belong		18		16-bit linear with emphasis,
4307>12	belong		19		16-bit linear compressed,
4308>12	belong		20		16-bit linear with emphasis and compression,
4309>12	belong		21		Music kit DSP commands,
4310>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4311!:mime  audio/x-adpcm
4312>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4313>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4314>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4315>12	belong		27		8-bit A-law (CCITT G.711),
4316>20	belong		1		mono,
4317>20	belong		2		stereo,
4318>20	belong		4		quad,
4319>16	belong		>0		%d Hz
4320
4321# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
4322# that uses little-endian encoding and has a different magic number
43230	lelong		0x0064732E	DEC audio data:
4324>12	lelong		1		8-bit ISDN mu-law,
4325!:mime	audio/x-dec-basic
4326>12	lelong		2		8-bit linear PCM [REF-PCM],
4327!:mime	audio/x-dec-basic
4328>12	lelong		3		16-bit linear PCM,
4329!:mime	audio/x-dec-basic
4330>12	lelong		4		24-bit linear PCM,
4331!:mime	audio/x-dec-basic
4332>12	lelong		5		32-bit linear PCM,
4333!:mime	audio/x-dec-basic
4334>12	lelong		6		32-bit IEEE floating point,
4335!:mime	audio/x-dec-basic
4336>12	lelong		7		64-bit IEEE floating point,
4337!:mime	audio/x-dec-basic
4338>12	belong		8		Fragmented sample data,
4339>12	belong		10		DSP program,
4340>12	belong		11		8-bit fixed point,
4341>12	belong		12		16-bit fixed point,
4342>12	belong		13		24-bit fixed point,
4343>12	belong		14		32-bit fixed point,
4344>12	belong		18		16-bit linear with emphasis,
4345>12	belong		19		16-bit linear compressed,
4346>12	belong		20		16-bit linear with emphasis and compression,
4347>12	belong		21		Music kit DSP commands,
4348>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
4349!:mime	audio/x-dec-basic
4350>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
4351>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
4352>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
4353>12	belong		27		8-bit A-law (CCITT G.711),
4354>20	lelong		1		mono,
4355>20	lelong		2		stereo,
4356>20	lelong		4		quad,
4357>16	lelong		>0		%d Hz
4358
4359# Creative Labs AUDIO stuff
43600	string	MThd			Standard MIDI data
4361!:mime	audio/midi
4362>8 	beshort	x			(format %d)
4363>10	beshort	x			using %d track
4364>10	beshort		>1		\bs
4365>12	beshort&0x7fff	x		at 1/%d
4366>12	beshort&0x8000	>0		SMPTE
4367
43680	string	CTMF			Creative Music (CMF) data
4369!:mime	audio/x-unknown
43700	string	SBI			SoundBlaster instrument data
4371!:mime	audio/x-unknown
43720	string	Creative\ Voice\ File	Creative Labs voice data
4373!:mime	audio/x-unknown
4374# is this next line right?  it came this way...
4375>19	byte	0x1A
4376>23	byte	>0			- version %d
4377>22	byte	>0			\b.%d
4378
4379# first entry is also the string "NTRK"
43800	belong		0x4e54524b	MultiTrack sound data
4381>4	belong		x		- version %d
4382
4383# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
4384# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
43850	string		EMOD		Extended MOD sound data,
4386>4	byte&0xf0	x		version %d
4387>4	byte&0x0f	x		\b.%d,
4388>45	byte		x		%d instruments
4389>83	byte		0		(module)
4390>83	byte		1		(song)
4391
4392# Real Audio (Magic .ra\0375)
43930	belong		0x2e7261fd	RealAudio sound file
4394!:mime	audio/x-pn-realaudio
43950	string		.RMF\0\0\0	RealMedia file
4396!:mime	application/vnd.rn-realmedia
4397#video/x-pn-realvideo
4398#video/vnd.rn-realvideo
4399#application/vnd.rn-realmedia
4400#	sigh, there are many mimes for that but the above are the most common.
4401
4402# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
4403# Oct 31, 1995
4404# fixed by <doj@cubic.org> 2003-06-24
4405# Too short...
4406#0	string		MTM		MultiTracker Module sound file
4407#0	string		if		Composer 669 Module sound data
4408#0	string		JN		Composer 669 Module sound data (extended format)
44090	string		MAS_U		ULT(imate) Module sound data
4410
4411#0	string		FAR		Module sound data
4412#>4	string		>\15		Title: "%s"
4413
44140x2c	string		SCRM		ScreamTracker III Module sound data
4415>0	string		>\0		Title: "%s"
4416!:mime	audio/x-s3m
4417
4418# .stm before it got above .s3m extension
44190x16	string		\!Scream\!	ScreamTracker Module sound data
4420>0	string		>\0		Title: "%s"
4421
4422# Gravis UltraSound patches
4423# From <ache@nagual.ru>
4424
44250	string		GF1PATCH110\0ID#000002\0	GUS patch
44260	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
4427
4428# mime types according to http://www.geocities.com/nevilo/mod.htm:
4429#	audio/it	.it
4430#	audio/x-zipped-it	.itz
4431#	audio/xm	fasttracker modules
4432#	audio/x-s3m	screamtracker modules
4433#	audio/s3m	screamtracker modules
4434#	audio/x-zipped-mod	mdz
4435#	audio/mod	mod
4436#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
4437
4438#
4439# Taken from loader code from mikmod version 2.14
4440# by Steve McIntyre (stevem@chiark.greenend.org.uk)
4441# <doj@cubic.org> added title printing on 2003-06-24
44420	string	MAS_UTrack_V00
4443>14	string	>/0		ultratracker V1.%.1s module sound data
4444!:mime	audio/x-mod
4445#audio/x-tracker-module
4446
44470	string	UN05		MikMod UNI format module sound data
4448
44490	string	Extended\ Module: Fasttracker II module sound data
4450!:mime	audio/x-mod
4451#audio/x-tracker-module
4452>17	string	>\0		Title: "%s"
4453
445421	string/c	=!SCREAM!	Screamtracker 2 module sound data
4455!:mime	audio/x-mod
4456#audio/x-screamtracker-module
445721	string	BMOD2STM	Screamtracker 2 module sound data
4458!:mime	audio/x-mod
4459#audio/x-screamtracker-module
44601080	string	M.K.		4-channel Protracker module sound data
4461!:mime	audio/x-mod
4462#audio/x-protracker-module
4463>0	string	>\0		Title: "%s"
44641080	string	M!K!		4-channel Protracker module sound data
4465!:mime	audio/x-mod
4466#audio/x-protracker-module
4467>0	string	>\0		Title: "%s"
44681080	string	FLT4		4-channel Startracker module sound data
4469!:mime	audio/x-mod
4470#audio/x-startracker-module
4471>0	string	>\0		Title: "%s"
44721080	string	FLT8		8-channel Startracker module sound data
4473!:mime	audio/x-mod
4474#audio/x-startracker-module
4475>0	string	>\0		Title: "%s"
44761080	string	4CHN		4-channel Fasttracker module sound data
4477!:mime	audio/x-mod
4478#audio/x-fasttracker-module
4479>0	string	>\0		Title: "%s"
44801080	string	6CHN		6-channel Fasttracker module sound data
4481!:mime	audio/x-mod
4482#audio/x-fasttracker-module
4483>0	string	>\0		Title: "%s"
44841080	string	8CHN		8-channel Fasttracker module sound data
4485!:mime	audio/x-mod
4486#audio/x-fasttracker-module
4487>0	string	>\0		Title: "%s"
44881080	string	CD81		8-channel Octalyser module sound data
4489!:mime	audio/x-mod
4490#audio/x-octalysertracker-module
4491>0	string	>\0		Title: "%s"
44921080	string	OKTA		8-channel Octalyzer module sound data
4493!:mime	audio/x-mod
4494#audio/x-octalysertracker-module
4495>0	string	>\0		Title: "%s"
4496# Not good enough.
4497#1082	string	CH
4498#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
44991080	string	16CN		16-channel Taketracker module sound data
4500!:mime	audio/x-mod
4501#audio/x-taketracker-module
4502>0	string	>\0		Title: "%s"
45031080	string	32CN		32-channel Taketracker module sound data
4504!:mime	audio/x-mod
4505#audio/x-taketracker-module
4506>0	string	>\0		Title: "%s"
4507
4508# TOC sound files -Trevor Johnson <trevor@jpj.net>
4509#
45100       string          TOC             TOC sound file
4511
4512# sidfiles <pooka@iki.fi>
4513# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
45140	string		SIDPLAY\ INFOFILE	Sidplay info file
4515
45160	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
4517>4	beshort		>0			w/ header v%d,
4518>14	beshort		=1			single song,
4519>14	beshort		>1			%d songs,
4520>16	beshort		>0			default song: %d
4521>0x16	string		>\0			name: "%s"
4522>0x36	string		>\0			author: "%s"
4523>0x56	string		>\0			copyright: "%s"
4524
45250	string		RSID			RSID sidtune PlaySID compatible
4526>4	beshort		>0			w/ header v%d,
4527>14	beshort		=1			single song,
4528>14	beshort		>1			%d songs,
4529>16	beshort		>0			default song: %d
4530>0x16	string		>\0			name: "%s"
4531>0x36	string		>\0			author: "%s"
4532>0x56	string		>\0			copyright: "%s"
4533
4534# IRCAM sound files - Michael Pruett <michael@68k.org>
4535# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
45360	belong		0x64a30100		IRCAM file (VAX little-endian)
45370	belong		0x0001a364		IRCAM file (VAX big-endian)
45380	belong		0x64a30200		IRCAM file (Sun big-endian)
45390	belong		0x0002a364		IRCAM file (Sun little-endian)
45400	belong		0x64a30300		IRCAM file (MIPS little-endian)
45410	belong		0x0003a364		IRCAM file (MIPS big-endian)
45420	belong		0x64a30400		IRCAM file (NeXT big-endian)
45430	belong		0x64a30400		IRCAM file (NeXT big-endian)
45440	belong		0x0004a364		IRCAM file (NeXT little-endian)
4545
4546# NIST SPHERE <mpruett@sgi.com>
45470	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
4548
4549# Sample Vision <mpruett@sgi.com>
45500	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
4551
4552# Audio Visual Research <tonigonenstein@users.sourceforge.net>
45530	string		2BIT			Audio Visual Research file,
4554>12	beshort		=0			mono,
4555>12	beshort		=-1			stereo,
4556>14	beshort		x			%d bits
4557>16	beshort		=0			unsigned,
4558>16	beshort		=-1			signed,
4559>22	belong&0x00ffffff	x		%d Hz,
4560>18	beshort		=0			no loop,
4561>18	beshort		=-1			loop,
4562>21	ubyte		<128			note %d,
4563>22	byte		=0			replay 5.485 KHz
4564>22	byte		=1			replay 8.084 KHz
4565>22	byte		=2			replay 10.971 KHz
4566>22	byte		=3			replay 16.168 KHz
4567>22	byte		=4			replay 21.942 KHz
4568>22	byte		=5			replay 32.336 KHz
4569>22	byte		=6			replay 43.885 KHz
4570>22	byte		=7			replay 47.261 KHz
4571
4572# SGI SoundTrack <mpruett@sgi.com>
45730	string		_SGI_SoundTrack		SGI SoundTrack project file
4574# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
45750	string		ID3	Audio file with ID3 version 2
4576>3	byte		x	\b.%d
4577>4	byte		x	\b.%d
4578>>5	byte		&0x80	\b, unsynchronized frames
4579>>5	byte		&0x40	\b, extended header
4580>>5	byte		&0x20	\b, experimental
4581>>5	byte		&0x10	\b, footer present
4582>(6.I+10)	indirect	x	\b, contains:
4583
4584# NSF (NES sound file) magic
45850	string		NESM\x1a	NES Sound File
4586>14	string		>\0		("%s" by
4587>46	string		>\0		%s, copyright
4588>78	string		>\0		%s),
4589>5	byte		x		version %d,
4590>6	byte		x		%d tracks,
4591>122	byte&0x2	=1		dual PAL/NTSC
4592>122	byte&0x1	=1		PAL
4593>122	byte&0x1	=0		NTSC
4594
4595# NSFE (Extended NES sound file) magic
4596# http://slickproductions.org/docs/NSF/nsfespec.txt
4597# From: David Pflug <david@pflug.email>
45980	string		NSFE		Extended NES Sound File
4599>48	search/0x1000	auth
4600>>&0	string		>\0		("%s"
4601>>>&1	string		>\0		by %s
4602>>>>&1	string		>\0		\b, copyright %s
4603>>>>>&1	string		>\0		\b, ripped by %s
4604>20	byte		x		\b), %d tracks,
4605>18	byte&0x2	=1		dual PAL/NTSC
4606>18     byte&0x2	=0
4607>>18	byte&0x1	=1		PAL
4608>>18	byte&0x1	=0		NTSC
4609
4610# Type: SNES SPC700 sound files
4611# From: Josh Triplett <josh@freedesktop.org>
46120	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
4613>&0	string	0.30					\b, version %s
4614>>0x23	byte	0x1B					\b, without ID666 tag
4615>>0x23	byte	0x1A					\b, with ID666 tag
4616>>>0x2E	string	>\0					\b, song "%.32s"
4617>>>0x4E	string	>\0					\b, game "%.32s"
4618
4619# Impulse tracker module (audio/x-it)
46200	string		IMPM		Impulse Tracker module sound data -
4621!:mime	audio/x-mod
4622>4	string		>\0		"%s"
4623>40	leshort		!0		compatible w/ITv%x
4624>42	leshort		!0		created w/ITv%x
4625
4626# Imago Orpheus module (audio/x-imf)
462760	string		IM10		Imago Orpheus module sound data -
4628>0	string		>\0		"%s"
4629
4630# From <collver1@attbi.com>
4631# These are the /etc/magic entries to decode modules, instruments, and
4632# samples in Impulse Tracker's native format.
4633
46340	string		IMPS		Impulse Tracker Sample
4635>18	byte		&2		16 bit
4636>18	byte		^2		8 bit
4637>18	byte		&4		stereo
4638>18	byte		^4		mono
46390	string		IMPI		Impulse Tracker Instrument
4640>28	leshort		!0		ITv%x
4641>30	byte		!0		%d samples
4642
4643# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
4644# From <collver1@attbi.com>
46450	string		LM8953		Yamaha TX Wave
4646>22	byte		0x49		looped
4647>22	byte		0xC9		non-looped
4648>23	byte		1		33kHz
4649>23	byte		2		50kHz
4650>23	byte		3		16kHz
4651
4652# scream tracker:  file(1) magic for Scream Tracker sample files
4653#
4654# From <collver1@attbi.com>
465576	string		SCRS		Scream Tracker Sample
4656>0	byte		1		sample
4657>0	byte		2		adlib melody
4658>0	byte		>2		adlib drum
4659>31	byte		&2		stereo
4660>31	byte		^2		mono
4661>31	byte		&4		16bit little endian
4662>31	byte		^4		8bit
4663>30	byte		0		unpacked
4664>30	byte		1		packed
4665
4666# audio
4667# From: Cory Dikkers <cdikkers@swbell.net>
46680	string		MMD0		MED music file, version 0
46690	string		MMD1		OctaMED Pro music file, version 1
46700	string		MMD3		OctaMED Soundstudio music file, version 3
46710	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
46720	string		MED		MED_Song
46730	string		SymM		Symphonie SymMOD music file
4674#
4675# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS)
4676# http://lclevy.free.fr/exotica/ahx/ahxformat.txt
46770	string		THX		AHX version
4678>3	byte		=0		1 module data
4679>3	byte		=1		2 module data
4680>10	byte		x		TRL: %u
4681>11	byte		x		TRK: %u
4682>12	byte		x		SMP: %u
4683>13	byte		x		SS: %u
4684#
46850	string		OKTASONG	Oktalyzer module data
4686#
46870	string		DIGI\ Booster\ module\0	%s
4688>20	byte		>0		%c
4689>>21	byte		>0		\b%c
4690>>>22	byte		>0		\b%c
4691>>>>23	byte		>0		\b%c
4692>610	string		>\0		\b, "%s"
4693#
46940	string		DBM0	   	DIGI Booster Pro Module
4695>4	byte		>0		V%X.
4696>>5	byte		x		\b%02X
4697>16	string		>\0		\b, "%s"
4698#
46990	string		FTMN		FaceTheMusic module
4700>16	string		>\0d		\b, "%s"
4701
4702# From: <doj@cubic.org> 2003-06-24
47030	string		AMShdr\32	Velvet Studio AMS Module v2.2
47040	string		Extreme		Extreme Tracker AMS Module v1.3
47050	string		DDMF		Xtracker DMF Module
4706>4	byte		x		v%i
4707>0xD	string		>\0		Title: "%s"
4708>0x2B	string		>\0		Composer: "%s"
47090	string		DSM\32		Dynamic Studio Module DSM
47100	string		SONG		DigiTrekker DTM Module
47110	string		DMDL		DigiTrakker MDL Module
47120	string		PSM\32		Protracker Studio PSM Module
471344	string		PTMF		Poly Tracker PTM Module
4714>0	string		>\32		Title: "%s"
47150	string		MT20		MadTracker 2.0 Module MT2
47160	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
47170	string		RTMM		RTM Module
47180x426	string		MaDoKaN96	XMS Adlib Module
4719>0	string		>\0		Composer: "%s"
47200	string		AMF		AMF Module
4721>4	string		>\0		Title: "%s"
47220	string		MODINFO1	Open Cubic Player Module Inforation MDZ
47230	string		Extended\40Instrument: Fast Tracker II Instrument
4724
4725# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
4726# NOA Nancy Codec file
47270	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
4728# Yamaha SMAF format
47290	string		MMMD		Yamaha SMAF file
4730# Sharp Jisaku Melody format for PDC
47310	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
4732>20	string		Ver01.00	Ver. 1.00
4733>>32	byte		x		, %d tracks
4734
4735# Free lossless audio codec <http://flac.sourceforge.net>
4736# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
47370	string			fLaC		FLAC audio bitstream data
4738!:mime	audio/flac
4739>4	byte&0x7f		>0		\b, unknown version
4740>4	byte&0x7f		0		\b
4741# some common bits/sample values
4742>>20	beshort&0x1f0		0x030		\b, 4 bit
4743>>20	beshort&0x1f0		0x050		\b, 6 bit
4744>>20	beshort&0x1f0		0x070		\b, 8 bit
4745>>20	beshort&0x1f0		0x0b0		\b, 12 bit
4746>>20	beshort&0x1f0		0x0f0		\b, 16 bit
4747>>20	beshort&0x1f0		0x170		\b, 24 bit
4748>>20	byte&0xe		0x0		\b, mono
4749>>20	byte&0xe		0x2		\b, stereo
4750>>20	byte&0xe		0x4		\b, 3 channels
4751>>20	byte&0xe		0x6		\b, 4 channels
4752>>20	byte&0xe		0x8		\b, 5 channels
4753>>20	byte&0xe		0xa		\b, 6 channels
4754>>20	byte&0xe		0xc		\b, 7 channels
4755>>20	byte&0xe		0xe		\b, 8 channels
4756# sample rates derived from known oscillator frequencies;
4757# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
4758# 16.384 (other/fs=32kHz).
4759>>17	belong&0xfffff0       	0x02b110	\b, 11.025 kHz
4760>>17	belong&0xfffff0       	0x03e800	\b, 16 kHz
4761>>17	belong&0xfffff0       	0x056220	\b, 22.05 kHz
4762>>17	belong&0xfffff0       	0x05dc00	\b, 24 kHz
4763>>17	belong&0xfffff0       	0x07d000	\b, 32 kHz
4764>>17	belong&0xfffff0       	0x0ac440	\b, 44.1 kHz
4765>>17	belong&0xfffff0       	0x0bb800	\b, 48 kHz
4766>>17	belong&0xfffff0       	0x0fa000	\b, 64 kHz
4767>>17	belong&0xfffff0       	0x158880	\b, 88.2 kHz
4768>>17	belong&0xfffff0       	0x177000	\b, 96 kHz
4769>>17	belong&0xfffff0       	0x1f4000	\b, 128 kHz
4770>>17	belong&0xfffff0       	0x2b1100	\b, 176.4 kHz
4771>>17	belong&0xfffff0       	0x2ee000	\b, 192 kHz
4772>>17	belong&0xfffff0       	0x3e8000	\b, 256 kHz
4773>>17	belong&0xfffff0       	0x562200	\b, 352.8 kHz
4774>>17	belong&0xfffff0       	0x5dc000	\b, 384 kHz
4775>>21	byte&0xf		>0		\b, >4G samples
4776>>21	byte&0xf		0		\b
4777>>>22	belong			>0		\b, %u samples
4778>>>22	belong			0		\b, length unknown
4779
4780# (ISDN) VBOX voice message file (Wolfram Kleff)
47810       string          VBOX            VBOX voice message data
4782
4783# ReBorn Song Files (.rbs)
4784# David J. Singer <doc@deadvirgins.org.uk>
47858       string          RB40             RBS Song file
4786>29     string          ReBorn           created by ReBorn
4787>37     string          Propellerhead    created by ReBirth
4788
4789# Synthesizer Generator and Kimwitu share their file format
47900	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
4791# Kimwitu++ uses a slightly different magic
47920	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
4793
4794# From "Simon Hosie
47950       string  TFMX-SONG       TFMX module sound data
4796
4797# Monkey's Audio compressed audio format (.ape)
4798# From danny.milo@gmx.net (Danny Milosavljevic)
4799# New version from Abel Cheung <abel (@) oaka.org>
48000		string		MAC\040		Monkey's Audio compressed format
4801!:mime audio/x-ape
4802>4		uleshort	>0x0F8B		version %d
4803>>(0x08.l)	uleshort	=1000		with fast compression
4804>>(0x08.l)	uleshort	=2000		with normal compression
4805>>(0x08.l)	uleshort	=3000		with high compression
4806>>(0x08.l)	uleshort	=4000		with extra high compression
4807>>(0x08.l)	uleshort	=5000		with insane compression
4808>>(0x08.l+18)	uleshort	=1		\b, mono
4809>>(0x08.l+18)	uleshort	=2		\b, stereo
4810>>(0x08.l+20)	ulelong		x		\b, sample rate %d
4811>4		uleshort	<0x0F8C		version %d
4812>>6		uleshort	=1000		with fast compression
4813>>6		uleshort	=2000		with normal compression
4814>>6		uleshort	=3000		with high compression
4815>>6		uleshort	=4000		with extra high compression
4816>>6		uleshort	=5000		with insane compression
4817>>10		uleshort	=1		\b, mono
4818>>10		uleshort	=2		\b, stereo
4819>>12		ulelong		x		\b, sample rate %d
4820
4821# adlib sound files
4822# From: Alex Myczko <alex@aiei.ch>
4823
4824# https://github.com/rerrahkr/BambooTracker
48250	string		BambooTrackerMod	BambooTracker module
4826>22	byte	x	\b, version %u
4827>21	byte	x	\b.%u
4828>20	byte	x	\b.%u
4829
48300	string		BambooTrackerIst	BambooTracker instrument
4831>22	byte	x	\b, version %u
4832>21	byte	x	\b.%u
4833>20	byte	x	\b.%u
4834
48350	string		CC2x		CheeseCutter 2 song
4836
48370    	string		RAWADATA	RdosPlay RAW
4838
48391068	string		RoR		AMUSIC Adlib Tracker
4840
48410	string		JCH		EdLib
4842
48430	string		mpu401tr	MPU-401 Trakker
4844
48450	string		SAdT		Surprise! Adlib Tracker
4846>4	byte		x		Version %d
4847
48480	string		XAD!		eXotic ADlib
4849
48500	string		ofTAZ!		eXtra Simple Music
4851
48520	string		FMK!		FM Kingtracker Song
4853
48540	string		DFM		DFM Song
4855
48560	string		\<CUD-FM-File\>	CFF Song
4857
48580	string		_A2module	A2M Song
4859
4860# Spectrum 128 tunes (.ay files).
4861# From: Emanuel Haupt <ehaupt@critical.ch>
48620	string		ZXAYEMUL	Spectrum 128 tune
4863
48640	string		\0BONK		BONK,
4865#>5	byte		x		version %d
4866>14	byte		x		%d channel(s),
4867>15	byte		=1		lossless,
4868>15	byte		=0		lossy,
4869>16	byte		x		mid-side
4870
4871384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
4872
4873# format VQF (proprietary codec for sound)
4874# some infos on the header file available at :
4875# http://www.twinvq.org/english/technology_format.html
48760	string		TWIN97012000	VQF data
4877>27	short		0		\b, Mono
4878>27	short		1		\b, Stereo
4879>31	short 		>0		\b, %d kbit/s
4880>35	short 		>0		\b, %d kHz
4881
4882# Nelson A. de Oliveira (naoliv@gmail.com)
4883# .eqf
48840	string	Winamp\ EQ\ library\ file	%s
4885# it will match only versions like v<digit>.<digit>
4886# Since I saw only eqf files with version v1.1 I think that it's OK
4887>23	string	x	\b%.4s
4888# .preset
48890	string	[Equalizer\ preset]	XMMS equalizer preset
4890# .m3u
48910	search/1	#EXTM3U 	M3U playlist text
4892# .pls
48930	search/1	[playlist]	PLS playlist text
4894# licq.conf
48951	string	[licq]			LICQ configuration file
4896
4897# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
4898# NOTE: Most SNDH music is packed using ICE, which has
4899# magic numbers "ICE!" and "Ice!". Some SNDH music is
4900# not packed, so we check for both packed and unpacked.
490112	string			SNDH	SNDH Atari ST music
49020	belong&0xFFDFDFFF	0x49434521
4903>14	search/40		NDH	SNDH Atari ST music
4904>14	search/40		TITL	SNDH Atari ST music
49050	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
4906
4907# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
49080       string          MP+     Musepack audio (MP+)
4909!:mime	audio/x-musepack
4910>3      byte            255     \b, SV pre8
4911>3      byte&0xF        0x6     \b, SV 6
4912>3      byte&0xF        0x8     \b, SV 8
4913>3      byte&0xF        0x7     \b, SV 7
4914>>3     byte&0xF0       0x0     \b.0
4915>>3     byte&0xF0       0x10    \b.1
4916>>3     byte&0xF0       240     \b.15
4917>>10    byte&0xF0       0x0     \b, no profile
4918>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
4919>>10    byte&0xF0       0x50    \b, quality 0
4920>>10    byte&0xF0       0x60    \b, quality 1
4921>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
4922>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
4923>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
4924>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
4925>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
4926>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
4927>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
4928>>10    byte&0xF0       0xE0    \b, quality 9
4929>>10    byte&0xF0       0xF0    \b, quality 10
4930>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
4931>>27    byte            102     \b, Beta 1.02
4932>>27    byte            104     \b, Beta 1.04
4933>>27    byte            105     \b, Alpha 1.05
4934>>27    byte            106     \b, Beta 1.06
4935>>27    byte            110     \b, Release 1.1
4936>>27    byte            111     \b, Alpha 1.11
4937>>27    byte            112     \b, Beta 1.12
4938>>27    byte            113     \b, Alpha 1.13
4939>>27    byte            114     \b, Beta 1.14
4940>>27    byte            115     \b, Alpha 1.15
4941
49420       string          MPCK    Musepack audio (MPCK)
4943!:mime	audio/x-musepack
4944
4945# IMY
4946# from http://filext.com/detaillist.php?extdetail=IMY
4947# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
4948# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
4949# http://www.wx800.com/msg/download/irda/iMelody.pdf
49500	string	BEGIN:IMELODY	iMelody Ringtone Format
4951
4952# From: "Mateus Caruccio" <mateus@caruccio.com>
4953# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
49540	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
4955
4956# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
495760	string	SONG		SoundFX Module sound file
4958
4959# Type: Adaptive Multi-Rate Codec
4960# URL:  http://filext.com/detaillist.php?extdetail=AMR
4961# From: Russell Coker <russell@coker.com.au>
49620	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
4963!:mime	audio/amr
4964!:ext  amr
4965
4966# Type: SuperCollider 3 Synth Definition File Format
4967# From: Mario Lang <mlang@debian.org>
49680	string	SCgf	SuperCollider3 Synth Definition file,
4969>4	belong	x	version %d
4970
4971# Type: True Audio Lossless Audio
4972# URL:  https://wiki.multimedia.cx/index.php?title=True_Audio
4973# From: Mike Melanson <mike@multimedia.cx>
49740	string	TTA1	True Audio Lossless Audio
4975
4976# Type: WavPack Lossless Audio
4977# URL:  https://wiki.multimedia.cx/index.php?title=WavPack
4978# From: Mike Melanson <mike@multimedia.cx>
49790	string	wvpk	WavPack Lossless Audio
4980
4981# From Fabio R. Schmidlin <frs@pop.com.br>
4982# VGM music file
49830	string		Vgm\040
4984>9	ubyte		>0	VGM Video Game Music dump v
4985!:mime	audio/x-vgm
4986!:ext	vgm
4987>>9	ubyte/16	>0	\b%d
4988>>9	ubyte&0x0F	x	\b%d
4989>>8	ubyte/16	x	\b.%d
4990>>8	ubyte&0x0F	>0	\b%d
4991#Get soundchips
4992>>8	ubyte		x	\b, soundchip(s)=
4993>>0x0C	ulelong		>0	SN76489,
4994>>0x10	ulelong		>0	YM2413,
4995>>0x2C	ulelong		>0	YM2612,
4996>>0x30	ulelong		>0	YM2151,
4997>>0x38	ulelong		>0	Sega PCM,
4998>>0x34	ulelong		>0xC
4999>>>0x40	ulelong		>0	RF5C68,
5000>>0x34	ulelong		>0x10
5001>>>0x44	ulelong		>0	YM2203,
5002>>0x34	ulelong		>0x14
5003>>>0x48	ulelong		>0	YM2608,
5004>>0x34	ulelong		>0x18
5005>>>0x4C	lelong		>0	YM2610,
5006>>>0x4C	lelong		<0	YM2610B,
5007>>0x34	ulelong		>0x1C
5008>>>0x50	ulelong		>0	YM3812,
5009>>0x34	ulelong		>0x20
5010>>>0x54	ulelong		>0	YM3526,
5011>>0x34	ulelong		>0x24
5012>>>0x58	ulelong		>0	Y8950,
5013>>0x34	ulelong		>0x28
5014>>>0x5C	ulelong		>0	YMF262,
5015>>0x34	ulelong		>0x2C
5016>>>0x60	ulelong		>0	YMF278B,
5017>>0x34	ulelong		>0x30
5018>>>0x64	ulelong		>0	YMF271,
5019>>0x34	ulelong		>0x34
5020>>>0x68	ulelong		>0	YMZ280B,
5021>>0x34	ulelong		>0x38
5022>>>0x6C	ulelong		>0	RF5C164,
5023>>0x34	ulelong		>0x3C
5024>>>0x70	ulelong		>0	PWM,
5025>>0x34	ulelong		>0x40
5026>>>0x74	ulelong		>0
5027>>>>0x78 ubyte		0x00	AY-3-8910,
5028>>>>0x78 ubyte		0x01	AY-3-8912,
5029>>>>0x78 ubyte		0x02	AY-3-8913,
5030>>>>0x78 ubyte		0x03	AY-3-8930,
5031>>>>0x78 ubyte		0x10	YM2149,
5032>>>>0x78 ubyte		0x11	YM3439,
5033>>>>0x78 ubyte		0x12	YMZ284,
5034>>>>0x78 ubyte		0x13	YMZ294,
5035# VGM 1.61
5036>>0x34	ulelong		>0x4C
5037>>>0x80	ulelong		>0	DMG,
5038>>0x34	ulelong		>0x50
5039>>>0x84	lelong		>0	NES APU,
5040>>>0x84	lelong		<0	NES APU with FDS,
5041>>0x34	ulelong		>0x54
5042>>>0x88	ulelong		>0	MultiPCM,
5043>>0x34	ulelong		>0x58
5044>>>0x8C	ulelong		>0	uPD7759,
5045>>0x34	ulelong		>0x5C
5046>>>0x90	ulelong		>0	OKIM6258,
5047>>0x34	ulelong		>0x64
5048>>>0x98	ulelong		>0	OKIM6295,
5049>>0x34	ulelong		>0x68
5050>>>0x9C	ulelong		>0	K051649,
5051>>0x34	ulelong		>0x6C
5052>>>0xA0	ulelong		>0	K054539,
5053>>0x34	ulelong		>0x70
5054>>>0xA4	ulelong		>0	HuC6280,
5055>>0x34	ulelong		>0x74
5056>>>0xA8	ulelong		>0	C140,
5057>>0x34	ulelong		>0x78
5058>>>0xAC	ulelong		>0	K053260,
5059>>0x34	ulelong		>0x7C
5060>>>0xB0	ulelong		>0	Pokey,
5061>>0x34	ulelong		>0x80
5062>>>0xB4	ulelong		>0	QSound,
5063# VGM 1.71
5064>>0x34	ulelong		>0x84
5065>>>0xB8	ulelong		>0	SCSP,
5066>>0x34	ulelong		>0x8C
5067>>>0xC0	ulelong		>0	WonderSwan,
5068>>0x34	ulelong		>0x90
5069>>>0xC4	ulelong		>0	VSU,
5070>>0x34	ulelong		>0x94
5071>>>0xC8	ulelong		>0	SAA1099,
5072>>0x34	ulelong		>0x98
5073>>>0xCC	ulelong		>0	ES5503,
5074>>0x34	ulelong		>0x9C
5075>>>0xD0	lelong		>0	ES5505,
5076>>>0xD0	lelong		<0	ES5506,
5077>>0x34	ulelong		>0xA4
5078>>>0xD8	ulelong		>0	X1-010,
5079>>0x34	ulelong		>0xA8
5080>>>0xDC	ulelong		>0	C352,
5081>>0x34	ulelong		>0xAC
5082>>>0xE0	ulelong		>0	GA20,
5083
5084# GVOX Encore file format
5085# Since this is a proprietary file format and there is no publicly available
5086# format specification, this is just based on induction
5087#
50880	string	SCOW
5089>4	byte	0xc4	GVOX Encore music, version 5.0 or above
5090>4	byte	0xc2	GVOX Encore music, version < 5.0
5091
50920	string	ZBOT
5093>4	byte	0xc5	GVOX Encore music, version < 5.0
5094
5095# Summary:	Garmin Voice Processing Module (WAVE audios)
5096# From:		Joerg Jenderek
5097# URL:		https://www.garmin.com/
5098# Reference:	http://www.poi-factory.com/node/19580
5099# NOTE:		there exist 2 other Garmin VPM formats
51000		string	AUDIMG
5101# skip text files starting with string "AUDIMG"
5102>13		ubyte		<13	Garmin Voice Processing Module
5103!:mime	audio/x-vpm-wav-garmin
5104!:ext	vpm
5105# 3 bytes indicating the voice version (200,220)
5106>>6		string		x	\b, version %3.3s
5107# day of release (01-31)
5108>>12		ubyte		x	\b, %.2d
5109# month of release (01-12)
5110>>13		ubyte		x	\b.%.2d
5111# year of release (like 2006, 2007, 2008)
5112>>14		uleshort	x	\b.%.4d
5113# hour of release (0-23)
5114>>11		ubyte		x	%.2d
5115# minute of release (0-59)
5116>>10		ubyte		x	\b:%.2d
5117# second of release (0-59)
5118>>9		ubyte		x	\b:%.2d
5119# if you select a language like german on your garmin device
5120# you can only select voice modules with corresponding language byte ID like 1
5121>>18		ubyte		x	\b, language ID %d
5122# structure for phrases/sentences?
5123# number of voice sample in the 1st phrase?
5124#>>19		uleshort		x	\b, 0x%x samples
5125#>>>21		uleshort		>0	\b, at 0x%4.4x
5126#>>>(21.s)	ubequad			x	0x%llx
5127# 2nd phrase?
5128#>>23		uleshort		x	\b, 0x%x samples
5129#>>>25		uleshort		>0	\b, at 0x%4.4x
5130#>>>(25.s)	ubequad			x	0x%llx
5131# pointer to 1st audio WAV sample
5132>>16		uleshort	>0
5133>>>(16.s)	ulelong		>0	\b, at 0x%x
5134# WAV length
5135# 1 space char after "bytes" to get phrase "bytes RIFF"
5136>>>>(16.s+4)	ulelong		>0	%u bytes
5137# look for magic
5138>>>>>(&-8.l)	string		RIFF
5139# determine type by ./riff
5140>>>>>>&-4	indirect	x
5141# 2 - ~ 131 WAV samples following same way
5142#
5143# Summary:	encrypted Garmin Voice Processing Module
5144# From:		Joerg Jenderek
5145# URL:		https://www.garmin.com/us/products/ontheroad/voicestudio
5146# NOTE:		Encrypted variant used in voices like DrNightmare, Elfred, Yeti.
5147#		There exist 2 other Garmin VPM formats
51480	ubequad		0xa141190fecc8ced6	Garmin Voice Processing Module (encrypted)
5149!:mime	audio/x-vpm-garmin
5150!:ext	vpm
5151
5152# From Martin Mueller Skarbiniks Pedersen
51530		string		GDM
5154>0x3		byte		0xFE	General Digital Music.
5155>0x4		string		>\0	title: "%s"
5156>0x24		string		>\0	musician: "%s"
5157>>0x44		beshort		0x0D0A
5158>>>0x46		byte		0x1A
5159>>>>0x47	string		GMFS	Version
5160>>>>0x4B	byte		x	%d.
5161>>>>0x4C	byte		x	\b%02d
5162>>>>0x4D	beshort		0x000	(2GDM v
5163>>>>0x4F	byte		x	\b%d.
5164>>>>>0x50	byte		x	\b%d)
5165
51660		string		MTM	Multitracker
5167>0x3		byte/16		x	Version %d.
5168>0x3		byte&0x0F	x	\b%02d
5169>>0x4		string		>\0	title: "%s"
5170
51710		string		HVL
5172>3		byte		<2	Hively Tracker Song
5173>3		byte		0	1 module data
5174>3		byte		1	2 module data
5175
51760		string		MO3
5177>3		ubyte		<6	MOdule with MP3
5178>>3		byte		0	Version	0	(With MP3 and lossless)
5179>>3		byte		1	Version	1	(With ogg and lossless)
5180>>3		byte		3	Version 2.2
5181>>3		byte		4	(With no LAME header)
5182>>3		byte		5	Version 2.4
5183
51840		string		ADRVPACK	AProSys	module
5185
5186# ftp://ftp.modland.com/pub/documents/format_documentation/\
5187# Art%20Of%20Noise%20(.aon).txt
51880		string		AON
5189>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
5190>0x2e		string		NAME	Art of Noise Tracker Song
5191>3		string		<9
5192>3		string		4	(4 voices)
5193>3		string		8	(8 voices)
5194>>0x36		string		>\0	Title: "%s"
5195
51960		string		FAR
5197>0x2c		byte		0x0d
5198>0x2d		byte		0x0a
5199>0x2e		byte		0x1a
5200>>0x3		byte		0xFE	Farandole Tracker Song
5201>>>0x31		byte/16		x	Version %d.
5202>>>0x31		byte&0x0F	x	\b%02d
5203>>>>0x4		string		>\0	\b, title: "%s"
5204
5205# magic for Klystrack, https://kometbomb.github.io/klystrack/
5206# from Alex Myczko <alex@aiei.ch>
52070	string	cyd!song	Klystrack song
5208>8	byte	>0		\b, version %u
5209>8	byte	>26
5210#>>9	byte	x		\b, channels %u
5211#>>10	leshort	x		\b, time signature %u
5212#>>12	leshort	x		\b, sequence step %u
5213#>>14	byte	x		\b, instruments %u
5214#>>15	leshort	x		\b, patterns %u
5215#>>17	leshort	x		\b, sequences %u
5216#>>19	leshort	x		\b, length %u
5217#>>21	leshort	x		\b, loop point %u
5218#>>23	byte	x		\b, master volume %u
5219#>>24	byte	x		\b, song speed %u
5220#>>25	byte	x		\b, song speed2 %u
5221#>>26	byte	x		\b, song rate %u
5222#>>27	belong	x		\b, flags %#x
5223#>>31	byte	x		\b, multiplex period %u
5224#>>32	byte	x		\b, pitch inaccuracy %u
5225>>149	pstring	x		\b, title %s
5226
52270	string	cyd!inst	Klystrack instrument
5228
5229# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
5230# see Specifications/WOPL-and-OPLI-Specification.txt
5231
52320	string	WOPL3-INST\0	WOPL instrument
5233>11	leshort	x	\b, version %u
52340	string	WOPL3-BANK\0	WOPL instrument bank
5235>11	leshort	x	\b, version %u
5236
5237# AdLib/OPL instrument files. Format specifications on
5238#  http://www.shikadi.net/moddingwiki
52390	string	Junglevision\ Patch\ File	Junglevision instrument data
52400	string	#OPL_II#	DMX OP2 instrument data
52410	string	IBK\x1a		IBK instrument data
52420	string	2OP\x1a		IBK instrument data, 2 operators
52430	string	4OP\x1a		IBK instrument data, 4 operators
52442	string	ADLIB-		AdLib instrument data
5245>0	byte	x		\b, version %u
5246>1	byte	x		\b.%u
5247
5248# CRI ADX ADPCM audio
5249# Used by various Sega games.
5250# https://en.wikipedia.org/wiki/ADX_(file_format)
5251# https://wiki.multimedia.cx/index.php/CRI_ADX_file
5252# Added by David Korth <gerbilsoft@gerbilsoft.com>
52530x00		beshort		0x8000
5254>(2.S-2)	string		(c)CRI		CRI ADX ADPCM audio
5255!:ext adx
5256!:mime audio/x-adx
5257!:strength +50
5258>>0x12		byte		x		v%u
5259>>0x04		byte		0x02		\b, pre-set prediction coefficients
5260>>0x04		byte		0x03		\b, standard ADX
5261>>0x04		byte		0x04		\b, exponential scale
5262>>0x04		byte		0x10		\b, AHX (Dreamcast)
5263>>0x04		byte		0x11		\b, AHX
5264>>0x08		belong		x		\b, %u Hz
5265>>0x12		byte		0x03
5266>>>0x02		beshort		>0x2B
5267>>>>0x18	belong		!0		\b, looping
5268>>0x12		byte		0x04
5269>>>0x02		beshort		>0x37
5270>>>>0x24	belong		!0		\b, looping
5271>>0x13		byte&0x08	0x08		\b, encrypted
5272
5273# Lossless audio (.la) (http://www.lossless-audio.com/)
52740	string	LA
5275>2	string	03	Lossless audio version 0.3
5276>2	string	04	Lossless audio version 0.4
5277
5278# Sony PlayStation Audio (.xa)
52790	leshort 0x4158	Sony PlayStation Audio
5280
5281# Portable Sound Format
5282# Used for audio rips for various consoles.
5283# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
5284# Added by David Korth <gerbilsoft@gerbilsoft.com>
52850	string	PSF
5286>3	byte	0x01
5287>3	byte	0x02
5288>3	byte	0x11
5289>3	byte	0x12
5290>3	byte	0x13
5291>3	byte	0x21
5292>3	byte	0x22
5293>3	byte	0x23
5294>3	byte	0x41
5295>>0	string	PSF	Portable Sound Format
5296!:mime	audio/x-psf
5297>>>3	byte	0x01	(Sony PlayStation)
5298>>>3	byte	0x02	(Sony PlayStation 2)
5299>>>3	byte	0x11	(Sega Saturn)
5300>>>3	byte	0x12	(Sega Dreamcast)
5301>>>3	byte	0x13	(Sega Mega Drive)
5302>>>3	byte	0x21	(Nintendo 64)
5303>>>3	byte	0x22	(Game Boy Advance)
5304>>>3	byte	0x23	(Super NES)
5305>>>3	byte	0x41	(Capcom QSound)
5306
5307# Atari 8-bit SAP audio format
5308# http://asap.sourceforge.net/sap-format.html
5309# Added by David Korth <gerbilsoft@gerbilsoft.com>
53100	string		SAP\r\n	Atari 8-bit SAP audio file
5311!:mime	audio/x-sap
5312!:ext	sap
5313>5	search/1024	NAME
5314>>&1	string		x	\b: %s
5315>>5	search/1024	AUTHOR
5316>>>&1	string		x	by %s
5317
5318# Nintendo Wii BRSTM audio format (fields)
5319# NOTE: Assuming HEAD starts at 0x40.
5320# FIXME: Replace 0x48 with HEAD offset plus 8.
53210	name	nintendo-wii-brstm-fields
5322>(0x10.L)	string	HEAD	\b:
5323>>(0x10.L+0x0C)	belong	x
5324>>>(&-4.L+0x48)	belong	x
5325>>>>&-4		byte	0	PCM, signed 8-bit,
5326>>>>&-4		byte	1	PCM, signed 16-bit,
5327>>>>&-4		byte	2	THP ADPCM,
5328>>>>&-3		byte	!0	looping,
5329>>>>&-2		byte	1	mono
5330>>>>&-2		byte	2	stereo
5331>>>>&-2		byte	3	3 channels
5332>>>>&-2		byte	4	quad
5333>>>>&-2		byte	>4	%u channels
5334>>>>&0		beshort	!0	%u Hz
5335
5336# Nintendo Wii BRSTM audio format
5337# https://wiibrew.org/wiki/BRSTM_file
5338# Added by David Korth <gerbilsoft@gerbilsoft.com>
53390	string		RSTM	Nintendo Wii BRSTM audio file
5340!:mime	audio/x-brstm
5341!:ext	brstm
5342# Wii is big-endian, so default to BE.
5343>4	beshort		0xFEFF
5344>>0	use		nintendo-wii-brstm-fields
5345>4	leshort		0xFEFF
5346>>0	use		\^nintendo-wii-brstm-fields
5347
5348# Nintendo 3DS BCSTM audio format (fields)
53490	name	nintendo-3ds-bcstm-fields
5350>(0x18.l)	string	INFO	\b:
5351# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic)
5352>>&0x1C		byte	0	PCM, signed 8-bit,
5353>>&0x1C		byte	1	PCM, signed 16-bit,
5354>>&0x1C		byte	2	DSP ADPCM,
5355>>&0x1C		byte	3	IMA ADPCM,
5356>>&0x1D		byte	!0	looping,
5357>>&0x1E		byte	1	mono
5358>>&0x1E		byte	2	stereo
5359>>&0x1E		byte	3	3 channels
5360>>&0x1E		byte	4	quad
5361>>&0x1E		byte	>4	%u channels
5362>>&0x20		lelong	!0	%u Hz
5363
5364# Nintendo 3DS BCSTM audio format
5365# https://www.3dbrew.org/wiki/BCSTM
5366# Added by David Korth <gerbilsoft@gerbilsoft.com>
53670	string		CSTM	Nintendo 3DS BCSTM audio file
5368!:mime	audio/x-bcstm
5369!:ext	bcstm
5370# 3DS is little-endian, so default to LE.
5371>4	leshort		0xFEFF
5372>>0	use		nintendo-3ds-bcstm-fields
5373>4	beshort		0xFEFF
5374>>0	use		\^nintendo-3ds-bcstm-fields
5375
5376# Nintendo Wii U BFSTM audio format
5377# http://mk8.tockdom.com/wiki/BFSTM_(File_Format)
5378# NOTE: This format is very similar to BCSTM.
5379# Added by David Korth <gerbilsoft@gerbilsoft.com>
53800	string		FSTM	Nintendo Wii U BFSTM audio file
5381!:mime	audio/x-bfstm
5382!:ext	bfstm
5383# BFSTM is used on both Wii U (BE) and Switch (LE),
5384# so default to LE.
5385>4	leshort		0xFEFF
5386>>0	use		nintendo-3ds-bcstm-fields
5387>4	beshort		0xFEFF
5388>>0	use		\^nintendo-3ds-bcstm-fields
5389
5390# Nintendo 3DS BCSTM audio format (fields)
53910	name	nintendo-3ds-bcwav-fields
5392>(0x18.l)	string	INFO	\b:
5393# INFO block (minus 4 for INFO magic)
5394>>&0x4		byte	0	PCM, signed 8-bit,
5395>>&0x4		byte	1	PCM, signed 16-bit,
5396>>&0x4		byte	2	DSP ADPCM,
5397>>&0x4		byte	3	IMA ADPCM,
5398>>&0x5		byte	!0	looping,
5399>>&0x8		lelong	x	stereo
5400>>&0x8		lelong	!0	%u Hz
5401
5402# Nintendo 3DS BCWAV audio format
5403# https://www.3dbrew.org/wiki/BCWAV
5404# Added by David Korth <gerbilsoft@gerbilsoft.com>
54050	string		CWAV	Nintendo 3DS BCWAV audio file
5406!:mime	audio/x-bcwav
5407!:ext	bcwav
5408# 3DS is little-endian, so default to LE.
5409>4	leshort		0xFEFF
5410>>0	use		nintendo-3ds-bcwav-fields
5411>4	beshort		0xFEFF
5412>>0	use		\^nintendo-3ds-bcwav-fields
5413
5414#----------------------------------------------------------------
5415# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
5416# basis: file(1) magic for BBx/Pro5-files
5417#      Oliver Dammer <dammer@olida.de>	 2005/11/07
5418# https://www.basis.com business-basic-files.
5419#
54200	string		\074\074bbx\076\076	BBx
5421>7	string		\000			indexed file
5422>7	string		\001			serial file
5423>7	string		\002			keyed file
5424>>13	short		0			(sort)
5425>7	string		\004			program
5426>>18	byte		x			(LEVEL %d)
5427>>>23	string		>\000			psaved
5428>7	string		\006			mkeyed file
5429>>13	short		0			(sort)
5430>>8	string		\000			(mkey)
5431#------------------------------------------------------------------------------
5432# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
5433# beetle:  file(1) magic for Beetle VM object files
5434# https://github.com/rrthomas/beetle/
5435
5436# Beetle object module
54370	string		BEETLE\000	Beetle VM object file
5438
5439#------------------------------------------------------------------------------
5440# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
5441# ber:  file(1) magic for several BER formats used in the mobile
5442# telecommunications industry (Georg Sauthoff)
5443
5444# The file formats are standardized by the GSMA (GSM association).
5445# They are specified via ASN.1 schemas and some prose. Basic encoding
5446# rules (BER) is the used encoding. The formats are used for exchanging
5447# call data records (CDRs) between mobile operators and associated
5448# parties for roaming clearing purposes and fraud detection.
5449
5450# The magic file covers:
5451
5452# - TAP files (TD.57) - CDR batches and notifications
5453# - RAP files (TD.32) - return batches and acknowledgements
5454# - NRT files (TD.35) - CDR batches for 'near real time' processing
5455
5456#
5457# TAP 3 Files
5458# TAP -> Transferred Account Procedure
5459# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
5460# TransferBatch short tag
54610	byte	0x61
5462# BatchControlInfo short tag
5463>&1	search/b5	\x64
5464# Sender long tag #TAP 3.x (BER encoded)
5465>>&1	search/b8	\x5f\x81\x44
5466# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5467>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5468>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
5469
5470# Notification short tag
54710	byte	0x62
5472# Sender long tag
5473>2	search/b8	\x5f\x81\x44
5474# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5475>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5476>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
5477
5478
5479# NRT Files
5480# NRT a.k.a. NRTRDE
54810	byte	0x61
5482# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
5483>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
5484>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
5485
5486# RAP Files
5487# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
5488# Long ReturnBatch tag
54890	string	\x7f\x84\x16
5490# Long RapBatchControlInfo tag
5491>&1	search/b8	\x7f\x84\x19
5492# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
5493>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
5494# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
5495>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
5496>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
5497>>>&0	byte	x	TAP 3.%d
5498
5499# Long Acknowledgement tag
55000	string \x7f\x84\x17
5501# Long Sender tag
5502>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
5503
5504#------------------------------------------------------------------------------
5505# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
5506# bFLT: file(1) magic for BFLT uclinux binary files
5507#
5508# From Philippe De Muyter <phdm@macqel.be>
5509#
55100	string		bFLT		BFLT executable
5511>4	belong		x		- version %d
5512>4	belong		4
5513>>36	belong&0x1	0x1		ram
5514>>36	belong&0x2	0x2		gotpic
5515>>36	belong&0x4	0x4		gzip
5516>>36	belong&0x8	0x8		gzdata
5517
5518#------------------------------------------------------------------------------
5519# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
5520# BlockHashLoc
5521# ext: bhl
5522# Marco Pontello marcopon@gmail.com
5523# reference: https://github.com/MarcoPon/BlockHashLoc
55240	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
5525>13	byte	x			version %d
5526!:ext   bhl
5527
5528#------------------------------------------------------------------------------
5529# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
5530# bioinfomatics:  file(1) magic for Bioinfomatics file formats
5531
5532###############################################################################
5533# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
5534# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5535###############################################################################
55360	string		\037\213
5537>3	byte		&0x04
5538>>12	string		BC
5539>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
5540>>>>16	leshort		x	\b, block length %d
5541!:mime	application/x-gzip
5542
5543
5544###############################################################################
5545# Tabix index file
5546# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
5547###############################################################################
55480	string	TBI\1		SAMtools TBI (Tabix index format)
5549>0x04	lelong	=1		\b, with %d reference sequence
5550>0x04	lelong	>1		\b, with %d reference sequences
5551>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
5552>0x08	lelong	^0x10000
5553>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
5554>>0x08	lelong	=1		\b, using SAM format
5555>>0x08	lelong	=2		\b, using VCF format
5556>0x0c	lelong	x		\b, sequence name column: %d
5557>0x10	lelong	x		\b, region start column: %d
5558>0x08	lelong	=0
5559>>0x14	lelong	x		\b, region end column: %d
5560>0x18	byte	x		\b, comment character: %c
5561>0x1c	lelong	x		\b, skip line count: %d
5562
5563
5564###############################################################################
5565# BAM (Binary Sequence Alignment/Map format)
5566# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5567# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5568###############################################################################
55690	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
5570>0x04	lelong	>0
5571>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
5572>>>&0	regex	=[0-9.]+		\b version %s
5573>>&(0x04)	lelong	>0	\b, with %d reference sequences
5574
5575
5576###############################################################################
5577# BAI (BAM indexing format)
5578# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5579###############################################################################
55800		string	BAI\1	SAMtools BAI (BAM indexing format)
5581>0x04		lelong	>0	\b, with %d reference sequences
5582
5583
5584###############################################################################
5585# CRAM (Binary Sequence Alignment/Map format)
5586###############################################################################
55870	string	CRAM	CRAM
5588>0x04	byte	>-1	version %d.
5589>0x05	byte	>-1	\b%d
5590>0x06	string	>\0	(identified as %s)
5591
5592
5593###############################################################################
5594# BCF (Binary Call Format), version 1
5595# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
5596# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5597###############################################################################
55980		string	   BCF\4
5599# length of seqnm data in bytes is positive
5600>&0x00		lelong	  >0
5601# length of smpl data in bytes is positive
5602>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
5603# length of meta in bytes
5604>>>&(&-0x04)	lelong	  >0
5605# have meta text string
5606>>>>&0x00	search	  ##samtoolsVersion=
5607>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
5608
5609
5610###############################################################################
5611# BCF (Binary Call Format), version 2.1
5612# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5613# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5614###############################################################################
56150		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
5616# length of header text
5617>&0x00		lelong	  >0
5618# have header string
5619>>&0x00 search	  ##samtoolsVersion=
5620>>>&0x00	string	  x			\b, generated by SAMtools version %s
5621
5622
5623###############################################################################
5624# BCF (Binary Call Format), version 2.2
5625# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
5626# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
5627###############################################################################
56280		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
5629# length of header text
5630>&0x00		lelong	  >0
5631# have header string
5632>>&0x00 search	  ##samtoolsVersion=
5633>>>&0x00	string	  x			\b, generated by SAMtools version %s
5634
5635###############################################################################
5636# VCF (Variant Call Format)
5637# used by VCFtools (http://vcftools.sourceforge.net/)
5638###############################################################################
56390      search	   ##fileformat=VCFv	Variant Call Format (VCF)
5640>&0    string	   x			\b version %s
5641
5642###############################################################################
5643# FASTQ
5644# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
5645###############################################################################
5646# XXX Broken?
5647# @<seqname>
5648#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
5649# <seq>
5650#>&1	regex	=^[A-Za-z\n.~]++
5651# +[<seqname>]
5652#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
5653# <qual>
5654#>>>&1	regex	=^[!-~\n]+\n		FASTQ
5655
5656###############################################################################
5657# FASTA
5658# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
5659###############################################################################
5660#0	byte	0x3e
5661# q>0	regex	=^[>][!-~\t\ ]+$
5662# Amino Acid codes: [A-IK-Z*-]+
5663#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
5664# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
5665# not in IUPAC codes/gaps: [EFIJLOPQZ]
5666#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
5667#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
5668
5669###############################################################################
5670# SAM (Sequence Alignment/Map format)
5671# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
5672###############################################################################
5673# Short-cut version to recognise SAM files with (optional) header at beginning
5674###############################################################################
56750      string	   @HD\t
5676>4     search	   VN:		Sequence Alignment/Map (SAM), with header
5677>>&0   regex	   [0-9.]+	\b version %s
5678###############################################################################
5679# Longer version to recognise SAM alignment lines using (many) regexes
5680###############################################################################
5681# SAM Alignment QNAME
56820		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
5683# SAM Alignment FLAG
5684>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
5685# SAM Alignment RNAME
5686>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
5687# SAM Alignment POS
5688>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
5689# SAM Alignment MAPQ
5690>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
5691# SAM Alignment CIGAR
5692>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
5693# SAM Alignment RNEXT
5694>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
5695# SAM Alignment PNEXT
5696>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
5697# SAM Alignment TLEN
5698>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
5699# SAM Alignment SEQ
5700>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
5701# SAM Alignment QUAL
5702>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
5703>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
5704>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
5705
5706##############################################################################
5707#
5708#    Magic ids for biomedical signal file formats
5709#    Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
5710#
5711#    The list has been derived from biosig projects
5712#      http://biosig.sourceforge.net
5713#      https://pub.ist.ac.at/~schloegl/matlab/eeg/
5714#      https://pub.ist.ac.at/~schloegl/biosig/TESTED
5715#
5716##############################################################################
5717#
57180	string  ABF\x20					Biosig/Axon Binary format
5719!:mime biosig/abf2
57200	string  ABF2\0\0				Biosig/Axon Binary format
5721!:mime biosig/abf2
5722#
57230	string  ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows	Biosig/ATES MEDICA SOFT. EEG for Windows
5724!:mime biosig/ates
5725#
57260	string  ATF\x09					Biosig/Axon Text fomrat
5727!:mime biosig/atf
5728#
57290	string  ADU1					Biosig/Axona file format
5730!:mime biosig/axona
57310	string  ADU2					Biosig/Axona file format
5732!:mime biosig/axona
5733#
57340	string  ALPHA-TRACE-MEDICAL			Biosig/alpha trace
5735!:mime biosig/alpha
5736#
57370       string  AxGr					Biosig/AXG
57380       string  axgx					Biosig/AXG
5739!:mime biosig/axg
5740#
57410	string  HeaderLen=				Biosig/BCI2000
57420	string  BCI2000V				Biosig/BCI2000
5743!:mime biosig/bci2000
5744#
5745### Specification: https://www.biosemi.com/faq/file_format.htm
57460	string  \xffBIOSEMI				Biosig/Biosemi data format
5747!:mime biosig/bdf
5748#
57490	string  Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File			Biosig/Brainvision data file
57500	string  Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version		Biosig/Brainvision V-Amp file
57510	string  Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version	Biosig/Brainvision Marker file
5752!:mime biosig/brainvision
5753#
57540	string  CEDFILE					Biosig/CFS: Cambridge Electronic devices File format
5755!:mime biosig/ced
5756#
5757### Specification: https://www.edfplus.info/specs/index.html
57580	string	0\x20\x20\x20\x20\x20\x20\x20		Biosig/EDF: European Data format
5759!:mime biosig/edf
5760#
5761### Specifications: https://arxiv.org/abs/cs/0608052
57620	string  GDF					Biosig/GDF: General data format for biosignals
5763!:mime biosig/gdf
5764#
57650	string  DATA\0\0\0\0				Biosig/Heka Patchmaster
57660	string  DAT1\0\0\0\0				Biosig/Heka Patchmaster
57670	string  DAT2\0\0\0\0				Biosig/Heka Patchmaster
5768!:mime biosig/heka
5769#
57700	string  (C)\x20CED\x2087			Biosig/CED SMR
5771!:mime biosig/ced-smr
5772#
57730	string  CFWB\1\0\0\0				Biosig/CFWB
5774!:mime biosig/cfwb
5775#
57760	string  DEMG					Biosig/DEMG
5777!:mime biosig/demg
5778#
57790	string  EBS\x94\x0a\x13\x1a\x0d			Biosig/EBS
5780!:mime biosig/ebs
5781#
57820	string  Embla\x20data\x20file			Biosig/Embla
5783!:mime biosig/embla
5784#
57850	string  Header\r\nFile Version			Biosig/ETG4000
5786!:mime biosig/etg4000
5787#
57880	string  GALILEO\x20EEG\x20TRACE\x20FILE		Biosig/Galileo
5789!:mime biosig/galileo
5790#
57910	string  IGOR					Biosig/IgorPro ITX file
5792!:mime biosig/igorpro
5793#
5794#	Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
57950	string  ISHNE1.0				Biosig/ISHNE
5796!:mime biosig/ishne
5797#
5798# 	CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
57990	string  @\x20\x20MFER\x20			Biosig/MFER
58000	string  @\x20MFR\x20				Biosig/MFER
5801!:mime biosig/mfer
5802#
58030	string  NEURALEV				Biosig/NEV
58040	string  N.EV.\0					Biosig/NEV
5805!:mime biosig/nev
5806#
58070	string  NEX1					Biosig/NEX
5808!:mime biosig/nex1
5809#
58100	string  PLEX 					Biosig/Plexon v1.0
581110	string  PLEXON 					Biosig/Plexon v2.0
5812!:mime biosig/plexon
5813#
58140	string  \x02\x27\x91\xC6			Biosig/RHD2000: Intan RHD2000 format
5815#
5816#	Specification: CEN 1064:2005/ISO 11073:91064
581716	string  SCPECG\0\0 				Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
5818!:mime biosig/scpecg
5819#
58200	string  IAvSFo									Biosig/SIGIF
5821!:mime biosig/sigif
5822#
58230	string  POLY\x20SAMPLE\x20FILEversion\x20					Biosig/TMS32
5824!:mime biosig/tms32
5825#
58260	string  FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion=	Biosig/TMSiLOG
5827!:mime biosig/tmsilog
5828#
58294	string	Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
5830>63	string	CRawDataElement
5831>>85	string	CRawDataBuffer								Biosig/SYNERGY
5832!:mime biosig/synergy
5833#
58344	string	\40\0\4\1\44\1\102\2\146\3\44\0\190\3					Biosig/UNIPRO
5835!:mime biosig/unipro
5836#
58370	string	VER=9\r\nCTIME=								Biosig/WCP
5838!:mime biosig/wcp
5839#
58400	string	\xAF\xFE\xDA\xDA							Biosig/Walter Graphtek
58410	string	\xDA\xDA\xFE\xAF							Biosig/Walter Graphtek
58420	string	\x55\x55\xFE\xAF							Biosig/Walter Graphtek
5843!:mime biosig/walter-graphtek
5844#
58450	string  V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
5846>32	string  [PatInfo]								Biosig/Sigma
5847!:mime biosig/sigma
5848#
58490	string  \067\069\078\013\010\0x1a\04\0x84					Biosig/File exchange format (FEF)
5850!:mime biosig/fef
58510	string  \67\69\78\0x13\0x10\0x1a\4\0x84						Biosig/File exchange format (FEF)
5852!:mime biosig/fef
5853#
58540	string  \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
5855>36  	string  \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
5856>>56	string  \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0			Biosig/FIFF
5857!:mime biosig/fiff
5858#
5859
5860#------------------------------------------------------------------------------
5861# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
5862# blackberry:  file(1) magic for BlackBerry file formats
5863#
58645	belong	0
5865>8	belong  010010010	BlackBerry RIM ETP file
5866>>22	string	x		\b for %s
5867# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
5868# https://ftg.lbl.gov/checkpoint
58690	string	C\0\0\0R\0\0\0	BLCR
5870>16	lelong	1	x86
5871>16	lelong	3	alpha
5872>16	lelong	5	x86-64
5873>16	lelong	7	ARM
5874>8	lelong	x	context data (little endian, version %d)
5875# Uncomment the following only of your "file" program supports "search"
5876#>0	search/1024	VMA\06	for kernel
5877#>>&1	byte	x	%d.
5878#>>&2	byte	x	%d.
5879#>>&3	byte	x	%d
58800	string	\0\0\0C\0\0\0R	BLCR
5881>16	belong	2	SPARC
5882>16	belong	4	ppc
5883>16	belong	6	ppc64
5884>16	belong	7	ARMEB
5885>16	belong	8	SPARC64
5886>8	belong	x	context data (big endian, version %d)
5887# Uncomment the following only of your "file" program supports "search"
5888#>0	search/1024	VMA\06	for kernel
5889#>>&1	byte	x	%d.
5890#>>&2	byte	x	\b%d.
5891#>>&3	byte	x	\b%d
5892
5893#------------------------------------------------------------------------------
5894# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
5895# blender: file(1) magic for Blender 3D related files
5896#
5897# Native format rule v1.2. For questions use the developers list
5898# https://lists.blender.org/mailman/listinfo/bf-committers
5899# GLOB chunk was moved near start and provides subversion info since 2.42
5900
59010		string	=BLENDER	Blender3D,
5902>7		string	=_		saved as 32-bits
5903>>8		string	=v		little endian
5904>>>9		byte	x		with version %c.
5905>>>10		byte	x		\b%c
5906>>>11		byte	x		\b%c
5907>>>0x40		string	=GLOB		\b.
5908>>>>0x58	leshort	x		\b%.4d
5909>>8		string	=V		big endian
5910>>>9		byte	x		with version %c.
5911>>>10		byte	x		\b%c
5912>>>11		byte	x		\b%c
5913>>>0x40		string	=GLOB		\b.
5914>>>>0x58	beshort	x		\b%.4d
5915>7		string	=-		saved as 64-bits
5916>>8		string	=v		little endian
5917>>9		byte	x		with version %c.
5918>>10		byte	x		\b%c
5919>>11		byte	x		\b%c
5920>>0x44		string	=GLOB		\b.
5921>>>0x60		leshort	x		\b%.4d
5922>>8		string	=V		big endian
5923>>>9		byte	x		with version %c.
5924>>>10		byte	x		\b%c
5925>>>11		byte	x		\b%c
5926>>>0x44		string	=GLOB		\b.
5927>>>>0x60	beshort	x		\b%.4d
5928
5929# Scripts that run in the embedded Python interpreter
59300		string	#!BPY		Blender3D BPython script
5931
5932#------------------------------------------------------------------------------
5933# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
5934# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
5935#
5936# Note that this 0407 conflicts with several other a.out formats...
5937#
5938# XXX - should this be redone with "be" and "le", so that it works on
5939# little-endian machines as well?  If so, what's the deal with
5940# "VAX-order" and "VAX-order2"?
5941#
5942#0	long		0407		68K Blit (standalone) executable
5943#0	short		0407		VAX-order2 68K Blit (standalone) executable
59440	short		03401		VAX-order 68K Blit (standalone) executable
59450	long		0406		68k Blit mpx/mux executable
59460	short		0406		VAX-order2 68k Blit mpx/mux executable
59470	short		03001		VAX-order 68k Blit mpx/mux executable
5948# Need more values for WE32 DMD executables.
5949# Note that 0520 is the same as COFF
5950#0	short		0520		tty630 layers executable
5951
5952#------------------------------------------------------------------------------
5953# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
5954# i80960 b.out objects and archives
5955#
59560	long		0x10d		i960 b.out relocatable object
5957>16	long		>0		not stripped
5958#
5959# b.out archive (hp-rt on i960)
59600	string		=!<bout>	b.out archive
5961>8	string		__.SYMDEF	random library
5962
5963#------------------------------------------------------------------------------
5964# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
5965# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
5966# Some object/executable formats use the same magic numbers as are used
5967# in other OSes; those are handled by entries in aout.
5968#
5969
59700	lelong		0314		386 compact demand paged pure executable
5971>16	lelong		>0		not stripped
5972>32	byte		0x6a		(uses shared libs)
5973
5974# same as in SunOS 4.x, except for static shared libraries
59750	belong&077777777	0600413		SPARC demand paged
5976>0	byte		&0x80
5977>>20	belong		<4096		shared library
5978>>20	belong		=4096		dynamically linked executable
5979>>20	belong		>4096		dynamically linked executable
5980>0	byte		^0x80		executable
5981>16	belong		>0		not stripped
5982>36	belong		0xb4100001	(uses shared libs)
5983
59840	belong&077777777	0600410		SPARC pure
5985>0	byte		&0x80		dynamically linked executable
5986>0	byte		^0x80		executable
5987>16	belong		>0		not stripped
5988>36	belong		0xb4100001	(uses shared libs)
5989
59900	belong&077777777	0600407		SPARC
5991>0	byte		&0x80		dynamically linked executable
5992>0	byte		^0x80		executable
5993>16	belong		>0		not stripped
5994>36	belong		0xb4100001	(uses shared libs)
5995# Chiasmus is an encryption standard developed by the German Federal
5996# Office for Information Security (Bundesamt fuer Sicherheit in der
5997# Informationstechnik).
5998
5999# Extension: .xia
60000	string	XIA1	Chiasmus encrypted data
6001
6002# Extension: .xis
60030	string	XIS	Chiasmus key
6004
6005#------------------------------------------------------------------------------
6006# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
6007# BTSnoop:  file(1) magic for BTSnoop files
6008#
6009# From <marcel@holtmann.org>
60100	string		btsnoop\0		BTSnoop
6011>8	belong		x			version %d,
6012>12	belong		1001			Unencapsulated HCI
6013>12	belong		1002			HCI UART (H4)
6014>12	belong		1003			HCI BCSP
6015>12	belong		1004			HCI Serial (H5)
6016>>12	belong		x			type %d
6017
6018#------------------------------------------------------------------------------
6019# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
6020# c64:  file(1) magic for various commodore 64 related files
6021#
6022# From: Dirk Jagdmann <doj@cubic.org>
6023
60240x16500	belong		0x12014100	D64 Image
60250x16500	belong		0x12014180	D71 Image
60260x61800 belong		0x28034400	D81 Image
60270	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
60280	belong		0x43154164	X64 Image
6029
60300	string		GCR-1541	GCR Image
6031>8	byte		x		version: %i
6032>9	byte		x		tracks: %i
6033
60349	string		PSUR		ARC archive (c64)
60352	string		-LH1-		LHA archive (c64)
6036
60370	string		C64File		PC64 Emulator file
6038>8	string		>\0		"%s"
60390	string		C64Image	PC64 Freezer Image
6040
60410	beshort		0x38CD		C64 PCLink Image
60420	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
6043
60440	belong		0xFF424CFF	WRAptor packer (c64)
6045
60460	string		C64S\x20tape\x20file	T64 tape Image
6047>32	leshort		x		Version:0x%x
6048>36	leshort		!0		Entries:%i
6049>40	string		x		Name:%.24s
6050
60510	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
6052>32	leshort		x		Version:0x%x
6053>36	leshort		!0		Entries:%i
6054>40	string		x		Name:%.24s
6055
60560	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
6057>32	leshort		x		Version:0x%x
6058>36	leshort		!0		Entries:%i
6059>40	string		x		Name:%.24s
6060
6061# Raw tape file format (.tap files)
6062# Esa Hyyti <esa@netlab.tkk.fi>
60630	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
6064>0x0c	byte		x		Version:%u,
6065>0x10	lelong		x		Length:%u cycles
6066
6067# magic for Goattracker2, http://covertbitops.c64.org/
6068# from Alex Myczko <alex@aiei.ch>
60690	string		GTS5		GoatTracker 2 song
6070>4	string		>\0		\b, "%s"
6071>36	string		>\0		\b by %s
6072>68	string		>\0		\b (C) %s
6073>100	byte		>0		\b, %u subsong(s)
6074
6075
6076#------------------------------------------------------------------------------
6077# $File: cad,v 1.23 2020/05/30 23:58:07 christos Exp $
6078# autocad:  file(1) magic for cad files
6079#
6080
6081# Microstation DGN/CIT Files (www.bentley.com)
6082# Last updated July 29, 2005 by Lester Hightower
6083# DGN is the default file extension of Microstation/Intergraph CAD files.
6084# CIT is the proprietary raster format (similar to TIFF) used to attach
6085# raster underlays to Microstation DGN (vector) drawings.
6086#
6087# http://www.wotsit.org/search.asp
6088# https://filext.com/detaillist.php?extdetail=DGN
6089# https://filext.com/detaillist.php?extdetail=CIT
6090#
6091# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
6092# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
6093# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
6094# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
6095#
6096# URL:		https://en.wikipedia.org/wiki/MicroStation
6097# reference:	http://dgnlib.maptools.org/dgn.html
6098#		http://dgnlib.maptools.org/dl/ref18.pdf
6099# Update:	Joerg Jenderek
6100# Note: verfied by command like `dgndump seed2d_b.dgn`
6101# test for level 8 and type 5 or 9
61020	beshort&0x3F73	0x0801
6103# level of element like 8
6104#>0	ubyte&0x3F	x			\b, level %u
6105#>0	ubyte		&0x80			\b, complex
6106#>0	ubyte		&0x40			\b, reserved
6107# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
6108#>1	ubyte&0x7F	x			\b, type %u
6109# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT
6110#>2	uleshort	x			\b, words 0x%4.4x to follow
6111# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
6112#>508	ubelong		x			\b, RESERVED %8.8x
6113>508	ubelong&0xFFffFF00	=0
6114# test for level 8 and type 9 for INGR raster image
6115>>0	beshort		0x0809
6116# test for length of 1st element is multiple of blocks a 512 bytes
6117>>>2	ubyte		0xfe
6118>>>>0 	use		ingr-image
6119# test for DGN or CEL by jump words (uleshort) forward to next element
6120>(2.s*2)	ulong		x
6121# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT
6122#>>&1		ubyte&0x7F	x		\b, 2nd type %u
6123# DGN
6124>>&1		ubyte&0x7F	8
6125>>>2		uleshort	=0x02FE		Bentley/Intergraph Microstation CAD drawing
6126!:mime		application/x-bentley-dgn
6127!:ext		dgn
6128# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0
6129>>>>1214	ubyte  		&0x40		3D
6130>>>>1214	ubyte  		^0x40		2D
6131# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040
6132>>>>1120	string		x		\b, units %-.2s
6133# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
6134>>>>1122	string		>\0		%-.2s
6135#>>>>1120	ubelong		x		\b, units 0x%8.8x
6136# element range low,high x y z like xlow=0 08010000h 01080000h
6137#>>>>4		ubelong	  	!0		\b, xlow %8.8x
6138#>>>>8		ubelong	  	!0		\b, ylow %8.8x
6139#>>>>12		ubelong	  	!0		\b, zlow %8.8x
6140#>>>>16		ubelong	  	!0		\b, xhigh %8.8x
6141#>>>>20		ubelong	  	!0		\b, yhigh %8.8x
6142#>>>>24		ubelong	  	!0		\b, zhigh %8.8x
6143# graphic group number; all other elements in that group have same non-0 number
6144#>>>>28		leshort		x		\b, grphgrp 0x%4.4x
6145# words to optional attribute linkage
6146#>>>>30		ubyte		x		\b, attindx \%o
6147#>>>>31		ubyte		x		\b\%o
6148# >>30	string	\026\105			DGNFile
6149# >>30	string	\034\105			DGNFile
6150# >>30	string	\073\107			DGNFile
6151# >>30	string	\073\110			DGNFile
6152# >>30	string	\106\107			DGNFile
6153# >>30	string	\110\103			DGNFile
6154# >>30	string	\120\104			DGNFile
6155# >>30	string	\172\104			DGNFile
6156# >>30	string	\172\105			DGNFile
6157# >>30	string	\172\106			DGNFile
6158# >>30	string	\234\106			DGNFile
6159# >>30	string	\273\105			DGNFile
6160# >>30	string	\306\106			DGNFile
6161# >>30	string	\310\104			DGNFile
6162# >>30	string	\341\104			DGNFile
6163# >>30	string	\372\103			DGNFile
6164# >>30	string	\372\104			DGNFile
6165# >>30	string	\372\106			DGNFile
6166# >>30	string	\376\103			DGNFile
6167# elements properties indicator
6168#>>>>32		uleshort	!0		\b, properties 0x%4.4x
6169# class 0~Primary
6170#>>>>>32		uleshort&0x000F	!0		\b, class 0x%4.4x
6171# Symbology
6172#>>>>>34		uleshort	x		\b, Symbology 0x%4.4x
6173# test for 2nd element type 1~library cell header
6174>>&1		ubyte&0x7F	1
6175# test for 1st element with level 8 and type 5 for cell library
6176>>>0		beshort		0x0805		Bentley/Intergraph Microstation CAD cell library
6177!:mime		application/x-bentley-cel
6178!:ext		cel
6179#
6180# URL:		http://fileformats.archiveteam.org/wiki/Intergraph_Raster
6181# reference:	https://web.archive.org/web/20140903185431/
6182#		http://oreilly.com/www/centers/gff/formats/ingr/index.htm
6183# note:		verfied by command like `nconvert -fullinfo LONGLAT.CIT`
6184# display information for intergraph raster bitmap
61850	name	ingr-image
6186# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD"
6187# DataTypeCode indicates format, depth of the pixel data and used compression
6188>4	uleshort	x			Intergraph raster image
6189>>4	uleshort	0x0009			\b, Run-Length Encoded 1-bit
6190!:mime	image/x-intergraph-rle
6191!:ext	rel
6192>>4	uleshort	0x0018			\b, CCITT Group 4 1-bit
6193!:mime	image/x-intergraph-cit
6194!:ext	cit
6195>>4	uleshort	27			\b, Adaptive RLE RGB
6196!:mime	image/x-intergraph-rgb
6197!:ext	rgb
6198>>4	default		x
6199>>>4	uleshort	x			\b, Type %u
6200!:mime	image/x-intergraph
6201# TODO:
6202#>4	uleshort	0			\b, no data
6203# ...
6204#>4	uleshort	0x0045			\b, Continuous Tone CMKY (Uncompressed)
6205# ApplicationType: 0~generic raster image 3~drawing, scanning
6206# 8~I/IMAGE and MicroStation Imager 9~ModelView
6207>6	uleshort	!0			\b, ApplicationType %u
6208#>6	uleshort	x			\b, ApplicationType %u
6209# XViewOrigin; Raster grid data X origin
6210#>8	ulequad		!0			\b, XViewOrigin %llx
6211# PixelsPerLine is the number of pixels in a scan line of bitmapp
6212>184	ulelong		x			\b, %u x
6213# NumberOfLines is height of the raster data in scanlines
6214>188	ulelong		x			%u
6215# DeviceResolution; resolution of scanning device
6216# positive indicates number of micros between lines; negative indicates DPI
6217#>192	leshort		x			\b, DeviceResolution %d
6218# ScanlineOrient indicates the origin and the orientation of the scan lines
6219#>194	ubyte		x			\b, ScanlineOrient %x
6220>194	ubyte		x			\b, orientation
6221>194	ubyte		&0x01			right
6222>194	ubyte		^0x01			left
6223>194	ubyte		&0x02			down
6224>194	ubyte		^0x02			top
6225>194	ubyte		&0x04			horizontal
6226>194	ubyte		^0x04			vertical
6227# ScannableFlag; Scanline indexing method used
6228#>195	ubyte		!0			\b, ScannableFlag 0x%x
6229# RotationAngle; Rotation angle of raster data
6230#>196	ubequad		!0			\b, RotationAngle 0x%llx
6231# SkewAngle; Skew angle of raster data
6232#>204	ubequad		!0			\b, SkewAngle %llx
6233# DataTypeModifier; Additional raster data format info
6234#>212	uleshort	!0			\b, DataTypeModifier 0x%4.4x
6235# DesignFile[66]; Name of the design file
6236>214	string		>\0			\b, DesignFile %-.66s
6237# DatabaseFile[66]; Name of the database file
6238>280	string		>\0			\b, DatabaseFile %-.66s
6239# ParentGridFile[66]; Name of parent grid file
6240>346	string		>\0			\b, ParentGridFile %-.66s
6241# FileDescription[80]; Text description of file and contents
6242>412	string		>\0			\b, FileDescription %-.80s
6243# MinValue
6244#>492	ubequad		!0			\b, MinValue 0x%llx
6245# MaxValue
6246#>500	ubequad		!0			\b, MaxValue 0x%llx
6247# Reserved[3]; Unused (always 0)
6248#>508	ubelong&0xFFffFF00	x		\b, RESERVED %8.8x
6249# GridFileVersion; Grid File Version like 2 3
6250#>511	ubyte		x			\b, GridFileVersion %x
6251
6252# AutoCAD
6253# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
6254# and https://www.iana.org/assignments/media-types/image/vnd.dwg
62550	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
6256!:mime image/vnd.dwg
62570	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
6258!:mime image/vnd.dwg
62590	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
6260!:mime image/vnd.dwg
62610	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
6262!:mime image/vnd.dwg
62630	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
6264!:mime image/vnd.dwg
62650	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
6266!:mime image/vnd.dwg
62670	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
6268!:mime image/vnd.dwg
62690	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
6270!:mime image/vnd.dwg
62710	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
6272!:mime image/vnd.dwg
62730	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
6274!:mime image/vnd.dwg
62750	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
6276!:mime image/vnd.dwg
62770	string	AC1004	DWG AutoDesk AutoCAD Release 9
6278!:mime image/vnd.dwg
62790	string	AC1006	DWG AutoDesk AutoCAD Release 10
6280!:mime image/vnd.dwg
62810	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
6282!:mime image/vnd.dwg
6283# AutoCAD DWG versions R13/R14 (www.autodesk.com)
6284# Written December 01, 2003 by Lester Hightower
6285# Based on the DWG File Format Specifications at http://www.opendwg.org/
6286# AutoCad, from Nahuel Greco
6287# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
62880	string	AC1012	DWG AutoDesk AutoCAD Release 13
6289!:mime image/vnd.dwg
62900	string	AC1014	DWG AutoDesk AutoCAD Release 14
6291!:mime image/vnd.dwg
62920	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
6293!:mime image/vnd.dwg
6294
6295# A new version of AutoCAD DWG
6296# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
6297# ICQ 358572321)
6298# From various sources like:
6299# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
63000	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
6301!:mime image/vnd.dwg
63020	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
6303!:mime image/vnd.dwg
63040	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
6305!:mime image/vnd.dwg
63060	string	AC1027	DWG AutoDesk AutoCAD 2013-2017
6307!:mime image/vnd.dwg
6308
6309# From GNU LibreDWG
63100	string	AC1032	DWG AutoDesk AutoCAD 2018/2019
6311!:mime image/vnd.dwg
6312
6313# KOMPAS 2D drawing from ASCON
6314# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
6315# gathered nor specification
6316# ASCON https://ascon.net/main/ in English,
6317#	https://ascon.ru/ main site in Russian
6318# Extension is CDW for drawing and FRW for fragment of drawing
6319# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
6320# ICQ 358572321, https://vkontakte.ru/id16076543)
6321# From:
6322# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
6323# (in russian) and my experiments
63240	string	KF
6325>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
6326>2	belong	0x4D00000C	Kompas drawing 12.0
6327>2	belong	0x3200000B	Kompas drawing 11.0 SP1
6328>2	belong	0x3100000B	Kompas drawing 11.0
6329>2	belong	0x2310000A	Kompas drawing 10.0 SP1
6330>2	belong	0x2110000A	Kompas drawing 10.0
6331>2	belong	0x08000009	Kompas drawing 9.0 SP1
6332>2	belong	0x05000009	Kompas drawing 9.0
6333>2	belong	0x33010008	Kompas drawing 8+
6334>2	belong	0x1A000008	Kompas drawing 8.0
6335>2	belong	0x2C010107	Kompas drawing 7+
6336>2	belong	0x05000007	Kompas drawing 7.0
6337>2	belong	0x32000006	Kompas drawing 6+
6338>2	belong	0x09000006	Kompas drawing 6.0
6339>2	belong	0x5C009005	Kompas drawing 5.11R03
6340>2	belong	0x54009005	Kompas drawing 5.11R02
6341>2	belong	0x51009005	Kompas drawing 5.11R01
6342>2	belong	0x22009005	Kompas drawing 5.10R03
6343>2	belong	0x22009005	Kompas drawing 5.10R02 mar
6344>2	belong	0x21009005	Kompas drawing 5.10R02 febr
6345>2	belong	0x19009005	Kompas drawing 5.10R01
6346>2	belong	0xF4008005	Kompas drawing 5.9R01.003
6347>2	belong	0x1C008005	Kompas drawing 5.9R01.002
6348>2	belong	0x11008005	Kompas drawing 5.8R01.003
6349
6350# CAD: file(1) magic for computer aided design files
6351# Phillip Griffith <phillip dot griffith at gmail dot com>
6352# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
6353#
6354
6355# 3DS (3d Studio files)
63560	leshort		0x4d4d
6357>6	leshort		0x2
6358>>8	lelong		0xa
6359>>>16	leshort		0x3d3d	3D Studio model
6360!:mime	image/x-3ds
6361!:ext 3ds
6362
6363# MegaCAD 2D/3D drawing (.prt)
6364# https://megacad.de/
6365# From: Markus Heidelberg <markus.heidelberg@web.de>
63660	string	MegaCad23\0	MegaCAD 2D/3D drawing
6367
6368# Hoops CAD files
6369# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
6370# HSF_architecture.html
6371# Stephane Charette <stephane.charette@gmail.com>
63720	string	;;\020HSF\020V		OpenHSF (Hoops Stream Format)
6373>7	regex/9 V[.0-9]{4,5}\020	%s
6374!:ext hsf
6375
6376# AutoCAD Drawing Exchange Format
63770	regex		\^[\ \t]*0\r?\000$
6378>1	regex		\^[\ \t]*SECTION\r?$
6379>>2	regex		\^[\ \t]*2\r?$
6380>>>3	regex		\^[\ \t]*HEADER\r?$	AutoCAD Drawing Exchange Format
6381!:mime	application/x-dxf
6382!:ext	dxf
6383>>>>&1	search/8192	AC1006			\b, R10
6384>>>>&1	search/8192	AC1009			\b, R11/R12
6385>>>>&1	search/8192	AC1012			\b, R13
6386>>>>&1	search/8192	AC1014			\b, R14
6387>>>>&1	search/8192	AC1015			\b, version 2000
6388>>>>&1	search/8192	AC1018			\b, version 2004
6389>>>>&1	search/8192	AC1021			\b, version 2007
6390>>>>&1	search/8192	AC1024			\b, version 2010
6391
6392# The Sketchup 3D model format https://www.sketchup.com/
63930	string	\xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00	SketchUp Model
6394!:mime application/vnd.sketchup.skp
6395!:ext skp
6396
63974	regex/b	P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9]	NAXOS CAD System file from version %s
6398!:strength +40
6399
6400#------------------------------------------------------------------------------
6401# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $
6402# Cafe Babes unite!
6403#
6404# Since Java bytecode and Mach-O universal binaries have the same magic number,
6405# the test must be performed in the same "magic" sequence to get both right.
6406# The long at offset 4 in a Mach-O universal binary tells the number of
6407# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
6408# version and the short at offset 6 is the JVM major version.  Since there are only
6409# only 18 labeled Mach-O architectures at current, and the first released
6410# Java class format was version 43.0, we can safely choose any number
6411# between 18 and 39 to test the number of architectures against
6412# (and use as a hack). Let's not use 18, because the Mach-O people
6413# might add another one or two as time goes by...
6414#
6415### JAVA START ###
64160	belong		0xcafebabe
6417>4	belong		>30		compiled Java class data,
6418!:mime	application/x-java-applet
6419>>6	beshort		x	        version %d.
6420>>4	beshort		x       	\b%d
6421# Which is which?
6422#>>4	belong		0x032d		(Java 1.0)
6423#>>4	belong		0x032d		(Java 1.1)
6424>>4	belong		0x002e		(Java 1.2)
6425>>4	belong		0x002f		(Java 1.3)
6426>>4	belong		0x0030		(Java 1.4)
6427>>4	belong		0x0031		(Java 1.5)
6428>>4	belong		0x0032		(Java 1.6)
6429>>4	belong		0x0033		(Java 1.7)
6430>>4	belong		0x0034		(Java 1.8)
6431
64320	belong		0xcafed00d	JAR compressed with pack200,
6433>5	byte		x		version %d.
6434>4	byte		x		\b%d
6435!:mime	application/x-java-pack200
6436
6437
64380	belong		0xcafed00d	JAR compressed with pack200,
6439>5	byte		x		version %d.
6440>4	byte		x		\b%d
6441!:mime	application/x-java-pack200
6442
6443### JAVA END ###
6444### MACH-O START ###
6445
64460	name		mach-o		\b [
6447>0	use		mach-o-cpu	\b
6448>(8.L)	indirect	x		\b:
6449>0	belong		x		\b]
6450
64510	belong		0xcafebabe
6452>4	belong		1		Mach-O universal binary with 1 architecture:
6453!:mime application/x-mach-binary
6454>>8	use		mach-o		\b
6455>4	belong		>1
6456>>4	belong		<20		Mach-O universal binary with %d architectures:
6457!:mime application/x-mach-binary
6458>>>8	use		mach-o		\b
6459>>4	belong		>1
6460>>>28	use		mach-o		\b
6461>>4	belong		>2
6462>>>48	use		mach-o		\b
6463>>4	belong		>3
6464>>>68	use		mach-o		\b
6465>>4	belong		>4
6466>>>88	use		mach-o		\b
6467>>4	belong		>5
6468>>>108	use		mach-o		\b
6469
6470### MACH-O END ###
6471
6472#------------------------------------------------------------------------------
6473# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
6474# cbor:  file(1) magic for CBOR files as defined in RFC 7049
6475
64760	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
6477!:mime	application/cbor
6478>3	ubyte	<0x20	(positive integer)
6479>3	ubyte	<0x40
6480>>3	ubyte	>0x1f	(negative integer)
6481>3	ubyte	<0x60
6482>>3	ubyte	>0x3f	(byte string)
6483>3	ubyte	<0x80
6484>>3	ubyte	>0x5f	(text string)
6485>3	ubyte	<0xa0
6486>3	ubyte	>0x7f	(array)
6487>3	ubyte	<0xc0
6488>>3	ubyte	>0x9f	(map)
6489>3	ubyte	<0xe0
6490>>3	ubyte	>0xbf	(tagged)
6491>3	ubyte	>0xdf	(other)
6492
6493#------------------------------------------------------------------------------
6494# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
6495# CDDB: file(1) magic for CDDB(tm) format CD text data files
6496#
6497# From <steve@gracenote.com>
6498#
6499# This is the /etc/magic entry to decode datafiles as used by
6500# CDDB-enabled CD player applications.
6501#
6502
65030	search/1/w	#\040xmcd	CDDB(tm) format CD text data
6504
6505#------------------------------------------------------------------------------
6506# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
6507# chord: file(1) magic for Chord music sheet typesetting utility input files
6508#
6509# From Philippe De Muyter <phdm@macqel.be>
6510# File format is actually free, but many distributed files begin with `{title'
6511#
65120	string		{title		Chord text file
6513
6514# Type:	PowerTab file format
6515# URL:	http://www.power-tab.net/
6516# From:	Jelmer Vernooij <jelmer@samba.org>
65170	string		ptab\003\000	Power-Tab v3 Tablature File
65180	string		ptab\004\000	Power-Tab v4 Tablature File
6519
6520#------------------------------------------------------------------------------
6521# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
6522# cisco:  file(1) magic for cisco Systems routers
6523#
6524# Most cisco file-formats are covered by the generic elf code
6525#
6526# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
65270	belong&0xffffff00	0x85011400  cisco IOS microcode
6528>7	string		>\0		    for '%s'
65290	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
6530>7	string		>\0		    for '%s'
6531
6532#------------------------------------------------------------------------------
6533# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
6534# citrus locale declaration
6535#
6536
65370	string		RuneCT		Citrus locale declaration for LC_CTYPE
6538
6539#------------------------------------------------------------------------------
6540# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $
6541# c-lang:  file(1) magic for C and related languages programs
6542#
6543# The strength is to beat standard HTML
6544
6545# BCPL
65460	search/8192	"libhdr"	BCPL source text
6547!:mime	text/x-bcpl
65480	search/8192	"LIBHDR"	BCPL source text
6549!:mime	text/x-bcpl
6550
6551# C
6552# Check for class if include is found, otherwise class is beaten by include because of lowered strength
65530	search/8192	#include
6554>0	regex	\^#include			C
6555>>0	regex	\^class[[:space:]]+
6556>>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
6557>>&0	clear	x				source text
6558!:strength + 13
6559!:mime	text/x-c
65600	search/8192	pragma
6561>0	regex	\^#[[:space:]]*pragma	C source text
6562!:mime	text/x-c
65630	search/8192	endif
6564>0	regex	\^#[[:space:]]*(if\|ifn)def
6565>>&0	regex	\^#[[:space:]]*endif$	C source text
6566!:mime	text/x-c
65670	search/8192	define
6568>0	regex	\^#[[:space:]]*(if\|ifn)def
6569>>&0	regex	\^#[[:space:]]*define	C source text
6570!:mime	text/x-c
65710	search/8192	char
6572>0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6573!:mime	text/x-c
65740	search/8192	double
6575>0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6576!:mime	text/x-c
65770	search/8192	extern
6578>0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
6579!:mime	text/x-c
65800	search/8192	float
6581>0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
6582!:mime	text/x-c
65830	search/8192	struct
6584>0	regex	\^struct[[:space:]]+		C source text
6585!:mime	text/x-c
65860	search/8192	union
6587>0	regex	\^union[[:space:]]+		C source text
6588!:mime	text/x-c
65890	search/8192	main(
6590>&0 regex	\\)[[:space:]]*\\{		C source text
6591!:mime	text/x-c
6592
6593# C++
6594# The strength of these rules is increased so they beat the C rules above
65950	search/8192	namespace
6596>0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
6597!:strength + 30
6598!:mime	text/x-c++
6599# using namespace [namespace] or using std::[lib]
66000	search/8192	using
6601>0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
6602!:strength + 30
6603!:mime	text/x-c++
66040	search/8192	template
6605>0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
6606!:strength + 30
6607!:mime	text/x-c++
66080	search/8192	virtual
6609>0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
6610!:strength + 30
6611!:mime	text/x-c++
6612# But class alone is reduced to avoid beating php (Jens Schleusener)
66130	search/8192	class
6614>0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
6615!:strength + 13
6616!:mime	text/x-c++
66170	search/8192	public
6618>0	regex	\^[[:space:]]*public:		C++ source text
6619!:strength + 30
6620!:mime	text/x-c++
66210	search/8192	private
6622>0	regex	\^[[:space:]]*private:		C++ source text
6623!:strength + 30
6624!:mime	text/x-c++
66250	search/8192	protected
6626>0	regex	\^[[:space:]]*protected:		C++ source text
6627!:strength + 30
6628!:mime	text/x-c++
6629
6630# Objective-C
66310	search/8192	#import
6632>0	regex	\^#import			Objective-C source text
6633!:strength + 25
6634!:mime	text/x-objective-c
6635
6636# From: Mikhail Teterin <mi@aldan.algebra.com>
66370	string		cscope		cscope reference data
6638>7	string		x		version %.2s
6639# We skip the path here, because it is often long (so file will
6640# truncate it) and mostly redundant.
6641# The inverted index functionality was added some time between
6642# versions 11 and 15, so look for -q if version is above 14:
6643>7	string		>14
6644>>10	search/100	\ -q\ 		with inverted index
6645>10	search/100	\ -c\ 		text (non-compressed)
6646
6647#------------------------------------------------------------------------------
6648# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
6649# clarion:  file(1) magic for # Clarion Personal/Professional Developer
6650# (v2 and above)
6651# From: Julien Blache <jb@jblache.org>
6652
6653# Database files
6654# signature
66550	leshort	0x3343	Clarion Developer (v2 and above) data file
6656# attributes
6657>2	leshort	&0x0001	\b, locked
6658>2	leshort	&0x0004	\b, encrypted
6659>2	leshort	&0x0008	\b, memo file exists
6660>2	leshort	&0x0010	\b, compressed
6661>2	leshort	&0x0040	\b, read only
6662# number of records
6663>5	lelong	x	\b, %d records
6664
6665# Memo files
66660	leshort	0x334d	Clarion Developer (v2 and above) memo data
6667
6668# Key/Index files
6669# No magic? :(
6670
6671# Help files
66720	leshort	0x49e0	Clarion Developer (v2 and above) help data
6673
6674#------------------------------------------------------------------------------
6675# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
6676# claris:  file(1) magic for claris
6677# "H. Nanosecond" <aldomel@ix.netcom.com>
6678# Claris Works a word processor, etc.
6679# Version 3.0
6680
6681# .pct claris works clip art files
6682#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
6683#*
6684#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
6685#null to byte 1000 octal
6686514	string	\377\377\377\377\000
6687>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
6688514	string	\377\377\377\377\001
6689>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
6690
6691# Claris works files
6692# .cwk
6693# Moved to Apple AppleWorks document
6694#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
6695# .plt
66960	string	\020\341\000\000\010\010	Claris Works palette files .plt
6697
6698# .msp a dictionary file I am not sure about this I have only one .msp file
66990	string	\002\271\262\000\040\002\000\164	Claris works dictionary
6700
6701# .usp are user dictionary bits
6702# I am not sure about a magic header:
6703#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
6704#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
6705#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
6706#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
6707
6708# .mth Thesaurus
6709# starts with \0 but no magic header
6710
6711# .chy Hyphenation file
6712# I am not sure: 000 210 034 000 000
6713
6714# other claris files
6715#./windows/claris/useng.ndx: data
6716#./windows/claris/xtndtran.l32: data
6717#./windows/claris/xtndtran.lst: data
6718#./windows/claris/clworks.lbl: data
6719#./windows/claris/clworks.prf: data
6720#./windows/claris/userd.spl: data
6721
6722#------------------------------------------------------------------------------
6723# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
6724# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
6725#
6726# XXX - what byte order does the Clipper use?
6727#
6728# XXX - what's the "!" stuff:
6729#
6730# >18	short		!074000,000000	C1 R1
6731# >18	short		!074000,004000	C2 R1
6732# >18	short		!074000,010000	C3 R1
6733# >18	short		!074000,074000	TEST
6734#
6735# I shall assume it's ANDing the field with the first value and
6736# comparing it with the second, and rewrite it as:
6737#
6738# >18	short&074000	000000		C1 R1
6739# >18	short&074000	004000		C2 R1
6740# >18	short&074000	010000		C3 R1
6741# >18	short&074000	074000		TEST
6742#
6743# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
6744# sort, nor does SunOS 4.x, so either it's something Intergraph added
6745# in CLIX, or something AT&T added in SVR3.2 or later, or something
6746# somebody else thought was a good idea; it's not documented in the
6747# man page for this version of "magic", nor does it appear to be
6748# implemented (at least not after I blew off the bogus code to turn
6749# old-style "&"s into new-style "&"s, which just didn't work at all).
6750#
67510	short		0575		CLIPPER COFF executable (VAX #)
6752>20	short		0407		(impure)
6753>20	short		0410		(5.2 compatible)
6754>20	short		0411		(pure)
6755>20	short		0413		(demand paged)
6756>20	short		0443		(target shared library)
6757>12	long		>0		not stripped
6758>22	short		>0		- version %d
67590	short		0577		CLIPPER COFF executable
6760>18	short&074000	000000		C1 R1
6761>18	short&074000	004000		C2 R1
6762>18	short&074000	010000		C3 R1
6763>18	short&074000	074000		TEST
6764>20	short		0407		(impure)
6765>20	short		0410		(pure)
6766>20	short		0411		(separate I&D)
6767>20	short		0413		(paged)
6768>20	short		0443		(target shared library)
6769>12	long		>0		not stripped
6770>22	short		>0		- version %d
6771>48	long&01		01		alignment trap enabled
6772>52	byte		1		-Ctnc
6773>52	byte		2		-Ctsw
6774>52	byte		3		-Ctpw
6775>52	byte		4		-Ctcb
6776>53	byte		1		-Cdnc
6777>53	byte		2		-Cdsw
6778>53	byte		3		-Cdpw
6779>53	byte		4		-Cdcb
6780>54	byte		1		-Csnc
6781>54	byte		2		-Cssw
6782>54	byte		3		-Cspw
6783>54	byte		4		-Cscb
67844	string		pipe		CLIPPER instruction trace
67854	string		prof		CLIPPER instruction profile
6786#------------------------------------------------------------------------------
6787# file:  file(1) magic for Clojure
6788# URL:  https://clojure.org/
6789# From: Jason Felice <jason.m.felice@gmail.com>
6790
67910	string/w	#!\ /usr/bin/clj	Clojure script text executable
6792!:mime	text/x-clojure
67930	string/w	#!\ /usr/local/bin/clj	Clojure script text executable
6794!:mime	text/x-clojure
67950	string/w	#!\ /usr/bin/clojure	Clojure script text executable
6796!:mime	text/x-clojure
67970	string/w	#!\ /usr/local/bin/clojure	Clojure script text executable
6798!:mime	text/x-clojure
67990	string/W	#!/usr/bin/env\ clj	Clojure script text executable
6800!:mime	text/x-clojure
68010	string/W	#!/usr/bin/env\ clojure	Clojure script text executable
6802!:mime	text/x-clojure
68030	string/W	#!\ /usr/bin/env\ clj	Clojure script text executable
6804!:mime	text/x-clojure
68050	string/W	#!\ /usr/bin/env\ clojure	Clojure script text executable
6806!:mime	text/x-clojure
6807
68080	regex	\^\\\(ns[[:space:]]+[a-z]	Clojure module source text
6809!:mime	text/x-clojure
6810
68110	regex	\^\\\(ns[[:space:]]+\\\^\\{:	Clojure module source text
6812!:mime	text/x-clojure
6813
68140	regex	\^\\\(defn-?[[:space:]]	Clojure module source text
6815!:mime	text/x-clojure
6816
6817#------------------------------------------------------------------------------
6818# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $
6819# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
6820#
6821# COFF
6822#
6823# by Joerg Jenderek at Oct 2015
6824# https://en.wikipedia.org/wiki/COFF
6825# https://de.wikipedia.org/wiki/Common_Object_File_Format
6826# http://www.delorie.com/djgpp/doc/coff/filhdr.html
6827
6828# display name+variables+flags of Common Object Files Format (32bit)
6829# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
6830# mips,motorola,msdos,osf1,sharc,varied.out,vax
68310	name				display-coff
6832# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
6833>18	uleshort&0x8E80	0
6834>>0	clear		x
6835# f_magic - magic number
6836# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
6837>>0	uleshort	0x014C		Intel 80386
6838# Hitachi SH big-endian COFF (./hitachi-sh)
6839>>0	uleshort	0x0500		Hitachi SH big-endian
6840# Hitachi SH little-endian COFF (./hitachi-sh)
6841>>0	uleshort	0x0550		Hitachi SH little-endian
6842# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
6843#>>0	uleshort	0x01DF
6844# MS Windows COFF Intel Itanium, AMD64
6845# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
6846>>0	uleshort	0x0200		Intel ia64
6847>>0	uleshort	0x8664		Intel amd64
6848# TODO for other COFFs
6849#>>0	uleshort	0xABCD		COFF_TEMPLATE
6850>>0	default		x
6851>>>0	uleshort	x		type 0x%04x
6852>>0	uleshort	x		COFF
6853# F_EXEC flag bit
6854>>18	leshort		^0x0002		object file
6855#!:mime	application/x-coff
6856#!:ext cof/o/obj/lib
6857>>18	leshort		&0x0002		executable
6858#!:mime	application/x-coffexec
6859# F_RELFLG flag bit,static object
6860>>18	leshort		&0x0001		\b, no relocation info
6861# F_LNNO flag bit
6862>>18	leshort		&0x0004		\b, no line number info
6863# F_LSYMS flag bit
6864>>18	leshort		&0x0008		\b, stripped
6865>>18	leshort		^0x0008		\b, not stripped
6866# flags in other COFF versions
6867#0x0010    F_FDPR_PROF
6868#0x0020    F_FDPR_OPTI
6869#0x0040    F_DSA
6870# F_AR32WR flag bit
6871#>>>18	leshort		&0x0100		\b, 32 bit little endian
6872#0x1000    F_DYNLOAD
6873#0x2000    F_SHROBJ
6874#0x4000    F_LOADONLY
6875# f_nscns - number of sections
6876>>2	uleshort	<2		\b, %d section
6877>>2	uleshort	>1		\b, %d sections
6878# f_timdat - file time & date stamp only for little endian
6879#>>4	date		x		\b, %s
6880# f_symptr - symbol table pointer, only for not stripped
6881>>8	ulelong		>0		\b, symbol offset=0x%x
6882# f_nsyms - number of symbols, only for not stripped
6883>>12	ulelong		>0		\b, %d symbols
6884# f_opthdr - optional header size
6885>>16	uleshort	>0		\b, optional header size %d
6886# at offset 20 can be optional header, extra bytes FILHSZ-20 because
6887# do not rely on sizeof(FILHDR) to give the correct size for header.
6888# or first section header
6889# additional variables for other COFF files
6890# >20	beshort		0407		(impure)
6891# >20	beshort		0410		(pure)
6892# >20	beshort		0413		(demand paged)
6893# >20	beshort		0421		(standalone)
6894# >22	leshort		>0		- version %d
6895# >168	string		.lowmem		Apple toolbox
6896
6897
6898#------------------------------------------------------------------------------
6899# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $
6900# commands:  file(1) magic for various shells and interpreters
6901#
6902#0	string/w	:			shell archive or script for antique kernel text
69030	string/wt	#!\ /bin/sh		POSIX shell script text executable
6904!:mime	text/x-shellscript
69050	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
6906!:mime	text/x-shellscript
6907
69080	string/wt	#!\ /bin/csh		C shell script text executable
6909!:mime	text/x-shellscript
6910
6911# korn shell magic, sent by George Wu, gwu@clyde.att.com
69120	string/wt	#!\ /bin/ksh		Korn shell script text executable
6913!:mime	text/x-shellscript
69140	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
6915!:mime	text/x-shellscript
6916
69170	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
6918!:mime	text/x-shellscript
69190	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
6920!:mime	text/x-shellscript
69210	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
6922!:mime	text/x-shellscript
69230	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
6924!:mime	text/x-shellscript
6925
6926#
6927# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
69280	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
6929!:mime	text/x-shellscript
69300	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
6931!:mime	text/x-shellscript
69320	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
6933!:mime	text/x-shellscript
69340	search/1	#!/usr/bin/env\ zsh	Paul Falstad's zsh script text executable
6935!:mime	text/x-shellscript
6936
69370	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
6938!:mime	text/x-shellscript
69390	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
6940!:mime	text/x-shellscript
69410	string/wt	#!\ /bin/nawk		new awk script text executable
6942!:mime	text/x-nawk
69430	string/wt	#!\ /usr/bin/nawk	new awk script text executable
6944!:mime	text/x-nawk
69450	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
6946!:mime	text/x-nawk
69470	string/wt	#!\ /bin/gawk		GNU awk script text executable
6948!:mime	text/x-gawk
69490	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
6950!:mime	text/x-gawk
69510	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
6952!:mime	text/x-gawk
6953#
69540	string/wt	#!\ /bin/awk		awk script text executable
6955!:mime	text/x-awk
69560	string/wt	#!\ /usr/bin/awk	awk script text executable
6957!:mime	text/x-awk
69580	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
6959
6960# AT&T Bell Labs' Plan 9 shell
69610	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
6962
6963# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
69640	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
6965!:mime	text/x-shellscript
69660	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
6967!:mime	text/x-shellscript
69680	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
6969!:mime	text/x-shellscript
69700	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
6971!:mime	text/x-shellscript
69720	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
6973!:mime	text/x-shellscript
69740	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
6975!:mime	text/x-shellscript
69760	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
6977!:mime	text/x-shellscript
69780	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
6979!:mime	text/x-shellscript
69800	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
6981!:mime	text/x-shellscript
6982
6983# Fish shell magic
6984# From: Benjamin Lowry <ben@ben.gmbh>
69850	string/wt	#!\ /usr/local/bin/fish		fish shell script text executable
6986!:mime	text/x-shellscript
69870	string/wt	#!\ /usr/bin/fish		fish shell script text executable
6988!:mime	text/x-shellscript
69890	string/wt	#!\ /usr/bin/env\ fish		fish shell script text executable
6990!:mime	text/x-shellscript
6991
6992
69930	search/1/wt	#!\ /usr/bin/tclsh	Tcl/Tk script text executable
6994!:mime  text/x-tcl
6995
69960	search/1/wt	#!\ /usr/bin/texlua	LuaTex script text executable
6997!:mime	text/x-luatex
6998
69990	search/1/wt	#!\ /usr/bin/luatex	LuaTex script text executable
7000!:mime	text/x-luatex
7001
70020	search/1/wt	#!\ /usr/bin/stap	Systemtap script text executable
7003!:mime  text/x-systemtap
7004
7005
7006
7007# PHP scripts
7008# Ulf Harnhammar <ulfh@update.uu.se>
70090	search/1/c	=<?php			PHP script text
7010!:strength + 30
7011!:mime	text/x-php
70120	search/1	=<?\n			PHP script text
7013!:mime	text/x-php
70140	search/1	=<?\r			PHP script text
7015!:mime	text/x-php
70160	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
7017!:strength + 10
7018!:mime	text/x-php
70190	search/1/w	#!\ /usr/bin/php	PHP script text executable
7020!:strength + 10
7021!:mime	text/x-php
7022# Smarty compiled template, https://www.smarty.net/
7023# Elan Ruusamae <glen@delfi.ee>
70240	string	=<?php
7025>5	regex	[\ \n]
7026>>6	string	/*\ Smarty\ version		Smarty compiled template
7027>>>24	regex	[0-9.]+				\b, version %s
7028!:mime	text/x-php
7029
70300	string		Zend\x00		PHP script Zend Optimizer data
7031
70320	string/t	$!			DCL command file
7033
7034# Type: Pdmenu
7035# URL:  https://packages.debian.org/pdmenu
7036# From: Edward Betts <edward@debian.org>
70370	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
7038
7039# From Danny Weldon
70400	string	\x0b\x13\x08\x00
7041>0x04   uleshort	<4      ksh byte-code version %d
7042
7043#----------------------------------------------------------------------------
7044# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
7045# communication
7046
7047# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
7048# It is used for conformance testing of communication protocols.
7049# Added by W. Borgert <debacle@debian.org>.
70500	string		$Suite			TTCN Abstract Test Suite
7051>&1	string		$SuiteId
7052>>&1	string		>\n			%s
7053>&2	string		$SuiteId
7054>>&1	string		>\n			%s
7055>&3	string		$SuiteId
7056>>&1	string		>\n			%s
7057
7058# MSC (message sequence charts) are a formal description technique,
7059# described in ITU-T Z.120, mainly used for communication protocols.
7060# Added by W. Borgert <debacle@debian.org>.
70610	string		mscdocument	Message Sequence Chart (document)
70620	string		msc		Message Sequence Chart (chart)
70630	string		submsc		Message Sequence Chart (subchart)
7064#------------------------------------------------------------------------------
7065# $File: compress,v 1.79 2020/05/30 23:53:04 christos Exp $
7066# compress:  file(1) magic for pure-compression formats (no archives)
7067#
7068# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
7069#
7070# Formats for various forms of compressed data
7071# Formats for "compress" proper have been moved into "compress.c",
7072# because it tries to uncompress it to figure out what's inside.
7073
7074# standard unix compress
70750	string		\037\235	compress'd data
7076!:mime	application/x-compress
7077!:apple	LZIVZIVU
7078>2	byte&0x80	>0		block compressed
7079>2	byte&0x1f	x		%d bits
7080
7081# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
7082# URL: https://en.wikipedia.org/wiki/Gzip
7083# Reference: https://tools.ietf.org/html/rfc1952
7084# Update: Joerg Jenderek, Apr 2019
7085#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
7086#	* Original filename is only at offset 10 if "extra field" absent
7087#	* Produce shorter output - notably, only report compression methods
7088#         other than 8 ("deflate", the only method defined in RFC 1952).
7089# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
7090# TODO:
7091# FBR	Blueberry FlashBack screen Record	https://www.flashbackrecorder.com/
7092# KPR	KOffice/Calligra KPresenter		application/x-kpresenter
7093# KPT	KOffice/Calligra KPresenter template?	application/x-kpresenter
7094# SAV	Diggles Saved Game File			http://www.innonics.com
7095# SAV	FarCry (demo) saved game		http://www.farcry-thegame.com
7096# DAT	ZOAGZIP game data format		http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
70970       string          \037\213
7098# to display gzip compressed (strength=100=2*50) before other (strength=50)?
7099#!:strength * 2
7100# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
7101>3	byte&0x18	=0
7102# For binary gzipped no ASCII text should occur
7103#	mcd-monu-cad.trid.xml
7104>>10	string		MCD			Monu-Cad Drawing, Component or Font
7105#>>36	string		Created\ with\ MONU-CAD
7106#!:mime	application/octet-stream
7107# http://fileformats.archiveteam.org/wiki/Monu-CAD
7108#	http://www.monucad.com/downloads/FullDemo-2005.EXE
7109#	/HANDS96.MCC	Component
7110#	/DEMO_DD01.MCD	Drawing
7111#	/MCALF020.FNT	Font
7112!:ext	mcc/mcd/fnt
7113# http://www.generalcadd.com
7114>>10	string		GXD			General CADD, Drawing or Component
7115#!:mime	application/octet-stream
7116#	/gxc/BUILDINGEDGE.gxc			Component
7117#	/gxd/HOCKETT-STPAUL-WRHSE.gxd		Drawing
7118#	/gxd/POWERLAND-MILL-ADD-11.gxd		Drawing		v9.1.06
7119!:ext	gxc/gxd
7120#>>>13	ubyte		0			\b, version 0
7121>>>13	string		09			\b, version 9
7122# other gzipped binary like gzipped tar, VirtualBox extension package,...
7123>>10	default		x		gzip compressed data
7124!:mime	application/gzip
7125>>>0	use	gzip-info
7126# size of the original (uncompressed) input data modulo 2^32
7127>>-0	offset		>48
7128>>>-4	ulelong		x		\b, original size modulo 2^32 %u
7129>>-0	offset		<48		\b, truncated
7130# gzipped TAR or VirtualBox extension package
7131#!:mime	application/x-compressed-tar
7132#!:mime	application/x-virtualbox-vbox-extpack
7133# https://www.w3.org/TR/SVG/mimereg.html
7134#!:mime	image/image/svg+xml-compressed
7135#	zlib.3.gz
7136#	microcode-20180312.tgz
7137#	tpz same as tgz
7138#	lua-md5_1.2-1_i386_i486.ipk	https://en.wikipedia.org/wiki/Opkg
7139#	Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
7140!:ext	gz/tgz/tpz/ipk/vbox-extpack/svgz
7141# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
7142>3	byte&0x18	>0		gzip compressed data
7143!:mime	application/gzip
7144# gzipped tar, gzipped Abiword document
7145#!:mime	application/x-compressed-tar
7146#!:mime	application/x-abiword-compressed
7147#!:mime	image/image/svg+xml-compressed
7148#	kleopatra_splashscreen.svgz	gzipped .svg
7149!:ext	gz/tgz/tpz/zabw/svgz
7150>>0	use	gzip-info
7151# size of the original (uncompressed) input data modulo 2^32
7152>>-0	offset		>48
7153>>>-4	ulelong		x		\b, original size modulo 2^32 %u
7154>>-0	offset		<48		\b, truncated
7155#	display information of gzip compressed files
71560	name				gzip-info
7157#>2	byte		x		THIS iS GZIP
7158>2	byte		<8		\b, reserved method
7159>2	byte		>8		\b, unknown method
7160>3	byte		&0x01		\b, ASCII
7161>3	byte		&0x02		\b, has CRC
7162>3	byte		&0x04		\b, extra field
7163>3	byte&0xC	=0x08
7164>>10	string		x		\b, was "%s"
7165>3	byte		&0x10		\b, has comment
7166>3	byte		&0x20		\b, encrypted
7167>4	ledate		>0		\b, last modified: %s
7168>8	byte		2		\b, max compression
7169>8	byte		4		\b, max speed
7170>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
7171>9	byte		=0x01		\b, from Amiga
7172>9	byte		=0x02		\b, from VMS
7173>9	byte		=0x03		\b, from Unix
7174>9	byte		=0x04		\b, from VM/CMS
7175>9	byte		=0x05		\b, from Atari
7176>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
7177>9	byte		=0x07		\b, from MacOS
7178>9	byte		=0x08		\b, from Z-System
7179>9	byte		=0x09		\b, from CP/M
7180>9	byte		=0x0A		\b, from TOPS/20
7181>9	byte		=0x0B		\b, from NTFS filesystem (NT)
7182>9	byte		=0x0C		\b, from QDOS
7183>9	byte		=0x0D		\b, from Acorn RISCOS
7184# size of the original (uncompressed) input data modulo 2^32
7185#>-4	ulelong		x		\b, original size modulo 2^32 %u
7186#ERROR: line 114: non zero offset 1048572 at level 1
7187
7188# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
71890	string		\037\036	packed data
7190!:mime	application/octet-stream
7191>2	belong		>1		\b, %d characters originally
7192>2	belong		=1		\b, %d character originally
7193#
7194# This magic number is byte-order-independent.
71950	short		0x1f1f		old packed data
7196!:mime	application/octet-stream
7197
7198# XXX - why *two* entries for "compacted data", one of which is
7199# byte-order independent, and one of which is byte-order dependent?
7200#
72010	short		0x1fff		compacted data
7202!:mime	application/octet-stream
7203# This string is valid for SunOS (BE) and a matching "short" is listed
7204# in the Ultrix (LE) magic file.
72050	string		\377\037	compacted data
7206!:mime	application/octet-stream
72070	short		0145405		huf output
7208!:mime	application/octet-stream
7209
7210# bzip2
72110	string		BZh		bzip2 compressed data
7212!:mime	application/x-bzip2
7213>3	byte		>47		\b, block size = %c00k
7214
7215# bzip	a block-sorting file compressor
7216#	by Julian Seward <sewardj@cs.man.ac.uk> and others
72170	string		BZ0		bzip compressed data
7218!:mime	application/x-bzip
7219>3	byte		>47		\b, block size = %c00k
7220
7221# lzip
72220	string		LZIP		lzip compressed data
7223!:mime application/x-lzip
7224>4	byte		x		\b, version: %d
7225
7226# squeeze and crunch
7227# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
72280	beshort		0x76FF		squeezed data,
7229>4	string		x		original name %s
72300	beshort		0x76FE		crunched data,
7231>2	string		x		original name %s
72320	beshort		0x76FD		LZH compressed data,
7233>2	string		x		original name %s
7234
7235# Freeze
72360	string		\037\237	frozen file 2.1
72370	string		\037\236	frozen file 1.0 (or gzip 0.5)
7238
7239# SCO compress -H (LZH)
72400	string		\037\240	SCO compress -H (LZH) data
7241
7242# European GSM 06.10 is a provisional standard for full-rate speech
7243# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
7244# excitation/long term prediction) coding at 13 kbit/s.
7245#
7246# There's only a magic nibble (4 bits); that nibble repeats every 33
7247# bytes.  This isn't suited for use, but maybe we can use it someday.
7248#
7249# This will cause very short GSM files to be declared as data and
7250# mismatches to be declared as data too!
7251#0	byte&0xF0	0xd0		data
7252#>33	byte&0xF0	0xd0
7253#>66	byte&0xF0	0xd0
7254#>99	byte&0xF0	0xd0
7255#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
7256
7257# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
72580	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
7259>9	beshort		<0x0940
7260>>9	byte&0xf0	=0x00		- version 0.
7261>>9	beshort&0x0fff	x		\b%03x,
7262>>13	byte		1		LZO1X-1,
7263>>13	byte		2		LZO1X-1(15),
7264>>13	byte		3		LZO1X-999,
7265## >>22	bedate		>0		last modified: %s,
7266>>14	byte		=0x00		os: MS-DOS
7267>>14	byte		=0x01		os: Amiga
7268>>14	byte		=0x02		os: VMS
7269>>14	byte		=0x03		os: Unix
7270>>14	byte		=0x05		os: Atari
7271>>14	byte		=0x06		os: OS/2
7272>>14	byte		=0x07		os: MacOS
7273>>14	byte		=0x0A		os: Tops/20
7274>>14	byte		=0x0B		os: WinNT
7275>>14	byte		=0x0E		os: Win32
7276>9	beshort		>0x0939
7277>>9	byte&0xf0	=0x00		- version 0.
7278>>9	byte&0xf0	=0x10		- version 1.
7279>>9	byte&0xf0	=0x20		- version 2.
7280>>9	beshort&0x0fff	x		\b%03x,
7281>>15	byte		1		LZO1X-1,
7282>>15	byte		2		LZO1X-1(15),
7283>>15	byte		3		LZO1X-999,
7284## >>25	bedate		>0		last modified: %s,
7285>>17	byte		=0x00		os: MS-DOS
7286>>17	byte		=0x01		os: Amiga
7287>>17	byte		=0x02		os: VMS
7288>>17	byte		=0x03		os: Unix
7289>>17	byte		=0x05		os: Atari
7290>>17	byte		=0x06		os: OS/2
7291>>17	byte		=0x07		os: MacOS
7292>>17	byte		=0x0A		os: Tops/20
7293>>17	byte		=0x0B		os: WinNT
7294>>17	byte		=0x0E		os: Win32
7295
7296# 4.3BSD-Quasijarus Strong Compression
7297# https://minnie.tuhs.org/Quasijarus/compress.html
72980	string		\037\241	Quasijarus strong compressed data
7299
7300# From: Cory Dikkers <cdikkers@swbell.net>
73010	string		XPKF		Amiga xpkf.library compressed data
73020	string		PP11		Power Packer 1.1 compressed data
73030	string		PP20		Power Packer 2.0 compressed data,
7304>4	belong		0x09090909	fast compression
7305>4	belong		0x090A0A0A	mediocre compression
7306>4	belong		0x090A0B0B	good compression
7307>4	belong		0x090A0C0C	very good compression
7308>4	belong		0x090A0C0D	best compression
7309
7310# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
7311# https://www.7-zip.org or DOC/7zFormat.txt
7312#
73130	string		7z\274\257\047\034	7-zip archive data,
7314>6	byte		x			version %d
7315>7	byte		x			\b.%d
7316!:mime	application/x-7z-compressed
7317!:ext 7z/cb7
7318
7319# Type: LZMA
73200	lelong&0xffffff	=0x5d
7321>12	leshort		0xff			LZMA compressed data,
7322!:mime	application/x-lzma
7323>>5	lequad		=0xffffffffffffffff	streamed
7324>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
7325>12	leshort		0			LZMA compressed data,
7326>>5	lequad		=0xffffffffffffffff	streamed
7327>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
7328
7329# http://tukaani.org/xz/xz-file-format.txt
73300	ustring		\xFD7zXZ\x00		XZ compressed data
7331!:strength * 2
7332!:mime	application/x-xz
7333
7334# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
73350	string		LRZI			LRZIP compressed data
7336>4	byte		x			- version %d
7337>5	byte		x			\b.%d
7338!:mime	application/x-lrzip
7339
7340# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
73410	lelong		0x184d2204	LZ4 compressed data (v1.4+)
7342!:mime	application/x-lz4
7343# Added by osm0sis@xda-developers.com
73440 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
7345!:mime	application/x-lz4
73460	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
7347!:mime	application/x-lz4
7348
7349# Zstandard/LZ4 skippable frames
7350# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
73510         lelong&0xFFFFFFF0  0x184D2A50
7352>(4.l+8)  indirect	x
7353
7354# Zstandard Dictionary ID subroutine
73550     name        zstd-dictionary-id
7356# Single Segment = True
7357>0    byte        &0x20   \b, Dictionary ID:
7358>>0   byte&0x03   0       None
7359>>0   byte&0x03   1
7360>>>1  byte        x       %u
7361>>0   byte&0x03   2
7362>>>1  leshort     x       %u
7363>>0   byte&0x03   3
7364>>>1  lelong      x       %u
7365# Single Segment = False
7366>0    byte        ^0x20   \b, Dictionary ID:
7367>>0   byte&0x03   0       None
7368>>0   byte&0x03   1
7369>>>2  byte        x       %u
7370>>0   byte&0x03   2
7371>>>2  leshort     x       %u
7372>>0   byte&0x03   3
7373>>>2  lelong      x       %u
7374
7375# Zstandard compressed data
7376# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
73770     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
7378!:mime  application/zstd
73790     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
7380!:mime  application/zstd
73810     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
7382!:mime  application/zstd
73830     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
7384!:mime  application/zstd
73850     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
7386!:mime  application/zstd
73870     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
7388!:mime  application/zstd
7389>4    use          zstd-dictionary-id
73900     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
7391!:mime  application/zstd
7392>4    use          zstd-dictionary-id
7393
7394# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
73950  lelong    0xEC30A437  Zstandard dictionary
7396!:mime  application/x-std-dictionary
7397>4 lelong    x           (ID %u)
7398
7399# AFX compressed files (Wolfram Kleff)
74002	string		-afx-		AFX compressed file data
7401
7402# Supplementary magic data for the file(1) command to support
7403# rzip(1).  The format is described in magic(5).
7404#
7405# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
7406# this file.
7407#
74080	string		RZIP		rzip compressed data
7409>4	byte		x		- version %d
7410>5	byte		x		\b.%d
7411>6	belong		x		(%d bytes)
7412
74130	string		ArC\x01		FreeArc archive <http://freearc.org>
7414
7415# Type:	DACT compressed files
74160	long	0x444354C3	DACT compressed data
7417>4	byte	>-1		(version %i.
7418>5	byte	>-1		%i.
7419>6	byte	>-1		%i)
7420>7	long	>0		, original size: %i bytes
7421>15	long	>30		, block size: %i bytes
7422
7423# Valve Pack (VPK) files
74240	lelong	0x55aa1234	Valve Pak file
7425>0x4	lelong	x		\b, version %u
7426>0x8	lelong	x		\b, %u entries
7427
7428# Snappy framing format
7429# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
74300	string	\377\006\0\0sNaPpY	snappy framed data
7431!:mime	application/x-snappy-framed
7432
7433# qpress, https://www.quicklz.com/
74340	string	qpress10	qpress compressed data
7435!:mime	application/x-qpress
7436
7437# Zlib https://www.ietf.org/rfc/rfc6713.txt
74380	string/b	x
7439>0	beshort%31	=0
7440>>0	byte&0xf	=8
7441>>>0	byte&0x80 	=0	zlib compressed data
7442!:mime	application/zlib
7443
7444# BWC compression
74450	string		BWC
7446>3	byte		0	BWC compressed data
7447
7448# UCL compression
74490	bequad		0x00e955434cff011a	UCL compressed data
7450
7451# Softlib archive
74520	string		SLIB	Softlib archive
7453>4	leshort		x	\b, version %d
7454>6	leshort		x	(contains %d files)
7455
7456# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
7457# From: Eric Hall <eric.hall@darkart.com>
74580	string	bvx-	lzfse encoded, no compression
74590	string	bvx1	lzfse compressed, uncompressed tables
74600	string	bvx2	lzfse compressed, compressed tables
74610	string	bvxn	lzfse encoded, lzvn compressed
7462
7463# pcxLib.exe compression program
7464# http://www.shikadi.net/moddingwiki/PCX_Library
74650	string/b	pcxLib
7466>0x0A	string/b	Copyright\020(c)\020Genus\020Microprogramming,\020Inc.	pcxLib compressed
7467
7468#------------------------------------------------------------------------------
7469# $File: console,v 1.55 2020/04/19 17:30:55 christos Exp $
7470# Console game magic
7471# Toby Deshane <hac@shoelace.digivill.net>
7472
7473# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
7474# Updated by David Korth <gerbilsoft@gerbilsoft.com>
7475# References:
7476# - https://wiki.nesdev.com/w/index.php/INES
7477# - https://wiki.nesdev.com/w/index.php/NES_2.0
7478
7479# Common header for iNES, NES 2.0, and Wii U iNES.
74800	name		nes-rom-image-ines
7481>7	byte&0x0C	=0x8		(NES 2.0)
7482>4	byte		x		\b: %ux16k PRG
7483>5	byte		x		\b, %ux8k CHR
7484>6	byte&0x08	=0x8		[4-Scr]
7485>6	byte&0x09	=0x0		[H-mirror]
7486>6	byte&0x09	=0x1		[V-mirror]
7487>6	byte&0x02	=0x2		[SRAM]
7488>6	byte&0x04	=0x4		[Trainer]
7489>7	byte&0x03	=0x2		[PC10]
7490>7	byte&0x03	=0x1		[VS]
7491>>7	byte&0x0C	=0x8
7492# NES 2.0: VS PPU
7493>>>13	byte&0x0F	=0x0		\b, RP2C03B
7494>>>13	byte&0x0F	=0x1		\b, RP2C03G
7495>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
7496>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
7497>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
7498>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
7499>>>13	byte&0x0F	=0x6		\b, RP2C03B
7500>>>13	byte&0x0F	=0x7		\b, RP2C03C
7501>>>13	byte&0x0F	=0x8		\b, RP2C05-01
7502>>>13	byte&0x0F	=0x9		\b, RP2C05-02
7503>>>13	byte&0x0F	=0xA		\b, RP2C05-03
7504>>>13	byte&0x0F	=0xB		\b, RP2C05-04
7505>>>13	byte&0x0F	=0xC		\b, RP2C05-05
7506# TODO: VS protection hardware?
7507>>7	byte		x		\b]
7508# NES 2.0-specific flags.
7509>7	byte&0x0C	=0x8
7510>>12	byte&0x03	=0x0		[NTSC]
7511>>12	byte&0x03	=0x1		[PAL]
7512>>12	byte&0x02	=0x2		[NTSC+PAL]
7513
7514# Standard iNES ROM header.
75150	string		NES\x1A		NES ROM image (iNES)
7516!:mime	application/x-nes-rom
7517>0	use		nes-rom-image-ines
7518
7519# Wii U Virtual Console iNES ROM header.
75200	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
7521!:mime	application/x-nes-rom
7522>0	use		nes-rom-image-ines
7523
7524#------------------------------------------------------------------------------
7525# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
7526# Reference: https://wiki.nesdev.com/w/index.php/UNIF
7527# From: David Korth <gerbilsoft@gerbilsoft.com>
7528#
7529# NOTE: The UNIF format uses chunks instead of a fixed header,
7530# so most of the data isn't easily parseable.
7531#
75320	string	UNIF
7533>4	lelong	<16	NES ROM image (UNIF v%d format)
7534!:mime	application/x-nes-rom
7535
7536#------------------------------------------------------------------------------
7537# fds: file(1) magic for Famciom Disk System disk images
7538# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
7539# From: David Korth <gerbilsoft@gerbilsoft.com>
7540# TODO: Check "Disk info block" and get info from that in addition to the optional header.
7541
7542# Disk info block. (block 1)
75430	name	nintendo-fds-disk-info-block
7544>23	byte	!1		FMC-
7545>23	byte	1		FSC-
7546>16	string	x		\b%.3s
7547>15	byte	x		\b, mfr %02X
7548>20	byte	x		(Rev.%02u)
7549
7550# Headered version.
75510	string	FDS\x1A
7552>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7553!:mime	application/x-fds-disk
7554>>0x10	use	nintendo-fds-disk-info-block
7555>4	byte	1	(%u side)
7556>4	byte	!1	(%u sides)
7557
7558# Unheadered version.
75591	string	*NINTENDO-HVC*	Famicom Disk System disk image:
7560!:mime	application/x-fds-disk
7561>0	use	nintendo-fds-disk-info-block
7562
7563#------------------------------------------------------------------------------
7564# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
7565# Used by Nintendo 3DS NES Virtual Console games.
7566# From: David Korth <gerbilsoft@gerbilsoft.com>
7567#
75680		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
7569!:mime		application/x-nes-rom
7570>4		byte	100	\b: FDS,
7571>>0x2010	use	nintendo-fds-disk-info-block
7572>4		byte	!100	\b: TNES mapper %u
7573>>5	byte		x		\b, %ux8k PRG
7574>>6	byte		x		\b, %ux8k CHR
7575>>7	byte&0x08	=1		[WRAM]
7576>>8	byte&0x09	=1		[H-mirror]
7577>>8	byte&0x09	=2		[V-mirror]
7578>>8	byte&0x02	=3		[VRAM]
7579
7580#------------------------------------------------------------------------------
7581# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
7582# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
7583#
75840x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
7585# TODO: application/x-gameboy-color-rom for GBC.
7586!:mime		application/x-gameboy-rom
7587>0x143		byte&0x80	0x80
7588>>0x134		string		>\0			\b: "%.15s"
7589>0x143		byte&0x80	!0x80
7590>>0x134		string		>\0			\b: "%.16s"
7591>0x14c		byte		x			(Rev.%02u)
7592
7593# Machine type. (SGB, CGB, SGB+CGB)
7594>0x14b		byte		0x33
7595>>0x146		byte		0x03
7596>>>0x143	byte&0x80	0x80	[SGB+CGB]
7597>>>0x143	byte&0x80	!0x80	[SGB]
7598>>0x146		byte		!0x03
7599>>>0x143	byte&0xC0	0x80	[CGB]
7600>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
7601>0x14b		byte		!0x33
7602
7603# Mapper.
7604>0x147 byte 0x00  [ROM ONLY]
7605>0x147 byte 0x01  [MBC1]
7606>0x147 byte 0x02  [MBC1+RAM]
7607>0x147 byte 0x03  [MBC1+RAM+BATT]
7608>0x147 byte 0x05  [MBC2]
7609>0x147 byte 0x06  [MBC2+BATTERY]
7610>0x147 byte 0x08  [ROM+RAM]
7611>0x147 byte 0x09  [ROM+RAM+BATTERY]
7612>0x147 byte 0x0B  [MMM01]
7613>0x147 byte 0x0C  [MMM01+SRAM]
7614>0x147 byte 0x0D  [MMM01+SRAM+BATT]
7615>0x147 byte 0x0F  [MBC3+TIMER+BATT]
7616>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
7617>0x147 byte 0x11  [MBC3]
7618>0x147 byte 0x12  [MBC3+RAM]
7619>0x147 byte 0x13  [MBC3+RAM+BATT]
7620>0x147 byte 0x19  [MBC5]
7621>0x147 byte 0x1A  [MBC5+RAM]
7622>0x147 byte 0x1B  [MBC5+RAM+BATT]
7623>0x147 byte 0x1C  [MBC5+RUMBLE]
7624>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
7625>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
7626>0x147 byte 0xFC  [Pocket Camera]
7627>0x147 byte 0xFD  [Bandai TAMA5]
7628>0x147 byte 0xFE  [Hudson HuC-3]
7629>0x147 byte 0xFF  [Hudson HuC-1]
7630
7631# ROM size.
7632>0x148 byte 0     \b, ROM: 256Kbit
7633>0x148 byte 1     \b, ROM: 512Kbit
7634>0x148 byte 2     \b, ROM: 1Mbit
7635>0x148 byte 3     \b, ROM: 2Mbit
7636>0x148 byte 4     \b, ROM: 4Mbit
7637>0x148 byte 5     \b, ROM: 8Mbit
7638>0x148 byte 6     \b, ROM: 16Mbit
7639>0x148 byte 7     \b, ROM: 32Mbit
7640>0x148 byte 0x52  \b, ROM: 9Mbit
7641>0x148 byte 0x53  \b, ROM: 10Mbit
7642>0x148 byte 0x54  \b, ROM: 12Mbit
7643
7644# RAM size.
7645>0x149 byte 1     \b, RAM: 16Kbit
7646>0x149 byte 2     \b, RAM: 64Kbit
7647>0x149 byte 3     \b, RAM: 128Kbit
7648>0x149 byte 4     \b, RAM: 1Mbit
7649>0x149 byte 5     \b, RAM: 512Kbit
7650
7651#------------------------------------------------------------------------------
7652# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
7653# Updated by David Korth <gerbilsoft@gerbilsoft.com>
7654# References:
7655# - https://www.retrodev.com/segacd.html
7656# - http://devster.monkeeh.com/sega/32xguide1.txt
7657#
7658
7659# Common Sega Mega Drive header format.
7660# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
76610		name	sega-mega-drive-header
7662# ROM title. (Use domestic if present; if not, use international.)
7663>0x120		byte	>0x20
7664>>0x120		string	>\0	\b: "%.16s"
7665>0x120		byte	<0x21
7666>>0x150		string	>\0	\b: "%.16s"
7667# Other information.
7668>0x180		string	>\0	(%.14s
7669>>0x110		string  >\0	\b, %.16s
7670>0x180		byte	0
7671>>0x110		string  >\0	(%.16s
7672>0		byte	x	\b)
7673
7674# TODO: Check for 32X CD?
7675# Sega Mega CD disc images: 2048-byte sectors.
76760	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
7677!:mime	application/x-sega-cd-rom
7678>0	use	sega-mega-drive-header
7679>0	byte	x			\b, 2048-byte sectors
76800	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
7681!:mime	application/x-sega-cd-rom
7682>0	use	sega-mega-drive-header
7683>0	byte	x			\b, 2048-byte sectors
7684# Sega Mega CD disc images: 2352-byte sectors.
76850x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
7686!:mime	application/x-sega-cd-rom
7687>0x10	use	sega-mega-drive-header
7688>0	byte	x			\b, 2352-byte sectors
76890x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
7690!:mime	application/x-sega-cd-rom
7691>0x10	use	sega-mega-drive-header
7692>0	byte	x			\b, 2352-byte sectors
7693
7694# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
76950x100		string	SEGA
7696>0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
7697!:mime		application/x-genesis-32x-rom
7698>>0		use	sega-mega-drive-header
7699>0x3C0		bequad	!0x4D41525320434845
7700>>0x105		belong	0x5049434F	Sega Pico ROM image
7701!:mime		application/x-sega-pico-rom
7702>>>0		use	sega-mega-drive-header
7703>>0x105		belong	!0x5049434F
7704>>>0x180	beshort	0x4252		Sega Mega CD Boot ROM image
7705!:mime		application/x-genesis-rom
7706>>>0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
7707!:mime		application/x-genesis-rom
7708>>>0		use	sega-mega-drive-header
7709
7710#------------------------------------------------------------------------------
7711# genesis: file(1) magic for the Super MegaDrive ROM dump format
7712#
7713
7714# NOTE: Due to interleaving, we can't display anything
7715# other than the copier header information.
77160      name    sega-genesis-smd-header
7717>0     byte    x       %dx16k blocks
7718>2     byte    0       \b, last in series or standalone
7719>2     byte    >0      \b, split ROM
7720
7721# "Sega Genesis" header.
77220x280	string EAGN
7723>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
7724!:mime	application/x-genesis-rom
7725>>0	use     sega-genesis-smd-header
7726
7727# "Sega Mega Drive" header.
77280x280	string EAMG
7729>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
7730!:mime	application/x-genesis-rom
7731>>0	use     sega-genesis-smd-header
7732
7733#------------------------------------------------------------------------------
7734# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
7735# Detects all Game Gear and export Sega Master System ROM images,
7736# and some Japanese Sega Master System ROM images.
7737# From: David Korth <gerbilsoft@gerbilsoft.com>
7738# Reference: https://www.smspower.org/Development/ROMHeader
7739#
7740
7741# General SMS header rule.
7742# The SMS boot ROM checks the header at three locations.
77430	name	sega-master-system-rom-header
7744# Machine type.
7745>0x0F	byte&0xF0	0x30	Sega Master System
7746!:mime	application/x-sms-rom
7747>0x0F	byte&0xF0	0x40	Sega Master System
7748!:mime	application/x-sms-rom
7749>0x0F	byte&0xF0	0x50	Sega Game Gear
7750!:mime	application/x-gamegear-rom
7751>0x0F	byte&0xF0	0x60	Sega Game Gear
7752!:mime	application/x-gamegear-rom
7753>0x0F	byte&0xF0	0x70	Sega Game Gear
7754!:mime	application/x-gamegear-rom
7755>0x0F	default		x	Sega Master System / Game Gear
7756!:mime	application/x-sms-rom
7757>0	byte		x	ROM image:
7758# Product code.
7759>0x0E	byte&0xF0	0x10	1
7760>0x0E	byte&0xF0	0x20	2
7761>0x0E	byte&0xF0	0x30	3
7762>0x0E	byte&0xF0	0x40	4
7763>0x0E	byte&0xF0	0x50	5
7764>0x0E	byte&0xF0	0x60	6
7765>0x0E	byte&0xF0	0x70	7
7766>0x0E	byte&0xF0	0x80	8
7767>0x0E	byte&0xF0	0x90	9
7768>0x0E	byte&0xF0	0xA0	10
7769>0x0E	byte&0xF0	0xB0	11
7770>0x0E	byte&0xF0	0xC0	12
7771>0x0E	byte&0xF0	0xD0	13
7772>0x0E	byte&0xF0	0xE0	14
7773>0x0E	byte&0xF0	0xF0	15
7774# If the product code is 5 digits, we'll need to backspace here.
7775>0x0E	byte&0xF0	!0
7776>>0x0C	leshort		x	\b%04x
7777>0x0E	byte&0xF0	0
7778>>0x0C	leshort		x	%04x
7779# Revision.
7780>0x0E	byte&0x0F	x	(Rev.%02d)
7781# ROM size. (Used for the boot ROM checksum routine.)
7782>0x0F	byte&0x0F	0x0A	(8 KB)
7783>0x0F	byte&0x0F	0x0B	(16 KB)
7784>0x0F	byte&0x0F	0x0C	(32 KB)
7785>0x0F	byte&0x0F	0x0D	(48 KB)
7786>0x0F	byte&0x0F	0x0E	(64 KB)
7787>0x0F	byte&0x0F	0x0F	(128 KB)
7788>0x0F	byte&0x0F	0x00	(256 KB)
7789>0x0F	byte&0x0F	0x01	(512 KB)
7790>0x0F	byte&0x0F	0x02	(1 MB)
7791
7792# SMS/GG header locations.
77930x7FF0	string	TMR\ SEGA
7794>0x7FF0	use	sega-master-system-rom-header
77950x3FF0	string	TMR\ SEGA
7796>0x3FF0	use	sega-master-system-rom-header
77970x1FF0	string	TMR\ SEGA
7798>0x1FF0	use	sega-master-system-rom-header
7799
7800#------------------------------------------------------------------------------
7801# saturn: file(1) magic for the Sega Saturn disc image format.
7802# From: David Korth <gerbilsoft@gerbilsoft.com>
7803#
7804
7805# Common Sega Saturn disc header format.
7806# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
7807# TODO: Release date, device information, region code, others?
78080	name	sega-saturn-disc-header
7809>0x60	string	>\0	\b: "%.32s"
7810>0x20	string	>\0	(%.10s
7811>>0x2A	string	>\0	\b, %.6s)
7812>>0x2A	byte	0	\b)
7813
7814# 2048-byte sector version.
78150	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
7816!:mime	application/x-saturn-rom
7817>0	use	sega-saturn-disc-header
7818>0	byte	x			(2048-byte sectors)
7819# 2352-byte sector version.
78200x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
7821!:mime	application/x-saturn-rom
7822>0x10	use	sega-saturn-disc-header
7823>0	byte	x			(2352-byte sectors)
7824
7825#------------------------------------------------------------------------------
7826# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
7827# From: David Korth <gerbilsoft@gerbilsoft.com>
7828# Reference: https://mc.pp.se/dc/ip0000.bin.html
7829#
7830
7831# Common Sega Dreamcast disc header format.
7832# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
7833# TODO: Release date, device information, region code, others?
78340	name	sega-dreamcast-disc-header
7835>0x80	string	>\0	\b: "%.32s"
7836>0x40	string	>\0	(%.10s
7837>>0x4A	string	>\0	\b, %.6s)
7838>>0x4A	byte	0	\b)
7839
7840# 2048-byte sector version.
78410	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
7842!:mime	application/x-dc-rom
7843>0	use	sega-dreamcast-disc-header
7844>0	byte	x			(2048-byte sectors)
7845# 2352-byte sector version.
78460x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
7847!:mime	application/x-dc-rom
7848>0x10	use	sega-dreamcast-disc-header
7849>0	byte	x			(2352-byte sectors)
7850
7851#------------------------------------------------------------------------------
7852# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
7853#
78540 belong 0x21068028   Sega Dreamcast VMU game image
78550 string LCDi         Dream Animator file
7856
7857#------------------------------------------------------------------------------
7858# z64: file(1) magic for the Z64 format N64 ROM dumps
7859# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
7860# From: David Korth <gerbilsoft@gerbilsoft.com>
7861#
78620	bequad	0x803712400000000F	Nintendo 64 ROM image
7863!:mime	application/x-n64-rom
7864>0x20	string	>\0	\b: "%.20s"
7865>0x3B	string	x	(%.4s
7866>0x3F	byte	x	\b, Rev.%02u)
7867
7868#------------------------------------------------------------------------------
7869# v64: file(1) magic for the V64 format N64 ROM dumps
7870# Same as z64 format, but with 16-bit byteswapping.
7871#
78720	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
7873!:mime	application/x-n64-rom
7874
7875#------------------------------------------------------------------------------
7876# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
7877# Same as z64 format, but with swapped 16-bit words.
7878#
78790	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
7880!:mime	application/x-n64-rom
7881
7882#------------------------------------------------------------------------------
7883# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
7884# Same as z64 format, but with 32-bit byteswapping.
7885#
78860	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
7887!:mime	application/x-n64-rom
7888
7889#------------------------------------------------------------------------------
7890# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
7891# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader
7892#
7893# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
7894# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
7895#
78964	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
7897!:mime	application/x-gba-rom
7898>0xA0	string	>\0	\b: "%.12s"
7899>0xAC	string	x	(%.6s
7900>0xBC	byte	x	\b, Rev.%02u)
7901
7902#------------------------------------------------------------------------------
7903# nds: file(1) magic for the Nintendo DS(i) raw ROM format
7904# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader
7905#
7906# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
7907# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
7908#
79090xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
7910!:mime	application/x-nintendo-ds-rom
7911>0x00	string	>\0		\b: "%.12s"
7912>0x0C	string	x		(%.6s
7913>0x1E	byte	x		\b, Rev.%02u)
7914>0x12	byte	2		(DSi enhanced)
7915>0x12	byte	3		(DSi only)
7916# Secure Area check.
7917>0x20		lelong	<0x4000		(homebrew)
7918>0x20		lelong	>0x3FFF
7919>>0x4000	lequad	0x0000000000000000	(multiboot)
7920>>0x4000	lequad	!0x0000000000000000
7921>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
7922>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
7923>>>>0x1000	lequad	0x0000000000000000	(encrypted)
7924>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)
7925
7926#------------------------------------------------------------------------------
7927# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
7928# This is also used for loading .nds files using the MSET exploit on 3DS.
7929# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
79300xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
7931!:mime	application/x-nintendo-ds-rom
7932
7933#------------------------------------------------------------------------------
7934# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
7935# From: David Korth <gerbilsoft@gerbilsoft.com>
7936# References:
7937# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
7938# - https://www.devrs.com/ngp/files/ngpctech.txt
7939#
79400x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
7941!:mime	application/x-neo-geo-pocket-rom
7942>0x23	byte	0x10			Color
7943>0	byte	x			ROM image
7944>0x24	string	>\0			\b: "%.12s"
7945>0x1F	byte	0xFF			(debug mode enabled)
7946
7947#------------------------------------------------------------------------------
7948# msx: file(1) magic for MSX game cartridge dumps
7949# Too simple - MPi
7950#0 beshort 0x4142 MSX game cartridge dump
7951
7952#------------------------------------------------------------------------------
7953# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
79540	string	PS-X\ EXE	Sony Playstation executable
7955>16	lelong	x		PC=0x%08x,
7956>20	lelong	!0		GP=0x%08x,
7957>24	lelong	!0		.text=[0x%08x,
7958>>28	lelong	x		\b0x%x],
7959>32	lelong	!0		.data=[0x%08x,
7960>>36	lelong	x		\b0x%x],
7961>40	lelong	!0		.bss=[0x%08x,
7962>>44	lelong	x		\b0x%x],
7963>48	lelong	!0		Stack=0x%08x,
7964>48	lelong	=0		No Stack!,
7965>52	lelong	!0		StackSize=0x%x,
7966#>76	string	>\0		(%s)
7967#  Area:
7968>113	string	x		(%s)
7969
7970# CPE executables
79710	string	CPE		CPE executable
7972>3	byte	x		(version %d)
7973
7974#------------------------------------------------------------------------------
7975# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
79760	string	XBEH	Microsoft Xbox executable
7977!:mime	audio/x-xbox-executable
7978!:ext	xbe
7979# expect base address of 0x10000
7980>0x0104                 ulelong =0x10000
7981>>(0x0118.l-0x0FFF4)    lestring16 x       \b: "%.40s"
7982>>(0x0118.l-0x0FFF5)    byte     x         (%c
7983>>(0x0118.l-0x0FFF6)    byte     x         \b%c-
7984>>(0x0118.l-0x0FFF8)    uleshort x         \b%03u)
7985>>(0x0118.l-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
7986>>(0x0118.l-0x0FF60)    ulelong&0x80000007  !0x80000007
7987>>>(0x0118.l-0x0FF60)   ulelong >0           (regions:
7988>>>>(0x0118.l-0x0FF60)  ulelong &0x00000001  NA
7989>>>>(0x0118.l-0x0FF60)  ulelong &0x00000002  Japan
7990>>>>(0x0118.l-0x0FF60)  ulelong &0x00000004  Rest_of_World
7991>>>>(0x0118.l-0x0FF60)  ulelong &0x80000000  Manufacturer
7992>>>(0x0118.l-0x0FF60)   ulelong >0           \b)
7993# probabilistic checks whether signed or not
7994>0x0004 ulelong =0x0
7995>>&2    ulelong =0x0
7996>>>&2   ulelong =0x0  \b, not signed
7997>0x0004 ulelong >0
7998>>&2    ulelong >0
7999>>>&2   ulelong >0    \b, signed
8000
8001# --------------------------------
8002# Microsoft Xbox data file formats
80030       string          XIP0            XIP, Microsoft Xbox data
80040       string          XTF0            XTF, Microsoft Xbox data
8005
8006#------------------------------------------------------------------------------
8007# Microsoft Xbox 360 executables (.xex)
8008# From: David Korth <gerbilsoft@gerbilsoft.com>
8009# References:
8010# - https://free60project.github.io/wiki/XEX.html
8011# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
8012
8013# Title ID (part of Execution ID section)
80140		name	xbox-360-xex-execution-id
8015>(0.L+0xC)	byte	x	(%c
8016>(0.L+0xD)	byte	x	\b%c
8017>(0.L+0xE)	beshort	x	\b-%04u, media ID:
8018>(0.L)		belong	x	%08X)
8019
8020# Region code (part of Security Info)
80210	name	xbox-360-xex-region-code
8022>0	ubelong	0xFFFFFFFF	\b, all regions
8023>0	ubelong	!0xFFFFFFFF
8024>>0	ubelong	>0		(regions:
8025>>0	ubelong&0x000000FF	0x000000FF	USA
8026>>0	ubelong&0x00000100	0x00000100	Japan
8027>>0	ubelong&0x00000200	0x00000200	China
8028>>0	ubelong&0x0000FC00	0x0000FC00	Asia
8029>>0	ubelong&0x00FF0000	0x00FF0000	PAL
8030>>0	ubelong&0x00FF0000	0x00FE0000	PAL [except AU/NZ]
8031>>0	ubelong&0x00FF0000	0x00010000	AU/NZ
8032>>0	ubelong&0xFF000000	0xFF000000	Other
8033>>0	ubelong	>0		\b)
8034
80350	string	XEX2	Microsoft Xbox 360 executable
8036!:mime	audio/x-xbox360-executable
8037!:ext	xex
8038>0x18	search/0x100	\x00\x04\x00\x06
8039>>&0	use	xbox-360-xex-execution-id
8040>(0x010.L+0x178)	use	xbox-360-xex-region-code
8041
80420	string	XEX1	Microsoft Xbox 360 executable (XEX1)
8043!:mime	audio/x-xbox360-executable
8044!:ext	xex
8045>0x18	search/0x100	\x00\x04\x00\x06
8046>>&0	use	xbox-360-xex-execution-id
8047>(0x010.L+0x154)	use	xbox-360-xex-region-code
8048
8049#------------------------------------------------------------------------------
8050# Microsoft Xbox 360 packages
8051# From: David Korth <gerbilsoft@gerbilsoft.com>
8052# References:
8053# - https://free60project.github.io/wiki/STFS.html
8054# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
8055
8056# TODO: More information for console-signed packages.
8057
80580	name	xbox-360-package
8059>0x360	byte	x	(%c
8060>0x361	byte	x	\b%c
8061>0x362	beshort	x	\b-%04u, media ID:
8062>0x354	belong	x	%08X)
8063>0x344	belong	x	\b, content type:
8064>>0x344	belong	0x1		Saved Game
8065>>0x344	belong	0x2		Marketplace Content
8066>>0x344	belong	0x3		Publisher
8067>>0x344	belong	0x1000		Xbox 360 Title
8068>>0x344	belong	0x2000		IPTV Pause Buffer
8069>>0x344	belong	0x4000		Installed Game
8070>>0x344	belong	0x5000		Original Xbox Game
8071>>0x344	belong	0x9000		Avatar Item
8072>>0x344	belong	0x10000		Profile
8073>>0x344	belong	0x20000		Gamer Picture
8074>>0x344	belong	0x30000		Theme
8075>>0x344	belong	0x40000		Cache File
8076>>0x344	belong	0x50000		Storage Download
8077>>0x344	belong	0x60000		Xbox Saved Game
8078>>0x344	belong	0x70000		Xbox Download
8079>>0x344	belong	0x80000		Game Demo
8080>>0x344	belong	0x90000		Video
8081>>0x344	belong	0xA0000		Game
8082>>0x344	belong	0xB0000		Installer
8083>>0x344	belong	0xC0000		Game Trailer
8084>>0x344	belong	0xD0000		Arcade Title
8085>>0x344	belong	0xE0000		XNA
8086>>0x344	belong	0xF0000		License Store
8087>>0x344	belong	0x100000	Movie
8088>>0x344	belong	0x200000	TV
8089>>0x344	belong	0x300000	Music Video
8090>>0x344	belong	0x400000	Game Video
8091>>0x344	belong	0x500000	Podcast Video
8092>>0x344	belong	0x600000	Viral Video
8093>>0x344	belong	0x2000000	Community Game
8094
80950	string	CON\x20	Microsoft Xbox 360 package (console-signed)
8096>0	use	xbox-360-package
80970	string	PIRS
8098>0	belong	0	Microsoft Xbox 360 package (non-Xbox Live)
8099>>0	use	xbox-360-package
81000	string	LIVE
8101>0x104	belong	0	Microsoft Xbox 360 package (Xbox Live)
8102>>0	use	xbox-360-package
8103
8104# Atari Lynx cartridge dump (EXE/BLL header)
8105# From: "Stefan A. Haubenthal" <polluks@web.de>
8106
8107# Double-check that the image type matches too, 0x8008 conflicts with
8108# 8 character OMF-86 object file headers.
81090	beshort		0x8008
8110>6	string		BS93		Lynx homebrew cartridge
8111!:mime	application/x-atari-lynx-rom
8112>>2	beshort		x		\b, RAM start $%04x
8113>6	string		LYNX		Lynx cartridge
8114!:mime	application/x-atari-lynx-rom
8115>>2	beshort		x		\b, RAM start $%04x
8116
8117# Opera file system that is used on the 3DO console
8118# From: Serge van den Boom <svdb@stack.nl>
81190	string		\x01ZZZZZ\x01	3DO "Opera" file system
8120
8121# From: Alex Myczko <alex@aiei.ch>
8122# From: David Pflug <david@pflug.email>
8123# is the offset 12 or the offset 16 correct?
8124# GBS (Game Boy Sound) magic
8125# ftp://ftp.modland.com/pub/documents/format_documentation/\
8126# Gameboy%20Sound%20System%20(.gbs).txt
81270	string		GBS		Nintendo Gameboy Music/Audio Data
8128#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
8129>16	string		>\0	("%.32s" by
8130>48	string		>\0	%.32s, copyright
8131>80	string		>\0	%.32s),
8132>3	byte		x	version %u,
8133>4	byte		x	%u tracks
8134
8135# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
8136# see https://zerosoft.zophar.net/ips.php
81370	string	PATCH			IPS patch file
8138!:ext	ips
8139
8140# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8141# Reference: https://www.romhacking.net/documents/746/
81420	string	BPS1			BPS patch file
8143!:ext	bps
8144
8145# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8146# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64)
81470	string	APS10			APS patch file
8148!:ext	aps
8149>5	byte	0			\b, simple patch
8150>5	byte	1			\b, N64-specific patch for
8151>>58	byte	x			N%c
8152>>59	byte	x			\b%c
8153>>60	byte	x			\b%c
8154>7	byte	!0x20
8155# FIXME: /T specifier isn't working with a fixed-length string.
8156>>7	string	x			\b: "%.50s"
8157
8158# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com>
8159# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format)
81600	string	UPS1			UPS patch file
8161!:ext	ups
8162
8163# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
81640	string	PPF30			Playstation Patch File version 3.0
8165>5	byte	0			\b, PPF 1.0 patch
8166>5	byte	1			\b, PPF 2.0 patch
8167>5	byte	2			\b, PPF 3.0 patch
8168>>56	byte	0			\b, Imagetype BIN (any)
8169>>56	byte	1			\b, Imagetype GI (PrimoDVD)
8170>>57	byte	0			\b, Blockcheck disabled
8171>>57	byte	1			\b, Blockcheck enabled
8172>>58	byte	0			\b, Undo data not available
8173>>58	byte	1			\b, Undo data available
8174>6	string	x			\b, description: %s
8175
81760	string	PPF20			Playstation Patch File version 2.0
8177>5	byte	0			\b, PPF 1.0 patch
8178>5	byte	1			\b, PPF 2.0 patch
8179>>56	lelong	>0			\b, size of file to patch %d
8180>6	string	x			\b, description: %s
8181
81820	string	PPF10			Playstation Patch File version 1.0
8183>5	byte	0			\b, Simple Encoding
8184>6	string	x			\b, description: %s
8185
8186# From: Daniel Dawson <ddawson@icehouse.net>
8187# SNES9x .smv "movie" file format.
81880		string		SMV\x1A	SNES9x input recording
8189>0x4		lelong		x	\b, version %d
8190# version 4 is latest so far
8191>0x4		lelong		<5
8192>>0x8		ledate		x	\b, recorded at %s
8193>>0xc		lelong		>0	\b, rerecorded %d times
8194>>0x10		lelong		x	\b, %d frames long
8195>>0x14		byte		>0	\b, data for controller(s):
8196>>>0x14		byte		&0x1	#1
8197>>>0x14		byte		&0x2	#2
8198>>>0x14		byte		&0x4	#3
8199>>>0x14		byte		&0x8	#4
8200>>>0x14		byte		&0x10	#5
8201>>0x15		byte		^0x1	\b, begins from snapshot
8202>>0x15		byte		&0x1	\b, begins from reset
8203>>0x15		byte		^0x2	\b, NTSC standard
8204>>0x15		byte		&0x2	\b, PAL standard
8205>>0x17		byte		&0x1    \b, settings:
8206# WIP1Timing not used as of version 4
8207>>>0x4		lelong		<4
8208>>>>0x17	byte		&0x2	WIP1Timing
8209>>>0x17		byte		&0x4	Left+Right
8210>>>0x17		byte		&0x8	VolumeEnvX
8211>>>0x17		byte		&0x10	FakeMute
8212>>>0x17		byte		&0x20	SyncSound
8213# New flag as of version 4
8214>>>0x4		lelong		>3
8215>>>>0x17	byte		&0x80	NoCPUShutdown
8216>>0x4		lelong		<4
8217>>>0x18		lelong		>0x23
8218>>>>0x20	leshort		!0
8219>>>>>0x20	lestring16	x	\b, metadata: "%s"
8220>>0x4		lelong		>3
8221>>>0x24		byte		>0	\b, port 1:
8222>>>>0x24	byte		1	joypad
8223>>>>0x24	byte		2	mouse
8224>>>>0x24	byte		3	SuperScope
8225>>>>0x24	byte		4	Justifier
8226>>>>0x24	byte		5	multitap
8227>>>0x24		byte		>0	\b, port 2:
8228>>>>0x25	byte		1	joypad
8229>>>>0x25	byte		2	mouse
8230>>>>0x25	byte		3	SuperScope
8231>>>>0x25	byte		4	Justifier
8232>>>>0x25	byte		5	multitap
8233>>>0x18		lelong		>0x43
8234>>>>0x40	leshort		!0
8235>>>>>0x40	lestring16	x	\b, metadata: "%s"
8236>>0x17		byte		&0x40   \b, ROM:
8237>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
8238>>>(0x18.l-23)	string		x	"%s"
8239
8240# Type: scummVM savegame files
8241# From: Sven Hartge <debian@ds9.argh.org>
82420	string	SCVM	ScummVM savegame
8243>12	string	>\0	"%s"
8244
8245#------------------------------------------------------------------------------
8246# Nintendo GameCube / Wii file formats.
8247#
8248
8249# Type: Nintendo GameCube/Wii common disc header data.
8250# From: David Korth <gerbilsoft@gerbilsoft.com>
8251# Reference: https://wiibrew.org/wiki/Wii_Disc
82520	name	nintendo-gcn-disc-common
8253>0x20	string	x	"%.64s"
8254>0x00	string	x	(%.6s
8255>0x06	byte	>0
8256>>0x06	byte	1	\b, Disc 2
8257>>0x06	byte	2	\b, Disc 3
8258>>0x06	byte	3	\b, Disc 4
8259>0x07	byte	x	\b, Rev.%02u)
8260>0x18	belong	0x5D1C9EA3
8261>>0x60	beshort	0x0101	\b (Unencrypted)
8262>0x200	string	NKIT	\b (NKit compressed)
8263
8264
8265# Type: Nintendo GameCube disc image
8266# From: David Korth <gerbilsoft@gerbilsoft.com>
8267# Reference: https://wiibrew.org/wiki/Wii_Disc
82680x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
8269!:mime	application/x-gamecube-rom
8270>0	use	nintendo-gcn-disc-common
8271
8272# Type: Nintendo GameCube embedded disc image
8273# Commonly found on demo discs.
8274# From: David Korth <gerbilsoft@gerbilsoft.com>
8275# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
82760		belong	0xAE0F38A2
8277>0x0C		belong	0x00100000
8278>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
8279!:mime	application/x-gamecube-rom
8280>>>(8.L)	use	nintendo-gcn-disc-common
8281
8282# Type: Nintendo Wii disc image
8283# From: David Korth <gerbilsoft@gerbilsoft.com>
8284# Reference: https://wiibrew.org/wiki/Wii_Disc
82850x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
8286>0	use	nintendo-gcn-disc-common
8287
8288# Type: Nintendo Wii disc image (WBFS format)
8289# From: David Korth <gerbilsoft@gerbilsoft.com>
8290# Reference: https://wiibrew.org/wiki/Wii_Disc
82910	string	WBFS
8292>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
8293!:mime	application/x-wii-rom
8294>>0x200	use	nintendo-gcn-disc-common
8295
8296# Type: Nintendo GameCube/Wii disc image (CISO format)
8297# NOTE: This is NOT the same as Compact ISO or PSP CISO,
8298# though it has the same magic number.
82990		string	CISO
8300# Other fields are used to determine what type of CISO this is:
8301# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
8302# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
8303# - None of the above: Compact ISO.
8304>4		lelong	0x200000
8305>>8		byte	1
8306>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
8307!:mime	application/x-wii-rom
8308>>>>0x8000	use	nintendo-gcn-disc-common
8309>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
8310!:mime	application/x-wii-rom
8311>>>>0x8000	use	nintendo-gcn-disc-common
8312
8313# Type: Nintendo GameCube/Wii disc image (GCZ format)
8314# Due to zlib compression, we can't get the actual disc information.
83150	lelong	0xB10BC001
8316>4	lelong	0		Nintendo GameCube disc image (GCZ format)
8317!:mime	application/x-gamecube-rom
8318>4	lelong	1		Nintendo Wii disc image (GCZ format)
8319!:mime	application/x-wii-rom
8320>4	default	x		Nintendo GameCube/Wii disc image (GCZ format)
8321
8322# Type: Nintendo GameCube/Wii disc image (WDF format)
83230		string	WII\001DISC
8324>8		belong	1
8325# WDFv1
8326>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
8327!:mime	application/x-gamecube-rom
8328>>>0x38		use	nintendo-gcn-disc-common
8329>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
8330!:mime	application/x-wii-rom
8331>>>0x38		use	nintendo-gcn-disc-common
8332>8		belong	2
8333# WDFv2
8334>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
8335!:mime	application/x-gamecube-rom
8336>>>(12.L)	use	nintendo-gcn-disc-common
8337>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
8338!:mime	application/x-wii-rom
8339>>>(12.L)	use	nintendo-gcn-disc-common
8340
8341# Type: Nintendo GameCube/Wii disc image (WIA format)
83420	string	WIA\001	Nintendo
8343>0x48	belong	1	GameCube
8344!:mime	application/x-gamecube-rom
8345>0x48	belong	2	Wii
8346!:mime	application/x-wii-rom
8347>0x48	default	x	GameCube/Wii
8348>0x48	belong	x	disc image (WIA format):
8349>>0x58	use	nintendo-gcn-disc-common
8350
8351# Type: Nintendo GameCube/Wii disc image (with SDK header)
8352# From: David Korth <gerbilsoft@gerbilsoft.com>
8353# Reference: https://wiibrew.org/wiki/Wii_Disc
83540		belong	0xFFFF0000
8355>0x18		belong	0x00000000
8356>>0x1C		belong	0x00000000
8357>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii SDK disc image:
8358!:mime	application/x-wii-rom
8359>>>>0x8000	use	nintendo-gcn-disc-common
8360>>>0x801C	belong	0xC2339F3D	Nintendo GameCube SDK disc image:
8361!:mime	application/x-gamecube-rom
8362>>>>0x8000	use	nintendo-gcn-disc-common
8363
8364#------------------------------------------------------------------------------
8365# Nintendo 3DS file formats.
8366#
8367
8368# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
8369# From: David Korth <gerbilsoft@gerbilsoft.com>
8370# Reference: https://www.3dbrew.org/wiki/NCSD
83710x100		string		NCSD
8372>0x118		lequad		0		Nintendo 3DS Game Card image
8373# NCCH header for partition 0. (game data)
8374>>0x1150	string		>\0	\b: "%.16s"
8375>>0x312		byte		x	(Rev.%02u)
8376>>0x118C	byte		2	(New3DS only)
8377>>0x18D		byte		0		(inner device)
8378>>0x18D		byte		1		(Card1)
8379>>0x18D		byte		2		(Card2)
8380>>0x18D		byte		3		(extended device)
8381>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
8382>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
8383
8384# Nintendo 3DS version code.
8385# Reference: https://www.3dbrew.org/wiki/Titles
8386# Format: leshort containing three fields:
8387# - 6-bit: Major
8388# - 6-bit: Minor
8389# - 4-bit: Revision
8390# NOTE: Only supporting major/minor versions from 0-15 right now.
8391# NOTE: Should be prefixed with "v".
83920	name	nintendo-3ds-version-code
8393# Raw version.
8394>0	leshort	x	\b%u,
8395# Major version.
8396>0	leshort&0xFC00	0x0000	0
8397>0	leshort&0xFC00	0x0400	1
8398>0	leshort&0xFC00	0x0800	2
8399>0	leshort&0xFC00	0x0C00	3
8400>0	leshort&0xFC00	0x1000	4
8401>0	leshort&0xFC00	0x1400	5
8402>0	leshort&0xFC00	0x1800	6
8403>0	leshort&0xFC00	0x1C00	7
8404>0	leshort&0xFC00	0x2000	8
8405>0	leshort&0xFC00	0x2400	9
8406>0	leshort&0xFC00	0x2800	10
8407>0	leshort&0xFC00	0x2C00	11
8408>0	leshort&0xFC00	0x3000	12
8409>0	leshort&0xFC00	0x3400	13
8410>0	leshort&0xFC00	0x3800	14
8411>0	leshort&0xFC00	0x3C00	15
8412# Minor version.
8413>0	leshort&0x03F0	0x0000	\b.0
8414>0	leshort&0x03F0	0x0010	\b.1
8415>0	leshort&0x03F0	0x0020	\b.2
8416>0	leshort&0x03F0	0x0030	\b.3
8417>0	leshort&0x03F0	0x0040	\b.4
8418>0	leshort&0x03F0	0x0050	\b.5
8419>0	leshort&0x03F0	0x0060	\b.6
8420>0	leshort&0x03F0	0x0070	\b.7
8421>0	leshort&0x03F0	0x0080	\b.8
8422>0	leshort&0x03F0	0x0090	\b.9
8423>0	leshort&0x03F0	0x00A0	\b.10
8424>0	leshort&0x03F0	0x00B0	\b.11
8425>0	leshort&0x03F0	0x00C0	\b.12
8426>0	leshort&0x03F0	0x00D0	\b.13
8427>0	leshort&0x03F0	0x00E0	\b.14
8428>0	leshort&0x03F0	0x00F0	\b.15
8429# Revision.
8430>0	leshort&0x000F	x	\b.%u
8431
8432# Type: Nintendo 3DS "NCCH" container.
8433# https://www.3dbrew.org/wiki/NCCH
84340x100		string	NCCH	Nintendo 3DS
8435>0x18D		byte&2	0	File Archive (CFA)
8436>0x18D		byte&2	2	Executable Image (CXI)
8437>0x150		string	>\0	\b: "%.16s"
8438>0x18D		byte	0x05
8439>>0x10E		leshort	x	(Old3DS System Update v
8440>>0x10E		use	nintendo-3ds-version-code
8441>>0x10E		leshort	x	\b)
8442>0x18D		byte	0x15
8443>>0x10E		leshort	x	(New3DS System Update v
8444>>0x10E		use	nintendo-3ds-version-code
8445>>0x10E		leshort	x	\b)
8446>0x18D		byte	!0x05
8447>>0x18D		byte	!0x15
8448>>>0x112	byte	x	(v
8449>>>0x112	use	nintendo-3ds-version-code
8450>>>0x112	byte	x	\b)
8451>0x18C		byte	2	(New3DS only)
8452
8453# Type: Nintendo 3DS "SMDH" file. (application description)
8454# From: David Korth <gerbilsoft@gerbilsoft.com>
8455# Reference: https://3dbrew.org/wiki/SMDH
84560		string		SMDH		Nintendo 3DS SMDH file
8457>0x208		leshort		!0
8458>>0x208		lestring16	x		\b: "%.128s"
8459>>0x388		leshort		!0
8460>>>0x388	lestring16	x		by %.128s
8461>0x208		leshort		0
8462>>0x008		leshort		!0
8463>>>0x008	lestring16	x		\b: "%.128s"
8464>>>0x188	leshort		!0
8465>>>>0x188	lestring16	x		by %.128s
8466
8467# Type: Nintendo 3DS Homebrew Application.
8468# From: David Korth <gerbilsoft@gerbilsoft.com>
8469# Reference: https://3dbrew.org/wiki/3DSX_Format
84700	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
8471
8472#------------------------------------------------------------------------------
8473# a7800: file(1) magic for the Atari 7800 raw ROM format.
8474# From: David Korth <gerbilsoft@gerbilsoft.com>
8475# Reference: https://sites.google.com/site/atari7800wiki/a78-header
8476
84770	byte	>0
8478>0	byte	<3
8479>>1	string	ATARI7800	Atari 7800 ROM image
8480!:mime	application/x-atari-7800-rom
8481>>>0x11	string	>\0	\b: "%.32s"
8482# Display type.
8483>>>0x39	byte	0	(NTSC)
8484>>>0x39	byte	1	(PAL)
8485>>>0x36	byte&1	1	(POKEY)
8486
8487#------------------------------------------------------------------------------
8488# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
8489# From: David Korth <gerbilsoft@gerbilsoft.com>
8490# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
8491#
8492# NOTE: Title is terminated with 0x80, not 0.
8493# The header is terminated with a 0, so that will
8494# terminate the title as well.
8495#
84960	string	g\ GCE	Vectrex ROM image
8497>0x11	string	>\0	\b: "%.16s"
8498
8499#------------------------------------------------------------------------------
8500# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
8501# From: David Korth <gerbilsoft@gerbilsoft.com>
8502# Reference: https://www.3dbrew.org/wiki/Amiibo
85030x00		byte	0x04
8504>0x0A		beshort	0x0FE0
8505>>0x0C		belong	0xF110FFEE
8506>>>0x208	beshort	0x0100
8507>>>>0x020A	byte	0x0F
8508>>>>>0x020C	bequad	0x000000045F000000
8509>>>>>>0x5B	byte	0x02
8510>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
8511>>>>>>>0x58	belong	x	\b%08X
8512
8513#------------------------------------------------------------------------------
8514# Type: Nintendo Switch XCI (Game Cartridge Image)
8515# From: Benjamin Lowry <ben@ben.gmbh>
8516# Reference: https://switchbrew.org/wiki/Gamecard_Format
85170x100		string	HEAD
8518>0x10D		byte	0xFA	Nintendo Switch cartridge image (XCI), 1GB
8519>0x10D		byte	0xF8	Nintendo Switch cartridge image (XCI), 2GB
8520>0x10D		byte	0xF0	Nintendo Switch cartridge image (XCI), 4GB
8521>0x10D		byte	0xE0	Nintendo Switch cartridge image (XCI), 8GB
8522>0x10D		byte	0xE1	Nintendo Switch cartridge image (XCI), 16GB
8523>0x10D		byte	0xE2	Nintendo Switch cartridge image (XCI), 32GB
8524
8525#------------------------------------------------------------------------------
8526# Type: Nintendo Switch Executable
8527# From: Benjamin Lowry <ben@ben.gmbh>
8528# Reference: https://switchbrew.org/wiki/NSO
85290x00		string	NSO0	Nintendo Switch executable (NSO)
8530
8531#------------------------------------------------------------------------------
8532# Type: Nintendo Switch PFS0
8533# From: Benjamin Lowry <ben@ben.gmbh>
8534# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0
85350x00		string	PFS0	Nintendo Switch partition filesystem (PFS0)
8536>0x04		ulelong	x	\b, %d files
8537
8538#------------------------------------------------------------------------------
8539# amiibo: file(1) magic for Nintendo Badge Arcade files.
8540# From: David Korth <gerbilsoft@gerbilsoft.com>
8541# References:
8542# - https://github.com/GerbilSoft/rom-properties/issues/92
8543# - https://github.com/CaitSith2/BadgeArcadeTool
8544# - https://github.com/TheMachinumps/Advanced-badge-editor
8545
8546# PRBS: Individual badge and/or mega badge.
85470		string	PRBS
8548>0x44		byte	>0x20	Nintendo Badge Arcade
8549>>0xB8		ulelong	<2
8550>>>0xBC		ulelong	<2	badge:
8551>>>0xBC		ulelong	>1	Mega Badge
8552>>>>0xB8	ulelong	x	(%ux
8553>>>>0xBC	ulelong	x	\b%u):
8554>>0xB8		ulelong	>1	Mega Badge
8555>>>0xB8		ulelong	x	(%ux
8556>>>0xBC		ulelong	x	\b%u):
8557>0x44		string	x	"%s"
8558>0x3C		ulelong	x	\b, badge ID: %u
8559>0x74		byte	>0x20
8560>>0x74		string	x	\b, set: "%s"
8561>0xA8		ulelong	!0xFFFFFFFF
8562>>0xA8		ulelong	x	\b, launch title ID: %08X
8563>>0xA4		ulelong	x	\b-%08X
8564
8565# CABS: Badge set.
85660	string	CABS
8567>0x2C	byte	>0x20	Nintendo Badge Arcade badge set:
8568>>0x2C	string	x	"%.48s"
8569>>0x24	ulelong	x	\b, set ID: %u
8570
8571#------------------------------------------------------------------------------
8572# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
8573# convex:  file(1) magic for Convex boxes
8574#
8575# Convexes are big-endian.
8576#
8577# /*\
8578#  * Below are the magic numbers and tests added for Convex.
8579#  * Added at beginning, because they are expected to be used most.
8580# \*/
85810	belong	0507	Convex old-style object
8582>16	belong	>0	not stripped
85830	belong	0513	Convex old-style demand paged executable
8584>16	belong	>0	not stripped
85850	belong	0515	Convex old-style pre-paged executable
8586>16	belong	>0	not stripped
85870	belong	0517	Convex old-style pre-paged, non-swapped executable
8588>16	belong	>0	not stripped
85890	belong	0x011257	Core file
8590#
8591# The following are a series of dump format magic numbers.  Each one
8592# corresponds to a drastically different dump format.  The first on is
8593# the original dump format on a 4.1 BSD or earlier file system.  The
8594# second marks the change between the 4.1 file system and the 4.2 file
8595# system.  The Third marks the changing of the block size from 1K
8596# to 2K to be compatible with an IDC file system.  The fourth indicates
8597# a dump that is dependent on Convex Storage Manager, because data in
8598# secondary storage is not physically contained within the dump.
8599# The restore program uses these number to determine how the data is
8600# to be extracted.
8601#
860224	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
860324	belong	=60014	dump format, Convex Storage Manager by-reference dump
8604#
8605# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
8606# If there is no `=' sign, assume just checking for whether the bit is set?
8607#
86080	belong	0601		Convex SOFF
8609>88	belong&0x000f0000	=0x00000000	c1
8610>88	belong			&0x00010000	c2
8611>88	belong			&0x00020000	c2mp
8612>88	belong			&0x00040000	parallel
8613>88	belong			&0x00080000	intrinsic
8614>88	belong			&0x00000001	demand paged
8615>88	belong			&0x00000002	pre-paged
8616>88	belong			&0x00000004	non-swapped
8617>88	belong			&0x00000008	POSIX
8618#
8619>84	belong			&0x80000000	executable
8620>84	belong			&0x40000000	object
8621>84	belong&0x20000000	=0		not stripped
8622>84	belong&0x18000000	=0x00000000	native fpmode
8623>84	belong&0x18000000	=0x10000000	ieee fpmode
8624>84	belong&0x18000000	=0x18000000	undefined fpmode
8625#
86260	belong			0605		Convex SOFF core
8627#
86280	belong			0607		Convex SOFF checkpoint
8629>88	belong&0x000f0000	=0x00000000	c1
8630>88	belong			&0x00010000	c2
8631>88	belong			&0x00020000	c2mp
8632>88	belong			&0x00040000	parallel
8633>88	belong			&0x00080000	intrinsic
8634>88	belong			&0x00000008	POSIX
8635#
8636>84	belong&0x18000000	=0x00000000	native fpmode
8637>84	belong&0x18000000	=0x10000000	ieee fpmode
8638>84	belong&0x18000000	=0x18000000	undefined fpmode
8639
8640#------------------------------------------------------------------------------
8641# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $
8642# xoverage:  file(1) magic for test coverage data
8643
8644# File formats used to store test coverage data
8645# 2016-05-21, Georg Sauthoff <mail@georg.so>
8646
8647
8648# - GCC gcno - written by GCC at compile time when compiling with
8649# 	gcc -ftest-coverage
8650# - GCC gcda - written by a program that was compiled with
8651#	gcc -fprofile-arcs
8652# - LLVM raw profiles - generated by a program compiled with
8653#	clang -fprofile-instr-generate -fcoverage-mapping ...
8654# - LLVM indexed profiles - generated by
8655#	llvm-profdata
8656# - GCOV reports, i.e. the annotated source code
8657# - LCOV trace files, i.e. aggregated GCC profiles
8658#
8659# GCC coverage tracefiles
8660# .gcno file are created during compile time,
8661# while data collected during runtime is stored in .gcda files
8662# cf. gcov-io.h
8663# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
8664# Examples:
8665# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
8666# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
86670	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
8668>&3	byte	x	version %c.
8669>&1	byte	x	\b%c
8670
8671# big endian
86720	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
8673>&0	byte	x	version %c.
8674>&2	byte	x	\b%c (big-endian)
8675
8676# Examples:
8677# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
8678# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
86790	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
8680>&3	byte	x	version %c.
8681>&1	byte	x	\b%c
8682
8683# big endian
86840	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
8685>&0	byte	x	version %c.
8686>&2	byte	x	\b%c (big-endian)
8687
8688
8689# LCOV tracefiles
8690# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
86910	string	TN:
8692>&0	search/64	\nSF:/	LCOV coverage tracefile
8693
8694
8695# Coverage reports generated by gcov
8696# i.e. source code annoted with coverage information
86970	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
8698>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
8699>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
8700
8701
8702# LLVM coverage files
8703
8704# raw data after running a program compiled with:
8705# `clang -fprofile-instr-generate -fcoverage-mapping ...`
8706# default name: default.profraw
8707# magic is: \xFF lprofr \x81
8708# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
87090	lequad	0xff6c70726f667281	LLVM raw profile data,
8710>&0	byte	x	version %d
8711
8712# big endian
87130	bequad	0xff6c70726f667281	LLVM raw profile data,
8714>&7	byte	x	version %d (big-endian)
8715
8716
8717# LLVM indexed instruction profile (as generated by llvm-profdata)
8718# magic is: reverse(\xFF lprofi \x81)
8719# cf. https://llvm.org/docs/CoverageMappingFormat.html
8720# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
8721# https://llvm.org/docs/CommandGuide/llvm-cov.html
8722# https://llvm.org/docs/CommandGuide/llvm-profdata.html
87230	lequad	0x8169666f72706cff	LLVM indexed profile data,
8724>&0	byte	x	version %d
8725
8726# big endian
87270	bequad	0x8169666f72706cff	LLVM indexed profile data,
8728>&7	byte	x	version %d (big-endian)
8729
8730
8731#------------------------------------------------------------------------------
8732# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
8733# cracklib:  file (1) magic for cracklib v2.7
8734
87350	lelong	0x70775631	Cracklib password index, little endian
8736>4	long	>0		(%i words)
8737>4	long	0		("64-bit")
8738>>8	long	>-1		(%i words)
87390	belong	0x70775631	Cracklib password index, big endian
8740>4	belong	>-1		(%i words)
8741# really bellong 0x0000000070775631
87420	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
8743>12	belong	>0		(%i words)
8744
8745# ----------------------------------------------------------------------------
8746# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
8747# ctags:  file (1) magic for Exuberant Ctags files
8748# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
87490	search/1	=!_TAG	Exuberant Ctags tag file text
8750
8751#--------------------------------------------------------------
8752# ctf:  file(1) magic for CTF (Common Trace Format) trace files
8753#
8754# Specs. available here: <https://www.efficios.com/ctf>
8755#--------------------------------------------------------------
8756
8757# CTF trace data
87580	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
87590	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
8760
8761# CTF metadata (packetized)
87620	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
8763>35	byte	x		\b, v%d
8764>36	byte	x		\b.%d
87650	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
8766>35	byte	x		\b, v%d
8767>36	byte	x		\b.%d
8768
8769# CTF metadata (plain text)
87700	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
8771!:strength + 5			# this is to make sure we beat C
8772>&0	regex	[0-9]+\.[0-9]+	\b, v%s
8773
8774#------------------------------------------------------------------------------
8775# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
8776# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
8777#
87780	string	ACMP	Map file for the AssaultCube FPS game
87790	string	CUBE	Map file for cube and cube2 engine games
87800	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
8781
8782#------------------------------------------------------------------------------
8783# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
8784# Cups: file(1) magic for the cups raster file format
8785# From: Laurent Martelli <martellilaurent@gmail.com>
8786# https://www.cups.org/documentation.php/spec-raster.html
8787#
8788
87890	name		cups-le
8790>280	lelong		x		\b, %d
8791>284	lelong		x		\bx%d dpi
8792>376	lelong		x		\b, %dx
8793>380	lelong		x		\b%d pixels
8794>388	lelong		x		%d bits/color
8795>392	lelong		x		%d bits/pixel
8796>400	lelong		0		ColorOrder=Chunky
8797>400	lelong		1		ColorOrder=Banded
8798>400	lelong		2		ColorOrder=Planar
8799>404	lelong		0		ColorSpace=gray
8800>404	lelong		1		ColorSpace=RGB
8801>404	lelong		2		ColorSpace=RGBA
8802>404	lelong		3		ColorSpace=black
8803>404	lelong		4		ColorSpace=CMY
8804>404	lelong		5		ColorSpace=YMC
8805>404	lelong		6		ColorSpace=CMYK
8806>404	lelong		7		ColorSpace=YMCK
8807>404	lelong		8		ColorSpace=KCMY
8808>404	lelong		9		ColorSpace=KCMYcm
8809>404	lelong		10		ColorSpace=GMCK
8810>404	lelong		11		ColorSpace=GMCS
8811>404	lelong		12		ColorSpace=WHITE
8812>404	lelong		13		ColorSpace=GOLD
8813>404	lelong		14		ColorSpace=SILVER
8814>404	lelong		15		ColorSpace=CIE XYZ
8815>404	lelong		16		ColorSpace=CIE Lab
8816>404	lelong		17		ColorSpace=RGBW
8817>404	lelong		18		ColorSpace=sGray
8818>404	lelong		19		ColorSpace=sRGB
8819>404	lelong		20		ColorSpace=AdobeRGB
8820
8821# Cups Raster image format, Big Endian
88220	string		RaS
8823>3	string		t		Cups Raster version 1, Big Endian
8824>3	string		2		Cups Raster version 2, Big Endian
8825>3	string		3		Cups Raster version 3, Big Endian
8826!:mime	application/vnd.cups-raster
8827>0	use		\^cups-le
8828
8829
8830# Cups Raster image format, Little Endian
88311	string		SaR
8832>0	string		t		Cups Raster version 1, Little Endian
8833>0	string		2		Cups Raster version 2, Little Endian
8834>0	string		3		Cups Raster version 3, Little Endian
8835!:mime	application/vnd.cups-raster
8836>0	use		cups-le
8837
8838#------------------------------------------------------------------------------
8839# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
8840# dact:  file(1) magic for DACT compressed files
8841#
88420	long		0x444354C3	DACT compressed data
8843>4	byte		>-1		(version %i.
8844>5	byte		>-1		$BS%i.
8845>6	byte		>-1		$BS%i)
8846>7	long		>0		$BS, original size: %i bytes
8847>15	long		>30		$BS, block size: %i bytes
8848
8849#------------------------------------------------------------------------------
8850# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $
8851# database:  file(1) magic for various databases
8852#
8853# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
8854#
8855#
8856# GDBM magic numbers
8857#  Will be maintained as part of the GDBM distribution in the future.
8858#  <downsj@teeny.org>
88590	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
8860!:mime	application/x-gdbm
88610	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
8862!:mime	application/x-gdbm
88630	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
8864!:mime	application/x-gdbm
88650	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
8866!:mime	application/x-gdbm
88670	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
8868!:mime	application/x-gdbm
88690	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
8870!:mime	application/x-gdbm
88710	string	GDBM		GNU dbm 2.x database
8872!:mime	application/x-gdbm
8873#
8874# Berkeley DB
8875#
8876# Ian Darwin's file /etc/magic files: big/little-endian version.
8877#
8878# Hash 1.85/1.86 databases store metadata in network byte order.
8879# Btree 1.85/1.86 databases store the metadata in host byte order.
8880# Hash and Btree 2.X and later databases store the metadata in host byte order.
8881
88820	long	0x00061561	Berkeley DB
8883!:mime	application/x-dbm
8884>8	belong	4321
8885>>4	belong	>2		1.86
8886>>4	belong	<3		1.85
8887>>4	belong	>0		(Hash, version %d, native byte-order)
8888>8	belong	1234
8889>>4	belong	>2		1.86
8890>>4	belong	<3		1.85
8891>>4	belong	>0		(Hash, version %d, little-endian)
8892
88930	belong	0x00061561	Berkeley DB
8894>8	belong	4321
8895>>4	belong	>2		1.86
8896>>4	belong	<3		1.85
8897>>4	belong	>0		(Hash, version %d, big-endian)
8898>8	belong	1234
8899>>4	belong	>2		1.86
8900>>4	belong	<3		1.85
8901>>4	belong	>0		(Hash, version %d, native byte-order)
8902
89030	long	0x00053162	Berkeley DB 1.85/1.86
8904>4	long	>0		(Btree, version %d, native byte-order)
89050	belong	0x00053162	Berkeley DB 1.85/1.86
8906>4	belong	>0		(Btree, version %d, big-endian)
89070	lelong	0x00053162	Berkeley DB 1.85/1.86
8908>4	lelong	>0		(Btree, version %d, little-endian)
8909
891012	long	0x00061561	Berkeley DB
8911>16	long	>0		(Hash, version %d, native byte-order)
891212	belong	0x00061561	Berkeley DB
8913>16	belong	>0		(Hash, version %d, big-endian)
891412	lelong	0x00061561	Berkeley DB
8915>16	lelong	>0		(Hash, version %d, little-endian)
8916
891712	long	0x00053162	Berkeley DB
8918>16	long	>0		(Btree, version %d, native byte-order)
891912	belong	0x00053162	Berkeley DB
8920>16	belong	>0		(Btree, version %d, big-endian)
892112	lelong	0x00053162	Berkeley DB
8922>16	lelong	>0		(Btree, version %d, little-endian)
8923
892412	long	0x00042253	Berkeley DB
8925>16	long	>0		(Queue, version %d, native byte-order)
892612	belong	0x00042253	Berkeley DB
8927>16	belong	>0		(Queue, version %d, big-endian)
892812	lelong	0x00042253	Berkeley DB
8929>16	lelong	>0		(Queue, version %d, little-endian)
8930
8931# From Max Bowsher.
893212	long	0x00040988	Berkeley DB
8933>16	long	>0		(Log, version %d, native byte-order)
893412	belong	0x00040988	Berkeley DB
8935>16	belong	>0		(Log, version %d, big-endian)
893612	lelong	0x00040988	Berkeley DB
8937>16	lelong	>0		(Log, version %d, little-endian)
8938
8939#
8940#
8941# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
89420	string/b	RRD\0		RRDTool DB
8943>4	string/b	x		version %s
8944
8945>>10	short		!0		16bit aligned
8946>>>10	bedouble	8.642135e+130	big-endian
8947>>>>18	short		x		32bit long (m68k)
8948
8949>>10	short		0
8950>>>12	long		!0		32bit aligned
8951>>>>12	bedouble	8.642135e+130	big-endian
8952>>>>>20 long		0		64bit long
8953>>>>>20 long		!0		32bit long
8954>>>>12	ledouble	8.642135e+130	little-endian
8955>>>>>24 long		0		64bit long
8956>>>>>24 long		!0		32bit long (i386)
8957>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
8958>>>>>24 short		!0		32bit long (arm)
8959
8960>>8	quad		0		64bit aligned
8961>>>16	bedouble	8.642135e+130	big-endian
8962>>>>24	long		0		64bit long (s390x)
8963>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
8964>>>16	ledouble	8.642135e+130	little-endian
8965>>>>28	long		0		64bit long (alpha/amd64/ia64)
8966>>>>28	long		!0		32bit long (armel/mipsel)
8967
8968#----------------------------------------------------------------------
8969# ROOT: file(1) magic for ROOT databases
8970#
89710       string  root\0  ROOT file
8972>4      belong  x       Version %d
8973>33     belong  x       (Compression: %d)
8974
8975# XXX: Weak magic.
8976# Alex Ott <ott@jet.msk.su>
8977## Paradox file formats
8978#2	  leshort	0x0800	Paradox
8979#>0x39	  byte		3	v. 3.0
8980#>0x39	  byte		4	v. 3.5
8981#>0x39	  byte		9	v. 4.x
8982#>0x39	  byte		10	v. 5.x
8983#>0x39	  byte		11	v. 5.x
8984#>0x39	  byte		12	v. 7.x
8985#>>0x04	  byte		0	indexed .DB data file
8986#>>0x04	  byte		1	primary index .PX file
8987#>>0x04	  byte		2	non-indexed .DB data file
8988#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
8989#>>0x04	  byte		4	secondary index .Ynn file
8990#>>0x04	  byte		5	incrementing secondary index .Xnn file
8991#>>0x04	  byte		6	non-incrementing secondary index .XGn file
8992#>>0x04	  byte		7	secondary index .YGn file
8993#>>>0x04	  byte		8	incrementing secondary index .XGn file
8994
8995## XBase database files
8996# updated by Joerg Jenderek at Feb 2013
8997# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
8998# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
8999# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
90000	ubelong&0x0000FFFF		<0x00000C20
9001# skip Infocom game Z-machine
9002>2		ubyte			>0
9003# skip Androids *.xml
9004>>3		ubyte			>0
9005>>>3		ubyte			<32
9006# 1 < version VV
9007>>>>0		ubyte			>1
9008# skip HELP.CA3 by test for reserved byte ( NULL )
9009>>>>>27		ubyte			0
9010# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
9011#>>>>>30		ubeshort     		x		30NULL?%x
9012# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
9013>>>>>>24	ubelong&0xffFFFFff	>0x01302000
9014# .DBF or .MDX
9015>>>>>>24	ubelong&0xffFFFFff	<0x01302001
9016# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
9017>>>>>>>24	ubelong&0xffFFFFff	=0
9018# test for 2 reserved NULL bytes,transaction and encryption byte flag
9019>>>>>>>>12	ubelong&0xFFFFfEfE	0
9020# test for MDX flag
9021>>>>>>>>>28	ubyte			x
9022>>>>>>>>>28	ubyte&0xf8		0
9023# header size >= 32
9024>>>>>>>>>>8	uleshort		>31
9025# skip PIC15736.PCX by test for language driver name or field name
9026>>>>>>>>>>>32	ubyte			>0
9027#!:mime	application/x-dbf; charset=unknown-8bit ??
9028#!:mime	application/x-dbase
9029>>>>>>>>>>>>0	use			xbase-type
9030# database file
9031>>>>>>>>>>>>0	ubyte			x		\b DBF
9032>>>>>>>>>>>>4	lelong			0		\b, no records
9033>>>>>>>>>>>>4	lelong			>0		\b, %d record
9034# plural s appended
9035>>>>>>>>>>>>>4	lelong			>1		\bs
9036# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
9037# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
9038>>>>>>>>>>>>10	uleshort		x		* %d
9039# file size = records * record size + header size
9040>>>>>>>>>>>>1	ubyte			x		\b, update-date
9041>>>>>>>>>>>>1	use			xbase-date
9042# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
9043#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
9044# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
9045>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
9046#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
9047>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
9048>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
9049>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
9050# 1st record offset + 1 = header size
9051>>>>>>>>>>>>8	uleshort		>0
9052>>>>>>>>>>>>(8.s+1)	ubyte		>0
9053>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
9054>>>>>>>>>>>>>(8.s+1)	ubyte		>0
9055>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
9056# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
9057>>>>>>>24	ubelong&0x0133f7ff	>0
9058# test for reserved NULL byte
9059>>>>>>>>47	ubyte			0
9060# test for valid TAG key format (0x10 or 0)
9061>>>>>>>>>559	ubyte&0xeF		0
9062# test MM <= 12
9063>>>>>>>>>>45	ubeshort		<0x0C20
9064>>>>>>>>>>>45	ubyte			>0
9065>>>>>>>>>>>>46	ubyte			<32
9066>>>>>>>>>>>>>46	ubyte			>0
9067#!:mime	application/x-mdx
9068>>>>>>>>>>>>>>0		use		xbase-type
9069>>>>>>>>>>>>>>0		ubyte		x		\b MDX
9070>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
9071>>>>>>>>>>>>>>1		use		xbase-date
9072>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
9073>>>>>>>>>>>>>>44	use		xbase-date
9074# No.of tags in use (1,2,5,12)
9075>>>>>>>>>>>>>>28	uleshort	x		\b, %d
9076# No. of entries in tag (0x30)
9077>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
9078#  Length of tag
9079>>>>>>>>>>>>>>26	ubyte		x		* %d
9080# 1st tag name_
9081>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
9082# 2nd tag name
9083#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
9084#
9085#		Print the xBase names of different version variants
90860	name				xbase-type
9087>0	ubyte		<2
9088# 1 < version
9089>0	ubyte		>1
9090>>0	ubyte		0x02		FoxBase
9091# FoxBase+/dBaseIII+, no memo
9092>>0	ubyte		0x03		FoxBase+/dBase III
9093!:mime	application/x-dbf
9094# dBASE IV no memo file
9095>>0	ubyte		0x04		dBase IV
9096!:mime	application/x-dbf
9097# dBASE V no memo file
9098>>0	ubyte		0x05		dBase V
9099!:mime	application/x-dbf
9100>>0	ubyte		0x30		Visual FoxPro
9101!:mime	application/x-dbf
9102>>0	ubyte		0x31		Visual FoxPro, autoincrement
9103!:mime	application/x-dbf
9104# Visual FoxPro, with field type Varchar or Varbinary
9105>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
9106!:mime	application/x-dbf
9107# dBASE IV SQL, no memo;dbv memo var size (Flagship)
9108>>0	ubyte		0x43		dBase IV, with SQL table
9109!:mime	application/x-dbf
9110# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9111#>>0	ubyte		0x62		dBase IV, with SQL table
9112#!:mime	application/x-dbf
9113# dBASE IV, with memo!!
9114>>0	ubyte		0x7b		dBase IV, with memo
9115!:mime	application/x-dbf
9116# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9117#>>0	ubyte		0x82		dBase IV, with SQL system
9118#!:mime	application/x-dbf
9119# FoxBase+/dBaseIII+ with memo .DBT!
9120>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
9121!:mime	application/x-dbf
9122# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
9123>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
9124!:mime	application/x-dbf
9125# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9126#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
9127#!:mime	application/x-dbf
9128# dBASE IV with memo!
9129>>0	ubyte		0x8B		dBase IV, with memo .DBT
9130!:mime	application/x-dbf
9131# dBase IV with SQL Table,no memo?
9132>>0	ubyte		0x8E		dBase IV, with SQL table
9133!:mime	application/x-dbf
9134# .dbv and .dbt memo (Flagship)?
9135>>0	ubyte		0xB3		Flagship
9136# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9137#>>0	ubyte		0xCA		dBase IV with memo .DBT
9138#!:mime	application/x-dbf
9139# dBASE IV with SQL table, with memo .DBT
9140>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
9141!:mime	application/x-dbf
9142# HiPer-Six format;Clipper SIX, with SMT memo file
9143>>0	ubyte		0xE5		Clipper SIX with memo
9144!:mime	application/x-dbf
9145# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9146#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
9147#!:mime	application/x-dbf
9148>>0	ubyte		0xF5		FoxPro with memo
9149!:mime	application/x-dbf
9150# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
9151#>>0	ubyte		0xFA		FoxPro 2.x, with memo
9152#!:mime	application/x-dbf
9153# unknown version (should not happen)
9154>>0	default		x		xBase
9155!:mime	application/x-dbf
9156>>>0	ubyte		x		(0x%x)
9157# flags in version byte
9158# DBT flag (with dBASE III memo .DBT)!!
9159# >>0	ubyte&0x80	>0		DBT_FLAG=%x
9160# memo flag ??
9161# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
9162# SQL flag ??
9163# >>0	ubyte&0x70	>0		SQL_FLAG=%x
9164#		test and print the date of xBase .DBF .MDX
91650	name				xbase-date
9166# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
9167>0	ubelong		x
9168>1	ubyte		<13
9169>>1	ubyte		>0
9170>>>2	ubyte		>0
9171>>>>2	ubyte		<32
9172>>>>>0	ubyte		x
9173# YY is interpreted as 20YY or 19YY
9174>>>>>>0	ubyte		<100		\b %.2d
9175# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
9176>>>>>>0	ubyte		>99		\b %d
9177>>>>>1	ubyte		x		\b-%d
9178>>>>>2	ubyte		x		\b-%d
9179
9180#	dBase memo files .DBT or .FPT
9181# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
918216		ubyte		<4
9183>16		ubyte		!2
9184>>16		ubyte		!1
9185# next free block index is positive
9186>>>0		ulelong		>0
9187# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
9188>>>>17		ubelong&0xFFfdFEff	0x00000000
9189# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
9190>>>>>20		ubelong&0xFF01209B	0x00000000
9191# dBASE III
9192>>>>>>16	ubyte		3
9193# dBASE III DBT
9194>>>>>>>0	use		dbase3-memo-print
9195# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
9196>>>>>>16	ubyte		0
9197# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
9198>>>>>>>20	uleshort	0
9199# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
9200>>>>>>>>8	ulong		=0
9201>>>>>>>>>6	ubeshort	>0
9202# skip emacs.PIF
9203>>>>>>>>>>4	ushort		0
9204# check for valid FoxPro field type
9205>>>>>>>>>>>512	ubelong		<3
9206>>>>>>>>>>>>0	use		foxpro-memo-print
9207# dBASE III DBT , garbage
9208# skip WORD1XW.DOC with improbably high free block index
9209>>>>>>>>>0	ulelong		<0x400000
9210# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
9211>>>>>>>>>>513	ubyte		>037
9212# unusual dBASE III DBT like adressen.dbt
9213>>>>>>>>>>>0	use		dbase3-memo-print
9214# dBASE III DBT like angest.dbt, or garbage PCX DBF
9215>>>>>>>>8	ubelong		!0
9216# skip PCX and some DBF by test for for reserved NULL bytes
9217>>>>>>>>>510	ubeshort	0
9218# skip bad symples with improbably high free block index above 2 GiB file limit
9219>>>>>>>>>>0	ulelong		<0x400000
9220# skip AI070GEP.EPS by printable 1st character of 1st memo item
9221>>>>>>>>>>>512	ubyte		>037
9222# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
9223>>>>>>>>>>>>513	ubyte		>037
9224>>>>>>>>>>>>>0	use		dbase3-memo-print
9225# dBASE IV DBT with positive block size
9226>>>>>>>20	uleshort	>0
9227# dBASE IV DBT with valid block length like 512, 1024
9228# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
9229# skip also 3600h 3E00h size
9230>>>>>>>>20	uleshort&0xE00f	0
9231>>>>>>>>>0	use		dbase4-memo-print
9232
9233#		Print the information of dBase III DBT memo file
92340	name				dbase3-memo-print
9235>0	ubyte			x		dBase III DBT
9236!:mime	application/x-dbt
9237!:ext	dbt
9238# instead 3 as version number 0 for unusual examples like biblio.dbt
9239>16	ubyte			!3		\b, version number %u
9240# Number of next available block for appending data
9241#>0	lelong			=0		\b, next free block index %u
9242>0	lelong			!0		\b, next free block index %u
9243# no positiv block length
9244#>20	uleshort		=0		\b, block length %u
9245>20	uleshort		!0		\b, block length %u
9246# dBase III memo field terminated by \032\032
9247>512	string			>\0		\b, 1st item "%s"
9248# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
9249#		Print the information of dBase IV DBT memo file
92500	name				dbase4-memo-print
9251>0		lelong		x		dBase IV DBT
9252!:mime	application/x-dbt
9253!:ext dbt
9254# 8 character shorted main name of coresponding dBASE IV DBF file
9255>8		ubelong		>0x20000000
9256# skip unusual like for angest.dbt
9257>>20		uleshort	>0
9258>>>8		string		>\0		\b of %-.8s.DBF
9259# value 0 implies 512 as size
9260#>4		ulelong		=0		\b, blocks size %u
9261# size of blocks not reliable like 0x2020204C in angest.dbt
9262>4		ulelong		!0
9263>>4		ulelong&0x0000003f	0	\b, blocks size %u
9264# dBase IV DBT with positive block length (found 512 , 1024)
9265>20		uleshort	>0		\b, block length %u
9266# next available block
9267#>0		lelong		=0		\b, next free block index %u
9268>0		lelong		!0		\b, next free block index %u
9269>20		uleshort	>0
9270>>(20.s)	ubelong		x
9271>>>&-4		use		dbase4-memofield-print
9272# unusual dBase IV DBT without block length (implies 512 as length)
9273>20		uleshort	=0
9274>>512		ubelong		x
9275>>>&-4		use				dbase4-memofield-print
9276#		Print the information of dBase IV memo field
92770	name			dbase4-memofield-print
9278# free dBase IV memo field
9279>0		ubelong		!0xFFFF0800
9280>>0		lelong		x		\b, next free block %u
9281>>4		lelong		x		\b, next used block %u
9282# used dBase IV memo field
9283>0		ubelong		=0xFFFF0800
9284# length of memo field
9285>>4		lelong		x		\b, field length %d
9286>>>8		string		>\0		\b, 1st used item "%s"
9287# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
9288#		Print the information of FoxPro FPT memo file
92890	name				foxpro-memo-print
9290>0		belong		x		FoxPro FPT
9291!:mime	application/x-fpt
9292!:ext	fpt
9293# Size of blocks for FoxPro ( 64,256 )
9294>6		ubeshort	x		\b, blocks size %u
9295# next available block
9296#>0		belong		=0		\b, next free block index %u
9297>0		belong		!0		\b, next free block index %u
9298# field type ( 0~picture, 1~memo, 2~object )
9299>512		ubelong		<3		\b, field type %u
9300# length of memo field
9301>512		ubelong		1
9302>>516		belong		>0		\b, field length %d
9303>>>520		string		>\0		\b, 1st item "%s"
9304
9305# TODO:
9306# DBASE index file *.NDX
9307# DBASE Compound Index file *.CDX
9308# dBASE IV Printer Driver *.PRF
9309## End of XBase database stuff
9310
9311# MS Access database
93124	string	Standard\ Jet\ DB	Microsoft Access Database
9313!:mime	application/x-msaccess
93144	string	Standard\ ACE\ DB	Microsoft Access Database
9315!:mime	application/x-msaccess
9316
9317# From: Joerg Jenderek
9318# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
9319# Reference: https://github.com/libyal/libesedb/archive/master.zip
9320#	libesedb-master/documentation/
9321#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
9322# Note: also known as "JET Blue". Used by numerous Windows components such as
9323# Windows Search, Mail, Exchange and Active Directory.
93244	ubelong		0xefcdab89
9325# unknown1
9326>132	ubelong		0		Extensible storage engine
9327!:mime	application/x-ms-ese
9328# file_type 0~database 1~stream
9329>>12	ulelong		0		DataBase
9330# Security DataBase (sdb)
9331!:ext	edb/sdb
9332>>12	ulelong		1		STreaMing
9333!:ext	stm
9334# format_version 620h
9335>>8	uleshort	x		\b, version 0x%x
9336>>10	uleshort	>0		revision 0x%4.4x
9337>>0	ubelong		x	 	\b, checksum 0x%8.8x
9338# Page size 4096 8192 32768
9339>>236	ulequad		x		\b, page size %lld
9340# database_state
9341>>52	ulelong		1		\b, JustCreated
9342>>52	ulelong		2		\b, DirtyShutdown
9343#>>52	ulelong		3		\b, CleanShutdown
9344>>52	ulelong		4		\b, BeingConverted
9345>>52	ulelong		5		\b, ForceDetach
9346# Windows NT major version when the databases indexes were updated.
9347>>216	ulelong		x		\b, Windows version %d
9348# Windows NT minor version
9349>>220	ulelong		x		\b.%d
9350
9351# From: Joerg Jenderek
9352# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
9353# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
93548	string		sdbf
9355>7	ubyte		0
9356# TAG_TYPE_LIST+TAG_INDEXES
9357>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
9358# version? 2 3
9359#>>>0	ulelong		x		\b, version %d
9360!:mime	application/x-ms-sdb
9361!:ext	sdb
9362
9363# TDB database from Samba et al - Martin Pool <mbp@samba.org>
93640	string	TDB\ file		TDB database
9365>32	lelong	0x2601196D		version 6, little-endian
9366>>36	lelong	x			hash size %d bytes
9367
9368# SE Linux policy database
93690       lelong  0xf97cff8c      SE Linux policy
9370>16     lelong  x               v%d
9371>20     lelong  1      MLS
9372>24     lelong  x       %d symbols
9373>28     lelong  x       %d ocons
9374
9375# ICE authority file data (Wolfram Kleff)
93762	string		ICE		ICE authority data
9377
9378# X11 Xauthority file (Wolfram Kleff)
937910	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938011	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938112	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938213	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938314	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938415	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938516	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938617	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
938718	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
9388
9389# From: Maxime Henrion <mux@FreeBSD.org>
9390# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
93910	string		PGDMP		PostgreSQL custom database dump
9392>5	byte		x		- v%d
9393>6	byte		x		\b.%d
9394>5	beshort		<0x101		\b-0
9395>5	beshort		>0x100
9396>>7	byte		x		\b-%d
9397
9398# Type: Advanced Data Format (ADF) database
9399# URL:  https://www.grc.nasa.gov/WWW/cgns/adf/
9400# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
94010	string	@(#)ADF\ Database	CGNS Advanced Data Format
9402
9403# Tokyo Cabinet magic data
9404# http://tokyocabinet.sourceforge.net/index.html
94050	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
9406>14	string		x			\b (%s)
9407>32	byte		0			\b, Hash
9408!:mime	application/x-tokyocabinet-hash
9409>32	byte		1			\b, B+ tree
9410!:mime	application/x-tokyocabinet-btree
9411>32	byte		2			\b, Fixed-length
9412!:mime	application/x-tokyocabinet-fixed
9413>32	byte		3			\b, Table
9414!:mime	application/x-tokyocabinet-table
9415>33	byte		&1			\b, [open]
9416>33	byte		&2			\b, [fatal]
9417>34	byte		x			\b, apow=%d
9418>35	byte		x			\b, fpow=%d
9419>36	byte		&0x01			\b, [large]
9420>36	byte		&0x02			\b, [deflate]
9421>36	byte		&0x04			\b, [bzip]
9422>36	byte		&0x08			\b, [tcbs]
9423>36	byte		&0x10			\b, [excodec]
9424>40	lequad		x			\b, bnum=%lld
9425>48	lequad		x			\b, rnum=%lld
9426>56	lequad		x			\b, fsiz=%lld
9427
9428# Type:	QDBM Quick Database Manager
9429# From:	Benoit Sibaud <bsibaud@april.org>
94300	string		\\[depot\\]\n\f		Quick Database Manager, little endian
94310	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
9432
9433# Type:	TokyoCabinet database
9434# URL:	http://tokyocabinet.sourceforge.net/
9435# From:	Benoit Sibaud <bsibaud@april.org>
94360	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
9437>14	string		x			(version %s)
9438
9439# From:  Stephane Blondon https://www.yaal.fr
9440# Database file for Zope (done by FileStorage)
94410	string	FS21	Zope Object Database File Storage v3 (data)
94420	string	FS30	Zope Object Database File Storage v4 (data)
9443
9444# Cache file for the database of Zope (done by ClientStorage)
94450	string		ZEC3	Zope Object Database Client Cache File (data)
9446
9447# IDA (Interactive Disassembler) database
94480	string		IDA1	IDA (Interactive Disassembler) database
9449
9450# Hopper (reverse engineering tool) https://www.hopperapp.com/
94510	string		hopperdb	Hopper database
9452
9453# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
9454# Reference: http://www.provue.com/Panorama/
9455# From: Joerg Jenderek
9456# NOTE: test only versions 4 and 6.0 with Windows
9457# length of Panorama database name
94585	ubyte				>0
9459# look after database name for "some" null bits
9460>(5.B+7)	ubelong&0xF3ffF000	0
9461# look for first keyword
9462>>&1		search/2		DESIGN		Panorama database
9463#!:mime	application/x-panorama-database
9464!:apple	KASXZEPD
9465!:ext	pan
9466# database name
9467>>>5	pstring				x		\b, "%s"
9468
9469#
9470#
9471# askSam Database by Stefan A. Haubenthal <polluks@web.de>
94720	string	askw40\0	askSam DB
9473
9474#
9475#
9476# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
94770	string	MBSTV\040	MUIbase DB
9478>6	string	x		version %s
9479
9480#
9481# CDB database
94820	string	NBCDB\012	NetBSD Constant Database
9483>7	byte	x		\b, version %d
9484>8	string	x		\b, for '%s'
9485>24	lelong	x		\b, datasize %d
9486>28	lelong	x		\b, entries %d
9487>32	lelong	x		\b, index %d
9488>36	lelong	x		\b, seed %#x
9489
9490#
9491# Redis RDB - https://redis.io/topics/persistence
94920	string	REDIS			Redis RDB file,
9493>5	regex	[0-9][0-9][0-9][0-9]	version %s
9494
9495# Mork database.
9496# Used by older versions of Mozilla Suite and Firefox,
9497# and current versions of Thunderbird.
9498# From: David Korth <gerbilsoft@gerbilsoft.com>
94990	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
9500>23	string	x		\b, version %.3s
9501
9502# URL:		https://en.wikipedia.org/wiki/Management_Information_Format
9503# Reference:	https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
9504# From:		Joerg Jenderek
9505# Note:		only tested with monitor asset reports of Dell Display Manager
9506#		skip start like Language=fr|CA|iso8859-1
95070	search/27/C	Start\040Component	DMI Management Information Format
9508#!:mime	text/plain
9509!:mime	text/x-dmtf-mif
9510!:ext	mif
9511
9512
9513#------------------------------------------------------------------------------
9514# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $
9515#
9516# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
9517#                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
9518#
9519# file formats:   https://cn.dataone.org/cn/v2/formats
9520#------------------------------------------------------------------------------
9521
9522# EML (Ecological Metadata Language Format)
95230	string	<?xml
9524>&0	regex	(eml)-[0-9].[0-9].[0-9]+	eml://ecoinformatics.org/%s
9525
9526# onedcx (DataONE Dublin Core Extended v1.0)
9527>&0	regex	(onedcx/v)[0-9].[0-9]+		https://ns.dataone.org/metadata/schema/onedcx/v1.0
9528
9529# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
9530# version 001-1998)
9531>&0	regex	fgdc				FGDC-STD-001-1998
9532
9533# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
9534>&0	regex	(mercury/terms/v)[0-9].[0-9]	https://purl.org/ornl/schema/mercury/terms/v1.0
9535
9536# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
9537>&0	regex	isotc211
9538>>&0	regex	eng;USA				https://www.isotc211.org/2005/gmd
9539
9540# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
9541>>&0	regex	gov.noaa.nodc:[0-9]+		https://www.isotc211.org/2005/gmd-noaa
9542
9543# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
9544>>&0	regex	pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+	https://www.isotc211.org/2005/gmd-pangaea
9545!:mime	text/xml
9546
9547
9548# Object Reuse and Exchange Vocabulary
95490	string	<?xml
9550>&0	regex	rdf
9551>>&0	regex	openarchives	https://www.openarchives.org/ore/terms
9552!:mime application/rdf+xml
9553
9554
9555# Dryad Metadata Application Profile Version 3.1
95560	string	<DryadData
9557>&0	regex	(dryad-bibo/v)[0-9].[0-9]	https://datadryad.org/profile/v3.1
9558!:mime	text/xml
9559
9560#------------------------------------------------------------------------------
9561# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
9562# dppf:	Maxis Database Packed Files, the stored data file format used by all
9563#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
9564# 	https://www.wiki.sc4devotion.com/index.php?title=DBPF
9565#	13 Oct 2017, Kip Warner <kip at thevertigo dot com>
95660	string	DBPF	Maxis Database Packed File
9567>4	ulelong	x	\b, version: %u.
9568>>8	ulelong	x	\b%u
9569>>>36	ulelong	x       \b, files: %u
9570>>24	ledate	!0	\b, created: %s
9571>>28	ledate	!0	\b, modified: %s
9572!:ext	dbpf/package/dat/sc4
9573!:mime	application/x-maxis-dbpf
9574#------------------------------------------------------------------------------
9575# $File: der,v 1.3 2020/02/16 20:45:21 christos Exp $
9576# der: file(1) magic for DER encoded files
9577#
9578
9579# Certificate information piece
95800	name	certinfo
9581>0	der	seq
9582>>&0	der	set
9583>>>&0	der	seq
9584>>>>&0	der	obj_id3=550406
9585>>>>&0	der	prt_str=x	\b, countryName=%s
9586>>&0	der	set
9587>>>&0	der	seq
9588>>>>&0	der	obj_id3=550408
9589>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
9590>>&0	der	set
9591>>>&0	der	seq
9592>>>>&0	der	obj_id3=55040a
9593>>>>&0	der	utf8_str=x	\b, organizationName=%s
9594>>&0	der	set
9595>>>&0	der	seq
9596>>>>&0	der	obj_id3=550403
9597>>>>&0	der	utf8_str=x	\b, commonName=%s
9598>>&0	der	seq
9599
9600# Certificate requests
96010	der	seq
9602>&0	der	seq
9603>>&0	der	int1=00		DER Encoded Certificate request
9604>>&0	use	certinfo
9605
9606# Key Pairs
96070	der	seq
9608>&0	der	int1=00
9609>&0	der	int65=x
9610>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
9611
96120	der	seq
9613>&0	der	int1=00
9614>&0	der	int129=x
9615>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
9616
96170	der	seq
9618>&0	der	int1=00
9619>&0	der	int257=x
9620>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
9621
96220	der	seq
9623>&0	der	int1=00
9624>&0	der	int513=x
9625>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
9626
96270	der	seq
9628>&0	der	int1=00
9629>&0	der	int1025=x
9630>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
9631
96320	der	seq
9633>&0	der	int1=00
9634>&0	der	int2049=x
9635>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
9636
96370	der	seq
9638>&0	der	int1=00
9639>&0	der	int4097=x
9640>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
9641
9642# Certificates
96430	der	seq
9644>&0	der	seq
9645>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
9646>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
9647>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
9648>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
9649>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
9650>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
9651>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
9652>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
9653>>&0	der	seq
9654>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
9655>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
9656>>>&0	der	null
9657>>&0	der	seq
9658>>>&0	der	set
9659>>>>&0	der	seq
9660>>>>>&0	der	obj_id3=550406
9661>>>>>&0	der	prt_str=x	\b, countryName=%s
9662>>>&0	der	set
9663>>>>&0	der	seq
9664>>>>>&0	der	obj_id3=550408
9665>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
9666>>>&0	der	set
9667>>>>&0	der	seq
9668>>>>>&0	der	obj_id3=550407
9669>>>>>&0	der	prt_str=x	\b, localityName=%s
9670>>>&0	der	set
9671>>>>&0	der	seq
9672>>>>>&0	der	obj_id3=55040a
9673>>>>>&0	der	prt_str=x	\b, organizationName=%s
9674>>>&0	der	set
9675>>>>&0	der	seq
9676>>>>>&0	der	obj_id3=55040b
9677>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
9678>>>&0	der	set
9679>>>>&0	der	seq
9680>>>>>&0	der	obj_id3=550403
9681>>>>>&0	der	prt_str=x	\b, commonName=%s
9682>>>&0	der	set
9683>>>>&0	der	seq
9684>>>>>&0	der	obj_id9=2a864886f70d010901
9685>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
9686>>&0	der	seq
9687>>>&0	der	utc_time=x	\b, utcTime=%s
9688>>>&0	der	utc_time=x	\b, utcTime=%s
9689>>&0	use	certinfo
9690
96910	der	seq
9692>&0	der	seq
9693>>&0	der	eoc		Certificate
9694>>>&0	der	int1=02		\b, Version=3
9695>>&0	der	int9=x		\b, Serial=%s
9696>>&0	der	seq
9697>>>&0	der     obj_id9=2a864886f70d01010b
9698>>>&0	der	null
9699>>&0	der	seq
9700>>>&0	der	set
9701>>>>&0	der	seq
9702>>>>>&0	der     obj_id3=550403
9703>>>>>&0	der     utf8_str=x      \b, Issuer=%s
9704>>&0	der	seq
9705>>>&0	der	utc_time=x	\b, not-valid-before=%s
9706>>>&0	der	utc_time=x	\b, not-valid-after=%s
9707>>&0	der	seq
9708>>>&0	der	set
9709>>>>&0	der	seq
9710>>>>>&0	der     obj_id3=550403
9711>>>>>&0	der     utf8_str=x      \b, Subject=%s
9712
9713#------------------------------------------------------------------------------
9714# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
9715# diamond:  file(1) magic for Diamond system
9716#
9717# ... diamond is a multi-media mail and electronic conferencing system....
9718#
9719# XXX - I think it was either renamed Slate, or replaced by Slate....
9720#
9721#	The full deal is too long...
9722#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
97230	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
9724
9725#------------------------------------------------------------------------------
9726# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $
9727# dif:  file(1) magic for DIF text files
9728
9729#------------------------------------------------------------------------------
9730# From:	Joerg Jenderek
9731# URL:	http://en.wikipedia.org/wiki/Data_Interchange_Format
9732#	http://fileformats.archiveteam.org/wiki/Data_Interchange_Format
9733# Note:	called by TrID "Data Interchange Format",
9734#	by DROID x-fmt/368 "VisiCalc Database"
97350	string		TABLE
9736# skip text starting with TABLE by looking for numeric version on 2nd line
9737>6	search/2	0,
9738# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning
9739>>27	search/128	TUPLES		Data Interchange Format
9740# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html
9741#!:mime	application/x-dif-spreadsheet	Gnumeric
9742# https://github.com/LibreOffice/online/blob/master/discovery.xml
9743#!:mime	application/x-dif-document	LibreOffice
9744# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats
9745!:mime	application/x-dif
9746# https://extension.nirsoft.net/dif
9747#!:mime	application/vnd.ms-excel
9748#!:mime	text/plain
9749!:ext	dif
9750# look for double quote 0x22 on 3rd line
9751>>>10	search/3	"
9752# skip if next character also double quote
9753>>>>&0	ubyte		!0x22		\b, generator or table name
9754# comment like EXCEL, pwm enclosed in double quotes
9755>>>>>&-2	string	x		%s
9756
9757
9758#------------------------------------------------------------------------------
9759# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
9760# diff:  file(1) magic for diff(1) output
9761#
97620	search/1	diff\040	diff output text
9763!:mime	text/x-diff
97640	search/1	***\040 	diff output text
9765!:mime	text/x-diff
97660	search/1	Only\040in\040 	diff output text
9767!:mime	text/x-diff
97680	search/1	Common\040subdirectories:\040 	diff output text
9769!:mime	text/x-diff
9770
97710	search/1	Index:		RCS/CVS diff output text
9772!:mime	text/x-diff
9773
9774# bsdiff:  file(1) magic for bsdiff(1) output
97750	string/b		BSDIFF40	bsdiff(1) patch file
9776
9777
9778# unified diff
97790	search/4096	---\040
9780>&0	search/1024 \n
9781>>&0	search/1 +++\040
9782>>>&0	search/1024 \n
9783>>>>&0	search/1 @@	unified diff output text
9784!:mime	text/x-diff
9785!:strength + 90
9786
9787# librsync -- the library for network deltas
9788#
9789# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
9790# this file.
9791#
97920	belong		0x72730236	rdiff network-delta data
9793
97940	belong		0x72730136	rdiff network-delta signature data
9795>4	belong		x		(block length=%d,
9796>8	belong		x		signature strength=%d)
9797
9798#------------------------------------------------------------------------------
9799# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
9800#  Digital UNIX - Info
9801#
98020	string	=!<arch>\n________64E	Alpha archive
9803>22	string	X			-- out of date
9804#
9805
98060	leshort		0603
9807>24	leshort		0410		COFF format alpha pure
9808>24	leshort		0413		COFF format alpha demand paged
9809>>22	leshort&030000	!020000		executable
9810>>22	leshort&020000	!0		dynamically linked
9811>>16	lelong		!0		not stripped
9812>>16	lelong		0		stripped
9813>>27	byte		x		- version %d
9814>>26	byte		x		\b.%d
9815>>28	byte		x		\b-%d
9816>24	leshort		0407		COFF format alpha object
9817>>22	leshort&030000	020000		shared library
9818>>27	byte		x		- version %d
9819>>26	byte		x		\b.%d
9820>>28	byte		x		\b-%d
9821
9822# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
9823#
9824# The actual magic number is just "Core", followed by a 2-byte version
9825# number; however, treating any file that begins with "Core" as a Digital
9826# UNIX core dump file may produce too many false hits, so we include one
9827# byte of the version number as well; DU 5.0 appears only to be up to
9828# version 2.
9829#
98300	string		Core\001	Alpha COFF format core dump (Digital UNIX)
9831>24	string		>\0		\b, from '%s'
98320	string		Core\002	Alpha COFF format core dump (Digital UNIX)
9833>24	string		>\0		\b, from '%s'
9834#
9835# The next is incomplete, we could tell more about this format,
9836# but its not worth it.
98370	leshort		0x188	Alpha compressed COFF
98380	leshort		0x18f	Alpha u-code object
9839#
9840#
9841# Some other interesting Digital formats,
98420	string	\377\377\177		ddis/ddif
98430	string	\377\377\174		ddis/dots archive
98440	string	\377\377\176		ddis/dtif table data
98450	string	\033c\033		LN03 output
98460	long	04553207		X image
9847#
98480	string	=!<PDF>!\n		profiling data file
9849#
9850# Locale data tables (MIPS and Alpha).
9851#
98520	short		0x0501		locale data table
9853>6	short		0x24		for MIPS
9854>6	short		0x40		for Alpha
9855
9856#------------------------------------------------------------------------------
9857# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
9858# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
9859# from https://www.atsc.org/standards/a_52a.pdf
9860# corrections, additions, etc. are always welcome!
9861#
9862# syncword
98630	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
9864# Proposed audio/ac3 RFC/4184
9865!:mime	audio/vnd.dolby.dd-raw
9866# fscod
9867>4	byte&0xc0 = 0x00	48 kHz,
9868>4	byte&0xc0 = 0x40	44.1 kHz,
9869>4	byte&0xc0 = 0x80	32 kHz,
9870# is this one used for 96 kHz?
9871>4	byte&0xc0 = 0xc0	reserved frequency,
9872#
9873>5	byte&0x07 = 0x00	\b, complete main (CM)
9874>5	byte&0x07 = 0x01	\b, music and effects (ME)
9875>5	byte&0x07 = 0x02	\b, visually impaired (VI)
9876>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
9877>5	byte&0x07 = 0x04	\b, dialogue (D)
9878>5	byte&0x07 = 0x05	\b, commentary (C)
9879>5	byte&0x07 = 0x06	\b, emergency (E)
9880>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
9881>5	beshort&0x07e0 >0x0720	\b, karaoke
9882# acmod
9883>6	byte&0xe0 = 0x00	1+1 front,
9884>>6	byte&0x10 = 0x10	LFE on,
9885>6	byte&0xe0 = 0x20	1 front/0 rear,
9886>>6	byte&0x10 = 0x10	LFE on,
9887>6	byte&0xe0 = 0x40	2 front/0 rear,
9888# dsurmod (for stereo only)
9889>>6	byte&0x18 = 0x00	Dolby Surround not indicated
9890>>6	byte&0x18 = 0x08	not Dolby Surround encoded
9891>>6	byte&0x18 = 0x10	Dolby Surround encoded
9892>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
9893>>6	byte&0x04 = 0x04	LFE on,
9894>6	byte&0xe0 = 0x60	3 front/0 rear,
9895>>6	byte&0x04 = 0x04	LFE on,
9896>6	byte&0xe0 = 0x80	2 front/1 rear,
9897>>6	byte&0x04 = 0x04	LFE on,
9898>6	byte&0xe0 = 0xa0	3 front/1 rear,
9899>>6	byte&0x01 = 0x01	LFE on,
9900>6	byte&0xe0 = 0xc0	2 front/2 rear,
9901>>6	byte&0x04 = 0x04	LFE on,
9902>6	byte&0xe0 = 0xe0	3 front/2 rear,
9903>>6	byte&0x01 = 0x01	LFE on,
9904#
9905>4	byte&0x3e = 0x00	\b, 32 kbit/s
9906>4	byte&0x3e = 0x02	\b, 40 kbit/s
9907>4	byte&0x3e = 0x04	\b, 48 kbit/s
9908>4	byte&0x3e = 0x06	\b, 56 kbit/s
9909>4	byte&0x3e = 0x08	\b, 64 kbit/s
9910>4	byte&0x3e = 0x0a	\b, 80 kbit/s
9911>4	byte&0x3e = 0x0c	\b, 96 kbit/s
9912>4	byte&0x3e = 0x0e	\b, 112 kbit/s
9913>4	byte&0x3e = 0x10	\b, 128 kbit/s
9914>4	byte&0x3e = 0x12	\b, 160 kbit/s
9915>4	byte&0x3e = 0x14	\b, 192 kbit/s
9916>4	byte&0x3e = 0x16	\b, 224 kbit/s
9917>4	byte&0x3e = 0x18	\b, 256 kbit/s
9918>4	byte&0x3e = 0x1a	\b, 320 kbit/s
9919>4	byte&0x3e = 0x1c	\b, 384 kbit/s
9920>4	byte&0x3e = 0x1e	\b, 448 kbit/s
9921>4	byte&0x3e = 0x20	\b, 512 kbit/s
9922>4	byte&0x3e = 0x22	\b, 576 kbit/s
9923>4	byte&0x3e = 0x24	\b, 640 kbit/s
9924
9925#------------------------------------------------------------------------------
9926# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
9927# dump:  file(1) magic for dump file format--for new and old dump filesystems
9928#
9929# We specify both byte orders in order to recognize byte-swapped dumps.
9930#
99310	name	new-dump-be
9932>4	bedate	x		This dump %s,
9933>8	bedate	x		Previous dump %s,
9934>12	belong	>0		Volume %d,
9935>692	belong	0		Level zero, type:
9936>692	belong	>0		Level %d, type:
9937>0	belong	1		tape header,
9938>0	belong	2		beginning of file record,
9939>0	belong	3		map of inodes on tape,
9940>0	belong	4		continuation of file record,
9941>0	belong	5		end of volume,
9942>0	belong	6		map of inodes deleted,
9943>0	belong	7		end of medium (for floppy),
9944>676	string	>\0		Label %s,
9945>696	string	>\0		Filesystem %s,
9946>760	string	>\0		Device %s,
9947>824	string	>\0		Host %s,
9948>888	belong	>0		Flags %x
9949
99500	name	old-dump-be
9951#>4	bedate	x		This dump %s,
9952#>8	bedate	x		Previous dump %s,
9953>12	belong	>0		Volume %d,
9954>692	belong	0		Level zero, type:
9955>692	belong	>0		Level %d, type:
9956>0	belong	1		tape header,
9957>0	belong	2		beginning of file record,
9958>0	belong	3		map of inodes on tape,
9959>0	belong	4		continuation of file record,
9960>0	belong	5		end of volume,
9961>0	belong	6		map of inodes deleted,
9962>0	belong	7		end of medium (for floppy),
9963>676	string	>\0		Label %s,
9964>696	string	>\0		Filesystem %s,
9965>760	string	>\0		Device %s,
9966>824	string	>\0		Host %s,
9967>888	belong	>0		Flags %x
9968
99690	name	ufs2-dump-be
9970>896	beqdate	x		This dump %s,
9971>904	beqdate	x		Previous dump %s,
9972>12	belong	>0		Volume %d,
9973>692	belong	0		Level zero, type:
9974>692	belong	>0		Level %d, type:
9975>0	belong	1		tape header,
9976>0	belong	2		beginning of file record,
9977>0	belong	3		map of inodes on tape,
9978>0	belong	4		continuation of file record,
9979>0	belong	5		end of volume,
9980>0	belong	6		map of inodes deleted,
9981>0	belong	7		end of medium (for floppy),
9982>676	string	>\0		Label %s,
9983>696	string	>\0		Filesystem %s,
9984>760	string	>\0		Device %s,
9985>824	string	>\0		Host %s,
9986>888	belong	>0		Flags %x
9987
998824	belong	60012		new-fs dump file (big endian),
9989>0	use	new-dump-be
9990
999124	belong	60011		old-fs dump file (big endian),
9992>0	use	old-dump-be
9993
999424	lelong	60012		new-fs dump file (little endian),
9995# to correctly recognize '*.mo' GNU message catalog (little endian)
9996!:strength - 15
9997>0	use	\^new-dump-be
9998
999924	lelong	60011		old-fs dump file (little endian),
10000>0	use	\^old-dump-be
10001
10002
1000324	belong	0x19540119	new-fs dump file (ufs2, big endian),
10004>0	use	ufs2-dump-be
10005
1000624	lelong	0x19540119	new-fs dump file (ufs2, little endian),
10007>0	use	\^ufs2-dump-be
10008
1000918	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
10010>2	medate	x		Previous dump %s,
10011>6	medate	x		This dump %s,
10012>10	leshort	>0		Volume %d,
10013>0	leshort	1		tape header.
10014>0	leshort	2		beginning of file record.
10015>0	leshort	3		map of inodes on tape.
10016>0	leshort	4		continuation of file record.
10017>0	leshort	5		end of volume.
10018>0	leshort	6		map of inodes deleted.
10019>0	leshort	7		end of medium (for floppy).
10020
10021#------------------------------------------------------------------------------
10022# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
10023# Dyadic: file(1) magic for Dyalog APL.
10024#
10025# updated by Joerg Jenderek at Oct 2013
10026# https://en.wikipedia.org/wiki/Dyalog_APL
10027# https://www.dyalog.com/
10028# .DXV Dyalog APL External Variable
10029# .DIN Dyalog APL Input Table
10030# .DOT Dyalog APL Output Table
10031# .DFT Dyalog APL Format File
100320	ubeshort&0xFF60	0xaa00
10033# skip biblio.dbt
10034>1	byte		!4
10035# real Dyalog APL have non zero version numbers like 7.3 or 13.4
10036>>2	ubeshort	>0x0000		Dyalog APL
10037>>>1	byte		0x00		aplcore
10038#>>>1	byte		0x00		incomplete workspace
10039# *.DCF Dyalog APL Component File
10040>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
10041#>>>1	byte		0x01		component file
10042>>>1	byte		0x02		external variable exclusive
10043#>>>1	byte		0x02		external variable
10044# *.DWS Dyalog APL Workspace
10045>>>1	byte		0x03		workspace
10046>>>>7	byte&0x28	0x00		32-bit
10047>>>>7	byte&0x28	0x20		64-bit
10048>>>>7	byte&0x0c	0x00		classic
10049>>>>7	byte&0x0c	0x04		unicode
10050>>>>7	byte&0x88	0x00		big-endian
10051>>>>7	byte&0x88	0x80		little-endian
10052>>>1	byte		0x06		external variable shared
10053# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
10054>>>1	byte		0x07		session
10055>>>1	byte		0x08		mapped file 32-bit
10056>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
10057>>>1	byte		0x0a		mapped file 64-bit
10058>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
10059>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
10060>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
10061>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
10062>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
10063>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
10064>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
10065>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
10066>>>1	byte		0x13		component file 32-bit non-journaled checksummed
10067>>>1	byte		0x14		component file 64-bit non-journaled checksummed
10068>>>1	byte		0x15		component file under construction
10069>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
10070>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
10071>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
10072>>>1	byte		0x19		external workspace
10073>>>1	byte		0x80		DDB
10074>>>2	byte		x		version %d
10075>>>3	byte		x		\b.%d
10076#>>>2	byte		x		type %d
10077#>>>3	byte		x		subtype %d
10078
10079# *.DXF Dyalog APL Transfer File
100800	short		0x6060		Dyalog APL transfer
10081
10082#------------------------------------------------------------------------------
10083# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
10084# ebml:  file(1) magic for various Extensible Binary Meta Language
10085# https://www.matroska.org/technical/specs/index.html#track
100860	belong	0x1a45dfa3	EBML file
10087>4	search/b/100	\102\202
10088>>&1	string	x		\b, creator %.8s
10089
10090#------------------------------------------------------------------------------
10091# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
10092# edid:  file(1) magic for EDID dump files
10093
100940	quad	0x00ffffffffffff00	Extended display identification data dump
10095!:mime application/x-edid-dump
10096>18	byte	0x01			Version 1
10097>>19	byte	<0x04			\b.%d
10098>18	byte	0x02			Version 2
10099>>19	byte	0x00			\b.0
10100
10101#------------------------------------------------------------------------------
10102# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
10103# T602 editor documents
10104# by David Necas <yeti@physics.muni.cz>
101050	string	@CT\ 	T602 document data,
10106>4	string	0	Kamenicky
10107>4	string	1	CP 852
10108>4	string	2	KOI8-CS
10109>4	string	>2	unknown encoding
10110
10111# Vi IMproved Encrypted file
10112# by David Necas <yeti@physics.muni.cz>
101130	string	VimCrypt~	Vim encrypted file data
10114
101150	name	vimnanoswap
10116>67	byte	0
10117>>107	byte	0
10118#>>>2	string	x	%s swap file
10119>>>24	ulelong	x	\b, pid %d
10120>>>28	string	>\0	\b, user %s
10121>>>68	string	>\0	\b, host %s
10122>>>108	string	>\0	\b, file %s
10123>>>1007	byte	0x55	\b, modified
10124
10125# Vi IMproved Swap file
10126# by Sven Wegener <swegener@gentoo.org>
101270	string  b0VIM\ 		Vim swap file
10128>&0	string  >\0		\b, version %s
10129>0	use	vimnanoswap
10130
10131
10132# Lock/swap file for several editors, at least
10133# Vi IMproved and nano
101340	string	b0nano		Nano swap file
10135>0	use	vimnanoswap
10136
10137# kate (K Advanced Text Editor)
101380	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
10139
10140#------------------------------------------------------------------------------
10141# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
10142# efi:  file(1) magic for Universal EFI binaries
10143
101440	lelong	0x0ef1fab9
10145>4	lelong	1		Universal EFI binary with 1 architecture
10146>>&0	lelong	7		\b, i386
10147>>&0	lelong	0x01000007	\b, x86_64
10148>4	lelong	2		Universal EFI binary with 2 architectures
10149>>&0	lelong	7		\b, i386
10150>>&0	lelong	0x01000007	\b, x86_64
10151>>&20	lelong	7		\b, i386
10152>>&20	lelong	0x01000007	\b, x86_64
10153>4	lelong	>2		Universal EFI binary with %d architectures
10154
10155#------------------------------------------------------------------------------
10156# $File: elf,v 1.80 2020/02/12 22:17:33 christos Exp $
10157# elf:  file(1) magic for ELF executables
10158#
10159# We have to check the byte order flag to see what byte order all the
10160# other stuff in the header is in.
10161#
10162# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
10163#
10164# Created by: unknown
10165# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
10166# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
10167# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
10168# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
10169# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
10170
101710	name		elf-mips
10172>0	lelong&0xf0000000	0x00000000	MIPS-I
10173>0	lelong&0xf0000000	0x10000000	MIPS-II
10174>0	lelong&0xf0000000	0x20000000	MIPS-III
10175>0	lelong&0xf0000000	0x30000000	MIPS-IV
10176>0	lelong&0xf0000000	0x40000000	MIPS-V
10177>0	lelong&0xf0000000	0x50000000	MIPS32
10178>0	lelong&0xf0000000	0x60000000	MIPS64
10179>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
10180>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
10181>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
10182>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
10183
101840	name		elf-sparc
10185>0	lelong&0x00ffff00	0x00000100	V8+ Required,
10186>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
10187>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
10188>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
10189>0	lelong&0x3		0		total store ordering,
10190>0	lelong&0x3		1		partial store ordering,
10191>0	lelong&0x3		2		relaxed memory ordering,
10192
101930	name		elf-pa-risc
10194>2	leshort		0x020b		1.0
10195>2	leshort		0x0210		1.1
10196>2	leshort		0x0214		2.0
10197>0	leshort		&0x0008		(LP64)
10198
101990	name		elf-le
10200>16	leshort		0		no file type,
10201!:mime	application/octet-stream
10202>16	leshort		1		relocatable,
10203!:mime	application/x-object
10204>16	leshort		2		executable,
10205!:mime	application/x-executable
10206>16	leshort		3		${x?pie executable:shared object},
10207
10208!:mime	application/x-${x?pie-executable:sharedlib}
10209>16	leshort		4		core file,
10210!:mime	application/x-coredump
10211# OS-specific
10212>7	byte		202
10213>>16	leshort		0xFE01		executable,
10214!:mime	application/x-executable
10215# Core file detection is not reliable.
10216#>>>(0x38+0xcc) string	>\0		of '%s'
10217#>>>(0x38+0x10) lelong	>0		(signal %d),
10218>16	leshort		&0xff00		processor-specific,
10219>18	clear		x
10220>18	leshort		0		no machine,
10221>18	leshort		1		AT&T WE32100,
10222>18	leshort		2		SPARC,
10223>18	leshort		3		Intel 80386,
10224>18	leshort		4		Motorola m68k,
10225>>4	byte		1
10226>>>36	lelong		&0x01000000	68000,
10227>>>36	lelong		&0x00810000	CPU32,
10228>>>36	lelong		0		68020,
10229>18	leshort		5		Motorola m88k,
10230>18	leshort		6		Intel 80486,
10231>18	leshort		7		Intel 80860,
10232# The official e_machine number for MIPS is now #8, regardless of endianness.
10233# The second number (#10) will be deprecated later. For now, we still
10234# say something if #10 is encountered, but only gory details for #8.
10235>18	leshort		8		MIPS,
10236>>4	byte		1
10237>>>36	lelong		&0x20		N32
10238>18	leshort		10		MIPS,
10239>>4	byte		1
10240>>>36	lelong		&0x20		N32
10241>18	leshort		8
10242# only for 32-bit
10243>>4	byte		1
10244>>>36	use		elf-mips
10245# only for 64-bit
10246>>4	byte		2
10247>>>48	use		elf-mips
10248>18	leshort		9		Amdahl,
10249>18	leshort		10		MIPS (deprecated),
10250>18	leshort		11		RS6000,
10251>18	leshort		15		PA-RISC,
10252# only for 32-bit
10253>>4	byte		1
10254>>>36	use		elf-pa-risc
10255# only for 64-bit
10256>>4	byte		2
10257>>>48	use		elf-pa-risc
10258>18	leshort		16		nCUBE,
10259>18	leshort		17		Fujitsu VPP500,
10260>18	leshort		18		SPARC32PLUS,
10261# only for 32-bit
10262>>4	byte		1
10263>>>36	use		elf-sparc
10264>18	leshort		19		Intel 80960,
10265>18	leshort		20		PowerPC or cisco 4500,
10266>18	leshort		21		64-bit PowerPC or cisco 7500,
10267>18	leshort		22		IBM S/390,
10268>18	leshort		23		Cell SPU,
10269>18	leshort		24		cisco SVIP,
10270>18	leshort		25		cisco 7200,
10271>18	leshort		36		NEC V800 or cisco 12000,
10272>18	leshort		37		Fujitsu FR20,
10273>18	leshort		38		TRW RH-32,
10274>18	leshort		39		Motorola RCE,
10275>18	leshort		40		ARM,
10276>>4	byte		1
10277>>>36	lelong&0xff000000	0x04000000	EABI4
10278>>>36	lelong&0xff000000	0x05000000	EABI5
10279>>>36	lelong		&0x00800000	BE8
10280>>>36	lelong		&0x00400000	LE8
10281>18	leshort		41		Alpha,
10282>18	leshort		42		Renesas SH,
10283>18	leshort		43		SPARC V9,
10284>>4	byte		2
10285>>>48	use		elf-sparc
10286>18	leshort		44		Siemens Tricore Embedded Processor,
10287>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
10288>18	leshort		46		Renesas H8/300,
10289>18	leshort		47		Renesas H8/300H,
10290>18	leshort		48		Renesas H8S,
10291>18	leshort		49		Renesas H8/500,
10292>18	leshort		50		IA-64,
10293>18	leshort		51		Stanford MIPS-X,
10294>18	leshort		52		Motorola Coldfire,
10295>18	leshort		53		Motorola M68HC12,
10296>18	leshort		54		Fujitsu MMA,
10297>18	leshort		55		Siemens PCP,
10298>18	leshort		56		Sony nCPU,
10299>18	leshort		57		Denso NDR1,
10300>18	leshort		58		Start*Core,
10301>18	leshort		59		Toyota ME16,
10302>18	leshort		60		ST100,
10303>18	leshort		61		Tinyj emb.,
10304>18	leshort		62		x86-64,
10305>18	leshort		63		Sony DSP,
10306>18	leshort		64		DEC PDP-10,
10307>18	leshort		65		DEC PDP-11,
10308>18	leshort		66		FX66,
10309>18	leshort		67		ST9+ 8/16 bit,
10310>18	leshort		68		ST7 8 bit,
10311>18	leshort		69		MC68HC16,
10312>18	leshort		70		MC68HC11,
10313>18	leshort		71		MC68HC08,
10314>18	leshort		72		MC68HC05,
10315>18	leshort		73		SGI SVx or Cray NV1,
10316>18	leshort		74		ST19 8 bit,
10317>18	leshort		75		Digital VAX,
10318>18	leshort		76		Axis cris,
10319>18	leshort		77		Infineon 32-bit embedded,
10320>18	leshort		78		Element 14 64-bit DSP,
10321>18	leshort		79		LSI Logic 16-bit DSP,
10322>18	leshort		80		MMIX,
10323>18	leshort		81		Harvard machine-independent,
10324>18	leshort		82		SiTera Prism,
10325>18	leshort		83		Atmel AVR 8-bit,
10326>18	leshort		84		Fujitsu FR30,
10327>18	leshort		85		Mitsubishi D10V,
10328>18	leshort		86		Mitsubishi D30V,
10329>18	leshort		87		NEC v850,
10330>18	leshort		88		Renesas M32R,
10331>18	leshort		89		Matsushita MN10300,
10332>18	leshort		90		Matsushita MN10200,
10333>18	leshort		91		picoJava,
10334>18	leshort		92		OpenRISC,
10335>18	leshort		93		ARC Cores Tangent-A5,
10336>18	leshort		94		Tensilica Xtensa,
10337>18	leshort		95		Alphamosaic VideoCore,
10338>18	leshort		96		Thompson Multimedia,
10339>18	leshort		97		NatSemi 32k,
10340>18	leshort		98		Tenor Network TPC,
10341>18	leshort		99		Trebia SNP 1000,
10342>18	leshort		100		STMicroelectronics ST200,
10343>18	leshort		101		Ubicom IP2022,
10344>18	leshort		102		MAX Processor,
10345>18	leshort		103		NatSemi CompactRISC,
10346>18	leshort		104		Fujitsu F2MC16,
10347>18	leshort		105		TI msp430,
10348>18	leshort		106		Analog Devices Blackfin,
10349>18	leshort		107		S1C33 Family of Seiko Epson,
10350>18	leshort		108		Sharp embedded,
10351>18	leshort		109		Arca RISC,
10352>18	leshort		110		PKU-Unity Ltd.,
10353>18	leshort		111		eXcess: 16/32/64-bit,
10354>18	leshort		112		Icera Deep Execution Processor,
10355>18	leshort		113		Altera Nios II,
10356>18	leshort		114		NatSemi CRX,
10357>18	leshort		115		Motorola XGATE,
10358>18	leshort		116		Infineon C16x/XC16x,
10359>18	leshort		117		Renesas M16C series,
10360>18	leshort		118		Microchip dsPIC30F,
10361>18	leshort		119		Freescale RISC core,
10362>18	leshort		120		Renesas M32C series,
10363>18	leshort		131		Altium TSK3000 core,
10364>18	leshort		132		Freescale RS08,
10365>18	leshort		134		Cyan Technology eCOG2,
10366>18	leshort		135		Sunplus S+core7 RISC,
10367>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
10368>18	leshort		137		Broadcom VideoCore III,
10369>18	leshort		138		LatticeMico32,
10370>18	leshort		139		Seiko Epson C17 family,
10371>18	leshort		140		TI TMS320C6000 DSP family,
10372>18	leshort		141		TI TMS320C2000 DSP family,
10373>18	leshort		142		TI TMS320C55x DSP family,
10374>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
10375>18	leshort		161		Cypress M8C,
10376>18	leshort		162		Renesas R32C series,
10377>18	leshort		163		NXP TriMedia family,
10378>18	leshort		164		QUALCOMM DSP6,
10379>18	leshort		165		Intel 8051 and variants,
10380>18	leshort		166		STMicroelectronics STxP7x family,
10381>18	leshort		167		Andes embedded RISC,
10382>18	leshort		168		Cyan eCOG1X family,
10383>18	leshort		169		Dallas MAXQ30,
10384>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
10385>18	leshort		171		M2000 Reconfigurable RISC,
10386>18	leshort		172		Cray NV2 vector architecture,
10387>18	leshort		173		Renesas RX family,
10388>18	leshort		174		META,
10389>18	leshort		175		MCST Elbrus,
10390>18	leshort		176		Cyan Technology eCOG16 family,
10391>18	leshort		177		NatSemi CompactRISC,
10392>18	leshort		178		Freescale Extended Time Processing Unit,
10393>18	leshort		179		Infineon SLE9X,
10394>18	leshort		180		Intel L1OM,
10395>18	leshort		181		Intel K1OM,
10396>18	leshort		183		ARM aarch64,
10397>18	leshort		185		Atmel 32-bit family,
10398>18	leshort		186		STMicroeletronics STM8 8-bit,
10399>18	leshort		187		Tilera TILE64,
10400>18	leshort		188		Tilera TILEPro,
10401>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
10402>18	leshort		190		NVIDIA CUDA architecture,
10403>18	leshort		191		Tilera TILE-Gx,
10404>18	leshort		197		Renesas RL78 family,
10405>18	leshort		199		Renesas 78K0R,
10406>18	leshort		200		Freescale 56800EX,
10407>18	leshort		201		Beyond BA1,
10408>18	leshort		202		Beyond BA2,
10409>18	leshort		203		XMOS xCORE,
10410>18	leshort		204		Microchip 8-bit PIC(r),
10411>18	leshort		210		KM211 KM32,
10412>18	leshort		211		KM211 KMX32,
10413>18	leshort		212		KM211 KMX16,
10414>18	leshort		213		KM211 KMX8,
10415>18	leshort		214		KM211 KVARC,
10416>18	leshort		215		Paneve CDP,
10417>18	leshort		216		Cognitive Smart Memory,
10418>18	leshort		217		iCelero CoolEngine,
10419>18	leshort		218		Nanoradio Optimized RISC,
10420>18	leshort		243		UCB RISC-V,
10421>18	leshort		247		eBPF,
10422>18	leshort		251             NEC VE,
10423>18	leshort		0x1057		AVR (unofficial),
10424>18	leshort		0x1059		MSP430 (unofficial),
10425>18	leshort		0x1223		Adapteva Epiphany (unofficial),
10426>18	leshort		0x2530		Morpho MT (unofficial),
10427>18	leshort		0x3330		FR30 (unofficial),
10428>18	leshort		0x3426		OpenRISC (obsolete),
10429>18	leshort		0x4688		Infineon C166 (unofficial),
10430>18	leshort		0x5441		Cygnus FRV (unofficial),
10431>18	leshort		0x5aa5		DLX (unofficial),
10432>18	leshort		0x7650		Cygnus D10V (unofficial),
10433>18	leshort		0x7676		Cygnus D30V (unofficial),
10434>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
10435>18	leshort		0x8472		OpenRISC (obsolete),
10436>18	leshort		0x9025		Cygnus PowerPC (unofficial),
10437>18	leshort		0x9026		Alpha (unofficial),
10438>18	leshort		0x9041		Cygnus M32R (unofficial),
10439>18	leshort		0x9080		Cygnus V850 (unofficial),
10440>18	leshort		0xa390		IBM S/390 (obsolete),
10441>18	leshort		0xabc7		Old Xtensa (unofficial),
10442>18	leshort		0xad45		xstormy16 (unofficial),
10443>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
10444>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
10445>18	leshort		0xdead		Cygnus MN10200 (unofficial),
10446>18	leshort		0xf00d		Toshiba MeP (unofficial),
10447>18	leshort		0xfeb0		Renesas M32C (unofficial),
10448>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
10449>18	leshort		0xfebb		NIOS (unofficial),
10450>18	leshort		0xfeed		Moxie (unofficial),
10451>18	default		x
10452>>18	leshort		x		*unknown arch 0x%x*
10453>20	lelong		0		invalid version
10454>20	lelong		1		version 1
10455
104560	string		\177ELF		ELF
10457!:strength *2
10458>4	byte		0		invalid class
10459>4	byte		1		32-bit
10460>4	byte		2		64-bit
10461>5	byte		0		invalid byte order
10462>5	byte		1		LSB
10463>>0	use		elf-le
10464>5	byte		2		MSB
10465>>0	use		\^elf-le
10466>7	byte		0		(SYSV)
10467>7	byte		1		(HP-UX)
10468>7	byte		2		(NetBSD)
10469>7	byte		3		(GNU/Linux)
10470>7	byte		4		(GNU/Hurd)
10471>7	byte		5		(86Open)
10472>7	byte		6		(Solaris)
10473>7	byte		7		(Monterey)
10474>7	byte		8		(IRIX)
10475>7	byte		9		(FreeBSD)
10476>7	byte		10		(Tru64)
10477>7	byte		11		(Novell Modesto)
10478>7	byte		12		(OpenBSD)
10479>7	byte		13		(OpenVMS)
10480>7	byte		14		(HP NonStop Kernel)
10481>7	byte		15		(AROS Research Operating System)
10482>7	byte		16		(FenixOS)
10483>7	byte		17		(Nuxi CloudABI)
10484>7	byte		97		(ARM)
10485>7	byte		202		(Cafe OS)
10486>7	byte		255		(embedded)
10487
10488#------------------------------------------------------------------------------
10489# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
10490# encore:  file(1) magic for Encore machines
10491#
10492# XXX - needs to have the byte order specified (NS32K was little-endian,
10493# dunno whether they run the 88K in little-endian mode or not).
10494#
104950	short		0x154		Encore
10496>20	short		0x107		executable
10497>20	short		0x108		pure executable
10498>20	short		0x10b		demand-paged executable
10499>20	short		0x10f		unsupported executable
10500>12	long		>0		not stripped
10501>22	short		>0		- version %d
10502>22	short		0		-
10503#>4	date		x		stamp %s
105040	short		0x155		Encore unsupported executable
10505>12	long		>0		not stripped
10506>22	short		>0		- version %d
10507>22	short		0		-
10508#>4	date		x		stamp %s
10509
10510#------------------------------------------------------------------------------
10511# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
10512# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
10513# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
10514# Useful information for improving this file can be found at:
10515# http://software.frodo.looijaard.name/psiconv/formats/Index.html
10516#------------------------------------------------------------------------------
105170	lelong		0x10000037	Psion Series 5
10518>4	lelong		0x10000039	font file
10519>4	lelong		0x1000003A	printer driver
10520>4	lelong		0x1000003B	clipboard
10521>4	lelong		0x10000042	multi-bitmap image
10522!:mime image/x-epoc-mbm
10523>4	lelong		0x1000006A	application information file
10524>4	lelong		0x1000006D
10525>>8	lelong		0x1000007D	Sketch image
10526!:mime image/x-epoc-sketch
10527>>8	lelong		0x1000007E	voice note
10528>>8	lelong		0x1000007F	Word file
10529!:mime application/x-epoc-word
10530>>8	lelong		0x10000085	OPL program (TextEd)
10531!:mime application/x-epoc-opl
10532>>8	lelong		0x10000087	Comms settings
10533>>8	lelong		0x10000088	Sheet file
10534!:mime application/x-epoc-sheet
10535>>8	lelong		0x100001C4	EasyFax initialisation file
10536>4	lelong		0x10000073	OPO module
10537!:mime application/x-epoc-opo
10538>4	lelong		0x10000074	OPL application
10539!:mime application/x-epoc-app
10540>4	lelong		0x1000008A	exported multi-bitmap image
10541>4	lelong		0x1000016D
10542>>8	lelong		0x10000087	Comms names
10543
105440	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
10545
105460	lelong		0x10000050	Psion Series 5
10547>4	lelong		0x1000006D	database
10548>>8	lelong		0x10000084	Agenda file
10549!:mime application/x-epoc-agenda
10550>>8	lelong		0x10000086	Data file
10551!:mime application/x-epoc-data
10552>>8	lelong		0x10000CEA	Jotter file
10553!:mime application/x-epoc-jotter
10554>4	lelong		0x100000E4	ini file
10555
105560	lelong		0x10000079	Psion Series 5 binary:
10557>4	lelong		0x00000000	DLL
10558>4	lelong		0x10000049	comms hardware library
10559>4	lelong		0x1000004A	comms protocol library
10560>4	lelong		0x1000005D	OPX
10561>4	lelong		0x1000006C	application
10562>4	lelong		0x1000008D	DLL
10563>4	lelong		0x100000AC	logical device driver
10564>4	lelong		0x100000AD	physical device driver
10565>4	lelong		0x100000E5	file transfer protocol
10566>4	lelong		0x100000E5	file transfer protocol
10567>4	lelong		0x10000140	printer definition
10568>4	lelong		0x10000141	printer definition
10569
105700	lelong		0x1000007A	Psion Series 5 executable
10571
10572#------------------------------------------------------------------------------
10573# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
10574# erlang:  file(1) magic for Erlang JAM and BEAM files
10575# URL:  https://www.erlang.org/faq/x779.html#AEN812
10576
10577# OTP R3-R4
105780	string	\0177BEAM!	Old Erlang BEAM file
10579>6	short	>0		- version %d
10580
10581# OTP R5 and onwards
105820	string	FOR1
10583>8	string	BEAM		Erlang BEAM file
10584
10585# 4.2 version may have a copyright notice!
105864	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
1058779	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
10588
105894	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
10590
105910	bequad	0x0000000000ABCDEF	Erlang DETS file
10592
10593# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $
10594# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
10595# URL: https://github.com/arendst/Sonoff-Tasmota/
10596# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
10597# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
10598# From: Joerg Jenderek
10599#
10600# cfg_holder=4617=0x1209
106010		uleshort	4617
10602# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
10603>0x1D5		ubequad		0x2f30313233343536	configuration of Tasmota firmware (ESP8266)
10604!:mime	application/x-tasmota-dmp
10605!:ext	dmp
10606# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
10607>>11		ubyte^0x65	x			\b, version %u
10608>>10		ubyte^0x64	x			\b.%u
10609>>9		ubyte^0x63	x			\b.%u
10610>>8		ubyte^0x62	x			\b.%u
10611#>8		ubelong		x			(0x%x)
10612# hostname[33] XORed
10613>>0x165		ubyte^0x1BF	x			\b, hostname %c
10614>>0x166		ubyte^0x1C0	>037			\b%c
10615>>0x167		ubyte^0x1C1	>037			\b%c
10616>>0x168		ubyte^0x1C2	>037			\b%c
10617>>0x169		ubyte^0x1C3	>037			\b%c
10618>>0x16A		ubyte^0x1C4	>037			\b%c
10619>>0x16B		ubyte^0x1C5	>037			\b%c
10620>>0x16C		ubyte^0x1C6	>037			\b%c
10621>>0x16D		ubyte^0x1C7	>037			\b%c
10622>>0x16E		ubyte^0x1C8	>037			\b%c
10623>>0x16F		ubyte^0x1C9	>037			\b%c
10624>>0x170		ubyte^0x1CA	>037			\b%c
10625>>0x171		ubyte^0x1CB	>037			\b%c
10626>>0x172		ubyte^0x1CC 	>037			\b%c
10627>>0x173		ubyte^0x1CD	>037			\b%c
10628>>0x174		ubyte^0x1CE	>037			\b%c
10629>>0x175		ubyte^0x1CF	>037			\b%c
10630>>0x176		ubyte^0x1D0	>037			\b%c
10631>>0x177		ubyte^0x1D1	>037			\b%c
10632>>0x178		ubyte^0x1D2	>037			\b%c
10633>>0x179		ubyte^0x1D3	>037			\b%c
10634>>0x17A		ubyte^0x1D4	>037			\b%c
10635>>0x17B		ubyte^0x1D5	>037			\b%c
10636>>0x17C		ubyte^0x1D6	>037			\b%c
10637>>0x17D		ubyte^0x1D7	>037			\b%c
10638>>0x17E		ubyte^0x1D8	>037			\b%c
10639>>0x17F		ubyte^0x1D9	>037			\b%c
10640>>0x180		ubyte^0x1DA	>037			\b%c
10641>>0x181		ubyte^0x1DB	>037			\b%c
10642>>0x182		ubyte^0x1DC	>037			\b%c
10643>>0x183		ubyte^0x1DD	>037			\b%c
10644>>0x184		ubyte^0x1DE	>037			\b%c
10645>>0x185		ubyte^0x1DF	>037			\b%c
10646#>>0x165		string		x			(%.33s)
10647
10648
10649
10650#------------------------------------------------------------------------------
10651# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $
10652# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
10653# Based on info from
10654# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
106550	belong	9994	ESRI Shapefile
10656>4	belong	=0
10657>8	belong	=0
10658>12	belong	=0
10659>16	belong	=0
10660>20	belong	=0
10661>28	lelong	x	version %d
10662>24	belong	x	length %d
10663>32	lelong	=0	type Null Shape
10664>32	lelong	=1	type Point
10665>32	lelong	=3	type PolyLine
10666>32	lelong	=5	type Polygon
10667>32	lelong	=8	type MultiPoint
10668>32	lelong	=11	type PointZ
10669>32	lelong	=13	type PolyLineZ
10670>32	lelong	=15	type PolygonZ
10671>32	lelong	=18	type MultiPointZ
10672>32	lelong	=21	type PointM
10673>32	lelong	=23	type PolyLineM
10674>32	lelong	=25	type PolygonM
10675>32	lelong	=28	type MultiPointM
10676>32	lelong	=31	type MultiPatch
10677
10678#------------------------------------------------------------------------------
10679# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
10680# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
10681# From Roger Leigh <roger@whinlatter.uklinux.net>
106820       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
106830       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
106840       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
10685
10686#------------------------------------------------------------------------------
10687# $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $
10688# filesystems:  file(1) magic for different filesystems
10689#
106900	name	partid
10691>0	ubyte	0x00	Unused
10692>0	ubyte	0x01	12-bit FAT
10693>0	ubyte	0x02	XENIX /
10694>0	ubyte	0x03	XENIX /usr
10695>0	ubyte	0x04	16-bit FAT, less than 32M
10696>0	ubyte	0x05	extended partition
10697>0	ubyte	0x06	16-bit FAT, more than 32M
10698>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
10699>0	ubyte	0x08	AIX or os, or etc.
10700>0	ubyte	0x09	AIX boot partition or Coherent
10701>0	ubyte	0x0a	O/2 boot manager or Coherent swap
10702>0	ubyte	0x0b	32-bit FAT
10703>0	ubyte	0x0c	32-bit FAT, LBA-mapped
10704>0	ubyte	0x0d	7XXX, LBA-mapped
10705>0	ubyte	0x0e	16-bit FAT, LBA-mapped
10706>0	ubyte	0x0f	extended partition, LBA-mapped
10707>0	ubyte	0x10	OPUS
10708>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
10709>0	ubyte	0x12 	Compaq diagnostics
10710>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
10711>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
10712>0	ubyte	0x17 	OS/2 hidden IFS
10713>0	ubyte	0x18 	AST Windows swapfile
10714>0	ubyte	0x19 	Willowtech Photon coS
10715>0	ubyte	0x1b 	hidden win95 fat 32
10716>0	ubyte	0x1c 	hidden win95 fat 32 lba
10717>0	ubyte	0x1d	hidden win95 fat 16 lba
10718>0	ubyte	0x20 	Willowsoft OFS1
10719>0	ubyte	0x21 	reserved
10720>0	ubyte	0x23 	reserved
10721>0	ubyte	0x24	NEC DOS
10722>0	ubyte	0x26 	reserved
10723>0	ubyte	0x31 	reserved
10724>0	ubyte	0x32	Alien Internet Services NOS
10725>0	ubyte	0x33 	reserved
10726>0	ubyte	0x34 	reserved
10727>0	ubyte	0x35 	JFS on OS2
10728>0	ubyte	0x36 	reserved
10729>0	ubyte	0x38 	Theos
10730>0	ubyte	0x39 	Plan 9, or Theos spanned
10731>0	ubyte	0x3a 	Theos ver 4 4gb partition
10732>0	ubyte	0x3b 	Theos ve 4 extended partition
10733>0	ubyte	0x3c 	PartitionMagic recovery
10734>0	ubyte	0x3d 	Hidden Netware
10735>0	ubyte	0x40 	VENIX 286 or LynxOS
10736>0	ubyte	0x41	PReP
10737>0	ubyte	0x42	linux swap sharing DRDOS disk
10738>0	ubyte	0x43	linux sharing DRDOS disk
10739>0	ubyte	0x44	GoBack change utility
10740>0	ubyte	0x45	Boot US Boot manager
10741>0	ubyte	0x46	EUMEL/Elan or Ergos 3
10742>0	ubyte	0x47	EUMEL/Elan or Ergos 3
10743>0	ubyte	0x48	EUMEL/Elan or Ergos 3
10744>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
10745>0	ubyte	0x4c	Oberon partition
10746>0	ubyte	0x4d 	QNX4.x
10747>0	ubyte	0x4e 	QNX4.x 2nd part
10748>0	ubyte	0x4f 	QNX4.x 3rd part
10749>0	ubyte	0x50 	DM (disk manager)
10750>0	ubyte	0x51 	DM6 Aux1 (or Novell)
10751>0	ubyte	0x52 	CP/M or Microport SysV/AT
10752>0	ubyte	0x53 	DM6 Aux3
10753>0	ubyte	0x54	DM6 DDO
10754>0	ubyte	0x55	EZ-Drive (disk manager)
10755>0	ubyte	0x56	Golden Bow (disk manager)
10756>0	ubyte	0x57	Drive PRO
10757>0	ubyte	0x5c	Priam Edisk (disk manager)
10758>0	ubyte	0x61	SpeedStor
10759>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
10760>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
10761>0	ubyte	0x65	Novell Netware 3.xx
10762>0	ubyte	0x66	Novell 386 Netware
10763>0	ubyte	0x67	Novell
10764>0	ubyte	0x68	Novell
10765>0	ubyte	0x69	Novell
10766>0	ubyte	0x70	DiskSecure Multi-Boot
10767>0	ubyte	0x71	reserved
10768>0	ubyte	0x73	reserved
10769>0	ubyte	0x74	reserved
10770>0	ubyte	0x75	PC/IX
10771>0	ubyte	0x76	reserved
10772>0	ubyte	0x77	M2FS/M2CS partition
10773>0	ubyte	0x78	XOSL boot loader filesystem
10774>0	ubyte	0x80	MINIX until 1.4a
10775>0	ubyte	0x81	MINIX since 1.4b
10776>0	ubyte	0x82	Linux swap or Solaris
10777>0	ubyte	0x83	Linux native
10778>0	ubyte	0x84	OS/2 hidden C: drive
10779>0	ubyte	0x85	Linux extended partition
10780>0	ubyte	0x86	NT FAT volume set
10781>0	ubyte	0x87	NTFS volume set or HPFS mirrored
10782>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
10783>0	ubyte	0x8b	Legacy Fault tolerant FAT32
10784>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
10785>0	ubyte	0x8d	Hidden free FDISK FAT12
10786>0	ubyte	0x8e	Linux Logical Volume Manager
10787>0	ubyte	0x90	Hidden free FDISK FAT16
10788>0	ubyte	0x91	Hidden free FDISK DOS EXT
10789>0	ubyte	0x92	Hidden free FDISK FAT16 Big
10790>0	ubyte	0x93	Amoeba filesystem
10791>0	ubyte	0x94	Amoeba bad block table
10792>0	ubyte	0x95	MIT EXOPC native partitions
10793>0	ubyte	0x97	Hidden free FDISK FAT32
10794>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
10795>0	ubyte	0x99	Mylex EISA SCSI
10796>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
10797>0	ubyte	0x9b	Hidden free FDISK EXT LBA
10798>0	ubyte	0x9f	BSDI?
10799>0	ubyte	0xa0	IBM Thinkpad hibernation
10800>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
10801>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
10802>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
10803>0	ubyte	0xa5	386BSD partition type
10804>0	ubyte	0xa6	OpenBSD partition type
10805>0	ubyte	0xa7	NeXTSTEP 486
10806>0	ubyte	0xa8	Apple UFS
10807>0	ubyte	0xa9	NetBSD partition type
10808>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
10809>0	ubyte	0xab	Apple Boot
10810>0	ubyte	0xae	SHAG OS filesystem
10811>0	ubyte	0xaf	Apple HFS
10812>0	ubyte	0xb0	BootStar Dummy
10813>0	ubyte	0xb1	reserved
10814>0	ubyte	0xb3	reserved
10815>0	ubyte	0xb4	reserved
10816>0	ubyte	0xb6	reserved
10817>0	ubyte	0xb7	BSDI BSD/386 filesystem
10818>0	ubyte	0xb8	BSDI BSD/386 swap
10819>0	ubyte	0xbb	Boot Wizard Hidden
10820>0	ubyte	0xbe	Solaris 8 partition type
10821>0	ubyte	0xbf	Solaris partition type
10822>0	ubyte	0xc0 	CTOS
10823>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
10824>0	ubyte	0xc2 	Hidden Linux
10825>0	ubyte	0xc3 	Hidden Linux swap
10826>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
10827>0	ubyte	0xc5 	DRDOS/sec (EXT)
10828>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
10829>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
10830>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
10831>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
10832>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
10833>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
10834>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
10835>0	ubyte	0xcd	CTOS Memdump
10836>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
10837>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
10838>0	ubyte	0xd0 	REAL/32 secure big partition
10839>0	ubyte	0xd1 	Old Multiuser DOS FAT12
10840>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
10841>0	ubyte	0xd5 	Old Multiuser DOS Extended
10842>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
10843>0	ubyte	0xd8 	CP/M 86
10844>0	ubyte	0xdb 	CP/M or Concurrent CP/M
10845>0	ubyte	0xdd 	Hidden CTOS Memdump
10846>0	ubyte	0xde 	Dell PowerEdge Server utilities
10847>0	ubyte	0xdf 	DG/UX virtual disk manager
10848>0	ubyte	0xe0 	STMicroelectronics ST AVFS
10849>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
10850>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
10851>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
10852>0	ubyte	0xe5	reserved
10853>0	ubyte	0xe6	reserved
10854>0	ubyte	0xeb 	BeOS
10855>0	ubyte	0xee	GPT Protective MBR
10856>0	ubyte	0xef	EFI system partition
10857>0	ubyte	0xf0 	Linux PA-RISC boot loader
10858>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
10859>0	ubyte	0xf2 	DOS 3.3+ Secondary
10860>0	ubyte	0xf3	reserved
10861>0	ubyte	0xf4	SpeedStor large partition
10862>0	ubyte	0xf5	Prologue multi-volumen partition
10863>0	ubyte	0xf6 	reserved
10864>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
10865>0	ubyte	0xfa 	Bochs x86 emulator
10866>0	ubyte	0xfb 	VMware File System
10867>0	ubyte	0xfc 	VMware Swap
10868>0	ubyte	0xfd 	Linux RAID partition persistent sb
10869>0	ubyte	0xfe	LANstep or IBM PS/2 IML
10870>0	ubyte	0xff 	Xenix Bad Block Table
10871
108720	string	\366\366\366\366	PC formatted floppy with no filesystem
10873# Sun disk labels
10874# From /usr/include/sun/dklabel.h:
108750774	beshort		0xdabe
10876# modified by Joerg Jenderek, because original test
10877# succeeds for Cabinet archive dao360.dl_ with negative blocks
10878>0770	long		>0		Sun disk label
10879>>0	string		x		'%s
10880>>>31	string		>\0		\b%s
10881>>>>63	string		>\0		\b%s
10882>>>>>95	string		>\0		\b%s
10883>>0	string		x		\b'
10884>>0734	short		>0		%d rpm,
10885>>0736	short		>0		%d phys cys,
10886>>0740	short		>0		%d alts/cyl,
10887>>0746	short		>0		%d interleave,
10888>>0750	short		>0		%d data cyls,
10889>>0752	short		>0		%d alt cyls,
10890>>0754	short		>0		%d heads/partition,
10891>>0756	short		>0		%d sectors/track,
10892>>0764	long		>0		start cyl %d,
10893>>0770	long		x		%d blocks
10894# Is there a boot block written 1 sector in?
10895>512    belong&077777777	0600407	\b, boot block present
10896
10897# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
10898# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
108990		string	SBMBAKUP_	Smart Boot Manager backup file
10900>9		string	x		\b, version %-5.5s
10901>>14		string	=_
10902>>>15		string	x		%-.1s
10903>>>>16		string	=_		\b.
10904>>>>>17		string	x		\b%-.1s
10905>>>>>>18	string	=_		\b.
10906>>>>>>>19	string	x		\b%-.1s
10907>>>22		ubyte	0
10908>>>>21		ubyte	x		\b, from drive 0x%x
10909>>>22		ubyte	>0
10910>>>>21		string	x		\b, from drive %s
10911>>>535		search/17	\x55\xAA
10912>>>>&-512	indirect	x	\b; contains
10913
10914# updated by Joerg Jenderek at Nov 2012
10915# DOS Emulator image is 128 byte, null right padded header + harddisc image
109160	string	DOSEMU\0
10917>0x27E	leshort	0xAA55
10918#offset is 128
10919>>19	ubyte	128
10920>>>(19.b-1)	ubyte	0x0	DOS Emulator image
10921>>>>7	ulelong	>0		\b, %u heads
10922>>>>11	ulelong	>0		\b, %d sectors/track
10923>>>>15	ulelong	>0		\b, %d cylinders
10924>>>>128	indirect	x	\b; contains
10925
10926# added by Joerg Jenderek at Nov 2012
10927# http://www.thenakedpc.com/articles/v04/08/0408-05.html
10928# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
109290	string	PNCIHISK\0		Norton Utilities disc image data
10930# real x86 boot sector with jump instruction
10931>509	search/1026	\x55\xAA\xeb
10932>>&-1	indirect	x		\b; contains
10933# http://file-extension.net/seeker/file_extension_dat
109340	string	PNCIUNDO		Norton Disk Doctor UnDo file
10935#
10936
10937# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
10938# for any allowed sector sizes
1093930		search/481	\x55\xAA
10940# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
10941# DOS BPB information (70) and after DOS floppy (120) like in previous file version
10942!:strength +65
10943# for sector sizes < 512 Bytes
10944>11		uleshort	<512
10945>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
10946# for sector sizes with 512 or more Bytes
10947>0x1FE		leshort		0xAA55		DOS/MBR boot sector
10948
10949# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
10950# only for sector sizes with 512 or more Bytes
109510x1FE          leshort         0xAA55         	DOS/MBR boot sector
10952#
10953# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
10954!:strength +65
10955>2		string		OSBS		OS/BS MBR
10956# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/
10957# and https://en.wikipedia.org/wiki/Master_Boot_Record
10958# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
10959# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
10960>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
10961# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
10962# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
10963>>8	ubequad		0x8bf45007501ffbfc
10964# https://thestarman.pcministry.com/asm/mbr/200MBR.htm
10965>>>0x16	ubyte		0xF3				\b,DOS 2
10966>>>>219	regex		Author\ -\ 			Author:
10967# found "David Litton" , "A Pehrsson  "
10968>>>>>&0	string		x				"%s"
10969>>>0x16	ubyte		0xF2
10970# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
10971# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
10972>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
10973# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
10974>>>>0x22	default	x				\b,D0S version 3.3-7.0
10975# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
10976# where nn is string offset varying for different languages
10977# "Invalid partition table"				nn=0x8b for english version
10978>>>>>(0x49.b)	string		Invalid\ partition\ table		english
10979>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
10980>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
10981>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
10982>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
10983>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
10984>>>>>0x49	ubyte		>0			at offset 0x%x
10985>>>>>>(0x49.b)	string		>\0			"%s"
10986# "Error loading operating system"			nn=0xa3 for english version
10987# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
10988# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
10989# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
10990# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
10991# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
10992>>>>>0x74	ubyte		>0			at offset 0x%x
10993>>>>>>(0x74.b)	string		>\0			"%s"
10994# "Missing operating system"				nn=0xc2 for english version
10995# "Betriebssystem fehlt"				nn=0xcd for german version
10996# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
10997# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
10998# "Falta sistema operativo"				nn=0xca for spanish version
10999# "Sistema operativo mancante"				nn=0xe2 for italian version
11000>>>>>0x79	ubyte		>0			at offset 0x%x
11001>>>>>>(0x79.b)	string		>\0			"%s"
11002# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
11003# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
11004>>8	ubequad		0x5007501ffcbe1b7c
11005# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
11006>>>24		ubequad	0xf3a4cbbebe07b104		9M
11007# "Invalid partition table"				nn=0x10F for english version
11008# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
11009# "Table de partition erron\202e"				nn=0x10F for french version
11010# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
11011>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
11012>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
11013>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
11014>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
11015>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
11016>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
11017# "Error loading operating system"			nn=0x127 for english version
11018# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
11019# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
11020# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
11021>>>>0xBD		ubyte	x			at offset 0x1%x
11022>>>>(0xBD.b+0x100)	string	>\0			"%s"
11023# "Missing operating system"				nn=0x146 for english version
11024# "Betriebssystem fehlt"				nn=0x151 for german version
11025# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
11026# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
11027>>>>0xA9		ubyte	x			at offset 0x1%x
11028>>>>(0xA9.b+0x100)	string	>\0			"%s"
11029# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
11030# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
11031>>>24		ubequad	0xf3a4cbbdbe07b104		XP
11032# where xxyyzz are lower bits from offsets of error messages varying for different languages
11033>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
11034>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
11035# "Invalid partition table"				xx=0x12C for english version
11036# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
11037>>>>0x1b5	ubyte		>0			at offset 0x1%x
11038>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11039# "Error loading operating system"			yy=0x144 for english version
11040# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
11041>>>>0x1b6	ubyte		>0			at offset 0x1%x
11042>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11043# "Missing operating system"				zz=0x163 for english version
11044# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
11045>>>>0x1b7	ubyte		>0			at offset 0x1%x
11046>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11047# Microsoft Windows Vista or 7
11048# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
11049>>8	ubequad		0xc08ed8be007cbf00
11050# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
11051# assembler instructions: jnz 0729;cmp ebx,"TCPA"
11052>>>0xEC		ubequad	0x753b6681fb544350		Vista
11053# where xxyyzz are lower bits from offsets of error messages varying for different languages
11054>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
11055#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
11056# "Invalid partition table"				xx=0x162 for english version
11057# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
11058>>>>0x1b5	ubyte		>0			at offset 0x1%x
11059>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11060# "Error loading operating system"			yy=0x17a for english version
11061# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
11062>>>>0x1b6	ubyte		>0			at offset 0x1%x
11063>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11064# "Missing operating system"				zz=0x199 for english version
11065# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
11066>>>>0x1b7	ubyte		>0			at offset 0x1%x
11067>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11068# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
11069# assembler instructions: cmp ebx,"TCPA";cmp
11070>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
11071# where xxyyzz are lower bits from offsets of error messages varying for different languages
11072>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
11073#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
11074# "Invalid partition table"				xx=0x163 for english version
11075# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
11076>>>>0x1b5	ubyte		>0			at offset 0x1%x
11077>>>>(0x1b5.b+0x100)	string	>\0			"%s"
11078# "Error loading operating system"			yy=0x17b for english version
11079# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
11080>>>>0x1b6	ubyte		>0			at offset 0x1%x
11081>>>>(0x1b6.b+0x100)	string	>\0			"%s"
11082# "Missing operating system"				zz=0x19a for english version
11083# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
11084>>>>0x1b7	ubyte		>0			at offset 0x1%x
11085>>>>(0x1b7.b+0x100)	string	>\0			"%s"
11086# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
11087# https://en.wikipedia.org/wiki/MBR_disk_signature#ID
11088>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
11089# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm
11090>>0xDA	uleshort		0
11091>>>0xDC 	ulelong		>0			\b, created
11092# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
11093>>>>0xDC	ubyte		x			with driveID 0x%x
11094# hours, minutes and seconds
11095>>>>0xDf	ubyte		x			at %x
11096>>>>0xDe	ubyte		x			\b:%x
11097>>>>0xDd	ubyte		x			\b:%x
11098# special case for Microsoft MS-DOS 3.21 spanish
11099# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
11100>0	ubequad		0xfab830008ed0bc00
11101# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
11102>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
11103# Microsoft MBR IPL end
11104
11105# dr-dos with some upper-, lowercase variants
11106>0x9D	string	Invalid\ partition\ table$
11107>>181	string	No\ Operating\ System$
11108>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
11109>0x9D	string	Invalid\ partition\ table$
11110>>181	string	No\ operating\ system$
11111>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
11112>342	string	Invalid\ partition\ table$
11113>>366	string	No\ operating\ system$
11114>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
11115>295	string	NEWLDR\0
11116>>302	string	Bad\ PT\ $
11117>>>310	string	No\ OS\ $
11118>>>>317	string	OS\ load\ err$
11119>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
11120>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
11121>>>>>>>387	string	Copyright\ (c)\ 1984,1998
11122>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
11123#
11124# tests for different MS-DOS Master Boot Records (MBR) moved and merged
11125#
11126#>0x145	string	Default:\ F				\b, FREE-DOS MBR
11127#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
11128>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
11129#>>313		string	F0\ .\ .\ .
11130#>>>322		string	disk\ 1
11131#>>>>382	string	FAT3
11132>64	string	no\ active\ partition\ found
11133>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
11134# Ranish Partition Manager http://www.ranish.com/part/
11135>387	search/4	\0\ Error!\r
11136>>378	search/7	Virus!
11137>>>397	search/4	Booting\040
11138>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
11139>>>>>416	string	Writing\ changes...		\b2.37
11140>>>>>>438	ubyte		x			\b,0x%x dots
11141>>>>>>440	ubyte		>0			\b,virus check
11142>>>>>>441	ubyte		>0			\b,partition %c
11143#2.38,2.42,2.44
11144>>>>>416	string	!Writing\ changes...		\b
11145>>>>>>418	ubyte	1				\bvirus check,
11146>>>>>>419	ubyte	x				\b0x%x seconds
11147>>>>>>420	ubyte&0x0F	>0			\b,partition
11148>>>>>>>420	ubyte&0x0F	<5			\b %x
11149>>>>>>>420	ubyte&0x0F	0Xf			\b ask
11150>>>>>420	ubyte		x			\b)
11151#
11152# SYSLINUX MBR moved
11153# https://www.acronis.de/
11154>362	string	MBR\ Error\ \0\r
11155>>376	string	ress\ any\ key\ to\040
11156>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
11157# added by Joerg Jenderek
11158# https://www.visopsys.org/
11159# https://partitionlogic.org.uk/
11160>309	string	No\ bootable\ partition\ found\r
11161>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
11162>349	string	No\ bootable\ partition\ found\r
11163>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
11164# bootloader, bootmanager
11165>0x40	string	SBML
11166# label with 11 characters of FAT 12 bit filesystem
11167>>43	string	SMART\ BTMGR
11168>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
11169# OEM-ID not always "SBM"
11170#>>>>3	strings	SBM
11171>>>>6	string	>\0                             \b, version %s
11172>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
11173>6	string	LILO				\b, LInux i386 boot LOader
11174>>120	string	LILO				\b, version 22.3.4 SuSe
11175>>172	string	LILO				\b, version 22.5.8 Debian
11176# updated by Joerg Jenderek at Oct 2008
11177# variables according to grub-0.97/stage1/stage1.S or
11178# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
11179# usual values are marked with comments to get only informations of strange GRUB loaders
11180>342		search/60	\0Geom\0
11181#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
11182>>0x41		ubyte		<2
11183>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
11184# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
11185>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
11186#If it is 0xFF, use a drive passed by BIOS
11187>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
11188# in most case 0,1,0x2e for GRUB 0.5.95
11189>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
11190>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
11191#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
11192>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
11193#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
11194>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
11195>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
11196#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
11197>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
11198>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11199>>>>>394	string	stage1			\b, GRUB version 0.5.95
11200>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11201>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
11202>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11203>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
11204>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11205>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
11206>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11207>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
11208# unknown version
11209>>>343		string	Geom\0Read\0\ Error\0
11210>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
11211>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
11212>>>>374		string	GRUB\ \0		\b, GRUB version n.m
11213# SYSLINUX bootloader moved
11214>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
11215# http://www.bcdwb.de/bcdw/index_e.htm
11216>3	string	BCDL
11217>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
11218# mbr partition table entries updated by Joerg Jenderek at Sep 2013
11219# skip Norton Utilities disc image data
11220>3		string		!IHISK
11221# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
11222>>0		belong		!0xb8c0078e
11223# not Linux kernel
11224>>>514		string		!HdrS
11225# not BeOS
11226>>>>422		string		!Be\ Boot\ Loader
11227# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
11228>>>>>0		ubelong&0xFD000000	=0xE9000000
11229# AdvanceMAME mbr
11230>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
11231>>>>>>>446	use		partition-table
11232# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
11233>>>>>0		ubelong&0xFD000000	!0xE9000000
11234# skip FSInfosector
11235>>>>>>0		string		!RRaA
11236# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
11237# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
11238>>>>>>>0	ubequad		!0xfa660fb64610668b
11239# skip 13rd sector of MS x86 bootloader
11240>>>>>>>>0	ubequad		!0x660fb64610668b4e
11241# skip sector starting with DOS new line
11242>>>>>>>>>0	string		!\r\n
11243# allowed active flag 0,80h-FFh
11244>>>>>>>>>>446	ubyte		0
11245>>>>>>>>>>>446	use		partition-table
11246>>>>>>>>>>446	ubyte		>0x7F
11247>>>>>>>>>>>446	use		partition-table
11248# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
11249# mbr partition table entries end
11250# https://www.acronis.de/
11251#FAT label=ACRONIS\ SZ
11252#OEM-ID=BOOTWIZ0
11253>442	string	Non-system\ disk,\040
11254>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
11255# updated by Joerg Jenderek at Nov 2012, Sep 2013
11256# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
11257# display 1 space
11258>>>447	ubyte	x		\b
11259>>>477	use	DOS-filename
11260#
11261>185	string	FDBOOT\ Version\040
11262>>204	string	\rNo\ Systemdisk.\040
11263>>>220	string	Booting\ from\ harddisk.\n\r
11264>>>245	string	Cannot\ load\ from\ harddisk.\n\r
11265>>>>273 string	Insert\ Systemdisk\040
11266>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
11267>>>>>>200 string	>\0                             \b, version %-3s
11268>242	string	Bootsector\ from\ C.H.\ Hochst\204
11269# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
11270# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
11271# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
11272>242	search/127	Bootsector\ from\ C.H.\ Hochst
11273>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
11274# followed by variants with point,CR-NL or NL-CR
11275>>>208	search/261	Cannot\ load\ from\ harddisk.
11276# followed by variants CR-NL or NL-CR
11277>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
11278# followed by variants with point,CR-NL or NL-CR
11279>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
11280# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
11281>>>>>>&0	string		x 					\b, version %-4.4s
11282>(1.b+2)	ubyte		0xe
11283>>(1.b+3)	ubyte		0x1f
11284>>>(1.b+4)	ubyte		0xbe
11285# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
11286>>>>(1.b+5)	ubyte&0xd3	0x53
11287>>>>>(1.b+6)	ubyte		0x7c
11288# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
11289>>>>>>(1.b+7)	ubyte		0xac
11290>>>>>>>(1.b+8)	ubyte		0x22
11291>>>>>>>>(1.b+9)	ubyte		0xc0
11292>>>>>>>>>(1.b+10)	ubyte	0x74
11293>>>>>>>>>>(1.b+11)	ubyte	0x0b
11294>>>>>>>>>>>(1.b+12)	ubyte	0x56
11295>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
11296# FAT1X version
11297>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
11298>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
11299# FAT32 version
11300>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
11301>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
11302>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
11303#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
11304#>>>170	string	Sorry,\ could\ not\ load\ an\040
11305#>>>>195	string	operating\ system.\r\n
11306#
11307>103	string	This\ is\ not\ a\ bootable\ disk.\040
11308>>132	string	Please\ insert\ a\ bootable\040
11309>>>157	string	floppy\ and\r\n
11310>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
11311#
11312>66	string	Solaris\ Boot\ Sector
11313>>99	string	Incomplete\ MDBoot\ load.
11314>>>89	string	Version 				\b, Sun Solaris Bootloader
11315>>>>97	byte	x					version %c
11316#
11317>408	string	OS/2\ !!\ SYS01475\r\0
11318>>429	string	OS/2\ !!\ SYS02025\r\0
11319>>>450	string	OS/2\ !!\ SYS02027\r\0
11320>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
11321#
11322>409	string	OS/2\ !!\ SYS01475\r\0
11323>>430	string	OS/2\ !!\ SYS02025\r\0
11324>>>451	string	OS/2\ !!\ SYS02027\r\0
11325>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
11326>112		string	This\ disk\ is\ not\ bootable\r
11327>>142		string	If\ you\ wish\ to\ make\ it\ bootable
11328>>>176		string	run\ the\ DOS\ program\ SYS\040
11329>>>200		string	after\ the\r
11330>>>>216		string	system\ has\ been\ loaded\r\n
11331>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
11332>>>>>271	string	into\r\n\ the\ drive\ and\040
11333>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
11334# XP
11335>430	string	NTLDR\ is\ missing\xFF\r\n
11336>>449	string	Disk\ error\xFF\r\n
11337>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
11338# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
11339>>>>417		ubyte&0xDF	>0
11340>>>>>417	string		x			%-.5s
11341>>>>>>422	ubyte&0xDF	>0
11342>>>>>>>422	string		x 			\b%-.3s
11343>>>>>425	ubyte&0xDF	>0
11344>>>>>>425	string		>\ 			\b.%-.3s
11345#
11346>>>>371		ubyte		>0x20
11347>>>>>368	ubyte&0xDF	>0
11348>>>>>>368	string		x 			%-.5s
11349>>>>>>>373	ubyte&0xDF	>0
11350>>>>>>>>373	string		x 			\b%-.3s
11351>>>>>>376	ubyte&0xDF	>0
11352>>>>>>>376	string		x 			\b.%-.3s
11353#
11354>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
11355>>453	string	Datentr\204gerfehler\xFF\r\n
11356>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
11357>>>>417		ubyte&0xDF	>0
11358>>>>>417	string		x			%-.5s
11359>>>>>>422	ubyte&0xDF	>0
11360>>>>>>>422	string		x 			\b%-.3s
11361>>>>>425	ubyte&0xDF	>0
11362>>>>>>425	string		>\ 			\b.%-.3s
11363# offset variant
11364>>>>379	string	\0
11365>>>>>368	ubyte&0xDF	>0
11366>>>>>>368	string		x 			%-.5s
11367>>>>>>>373	ubyte&0xDF	>0
11368>>>>>>>>373	string		x 			\b%-.3s
11369#
11370>430	string	NTLDR\ fehlt\xFF\r\n
11371>>444	string	Datentr\204gerfehler\xFF\r\n
11372>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
11373>>>>417		ubyte&0xDF	>0
11374>>>>>417	string		x			%-.5s
11375>>>>>>422	ubyte&0xDF	>0
11376>>>>>>>422	string		x 			\b%-.3s
11377>>>>>425	ubyte&0xDF	>0
11378>>>>>>425	string		>\ 			\b.%-.3s
11379# variant
11380>>>>371		ubyte		>0x20
11381>>>>>368	ubyte&0xDF	>0
11382>>>>>>368	string		x 			%-.5s
11383>>>>>>>373	ubyte&0xDF	>0
11384>>>>>>>>373	string		x 			\b%-.3s
11385>>>>>>376	ubyte&0xDF	>0
11386>>>>>>>376	string		x 			\b.%-.3s
11387#
11388>430	string	NTLDR\ fehlt\xFF\r\n
11389>>444	string	Medienfehler\xFF\r\n
11390>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
11391>>>>371		ubyte		>0x20
11392>>>>>368	ubyte&0xDF	>0
11393>>>>>>368	string		x 			%-.5s
11394>>>>>>>373	ubyte&0xDF	>0
11395>>>>>>>>373	string		x 			\b%-.3s
11396>>>>>>376	ubyte&0xDF	>0
11397>>>>>>>376	string		x 			\b.%-.3s
11398# variant
11399>>>>417		ubyte&0xDF	>0
11400>>>>>417	string		x			%-.5s
11401>>>>>>422	ubyte&0xDF	>0
11402>>>>>>>422	string		x 			\b%-.3s
11403>>>>>425	ubyte&0xDF	>0
11404>>>>>>425	string		>\ 			\b.%-.3s
11405#
11406>430	string	Datentr\204ger\ entfernen\xFF\r\n
11407>>454	string	Medienfehler\xFF\r\n
11408>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
11409>>>>379		string		\0
11410>>>>>368	ubyte&0xDF	>0
11411>>>>>>368	string		x 			%-.5s
11412>>>>>>>373	ubyte&0xDF	>0
11413>>>>>>>>373	string		x 			\b%-.3s
11414>>>>>>376	ubyte&0xDF	>0
11415>>>>>>>376	string		x 			\b.%-.3s
11416# variant
11417>>>>417		ubyte&0xDF	>0
11418>>>>>417	string		x			%-.5s
11419>>>>>>422	ubyte&0xDF	>0
11420>>>>>>>422	string		x 			\b%-.3s
11421>>>>>425	ubyte&0xDF	>0
11422>>>>>>425	string		>\ 			\b.%-.3s
11423#
11424
11425#>3	string	NTFS\ \ \ \040
11426>389	string	Fehler\ beim\ Lesen\040
11427>>407	string	des\ Datentr\204gers
11428>>>426	string	NTLDR\ fehlt
11429>>>>440	string	NTLDR\ ist\ komprimiert
11430>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
11431#>3	string	NTFS\ \ \ \040
11432>313	string	A\ disk\ read\ error\ occurred.\r
11433>>345	string	A\ kernel\ file\ is\ missing\040
11434>>>370	string	from\ the\ disk.\r
11435>>>>484	string	NTLDR\ is\ compressed
11436>>>>>429 string	Insert\ a\ system\ diskette\040
11437>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
11438# DOS loader variants different languages,offsets
11439>472	ubyte&0xDF	>0
11440>>389	string	Invalid\ system\ disk\xFF\r\n
11441>>>411	string	Disk\ I/O\ error
11442>>>>428	string	Replace\ the\ disk,\ and\040
11443>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
11444#IO.SYS
11445>>>>>>472	ubyte&0xDF	>0
11446>>>>>>>472	string		x 			\b %-.2s
11447>>>>>>>>474	ubyte&0xDF	>0
11448>>>>>>>>>474	string		x 			\b%-.5s
11449>>>>>>>>>>479	ubyte&0xDF	>0
11450>>>>>>>>>>>479 string		x 			\b%-.1s
11451>>>>>>>480	ubyte&0xDF	>0
11452>>>>>>>>480	string		x 			\b.%-.3s
11453#MSDOS.SYS
11454>>>>>>>483	ubyte&0xDF	>0			\b+
11455>>>>>>>>483	string		x 			\b%-.5s
11456>>>>>>>>>488	ubyte&0xDF	>0
11457>>>>>>>>>>488	string		x 			\b%-.3s
11458>>>>>>>>491	ubyte&0xDF	>0
11459>>>>>>>>>491	string		x 			\b.%-.3s
11460#
11461>>390	string	Invalid\ system\ disk\xFF\r\n
11462>>>412	string	Disk\ I/O\ error\xFF\r\n
11463>>>>429	string	Replace\ the\ disk,\ and\040
11464>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
11465>>388	string	Ungueltiges\ System\ \xFF\r\n
11466>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
11467>>>>427	string	Datentraeger\ wechseln\ und\040
11468>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
11469#WINBOOT.SYS only not spaces (0xDF)
11470>>>>>>497	ubyte&0xDF	>0
11471>>>>>>>497	string		x 			%-.5s
11472>>>>>>>>502	ubyte&0xDF	>0
11473>>>>>>>>>502	string		x 			\b%-.1s
11474>>>>>>>>>>503	ubyte&0xDF	>0
11475>>>>>>>>>>>503	string		x 			\b%-.1s
11476>>>>>>>>>>>>504	ubyte&0xDF	>0
11477>>>>>>>>>>>>>504 string		x 			\b%-.1s
11478>>>>>>505	ubyte&0xDF	>0
11479>>>>>>>505	string		x 			\b.%-.3s
11480#IO.SYS
11481>>>>>>472	ubyte&0xDF	>0			or
11482>>>>>>>472	string		x 			\b %-.2s
11483>>>>>>>>474	ubyte&0xDF	>0
11484>>>>>>>>>474	string		x 			\b%-.5s
11485>>>>>>>>>>479	ubyte&0xDF	>0
11486>>>>>>>>>>>479 string		x 			\b%-.1s
11487>>>>>>>480	ubyte&0xDF	>0
11488>>>>>>>>480	string		x 			\b.%-.3s
11489#MSDOS.SYS
11490>>>>>>>483	ubyte&0xDF	>0			\b+
11491>>>>>>>>483	string		x 			\b%-.5s
11492>>>>>>>>>488	ubyte&0xDF	>0
11493>>>>>>>>>>488	string		x 			\b%-.3s
11494>>>>>>>>491	ubyte&0xDF	>0
11495>>>>>>>>>491	string		x 			\b.%-.3s
11496#
11497>>390	string	Ungueltiges\ System\ \xFF\r\n
11498>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
11499>>>>429	string	Datentraeger\ wechseln\ und\040
11500>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
11501#WINBOOT.SYS only not spaces (0xDF)
11502>>>>>>497	ubyte&0xDF	>0
11503>>>>>>>497	string		x 			%-.7s
11504>>>>>>>>504	ubyte&0xDF	>0
11505>>>>>>>>>504	string		x 			\b%-.1s
11506>>>>>>505	ubyte&0xDF	>0
11507>>>>>>>505	string		x 			\b.%-.3s
11508#IO.SYS
11509>>>>>>472	ubyte&0xDF	>0			or
11510>>>>>>>472	string		x 			\b %-.2s
11511>>>>>>>>474	ubyte&0xDF	>0
11512>>>>>>>>>474	string		x 			\b%-.6s
11513>>>>>>>480	ubyte&0xDF	>0
11514>>>>>>>>480	string		x 			\b.%-.3s
11515#MSDOS.SYS
11516>>>>>>>483	ubyte&0xDF	>0			\b+
11517>>>>>>>>483	string		x 			\b%-.5s
11518>>>>>>>>>488	ubyte&0xDF	>0
11519>>>>>>>>>>488	string		x 			\b%-.3s
11520>>>>>>>>491	ubyte&0xDF	>0
11521>>>>>>>>>491	string		x 			\b.%-.3s
11522#
11523>>389	string	Ungueltiges\ System\ \xFF\r\n
11524>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
11525>>>>428	string	Datentraeger\ wechseln\ und\040
11526>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
11527# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
11528>>>>>>472	string		x 			%-.2s
11529>>>>>>>474	ubyte&0xDF	>0
11530>>>>>>>>474	string		x 			\b%-.5s
11531>>>>>>>>479	ubyte&0xDF	>0
11532>>>>>>>>>479	string		x 			\b%-.1s
11533>>>>>>480	ubyte&0xDF	>0
11534>>>>>>>480	string		x 			\b.%-.3s
11535>>>>>>483	ubyte&0xDF	>0			\b+
11536>>>>>>>483	string		x 			\b%-.5s
11537>>>>>>>488	ubyte&0xDF	>0
11538>>>>>>>>488	string		x 			\b%-.2s
11539>>>>>>>>490	ubyte&0xDF	>0
11540>>>>>>>>>490	string		x 			\b%-.1s
11541>>>>>>>491	ubyte&0xDF	>0
11542>>>>>>>>491	string		x 			\b.%-.3s
11543>479	ubyte&0xDF	>0
11544>>416	string	Kein\ System\ oder\040
11545>>>433	string	Laufwerksfehler
11546>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
11547#IO.SYS
11548>>>>>479	string		x 			\b %-.2s
11549>>>>>>481	ubyte&0xDF	>0
11550>>>>>>>481	string		x 			\b%-.6s
11551>>>>>487	ubyte&0xDF	>0
11552>>>>>>487	string		x 			\b.%-.3s
11553#MSDOS.SYS
11554>>>>>>490	ubyte&0xDF	>0			\b+
11555>>>>>>>490	string		x 			\b%-.5s
11556>>>>>>>>495	ubyte&0xDF	>0
11557>>>>>>>>>495	string		x 			\b%-.3s
11558>>>>>>>498	ubyte&0xDF	>0
11559>>>>>>>>498	string		x 			\b.%-.3s
11560#
11561>376	search/41	Non-System\ disk\ or\040
11562>>395	search/41	disk\ error\r
11563>>>407	search/41	Replace\ and\040
11564>>>>419	search/41	press\ 				\b,
11565>>>>419	search/41	strike\ 			\b, old
11566>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
11567#449			Disk\ Boot\ failure\r		MS 3.21
11568#466			Boot\ Failure\r			MS 3.30
11569>>>>>468 search/18	\0
11570#IO.SYS,IBMBIO.COM
11571>>>>>>&0	string		x 			\b %-.2s
11572>>>>>>>&-20	ubyte&0xDF	>0
11573>>>>>>>>&-1	string		x 			\b%-.4s
11574>>>>>>>>>&-16	ubyte&0xDF	>0
11575>>>>>>>>>>&-1	string		x 			\b%-.2s
11576>>>>>>&8	ubyte&0xDF	>0			\b.
11577>>>>>>>&-1	string		x 			\b%-.3s
11578#MSDOS.SYS,IBMDOS.COM
11579>>>>>>&11	ubyte&0xDF	>0			\b+
11580>>>>>>>&-1	string		x 			\b%-.5s
11581>>>>>>>>&-6	ubyte&0xDF	>0
11582>>>>>>>>>&-1	string		x 			\b%-.1s
11583>>>>>>>>>>&-5	ubyte&0xDF	>0
11584>>>>>>>>>>>&-1	string		x 			\b%-.2s
11585>>>>>>>&7	ubyte&0xDF	>0			\b.
11586>>>>>>>>&-1	string		x 			\b%-.3s
11587>441	string	Cannot\ load\ from\ harddisk.\n\r
11588>>469	string	Insert\ Systemdisk\040
11589>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
11590#>43	string	\224R-LOADER\ \ SYS			=label
11591>54	string	SYS
11592>>324	string	VASKK
11593>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
11594#
11595>98	string	Press\ a\ key\ to\ retry\0\r
11596>>120	string	Cannot\ find\ file\ \0\r
11597>>>139	string	Disk\ read\ error\0\r
11598>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
11599#DRBIOS.SYS
11600>>>>>44		ubyte&0xDF	>0
11601>>>>>>44	string		x			\b %-.6s
11602>>>>>>>50	ubyte&0xDF	>0
11603>>>>>>>>50	string		x 			\b%-.2s
11604>>>>>>52	ubyte&0xDF	>0
11605>>>>>>>52	string		x 			\b.%-.3s
11606#
11607>70	string	IBMBIO\ \ COM
11608>>472	string	Cannot\ load\ DOS!\040
11609>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
11610>>471	string	Cannot\ load\ DOS\040
11611>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
11612#??
11613>444	string	KERNEL\ \ SYS
11614>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
11615>499	string	KERNEL\ \ SYS
11616>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
11617>449	string	KERNEL\ \ SYS
11618>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
11619#
11620>449	string	Loading\ FreeDOS
11621>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
11622>>>497		ubyte&0xDF	>0
11623>>>>497		string		x 			\b %-.6s
11624>>>>>503	ubyte&0xDF	>0
11625>>>>>>503	string		x 			\b%-.1s
11626>>>>>>>504	ubyte&0xDF	>0
11627>>>>>>>>504	string		x 			\b%-.1s
11628>>>>505		ubyte&0xDF	>0
11629>>>>>505	string		x 			\b.%-.3s
11630#
11631>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
11632#
11633>125	string	Loading\ FreeDOS...\r
11634>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
11635>>>441		ubyte&0xDF	>0
11636>>>>441		string		x 			\b %-.6s
11637>>>>>447	ubyte&0xDF	>0
11638>>>>>>447	string		x 			\b%-.1s
11639>>>>>>>448	ubyte&0xDF	>0
11640>>>>>>>>448	string		x 			\b%-.1s
11641>>>>449		ubyte&0xDF	>0
11642>>>>>449	string		x 			\b.%-.3s
11643>124	string	FreeDOS\0
11644>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
11645# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
11646>>>497		ubyte&0xDF	>0
11647>>>>497		string		x 			\b %-.6s
11648>>>>>503	ubyte&0xDF	>0
11649>>>>>>503	string		x 			\b%-.1s
11650>>>>>>>504	ubyte&0xDF	>0
11651>>>>>>>>504	string		x 			\b%-.1s
11652>>>>505		ubyte&0xDF	>0
11653>>>>>505	string		x 			\b.%-.3s
11654>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
11655>>>497		ubyte&0xDF	>0
11656>>>>497		string		x 			\b %-.6s
11657>>>>>503	ubyte&0xDF	>0
11658>>>>>>503	string		x 			\b%-.1s
11659>>>>>>>504	ubyte&0xDF	>0
11660>>>>>>>>504	string		x 			\b%-.1s
11661>>>>505		ubyte&0xDF	>0
11662>>>>>505	string		x 			\b.%-.3s
11663>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
11664>>>497		ubyte&0xDF	>0
11665>>>>497		string		x 			\b %-.6s
11666>>>>>503	ubyte&0xDF	>0
11667>>>>>>503	string		x 			\b%-.1s
11668>>>>>>>504	ubyte&0xDF	>0
11669>>>>>>>>504	string		x 			\b%-.1s
11670>>>>505		ubyte&0xDF	>0
11671>>>>>505	string		x 			\b.%-.3s
11672>336	string	Error!\040
11673>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
11674>>>497		ubyte&0xDF	>0
11675>>>>497		string		x 			\b %-.6s
11676>>>>>503	ubyte&0xDF	>0
11677>>>>>>503	string		x 			\b%-.1s
11678>>>>>>>504	ubyte&0xDF	>0
11679>>>>>>>>504	string		x 			\b%-.1s
11680>>>>505		ubyte&0xDF	>0
11681>>>>>505	string		x 			\b.%-.3s
11682# added by Joerg Jenderek
11683# https://www.visopsys.org/
11684# https://partitionlogic.org.uk/
11685# OEM-ID=Visopsys
11686>478		ulelong	0
11687>>(1.b+326)	string	I/O\ Error\ reading\040
11688>>>(1.b+344)	string	Visopsys\ loader\r
11689>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
11690# http://alexfru.chat.ru/epm.html#bootprog
11691>494	ubyte	>0x4D
11692>>495	string	>E
11693>>>495	string	<S
11694#OEM-ID is not reliable
11695>>>>3	string	BootProg
11696# It just looks for a program file name at the root directory
11697# and loads corresponding file with following execution.
11698# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
11699>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
11700>>>>>499		use		DOS-filename
11701#If the boot sector fails to read any other sector,
11702#it prints a very short message ("RE") to the screen and hangs the computer.
11703#If the boot sector fails to find needed program in the root directory,
11704#it also hangs with another message ("NF").
11705>>>>>492		string		RENF		\b, FAT (12 bit)
11706>>>>>495		string		RENF		\b, FAT (16 bit)
11707#If the boot sector fails to read any other sector,
11708#it prints a very short message ("RE") to the screen and hangs the computer.
11709# x86 bootloader end
11710
11711# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
11712# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
11713>0		string		RRaA
11714>>0x1E4		string		rrAa		\b, FSInfosector
11715#>>0x1FC	uleshort	=0		SHOULD BE ZERO
11716>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
11717>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
11718
11719# updated by Joerg Jenderek at Sep 2007
11720>3	ubyte	0
11721#no active flag
11722>>446	ubyte	0
11723# partition 1 not empty
11724>>>450	ubyte	>0
11725# partitions 3,4 empty
11726>>>>482		ubyte	0
11727>>>>>498	ubyte	0
11728# partition 2 ID=0,5,15
11729>>>>>>466	ubyte	<0x10
11730>>>>>>>466	ubyte	0x05			\b, extended partition table
11731>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
11732>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
11733
11734# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
11735
11736>0x200	lelong	0x82564557		\b, BSD disklabel
11737
11738# by Joerg Jenderek at Apr 2013
11739#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
11740#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
117410	name			DOS-filename
11742# space=0x20 (00100000b) means empty
11743>0			ubyte&0xDF	>0
11744>>0			ubyte		x 		\b%c
11745>>>1			ubyte&0xDF	>0
11746>>>>1			ubyte		x 		\b%c
11747>>>>>2			ubyte&0xDF	>0
11748>>>>>>2			ubyte		x 		\b%c
11749>>>>>>>3		ubyte&0xDF	>0
11750>>>>>>>>3		ubyte		x 		\b%c
11751>>>>>>>>>4		ubyte&0xDF	>0
11752>>>>>>>>>>4		ubyte		x 		\b%c
11753>>>>>>>>>>>5		ubyte&0xDF	>0
11754>>>>>>>>>>>>5		ubyte		x 		\b%c
11755>>>>>>>>>>>>>6		ubyte&0xDF	>0
11756>>>>>>>>>>>>>>6		ubyte		x 		\b%c
11757>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
11758>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
11759# DOS filename extension
11760>>8			ubyte&0xDF	>0		\b.
11761>>>8			ubyte		x 		\b%c
11762>>>>9			ubyte&0xDF	>0
11763>>>>>9			ubyte		x 		\b%c
11764>>>>>>10		ubyte&0xDF	>0
11765>>>>>>>10		ubyte		x 		\b%c
11766#	Print 2 following DOS filenames from directory entry form
11767#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
117680	name			2xDOS-filename
11769# display 1 space
11770>0			ubyte		x		\b
11771>0			use		DOS-filename
11772>11			ubyte		x		\b+
11773>11			use		DOS-filename
11774
11775# https://en.wikipedia.org/wiki/Master_boot_record#PTE
11776# display standard partition table
117770	name				partition-table
11778#>0		ubyte		x	PARTITION-TABLE
11779# test and display 1st til 4th partition table entry
11780>0		use			partition-entry-test
11781>16		use			partition-entry-test
11782>32		use			partition-entry-test
11783>48		use			partition-entry-test
11784#		test for entry of partition table
117850	name				partition-entry-test
11786# partition type ID > 0
11787>4		ubyte		>0
11788# active flag 0
11789>>0		ubyte		0
11790>>>0		use		partition-entry
11791# active flag 0x80, 0x81, ...
11792>>0		ubyte		>0x7F
11793>>>0		use		partition-entry
11794#		Print entry of partition table
117950	name				partition-entry
11796# partition type ID > 0
11797>4		ubyte		>0	\b; partition
11798>>64		leshort		0xAA55	1
11799>>48		leshort		0xAA55	2
11800>>32		leshort		0xAA55	3
11801>>16		leshort		0xAA55	4
11802>>4		ubyte		x	: ID=0x%x
11803>>0		ubyte&0x80	0x80	\b, active
11804>>0		ubyte		>0x80	0x%x
11805>>1		ubyte		x	\b, start-CHS (
11806>>1		use		partition-chs
11807>>5		ubyte		x	\b), end-CHS (
11808>>5		use		partition-chs
11809>>8		ulelong		x	\b), startsector %u
11810>>12		ulelong		x	\b, %u sectors
11811#		Print cylinder,head,sector (CHS) of partition entry
118120	name				partition-chs
11813# cylinder
11814>1		ubyte		x	\b0x
11815>1		ubyte&0xC0	0x40	\b1
11816>1		ubyte&0xC0	0x80	\b2
11817>1		ubyte&0xC0	0xC0	\b3
11818>2		ubyte		x	\b%x
11819# head
11820>0		ubyte		x	\b,%u
11821# sector
11822>1		ubyte&0x3F	x	\b,%u
11823
11824# FATX
118250		string		FATX		FATX filesystem data
11826
11827# romfs filesystems - Juan Cespedes <cespedes@debian.org>
118280	string		-rom1fs-	romfs filesystem, version 1
11829>8	belong	x			%d bytes,
11830>16	string	x			named %s.
11831
11832# netboot image - Juan Cespedes <cespedes@debian.org>
118330	lelong		0x1b031336L	Netboot image,
11834>4	lelong&0xFFFFFF00	0
11835>>4	lelong&0x100	0x000		mode 2
11836>>4	lelong&0x100	0x100		mode 3
11837>4	lelong&0xFFFFFF00	!0	unknown mode
11838
118390x18b	string	OS/2	OS/2 Boot Manager
11840
11841# updated by Joerg Jenderek at Oct 2008 and Sep 2012
11842# https://syslinux.zytor.com/iso.php
11843# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
11844# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
118450	ulequad&0x909000007cc0eafa	0x909000007c40eafa
11846>631	search/689	ISOLINUX\ 	isolinux Loader
11847>>&0	string		x		(version %-4.4s)
11848# https://syslinux.zytor.com/pxe.php
11849# assembler instructions: jmp 7C05
118500	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
11851# assembler instructions: pushfd;pushad
118520	ulelong	0x60669c66		pxelinux loader
11853# assembler instructions: jmp 05
118540	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
11855# https://syslinux.zytor.com/wiki/index.php/SYSLINUX
118560	string	LDLINUX\ SYS\ 		SYSLINUX loader
11857>12	string	x			(older version %-4.4s)
118580	string	\r\nSYSLINUX\ 		SYSLINUX loader
11859>11	string	x			(version %-4.4s)
11860# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
11861# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
118620	ulelong&0x80909bEB	0x009018EB
11863# OEM-ID not always "SYSLINUX"
11864>434	search/47	Boot\ failed
11865# followed by \r\n\0 or :\
11866>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
11867>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
11868>459	search/30	Boot\ error\r\n\0
11869>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
11870# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
11871# assembler instructions: mov di,0600h;mov cx,0100h
1187216	search/4	\xbf\x00\x06\xb9\x00\x01
11873# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
11874!:strength +36
11875>94	search/249	Missing\ operating\ system
11876# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
11877# skip Ranish MBR
11878>>408	search/4	HD1/\0
11879>>408	default		x
11880>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
11881# followed by "ing " or space
11882>>>>292	search/98	error
11883>>>>>&0	string		\r		    			(version 3.35 or older)
11884>>>>>&0	string		.\r					(version 3.52 or newer)
11885>>>>>&0	default		x					(version 3.36-3.51 )
11886>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
11887>>156	search/10	\0Boot\ partition\ not\ found\r\n
11888>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
11889>>174	search/10	\0Missing\ OS\r\n
11890>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
11891# SYSLINUX END
11892
11893# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
11894# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
118950	ubequad		0x31c08ed0bc007c8e
11896# mbr_bootsel magic before partition table not reliable with small ipl fragments
11897#>444	uleshort	0xb5e1
11898>0004	uleshort	x
11899# ERRorTeXT
11900>>181	search/166		Error\ \0\r\n				NetBSD mbr
11901# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
11902>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
11903# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
11904>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
11905# BOOT_EXTENDED definitions contains assembler instructions:
11906# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
11907>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
11908# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
11909>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
11910# not TERSE_ERROR
11911>>>196		search/106	No\ active\ partition\0
11912>>>>&0		string		Disk\ read\ error\0
11913>>>>>&0		string		No\ operating\ system\0			\b,verbose
11914# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
11915>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
11916# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
11917>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
11918# assembler instructions: movw nametab,bx
11919>>>0x26	    search/21	\xBB\x94\x07
11920# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
11921>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
11922>>>>>181	search/166		Error\ \0
11923# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
11924>>>>>>&3	string			x				\b,"%s"
11925>>>446	use		partition-table
11926# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
11927# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
11928# assembler instructions: jmp short 0x58;nop;ASCII
119290	ubequad&0xeb58908000000000	0xeb58900000000000
11930# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
11931>(1.b+2)	ubequad			0xfa31c08ed88ec08e
11932# Error messages at end of code
11933>>376		string	No\ operating\ system\r\n\0
11934>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
11935>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
11936
11937# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/
11938# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
11939# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
11940# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
119410	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
11942# pointer to the data starting with Neil Turton signature string
11943>(0x1BC.s)		string		NDTmbr
11944>>&-14			string		1234F\0			Turton mbr (
11945# parameters also viewed by install-mbr --list
11946>>>(0x1BC.s+7)		ubyte		x			\b%u<=
11947>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
11948#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
11949>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
11950# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode
11951>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
11952#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
11953#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
11954#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
11955#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
11956# for older versions
11957>>>(0x1BC.s+9)		ubyte		<2
11958#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
11959>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
11960# floppy A: or B:
11961>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
11962>>>>(0x1BC.s+13)	ubyte		>1
11963# 1st hard disc
11964#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
11965# not 1st hard disc
11966>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
11967# for version >= 2 maximal timeout can be 65534
11968>>>(0x1BC.s+9)		ubyte		>1
11969#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
11970>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
11971# floppy A: or B:
11972>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
11973>>>>(0x1BC.s+14)	ubyte		>1
11974# 1st hard disc
11975#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
11976# not 1st hard disc
11977>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
11978>>>0	ubyte		x					\b)
11979
11980# added by Joerg Jenderek
11981# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
11982# grub-1.94/kern/i386/pc/startup.S
11983# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
11984# usual values are marked with comments to get only informations of strange GRUB loaders
119850x200	uleshort		0x70EA
11986# found only version 3.{1,2}
11987>0x206		ubeshort	>0x0300
11988# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
11989>>0x212 	ubyte		>0x29
11990>>>0x213 	ubyte		>0x29
11991# not iso9660_stage1_5
11992#>>>0	ulelong&0x00BE5652	0x00BE5652
11993>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
11994# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
11995>>>>0x217 	ubyte		0xFF		stage1_5
11996>>>>0x217 	ubyte		<0xFF		stage2
11997>>>>0x206	ubyte		x		\b version %u
11998>>>>0x207	ubyte		x		\b.%u
11999# module_size for 1.94
12000>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
12001#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
12002>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
12003# GRUB 0.5.95 unofficial
12004>>>>0x20C	ulelong&0x2E300000 0x2E300000
12005# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
12006>>>>>0x20C	ubyte		x		\b, identifier 0x%x
12007#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
12008>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
12009# GRUB version as string
12010>>>>>0x20E 	string		>\0		\b, GRUB version %-s
12011# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
12012>>>>>>0x215 	ulong		0xffffffff
12013>>>>>>>0x219 	string		>\0		\b, configuration file %-s
12014>>>>>>0x215 	ulong		!0xffffffff
12015>>>>>>>0x215 	string		>\0		\b, configuration file %-s
12016# newer GRUB versions
12017>>>>0x20C	ulelong&0x2E300000 !0x2E300000
12018##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
12019>>>>>0x20C	ulelong		>0		\b, saved entry %d
12020# for 1.94 contains kernel image size
12021# for 0.93,0.94,0.96,0.97
12022# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
12023>>>>>0x210	ubyte		x		\b, identifier 0x%x
12024# The flag for LBA forcing is in most cases 0
12025#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
12026>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
12027# GRUB version as string
12028>>>>>0x212 	string		>\0		\b, GRUB version %-s
12029# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
12030>>>>>0x217 	ulong		0xffffffff
12031>>>>>>0x21b 	string		>\0		\b, configuration file %-s
12032>>>>>0x217 	ulong		!0xffffffff
12033>>>>>>0x217 	string		>\0		\b, configuration file %-s
12034
12035# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
12036# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
12037# over BIOS parameter block (BPB)
12038# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
12039# older drives may use Near JuMP instruction E9 xx xx
12040# minimal short forward jump found 0x29 for bootloaders or 0x0
12041# maximal short forward jump is 0x7f
12042# OEM-ID is empty or contain readable bytes
120430		ulelong&0x804000E9	0x000000E9
12044!:strength	+60
12045# mtools-3.9.8/msdos.h
12046# usual values are marked with comments to get only informations of strange FAT systems
12047# valid sectorsize must be a power of 2 from 32 to 32768
12048>11		uleshort&0x001f	0
12049>>11		uleshort	<32769
12050>>>11		uleshort	>31
12051>>>>21		ubyte&0xf0	0xF0
12052>>>>>0		ubyte		0xEB		DOS/MBR boot sector
12053>>>>>>1		ubyte		x		\b, code offset 0x%x+2
12054>>>>>0		ubyte		0xE9
12055>>>>>>1		uleshort	x		\b, code offset 0x%x+3
12056>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
12057#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
12058>>>>>>8		string		IHC		\b cached by Windows 9M
12059>>>>>11		uleshort	>512		\b, Bytes/sector %u
12060#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
12061>>>>>11		uleshort	<512		\b, Bytes/sector %u
12062>>>>>13		ubyte		>1		\b, sectors/cluster %u
12063#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
12064# for lazy FAT32 implementation like Transcend digital photo frame PF830
12065>>>>>82		string/c	fat32
12066>>>>>>14	uleshort	!32		\b, reserved sectors %u
12067#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
12068>>>>>82		string/c	!fat32
12069>>>>>>14	uleshort	>1		\b, reserved sectors %u
12070#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
12071#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
12072>>>>>16		ubyte		>2		\b, FATs %u
12073#>>>>>16	ubyte		=2		\b, FATs %u (usual)
12074>>>>>16		ubyte		=1		\b, FAT  %u
12075>>>>>16		ubyte		>0
12076>>>>>17		uleshort	>0		\b, root entries %u
12077#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
12078>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
12079#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
12080>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
12081#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
12082>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
12083>>>>>22		uleshort	>0		\b, sectors/FAT %u
12084#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
12085>>>>>24		uleshort	x		\b, sectors/track %u
12086>>>>>26		ubyte		>2		\b, heads %u
12087#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
12088>>>>>26		ubyte		=1		\b, heads %u
12089# valid only for sector sizes with more then 32 Bytes
12090>>>>>11		uleshort	>32
12091# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
12092# skip for values 2,2Ah,70h,73h,DFh
12093# and continue for extended boot signature values 0,28h,29h,80h
12094>>>>>>38	ubyte&0x56	=0
12095>>>>>>>28	ulelong		>0		\b, hidden sectors %u
12096#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
12097>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
12098#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
12099# FAT<32 bit specific
12100>>>>>>>82	string/c	!fat32
12101#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
12102#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
12103>>>>>>>>36	ubyte		!0x80
12104>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
12105# VGA-copy CRC or
12106# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
12107>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
12108#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
12109# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
12110>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
12111>>>>>>>>38	ubyte&0xFE	=0x28
12112>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
12113>>>>>>>>38	ubyte		=0x29
12114>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
12115>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
12116>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
12117# there exist some old floppies without word FAT at offset 54
12118# a word like "FATnm   " is only a hint for a FAT size on nm-bits
12119# Normally the number of clusters is calculated by the values of BPP.
12120# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
12121# otherwise FAT is 16 bit.
12122# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
12123>>>>>82		string/c	!fat32
12124>>>>>>54	string		FAT12		\b, FAT (12 bit)
12125>>>>>>54	string		FAT16		\b, FAT (16 bit)
12126>>>>>>54	default		x
12127# determinate FAT bit size by media descriptor
12128# small floppies implies FAT12
12129>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
12130# with media descriptor F0h floppy or maybe superfloppy with FAT16
12131>>>>>>>21	ubyte		=0xF0
12132# superfloppy (many sectors) implies FAT16
12133>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
12134# no superfloppy with media descriptor F0h implies FAT12
12135>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
12136# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
12137>>>>>>>21	ubyte		=0xF8
12138# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
12139>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
12140# hard disc with FAT12 or FAT16
12141>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
12142# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
12143>>>>>>>21	ubyte		=0xFA
12144# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
12145>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
12146# RAM disc with FAT12 or FAT16 or Tandy hard disc
12147>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
12148# others are floppy
12149>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
12150# FAT32 bit specific
12151>>>>>82		string/c	fat32		\b, FAT (32 bit)
12152>>>>>>36	ulelong		x		\b, sectors/FAT %u
12153# https://technet.microsoft.com/en-us/library/cc977221.aspx
12154>>>>>>40	uleshort	>0		\b, extension flags 0x%x
12155#>>>>>>40	uleshort	=0		\b, extension flags %hu
12156>>>>>>42	uleshort	>0		\b, fsVersion %u
12157#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
12158>>>>>>44	ulelong		>2		\b, rootdir cluster %u
12159#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
12160#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
12161>>>>>>48	uleshort	>1		\b, infoSector %u
12162#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
12163>>>>>>48	uleshort	<1		\b, infoSector %u
12164# 0 or 0xFFFF instead of usual 6 means no backup sector
12165>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
12166>>>>>>50	uleshort	=0		\b, no Backup boot sector
12167#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
12168>>>>>>50	default		x
12169>>>>>>>50	uleshort	x		\b, Backup boot sector %u
12170# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
12171>>>>>>52	ulelong		>0		\b, reserved1 0x%x
12172>>>>>>56	ulelong		>0		\b, reserved2 0x%x
12173>>>>>>60	ulelong		>0		\b, reserved3 0x%x
12174# same structure as FAT1X
12175#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
12176#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
12177>>>>>>64	ubyte		!0x80
12178>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
12179# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
12180>>>>>>65	ubyte		>0		\b, reserved 0x%x
12181>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
12182>>>>>>66	ubyte		=0x29
12183>>>>>>>67	ulelong		x		\b, serial number 0x%x
12184>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
12185>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
12186>>>>>>>71	string		=NO\ NAME	\b, unlabeled
12187# additional tests for floppy image added by Joerg Jenderek
12188# no fixed disk
12189>>>>>21		ubyte		!0xF8
12190# floppy media with 12 bit FAT
12191>>>>>>54	string		!FAT16
12192# test for FAT after bootsector
12193>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
12194# floppy image
12195!:mime application/x-ima
12196# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
12197# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
12198# 0 FATs
12199>>>>>16	ubyte		=0
12200# 0 root entries
12201>>>>>>17	uleshort	=0
12202# 0 DOS sectors
12203>>>>>>>19	uleshort	=0
12204# 0 sectors/FAT
12205# dos < 4.0 BootSector value found is 0x80
12206#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
12207>>>>>>>>22	uleshort	=0		\b; NTFS
12208>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
12209>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
12210>>>>>>>>>40	ulequad		>0		\b, sectors %lld
12211>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
12212>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
12213# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
12214# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
12215>>>>>>>>>64	lelong		<256
12216>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
12217>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
12218# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
12219# Values 128 to 255 represent index block sizes of 2^(256-N) byte
12220>>>>>>>>>68	ulelong		<256
12221>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
12222#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
12223>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
12224>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
12225>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
12226#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
12227# unicode loadername size jump
12228>>>>>>>>>(0x200.s*2)	ubyte				x
12229# in next sector loadername terminated by unicode CTRL-D and $
12230>>>>>>>>>>&0x1FF	ulequad&0x0000FFffFFffFF00	0x0000002400040000 \b; contains
12231# if 2nd NTFS sectors is found then assume whole filesystem
12232#!:mime		application/x-raw-disk-image
12233!:ext		img/bin/ntfs
12234>>>>>>>>>>>0x200	use				ntfs-sector2
12235
12236# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019
12237# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
12238# unused assembler instructions short JMP y2;NOP;NOP
122390x056		ulelong&0xFFFF0FFF	0x909002EB	NTFS
12240#!:mime		application/octet-stream
12241!:ext		bin
12242>0		use		ntfs-sector2
12243# https://memory.dataram.com/products-and-services/software/ramdisk
12244# assembler instructions JMP C000;NOP
122450x056		ulelong			0x9000c0e9	NTFS
12246#!:mime		application/octet-stream
12247!:ext		bin
12248>0		use		ntfs-sector2
12249# check for characteristics of second NTFS sector and then display loader name
122500		name		ntfs-sector2
12251# number of utf16 characters of loadername
12252>0		uleshort	<8
12253# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP
12254>>0x056		ulelong&0xFF0000FD	0x900000E9
12255# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
12256>>>0x002		lestring16	x	bootstrap %-5.5s
12257# check for 7 character length of loader name like BOOTMGR
12258>>>0		uleshort	7
12259>>>>0x0c	lestring16	x	\b%-2.2s
12260### DOS,NTFS boot sectors end
12261
12262# ntfsclone-image is a special save format for NTFS volumes,
12263# created and restored by the ntfsclone program
122640	string	\0ntfsclone-image	ntfsclone image,
12265>0x10	byte	x			version %d.
12266>0x11	byte	x			\b%d,
12267>0x12	lelong	x			cluster size %d,
12268>0x16	lequad	x			device size %lld,
12269>0x1e	lequad	x			%lld total clusters,
12270>0x26	lequad	x			%lld clusters in use
12271
122729564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
12273>8404	string		x		last mounted on %s,
12274#>9504	ledate		x		last checked at %s,
12275>8224	ledate		x		last written at %s,
12276>8401	byte		x		clean flag %d,
12277>8228	lelong		x		number of blocks %d,
12278>8232	lelong		x		number of data blocks %d,
12279>8236	lelong		x		number of cylinder groups %d,
12280>8240	lelong		x		block size %d,
12281>8244	lelong		x		fragment size %d,
12282>8252	lelong		x		minimum percentage of free blocks %d,
12283>8256	lelong		x		rotational delay %dms,
12284>8260	lelong		x		disk rotational speed %drps,
12285>8320	lelong		0		TIME optimization
12286>8320	lelong		1		SPACE optimization
12287
1228842332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
12289>&-1164	string		x		last mounted on %s,
12290>&-696	string		>\0		volume name %s,
12291>&-304	leqldate	x		last written at %s,
12292>&-1167	byte		x		clean flag %d,
12293>&-1168	byte		x		readonly flag %d,
12294>&-296	lequad		x		number of blocks %lld,
12295>&-288	lequad		x		number of data blocks %lld,
12296>&-1332	lelong		x		number of cylinder groups %d,
12297>&-1328	lelong		x		block size %d,
12298>&-1324	lelong		x		fragment size %d,
12299>&-180	lelong		x		average file size %d,
12300>&-176	lelong		x		average number of files in dir %d,
12301>&-272	lequad		x		pending blocks to free %lld,
12302>&-264	lelong		x		pending inodes to free %d,
12303>&-664	lequad		x		system-wide uuid %0llx,
12304>&-1316	lelong		x		minimum percentage of free blocks %d,
12305>&-1248	lelong		0		TIME optimization
12306>&-1248	lelong		1		SPACE optimization
12307
1230866908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
12309>&-1164	string		x		last mounted on %s,
12310>&-696	string		>\0		volume name %s,
12311>&-304	leqldate	x		last written at %s,
12312>&-1167	byte		x		clean flag %d,
12313>&-1168	byte		x		readonly flag %d,
12314>&-296	lequad		x		number of blocks %lld,
12315>&-288	lequad		x		number of data blocks %lld,
12316>&-1332	lelong		x		number of cylinder groups %d,
12317>&-1328	lelong		x		block size %d,
12318>&-1324	lelong		x		fragment size %d,
12319>&-180	lelong		x		average file size %d,
12320>&-176	lelong		x		average number of files in dir %d,
12321>&-272	lequad		x		pending blocks to free %lld,
12322>&-264	lelong		x		pending inodes to free %d,
12323>&-664	lequad		x		system-wide uuid %0llx,
12324>&-1316	lelong		x		minimum percentage of free blocks %d,
12325>&-1248	lelong		0		TIME optimization
12326>&-1248	lelong		1		SPACE optimization
12327
123289564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
12329>7168   belong		0x4c41424c	Apple UFS Volume
12330>>7186  string		x		named %s,
12331>>7176  belong		x		volume label version %d,
12332>>7180  bedate		x		created on %s,
12333>8404	string		x		last mounted on %s,
12334#>9504	bedate		x		last checked at %s,
12335>8224	bedate		x		last written at %s,
12336>8401	byte		x		clean flag %d,
12337>8228	belong		x		number of blocks %d,
12338>8232	belong		x		number of data blocks %d,
12339>8236	belong		x		number of cylinder groups %d,
12340>8240	belong		x		block size %d,
12341>8244	belong		x		fragment size %d,
12342>8252	belong		x		minimum percentage of free blocks %d,
12343>8256	belong		x		rotational delay %dms,
12344>8260	belong		x		disk rotational speed %drps,
12345>8320	belong		0		TIME optimization
12346>8320	belong		1		SPACE optimization
12347
1234842332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
12349>&-1164	string		x		last mounted on %s,
12350>&-696	string		>\0		volume name %s,
12351>&-304	beqldate	x		last written at %s,
12352>&-1167	byte		x		clean flag %d,
12353>&-1168	byte		x		readonly flag %d,
12354>&-296	bequad		x		number of blocks %lld,
12355>&-288	bequad		x		number of data blocks %lld,
12356>&-1332	belong		x		number of cylinder groups %d,
12357>&-1328	belong		x		block size %d,
12358>&-1324	belong		x		fragment size %d,
12359>&-180	belong		x		average file size %d,
12360>&-176	belong		x		average number of files in dir %d,
12361>&-272	bequad		x		pending blocks to free %lld,
12362>&-264	belong		x		pending inodes to free %d,
12363>&-664	bequad		x		system-wide uuid %0llx,
12364>&-1316	belong		x		minimum percentage of free blocks %d,
12365>&-1248	belong		0		TIME optimization
12366>&-1248	belong		1		SPACE optimization
12367
1236866908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
12369>&-1164	string		x		last mounted on %s,
12370>&-696	string		>\0		volume name %s,
12371>&-304	beqldate	x		last written at %s,
12372>&-1167	byte		x		clean flag %d,
12373>&-1168	byte		x		readonly flag %d,
12374>&-296	bequad		x		number of blocks %lld,
12375>&-288	bequad		x		number of data blocks %lld,
12376>&-1332	belong		x		number of cylinder groups %d,
12377>&-1328	belong		x		block size %d,
12378>&-1324	belong		x		fragment size %d,
12379>&-180	belong		x		average file size %d,
12380>&-176	belong		x		average number of files in dir %d,
12381>&-272	bequad		x		pending blocks to free %lld,
12382>&-264	belong		x		pending inodes to free %d,
12383>&-664	bequad		x		system-wide uuid %0llx,
12384>&-1316	belong		x		minimum percentage of free blocks %d,
12385>&-1248	belong		0		TIME optimization
12386>&-1248	belong		1		SPACE optimization
12387
123880	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
12389>0x90	lelong+1	x			volume %d
12390>0x94	lelong		x			(of %d),
12391>0x50	string		x			name %s,
12392>0x98	ulelong		x			version %u,
12393>0xa0	ulelong		x			flags 0x%x
12394
12395# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
12396# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
12397# volume label and UUID Russell Coker
12398# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
123990x438   leshort         0xEF53          Linux
12400>0x44c  lelong          x               rev %d
12401>0x43e  leshort         x               \b.%d
12402# No journal?  ext2
12403>0x45c  lelong          ^0x0000004      ext2 filesystem data
12404>>0x43a leshort         ^0x0000001      (mounted or unclean)
12405# Has a journal?  ext3 or ext4
12406>0x45c  lelong          &0x0000004
12407#  and small INCOMPAT?
12408>>0x460 lelong          <0x0000040
12409#   and small RO_COMPAT?
12410>>>0x464 lelong         <0x0000008      ext3 filesystem data
12411#   else large RO_COMPAT?
12412>>>0x464 lelong         >0x0000007      ext4 filesystem data
12413#  else large INCOMPAT?
12414>>0x460	lelong          >0x000003f      ext4 filesystem data
12415>0x468	belong		x		\b, UUID=%08x
12416>0x46c	beshort		x		\b-%04x
12417>0x46e	beshort		x		\b-%04x
12418>0x470	beshort		x		\b-%04x
12419>0x472	belong		x		\b-%08x
12420>0x476	beshort		x		\b%04x
12421>0x478	string		>0		\b, volume name "%s"
12422# General flags for any ext* fs
12423>0x460	lelong          &0x0000004      (needs journal recovery)
12424>0x43a	leshort         &0x0000002      (errors)
12425# INCOMPAT flags
12426>0x460	lelong          &0x0000001      (compressed)
12427#>0x460	lelong          &0x0000002      (filetype)
12428#>0x460	lelong          &0x0000010      (meta bg)
12429>0x460	lelong          &0x0000040      (extents)
12430>0x460	lelong          &0x0000080      (64bit)
12431#>0x460	lelong          &0x0000100      (mmp)
12432#>0x460	lelong          &0x0000200      (flex bg)
12433# RO_INCOMPAT flags
12434#>0x464	lelong          &0x0000001      (sparse super)
12435>0x464	lelong          &0x0000002      (large files)
12436>0x464	lelong          &0x0000008      (huge files)
12437#>0x464	lelong          &0x0000010      (gdt checksum)
12438#>0x464	lelong          &0x0000020      (many subdirs)
12439#>0x463	lelong          &0x0000040      (extra isize)
12440
12441# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
124420x400	lelong		0xF2F52010	F2FS filesystem
12443>0x46c	belong		x		\b, UUID=%08x
12444>0x470	beshort		x		\b-%04x
12445>0x472	beshort		x		\b-%04x
12446>0x474	beshort		x		\b-%04x
12447>0x476	belong		x		\b-%08x
12448>0x47a	beshort		x		\b%04x
12449>0x147c	lestring16	x		\b, volume name "%s"
12450
12451# Minix filesystems - Juan Cespedes <cespedes@debian.org>
124520x410	leshort		0x137f
12453!:strength / 2
12454>0x402	beshort		< 100
12455>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
12456>0x1e	string		minix		\b, bootable
124570x410	beshort		0x137f
12458!:strength / 2
12459>0x402	beshort		< 100
12460>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
12461>0x1e	string		minix		\b, bootable
124620x410	leshort		0x138f
12463!:strength / 2
12464>0x402	beshort		< 100
12465>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
12466>0x1e	string		minix		\b, bootable
124670x410	beshort		0x138f
12468!:strength / 2
12469>0x402	beshort		< 100
12470>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
12471>0x1e	string		minix		\b, bootable
12472# Weak Magic: this is $x
12473#0x410	leshort		0x2468
12474#>0x402	beshort		< 100
12475#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
12476#>0x1e	string		minix		\b, bootable
12477#0x410	beshort		0x2468
12478#>0x402	beshort		< 100
12479#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
12480#>0x1e	string		minix		\b, bootable
12481#0x410	leshort		0x2478
12482#>0x402	beshort		< 100
12483#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
12484#>0x1e	string		minix		\b, bootable
12485#0x410	leshort		0x2478
12486#>0x402	beshort		< 100
12487#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
12488#>0x1e	string		minix		\b, bootable
12489#0x410	beshort		0x2478
12490#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
12491#>0x1e	string		minix		\b, bootable
12492# Weak Magic! this is MD
12493#0x418	leshort		0x4d5a
12494#>0x402	beshort		<100
12495#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
12496
12497# SGI disk labels - Nathan Scott <nathans@debian.org>
124980	belong		0x0BE5A941	SGI disk label (volume header)
12499
12500# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
125010	belong		0x58465342	SGI XFS filesystem data
12502>0x4	belong		x		(blksz %d,
12503>0x68	beshort		x		inosz %d,
12504>0x64	beshort		^0x2004		v1 dirs)
12505>0x64	beshort		&0x2004		v2 dirs)
12506
12507############################################################################
12508# Minix-ST kernel floppy
125090x800	belong		0x46fc2700	Atari-ST Minix kernel image
12510# https://en.wikipedia.org/wiki/BIOS_parameter_block
12511# floppies with valid BPB and any instruction at beginning
12512>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
12513>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
12514
12515############################################################################
12516# Hmmm, is this a better way of detecting _standard_ floppy images ?
1251719	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
12518>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1251919	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
12520>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1252119	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
12522>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
12523
1252419	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
12525>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1252619	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
12527>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
12528
1252919	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1253019	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
12531#			|       |   |     |     |
12532#			|       |   |     |     heads
12533#			|       |   |     sectors/track
12534#			|       |   sectors/FAT
12535#			|       media descriptor
12536#		BPB:	sectors
12537
12538#  Valid media descriptor bytes for MS-DOS:
12539#
12540#     Byte   Capacity   Media Size and Type
12541#     -------------------------------------------------
12542#
12543#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
12544#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
12545#     F9     720K       3.5-inch, 2-sided, 9-sector
12546#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
12547#     FD     360K       5.25-inch, 2-sided, 9-sector
12548#     FF     320K       5.25-inch, 2-sided, 8-sector
12549#     FC     180K       5.25-inch, 1-sided, 9-sector
12550#     FE     160K       5.25-inch, 1-sided, 8-sector
12551#     FE     250K       8-inch, 1-sided, single-density
12552#     FD     500K       8-inch, 2-sided, single-density
12553#     FE     1.2 MB     8-inch, 2-sided, double-density
12554#     F8     -----      Fixed disk
12555#
12556#     FC     xxxK       Apricot 70x1x9 boot disk.
12557#
12558# Originally a bitmap:
12559#  xxxxxxx0	Not two sided
12560#  xxxxxxx1	Double sided
12561#  xxxxxx0x	Not 8 SPT
12562#  xxxxxx1x	8 SPT
12563#  xxxxx0xx	Not Removable drive
12564#  xxxxx1xx	Removable drive
12565#  11111xxx	Must be one.
12566#
12567# But now it's rather random:
12568#  111111xx	Low density disk
12569#        00	SS, Not 8 SPT
12570#        01	DS, Not 8 SPT
12571#        10	SS, 8 SPT
12572#        11	DS, 8 SPT
12573#
12574#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
12575#  11110000	High density 3 1/2 floppy disk
12576#  11111000	Hard disk any format
12577#
12578
12579# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
12580# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
12581# Too Weak.
12582#512		ubelong&0xE0ffff00	0xE0ffff00
12583# without valid Media descriptor in place of BPB, cases with are done at other places
12584#>21		ubyte			<0xE5			floppy with old FAT filesystem
12585# but valid Media descriptor at begin of FAT
12586#>>512		ubyte			=0xed			720k
12587#>>512		ubyte			=0xf0			1440k
12588#>>512		ubyte			=0xf8			720k
12589#>>512		ubyte			=0xf9			1220k
12590#>>512		ubyte			=0xfa			320k
12591#>>512		ubyte			=0xfb			640k
12592#>>512		ubyte			=0xfc			180k
12593# look like an old DOS directory entry
12594#>>>0xA0E	ubequad			0
12595#>>>>0xA00	ubequad			!0
12596#!:mime application/x-ima
12597#>>512		ubyte			=0xfd
12598# look for 2nd FAT at different location to distinguish between 360k and 500k
12599#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
12600#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
12601#>>>0xA0E	ubequad			0
12602#!:mime application/x-ima
12603#>>512		ubyte			=0xfe
12604#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
12605#>>>>0x60E	ubequad			0
12606#>>>>>0x600	ubequad			!0
12607#!:mime application/x-ima
12608#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
12609#>>512		ubyte			=0xff			320k
12610#>>>0x60E	ubequad			0
12611#>>>>0x600	ubequad			!0
12612#!:mime application/x-ima
12613#>>512		ubyte			x			\b, Media descriptor 0x%x
12614# without x86 jump instruction
12615#>>0		ulelong&0x804000E9	!0x000000E9
12616# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
12617#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
12618# IOSYS.COM+MSDOS.COM
12619#>>>>0xc4	use			2xDOS-filename
12620#>>0		ulelong&0x804000E9	=0x000000E9
12621# only x86 short jump instruction found
12622#>>>0		ubyte			=0xEB
12623#>>>>1		ubyte			x			\b, code offset 0x%x+2
12624# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm
12625# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
12626#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
12627# ibmbio.com+ibmdos.com
12628#>>>>>0x176	use			DOS-filename
12629#>>>>>0x181	ubyte			x			\b+
12630#>>>>>0x182	use			DOS-filename
12631# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm
12632# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
12633#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
12634# ibmbio.com+ibmdos.com
12635#>>>>>0x18b	use			DOS-filename
12636#>>>>>0x196	ubyte			x			\b+
12637#>>>>>0x197	use			DOS-filename
12638# https://en.wikipedia.org/wiki/Zenith_Data_Systems
12639# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
12640#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
12641# IO.SYS+MSDOS.SYS
12642#>>>>>0x20	use			2xDOS-filename
12643# https://en.wikipedia.org/wiki/Corona_Data_Systems
12644# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
12645#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
12646# IO.SYS+MSDOS.SYS
12647#>>>>>0x69	use			2xDOS-filename
12648# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
12649#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
12650# defect IO.SYS+MSDOS.SYS ?
12651#>>>>>0x162	use			2xDOS-filename
12652
126530	name				cdrom
12654>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
12655!:mime	application/x-iso9660-image
12656!:ext	iso/iso9660
12657>38913	string    NSR0      UDF filesystem data
12658!:mime	application/x-iso9660-image
12659!:ext	iso/udf
12660>>38917	string    1         (version 1.0)
12661>>38917	string    2         (version 1.5)
12662>>38917	string    3         (version 2.0)
12663>>38917	byte     >0x33      (unknown version, ID 0x%X)
12664>>38917	byte     <0x31      (unknown version, ID 0x%X)
12665# The next line is not necessary because the MBR staff is done looking for boot signature
12666>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
12667# "application id" which appears to be used as a volume label
12668>32808	string/T  >\0       '%s'
12669>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1267037633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
12671!:mime	application/x-iso9660-image
1267232777	string    CDROM     High Sierra CD-ROM filesystem data
12673
12674# CDROM Filesystems
12675# https://en.wikipedia.org/wiki/ISO_9660
12676# Modified for UDF by gerardo.cacciari@gmail.com
1267732769	string    CD001
12678# mime line at that position does not work
12679# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
12680#!:strength -11
12681# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
12682!:strength +35
12683>0	use	cdrom
12684
12685# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
12686# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
12687#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
12688# From: Joerg Jenderek
12689# Note:	Only for nero disc with once (DAO) type after 300 KB header
12690339969	string    CD001	Nero CD image at 0x4B000
12691!:mime	application/x-nrg
12692!:ext	nrg
12693>307200	use cdrom
12694
12695# .cso files
12696# Reference: https://pismotec.com/ciso/ciso.h
12697# NOTE: There are two other formats with the same magic but
12698# completely incompatible specifications:
12699# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
12700# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
127010    string    CISO
12702# Other fields are used to determine what type of CISO this is:
12703# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
12704# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
12705# - 0x10 == 0x00004000: For >2GB files using maxcso...
12706# 			https://github.com/unknownbrackets/maxcso/issues/26
12707# - None of the above: Compact ISO.
12708>4	lelong	!0
12709>>4	lelong	!0x200000
12710>>>16	lelong	!0x800
12711>>>>16	lelong	!0x4000		Compressed ISO CD image
12712
12713# cramfs filesystem - russell@coker.com.au
127140       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
12715>4      lelong  x size %u
12716>8      lelong  &1 version #2
12717>8      lelong  &2 sorted_dirs
12718>8      lelong  &4 hole_support
12719>32     lelong  x CRC 0x%x,
12720>36     lelong  x edition %u,
12721>40     lelong  x %u blocks,
12722>44     lelong  x %u files
12723
127240       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
12725>4      belong  x size %u
12726>8      belong  &1 version #2
12727>8      belong  &2 sorted_dirs
12728>8      belong  &4 hole_support
12729>32     belong  x CRC 0x%x,
12730>36     belong  x edition %u,
12731>40     belong  x %u blocks,
12732>44     belong  x %u files
12733
12734# reiserfs - russell@coker.com.au
127350x10034		string	ReIsErFs	ReiserFS V3.5
127360x10034		string	ReIsEr2Fs	ReiserFS V3.6
127370x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
12738>0x1002c 	leshort	x		block size %d
12739>0x10032	leshort	&2		(mounted or unclean)
12740>0x10000	lelong	x		num blocks %d
12741>0x10040	lelong	1		tea hash
12742>0x10040	lelong	2		yura hash
12743>0x10040	lelong	3		r5 hash
12744
12745# EST flat binary format (which isn't, but anyway)
12746# From: Mark Brown <broonie@sirena.org.uk>
127470	string	ESTFBINR	EST flat binary
12748
12749# Aculab VoIP firmware
12750# From: Mark Brown <broonie@sirena.org.uk>
127510	string	VoIP\ Startup\ and	Aculab VoIP firmware
12752>35	string	x	format %s
12753
12754# From: Mark Brown <broonie@sirena.org.uk> [old]
12755# From: Behan Webster <behanw@websterwood.com>
127560	belong	0x27051956	u-boot legacy uImage,
12757>32	string	x		%s,
12758>28	byte	0		Invalid os/
12759>28	byte	1		OpenBSD/
12760>28	byte	2		NetBSD/
12761>28	byte	3		FreeBSD/
12762>28	byte	4		4.4BSD/
12763>28	byte	5		Linux/
12764>28	byte	6		SVR4/
12765>28	byte	7		Esix/
12766>28	byte	8		Solaris/
12767>28	byte	9		Irix/
12768>28	byte	10		SCO/
12769>28	byte	11		Dell/
12770>28	byte	12		NCR/
12771>28	byte	13		LynxOS/
12772>28	byte	14		VxWorks/
12773>28	byte	15		pSOS/
12774>28	byte	16		QNX/
12775>28	byte	17		Firmware/
12776>28	byte	18		RTEMS/
12777>28	byte	19		ARTOS/
12778>28	byte	20		Unity OS/
12779>28	byte	21		INTEGRITY/
12780>29	byte	0		\bInvalid CPU,
12781>29	byte	1		\bAlpha,
12782>29	byte	2		\bARM,
12783>29	byte	3		\bIntel x86,
12784>29	byte	4		\bIA64,
12785>29	byte	5		\bMIPS,
12786>29	byte	6		\bMIPS 64-bit,
12787>29	byte	7		\bPowerPC,
12788>29	byte	8		\bIBM S390,
12789>29	byte	9		\bSuperH,
12790>29	byte	10		\bSparc,
12791>29	byte	11		\bSparc 64-bit,
12792>29	byte	12		\bM68K,
12793>29	byte	13		\bNios-32,
12794>29	byte	14		\bMicroBlaze,
12795>29	byte	15		\bNios-II,
12796>29	byte	16		\bBlackfin,
12797>29	byte	17		\bAVR32,
12798>29	byte	18		\bSTMicroelectronics ST200,
12799>29	byte	19		\bSandbox architecture,
12800>29	byte	20		\bANDES Technology NDS32,
12801>29	byte	21		\bOpenRISC 1000,
12802>29	byte	22		\bARM 64-bit,
12803>29	byte	23		\bDesignWare ARC,
12804>29	byte	24		\bx86_64,
12805>29	byte	25		\bXtensa,
12806>29	byte	26		\bRISC-V,
12807>30	byte	0		Invalid Image
12808>30	byte	1		Standalone Program
12809>30	byte	2		OS Kernel Image
12810>30	byte	3		RAMDisk Image
12811>30	byte	4		Multi-File Image
12812>30	byte	5		Firmware Image
12813>30	byte	6		Script File
12814>30	byte	7		Filesystem Image (any type)
12815>30	byte	8		Binary Flat Device Tree BLOB
12816>31	byte	0		(Not compressed),
12817>31	byte	1		(gzip),
12818>31	byte	2		(bzip2),
12819>31	byte	3		(lzma),
12820>12	belong	x		%d bytes,
12821>8	bedate	x		%s,
12822>16	belong	x		Load Address: 0x%08X,
12823>20	belong	x		Entry Point: 0x%08X,
12824>4	belong	x		Header CRC: 0x%08X,
12825>24	belong	x		Data CRC: 0x%08X
12826
12827# JFFS2 file system
128280	leshort	0x1984		Linux old jffs2 filesystem data little endian
128290	beshort	0x1984		Linux old jffs2 filesystem data big endian
128300	leshort	0x1985		Linux jffs2 filesystem data little endian
128310	beshort	0x1985		Linux jffs2 filesystem data big endian
12832
12833# Squashfs
128340	name	squashfs
12835>28	beshort	x	version %d.
12836>30	beshort	x	\b%d,
12837>20	beshort 0	uncompressed,
12838>20	beshort 1	zlib
12839>20	beshort 2	lzma
12840>20	beshort 3	lzo
12841>20	beshort 4	xz
12842>20	beshort 5	lz4
12843>20	beshort 6	zstd
12844>20	beshort >0	compressed,
12845>28	beshort <3
12846>>8	belong	x	%d bytes,
12847>28	beshort >2
12848>>28	beshort <4
12849>>>63	bequad x	%lld bytes,
12850>>28	beshort >3
12851>>>40	bequad x	%lld bytes,
12852#>>67	belong	x	%d bytes,
12853>4	belong	x	%d inodes,
12854>28	beshort <2
12855>>32	beshort	x	blocksize: %d bytes,
12856>28	beshort >1
12857>>28	beshort <4
12858>>>51	belong	x	blocksize: %d bytes,
12859>>28	beshort >3
12860>>>12	belong	x	blocksize: %d bytes,
12861>28	beshort <4
12862>>39	bedate	x	created: %s
12863>28	beshort >3
12864>>8	bedate	x	created: %s
12865
128660	string	sqsh	Squashfs filesystem, big endian,
12867>0	use	squashfs
12868
128690	string	hsqs	Squashfs filesystem, little endian,
12870>0	use	\^squashfs
12871
12872# AFS Dump Magic
12873# From: Ty Sarna <tsarna@sarna.org>
128740       string                  \x01\xb3\xa1\x13\x22    AFS Dump
12875>&0     belong                  x                       (v%d)
12876>>&0    byte                    0x76
12877>>>&0   belong                  x                       Vol %d,
12878>>>>&0  byte                    0x6e
12879>>>>>&0 string                  x                       %s
12880>>>>>>&1        byte            0x74
12881>>>>>>>&0       beshort         2
12882>>>>>>>>&4      bedate          x                       on: %s
12883>>>>>>>>&0      bedate          =0                      full dump
12884>>>>>>>>&0      bedate          !0                      incremental since: %s
12885
12886#----------------------------------------------------------
12887#delta ISO    Daniel Novotny (dnovotny@redhat.com)
128880	string  DISO	Delta ISO data
12889!:strength +50
12890>4	belong  x	version %d
12891
12892# VMS backup savesets - gerardo.cacciari@gmail.com
12893#
128944            string  \x01\x00\x01\x00\x01\x00
12895>(0.s+16)    string  \x01\x01
12896>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
12897>>>40        lelong  x          (block size %d,
12898>>>49        string  >\0        original name '%s',
12899>>>2         short   1024       VAX generated)
12900>>>2         short   2048       AXP generated)
12901>>>2         short   4096       I64 generated)
12902
12903# Summary: Oracle Clustered Filesystem
12904# Created by: Aaron Botsis <redhat@digitalmafia.org>
129058	string		OracleCFS	Oracle Clustered Filesystem,
12906>4	long		x		rev %d
12907>0	long		x		\b.%d,
12908>560	string		x		label: %.64s,
12909>136	string		x		mountpoint: %.128s
12910
12911# Summary: Oracle ASM tagged volume
12912# Created by: Aaron Botsis <redhat@digitalmafia.org>
1291332	string		ORCLDISK	Oracle ASM Volume,
12914>40	string		x		Disk Name: %0.12s
1291532	string		ORCLCLRD	Oracle ASM Volume (cleared),
12916>40	string		x		Disk Name: %0.12s
12917
12918# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
129198	string		OracleCFS	Oracle Clustered Filesystem,
12920>4	long		x		rev %d
12921>0	long		x		\b.%d,
12922>560	string		x		label: %.64s,
12923>136	string		x		mountpoint: %.128s
12924
12925# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1292632	string		ORCLDISK	Oracle ASM Volume,
12927>40	string		x		Disk Name: %0.12s
1292832	string		ORCLCLRD	Oracle ASM Volume (cleared),
12929>40	string		x		Disk Name: %0.12s
12930
12931# Compaq/HP RILOE floppy image
12932# From: Dirk Jagdmann <doj@cubic.org>
129330	string	CPQRFBLO	Compaq/HP RILOE floppy image
12934
12935#------------------------------------------------------------------------------
12936# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
12937# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
12938# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
12939#
129401008    string          DECFILE11       Files-11 On-Disk Structure
12941>525    byte            x               (ODS-%d);
12942>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
12943>1017   string          B
12944>>525   byte            2               VAX/VMS or OpenVMS file system;
12945>>525   byte            5               OpenVMS Alpha or Itanium file system;
12946>984    string          x               volume label is '%-12.12s'
12947
12948# From: Thomas Klausner <wiz@NetBSD.org>
12949# https://filext.com/file-extension/DAA
12950# describes the daa file format. The magic would be:
129510	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
12952
12953# From Albert Cahalan <acahalan@gmail.com>
12954# really le32 operation,destination,payloadsize (but quite predictable)
12955# 01 00 00 00 00 00 00 c0 00 02 00 00
129560	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
12957
12958# From Eric Sandeen
12959# GFS2
129600x10000         belong          0x01161970
12961>0x10018        belong          0x0000051d      GFS1 Filesystem
12962>>0x10024        belong          x               (blocksize %d,
12963>>0x10060        string          >\0             lockproto %s)
12964>0x10018        belong          0x00000709      GFS2 Filesystem
12965>>0x10024        belong          x               (blocksize %d,
12966>>0x10060        string          >\0             lockproto %s)
12967
12968# Russell Coker <russell@coker.com.au>
129690x10040		string	_BHRfS_M	BTRFS Filesystem
12970>0x1012b	string	>\0		label "%s",
12971>0x10090	lelong	x		sectorsize %d,
12972>0x10094	lelong	x		nodesize %d,
12973>0x10098	lelong	x		leafsize %d,
12974>0x10020	belong	x		UUID=%08x-
12975>0x10024	beshort	x		\b%04x-
12976>0x10026	beshort	x		\b%04x-
12977>0x10028	beshort	x		\b%04x-
12978>0x1002a	beshort	x		\b%04x
12979>0x1002c	belong	x		\b%08x,
12980>0x10078	lequad	x		%lld/
12981>0x10070	lequad	x		\b%lld bytes used,
12982>0x10088	lequad	x		%lld devices
12983
12984# dvdisaster's .ecc
12985# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
129860	string	*dvdisaster*	dvdisaster error correction file
12987
12988# xfs metadump image
12989# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
12990# but can we do the << ?  For now it's always 512 (0x200) anyway.
129910	string XFSM
12992>0x200	string XFSB	XFS filesystem metadump image
12993
12994# Type:	CROM filesystem
12995# From:	Werner Fink <werner@suse.de>
129960	string	CROMFS	CROMFS
12997>6	string	>\0	\b version %2.2s,
12998>8	ulequad	>0	\b block data at %lld,
12999>16	ulequad	>0	\b fblock table at %lld,
13000>24	ulequad	>0	\b inode table at %lld,
13001>32	ulequad	>0	\b root at %lld,
13002>40	ulelong	>0	\b fblock size = %d,
13003>44	ulelong	>0	\b block size = %d,
13004>48	ulequad	>0	\b bytes = %lld
13005
13006# Type:	xfs metadump image
13007# From:	Daniel Novotny <dnovotny@redhat.com>
13008# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
13009# but can we do the << ? For now it's always 512 (0x200) anyway.
130100	string	XFSM
13011>0x200	string	XFSB	XFS filesystem metadump image
13012
13013# Type:	delta ISO
13014# From:	Daniel Novotny <dnovotny@redhat.com>
130150	string	DISO	Delta ISO data,
13016>4	belong	x	version %d
13017
13018# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
13019# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
13020# From: Adam Buchbinder <adam.buchbinder@gmail.com>
130210x8000	string	JFS1
13022# Because it's text-only magic, check a binary value (version) to be sure.
13023# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
13024# mountable.
13025>&0	lelong	<3	JFS2 filesystem image
13026# Label is followed by a UUID; we have to limit string length to avoid
13027# appending the UUID in the case of a 16-byte label.
13028>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
13029>>&0	lequad	x	\b, %lld blocks
13030>>&8	lelong	x	\b, blocksize %d
13031>>&32	lelong&0x00000006	>0	(dirty)
13032>>&36	lelong	>0	(compressed)
13033
13034# LFS
130350	lelong	0x070162	LFS filesystem image
13036>4	lelong	1		version 1,
13037>>8	lelong	x		\b blocks %u,
13038>>12	lelong	x		\b blocks per segment %u,
13039>4	lelong	2		version 2,
13040>>8	lelong	x		\b fragments %u,
13041>>12	lelong	x		\b bytes per segment %u,
13042>16	lelong	x		\b disk blocks %u,
13043>20	lelong	x		\b block size %u,
13044>24	lelong	x		\b fragment size %u,
13045>28	lelong	x		\b fragments per block %u,
13046>32	lelong	x		\b start for free list %u,
13047>36	lelong	x		\b number of free blocks %d,
13048>40	lelong	x		\b number of files %u,
13049>44	lelong	x		\b blocks available for writing %d,
13050>48	lelong	x		\b inodes in cache %d,
13051>52	lelong	x		\b inode file disk address 0x%x,
13052>56	lelong	x		\b inode file inode number %u,
13053>60	lelong	x		\b address of last segment written 0x%x,
13054>64	lelong	x		\b address of next segment to write 0x%x,
13055>68	lelong	x		\b address of current segment written 0x%x
13056
130570	string	td\000		floppy image data (TeleDisk, compressed)
130580	string	TD\000		floppy image data (TeleDisk)
13059
130600	string	CQ\024		floppy image data (CopyQM,
13061>16	leshort	x		%d sectors,
13062>18	leshort	x		%d heads.)
13063
130640	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
13065
130660	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
130670	beshort	0xAA59		floppy image data (IBM SaveDskF)
130680	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
13069
130700	string	\074CPM_Disk\076	disk image data (YAZE)
13071
13072# ReFS
13073# Richard W.M. Jones <rjones@redhat.com>
130740	string	\0\0\0ReFS\0	ReFS filesystem image
13075
13076# EFW encase image file format:
13077# Gregoire Passault
13078# http://www.forensicswiki.org/wiki/Encase_image_file_format
130790	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
13080
13081# UBIfs
13082# Linux kernel sources: fs/ubifs/ubifs-media.h
130830	lelong	0x06101831
13084>0x16	leshort	0		UBIfs image
13085>0x08	lequad	x		\b, sequence number %llu
13086>0x10	leshort x		\b, length %u
13087>0x04	lelong	x		\b, CRC 0x%08x
13088
130890	lelong	0x23494255
13090>0x04	leshort	<2
13091>0x05	string	\0\0\0
13092>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13093>0x04	leshort	x		UBI image, version %u
13094
13095# NEC PC-88 2D disk image
13096# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
130970x20		ulelong&0xFFFFFEFF	0x2A0
13098>0x10		string			\0\0\0\0\0\0\0\0\0\0
13099>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13100>>>0x1A		ubyte&0xEF		0
13101>>>>0x1B	ubyte&0x8F		0
13102>>>>>0x1B	ubyte&70		<0x40
13103>>>>>>0x1C	ulelong			>0x21
13104>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
13105>>>>>>>>0x1B	ubyte	0		\b, media=2D
13106>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
13107>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
13108>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
13109>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
13110>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
13111
13112# HDD Raw Copy Tool disk image, file extension: .imgc
13113# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
131140	pstring	HDD\ Raw\ Copy\ Tool	%s
13115>0x100	pstring	x			%s
13116>0x200	pstring	x			- HD model: %s
13117#>0x300	pstring	x			unknown %s
13118>0x400	pstring	x			serial: %s
13119#>0x500	pstring	x			unknown: %s
13120!:ext	imgc
13121
13122#------------------------------------------------------------------------------
13123# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $
13124# fingerprint:  file(1) magic for fingerprint data
13125# XPM bitmaps)
13126#
13127
13128# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
13129
131300	string	FP1		libfprint fingerprint data V1
13131>3	beshort	x		\b, driver_id %x
13132>5	belong	x		\b, devtype %x
13133
131340	string	FP2		libfprint fingerprint data V2
13135>3	beshort	x		\b, driver_id %x
13136>5	belong	x		\b, devtype %x
13137
13138#------------------------------------------------------------------------------
13139# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $
13140# flash:	file(1) magic for Macromedia Flash file format
13141#
13142# See
13143#
13144#	https://www.macromedia.com/software/flash/open/
13145#	https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
13146#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
13147#
13148
131490   name	swf-details
13150
13151>0	string		F
13152>>8	byte&0xfd	0x08		Macromedia Flash data
13153!:mime	application/x-shockwave-flash
13154>>>3	byte		x		\b, version %d
13155>>8	byte&0xfe	0x10		Macromedia Flash data
13156!:mime	application/x-shockwave-flash
13157>>>3	byte		x		\b, version %d
13158>>8	byte		0x18		Macromedia Flash data
13159!:mime	application/x-shockwave-flash
13160>>>3	byte		x		\b, version %d
13161>>8	beshort&0xff87	0x2000		Macromedia Flash data
13162!:mime	application/x-shockwave-flash
13163>>>3	byte		x		\b, version %d
13164>>8	beshort&0xffe0	0x3000		Macromedia Flash data
13165!:mime	application/x-shockwave-flash
13166>>>3	byte		x		\b, version %d
13167>>8	byte&0x7	0
13168>>>8	ubyte		>0x2f
13169>>>>9	ubyte		<0x20		Macromedia Flash data
13170!:mime	application/x-shockwave-flash
13171>>>>>3	byte		x		\b, version %d
13172
13173>0	string		C
13174>>8	byte		0x78		Macromedia Flash data (compressed)
13175!:mime	application/x-shockwave-flash
13176>>>3	byte		x		\b, version %d
13177
13178>0	string		Z
13179>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
13180!:mime	application/x-shockwave-flash
13181>>>3	byte		x		\b, version %d
13182
13183
131841	string		WS
13185>4	ulelong		>14
13186>>3	ubyte		!0
13187>>>0	use		swf-details
13188
13189# From: Cal Peake <cp@absolutedigital.net>
131900	string		FLV\x01		Macromedia Flash Video
13191!:mime	video/x-flv
13192
13193#
13194# Yosu Gomez
131950	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
131960	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
13197# From Dave Wilson
131980	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
13199
13200#------------------------------------------------------------------------------
13201#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
13202#	flif:	Magic	data	for	file(1)	command.
13203#	FLIF	(Free	Lossless	Image	Format)
13204
132050	string	FLIF	FLIF
13206>4	string	<H	image data
13207>>6	beshort	x	\b, %u
13208>>8	beshort	x	\bx%u
13209>>5	string	1	\b, 8-bit/color,
13210>>5	string	2	\b, 16-bit/color,
13211>>4	string	1	\b, grayscale, non-interlaced
13212>>4	string	3	\b, RGB, non-interlaced
13213>>4	string	4	\b, RGBA, non-interlaced
13214>>4	string	A	\b, grayscale
13215>>4	string	C	\b, RGB, interlaced
13216>>4	string	D	\b, RGBA, interlaced
13217>4	string	>H	\b, animation data
13218>>5	ubyte	<255	\b, %i frames
13219>>>7	beshort	x	\b, %u
13220>>>9	beshort	x	\bx%u
13221>>>6	string	=1	\b, 8-bit/color
13222>>>6	string	=2	\b, 16-bit/color
13223>>5	ubyte	0xFF
13224>>>6	beshort	x	\b, %i frames,
13225>>>9	beshort	x	\b, %u
13226>>>11	beshort	x	\bx%u
13227>>>8	string	=1	\b, 8-bit/color
13228>>>8	string	=2	\b, 16-bit/color
13229>>4	string	=Q	\b, grayscale, non-interlaced
13230>>4	string	=S	\b, RGB, non-interlaced
13231>>4	string	=T	\b, RGBA, non-interlaced
13232>>4	string	=a	\b, grayscale
13233>>4	string	=c	\b, RGB, interlaced
13234>>4	string	=d	\b, RGBA, interlaced
13235
13236#------------------------------------------------------------------------------
13237# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $
13238# fonts:  file(1) magic for font data
13239#
132400	search/1	FONT		ASCII vfont text
132410	short		0436		Berkeley vfont data
132420	short		017001		byte-swapped Berkeley vfont data
13243
13244# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
132450	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
13246>20	string		>\0			(%s)
132476	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
132480	string		%!FontType1	PostScript Type 1 font program data
132496	string		%!FontType1	PostScript Type 1 font program data
132500	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
13251
13252# Summary:	PostScript Type 1 Printer Font Metrics
13253# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
13254# Reference:	https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
13255# Modified by:	Joerg Jenderek
13256# Note:		moved from ./msdos magic
13257# dfVersion 256=0100h
132580		uleshort	0x0100
13259# GRR: line above is too general as it catches also TrueType font,
13260# raw G3 data FAX, WhatsApp encrypted and Panorama database
13261# dfType 129=0081h
13262>66		uleshort	0x0081
13263# dfVertRes 300=012Ch not needed as additional test
13264#>>70		uleshort	0x012c
13265# dfHorizRes 300=012Ch
13266#>>>72		uleshort	0x012c
13267# dfDriverInfo points to postscript information section
13268>>(101.l)	string/c	Postscript	Printer Font Metrics
13269# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
13270!:mime	application/x-font-pfm
13271# AppleShare Print Server
13272#!:apple	ASPS????
13273!:ext	pfm
13274# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
13275#>>>6		string		>\060		- %-.60s
13276# dfDriverInfo
13277>>>139		ulelong		>0
13278# often abbreviated and same as filename
13279>>>>(139.l)	string		x		%s
13280# dfSize
13281>>>2		ulelong		x		\b, %d bytes
13282# dfFace 210=D2h 9Eh
13283>>>105		ulelong		>0
13284# Windows font name
13285>>>>(105.l)	string		x		\b, %s
13286# dfItalic
13287>>>80		ubyte		1		italic
13288# dfUnderline
13289>>>81		ubyte		1		underline
13290# dfStrikeOut
13291>>>82		ubyte		1		strikeout
13292# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
13293>>>83		uleshort	>699		bold
13294# dfPitchAndFamily 16 17 48 49 64 65
13295>>>90		ubyte		16		serif
13296>>>90		ubyte		17		serif proportional
13297#>>>90		ubyte		48		other
13298>>>90		ubyte		49		proportional
13299>>>90		ubyte		64		script
13300>>>90		ubyte		65		script proportional
13301
13302# X11 font files in SNF (Server Natural Format) format
13303# updated by Joerg Jenderek at Feb 2013
13304# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
133050	belong		00000004		X11 SNF font data, MSB first
13306#>104	belong		00000004		X11 SNF font data, MSB first
13307!:mime	application/x-font-sfn
13308# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
133090	lelong		00000004
13310>104	lelong		00000004		X11 SNF font data, LSB first
13311!:mime	application/x-font-sfn
13312
13313# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
133140	search/1	STARTFONT\ 		X11 BDF font text
13315
13316# From: Joerg Jenderek
13317# URL: https://grub.gibibit.com/New_font_format
13318# Reference: util/grub-mkfont.c
13319#		include/grub/fontformat.h
13320# FONT_FORMAT_SECTION_NAMES_FILE
133210			string		FILE
13322# FONT_FORMAT_PFF2_MAGIC
13323>8			string		PFF2
13324# leng 4 only at the moment
13325>>4			ubelong		4
13326# FONT_FORMAT_SECTION_NAMES_FONT_NAME
13327>>>12			string		NAME		GRUB2 font
13328!:mime			application/x-font-pf2
13329!:ext			pf2
13330# length of font_name
13331>>>>16			ubelong		>0
13332# font_name
13333>>>>>20			string		>\0		"%-s"
13334
13335# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
13336# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
133370	string		\001fcp			X11 Portable Compiled Font data,
13338>12	lelong		^0x08			bit: LSB,
13339>12	lelong		&0x08			bit: MSB,
13340>12	lelong		^0x04			byte: LSB first
13341>12	lelong		&0x04			byte: MSB first
133420	string		D1.0\015		X11 Speedo font data
13343
13344#------------------------------------------------------------------------------
13345# FIGlet fonts and controlfiles
13346# From figmagic supplied with Figlet version 2.2
13347# "David E. O'Brien" <obrien@FreeBSD.ORG>
133480	string		flf		FIGlet font
13349>3	string		>2a		version %-2.2s
133500	string		flc		FIGlet controlfile
13351>3	string		>2a		version %-2.2s
13352
13353# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
13354# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
133550	belong		0x14025919	libGrx font data,
13356>8	leshort		x		%dx
13357>10	leshort		x		\b%d
13358>40	string		x		%s
13359# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
133600	belong		0xff464f4e	DOS code page font data collection
133617	belong		0x00454741	DOS code page font data
133627	belong		0x00564944	DOS code page font data (from Linux?)
133634098	string		DOSFONT		DOSFONT2 encrypted font data
13364
13365# From: Joerg Jenderek
13366# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font
13367# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
13368#
13369# usual case with lightening mask and skewing mask 5555h~UU
13370#62	ulelong		0x55555555
13371# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72
13372#>2	uleshort	<73
13373#>>0	use		gdos-font
13374# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
13375#62	ulelong		0
13376# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
13377#>2	uleshort	>2
13378# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72
13379#>>2	uleshort	<73
13380# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE
13381#>>>4	ulelong		>0x001F1f1F
13382# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data
13383#>>>>76	ulelong		>83
13384#>>>>>0	use		gdos-font
133850	name		gdos-font
13386>0	uleshort	x		GEM GDOS font
13387!:mime	application/x-font-gdos
13388# also .eps found like AA070GEP.EPS AI360GEP.EPS
13389!:ext	fnt/gtf
13390# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE
13391>4	string		x		%.32s
13392# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT
13393>2	uleshort	x		%u
13394# face ID (must be unique)
13395>0	uleshort	x		\b, ID 0x%4.4x
13396# lowest character index in face (4 but usually 32 for disk-loaded fonts)
13397#>36	uleshort	!32		\b, unusual character index %u
13398# width of the widest character like 0 8 10 12 16 24 32
13399#>50	uleshort	x		\b, %u char width
13400# width of the widest character cell like 8 11 12 14 15 16 33 67
13401#>52	uleshort	x		\b, %u cell width
13402# thickening size in pixel like 0 1 2 3 4 5 6 7 8
13403#>58	uleshort	x		\b, %u thick
13404# lightening mask to eliminate pixels, usually 5555h
13405>62	uleshort	!0x5555		\b, lightening mask 0x%x
13406# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
13407>64	uleshort	!0x5555		\b, skewing mask 0x%x
13408# offset to optional horizontal offset table 0 58h~88 5eh 252h
13409#>68	ulelong		x		\b, 0x%x horizontal table offset
13410# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h
13411#>72	ulelong		x		\b, 0x%x coffset
13412# offset to font data like 116h 118h 158 20Ah 20Eh
13413>76	ulelong		x		\b, 0x%x foffset
13414# form width in bytes like 58 67 156 190 227 317 345
13415#>80	uleshort	x		\b, %u fwidth
13416# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150
13417#>82	uleshort	x		\b, %u fheight
13418# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h
13419#>84	ulelong		x		\b, 0x%x noffset
13420
13421# downloadable fonts for browser (prints type) anthon@mnt.org
13422# https://tools.ietf.org/html/rfc3073
134230	string		PFR1		Portable Font Resource font data (new)
13424>102	string		>0		\b: %s
134250	string		PFR0		Portable Font Resource font data (old)
13426>4	beshort		>0		version %d
13427
13428# True Type fonts
13429# Modified by: Joerg Jenderek
13430# URL: https://en.wikipedia.org/wiki/TrueType
13431# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
13432#
13433# sfnt version "typ1" used by some Apple, but no example found
134340	string	typ1
13435>0	use		sfnt-font
13436>0	use		sfnt-names
13437# sfnt version "true" used by some Apple
134380	string	true
13439>0	use		sfnt-font
13440>0	use		sfnt-names
13441# GRR: below test is too general
13442# sfnt version often 0x00010000
134430	string	\000\001\000\000
13444>0	use		sfnt-font
13445>0	use		sfnt-names
13446#	validate and display sfnt font data like number of tables
134470	name		sfnt-font
13448# file 5.30 version assumes 00FFh as maximal number of tables
13449#>4	ubeshort	<0x0100
13450# maximal 27 tables found like in Skia.ttf
13451# 46 different table names mentioned on Apple specification
13452# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
13453>4	ubeshort	<47
13454# skip bad examples with garbage table names like in a5.show HYPERC MAC
13455# tag names consist of up to four characters padded with spaces at end like
13456# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
13457>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
13458#>>>0	ubelong	x	\b, sfnt version 0x%x
13459>>>0	ubelong	!0x4f54544f	TrueType
13460!:mime	font/sfnt
13461!:apple	????tfil
13462# .ttf for TrueType font
13463# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
13464!:ext	ttf/tte
13465# sfnt version 4F54544Fh~OTTO
13466>>>0	ubelong	=0x4f54544f	OpenType
13467!:mime	font/otf
13468!:apple	????OTTO
13469!:ext	otf
13470>>>0	ubelong	x		Font data
13471# DSIG=44454947h table name implies a digitally signed font
13472# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
13473>>>12	search/432	DSIG		\b, digitally signed
13474>>>4	ubeshort	x		\b, %d tables
13475# minimal 9 tables found like in NISC18030.ttf
13476#>>>4	ubeshort	<10		TMIN
13477#>>>4	ubeshort	>24		TBIG
13478# table directory entries
13479>>>12	string		x		\b, 1st "%4.4s"
13480
13481#	search and display 1st name in sfnt font which is often copyright text
13482#	does not work inside font collections
134830	name		sfnt-names
13484# search for naming table
13485>12	search/432/s	name
13486# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
13487#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
13488>>&8	ubelong		>0x00100000
13489# offset of name table
13490>>>&-4	ubelong		x		\b, name offset 0x%x
13491# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
13492>>&8	ubelong		<0x00100000
13493>>>&-16	ubelong		x
13494# name table
13495>>>>(&8.L)	ubequad	x
13496# invalid format selector
13497#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
13498# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
13499# maximal 1227 name records found like in Apple Chancery.ttf
13500#>>>>>&-6	ubeshort	<0x4	mincount
13501#>>>>>&-6	ubeshort	>130	maxcount
13502>>>>>&-6	ubeshort	x	\b, %d names
13503# offset to start of string storage from start of table
13504#>>>>>&-4	ubeshort	x	\b, record offset %d
13505# 1st name record
13506# string offset from start of storage area
13507#>>>>>&8		ubeshort	x	\b, string offset %d
13508# string length
13509#>>>>>&6		ubeshort	x	\b, string length %d
13510# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
13511# also found 0 like in SWZCONLN.TTF
13512#>>>>>&6		ubeshort	<8	MIN STRING
13513# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
13514#>>>>>&6		ubeshort	>805	MAX STRING
13515# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
13516#>>>>>&-2	ubeshort	>3	BAD PLATFORM
13517>>>>>&-2	ubeshort	0	\b, Unicode
13518>>>>>&-2	ubeshort	1	\b, Macintosh
13519>>>>>&-2	ubeshort	3	\b, Microsoft
13520# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
13521>>>>>&2		ubeshort	>0	\b, language 0x%x
13522# name identifiers
13523# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
13524>>>>>&4		ubeshort	>0	\b, type %d string
13525# platform specific encoding:
13526# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
13527#>>>>>&0		ubeshort	x	\b, %d encoding
13528>>>>>&0		ubeshort	0
13529# handle only name string offset 0 because do not know how to add 2 relative offsets
13530>>>>>>&6		ubeshort	0
13531>>>>>>>&(&-14.S-18)	ubyte		!0
13532# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
13533# often copyright string that starts like \251 2006 The Monotype Corporation
13534>>>>>>>>&-1		string		x	\b, %-11.96s
13535# test for unicode string
13536>>>>>>>&(&-14.S-18)	ubyte		0
13537>>>>>>>>&0		lestring16	x	\b, %-11.96s
13538# unicode encoding
13539>>>>>&0		ubeshort	>0
13540>>>>>>&6		ubeshort	0
13541>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s
13542
135430	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
135440	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
13545
13546# TrueType/OpenType font collections (.ttc)
13547# URL: https://en.wikipedia.org/wiki/OpenType
13548# https://www.microsoft.com/typography/otspec/otff.htm
13549# Modified by: Joerg Jenderek
13550# Note:	container for TrueType, OpenType font
135510	string		ttcf
13552# skip ASCII text
13553>4	ubyte		0
13554# sfnt version often 0x00010000 of 1st table is TrueType
13555>>(12.L)	ubelong	!0x4f54544f	TrueType
13556!:mime	font/ttf
13557!:apple	????tfil
13558!:ext	ttc
13559# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
13560>>(12.L)	ubelong	=0x4f54544f	OpenType
13561!:mime	font/otf
13562!:apple	????OTTO
13563# no example found for otc
13564!:ext	ttc/otc
13565>>4	ubyte		x		font collection data
13566#!:mime	font/collection
13567# TCC version
13568>>4	belong		0x00010000	\b, 1.0
13569>>4	belong		0x00020000	\b, 2.0
13570>>8	ubelong		>0		\b, %d fonts
13571# array offset size = fonts * offsetsize = fonts * 4
13572>>(8.L*4) ubequad	x
13573# 0x44454947 = 'DSIG'
13574>>>&4	belong		0x44534947	\b, digitally signed
13575# offset to 1st font
13576>>12	ubelong		x		\b, at 0x%x
13577# point to 1st font that starts with sfnt version
13578>>(12.L) use		sfnt-font
13579
13580# Opentype font data from Avi Bercovich
135810	string		OTTO		OpenType font data
13582!:mime application/vnd.ms-opentype
13583
13584# From: Alex Myczko <alex@aiei.ch>
135850	string		SplineFontDB:	Spline Font Database
13586!:mime application/vnd.font-fontforge-sfd
13587>14	string		x		version %s
13588
13589# EOT
135900x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13591>0x22	string		LP		Embedded OpenType (EOT)
13592# workaround until there's lepstring16
13593# >>0x52	lepstring16/h	>\0		\b, %s family
13594>>0x52	short	!0
13595>>>0x54	lestring16	x		\b, %s family
13596!:mime application/vnd.ms-fontobject
13597
13598# Web Open Font Format (.woff)
135990	name		woff
13600>4	belong		0x00010000	\b, TrueType
13601>4	belong		0x4F54544F	\b, CFF
13602>4	belong		0x74727565	\b, TrueType
13603>4	default		x
13604>>4	belong		x		\b, flavor %d
13605>8	belong		x		\b, length %d
13606#>12	beshort		x		\b, numTables %d
13607#>14	beshort		x		\b, reserved %d
13608#>16	belong		x		\b, totalSfntSize %d
13609
13610# https://www.w3.org/TR/WOFF/
136110	string		wOFF	Web Open Font Format
13612>0	use		woff
13613>20	beshort		x	\b, version %d
13614>22	beshort		x	\b.%d
13615# https://www.w3.org/TR/WOFF2/
136160	string		wOF2	Web Open Font Format (Version 2)
13617>0	use		woff
13618#>20	belong		x	\b, totalCompressedSize %d
13619>24	beshort		x	\b, version %d
13620>26	beshort		x	\b.%d
13621
13622#------------------------------------------------------------------------------
13623# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $
13624# forth:  file(1) magic for various Forth environments
13625# From: Lubomir Rintel <lkundrak@v3.sk>
13626#
13627
13628# Has a FORTH stack diagram and something that looks very much like a FORTH
13629# multi-line word definition. Probably a FORTH source.
136300       regex   \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)
13631>0      regex   \^:\[[:space:]]
13632>>0     regex   \^;$				FORTH program
13633!:mime  text/x-forth
13634
13635# Inline word definition complete with a stack diagram
136360       regex   \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$	FORTH program
13637!:mime  text/x-forth
13638
13639# Various dictionary images used by OpenFirware FORTH environent
13640
136410	lelong	0xe1a00000
13642>8	lelong	0xe1a00000	ARM OpenFirmware FORTH Dictionary,
13643>>24	lelong	x		Text length: %d bytes,
13644>>28	lelong	x		Data length: %d bytes,
13645>>32	lelong	x		Text Relocation Table length: %d bytes,
13646>>36	lelong	x		Data Relocation Table length: %d bytes,
13647>>40	lelong	x		Entry Point: 0x%08X,
13648>>44	lelong	x		BSS length: %d bytes
13649
136500	string	MP
13651>28	lelong	1		x86 OpenFirmware FORTH Dictionary,
13652>>4	leshort	x		%d blocks
13653>>2	leshort	x		+ %d bytes,
13654>>6	leshort	x		%d relocations,
13655>>8	leshort	x		Header length: %d paragraphs,
13656>>10	leshort	x		Data Size: %d
13657>>12	leshort	x		- %d 4K pages,
13658>>14	lelong	x		Initial Stack Pointer: 0x%08X,
13659>>20	lelong	x		Entry Point: 0x%08X,
13660>>24	lelong	x		First Relocation Item: %d,
13661>>26	lelong	x		Overlay Number: %d,
13662>>18	leshort	x		Checksum: 0x%08X
13663
136640	belong	0x48000020	PowerPC OpenFirmware FORTH Dictionary,
13665>4	belong	x		Text length: %d bytes,
13666>8	belong	x		Data length: %d bytes,
13667>12	belong	x		BSS length: %d bytes,
13668>16	belong	x		Symbol Table length: %d bytes,
13669>20	belong	x		Entry Point: 0x%08X,
13670>24	belong	x		Text Relocation Table length: %d bytes,
13671>28	belong	x		Data Relocation Table length: %d bytes
13672
136730	lelong	0x10000007	MIPS OpenFirmware FORTH Dictionary,
13674>4	lelong	x		Text length: %d bytes,
13675>8	lelong	x		Data length: %d bytes,
13676>12	lelong	x		BSS length: %d bytes,
13677>16	lelong	x		Symbol Table length: %d bytes,
13678>20	lelong	x		Entry Point: 0x%08X,
13679>24	lelong	x		Text Relocation Table length: %d bytes,
13680>28	lelong	x		Data Relocation Table length: %d bytes
13681
13682# Dictionary images used by minimal C FORTH environments, any platform,
13683# using native byte order.
13684
13685# Weak.
13686#0	short	0x5820		cForth 16-bit Dictionary,
13687#>2	short	x		Serial: 0x%08X,
13688#>4	short	x		Dictionary Start: 0x%08X,
13689#>6	short	x		Dictionary Size: %d bytes,
13690#>8	short	x		User Area Start: 0x%08X,
13691#>10	short	x		User Area Size: %d bytes,
13692#>12	short	x		Entry Point: 0x%08X
13693
136940	long	0x581120	cForth 32-bit Dictionary,
13695>4	long	x		Serial: 0x%08X,
13696>8	long	x		Dictionary Start: 0x%08X,
13697>12	long	x		Dictionary Size: %d bytes,
13698>16	long	x		User Area Start: 0x%08X,
13699>20	long	x		User Area Size: %d bytes,
13700>24	long	x		Entry Point: 0x%08X
13701
13702#------------------------------------------------------------------------------
13703# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
13704# FORTRAN source
13705# Check that the first 100 lines start with C or whitespace first.
137060       regex/100l      !\^[^Cc\ \t].*$
13707>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
13708!:mime	text/x-fortran
13709!:strength - 5
13710
13711#------------------------------------------------------------------------------
13712# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
13713# frame:  file(1) magic for FrameMaker files
13714#
13715# This stuff came on a FrameMaker demo tape, most of which is
13716# copyright, but this file is "published" as witness the following:
13717#
13718# Note that this is the Framemaker Maker Interchange Format, not the
13719# Normal format which would be application/vnd.framemaker.
13720#
137210	string		\<MakerFile	FrameMaker document
13722!:mime	application/x-mif
13723>11	string		5.5		 (5.5
13724>11	string		5.0		 (5.0
13725>11	string		4.0		 (4.0
13726>11	string		3.0		 (3.0
13727>11	string		2.0		 (2.0
13728>11	string		1.0		 (1.0
13729>14	byte		x		  %c)
13730# URL:		http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
13731# Reference:	https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
13732# Update:	Joerg Jenderek 2019 Nov
137330	string		\<MIFFile	FrameMaker MIF (ASCII) file
13734# https://www.iana.org/assignments/media-types/application/vnd.mif
13735!:mime	application/vnd.mif
13736# mif most but also find bookTOC.framemif
13737!:ext	mif/framemif
13738# followed by space~20h
13739#>8	ubyte		0x20		\b, space before version
13740# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ...
13741>9	string		x		(%.3s
13742# if not greater sign then display 4th character of version
13743>12	ubyte		=0x3e		\b)
13744>12	ubyte		!0x3e		\b%c)
13745# comment starting with # shows the name+version number of generating program
13746>13	search/3	#
13747>>&0	string		x		"%s"
137480	search/1	\<MakerDictionary	FrameMaker Dictionary text
13749!:mime	application/x-mif
13750>17	string		3.0		 (3.0)
13751>17	string		2.0		 (2.0)
13752>17	string		1.0		 (1.x)
137530	string		\<MakerScreenFont	FrameMaker Font file
13754!:mime	application/x-mif
13755>17	string		1.01		 (%s)
137560	string		\<MML		FrameMaker MML file
13757!:mime	application/x-mif
137580	string		\<BookFile	FrameMaker Book file
13759!:mime	application/x-mif
13760>10	string		3.0		 (3.0
13761>10	string		2.0		 (2.0
13762>10	string		1.0		 (1.0
13763>13	byte		x		  %c)
13764# XXX - this book entry should be verified, if you find one, uncomment this
13765#0	string		\<Book\040 	FrameMaker Book (ASCII) file
13766#!:mime	application/x-mif
13767#>6	string		3.0		 (3.0)
13768#>6	string		2.0		 (2.0)
13769#>6	string		1.0		 (1.0)
137700	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
13771!:mime	application/x-mif
13772
13773#------------------------------------------------------------------------------
13774# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
13775# freebsd:  file(1) magic for FreeBSD objects
13776#
13777# All new-style FreeBSD magic numbers are in host byte order (i.e.,
13778# little-endian on x86).
13779#
13780# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
13781# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
13782# schemes for distinguishing between executable images, shared libraries,
13783# and object files.
13784#
13785# FreeBSD says:
13786#
13787#    Regardless of whether it's pure, demand-paged, or none of the
13788#    above:
13789#
13790#	if the entry point is < 4096, then it's a shared library if
13791#	the "has run-time loader information" bit is set, and is
13792#	position-independent if the "is position-independent" bit
13793#	is set;
13794#
13795#	if the entry point is >= 4096 (or >4095, same thing), then it's
13796#	an executable, and is dynamically-linked if the "has run-time
13797#	loader information" bit is set.
13798#
13799# On x86, NetBSD says:
13800#
13801#    If it's neither pure nor demand-paged:
13802#
13803#	if it has the "has run-time loader information" bit set, it's
13804#	a dynamically-linked executable;
13805#
13806#	if it doesn't have that bit set, then:
13807#
13808#	    if it has the "is position-independent" bit set, it's
13809#	    position-independent;
13810#
13811#	    if the entry point is non-zero, it's an executable, otherwise
13812#	    it's an object file.
13813#
13814#    If it's pure:
13815#
13816#	if it has the "has run-time loader information" bit set, it's
13817#	a dynamically-linked executable, otherwise it's just an
13818#	executable.
13819#
13820#    If it's demand-paged:
13821#
13822#	if it has the "has run-time loader information" bit set,
13823#	then:
13824#
13825#	    if the entry point is < 4096, it's a shared library;
13826#
13827#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
13828#	    it's a dynamically-linked executable);
13829#
13830#	if it doesn't have the "has run-time loader information" bit
13831#	set, then it's just an executable.
13832#
13833# (On non-x86, NetBSD does much the same thing, except that it uses
13834# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
13835# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
13836# had 8K pages; dunno about MIPS.)
13837#
13838# I suspect the two will differ only in perverse and uninteresting cases
13839# ("shared" libraries that aren't demand-paged and whose pages probably
13840# won't actually be shared, executables with entry points <4096).
13841#
13842# I leave it to those more familiar with FreeBSD and NetBSD to figure out
13843# what the right answer is (although using ">4095", FreeBSD-style, is
13844# probably better than separately checking for "=4096" and ">4096",
13845# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
13846# executables using the NetBSD technique.)
13847#
138480	lelong&0377777777	041400407	FreeBSD/i386
13849>20	lelong			<4096
13850>>3	byte&0xC0		&0x80		shared library
13851>>3	byte&0xC0		0x40		PIC object
13852>>3	byte&0xC0		0x00		object
13853>20	lelong			>4095
13854>>3	byte&0x80		0x80		dynamically linked executable
13855>>3	byte&0x80		0x00		executable
13856>16	lelong			>0		not stripped
13857
138580	lelong&0377777777	041400410	FreeBSD/i386 pure
13859>20	lelong			<4096
13860>>3	byte&0xC0		&0x80		shared library
13861>>3	byte&0xC0		0x40		PIC object
13862>>3	byte&0xC0		0x00		object
13863>20	lelong			>4095
13864>>3	byte&0x80		0x80		dynamically linked executable
13865>>3	byte&0x80		0x00		executable
13866>16	lelong			>0		not stripped
13867
138680	lelong&0377777777	041400413	FreeBSD/i386 demand paged
13869>20	lelong			<4096
13870>>3	byte&0xC0		&0x80		shared library
13871>>3	byte&0xC0		0x40		PIC object
13872>>3	byte&0xC0		0x00		object
13873>20	lelong			>4095
13874>>3	byte&0x80		0x80		dynamically linked executable
13875>>3	byte&0x80		0x00		executable
13876>16	lelong			>0		not stripped
13877
138780	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
13879>20	lelong			<4096
13880>>3	byte&0xC0		&0x80		shared library
13881>>3	byte&0xC0		0x40		PIC object
13882>>3	byte&0xC0		0x00		object
13883>20	lelong			>4095
13884>>3	byte&0x80		0x80		dynamically linked executable
13885>>3	byte&0x80		0x00		executable
13886>16	lelong			>0		not stripped
13887
13888# XXX gross hack to identify core files
13889# cores start with a struct tss; we take advantage of the following:
13890# byte 7:     highest byte of the kernel stack pointer, always 0xfe
13891#      8/9:   kernel (ring 0) ss value, always 0x0010
13892#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
13893#      28:    low order byte of the current PTD entry, always 0 since the
13894#             PTD is page-aligned
13895#
138967	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
13897>1039	string	>\0	from '%s'
13898
13899# /var/run/ld.so.hints
13900# What are you laughing about?
139010	lelong			011421044151	ld.so hints file (Little Endian
13902>4	lelong			>0		\b, version %d)
13903>4	belong			<1		\b)
139040	belong			011421044151	ld.so hints file (Big Endian
13905>4	belong			>0		\b, version %d)
13906>4	belong			<1		\b)
13907
13908#
13909# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
13910#
139110	string	SCRSHOT_	scrshot(1) screenshot,
13912>8	byte	x		version %d,
13913>9	byte	2		%d bytes in header,
13914>>10	byte	x		%d chars wide by
13915>>11	byte	x		%d chars high
13916
13917#------------------------------------------------------------------------------
13918# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $
13919# fsav:  file(1) magic for datafellows fsav virus definition files
13920# Anthon van der Neut (anthon@mnt.org)
13921
13922# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
139230	beshort		0x1575		fsav macro virus signatures
13924>8	leshort		>0		(%d-
13925>11	byte		>0		\b%02d-
13926>10	byte		>0		\b%02d)
13927# ftp://ftp.f-prot.com/pub/sign.zip
13928#10	ubyte		<12
13929#>9	ubyte		<32
13930#>>8	ubyte		0x0a
13931#>>>12	ubyte		0x07
13932#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
13933#>>>>10	byte		0		\b01-
13934#>>>>10	byte		1		\b02-
13935#>>>>10	byte		2		\b03-
13936#>>>>10	byte		3		\b04-
13937#>>>>10	byte		4		\b05-
13938#>>>>10	byte		5		\b06-
13939#>>>>10	byte		6		\b07-
13940#>>>>10	byte		7		\b08-
13941#>>>>10	byte		8		\b09-
13942#>>>>10	byte		9		\b10-
13943#>>>>10	byte		10		\b11-
13944#>>>>10	byte		11		\b12-
13945#>>>>9	ubyte		>0		\b%02d)
13946# ftp://ftp.f-prot.com/pub/sign2.zip
13947#0	ubyte		0x62
13948#>1	ubyte		0xF5
13949#>>2	ubyte		0x1
13950#>>>3	ubyte		0x1
13951#>>>>4	ubyte		0x0e
13952#>>>>>13		ubyte	>0		fsav virus signatures
13953#>>>>>>11	ubyte	x		size 0x%02x
13954#>>>>>>12	ubyte	x		\b%02x
13955#>>>>>>13	ubyte	x		\b%02x bytes
13956
13957# Joerg Jenderek: joerg dot jenderek at web dot de
13958# clamav-0.100.2\docs\html\node60.html
13959# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf
13960# ClamAV virus database files start with a 512 bytes colon separated header
13961# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
13962# + gzipped (optional) tarball files
13963# output can often be verified by `sigtool --info=FILE`
139640	string		ClamAV-VDB:	Clam AntiVirus
13965# padding spaces implies database
13966>511	ubyte		=0x20		database
13967!:mime	application/x-clamav-database
13968# empty build time
13969>>10	string		=::		(unsigned)
13970# sigtool(1) man page
13971!:ext	cud
13972# display some text to avoid error like:
13973# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type
13974# file: could not find any valid magic files! (No error)
13975>>10	default		x		(with buildtime)
13976#>>10	default		x
13977# clamtmp is used for temporily database like update process
13978# for pure tar database only cld extension found
13979!:ext	cld/cvd/clamtmp/cud
13980>511	default		x		file
13981!:mime	application/x-clamav
13982!:ext	info
13983>11	string		>\0
13984# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE`
13985>>11	regex		\^[^:]{0,23}	\b, %s
13986# version like 25170
13987>>>&1	regex		\^[^:]{1,6}	\b, version %s
13988# signaturesNumbers like 4566249
13989>>>>&1	regex		\^[^:]{1,10}	\b, %s signatures
13990# functionalityLevelRequired like 60
13991>>>>>&1	regex		\^[^:]{1,4}	\b, level %s
13992# X for nothing or MD5
13993#>>>>>>&1	regex	\^[^:]{1,32}	\b, MD5 "%s"
13994>>>>>>&1	regex	\^[^:]{1,32}
13995# X for nothing or digital signature starting like AIzk/LYbX
13996#>>>>>>>&1	regex	\^[^:]{1,255}	\b, signature "%s"
13997>>>>>>>&1	regex	\^[^:]{1,255}
13998# builder like neo
13999>>>>>>>>&1	regex	\^[^:]{1,32}	\b, builder %s
14000# buildTime like 1506611558
14001#>>>>>>>>>&1	regex	\^[^:]{1,10}	\b, %s
14002>>>>>>>>>&1	regex	\^[^:]{1,10}
14003# padding with spaces
14004#>>>>>>>>>>&1	ubequad	x		\b, padding 0x%16.16llx
14005>510	ubyte		=0x20
14006# inspect real database content
14007#>>512	ubeshort	x		\b, database MAGIC 0x%x
14008# ./archive handle pure tar archives
14009>>1012	quad		=0		\b, with
14010>>>512	use		tar-file
14011# not pure tar
14012>>1012	quad		!0
14013# one space at the end of text and then handles gziped archives by ./compress
14014>>>512	string		\037\213	\b, with
14015>>>>512	indirect	x
14016
14017# Type: Grisoft AVG AntiVirus
14018# From: David Newgas <david@newgas.net>
140190	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
14020
140210	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
14022>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
14023
14024# From: Joerg Jenderek
14025# URL: https://www.avira.com/
14026# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows)
14027# tested with version 15.0.43.23 at November 2019
140280	string		AntiVir\ Qua	Avira AntiVir quarantined
14029!:mime	application/x-avira-qua
14030#!:mime	application/octet-stream
14031!:ext	qua
14032>156	string		SUSPICIOUS_FILE
14033# file path of suspicious file
14034>>220	lestring16	x		%s
14035>156	string		!SUSPICIOUS_FILE
14036# file path of virus file
14037>>228	lestring16	x		%s
14038# quarantined date
14039>60	ldate		x		at %s
14040# virus/danger name
14041>156	string		!SUSPICIOUS_FILE
14042>>156	string		x		\b, category "%s"
14043
14044
14045#------------------------------------------------------------------------------
14046# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
14047# fusecompress:   file(1) magic for fusecompress
140480	string	\037\135\211	FuseCompress(ed) data
14049>3	byte	0x00	(none format)
14050>3	byte	0x01	(bz2 format)
14051>3	byte	0x02	(gz format)
14052>3	byte	0x03	(lzo format)
14053>3	byte	0x04	(xor format)
14054>3	byte	>0x04	(unknown format)
14055>4	long	x	uncompressed size: %d
14056
14057#------------------------------------------------------------------------------
14058# $File: games,v 1.20 2020/02/01 16:32:33 christos Exp $
14059# games:  file(1) for games
14060
14061# Fabio Bonelli <fabiobonelli@libero.it>
14062# Quake II - III data files
140630       string  IDP2        	Quake II 3D Model file,
14064>20     long    x               %u skin(s),
14065>8      long    x               (%u x
14066>12     long    x 		%u),
14067>40     long    x               %u frame(s),
14068>16     long    x               Frame size %u bytes,
14069>24     long  	x               %u vertices/frame,
14070>28     long    x            	%u texture coordinates,
14071>32     long    x               %u triangles/frame
14072
140730       string  IBSP            Quake
14074>4      long    0x26            II Map file (BSP)
14075>4      long    0x2E      	III Map file (BSP)
14076
140770       string  IDS2            Quake II SP2 sprite file
14078
14079#---------------------------------------------------------------------------
14080# Doom and Quake
14081# submitted by Nicolas Patrois
14082
140830       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
14084# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
14085
1408624      string  LxD\ 203        Linuxdoom save
14087>0      string  x       , name=%s
14088>44     string  x       , world=%s
14089
14090# Quake
14091
14092# Update: Joerg Jenderek
14093# URL: http://fileformats.archiveteam.org/wiki/PAK
14094# reference: https://quakewiki.org/wiki/.pak
14095# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
14096# and Git pack ./revision
140970       string  PACK
14098# real Quake examples like pak0.pak have only some hundreds like 150 files
14099# So test for few files
14100>8	ulelong <0x01000000
14101# in file version 5.32 test for null terminator is only true for
14102# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
14103# look for null terminator of 1st entry name
14104>>(4.l+55)	ubyte	0	Quake I or II world or extension
14105!:mime	application/x-dzip
14106!:ext	pak
14107#>>>8	ulelong	x	\b, table size %u
14108# dividing this by entry size (64) gives number of files
14109>>>8	ulelong/64 x	\b, %u files
14110# offset to the beginning of the file table
14111>>>4	ulelong	x	\b, offset 0x%x
14112# 1st file entry
14113>>>(4.l)	use	pak-entry
14114# 2nd file entry
14115#>>>4	ulelong+64	x	\b, offset 0x%x
14116#>>>(4.l+64)	use	pak-entry
14117#
14118#	display file table entry of Quake PAK archive
141190	name		pak-entry
14120# normally entry start after header which implies offset 12 or higher
14121>56	ulelong	>11
14122# the offset from the beginning of pak to beginning of this entry file contents
14123>>56	ulelong	x	at 0x%x
14124# the size of file for this entry
14125>>60	ulelong	x	%u bytes
14126# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
14127>>0	string	x	'%-.56s'
14128# inspect entry content by jumping to entry offset
14129>>(56)	indirect x	\b:
14130
14131#0       string  -1\x0a  Quake I demo
14132#>30     string  x        version %.4s
14133#>61     string  x        level %s
14134
14135#0       string  5\x0a   Quake I save
14136
14137# The levels
14138
14139# Quake 1
14140
141410	string	5\x0aIntroduction             Quake I save: start Introduction
141420	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
141430	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
141440	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
141450	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
141460	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
141470	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
141480	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
141490	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
141500	string	5\x0athe_Installation         Quake I save: e2m1 The installation
141510	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
141520	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
141530	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
141540	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
141550	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
141560	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
141570	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
141580	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
141590	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
141600	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
141610	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
141620	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
141630	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
141640	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
141650	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
141660	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
141670	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
141680	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
141690	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
141700	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
141710	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
141720	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
14173
14174# Quake DeathMatch levels
14175
141760	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
141770	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
141780	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
141790	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
141800	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
141810	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
14182
14183# Scourge of Armagon
14184
141850	string	5\x0aCommand_HQ               Quake I save: start Command HQ
141860	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
141870	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
141880	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
141890	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
141900	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
141910	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
141920	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
141930	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
141940	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
141950	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
141960	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
141970	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
141980	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
141990	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
142000	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
142010	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
142020	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
14203
14204# Malice
14205
142060	string	5\x0aThe_Academy      Quake I save: start The academy
142070	string	5\x0aThe_Lab          Quake I save: d1 The lab
142080	string	5\x0aArea_33          Quake I save: d1b Area 33
142090	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
142100	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
142110	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
142120	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
142130	string	5\x0aArea44           Quake I save: d1c Area 44
142140	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
142150	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
142160	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
142170	string	5\x0aThe_Flood        Quake I save: d5 The flood
142180	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
142190	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
142200	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
142210	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
142220	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
142230	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
142240	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
142250	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
142260	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
14227
14228# Malice DeathMatch levels
14229
142300	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
142310	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
142320	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
142330	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
142340	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
142350	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
142360	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
14237
14238
142390	string	MComprHD	MAME CHD compressed hard disk image,
14240>12	belong	x		version %u
14241
14242# doom - submitted by Jon Dowland
14243
142440	string	=IWAD		doom main IWAD data
14245>4	lelong	x		containing %d lumps
142460	string	=PWAD		doom patch PWAD data
14247>4	lelong	x		containing %d lumps
14248
14249# Build engine group files (Duke Nukem, Shadow Warrior, ...)
14250# Extension: .grp
14251# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
142520	string	KenSilverman	Build engine group file
14253>12	lelong	x		containing %d files
14254
14255# Summary: Warcraft 3 save
14256# Extension: .w3g
14257# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
142580	string		Warcraft\ III\ recorded\ game	%s
14259
14260
14261# Summary: Warcraft 3 map
14262# Extension: .w3m
14263# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
142640	string		HM3W		Warcraft III map file
14265
14266
14267# Summary: SGF Smart Game Format
14268# Extension: .sgf
14269# Reference: https://www.red-bean.com/sgf/
14270# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
14271# Modified by (1): Abel Cheung (regex, more game format)
14272# FIXME: Some games don't have GM (game type)
142730	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
14274>2	search/0x200/b	GM[
14275>>&0	string		1]	(Go)
14276>>&0	string		2]	(Othello)
14277>>&0	string		3]	(chess)
14278>>&0	string		4]	(Gomoku+Renju)
14279>>&0	string		5]	(Nine Men's Morris)
14280>>&0	string		6]	(Backgammon)
14281>>&0	string		7]	(Chinese chess)
14282>>&0	string		8]	(Shogi)
14283>>&0	string		9]	(Lines of Action)
14284>>&0	string		10]	(Ataxx)
14285>>&0	string		11]	(Hex)
14286>>&0	string		12]	(Jungle)
14287>>&0	string		13]	(Neutron)
14288>>&0	string		14]	(Philosopher's Football)
14289>>&0	string		15]	(Quadrature)
14290>>&0	string		16]	(Trax)
14291>>&0	string		17]	(Tantrix)
14292>>&0	string		18]	(Amazons)
14293>>&0	string		19]	(Octi)
14294>>&0	string		20]	(Gess)
14295>>&0	string		21]	(Twixt)
14296>>&0	string		22]	(Zertz)
14297>>&0	string		23]	(Plateau)
14298>>&0	string		24]	(Yinsh)
14299>>&0	string		25]	(Punct)
14300>>&0	string		26]	(Gobblet)
14301>>&0	string		27]	(hive)
14302>>&0	string		28]	(Exxit)
14303>>&0	string		29]	(Hnefatal)
14304>>&0	string		30]	(Kuba)
14305>>&0	string		31]	(Tripples)
14306>>&0	string		32]	(Chase)
14307>>&0	string		33]	(Tumbling Down)
14308>>&0	string		34]	(Sahara)
14309>>&0	string		35]	(Byte)
14310>>&0	string		36]	(Focus)
14311>>&0	string		37]	(Dvonn)
14312>>&0	string		38]	(Tamsk)
14313>>&0	string		39]	(Gipf)
14314>>&0	string		40]	(Kropki)
14315
14316##############################################
14317# NetImmerse/Gamebryo game engine entries
14318
14319# Summary: Gamebryo game engine file
14320# Extension: .nif, .kf
14321# Created by: Abel Cheung <abelcheung@gmail.com>
143220		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
14323>&0		regex		[0-9a-z.]+				\b, version %s
14324
14325# Summary: Gamebryo game engine file
14326# Extension: .kfm
14327# Created by: Abel Cheung <abelcheung@gmail.com>
143280		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
14329>&0		regex		[0-9a-z.]+				\b, version %s
14330
14331# Summary: NetImmerse game engine file
14332# Extension .nif
14333# Created by: Abel Cheung <abelcheung@gmail.com>
143340		string		NetImmerse\ File\ Format,\ Versio
14335>&0		string		n\ 					NetImmerse game engine file
14336>>&0		regex		[0-9a-z.]+				\b, version %s
14337
14338# Type:	SGF Smart Game Format
14339# URL:	https://www.red-bean.com/sgf/
14340# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
143412	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
14342>2	regex/c	GM\\[1\\]			- Go Game
14343>2	regex/c	GM\\[6\\]			- BackGammon Game
14344>2	regex/c	GM\\[11\\]			- Hex Game
14345>2	regex/c	GM\\[18\\]			- Amazons Game
14346>2	regex/c	GM\\[19\\]			- Octi Game
14347>2	regex/c	GM\\[20\\]			- Gess Game
14348>2	regex/c	GM\\[21\\]			- twix Game
14349
14350# Epic Games/Unreal Engine Package
14351#
143520	lelong		0x9E2A83C1	Unreal Engine Package,
14353>4	leshort		x		version: %i
14354>12	lelong		!0		\b, names: %i
14355>28	lelong		!0		\b, imports: %i
14356>20	lelong		!0		\b, exports: %i
14357
143580	string		ESVG
14359>4	lelong		0x00160000
14360>10	string		TOC\020		Empire Deluxe for DOS saved game
14361
14362# Sid Meier's Civilization V/VI
14363# From: Benjamin Lowry <ben@ben.gmbh>
143640	string	CIV5
14365>4	byte	0x08		Sid Meier's Civilization V saved game,
14366>>12	regex	[0-9a-z.]+	saved by game version %s
14367>4	byte	0x01		Sid Meier's Civilization V replay data,
14368>>12	regex	[0-9a-z.]+	saved by game version %s
14369
143700	string	CIV6		Sid Meier's Civilization VI saved game
14371
14372#------------------------------------------------------------------------------
14373# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
14374# gcc:  file(1) magic for GCC special files
14375#
143760	string		gpch		GCC precompiled header
14377
14378# The version field is annoying.  It's 3 characters, not zero-terminated.
14379>5	byte		x			(version %c
14380>6	byte		x			\b%c
14381>7	byte		x			\b%c)
14382
14383# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
14384>4	byte		67			for C
14385>4	byte		111			for Objective-C
14386>4	byte		43			for C++
14387>4	byte		79			for Objective-C++
14388
14389#------------------------------------------------------------------------------
14390# $File: gconv
14391# gconv: file(1) magic for iconv/gconv module configuration cache
14392#
14393# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
14394#
14395# From: Marek Cermak <macermak@redhat.com>
14396#
143970		lelong		0x20010324 	gconv module configuration cache data
14398
14399#------------------------------------------------------------------------------
14400# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $
14401# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
14402
14403######################################################################
14404#
14405# Acoustic Doppler Current Profilers (ADCP)
14406#
14407######################################################################
14408
144090	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
14410
14411######################################################################
14412#
14413# Metadata
14414#
14415######################################################################
14416
144170	string	Identification_Information	FGDC ASCII metadata
14418
14419######################################################################
14420#
14421# Seimsic / Subbottom
14422#
14423######################################################################
14424
14425# Knudsen subbottom chirp profiler - Binary File Format: B9
14426# KEB D409-03167 V1.75 Huffman
144270	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
14428>4	regex	[-A-Z0-9]*	Software: %s
14429>>&1	regex	V[0-9]*\.[0-9]*	version %s
14430
14431######################################################################
14432#
14433# LIDAR - Laser altimetry or bathy
14434#
14435######################################################################
14436
14437
14438# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
144390	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
14440>4	regex [0-9]*\.[0-9]*	version %s
14441
144420	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
14443>3      byte    x	version %d .
14444>4	byte	x	%d
14445
14446
14447######################################################################
14448#
14449# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
14450#
14451######################################################################
14452
14453# GeoAcoustics - GeoSwath Plus
144544	beshort	0x2002	GeoSwath RDF
144550	string	Start:-	GeoSwatch auf text file
14456
14457# Seabeam 2100
14458# mbsystem code mb41
144590	string SB2100	SeaBeam 2100 multibeam sonar
144600	string SB2100DR	SeaBeam 2100 DR multibeam sonar
144610	string SB2100PR SeaBeam 2100 PR multibeam sonar
14462
14463# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
14464# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
144650    string $HSF    XSE multibeam
14466
14467# mb121 https://www.saic.com/maritime/gsf/
144688	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
14469>&0	regex [0-9]*\.[0-9]*	version %s
14470
14471# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
14472# mb161
144739	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
14474
14475# MBSystem processing caches the mbinfo output
144761	string	Swath\ Data\ File:	mbsystem info cache
14477
14478# Caris John Hughes Clark format
144790	string	HDCS	Caris multibeam sonar related data
144801	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
14481
14482######################################################################
14483#
14484# Visualization and 3D modeling
14485#
14486######################################################################
14487
14488# IVS - IVS3d.com Tagged Data Represetation
144890	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
14490
14491# http://www.ecma-international.org/publications/standards/Ecma-363.htm
14492# 3D in PDFs
144930	string	U3D	ECMA-363, Universal 3D
14494
14495######################################################################
14496#
14497# Support files
14498#
14499######################################################################
14500
14501# https://midas.psi.ch/elog/
145020	string	$@MID@$	elog journal entry
14503
14504# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm
145050	string		DSBB	Surfer 6 binary grid file
14506>4	leshort		x	\b, %d
14507>6	leshort		x	\bx%d
14508>8	ledouble	x	\b, minx=%g
14509>16	ledouble	x	\b, maxx=%g
14510>24	ledouble	x	\b, miny=%g
14511>32	ledouble	x	\b, maxy=%g
14512>40	ledouble	x	\b, minz=%g
14513>48	ledouble	x	\b, maxz=%g
14514
14515# magic for LAS format files
14516# alex myczko <alex@aiei.ch>
14517# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
145180	string		LASF	LIDAR point data records
14519>24	byte		>0	\b, version %u
14520>25	byte		>0	\b.%u
14521>26	string		>\0	\b, SYSID %s
14522>58	string		>\0	\b, Generating Software %s
14523
14524# magic for PCD format files
14525# alex myczko <alex@aiei.ch>
14526# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
145270	string		#\ .PCD	Point Cloud Data
14528
14529#------------------------------------------------------------------------------
14530# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
14531# GEOS files (Vidar Madsen, vidar@gimp.org)
14532# semi-commonly used in embedded and handheld systems.
145330	belong	0xc745c153	GEOS
14534>40	byte	1	executable
14535>40	byte	2	VMFile
14536>40	byte	3	binary
14537>40	byte	4	directory label
14538>40	byte	<1	unknown
14539>40	byte	>4	unknown
14540>4	string	>\0	\b, name "%s"
14541#>44	short	x	\b, version %d
14542#>46	short	x	\b.%d
14543#>48	short	x	\b, rev %d
14544#>50	short	x	\b.%d
14545#>52	short	x	\b, proto %d
14546#>54	short	x	\br%d
14547#>168	string	>\0	\b, copyright "%s"
14548
14549#------------------------------------------------------------------------------
14550# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $
14551# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
14552# by Federico Mena <federico@nuclecu.unam.mx>
14553
145540       string/t        GIMP\ Gradient  GIMP gradient data
14555#!:mime	text/plain
14556!:mime	text/x-gimp-ggr
14557!:ext	ggr
14558
14559# GIMP palette (.gpl)
14560# From: Markus Heidelberg <markus.heidelberg@web.de>
145610       string/t        GIMP\ Palette   GIMP palette data
14562# URL:		https://docs.gimp.org/en/gimp-concepts-palettes.html
14563# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Palette
14564#!:mime	text/plain
14565!:mime	text/x-gimp-gpl
14566!:ext	gpl
14567
14568#------------------------------------------------------------------------------
14569# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
14570#       by Spencer Kimball and Peter Mattis
14571#       ('Bucky' LaDieu, nega@vt.edu)
14572
14573# URL:		https://en.wikipedia.org/wiki/XCF_(file_format)
14574# Reference:	https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt
145750	string		gimp\ xcf	GIMP XCF image data,
14576!:mime	image/x-xcf
14577!:ext	xcf
14578>9	string		file		version 0,
14579>9	string		v		version
14580>>10	string		>\0		%s,
14581>14	belong		x		%u x
14582>18	belong		x		%u,
14583>22     belong          0               RGB Color
14584>22     belong          1               Greyscale
14585>22     belong          2               Indexed Color
14586>22	belong		>2		Unknown Image Type.
14587
14588#------------------------------------------------------------------------------
14589# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
14590#       by Spencer Kimball and Peter Mattis
14591#       ('Bucky' LaDieu, nega@vt.edu)
14592
14593# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Pattern
1459420      string          GPAT            GIMP pattern data,
14595>24     string          x               %s
14596!:mime	image/x-gimp-pat
14597!:ext	pat
14598
14599#------------------------------------------------------------------------------
14600# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
14601#       by Spencer Kimball and Peter Mattis
14602#       ('Bucky' LaDieu, nega@vt.edu)
14603
1460420      string          GIMP            GIMP brush data
14605# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Brush
14606!:mime	image/x-gimp-gbr
14607# some sources also list gpb
14608!:ext	gbr
14609
14610# From:		Joerg Jenderek
14611# URL:		https://docs.gimp.org/en/gimp-using-animated-brushes.html
14612# Reference:	http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush
14613# share\gimp\2.0\brushes\Legacy\confetti.gih
146140	search/21/b	\040ncells:		GIMP animated brush data
14615!:mime	image/x-gimp-gih
14616!:ext	gih
14617
14618# GIMP Curves File
14619# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
146200	string	#\040GIMP\040Curves\040File	GIMP curve file
14621#!:mime	text/plain
14622!:mime	text/x-gimp-curve
14623!:ext	/txt
14624
14625
14626#------------------------------------------------------------------------------
14627# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $
14628# git:  file(1) magic for Git objects
14629
146300	string	blob\040
14631>5	regex	[0-9]+		Git blob %s
14632
146330	string	tree\040
14634>5	regex	[0-9]+		Git tree %s
14635
146360	string	commit\040
14637>7	regex	[0-9]+		Git commit %s
14638
14639#------------------------------------------------------------------------------
14640# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $
14641# glibc locale files
14642#
14643# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32
14644
146450	belong	0x20070920	glibc locale file LC_CTYPE
146460	belong	0x14110320	glibc locale file LC_NUMERIC
146470	belong	0x17110320	glibc locale file LC_TIME
146480	belong	0x17100520	glibc locale file LC_COLLATE
146490	belong	0x11110320	glibc locale file LC_MONETARY
146500	belong	0x10110320	glibc locale file LC_MESSAGES
146510	belong	0x13110320	glibc locale file LC_ALL
146520	belong	0x12110320	glibc locale file LC_PAPER
146530	belong	0x1d110320	glibc locale file LC_NAME
146540	belong	0x1c110320	glibc locale file LC_ADDRESS
146550	belong	0x1f110320	glibc locale file LC_TELEPHONE
146560	belong	0x1e110320	glibc locale file LC_MEASUREMENT
146570	belong	0x19110320	glibc locale file LC_IDENTIFICATION
14658
14659
14660#------------------------------------------------------------------------------
14661# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $
14662# GNOME related files
14663
14664# Contributed by Josh Triplett
14665# FIXME: Could be simplified if pstring supported two-byte counts
146660         string   GnomeKeyring\n\r\0\n GNOME keyring
14667>&0       ubyte    0                    \b, major version 0
14668>>&0      ubyte    0                    \b, minor version 0
14669>>>&0     ubyte    0                    \b, crypto type 0 (AES)
14670>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
14671>>>&1     ubyte    0                    \b, hash type 0 (MD5)
14672>>>&1     ubyte    >0                   \b, hash type %u (unknown)
14673>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
14674>>>&2     ubelong  !0xFFFFFFFF
14675>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
14676>>>>&-4   ubelong  <256
14677>>>>>&-1  pstring  x                    \b, name "%s"
14678>>>>>>&0  ubeqdate x                    \b, last modified %s
14679>>>>>>&8  ubeqdate x                    \b, created %s
14680>>>>>>&16 ubelong  &1
14681>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
14682>>>>>>&16 ubelong  ^1                   \b, not locked if idle
14683>>>>>>&24 ubelong  x                    \b, hash iterations %u
14684>>>>>>&28 ubequad  x                    \b, salt %llu
14685>>>>>>&52 ubelong  x                    \b, %u item(s)
14686
14687# From: Alex Beregszaszi <alex@fsn.hu>
146884	string	gtktalog		GNOME Catalogue (gtktalog)
14689>13	string	>\0			version %s
14690
14691# Summary: GStreamer binary registry
14692# Extension: .bin
14693# Submitted by: Josh Triplett <josh@joshtriplett.org>
146940	belong	0xc0def00d		GStreamer binary registry
14695>4	string	x			\b, version %s
14696
14697# GVariant Database file
14698# By Elan Ruusamae <glen@delfi.ee>
14699# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
14700# It's always "GVariant", it's byte swapped on incompatible archs
14701# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
14702# file_builder_serialise()
14703# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
147040	string	GVariant	GVariant Database file,
14705# version is never filled. probably future extension
14706>8	lelong	x		version %d
14707# not sure are these usable, so commented out
14708#>>16	lelong	x		start %d,
14709#>>>20	lelong	x		end %d
14710
14711# G-IR database made by gobject-introspect toolset,
14712# https://live.gnome.org/GObjectIntrospection
147130	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
14714>16	byte		x			\b, v%d
14715>17	byte		x			\b.%d
14716>20	leshort		x			\b, %d entries
14717>22	leshort		x			\b/%d local
14718
14719#------------------------------------------------------------------------------
14720# $File: gnu,v 1.22 2020/04/09 19:11:58 christos Exp $
14721# gnu:  file(1) magic for various GNU tools
14722#
14723# GNU nlsutils message catalog file format
14724#
14725# GNU message catalog (.mo and .gmo files)
14726
14727# Update: Joerg Jenderek
14728# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
14729# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
14730#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
14731# Note: maybe call it like "GNU translation gettext machine object"
147320	string		\336\22\4\225	GNU message catalog (little endian),
14733#0	ulelong	0x950412DE		GNU-format message catalog data
14734# TODO: write lines in such a way that code can also be called for big endian variant
14735#>0	use		gettext-object
14736#0	name		gettext-object
14737>4	ulelong		x		revision
14738!:mime	application/x-gettext-translation
14739# mo extension is also used for Easeus Partition Master PE32 executable module
14740# like ConvertFatToNTFS.mo
14741!:ext	gmo/mo
14742# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
14743# major revision
14744>4	ulelong/0xFFff	x		%u.
14745# minor revision
14746>4	ulelong&0x0000FFff	x	\b%u
14747>>8	ulelong		x		\b, %u message
14748# plural s
14749>>8	ulelong		>1		\bs
14750# size of hashing table
14751#>20	ulelong		x		\b, %u hash
14752#>20	ulelong		>1		\bes
14753#>24	ulelong		x		at 0x%x
14754# for revsion x.0 offset of table with originals is 1Ch if directly after header
14755>4	ulelong&0x0000FFff	=0
14756>>12	ulelong		!0x1C		\b, at 0x%x string table
14757# but for x.1 table offset i found is 30h. That means directly after bigger header
14758>4	ulelong&0x0000FFff	>0
14759>>12	ulelong		!0x30		\b, at 0x%x string table
14760# The following variables are only used in .mo files with minor revision >= 1
14761# number of system dependent segments
14762#>>28	ulelong		x		\b, %u segment
14763#>>28	ulelong		>1		\bs
14764# offset of table describing system dependent segments
14765#>>32	ulelong		x		at 0x%x
14766# number of system dependent strings pairs
14767>>36	ulelong		x		\b, %u sysdep message
14768>>36	ulelong		>1		\bs
14769# offset of table with start offsets of original sysdep strings
14770#>>40	ulelong		x		\b, at 0x%x sysdep strings
14771# offset of table with start offsets of translated sysdep strings
14772#>>44	ulelong		x		\b, at 0x%x sysdep translations
14773# >>(44.l)	ulelong	x		0x%x chars
14774# >>>&0		ulelong	x		at 0x%x
14775# >>>>(&-4)	string	x		"%s"
14776# string table after big header
14777#>>48	ubequad		x		\b, string table 0x%llx
14778#
14779# 0th string length seems to be always 0
14780#>(12.l)	ulelong	x		\b, %u chars
14781#>>&0		ulelong	x		at 0x%x
14782# if 1st string length positiv inspect offset and string
14783#>(12.l+8)	ulelong	>0		\b, %u chars
14784#>>&0		ulelong	x		at 0x%x
14785# if 2nd string length positiv inspect offset and string
14786# >(12.l+16)	ulelong	>0		\b, %u chars
14787# >>&0		ulelong	x		at 0x%x
14788# skip newline byte
14789#>>>(&-4)	ubyte	=0x0A
14790#>>>>&0		string	x		"%s"
14791#>>>(&-4)	ubyte	!0x0A
14792#>>>>&-1		string	x		'%s'
14793# offset of table with translation strings
14794#>16	ulelong		x		\b, at 0x%x translation table
14795# check translation 0 length and offset
14796>(16.l)		ulelong	>0
14797>>&0		ulelong	x
14798# translation 0 seems to be often Project-Id with name and version
14799>>>(&-4)	string	x		\b, %s
14800# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
14801>(16.l+8)	ulelong	>1
14802>>&0		ulelong	x
14803>>>(&-4)	ubyte	!0x0A
14804>>>>&-1		string	x		'%s'
14805# 1 New Line like in tar-1.29\po\de.gmo
14806>>>(&-4)	ubyte	=0x0A
14807>>>>&0		ubyte	!0x0A
14808>>>>>&-1	string	x		'%s'
14809# 2nd New Line like in parted-3.1\po\de.gmo
14810>>>>&0		ubyte	=0x0A
14811>>>>>&0		string	x		'%s'
14812
148130	string		\225\4\22\336	GNU message catalog (big endian),
14814#0	ubelong	0x950412DE		GNU-format message catalog data
14815!:mime	application/x-gettext-translation
14816!:ext	gmo/mo
14817# TODO: for big endian use same code as for little endian
14818#>0	use		\^gettext-object
14819# DEBUG code
14820#>16	ubelong		x		\b, at 0x%x translation table
14821#>(16.L)		ubelong	x		0x%x chars
14822#>>&0		ubelong	x		at 0x%x
14823# unexpected value HERE!
14824#>>>(&-4)	ubequad	x		0x%llx
14825#
14826>4	beshort		x		revision %d.
14827>6	beshort		>0		\b%d,
14828>>8	belong		x		%d messages,
14829>>36	belong		x		%d sysdep messages
14830>6	beshort		=0		\b%d,
14831>>8	belong		x		%d messages
14832
14833
14834# GnuPG
14835# The format is very similar to pgp
148360	string          \001gpg                 GPG key trust database
14837>4	byte            x                       version %d
14838# Note: magic.mime had 0x8501 for the next line instead of 0x8502
148390	beshort		0x8502			GPG encrypted data
14840!:mime	text/PGP # encoding: data
14841
14842# Update: Joerg Jenderek
14843# Note:	PGP and GPG use same data structure.
14844#	So recognition is now done by ./pgp with start test for byte 0x99
14845# This magic is not particularly good, as the keyrings don't have true
14846# magic. Nevertheless, it covers many keyrings.
14847# 0	ubeshort-0x9901	<2
14848# >3	byte		4
14849# >>4	bedate		x		GPG key public ring, created %s
14850# !:mime application/x-gnupg-keyring
14851
14852# Symmetric encryption
148530	leshort		0x0d8c
14854>4	leshort		0x0203
14855>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
14856>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
14857>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
14858>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
14859>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
14860>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
14861>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
14862>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
14863>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
14864>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
14865
14866
14867# GnuPG Keybox file
14868# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
14869# From: Philipp Hahn <hahn@univention.de>
148700	belong	32
14871>4	byte	1
14872>>8	string	KBXf	GPG keybox database
14873>>>5	byte	1	version %d
14874>>>16	bedate	x	\b, created-at %s
14875>>>20	bedate	x	\b, last-maintained %s
14876
14877
14878# From: James Youngman <jay@gnu.org>
14879# gnu find magic
148800	string	\0LOCATE	GNU findutils locate database data
14881>7	string	>\0		\b, format %s
14882>7	string	02		\b (frcode)
14883
14884# Files produced by GNU gettext
14885
14886# gettext message catalogue
148870	search/1024	\nmsgid
14888>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
14889!:strength +100
14890!:mime text/x-po
14891
14892#------------------------------------------------------------------------------
14893# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
14894# gnumeric:  file(1) magic for Gnumeric spreadsheet
14895# This entry is only semi-helpful, as Gnumeric compresses its files, so
14896# they will ordinarily reported as "compressed", but at least -z helps
1489739	string	=<gmr:Workbook	Gnumeric spreadsheet
14898!:mime	application/x-gnumeric
14899
14900#------------------------------------------------------------------------------
14901# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
14902#
14903# GPT Partition table patterns.
14904# Author: Rogier Goossens (goossens.rogier@gmail.com)
14905# Note that a GPT-formatted disk must contain an MBR as well.
14906#
14907
14908# The initial segment (up to >>>>>>>>422) was copied from the X86
14909# partition table code (aka MBR).
14910# This is kept separate, so that MBR partitions are not reported as well.
14911# (use -k if you do want them as well)
14912
14913# First, detect the MBR partiton table
14914# If more than one GPT protective MBR partition exists, don't print anything
14915# (the other MBR detection code will then just print the MBR partition table)
149160x1FE			leshort		0xAA55
14917>3			string		!MS
14918>>3			string		!SYSLINUX
14919>>>3			string		!MTOOL
14920>>>>3			string		!NEWLDR
14921>>>>>5			string		!DOS
14922# not FAT (32 bit)
14923>>>>>>82		string		!FAT32
14924#not Linux kernel
14925>>>>>>>514		string		!HdrS
14926#not BeOS
14927>>>>>>>>422		string		!Be\ Boot\ Loader
14928# GPT with protective MBR entry in partition 1 (only)
14929>>>>>>>>>450		ubyte		0xee
14930>>>>>>>>>>466		ubyte		!0xee
14931>>>>>>>>>>>482		ubyte		!0xee
14932>>>>>>>>>>>>498		ubyte		!0xee
14933#>>>>>>>>>>>>>446	use		gpt-mbr-partition
14934>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
14935>>>>>>>>>>>>>>0			use		gpt-mbr-type
14936>>>>>>>>>>>>>>&-8		use		gpt-table
14937>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14938>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
14939>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
14940>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14941>>>>>>>>>>>>>>>&-8		use		gpt-table
14942>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14943>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
14944>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
14945>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14946>>>>>>>>>>>>>>>>&-8		use		gpt-table
14947>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14948>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
14949>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
14950>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14951>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14952>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14953>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
14954>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
14955>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14956>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14957>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14958# GPT with protective MBR entry in partition 2 (only)
14959>>>>>>>>>450		ubyte		!0xee
14960>>>>>>>>>>466		ubyte		0xee
14961>>>>>>>>>>>482		ubyte		!0xee
14962>>>>>>>>>>>>498		ubyte		!0xee
14963#>>>>>>>>>>>>>462	use		gpt-mbr-partition
14964>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
14965>>>>>>>>>>>>>>0			use		gpt-mbr-type
14966>>>>>>>>>>>>>>&-8		use		gpt-table
14967>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14968>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
14969>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
14970>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14971>>>>>>>>>>>>>>>&-8		use		gpt-table
14972>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
14973>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
14974>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
14975>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14976>>>>>>>>>>>>>>>>&-8		use		gpt-table
14977>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
14978>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
14979>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
14980>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14981>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14982>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
14983>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
14984>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
14985>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
14986>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
14987>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
14988# GPT with protective MBR entry in partition 3 (only)
14989>>>>>>>>>450		ubyte		!0xee
14990>>>>>>>>>>466		ubyte		!0xee
14991>>>>>>>>>>>482		ubyte		0xee
14992>>>>>>>>>>>>498		ubyte		!0xee
14993#>>>>>>>>>>>>>478	use		gpt-mbr-partition
14994>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
14995>>>>>>>>>>>>>>0			use		gpt-mbr-type
14996>>>>>>>>>>>>>>&-8		use		gpt-table
14997>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
14998>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
14999>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
15000>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15001>>>>>>>>>>>>>>>&-8		use		gpt-table
15002>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15003>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
15004>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
15005>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15006>>>>>>>>>>>>>>>>&-8		use		gpt-table
15007>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15008>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
15009>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
15010>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15011>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15012>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15013>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
15014>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
15015>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15016>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15017>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15018# GPT with protective MBR entry in partition 4 (only)
15019>>>>>>>>>450		ubyte		!0xee
15020>>>>>>>>>>466		ubyte		!0xee
15021>>>>>>>>>>>482		ubyte		!0xee
15022>>>>>>>>>>>>498		ubyte		0xee
15023#>>>>>>>>>>>>>494	use		gpt-mbr-partition
15024>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
15025>>>>>>>>>>>>>>0			use		gpt-mbr-type
15026>>>>>>>>>>>>>>&-8		use		gpt-table
15027>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
15028>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
15029>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
15030>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15031>>>>>>>>>>>>>>>&-8		use		gpt-table
15032>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
15033>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
15034>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
15035>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15036>>>>>>>>>>>>>>>>&-8		use		gpt-table
15037>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
15038>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
15039>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
15040>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15041>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15042>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
15043>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
15044>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
15045>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
15046>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
15047>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
15048
15049# The following code does GPT detection and processing, including
15050# sector size detection.
15051# It has to be duplicated above because the top-level pattern
15052# (i.e. not called using 'use') must print *something* for file
15053# to count it as a match. Text only printed in named patterns is
15054# not counted, and causes file to continue, and try and match
15055# other patterns.
15056#
15057# Unfortunately, when assuming sector sizes >=16k, if the sector size
15058# happens to be 512 instead, we may find confusing data after the GPT
15059# table...  If the GPT table has less than 128 entries, this may even
15060# happen for assumed sector sizes as small as 4k
15061# This could be solved by checking for the presence of the backup GPT
15062# header as well, but that makes the logic extremely complex
15063##0		name		gpt-mbr-partition
15064##>(8.l*8192)	string		EFI\ PART
15065##>>(8.l*8192)	use		gpt-mbr-type
15066##>>&-8		use		gpt-table
15067##>>0		ubyte		x		of 8192 bytes
15068##>(8.l*8192)	string		!EFI\ PART
15069##>>(8.l*4096)	string		EFI\ PART	GPT partition table
15070##>>>0		use		gpt-mbr-type
15071##>>>&-8		use		gpt-table
15072##>>>0		ubyte		x		of 4096 bytes
15073##>>(8.l*4096)	string		!EFI\ PART
15074##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
15075##>>>>0		use		gpt-mbr-type
15076##>>>>&-8		use		gpt-table
15077##>>>>0		ubyte		x		of 2048 bytes
15078##>>>(8.l*2048)	string		!EFI\ PART
15079##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
15080##>>>>>0		use		gpt-mbr-type
15081##>>>>>&-8	use		gpt-table
15082##>>>>>0		ubyte		x		of 1024 bytes
15083##>>>>(8.l*1024)	string		!EFI\ PART
15084##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
15085##>>>>>>0		use		gpt-mbr-type
15086##>>>>>>&-8	use		gpt-table
15087##>>>>>>0		ubyte		x		of 512 bytes
15088
15089# Print details of MBR type for a GPT-disk
15090# Calling code ensures that there is only one 0xee partition.
150910		name		gpt-mbr-type
15092# GPT with protective MBR entry in partition 1
15093>450		ubyte		0xee
15094>>454		ulelong		1
15095>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15096>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
15097# GPT with protective MBR entry in partition 2
15098>466		ubyte		0xee
15099>>470		ulelong		1
15100>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
15101>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
15102>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15103>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
15104# GPT with protective MBR entry in partition 3
15105>482		ubyte		0xee
15106>>486		ulelong		1
15107>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
15108>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15109>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
15110>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
15111# GPT with protective MBR entry in partition 4
15112>498		ubyte		0xee
15113>>502		ulelong		1
15114>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
15115>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
15116
15117# Print the information from a GPT partition table structure
151180		name		gpt-table
15119>10		uleshort	x		\b, version %u
15120>8		uleshort	x		\b.%u
15121>56		ulelong		x		\b, GUID: %08x
15122>60		uleshort	x		\b-%04x
15123>62		uleshort	x		\b-%04x
15124>64		ubeshort	x		\b-%04x
15125>66		ubeshort	x		\b-%04x
15126>68		ubelong		x		\b%08x
15127#>80		uleshort	x		\b, %d partition entries
15128>32		ulequad+1	x		\b, disk size: %lld sectors
15129
15130# In case a GPT data-structure is at LBA 0, report it as well
15131# This covers systems which are not GPT-aware, and which show
15132# and allow access to the protective partition. This code will
15133# detect the contents of such a partition.
151340		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
15135>0		use		gpt-table
15136>0		ubyte		x		(sector size unknown)
15137
15138
15139
15140#------------------------------------------------------------------------------
15141# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
15142# gpu: file(1) magic for GPU input files
15143
15144# Standard Portable Intermediate Representation (SPIR)
15145# Documentation: https://www.khronos.org/spir
15146# Typical file extension: .spv
15147
151480	belong	0x07230203	Khronos SPIR-V binary, big-endian
15149>4	belong	x		\b, version 0x%08x
15150>8	belong	x		\b, generator 0x%08x
15151
151520	lelong	0x07230203      Khronos SPIR-V binary, little-endian
15153>4	lelong	x		\b, version 0x%08x
15154>8	lelong	x		\b, generator 0x%08x
15155
15156# Vulkan Trace file
15157# Documentation:
15158# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
15159# vktrace_trace_packet_identifiers.h
15160# Typical file extension: .vktrace
15161
151628	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
15163>0	leshort	x			\b, version %d
15164
151658	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
15166>0	beshort	x			\b, version %d
15167
15168#------------------------------------------------------------------------------
15169# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
15170# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
15171#
15172# ACE/gr binary
151730	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
15174>39	byte	>0			- version %c
15175# ACE/gr ascii
151760	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
151770	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
151780	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
15179# Grace projects
151800	string	#\ Grace\ project\ file		Grace project file
15181>23	string	@version\  			(version
15182>>32	byte	>0 				%c
15183>>33	string	>\0 				\b.%.2s
15184>>35	string	>\0 				\b.%.2s)
15185# ACE/gr fit description files
151860	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
15187# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
15188
15189#------------------------------------------------------------------------------
15190# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $
15191# graphviz:  file(1) magic for https://www.graphviz.org/
15192
15193# FIXME: These patterns match too generally. For example, the first
15194# line matches a LaTeX file containing the word "graph" (with a {
15195# following later) and the second line matches this file.
15196#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
15197#!:mime	text/vnd.graphviz
15198#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
15199#!:mime	text/vnd.graphviz
15200
15201#------------------------------------------------------------------------------
15202# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
15203# gringotts:  file(1) magic for Gringotts
15204# http://devel.pluto.linux.it/projects/Gringotts/
15205# author: Germano Rizzo <mano@pluto.linux.it>
15206#GRG3????Y
152070	string	GRG		Gringotts data file
15208#file format 1
15209>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
15210#file format 2
15211>3	string		2		v.2, MCRYPT S2K,
15212>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
15213>>8	byte&0x70	0x10		SERPENT crypt,
15214>>8	byte&0x70	0x20		TWOFISH crypt,
15215>>8	byte&0x70	0x30		CAST-256 crypt,
15216>>8	byte&0x70	0x40		SAFER+ crypt,
15217>>8	byte&0x70	0x50		LOKI97 crypt,
15218>>8	byte&0x70	0x60		3DES crypt,
15219>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
15220>>8	byte&0x08	0x00		SHA1 hash,
15221>>8	byte&0x08	0x08		RIPEMD-160 hash,
15222>>8	byte&0x04	0x00		ZLib
15223>>8	byte&0x04	0x04		BZip2
15224>>8	byte&0x03	0x00		lvl.0
15225>>8	byte&0x03	0x01		lvl.3
15226>>8	byte&0x03	0x02		lvl.6
15227>>8	byte&0x03	0x03		lvl.9
15228#file format 3
15229>3	string		3		v.3, OpenPGP S2K,
15230>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
15231>>8	byte&0x70	0x10		SERPENT crypt,
15232>>8	byte&0x70	0x20		TWOFISH crypt,
15233>>8	byte&0x70	0x30		CAST-256 crypt,
15234>>8	byte&0x70	0x40		SAFER+ crypt,
15235>>8	byte&0x70	0x50		LOKI97 crypt,
15236>>8	byte&0x70	0x60		3DES crypt,
15237>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
15238>>8	byte&0x08	0x00		SHA1 hash,
15239>>8	byte&0x08	0x08		RIPEMD-160 hash,
15240>>8	byte&0x04	0x00		ZLib
15241>>8	byte&0x04	0x04		BZip2
15242>>8	byte&0x03	0x00		lvl.0
15243>>8	byte&0x03	0x01		lvl.3
15244>>8	byte&0x03	0x02		lvl.6
15245>>8	byte&0x03	0x03		lvl.9
15246#file format >3
15247>3	string		>3		v.%.1s (unknown details)
15248
15249#------------------------------------------------------------------------------
15250# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $
15251# Guile file magic from <dalepsmith@gmail.com>
15252# https://www.gnu.org/s/guile/
15253# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
15254
152550	string	GOOF----	Guile Object
15256>8	string	LE		\b, little endian
15257>8	string	BE		\b, big endian
15258>11	string	4		\b, 32bit
15259>11	string	8		\b, 64bit
15260>13	regex	.\..		\b, bytecode v%s
15261
15262#------------------------------------------------------------------------------
15263# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $
15264# hardware magic
15265
15266# EDID
15267# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data
152680	string		\x00\xFF\xFF\xFF\xFF\xFF\xFF\x00
15269>19	byte		x
15270>>18	byte		x	EDID data, version %u.
15271>>19	byte		x	\b%u
15272#>>17	ubyte+1990	<255	\b, manufactured %u
15273
15274#------------------------------------------------------------------------------
15275# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $
15276# hitach-sh: file(1) magic for Hitachi Super-H
15277#
15278# Super-H COFF
15279#
15280# updated by Joerg Jenderek at Oct 2015
15281# https://en.wikipedia.org/wiki/COFF
15282# https://de.wikipedia.org/wiki/Common_Object_File_Format
15283# http://www.delorie.com/djgpp/doc/coff/filhdr.html
15284# below test line conflicts with 2nd NTFS filesystem sector
15285# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
15286# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
152870	beshort		0x0500
15288# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
15289>18	ubeshort&0x8E80	0
15290# use big endian variant of subroutine to display name+variables+flags
15291# for common object formated files
15292>>0	use				\^display-coff
15293!:strength -10
15294
152950	leshort		0x0550
15296# test for unused flag bits in f_flags
15297>18	uleshort&0x8E80	0
15298# use little endian variant of subroutine to
15299# display name+variables+flags for common object formated files
15300>>0	use				display-coff
15301!:strength -10
15302
15303
15304#------------------------------------------------------------------------------
15305# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
15306# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
15307#
15308# XXX - somebody should figure out whether any byte order needs to be
15309# applied to the "TML" stuff; I'm assuming the Apollo stuff is
15310# big-endian as it was mostly 68K-based.
15311#
15312# I think the 500 series was the old stack-based machines, running a
15313# UNIX environment atop the "SUN kernel"; dunno whether it was
15314# big-endian or little-endian.
15315#
15316# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
15317# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
15318# HP magic is useful for reference, but using "long" magic is a better
15319# practice in order to avoid collisions.
15320#
15321# Guy Harris (guy@netapp.com): some additions to this list came from
15322# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
15323# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
15324# "/etc/magic", though, except for the "archive file relocatable library"
15325# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
15326# used in executables, or have they just not yet updated "/etc/magic"
15327# completely?
15328#
15329# 0	beshort		200		hp200 (68010) BSD binary
15330# 0	beshort		300		hp300 (68020+68881) BSD binary
15331# 0	beshort		0x20c		hp200/300 HP-UX binary
15332# 0	beshort		0x20d		hp400 (68030) HP-UX binary
15333# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
15334# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
15335# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
15336# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
15337# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
15338
15339#
15340# The "misc" stuff needs a byte order; the archives look suspiciously
15341# like the old 177545 archives (0xff65 = 0177545).
15342#
15343#### Old Apollo stuff
153440	beshort		0627		Apollo m68k COFF executable
15345>18	beshort		^040000		not stripped
15346>22	beshort		>0		- version %d
153470	beshort		0624		apollo a88k COFF executable
15348>18	beshort		^040000		not stripped
15349>22	beshort		>0		- version %d
153500       long            01203604016     TML 0123 byte-order format
153510       long            01702407010     TML 1032 byte-order format
153520       long            01003405017     TML 2301 byte-order format
153530       long            01602007412     TML 3210 byte-order format
15354#### PA-RISC 1.1
153550	belong 		0x02100106	PA-RISC1.1 relocatable object
153560	belong 		0x02100107	PA-RISC1.1 executable
15357>168	belong		&0x00000004	dynamically linked
15358>(144)	belong		0x054ef630	dynamically linked
15359>96	belong		>0		- not stripped
15360
153610	belong 		0x02100108	PA-RISC1.1 shared executable
15362>168	belong&0x4	0x4		dynamically linked
15363>(144)	belong		0x054ef630	dynamically linked
15364>96	belong		>0		- not stripped
15365
153660	belong 		0x0210010b	PA-RISC1.1 demand-load executable
15367>168	belong&0x4	0x4		dynamically linked
15368>(144)	belong		0x054ef630	dynamically linked
15369>96	belong		>0		- not stripped
15370
153710	belong 		0x0210010e	PA-RISC1.1 shared library
15372>96	belong		>0		- not stripped
15373
153740	belong 		0x0210010d	PA-RISC1.1 dynamic load library
15375>96	belong		>0		- not stripped
15376
15377#### PA-RISC 2.0
153780	belong		0x02140106	PA-RISC2.0 relocatable object
15379
153800       belong		0x02140107	PA-RISC2.0 executable
15381>168	belong		&0x00000004	dynamically linked
15382>(144)	belong		0x054ef630	dynamically linked
15383>96	belong		>0		- not stripped
15384
153850       belong		0x02140108	PA-RISC2.0 shared executable
15386>168	belong		&0x00000004	dynamically linked
15387>(144)	belong		0x054ef630	dynamically linked
15388>96	belong		>0		- not stripped
15389
153900       belong		0x0214010b	PA-RISC2.0 demand-load executable
15391>168	belong		&0x00000004	dynamically linked
15392>(144)	belong		0x054ef630	dynamically linked
15393>96	belong		>0		- not stripped
15394
153950       belong		0x0214010e	PA-RISC2.0 shared library
15396>96	belong		>0		- not stripped
15397
153980       belong		0x0214010d	PA-RISC2.0 dynamic load library
15399>96	belong		>0		- not stripped
15400
15401#### 800
154020	belong 		0x020b0106	PA-RISC1.0 relocatable object
15403
154040	belong 		0x020b0107	PA-RISC1.0 executable
15405>168	belong&0x4	0x4		dynamically linked
15406>(144)	belong		0x054ef630	dynamically linked
15407>96	belong		>0		- not stripped
15408
154090	belong 		0x020b0108	PA-RISC1.0 shared executable
15410>168	belong&0x4	0x4		dynamically linked
15411>(144)	belong		0x054ef630	dynamically linked
15412>96	belong		>0		- not stripped
15413
154140	belong 		0x020b010b	PA-RISC1.0 demand-load executable
15415>168	belong&0x4	0x4		dynamically linked
15416>(144)	belong		0x054ef630	dynamically linked
15417>96	belong		>0		- not stripped
15418
154190	belong 		0x020b010e	PA-RISC1.0 shared library
15420>96	belong		>0		- not stripped
15421
154220	belong 		0x020b010d	PA-RISC1.0 dynamic load library
15423>96	belong		>0		- not stripped
15424
15425#### 500
154260	long		0x02080106	HP s500 relocatable executable
15427>16	long		>0		- version %d
15428
154290	long		0x02080107	HP s500 executable
15430>16	long		>0		- version %d
15431
154320	long		0x02080108	HP s500 pure executable
15433>16	long		>0		- version %d
15434
15435#### 200
154360	belong 		0x020c0108	HP s200 pure executable
15437>4	beshort		>0		- version %d
15438>8	belong		&0x80000000	save fp regs
15439>8	belong		&0x40000000	dynamically linked
15440>8	belong		&0x20000000	debuggable
15441>36	belong		>0		not stripped
15442
154430	belong		0x020c0107	HP s200 executable
15444>4	beshort		>0		- version %d
15445>8	belong		&0x80000000	save fp regs
15446>8	belong		&0x40000000	dynamically linked
15447>8	belong		&0x20000000	debuggable
15448>36	belong		>0		not stripped
15449
154500	belong		0x020c010b	HP s200 demand-load executable
15451>4	beshort		>0		- version %d
15452>8	belong		&0x80000000	save fp regs
15453>8	belong		&0x40000000	dynamically linked
15454>8	belong		&0x20000000	debuggable
15455>36	belong		>0		not stripped
15456
154570	belong		0x020c0106	HP s200 relocatable executable
15458>4	beshort		>0		- version %d
15459>6	beshort		>0		- highwater %d
15460>8	belong		&0x80000000	save fp regs
15461>8	belong		&0x20000000	debuggable
15462>8	belong		&0x10000000	PIC
15463
154640	belong 		0x020a0108	HP s200 (2.x release) pure executable
15465>4	beshort		>0		- version %d
15466>36	belong		>0		not stripped
15467
154680	belong		0x020a0107	HP s200 (2.x release) executable
15469>4	beshort		>0		- version %d
15470>36	belong		>0		not stripped
15471
154720	belong		0x020c010e	HP s200 shared library
15473>4	beshort		>0		- version %d
15474>6	beshort		>0		- highwater %d
15475>36	belong		>0		not stripped
15476
154770	belong		0x020c010d	HP s200 dynamic load library
15478>4	beshort		>0		- version %d
15479>6	beshort		>0		- highwater %d
15480>36	belong		>0		not stripped
15481
15482#### MISC
154830	long		0x0000ff65	HP old archive
154840	long		0x020aff65	HP s200 old archive
154850	long		0x020cff65	HP s200 old archive
154860	long		0x0208ff65	HP s500 old archive
15487
154880	long		0x015821a6	HP core file
15489
154900	long		0x4da7eee8	HP-WINDOWS font
15491>8	byte		>0		- version %d
154920	string		Bitmapfile	HP Bitmapfile
15493
154940	string		IMGfile	CIS 	compimg HP Bitmapfile
15495# XXX - see "lif"
15496#0	short		0x8000		lif file
154970	long		0x020c010c	compiled Lisp
15498
154990	string		msgcat01	HP NLS message catalog,
15500>8	long		>0		%d messages
15501
15502# Summary: HP-48/49 calculator
15503# Created by: phk@data.fls.dk
15504# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
15505# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
155060	string		HPHP		HP
15507>4	string		48		48 binary
15508>4	string		49		49 binary
15509>7	byte		>64		- Rev %c
15510>8	leshort		0x2911		(ADR)
15511>8	leshort		0x2933		(REAL)
15512>8	leshort		0x2955		(LREAL)
15513>8	leshort		0x2977		(COMPLX)
15514>8	leshort		0x299d		(LCOMPLX)
15515>8	leshort		0x29bf		(CHAR)
15516>8	leshort		0x29e8		(ARRAY)
15517>8	leshort		0x2a0a		(LNKARRAY)
15518>8	leshort		0x2a2c		(STRING)
15519>8	leshort		0x2a4e		(HXS)
15520>8	leshort		0x2a74		(LIST)
15521>8	leshort		0x2a96		(DIR)
15522>8	leshort		0x2ab8		(ALG)
15523>8	leshort		0x2ada		(UNIT)
15524>8	leshort		0x2afc		(TAGGED)
15525>8	leshort		0x2b1e		(GROB)
15526>8	leshort		0x2b40		(LIB)
15527>8	leshort		0x2b62		(BACKUP)
15528>8	leshort		0x2b88		(LIBDATA)
15529>8	leshort		0x2d9d		(PROG)
15530>8	leshort		0x2dcc		(CODE)
15531>8	leshort		0x2e48		(GNAME)
15532>8	leshort		0x2e6d		(LNAME)
15533>8	leshort		0x2e92		(XLIB)
15534
155350	string		%%HP:		HP text
15536>6	string		T(0)		- T(0)
15537>6	string		T(1)		- T(1)
15538>6	string		T(2)		- T(2)
15539>6	string		T(3)		- T(3)
15540>10	string		A(D)		A(D)
15541>10	string		A(R)		A(R)
15542>10	string		A(G)		A(G)
15543>14	string		F(.)		F(.);
15544>14	string		F(,)		F(,);
15545
15546
15547# Summary: HP-38/39 calculator
15548# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
155490	string		HP3
15550>3	string		8		HP 38
15551>3	string		9		HP 39
15552>4	string		Bin		binary
15553>4	string		Asc		ASCII
15554>7	string		A		(Directory List)
15555>7	string		B		(Zaplet)
15556>7	string		C		(Note)
15557>7	string		D		(Program)
15558>7	string		E		(Variable)
15559>7	string		F		(List)
15560>7	string		G		(Matrix)
15561>7	string		H		(Library)
15562>7	string		I		(Target List)
15563>7	string		J		(ASCII Vector specification)
15564>7	string		K		(wildcard)
15565
15566# Summary: HP-38/39 calculator
15567# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
155680	string		HP3
15569>3	string		8		HP 38
15570>3	string		9		HP 39
15571>4	string		Bin		binary
15572>4	string		Asc		ASCII
15573>7	string		A		(Directory List)
15574>7	string		B		(Zaplet)
15575>7	string		C		(Note)
15576>7	string		D		(Program)
15577>7	string		E		(Variable)
15578>7	string		F		(List)
15579>7	string		G		(Matrix)
15580>7	string		H		(Library)
15581>7	string		I		(Target List)
15582>7	string		J		(ASCII Vector specification)
15583>7	string		K		(wildcard)
15584
15585# hpBSD magic numbers
155860	beshort		200		hp200 (68010) BSD
15587>2	beshort		0407		impure binary
15588>2	beshort		0410		read-only binary
15589>2	beshort		0413		demand paged binary
155900	beshort		300		hp300 (68020+68881) BSD
15591>2	beshort		0407		impure binary
15592>2	beshort		0410		read-only binary
15593>2	beshort		0413		demand paged binary
15594#
15595# From David Gero <dgero@nortelnetworks.com>
15596# HP-UX 10.20 core file format from /usr/include/sys/core.h
15597# Unfortunately, HP-UX uses corehead blocks without specifying the order
15598# There are four we care about:
15599#     CORE_KERNEL, which starts with the string "HP-UX"
15600#     CORE_EXEC, which contains the name of the command
15601#     CORE_PROC, which contains the signal number that caused the core dump
15602#     CORE_FORMAT, which contains the version of the core file format (== 1)
15603# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
15604# but we include all 6 variations of the order of the first 3, and
15605# assume that PROC will always be last
15606# Order 1: KERNEL, EXEC, FORMAT, PROC
156070x10		string	HP-UX
15608>0		belong	2
15609>>0xC		belong	0x3C
15610>>>0x4C		belong	0x100
15611>>>>0x58	belong	0x44
15612>>>>>0xA0	belong	1
15613>>>>>>0xAC	belong	4
15614>>>>>>>0xB0	belong	1
15615>>>>>>>>0xB4	belong	4		core file
15616>>>>>>>>>0x90	string	>\0		from '%s'
15617>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15618>>>>>>>>>0xC4	belong	4		- received SIGILL
15619>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15620>>>>>>>>>0xC4	belong	6		- received SIGABRT
15621>>>>>>>>>0xC4	belong	7		- received SIGEMT
15622>>>>>>>>>0xC4	belong	8		- received SIGFPE
15623>>>>>>>>>0xC4	belong	10		- received SIGBUS
15624>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15625>>>>>>>>>0xC4	belong	12		- received SIGSYS
15626>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15627>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15628# Order 2: KERNEL, FORMAT, EXEC, PROC
15629>>>0x4C		belong	1
15630>>>>0x58	belong	4
15631>>>>>0x5C	belong	1
15632>>>>>>0x60	belong	0x100
15633>>>>>>>0x6C	belong	0x44
15634>>>>>>>>0xB4	belong	4		core file
15635>>>>>>>>>0xA4	string	>\0		from '%s'
15636>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15637>>>>>>>>>0xC4	belong	4		- received SIGILL
15638>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15639>>>>>>>>>0xC4	belong	6		- received SIGABRT
15640>>>>>>>>>0xC4	belong	7		- received SIGEMT
15641>>>>>>>>>0xC4	belong	8		- received SIGFPE
15642>>>>>>>>>0xC4	belong	10		- received SIGBUS
15643>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15644>>>>>>>>>0xC4	belong	12		- received SIGSYS
15645>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15646>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15647# Order 3: FORMAT, KERNEL, EXEC, PROC
156480x24		string	HP-UX
15649>0		belong	1
15650>>0xC		belong	4
15651>>>0x10		belong	1
15652>>>>0x14	belong	2
15653>>>>>0x20	belong	0x3C
15654>>>>>>0x60	belong	0x100
15655>>>>>>>0x6C	belong	0x44
15656>>>>>>>>0xB4	belong	4		core file
15657>>>>>>>>>0xA4	string	>\0		from '%s'
15658>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15659>>>>>>>>>0xC4	belong	4		- received SIGILL
15660>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15661>>>>>>>>>0xC4	belong	6		- received SIGABRT
15662>>>>>>>>>0xC4	belong	7		- received SIGEMT
15663>>>>>>>>>0xC4	belong	8		- received SIGFPE
15664>>>>>>>>>0xC4	belong	10		- received SIGBUS
15665>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15666>>>>>>>>>0xC4	belong	12		- received SIGSYS
15667>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15668>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15669# Order 4: EXEC, KERNEL, FORMAT, PROC
156700x64		string	HP-UX
15671>0		belong	0x100
15672>>0xC		belong	0x44
15673>>>0x54		belong	2
15674>>>>0x60	belong	0x3C
15675>>>>>0xA0	belong	1
15676>>>>>>0xAC	belong	4
15677>>>>>>>0xB0	belong	1
15678>>>>>>>>0xB4	belong	4		core file
15679>>>>>>>>>0x44	string	>\0		from '%s'
15680>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15681>>>>>>>>>0xC4	belong	4		- received SIGILL
15682>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15683>>>>>>>>>0xC4	belong	6		- received SIGABRT
15684>>>>>>>>>0xC4	belong	7		- received SIGEMT
15685>>>>>>>>>0xC4	belong	8		- received SIGFPE
15686>>>>>>>>>0xC4	belong	10		- received SIGBUS
15687>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15688>>>>>>>>>0xC4	belong	12		- received SIGSYS
15689>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15690>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15691# Order 5: FORMAT, EXEC, KERNEL, PROC
156920x78		string	HP-UX
15693>0		belong	1
15694>>0xC		belong	4
15695>>>0x10		belong	1
15696>>>>0x14	belong	0x100
15697>>>>>0x20	belong	0x44
15698>>>>>>0x68	belong	2
15699>>>>>>>0x74	belong	0x3C
15700>>>>>>>>0xB4	belong	4		core file
15701>>>>>>>>>0x58	string	>\0		from '%s'
15702>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15703>>>>>>>>>0xC4	belong	4		- received SIGILL
15704>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15705>>>>>>>>>0xC4	belong	6		- received SIGABRT
15706>>>>>>>>>0xC4	belong	7		- received SIGEMT
15707>>>>>>>>>0xC4	belong	8		- received SIGFPE
15708>>>>>>>>>0xC4	belong	10		- received SIGBUS
15709>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15710>>>>>>>>>0xC4	belong	12		- received SIGSYS
15711>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15712>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15713# Order 6: EXEC, FORMAT, KERNEL, PROC
15714>0		belong	0x100
15715>>0xC		belong	0x44
15716>>>0x54		belong	1
15717>>>>0x60	belong	4
15718>>>>>0x64	belong	1
15719>>>>>>0x68	belong	2
15720>>>>>>>0x74	belong	0x2C
15721>>>>>>>>0xB4	belong	4		core file
15722>>>>>>>>>0x44	string	>\0		from '%s'
15723>>>>>>>>>0xC4	belong	3		- received SIGQUIT
15724>>>>>>>>>0xC4	belong	4		- received SIGILL
15725>>>>>>>>>0xC4	belong	5		- received SIGTRAP
15726>>>>>>>>>0xC4	belong	6		- received SIGABRT
15727>>>>>>>>>0xC4	belong	7		- received SIGEMT
15728>>>>>>>>>0xC4	belong	8		- received SIGFPE
15729>>>>>>>>>0xC4	belong	10		- received SIGBUS
15730>>>>>>>>>0xC4	belong	11		- received SIGSEGV
15731>>>>>>>>>0xC4	belong	12		- received SIGSYS
15732>>>>>>>>>0xC4	belong	33		- received SIGXCPU
15733>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
15734
15735
15736
15737#------------------------------------------------------------------------------
15738# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
15739# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
15740# Magic too short!
15741#0		string	HU		Human68k
15742#>68		string	LZX		LZX compressed
15743#>>72		string	>\0		(version %s)
15744#>(8.L+74)	string	LZX		LZX compressed
15745#>>(8.L+78)	string	>\0		(version %s)
15746#>60		belong	>0		binded
15747#>(8.L+66)	string	#HUPAIR		hupair
15748#>0		string	HU		X executable
15749#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
15750#>4		belong	>0		- base address 0x%x
15751#>28		belong	>0		not stripped
15752#>32		belong	>0		with debug information
15753#0		beshort	0x601a		Human68k Z executable
15754#0		beshort	0x6000		Human68k object file
15755#0		belong	0xd1000000	Human68k ar binary archive
15756#0		belong	0xd1010000	Human68k ar ascii archive
15757#0		beshort	0x0068		Human68k lib archive
15758#4		string	LZX		Human68k LZX compressed
15759#>8		string	>\0		(version %s)
15760#>4		string	LZX		R executable
15761#2		string	#HUPAIR		Human68k hupair R executable
15762
15763#------------------------------------------------------------------------------
15764# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
15765# ibm370:  file(1) magic for IBM 370 and compatibles.
15766#
15767# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
15768# What the heck *is* "USS/370"?
15769# AIX 4.1's "/etc/magic" has
15770#
15771#	0	short		0535		370 sysV executable
15772#	>12	long		>0		not stripped
15773#	>22	short		>0		- version %d
15774#	>30	long		>0		- 5.2 format
15775#	0	short		0530		370 sysV pure executable
15776#	>12	long		>0		not stripped
15777#	>22	short		>0		- version %d
15778#	>30	long		>0		- 5.2 format
15779#
15780# instead of the "USS/370" versions of the same magic numbers.
15781#
157820	beshort		0537		370 XA sysV executable
15783>12	belong		>0		not stripped
15784>22	beshort		>0		- version %d
15785>30	belong		>0		- 5.2 format
157860	beshort		0532		370 XA sysV pure executable
15787>12	belong		>0		not stripped
15788>22	beshort		>0		- version %d
15789>30	belong		>0		- 5.2 format
157900	beshort		054001		370 sysV pure executable
15791>12	belong		>0		not stripped
157920	beshort		055001		370 XA sysV pure executable
15793>12	belong		>0		not stripped
157940	beshort		056401		370 sysV executable
15795>12	belong		>0		not stripped
157960	beshort		057401		370 XA sysV executable
15797>12	belong		>0		not stripped
157980       beshort		0531		SVR2 executable (Amdahl-UTS)
15799>12	belong		>0		not stripped
15800>24     belong		>0		- version %d
158010	beshort		0534		SVR2 pure executable (Amdahl-UTS)
15802>12	belong		>0		not stripped
15803>24	belong		>0		- version %d
158040	beshort		0530		SVR2 pure executable (USS/370)
15805>12	belong		>0		not stripped
15806>24	belong		>0		- version %d
158070	beshort		0535		SVR2 executable (USS/370)
15808>12	belong		>0		not stripped
15809>24	belong		>0		- version %d
15810
15811#------------------------------------------------------------------------------
15812# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $
15813# ibm6000:  file(1) magic for RS/6000 and the RT PC.
15814#
158150	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
15816>12	belong		>0		not stripped
15817# Breaks sun4 statically linked execs.
15818#0      beshort		0x0103		executable (RT Version 2) or obj module
15819#>2	byte		0x50		pure
15820#>28	belong		>0		not stripped
15821#>6	beshort		>0		- version %ld
158220	beshort		0x0104		shared library
158230	beshort		0x0105		ctab data
158240	beshort		0xfe04		structured file
158250	string		0xabcdef	AIX message catalog
158260	belong		0x000001f9	AIX compiled message catalog
158270	string		\<aiaff>	archive
158280	string		\<bigaf>	archive (big format)
158290	belong		0x09006bea	AIX backup/restore format file
158300	belong		0x09006fea	AIX backup/restore format file
15831
158320	beshort		0x01f7		64-bit XCOFF executable or object module
15833>20	belong		0		not stripped
15834# GRR: this test is still too general as it catches also many FATs of DOS filesystems
158354	belong		&0x0feeddb0
15836# real core dump could not be 32-bit and 64-bit together
15837>7	byte&0x03	!3		AIX core file
15838>>1	byte		&0x01		fulldump
15839>>7	byte		&0x01		32-bit
15840>>>0x6e0	string	>\0		\b, %s
15841>>7	byte		&0x02		64-bit
15842>>>0x524	string	>\0		\b, %s
15843
15844#------------------------------------------------------------------------------
15845# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $
15846# icc:  file(1) magic for International Color Consortium file formats
15847
15848#
15849# Color profiles as per the ICC's "Image technology colour management -
15850# Architecture, profile format, and data structure" specification.
15851# See
15852#
15853#	http://www.color.org/specification/ICC1v43_2010-12.pdf
15854#
15855# for Specification ICC.1:2010 (Profile version 4.3.0.0).
15856# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
15857# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
15858# Update: Joerg Jenderek
15859#
15860# Bytes 36 to 39 contain a generic profile file signature of "acsp";
15861# bytes 40 to 43 "may be used to identify the primary platform/operating
15862# system framework for which the profile was created".
15863#
15864#	check and display ICC/ICM color profile
158650	name	color-profile
15866>36	string		acsp
15867# skip ASCII like Cognacspirit.txt by month <= 12
15868>>26	ubeshort	<13
15869# platform/operating system. Only 5 mentioned
15870
15871#
15872# This appears to be what's used for Apple ColorSync profiles.
15873# Instead of adding that, Apple just changed the generic "acsp" entry
15874# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
15875# Management System, ICC Profile".
15876# Yes, it's "APPL", not "AAPL"; see the spec.
15877>>>40	string		APPL		ColorSync
15878
15879# Microsoft ICM color profile
15880>>>40	string		MSFT		Microsoft
15881
15882# Yes, that's a blank after "SGI".
15883>>>40	string		SGI\ 		SGI
15884
15885# XXX - is this what's used for the Sun KCMS or not?  The standard file
15886# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
15887# and there *is* an identified "primary platform" value of SUNW.
15888>>>40	string		SUNW		Sun KCMS
15889
15890# 5th platform
15891>>>40	string		TGNT		Taligent
15892
15893# remaining "l" "e" of "color profile" printed later to avoid error
15894>>>40	string		x 		color profi
15895#>>>40	string		x		(%.4s)
15896!:mime	application/vnd.iccprofile
15897# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
15898>>>8	ubyte		=2
15899# do not use empty message text to avoid error like
15900# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
15901# file.exe: could not find any valid magic files!
15902>>>>9	ubyte		!0		\ble
15903!:ext	icc/icm
15904# minor version
15905>>>>9	ubyte		=0		\bl
15906# Kodak colour management system
15907>>>>>4	string		=KCMS		\be
15908!:ext	icc/icm/cc
15909>>>>>4	string		!KCMS		\be
15910!:ext	icc/icm
15911>>>8	ubyte		!2		\ble
15912!:ext	icc
15913# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
15914>>>8	ubyte		x		%u
15915>>>9	ubyte/16	x		\b.%u
15916# reserved and shall be null but 205.205 in umx1220u.icm
15917>>>10	ubyte		>0		\b.%u
15918>>>>11	ubyte		>0		\b.%u
15919# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
15920# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
15921>>>4	string		>\ 		\b, type %.2s
15922>>>>6	string		>\  		\b%.1s
15923>>>>>7	string		>\  		\b%.1s
15924# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
15925>>>16	string		x		\b, %.3s
15926>>>19	string		>\  		\b%.1s
15927# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
15928# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
15929>>>20	string		>\0		\b/%.3s
15930>>>>23	string		>\ 		\b%.1s
15931# eleven device classes
15932>>>12	string		x		\b-%.4s device
15933# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
15934>>>52	string		>\040
15935# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
15936>>>>52	ubelong		!0x6e6f6e65
15937# device manufacturer field like "HP  " "IBM " EPSO
15938>>>>>48	string		x		\b, %.2s
15939>>>>>50	string		>\  		\b%.1s
15940>>>>>51	string		>\  		\b%.1s
15941# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
15942>>>>>52	string		>\ \  		\b/%.3s
15943>>>>>>55 string		>\  		\b%.1s
15944>>>>>52	string		x		model
15945# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
15946>>>80	string		>\0		by %.2s
15947>>>>82	string		>\  		\b%.1s
15948>>>>>83	string		>\  		\b%.1s
15949# profile size
15950>>>0	ubelong		x		\b, %u bytes
15951# skip invalid date 0 like in linearSRGB.icc
15952>>>24	ubequad		!0
15953# datetime dd-mm-yyyy hh:mm:ss
15954>>>>28	ubeshort	x		\b, %u
15955# month <= 12
15956>>>>26	ubeshort	x		\b-%u
15957# year
15958>>>>24	ubeshort	x		\b-%u
15959# do not display midnight time like in CNHP8308.ICC
15960>>>>30	ubequad&0xFFffFFffFFff0000	!0
15961# hour <= 24
15962>>>>>30	ubeshort	x		%u
15963# minutes <= 59
15964>>>>>32	ubeshort	x		\b:%.2u
15965# seconds <= 59
15966>>>>>34	ubeshort	x		\b:%.2u
15967# vendor specific flags like 2 in HPCLJ5.ICM
15968>>>44	ubeshort	>0		\b, 0x%x vendor flags
15969# profile flags bits 0-2 of least 16 used by ICC
15970#>>>44	ubelong		>0		\b, 0x%x flags
15971# icEmbeddedProfileTrue
15972>>>44	ubelong		&1		\b, embedded
15973# icEmbeddedProfileFalse
15974#>>>44	ubelong		^1		\b, not embedded
15975# icUseWithEmbeddedDataOnly
15976>>>44	ubelong		&2		\b, dependently
15977# icUseAnywhere
15978#>>>44	ubelong		^2		\b, independently
15979>>>44	ubelong		&4		\b, MCS
15980#>>>44	ubelong		^4		\b, no MCS
15981# vendor specific device attributes 1~srgb.icc
15982# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
15983>>>56	ubelong		>0		\b, 0x%x vendor attribute
15984# ICC device attributes bits 0-7 used
15985#>>>60	ubelong		x		\b, 0x%x attribute
15986# http://www.color.org/icc34.h
15987>>>60	ubelong		&0x01		\b, transparent
15988#>>>60	ubelong		^0x01		\b, reflective
15989>>>60	ubelong		&0x02		\b, matte
15990#>>>60	ubelong		^0x02		\b, glossy
15991>>>60	ubelong		&0x04		\b, negative
15992#>>>60	ubelong		^0x04		\b, positive
15993>>>60	ubelong		&0x08		\b, black&white
15994#>>>60	ubelong		^0x08		\b, colour
15995>>>60	ubelong		&0x10		\b, non-paper
15996#>>>60	ubelong		^0x10		\b, paper
15997>>>60	ubelong		&0x20		\b, non-textured
15998#>>>60	ubelong		^0x20		\b, textured
15999>>>60	ubelong		&0x40		\b, non-isotropic
16000#>>>60	ubelong		^0x40		\b, isotropic
16001>>>60	ubelong		&0x80		\b, self-luminous
16002#>>>60	ubelong		^0x80		\b, non-self-luminous
16003# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
16004>>>64	ubelong		>3		\b, 0x%x rendering intent
16005#>>>64	ubelong		=0		\b, perceptual
16006>>>64	ubelong		=1		\b, relative colorimetric
16007>>>64	ubelong		=2		\b, saturation
16008>>>64	ubelong		=3		\b, absolute colorimetric
16009# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
16010>>>71	ubequad		!0xd6000100000000d3	\b, PCS
16011# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
16012# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
16013>>>>68	ubelong			!0x0000f6d5	X=0x%x
16014# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
16015>>>>72	ubelong			!0x00010000	Y=0x%x
16016# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
16017# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
16018>>>>76	ubelong			!0x0000d32d	Z=0x%x
16019# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
16020>>>84	ubequad		>0		\b, 0x%llx MD5
16021# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
16022#>>100	ubequad		x		\b 0x%llx reserved
16023# tag table
16024# 6 <= tags count <= 43
16025#>>>128	ubelong		>43		\b, %u tags
16026>>>128	ubelong		x
16027# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
16028# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
16029>>>>132	search/508	cprt
16030# but no copyright tag in linearSRGB.icc
16031# beneath /System/Library/Frameworks/WebKit.framework/
16032# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
16033>>>>132	default		x		\b, no copyright tag
16034# 1st tag
16035#>>>132	string		x		\b, 1st tag %.4s
16036#>>>136	ubelong		x		0x%x offset
16037#>>>140	ubelong		x		0x%x len
16038# 2nd tag,...
16039# look also for profileDescriptionTag "desc"
16040>>>132	search/508	desc
16041# look further for TextDescriptionType "desc" signature
16042>>>>(&0.L)	string		=desc
16043>>>>>&4		pstring/l	x	"%s"
16044# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
16045>>>>(&0.L)	string		=mluc
16046>>>>>&(&8.L)	ubequad		x
16047>>>>>>&4	bestring16	x	'%s'
16048
16049# Any other profile.
16050# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
16051# and use "acsp" for everything else and dump the "primary platform"
16052# string in those cases?
1605336	string		acsp
16054>0	use		color-profile
16055
16056
16057
16058#------------------------------------------------------------------------------
16059# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
16060# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
16061#
16062# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
16063# Arts for file interchange.  It has also been used by Apple, SGI, and
16064# especially Commodore-Amiga.
16065#
16066# IFF files begin with an 8 byte FORM header, followed by a 4 character
16067# FORM type, which is followed by the first chunk in the FORM.
16068
160690	string		FORM		IFF data
16070#>4	belong		x		\b, FORM is %d bytes long
16071# audio formats
16072>8	string		AIFF		\b, AIFF audio
16073!:mime	audio/x-aiff
16074>8	string		AIFC		\b, AIFF-C compressed audio
16075!:mime	audio/x-aiff
16076>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
16077!:mime	audio/x-aiff
16078>8	string		16SV		\b, 16SV 16-bit sampled sound voice
16079>8	string		SAMP		\b, SAMP sampled audio
16080>8	string		MAUD		\b, MAUD MacroSystem audio
16081>8	string		SMUS		\b, SMUS simple music
16082>8	string		CMUS		\b, CMUS complex music
16083# image formats
16084>8	string		ILBMBMHD	\b, ILBM interleaved image
16085>>20	beshort		x		\b, %d x
16086>>22	beshort		x		%d
16087>8	string		RGBN		\b, RGBN 12-bit RGB image
16088>8	string		RGB8		\b, RGB8 24-bit RGB image
16089>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
16090>8	string		DR2D		\b, DR2D 2-D object
16091>8	string		TDDD		\b, TDDD 3-D rendering
16092>8	string		LWOB		\b, LWOB 3-D object
16093>8	string		LWO2		\b, LWO2 3-D object, v2
16094>8	string		LWLO		\b, LWLO 3-D layered object
16095>8	string		REAL		\b, REAL Real3D rendering
16096>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
16097>8	string		ANIM		\b, ANIM animation
16098>8	string		YAFA		\b, YAFA animation
16099>8	string		SSA\ 		\b, SSA super smooth animation
16100>8	string		ACBM		\b, ACBM continuous image
16101>8	string		FAXX		\b, FAXX fax image
16102# other formats
16103>8	string		FTXT		\b, FTXT formatted text
16104>8	string		CTLG		\b, CTLG message catalog
16105>8	string		PREF		\b, PREF preferences
16106>8	string		DTYP		\b, DTYP datatype description
16107>8	string		PTCH		\b, PTCH binary patch
16108>8	string		AMFF		\b, AMFF AmigaMetaFile format
16109>8	string		WZRD		\b, WZRD StormWIZARD resource
16110>8	string		DOC\ 		\b, DOC desktop publishing document
16111>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
16112>>24	leshort		x		%d video frames,
16113>>26	leshort		x		%d x
16114>>28	leshort		x		%d
16115>8	string		MOVE		\b, Wing Commander III Video
16116>>12	string		_PC_		\b, PC version
16117>>12	string		3DO_		\b, 3DO version
16118
16119# These go at the end of the iff rules
16120#
16121# David Griffith <dave@661.org>
16122# I don't see why these might collide with anything else.
16123#
16124# Interactive Fiction related formats
16125#
16126>8	string		IFRS		\b, Blorb Interactive Fiction
16127>>24	string		Exec		with executable chunk
16128>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
16129!:mime	application/x-blorb
16130
16131#------------------------------------------------------------------------------
16132# $File: images,v 1.183 2020/06/26 17:08:32 christos Exp $
16133# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
16134# XPM bitmaps)
16135#
16136# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
16137# additions by janl@ifi.uio.no as well as others. Jan also suggested
16138# merging several one- and two-line files into here.
16139#
16140# little magic: PCX (first byte is 0x0a)
16141
16142# Targa - matches `povray', `ppmtotga' and `xv' outputs
16143# by Philippe De Muyter <phdm@macqel.be>
16144# URL: http://justsolve.archiveteam.org/wiki/TGA
16145# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
16146# Update: Joerg Jenderek
16147# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
16148#	,32 or 33 (both not observed)
16149# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
16150#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
16151# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
16152# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
16153# `tgatoppm' recognizes a superset (Index may be anything)
16154#
16155# test of Color Map Type 0~no 1~color map
16156# and Image Type 1 2 3 9 10 11 32 33
16157# and Color Map Entry Size 0 15 16 24 32
161580	ubequad&0x00FeC400000000C0	0
16159# Conflict with MPEG sequences.
16160!:strength -40
16161# Prevent conflicts with CRI ADX.
16162>(2.S-2) belong	!0x28632943
16163# skip more garbage like *.iso by looking for positive image type
16164>2	ubyte			>0
16165# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
16166>>2	ubyte			<34
16167# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
16168>>>16	ubyte			1
16169>>>>0		use		tga-image
16170>>>16	ubyte			8
16171>>>>0		use		tga-image
16172>>>16	ubyte			15
16173>>>>0		use		tga-image
16174>>>16	ubyte			16
16175>>>>0		use		tga-image
16176>>>16	ubyte			24
16177>>>>0		use		tga-image
16178>>>16	ubyte			32
16179>>>>0		use		tga-image
16180#	display tga bitmap image information
161810	name				tga-image
16182>2	ubyte		<34		Targa image data
16183!:mime	image/x-tga
16184!:apple	????TPIC
16185# normal extension .tga but some Truevision products used others:
16186# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
16187!:ext	tga/tpic/icb/vda/vst
16188# image type 1 2 3 9 10 11 32 33
16189>2	ubyte&0xF7	1		- Map
16190>2	ubyte&0xF7	2		- RGB
16191# alpha channel
16192>>17	ubyte&0x0F	>0		\bA
16193>2	ubyte&0xF7	3		- Mono
16194# type not found, but by http://www.fileformat.info/format/tga/corion.htm
16195# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
16196>2	ubyte		32		- Color
16197# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
16198>2	ubyte		33		- Color
16199# Color Map Type 0~no 1~color map
16200>1	ubyte		1		(
16201# first color map entry, 0 normal
16202>>3	uleshort	>0		\b%d-
16203# color map length 0 2 1dh 3bh d9h 100h
16204>>5	uleshort	x		\b%d)
16205# 8~run length encoding bit
16206>2	ubyte&0x08	8		- RLE
16207# gimp can create big pictures!
16208>12	uleshort	>0		%d x
16209>12	uleshort	=0		65536 x
16210# image height. 0 interpreted as 65536
16211>14	uleshort	>0		%d
16212>14	uleshort	=0		65536
16213# Image Pixel depth 1 8 15 16 24 32
16214>16	ubyte		x		x %d
16215# X origin of image. 0 normal
16216>8	uleshort	>0		+%d
16217# Y origin of image. 0 normal; positive for top
16218>10	uleshort	>0		+%d
16219# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
16220>17	ubyte&0x0F	>0		- %d-bit alpha
16221# bits 5-4 give direction. normal bottom left
16222>17	ubyte		&0x20		- top
16223#>17	ubyte		^0x20		- bottom
16224>17	ubyte		&0x10		- right
16225#>17	ubyte		^0x10		- left
16226# some info say other bits 6-7 should be zero
16227# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
16228# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
16229#>17	ubyte&0xC0	0x00		- no interleave
16230>17	ubyte&0xC0	0x40		- interleave
16231>17	ubyte&0xC0	0x80		- four way interleave
16232>17	ubyte&0xC0	0xC0		- reserved
16233# positive length implies identification field
16234>0	ubyte		>0
16235>>18	string		x		"%s"
16236# last 18 bytes of newer tga file footer signature
16237>18	search/4261301/s	TRUEVISION-XFILE.\0
16238# extension area offset if not 0
16239>>&-8		ulelong			>0
16240# length of the extension area. normal 495 for version 2.0
16241>>>(&-4.l)	uleshort		0x01EF
16242# AuthorName[41]
16243>>>>&0		string			>\0		- author "%-.40s"
16244# Comment[324]=4 * 80 null terminated
16245>>>>&41		string			>\0		- comment "%-.80s"
16246# date
16247>>>>&365	ubequad&0xffffFFFFffff0000	!0
16248# Day
16249>>>>>&-6		uleshort		x		%d
16250# Month
16251>>>>>&-8		uleshort		x		\b-%d
16252# Year
16253>>>>>&-4		uleshort		x		\b-%d
16254# time
16255>>>>&371	ubequad&0xffffFFFFffff0000	!0
16256# hour
16257>>>>>&-8		uleshort		x		%d
16258# minutes
16259>>>>>&-6		uleshort		x		\b:%.2d
16260# second
16261>>>>>&-4		uleshort		x		\b:%.2d
16262# JobName[41]
16263>>>>&377		string			>\0		- job "%-.40s"
16264# JobHour Jobminute Jobsecond
16265>>>>&418	ubequad&0xffffFFFFffff0000	!0
16266>>>>>&-8		uleshort		x		%d
16267>>>>>&-6		uleshort		x		\b:%.2d
16268>>>>>&-4		uleshort		x		\b:%.2d
16269# SoftwareId[41]
16270>>>>&424		string			>\0		- %-.40s
16271# SoftwareVersionNumber
16272>>>>&424	ubyte				>0
16273>>>>>&40		uleshort/100		x		%d
16274>>>>>&40		uleshort%100		x		\b.%d
16275# VersionLetter
16276>>>>>&42		ubyte			>0x20		\b%c
16277# KeyColor
16278>>>>&468		ulelong			>0		- keycolor 0x%8.8x
16279# Denominator of Pixel ratio. 0~no pixel aspect
16280>>>>&474	uleshort			>0
16281# Numerator
16282>>>>>&-4		uleshort		>0		- aspect %d
16283>>>>>&-2		uleshort		x		\b/%d
16284# Denominator of Gamma ratio. 0~no Gamma value
16285>>>>&478	uleshort			>0
16286# Numerator
16287>>>>>&-4		uleshort		>0		- gamma %d
16288>>>>>&-2		uleshort		x		\b/%d
16289# ColorOffset
16290#>>>>&480	ulelong			x		- col offset 0x%8.8x
16291# StampOffset
16292#>>>>&484	ulelong			x		- stamp offset 0x%8.8x
16293# ScanOffset
16294#>>>>&488	ulelong			x		- scan offset 0x%8.8x
16295# AttributesType
16296#>>>>&492	ubyte			x		- Attributes 0x%x
16297## EndOfTGA
16298
16299# PBMPLUS images
16300# The next byte following the magic is always whitespace.
16301# strength is changed to try these patterns before "x86 boot sector"
163020	name		netpbm
16303>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
16304>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
16305>>>&0	regex		=[0-9]{1,50}			\b %s
16306
163070	search/1	P1
16308>0	regex/4		P1[\040\t\f\r\n]
16309>>0	use		netpbm
16310>>0	string		x	\b, bitmap
16311!:strength + 65
16312!:mime	image/x-portable-bitmap
16313
163140	search/1	P2
16315>0	regex/4		P2[\040\t\f\r\n]
16316>>0	use		netpbm
16317>>0	string		x	\b, greymap
16318!:strength + 65
16319!:mime	image/x-portable-greymap
16320
163210	search/1	P3
16322>0	regex/4		P3[\040\t\f\r\n]
16323>>0	use		netpbm
16324>>0	string		x	\b, pixmap
16325!:strength + 65
16326!:mime	image/x-portable-pixmap
16327
163280	string		P4
16329>0	regex/4		P4[\040\t\f\r\n]
16330>>0	use		netpbm
16331>>0	string		x	\b, rawbits, bitmap
16332!:strength + 65
16333!:mime	image/x-portable-bitmap
16334
163350	string		P5
16336>0	regex/4		P5[\040\t\f\r\n]
16337>>0	use		netpbm
16338>>0	string		x	\b, rawbits, greymap
16339!:strength + 65
16340!:mime	image/x-portable-greymap
16341
163420	string		P6
16343>0	regex/4		P6[\040\t\f\r\n]
16344>>0	use		netpbm
16345>>0	string		x	\b, rawbits, pixmap
16346!:strength + 65
16347!:mime	image/x-portable-pixmap
16348
163490	string		P7		Netpbm PAM image file
16350!:mime	image/x-portable-pixmap
16351
16352# From: bryanh@giraffe-data.com (Bryan Henderson)
163530	string		\117\072	Solitaire Image Recorder format
16354>4	string		\013		MGI Type 11
16355>4	string		\021		MGI Type 17
163560	string		.MDA		MicroDesign data
16357>21	byte		48		version 2
16358>21	byte		51		version 3
163590	string		.MDP		MicroDesign page data
16360>21	byte		48		version 2
16361>21	byte		51		version 3
16362
16363# NIFF (Navy Interchange File Format, a modification of TIFF) images
16364# [GRR:  this *must* go before TIFF]
163650	string		IIN1		NIFF image data
16366!:mime	image/x-niff
16367
16368# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
16369# (CIFF) file. These are apparently all little-endian.
16370# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16371# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
163720	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
16373!:mime	image/x-canon-crw
16374>16	leshort		x	\b, version %d.
16375>14	leshort		x	\b%d
16376
16377# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
16378# number. Put this above the TIFF test to make sure we detect them.
16379# These are apparently all little-endian.
16380# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16381# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2
163820	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
16383!:mime	image/x-canon-cr2
16384!:strength +80
16385>10	byte		x	\b, version %d.
16386>11	byte		x	\b%d
16387
16388# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
16389# The second word of TIFF files is the TIFF version number, 42, which has
16390# never changed.  The TIFF specification recommends testing for it.
163910	string		MM\x00\x2a	TIFF image data, big-endian
16392!:strength +70
16393!:mime	image/tiff
16394>(4.L)	use		\^tiff_ifd
163950	string		II\x2a\x00	TIFF image data, little-endian
16396!:mime	image/tiff
16397!:strength +70
16398>(4.l)	use		tiff_ifd
16399
164000	name		tiff_ifd
16401>0	leshort		x		\b, direntries=%d
16402>2	use		tiff_entry
16403
164040	name		tiff_entry
16405# NewSubFileType
16406>0	leshort		0xfe
16407>>12	use		tiff_entry
16408>0	leshort		0x100
16409>>4	lelong		1
16410>>>12	use		tiff_entry
16411>>>8	leshort		x		\b, width=%d
16412>0	leshort		0x101
16413>>4	lelong		1
16414>>>8	leshort		x		\b, height=%d
16415>>>12	use		tiff_entry
16416>0	leshort		0x102
16417>>8	leshort		x		\b, bps=%d
16418>>12	use		tiff_entry
16419>0	leshort		0x103
16420>>4	lelong		1		\b, compression=
16421>>>8	leshort		1		\bnone
16422>>>8	leshort		2		\bhuffman
16423>>>8	leshort		3		\bbi-level group 3
16424>>>8	leshort		4		\bbi-level group 4
16425>>>8	leshort		5		\bLZW
16426>>>8	leshort		6		\bJPEG (old)
16427>>>8	leshort		7		\bJPEG
16428>>>8	leshort		8		\bdeflate
16429>>>8	leshort		9		\bJBIG, ITU-T T.85
16430>>>8	leshort		0xa		\bJBIG, ITU-T T.43
16431>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
16432>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
16433>>>8	leshort		0x8029		\bThunderscan RLE
16434>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
16435>>>8	leshort		0x8080		\bRLE (Line Work)
16436>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
16437>>>8	leshort		0x8082		\bRLE (Binary Line Work)
16438>>>8	leshort		0x80b2		\bDeflate (PKZIP)
16439>>>8	leshort		0x80b3		\bKodak DCS
16440>>>8	leshort		0x8765		\bJBIG
16441>>>8	leshort		0x8798		\bJPEG2000
16442>>>8	leshort		0x8799		\bNikon NEF Compressed
16443>>>8	default		x
16444>>>>8	leshort		x		\b(unknown 0x%x)
16445>>>12	use		tiff_entry
16446>0	leshort		0x106		\b, PhotometricIntepretation=
16447>>8	clear		x
16448>>8	leshort		0		\bWhiteIsZero
16449>>8	leshort		1		\bBlackIsZero
16450>>8	leshort		2		\bRGB
16451>>8	leshort		3		\bRGB Palette
16452>>8	leshort		4		\bTransparency Mask
16453>>8	leshort		5		\bCMYK
16454>>8	leshort		6		\bYCbCr
16455>>8	leshort		8		\bCIELab
16456>>8	default		x
16457>>>8	leshort		x		\b(unknown=0x%x)
16458>>12	use		tiff_entry
16459# FillOrder
16460>0	leshort		0x10a
16461>>4	lelong		1
16462>>>12	use		tiff_entry
16463# DocumentName
16464>0	leshort		0x10d
16465>>(8.l)	string		x		\b, name=%s
16466>>>12	use		tiff_entry
16467# ImageDescription
16468>0	leshort		0x10e
16469>>(8.l)	string		x		\b, description=%s
16470>>>12	use		tiff_entry
16471# Make
16472>0	leshort		0x10f
16473>>(8.l)	string		x		\b, manufacturer=%s
16474>>>12	use		tiff_entry
16475# Model
16476>0	leshort		0x110
16477>>(8.l)	string		x		\b, model=%s
16478>>>12	use		tiff_entry
16479# StripOffsets
16480>0	leshort		0x111
16481>>12	use		tiff_entry
16482# Orientation
16483>0	leshort		0x112		\b, orientation=
16484>>8	leshort		1		\bupper-left
16485>>8	leshort		3		\blower-right
16486>>8	leshort		6		\bupper-right
16487>>8	leshort		8		\blower-left
16488>>8	leshort		9		\bundefined
16489>>8	default		x
16490>>>8	leshort		x		\b[*%d*]
16491>>12	use		tiff_entry
16492# XResolution
16493>0	leshort		0x11a
16494>>8	lelong		x		\b, xresolution=%d
16495>>12	use		tiff_entry
16496# YResolution
16497>0	leshort		0x11b
16498>>8	lelong		x		\b, yresolution=%d
16499>>12	use		tiff_entry
16500# ResolutionUnit
16501>0	leshort		0x128
16502>>8	leshort		x		\b, resolutionunit=%d
16503>>12	use		tiff_entry
16504# Software
16505>0	leshort		0x131
16506>>(8.l)	string		x		\b, software=%s
16507>>12	use		tiff_entry
16508# Datetime
16509>0	leshort		0x132
16510>>(8.l)	string		x		\b, datetime=%s
16511>>12	use		tiff_entry
16512# HostComputer
16513>0	leshort		0x13c
16514>>(8.l)	string		x		\b, hostcomputer=%s
16515>>12	use		tiff_entry
16516# WhitePoint
16517>0	leshort		0x13e
16518>>12	use		tiff_entry
16519# PrimaryChromaticities
16520>0	leshort		0x13f
16521>>12	use		tiff_entry
16522# YCbCrCoefficients
16523>0	leshort		0x211
16524>>12	use		tiff_entry
16525# YCbCrPositioning
16526>0	leshort		0x213
16527>>12	use		tiff_entry
16528# ReferenceBlackWhite
16529>0	leshort		0x214
16530>>12	use		tiff_entry
16531# Copyright
16532>0	leshort		0x8298
16533>>(8.l)	string		x		\b, copyright=%s
16534>>12	use		tiff_entry
16535# ExifOffset
16536>0	leshort		0x8769
16537>>12	use		tiff_entry
16538# GPS IFD
16539>0	leshort		0x8825		\b, GPS-Data
16540>>12	use		tiff_entry
16541
16542#>0	leshort		x		\b, unknown=0x%x
16543#>>12	use		tiff_entry
16544
165450	string		MM\x00\x2b	Big TIFF image data, big-endian
16546!:mime	image/tiff
165470	string		II\x2b\x00	Big TIFF image data, little-endian
16548!:mime	image/tiff
16549
16550# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
16551# (Greg Roelofs, newt@uchicago.edu)
16552# (Albert Cahalan, acahalan@cs.uml.edu)
16553#
16554# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
16555#
16556
16557# IHDR parser
165580	name		png-ihdr
16559>0	belong		x		\b, %d x
16560>4	belong		x		%d,
16561>8	byte		x		%d-bit
16562>9	byte		0		grayscale,
16563>9	byte		2		\b/color RGB,
16564>9	byte		3		colormap,
16565>9	byte		4		gray+alpha,
16566>9	byte		6		\b/color RGBA,
16567#>10	byte		0		deflate/32K,
16568>12	byte		0		non-interlaced
16569>12	byte		1		interlaced
16570
16571# Standard PNG image.
165720	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
16573!:mime	image/png
16574!:ext   png
16575!:strength +10
16576>16	use		png-ihdr
16577
16578# Apple CgBI PNG image.
165790	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
16580>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
16581!:mime	image/png
16582!:ext   png
16583!:strength +10
16584>>32	use		png-ihdr
16585
16586# possible GIF replacements; none yet released!
16587# (Greg Roelofs, newt@uchicago.edu)
16588#
16589# GRR 950115:  this was mine ("Zip GIF"):
165900	string		GIF94z		ZIF image (GIF+deflate alpha)
16591!:mime	image/x-unknown
16592#
16593# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
16594#
165950	string		FGF95a		FGF image (GIF+deflate beta)
16596!:mime	image/x-unknown
16597#
16598# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
16599# (best; not yet implemented):
16600#
166010	string		PBF		PBF image (deflate compression)
16602!:mime	image/x-unknown
16603
16604# GIF
16605# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
166060	string		GIF8		GIF image data
16607!:strength +80
16608!:mime	image/gif
16609!:apple	8BIMGIFf
16610>4	string		7a		\b, version 8%s,
16611>4	string		9a		\b, version 8%s,
16612>6	leshort		>0		%d x
16613>8	leshort		>0		%d
16614#>10	byte		&0x80		color mapped,
16615#>10	byte&0x07	=0x00		2 colors
16616#>10	byte&0x07	=0x01		4 colors
16617#>10	byte&0x07	=0x02		8 colors
16618#>10	byte&0x07	=0x03		16 colors
16619#>10	byte&0x07	=0x04		32 colors
16620#>10	byte&0x07	=0x05		64 colors
16621#>10	byte&0x07	=0x06		128 colors
16622#>10	byte&0x07	=0x07		256 colors
16623
16624# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
16625# 1 plane, no encoding.
166260	string		\361\0\100\273	CMU window manager raster image data
16627>4	lelong		>0		%d x
16628>8	lelong		>0		%d,
16629>12	lelong		>0		%d-bit
16630
16631# Magick Image File Format
16632# URL:		https://imagemagick.org/script/miff.php
16633# Reference:	http://fileformats.archiveteam.org/wiki/MIFF
16634# Update:	Joerg Jenderek
16635# http://www.nationalarchives.gov.uk/pronom/fmt/930
166360	search/256/bc	id=imagemagick
16637# skip bad ASCII text by following new line~0x0A or space~0x20 character
16638#>&0	ubyte		x		\b, next character 0x%x
16639# called by TriD ImageMagick Machine independent File Format bitmap
16640>&0	ubyte&0xD5	0		MIFF image data
16641# https://reposcope.com/mimetype/image/miff
16642#!:mime	image/miff
16643!:mime	image/x-miff
16644!:ext	miff/mif
16645# examples with standard file(1) magic
16646#>>0	string		=id=ImageMagick	with standard magic
16647# examples with unusual file(1) magic like
16648>>0	string		!id=ImageMagick	starting with
16649# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF
16650>>>0	ubyte		=0x7b		comment
16651# skip second character which is often a newline and show comment
16652>>>>2	string		x		"%s"
16653# does not start with comment, probably letters with other case like Id=ImageMagick
16654# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff
16655>>>0	ubyte		!0x7b
16656>>>>0	string		>\0		'%-.14s'
16657# URL:		https://imagemagick.org/
16658# Reference:	https://imagemagick.org/script/magick-vector-graphics.php
16659# From:		Joerg Jenderek
16660# Note:		all white-spaces between commands are ignored
166610	string		push
16662# skip some white spaces
16663>5	search/3	graphic-context	ImageMagick Vector Graphic
16664# TODO: look for dangerous commands like CVE-2016-3715
16665#!:mime	text/plain
16666!:mime	image/x-mvg
16667!:ext	mvg
16668
16669# Artisan
166700	long		1123028772	Artisan image data
16671>4	long		1		\b, rectangular 24-bit
16672>4	long		2		\b, rectangular 8-bit with colormap
16673>4	long		3		\b, rectangular 32-bit (24-bit with matte)
16674
16675# FIG (Facility for Interactive Generation of figures), an object-based format
166760	search/1	#FIG		FIG image text
16677>5	string		x		\b, version %.3s
16678
16679# PHIGS
166800	string		ARF_BEGARF		PHIGS clear text archive
166810	string		@(#)SunPHIGS		SunPHIGS
16682# version number follows, in the form m.n
16683>40	string		SunBin			binary
16684>32	string		archive			archive
16685
16686# GKS (Graphics Kernel System)
166870	string		GKSM		GKS Metafile
16688>24	string		SunGKS		\b, SunGKS
16689
16690# CGM image files
166910	string		BEGMF		clear text Computer Graphics Metafile
16692
16693# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
166940	string	yz	MGR bitmap, modern format, 8-bit aligned
166950	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
166960	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
166970	string	yx	MGR bitmap, modern format, squeezed
16698
16699# Fuzzy Bitmap (FBM) images
167000	string		%bitmap\0	FBM image data
16701>30	long		0x31		\b, mono
16702>30	long		0x33		\b, color
16703
16704# facsimile data
167051	string		PC\ Research,\ Inc	group 3 fax data
16706>29	byte		0		\b, normal resolution (204x98 DPI)
16707>29	byte		1		\b, fine resolution (204x196 DPI)
16708# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
167090	string		Sfff		structured fax file
16710
16711# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
16712# most files with the extension .EPA and some with .BMP
167130	string		\x11\x06	Award BIOS Logo, 136 x 84
16714!:mime	image/x-award-bioslogo
167150	string		\x11\x09	Award BIOS Logo, 136 x 126
16716!:mime	image/x-award-bioslogo
16717#0	string		\x07\x1f	BIOS Logo corrupted?
16718# http://www.blackfiveservices.co.uk/awbmtools.shtml
16719# http://biosgfx.narod.ru/v3/
16720# http://biosgfx.narod.ru/abr-2/
167210	string		AWBM
16722>4	leshort		<1981		Award BIOS bitmap
16723!:mime	image/x-award-bmp
16724# image width is a multiple of 4
16725>>4	leshort&0x0003	0
16726>>>4		leshort	x		\b, %d
16727>>>6		leshort	x		x %d
16728>>4	leshort&0x0003	>0		\b,
16729>>>4	leshort&0x0003	=1
16730>>>>4		leshort	x		%d+3
16731>>>4	leshort&0x0003	=2
16732>>>>4		leshort	x		%d+2
16733>>>4	leshort&0x0003	=3
16734>>>>4		leshort	x		%d+1
16735>>>6		leshort	x		x %d
16736# at offset 8 starts imagedata followed by "RGB " marker
16737
16738# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
16739# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
16740# 28bitmap_information_header.29
16741# Note:	variant starting direct with DIB header see
16742#	http://fileformats.archiveteam.org/wiki/BMP
16743#	verified by ImageMagick version 6.8.9-8 command `identify *.dib`
167440	leshort		40
16745# skip bad samples like GAME by looking for valid number of color planes
16746>12	uleshort	1		Device independent bitmap graphic
16747!:mime	image/x-ms-bmp
16748!:apple	????BMPp
16749!:ext	dib
16750>>4	lelong		x		\b, %d x
16751>>8	lelong		x		%d x
16752>>14	leshort		x		%d
16753# number of color planes (must be 1)
16754#>>12	uleshort	>1		\b, %u color planes
16755# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D
16756#>>16	ulelong		3		\b, Huffman 1D compression
16757>>16	ulelong		>0		\b, %u compression
16758# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
16759>>20	ulelong		x		\b, image size %u
16760# horizontal and vertical resolution of the image (pixel per metre, signed integer)
16761>>24	lelong		>0		\b, resolution %d x
16762>>>28	lelong		x		%d px/m
16763# number of colors in palette, or 0 to default to 2**n
16764#>>32	ulelong		>0		\b, %u colors
16765# number of important colors used, or 0 when every color is important
16766>>36	ulelong		>0		\b, %u important colors
167670	string		BM
16768>14	leshort		12		PC bitmap, OS/2 1.x format
16769!:mime	image/x-ms-bmp
16770>>18	leshort		x		\b, %d x
16771>>20	leshort		x		%d
16772>14	leshort		64		PC bitmap, OS/2 2.x format
16773!:mime	image/x-ms-bmp
16774!:apple	????BMPp
16775!:ext	bmp
16776# image width and height fields are unsigned integers for OS/2
16777>>18	ulelong		x		\b, %u x
16778>>22	ulelong		x		%u
16779# number of bits per pixel (color depth); found 1 4 8
16780>>28	uleshort	>1		x %u
16781# x, y coordinates of the hotspot
16782>>6	uleshort	>0		\b, hotspot %ux
16783>>>8	uleshort	x		\b%u
16784>>26	uleshort	>1		\b, %u color planes
16785# cbSize; size of file or headers
16786>>2	ulelong		x		\b, cbSize %u
16787#>>2	ulelong		x		\b, cbSize 0x%x
16788# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh
16789>>10	ulelong			x	\b, bits offset %u
16790#>>10	ulelong			x	\b, bits offset 0x%x
16791#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
16792# BITMAPV2INFOHEADER	adds RGB bit masks
16793>14	leshort		52		PC bitmap, Adobe Photoshop
16794!:mime	image/x-ms-bmp
16795!:apple	????BMPp
16796!:ext	bmp
16797>>18	lelong		x		\b, %d x
16798>>22	lelong		x		%d x
16799>>28	leshort		x		%d
16800# BITMAPV3INFOHEADER	adds alpha channel bit mask
16801>14	leshort		56		PC bitmap, Adobe Photoshop with alpha channel mask
16802!:mime	image/x-ms-bmp
16803!:apple	????BMPp
16804!:ext	bmp
16805>>18	lelong		x		\b, %d x
16806>>22	lelong		x		%d x
16807>>28	leshort		x		%d
16808>14	leshort		40
16809# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib
16810>>(2.l-4)	ulong	x		PC bitmap, Windows 3.x format
16811!:mime	image/x-ms-bmp
16812!:apple	????BMPp
16813>>>18	lelong		x		\b, %d x
16814>>>22	lelong		x		%d
16815# 320 x 400		https://en.wikipedia.org/wiki/LOGO.SYS
16816>>>18	ulequad		=0x0000019000000140	x
16817!:ext	bmp/sys
16818>>>18	ulequad		!0x0000019000000140
16819# compression method 2~RLE 4-bit/pixel implies also extension rle
16820>>>>30	ulelong		2		x
16821!:ext	bmp/rle
16822>>>>30	default		x		x
16823!:ext	bmp
16824# number of bits per pixel (color depth); found 1 2 4 8 16 24 32
16825>>>28	leshort		x		%d
16826# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0
16827#>>>6	uleshort	>0		\b, hotspot %ux
16828#>>>>8	uleshort	x		\b%u
16829# number of color planes (must be 1), except badplanes.bmp for testing
16830#>>>26	uleshort	>1		\b, %u color planes
16831# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks
16832#>>>30	ulelong		3		\b, Huffman 1D compression
16833>>>30	ulelong		>0		\b, %u compression
16834# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
16835>>>34	ulelong		>0		\b, image size %u
16836# horizontal and vertical resolution of the image (pixel per metre, signed integer)
16837>>>38	lelong		>0		\b, resolution %d x
16838>>>>42	lelong		x		%d px/m
16839# number of colors in palette 16 256, or 0 to default to 2**n
16840#>>>46	ulelong		>0		\b, %u colors
16841# number of important colors used, or 0 when every color is important
16842>>>50	ulelong		>0		\b, %u important colors
16843# cbSize; often size of file
16844>>>2	ulelong		x		\b, cbSize %u
16845#>>>2	ulelong		x		\b, cbSize 0x%x
16846# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h
16847>>>10	ulelong			x	\b, bits offset %u
16848#>>>10	ulelong			x	\b, bits offset 0x%x
16849#>>>(10.l) ubequad		!0	\b, bits 0x%16.16llxd
16850>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
16851!:mime	image/x-ms-bmp
16852>>18	lelong		x		\b, %d x
16853>>22	lelong		x		%d x
16854>>28	leshort		x		%d
16855>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
16856!:mime	image/x-ms-bmp
16857>>18	lelong		x		\b, %d x
16858>>22	lelong		x		%d x
16859>>28	leshort		x		%d
16860>14	leshort		128		PC bitmap, Windows NT/2000 format
16861!:mime	image/x-ms-bmp
16862>>18	lelong		x		\b, %d x
16863>>22	lelong		x		%d x
16864>>28	leshort		x		%d
16865# Update:	Joerg Jenderek
16866# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Icon
16867# Reference:	http://www.fileformat.info
16868#		/format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm
16869# Note: verified by command like `deark -l -d3 OS2MEMU.ICO`
168700	string			IC
16871# skip Lotus smart icon *.smi by looking for valid hotspot coordinates
16872>6	ulelong&0xFF00FF00	=0	OS/2 icon
16873# jump 4 bytes before end of header/file and test for accessibility
16874#>>(2.l-4) ubelong		x	End of header is OK!
16875!:mime	image/x-os2-ico
16876!:ext	ico
16877# cbSize; size of header or file in bytes like 1ah 120h 420h
16878>>2	ulelong			x	\b, cbSize %u
16879# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32
16880>>6	uleshort		x	\b, hotspot %ux
16881>>8	uleshort		x	\b%u
16882# offBits; offset in bytes to the beginning of the bit-map pel data like 20h
16883>>10	ulelong			x	\b, bits offset %u
16884#>>(10.l) ubequad		x	\b, bits 0x%16.16llx
16885#0	string		PI		PC pointer image data
16886#0	string		CI		PC color icon data
168870	string		CI
16888# test also for valid dib header sizes 12 or 64
16889>14	ulelong		<65		OS/2
16890# test also for valid hotspot coordinates
16891#>>6	ulelong&0xFE00FE00	=0	OS/2
16892!:mime	image/x-os2-ico
16893!:ext	ico
16894>>14	ulelong		12		1.x color icon
16895# image width and height fields are unsigned integers for OS/2
16896>>>18	uleshort	x		%u x
16897# stored height = 2 * real height
16898>>>20	uleshort/2	x		%u
16899# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
16900>>>24	uleshort	>1		x %u
16901# color planes; must be 1
16902#>>>22	uleshort	>1		\b, %u color planes
16903>>14	ulelong		64		2.x color icon
16904# image width and height
16905>>>18	ulelong		x		%u x
16906# stored height = 2 * real height
16907>>>22	ulelong/2	x		%u
16908# number of bits per pixel (color depth). only 1 found
16909>>>28	uleshort	>1		x %u
16910#>>>26	uleshort	>1		\b, %u color planes
16911# compression method: 0~no 3~Huffman 1D
16912>>>30	ulelong		3		\b, Huffman 1D compression
16913#>>>30	ulelong		>0		\b, %u compression
16914# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64
16915>>6	uleshort		x	\b, hotspot %ux
16916>>8	uleshort		x	\b%u
16917# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh
16918>>2	ulelong			x	\b, cbSize %u
16919#>>2	ulelong			x	\b, cbSize %x
16920# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h
16921>>10	ulelong			x	\b, bits offset %u
16922#>>10	ulelong			x	\b, bits offset 0x%x
16923#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
16924# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
16925#>>14	ulelong		x		\b, dib header size %u
16926#0	string		CP		PC color pointer image data
16927# URL:		http://fileformats.archiveteam.org/wiki/OS/2_Pointer
16928# Reference:	http://www.fileformat.info/format/os2bmp/egff.htm
169290	string		CP
16930# skip CPU-Z Report by checking for valid dib header sizes 12 or 64
16931>14	ulelong		<65		OS/2
16932# http://extension.nirsoft.net/PTR
16933!:mime	image/x-ibm-pointer
16934!:ext	ptr
16935>>14	ulelong		12		1.x color pointer
16936# image width and height fields are unsigned integers for OS/2
16937>>>18	uleshort	x		%u x
16938# stored height = 2 * real height
16939>>>20	uleshort/2	x		%u
16940# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
16941>>>24	uleshort	>1		x %u
16942# color planes; must be 1
16943#>>>22	uleshort	>1		\b, %u color planes
16944>>14	ulelong		64		2.x color pointer
16945# image width and height
16946>>>18	ulelong		x		%u x
16947# stored height = 2 * real height
16948>>>22	ulelong/2	x		%u
16949# number of bits per pixel (color depth). only 1 found
16950>>>28	uleshort	>1		x %u
16951#>>>26	uleshort	>1		\b, %u color planes
16952# compression method: 0~no 3~Huffman 1D
16953>>>30	ulelong		3		\b, Huffman 1D compression
16954#>>>30	ulelong		>0		\b, %u compression
16955# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31
16956>>6	uleshort		x	\b, hotspot %ux
16957>>8	uleshort		x	\b%u
16958# cbSize; size of header or maybe file in bytes like 1Ah 4Eh
16959>>2	ulelong			x	\b, cbSize %u
16960#>>2	ulelong			x	\b, cbSize %x
16961# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h
16962>>10	ulelong			x	\b, bits offset %u
16963#>>10	ulelong			x	\b, bits offset 0x%x
16964#>>(10.l) ubequad		!0	\b, bits 0x%16.16llx
16965# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
16966#>>14	ulelong		x		\b, dib header size %u
16967# Conflicts with other entries [BABYL]
16968# URL:	http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
16969# Note:	container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
16970#0	string		BA		PC bitmap array data
169710	string		BA
16972# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size
16973>2	ulelong		<0x004c5942	OS/2 graphic array
16974!:mime	image/x-os2-graphics
16975#!:apple	????BMPf
16976# cbSize; size of header like 28h 5Ch
16977>>2	ulelong			x	\b, cbSize %u
16978#>>2	ulelong			x	\b, cbSize 0x%x
16979# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h
16980>>6	ulelong			>0	\b, data offset %u
16981#>>6	ulelong			>0	\b, data offset 0x%x
16982#>>(6.l) ubequad		!0	\b, data 0x%16.16llx
16983# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768
16984>>10	uleshort	>0		\b, display %u
16985>>>12	uleshort	>0		x %u
16986# usType of first array element
16987#>>14	string		x		\b, usType %2.2s
16988# 1 space char after "1st"
16989# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342
16990>>14	string		BM	\b; 1st
16991!:ext	bmp/bga
16992>>14	string		CI	\b; 1st
16993!:ext	ico
16994>>14	string		CP	\b; 1st
16995!:ext	ico
16996>>14	string		IC	\b; 1st
16997!:ext	ico
16998# no white-black pointer found
16999#>>14	string		PT	\b; 1st
17000#!:ext
17001>>14	indirect	x
17002
17003# XPM icons (Greg Roelofs, newt@uchicago.edu)
170040	search/1	/*\ XPM\ */	X pixmap image text
17005!:mime	image/x-xpmi
17006
17007# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
170080	leshort		0xcc52		RLE image data,
17009>6	leshort		x		%d x
17010>8	leshort		x		%d
17011>2	leshort		>0		\b, lower left corner: %d
17012>4	leshort		>0		\b, lower right corner: %d
17013>10	byte&0x1	=0x1		\b, clear first
17014>10	byte&0x2	=0x2		\b, no background
17015>10	byte&0x4	=0x4		\b, alpha channel
17016>10	byte&0x8	=0x8		\b, comment
17017>11	byte		>0		\b, %d color channels
17018>12	byte		>0		\b, %d bits per pixel
17019>13	byte		>0		\b, %d color map channels
17020
17021# image file format (Robert Potter, potter@cs.rochester.edu)
170220	string		Imagefile\ version-	iff image data
17023# this adds the whole header (inc. version number), informative but longish
17024>10	string		>\0		%s
17025
17026# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
170270	belong		0x59a66a95	Sun raster image data
17028>4	belong		>0		\b, %d x
17029>8	belong		>0		%d,
17030>12	belong		>0		%d-bit,
17031#>16	belong		>0		%d bytes long,
17032>20	belong		0		old format,
17033#>20	belong		1		standard,
17034>20	belong		2		compressed,
17035>20	belong		3		RGB,
17036>20	belong		4		TIFF,
17037>20	belong		5		IFF,
17038>20	belong		0xffff		reserved for testing,
17039>24	belong		0		no colormap
17040>24	belong		1		RGB colormap
17041>24	belong		2		raw colormap
17042#>28	belong		>0		colormap is %d bytes long
17043
17044# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
17045#
17046# See
17047#	http://reality.sgi.com/grafica/sgiimage.html
17048#
170490	beshort		474		SGI image data
17050#>2	byte		0		\b, verbatim
17051>2	byte		1		\b, RLE
17052#>3	byte		1		\b, normal precision
17053>3	byte		2		\b, high precision
17054>4	beshort		x		\b, %d-D
17055>6	beshort		x		\b, %d x
17056>8	beshort		x		%d
17057>10	beshort		x		\b, %d channel
17058>10	beshort		!1		\bs
17059>80	string		>0		\b, "%s"
17060
170610	string		IT01		FIT image data
17062>4	belong		x		\b, %d x
17063>8	belong		x		%d x
17064>12	belong		x		%d
17065#
170660	string		IT02		FIT image data
17067>4	belong		x		\b, %d x
17068>8	belong		x		%d x
17069>12	belong		x		%d
17070#
170712048	string		PCD_IPI		Kodak Photo CD image pack file
17072>0xe02	byte&0x03	0x00		, landscape mode
17073>0xe02	byte&0x03	0x01		, portrait mode
17074>0xe02	byte&0x03	0x02		, landscape mode
17075>0xe02	byte&0x03	0x03		, portrait mode
170760	string		PCD_OPA		Kodak Photo CD overview pack file
17077
17078# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
17079# FITS is the Flexible Image Transport System, the de facto standard for
17080# data and image transfer, storage, etc., for the astronomical community.
17081# (FITS floating point formats are big-endian.)
170820	string	SIMPLE\ \ =	FITS image data
17083!:mime	image/fits
17084!:ext	fits/fts
17085>109	string	8		\b, 8-bit, character or unsigned binary integer
17086>108	string	16		\b, 16-bit, two's complement binary integer
17087>107	string	\ 32		\b, 32-bit, two's complement binary integer
17088>107	string	-32		\b, 32-bit, floating point, single precision
17089>107	string	-64		\b, 64-bit, floating point, double precision
17090
17091# other images
170920	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
17093
17094# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
17095# stuff.
17096#
170970	beshort		0x1010		PEX Binary Archive
17098
17099# DICOM medical imaging data
17100# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
17101# Note:		"dcm" is the official file name extension
17102# 		XnView mention also "dc3" and "acr" as file name extension
17103128	string	DICM			DICOM medical imaging data
17104!:mime	application/dicom
17105!:ext dcm/dicom/dic
17106
17107# XWD - X Window Dump file.
17108#   As described in /usr/X11R6/include/X11/XWDFile.h
17109#   used by the xwd program.
17110#   Bradford Castalia, idaeim, 1/01
17111#   updated by Adam Buchbinder, 2/09
17112# The following assumes version 7 of the format; the first long is the length
17113# of the header, which is at least 25 4-byte longs, and the one at offset 8
17114# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
17115# which is a maximum of 32.
171160	belong	>100
17117>8	belong	<3
17118>>12	belong	<33
17119>>>4	belong	7			XWD X Window Dump image data
17120!:mime	image/x-xwindowdump
17121>>>>100	string	>\0			\b, "%s"
17122>>>>16	belong	x			\b, %dx
17123>>>>20	belong	x			\b%dx
17124>>>>12	belong	x			\b%d
17125
17126# PDS - Planetary Data System
17127#   These files use Parameter Value Language in the header section.
17128#   Unfortunately, there is no certain magic, but the following
17129#   strings have been found to be most likely.
171300	string	NJPL1I00		PDS (JPL) image data
171312	string	NJPL1I			PDS (JPL) image data
171320	string	CCSD3ZF			PDS (CCSD) image data
171332	string	CCSD3Z			PDS (CCSD) image data
171340	string	PDS_			PDS image data
171350	string	LBLSIZE=		PDS (VICAR) image data
17136
17137# pM8x: ATARI STAD compressed bitmap format
17138#
17139# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
17140# p M 8 5/6 xx yy zz data...
17141# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
17142# bytes either run horizontally (pM85) or vertically (pM86). yy is the
17143# most frequent byte, xx and zz are runlength escape codes, where xx is
17144# used for runs of yy.
17145#
171460	string	pM85		Atari ST STAD bitmap image data (hor)
17147>5	byte	0x00		(white background)
17148>5	byte	0xFF		(black background)
171490	string	pM86		Atari ST STAD bitmap image data (vert)
17150>5	byte	0x00		(white background)
17151>5	byte	0xFF		(black background)
17152
17153# From: Alex Myczko <alex@aiei.ch>
17154# https://www.atarimax.com/jindroush.atari.org/afmtatr.html
171550	leshort	0x0296		Atari ATR image
17156
17157# XXX:
17158# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
17159# magic.
17160# SGI RICE image file <mpruett@sgi.com>
17161#0	beshort	0x5249		RICE image
17162#>2	beshort	x		v%d
17163#>4	beshort	x		(%d x
17164#>6	beshort	x		%d)
17165#>8	beshort	0		8 bit
17166#>8	beshort	1		10 bit
17167#>8	beshort	2		12 bit
17168#>8	beshort	3		13 bit
17169#>10	beshort	0		4:2:2
17170#>10	beshort	1		4:2:2:4
17171#>10	beshort	2		4:4:4
17172#>10	beshort	3		4:4:4:4
17173#>12	beshort	1		RGB
17174#>12	beshort	2		CCIR601
17175#>12	beshort	3		RP175
17176#>12	beshort	4		YUV
17177
17178# PCX image files
17179# From: Dan Fandrich <dan@coneharvesters.com>
17180# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
17181# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
17182# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
17183# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
171840	ubelong&0xffF8fe00	0x0a000000
17185# for PCX bit depth > 0
17186>3	ubyte		>0
17187# test for valid versions
17188>>1	ubyte		<6
17189>>>1	ubyte		!1	PCX
17190!:mime	image/x-pcx
17191#!:mime	image/pcx
17192>>>>1	ubyte		0	ver. 2.5 image data
17193>>>>1	ubyte		2	ver. 2.8 image data, with palette
17194>>>>1	ubyte		3	ver. 2.8 image data, without palette
17195>>>>1	ubyte		4	for Windows image data
17196>>>>1	ubyte		5	ver. 3.0 image data
17197>>>>4	uleshort	x	bounding box [%d,
17198>>>>6	uleshort	x	%d] -
17199>>>>8	uleshort	x	[%d,
17200>>>>10	uleshort	x	%d],
17201>>>>65	ubyte		>1	%d planes each of
17202>>>>3	ubyte		x	%d-bit
17203>>>>68	byte		1	colour,
17204>>>>68	byte		2	grayscale,
17205# this should not happen
17206>>>>68	default		x	image,
17207>>>>12	leshort		>0	%d x
17208>>>>>14	uleshort	x	%d dpi,
17209>>>>2	byte		0	uncompressed
17210>>>>2	byte		1	RLE compressed
17211
17212# Adobe Photoshop
17213# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
172140	string		8BPS Adobe Photoshop Image
17215!:mime	image/vnd.adobe.photoshop
17216>4   beshort 2 (PSB)
17217>18  belong  x \b, %d x
17218>14  belong  x %d,
17219>24  beshort 0 bitmap
17220>24  beshort 1 grayscale
17221>>12 beshort 2 with alpha
17222>24  beshort 2 indexed
17223>24  beshort 3 RGB
17224>>12 beshort 4 \bA
17225>24  beshort 4 CMYK
17226>>12 beshort 5 \bA
17227>24  beshort 7 multichannel
17228>24  beshort 8 duotone
17229>24  beshort 9 lab
17230>12  beshort > 1
17231>>12  beshort x \b, %dx
17232>12  beshort 1 \b,
17233>22  beshort x %d-bit channel
17234>12  beshort > 1 \bs
17235
17236# XV thumbnail indicator (ThMO)
172370	string		P7\ 332		XV thumbnail image data
17238
17239# NITF is defined by United States MIL-STD-2500A
172400	string	NITF	National Imagery Transmission Format
17241>25	string	>\0	dated %.14s
17242
17243# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
17244# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
17245# Update: Joerg Jenderek
17246# See http://fileformats.archiveteam.org/wiki/GEM_Raster
17247# For variations, also see:
17248#    https://www.seasip.info/Gem/ff_img.html (Ventura)
17249#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
17250#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
17251#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
172520       beshort     0x0001
17253# header_size
17254>2      beshort     0x0008
17255>>0     use gem_info
17256>2      beshort     0x0009
17257>>0     use gem_info
17258# no example for NOSIG
17259>2      beshort     24
17260>>0     use gem_info
17261# no example for HYPERPAINT
17262>2      beshort     25
17263>>0     use gem_info
1726416      string      XIMG\0
17265>0      use gem_info
17266# no example
1726716      string      STTT\0\x10
17268>0      use gem_info
17269# no example or description
1727016      string      TIMG\0
17271>0      use gem_info
17272
172730   name        gem_info
17274# version is 2 for some XIMG and 1 for all others
17275>0	beshort		<0x0003		GEM
17276# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
17277!:mime	image/x-gem
17278# header_size 24 25 27 59 779 words for colored bitmaps
17279>>2	beshort		>9
17280>>>16	string		STTT\0\x10	STTT
17281>>>16	string		TIMG\0		TIMG
17282# HYPERPAINT or NOSIG variant
17283>>>16	string		\0\x80
17284>>>>2	beshort		=24		NOSIG
17285>>>>2	beshort		!24		HYPERPAINT
17286# NOSIG or XIMG variant
17287>>>16	default		x
17288>>>>16	string		!XIMG\0		NOSIG
17289>>16	string		=XIMG\0		XIMG Image data
17290!:ext	img/ximg
17291# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
17292>>16	string		!XIMG\0		Image data
17293!:ext	img
17294# header_size is 9 for Ventura files and 8 for other GEM Paint files
17295>>2	beshort		9		(Ventura)
17296#>>2	beshort		8		(Paint)
17297>>12	beshort		x		%d x
17298>>14	beshort		x		%d,
17299# 1 4 8
17300>>4	beshort		x		%d planes,
17301# in tenths of a millimetre
17302>>8	beshort		x		%d x
17303>>10	beshort		x		%d pixelsize
17304# pattern_size 1-8. 2 for GEM Paint
17305>>6	beshort		!2		\b, pattern size %d
17306
17307# GEM Metafile (Wolfram Kleff)
173080	lelong		0x0018FFFF	GEM Metafile data
17309>4	leshort		x		version %d
17310
17311#
17312# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
17313# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
17314#
173150	string	\0\nSMJPEG	SMJPEG
17316>8	belong	x		%d.x data
17317# According to the specification you could find any number of _TXT
17318# headers here, but I can't think of any way of handling that. None of
17319# the SMJPEG files I tried it on used this feature. Even if such a
17320# file is encountered the output should still be reasonable.
17321>16	string	_SND		\b,
17322>>24	beshort	>0		%d Hz
17323>>26	byte	8		8-bit
17324>>26	byte	16		16-bit
17325>>28	string	NONE		uncompressed
17326# >>28	string	APCM		ADPCM compressed
17327>>27	byte	1		mono
17328>>28	byte	2		stereo
17329# Help! Isn't there any way to avoid writing this part twice?
17330>>32	string	_VID		\b,
17331# >>>48	string	JFIF		JPEG
17332>>>40	belong	>0		%d frames
17333>>>44	beshort	>0		(%d x
17334>>>46	beshort	>0		%d)
17335>16	string	_VID		\b,
17336# >>32	string	JFIF		JPEG
17337>>24	belong	>0		%d frames
17338>>28	beshort	>0		(%d x
17339>>30	beshort	>0		%d)
17340
173410	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
17342
17343# "thumbnail file" (icon)
17344# descended from "xv", but in use by other applications as well (Wolfram Kleff)
173450       string          P7\ 332         XV "thumbnail file" (icon) data
17346
17347# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
173480       string          KiSS            KISS/GS
17349>4      byte            16              color
17350>>5     byte            x               %d bit
17351>>8     leshort         x               %d colors
17352>>10    leshort         x               %d groups
17353>4      byte            32              cell
17354>>5     byte            x               %d bit
17355>>8     leshort         x               %d x
17356>>10    leshort         x               %d
17357>>12    leshort         x               +%d
17358>>14    leshort         x               +%d
17359
17360# Webshots (www.webshots.com), by John Harrison
173610       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
17362
17363# Hercules DASD image files
17364# From Jan Jaeger <jj@septa.nl>
173650       string  CKD_P370        Hercules CKD DASD image file
17366>8      long    x               \b, %d heads per cylinder
17367>12     long    x               \b, track size %d bytes
17368>16     byte    x               \b, device type 33%2.2X
17369
173700       string  CKD_C370        Hercules compressed CKD DASD image file
17371>8      long    x               \b, %d heads per cylinder
17372>12     long    x               \b, track size %d bytes
17373>16     byte    x               \b, device type 33%2.2X
17374
173750       string  CKD_S370        Hercules CKD DASD shadow file
17376>8      long    x               \b, %d heads per cylinder
17377>12     long    x               \b, track size %d bytes
17378>16     byte    x               \b, device type 33%2.2X
17379
17380# Squeak images and programs - etoffi@softhome.net
173810	string		\146\031\0\0	Squeak image data
173820	search/1	'From\040Squeak	Squeak program text
17383
17384# partimage: file(1) magic for PartImage files (experimental, incomplete)
17385# Author: Hans-Joachim Baader <hjb@pro-linux.de>
173860		string	PaRtImAgE-VoLuMe	PartImage
17387>0x0020		string	0.6.1		file version %s
17388>>0x0060	lelong	>-1		volume %d
17389#>>0x0064 8 byte identifier
17390#>>0x007c reserved
17391>>0x0200	string	>\0		type %s
17392>>0x1400	string	>\0		device %s,
17393>>0x1600	string	>\0		original filename %s,
17394# Some fields omitted
17395>>0x2744	lelong	0		not compressed
17396>>0x2744	lelong	1		gzip compressed
17397>>0x2744	lelong	2		bzip2 compressed
17398>>0x2744	lelong	>2		compressed with unknown algorithm
17399>0x0020		string	>0.6.1		file version %s
17400>0x0020		string	<0.6.1		file version %s
17401
17402# DCX is multi-page PCX, using a simple header of up to 1024
17403# offsets for the respective PCX components.
17404# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
174050	lelong	987654321	DCX multi-page PCX image data
17406
17407# Simon Walton <simonw@matteworld.com>
17408# Kodak Cineon format for scanned negatives
17409# http://www.kodak.com/US/en/motion/support/dlad/
174100	lelong  0xd75f2a80	Cineon image data
17411>200	belong  >0		\b, %d x
17412>204	belong  >0		%d
17413
17414
17415# Bio-Rad .PIC is an image format used by microscope control systems
17416# and related image processing software used by biologists.
17417# From: Vebjorn Ljosa <vebjorn@ljosa.com>
17418# BOOL values are two-byte integers; use them to rule out false positives.
17419# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
17420# Samples: https://www.loci.wisc.edu/software/sample-data
1742114	leshort <2
17422>62	leshort <2
17423>>54	leshort 12345		Bio-Rad .PIC Image File
17424>>>0	leshort >0		%d x
17425>>>2	leshort >0		%d,
17426>>>4	leshort =1		1 image in file
17427>>>4	leshort >1		%d images in file
17428
17429# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
17430# The description of *.mrw format can be found at
17431# http://www.dalibor.cz/minolta/raw_file_format.htm
174320	string	\000MRM			Minolta Dimage camera raw image data
17433
17434# Summary: DjVu image / document
17435# Extension: .djvu
17436# Reference: http://djvu.org/docs/DjVu3Spec.djvu
17437# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
17438# Modified by (1): Abel Cheung <abelcheung@gmail.com>
174390	string	AT&TFORM
17440>12	string	DJVM		DjVu multiple page document
17441!:mime	image/vnd.djvu
17442>12	string	DJVU		DjVu image or single page document
17443!:mime	image/vnd.djvu
17444>12	string	DJVI		DjVu shared document
17445!:mime	image/vnd.djvu
17446>12	string	THUM		DjVu page thumbnails
17447!:mime	image/vnd.djvu
17448
17449# Originally by Marc Espie
17450# Modified by Robert Minsk <robertminsk at yahoo.com>
17451# https://www.openexr.com/openexrfilelayout.pdf
174520	lelong		20000630	OpenEXR image data,
17453!:mime image/x-exr
17454>4	lelong&0x000000ff x		version %d,
17455>4	lelong		^0x00000200	storage: scanline
17456>4	lelong		&0x00000200	storage: tiled
17457>8	search/0x1000	compression\0	\b, compression:
17458>>&16	byte		0		none
17459>>&16	byte		1		rle
17460>>&16	byte		2		zips
17461>>&16	byte		3		zip
17462>>&16	byte		4		piz
17463>>&16	byte		5		pxr24
17464>>&16	byte		6		b44
17465>>&16	byte		7		b44a
17466>>&16	byte		8		dwaa
17467>>&16	byte		9		dwab
17468>>&16	byte		>9		unknown
17469>8	 search/0x1000	dataWindow\0	\b, dataWindow:
17470>>&10	lelong		x		(%d
17471>>&14	lelong		x		%d)-
17472>>&18	lelong		x		\b(%d
17473>>&22	lelong		x		%d)
17474>8	search/0x1000	displayWindow\0	\b, displayWindow:
17475>>&10	lelong		x		(%d
17476>>&14	lelong		x		%d)-
17477>>&18	lelong		x		\b(%d
17478>>&22	lelong		x		%d)
17479>8	search/0x1000	lineOrder\0	 \b, lineOrder:
17480>>&14	byte		0		increasing y
17481>>&14	byte		1		decreasing y
17482>>&14	byte		2		random y
17483>>&14	byte		>2		unknown
17484
17485# SMPTE Digital Picture Exchange Format, SMPTE DPX
17486#
17487# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
17488# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
17489# Robert Minsk <robertminsk at yahoo.com>
17490# Modified by Harry Mallon <hjmallon at gmail.com>
174910	string		SDPX	DPX image data, big-endian,
17492!:mime image/x-dpx
17493>0	use		dpx_info
174940	string		XPDS	DPX image data, little-endian,
17495!:mime image/x-dpx
17496>0	use		\^dpx_info
17497
174980	name		dpx_info
17499>768	beshort		<4
17500>>772	belong		x	%dx
17501>>776	belong		x	\b%d,
17502>768	beshort		>3
17503>>776	belong		x	%dx
17504>>772	belong		x	\b%d,
17505>768	beshort		0	left to right/top to bottom
17506>768	beshort		1	right to left/top to bottom
17507>768	beshort		2	left to right/bottom to top
17508>768	beshort		3	right to left/bottom to top
17509>768	beshort		4	top to bottom/left to right
17510>768	beshort		5	top to bottom/right to left
17511>768	beshort		6	bottom to top/left to right
17512>768	beshort		7	bottom to top/right to left
17513
17514# From: Tom Hilinski <tom.hilinski@comcast.net>
17515# https://www.unidata.ucar.edu/packages/netcdf/
175160	string	CDF\001			NetCDF Data Format data
17517# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications
175180	string	CDF\002			NetCDF Data Format data (64-bit offset)
17519
17520#-----------------------------------------------------------------------
17521# Hierarchical Data Format, used to facilitate scientific data exchange
17522# specifications at http://hdf.ncsa.uiuc.edu/
175230	belong	0x0e031301	Hierarchical Data Format (version 4) data
17524!:mime	application/x-hdf
175250	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
17526!:mime	application/x-hdf
17527512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
17528!:mime	application/x-hdf
175291024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
17530!:mime	application/x-hdf
175312048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
17532!:mime	application/x-hdf
175334096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
17534!:mime	application/x-hdf
17535
17536
17537# From: Tobias Burnus <burnus@net-b.de>
17538# Xara (for a while: Corel Xara) is a graphic package, see
17539# http://www.xara.com/ for Windows and as GPL application for Linux
175400	string	XARA\243\243	Xara graphics file
17541
17542# https://www.cartesianinc.com/Tech/
175430	string	CPC\262		Cartesian Perceptual Compression image
17544!:mime	image/x-cpi
17545
17546# From Albert Cahalan <acahalan@gmail.com>
17547# puredigital used it for the CVS disposable camcorder
17548#8       lelong  4       ZBM bitmap image data
17549#>4      leshort x       %u x
17550#>6      leshort x       %u
17551
17552# From Albert Cahalan <acahalan@gmail.com>
17553# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
175540       string C565     OLPC firmware icon image data
17555>4      leshort x       %u x
17556>6      leshort x       %u
17557
17558# Applied Images - Image files from Cytovision
17559# Gustavo Junior Alves <gjalves@gjalves.com.br>
175600	string	\xce\xda\xde\xfa	Cytovision Metaphases file
175610	string	\xed\xad\xef\xac	Cytovision Karyotype file
175620	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
175630	string	\xed\xfe\xda\xbe	Cytovision FLEX file
175640	string	\xed\xab\xed\xfe	Cytovision FLEX file
175650	string	\xad\xfd\xea\xad	Cytovision RATS file
17566
17567# Wavelet Scalar Quantization format used in gray-scale fingerprint images
17568# From Tano M Fotang <mfotang@quanteq.com>
175690	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
17570
17571# Type:		PCO B16 image files
17572# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
17573# From:		Florian Philipp <florian.philipp@binarywings.net>
17574# Extension:	.b16
17575# Description:	Pixel image format produced by PCO Camware, typically used
17576#		together with PCO cameras.
17577# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
17578#		Documentation is incomplete.
175790	string/b	PCO-	PCO B16 image data
17580>12	lelong		x	\b, %dx
17581>16	lelong		x	\b%d
17582>20	lelong		0	\b, short header
17583>20	lelong		-1	\b, extended header
17584>>24	lelong		0	\b, grayscale
17585>>>36	lelong		0	linear LUT
17586>>>36	lelong		1	logarithmic LUT
17587>>>28	lelong		x	[%d
17588>>>32	lelong		x	\b,%d]
17589>>24	lelong		1	\b, color
17590>>>64	lelong		0	linear LUT
17591>>>64	lelong		1	logarithmic LUT
17592>>>40	lelong		x	r[%d
17593>>>44	lelong		x	\b,%d]
17594>>>48	lelong		x	g[%d
17595>>>52	lelong		x	\b,%d]
17596>>>56	lelong		x	b[%d
17597>>>60	lelong		x	\b,%d]
17598
17599# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
17600# From: Markus Heidelberg <markus.heidelberg at web.de>
176010	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
17602!:mime	image/x-polar-monitor-bitmap
17603
17604# From: Rick Richardson <rickrich@gmail.com>
17605# updated by: Joerg Jenderek
17606# URL: http://techmods.net/nuvi/
176070	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
17608# extension is also used for
17609# Sony SRF raw image (image/x-sony-srf)
17610# SRF map
17611# Terragen Surface Map (https://www.planetside.co.uk/terragen)
17612# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro)
17613!:ext srf
17614#!:mime	image/x-garmin-srf
17615# version 1.00,2.00,2.10,2.40,2.50
17616>0x2f	string		>0		\b, version %4.4s
17617# width (2880,2881,3240)
17618>0x55	uleshort	>0		\b, %dx
17619# height (80,90)
17620>>0x53	uleshort	x		\b%d
17621
17622# Type:	Ulead Photo Explorer5 (.pe5)
17623# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
17624# From:	Simon Horman <horms@debian.org>
176250	string	IIO2H			Ulead Photo Explorer5
17626
17627# Type:	X11 cursor
17628# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
17629# From:	Mathias Brodala <info@noctus.net>
176300	string	Xcur			X11 cursor
17631
17632# Type:	Olympus ORF raw images.
17633# URL:	https://libopenraw.freedesktop.org/wiki/Olympus_ORF
17634# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
176350	string		MMOR		Olympus ORF raw image data, big-endian
17636!:mime	image/x-olympus-orf
176370	string		IIRO		Olympus ORF raw image data, little-endian
17638!:mime	image/x-olympus-orf
176390	string		IIRS		Olympus ORF raw image data, little-endian
17640!:mime	image/x-olympus-orf
17641
17642# Type: files used in modern AVCHD camcoders to store clip information
17643# Extension: .cpi
17644# From: Alexander Danilov <alexander.a.danilov@gmail.com>
176450	string	HDMV0100	AVCHD Clip Information
17646
17647# From: Adam Buchbinder <adam.buchbinder@gmail.com>
17648# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
17649# Radiance HDR; usually has .pic or .hdr extension.
176500	string	#?RADIANCE\n	Radiance HDR image data
17651#!mime	image/vnd.radiance
17652
17653# From: Adam Buchbinder <adam.buchbinder@gmail.com>
17654# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
17655# Used by the pfstools packages. The regex matches for the image size could
17656# probably use some work. The MIME type is made up; if there's one in
17657# actual common use, it should replace the one below.
176580	string	PFS1\x0a	PFS HDR image data
17659#!mime	image/x-pfs
17660>1	regex	[0-9]*\ 		\b, %s
17661>>1	regex	\ [0-9]{4}		\bx%s
17662
17663# Type: Foveon X3F
17664# URL:  https://www.photofo.com/downloads/x3f-raw-format.pdf
17665# From: Adam Buchbinder <adam.buchbinder@gmail.com>
17666# Note that the MIME type isn't defined anywhere that I can find; if
17667# there's a canonical type for this format, it should replace this one.
176680	string	FOVb	Foveon X3F raw image data
17669!:mime	image/x-x3f
17670>6	leshort	x	\b, version %d.
17671>4	leshort	x	\b%d
17672>28	lelong	x	\b, %dx
17673>32	lelong	x	\b%d
17674
17675# Paint.NET file
17676# From Adam Buchbinder <adam.buchbinder@gmail.com>
176770	string	PDN3	Paint.NET image data
17678!:mime	image/x-paintnet
17679
17680# Not really an image.
17681# From: "Tano M. Fotang" <mfotang@quanteq.com>
176820	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
17683
17684# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
17685# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1768690	bequad		0x574D50484F544F00	JPEG-XR Image
17687>98	byte&0x08	=0x08			\b, hard tiling
17688>99	byte&0x80	=0x80			\b, tiling present
17689>99	byte&0x40	=0x40			\b, codestream present
17690>99	byte&0x38	x			\b, spatial xform=
17691>99	byte&0x38	0x00			\bTL
17692>99	byte&0x38	0x08			\bBL
17693>99	byte&0x38	0x10			\bTR
17694>99	byte&0x38	0x18			\bBR
17695>99	byte&0x38	0x20			\bBT
17696>99	byte&0x38	0x28			\bRB
17697>99	byte&0x38	0x30			\bLT
17698>99	byte&0x38	0x38			\bLB
17699>100	byte&0x80	=0x80			\b, short header
17700>>102	beshort+1	x			\b, %d
17701>>104	beshort+1	x			\bx%d
17702>100	byte&0x80	=0x00			\b, long header
17703>>102	belong+1	x			\b, %x
17704>>106	belong+1	x			\bx%x
17705>101	beshort&0xf	x			\b, bitdepth=
17706>>101	beshort&0xf	0x0			\b1-WHITE=1
17707>>101	beshort&0xf	0x1			\b8
17708>>101	beshort&0xf	0x2			\b16
17709>>101	beshort&0xf	0x3			\b16-SIGNED
17710>>101	beshort&0xf	0x4			\b16-FLOAT
17711>>101	beshort&0xf	0x5			\b(reserved 5)
17712>>101	beshort&0xf	0x6			\b32-SIGNED
17713>>101	beshort&0xf	0x7			\b32-FLOAT
17714>>101	beshort&0xf	0x8			\b5
17715>>101	beshort&0xf	0x9			\b10
17716>>101	beshort&0xf	0xa			\b5-6-5
17717>>101	beshort&0xf	0xb			\b(reserved %d)
17718>>101	beshort&0xf	0xc			\b(reserved %d)
17719>>101	beshort&0xf	0xd			\b(reserved %d)
17720>>101	beshort&0xf	0xe			\b(reserved %d)
17721>>101	beshort&0xf	0xf			\b1-BLACK=1
17722>101	beshort&0xf0	x			\b, colorfmt=
17723>>101	beshort&0xf0	0x00			\bYONLY
17724>>101	beshort&0xf0	0x10			\bYUV240
17725>>101	beshort&0xf0	0x20			\bYWV422
17726>>101	beshort&0xf0	0x30			\bYWV444
17727>>101	beshort&0xf0	0x40			\bCMYK
17728>>101	beshort&0xf0	0x50			\bCMYKDIRECT
17729>>101	beshort&0xf0	0x60			\bNCOMPONENT
17730>>101	beshort&0xf0	0x70			\bRGB
17731>>101	beshort&0xf0	0x80			\bRGBE
17732>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
17733
17734# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
17735#
17736# BPG (Better Portable Graphics) format
17737# https://bellard.org/bpg/
17738# http://fileformats.archiveteam.org/wiki/BPG
17739#
177400	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
17741!:mime  image/bpg
17742
17743# From: Joerg Jenderek
17744# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
177450	string		icns		Mac OS X icon
17746!:mime	image/x-icns
17747!:apple	????icns
17748!:ext icns
17749>4	ubelong		>0
17750# file size
17751>>4	ubelong		x		\b, %d bytes
17752# icon type
17753>>8	string		x		\b, "%4.4s" type
17754
17755# TIM images
177560		lelong		0x00000010	TIM image,
17757>4		lelong  	0x8		4-Bit,
17758>4		lelong  	0x9		8-Bit,
17759>4		lelong  	0x2		15-Bit,
17760>4		lelong  	0x3		24-Bit,
17761>4		lelong 		&8
17762>>(8.l+12)	leshort		x		Pixel at (%d,
17763>>(8.l+14)	leshort		x		\b%d)
17764>>(8.l+16)	leshort		x		Size=%dx
17765>>(8.l+18)	leshort		x		\b%d,
17766>>4		lelong 		0x8		16 CLUT Entries at
17767>>4		lelong 		0x9		256 CLUT Entries at
17768>>12		leshort		x		(%d,
17769>>14		leshort		x		\b%d)
17770>4		lelong		^8
17771>>12		leshort		x		Pixel at (%d,
17772>>14		leshort		x		\b%d)
17773>>16		leshort		x		Size=%dx
17774>>18		leshort		x		\b%d
17775
17776# MDEC streams
177770		lelong		0x80010160	MDEC video stream,
17778>16		leshort		x		%dx
17779>18		leshort		x		\b%d
17780#>8		lelong		x		%d frames
17781#>4		leshort		x		secCount=%d;
17782#>6		leshort		x		nSectors=%d;
17783#>12		lelong		x		frameSize=%d;
17784
17785# BS encoded bitstreams
177862		leshort		0x3800		BS image,
17787>6		leshort		x		Version %d,
17788>4		leshort		x		Quantization %d,
17789>0		leshort		x		(Decompresses to %d words)
17790
17791# Type: farbfeld image.
17792# Url: http://tools.suckless.org/farbfeld/
17793# From: Ian D. Scott <ian@iandouglasscott.com>
17794#
177950		string		farbfeld	farbfeld image data,
17796>8		ubelong		x		%dx
17797>12		ubelong		x		\b%d
17798
17799# Type: Microsoft DirectDraw Surface (common data)
17800# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
17801# From: Morten Hustveit <morten@debian.org>
17802# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
178030	name	ms-directdraw-surface
17804>0x10	ulelong	x			%u x
17805>0x0C	ulelong	x			%u
17806# Color depth.
17807>0x58	ulelong	>0			\b, %u-bit color
17808# Determine the pixel format.
17809>0x50	ulelong&0x4	4
17810# FIXME: Handle DX10 and XBOX formats.
17811>>0x54	string	x			\b, compressed using %.4s
17812>0x50	ulelong&0x2	0x2		\b, alpha only
17813>0x50	ulelong&0x200	0x200		\b, YUV
17814>0x50	ulelong&0x20000	0x20000		\b, luminance
17815# RGB pixel format
17816>0x50	ulelong&0x40	0x40
17817
17818# Determine the RGB format using the color masks.
17819# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB
17820
17821>>0x58		ulelong	16
17822
17823# NOTE: 15-bit color formats usually have 16-bit listed as the color depth.
17824>>>0x5C		ulequad	0x000003E000007C00
17825>>>>0x64	ulequad 0x000000000000001F	\b, RGB555
17826>>>0x5C		ulequad	0x000003E000001F00
17827>>>>0x64	ulequad 0x000000000000007C	\b, BGR555
17828
17829>>>0x5C		ulequad	0x000007E00000F800
17830>>>>0x64	ulequad 0x000000000000001F	\b, RGB565
17831>>>0x5C		ulequad	0x000007E000001F00
17832>>>>0x64	ulequad 0x00000000000000F8	\b, BGR565
17833
17834>>>0x5C		ulequad	0x000000F000000F00
17835>>>>0x64	ulequad 0x0000F0000000000F	\b, ARGB4444
17836>>>0x5C		ulequad	0x000000F00000000F
17837>>>>0x64	ulequad 0x0000F00000000F00	\b, ABGR4444
17838
17839>>>0x5C		ulequad	0x00000F000000F000
17840>>>>0x64	ulequad 0x0000000F000000F0	\b, RGBA4444
17841>>>0x5C		ulequad	0x00000F00000000F0
17842>>>>0x64	ulequad 0x0000000F0000F000	\b, BGRA4444
17843
17844>>>0x5C		ulequad	0x000000F000000F00
17845>>>>0x64	ulequad 0x000000000000000F	\b, xRGB4444
17846>>>0x5C		ulequad	0x000000F00000000F
17847>>>>0x64	ulequad 0x0000000000000F00	\b, xBGR4444
17848
17849>>>0x5C		ulequad	0x00000F000000F000
17850>>>>0x64	ulequad 0x00000000000000F0	\b, RGBx4444
17851>>>0x5C		ulequad	0x00000F00000000F0
17852>>>>0x64	ulequad 0x000000000000F000	\b, BGRx4444
17853
17854>>>0x5C		ulequad	0x000003E000007C00
17855>>>>0x64	ulequad 0x000080000000001F	\b, ARGB1555
17856>>>0x5C		ulequad	0x000003E000001F00
17857>>>>0x64	ulequad 0x000080000000007C	\b, ABGR1555
17858>>>0x5C		ulequad	0x000007C00000F800
17859>>>>0x64	ulequad 0x000000010000003E	\b, RGBA5551
17860>>>0x5C		ulequad	0x000007C00000003E
17861>>>>0x64	ulequad 0x000000010000F800	\b, BGRA5551
17862
17863>>88		ulelong 24
17864>>>0x5C		ulequad	0x0000FF0000FF0000
17865>>>>0x64	ulequad 0x00000000000000FF	\b, RGB888
17866>>>0x5C		ulequad	0x0000FF00000000FF
17867>>>>0x64	ulequad 0x0000000000FF0000	\b, BGR888
17868
17869>>88		ulelong 32
17870>>>0x5C		ulequad	0x0000FF0000FF0000
17871>>>>0x64	ulequad 0xFF000000000000FF	\b, ARGB8888
17872>>>0x5C		ulequad	0x0000FF00000000FF
17873>>>>0x64	ulequad 0xFF00000000FF0000	\b, ABGR8888
17874
17875>>>0x5C		ulequad	0x00FF0000FF000000
17876>>>>0x64	ulequad 0x000000FF0000FF00	\b, RGBA8888
17877>>>0x5C		ulequad	0x00FF00000000FF00
17878>>>>0x64	ulequad 0x000000FFFF000000	\b, BGBA8888
17879
17880>>>0x5C		ulequad	0x0000FF0000FF0000
17881>>>>0x64	ulequad 0x00000000000000FF	\b, xRGB8888
17882>>>0x5C		ulequad	0x0000FF00000000FF
17883>>>>0x64	ulequad 0x0000000000FF0000	\b, xBGR8888
17884
17885>>>0x5C		ulequad	0x00FF0000FF000000
17886>>>>0x64	ulequad 0x000000000000FF00	\b, RGBx8888
17887>>>0x5C		ulequad	0x00FF00000000FF00
17888>>>>0x64	ulequad 0x00000000FF000000	\b, BGBx8888
17889
17890# Less common 32-bit color formats.
17891>>>0x5C		ulequad	0xFFFF00000000FFFF
17892>>>>0x64	ulequad 0x0000000000000000	\b, G16R16
17893>>>0x5C		ulequad	0x0000FFFFFFFF0000
17894>>>>0x64	ulequad 0x0000000000000000	\b, R16G16
17895
17896>>>0x5C		ulequad	0x000FFC003FF00000
17897>>>>0x64	ulequad 0xC0000000000003FF	\b, A2R10G10B10
17898>>>0x5C		ulequad	0x000FFC00000003FF
17899>>>>0x64	ulequad 0xC00000003FF00000	\b, A2B10G10R10
17900
17901# Type: Microsoft DirectDraw Surface
17902# URL:	https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
17903# From: Morten Hustveit <morten@debian.org>
17904# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
179050	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
17906>0	use	ms-directdraw-surface
17907
17908# Type: Sega PVR image.
17909# From: David Korth <gerbilsoft@gerbilsoft.com>
17910# References:
17911# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
17912# - https://github.com/yazgoo/pvrx2png
17913# - https://github.com/nickworonekin/puyotools
17914
17915# Sega PVR header.
179160	name	sega-pvr-image-header
17917>0x0C	leshort	x	%u x
17918>0x0E	leshort	x	%u
17919# Image format.
17920>0x08	byte	0	\b, ARGB1555
17921>0x08	byte	1	\b, RGB565
17922>0x08	byte	2	\b, ARGB4444
17923>0x08	byte	3	\b, YUV442
17924>0x08	byte	4	\b, Bump
17925>0x08	byte	5	\b, 4bpp
17926>0x08	byte	6	\b, 8bpp
17927# Image data type.
17928>0x09	byte	0x01	\b, square twiddled
17929>0x09	byte	0x02	\b, square twiddled & mipmap
17930>0x09	byte	0x03	\b, VQ
17931>0x09	byte	0x04	\b, VQ & mipmap
17932>0x09	byte	0x05	\b, 8-bit CLUT twiddled
17933>0x09	byte	0x06	\b, 4-bit CLUT twiddled
17934>0x09	byte	0x07	\b, 8-bit direct twiddled
17935>0x09	byte	0x08	\b, 4-bit direct twiddled
17936>0x09	byte	0x09	\b, rectangle
17937>0x09	byte	0x0B	\b, rectangular stride
17938>0x09	byte	0x0D	\b, rectangular twiddled
17939>0x09	byte	0x10	\b, small VQ
17940>0x09	byte	0x11	\b, small VQ & mipmap
17941>0x09	byte	0x12	\b, square twiddled & mipmap
17942
17943# Sega PVR image.
179440	string	PVRT
17945>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
17946>>0x20	use	ms-directdraw-surface
17947>0x10	belong	!0x44445320		Sega PVR image:
17948>>0	use	sega-pvr-image-header
17949
17950# Sega PVR image with GBIX.
179510	string	GBIX
17952>0x10	string	PVRT
17953>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
17954>>>0x20	use	ms-directdraw-surface
17955>>0x10	belong	!0x44445320		Sega PVR image:
17956>>>0x10	use	sega-pvr-image-header
17957>>0x08	lelong	x	\b, global index = %u
17958
17959# Sega GVR header.
179600	name	sega-gvr-image-header
17961>0x0C	beshort	x	%u x
17962>0x0E	beshort	x	%u
17963# Image data format.
17964>0x0B	byte	0	\b, I4
17965>0x0B	byte	1	\b, I8
17966>0x0B	byte	2	\b, IA4
17967>0x0B	byte	3	\b, IA8
17968>0x0B	byte	4	\b, RGB565
17969>0x0B	byte	5	\b, RGB5A3
17970>0x0B	byte	6	\b, ARGB8888
17971>0x0B	byte	8	\b, CI4
17972>0x0B	byte	9	\b, CI8
17973>0x0B	byte	14	\b, DXT1
17974
17975# Sega GVR image.
179760	string	GVRT	Sega GVR image:
17977>0x10	use	sega-gvr-image-header
17978
17979# Sega GVR image with GBIX.
179800	string	GBIX
17981>0x10	string	GVRT	Sega GVR image:
17982>>0x10	use	sega-gvr-image-header
17983>>0x08	belong	x	\b, global index = %u
17984
17985# Sega GVR image with GCIX. (Wii)
179860	string	GCIX
17987>0x10	string	GVRT	Sega GVR image:
17988>>0x10	use	sega-gvr-image-header
17989>>0x08	belong	x	\b, global index = %u
17990
17991# Light Field Picture
17992# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
17993# Typical file extensions: .lfp .lfr .lfx
17994
179950	belong	0x894C4650
17996>4	belong	0x0D0A1A0A
17997>12	belong	0x00000000	Lytro Light Field Picture
17998>8	belong	x		\b, version %d
17999
18000# Type: Vision Research Phantom CINE Format
18001# URL: https://www.phantomhighspeed.com/
18002# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
18003# From: Harry Mallon <hjmallon at gmail.com>
18004#
18005# This has a short "CI" code but the 44 is the size of the struct which is
18006# stable
180070	string	CI
18008>2	leshort 44		Vision Research CINE Video,
18009>>4	leshort	0		Grayscale,
18010>>4	leshort 1		JPEG Compressed,
18011>>4	leshort 2		RAW,
18012>>6	leshort x		version %d,
18013>>20	lelong	x		%d frames,
18014>>48	lelong	x		%dx
18015>>52	lelong	x		\b%d
18016
18017# Type: ARRI Raw Image
18018# Info: SMPTE RDD30:2014
18019# From: Harry Mallon <hjmallon at gmail.com>
180200	string ARRI		ARRI ARI image data,
18021>4	lelong 0x78563412	little-endian,
18022>4 	lelong 0x12345678	big-endian,
18023>12	lelong x		version %d,
18024>20	lelong x 		%dx
18025>24	lelong x		\b%d
18026
18027# Type: Khronos KTX texture.
18028# From: David Korth <gerbilsoft@gerbilsoft.com>
18029# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
18030
18031# glEnum decoding.
18032# NOTE: Only the most common formats are listed here.
180330	name	khronos-ktx-glEnum
18034>0	lelong	0x1907	\b, RGB
18035>0	lelong	0x1908	\b, RGBA
18036>0	lelong	0x1909	\b, LUMINANCE
18037>0	lelong	0x190A	\b, LUMINANCE_ALPHA
18038>0	lelong	0x80E1	\b, BGR
18039>0	lelong	0x80E2	\b, BGRA
18040>0	lelong	0x83A0	\b, RGB_S3TC
18041>0	lelong	0x83A1	\b, RGB4_S3TC
18042>0	lelong	0x83A2	\b, RGBA_S3TC
18043>0	lelong	0x83A3	\b, RGBA4_S3TC
18044>0	lelong	0x83A4	\b, RGBA_DXT5_S3TC
18045>0	lelong	0x83A5	\b, RGBA4_DXT5_S3TC
18046>0	lelong	0x83F0	\b, COMPRESSED_RGB_S3TC_DXT1_EXT
18047>0	lelong	0x83F1	\b, COMPRESSED_RGBA_S3TC_DXT1_EXT
18048>0	lelong	0x83F2	\b, COMPRESSED_RGBA_S3TC_DXT3_EXT
18049>0	lelong	0x83F3	\b, COMPRESSED_RGBA_S3TC_DXT5_EXT
18050>0	lelong	0x8D64	\b, ETC1_RGB8_OES
18051>0	lelong	0x9270	\b, COMPRESSED_R11_EAC
18052>0	lelong	0x9271	\b, COMPRESSED_SIGNED_R11_EAC
18053>0	lelong	0x9272	\b, COMPRESSED_RG11_EAC
18054>0	lelong	0x9273	\b, COMPRESSED_SIGNED_RG11_EAC
18055>0	lelong	0x9274	\b, COMPRESSED_RGB8_ETC2
18056>0	lelong	0x9275	\b, COMPRESSED_SRGB8_ETC2
18057>0	lelong	0x9276	\b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2
18058>0	lelong	0x9277	\b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2
18059>0	lelong	0x9278	\b, COMPRESSED_RGBA2_ETC2_EAC
18060>0	lelong	0x9279	\b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC
18061>0	lelong	0x93B0	\b, COMPRESSED_RGBA_ASTC_4x4_KHR
18062>0	lelong	0x93B1	\b, COMPRESSED_RGBA_ASTC_5x4_KHR
18063>0	lelong	0x93B2	\b, COMPRESSED_RGBA_ASTC_5x5_KHR
18064>0	lelong	0x93B3	\b, COMPRESSED_RGBA_ASTC_6x5_KHR
18065>0	lelong	0x93B4	\b, COMPRESSED_RGBA_ASTC_6x6_KHR
18066>0	lelong	0x93B5	\b, COMPRESSED_RGBA_ASTC_8x5_KHR
18067>0	lelong	0x93B6	\b, COMPRESSED_RGBA_ASTC_8x6_KHR
18068>0	lelong	0x93B7	\b, COMPRESSED_RGBA_ASTC_8x8_KHR
18069>0	lelong	0x93B8	\b, COMPRESSED_RGBA_ASTC_10x5_KHR
18070>0	lelong	0x93B9	\b, COMPRESSED_RGBA_ASTC_10x6_KHR
18071>0	lelong	0x93BA	\b, COMPRESSED_RGBA_ASTC_10x8_KHR
18072>0	lelong	0x93BB	\b, COMPRESSED_RGBA_ASTC_10x10_KHR
18073>0	lelong	0x93BC	\b, COMPRESSED_RGBA_ASTC_12x10_KHR
18074>0	lelong	0x93BD	\b, COMPRESSED_RGBA_ASTC_12x12_KHR
18075>0	lelong	0x93D0	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR
18076>0	lelong	0x93D1	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR
18077>0	lelong	0x93D2	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR
18078>0	lelong	0x93D3	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR
18079>0	lelong	0x93D4	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR
18080>0	lelong	0x93D5	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR
18081>0	lelong	0x93D6	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR
18082>0	lelong	0x93D7	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR
18083>0	lelong	0x93D8	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR
18084>0	lelong	0x93D9	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR
18085>0	lelong	0x93DA	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR
18086>0	lelong	0x93DB	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR
18087>0	lelong	0x93DC	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR
18088>0	lelong	0x93DD	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR
18089
18090# Endian-specific KTX header.
18091# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE)
180920	name	khronos-ktx-endian-header
18093>20	lelong	x	\b, %u
18094>24	lelong	>1	x %u
18095>28	lelong	>1	x %u
18096>8	lelong	>0
18097>>8	use	khronos-ktx-glEnum
18098>8	lelong	0
18099>>12	use	khronos-ktx-glEnum
18100
18101# Main KTX header.
18102# Determine endianness, then check the rest of the header.
181030	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
18104>12	lelong	0x04030201			(little-endian)
18105>>16	use	khronos-ktx-endian-header
18106>12	belong	0x04030201			(big-endian)
18107>>16	use	\^khronos-ktx-endian-header
18108
18109# Type: Khronos KTX2 texture.
18110# From: David Korth <gerbilsoft@gerbilsoft.com>
18111# Based on draft19.
18112# Reference: http://github.khronos.org/KTX-Specification/
18113
18114# Supercompression enum.
181150	name	khronos-ktx2-supercompression
18116>0	lelong	1	Basis Universal
18117>0	lelong	2	Zstandard
18118
18119# Vulkan format identifier.
18120# NOTE: Formats prohibited from KTX2 are commented out.
181210	name	khronos-ktx2-vkFormat
18122>0	lelong	0	UNDEFINED
18123>0	lelong	1	R4G4_UNORM_PACK8
18124>0	lelong	2	R4G4B4A4_UNORM_PACK16
18125>0	lelong	3	B4G4R4A4_UNORM_PACK16
18126>0	lelong	4	R5G6B5_UNORM_PACK16
18127>0	lelong	5	B5G6R5_UNORM_PACK16
18128>0	lelong	6	R5G5B5A1_UNORM_PACK16
18129>0	lelong	7	B5G5R5A1_UNORM_PACK16
18130>0	lelong	8	A1R5G5B5_UNORM_PACK16
18131>0	lelong	9	R8_UNORM
18132>0	lelong	10	R8_SNORM
18133#>0	lelong	11	R8_USCALED
18134#>0	lelong	12	R8_SSCALED
18135>0	lelong	13	R8_UINT
18136>0	lelong	14	R8_SINT
18137>0	lelong	15	R8_SRGB
18138>0	lelong	16	R8G8_UNORM
18139>0	lelong	17	R8G8_SNORM
18140#>0	lelong	18	R8G8_USCALED
18141#>0	lelong	19	R8G8_SSCALED
18142>0	lelong	20	R8G8_UINT
18143>0	lelong	21	R8G8_SINT
18144>0	lelong	22	R8G8_SRGB
18145>0	lelong	23	R8G8B8_UNORM
18146>0	lelong	24	R8G8B8_SNORM
18147#>0	lelong	25	R8G8B8_USCALED
18148#>0	lelong	26	R8G8B8_SSCALED
18149>0	lelong	27	R8G8B8_UINT
18150>0	lelong	28	R8G8B8_SINT
18151>0	lelong	29	R8G8B8_SRGB
18152>0	lelong	30	B8G8R8_UNORM
18153>0	lelong	31	B8G8R8_SNORM
18154#>0	lelong	32	B8G8R8_USCALED
18155#>0	lelong	33	B8G8R8_SSCALED
18156>0	lelong	34	B8G8R8_UINT
18157>0	lelong	35	B8G8R8_SINT
18158>0	lelong	36	B8G8R8_SRGB
18159>0	lelong	37	R8G8B8A8_UNORM
18160>0	lelong	38	R8G8B8A8_SNORM
18161#>0	lelong	39	R8G8B8A8_USCALED
18162#>0	lelong	40	R8G8B8A8_SSCALED
18163>0	lelong	41	R8G8B8A8_UINT
18164>0	lelong	42	R8G8B8A8_SINT
18165>0	lelong	43	R8G8B8A8_SRGB
18166>0	lelong	44	B8G8R8A8_UNORM
18167>0	lelong	45	B8G8R8A8_SNORM
18168#>0	lelong	46	B8G8R8A8_USCALED
18169#>0	lelong	47	B8G8R8A8_SSCALED
18170>0	lelong	48	B8G8R8A8_UINT
18171>0	lelong	49	B8G8R8A8_SINT
18172>0	lelong	50	B8G8R8A8_SRGB
18173#>0	lelong	51	A8B8G8R8_UNORM_PACK32
18174#>0	lelong	52	A8B8G8R8_SNORM_PACK32
18175#>0	lelong	53	A8B8G8R8_USCALED_PACK32
18176#>0	lelong	54	A8B8G8R8_SSCALED_PACK32
18177#>0	lelong	55	A8B8G8R8_UINT_PACK32
18178#>0	lelong	56	A8B8G8R8_SINT_PACK32
18179#>0	lelong	57	A8B8G8R8_SRGB_PACK32
18180>0	lelong	58	A2R10G10B10_UNORM_PACK32
18181>0	lelong	59	A2R10G10B10_SNORM_PACK32
18182#>0	lelong	60	A2R10G10B10_USCALED_PACK32
18183#>0	lelong	61	A2R10G10B10_SSCALED_PACK32
18184>0	lelong	62	A2R10G10B10_UINT_PACK32
18185>0	lelong	63	A2R10G10B10_SINT_PACK32
18186>0	lelong	64	A2B10G10R10_UNORM_PACK32
18187>0	lelong	65	A2B10G10R10_SNORM_PACK32
18188#>0	lelong	66	A2B10G10R10_USCALED_PACK32
18189#>0	lelong	67	A2B10G10R10_SSCALED_PACK32
18190>0	lelong	68	A2B10G10R10_UINT_PACK32
18191>0	lelong	69	A2B10G10R10_SINT_PACK32
18192>0	lelong	70	R16_UNORM
18193>0	lelong	71	R16_SNORM
18194#>0	lelong	72	R16_USCALED
18195#>0	lelong	73	R16_SSCALED
18196>0	lelong	74	R16_UINT
18197>0	lelong	75	R16_SINT
18198>0	lelong	76	R16_SFLOAT
18199>0	lelong	77	R16G16_UNORM
18200>0	lelong	78	R16G16_SNORM
18201#>0	lelong	79	R16G16_USCALED
18202#>0	lelong	80	R16G16_SSCALED
18203>0	lelong	81	R16G16_UINT
18204>0	lelong	82	R16G16_SINT
18205>0	lelong	83	R16G16_SFLOAT
18206>0	lelong	84	R16G16B16_UNORM
18207>0	lelong	85	R16G16B16_SNORM
18208#>0	lelong	86	R16G16B16_USCALED
18209#>0	lelong	87	R16G16B16_SSCALED
18210>0	lelong	88	R16G16B16_UINT
18211>0	lelong	89	R16G16B16_SINT
18212>0	lelong	90	R16G16B16_SFLOAT
18213>0	lelong	91	R16G16B16A16_UNORM
18214>0	lelong	92	R16G16B16A16_SNORM
18215#>0	lelong	93	R16G16B16A16_USCALED
18216#>0	lelong	94	R16G16B16A16_SSCALED
18217>0	lelong	95	R16G16B16A16_UINT
18218>0	lelong	96	R16G16B16A16_SINT
18219>0	lelong	97	R16G16B16A16_SFLOAT
18220>0	lelong	98	R32_UINT
18221>0	lelong	99	R32_SINT
18222>0	lelong	100	R32_SFLOAT
18223>0	lelong	101	R32G32_UINT
18224>0	lelong	102	R32G32_SINT
18225>0	lelong	103	R32G32_SFLOAT
18226>0	lelong	104	R32G32B32_UINT
18227>0	lelong	105	R32G32B32_SINT
18228>0	lelong	106	R32G32B32_SFLOAT
18229>0	lelong	107	R32G32B32A32_UINT
18230>0	lelong	108	R32G32B32A32_SINT
18231>0	lelong	109	R32G32B32A32_SFLOAT
18232>0	lelong	110	R64_UINT
18233>0	lelong	111	R64_SINT
18234>0	lelong	112	R64_SFLOAT
18235>0	lelong	113	R64G64_UINT
18236>0	lelong	114	R64G64_SINT
18237>0	lelong	115	R64G64_SFLOAT
18238>0	lelong	116	R64G64B64_UINT
18239>0	lelong	117	R64G64B64_SINT
18240>0	lelong	118	R64G64B64_SFLOAT
18241>0	lelong	119	R64G64B64A64_UINT
18242>0	lelong	120	R64G64B64A64_SINT
18243>0	lelong	121	R64G64B64A64_SFLOAT
18244>0	lelong	122	B10G11R11_UFLOAT_PACK32
18245>0	lelong	123	E5B9G9R9_UFLOAT_PACK32
18246>0	lelong	124	D16_UNORM
18247>0	lelong	125	X8_D24_UNORM_PACK32
18248>0	lelong	126	D32_SFLOAT
18249>0	lelong	127	S8_UINT
18250>0	lelong	128	D16_UNORM_S8_UINT
18251>0	lelong	129	D24_UNORM_S8_UINT
18252>0	lelong	130	D32_SFLOAT_S8_UINT
18253
18254>0	lelong	131	BC1_RGB_UNORM_BLOCK
18255>0	lelong	132	BC1_RGB_SRGB_BLOCK
18256>0	lelong	133	BC1_RGBA_UNORM_BLOCK
18257>0	lelong	134	BC1_RGBA_SRGB_BLOCK
18258>0	lelong	135	BC2_UNORM_BLOCK
18259>0	lelong	136	BC2_SRGB_BLOCK
18260>0	lelong	137	BC3_UNORM_BLOCK
18261>0	lelong	138	BC3_SRGB_BLOCK
18262>0	lelong	139	BC4_UNORM_BLOCK
18263>0	lelong	140	BC4_SNORM_BLOCK
18264>0	lelong	141	BC5_UNORM_BLOCK
18265>0	lelong	142	BC5_SNORM_BLOCK
18266>0	lelong	143	BC6H_UFLOAT_BLOCK
18267>0	lelong	144	BC6H_SFLOAT_BLOCK
18268>0	lelong	145	BC7_UNORM_BLOCK
18269>0	lelong	146	BC7_SRGB_BLOCK
18270
18271>0	lelong	147	ETC2_R8G8B8_UNORM_BLOCK
18272>0	lelong	148	ETC2_R8G8B8_SRGB_BLOCK
18273>0	lelong	149	ETC2_R8G8B8A1_UNORM_BLOCK
18274>0	lelong	150	ETC2_R8G8B8A1_SRGB_BLOCK
18275>0	lelong	151	ETC2_R8G8B8A8_UNORM_BLOCK
18276>0	lelong	152	ETC2_R8G8B8A8_SRGB_BLOCK
18277
18278>0	lelong	153	EAC_R11_UNORM_BLOCK
18279>0	lelong	154	EAC_R11_SNORM_BLOCK
18280>0	lelong	155	EAC_R11G11_UNORM_BLOCK
18281>0	lelong	156	EAC_R11G11_SNORM_BLOCK
18282
18283>0	lelong	157	ASTC_4x4_UNORM_BLOCK
18284>0	lelong	158	ASTC_4x4_SRGB_BLOCK
18285>0	lelong	159	ASTC_5x4_UNORM_BLOCK
18286>0	lelong	160	ASTC_5x4_SRGB_BLOCK
18287>0	lelong	161	ASTC_5x5_UNORM_BLOCK
18288>0	lelong	162	ASTC_5x5_SRGB_BLOCK
18289>0	lelong	163	ASTC_6x5_UNORM_BLOCK
18290>0	lelong	164	ASTC_6x5_SRGB_BLOCK
18291>0	lelong	165	ASTC_6x6_UNORM_BLOCK
18292>0	lelong	166	ASTC_6x6_SRGB_BLOCK
18293>0	lelong	167	ASTC_8x5_UNORM_BLOCK
18294>0	lelong	168	ASTC_8x5_SRGB_BLOCK
18295>0	lelong	169	ASTC_8x6_UNORM_BLOCK
18296>0	lelong	170	ASTC_8x6_SRGB_BLOCK
18297>0	lelong	171	ASTC_8x8_UNORM_BLOCK
18298>0	lelong	172	ASTC_8x8_SRGB_BLOCK
18299>0	lelong	173	ASTC_10x5_UNORM_BLOCK
18300>0	lelong	174	ASTC_10x5_SRGB_BLOCK
18301>0	lelong	175	ASTC_10x6_UNORM_BLOCK
18302>0	lelong	176	ASTC_10x6_SRGB_BLOCK
18303>0	lelong	177	ASTC_10x8_UNORM_BLOCK
18304>0	lelong	178	ASTC_10x8_SRGB_BLOCK
18305>0	lelong	179	ASTC_10x10_UNORM_BLOCK
18306>0	lelong	180	ASTC_10x10_SRGB_BLOCK
18307>0	lelong	181	ASTC_12x10_UNORM_BLOCK
18308>0	lelong	182	ASTC_12x10_SRGB_BLOCK
18309>0	lelong	183	ASTC_12x12_UNORM_BLOCK
18310>0	lelong	184	ASTC_12x12_SRGB_BLOCK
18311
18312>0	lelong	1000156000	G8B8G8R8_422_UNORM
18313>0	lelong	1000156001	B8G8R8G8_422_UNORM
18314>0	lelong	1000156002	G8_B8_R8_3PLANE_420_UNORM
18315>0	lelong	1000156003	G8_B8R8_2PLANE_420_UNORM
18316>0	lelong	1000156004	G8_B8_R8_3PLANE_422_UNORM
18317>0	lelong	1000156005	G8_B8R8_2PLANE_422_UNORM
18318>0	lelong	1000156006	G8_B8_R8_3PLANE_444_UNORM
18319>0	lelong	1000156007	R10X6_UNORM_PACK16
18320>0	lelong	1000156008	R10X6G10X6_UNORM_2PACK16
18321>0	lelong	1000156009	R10X6G10X6B10X6A10X6_UNORM_4PACK16
18322>0	lelong	1000156010	G10X6B10X6G10X6R10X6_422_UNORM_4PACK16
18323>0	lelong	1000156011	B10X6G10X6R10X6G10X6_422_UNORM_4PACK16
18324>0	lelong	1000156012	G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16
18325>0	lelong	1000156013	G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16
18326>0	lelong	1000156014	G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16
18327>0	lelong	1000156015	G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16
18328>0	lelong	1000156016	G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16
18329>0	lelong	1000156017	R12X4_UNORM_PACK16
18330>0	lelong	1000156018	R12X4G12X4_UNORM_2PACK16
18331>0	lelong	1000156019	R12X4G12X4B12X4A12X4_UNORM_4PACK16
18332>0	lelong	1000156020	G12X4B12X4G12X4R12X4_422_UNORM_4PACK16
18333>0	lelong	1000156021	B12X4G12X4R12X4G12X4_422_UNORM_4PACK16
18334>0	lelong	1000156022	G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16
18335>0	lelong	1000156023	G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16
18336>0	lelong	1000156024	G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16
18337>0	lelong	1000156025	G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16
18338>0	lelong	1000156026	G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16
18339>0	lelong	1000156027	G16B16G16R16_422_UNORM
18340>0	lelong	1000156028	B16G16R16G16_422_UNORM
18341>0	lelong	1000156029	G16_B16_R16_3PLANE_420_UNORM
18342>0	lelong	1000156030	G16_B16R16_2PLANE_420_UNORM
18343>0	lelong	1000156031	G16_B16_R16_3PLANE_422_UNORM
18344>0	lelong	1000156032	G16_B16R16_2PLANE_422_UNORM
18345>0	lelong	1000156033	G16_B16_R16_3PLANE_444_UNORM
18346
18347>0	lelong	1000054000	PVRTC1_2BPP_UNORM_BLOCK_IMG
18348>0	lelong	1000054001	PVRTC1_4BPP_UNORM_BLOCK_IMG
18349>0	lelong	1000054002	PVRTC2_2BPP_UNORM_BLOCK_IMG
18350>0	lelong	1000054003	PVRTC2_4BPP_UNORM_BLOCK_IMG
18351>0	lelong	1000054004	PVRTC1_2BPP_SRGB_BLOCK_IMG
18352>0	lelong	1000054005	PVRTC1_4BPP_SRGB_BLOCK_IMG
18353>0	lelong	1000054006	PVRTC2_2BPP_SRGB_BLOCK_IMG
18354>0	lelong	1000054007	PVRTC2_4BPP_SRGB_BLOCK_IMG
18355
18356>0	lelong	1000066000	ASTC_4x4_SFLOAT_BLOCK_EXT
18357>0	lelong	1000066001	ASTC_5x4_SFLOAT_BLOCK_EXT
18358>0	lelong	1000066002	ASTC_5x5_SFLOAT_BLOCK_EXT
18359>0	lelong	1000066003	ASTC_6x5_SFLOAT_BLOCK_EXT
18360>0	lelong	1000066004	ASTC_6x6_SFLOAT_BLOCK_EXT
18361>0	lelong	1000066005	ASTC_8x5_SFLOAT_BLOCK_EXT
18362>0	lelong	1000066006	ASTC_8x6_SFLOAT_BLOCK_EXT
18363>0	lelong	1000066007	ASTC_8x8_SFLOAT_BLOCK_EXT
18364>0	lelong	1000066008	ASTC_10x5_SFLOAT_BLOCK_EXT
18365>0	lelong	1000066009	ASTC_10x6_SFLOAT_BLOCK_EXT
18366>0	lelong	1000066010	ASTC_10x8_SFLOAT_BLOCK_EXT
18367>0	lelong	1000066011	ASTC_10x10_SFLOAT_BLOCK_EXT
18368>0	lelong	1000066012	ASTC_12x10_SFLOAT_BLOCK_EXT
18369>0	lelong	1000066013	ASTC_12x12_SFLOAT_BLOCK_EXT
18370
18371# Main KTX2 header.
183720	string	\xABKTX\ 20\xBB\r\n\x1A\n	Khronos KTX2 texture
18373>20	lelong	x	\b, %u
18374>24	lelong	>1	x %u
18375>28	lelong	>1	x %u
18376>32	lelong	>1	\b, %u layers
18377>36	lelong	>1	\b, %u faces
18378>40	lelong	>1	\b, %u mipmaps
18379>44	lelong	>0	\b,
18380>>44	use	khronos-ktx2-supercompression
18381>12	lelong	>0	\b,
18382>>12	use	khronos-ktx2-vkFormat
18383
18384# Type: Valve VTF texture.
18385# From: David Korth <gerbilsoft@gerbilsoft.com>
18386# References:
18387# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format
18388
18389# VTF image formats.
183900	name	vtf-image-format
18391>0	lelong	0	RGBA8888
18392>0	lelong	1	ABGR8888
18393>0	lelong	2	RGB888
18394>0	lelong	3	BGR888
18395>0	lelong	4	RGB565
18396>0	lelong	5	I8
18397>0	lelong	6	IA88
18398>0	lelong	7	P8
18399>0	lelong	8	A8
18400>0	lelong	9	RGB888 (bluescreen)
18401>0	lelong	10	BGR888 (bluescreen)
18402>0	lelong	11	ARGB8888
18403>0	lelong	12	BGRA8888
18404>0	lelong	13	DXT1
18405>0	lelong	14	DXT3
18406>0	lelong	15	DXT5
18407>0	lelong	16	BGRx8888
18408>0	lelong	17	BGR565
18409>0	lelong	18	BGRx5551
18410>0	lelong	19	BGRA4444
18411>0	lelong	20	DXT1+A1
18412>0	lelong	21	BGRA5551
18413>0	lelong	22	UV88
18414>0	lelong	23	UVWQ8888
18415>0	lelong	24	RGBA16161616F
18416>0	lelong	25	RGBA16161616
18417>0	lelong	26	UVLX8888
18418
18419# Main VTF header.
184200	string	VTF\0				Valve Texture Format
18421>4	lelong	x				v%u
18422>8	lelong	x				\b.%u
18423>0x10	leshort	x				\b, %u
18424>0x12	leshort	>1				x %u
18425>4	lequad	0x0000000700000002
18426>>0x3F	leshort	>1				x %u
18427>0x18	leshort	>1				\b, %u frames
18428>0x38	byte	x				\b, mipmaps: %u
18429>0x34	lelong	>-1				\b,
18430>>0x34	use	vtf-image-format
18431
18432# Type: Valve VTF3 (PS3) texture.
18433# From: David Korth <gerbilsoft@gerbilsoft.com>
184340	string		VTF3	Valve Texture Format (PS3)
18435>0x14	beshort		x	\b, %u
18436>0x16	beshort		x	\b x %u
18437>0x10	belong&0x2000	0	\b, DXT1
18438>0x10	belong&0x2000	0x2000	\b, DXT5
18439
18440# Type: ASTC texture.
18441# From: David Korth <gerbilsoft@gerbilsoft.com>
18442# References:
18443# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header
18444# - https://stackoverflow.com/a/22682244
184450	lelong	0x5ca1ab13			ASTC
18446>4	byte	x				%u
18447>5	byte	x				\bx%u
18448>6	byte	>1				\bx%u
18449# X, Y, and Z dimensions are stored as 24-bit LE.
18450# Pretend it's 32-bit and mask off the high byte.
18451>7	lelong&0x00FFFFFF	x		texture, %u
18452>10	lelong&0x00FFFFFF	x		x %u
18453>13	lelong&0x00FFFFFF	>1		x %u
18454
18455# Zebra Metafile graphic
18456# http://www.fileformat.info/format/zbr/egff.htm
184570	beshort	0x9a02	Zebra Metafile graphic
18458>2	leshort 1	(version 1.x)
18459>2	leshort	2	(version 1.1x or 1.2x)
18460>2	leshort	3	(version 1.49)
18461>2	leshort	4	(version 1.50)
18462>4	string	x	(comment = %s)
18463
18464# Microsoft Paint graphic
18465# http://www.fileformat.info/format/mspaint/egff.htm
184660	string	DanM 	icrosoft Paint image data (version 1.x)
18467>4	leshort	x	(%d
18468>>6	leshort	x	x %d)
184690	string	LinS 	Microsoft Paint image data (version 2.0)
18470>4	leshort	x	(%d
18471>>6	leshort	x	x %d)
18472
18473# reMarkable tablet internal file format (https://www.remarkable.com/)
18474# https://github.com/ax3l/lines-are-beautiful
18475# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\
18476#	reMarkable-lines-file-format.html#what-to-do-next
18477# from Axel Huebl
184780		string	reMarkable
18479>11		string	lines
18480>>17		string	with
18481>>>22		string	selections
18482>>>>33		string	and
18483>>>>>37		string	layers
18484>>>>>>43	lelong	x	reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
18485
18486# newer per-page files for the reMarkable
184870		string	reMarkable
18488>11		string	.lines
18489>>18		string	file,
18490>>>24		string	version=
18491>>>>32		byte	x	reMarkable tablet page (v%c), 1404 x 1872,
18492>>>>>43		lelong	x	%d layer(s)
18493
18494# Type: PVR3 texture.
18495# From: David Korth <gerbilsoft@gerbilsoft.com>
18496# References:
18497# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf
18498
18499# PVR3 pixel formats.
185000	name		pvr3-pixel-format
18501>0	ulelong	0	PVRTC 2bpp RGB
18502>0	ulelong	1	PVRTC 2bpp RGBA
18503>0	ulelong	2	PVRTC 4bpp RGB
18504>0	ulelong	3	PVRTC 4bpp RGBA
18505>0	ulelong	4	PVRTC-II 2bpp
18506>0	ulelong	5	PVRTC-II 4bpp
18507>0	ulelong	6	ETC1
18508>0	ulelong	7	DXT1
18509>0	ulelong	8	DXT2
18510>0	ulelong	9	DXT3
18511>0	ulelong	10	DXT4
18512>0	ulelong	11	DXT5
18513>0	ulelong	12	BC4
18514>0	ulelong	13	BC5
18515>0	ulelong	14	BC6
18516>0	ulelong	15	BC7
18517>0	ulelong	16	UYVY
18518>0	ulelong	17	YUY2
18519>0	ulelong	18	BW1bpp
18520>0	ulelong	19	R9G9B9E5 Shared Exponent
18521>0	ulelong	20	RGBG8888
18522>0	ulelong	21	GRGB8888
18523>0	ulelong	22	ETC2 RGB
18524>0	ulelong	23	ETC2 RGBA
18525>0	ulelong	24	ETC2 RGB A1
18526>0	ulelong	25	EAC R11
18527>0	ulelong	26	EAC RG11
18528>0	ulelong	27	ASTC_4x4
18529>0	ulelong	28	ASTC_5x4
18530>0	ulelong	29	ASTC_5x5
18531>0	ulelong	30	ASTC_6x5
18532>0	ulelong	31	ASTC_6x6
18533>0	ulelong	32	ASTC_8x5
18534>0	ulelong	33	ASTC_8x6
18535>0	ulelong	34	ASTC_8x8
18536>0	ulelong	35	ASTC_10x5
18537>0	ulelong	36	ASTC_10x6
18538>0	ulelong	37	ASTC_10x8
18539>0	ulelong	38	ASTC_10x10
18540>0	ulelong	39	ASTC_12x10
18541>0	ulelong	40	ASTC_12x12
18542>0	ulelong	41	ASTC_3x3x3
18543>0	ulelong	42	ASTC_4x3x3
18544>0	ulelong	43	ASTC_4x4x3
18545>0	ulelong	44	ASTC_4x4x4
18546>0	ulelong	45	ASTC_5x4x4
18547>0	ulelong	46	ASTC_5x5x4
18548>0	ulelong	47	ASTC_5x5x5
18549>0	ulelong	48	ASTC_6x5x5
18550>0	ulelong	49	ASTC_6x6x5
18551>0	ulelong	50	ASTC_6x6x6
18552
185530	string		PVR\x03			PowerVR 3.0 texture:
18554>0x18	ulelong		x	%u x
18555>0x1C	ulelong		x	%u
18556>0x20	ulelong		>1	x %u
18557>0x08	byte		x	\b,
18558>0x0C	ulelong		0
18559>>0x08	use	pvr3-pixel-format
18560>0x0C	ulelong		!0
18561>>0x08	byte	!0	%c
18562>>>0x0C	byte	!0	\b%u
18563>>0x09	byte	!0	\b%c
18564>>>0x0D	byte	!0	\b%u
18565>>0x0A	byte	!0	\b%c
18566>>>0x0E	byte	!0	\b%u
18567>>0x0B	byte	!0	\b%c
18568>>>0x0F	byte	!0	\b%u
18569>0x10	ulelong		1	\b, sRGB
18570>0x04	ulelong&0x02	0x02	\b, premultiplied alpha
18571
185720	string		\x03RVP			PowerVR 3.0 texture: BE,
18573>0x18	ubelong		x	%u x
18574>0x1C	ubelong		x	%u
18575>0x20	ubelong		>1	x %u
18576>0x08	byte		x	\b,
18577>0x0C	ubelong		0
18578>>0x08	use	pvr3-pixel-format
18579>0x0C	ubelong		!0
18580>>0x0B	byte	!0	%c
18581>>>0x0F	byte	!0	\b%u
18582>>0x0A	byte	!0	\b%c
18583>>>0x0E	byte	!0	\b%u
18584>>0x09	byte	!0	\b%c
18585>>>0x0D	byte	!0	\b%u
18586>>0x08	byte	!0	\b%c
18587>>>0x0C	byte	!0	\b%u
18588>0x10	ubelong		1	\b, sRGB
18589>0x04	ubelong&0x02	0x02	\b, premultiplied alpha
18590
18591# Type: Microsoft Xbox XPR0 texture.
18592# From: David Korth <gerbilsoft@gerbilsoft.com>
18593# References:
18594# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h
18595
18596# XPR pixel formats.
185970	name	xbox-xpr-pixel-format
18598>0	byte	0x00	L8
18599>0	byte	0x01	AL8
18600>0	byte	0x02	ARGB1555
18601>0	byte	0x03	RGB555
18602>0	byte	0x04	ARGB4444
18603>0	byte	0x05	RGB565
18604>0	byte	0x06	ARGB8888
18605>0	byte	0x07	xRGB8888
18606>0	byte	0x0B	P8
18607>0	byte	0x0C	DXT1
18608>0	byte	0x0E	DXT2
18609>0	byte	0x0F	DXT4
18610>0	byte	0x10	Linear ARGB1555
18611>0	byte	0x11	Linear RGB565
18612>0	byte	0x12	Linear ARGB8888
18613>0	byte	0x13	Linear L8
18614>0	byte	0x16	Linear R8B8
18615>0	byte	0x17	Linear G8B8
18616>0	byte	0x19	A8
18617>0	byte	0x1A	A8L8
18618>0	byte	0x1B	Linear AL8
18619>0	byte	0x1C	Linear RGB555
18620>0	byte	0x1D	Linear ARGB4444
18621>0	byte	0x1E	Linear xRGB8888
18622>0	byte	0x1F	Linear A8
18623>0	byte	0x20	Linear A8L8
18624>0	byte	0x24	YUY2
18625>0	byte	0x25	UYVY
18626>0	byte	0x27	L6V5U5
18627>0	byte	0x28	V8U8
18628>0	byte	0x29	R8B8
18629>0	byte	0x2A	D24S8
18630>0	byte	0x2B	F24S8
18631>0	byte	0x2C	D16
18632>0	byte	0x2D	F16
18633>0	byte	0x2E	Linear D24S8
18634>0	byte	0x2F	Linear F24S8
18635>0	byte	0x30	Linear D16
18636>0	byte	0x31	Linear F16
18637>0	byte	0x32	L16
18638>0	byte	0x33	V16U16
18639>0	byte	0x35	Linear L16
18640>0	byte	0x36	Linear V16U16
18641>0	byte	0x37	Linear L6V5U5
18642>0	byte	0x38	RGBA5551
18643>0	byte	0x39	RGBA4444
18644>0	byte	0x3A	QWVU8888
18645>0	byte	0x3B	BGRA8888
18646>0	byte	0x3C	RGBA8888
18647>0	byte	0x3D	Linear RGBA5551
18648>0	byte	0x3E	Linear RGBA4444
18649>0	byte	0x3F	Linear ABGR8888
18650>0	byte	0x40	Linear BGRA8888
18651>0	byte	0x41	Linear RGBA8888
18652>0	byte	0x64	Vertex Data
18653
186540	string		XPR0	Microsoft Xbox XPR0 texture
18655>0x19	byte	x	\b, format:
18656>>0x19	use	xbox-xpr-pixel-format
18657
18658# ILDA Image Data Transfer Format
18659# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf
18660#
18661# Updated by Chuck Hein (laser@geekdude.com)
18662#
186630	string	ILDA	ILDA Image Data Transfer Format
18664>7	byte	0x00	3D Coordinates with Indexed Color
18665>7	byte	0x01	2D Coordinates with Indexed Color
18666>7	byte	0x02	Color Palette
18667>7	byte	0x04	3D Coordinates with True Color
18668>7	byte	0x05	2D Coordinates with True Color
18669>8	string	>0	\b, palette %s
18670>16	string	>0	\b, company %s
18671>24	beshort	>0	\b, number of records %d
18672>>26	beshort	x	\b, palette number %d
18673>>28	beshort	>0	\b, number of frames %d
18674>>30	byte	>0	\b, projector number %d
18675
18676# Dropbox "lepton" compressed jpeg format
18677# https://github.com/dropbox/lepton
186780	belong&0xfffff0ff	0xcf84005a	Lepton image file
18679>2	byte			x		(version %d)
18680
18681# Apple QuickTake camera raw images
18682# https://en.wikipedia.org/wiki/Apple_QuickTake
18683# dcraw can decode them
186840	name quicktake
18685>4	belong	8
18686>>544	beshort	x	\b, %dx
18687>>546	beshort	x	\b%d
18688>4	belong	4
18689>>546	beshort	x	\b, %dx
18690>>544	beshort	x	\b%d
18691
186920	string	qktk	Apple QuickTake 100 Raw Image
18693>0	use quicktake
18694
186950	string	qktn
18696>4	byte	0	Apple QuickTake 150 Raw Image
18697>4	byte	>0	Apple QuickTake 200 Raw Image
18698>0	use quicktake
18699
18700#------------------------------------------------------------------------------
18701# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
18702# inform:  file(1) magic for Inform interactive fiction language
18703
18704# URL:  http://www.inform-fiction.org/
18705# From: Reuben Thomas <rrt@sc3d.org>
18706
187070	search/100/cW	constant\ story		Inform source text
18708
18709#------------------------------------------------------------------------------
18710# $File: intel,v 1.18 2020/04/18 16:19:03 christos Exp $
18711# intel:  file(1) magic for x86 Unix
18712#
18713# Various flavors of x86 UNIX executable/object (other than Xenix, which
18714# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
18715# Windows as well.
18716#
18717# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
18718# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
18719# as well, if, as, and when IBM makes it portable.
18720#
18721# The `versions' should be un-commented if they work for you.
18722# (Was the problem just one of endianness?)
18723#
187240	leshort		0502		basic-16 executable
18725>12	lelong		>0		not stripped
18726#>22	leshort		>0		- version %d
187270	leshort		0503		basic-16 executable (TV)
18728>12	lelong		>0		not stripped
18729#>22	leshort		>0		- version %d
187300	leshort		0510		x86 executable
18731>12	lelong		>0		not stripped
187320	leshort		0511		x86 executable (TV)
18733>12	lelong		>0		not stripped
187340	leshort		=0512		iAPX 286 executable small model (COFF)
18735>12	lelong		>0		not stripped
18736#>22	leshort		>0		- version %d
187370	leshort		=0522		iAPX 286 executable large model (COFF)
18738>12	lelong		>0		not stripped
18739#>22	leshort		>0		- version %d
18740# updated by Joerg Jenderek at Oct 2015
18741# https://de.wikipedia.org/wiki/Common_Object_File_Format
18742# http://www.delorie.com/djgpp/doc/coff/filhdr.html
18743# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
18744# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
18745# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
187460	leshort		=0514
18747# use subroutine to display name+flags+variables for common object formated files
18748>0	use				display-coff
18749#>12	lelong		>0		not stripped
18750# no hint found, that at offset 22 is version
18751#>22	leshort		>0		- version %d
187520	leshort		0x0200
18753>0	use				display-coff
187540	leshort		0x8664
18755>0	use				display-coff
18756
18757# rom: file(1) magic for BIOS ROM Extensions found in intel machines
18758#      mapped into memory between 0xC0000 and 0xFFFFF
18759# From: Alex Myczko <alex@aiei.ch>
18760# updated by Joerg Jenderek
18761# https://en.wikipedia.org/wiki/Option_ROM
187620        beshort         0x55AA       BIOS (ia32) ROM Ext.
18763!:mime	application/octet-stream
18764!:ext	rom/bin
18765>5       string          USB          USB
18766>7       string          LDR          UNDI image
18767>30      string          IBM          IBM comp. Video
18768>26      string          Adaptec      Adaptec
18769>28      string          Adaptec      Adaptec
18770>42      string          PROMISE      Promise
18771>2       byte            x            (%d*512)
18772
18773# Flash descriptors for Intel SPI flash roms.
18774# From Dr. Jesus <j@hug.gs>
187750	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1877616	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
18777
18778# From: 	Joerg Jenderek
18779# URL:		https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface
18780# Reference:	https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf
18781# Note:		generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml`
187820	string		DSDT
18783>0	use		acpi-table
18784# not tested or other file format
187850	string		APIC
18786>0	use		acpi-table
18787#0	string		ASF!
18788#>0	use		acpi-table
187890	string		FACP
18790>0	use		acpi-table
18791#0	string		FACS
18792#>0	use		acpi-table
187930	string		MCFG
18794>0	use		acpi-table
187950	string		SLIC
18796>0	use		acpi-table
187970	string		SSDT
18798>0	use		acpi-table
187990	name		acpi-table
18800# skip ASCII text starting with DSDT by looking for valid "low" revision
18801>8	ubyte		<17	ACPI Machine Language file
18802# assume that ACPI tables size are lower than 16 MiB
18803#>4	ulelong		<0x01000000
18804# DSDT for Differentiated System Description Table
18805>>0	string		x	'%.4s'
18806#!:mime	application/octet-stream
18807!:mime	application/x-intel-aml
18808!:ext	aml
18809# the manufacture model ID like: VBOXBIOS BXDSDT
18810>>16	string		>\0	%.8s
18811# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511
18812>>>24	ulelong		x	%x
18813# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml
18814>>10	ubyte		>040	by %c
18815>>>11		ubyte	>040	\b%c
18816>>>>12		ubyte	>040	\b%c
18817>>>>>13		ubyte	>040	\b%c
18818>>>>>>14	ubyte	>040	\b%c
18819>>>>>>>15	ubyte	>040	\b%c
18820# This field also sets the global integer width for the AML interpreter.
18821# Values less than two will cause the interpreter to use 32-bit.
18822# Values of two and greater will cause the interpreter to use full 64-bit.
18823# 16 for asf!.aml, 67 fo rsdp.aml
18824>>8	ubyte		x	\b, revision %u
18825# length, in bytes, of the entire DSDT (including the header)
18826>>4	ulelong		x	\b, %u bytes
18827# entire table must sum to zero
18828#>>9	ubyte		x	\b, checksum 0x%x
18829# vendor ID for the ASL Compiler like: INTL MSFT ...
18830>>28	string		>\0	\b, created by %.4s
18831# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ...
18832>>>32	ulelong		x	%x
18833
18834
18835#------------------------------------------------------------------------------
18836# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
18837# interleaf:  file(1) magic for InterLeaf TPS:
18838#
188390	string		=\210OPS	Interleaf saved data
188400	string		=<!OPS		Interleaf document text
18841>5	string		,\ Version\ =	\b, version
18842>>17	string		>\0		%.3s
18843
18844#------------------------------------------------------------------------------
18845# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
18846# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
18847# "/etc/magic":
18848# From: guy@netapp.com (Guy Harris)
18849#
188504	string		pgscriptver	IslandWrite document
1885113	string		DrawFile	IslandDraw document
18852
18853
18854#------------------------------------------------------------------------------
18855# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
18856# ispell:  file(1) magic for ispell
18857#
18858# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
18859# will match 0x9600 through 0x9603 in *both* little endian and big endian.
18860# (No other current magic entries collide.)
18861#
18862# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
18863#
188640	leshort&0xFFFC	0x9600		little endian ispell
18865>0	byte		0		hash file (?),
18866>0	byte		1		3.0 hash file,
18867>0	byte		2		3.1 hash file,
18868>0	byte		3		hash file (?),
18869>2	leshort		0x00		8-bit, no capitalization, 26 flags
18870>2	leshort		0x01		7-bit, no capitalization, 26 flags
18871>2	leshort		0x02		8-bit, capitalization, 26 flags
18872>2	leshort		0x03		7-bit, capitalization, 26 flags
18873>2	leshort		0x04		8-bit, no capitalization, 52 flags
18874>2	leshort		0x05		7-bit, no capitalization, 52 flags
18875>2	leshort		0x06		8-bit, capitalization, 52 flags
18876>2	leshort		0x07		7-bit, capitalization, 52 flags
18877>2	leshort		0x08		8-bit, no capitalization, 128 flags
18878>2	leshort		0x09		7-bit, no capitalization, 128 flags
18879>2	leshort		0x0A		8-bit, capitalization, 128 flags
18880>2	leshort		0x0B		7-bit, capitalization, 128 flags
18881>2	leshort		0x0C		8-bit, no capitalization, 256 flags
18882>2	leshort		0x0D		7-bit, no capitalization, 256 flags
18883>2	leshort		0x0E		8-bit, capitalization, 256 flags
18884>2	leshort		0x0F		7-bit, capitalization, 256 flags
18885>4	leshort		>0		and %d string characters
188860	beshort&0xFFFC	0x9600		big endian ispell
18887>1	byte		0		hash file (?),
18888>1	byte		1		3.0 hash file,
18889>1	byte		2		3.1 hash file,
18890>1	byte		3		hash file (?),
18891>2	beshort		0x00		8-bit, no capitalization, 26 flags
18892>2	beshort		0x01		7-bit, no capitalization, 26 flags
18893>2	beshort		0x02		8-bit, capitalization, 26 flags
18894>2	beshort		0x03		7-bit, capitalization, 26 flags
18895>2	beshort		0x04		8-bit, no capitalization, 52 flags
18896>2	beshort		0x05		7-bit, no capitalization, 52 flags
18897>2	beshort		0x06		8-bit, capitalization, 52 flags
18898>2	beshort		0x07		7-bit, capitalization, 52 flags
18899>2	beshort		0x08		8-bit, no capitalization, 128 flags
18900>2	beshort		0x09		7-bit, no capitalization, 128 flags
18901>2	beshort		0x0A		8-bit, capitalization, 128 flags
18902>2	beshort		0x0B		7-bit, capitalization, 128 flags
18903>2	beshort		0x0C		8-bit, no capitalization, 256 flags
18904>2	beshort		0x0D		7-bit, no capitalization, 256 flags
18905>2	beshort		0x0E		8-bit, capitalization, 256 flags
18906>2	beshort		0x0F		7-bit, capitalization, 256 flags
18907>4	beshort		>0		and %d string characters
18908# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
18909# Ispell 4.0
189100       string          ISPL            ispell
18911>4      long            x               hash file version %d,
18912>8      long            x               lexletters %d,
18913>12     long            x               lexsize %d,
18914>16     long            x               hashsize %d,
18915>20     long            x               stblsize %d
18916
18917#------------------------------------------------------------------------------
18918# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $
18919# ISO Zipped file format
18920# https://www.ezbsystems.com/isz/iszspec.txt
189210	string	IsZ!	ISO Zipped file
18922>4	byte	x	\b, header size %u
18923>5	byte	x	\b, version %u
18924>8	lelong	x	\b, serial %u
18925#12	leshort	x	\b, sector size %u
18926#>16	lelong	x	\b, total sectors %u
18927>17	byte	>0	\b, password protected
18928#>24	lequad	x	\b, segment size %llu
18929#>32	lelong	x	\b, blocks %u
18930#>36	lelong	x	\b, block size %u
18931
18932#------------------------------------------------------------
18933# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
18934# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
18935# same magic number, 0xcafebabe, so they are both handled
18936# in the entry called "cafebabe".
18937#------------------------------------------------------------
18938# Java serialization
18939# From Martin Pool (m.pool@pharos.com.au)
189400	beshort		0xaced		Java serialization data
18941>2	beshort		>0x0004		\b, version %d
18942
189430	belong		0xfeedfeed	Java KeyStore
18944!:mime	application/x-java-keystore
189450	belong		0xcececece	Java JCE KeyStore
18946!:mime	application/x-java-jce-keystore
18947
18948# Java source
189490	regex	\^import.*;$	Java source
18950!:mime	text/x-java
18951
18952# Java HPROF dumps
18953# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
189540	string		JAVA\x20PROFILE\x201.0.
18955>0x12	byte		0
18956>>0x11	ubyte-0x31	<2      Java HPROF dump,
18957>>>0x17	beqdate/1000	x       created %s
18958
18959# Java jmod module
18960# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
18961# Grr. 2 byte magic "JM", really? In 2019?
189620	belong		0x4a4d0100	Java jmod module version 1.0
18963!:mime	application/x-java-jmod
18964
18965# Java jlinked image
18966# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
189670	belong	0xcafedada	Java module image (big endian)
18968>4	beshort	>0x00	\b, version %d
18969>6	beshort	x	\b.%d
18970!:mime	application/x-java-image
18971
189720	lelong	0xcafedada	Java module image (little endian)
18973>6	leshort	>0x00	\b, version %d
18974>4	leshort	x	\b.%d
18975!:mime	application/x-java-image
18976
18977#------------------------------------------------------------------------------
18978# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $
18979# javascript:  magic for javascript and node.js scripts.
18980#
189810	search/1/w	#!/bin/node		Node.js script text executable
18982!:mime application/javascript
189830	search/1/w	#!/usr/bin/node		Node.js script text executable
18984!:mime application/javascript
189850	search/1/w	#!/bin/nodejs		Node.js script text executable
18986!:mime application/javascript
189870	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
18988!:mime application/javascript
189890	search/1	#!/usr/bin/env\ node	Node.js script text executable
18990!:mime application/javascript
189910	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
18992!:mime application/javascript
18993# Hermes by Facebook https://hermesengine.dev/
18994# https://github.com/facebook/hermes/blob/master/include/hermes/\
18995# BCGen/HBC/BytecodeFileFormat.h#L24
189960	lequad		0x1F1903C103BC1FC6	Hermes JavaScript bytecode
18997>8	lelong		x			\b, version %d
18998
18999#------------------------------------------------------------------------------
19000# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $
19001# JPEG images
19002# SunOS 5.5.1 had
19003#
19004#	0	string		\377\330\377\340	JPEG file
19005#	0	string		\377\330\377\356	JPG file
19006#
19007# both of which turn into "JPEG image data" here.
19008#
190090	beshort		0xffd8		JPEG image data
19010!:mime	image/jpeg
19011!:apple	8BIMJPEG
19012!:strength *3
19013!:ext jpeg/jpg/jpe/jfif
19014>6	string		JFIF		\b, JFIF standard
19015# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
19016# in a vain attempt to add image size reporting for JFIF.  Note that these
19017# tests are not fool-proof since some perfectly valid JPEGs are currently
19018# impossible to specify in magic(4) format.
19019# First, a little JFIF version info:
19020>>11	byte		x		\b %d.
19021>>12	byte		x		\b%02d
19022# Next, the resolution or aspect ratio of the image:
19023>>13	byte		0		\b, aspect ratio
19024>>13	byte		1		\b, resolution (DPI)
19025>>13	byte		2		\b, resolution (DPCM)
19026>>14	beshort		x		\b, density %dx
19027>>16	beshort		x		\b%d
19028>>4	beshort		x		\b, segment length %d
19029# Next, show thumbnail info, if it exists:
19030>>18	byte		!0		\b, thumbnail %dx
19031>>>19	byte		x		\b%d
19032>6	string		Exif		\b, Exif standard: [
19033>>12	indirect/r	x
19034>>12	string		x		\b]
19035
19036# Jump to the first segment
19037>(4.S+4)	use		jpeg_segment
19038
19039# This uses recursion...
190400		name		jpeg_segment
19041>0	beshort		0xFFFE
19042# Recursion handled by FFE0
19043#>>(2.S+2)	use			jpeg_segment
19044>>2	pstring/HJ	x		\b, comment: "%s"
19045
19046>0	beshort		0xFFC0
19047>>(2.S+2)	use			jpeg_segment
19048>>4	byte		x		\b, baseline, precision %d
19049>>7	beshort		x		\b, %dx
19050>>5	beshort		x		\b%d
19051>>9	byte		x		\b, components %d
19052
19053>0	beshort		0xFFC1
19054>>(2.S+2)	use			jpeg_segment
19055>>4	byte		x		\b, extended sequential, precision %d
19056>>7	beshort		x		\b, %dx
19057>>5	beshort		x		\b%d
19058>>9	byte		x		\b, components %d
19059
19060>0	beshort		0xFFC2
19061>>(2.S+2)	use			jpeg_segment
19062>>4	byte		x		\b, progressive, precision %d
19063>>7	beshort		x		\b, %dx
19064>>5	beshort		x		\b%d
19065>>9	byte		x		\b, components %d
19066
19067# Define Huffman Tables
19068>0	beshort		0xFFC4
19069>>(2.S+2)	use			jpeg_segment
19070
19071>0	beshort		0xFFE1
19072# Recursion handled by FFE0
19073#>>(2.S+2)	use			jpeg_segment
19074>>4	string		Exif		\b, Exif Standard: [
19075>>>10	indirect/r	x
19076>>>10	string		x		\b]
19077
19078# Application specific markers
19079>0	beshort&0xFFE0	=0xFFE0
19080>>(2.S+2)	use			jpeg_segment
19081
19082# DB: Define Quantization tables
19083# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
19084# D8: Start of image
19085# D9: End of image
19086# Dn: Restart
19087>0	beshort&0xFFD0	=0xFFD0
19088>>0	beshort&0xFFE0	!0xFFE0
19089>>>(2.S+2)	use			jpeg_segment
19090
19091#>0	beshort		x		unknown 0x%x
19092#>>(2.S+2)	use			jpeg_segment
19093
19094# HSI is Handmade Software's proprietary JPEG encoding scheme
190950	string		hsi1		JPEG image data, HSI proprietary
19096
19097# From: David Santinoli <david@santinoli.com>
190980	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
19099# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
19100# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
19101# https://github.com/bitsgalore/jp2kMagic
19102#
19103# Now read value of 'Brand' field, which yields a few possibilities:
19104>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
19105!:mime	image/jp2
19106>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
19107!:mime	image/jpx
19108>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
19109!:mime	image/jpm
19110>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
19111!:mime	video/mj2
19112
19113# Type: JPEG 2000 codesream
19114# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
191150	belong		0xff4fff51						JPEG 2000 codestream
1911645	beshort		0xff52
19117
19118# JPEG extended range
191190	string		\x49\x49\xbc
19120>3	byte		1
19121>>4	lelong%2	0	JPEG-XR
19122!:mime	image/jxr
19123!:ext	jxr
19124
19125#------------------------------------------------------------------------------
19126# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
19127# karma:  file(1) magic for Karma data files
19128#
19129# From <rgooch@atnf.csiro.au>
19130
191310	string	KarmaRHD\040Version	Karma Data Structure Version
19132>16	belong		x		%u
19133
19134#------------------------------------------------------------------------------
19135# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
19136# kde:  file(1) magic for KDE
19137
191380		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
19139!:mime	application/x-kdelnk
191400		string/t	#\ KDE\ Config\ File	KDE config file
19141!:mime	application/x-kdelnk
191420		string/t	#\ xmcd	xmcd database file for kscd
19143!:mime	text/x-xmcd
19144
19145#------------------------------------------------------------------------------
19146# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $
19147# keepass: file(1) magic for KeePass file
19148#
19149# Keepass Password Safe:
19150#  * original one: https://keepass.info/
19151#  * *nix port:    https://www.keepassx.org/
19152#  * android port: https://code.google.com/p/keepassdroid/
19153
191540	lelong		0x9AA2D903	Keepass password database
19155>4	lelong		0xB54BFB65	1.x KDB
19156>>48	lelong		>0		\b, %d groups
19157>>52	lelong		>0		\b, %d entries
19158>>8	lelong&0x0f	1		\b, SHA-256
19159>>8	lelong&0x0f	2		\b, AES
19160>>8	lelong&0x0f	4		\b, RC4
19161>>8	lelong&0x0f	8		\b, Twofish
19162>>120	lelong		>0		\b, %d key transformation rounds
19163>4	lelong		0xB54BFB67	2.x KDBX
19164
19165#------------------------------------------------------------------------------
19166# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $
19167# kerberos: MIT kerberos file binary formats
19168#
19169
19170# This magic entry is for demonstration purposes and could be improved
19171# if the following features were implemented in file:
19172#
19173# Strings inside [[ .. ]] in the descriptions have special meanings and
19174# are not printed.
19175#
19176# 	- Provide some form of iteration in number of components
19177#		[[${counter}=%d]] in the description
19178#		then append
19179#		[${counter}--] in the offset of the entries
19180#	- Provide a way to round the next offset
19181#		Add [R:4] after the offset?
19182#	- Provide a way to have optional entries
19183#		XXX: Syntax:
19184#	- Provide a way to "save" entries to print them later.
19185#		if the description is [[${name}=%s]], then nothing is
19186#		printed and a subsequent entry in the same magic file
19187#		can refer to ${name}
19188#	- Provide a way to format strings as hex values
19189#
19190# https://www.gnu.org/software/shishi/manual/html_node/\
19191#	The-Keytab-Binary-File-Format.html
19192#
19193
191940		name		keytab_entry
19195#>0		beshort		x		\b, size=%d
19196#>2		beshort		x		\b, components=%d
19197>4		pstring/H	x		\b, realm=%s
19198>>&0		pstring/H	x		\b, principal=%s/
19199>>>&0		pstring/H	x		\b%s
19200>>>>&0		belong		x		\b, type=%d
19201>>>>>&0		bedate		x		\b, date=%s
19202>>>>>>&0	byte		x		\b, kvno=%u
19203#>>>>>>>&0	pstring/H	x
19204#>>>>>>>>&0	belong		x
19205#>>>>>>>>>>&0	use		keytab_entry
19206
192070		belong		0x05020000	Kerberos Keytab file
19208>4		use		keytab_entry
19209
19210#------------------------------------------------------------------------------
19211# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $
19212# kicad:  file(1) magic for KiCad files
19213#
19214# See
19215#
19216#	http://kicad-pcb.org
19217#
19218
19219# KiCad Schematic Document
192200	    string  (kicad_sch
19221>10	    byte    0x20		KiCad Schematic Document
19222!:ext kicad_sch/kicad_sch-bak
19223>>11	    string  (version
19224>>>19	    byte    0x20
19225>>>>20	    regex   [0-9.]+		(Version %s)
19226
19227# KiCad Schematic Document (Legacy)
192280	    string  EESchema
19229>8	    byte    0x20
19230>>9	    string  Schematic
19231>>>18	    byte    0x20		KiCad Schematic Document (Legacy)
19232!:ext sch/bak
19233>>>>24	    string  Version
19234>>>>>31	    byte    0x20
19235>>>>>>32    string  x			(Version %s)
19236
19237# KiCad Symbol Library
192380	    string  (kicad_symbol_lib
19239>17	    byte    0x20		KiCad Symbol Library
19240!:ext kicad_sym
19241>>18	    string  (version
19242>>>26	    byte    0x20
19243>>>>27	    regex   [0-9.]+		(Version %s)
19244
19245# KiCad Symbol Library (Legacy)
192460	    string  EESchema-LIBRARY
19247>16	    byte    0x20		KiCad Symbol Library (Legacy)
19248!:ext lib
19249>>17	    string  Version
19250>>>24	    byte    0x20
19251>>>>25	    string  x			(Version %s)
19252
19253# KiCad Symbol Library Documentation (Legacy)
192540	    string  EESchema-DOCLIB
19255>15	    byte    0x20		KiCad Symbol Library Documentation (Legacy)
19256!:ext dcm
19257>>17	    string  Version
19258>>>24	    byte    0x20
19259>>>>25	    string  x			(Version %s)
19260
19261# KiCad Board Layout
192620	    string  (kicad_pcb
19263>10	    byte    0x20		KiCad Board Layout
19264!:ext kicad_pcb/kicad_pcb-bak
19265>>11	    string  (version
19266>>>19	    byte    0x20
19267>>>>20	    regex   [0-9.]+		(Version %s)
19268
19269# KiCad Footprint
192700	    string  (module
19271>7	    byte    0x20		KiCad Footprint
19272!:ext kicad_mod
19273
19274# KiCad Footprint (Legacy)
192750	    string  PCBNEW-LibModule-V1	    KiCad Footprint (Legacy)
19276!:ext mod
19277
19278# KiCad Netlist
192790	    string  (export
19280>7	    byte    0x20		KiCad Netlist
19281!:ext net
19282
19283# KiCad Symbol Library Table
192840	    string  (sym_lib_table
19285>14	    byte    0xA			KiCad Symbol Library Table
19286>14	    byte    0xD			KiCad Symbol Library Table
19287>14	    byte    0x20		KiCad Symbol Library Table
19288
19289# KiCad Footprint Library Table
192900	    string  (fp_lib_table
19291>13	    byte    0xA			KiCad Footprint Library Table
19292>13	    byte    0xD			KiCad Footprint Library Table
19293>13	    byte    0x20		KiCad Footprint Library Table
19294
19295#------------------------------------------------------------------------------
19296# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $
19297# Type: Google KML, formerly Keyhole Markup Language
19298# Future development of this format has been handed
19299# over to the Open Geospatial Consortium.
19300# https://www.opengeospatial.org/standards/kml/
19301# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
193020 string/t    \<?xml
19303>20  search/400 \ xmlns=
19304>>&0 regex ['"]http://earth.google.com/kml Google KML document
19305!:mime application/vnd.google-earth.kml+xml
19306>>>&1 string 2.0' \b, version 2.0
19307>>>&1 string 2.1' \b, version 2.1
19308>>>&1 string 2.2' \b, version 2.2
19309
19310#------------------------------------------------------------------------------
19311# Type: OpenGIS KML, formerly Keyhole Markup Language
19312# This standard is maintained by the
19313# Open Geospatial Consortium.
19314# https://www.opengeospatial.org/standards/kml/
19315# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
19316>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
19317!:mime application/vnd.google-earth.kml+xml
19318>>>&1 string/t 2.2 \b, version 2.2
19319
19320#------------------------------------------------------------------------------
19321# Type: Google KML Archive (ZIP based)
19322# https://code.google.com/apis/kml/documentation/kml_tut.html
19323# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
193240 string    PK\003\004
19325>4  byte    0x14
19326>>30  string doc.kml Compressed Google KML Document, including resources.
19327!:mime application/vnd.google-earth.kmz
19328
19329#------------------------------------------------------------------------------
19330# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
19331# DEC SRC Virtual Paper: Lectern files
19332# Karl M. Hegbloom <karlheg@inetarena.com>
193330	string	lect	DEC SRC Virtual Paper Lectern file
19334
19335#------------------------------------------------------------------------------
19336# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
19337# lex:  file(1) magic for lex
19338#
19339#	derived empirically, your offsets may vary!
193400	search/100	yyprevious	C program text (from lex)
19341>3	search/1	>\0		 for %s
19342# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
193430	search/100	generated\ by\ flex	C program text (from flex)
19344# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
193450	search/1	%{		lex description text
19346
19347#------------------------------------------------------------------------------
19348# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
19349# lif:  file(1) magic for lif
19350#
19351# (Daniel Quinlan <quinlan@yggdrasil.com>)
19352#
193530	beshort		0x8000		lif file
19354
19355#------------------------------------------------------------------------------
19356# $File: linux,v 1.72 2020/06/07 21:56:13 christos Exp $
19357# linux:  file(1) magic for Linux files
19358#
19359# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
19360# The following basic Linux magic is useful for reference, but using
19361# "long" magic is a better practice in order to avoid collisions.
19362#
19363# 2	leshort		100		Linux/i386
19364# >0	leshort		0407		impure executable (OMAGIC)
19365# >0	leshort		0410		pure executable (NMAGIC)
19366# >0	leshort		0413		demand-paged executable (ZMAGIC)
19367# >0	leshort		0314		demand-paged executable (QMAGIC)
19368#
193690	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
19370>16	lelong		0		\b, stripped
193710	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
19372>16	lelong		0		\b, stripped
193730	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
19374>16	lelong		0		\b, stripped
193750	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
19376>16	lelong		0		\b, stripped
19377#
193780	string		\007\001\000	Linux/i386 object file
19379>20	lelong		>0x1020		\b, DLL library
19380# Linux-8086 stuff:
193810	string		\01\03\020\04	Linux-8086 impure executable
19382>28	long		!0		not stripped
193830	string		\01\03\040\04	Linux-8086 executable
19384>28	long		!0		not stripped
19385#
193860	string		\243\206\001\0	Linux-8086 object file
19387#
193880	string		\01\03\020\20	Minix-386 impure executable
19389>28	long		!0		not stripped
193900	string		\01\03\040\20	Minix-386 executable
19391>28	long		!0		not stripped
193920	string		\01\03\04\20	Minix-386 NSYM/GNU executable
19393>28	long		!0		not stripped
19394# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
19395216	lelong		0421		Linux/i386 core file
19396!:strength / 2
19397>220	string		>\0		of '%s'
19398>200	lelong		>0		(signal %d)
19399#
19400# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
19401# this can be overridden by the DOS executable (COM) entry
194022	string		LILO		Linux/i386 LILO boot/chain loader
19403#
19404# Linux make config build file, from Ole Aamot <oka@oka.no>
19405# Updated by Ken Sharp
1940628	string		make\ config		Linux make config build file (old)
1940749	search/70	Kernel\ Configuration	Linux make config build file
19408
19409#
19410# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
19411# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
19412# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
194130	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
19414>2	byte&0x01	0		256 characters,
19415>2	byte&0x01	!0		512 characters,
19416>2	byte&0x02	0		no directory,
19417>2	byte&0x02	!0		Unicode directory,
19418>3	byte		>0		8x%d
194190	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
19420>16	lelong		x		%d characters,
19421>12	lelong&0x01	0		no directory,
19422>12	lelong&0x01	!0		Unicode directory,
19423>24	lelong		x		%d
19424>28	lelong		x		\bx%d
19425
19426# Linux swap and hibernate files
19427# Linux kernel: include/linux/swap.h
19428# util-linux: libblkid/src/superblocks/swap.c
19429
19430# format v0, unsupported since 2002
194310xff6	string		SWAP-SPACE	Linux old swap file, 4k page size
194320x1ff6	string		SWAP-SPACE	Linux old swap file, 8k page size
194330x3ff6	string		SWAP-SPACE	Linux old swap file, 16k page size
194340x7ff6	string		SWAP-SPACE	Linux old swap file, 32k page size
194350xfff6	string		SWAP-SPACE	Linux old swap file, 64k page size
19436
19437# format v1, supported since 1998
194380		name	linux-swap
19439>0x400	lelong	1	little endian, version %u,
19440>>0x404	lelong	x	size %u pages,
19441>>0x408	lelong	x	%u bad pages,
19442>0x400	belong	1	big endian, version %u,
19443>>0x404	belong	x	size %u pages,
19444>>0x408	belong	x	%u bad pages,
19445>0x41c	string	\0	no label,
19446>0x41c	string	>\0	LABEL=%s,
19447>0x40c	belong	x	UUID=%08x
19448>0x410	beshort	x	\b-%04x
19449>0x412	beshort	x	\b-%04x
19450>0x414	beshort	x	\b-%04x
19451>0x416	belong	x	\b-%08x
19452>0x41a	beshort	x	\b%04x
19453
194540xff6	string		SWAPSPACE2	Linux swap file, 4k page size,
19455>0		use			linux-swap
194560x1ff6	string		SWAPSPACE2	Linux swap file, 8k page size,
19457>0		use			linux-swap
194580x3ff6	string		SWAPSPACE2	Linux swap file, 16k page size,
19459>0		use			linux-swap
194600x7ff6	string		SWAPSPACE2	Linux swap file, 32k page size,
19461>0		use			linux-swap
194620xfff6	string		SWAPSPACE2	Linux swap file, 64k page size,
19463>0		use			linux-swap
19464
194650	name	linux-hibernate
19466>0	string	S1SUSPEND	\b, with SWSUSP1 image
19467>0	string	S2SUSPEND	\b, with SWSUSP2 image
19468>0	string	ULSUSPEND	\b, with uswsusp image
19469>0	string	LINHIB0001	\b, with compressed hibernate image
19470>0	string	\xed\xc3\x02\xe9\x98\x56\xe5\x0c	\b, with tuxonice image
19471>0	default	x			\b, with unknown hibernate image
19472
194730xfec	string		SWAPSPACE2	Linux swap file, 4k page size,
19474>0		use			linux-swap
19475>0xff6	use			linux-hibernate
194760x1fec	string		SWAPSPACE2	Linux swap file, 8k page size,
19477>0		use			linux-swap
19478>0x1ff6	use			linux-hibernate
194790x3fec	string		SWAPSPACE2	Linux swap file, 16k page size,
19480>0		use			linux-swap
19481>0x3ff6	use			linux-hibernate
194820x7fec	string		SWAPSPACE2	Linux swap file, 32k page size,
19483>0		use			linux-swap
19484>0x7ff6	use			linux-hibernate
194850xffec	string		SWAPSPACE2	Linux swap file, 64k page size,
19486>0		use			linux-swap
19487>0xfff6	use			linux-hibernate
19488
19489#
19490# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
19491# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
19492# and Nicolas Lichtmaier <nick@debian.org>
19493# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
19494# Linux kernel boot images (i386 arch) (Wolfram Kleff)
19495# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
19496514	string		HdrS		Linux kernel
19497!:strength + 55
19498# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
19499# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
19500# DamnSmallLinux 1.5 damnsmll.lnx
19501!:ext	/dat/bin/lnx
19502>510	leshort		0xAA55		x86 boot executable
19503>>518	leshort		>0x1ff
19504>>>529	byte		0		zImage,
19505>>>529	byte		1		bzImage,
19506>>>526	lelong		>0
19507>>>>(526.s+0x200) string	>\0	version %s,
19508>>498	leshort		1		RO-rootFS,
19509>>498	leshort		0		RW-rootFS,
19510>>508	leshort		>0		root_dev 0x%X,
19511>>502	leshort		>0		swap_dev 0x%X,
19512>>504	leshort		>0		RAMdisksize %u KB,
19513>>506	leshort		0xFFFF		Normal VGA
19514>>506	leshort		0xFFFE		Extended VGA
19515>>506	leshort		0xFFFD		Prompt for Videomode
19516>>506	leshort		>0		Video mode %d
19517# This also matches new kernels, which were caught above by "HdrS".
195180		belong	0xb8c0078e	Linux kernel
19519>0x1e3		string	Loading		version 1.3.79 or older
19520>0x1e9		string	Loading		from prehistoric times
19521
19522# System.map files - Nicolas Lichtmaier <nick@debian.org>
195238	search/1	\ A\ _text	Linux kernel symbol map text
19524
19525# LSM entries - Nicolas Lichtmaier <nick@debian.org>
195260	search/1	Begin3	Linux Software Map entry text
195270	search/1	Begin4	Linux Software Map entry text (new format)
19528
19529# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
195300	belong	0x4f4f4f4d	User-mode Linux COW file
19531>4	belong	<3		\b, version %d
19532>>8	string	>\0		\b, backing file %s
19533>4	belong	>2		\b, version %d
19534>>32	string	>\0		\b, backing file %s
19535
19536############################################################################
19537# Linux kernel versions
19538
195390		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
19540>497		leshort		0		x86 boot sector
19541>>514		belong		0x8e	of a kernel from the dawn of time!
19542>>514		belong		0x908ed8b4	version 0.99-1.1.42
19543>>514		belong		0x908ed8b8	for memtest86
19544
19545>497		leshort		!0		x86 kernel
19546>>504		leshort		>0		RAMdisksize=%u KB
19547>>502		leshort		>0		swap=0x%X
19548>>508		leshort		>0		root=0x%X
19549>>>498		leshort		1		\b-ro
19550>>>498		leshort		0		\b-rw
19551>>506		leshort		0xFFFF		vga=normal
19552>>506		leshort		0xFFFE		vga=extended
19553>>506		leshort		0xFFFD		vga=ask
19554>>506		leshort		>0		vga=%d
19555>>514		belong		0x908ed881	version 1.1.43-1.1.45
19556>>514		belong		0x15b281cd
19557>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
19558>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
19559>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
19560>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
19561>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
19562>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
19563>>514		string		HdrS
19564>>>518		leshort		>0x1FF
19565>>>>529		byte		0		\b, zImage
19566>>>>529		byte		1		\b, bzImage
19567>>>>(526.s+0x200) string 	>\0		\b, version %s
19568
19569# Linux boot sector thefts.
195700		belong		0xb8c0078e	Linux
19571>0x1e6		belong		0x454c4b53	ELKS Kernel
19572>0x1e6		belong		!0x454c4b53	style boot sector
19573
19574############################################################################
19575# Linux S390 kernel image
19576# Created by: Jan Kaluza <jkaluza@redhat.com>
195778 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
19578>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
19579# 64bit
19580>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
19581>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
19582>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
19583>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
19584# 32bit
19585>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
19586>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
19587>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
19588>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
19589
19590############################################################################
19591# Linux ARM compressed kernel image
19592# From: Kevin Cernekee <cernekee@gmail.com>
19593# Update: Joerg Jenderek
195940x24	lelong	0x016f2818	Linux kernel ARM boot executable zImage
19595# There are three posible situations: LE, BE with LE bootloader and pure BE.
19596# In order to aid telling these apart a new endian flag was added. In order
19597# to support kernels before the flag and BE with LE bootloader was added we'll
19598# do a negative check against the BE variant of the flag when we see a LE magic.
19599>0x30	belong	!0x04030201	(little-endian)
19600>0x30	belong	0x04030201	(big-endian)
19601# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
19602!:ext	img/bin
196030x24	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
19604
19605############################################################################
19606# Linux AARCH64 kernel image
196070x38    lelong  0x644d5241  Linux kernel ARM64 boot executable Image
19608>0x18   lelong  ^1          \b, little-endian
19609>0x18   lelong  &1          \b, big-endian
19610>0x18   lelong  &2          \b, 4K pages
19611>0x18   lelong  &4          \b, 16K pages
19612>0x18   lelong  &6          \b, 32K pages
19613
19614############################################################################
19615# Linux 8086 executable
196160	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
19617>5	string		.
19618>>4	string		>\0		\b, libc version %s
19619
196200	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
19621>2	byte&0x01	!0		\b, unmapped zero page
19622>2	byte&0x20	0		\b, impure
19623>2	byte&0x20	!0
19624>>2	byte&0x10	!0		\b, A_EXEC
19625>2	byte&0x02	!0		\b, A_PAL
19626>2	byte&0x04	!0		\b, A_NSYM
19627>2	byte&0x08	!0		\b, A_STAND
19628>2	byte&0x40	!0		\b, A_PURE
19629>2	byte&0x80	!0		\b, A_TOVLY
19630>28     long            !0              \b, not stripped
19631>37	string		.
19632>>36	string		>\0		\b, libc version %s
19633
19634# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
19635# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
19636# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
19637# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
19638
19639# SYSLINUX boot logo files (from 'ppmtolss16' sources)
19640# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
19641# file extension .lss .16
196420	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
19643# syslinux-4.05/mime/image/x-lss16.xml
19644!:mime image/x-lss16
19645>4	leshort	x			\b, width %d
19646>6	leshort	x			\b, height %d
19647
196480	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
19649>4	belong	x			version %d
19650
19651# SE Linux policy database
19652# From: Mike Frysinger <vapier@gentoo.org>
196530	lelong	0xf97cff8c		SE Linux policy
19654>16	lelong	x			v%d
19655>20	lelong	1			MLS
19656>24	lelong	x			%d symbols
19657>28	lelong	x			%d ocons
19658
19659# Linux Logical Volume Manager (LVM)
19660# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
19661#
19662# System ID, UUID and volume group name are 128 bytes long
19663# but they should never be full and initialized with zeros...
19664#
19665# LVM1
19666#
196670x0	string/b	HM\001		LVM1 (Linux Logical Volume Manager), version 1
19668>0x12c	string/b	>\0		, System ID: %s
19669
196700x0	string/b	HM\002		LVM1 (Linux Logical Volume Manager), version 2
19671>0x12c	string/b	>\0		, System ID: %s
19672
19673#  LVM2
19674#
19675# It seems that the label header can be in one the four first sector
19676# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
19677#
19678# 0x200 seems to be the common case
196790		name	lvm2
19680# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
19681>0x0          string  >\x2f          \b, UUID: %.6s
19682>0x6          string  >\x2f          \b-%.4s
19683>0xa          string  >\x2f          \b-%.4s
19684>0xe          string  >\x2f          \b-%.4s
19685>0x12         string  >\x2f          \b-%.4s
19686>0x16         string  >\x2f          \b-%.4s
19687>0x1a         string  >\x2f          \b-%.6s
19688>0x20         lequad  x              \b, size: %lld
19689
19690
19691# read the offset to add to the start of the header, and the header
19692# start in 0x200
196930x218           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
19694>&(&-12.l-0x20) use	lvm2
19695
196960x018           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
19697>&(&-12.l-0x20) use	lvm2
19698
196990x418           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
19700>&(&-12.l-0x20) use	lvm2
19701
197020x618           string/b  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
19703>&(&-12.l-0x20) use	lvm2
19704
19705# LVM snapshot
19706# from Jason Farrel
197070	string	SnAp	LVM Snapshot (CopyOnWrite store)
19708>4	lelong	!0	- valid,
19709>4	lelong	0	- invalid,
19710>8	lelong	x	version %d,
19711>12	lelong	x	chunk_size %d
19712
19713# SE Linux policy database
197140	lelong	0xf97cff8c		SE Linux policy
19715>16	lelong	x			v%d
19716>20	lelong	1			MLS
19717>24	lelong	x			%d symbols
19718>28	lelong	x			%d ocons
19719
19720# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
19721# Anthon van der Neut (anthon@mnt.org)
197220	string	LUKS\xba\xbe	LUKS encrypted file,
19723>6	beshort x		ver %d
19724>8	string	x		[%s,
19725>40	string	x		%s,
19726>72	string	x		%s]
19727>168	string	x		UUID: %s
19728
19729
19730# Summary: Xen saved domain file
19731# Created by: Radek Vokal <rvokal@redhat.com>
197320	string		LinuxGuestRecord	Xen saved domain
19733>20	search/256	(name
19734>>&1	string		x			(name %s)
19735
19736# Type: Xen, the virtual machine monitor
19737# From: Radek Vokal <rvokal@redhat.com>
197380	string		LinuxGuestRecord	Xen saved domain
19739#>2	regex		\(name\ [^)]*\)		%s
19740>20	search/256	(name			(name
19741>>&1	string		x			%s...)
19742
19743# Systemd journald files
19744# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
19745# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
19746
19747# check magic
197480	string	LPKSHHRH
19749# check that state is one of known values
19750>16		ubyte&252	0
19751# check that each half of three unique id128s is non-zero
19752>>24		ubequad		>0
19753>>>32		ubequad		>0
19754>>>>40		ubequad		>0
19755>>>>>48		ubequad		>0
19756>>>>>>56	ubequad		>0
19757>>>>>>>64	ubequad		>0	Journal file
19758!:mime application/octet-stream
19759# provide more info
19760>>>>>>>>184	leqdate		0	empty
19761>>>>>>>>16	ubyte		0	\b, offline
19762>>>>>>>>16	ubyte		1	\b, online
19763>>>>>>>>16	ubyte		2	\b, archived
19764>>>>>>>>8	ulelong&1	1	\b, sealed
19765>>>>>>>>12	ulelong&1	1	\b, compressed
19766
19767# BCache backing and cache devices
19768# From: Gabriel de Perthuis <g2p.code@gmail.com>
197690x1008		lequad		8
19770>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
19771>>0x1010	ulequad		0	cache device
19772>>0x1010	ulequad		1	backing device
19773>>0x1010	ulequad		3	cache device
19774>>0x1010	ulequad		4	backing device
19775>>0x1048	string		>0	\b, label "%.32s"
19776>>0x1028	ubelong		x	\b, uuid %08x
19777>>0x102c	ubeshort	x	\b-%04x
19778>>0x102e	ubeshort	x	\b-%04x
19779>>0x1030	ubeshort	x	\b-%04x
19780>>0x1032	ubelong		x	\b-%08x
19781>>0x1036	ubeshort	x	\b%04x
19782>>0x1038	ubelong		x	\b, set uuid %08x
19783>>0x103c	ubeshort	x	\b-%04x
19784>>0x103e	ubeshort	x	\b-%04x
19785>>0x1040	ubeshort	x	\b-%04x
19786>>0x1042	ubelong		x	\b-%08x
19787>>0x1046	ubeshort	x	\b%04x
19788
19789# Linux device tree:
19790# File format description can be found in the Linux kernel sources at
19791# Documentation/devicetree/booting-without-of.txt
19792# From Christoph Biedl
197930		belong		0xd00dfeed
19794# structure and strings must be within blob
19795>&(8.L)		byte		x
19796>>&(12.L)	byte		x
19797>>>20		belong		>1	Device Tree Blob version %d
19798>>>>4		belong		x	\b, size=%d
19799>>>>20		belong		>1
19800>>>>>28		belong		x	\b, boot CPU=%d
19801>>>>20		belong		>2
19802>>>>>32		belong		x	\b, string block size=%d
19803>>>>20		belong		>16
19804>>>>>36		belong		x	\b, DT structure block size=%d
19805
19806# glibc locale archive as defined in glibc locale/locarchive.h
198070		lelong		0xde020109	locale archive
19808>24		lelong		x		%d strings
19809
19810# Linux Software RAID (mdadm)
19811# Russell Coker <russell@coker.com.au>
198120	name	linuxraid
19813>16	belong	x		UUID=%8x:
19814>20	belong	x		\b%8x:
19815>24	belong	x		\b%8x:
19816>28	belong	x		\b%8x
19817>32	string	x		name=%s
19818>72	lelong	x		level=%d
19819>92	lelong	x		disks=%d
19820
198214096	lelong	0xa92b4efc	Linux Software RAID
19822>4100	lelong	x		version 1.2 (%d)
19823>4096	use	linuxraid
19824
198250	lelong	0xa92b4efc	Linux Software RAID
19826>4	lelong	x		version 1.1 (%d)
19827>0	use	linuxraid
19828
19829# Summary:     Database file for mlocate
19830# Description: A database file as used by mlocate, a fast implementation
19831#              of locate/updatedb. It uses merging to reuse the existing
19832#              database and avoid rereading most of the filesystem. It's
19833#              the default version of locate on Arch Linux (and others).
19834# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
19835# Site:        https://fedorahosted.org/mlocate/
19836# Format docs: https://linux.die.net/man/5/mlocate.db
19837# Type: mlocate database file
19838# URL:  https://fedorahosted.org/mlocate/
19839# From: Wander Nauta <info@wandernauta.nl>
198400		string		\0mlocate	mlocate database
19841>12		byte		x		\b, version %d
19842>13		byte		1		\b, require visibility
19843>16		string		x		\b, root %s
19844
19845# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
19846# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
19847# From: Pavel Emelyanov <xemul@parallels.com>
198480		lelong		0x45311224	iproute2 routes dump
198490		lelong		0x47361222	iproute2 addresses dump
19850
19851# Image and service files for CRIU tool.
19852# URL: https://criu.org
19853# From: Pavel Emelyanov <xemul@parallels.com>
198540		lelong		0x54564319	CRIU image file v1.1
198550		lelong		0x55105940	CRIU service file
198560		lelong		0x58313116	CRIU inventory
19857
19858# Kdump compressed dump files
19859# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
19860
198610		string		KDUMP          	Kdump compressed dump
19862>8		long		x		v%d
19863>12		string		>\0		\b, system %s
19864>77		string		>\0		\b, node %s
19865>142		string		>\0		\b, release %s
19866>207		string		>\0		\b, version %s
19867>272		string		>\0		\b, machine %s
19868>337		string		>\0		\b, domain %s
19869
19870# Device Tree files
198710		search/1024	/dts-v1/	Device Tree File (v1)
19872# beat c code
19873!:strength +14
19874
19875#------------------------------------------------------------------------------
19876# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $
19877# lisp:  file(1) magic for lisp programs
19878#
19879# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
19880
19881# updated by Joerg Jenderek
19882# GRR: This lot is too weak
19883#0	string	;;
19884# windows INF files often begin with semicolon and use CRLF as line end
19885# lisp files are mainly created on unix system with LF as line end
19886#>2	search/4096	!\r		Lisp/Scheme program text
19887#>2	search/4096	\r		Windows INF file
19888
198890	search/4096	(setq\ 			Lisp/Scheme program text
19890!:mime	text/x-lisp
198910	search/4096	(defvar\ 		Lisp/Scheme program text
19892!:mime	text/x-lisp
198930	search/4096	(defparam\ 		Lisp/Scheme program text
19894!:mime	text/x-lisp
198950	search/4096	(defun\  		Lisp/Scheme program text
19896!:mime	text/x-lisp
198970	search/4096	(autoload\ 		Lisp/Scheme program text
19898!:mime	text/x-lisp
198990	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
19900!:mime	text/x-lisp
19901
19902# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
19903# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
19904# Update: Joerg Jenderek
19905# Emacs 18 - this is always correct, but not very magical.
199060	string	\012(
19907# look for emacs lisp keywords
19908# GRR: split regex because it is too long or get error like
19909# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
19910>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
19911!:mime	application/x-elc
19912# https://searchcode.com/codesearch/view/2173420/
19913# not really pure text
19914!:apple	EMAxTEXT
19915!:ext elc
19916# remaining regex
19917>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
19918!:mime	application/x-elc
19919!:apple	EMAxTEXT
19920!:ext elc
19921# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
19922
19923# Emacs 19+ - ver. recognition added by Ian Springer
19924# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
19925# - Chris Chittleborough <cchittleborough@yahoo.com.au>
19926# Update: Joerg Jenderek
199270	string	;ELC
19928# version\0\0\0
19929>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
19930# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
19931#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
19932!:mime	application/x-elc
19933!:apple	EMAxTEXT
19934!:ext elc
19935
19936# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
199370	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
199380	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
19939
199400	long	0x70768BD2		CLISP memory image data
199410	long	0xD28B7670		CLISP memory image data, other endian
19942
19943#.com and .bin for MIT scheme
199440	string	\372\372\372\372	MIT scheme (library?)
19945
19946# From: David Allouche <david@allouche.net>
199470	search/1	\<TeXmacs|	TeXmacs document text
19948!:mime	text/texmacs
19949
19950#------------------------------------------------------------------------------
19951# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $
19952# llvm:  file(1) magic for LLVM byte-codes
19953# URL:  https://llvm.org/docs/BitCodeFormat.html
19954# From: Al Stone <ahs3@fc.hp.com>
19955
199560	string	llvm	LLVM byte-codes, uncompressed
199570	string	llvc0	LLVM byte-codes, null compression
199580	string	llvc1	LLVM byte-codes, gzip compression
199590	string	llvc2	LLVM byte-codes, bzip2 compression
19960
199610	lelong	0x0b17c0de	LLVM bitcode, wrapper
19962# Are these Mach-O ABI values?  They appear to be.
19963>16	lelong	0x01000007	x86_64
19964>16	lelong	0x00000007	i386
19965>16	lelong	0x00000012	ppc
19966>16	lelong	0x01000012	ppc64
19967>16	lelong 	0x0000000c	arm
19968
199690	string	BC\xc0\xde	LLVM IR bitcode
19970
19971#------------------------------------------------------------------------------
19972# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $
19973# lua:  file(1) magic for Lua scripting language
19974# URL:  https://www.lua.org/
19975# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
19976
19977# Lua scripts
199780	search/1/w	#!\ /usr/bin/lua	Lua script text executable
19979!:mime	text/x-lua
199800	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
19981!:mime	text/x-lua
199820	search/1	#!/usr/bin/env\ lua	Lua script text executable
19983!:mime	text/x-lua
199840	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
19985!:mime	text/x-lua
19986
19987# Lua bytecode
199880	string		\033Lua			Lua bytecode,
19989>4	byte		0x50			version 5.0
19990>4	byte		0x51			version 5.1
19991>4	byte		0x52			version 5.2
19992
19993#------------------------------------------------------------------------------
19994# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
19995# luks:  file(1) magic for Linux Unified Key Setup
19996# URL:	http://luks.endorphin.org/spec
19997# From:	Anthon van der Neut <anthon@mnt.org>
19998
199990	string		LUKS\xba\xbe	LUKS encrypted file,
20000>6	beshort		x		ver %d
20001>8	string		x		[%s,
20002>40	string		x		%s,
20003>72	string		x		%s]
20004>168	string		x		UUID: %s
20005#------------------------------------------------------------------------------
20006# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $
20007# make:  file(1) magic for M4 scripts
20008#
200090	search/8192	dnl
20010>0	regex	\^dnl\ 		M4 macro processor script text
20011!:mime	text/x-m4
200120	search/8192	AC_DEFUN
20013>0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
20014!:strength + 15
20015!:mime	text/x-m4
20016
20017#------------------------------------------------------------
20018# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
20019# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
20020# Unfortunately the first, cafebabe, is shared with
20021# Java ByteCode, so they are both handled in the file "cafebabe".
20022# The "feedface" ones are handled herein.
20023#------------------------------------------------------------
20024# if set, it's for the 64-bit version of the architecture
20025# yes, this is separate from the low-order magic number bit
20026# it's also separate from the "64-bit libraries" bit in the
20027# upper 8 bits of the CPU subtype
20028
200290	name	mach-o-cpu
20030>0	belong&0x01000000	0
20031#
20032# 32-bit ABIs.
20033#
20034#				1	vax
20035>>0	belong&0x00ffffff	1
20036>>>4		belong&0x00ffffff	0	vax
20037>>>4		belong&0x00ffffff	1	vax11/780
20038>>>4		belong&0x00ffffff	2	vax11/785
20039>>>4		belong&0x00ffffff	3	vax11/750
20040>>>4		belong&0x00ffffff	4	vax11/730
20041>>>4		belong&0x00ffffff	5	uvaxI
20042>>>4		belong&0x00ffffff	6	uvaxII
20043>>>4		belong&0x00ffffff	7	vax8200
20044>>>4		belong&0x00ffffff	8	vax8500
20045>>>4		belong&0x00ffffff	9	vax8600
20046>>>4		belong&0x00ffffff	10	vax8650
20047>>>4		belong&0x00ffffff	11	vax8800
20048>>>4		belong&0x00ffffff	12	uvaxIII
20049>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
20050>>0	belong&0x00ffffff	2	romp
20051>>0	belong&0x00ffffff	3	architecture=3
20052>>0	belong&0x00ffffff	4	ns32032
20053>>0	belong&0x00ffffff	5	ns32332
20054>>0	belong&0x00ffffff	6	m68k
20055#				7	x86
20056>>0	belong&0x00ffffff	7
20057>>>4	belong&0x0000000f	3		i386
20058>>>4	belong&0x0000000f	4		i486
20059>>>>4	belong&0x00fffff0	0
20060>>>>4	belong&0x00fffff0	0x80		\bsx
20061>>>4	belong&0x0000000f	5		i586
20062>>>4	belong&0x0000000f	6
20063>>>>4	belong&0x00fffff0	0		p6
20064>>>>4	belong&0x00fffff0	0x10		pentium_pro
20065>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
20066>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
20067>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
20068>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
20069>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
20070>>>4	belong&0x0000000f	7		celeron
20071>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
20072>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
20073>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
20074>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
20075>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
20076>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
20077>>>>4	belong&0x00fffff0	0x60
20078>>>>4	belong&0x00fffff0	0x70		\b_mobile
20079>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
20080>>>4	belong&0x0000000f	8		pentium_3
20081>>>>4	belong&0x00fffff0	0x00
20082>>>>4	belong&0x00fffff0	0x10		\b_m
20083>>>>4	belong&0x00fffff0	0x20		\b_xeon
20084>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
20085>>>4	belong&0x0000000f	9		pentiumM
20086>>>>4	belong&0x00fffff0	0x00
20087>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
20088>>>4	belong&0x0000000f	10		pentium_4
20089>>>>4	belong&0x00fffff0	0x00
20090>>>>4	belong&0x00fffff0	0x10		\b_m
20091>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20092>>>4	belong&0x0000000f	11		itanium
20093>>>>4	belong&0x00fffff0	0x00
20094>>>>4	belong&0x00fffff0	0x10		\b_2
20095>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20096>>>4	belong&0x0000000f	12		xeon
20097>>>>4	belong&0x00fffff0	0x00
20098>>>>4	belong&0x00fffff0	0x10		\b_mp
20099>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
20100>>>4	belong&0x0000000f	>12		ia32 family=%d
20101>>>>4	belong&0x00fffff0	0x00
20102>>>>4	belong&0x00fffff0	>0x00		model=%x
20103>>0	belong&0x00ffffff	8	mips
20104>>>4		belong&0x00ffffff	1	R2300
20105>>>4		belong&0x00ffffff	2	R2600
20106>>>4		belong&0x00ffffff	3	R2800
20107>>>4		belong&0x00ffffff	4	R2000a
20108>>>4		belong&0x00ffffff	5	R2000
20109>>>4		belong&0x00ffffff	6	R3000a
20110>>>4		belong&0x00ffffff	7	R3000
20111>>>4		belong&0x00ffffff	>7	subarchitecture=%d
20112>>0	belong&0x00ffffff	9	ns32532
20113>>0	belong&0x00ffffff	10	mc98000
20114>>0	belong&0x00ffffff	11	hppa
20115>>>4		belong&0x00ffffff	0	7100
20116>>>4		belong&0x00ffffff	1	7100LC
20117>>>4		belong&0x00ffffff	>1	subarchitecture=%d
20118>>0	belong&0x00ffffff	12	arm
20119>>>4		belong&0x00ffffff	0
20120>>>4		belong&0x00ffffff	1	subarchitecture=%d
20121>>>4		belong&0x00ffffff	2	subarchitecture=%d
20122>>>4		belong&0x00ffffff	3	subarchitecture=%d
20123>>>4		belong&0x00ffffff	4	subarchitecture=%d
20124>>>4		belong&0x00ffffff	5	\bv4t
20125>>>4		belong&0x00ffffff	6	\bv6
20126>>>4		belong&0x00ffffff	7	\bv5tej
20127>>>4		belong&0x00ffffff	8	\bxscale
20128>>>4		belong&0x00ffffff	9	\bv7
20129>>>4		belong&0x00ffffff	10	\bv7f
20130>>>4		belong&0x00ffffff	11	\bv7s
20131>>>4		belong&0x00ffffff	12	\bv7k
20132>>>4		belong&0x00ffffff	13	\bv8
20133>>>4		belong&0x00ffffff	14	\bv6m
20134>>>4		belong&0x00ffffff	15	\bv7m
20135>>>4		belong&0x00ffffff	16	\bv7em
20136>>>4		belong&0x00ffffff	>16	subarchitecture=%d
20137#				13	m88k
20138>>0	belong&0x00ffffff	13
20139>>>4		belong&0x00ffffff	0	mc88000
20140>>>4		belong&0x00ffffff	1	mc88100
20141>>>4		belong&0x00ffffff	2	mc88110
20142>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
20143>>0	belong&0x00ffffff	14	SPARC
20144>>0	belong&0x00ffffff	15	i860g
20145>>0	belong&0x00ffffff	16	alpha
20146>>0	belong&0x00ffffff	17	rs6000
20147>>0	belong&0x00ffffff	18	ppc
20148>>>4		belong&0x00ffffff	0
20149>>>4		belong&0x00ffffff	1	\b_601
20150>>>4		belong&0x00ffffff	2	\b_602
20151>>>4		belong&0x00ffffff	3	\b_603
20152>>>4		belong&0x00ffffff	4	\b_603e
20153>>>4		belong&0x00ffffff	5	\b_603ev
20154>>>4		belong&0x00ffffff	6	\b_604
20155>>>4		belong&0x00ffffff	7	\b_604e
20156>>>4		belong&0x00ffffff	8	\b_620
20157>>>4		belong&0x00ffffff	9	\b_650
20158>>>4		belong&0x00ffffff	10	\b_7400
20159>>>4		belong&0x00ffffff	11	\b_7450
20160>>>4		belong&0x00ffffff	100	\b_970
20161>>>4		belong&0x00ffffff	>100	subarchitecture=%d
20162>>0	belong&0x00ffffff	>18	architecture=%d
20163>0	belong&0x01000000	0x01000000
20164#
20165# 64-bit ABIs.
20166#
20167>>0	belong&0x00ffffff	0	64-bit architecture=%d
20168>>0	belong&0x00ffffff	1	64-bit architecture=%d
20169>>0	belong&0x00ffffff	2	64-bit architecture=%d
20170>>0	belong&0x00ffffff	3	64-bit architecture=%d
20171>>0	belong&0x00ffffff	4	64-bit architecture=%d
20172>>0	belong&0x00ffffff	5	64-bit architecture=%d
20173>>0	belong&0x00ffffff	6	64-bit architecture=%d
20174>>0	belong&0x00ffffff	7	x86_64
20175>>>4		belong&0x00ffffff	0	subarchitecture=%d
20176>>>4		belong&0x00ffffff	1	subarchitecture=%d
20177>>>4		belong&0x00ffffff	2	subarchitecture=%d
20178>>>4		belong&0x00ffffff	3
20179>>>4		belong&0x00ffffff	4	\b_arch1
20180>>>4		belong&0x00ffffff	8	\b_haswell
20181>>>4		belong&0x00ffffff	>4	subarchitecture=%d
20182>>0	belong&0x00ffffff	8	64-bit architecture=%d
20183>>0	belong&0x00ffffff	9	64-bit architecture=%d
20184>>0	belong&0x00ffffff	10	64-bit architecture=%d
20185>>0	belong&0x00ffffff	11	64-bit architecture=%d
20186>>0	belong&0x00ffffff	12	arm64
20187>>>4		belong&0x00ffffff	0
20188>>>4		belong&0x00ffffff	1	\bv8
20189>>0	belong&0x00ffffff	13	64-bit architecture=%d
20190>>0	belong&0x00ffffff	14	64-bit architecture=%d
20191>>0	belong&0x00ffffff	15	64-bit architecture=%d
20192>>0	belong&0x00ffffff	16	64-bit architecture=%d
20193>>0	belong&0x00ffffff	17	64-bit architecture=%d
20194>>0	belong&0x00ffffff	18	ppc64
20195>>>4		belong&0x00ffffff	0
20196>>>4		belong&0x00ffffff	1		\b_601
20197>>>4		belong&0x00ffffff	2		\b_602
20198>>>4		belong&0x00ffffff	3		\b_603
20199>>>4		belong&0x00ffffff	4		\b_603e
20200>>>4		belong&0x00ffffff	5		\b_603ev
20201>>>4		belong&0x00ffffff	6		\b_604
20202>>>4		belong&0x00ffffff	7		\b_604e
20203>>>4		belong&0x00ffffff	8		\b_620
20204>>>4		belong&0x00ffffff	9		\b_650
20205>>>4		belong&0x00ffffff	10		\b_7400
20206>>>4		belong&0x00ffffff	11		\b_7450
20207>>>4		belong&0x00ffffff	100		\b_970
20208>>>4		belong&0x00ffffff	>100		subarchitecture=%d
20209>>0	belong&0x00ffffff	>18	64-bit architecture=%d
20210
20211
202120	name		mach-o-be
20213>0	byte		0xcf		64-bit
20214>4	use		mach-o-cpu
20215>12	belong		1		object
20216>12	belong		2		executable
20217>12	belong		3		fixed virtual memory shared library
20218>12	belong		4		core
20219>12	belong		5		preload executable
20220>12	belong		6		dynamically linked shared library
20221>12	belong		7		dynamic linker
20222>12	belong		8		bundle
20223>12	belong		9		dynamically linked shared library stub
20224>12	belong		10		dSYM companion file
20225>12	belong		11		kext bundle
20226>12	belong		>11
20227>>12	belong		x		filetype=%d
20228>24	belong		>0		\b, flags:<
20229>>24	belong		&0x0000001	\bNOUNDEFS
20230>>24	belong		&0x0000002	\b|INCRLINK
20231>>24	belong		&0x0000004	\b|DYLDLINK
20232>>24	belong		&0x0000008	\b|BINDATLOAD
20233>>24	belong		&0x0000010	\b|PREBOUND
20234>>24	belong		&0x0000020	\b|SPLIT_SEGS
20235>>24	belong		&0x0000040	\b|LAZY_INIT
20236>>24	belong		&0x0000080	\b|TWOLEVEL
20237>>24	belong		&0x0000100	\b|FORCE_FLAT
20238>>24	belong		&0x0000200	\b|NOMULTIDEFS
20239>>24	belong		&0x0000400	\b|NOFIXPREBINDING
20240>>24	belong		&0x0000800	\b|PREBINDABLE
20241>>24	belong		&0x0001000	\b|ALLMODSBOUND
20242>>24	belong		&0x0002000	\b|SUBSECTIONS_VIA_SYMBOLS
20243>>24	belong		&0x0004000	\b|CANONICAL
20244>>24	belong		&0x0008000	\b|WEAK_DEFINES
20245>>24	belong		&0x0010000	\b|BINDS_TO_WEAK
20246>>24	belong		&0x0020000	\b|ALLOW_STACK_EXECUTION
20247>>24	belong		&0x0040000	\b|ROOT_SAFE
20248>>24	belong		&0x0080000	\b|SETUID_SAFE
20249>>24	belong		&0x0100000	\b|NO_REEXPORTED_DYLIBS
20250>>24	belong		&0x0200000	\b|PIE
20251>>24	belong		&0x0400000	\b|DEAD_STRIPPABLE_DYLIB
20252>>24	belong		&0x0800000	\b|HAS_TLV_DESCRIPTORS
20253>>24	belong		&0x1000000	\b|NO_HEAP_EXECUTION
20254>>24	belong		&0x2000000	\b|APP_EXTENSION_SAFE
20255>>24	belong		x		\b>
20256
20257#
202580	lelong&0xfffffffe	0xfeedface	Mach-O
20259!:strength +1
20260!:mime application/x-mach-binary
20261>0	use	\^mach-o-be
20262
202630	belong&0xfffffffe	0xfeedface	Mach-O
20264!:strength +1
20265!:mime application/x-mach-binary
20266>0	use	mach-o-be
20267
20268#------------------------------------------------------------------------------
20269# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $
20270# macintosh description
20271#
20272# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
20273# Daniel Quinlan, quinlan@yggdrasil.com
20274# Update:	Joerg Jenderek
20275# URL:		https://en.wikipedia.org/wiki/BinHex
20276# Reference:	http://fileformats.archiveteam.org/wiki/BinHex
20277# Note:		only tested with version 4.0 and hqx extension
20278# Any text/binary before the characteristic comment sentence is to be ignored like in
20279# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
202800	search/1602	(This\ file\
20281>&0	use		binhex
20282# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
202830	search/2652/b	(This\ file\
20284>&0	use		binhex
202850	name				binhex
20286# keep splitted search string format similar like in version 5.37
20287>0	string	must\ be\ converted\ with\ BinHex\ 	BinHex binary text, version
20288# http://www.macdisk.com/binhexen.php3
20289!:apple	BNHQTEXT
20290# http://www.faqs.org/faqs/macintosh/comm-faq/part1/
20291>>&0	string	1.0					1.0
20292!:mime	application/mac-binhex
20293!:ext	hex
20294>>&0	string	2.0					2.0
20295!:mime	application/mac-binhex
20296!:ext	hcx
20297# BinHex	3.0 never existed
20298>>&0	string	4.0					4.0
20299!:mime	application/mac-binhex40
20300!:ext	hqx
20301# BinHex	5.0 also MacBinary I
20302>>&0	string	5.0					5.0
20303!:mime	application/mac-binhex40
20304!:ext	hqx
20305# this should never happen
20306>>&0	default	x
20307>>>&0	string	x					%.3s
20308!:mime	application/mac-binhex
20309!:ext	hqx
20310
20311# Stuffit archives are the de facto standard of compression for Macintosh
20312# files obtained from most archives. (franklsm@tuns.ca)
203130	string		SIT!			StuffIt Archive (data)
20314!:mime	application/x-stuffit
20315!:apple	SIT!SIT!
20316>2	string		x			: %s
203170	string		SITD			StuffIt Deluxe (data)
20318>2	string		x			: %s
203190	string		Seg			StuffIt Deluxe Segment (data)
20320>2	string		x			: %s
20321
20322# Newer StuffIt archives (grant@netbsd.org)
203230	string		StuffIt			StuffIt Archive
20324!:mime	application/x-stuffit
20325!:apple	SIT!SIT!
20326#>162	string		>0			: %s
20327
20328# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
20329# GRR: Too weak
20330#0	string		APPL			Macintosh Application (data)
20331#>2	string		x			\b: %s
20332
20333# Macintosh System files (franklsm@tuns.ca)
20334# GRR: Too weak
20335#0	string		zsys			Macintosh System File (data)
20336#0	string		FNDR			Macintosh Finder (data)
20337#0	string		libr			Macintosh Library (data)
20338#>2	string		x			: %s
20339#0	string		shlb			Macintosh Shared Library (data)
20340#>2	string		x			: %s
20341#0	string		cdev			Macintosh Control Panel (data)
20342#>2	string		x			: %s
20343#0	string		INIT			Macintosh Extension (data)
20344#>2	string		x			: %s
20345#0	string		FFIL			Macintosh Truetype Font (data)
20346#>2	string		x			: %s
20347#0	string		LWFN			Macintosh Postscript Font (data)
20348#>2	string		x			: %s
20349
20350# Additional Macintosh Files (franklsm@tuns.ca)
20351# GRR: Too weak
20352#0	string		PACT			Macintosh Compact Pro Archive (data)
20353#>2	string		x			: %s
20354#0	string		ttro			Macintosh TeachText File (data)
20355#>2	string		x			: %s
20356#0	string		TEXT			Macintosh TeachText File (data)
20357#>2	string		x			: %s
20358#0	string		PDF			Macintosh PDF File (data)
20359#>2	string		x			: %s
20360
20361# MacBinary format (Eric Fischer, enf@pobox.com)
20362# Update: Joerg Jenderek
20363# URL: https://en.wikipedia.org/wiki/MacBinary
20364# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
20365#
20366# Unfortunately MacBinary doesn't really have a magic number prior
20367# to the MacBinary III format.
20368#
20369
20370# old version number, must be kept at zero for compatibility
203710	byte	0
20372# length of filename (must be in the range 1-63)
20373>1	ubyte	>0
20374# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
20375>>1	ubyte	<64
20376# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
20377# by looking for printable characters at beginning of file name
20378>>>2	ubelong	>0x1F000000
20379# zero fill, must be zero for compatibility
20380>>>>74	byte	0
20381# zero fill, must be zero for compatibility
20382>>>>>82	byte	0
20383# MacBinary I		test for valid version numbers
20384>>>>>>122	ubeshort	0
20385# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
20386#>>>>>>>91	ubelong		>0x7c25b07F
20387# additional check for undefined header fields in MacBinary I
20388#>>>>>>>101	ulong		0
20389>>>>>>>0	use	mac-bin
20390# MacBinary II		the newer versions begins at 129
20391>>>>>>122	ubeshort	0x8181
20392>>>>>>>0	use	mac-bin
20393# MacBinary III with MacBinary II to read
20394>>>>>122	ubeshort	0x8281
20395>>>>>>0	use	mac-bin
20396
20397#	display information of MacBinary file
203980	name		mac-bin
20399>122	ubyte	x	MacBinary
20400# versions for MacBinary II/III
20401>122	ubyte	129		II
20402>122	ubyte	130		III
20403# only in MacBinary III
20404>>102	string	!mBIN		with surprising version
20405!:mime	application/x-macbinary
20406!:apple	PSPTBINA
20407!:ext	bin/macbin
20408# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
20409#>1	ubyte	>63		\b, name length %u too BIG!
20410#>122	ubeshort	x	\b, version 0x%x
20411# Finder flags if not 0
20412# >73	byte		!0		\b, flags 0x
20413# >73	byte		=0
20414# >>101	byte		!0		\b, flags 0x
20415# # original Finder flags (Bits 8-15)
20416# >73	byte		!0		\b%x
20417# # finder flags, bits 0-7
20418# >101	byte		!0		\b%x
20419>73	byte		&0x01		\b, inited
20420>73	byte		&0x02		\b, changed
20421>73	byte		&0x04		\b, busy
20422>73	byte		&0x08		\b, bozo
20423>73	byte		&0x10		\b, system
20424>73	byte		&0x20		\b, bundle
20425>73	byte		&0x40		\b, invisible
20426>73	byte		&0x80		\b, locked
20427
20428# 75	beshort				# vertical posn in window
20429#>75	beshort		!0		\b, v.pos %u
20430# 77	beshort				# horiz posn in window
20431#>77	beshort		!0		\b, h.pos %u
20432# 79	beshort				# window or folder ID
20433>79	ubeshort	!0		\b, ID 0x%x
20434# protected flag
20435>81	byte		!0		\b, protected 0x%x
20436# length of comment after resource
20437>99	ubeshort	!0		\b, comment length %u
20438# char. code of file name
20439>106	ubyte		!0		\b, char. code 0x%x
20440# still more Finder flags
20441>107	ubyte		!0		\b, more flags 0x%x
20442# length of total files when unpacked only used when pack and unpack on the fly
20443>116	ubelong		!0		\b, total length %u
20444# 120	beshort				# length of add'l header
20445>120	ubeshort	!0		\b, 2nd header length %u
20446# 124	beshort				# checksum
20447#>124	ubeshort	!0		\b, CRC 0x%x
20448# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
20449>91	beldate-0x7C25B080	x	\b, %s
20450# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
20451>91	ubelong		<0x7c25b080	INVALID date
20452#>91	belong-0x7C25B080	x	\b, DEBUG DATE %d
20453# last modified date
20454>95	beldate-0x7C25B080	x	\b, modified %s
20455# Apple creator+typ if not null
20456# file creator (normally expressed as four characters)
20457>69	ulong			!0	\b, creator
20458# instead 4 character code display full creator name
20459>>69	use			apple-creator
20460# file type (normally expressed as four characters)
20461>65	ulong			!0	\b, type
20462>>65	use			apple-type
20463# length of data segment
20464>83	ubelong			!0	\b, %u bytes
20465# filename (in the range 1-63)
20466>1	pstring			x	"%s"
20467# print 1 space and then at offset 128 inspect data fork content if it has one
20468>83	ubelong			!0	\b
20469>>128	indirect		x
20470# Afterwards resource fork if length of resource segment not zero
20471>87	ubelong			!0
20472# calculate resource fork offset
20473>>83	ubelong+128		x	\b, at 0x%x
20474# length of resource segment
20475>>87	ubelong			!0	%u bytes
20476>>(83.S+128)	ubequad		x	resource
20477# further resource fork content inspection
20478>>>&-8	indirect		x
20479
20480# Apple Type/Creator Database
20481# URL: https://en.wikipedia.org/wiki/Type_code
20482# Reference:	https://www.lacikam.co.il/tcdb/
20483#		https://www.macdisk.com/macsigen.php
20484# Note:	classic Mac OS files have two 4 character codes for type and creator.
20485#	Thereby the Finder attach documents types to applications.
20486
20487#>65	string		x		\b, type "%4.4s"
20488
20489#	display information about apple type
204900	name		apple-type
20491>0	string		8BIM		PhotoShop
20492>0	string		ALB3		PageMaker 3
20493>0	string		ALB4		PageMaker 4
20494>0	string		ALT3		PageMaker 3
20495>0	string		APPL		application
20496>0	string		AWWP		AppleWorks word processor
20497>0	string		CIRC		simulated circuit
20498>0	string		DRWG		MacDraw
20499>0	string		EPSF		Encapsulated PostScript
20500>0	string		FFIL		font suitcase
20501>0	string		FKEY		function key
20502>0	string		FNDR		Macintosh Finder
20503>0	string		GIFf		GIF image
20504>0	string		Gzip		GNU gzip
20505>0	string		INIT		system extension
20506>0	string		LIB\ 		library
20507>0	string		LWFN		PostScript font
20508>0	string		MSBC		Microsoft BASIC
20509>0	string		PACT		Compact Pro archive
20510>0	string		PDF\ 		Portable Document Format
20511>0	string		PICT		picture
20512>0	string		PNTG		MacPaint picture
20513>0	string		PREF		preferences
20514>0	string		PROJ		Think C project
20515>0	string		QPRJ		Think Pascal project
20516>0	string		SCFL		Defender scores
20517>0	string		SCRN		startup screen
20518>0	string		SITD		StuffIt Deluxe
20519>0	string		SPn3		SuperPaint
20520>0	string		STAK		HyperCard stack
20521>0	string		Seg\ 		StuffIt segment
20522>0	string		TARF		Unix tar archive
20523>0	string		TEXT		ASCII
20524>0	string		TIFF		TIFF image
20525>0	string		TOVF		Eudora table of contents
20526>0	string		WDBN		Microsoft Word word processor
20527>0	string		WORD		MacWrite word processor
20528>0	string		XLS\ 		Microsoft Excel
20529>0	string		ZIVM		compress (.Z)
20530>0	string		ZSYS		Pre-System 7 system file
20531>0	string		acf3		Aldus FreeHand
20532>0	string		cdev		control panel
20533>0	string		dfil		Desk Accessory suitcase
20534>0	string		libr		library
20535>0	string		nX^d		WriteNow word processor
20536>0	string		nX^w		WriteNow dictionary
20537>0	string		rsrc		resource
20538>0	string		scbk		Scrapbook
20539>0	string		shlb		shared library
20540>0	string		ttro		SimpleText read-only
20541>0	string		zsys		system file
20542
20543#	additional types added in Dec 2017
20544>0	string		BINA		binary file
20545>0	string		BMPp		BMP image
20546>0	string		JPEG		JPEG image
20547#>0	string		W4BN		Microsoft Word x.y word processor?
20548# if type name is not known display 4 character identifier
20549>0	default		x
20550>>0	string		x		'%4.4s'
20551
20552#>69	string		x		\b, creator "%4.4s"
20553
20554# Now Apple has no repository of registered Creator IDs any more. These are
20555# just the ones that I happened to have files from and was able to identify.
20556
20557#	display information about apple creator
205580	name		apple-creator
20559>0	string		8BIM		Adobe Photoshop
20560>0	string		ALD3		PageMaker 3
20561>0	string		ALD4		PageMaker 4
20562>0	string		ALFA		Alpha editor
20563>0	string		APLS		Apple Scanner
20564>0	string		APSC		Apple Scanner
20565>0	string		BRKL		Brickles
20566>0	string		BTFT		BitFont
20567>0	string		CCL2		Common Lisp 2
20568>0	string		CCL\ 		Common Lisp
20569>0	string		CDmo		The Talking Moose
20570>0	string		CPCT		Compact Pro
20571>0	string		CSOm		Eudora
20572>0	string		DMOV		Font/DA Mover
20573>0	string		DSIM		DigSim
20574>0	string		EDIT		Macintosh Edit
20575>0	string		ERIK		Macintosh Finder
20576>0	string		EXTR		self-extracting archive
20577>0	string		Gzip		GNU gzip
20578>0	string		KAHL		Think C
20579>0	string		LWFU		LaserWriter Utility
20580>0	string		LZIV		compress
20581>0	string		MACA		MacWrite
20582>0	string		MACS		Macintosh operating system
20583>0	string		MAcK		MacKnowledge terminal emulator
20584>0	string		MLND		Defender
20585>0	string		MPNT		MacPaint
20586>0	string		MSBB		Microsoft BASIC (binary)
20587>0	string		MSWD		Microsoft Word
20588>0	string		NCSA		NCSA Telnet
20589>0	string		PJMM		Think Pascal
20590>0	string		PSAL		Hunt the Wumpus
20591#>0	string		PSI2		Apple File Exchange
20592>0	string		R*ch		BBEdit
20593>0	string		RMKR		Resource Maker
20594>0	string		RSED		Resource Editor
20595>0	string		Rich		BBEdit
20596>0	string		SIT!		StuffIt
20597>0	string		SPNT		SuperPaint
20598>0	string		Unix		NeXT Mac filesystem
20599>0	string		VIM!		Vim editor
20600>0	string		WILD		HyperCard
20601>0	string		XCEL		Microsoft Excel
20602>0	string		aCa2		Fontographer
20603>0	string		aca3		Aldus FreeHand
20604>0	string		dosa		Macintosh MS-DOS file system
20605>0	string		movr		Font/DA Mover
20606>0	string		nX^n		WriteNow
20607>0	string		pdos		Apple ProDOS file system
20608>0	string		scbk		Scrapbook
20609>0	string		ttxt		SimpleText
20610>0	string		ufox		Foreign File Access
20611#	additional creators added in Dec 2017
20612# Claris/Apple Works
20613>0	string		BOBO		Apple Works
20614# CU-SeeMe_0.87b3_(68K).bin
20615#>0	string		CUce		bar
20616>0	string		PSPT		Apple File Exchange
20617# Disk_Copy_4.2.sea.bin
20618#>0	string		NCse		foo
20619# probably StuffIt/Aladdin by Smith Micro Software, Inc.
20620>0	string		STi0		stuffit
20621# MacGzip-1.1.3.sea.bin
20622#>0	string		aust		bar
20623# D-Disk_Copy_6.3.3.smi.bin
20624>0	string		oneb		Disk Copy Self Mounting
20625# if creator name is not known display 4 character identifier
20626>0	default		x
20627>>0	string		x		'%4.4s'
20628
20629# sas magic from Bruce Foster (bef@nwu.edu)
20630#
20631#0	string		SAS		SAS
20632#>8	string		x		%s
206330	string		SAS		SAS
20634>24	string		DATA		data file
20635>24	string		CATALOG		catalog
20636>24	string		INDEX		data file index
20637>24	string		VIEW		data view
20638# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
20639#
206400x54    string          SAS             SAS 7+
20641>0x9C   string          DATA            data file
20642>0x9C   string          CATALOG         catalog
20643>0x9C   string          INDEX           data file index
20644>0x9C   string          VIEW            data view
20645
20646# spss magic for SPSS system and portable files,
20647#	 from Bruce Foster (bef@nwu.edu).
20648
206490	long		0xc1e2c3c9	SPSS Portable File
20650>40	string 		x		%s
20651
206520	string		$FL2		SPSS System File
20653>24	string		x		%s
20654
206550	string		$FL3		SPSS System File
20656>24	string		x		%s
20657
20658# Macintosh filesystem data
20659# From "Tom N Harris" <telliamed@mac.com>
20660# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
20661# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
20662# entries depend on the data arithmetic added after v.35
20663# There's also some Pascal strings in here, ditto...
20664
20665# The boot block signature, according to IM:Files, is
20666# "for HFS volumes, this field always contains the value 0x4C4B."
20667# But if this is true for MFS or HFS+ volumes, I don't know.
20668# Alternatively, the boot block is supposed to be zeroed if it's
20669# unused, so a simply >0 should suffice.
20670
206710x400	beshort			0xD2D7		Macintosh MFS data
20672>0	beshort			0x4C4B		(bootable)
20673>0x40a	beshort			&0x8000		(locked)
20674>0x402	beldate-0x7C25B080	x		created: %s,
20675>0x406	beldate-0x7C25B080	>0		last backup: %s,
20676>0x414	belong			x		block size: %d,
20677>0x412	beshort			x		number of blocks: %d,
20678>0x424	pstring			x		volume name: %s
20679
20680# *.hfs updated by Joerg Jenderek
20681# https://en.wikipedia.org/wiki/Hierarchical_File_System
20682# "BD" gives many false positives
206830x400	beshort			0x4244
20684# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
20685# first block of volume bit map (always 3)
20686>0x40e	ubeshort		0x0003
20687# maximal length of volume name is 27
20688>>0x424		ubyte			<28	Macintosh HFS data
20689!:mime	application/x-apple-diskimage
20690#!:apple	hfsdINIT
20691#!:apple	MACSdisk
20692# https://www.macdisk.com/macsigen.php
20693#!:apple	ddskdevi
20694!:apple	????devi
20695# https://en.wikipedia.org/wiki/Apple_Disk_Image
20696!:ext hfs/dmg
20697>>>0		beshort			0x4C4B	(bootable)
20698#>>>0		beshort			0x0000	(not bootable)
20699>>>0x40a	beshort			&0x8000	(locked)
20700>>>0x40a	beshort			^0x0100	(mounted)
20701>>>0x40a	beshort			&0x0200	(spared blocks)
20702>>>0x40a	beshort			&0x0800	(unclean)
20703>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
20704# https://www.epochconverter.com/
20705# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
20706# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
20707# construct not working
20708#>>>0x402	beldate-0x7C25B080	x	created: %s,
20709#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
20710#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
20711# found block sizes 200h,1200h,2800h
20712>>>0x414	belong			x	block size: %d,
20713>>>0x412	beshort			x	number of blocks: %d,
20714>>>0x424	pstring			x	volume name: %s
20715
207160x400	beshort			0x482B		Macintosh HFS Extended
20717>&0	beshort			x		version %d data
20718>0	beshort			0x4C4B		(bootable)
20719>0x404	belong			^0x00000100	(mounted)
20720>&2	belong			&0x00000200	(spared blocks)
20721>&2	belong			&0x00000800	(unclean)
20722>&2	belong			&0x00008000	(locked)
20723>&6	string			x		last mounted by: '%.4s',
20724# really, that should be treated as a belong and we print a string
20725# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
20726>&14	beldate-0x7C25B080	x		created: %s,
20727# only the creation date is local time, all other timestamps in HFS+ are UTC.
20728>&18	bedate-0x7C25B080	x		last modified: %s,
20729>&22	bedate-0x7C25B080	>0		last backup: %s,
20730>&26	bedate-0x7C25B080	>0		last checked: %s,
20731>&38	belong			x		block size: %d,
20732>&42	belong			x		number of blocks: %d,
20733>&46	belong			x		free blocks: %d
20734
20735## AFAIK, only the signature is different
20736# same as Apple Partition Map
20737# GRR: This magic is too weak, it is just "TS"
20738#0x200		beshort		0x5453		Apple Old Partition data
20739#>0x2		beshort		x		block size: %d,
20740#>0x230		string		x		first type: %s,
20741#>0x210		string		x		name: %s,
20742#>0x254		belong		x		number of blocks: %d,
20743#>0x400		beshort		0x504D
20744#>>0x430		string		x		second type: %s,
20745#>>0x410		string		x		name: %s,
20746#>>0x454		belong		x		number of blocks: %d,
20747#>>0x800		beshort		0x504D
20748#>>>0x830	string		x		third type: %s,
20749#>>>0x810	string		x		name: %s,
20750#>>>0x854	belong		x		number of blocks: %d,
20751#>>>0xa00	beshort		0x504D
20752#>>>>0xa30	string		x		fourth type: %s,
20753#>>>>0xa10	string		x		name: %s,
20754#>>>>0xa54	belong		x		number of blocks: %d
20755
20756# From: Remi Mommsen <mommsen@slac.stanford.edu>
207570		string		BOMStore	Mac OS X bill of materials (BOM) file
20758
20759# From: Adam Buchbinder <adam.buchbinder@gmail.com>
20760# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
20761# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
20762# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
20763# don't know what they mean.
207640	belong	0x100
20765>(0x4.L+24)	beshort	x
20766>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
20767>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
20768>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
20769>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
20770
20771#------------------------------------------------------------------------------
20772# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
20773# MacOS files
20774#
20775
207760	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
20777
20778#------------------------------------------------------------------------------
20779# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
20780# magic:  file(1) magic for magic files
20781#
207820	string/t		#\ Magic	magic text file for file(1) cmd
207830	lelong		0xF11E041C	magic binary file for file(1) cmd
20784>4	lelong		x		(version %d) (little endian)
207850	belong		0xF11E041C	magic binary file for file(1) cmd
20786>4	belong		x		(version %d) (big endian)
20787#------------------------------------------------------------------------------
20788# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $
20789# mail.news:  file(1) magic for mail and news
20790#
20791# Unfortunately, saved netnews also has From line added in some news software.
20792#0	string		From 		mail text
207930	string/t		Relay-Version: 	old news text
20794!:mime	message/rfc822
207950	string/t		#!\ rnews	batched news text
20796!:mime	message/rfc822
207970	string/t		N#!\ rnews	mailed, batched news text
20798!:mime	message/rfc822
207990	string/t		Forward\ to 	mail forwarding text
20800!:mime	message/rfc822
208010	string/t		Pipe\ to 	mail piping text
20802!:mime	message/rfc822
208030	string/tc		delivered-to:	SMTP mail text
20804!:mime	message/rfc822
208050	string/tc		return-path:	SMTP mail text
20806!:mime	message/rfc822
208070	string/t		Path:		news text
20808!:mime	message/news
208090	string/t		Xref:		news text
20810!:mime	message/news
208110	string/t		From:		news or mail text
20812!:mime	message/rfc822
208130	string/t		Article 	saved news text
20814!:mime	message/news
20815# Reference:	http://quimby.gnus.org/notes/BABYL
20816# Update:	Joerg Jenderek
20817# Note:		used by Rmail in Emacs version 22 and before
20818#		is not text because of characters like Control-L Control-_
208190	string/b		BABYL\ OPTIONS:	Emacs RMAIL
20820#0	string/t		BABYL		Emacs RMAIL text
20821# https://reposcope.com/mimetype/message/x-gnu-rmail
20822!:mime	message/x-gnu-rmail
20823# ~/RMAIL
20824!:ext	/
208250	string/t		Received:	RFC 822 mail text
20826!:mime	message/rfc822
208270	string/t		MIME-Version:	MIME entity text
20828#0	string/t		Content-	MIME entity text
20829
20830# TNEF files...
208310	lelong		0x223E9F78	Transport Neutral Encapsulation Format
20832!:mime	application/vnd.ms-tnef
20833
20834# From: Kevin Sullivan <ksulliva@psc.edu>
208350	string		*mbx*		MBX mail folder
20836
20837# From: Simon Matter <simon.matter@invoca.ch>
208380	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
208390	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
20840
20841# JAM(mbp) Fidonet message area databases
20842# JHR file
208430	string	JAM\0			JAM message area header file
20844>12	leshort >0			(%d messages)
20845
20846# Squish Fidonet message area databases
20847# SQD file (requires at least one message in the area)
20848# XXX: Weak magic
20849#256	leshort	0xAFAE4453		Squish message area data file
20850#>4	leshort	>0			(%d messages)
20851
20852#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
20853
20854# Cyrus: file(1) magic for compiled Cyrus sieve scripts
20855# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
20856# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
20857# From: Philipp Hahn <hahn@univention.de>
20858
20859# Compiled Cyrus sieve script
208600       string CyrSBytecode     Cyrus sieve bytecode data,
20861>12     belong =1       version 1, big-endian
20862>12     lelong =1       version 1, little-endian
20863>12     belong x        version %d, network-endian
20864#------------------------------------------------------------------------------
20865# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $
20866# make:  file(1) magic for makefiles
20867#
20868# URL: https://en.wikipedia.org/wiki/Make_(software)
208690	regex/100l	\^CFLAGS	makefile script text
20870!:mime	text/x-makefile
208710	regex/100l	\^VPATH		makefile script text
20872!:mime	text/x-makefile
208730	regex/100l	\^LDFLAGS	makefile script text
20874!:mime	text/x-makefile
208750	regex/100l	\^all:		makefile script text
20876!:mime	text/x-makefile
208770	regex/100l	\^\\.PRECIOUS	makefile script text
20878!:mime	text/x-makefile
20879# Update: Joerg Jenderek
20880# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
20881# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
20882# by additional escaping point character
208830	regex/100l	\^\\.BEGIN	BSD makefile script text
20884!:mime	text/x-makefile
20885!:ext	/mk
20886!:strength +10
20887# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
20888# and NSIS script with "!include" by additional escaping point character
208890	regex/100l	\^\\.include	BSD makefile script text
20890!:mime	text/x-makefile
20891!:ext	/mk
20892!:strength +10
208930	regex/100l	\^\\.endif	BSD makefile script text
20894!:mime	text/x-makefile
20895!:ext	/mk
20896!:strength +10
208970	regex/100l	\^SUBDIRS	automake makefile script text
20898!:mime	text/x-makefile
20899!:strength +10
20900
20901
20902#------------------------------------------------------------------------------
20903# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $
20904# map:  file(1) magic for Map data
20905#
20906
20907# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
209088	string	.FIT		FIT Map data
20909>15	byte	0
20910>>35	belong	x		\b, unit id %d
20911>>39	lelong	x		\b, serial %u
20912# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
20913# 20 years after unix epoch
20914# TZ=GMT date -d '1989-12-31 0:00' +%s
20915>>43	leldate+631065600	x	\b, %s
20916
20917>>47	leshort x		\b, manufacturer %d
20918>>47	leshort	1		\b (garmin)
20919>>49	leshort x		\b, product %d
20920>>53	byte	x		\b, type %d
20921>>53	byte	1		\b (Device)
20922>>53	byte	2		\b (Settings)
20923>>53	byte	3		\b (Sports/Cycling)
20924>>53	byte	4		\b (Activity)
20925>>53	byte	8		\b (Elevations)
20926>>53	byte	10		\b (Totals)
20927
20928# Summary: Garmin map
20929# From:	Joerg Jenderek
20930# URL: https://en.wikipedia.org/wiki/Garmin_.img
20931# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
20932# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf
20933# GRR: similar to MBR boot sector handled by ./filesystems
209340x1FE	leshort		=0xAA55
20935# look for valid map signature
20936>0x13	string		=IMG\0
20937>>0	use		garmin-map
209380	name				garmin-map
20939>0	ubyte		x		Garmin
20940!:mime	application/x-garmin-map
20941# If non-zero, every byte of the entire .img file is to be XORed with this value
20942>0	ubyte		!0		\b, 0x%x XORed
20943# goto block before FAT
20944>(0x40.b*512)	ubyte	x
20945# 1st fat name "DLLINFO TXT" only found for vpm
20946>>&512 		string	=DLLINFO\ TXT 	map (Voice Processing)
20947# there exist 2 other Garmin VPM formats; see ./audio
20948!:ext	vpm
20949# Deutsch__Yannick_D4481-00_0210.vpm
20950#>>>512	search/0x0116da60/s	RIFF	\b; with
20951# determine type voice type by ./riff
20952#>>>>&0	indirect	x	\b
20953>>&512 		string	!DLLINFO\ TXT 	map
20954!:ext	img
20955# 9 zeros
20956>1 	ubelong		!0 		\b, zeroes 0x%x
20957# Map's version major
20958>8	ubyte		x		v%u
20959# Map's version minor
20960>9	ubyte		x		\b.%.2u
20961# Map description[20], 0x20 padded
20962>0x49	string		x		%.20s
20963# Map name, continued (0x20 padded, \0 terminated)
20964>0x65	string		>\ 		\b%.31s
20965# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62)
20966>0xB	ubyte		x		\b, updated
20967>>0xB	ubyte		>0x62
20968>>>0xB	ubyte-100	x		20%.2u
20969>>0xB	ubyte		<0x63
20970>>>0xB	ubyte		x		20%.2u
20971# Update month (0-11)
20972>0xA	ubyte		x		\b-%.2u
20973# All zeroes
20974>0xc 	uleshort	!0 		\b, zeroes 0x%x
20975# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport
20976#>0xE	ubyte		!0		\b, Mapsource flag 0x%x
20977>0xE	ubyte		1		\b, Mapsource
20978# Checksum, sum of all bytes modulo 256 should be 0
20979#>0xF	ubyte		x		\b, Checksum 0x%x
20980# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map
20981>0x10	string		!DSKIMG		\b, signature "%.7s"
20982>0x39	use		garmin-date
20983# Map file identifier like GARMIN\0
20984>0x41	string		!GARMIN		\b, id "%.7s"
20985# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes
20986>0x61	ubyte		!0x09		\b, E1=%u
20987# Block size exponent, E2 ; file blocksize=2**(E1+E2)
20988>>0x62	ubyte		x		\b, E2=%u
20989>0x61	ubyte		=0x09		\b, blocksize
20990>>0x62	ubyte		0		512
20991>>0x62	ubyte		1		1024
20992>>0x62	ubyte		2		2048
20993>>0x62	ubyte		3		4096
20994>>0x62	ubyte		4		8192
20995>>0x62	ubyte		5		16384
20996>>0x62	default		x
20997>>>0x62	ubyte		x		E2=%u
20998# MBR signature
20999>0x1FE	leshort		!0xAA55		\b, invalid MBR
21000# 512 zeros
21001>0x200 	uquad		!0		\b, zeroes 0x%llx
21002# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file!
21003>0x40C	ulelong		>0		\b, at 0x%x
21004# sub-file Header length
21005#>>(0x40C.l)	uleshort	x	\b, header len 0x%x
21006>>(0x40C.l)	uleshort	x	%u bytes
21007# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc.
21008>>(0x40C.l+2)	ubyte	>0x1F
21009>>>(0x40C.l+2)	ubyte	<0xFF
21010>>>>(0x40C.l+2)	string	x		"%.10s"
21011# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.)
21012>>>>(0x40C.l+13)	ubyte	>0		\b, locked 0x%x
21013# Block sequence numbers like 0000 0100 0200 ... FFFF
21014# >0x420	ubequad		>0	\b, seq. 0x%16.16llx
21015# >>0x428	ubequad		>0	\b%16.16llx
21016# >>>0x430	ubequad	>0	\b%16.16llx
21017# >>>>0x438	ubequad	>0	\b%16.16llx
21018# >>>>>0x440	ubequad	>0	\b%16.16llx
21019# >>>>>>0x448	ubequad	>0	\b%16.16llx
21020# >>>>>>>0x450	ubequad	>0	\b%16.16llx
21021# >>>>>>>>0x458	ubequad	>0	\b%16.16llx
21022# >>>>>>>>>0x460	ubequad	>0	\b%16.16llx
21023# >>>>>>>>>>0x468	ubequad	>0	\b%16.16llx
21024# >>>>>>>>>>>0x470	ubequad	>0	\b%16.16llx
21025# >>>>>>>>>>>>0x478	ubequad	>0	\b%16.16llx
21026# >>>>>>>>>>>>>0x480	ubequad	>0	\b%16.16llx
21027# >>>>>>>>>>>>>>0x488	ubequad	>0	\b%16.16llx
21028# >>>>>>>>>>>>>>>0x490	ubequad	>0	\b%16.16llx
21029# >>>>>>>>>>>>>>>>0x498	ubequad	>0	\b%16.16llx
21030# >>>>>>>>>>>>>>>>>0x4A0	ubequad	>0	\b%16.16llx
21031# >>>>>>>>>>>>>>>>>>0x4A8	ubequad	>0	\b%16.16llx
21032# look for end of FAT
21033#>>0x420	search/512/s	\xff\xff	FAT END
21034# Physical block number of FAT header
21035#>0x40	ubyte		x		\b, FAT at phy. block %u
21036>0x40	ubyte		x
21037>>(0x40.b*512)	ubyte	x
21038# 1st FAT block
21039>>>&511 	use	garmin-fat
21040# 2nd FAT block
21041>>>&1023 	use	garmin-fat
21042# 3th FAT block
21043>>>&1535 	use	garmin-fat
21044# 4th FAT block
21045>>>&2047 	use	garmin-fat
21046# ... xth FAT block
21047#
21048# 314 zeros but not in vpm and also gmaptz.img
21049>0x84 	uquad		!0		\b, at 0x84 0x%llx
21050# display FileAllocationTable block entry in garmin map
210510	name				garmin-fat
21052>0	ubyte		x		\b;
21053# sub file part; 0x0003 seems to be garbage
21054>0x10	uleshort	!0		next 0x%4.4x
21055>0x10	uleshort	=0
21056# fat flag 0~dummy block 1~true sub file
21057>>0	ubyte		!1		flag %u
21058>>0	ubyte		=1
21059# sub-file name like MAKEGMAP 12345678
21060>>>0x1	string		x		%.8s
21061# sub-file typ like RGN TRE MDR LBL
21062>>>0x9	string		x		\b.%.3s
21063# size of sub file
21064>>>0xC	ulelong		x		\b, %u bytes
21065# 32-bit block sequence numbers
21066#>>>0x20	ubequad		x		\b, seq. 0x%16.16llx
21067
21068#	display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss
210690	name				garmin-date
21070# year like 2018
21071>0 	uleshort	x 		\b, created %u
21072# month (0-11)
21073>2	ubyte		x		\b-%.2u
21074# day (1-31)
21075>3	ubyte		x		\b-%.2u
21076# hour (0-23)
21077>4	ubyte		x		%u
21078# minute (0-59)
21079>5	ubyte		x		\b:%.2u
21080# second (0-59)
21081>6	ubyte		x		\b:%.2u
21082
21083# Summary: Garmin Map subfiles
21084# From:	Joerg Jenderek
21085# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format
21086# Garmin Common Header
210872	string	GARMIN\
21088# skip ASCII text by checking for low header length
21089>0	uleshort <0x1000	Garmin map,
21090# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format
21091>>9	string	GMP				subtile
21092!:mime			application/x-garmin-gpm
21093!:ext			gmp
21094# copyright message
21095>>>(0.s)		string		x	%s
21096>>>0x0E 		use		garmin-date
21097# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format
21098# This contains the searchable address table used for finding routing destinations
21099>>9	string	MDR				address table
21100!:mime			application/x-garmin-mdr
21101!:ext			mdr
21102# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format
21103# http://svn.parabola.me.uk/display/trunk/doc/nod.txt
21104# This contains the routing information
21105>>9	string	NOD				routing
21106!:mime			application/x-garmin-nod
21107!:ext			nod
21108>>>0x0E 		use		garmin-date
21109#>>>0x15			ulelong		x	\b, at 0x%x
21110#>>>0x19			ulelong		x	0x%x bytes NOD1
21111#>>>0x25			ulelong		x	\b, at 0x%x
21112#>>>0x29			ulelong		x	0x%x bytes NOD2
21113#>>>0x31			ulelong		x	\b, at 0x%x
21114#>>>0x35			ulelong		x	0x%x bytes NOD3
21115# URL: http://www.pinns.co.uk/osm/net.html
21116# routable highways (length, direction, allowed speed,house address information)
21117>>9	string	NET				highways
21118!:mime			application/x-garmin-net
21119!:ext			net
21120#>>>0x15			ulelong		x	\b, at 0x%x
21121#>>>0x19			ulelong		x	0x%x bytes NET1
21122#>>>0x22			ulelong		>0
21123#>>>>0x1E		ulelong		x	\b, at 0x%x
21124#>>>>0x22		ulelong		x	0x%x bytes NET2
21125#>>>0x2B			ulelong		>0
21126#>>>>0x27		ulelong		x	\b, at 0x%x
21127#>>>>0x2B		ulelong		x	0x%x bytes NET3
21128# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format
21129>>9	string	LBL				labels
21130!:mime			application/x-garmin-lbl
21131!:ext			lbl
21132>>>(0.s)		string	x	%s
21133# Label coding type 6h 9h and ah
21134>>>0x1E			ubyte		x	\b, coding type 0x%x
21135#>>>0x15			ulelong		x	\b, at 0x%x
21136#>>>0x19			ulelong		x	0x%x bytes LBL1
21137#>>>0x1F			ulelong		x	\b, at 0x%x
21138#>>>0x23			ulelong		x	0x%x bytes LBL2
21139#>>>0x2D			ulelong		x	\b, at 0x%x
21140#>>>0x31			ulelong		x	0x%x bytes LBL3
21141# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format
21142# A lookup table of the chars in the map's codepage, and their collating sequence
21143>>9	string	SRT				sort table
21144!:mime			application/x-garmin-srt
21145!:ext			srt
21146>>>0x0E 		use		garmin-date
21147# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format
21148>>9	string	TRE				tree
21149!:mime			application/x-garmin-tre
21150!:ext			tre
21151# title like City Nav Europe NTU 2019.2 Basemap
21152# or OSM Street map
21153>>>(0.s)		string		x	%s
21154# 2nd title like Copyright 1995-2018 by GARMIN Corporation.
21155# or http://www.openstreetmap.org/
21156>>>>&1			string		x	%s
21157>>>0x0E 		use		garmin-date
21158#>>>0x21			ulelong		x	\b, at 0x%x
21159#>>>0x25			ulelong		x	0x%x bytes TRE1
21160#>>>0x29			ulelong		x	\b, at 0x%x
21161#>>>0x2D			ulelong		x	0x%x bytes TRE2
21162#>>>0x31			ulelong		x	\b, at 0x%x
21163#>>>0x35			ulelong		x	0x%x bytes TRE3
21164# Copyright record size
21165#>>>0x39			uleshort	x	\b, copyright record size %u
21166# Map ID
21167>>>0x74			ulelong		x	\b, ID 0x%x
21168# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html
21169# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps
21170>>9	string	TRF				traffic,
21171!:mime			application/x-garmin-trf
21172!:ext			trf
21173# city/region like Preitenegg
21174>>>(0.s+1) 		string		x	1st %s
21175# highway part like L606/L148
21176>>>>&1			string		x	%s
21177# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format
21178# Reference: http://www.pinns.co.uk/osm/typformat.html
21179# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps
21180>>9	string	TYP				types
21181!:mime			application/x-garmin-typ
21182!:ext			typ
21183>>>0x0E 		use		garmin-date
21184# character set 1252 65001~UTF8
21185>>>0x15			uleshort	x	\b, code page %u
21186# POIs
21187#>>>0x17			ulelong		x	\b, at 0x%x
21188#>>>0x1B			ulelong		x	0x%x bytes TYP1
21189# extra pois
21190#>>>0x5B			ulelong		x	\b, at 0x%x
21191#>>>0x5F			ulelong		x	0x%x bytes TYP8
21192# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format
21193# http://www.pinns.co.uk/osm/RGN.html
21194# region data used by the Garmin software
21195>>9	string	RGN				region
21196!:mime			application/x-garmin-rgn
21197!:ext			rgn
21198# POIs,Indexed POIs,Polylines or Polygons or first map level
21199#>>>0x15			ulelong	       x	\b, at 0x%x
21200#>>>0x19			ulelong	       x	0x%x bytes RGN1
21201# polygons with extended types
21202#>>>0x21			ulelong	       >0
21203#>>>>0x1D		ulelong	       x	\b, at 0x%x
21204#>>>>0x21		ulelong	       x	0x%x bytes RGN2
21205# polylines with extended types
21206#>>>0x3D			ulelong	       >0
21207#>>>>0x39		ulelong	       x	\b, at 0x%x
21208#>>>>0x3D		ulelong	       x	0x%x bytes RGN3
21209# extended POIs
21210#>>>0x59			ulelong	       >0
21211#>>>>0x55		ulelong	       x	\b, at 0x%x
21212#>>>>0x59		ulelong	       x	0x%x bytes RGN3
21213#>>9	default		x		unknown map type
21214# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h,
21215# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
21216>>0	uleshort	x		\b, header length 0x%x
21217
21218# URL:		https://www.memotech.franken.de/FileFormats/
21219# Reference:	https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf
21220# From:		Joerg Jenderek
212210	string		KpGr		Garmin update
21222# format version like: 0064h~1.0
21223>0x4	uleshort	!0x0064
21224>>4	uleshort/100	x		\b, version %u
21225>>4	uleshort%100	x		\b.%u
21226# 1st Garmin entry
21227>6	use	garmin-entry
21228# 2nd Garmin entry
21229>(0x6.l+10)	ubyte		x
21230>>&0		use		garmin-entry
21231# 3rd entry
21232>(0x6.l+10)	ubyte		x
21233>>&(&0.l+4)	ubyte		x
21234>>>&0		use		garmin-entry
21235# look again at version to use default clause
21236>0x4	uleshort	x
21237# test for region content by looking for
21238# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales"
21239# 1 space after equal sign
21240>>0x3a	search/5/s	GARMIN\ BITMAP	\b=
21241!:mime	image/x-garmin-exe
21242!:ext	exe
21243>>>&0	indirect	x
21244# if not bitmap *.srf then region; 1 space after equal sign
21245>>0x3a	default		x		\b=
21246!:mime	application/x-garmin-rgn
21247!:ext	rgn
21248# recursiv embedded
21249>>>0x3a	search/5/s	KpGrd
21250>>>>&0	indirect	x
21251# look for ZIP or JAR archive by ./archive and ./zip
21252>>>0x3a	search/5/s	PK\003\004
21253>>>>&0	indirect	x
21254# TODO: other garmin RGN record content like foo
21255#>>0x3a	search/5/s	bar		BAR
21256#		display information of Garmin RGN record
212570	name	garmin-entry
21258# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region
21259#>0	ulelong		x		\b, length 0x%x
21260# data record (ID='D') with version content like 0064h~1.0
21261>4	ubyte		=0x44
21262>>5	uleshort	!0x0064		\b; Data
21263>>>5	uleshort/100	x		\b, version %u
21264>>>5	uleshort%100	x		\b.%u
21265# Application Record (ID='A')
21266>4	ubyte		=0x41		\b; App
21267# version content like 00c8h~2.0
21268>>5	uleshort	!0x00C8
21269>>>5	uleshort/100	x		\b, version %u
21270>>>5	uleshort%100	x		\b.%u
21271# builder name like: SQA sqa build hales
21272>>7	string		x		\b, build by %s
21273# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009
21274>>>&1	string		x		%s
21275# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01
21276>>>>&1	string		x		%s
21277# region record (ID='R')
21278>4	ubyte		=0x52		\b; Region
21279# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP
21280>>5	uleshort	x		ID=%u
21281# delay in ms: like 0, 500
21282>>7	ulelong		!0		\b, %u ms
21283# region size (is record length - 10)
21284#>>11	ulelong		x		\b, length 0x%x
21285# region content like:
21286# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive
21287#>>15	string		x		\b, content "%s"
21288>>15	ubequad		x		\b, content 0x%llx...
21289# This does NOT WORK!
21290#>>15	indirect	x		\b; contains
21291>4	default		x		\b; other
21292# garmin Record ID Identifies the record content like: D A R
21293>>4	ubyte		x		ID '%c'
21294
21295# TOM TOM GPS watches ttbin files:
21296# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
21297# From: Daniel Lenski
212980	byte	0x20
21299>1	leshort	0x0007
21300>>0x76	byte	0x20
21301>>>0x77	leshort	0x0075		TomTom activity file, v7
21302>>>>8	leldate	x		(%s,
21303>>>>3	byte    x		device firmware %d.
21304>>>>4	byte	x		\b%d.
21305>>>>5	byte	x		\b%d,
21306>>>>6	leshort	x		product ID %04d)
21307
21308
21309#------------------------------------------------------------------------------
21310# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
21311# maple:  file(1) magic for maple files
21312# "H. Nanosecond" <aldomel@ix.netcom.com>
21313# Maple V release 4, a multi-purpose math program
21314#
21315
21316# maple library .lib
213170	string	\000MVR4\nI	MapleVr4 library
21318
21319# .ind
21320# no magic for these :-(
21321# they are compiled indexes for maple files
21322
21323# .hdb
213240	string	\000\004\000\000	Maple help database
21325
21326# .mhp
21327# this has the form <PACKAGE=name>
213280	string	\<PACKAGE=	Maple help file
213290	string	\<HELP\ NAME=	Maple help file
213300	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
21331#0	string	#\ Newton	Maple help file, old style
213320	string	#\ daub	Maple help file, old style
21333#0	string	#===========	Maple help file, old style
21334
21335# .mws
213360	string	\000\000\001\044\000\221	Maple worksheet
21337#this is anomalous
213380	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
21339# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
21340# that is {VERSION major_version miunor_version computer_type version_string}
213410	string	{VERSION\ 	Maple worksheet
21342>9	string	>\0	version %.1s.
21343>>11	string	>\0	%.1s
21344
21345# .mps
213460	string	\0\0\001$	Maple something
21347# from byte 4 it is either 'nul E' or 'soh R'
21348# I think 'nul E' means a file that was saved as  a different name
21349# a sort of revision marking
21350# 'soh R' means new
21351>4	string	\000\105	An old revision
21352>4	string	\001\122	The latest save
21353
21354# .mpl
21355# some of these are the same as .mps above
21356#0000000 000 000 001 044 000 105 same as .mps
21357#0000000 000 000 001 044 001 122 same as .mps
21358
213590	string	#\n##\ <SHAREFILE=	Maple something
213600	string	\n#\n##\ <SHAREFILE=	Maple something
213610	string	##\ <SHAREFILE=	Maple something
213620	string	#\r##\ <SHAREFILE=	Maple something
213630	string	\r#\r##\ <SHAREFILE=	Maple something
213640	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
21365#--------------------------------------------
21366# marc21: file(1) magic for MARC 21 Format
21367#
21368# Kevin Ford (kefo@loc.gov)
21369#
21370# MARC21 formats are for the representation and communication
21371# of bibliographic and related information in machine-readable
21372# form.  For more info, see https://www.loc.gov/marc/
21373
21374
21375# leader position 20-21 must be 45
21376# and 22-23 also 00 so far, but we check that later.
2137720	string		45
21378>0	search/2048	\x1e
21379
21380# leader starts with 5 digits, followed by codes specific to MARC format
21381>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
21382!:mime	application/marc
21383>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
21384!:mime	application/marc
21385>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
21386!:mime	application/marc
21387>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
21388!:mime	application/marc
21389>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
21390!:mime	application/marc
21391
21392# leader position 22-23, should be "00" but is it?
21393>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
21394!:mime	application/marc
21395
21396#------------------------------------------------------------------------------
21397# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
21398# mathcad:  file(1) magic for Mathcad documents
21399# URL:	http://www.mathsoft.com/
21400# From:	Josh Triplett <josh@freedesktop.org>
21401
214020	string	.MCAD\t		Mathcad document
21403
21404#------------------------------------------------------------------------------
21405# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
21406# mathematica:  file(1) magic for mathematica files
21407# "H. Nanosecond" <aldomel@ix.netcom.com>
21408# Mathematica a multi-purpose math program
21409# versions 2.2 and 3.0
21410
21411#mathematica .mb
214120	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
21413!:ext mb
214140	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
21415!:ext mb
21416
21417# .ma
21418# multiple possibilites:
21419
214200	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
21421#>41	string	>\0	%s
21422!:ext mb
21423
21424#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
21425
21426#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
21427#>675	string	>\0	%s #doesn't work well
21428
21429# there may be 'cr' instread of 'nl' in some does this matter?
21430
21431# generic:
214320	string	(*^\r\r::[\011	Mathematica notebook version 2.x
21433!:ext mb
214340	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
21435!:ext mb
214360	string	(*^\015			Mathematica notebook version 2.x
21437!:ext mb
214380	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
21439!:ext mb
214400	string	(*^\r::[\011	Mathematica notebook version 2.x
21441!:ext mb
214420	string	(*^\r\n::[\011	Mathematica notebook version 2.x
21443!:ext mb
214440	string	(*^\n\n::[\011	Mathematica notebook version 2.x
21445!:ext mb
214460	string	(*^\n::[\011	Mathematica notebook version 2.x
21447!:ext mb
21448
21449
21450# Mathematica .mx files
21451
21452#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
214530	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
21454#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
21455# >71... is optional
21456>88	string	>\0	from %s
21457
21458
21459# Mathematica files PBF:
21460# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
214610	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
21462
21463# .ml files  These are menu resources I think
21464# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
21465# how to put that into a magic rule?
214664	string	\ A~	MAthematica .ml file
21467
21468# .nb files
21469#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
214700	string	(***********************	Mathematica 3.0 notebook
21471
21472# other (* matches it is a comment start in these langs
21473# GRR: Too weak; also matches other languages e.g. ML
21474#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
21475
21476#########################
21477# MatLab v5
214780       string  MATLAB  Matlab v5 mat-file
21479>126    short   0x494d  (big endian)
21480>>124   beshort x       version 0x%04x
21481>126    short   0x4d49  (little endian)
21482>>124   leshort x       version 0x%04x
21483
21484
21485#------------------------------------------------------------------------------
21486# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $
21487# matroska:  file(1) magic for Matroska files
21488#
21489# See https://www.matroska.org/
21490#
21491
21492# EBML id:
214930		belong		0x1a45dfa3
21494# DocType id:
21495>4		search/4096 	\x42\x82
21496# DocType contents:
21497>>&1		string		webm		WebM
21498!:mime  video/webm
21499>>&1		string		matroska	Matroska data
21500!:mime  video/x-matroska
21501
21502#------------------------------------------------------------------------------
21503# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
21504# Mavroyanopoulos Nikos <nmav@hellug.gr>
21505# mcrypt:   file(1) magic for mcrypt 2.2.x;
215060	string		\0m\3		mcrypt 2.5 encrypted data,
21507>4	string		>\0		algorithm: %s,
21508>>&1	leshort		>0		keysize: %d bytes,
21509>>>&0	string		>\0		mode: %s,
21510
215110	string		\0m\2		mcrypt 2.2 encrypted data,
21512>3	byte		0		algorithm: blowfish-448,
21513>3	byte		1		algorithm: DES,
21514>3	byte		2		algorithm: 3DES,
21515>3	byte		3		algorithm: 3-WAY,
21516>3	byte		4		algorithm: GOST,
21517>3	byte		6		algorithm: SAFER-SK64,
21518>3	byte		7		algorithm: SAFER-SK128,
21519>3	byte		8		algorithm: CAST-128,
21520>3	byte		9		algorithm: xTEA,
21521>3	byte		10		algorithm: TWOFISH-128,
21522>3	byte		11		algorithm: RC2,
21523>3	byte		12		algorithm: TWOFISH-192,
21524>3	byte		13		algorithm: TWOFISH-256,
21525>3	byte		14		algorithm: blowfish-128,
21526>3	byte		15		algorithm: blowfish-192,
21527>3	byte		16		algorithm: blowfish-256,
21528>3	byte		100		algorithm: RC6,
21529>3	byte		101		algorithm: IDEA,
21530>4	byte		0		mode: CBC,
21531>4	byte		1		mode: ECB,
21532>4	byte		2		mode: CFB,
21533>4	byte		3		mode: OFB,
21534>4	byte		4		mode: nOFB,
21535>5	byte		0		keymode: 8bit
21536>5	byte		1		keymode: 4bit
21537>5	byte		2		keymode: SHA-1 hash
21538>5	byte		3		keymode: MD5 hash
21539
21540#------------------------------------------------------------------------------
21541# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $
21542# measure: file(1) magic for measurement data
21543
21544# DIY-Thermocam raw data
215450	name	diy-thermocam-parser
21546>0	beshort	x	scale %d-
21547>2	beshort x	\b%d,
21548>4	lefloat	x	spot sensor temperature %f,
21549>9	ubyte	0	unit celsius,
21550>9	ubyte	1	unit fahrenheit,
21551>8	ubyte	x	color scheme %d
21552>10	ubyte	1	\b, show spot sensor
21553>11	ubyte	1	\b, show scale bar
21554>12	ubyte	&1	\b, minimum point enabled
21555>12	ubyte	&2	\b, maximum point enabled
21556>13	lefloat	x	\b, calibration: offset %f,
21557>17	lefloat x	slope %f
21558
215590	name	diy-thermocam-checker
21560>9	ubyte	<2
21561>>10	ubyte	<2
21562>>>11	ubyte	<2
21563>>>>12	ubyte	<4
21564>>>>>17	lefloat	>0.0001	DIY-Thermocam raw data
21565
21566# V2 and Leption 3.x:
2156738408	ubyte	<19
21568>38400	use	diy-thermocam-checker
21569>>38400	default x	(Lepton 3.x),
21570>>>38400	use	diy-thermocam-parser
21571
21572# V1 or Lepton 2.x
215739608	ubyte	<19
21574>9600	use	diy-thermocam-checker
21575>>9600	default	x	(Lepton 2.x),
21576>>>9600	use	diy-thermocam-parser
21577
21578
21579#------------------------------------------------------------------------------
21580# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $
21581# mercurial:  file(1) magic for Mercurial changeset bundles
21582# https://www.selenic.com/mercurial/wiki/
21583#
21584# Jesse Glick (jesse.glick@sun.com)
21585#
21586
215870	string		HG10		Mercurial changeset bundle
21588>4	string		UN		(uncompressed)
21589>4	string		GZ		(gzip compressed)
21590>4	string		BZ		(bzip2 compressed)
21591
21592#------------------------------------------------------------------------------
21593# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $
21594# metastore:  file(1) magic for metastore files
21595# From: Thomas Wissen
21596# see https://david.hardeman.nu/software.php#metastore
215970	string		MeTaSt00r3	Metastore data file,
21598>10	bequad		x		version %0llx
21599
21600#------------------------------------------------------------------------------
21601# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
21602# rinex:  file(1) magic for RINEX files
21603# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
21604# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
21605# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
2160660	string		RINEX
21607>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
21608>>&32	string		x		\b, date %15.15s
21609>>5	string		x		\b, version %6.6s
21610!:mime	rinex/broadcast
21611>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
21612>>&32	string		x		\b, date %15.15s
21613>>5	string		x		\b, version %6.6s
21614!:mime	rinex/observation
21615>80	search/256	XXRINEXC	RINEX Data, Clock
21616>>&32	string		x		\b, date %15.15s
21617>>5	string		x		\b, version %6.6s
21618!:mime	rinex/clock
21619>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
21620>>&32	string		x		\b, date %15.15s
21621>>5	string		x		\b, version %6.6s
21622!:mime	rinex/navigation
21623>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
21624>>&32	string		x		\b, date %15.15s
21625>>5	string		x		\b, version %6.6s
21626!:mime	rinex/navigation
21627>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
21628>>&32	string		x		\b, date %15.15s
21629>>5	string		x		\b, version %6.6s
21630!:mime	rinex/navigation
21631>80	search/256	XXRINEXM	RINEX Data, Meteorological
21632>>&32	string		x		\b, date %15.15s
21633>>5	string		x		\b, version %6.6s
21634!:mime	rinex/meteorological
21635>80	search/256	XXRINEXN	RINEX Data, Navigation
21636>>&32	string		x		\b, date %15.15s
21637>>5	string		x		\b, version %6.6s
21638!:mime	rinex/navigation
21639>80	search/256	XXRINEXO	RINEX Data, Observation
21640>>&32	string		x		\b, date %15.15s
21641>>5	string		x		\b, version %6.6s
21642!:mime	rinex/observation
21643
21644# https://en.wikipedia.org/wiki/GRIB
216450	string	GRIB
21646>7	byte	=1	Gridded binary (GRIB) version 1
21647>7	byte	=2	Gridded binary (GRIB) version 2
21648
21649#------------------------------------------------------------------------------
21650# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $
21651# Micro Focus COBOL data files.
21652
21653# https://documentation.microfocus.com/help/index.jsp?topic=\
21654# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
21655# http://www.cobolproducts.com/datafile/data-viewer.html
21656# https://github.com/miracle2k/mfcobol-export
21657
216580 string \x30\x00\x00\x7C
21659>36 string \x00\x3E Micro Focus File with Header (DAT)
21660!:mime application/octet-stream
21661
216620 string \x30\x7E\x00\x00
21663>36 string \x00\x3E Micro Focus File with Header (DAT)
21664!:mime application/octet-stream
21665
2166639 string \x02
21667>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
21668!:mime application/octet-stream
21669
21670#------------------------------------------------------------------------------
21671# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
21672# mime:  file(1) magic for MIME encoded files
21673#
216740	string/t		Content-Type:\040
21675>14	string		>\0		%s
216760	string/t		Content-Type:
21677>13	string		>\0		%s
21678
21679#------------------------------------------------------------------------------
21680# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
21681# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
21682# and DEC Ultrix
21683#
216840	beshort	0x0160		MIPSEB ECOFF executable
21685>20	beshort	0407		(impure)
21686>20	beshort	0410		(swapped)
21687>20	beshort	0413		(paged)
21688>8	belong	>0		not stripped
21689>8	belong	0		stripped
21690>22	byte	x		- version %d
21691>23	byte	x		\b.%d
21692#
216930	beshort	0x0162		MIPSEL-BE ECOFF executable
21694>20	beshort	0407		(impure)
21695>20	beshort	0410		(swapped)
21696>20	beshort	0413		(paged)
21697>8	belong	>0		not stripped
21698>8	belong	0		stripped
21699>23	byte	x		- version %d
21700>22	byte	x		\b.%d
21701#
217020	beshort	0x6001		MIPSEB-LE ECOFF executable
21703>20	beshort	03401		(impure)
21704>20	beshort	04001		(swapped)
21705>20	beshort	05401		(paged)
21706>8	belong	>0		not stripped
21707>8	belong	0		stripped
21708>23	byte	x		- version %d
21709>22	byte	x		\b.%d
21710#
217110	beshort	0x6201		MIPSEL ECOFF executable
21712>20	beshort	03401		(impure)
21713>20	beshort	04001		(swapped)
21714>20	beshort	05401		(paged)
21715>8	belong	>0		not stripped
21716>8	belong	0		stripped
21717>23	byte	x		- version %d
21718>22	byte	x		\b.%d
21719#
21720# MIPS 2 additions
21721#
217220	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
21723>20	beshort	0407		(impure)
21724>20	beshort	0410		(swapped)
21725>20	beshort	0413		(paged)
21726>8	belong	>0		not stripped
21727>8	belong	0		stripped
21728>22	byte	x		- version %d
21729>23	byte	x		\b.%d
21730#
217310	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
21732>20	beshort	0407		(impure)
21733>20	beshort	0410		(swapped)
21734>20	beshort	0413		(paged)
21735>8	belong	>0		not stripped
21736>8	belong	0		stripped
21737>22	byte	x		- version %d
21738>23	byte	x		\b.%d
21739#
217400	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
21741>20	beshort	03401		(impure)
21742>20	beshort	04001		(swapped)
21743>20	beshort	05401		(paged)
21744>8	belong	>0		not stripped
21745>8	belong	0		stripped
21746>23	byte	x		- version %d
21747>22	byte	x		\b.%d
21748#
217490	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
21750>20	beshort	03401		(impure)
21751>20	beshort	04001		(swapped)
21752>20	beshort	05401		(paged)
21753>8	belong	>0		not stripped
21754>8	belong	0		stripped
21755>23	byte	x		- version %d
21756>22	byte	x		\b.%d
21757#
21758# MIPS 3 additions
21759#
217600	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
21761>20	beshort	0407		(impure)
21762>20	beshort	0410		(swapped)
21763>20	beshort	0413		(paged)
21764>8	belong	>0		not stripped
21765>8	belong	0		stripped
21766>22	byte	x		- version %d
21767>23	byte	x		\b.%d
21768#
217690	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
21770>20	beshort	0407		(impure)
21771>20	beshort	0410		(swapped)
21772>20	beshort	0413		(paged)
21773>8	belong	>0		not stripped
21774>8	belong	0		stripped
21775>22	byte	x		- version %d
21776>23	byte	x		\b.%d
21777#
217780	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
21779>20	beshort	03401		(impure)
21780>20	beshort	04001		(swapped)
21781>20	beshort	05401		(paged)
21782>8	belong	>0		not stripped
21783>8	belong	0		stripped
21784>23	byte	x		- version %d
21785>22	byte	x		\b.%d
21786#
217870	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
21788>20	beshort	03401		(impure)
21789>20	beshort	04001		(swapped)
21790>20	beshort	05401		(paged)
21791>8	belong	>0		not stripped
21792>8	belong	0		stripped
21793>23	byte	x		- version %d
21794>22	byte	x		\b.%d
21795#
217960	beshort	0x180		MIPSEB Ucode
217970	beshort	0x182		MIPSEL-BE Ucode
21798
21799#------------------------------------------------------------------------------
21800# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
21801# mirage:  file(1) magic for Mirage executables
21802#
21803# XXX - byte order?
21804#
218050	long	31415		Mirage Assembler m.out executable
21806
21807#-----------------------------------------------------------------------------
21808# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $
21809# misctools:  file(1) magic for miscellaneous UNIX tools.
21810#
218110	search/1	%%!!			X-Post-It-Note text
218120	string/c	BEGIN:VCALENDAR		vCalendar calendar file
21813!:mime	text/calendar
21814# updated by Joerg Jenderek at Apr 2015
21815# Extension: .vcf
21816# https://en.wikipedia.org/wiki/VCard
218170	string/c	BEGIN:VCARD		vCard visiting card
21818# deprecated
21819#!:mime	text/x-vcard
21820!:mime	text/vcard
21821# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
21822>12	search/14000/c	VERSION:
21823# VERSION 2.1 , 3.0 or 4.0
21824>>&0	string		x			\b, version %-.3s
21825
21826# Summary: Libtool library file
21827# Extension: .la
21828# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
218290	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
21830
21831# Summary: Libtool object file
21832# Extension: .lo
21833# Submitted by: Abel Cheung <abelcheung@gmail.com>
218340	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
21835
21836# From: Daniel Novotny <dnovotny@redhat.com>
21837# Update: Joerg Jenderek
21838# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
21839# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
21840#
21841# "Windows Minidump" by TrID
21842# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
218430	string		MDMP					Mini DuMP crash report
21844# https://filext.com/file-extension/DMP
21845!:mime	application/x-dmp
21846!:ext	dmp/mdmp
21847# The high-order word is an internal value that is implementation specific.
21848# The low-order word is MINIDUMP_VERSION 0xA793
21849>4	ulelong&0x0000FFFF	!0xA793				\b, version 0x%4.4x
21850# NumberOfStreams 8,9,10,13
21851>8	ulelong			x				\b, %d streams
21852# StreamDirectoryRva 0x20
21853>12	ulelong			!0x20				\b, 0x%8.8x RVA
21854# CheckSum 0
21855>16	ulelong			!0				\b, CheckSum 0x%8.8x
21856# Reserved or TimeDateStamp
21857>20	ledate			x				\b, %s
21858# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
21859# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
21860>24	ulelong			x				\b, 0x%x type
21861# >24	ulelong			>0				\b; include
21862# >>24	ulelong			&0x00000001			\b data sections,
21863# >>24	ulelong			&0x00000020			\b list of unloaded modules,
21864# >>24	ulelong			&0x00000100			\b process and thread information,
21865# >>24	ulelong			&0x00000800			\b memory information,
21866
21867# Summary: abook addressbook file
21868# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
218690	string	#\x20abook\x20addressbook\x20file abook address book
21870!:mime application/x-abook-addressbook
21871
21872#------------------------------------------------------------------------------
21873# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
21874# mkid:  file(1) magic for mkid(1) databases
21875#
21876# ID is the binary tags database produced by mkid(1).
21877#
21878# XXX - byte order?
21879#
218800	string		\311\304	ID tags data
21881>2	short		>0		version %d
21882
21883#------------------------------------------------------------------------------
21884# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
21885# mlssa: file(1) magic for MLSSA datafiles
21886#
218870		lelong		0xffffabcd	MLSSA datafile,
21888>4		leshort		x		algorithm %d,
21889>10		lelong		x		%d samples
21890
21891#------------------------------------------------------------------------------
21892# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
21893# mmdf:  file(1) magic for MMDF mail files
21894#
218950	string	\001\001\001\001	MMDF mailbox
21896
21897#------------------------------------------------------------------------------
21898# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $
21899# modem:  file(1) magic for modem programs
21900#
21901# From: Florian La Roche <florian@knorke.saar.de>
219021	string		PC\ Research,\ Inc	Digifax-G3-File
21903>29	byte		1			\b, fine resolution
21904>29	byte		0			\b, normal resolution
21905
21906# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
21907# Modified by: Joerg Jenderek
21908# URL: https://de.wikipedia.org/wiki/Fax
21909# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
21910# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
219110	short		0x0100
21912# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
21913>2	search/9	\0\0
21914# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
21915>2	default		x
21916# skip IRCAM file (VAX big-endian)	./audio
21917>>0	belong		!0x0001a364
21918# skip GEM Image data			./images
21919>>>2	beshort		!0x0008
21920# look for first keyword of Panorama database *.pan
21921>>>>11	search/262	\x06DESIGN
21922# skip Panorama database
21923>>>>11	default		x
21924# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
21925>>>>>27118	search/1864	DreamWorld
21926>>>>>27118	default		x
21927# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
21928>>>>>>8		ubequad		!0x2e01010454010203
21929# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
21930>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
21931# version 5.25 labeled the entry above "raw G3 data, byte-padded"
21932!:mime	image/g3fax
21933#!:apple	????TIFF
21934!:ext	g3
21935# unusual image starting with black pixel
21936#0	short		0x1300		raw G3 (Group 3) FAX
219370	short		0x1400
21938# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
21939>2	search/9	\0\0
21940# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
21941>2	default		x		raw G3 (Group 3) FAX
21942# version 5.25 labeled the above entry as "raw G3 data"
21943!:mime	image/g3fax
21944!:ext	g3
21945# unusual image with black pixel near beginning
21946#0	short		0x1900		raw G3 (Group 3) FAX
21947
21948#
21949# Magic data for vgetty voice formats
21950# (Martin Seine & Marc Eberhard)
21951
21952#
21953# raw modem data version 1
21954#
219550    string    RMD1      raw modem data
21956>4   string    >\0       (%s /
21957>20  short     >0        compression type 0x%04x)
21958
21959#
21960# portable voice format 1
21961#
219620    string    PVF1\n         portable voice format
21963>5   string    >\0       (binary %s)
21964
21965#
21966# portable voice format 2
21967#
219680    string    PVF2\n         portable voice format
21969>5   string >\0          (ascii %s)
21970
21971# From: Bernd Nuernberger <bernd.nuernberger@web.de>
21972# Brooktrout G3 fax data incl. 128 byte header
21973# Common suffixes: 3??, BRK, BRT, BTR
219740	leshort		0x01bb
21975>2	leshort		0x0100		Brooktrout 301 fax image,
21976>>9	leshort		x		%d x
21977>>0x2d	leshort		x		%d
21978>>6	leshort		200		\b, fine resolution
21979>>6	leshort		100		\b, normal resolution
21980>>11	byte		1		\b, G3 compression
21981>>11	byte		2		\b, G32D compression
21982
21983#------------------------------------------------------------------------------
21984# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $
21985# modulefile:  file(1) magic for user's environment modulefile
21986# URL: http://modules.sourceforge.net/
21987# Reference: https://modules.readthedocs.io/en/stable/modulefile.html
21988# From: Xavier Delaruelle <xavier.delaruelle@cea.fr>
219890	string	#%Module	modulefile
21990!:mime	text/x-modulefile
21991
21992#------------------------------------------------------------------------------
21993# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
21994# motorola:  file(1) magic for Motorola 68K and 88K binaries
21995#
21996# 68K
21997#
219980	beshort		0520		mc68k COFF
21999>18	beshort		^00000020	object
22000>18	beshort		&00000020	executable
22001>12	belong		>0		not stripped
22002>168	string		.lowmem		Apple toolbox
22003>20	beshort		0407		(impure)
22004>20	beshort		0410		(pure)
22005>20	beshort		0413		(demand paged)
22006>20	beshort		0421		(standalone)
220070	beshort		0521		mc68k executable (shared)
22008>12	belong		>0		not stripped
220090	beshort		0522		mc68k executable (shared demand paged)
22010>12	belong		>0		not stripped
22011#
22012# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
22013#
220140	beshort		0554		68K BCS executable
22015#
22016# 88K
22017#
22018# Motorola/88Open BCS
22019#
220200	beshort		0555		88K BCS executable
22021#
22022# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
220230   string      S0          Motorola S-Record; binary data in text format
22024
22025# ATARI ST relocatable PRG
22026#
22027# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
22028# (according to Roland Waldi, Oct 21, 1987)
22029# besides the magic 0x601a, the text segment size is checked to be
22030# not larger than 1 MB (which is a lot on ST).
22031# The additional 0x601b distinction I took from Doug Lee's magic.
220320	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
22033>2	belong			x		(txt=%d,
22034>6	belong			x		dat=%d,
22035>10	belong			x		bss=%d,
22036>14	belong			x		sym=%d)
220370	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
22038>2	belong			x		(txt=%d,
22039>6	belong			x		dat=%d,
22040>10	belong			x		bss=%d,
22041>14	belong			x		sym=%d)
22042
22043# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
220440       beshort         0x601A          Atari 68xxx executable,
22045>2      belong          x               text len %u,
22046>6      belong          x               data len %u,
22047>10     belong          x               BSS len %u,
22048>14     belong          x               symboltab len %u,
22049>18     belong          0
22050>22     belong          &0x01           fastload flag,
22051>22     belong          &0x02           may be loaded to alternate RAM,
22052>22     belong          &0x04           malloc may be from alternate RAM,
22053>22     belong          x               flags: 0x%X,
22054>26     beshort         0               no relocation tab
22055>26     beshort         !0              + relocation tab
22056>30     string          SFX             [Self-Extracting LZH SFX archive]
22057>38     string          SFX             [Self-Extracting LZH SFX archive]
22058>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
22059
220600       beshort         0x0064          Atari 68xxx CPX file
22061>8      beshort         x               (version %04x)
22062
22063#------------------------------------------------------------------------------
22064# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $
22065# mozilla:  file(1) magic for Mozilla XUL fastload files
22066# (XUL.mfasl and XPC.mfasl)
22067# URL:	https://www.mozilla.org/
22068# From:	Josh Triplett <josh@freedesktop.org>
22069
220700	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
22071# Probably the next magic line contains misspelled "mozLz40\0"
220720	string	mozLz4a				Mozilla lz4 compressed bookmark data
22073# From: Joerg Jenderek
22074# URL: https://lz4.github.io/lz4/
22075# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
22076# dejsonlz4-master\src\dejsonlz4.c
22077# Note: mostly JSON compressed with a non-standard LZ4 header
22078# can be unpacked by dejsonlz4 but not lz4 programm.
220790	string	mozLz40\0			Mozilla lz4 compressed data
22080!:mime	application/x-lz4+json
22081# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
22082!:ext	jsonlz4/mozlz4
22083# decomp_size
22084>8	ulelong	x				\b, originally %u bytes
22085# lz4 data
22086#>12	ubequad	x				\b, lz4 data 0x%16.16llx
22087
22088# From: Joerg Jenderek
22089# URL: https://en.wikipedia.org/wiki/Firefox_4
22090# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
22091# Note:	Most ZIP utilities are able to extract such archives
22092#	maybe only partly or after some warnings. Example:
22093#	zip -FF omni.ja --out omni.zip
220944	string	PK\001\002	Mozilla archive omni.ja
22095!:mime	application/x-zip
22096!:ext	ja
22097# TODO:
22098#>4	use	zip-dir-entry
22099
22100#------------------------------------------------------------------------------
22101# $File: msdos,v 1.137 2020/03/20 17:20:19 christos Exp $
22102# msdos:  file(1) magic for MS-DOS files
22103#
22104
22105# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
22106# updated by Joerg Jenderek at Oct 2008,Apr 2011
221070	string/t	@
22108>1	string/cW	\ echo\ off	DOS batch file text
22109!:mime	text/x-msdos-batch
22110!:ext	bat
22111>1	string/cW	echo\ off	DOS batch file text
22112!:mime	text/x-msdos-batch
22113!:ext	bat
22114>1	string/cW	rem		DOS batch file text
22115!:mime	text/x-msdos-batch
22116!:ext	bat
22117>1	string/cW	set\ 		DOS batch file text
22118!:mime	text/x-msdos-batch
22119!:ext	bat
22120
22121
22122# OS/2 batch files are REXX. the second regex is a bit generic, oh well
22123# the matched commands seem to be common in REXX and uncommon elsewhere
22124100	search/0xffff   rxfuncadd
22125>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
22126100	search/0xffff   say
22127>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
22128
22129# updated by Joerg Jenderek at Oct 2015
22130# https://de.wikipedia.org/wiki/Common_Object_File_Format
22131# http://www.delorie.com/djgpp/doc/coff/filhdr.html
22132# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
22133#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
22134#>4	ledate		x	stamp %s
221350	leshort		0x166	MS Windows COFF MIPS R4000 object file
22136#>4	ledate		x	stamp %s
221370	leshort		0x184	MS Windows COFF Alpha object file
22138#>4	ledate		x	stamp %s
221390	leshort		0x268	MS Windows COFF Motorola 68000 object file
22140#>4	ledate		x	stamp %s
221410	leshort		0x1f0	MS Windows COFF PowerPC object file
22142#>4	ledate		x	stamp %s
221430	leshort		0x290	MS Windows COFF PA-RISC object file
22144#>4	ledate		x	stamp %s
22145
22146# Tests for various EXE types.
22147#
22148# Many of the compressed formats were extraced from IDARC 1.23 source code.
22149#
221500	string/b	MZ
22151# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
22152>0x18	leshort <0x40 MS-DOS executable
22153!:mime	application/x-dosexec
22154# Windows and later versions of DOS will allow .EXEs to be named with a .COM
22155# extension, mostly for compatibility's sake.
22156!:ext	exe/com
22157# These traditional tests usually work but not always.  When test quality support is
22158# implemented these can be turned on.
22159#>>0x18	leshort	0x1c	(Borland compiler)
22160#>>0x18	leshort	0x1e	(MS compiler)
22161
22162# Maybe it's a PE?
22163>(0x3c.l)	string		PE\0\0	PE
22164!:mime	application/x-dosexec
22165>>(0x3c.l+24)	leshort		0x010b	\b32 executable
22166>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
22167>>(0x3c.l+24)	leshort		0x0107	ROM image
22168>>(0x3c.l+24)	default		x	Unknown PE signature
22169>>>&0 		leshort		x	0x%x
22170>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
22171>>(0x3c.l+92)	leshort		1
22172# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
22173# drivers in Windows/System32/drivers/*.sys.
22174>>>(0x3c.l+22)	leshort&0x2000	>0	(native)
22175!:ext	dll/sys
22176>>>(0x3c.l+22)	leshort&0x2000	0	(native)
22177!:ext	exe/sys
22178>>(0x3c.l+92)	leshort		2
22179>>>(0x3c.l+22)	leshort&0x2000	>0	(GUI)
22180# These could probably be at least partially distinguished from one another by
22181# looking for specific exported functions.
22182# CPL: Control Panel item
22183# TLB: Type library
22184# OCX: OLE/ActiveX control
22185# ACM: Audio compression manager codec
22186# AX: DirectShow source filter
22187# IME: Input method editor
22188!:ext	dll/cpl/tlb/ocx/acm/ax/ime
22189>>>(0x3c.l+22)	leshort&0x2000	0	(GUI)
22190# Screen savers typically include code from the scrnsave.lib static library, but
22191# that's not guaranteed.
22192!:ext	exe/scr
22193>>(0x3c.l+92)	leshort		3
22194>>>(0x3c.l+22)	leshort&0x2000	>0	(console)
22195!:ext	dll/cpl/tlb/ocx/acm/ax/ime
22196>>>(0x3c.l+22)	leshort&0x2000	0	(console)
22197!:ext	exe/com
22198# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
22199>>(0x3c.l+92)	leshort		7	(POSIX)
22200>>(0x3c.l+92)	leshort		9	(Windows CE)
22201>>(0x3c.l+92)	leshort		10	(EFI application)
22202>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
22203>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
22204>>(0x3c.l+92)	leshort		13	(EFI ROM)
22205>>(0x3c.l+92)	leshort		14	(XBOX)
22206>>(0x3c.l+92)	leshort		15	(Windows boot application)
22207>>(0x3c.l+92)	default		x	(Unknown subsystem
22208>>>&0		leshort		x	0x%x)
22209>>(0x3c.l+4)	leshort		0x14c	Intel 80386
22210>>(0x3c.l+4)	leshort		0x166	MIPS R4000
22211>>(0x3c.l+4)	leshort		0x168	MIPS R10000
22212>>(0x3c.l+4)	leshort		0x184	Alpha
22213>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
22214>>(0x3c.l+4)	leshort		0x1a3	Hitachi SH3 DSP
22215>>(0x3c.l+4)	leshort		0x1a8	Hitachi SH5
22216>>(0x3c.l+4)	leshort		0x169	MIPS WCE v2
22217>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
22218>>(0x3c.l+4)	leshort		0x1c0	ARM
22219>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
22220>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
22221>>(0x3c.l+4)	leshort		0x1d3	Matsushita AM33
22222>>(0x3c.l+4)	leshort		0x1f0	PowerPC
22223>>(0x3c.l+4)	leshort		0x1f1	PowerPC with FPU
22224>>(0x3c.l+4)	leshort		0x1f2	PowerPC (big-endian)
22225>>(0x3c.l+4)	leshort		0x200	Intel Itanium
22226>>(0x3c.l+4)	leshort		0x266	MIPS16
22227>>(0x3c.l+4)	leshort		0x268	Motorola 68000
22228>>(0x3c.l+4)	leshort		0x290	PA-RISC
22229>>(0x3c.l+4)	leshort		0x366	MIPSIV
22230>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
22231>>(0x3c.l+4)	leshort		0xebc	EFI byte code
22232>>(0x3c.l+4)	leshort		0x5032	RISC-V 32-bit
22233>>(0x3c.l+4)	leshort		0x5064	RISC-V 64-bit
22234>>(0x3c.l+4)	leshort		0x5128	RISC-V 128-bit
22235>>(0x3c.l+4)	leshort		0x9041	Mitsubishi M32R
22236>>(0x3c.l+4)	leshort		0x8664	x86-64
22237>>(0x3c.l+4)	leshort		0xaa64	Aarch64
22238>>(0x3c.l+4)	leshort		0xc0ee	MSIL
22239>>(0x3c.l+4)	default		x	Unknown processor type
22240>>>&0		leshort		x	0x%x
22241>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
22242>>(0x3c.l+22)	leshort&0x1000	>0	system file
22243>>(0x3c.l+24)	leshort		0x010b
22244>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
22245>>(0x3c.l+24)	leshort		0x020b
22246>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
22247
22248# hooray, there's a DOS extender using the PE format, with a valid PE
22249# executable inside (which just prints a message and exits if run in win)
22250>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
22251>>(8.s*16)		string		!32STUB	\b, for MS Windows
22252>>(0x3c.l+0xf8)		string		UPX0 \b, UPX compressed
22253>>(0x3c.l+0xf8)		search/0x140	PEC2 \b, PECompact2 compressed
22254>>(0x3c.l+0xf8)		search/0x140	UPX2
22255>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
22256>>(0x3c.l+0xf8)		search/0x140	.idata
22257>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
22258>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
22259>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
22260>>(0x3c.l+0xf8)		search/0x140	.rsrc
22261>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
22262>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
22263>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
22264>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
22265>>(0x3c.l+0xf8)		search/0x140	.data
22266>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
22267>>(0x3c.l+0xf8)		search/0x140	.petite\0 \b, Petite compressed
22268>>>(0x3c.l+0xf7)	byte		x
22269>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
22270>>(0x3c.l+0xf8)		search/0x140	.WISE \b, WISE installer self-extracting archive
22271>>(0x3c.l+0xf8)		search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
22272>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
22273>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
22274>>0x30			string		Inno \b, InnoSetup self-extracting archive
22275
22276# If the relocation table is 0x40 or more bytes into the file, it's definitely
22277# not a DOS EXE.
22278>0x18  leshort >0x3f
22279
22280# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
22281# must be one of the unusual subformats.
22282>>(0x3c.l) string !PE\0\0 MS-DOS executable
22283!:mime	application/x-dosexec
22284
22285>>(0x3c.l)		string		NE \b, NE
22286!:mime	application/x-dosexec
22287>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
22288>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
22289>>>(0x3c.l+0x36)	byte		3 for MS-DOS
22290>>>(0x3c.l+0x36)	byte		4 for Windows 386
22291>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
22292>>>(0x3c.l+0x36)	default		x
22293>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
22294>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
22295>>>(0x3c.l+0x0c)	leshort&0x8000	0x8000 (DLL or font)
22296# DRV: Driver
22297# 3GR: Grabber device driver
22298# CPL: Control Panel Item
22299# VBX: Visual Basic Extension
22300# FON: Bitmap font
22301# FOT: Font resource file
22302!:ext	dll/drv/3gr/cpl/vbx/fon/fot
22303>>>(0x3c.l+0x0c)	leshort&0x8000	0 (EXE)
22304!:ext	exe/scr
22305>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
22306>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
22307
22308>>(0x3c.l)		string		LX\0\0 \b, LX
22309!:mime	application/x-dosexec
22310>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
22311>>>(0x3c.l+0x0a)	leshort		1 for OS/2
22312>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
22313>>>(0x3c.l+0x0a)	leshort		3 for DOS
22314>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
22315>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
22316>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
22317>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
22318>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
22319>>>(0x3c.l+0x08)	leshort		1 i80286
22320>>>(0x3c.l+0x08)	leshort		2 i80386
22321>>>(0x3c.l+0x08)	leshort		3 i80486
22322>>>(8.s*16)		string		emx \b, emx
22323>>>>&1			string		x %s
22324>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
22325
22326# MS Windows system file, supposedly a collection of LE executables
22327>>(0x3c.l)		string		W3 \b, W3 for MS Windows
22328!:mime	application/x-dosexec
22329
22330>>(0x3c.l)		string		LE\0\0 \b, LE executable
22331!:mime	application/x-dosexec
22332>>>(0x3c.l+0x0a)	leshort		1
22333# some DOS extenders use LE files with OS/2 header
22334>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
22335>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
22336>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
22337>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
22338>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
22339>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
22340>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
22341# this is a wild guess; hopefully it is a specific signature
22342>>>>&0x24		lelong		<0x50
22343>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
22344>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
22345# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
22346#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
22347# fails with DOS-Extenders.
22348>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
22349>>>(0x3c.l+0x0a)	leshort		3 for DOS
22350>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
22351# VXD: VxD for Windows 95/98/Me
22352# 386: VxD for Windows 2.10, 3.0, 3.1x
22353# PDR: Port driver
22354# MPD: Miniport driver (?)
22355!:ext	vxd/386/pdr/mpd
22356>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
22357>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
22358
22359# looks like ASCII, probably some embedded copyright message.
22360# and definitely not NE/LE/LX/PE
22361>>0x3c		lelong	>0x20000000
22362>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
22363!:mime	application/x-dosexec
22364!:ext	exe/com
22365# header data too small for extended executable
22366>2		long	!0
22367>>0x18		leshort <0x40
22368>>>(4.s*512)	leshort !0x014c
22369
22370>>>>&(2.s-514)	string	!LE
22371>>>>>&-2	string	!BW \b, MZ for MS-DOS
22372!:mime	application/x-dosexec
22373>>>>&(2.s-514)	string	LE \b, LE
22374>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
22375# educated guess since indirection is still not capable enough for complex offset
22376# calculations (next embedded executable would be at &(&2*512+&0-2)
22377# I suspect there are only LE executables in these multi-exe files
22378>>>>&(2.s-514)	string	BW
22379>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
22380>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
22381
22382# This sequence skips to the first COFF segment, usually .text
22383>(4.s*512)	leshort		0x014c \b, COFF
22384!:mime	application/x-dosexec
22385>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
22386>>(8.s*16)	string		emx
22387>>>&1		string		x for DOS, Win or OS/2, emx %s
22388>>&(&0x42.l-3)	byte		x
22389>>>&0x26	string		UPX \b, UPX compressed
22390# and yet another guess: small .text, and after large .data is unusal, could be 32lite
22391>>&0x2c		search/0xa0	.text
22392>>>&0x0b	lelong		<0x2000
22393>>>>&0		lelong		>0x6000 \b, 32lite compressed
22394
22395>(8.s*16) string $WdX \b, WDos/X DOS extender
22396
22397# By now an executable type should have been printed out.  The executable
22398# may be a self-uncompressing archive, so look for evidence of that and
22399# print it out.
22400#
22401# Some signatures below from Greg Roelofs, newt@uchicago.edu.
22402#
22403>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
22404>0xe7	string	LH/2\ 	Self-Extract \b, %s
22405>0x1c	string	UC2X	\b, UCEXE compressed
22406>0x1c	string	WWP\ 	\b, WWPACK compressed
22407>0x1c	string	RJSX 	\b, ARJ self-extracting archive
22408>0x1c	string	diet 	\b, diet compressed
22409>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
22410>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
22411>0x1c	string	tz 	\b, TinyProg compressed
22412>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
22413!:mime	application/zip
22414# Yes, this really is "Copr", not "Corp."
22415>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
22416!:mime	application/zip
22417# winarj stores a message in the stub instead of the sig in the MZ header
22418>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
22419>0x20	string AIN
22420>>0x23	string 2	\b, AIN 2.x compressed
22421>>0x23	string <2	\b, AIN 1.x compressed
22422>>0x23	string >2	\b, AIN 1.x compressed
22423>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
22424!:mime	application/x-lha
22425>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
22426!:mime	application/x-lha
22427>0x24	string	\ $ARX \b, ARX self-extracting archive
22428>0x24	string	\ $LHarc \b, LHarc self-extracting archive
22429>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
22430>0x40	string aPKG \b, aPackage self-extracting archive
22431>0x64	string	W\ Collis\0\0 \b, Compack compressed
22432>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
22433>>&0xf4 search/0x140 \x0\x40\x1\x0
22434>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
22435>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
22436>0x17888 string Rar! \b, RAR self-extracting archive
22437
22438# Skip to the end of the EXE.  This will usually work fine in the PE case
22439# because the MZ image is hardcoded into the toolchain and almost certainly
22440# won't match any of these signatures.
22441>(4.s*512)	long	x
22442>>&(2.s-517)	byte	x
22443>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
22444>>>&0	string		Rar! \b, RAR self-extracting archive
22445>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
22446>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
22447>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
22448>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
22449>>>&7	search/400	**ACE** \b, ACE self-extracting archive
22450>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
22451
22452# a few unknown ZIP sfxes, no idea if they are needed or if they are
22453# already captured by the generic patterns above
22454>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
22455# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
22456#
22457
22458# TELVOX Teleinformatica CODEC self-extractor for OS/2:
22459>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
22460>>49824 leshort		=1			\b, 1 file
22461>>49824 leshort		>1			\b, %u files
22462
22463# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
22464# and https://www.freedos.org/software/?prog=kpdos
22465# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
224660	string/b	KCF		FreeDOS KEYBoard Layout collection
22467# only version=0x100 found
22468>3	uleshort	x		\b, version 0x%x
22469# length of string containing author,info and special characters
22470>6	ubyte		>0
22471#>>6	pstring		x		\b, name=%s
22472>>7	string		>\0		\b, author=%-.14s
22473>>7	search/254	\xff		\b, info=
22474#>>>&0	string		x		\b%-s
22475>>>&0	string		x		\b%-.15s
22476# for FreeDOS *.KL files
224770	string/b	KLF		FreeDOS KEYBoard Layout file
22478# only version=0x100 or 0x101 found
22479>3	uleshort	x		\b, version 0x%x
22480# stringlength
22481>5	ubyte		>0
22482>>8	string		x		\b, name=%-.2s
224830	string	\xffKEYB\ \ \ \0\0\0\0
22484>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
22485
22486# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
22487# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
224880	ulequad&0x07a0ffffffff		0xffffffff
22489>0	use				msdos-driver
224900       name    			msdos-driver		DOS executable (
22491#!:mime	application/octet-stream
22492!:mime	application/x-dosdriver
22493# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
22494!:ext	sys/dev/bin
22495>40	search/7			UPX!			\bUPX compressed
22496# DOS device driver attributes
22497>4	uleshort&0x8000			0x0000			\bblock device driver
22498# character device
22499>4	uleshort&0x8000			0x8000			\b
22500>>4	uleshort&0x0008			0x0008			\bclock
22501# fast video output by int 29h
22502>>4	uleshort&0x0010			0x0010			\bfast
22503# standard input/output device
22504>>4	uleshort&0x0003			>0			\bstandard
22505>>>4	uleshort&0x0001			0x0001			\binput
22506>>>4	uleshort&0x0003			0x0003			\b/
22507>>>4	uleshort&0x0002			0x0002			\boutput
22508>>4	uleshort&0x8000			0x8000			\bcharacter device driver
22509>0	ubyte				x
22510# upx compressed device driver has garbage instead of real in name field of header
22511>>40	search/7			UPX!
22512>>40	default				x
22513# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
22514>>>12		ubyte			>0x2E			\b
22515>>>>10		ubyte			>0x20
22516>>>>>10		ubyte			!0x2E
22517>>>>>>10	ubyte			!0x2A			\b%c
22518>>>>11		ubyte			>0x20
22519>>>>>11		ubyte			!0x2E			\b%c
22520>>>>12		ubyte			>0x20
22521>>>>>12		ubyte			!0x39
22522>>>>>>12	ubyte			!0x2E			\b%c
22523>>>13		ubyte			>0x20
22524>>>>13		ubyte			!0x2E			\b%c
22525>>>>14		ubyte			>0x20
22526>>>>>14		ubyte			!0x2E			\b%c
22527>>>>15		ubyte			>0x20
22528>>>>>15		ubyte			!0x2E			\b%c
22529>>>>16		ubyte			>0x20
22530>>>>>16		ubyte			!0x2E
22531>>>>>>16	ubyte			<0xCB			\b%c
22532>>>>17		ubyte			>0x20
22533>>>>>17		ubyte			!0x2E
22534>>>>>>17	ubyte			<0x90			\b%c
22535# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
22536>>>12		ubyte			<0x2F
22537# they have their real name at offset 22
22538# also block device drivers like DUMBDRV.SYS
22539>>>>22		string			>\056			%-.6s
22540>4	uleshort&0x8000			0x0000
22541# 32 bit sector addressing ( > 32 MB) for block devices
22542>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
22543# support by driver functions 13h, 17h, 18h
22544>4	uleshort&0x0040			0x0040			\b,IOCTL-
22545# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
22546>4	uleshort&0x0800			0x0800			\b,close media-
22547# output until busy support by int 10h for character device driver
22548>4	uleshort&0x8000			0x8000
22549>>4	uleshort&0x2000			0x2000			\b,until busy-
22550# direct read/write support by driver functions 03h,0Ch
22551>4	uleshort&0x4000			0x4000			\b,control strings-
22552>4	uleshort&0x8000			0x8000
22553>>4	uleshort&0x6840			>0			\bsupport
22554>4	uleshort&0x8000			0x0000
22555>>4	uleshort&0x4842			>0			\bsupport
22556>0	ubyte				x			\b)
22557# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
225580	ulequad				0x0513c00000000012
22559>0	use				msdos-driver
22560# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
225610	ulequad				0x32f28000ffff0016
22562>0	use				msdos-driver
225630	ulequad				0x007f00000000ffff
22564>0	use				msdos-driver
225650	ulequad				0x001600000000ffff
22566>0	use				msdos-driver
22567# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
225680	ulequad				0x0bf708c2ffffffff
22569>0	use				msdos-driver
225700	ulequad				0x07bd08c2ffffffff
22571>0	use				msdos-driver
22572
22573# updated by Joerg Jenderek
22574# GRR: line below too general as it catches also
22575# rt.lib DYADISKS.PIC and many more
22576# start with assembler instruction MOV
225770	ubyte		0x8c
22578# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
22579>4	string			!O====
22580# skip some unknown basic binaries like RocketRnger.SHR
22581>>5	string			!MAIN
22582# skip "GPG symmetrically encrypted data" ./gnu
22583# skip "PGP symmetric key encrypted data" ./pgp
22584# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
22585>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
22586# the remaining files should be DOS *.COM executables
22587# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
22588# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
22589# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
22590# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
22591# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
22592# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
22593# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
22594# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
22595!:mime	application/x-dosexec
22596!:ext com
22597
22598# updated by Joerg Jenderek at Oct 2008
225990	ulelong		0xffff10eb	DR-DOS executable (COM)
22600# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
226010	ubeshort&0xeb8d	>0xeb00
22602# DR-DOS STACKER.COM SCREATE.SYS missed
22603
226040       name    msdos-com
22605>0  byte        x               DOS executable (COM)
22606!:mime	application/x-dosexec
22607!:ext	com
22608>6	string		SFX\ of\ LHarc	\b, %s
22609>0x1FE leshort	0xAA55		    \b, boot code
22610>85	string		UPX		        \b, UPX compressed
22611>4	string		\ $ARX		    \b, ARX self-extracting archive
22612>4	string		\ $LHarc	    \b, LHarc self-extracting archive
22613>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
22614
22615# JMP 8bit
226160	        byte	0xeb
22617# allow forward jumps only
22618>1          byte    >-1
22619# that offset must be accessible
22620>>(1.b+2)   byte    x
22621>>>0        use msdos-com
22622
22623# JMP 16bit
226240           byte    0xe9
22625# forward jumps
22626>1          short   >-1
22627# that offset must be accessible
22628>>(1.s+3)   byte    x
22629>>>0        use msdos-com
22630# negative offset, must not lead into PSP
22631>1          short   <-259
22632# that offset must be accessible
22633>>(1,s+65539)   byte    x
22634>>>0        use msdos-com
22635
22636# updated by Joerg Jenderek at Oct 2008,2015
22637# following line is too general
226380	ubyte		0xb8
22639# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
22640>0	string		!\xb8\xc0\x07\x8e
22641# modified by Joerg Jenderek
22642# syslinux COM32 or COM32R executable
22643>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
22644# https://www.syslinux.org/wiki/index.php/Comboot_API
22645# Since version 5.00 c32 modules switched from the COM32 object format to ELF
22646!:mime	application/x-c32-comboot-syslinux-exec
22647!:ext c32
22648# https://syslinux.zytor.com/comboot.php
22649# older syslinux version ( <4 )
22650# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
22651# start with assembler instructions mov eax,21cd4cffh
22652>>>1	lelong		0x21CD4CFf	\b)
22653# syslinux:doc/comboot.txt
22654# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
22655# eax,21cd4cfeh) as a magic number.
22656# syslinux version (4.x)
22657# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
22658>>>1	lelong		0x21CD4CFe	\b, relocatable)
22659# remaining are DOS COM executables starting with assembler instruction MOV
22660# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
22661# MS-DOS SYS.COM RESTART.COM
22662# SYSLINUX.COM (version 1.40 - 2.13)
22663# GFXBOOT.COM (version 3.75)
22664# COPYBS.COM POWEROFF.COM INT18.COM
22665>>1	default	x			COM executable for DOS
22666!:mime	application/x-dosexec
22667#!:mime	application/x-ms-dos-executable
22668#!:mime	application/x-msdos-program
22669!:ext com
22670
226710	string/b	\x81\xfc
22672>4	string	\x77\x02\xcd\x20\xb9
22673>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
22674!:mime	application/x-dosexec
22675!:ext	com
22676252	string Must\ have\ DOS\ version DR-DOS executable (COM)
22677!:mime	application/x-dosexec
22678!:ext	com
22679# added by Joerg Jenderek at Oct 2008
22680# GRR search is not working
22681#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
2268234	string	UPX!			FREE-DOS executable (COM), UPX compressed
22683!:mime	application/x-dosexec
22684!:ext	com
2268535	string	UPX!			FREE-DOS executable (COM), UPX compressed
22686!:mime	application/x-dosexec
22687!:ext	com
22688# GRR search is not working
22689#2	search/28	\xcd\x21	COM executable for MS-DOS
22690#WHICHFAT.cOM
226912	string	\xcd\x21		COM executable for DOS
22692!:mime	application/x-dosexec
22693!:ext	com
22694#DELTREE.cOM DELTREE2.cOM
226954	string	\xcd\x21		COM executable for DOS
22696!:mime	application/x-dosexec
22697!:ext	com
22698#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
226995	string	\xcd\x21		COM executable for DOS
22700!:mime	application/x-dosexec
22701!:ext	com
22702#DELTMP.COm HASFAT32.cOM
227037	string	\xcd\x21
22704>0	byte	!0xb8			COM executable for DOS
22705!:mime	application/x-dosexec
22706!:ext	com
22707#COMP.cOM MORE.COm
2270810	string	\xcd\x21
22709>5	string	!\xcd\x21		COM executable for DOS
22710!:mime	application/x-dosexec
22711!:ext	com
22712#comecho.com
2271313	string	\xcd\x21		COM executable for DOS
22714!:mime	application/x-dosexec
22715!:ext	com
22716#HELP.COm EDIT.coM
2271718	string	\xcd\x21		COM executable for MS-DOS
22718!:mime	application/x-dosexec
22719!:ext	com
22720#NWRPLTRM.COm
2272123	string	\xcd\x21		COM executable for MS-DOS
22722!:mime	application/x-dosexec
22723!:ext	com
22724#LOADFIX.cOm LOADFIX.cOm
2272530	string	\xcd\x21		COM executable for MS-DOS
22726!:mime	application/x-dosexec
22727!:ext	com
22728#syslinux.com 3.11
2272970	string	\xcd\x21		COM executable for DOS
22730!:mime	application/x-dosexec
22731!:ext	com
22732# many compressed/converted COMs start with a copy loop instead of a jump
227330x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
22734!:mime	application/x-dosexec
22735!:ext	com
227360x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
22737!:mime	application/x-dosexec
22738!:ext	com
22739>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
227400x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
22741!:mime	application/x-dosexec
22742!:ext	com
22743# FIXME: missing diet .com compression
22744
22745# miscellaneous formats
227460	string/b	LZ		MS-DOS executable (built-in)
22747#0	byte		0xf0		MS-DOS program library data
22748#
22749
22750# AAF files:
22751# <stuartc@rd.bbc.co.uk> Stuart Cunningham
227520	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
22753>30	byte	9		(512B sectors)
22754>30	byte	12		(4kB sectors)
227550	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
22756>30	byte	9		(512B sectors)
22757>30	byte	12		(4kB sectors)
22758
22759# Popular applications
22760#
22761# Update:	Joerg Jenderek
22762# URL:		http://fileformats.archiveteam.org/wiki/DOC
22763# Reference:	https://web.archive.org/web/20170206041048/
22764#		http://www.msxnet.org/word2rtf/formats/ffh-dosword5
22765# wIdent+dty
227660	belong	0x31be0000
22767# skip droid skeleton like x-fmt-274-signature-id-488.doc
22768>128	ubyte		>0  			Microsoft
22769>>96	uleshort	=0			Word
22770!:mime	application/msword
22771!:apple	MSWDWDBN
22772# DCX is used in the Unix version.
22773!:ext	doc/dcx
22774>>>0x6E	ulequad		=0			1.0-4.0
22775>>>0x6E	ulequad		!0			5.0-6.0
22776>>>0x6E	ulequad		x			(DOS) Document
22777# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
22778>>96	uleshort	!0			Write 3.0 (Windows) Document
22779!:mime	application/x-mswrite
22780!:apple	MSWDWDBN
22781# sometimes also doc like in splitter.doc srchtest.doc
22782!:ext	wri/doc
22783# wTool must be 0125400 octal
22784#>>4	uleshort	!0xAB00			\b, wTool %o
22785# reserved; must be zero
22786#>>6	ulelong		!0			\b, reserved %u
22787# block pointer to the block containing optional file manager information
22788#>>0x1C	uleshort	x			\b, at 0x%x info block
22789# jump to File manager information block
22790>>(0x1C.s*128)	uleshort x
22791# test for valid information start; maybe also 0012h
22792>>>&-2		uleshort	=0x0014
22793# Document ASCIIZ name
22794>>>>&0x12	string		x		%s
22795# author name
22796>>>>>&1		string		x		\b, author %s
22797# reviser name
22798>>>>>>&1	string		x		\b, reviser %s
22799# keywords
22800>>>>>>>&1	string		x		\b, keywords %s
22801# comment
22802>>>>>>>>&1	string		x		\b, comment %s
22803# version number
22804>>>>>>>>>&1	string		x		\b, version %s
22805# date of last change MM/DD/YY
22806>>>>>>>>>>&1	string		x		\b, %-.8s
22807# creation date MM/DD/YY
22808>>>>>>>>>>&9	string		x		created %-.8s
22809# file name of print format like NORMAL.STY
22810>>0x1E	string		>0			\b, formatted by %-.66s
22811# count of pages in whole file for write variant; maybe some times wrong
22812>>96	uleshort	>0			\b, %u pages
22813# name of the printer driver like HPLASMS
22814>>0x62	string		>0			\b, %-.8s printer
22815# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
22816>>0x6A	uleshort	>0			\b, %u blocks
22817# bit field for corrected text areas
22818#>>0x6C	uleshort	x			\b, 0x%x bit field
22819# text of document; some times start with 4 non printable characters like CR LF
22820>>128	ubyte		x			\b,
22821>>>128		ubyte	>0x1F
22822>>>>128		string	x			%s
22823>>>128		ubyte	<0x20
22824>>>>129		ubyte	>0x1F
22825>>>>>129	string	x			%s
22826>>>>129		ubyte	<0x20
22827>>>>>130	ubyte	>0x1F
22828>>>>>>130	string	x			%s
22829>>>>>130	ubyte	<0x20
22830>>>>>>131	ubyte	>0x1F
22831>>>>>>>131	string	x			%s
22832>>>>>>131	ubyte	<0x20
22833>>>>>>>132	ubyte	>0x1F
22834>>>>>>>>132	string	x			%s
22835>>>>>>>132	ubyte	<0x20
22836>>>>>>>>133	ubyte	>0x1F
22837>>>>>>>>>133	string	x			%s
22838#
228390	string/b	PO^Q`				Microsoft Word 6.0 Document
22840!:mime	application/msword
22841#
228424   long        0
22843>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
22844!:mime	application/msword
22845!:ext   mcw
22846>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
22847!:mime	application/msword
22848!:ext   mcw
22849>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
22850!:mime	application/msword
22851!:ext   mcw
22852>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
22853!:mime	application/msword
22854!:ext   mcw
22855
228560	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
22857!:mime	application/msword
22858!:ext   doc
22859# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
22860#512	string/b	\354\245\301			Microsoft Word Document
22861#!:mime	application/msword
22862
22863#
228640	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
22865!:mime application/msword
22866#
228670	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
22868!:mime application/msword
22869
22870#
228710	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
22872!:mime	application/vnd.ms-excel
22873# https://www.macdisk.com/macsigen.php
22874!:apple	XCELXLS4
22875!:ext	xls
22876#
22877# Update: Joerg Jenderek
22878# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
22879# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
22880# Note: newer Lotus versions >2 use longer BOF record
22881# record type (BeginningOfFile=0000h) + length (001Ah)
228820	belong	0x00001a00
22883# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
22884#>18	uleshort&0x73E0	0
22885# Lotus Multi Byte Character Set (LMBCS=1-31)
22886>20	ubyte		>0
22887>>20	ubyte		<32	Lotus 1-2-3
22888#!:mime	application/x-123
22889!:mime	application/vnd.lotus-1-2-3
22890!:apple	????L123
22891# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
22892>>>4	uleshort	0x1000	WorKsheet, version 3
22893!:ext	wk3
22894# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
22895>>>4	uleshort	0x1002	WorKsheet, version 4
22896# also worksheet template 4 (.wt4)
22897!:ext	wk4/wt4
22898# no example or documentation for wk5
22899#>>4	uleshort	0x????	WorKsheet, version 4
22900#!:ext	wk5
22901# only MacrotoScript.123 example
22902>>>4	uleshort	0x1003	WorKsheet, version 97
22903# also worksheet template Smartmaster (.12M)?
22904!:ext	123
22905# only Set_Y2K.123 example
22906>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
22907!:ext	123
22908# no example for this version
22909>>>4	uleshort	0x8001	FoRMatting data
22910!:ext	frm
22911# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
22912# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
22913>>>4	uleshort	0x8007	ForMatting data, version 3
22914!:ext	fm3
22915>>>4	default		x	unknown
22916# file revision sub code 0004h for worksheets
22917>>>>6	uleshort	=0x0004	worksheet
22918!:ext	wXX
22919>>>>6	uleshort	!0x0004	formatting data
22920!:ext	fXX
22921# main revision number
22922>>>>4	uleshort	x	\b, revision 0x%x
22923>>>6	uleshort	=0x0004	\b, cell range
22924# active cellcoord range (start row, page,column ; end row, page, column)
22925# start values normally 0~1st sheet A1
22926>>>>8	ulelong		!0
22927>>>>>10	ubyte		>0	\b%d*
22928>>>>>8	uleshort	x	\b%d,
22929>>>>>11	ubyte		x	\b%d-
22930# end page mostly 0
22931>>>>14	ubyte		>0	\b%d*
22932# end raw, column normally not 0
22933>>>>12	uleshort	x	\b%d,
22934>>>>15	ubyte		x	\b%d
22935# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
22936>>>>20	ubyte		>1	\b, character set 0x%x
22937# flags
22938>>>>21	ubyte		x	\b, flags 0x%x
22939>>>6	uleshort	!0x0004
22940# record type (FONTNAME=00AEh)
22941>>>>30	search/29	\0\xAE
22942# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
22943>>>>>&4	string		>\0	\b, 1st font "%s"
22944#
22945# Update: Joerg Jenderek
22946# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
22947# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
22948# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
22949# record type (BeginningOfFile=0000h) + length (0002h)
229500	belong	0x00000200
22951# GRR: line above is too general as it catches also MS Windows CURsor
22952# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
22953!:strength -1
22954# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
22955>7	ubyte		0
22956# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
22957>>6	ubyte		>0	Lotus
22958# !:mime	application/x-123
22959!:mime	application/vnd.lotus-1-2-3
22960!:apple	????L123
22961# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
22962# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
22963>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
22964!:ext	cnf
22965>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
22966!:ext	cnf
22967>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
22968!:ext	cnf
22969>>>4	uleshort	0x0802	Symphony CoNFiguration
22970!:ext	cnf
22971>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
22972!:ext	cnf
22973>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
22974!:ext	cnf
22975>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
22976!:ext	cnf
22977>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
22978!:ext	cnf
22979# (version 5.26) labeled the entry as "Lotus 123"
22980# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
22981>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
22982# extension "wks" also for Microsoft Works document
22983!:ext	wks
22984# (version 5.26) labeled the entry as "Lotus 123"
22985# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
22986>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
22987!:ext	wrk/wr1
22988# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
22989# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
22990>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
22991# Symphony (.wr1)
22992!:ext	wk1/wr1
22993# no example for this japan version
22994>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
22995!:ext	wj1
22996# no example or documentation for wk2
22997#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
22998#!:ext	wk2
22999# undocumented japan version
23000>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
23001!:ext	wj3
23002# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
23003>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
23004# japan version 2.4J (fj3)
23005!:ext	fmt/fj3
23006# no example for this version
23007>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
23008!:ext	frm
23009# (version 5.26) labeled the entry as "Lotus 1-2-3"
23010>>>4	default		x	unknown worksheet or configuration
23011!:ext	cnf
23012>>>>4	uleshort	x	\b, revision 0x%x
23013# 2nd record for most worksheets describes cells range
23014>>>6		use	lotus-cells
23015# 3nd record for most japan worksheets describes cells range
23016>>>(8.s+10)	use	lotus-cells
23017#	check and then display Lotus worksheet cells range
230180	name		lotus-cells
23019# look for type (RANGE=0006h) + length (0008h) at record begin
23020>0	ubelong	0x06000800	\b, cell range
23021# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
23022>>4	ulong		!0
23023>>>4	uleshort	x	\b%d,
23024>>>6	uleshort	x	\b%d-
23025# end of cell range
23026>>8	uleshort	x	\b%d,
23027>>10	uleshort	x	\b%d
23028# EndOfLotus123
230290	string/b		WordPro\0	Lotus WordPro
23030!:mime	application/vnd.lotus-wordpro
230310	string/b		WordPro\r\373	Lotus WordPro
23032!:mime	application/vnd.lotus-wordpro
23033
23034
23035# Summary: Script used by InstallScield to uninstall applications
23036# Extension: .isu
23037# Submitted by: unknown
23038# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
230390		string		\x71\xa8\x00\x00\x01\x02
23040>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
23041
23042# Winamp .avs
23043#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
230440	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
23045
23046# Windows Metafile .WMF
230470	string/b	\327\315\306\232	Windows metafile
23048!:mime	image/wmf
23049!:ext	wmf
230500	string/b	\002\000\011\000	Windows metafile
23051!:mime	image/wmf
23052!:ext	wmf
230530	string/b	\001\000\011\000	Windows metafile
23054!:mime	image/wmf
23055!:ext	wmf
23056
23057#tz3 files whatever that is (MS Works files)
230580	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
230590	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
230600	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
23061
23062# PGP sig files .sig
23063#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
230640 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
230650 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
230660 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
230670 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
230680 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
230690 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
23070
23071# windows zips files .dmf
230720	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
23073
23074# Windows icons
23075# Update: Joerg Jenderek
23076# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
23077# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
230780   belong  0x00000100
23079>9  byte    0
23080>>0 byte    x
23081>>0 use     cur-ico-dir
23082>9  ubyte   0xff
23083>>0 byte    x
23084>>0 use     cur-ico-dir
23085#	displays number of icons and information for icon or cursor
230860	name		cur-ico-dir
23087# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
23088# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
23089>18		ulelong		&0x00000006
23090# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
23091>>(18.l)	ulelong		x		MS Windows
23092>>>0		ubelong		0x00000100	icon resource
23093# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon
23094!:mime		image/vnd.microsoft.icon
23095#!:mime		image/x-icon
23096!:ext		ico
23097>>>>4 		uleshort	x		- %d icon
23098# plural s
23099>>>>4 		uleshort	>1		\bs
23100# 1st icon
23101>>>>0x06	use		ico-entry
23102# 2nd icon
23103>>>>4 		uleshort	>1
23104>>>>>0x16	use		ico-entry
23105>>>0		ubelong		0x00000200	cursor resource
23106#!:mime		image/x-cur
23107!:mime		image/x-win-bitmap
23108!:ext		cur
23109>>>>4 		uleshort	x		- %d icon
23110>>>>4 		uleshort	>1		\bs
23111# 1st cursor
23112>>>>0x06	use		cur-entry
23113#>>>>0x16	use		cur-entry
23114#	display information of one cursor entry
231150	name		cur-entry
23116>0	use		cur-ico-entry
23117>4	uleshort	x	\b, hotspot @%dx
23118>6	uleshort	x	\b%d
23119#	display information of one icon entry
231200	name		ico-entry
23121>0			use	cur-ico-entry
23122# normally 0 1 but also found 14
23123>4	uleshort	>1	\b, %d planes
23124# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
23125>6	uleshort	>1	\b, %d bits/pixel
23126#	display shared information of cursor or icon entry
231270		name		cur-ico-entry
23128>0		byte		=0		\b, 256x
23129>0		byte		!0		\b, %dx
23130>1		byte        	=0		\b256
23131>1		byte        	!0		\b%d
23132# number of colors in palette
23133>2		ubyte		!0		\b, %d colors
23134# reserved 0 FFh
23135#>3		ubyte        	x		\b, reserved %x
23136#>8		ulelong		x		\b, image size %d
23137# offset of PNG or DIB image
23138#>12		ulelong		x		\b, offset 0x%x
23139# PNG header (\x89PNG)
23140>(12.l)		ubelong		=0x89504e47
23141# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
23142>>&-4		indirect	x	\b with
23143# DIB image
23144>(12.l)		ubelong		!0x89504e47
23145#>>&-4		use     	dib-image
23146
23147# Windows non-animated cursors
23148# Update: Joerg Jenderek
23149# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
23150# Note: similar to Windows ICOn. container for BMP ( only DIB part)
23151# GRR: line below is too general as it catches also Lotus 1-2-3 files
231520   belong  0x00000200
23153>9  byte    0
23154>>0 use     cur-ico-dir
23155>9  ubyte   0xff
23156>>0 use     cur-ico-dir
23157
23158# .chr files
231590	string/b	PK\010\010BGI	Borland font
23160>4	string	>\0	%s
23161# then there is a copyright notice
23162
23163
23164# .bgi files
231650	string/b	pk\010\010BGI	Borland device
23166>4	string	>\0	%s
23167# then there is a copyright notice
23168
23169
23170# Windows Recycle Bin record file (named INFO2)
23171# By Abel Cheung (abelcheung AT gmail dot com)
23172# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
23173# Since Vista uses another structure, INFO2 structure probably won't change
23174# anymore. Detailed analysis in:
23175# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
231760	lelong		0x00000004
23177>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
23178
231790	lelong		0x00000005
23180>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
23181
23182# From Doug Lee via a FreeBSD pr
231839	string		GERBILDOC	First Choice document
231849	string		GERBILDB	First Choice database
231859	string		GERBILCLIP	First Choice database
231860	string		GERBIL		First Choice device file
231879	string		RABBITGRAPH	RabbitGraph file
231880	string		DCU1		Borland Delphi .DCU file
231890	string		=!<spell>	MKS Spell hash list (old format)
231900	string		=!<spell2>	MKS Spell hash list
23191# Too simple - MPi
23192#0	string		AH		Halo(TM) bitmapped font file
231930	lelong		0x08086b70	TurboC BGI file
231940	lelong		0x08084b50	TurboC Font file
23195
23196# Debian#712046: The magic below identifies "Delphi compiled form data".
23197# An additional source of information is available at:
23198# http://www.woodmann.com/fravia/dafix_t1.htm
231990	string		TPF0
23200>4	pstring		>\0		Delphi compiled form '%s'
23201
23202# tests for DBase files moved, updated and merged to database
23203
232040	string		PMCC		Windows 3.x .GRP file
232051	string		RDC-meg		MegaDots
23206>8	byte		>0x2F		version %c
23207>9	byte		>0x2F		\b.%c file
232080	lelong		0x4C
23209>4	lelong		0x00021401	Windows shortcut file
23210
23211# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm
23212# only for windows versions equal or greater 3.0
232130x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
23214!:mime	application/x-dosexec
23215!:ext	pif
23216#>2	string	 	>\0		\b, Title:%.30s
23217>0x24	string		>\0		\b for %.63s
23218>0x65	string		>\0		\b, directory=%.64s
23219>0xA5	string		>\0		\b, parameters=%.64s
23220#>0x181	leshort	x	\b, offset %x
23221#>0x183	leshort	x	\b, offsetdata %x
23222#>0x185	leshort	x	\b, section length %x
23223>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
23224>>&0x5e		ubyte	>0
23225>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
23226#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
23227>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
23228>>&0xF0		ubyte	>0
23229>>>&-1		string	<Terminal		\b, font=%.32s
23230#>>>&-1		string	=Terminal		\b, font=%.32s
23231>>>&-1		string	>Terminal		\b, font=%.32s
23232>>&0x110	ubyte	>0
23233>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
23234#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
23235>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
23236#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
23237#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
23238>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
23239#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
23240>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
23241#>>&06		string	x			\b:%s
23242>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
23243#>>&06		string	x			\b:%s
23244
23245# DOS EPS Binary File Header
23246# From: Ed Sznyter <ews@Black.Market.NET>
232470	belong		0xC5D0D3C6	DOS EPS Binary File
23248!:mime	image/x-eps
23249>4	long		>0		Postscript starts at byte %d
23250>>8	long		>0		length %d
23251>>>12	long		>0		Metafile starts at byte %d
23252>>>>16	long		>0		length %d
23253>>>20	long		>0		TIFF starts at byte %d
23254>>>>24	long		>0		length %d
23255
23256# TNEF magic From "Joomy" <joomy@se-ed.net>
23257# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
232580	lelong		0x223e9f78	TNEF
23259!:mime	application/vnd.ms-tnef
23260
23261# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
23262# of http://www.davep.org/norton-guides/ng2h-105.tgz
23263# https://en.wikipedia.org/wiki/Norton_Guides
232640	string		NG\0\001
23265# only value 0x100 found at offset 2
23266>2	ulelong		0x00000100	Norton Guide
23267# Title[40]
23268>>8	string		>\0		"%-.40s"
23269#>>6	uleshort	x		\b, MenuCount=%u
23270# szCredits[5][66]
23271>>48	string		>\0		\b, %-.66s
23272>>114	string		>\0		%-.66s
23273
23274# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
23275# of https://www.4dos.info/
23276# pointer,HelpID[8]=4DHnnnmm
232770	ulelong	0x48443408		4DOS help file
23278>4	string	x			\b, version %-4.4s
23279
23280# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
232810	ulequad	0x3a000000024e4c	MS Advisor help file
23282
23283# HtmlHelp files (.chm)
232840	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
23285
23286# GFA-BASIC (Wolfram Kleff)
232872	string/b	GFA-BASIC3	GFA-BASIC 3 data
23288
23289#------------------------------------------------------------------------------
23290# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
23291# Update: Joerg Jenderek
23292# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
23293# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
23294# Note: verified by `7z l *.cab`
23295# Microsoft Cabinet files
232960	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
23297#
23298# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
23299# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
23300# because some archive does not have *.diag* as 1st or 2nd archive member like
23301# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
23302# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
23303>0x2c	search/980/c	.diag		\b, Diagnostic
23304!:mime	application/vnd.ms-cab-compressed
23305!:ext	diagcab
23306# http://fileformats.archiveteam.org/wiki/PUZ
23307# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
23308# bundles a Publisher document *PNG.pub with all links into a CAB
23309>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
23310!:mime	application/vnd.ms-cab-compressed
23311!:ext	puz
23312# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
23313>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
23314!:mime	application/vnd.ms-powerpoint
23315#!:mime	application/mspowerpoint
23316!:ext	ppz
23317# URL:		https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets
23318# Reference:	https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/
23319# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget
23320>0x2c	search/968/c	gadget.xml		\b, Windows Desktop Gadget
23321#!:mime	application/vnd.ms-cab-compressed
23322# http://extension.nirsoft.net/gadget
23323!:mime	application/x-windows-gadget
23324!:ext	gadget
23325# http://www.incredimail.com/
23326# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
23327>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
23328!:mime	application/x-incredimail
23329# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
23330>>0x2c	search/83/c	Flavor.htm\0	ecard
23331!:ext	imf
23332# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
23333>>0x2c	search/211/c	.swf\0		skin
23334!:ext	ims
23335# member anim.im3 implies IncrediMail animation like in letter_fold.ima
23336>>0x2c	search/92/c	anim.im3\0	animation
23337!:ext	ima
23338# other IncrediMail cab archive
23339>>0x2c	default		x
23340>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
23341!:ext	imf/imi/imn/ims
23342# http://file-extension.net/seeker/file_extension_ime
23343>>>0x2c	default		x		emoticons or sound
23344!:ext	ime/imw
23345# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail
23346>0x2c	default		x
23347# look for 1st member name
23348>>(16.l+16)	ubyte	x
23349# https://en.wikipedia.org/wiki/SNP_file_format
23350>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
23351!:mime	application/msaccess
23352!:ext	snp
23353# https://en.wikipedia.org/wiki/Microsoft_InfoPath
23354>>>&-1	string 		manifest.xsf	\b, InfoPath Form Template
23355!:mime	application/vnd.ms-cab-compressed
23356#!:mime	application/vnd.ms-infopath
23357!:ext	xsn
23358# https://www.cabextract.org.uk/wince_cab_format/
23359# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
23360>>>&7	string 		=.000		\b, WinCE install
23361!:mime	application/vnd.ms-cab-compressed
23362!:ext	cab
23363
23364# https://support.microsoft.com/kb/934307/en-US
23365# All inspected MSU contain a file with name WSUSSCAN.cab
23366# that is called "Windows Update meta data" by Microsoft
23367>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
23368!:mime	application/vnd.ms-cab-compressed
23369!:ext	msu
23370>>>&-1	default		x
23371# look at point charcter of 1st archive member name for file name extension
23372>>>>&-1	search/255 	.
23373# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
23374# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
23375# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
23376>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
23377!:mime	application/vnd.ms-powerpoint
23378#!:mime	application/mspowerpoint
23379!:ext	ppz
23380# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
23381# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
23382# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
23383>>>>>&0	string/c	theme		\b, Windows
23384!:mime	application/x-windows-themepack
23385# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
23386# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
23387# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
23388>>>>>>(16.l+16)	string	=Panoram	8
23389!:ext	deskthemepack
23390>>>>>>(16.l+16)	string	!Panoram	7 or 8
23391!:ext	themepack/deskthemepack
23392>>>>>>(16.l+16)	ubyte	x		Theme Pack
23393>>>>>&0	default		x
23394# look for null terminator of 1st member name
23395>>>>>>&0	search/255 	\0
23396# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
23397>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
23398!:mime	application/vnd.ms-cab-compressed
23399!:ext	msu
23400>>>>>>>&16	default	x
23401# archive with more then one file need some output in version 5.32 to avoid error message like
23402# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
23403# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
23404# file: could not find any valid magic files!
23405>>>>>>>>28	uleshort	>1	\b, many
23406!:mime	application/vnd.ms-cab-compressed
23407!:ext	cab
23408# remaining archives with just one file
23409>>>>>>>>28	uleshort	=1
23410# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
23411>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
23412# cut of last char of source extension and add underscore to generate extension
23413# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
23414!:mime	application/vnd.ms-cab-compressed
23415!:ext	_/?_/??_
23416# archive need some output like "single" in version 5.32 to avoid error messages
23417>>>>>>>>>30	uleshort	!0x0000	\b, single
23418!:mime	application/vnd.ms-cab-compressed
23419!:ext	cab
23420# TODO: additional extensions like
23421# .xtp	InfoPath Template Part
23422# .lvf	Logitech Video Effects Face Accessory
23423>8	ulelong		x		\b, %u bytes
23424>28	uleshort		1		\b, 1 file
23425>28	uleshort		>1		\b, %u files
23426# Reserved fields, set to zero
23427#>4	belong		!0		\b, reserved1 %x
23428#>12	belong		!0		\b, reserved2 %x
23429# offset of the first CFFILE entry coffFiles: minimal 2Ch
23430>16	ulelong		x		\b, at 0x%x
23431>(16.l)	use		cab-file
23432# at least also 2nd member
23433>28	uleshort		>1
23434>>(16.l+16)	ubyte	x
23435>>>&0	search/255 	\0
23436# second member info
23437>>>>&0	use		cab-file
23438#>20	belong		!0		\b, reserved %x
23439# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
23440>24	ubeshort	!0x0301		\b version 0x%x
23441# number of CFFOLDER entries
23442>26	uleshort	>1		\b, %u cffolders
23443# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
23444# only found for flags 0 1 2 3 4 not 7
23445>30	uleshort	>0		\b, flags 0x%x
23446# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
23447# default is zero, however, the -i option of cabarc can be used to set this field
23448>32	uleshort	>0		\b, ID %u
23449# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
23450#>34	uleshort	x		\b, iCabinet %u
23451# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
23452>34	uleshort+1	x		\b, number %u
23453>30	uleshort	&0x0004		\b, extra bytes
23454# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
23455>>36	uleshort	>0		%u in head
23456# cbCFFolder is optional size of per-folder reserved area
23457>>38	ubyte		>0		%u in folder
23458# cbCFData is optional size of per-datablock reserved area
23459>>39	ubyte		>0		%u in data block
23460# optional per-cabinet reserved area abReserve[cbCFHeader]
23461>>36	uleshort	>0
23462# 1st CFFOLDER after reserved area in header
23463>>>(36.s+40)	use			cab-folder
23464# no reserved area in header
23465>30	uleshort	^0x0004
23466# no previous and next cab archive
23467>>30	uleshort		=0x0000
23468>>>36	use				cab-folder
23469# only previous cab archive
23470>>30	uleshort		=0x0001	\b, previous
23471>>>36	use				cab-anchor
23472# only next cab archive
23473>>30	uleshort		=0x0002	\b, next
23474>>>36	use				cab-anchor
23475# previous+next cab archive
23476# can not use sub routine cab-anchor to display previous and next cabinet together
23477#>>>36	use				cab-anchor
23478#>>>>&0	use				cab-anchor
23479>>30	uleshort		=0x0003	\b, previous
23480>>>36	string		x		%s
23481# optional name of previous disk szDisk*
23482>>>>&1	string		x		disk %s
23483>>>>>&1	string		x		\b, next %s
23484# optional name of previous disk szDisk*
23485>>>>>>&1	string		x	disk %s
23486>>>>>>>&1	use			cab-folder
23487#	display filename and disk name of previous or next cabinet
234880       name    			cab-anchor
23489# optional name of previous/next cabinet file szCabinet*[255]
23490>&0	string		x		%s
23491# optional name of previous/next disk szDisk*[255]
23492>>&1	string		x		disk %s
23493#	display folder structure CFFOLDER information like compression of cabinet
234940       name    			cab-folder
23495# offset of the CFDATA block in this folder
23496#>0	ulelong		x		\b, coffCabStart 0x%x
23497# number of CFDATA blocks in folder
23498>4	uleshort	x		\b, %u datablock
23499# plural s
23500>4	uleshort	>1		\bs
23501# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
23502>6	uleshort	x		\b, 0x%x compression
23503# optional per-folder reserved area
23504#>8	ubequad		x		\b, abReserve 0x%llx
23505#	display member structure CFFILE information like member name of cabinet
235060       name    			cab-file
23507# cbFile is uncompressed size of file in bytes
23508#>0	ulelong		x		\b, cbFile %u
23509# uoffFolderStart is uncompressed offset of file in folder
23510#>4	ulelong		>0		\b, uoffFolderStart 0x%x
23511# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
23512# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
23513# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
23514# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
23515>8	uleshort	>0		\b, iFolder 0x%x
23516# date stamp for file
23517#>10	uleshort	x		\b, date 0x%x
23518# time stamp for file
23519#>12	uleshort	x		\b, time 0x%x
23520# attribs is attribute flags for file
23521# define  _A_RDONLY       (0x01)  file is read-only
23522# define  _A_HIDDEN       (0x02)  file is hidden
23523# define  _A_SYSTEM       (0x04)  file is a system file
23524# define  _A_ARCH         (0x20)  file modified since last backup
23525# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
23526# define  _A_EXEC         (0x40)  run after extraction
23527# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
23528# define  UNKNOWN       (0x0100)  undocumented or accident
23529#>14	uleshort	x		\b, attribs 0x%x
23530>14	uleshort	>0		+
23531>>14	uleshort	&0x0001		\bR
23532>>14	uleshort	&0x0002		\bH
23533>>14	uleshort	&0x0004		\bS
23534>>14	uleshort	&0x0020		\bA
23535>>14	uleshort	&0x0040		\bX
23536>>14	uleshort	&0x0080		\bUtf
23537# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
23538>>14	uleshort	&0x0100		\b?
23539# szName is name of archive member
23540>16	string		x		"%s"
23541# next archive member name if more files
23542#>>&17	string		>\0		\b, NEXT NAME %-.50s
23543
23544# InstallShield Cabinet files
235450	string/b	ISc(		InstallShield Cabinet archive data
23546>5	byte&0xf0	=0x60		version 6,
23547>5	byte&0xf0	!0x60		version 4/5,
23548>(12.l+40)	lelong	x		%u files
23549
23550# Windows CE package files
235510	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
23552>20	lelong		0		\b, architecture-independent
23553>20	lelong		103		\b, Hitachi SH3
23554>20	lelong		104		\b, Hitachi SH4
23555>20	lelong		0xA11		\b, StrongARM
23556>20	lelong		4000		\b, MIPS R4000
23557>20	lelong		10003		\b, Hitachi SH3
23558>20	lelong		10004		\b, Hitachi SH3E
23559>20	lelong		10005		\b, Hitachi SH4
23560>20	lelong		70001		\b, ARM 7TDMI
23561>52	leshort		1		\b, 1 file
23562>52	leshort		>1		\b, %u files
23563>56	leshort		1		\b, 1 registry entry
23564>56	leshort		>1		\b, %u registry entries
23565
23566
23567# Windows Enhanced Metafile (EMF)
23568# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
23569# for further information.
235700	ulelong 1
23571>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
23572>>44	ulelong x		version 0x%x
23573
23574
235750	string/b	\224\246\056		Microsoft Word Document
23576!:mime	application/msword
23577
23578# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
23579# Magic type for Dell's BIOS .hdr files
23580# Dell's .hdr
235810	string/b $RBU
23582>23	string Dell			%s system BIOS
23583>5	byte   2
23584>>48	byte   x			version %d.
23585>>49	byte   x			\b%d.
23586>>50	byte   x			\b%d
23587>5	byte   <2
23588>>48	string x			version %.3s
23589
23590# Type: Microsoft Document Imaging Format (.mdi)
23591# URL:	https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
23592# From: Daniele Sempione <scrows@oziosi.org>
23593# Too weak (EP)
23594#0	short	0x5045			Microsoft Document Imaging Format
23595
23596# MS eBook format (.lit)
235970	string/b	ITOLITLS		Microsoft Reader eBook Data
23598>8	lelong	x			\b, version %u
23599!:mime					application/x-ms-reader
23600
23601# Windows CE Binary Image Data Format
23602# From: Dr. Jesus <j@hug.gs>
236030	string/b	B000FF\n	Windows Embedded CE binary image
23604
23605# The second byte of these signatures is a file version; I don't know what,
23606# if anything, produced files with version numbers 0-2.
23607# From: John Elliott <johne@seasip.demon.co.uk>
236080	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
236090	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
236100	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
236110	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
23612
236130	string	MIOPEN		Mallard BASIC Jetsam data
236140	string	Jetsam0		Mallard BASIC Jetsam index data
23615
23616# DOS backup 2.0 to 3.2
23617
23618# backupid.@@@
23619
23620# plausibility check for date
236210x3	ushort	>1979
23622>0x5	ubyte-1 <31
23623>>0x6	ubyte-1 <12
23624# actually 121 nul bytes
23625>>>0x7	string	\0\0\0\0\0\0\0\0
23626>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
23627!:ext @@@
23628>>>>0x0 ubyte	0xff	\b, last disk
23629
23630# backed up file
23631
23632# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
23633# by looking for trailing nul of maximal file name string
236340x52	ubyte	0
23635# test for flag byte: FFh~complete file, 00h~split file
23636# FFh -127 =	-1 -127 =	-128
23637# 00h -127 =	 0 -127 =	-127
23638>0	byte-127	<-126
23639# plausibility check for file name length
23640>>0x53	ubyte-1	<78
23641# looking for terminating nul of file name string
23642>>>(0x53.b+4)	ubyte	0
23643# looking if last char of string is valid DOS file name
23644>>>>(0x53.b+3)	ubyte	>0x1F
23645# actually 44 nul bytes
23646# but sometimes garbage according to Ralf Quint. So can not be used as test
23647#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
23648# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
23649# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
23650>>>>>5	ubyte&0x8C	0x0C
23651# ./msdos (version 5.30) labeled the entry as
23652# "DOS 2.0 backed up file %s, split file, sequence %d" or
23653# "DOS 2.0 backed up file %s, complete file"
23654>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
23655#>>>>>>0	ubyte	0xff	complete
23656>>>>>>0	ubyte	0
23657>>>>>>>1 uleshort	x	sequence %d of
23658# full file name with path but without drive letter and colon stored from 0x05 til 0x52
23659>>>>>>0x5	string	x	file %s
23660# backup name is original filename
23661#!:ext	*
23662# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
23663# file: line 1169: Bad magic entry '  *'
23664# after header original file content
23665>>>>>>128	indirect x	\b;
23666
23667
23668# DOS backup 3.3 to 5.x
23669
23670# CONTROL.nnn files
236710	string	\x8bBACKUP\x20
23672# actually 128 nul bytes
23673>0xa	string	\0\0\0\0\0\0\0\0
23674>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
23675>>0x8a	ubyte	0xff	\b, last disk
23676
23677# NB: The BACKUP.nnn files consist of the files backed up,
23678# concatenated.
23679
23680#------------------------------------------------------------------------------
23681# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $
23682# msooxml:  file(1) magic for Microsoft Office XML
23683# From: Ralf Brown <ralf.brown@gmail.com>
23684
23685# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
23686#   archive.  The first member file is normally "[Content_Types].xml".
23687#   but some libreoffice generated files put this later. Perhaps skip
23688#   the "[Content_Types].xml" test?
23689# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
23690#   file of ePub or OpenDocument, we'll have to scan for a filename
23691#   which can distinguish between the three types
23692
236930		name		msooxml
23694>0		string		word/		Microsoft Word 2007+
23695!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
23696>0		string		ppt/		Microsoft PowerPoint 2007+
23697!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
23698>0		string		xl/		Microsoft Excel 2007+
23699!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
237000		string		visio/		Microsoft Visio 2013+
23701!:mime application/vnd.ms-visio.drawing.main+xml
23702
23703# start by checking for ZIP local file header signature
237040		string		PK\003\004
23705!:strength +10
23706# make sure the first file is correct
23707>0x1E		use		msooxml
23708>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
23709# skip to the second local file header
23710# since some documents include a 520-byte extra field following the file
23711# header, we need to scan for the next header
23712>>(18.l+49)	search/6000	PK\003\004
23713# now skip to the *third* local file header; again, we need to scan due to a
23714# 520-byte extra field following the file header
23715>>>&26		search/6000	PK\003\004
23716# and check the subdirectory name to determine which type of OOXML
23717# file we have.  Correct the mimetype with the registered ones:
23718# https://technet.microsoft.com/en-us/library/cc179224.aspx
23719>>>>&26		use		msooxml
23720>>>>&26		default		x
23721# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
23722>>>>>&26	search/6000	PK\003\004
23723>>>>>>&26	use		msooxml
23724>>>>>>&26	default		x		Microsoft OOXML
23725>>>>>&26	default		x		Microsoft OOXML
23726
23727#------------------------------------------------------------------------------
23728# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $
23729# msvc:  file(1) magic for msvc
23730# "H. Nanosecond" <aldomel@ix.netcom.com>
23731# Microsoft visual C
23732#
23733# I have version 1.0
23734
23735# .aps
237360	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
23737
23738# .ide
23739#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
237400	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
23741
23742# .res
237430	string	\000\000\000\000\040\000\000\000\377	MSVC .res
237440	string	\377\003\000\377\001\000\020\020\350	MSVC .res
237450	string	\377\003\000\377\001\000\060\020\350	MSVC .res
23746
23747#.lib
237480	string	\360\015\000\000	Microsoft Visual C library
237490	string	\360\075\000\000	Microsoft Visual C library
237500	string	\360\175\000\000	Microsoft Visual C library
23751
23752#.pch
237530	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
23754
23755# Summary: Symbol Table / Debug info used by Microsoft compilers
23756# URL: https://en.wikipedia.org/wiki/Program_database
23757# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
23758# Update: Joerg Jenderek
23759# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
23760#	info does only applies partly for older files like msvbvm50.pdb about year 2001
237610	string	Microsoft\ C/C++\040
23762# "Microsoft Program DataBase" by TrID
23763>24	search/14	\r\n\x1A	MSVC program database
23764!:mime	application/x-ms-pdb
23765!:ext	pdb
23766# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
23767>>16	regex	\([0-9.]+\)	ver %s
23768#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
23769# "MSF 7.00" variant
23770>>0x1e	leshort	0
23771# PageSize 400h 1000h
23772>>>0x20	lelong	x	\b, %d
23773# Page Count
23774>>>0x28	lelong	x	\b*%d bytes
23775# "program database 2.00"  variant
23776>>0x1e	leshort	!0
23777# PageSize 400h
23778>>>0x2c	lelong	x	\b, %d
23779# Page Count for msoo-dll.pdb 4379h
23780>>>0x32	leshort	x	\b*%d bytes
23781
23782# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
237830       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Roslyn C# debugging symbols version 1.0
23784
23785#.sbr
237860	string	\000\002\000\007\000	MSVC .sbr
23787>5	string 	>\0	%s
23788
23789#.bsc
237900	string	\002\000\002\001	MSVC .bsc
23791
23792#.wsp
237930	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
23794# these seem to start with the version and contain menus
23795
23796#------------------------------------------------------------------------------
23797# msx:  file(1) magic for the MSX Home Computer
23798# v1.3
23799# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
23800
23801############## MSX Music file formats ##############
23802
23803# Gigamix MGSDRV music file
238040	string/b		MGS	MSX Gigamix MGSDRV3 music file,
23805>6	ubeshort	0x0D0A
23806>>3	byte		x	\bv%c
23807>>4	byte		x	\b.%c
23808>>5	byte		x	\b%c
23809>>8	string		>\0	\b, title: %s
23810
238111	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
23812>6	uleshort	0x80
23813>>0x2E	uleshort	0
23814>>>0x30	string		>\0	\b, title: %s
23815
23816# KSS music file
238170	string/b		KSCC	KSS music file v1.03
23818>0xE	byte		0
23819>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
23820>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
23821>>>0xF	byte&0x04	4	stereo
23822>>0xF	byte&0x01	1	\b, YM2413
23823>>0xF	byte&0x08	8	\b, Y8950
23824
238250	string/b		KSSX	KSS music file v1.20
23826>0xE	byte&0xEF	0
23827>>0xF	byte&0x40	0x00	\b, 60Hz
23828>>0xF	byte&0x40	0x40	\b, 50Hz
23829>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
23830>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
23831>>>0xF	byte&0x04	0x04	stereo
23832>>0xF	byte&0x01	0x01	\b,
23833>>>0xF	byte&0x18	0x00	\bYM2413
23834>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
23835>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
23836>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
23837
23838# Moonblaster for Moonsound
238390	string/b		MBMS
23840>4	byte		0x10	MSX Moonblaster for MoonSound music
23841
23842# Music Player K-kaz
238430	string/b		MPK	MSX Music Player K-kaz song
23844>6	ubeshort	0x0D0A
23845>>3	byte		x	v%c
23846>>4	byte		x	\b.%c
23847>>5	byte		x	\b%c
23848
23849# I don't know why these don't work
23850#0	search/0xFFFF	\r\n.FM9
23851#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
23852#0	search/0xFFFF	\r\nFM1\ \=
23853#>0	search/0xFFFF	\r\nPSG1\=
23854#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
23855
23856# OPX Music file
238570x35	beshort		0x0d0a
23858>0x7B	beshort		0x0d0a
23859>>0x7D	byte		0x1a
23860>>>0x87	uleshort	0		MSX OPX Music file
23861>>>>0x86	byte		0		v1.5
23862>>>>>0	string		>\32		\b, title: %s
23863>>>>0x86	byte		1		v2.4
23864>>>>>0	string		>\32		\b, title: %s
23865
23866# SCMD music file
238670x8B	string/b		SCMD
23868>0xCE	uleshort	0	MSX SCMD Music file
23869#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
23870>>0x8F	string		>\0		\b, title: %s
23871
238720	search/0xFFFF	\r\n@title
23873>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
23874
23875
23876############## MSX image file formats ##############
23877
23878# MSX raw VRAM dump
238790	ubyte		0xFE
23880>1	uleshort	0
23881>>5	uleshort	0
23882>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
23883>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
23884>>>3	uleshort	>0x769E
23885>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
23886>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
23887>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
23888>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
23889
23890# Graph Saurus compressed images
238910	ubyte		0xFD
23892>1	uleshort	0
23893>>5	uleshort	0
23894>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
23895
23896# MSX G9B image file
238970	string/b		G9B
23898>1	uleshort	11
23899>>3	uleshort	>10
23900>>>5	ubyte		>0		MSX G9B image, depth=%d
23901>>>>8	uleshort	x		\b, %dx
23902>>>>10	uleshort	x		\b%d
23903>>>>5	ubyte		<9
23904>>>>>6	ubyte		0
23905>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
23906>>>>>6	ubyte		64		\b, codec=RGB fixed color
23907>>>>>6	ubyte		128		\b, codec=YJK
23908>>>>>6	ubyte		192		\b, codec=YUV
23909>>>>5	ubyte		>8		codec=RGB fixed color
23910>>>>12	ubyte		0		\b, raw
23911>>>>12	ubyte		1		\b, bitbuster compression
23912
23913############## Other MSX file formats ##############
23914
23915# MSX internal ROMs
239160		ubeshort	0xF3C3
23917>2		uleshort	<0x4000
23918>>8		ubyte		0xC3
23919>>>9		uleshort	<0x4000
23920>>>>0x0B	ubeshort	0x00C3
23921>>>>>0x0D	uleshort	<0x4000
23922>>>>>>0x0F	ubeshort	0x00C3
23923>>>>>>>0x11	uleshort	<0x4000
23924>>>>>>>>0x13	ubeshort	0x00C3
23925>>>>>>>>>0x15	uleshort	<0x4000
23926>>>>>>>>>>0x50	ubyte		0xC3
23927>>>>>>>>>>>0x51	uleshort	<0x4000
23928>>>>>>>>>>>>(9.s)	ubyte	0xC3
23929>>>>>>>>>>>>>&0	uleshort	>0x4000
23930>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
23931>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
23932>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
23933>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
23934>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
23935>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=0x%2x
23936>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=0x%2x
23937>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
23938>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
23939>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
23940>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
23941>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
23942>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
23943>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
23944>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
23945>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
23946>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
23947>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
23948>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
23949>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
23950>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
23951>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
23952>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
23953>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
23954>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
23955>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
23956>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
23957>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
23958
23959
239600		string/b		CD
23961>2		uleshort	>0x10
23962>>2		uleshort	<0x4000
23963>>>4		uleshort	<0x4000
23964>>>>6		uleshort	<0x4000
23965>>>>>8		ubyte		0xC3
23966>>>>>>9		uleshort	<0x4000
23967>>>>>>>0x10	ubyte		0xC3
23968>>>>>>>>0x11	uleshort	<0x4000
23969>>>>>>>>>0x14	ubyte		0xC3
23970>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
23971
239720		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
23973>0x5F0		ubequad		0x8282828244380000
23974>>0x150		ubyte		0x38
23975>>>0x170	string		\20\20\20
23976>>>>0x1E32	string		())
23977>>>>>0x2130	ubequad		0xA5A5594924231807
23978>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
23979
23980
23981
23982# MSX extension ROMs
239830	string/b		AB
23984>2	uleshort	0x0010			MSX ROM
23985>>2	uleshort	x			\b, init=0x%4x
23986>>4	uleshort	>0			\b, stahdl=0x%4x
23987>>6	uleshort	>0			\b, devhdl=0x%4x
23988>>8	uleshort	>0			\b, bas=0x%4x
23989>2	uleshort	0x4010			MSX ROM
23990>>2	uleshort	x			\b, init=0x%04x
23991>>4	uleshort	>0			\b, stahdl=0x%04x
23992>>6	uleshort	>0			\b, devhdl=0x%04x
23993>>8	uleshort	>0			\b, bas=0x%04x
23994>2	uleshort	0x8010			MSX ROM
23995>>2	uleshort	x			\b, init=0x%04x
23996>>4	uleshort	>0			\b, stahdl=0x%04x
23997>>6	uleshort	>0			\b, devhdl=0x%04x
23998>>8	uleshort	>0			\b, bas=0x%04x
239990	string/b		AB\0\0
24000>6	uleshort	0
24001>>4	uleshort	>0x400F			MSX-BASIC extension ROM
24002>>>4	uleshort	>0			\b, stahdl=0x%04x
24003>>>6	uleshort	>0			\b, devhdl=0x%04x
24004>>>0x1C		string		OPLL			\b, MSX-Music
24005>>>>0x18	string		PAC2			\b (external)
24006>>>>0x18	string		APRL			\b (internal)
24007
240080	string/b		AB\0\0\0\0
24009>6	uleshort	>0x400F			MSX device BIOS
24010>>6	uleshort	>0			\b, devhdl=0x%04x
24011
24012
240130	string/b		AB
24014#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
24015#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
24016#>3	string		@3\x80IA862		Golvellius MSX1 ROM
24017>2	uleshort	>15
24018>>2	uleshort	<0xC000
24019>>>8	string		\0\0\0\0\0\0\0\0
24020>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
24021>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
24022>>>>>0x10	string		CD			\b, Konami RC-
24023>>>>>>0x12	ubyte		x			\b%d
24024>>>>>>0x13	ubyte/16	x			\b%d
24025>>>>>>0x13	ubyte&0xF	x			\b%d
24026>>>>>0x10	string		EF			\b, Konami RC-
24027>>>>>>0x12	ubyte		x			\b%d
24028>>>>>>0x13	ubyte/16	x			\b%d
24029>>>>>>0x13	ubyte&0xF	x			\b%d
24030>>>>>2	uleshort	x			\b, init=0x%04x
24031>>>>>4	uleshort	>0			\b, stahdl=0x%04x
24032>>>>>6	uleshort	>0			\b, devhdl=0x%04x
24033>>>>>8	uleshort	>0			\b, bas=0x%04x
24034>>>2	uleshort	0
24035>>>>4	uleshort	0
24036>>>>>6	uleshort	0
24037>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
24038
240390x4000	string/b		AB
24040>0x4002	uleshort	>0x400F
24041>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
24042>>>0x4002	uleshort	x			\b, init=0x%04x
24043>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
24044>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
24045>>>0x4008	uleshort	>0			\b, bas=0x%04x
24046
240470x8000	string/b		AB
24048>0x8002	uleshort	>0x400F
24049>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
24050>>>0x8002	uleshort	x			\b, init=0x%04x
24051>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
24052>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
24053>>>0x8008	uleshort	>0			\b, bas=0x%04x
24054
24055
240560x3C000	string/b		AB
24057>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
24058>>0x3C002	uleshort	x			\b, init=0x%04x
24059>>0x3C004	uleshort	>0			\b, stahdl=0x%04x
24060>>0x3C006	uleshort	>0			\b, devhdl=0x%04x
24061>>0x3C008	uleshort	>0			\b, bas=0x%04x
24062
24063# MSX BIN file
24064#0	byte		0xFE
24065#>1	uleshort	>0x8000
24066#>>3	uleshort	>0x8004
24067#>>>5	uleshort	>0x8000			MSX BIN file
24068
24069# MSX-BASIC file
240700	byte		0xFF
24071>3	uleshort	0x000A
24072>>1	uleshort	>0x8000			MSX-BASIC program
24073
24074# MSX .CAS file
240750	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
24076
24077# Mega-Assembler file
240780	byte		0xFE
24079>1	uleshort	0x0001
24080>>5	uleshort	0xffff
24081>>>6	byte		0x0A		MSX Mega-Assembler source
24082
24083# Execrom Patchfile
240840	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
24085>0x12	ubyte/16	x		v%d
24086>0x12	ubyte&0xF	x		\b.%d
24087>0x13	ubyte		x		\b, contains %d patches
24088
24089# Konami's King's Valley-2 custom stage (ELG file)
240904	uleshort	0x0900
24091>0xF	byte		1
24092>>0x14	byte		0
24093>>>0x1E	string		\040\040\040
24094>>>>0x23	byte	1
24095>>>>>0x25	byte	0
24096>>>>>>0x15	string	>\x30
24097>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
24098>>>>>>>>0x1D	byte	<32	\b, theme: %d
24099
24100# Metal Gear 1 savegame
24101#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
24102#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
24103#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
24104
24105# ------------------------------------------------------------------------
24106# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
24107# mup: file(1) magic for Mup (Music Publisher) input file.
24108#
24109# From: Abel Cheung <abel (@) oaka.org>
24110#
24111# NOTE: This header is mainly proposed in the Arkkra mailing list,
24112# and is not a mandatory header because of old mup input file
24113# compatibility. Noteedit also use mup format, but is not forcing
24114# user to use any header as well.
24115#
241160		search/1	//!Mup		Mup music publication program input text
24117>6		string		-Arkkra		(Arkkra)
24118>>13		string		-
24119>>>16		string		.
24120>>>>14		string		x		\b, need V%.4s
24121>>>15		string		.
24122>>>>14		string		x		\b, need V%.3s
24123>6		string		-
24124>>9		string		.
24125>>>7		string		x		\b, need V%.4s
24126>>8		string		.
24127>>>7		string		x		\b, need V%.3s
24128#------------------------------------------------------------------------------
24129# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
24130# music:  file (1) magic for music formats
24131
24132# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
24133# and Bagpipe Writer by Doug Wickstrom
24134#
241350	string		Bagpipe		Bagpipe
24136>8	string		Reader		Reader
24137>>15	string		>\0		(version %.3s)
24138>8	string		Music\ Writer	Music Writer
24139>>20	string		:
24140>>>21	string		>\0		(version %.3s)
24141>>21	string		Gold		Gold
24142>>>25	string		:
24143>>>>26	string		>\0		(version %.3s)
24144
24145
24146#------------------------------------------------------------------------------
24147# nasa:	file(1) magic
24148
24149# From: Barry Carter <carter.barry@gmail.com>
241500	string	DAF/SPK				NASA SPICE file (binary format)
241510	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
24152
24153#-----------------------------------------------------------------------------
24154# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
24155# natinst:  file(1) magic for National Instruments Code Files
24156
24157#
24158# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
24159# version 1
24160# Many formats still missing, we use, for the moment LabVIEW
24161# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
24162#
241630       string          RSRC            National Instruments,
24164# Check if it's a LabVIEW File
24165>8      string          LV              LabVIEW File,
24166# Check which kind of file it is
24167>>10    string          SB              Code Resource File, data
24168>>10    string          IN              Virtual Instrument Program, data
24169>>10    string          AR              VI Library, data
24170# This is for Menu Libraries
24171>8      string          LMNULBVW        Portable File Names, data
24172# This is for General Resources
24173>8      string          rsc             Resources File, data
24174# This is for VXI Package
241750       string          VMAP            National Instruments, VXI File, data
24176
24177#------------------------------------------------------------------------------
24178# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
24179# ncr:  file(1) magic for NCR Tower objects
24180#
24181# contributed by
24182# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
24183# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
24184#
241850	beshort		000610	Tower/XP rel 2 object
24186>12	   belong		>0	not stripped
24187>20	   beshort		0407	executable
24188>20	   beshort		0410	pure executable
24189>22	   beshort		>0	- version %d
241900	beshort		000615	Tower/XP rel 2 object
24191>12	   belong		>0	not stripped
24192>20	   beshort		0407	executable
24193>20	   beshort		0410	pure executable
24194>22	   beshort		>0	- version %d
241950	beshort		000620	Tower/XP rel 3 object
24196>12	   belong		>0	not stripped
24197>20	   beshort		0407	executable
24198>20	   beshort		0410	pure executable
24199>22	   beshort		>0	- version %d
242000	beshort		000625	Tower/XP rel 3 object
24201>12	   belong		>0	not stripped
24202>20	   beshort		0407	executable
24203>20	   beshort		0410	pure executable
24204>22	   beshort		>0	- version %d
242050	beshort		000630	Tower32/600/400 68020 object
24206>12	   belong		>0	not stripped
24207>20	   beshort		0407	executable
24208>20	   beshort		0410	pure executable
24209>22	   beshort		>0	- version %d
242100	beshort		000640	Tower32/800 68020
24211>18	   beshort		&020000	w/68881 object
24212>18	   beshort		&040000	compatible object
24213>18	   beshort		&060000	object
24214>20	   beshort		0407	executable
24215>20	   beshort		0413	pure executable
24216>12	   belong		>0	not stripped
24217>22	   beshort		>0	- version %d
242180	beshort		000645	Tower32/800 68010
24219>18	   beshort		&040000	compatible object
24220>18	   beshort		&060000 object
24221>20	   beshort		0407	executable
24222>20	   beshort		0413	pure executable
24223>12	   belong		>0	not stripped
24224>22	   beshort		>0	- version %d
24225
24226#------------------------------------------------------------
24227# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $
24228
24229# From: Mikhail Gusarov <dottedmag@dottedmag.net>
24230# NekoVM (https://nekovm.org/) bytecode
242310	string		NEKO	NekoVM bytecode
24232>4	lelong		x	(%d global symbols,
24233>8	lelong		x	%d global fields,
24234>12	lelong		x	%d bytecode ops)
24235!:mime	application/x-nekovm-bytecode
24236
24237
24238#------------------------------------------------------------------------------
24239# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $
24240# netbsd:  file(1) magic for NetBSD objects
24241#
24242# All new-style magic numbers are in network byte order.
24243# The old-style magic numbers are indistinguishable from the same magic
24244# numbers used in other systems, and are handled, for all those systems,
24245# in aout.
24246#
24247
242480	name	netbsd-detail
24249>20	lelong	x		@%#x
24250>4	lelong	>0		\b+T=%d
24251>8	lelong	>0		\b+D=%d
24252>12	lelong	>0		\b+B=%d
24253>16	lelong	>0		\b+S=%d
24254>24	lelong	>0		\b+TR=%d
24255>28	lelong	>0		\b+TD=%d
24256
242570	name			netbsd-4096
24258>0	byte			&0x80
24259>>20	lelong			<4096		shared library
24260>>20	lelong			=4096		dynamically linked executable
24261>>20	lelong			>4096		dynamically linked executable
24262>0	byte			^0x80		executable
24263>16	lelong			>0		not stripped
24264
242650	name			netbsd-8192
24266>0	byte			&0x80
24267>>20	lelong			<8192		shared library
24268>>20	lelong			=8192		dynamically linked executable
24269>>20	lelong			>8192		dynamically linked executable
24270>0	byte			^0x80		executable
24271>16	lelong			>0		not stripped
24272>0	use			netbsd-detail
24273
242740	name			netbsd-normal
24275>0	byte			&0x80		dynamically linked executable
24276>0	byte			^0x80
24277>>0	byte			&0x40		position independent
24278>>20	lelong			!0		executable
24279>>20	lelong			=0		object file
24280>16	lelong			>0		not stripped
24281>0	use			netbsd-detail
24282
242830	name			netbsd-pure
24284>0	byte			&0x80		dynamically linked executable
24285>0	byte			^0x80		executable
24286>16	lelong			>0		not stripped
24287>0	use			netbsd-detail
24288
242890	name			netbsd-core
24290>12	string			>\0		from '%s'
24291>32	lelong			!0		(signal %d)
24292
242930	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
24294>0	use			netbsd-4096
24295
242960	belong&0377777777	041400410	a.out NetBSD/i386 pure
24297>0	use			netbsd-pure
24298
242990	belong&0377777777	041400407	a.out NetBSD/i386
24300>0	use			netbsd-normal
24301
243020	belong&0377777777	041400507	a.out NetBSD/i386 core
24303>0	use			netbsd-core
24304
243050	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
24306>0	use			\^netbsd-8192
24307
243080	belong&0377777777	041600410	a.out NetBSD/m68k pure
24309>0	use			\^netbsd-pure
24310
243110	belong&0377777777	041600407	a.out NetBSD/m68k
24312>0	use			\^netbsd-normal
24313
243140	belong&0377777777	041600507	a.out NetBSD/m68k core
24315>0	use			\^netbsd-core
24316
243170	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
24318>0	use			\^netbsd-4096
24319
243200	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
24321>0	use			\^netbsd-pure
24322
243230	belong&0377777777	042000407	a.out NetBSD/m68k4k
24324>0	use			\^netbsd-normal
24325
243260	belong&0377777777	042000507	a.out NetBSD/m68k4k core
24327>0	use			\^netbsd-core
24328
243290	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
24330>0	use			netbsd-4096
24331
243320	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
24333>0	use			netbsd-pure
24334
243350	belong&0377777777	042200407	a.out NetBSD/ns32532
24336>0	use			netbsd-normal
24337
243380	belong&0377777777	042200507	a.out NetBSD/ns32532 core
24339>0	use			netbsd-core
24340
243410	belong&0377777777	045200507	a.out NetBSD/powerpc core
24342>0	use			netbsd-core
24343
243440	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
24345>0	use			\^netbsd-8192
24346
243470	belong&0377777777	042400410	a.out NetBSD/SPARC pure
24348>0	use			\^netbsd-pure
24349
243500	belong&0377777777	042400407	a.out NetBSD/SPARC
24351>0	use			\^netbsd-normal
24352
243530	belong&0377777777	042400507	a.out NetBSD/SPARC core
24354>0	use			\^netbsd-core
24355
243560	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
24357>0	use			netbsd-4096
24358
243590	belong&0377777777	042600410	a.out NetBSD/pmax pure
24360>0	use			\^netbsd-pure
24361
243620	belong&0377777777	042600407	a.out NetBSD/pmax
24363>0	use			netbsd-normal
24364
243650	belong&0377777777	042600507	a.out NetBSD/pmax core
24366>0	use			netbsd-core
24367
243680	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
24369>0	use			netbsd-4096
24370
243710	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
24372>0	use			netbsd-pure
24373
243740	belong&0377777777	043000407	a.out NetBSD/vax 1k
24375>0	use			netbsd-normal
24376
243770	belong&0377777777	043000507	a.out NetBSD/vax 1k core
24378>0	use			netbsd-core
24379
243800	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
24381>0	use			netbsd-4096
24382
243830	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
24384>0	use			netbsd-pure
24385
243860	belong&0377777777	045400407	a.out NetBSD/vax 4k
24387>0	use			netbsd-normal
24388
243890	belong&0377777777	045400507	a.out NetBSD/vax 4k core
24390>0	use			netbsd-core
24391
24392# NetBSD/alpha does not support (and has never supported) a.out objects,
24393# so no rules are provided for them.  NetBSD/alpha ELF objects are
24394# dealt with in "elf".
243950	lelong		0x00070185		ECOFF NetBSD/alpha binary
24396>10	leshort		0x0001			not stripped
24397>10	leshort		0x0000			stripped
243980	belong&0377777777	043200507	a.out NetBSD/alpha core
24399>12	string			>\0		from '%s'
24400>32	lelong			!0		(signal %d)
24401
244020	belong&0377777777	043400413	a.out NetBSD/mips demand paged
24403>0	use			\^netbsd-8192
24404
24405>16	belong			>0		not stripped
244060	belong&0377777777	043400410	a.out NetBSD/mips pure
24407>0	use			netbsd-pure
24408
244090	belong&0377777777	043400407	a.out NetBSD/mips
24410>0	use			netbsd-normal
24411
244120	belong&0377777777	043400507	a.out NetBSD/mips core
24413>0	use			netbsd-core
24414
244150	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
24416>0	use			netbsd-4096
24417
244180	belong&0377777777	043600410	a.out NetBSD/arm32 pure
24419>0	use			netbsd-pure
24420
244210	belong&0377777777	043600407	a.out NetBSD/arm32
24422>0	use			netbsd-normal
24423
24424# NetBSD/arm26 has always used ELF objects, but it shares a core file
24425# format with NetBSD/arm32.
244260	belong&0377777777	043600507	a.out NetBSD/arm core
24427>0	use			netbsd-core
24428
24429# Kernel core dump format
244300	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
24431>0	belong&0x03ff0000 0x00000000	\b, Unknown
24432>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
24433>0	belong&0x03ff0000 0x00020000	\b, sun 68020
24434>0	belong&0x03ff0000 0x00640000	\b, 386 PC
24435>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
24436>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
24437>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
24438>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
24439>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
24440>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
24441>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
24442>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
24443>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
24444>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
24445>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
24446>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
24447>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
24448>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
24449>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
24450>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
24451>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
24452>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
24453>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
24454>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
24455>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
24456>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
24457>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
24458>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
24459>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
24460>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
24461>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
24462>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
24463>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
24464>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
24465>0	belong&0xfc000000 0x04000000	\b, CPU
24466>0	belong&0xfc000000 0x08000000	\b, DATA
24467>0	belong&0xfc000000 0x10000000	\b, STACK
24468>4	leshort	x			\b, (headersize = %d
24469>6	leshort	x			\b, segmentsize = %d
24470>8	lelong	x			\b, segments = %d)
24471
24472# little endian only for now.
244730	name		ktrace
24474>4	leshort		7
24475>>6	leshort		<3		NetBSD ktrace file version %d
24476>>>12	string		x		from %s
24477>>>56	string		x		\b, emulation %s
24478>>>8	lelong		<65536		\b, pid=%d
24479
2448056	string		netbsd
24481>0	use		ktrace
2448256	string		linux
24483>0	use		ktrace
2448456	string		sunos
24485>0	use		ktrace
2448656	string		hpux
24487>0	use		ktrace
24488
24489#------------------------------------------------------------------------------
24490# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
24491# netscape:  file(1) magic for Netscape files
24492# "H. Nanosecond" <aldomel@ix.netcom.com>
24493# version 3 and 4 I think
24494#
24495
24496# Netscape Address book  .nab
244970	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
24498
24499# Netscape Communicator address book
245000   string   \000\017\102\111 Netscape Communicator address book
24501
24502# .snm Caches
245030	string		#\ Netscape\ folder\ cache	Netscape folder cache
245040	string	\000\036\204\220\000	Netscape folder cache
24505# .n2p
24506# Net 2 Phone
24507#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
245080	string	SX961999	Net2phone
24509
24510#
24511#This is files ending in .art, FIXME add more rules
245120	string	JG\004\016\0\0\0\0	AOL ART image
245130	string	JG\003\016\0\0\0\0	AOL ART image
24514
24515#------------------------------------------------------------------------------
24516# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
24517# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
24518# From: Mads Martin Joergensen <mmj@suse.de>
24519
245200	string	NetWare\ Loadable\ Module	NetWare Loadable Module
24521
24522#------------------------------------------------------------------------------
24523# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
24524# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
24525#
245260	string		StartFontMetrics	ASCII font metrics
245270	string		StartFont	ASCII font bits
245280	belong		0x137A2944	NeWS bitmap font
245290	belong		0x137A2947	NeWS font family
245300	belong		0x137A2950	scalable OpenFont binary
245310	belong		0x137A2951	encrypted scalable OpenFont binary
245328	belong		0x137A2B45	X11/NeWS bitmap font
245338	belong		0x137A2B48	X11/NeWS font family
24534
24535#------------------------------------------------------------------------------
24536# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $
24537# nitpicker:  file(1) magic for Flowfiles.
24538# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de
245390	string	NPFF	NItpicker Flow File
24540>4	byte	x	V%d.
24541>5	byte	x	%d
24542>6	bedate	x	started: %s
24543>10	bedate	x	stopped: %s
24544>14	belong	x	Bytes: %u
24545>18	belong	x	Bytes1: %u
24546>22	belong	x	Flows: %u
24547>26	belong	x	Pkts: %u
24548
24549#------------------------------------------------------------------------------
24550# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $
24551# numpy: file(1) magic for NumPy array binary serialization format
24552# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html
245530	string		\x93NUMPY	NumPy array,
24554>6	ubyte		x		version %d
24555>7	ubyte		x		\b.%d,
24556>8	uleshort	x		header length %d
24557
24558#------------------------------------------------------------------------------
24559# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
24560# OASIS
24561# Summary: OASIS stream file
24562# Long description: Open Artwork System Interchange Standard
24563# File extension: .oas
24564# Full name:	Ben Cowley (bcowley@broadcom.com)
24565#		Philip Dixon (pdixon@broadcom.com)
24566# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
24567#		(see page 3)
245680	string	%SEMI-OASIS\r\n		OASIS Stream file
24569
24570#------------------------------------------------------------------------------
24571# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
24572# ocaml: file(1) magic for Objective Caml files.
245730	string	Caml1999	OCaml
24574>8	string	X		exec file
24575>8	string	I		interface file (.cmi)
24576>8	string	O		object file (.cmo)
24577>8	string	A		library file (.cma)
24578>8	string	Y		native object file (.cmx)
24579>8	string	Z		native library file (.cmxa)
24580>8	string	M		abstract syntax tree implementation file
24581>8	string	N		abstract syntax tree interface file
24582>9	string	>\0		(Version %3.3s)
24583
24584#------------------------------------------------------------------------------
24585# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
24586# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
245870	string		Octave-1-L	Octave binary data (little endian)
245880	string		Octave-1-B	Octave binary data (big endian)
24589
24590#------------------------------------------------------------------------------
24591# $File: ole2compounddocs,v 1.8 2020/03/28 23:10:30 christos Exp $
24592# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
24593# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
24594# Additional tests for OLE 2 Compound Documents should be under this recipe.
24595# reference:	https://www.openoffice.org/sc/compdocfileformat.pdf
24596
245970   string  \320\317\021\340\241\261\032\341
24598# https://digital-preservation.github.io/droid/
24599# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
24600>0x1A	ushort		!0xABAB		OLE 2 Compound Document
24601#>0x1C	uleshort		x			\b, endnian 0x%4.4x
24602# big endian not tested
24603>>0x1C	ubeshort		=0xfffe			\b, big-endian
24604>>>546	string	jbjb			: Microsoft Word Document
24605!:mime	application/msword
24606!:apple	MSWDWDBN
24607!:ext	doc
24608# Byte Order 0xFFFE means little-endian found in real world applications
24609#>>0x1C	uleshort		=0xfffe			\b, little-endian
24610>>0x1C	uleshort		=0xfffe
24611# From:		Joerg Jenderek
24612# Major Version 3 or 4
24613>>>0x1A	uleshort		x			\b, v%u
24614# Minor Version 32h=50 3Bh=59 3Eh=62
24615>>>0x18	uleshort		x			\b.%u
24616# SecID of first sector of the directory stream is often 1 but high like 3144h
24617>>>48	ulelong			x			\b, SecID 0x%x
24618# Sector Shift Exponent in short-stream container stream: 6~64 bytes
24619>>>32	uleshort		!6			\b, exponent of short stream %u
24620# total number of sectors used for the FAT
24621>>>44	ulelong			>1			\b, %u FAT sectors
24622# SecID of first sector of the short-sector allocation table (Mini FAT)
24623# or -2 (End Of ChainSecID) if not extant
24624>>>60	ulelong			!0xffFFffFE		\b, Mini FAT start sector 0x%x
24625# total number of sectors used for the short-sector allocation table
24626>>>64	ulelong			!1			\b, %u Mini FAT sector
24627# plural s
24628>>>>64	ulelong			>1			\bs
24629# SecID of first sector of the master sector allocation table (DIFAT)
24630# or -2 (End Of Chain SecID) if no additional sectors used
24631>>>68	ulelong			!0xffFFffFE		\b, DIFAT start sector 0x%x
24632# total number of sectors used for the master sector allocation table (DIFAT)
24633>>>72	ulelong			>0			\b, %u DIFAT sectors
24634# First part of the master sector allocation table (DIFAT) containing 109 SecIDs
24635#>>>76 	ubequad			x			\b, DIFAT=0x%16.16llx
24636#>>>84 	ubequad			x			\b%16.16llx...
24637# pointer to root entry only works with standard configuration for SecID ~< 800h
24638# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
24639# "ORLEN Factbook 2017.xls" XnView_metadata.doc
24640# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
24641>>>48	ulelong			>0x800			too big for FILE_BYTES_MAX = 1 MiB
24642# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
24643>>>0x1E	uleshort		0xc			\b, blocksize 4096
24644# jump to one block (4096 bytes per block) before root storage block
24645>>>>(48.l*4096)	ubyte	x
24646>>>>>&4095 	use		ole2-directory
24647#>>>0x1E	uleshort		9			\b, blocksize 512
24648>>>0x1E	uleshort		9
24649# jump to one block (512 bytes per block) before root storage block
24650# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
24651>>>>(48.l*512)	ubyte		x
24652>>>>>&511 	use		ole2-directory
24653# check directory entry structure and display types by GUID
246540	name			ole2-directory
24655# directory entry name like "Root Entry"
24656#>0 	lestring16	x 			\b, 1st %.10s
24657# type of the entry; 5~Root storage
24658#>66 	ubyte		x			\b, type %x
24659# node colour of the entry: 00H ~ Red 01H ~ Black
24660#>67 	ubyte		x			\b, color %x
24661# the DirIDs of the child nodes. Should both be -1 in the root storage entry
24662#>68 	bequad		!0xffffffffffffffff	\b, DirIDs %llx
24663# second directory entry name like VisioDocument Control000
24664#>128	lestring16	x \b, 2nd %.20s
24665# third directory entry like WordDocument
24666#>256	lestring16	x \b, 3rd %.20s
24667# forth
24668#>384	lestring16	x \b, 4th %.10s
24669# 5th
24670#>512	lestring16	x \b, 5th %.10s
24671# 6th
24672#>640	lestring16	x \b, 6th %.10s
24673# 7th
24674#>768	lestring16	x \b, 7th %.10s
24675#	https://wikileaks.org/ciav7p1/cms/page_13762814.html
24676#	https://m.blog.naver.com/superman4u/40047693679
24677#	https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
24678#	http://www.windowstricks.in/online-windows-guid-converter
24679#>80 	ubequad		!0			\b, clsid 0x%16.16llx
24680#>>88 	ubequad		x			\b%16.16llx
24681# test for "Root Entry" inside directory by type 5 value
24682>66 	ubyte		5
24683# look for CLSID GUID 0
24684>>88 	ubequad		0x0
24685>>>80 	ubequad		0x0
24686# - Microstation V8 DGN files (www.bentley.com)
24687# URL:	https://en.wikipedia.org/wiki/MicroStation
24688#   Last update on 10/23/2006 by Lester Hightower
24689#   07/24/2019 by Joerg Jenderek
24690# Second directory entry name like Dgn~H Dgn~S
24691>>>>128 	lestring16	Dgn~			: Microstation V8 CAD
24692#!:mime	application/x-ole-storage
24693!:mime	application/x-bentley-dgn
24694# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
24695!:ext	dgn
24696#
24697# URL:	http://fileformats.archiveteam.org/wiki/WordPerfect
24698# Second directory entry name PerfectOffice_
24699>>>>128 	lestring16	PerfectOffice_		: WordPerfect 7-X3 presentations Master, Document or Graphic
24700!:mime	application/vnd.wordperfect
24701# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
24702!:apple	????WPC7
24703!:ext	mst/wpd/wpg
24704#
24705# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
24706# Second directory entry name MatOST_
24707>>>>128 	lestring16	MatOST			: Microsoft Works 3.0 document
24708!:mime	application/vnd.ms-works
24709!:apple	????AWWP
24710!:ext	wps
24711#
24712# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
24713# 3rd directory entry name WksSSWorkBook
24714>>>>256 	lestring16	WksSSWorkBook		: Microsoft Works 6-9 spreadsheet
24715!:mime	application/vnd.ms-works
24716!:apple	????AWSS
24717!:ext	xlr
24718#
24719# URL:	http://fileformats.archiveteam.org/wiki/XLS
24720# what is the difference to {00020820-0000-0000-c000-000000000046} ?
24721# Second directory entry name Workbook
24722>>>>128 	lestring16	Workbook
24723>>>>>256 	lestring16	!WksSSWorkBook		: Microsoft Excel 97-2003 worksheet 0 clsid
24724!:mime	application/vnd.ms-excel
24725# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
24726!:apple	????XLS9
24727!:ext	xls
24728#
24729# URL:	http://fileformats.archiveteam.org/wiki/PPT
24730# Second directory entry name Object1 Object12 Object35
24731>>>>128 	lestring16	Object			: Microsoft PowerPoint 4 presentation
24732!:mime	application/vnd.ms-powerpoint
24733# https://www.macdisk.com/macsigen.php
24734!:apple	????PPT3
24735!:ext	ppt
24736#
24737# URL:	https://www.msoutlook.info/question/164
24738# Second directory entry name __CollDataStm
24739>>>>128 	lestring16	__CollDataStm		: Microsoft Outlook Send Receive Settings
24740#!:mime	application/vnd.ms-outlook
24741!:mime	application/x-ms-srs
24742# %APPDATA%\Microsoft\Outlook\Outlook.srs
24743!:ext	srs
24744#
24745# URL:	https://www.file-extensions.org/cag-file-extension
24746# Second directory entry name Category
24747>>>>128 	lestring16	Category		: Microsoft Clip Art Gallery
24748#!:mime	application/x-ole-storage
24749!:mime	application/x-ms-cag
24750!:apple	MScgCGdb
24751!:ext	cag/
24752#
24753# URL:	https://www.filesuffix.com/de/extension/rra
24754# 3rd directory entry name StrIndex_StringTable
24755>>>>256 	lestring16	StrIndex_StringTable	: Windows temporarily installer
24756#!:mime	application/x-ole-storage
24757!:mime	application/x-ms-rra
24758!:ext	rra
24759#
24760# URL:	https://www.forensicswiki.org/wiki/Jump_Lists
24761# 3rd directory entry name DestList
24762>>>>256 	lestring16	DestList		: Windows jump list
24763#!:mime	application/x-ole-storage
24764!:mime	application/x-ms-jumplist
24765# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
24766!:ext	automaticDestinations-ms
24767#
24768# URL:	https://en.wikipedia.org/wiki/Windows_thumbnail_cache
24769# Second directory entry name 256_
24770>>>>128 	lestring16	256_			: Windows thumbnail database 256
24771#!:mime	application/x-ole-storage
24772!:mime	application/x-ms-thumbnail
24773# Thumbs.db
24774!:ext	db
24775>>>>128 	lestring16	96_			: Windows thumbnail database 96
24776!:mime	application/x-ms-thumbnail
24777!:ext	db
24778# 3rd directory entry name Catalog_
24779>>>>256 	lestring16	Catalog			: Windows thumbnail database
24780!:mime	application/x-ms-thumbnail
24781!:ext	db
24782#
24783# URL:	https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
24784# Note:	older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
24785# Second directory entry name Control000
24786>>>>128 	lestring16	Control000		: Microsoft old Systeminfo
24787#!:mime	application/x-ole-storage
24788!:mime	application/x-ms-info
24789!:ext	nfo
24790#
24791# URL:	http://fileformats.archiveteam.org/wiki/Corel_Print_House
24792# Second directory entry name Thumbnail
24793>>>>128 	lestring16	Thumbnail		: Corel PrintHouse image
24794#!:mime	application/x-ole-storage
24795!:mime	application/x-corel-cph
24796!:ext	cph
24797# 3rd directory entry name Thumbnail
24798>>>>256 	lestring16	Thumbnail		: Corel PrintHouse image
24799!:mime	application/x-corel-cph
24800!:ext	cph
24801#
24802# URL:	https://en.wikipedia.org/wiki/Hangul_(word_processor)
24803# Note:	"HWP Document File" signature found in FileHeader
24804# Second directory entry name FileHeader hint for Thinkfree Office document
24805>>>>128 	lestring16	FileHeader		: Hangul (Korean) 5.0 Word Processor File
24806#!:mime	application/haansofthwp
24807!:mime	application/x-hwp
24808# https://example-files.online-convert.com/document/hwp/example.hwp
24809!:ext	hwp
24810#
24811# URL:	https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
24812# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
24813>>>>128 	lestring16	dd2			: StarOffice Gallery view
24814#!:mime	application/x-ole-storage
24815!:mime	application/x-star-sdv
24816!:ext	sdv
24817# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
24818# second directory entry name Current User
24819>>>>128 	lestring16	Current\ User		: SoftMaker
24820# third directory entry name SMNativeObjData
24821>>>>>256	lestring16	SMNativeObjData
24822# 5th directory entry nane PowerPoint
24823>>>>>>512	lestring16	PowerPoint		PowerPoint presentation or template
24824!:mime	application/vnd.ms-powerpoint
24825!:ext	ppt/pps/pot
24826# 4th directory entry name PowerPoint
24827>>>>>384	lestring16	PowerPoint		Presentations or template
24828# http://extension.nirsoft.net/prv
24829!:mime	application/vnd.softmaker.presentations
24830!:ext	prd/prv
24831# third directory entry name like Current User
24832>>>>256 	lestring16	Current\ User		: SoftMaker
24833# 5th directory entry name PowerPoint
24834>>>>>512	lestring16	PowerPoint		Presentations or template
24835# http://extension.nirsoft.net/prd
24836!:mime	application/vnd.softmaker.presentations
24837!:ext	prd/prv
24838# 2nd directory entry name Pictures
24839>>>>>>128 	lestring16	Pictures		with pictures
24840#	remaining null clsid
24841>>>>128 	default		x			: UNKNOWN
24842!:mime	application/x-ole-storage
24843#	look for known clsid GUID
24844# - Visio documents
24845# URL:	http://fileformats.archiveteam.org/wiki/Visio
24846#   Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
24847>>88 	ubequad		0xc000000000000046	: Microsoft
24848>>>80 	ubequad		0x131a020000000000	Visio 2000-2002 Document, stencil or template
24849!:mime	application/vnd.visio
24850# VSD~Drawing VSS~Stencil VST~Template
24851!:ext	vsd/vss/vst
24852>>>80 	ubequad		0x141a020000000000	Visio 2003-2010 Document, stencil or template
24853!:mime	application/vnd.visio
24854!:ext	vsd/vss/vst
24855#
24856# URL:	http://fileformats.archiveteam.org/wiki/Windows_Installer
24857>>>80 	ubequad		0x84100c0000000000	Windows Installer Package
24858!:mime	application/x-msi
24859#!:mime	application/x-ms-win-installer
24860!:ext	msi
24861>>>80 	ubequad		0x86100c0000000000	Windows Installer Patch
24862# ??
24863!:mime	application/x-wine-extension-msp
24864#!:mime	application/x-ms-msp
24865!:ext	msp
24866#
24867# URL:	http://fileformats.archiveteam.org/wiki/DOC
24868>>>80 	ubequad		0x0009020000000000	Word 6-95 document or template
24869!:mime	application/msword
24870# for template MSWDW8TN
24871!:apple	MSWDWDBN
24872!:ext	doc/dot
24873>>>80 	ubequad		0x0609020000000000	Word 97-2003 document or template
24874!:mime	application/msword
24875!:apple	MSWDWDBN
24876# dot for template; no extension on Macintosh
24877!:ext	doc/dot/
24878#
24879# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
24880>>>80 	ubequad		0x0213020000000000	Works 3-4 document or template
24881!:mime	application/vnd.ms-works
24882!:apple	????AWWP
24883# ps for template	https://filext.com/file-extension/PS	bps for backup
24884!:ext	wps/ps/bps
24885#
24886# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
24887>>>80 	ubequad		0x0313020000000000	Works 3-4 database or template
24888!:mime	application/vnd.ms-works-db
24889# https://www.macdisk.com/macsigen.php
24890!:apple	????AWDB
24891# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
24892!:ext	wdb/db/bdb
24893#
24894# URL:	https://en.wikipedia.org/wiki/Microsoft_Excel
24895>>>80 	ubequad		0x1008020000000000	Excel 5-95 worksheet, addin or template
24896!:mime	application/vnd.ms-excel
24897# https://www.macdisk.com/macsigen.php
24898!:apple	????XLS5
24899# worksheet/addin/template/no extension on Macintosh
24900!:ext	xls/xla/xlt/
24901#
24902>>>80 	ubequad		0x2008020000000000	Excel 97-2003
24903!:mime	application/vnd.ms-excel
24904# https://www.macdisk.com/macsigen.php	XLS5 for Excel 5
24905!:apple	????XLS9
24906# 3nd directory entry name
24907>>>>256 	lestring16	_VBA_PROJECT_CUR	addin
24908!:ext	xla/
24909# 4th directory entry name
24910>>>>384 	lestring16	_VBA_PROJECT_CUR	addin
24911!:ext	xla
24912#!:ext	xla/
24913>>>>256 	default		x			worksheet or template
24914!:ext	xls/xlt
24915#!:ext	xls/xlt/
24916#
24917# URL:	http://fileformats.archiveteam.org/wiki/OLE2
24918>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 item
24919#>>>80 	ubequad		0x0b0d020000000000	Outlook 97-2003 Message
24920#!:mime	application/vnd.ms-outlook
24921!:mime	application/x-ms-msg
24922!:ext	msg
24923# URL:	https://wiki.fileformat.com/email/oft/
24924>>>80 	ubequad		0x46f0060000000000	Outlook 97-2003 item template
24925#!:mime	application/vnd.ms-outlook
24926!:mime	application/x-ms-oft
24927!:ext	oft
24928#
24929# URL:	http://fileformats.archiveteam.org/wiki/PPT
24930>>>80 	ubequad		0x5148040000000000	PowerPoint 4.0 presentation
24931!:mime	application/vnd.ms-powerpoint
24932# https://www.macdisk.com/macsigen.php
24933!:apple	????PPT3
24934!:ext	ppt
24935#??
24936# URL:	http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
24937>>88 	ubequad		0xa29a00aa004a1a72	: Microsoft
24938# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
24939>>>80 	ubequad		0xc2dbcd28e20ace11	Works 4 document
24940!:mime	application/vnd.ms-works
24941!:apple	????AWWP
24942!:ext	wps
24943#
24944# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
24945>>>80 	ubequad		0xc3dbcd28e20ace11	Works 4 database
24946!:mime	application/vnd.ms-works-db
24947!:apple	????AWDB
24948!:ext	wdb/bdb
24949#??
24950>>88 	ubequad		0xa40700c04fb932ba	: Microsoft
24951# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
24952>>>80 	ubequad		0xb25aa40e0a9ed111	Works 5-6 document
24953!:mime	application/vnd.ms-works
24954!:apple	????AWWP
24955!:ext	wps
24956#??
24957# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
24958>>88 	ubequad		0x00c0000000000046	: Microsoft
24959>>>80 	ubequad		0x0112020000000000	Publisher
24960!:mime	application/vnd.ms-publisher
24961!:ext	pub
24962#
24963# URL:	http://fileformats.archiveteam.org/wiki/PPT
24964#??
24965>>88 	ubequad		0xa90300aa00510ea3	: Microsoft
24966>>>80 	ubequad		0x70ae7bea3bfbcd11	PowerPoint 95 presentation
24967!:mime	application/vnd.ms-powerpoint
24968# https://www.macdisk.com/macsigen.php
24969!:apple	????PPT3
24970!:ext	ppt/pot
24971#??
24972>>88 	ubequad		0x86ea00aa00b929e8	: Microsoft
24973>>>80 	ubequad		0x108d81649b4fcf11	PowerPoint 97-2003 presentation or template
24974!:mime	application/vnd.ms-powerpoint
24975!:apple	????PPT3
24976# /autostart/template
24977!:ext	ppt/pps/pot
24978#
24979# URL:	https://en.wikipedia.org/wiki/Microsoft_Project
24980#??
24981>>88 	ubequad		0xbe1100c04fb6faf1	: Microsoft
24982>>>80 	ubequad		0x3a8fb774c8c8d111	Project
24983!:mime	application/vnd.ms-project
24984!:ext	mpp
24985#
24986# URL:	http://fileformats.archiveteam.org/wiki/SHW_(Corel)
24987#???
24988>>88 	ubequad		0x99ae04021c007002	: WordPerfect
24989>>>80 	ubequad		0x62fe2e4099191b10	7-X3 presentation
24990!:mime	application/x-corelpresentations
24991#!:mime	application/x-shw-viewer
24992#!:mime	image/x-presentations
24993!:ext	shw
24994#
24995# URL:	http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
24996>>>80 	ubequad		0x60fe2e4099191b10	9 Graphic
24997#!:mime	application/x-wpg
24998#!:mime	image/x-wordperfect-graphics
24999!:mime	image/x-wpg
25000# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
25001!:apple	????WPC9
25002!:ext	wpg
25003#
25004# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
25005>>88 	ubequad		0x996104021c007002	: StarOffice
25006>>>80 	ubequad		0x407e5cdc5cb31b10	StarWriter 3.0 document or template
25007# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
25008!:mime	application/x-starwriter
25009!:ext	sdw/vor
25010#
25011>>>80 	ubequad		0xa03f543fa6b61b10	StarCalc 3.0 spreadsheet or template
25012!:mime	application/x-starcalc
25013!:ext	sdc/vor
25014#
25015>>>80 	ubequad		0xe0aa10af6db31b10	StarDraw 3.0 drawing or template
25016!:mime	application/x-starimpress
25017#!:mime	application/x-stardraw
25018# sda ??
25019!:ext	sdd/sda/vor
25020#??
25021>>88 	ubequad		0x89cb008029e4b0b1	: StarOffice
25022>>>80 	ubequad		0x41d461633542d011	StarCalc 4.0 spreadsheet or template
25023!:mime	application/x-starcalc
25024!:ext	sdc/vor
25025#
25026>>>80 	ubequad		0x61b8a5c6d685d111	StarCalc 5.0 spreadsheet or template
25027!:mime	application/vnd.stardivision.cal
25028!:ext	sdc/vor
25029#
25030>>>80 	ubequad		0xc03c2d011642d011	StarImpress 4.0 presentation or template
25031!:mime	application/x-starimpress
25032!:ext	sdd/vor
25033#??
25034>>88 	ubequad		0xb12a04021c007002	: StarOffice
25035>>>80 	ubequad		0x600459d4fd351c10	StarMath 3.0
25036!:mime	application/x-starmath
25037!:ext	smf
25038#??
25039>>88 	ubequad		0x8e2c00001b4cc711	: StarOffice
25040>>>80 	ubequad		0xe0999cfb6d2c1c10	StarChart 3.0
25041!:mime	application/x-starchart
25042!:ext	sds
25043#??
25044>>88 	ubequad		0xa45e00a0249d57b1	: StarOffice
25045>>>80 	ubequad		0xb0e9048b0e42d011	StarWriter 4.0 document or template
25046!:mime	application/x-starwriter
25047!:ext	sdw/vor
25048#??
25049>>88 	ubequad		0x89ca008029e4b0b1	: StarOffice
25050>>>80 	ubequad		0xe1b7b3022542d011	StarMath 4.0
25051!:mime	application/x-starmath
25052!:ext	smf
25053#
25054>>>80 	ubequad		0xe0b7b3022542d011	StarChart 4.0
25055!:mime	application/x-starchart
25056!:ext	sds
25057#??
25058>>88 	ubequad		0xa53f00a0249d57b1	: StarOffice
25059>>>80 	ubequad		0x70c90a340de3d011	Master 4.0 document
25060!:mime	application/x-starwriter-global
25061!:ext	sgl
25062#??
25063>>88 	ubequad		0x89d0008029e4b0b1	: StarOffice
25064>>>80 	ubequad		0x40e6b5ffde85d111	StarMath 5.0
25065!:mime	application/vnd.stardivision.math
25066!:ext	smf
25067#
25068>>>80 	ubequad		0xa005892ebd85d111	StarDraw 5.0 drawing or template
25069!:mime	application/vnd.stardivision.draw
25070!:ext	sda/vor
25071#
25072>>>80 	ubequad		0x21725c56bc85d111	StarImpress 5.0 presentation or template
25073!:mime	application/vnd.stardivision.impress
25074# sda is used for what?
25075!:ext	sdd/vor/sda
25076#
25077>>>80 	ubequad		0x214388bfdd85d111	StarChart 5.0
25078!:mime	application/vnd.stardivision.chart
25079!:ext	sds
25080# ??
25081>>88 	ubequad		0xaab4006097da561a	: StarOffice
25082>>>80 	ubequad		0xd1f90cc2ae85d111	StarWriter 5.0 document or template
25083!:mime	application/vnd.stardivision.writer
25084!:ext	sdw/vor
25085#
25086>>>80 	ubequad		0xd3f90cc2ae85d111	Master 5.0 document
25087!:mime	application/vnd.stardivision.writer-global
25088!:ext	sgl
25089#??
25090# URL:	http://fileformats.archiveteam.org/wiki/FlashPix
25091>>88 	ubequad		0x855300aa00a1f95b	: Kodak
25092>>>80 	ubequad		0x0067615654c1ce11	FlashPIX Image
25093!:mime	image/vnd.fpx
25094!:apple	????FPix
25095!:ext	fpx
25096# URL:	https://en.wikipedia.org/wiki/SoftMaker_Office
25097>>88 	ubequad		0x95f600a0cc3cca14	: PlanMaker
25098>>>80 	ubequad		0x9174088a6452d411	document or template
25099!:mime	application/vnd.softmaker.planmaker
25100# pmv for template	https://www.file-extensions.org/pmv-file-extension
25101!:ext	pmd/pmv
25102# remaining non null clsid
25103>>88 	default		x			: UNKNOWN
25104!:mime	application/x-ole-storage
25105>>>80 	ubequad		!0			\b, clsid 0x%16.16llx
25106>>>88 	ubequad		x			\b%16.16llx
25107
25108
25109#------------------------------------------------------------------------------
25110# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
25111# olf:  file(1) magic for OLF executables
25112#
25113# We have to check the byte order flag to see what byte order all the
25114# other stuff in the header is in.
25115#
25116# MIPS R3000 may also be for MIPS R2000.
25117# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
25118#
25119# Created by Erik Theisen <etheisen@openbsd.org>
25120# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
251210	string		\177OLF		OLF
25122>4	byte		0		invalid class
25123>4	byte		1		32-bit
25124>4	byte		2		64-bit
25125>7	byte		0		invalid os
25126>7	byte		1		OpenBSD
25127>7	byte		2		NetBSD
25128>7	byte		3		FreeBSD
25129>7	byte		4		4.4BSD
25130>7	byte		5		Linux
25131>7	byte		6		SVR4
25132>7	byte		7		esix
25133>7	byte		8		Solaris
25134>7	byte		9		Irix
25135>7	byte		10		SCO
25136>7	byte		11		Dell
25137>7	byte		12		NCR
25138>5	byte		0		invalid byte order
25139>5	byte		1		LSB
25140>>16	leshort		0		no file type,
25141>>16	leshort		1		relocatable,
25142>>16	leshort		2		executable,
25143>>16	leshort		3		shared object,
25144# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
25145# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
25146>>16	leshort		4		core file
25147>>>(0x38+0xcc) string	>\0		of '%s'
25148>>>(0x38+0x10) lelong	>0		(signal %d),
25149>>16	leshort		&0xff00		processor-specific,
25150>>18	leshort		0		no machine,
25151>>18	leshort		1		AT&T WE32100 - invalid byte order,
25152>>18	leshort		2		SPARC - invalid byte order,
25153>>18	leshort		3		Intel 80386,
25154>>18	leshort		4		Motorola 68000 - invalid byte order,
25155>>18	leshort		5		Motorola 88000 - invalid byte order,
25156>>18	leshort		6		Intel 80486,
25157>>18	leshort		7		Intel 80860,
25158>>18	leshort		8		MIPS R3000_BE - invalid byte order,
25159>>18	leshort		9		Amdahl - invalid byte order,
25160>>18	leshort		10		MIPS R3000_LE,
25161>>18	leshort		11		RS6000 - invalid byte order,
25162>>18	leshort		15		PA-RISC - invalid byte order,
25163>>18	leshort		16		nCUBE,
25164>>18	leshort		17		VPP500,
25165>>18	leshort		18		SPARC32PLUS,
25166>>18	leshort		20		PowerPC,
25167>>18	leshort		0x9026		Alpha,
25168>>20	lelong		0		invalid version
25169>>20	lelong		1		version 1
25170>>36	lelong		1		MathCoPro/FPU/MAU Required
25171>8	string		>\0		(%s)
25172>5	byte		2		MSB
25173>>16	beshort		0		no file type,
25174>>16	beshort		1		relocatable,
25175>>16	beshort		2		executable,
25176>>16	beshort		3		shared object,
25177>>16	beshort		4		core file,
25178>>>(0x38+0xcc) string	>\0		of '%s'
25179>>>(0x38+0x10) belong	>0		(signal %d),
25180>>16	beshort		&0xff00		processor-specific,
25181>>18	beshort		0		no machine,
25182>>18	beshort		1		AT&T WE32100,
25183>>18	beshort		2		SPARC,
25184>>18	beshort		3		Intel 80386 - invalid byte order,
25185>>18	beshort		4		Motorola 68000,
25186>>18	beshort		5		Motorola 88000,
25187>>18	beshort		6		Intel 80486 - invalid byte order,
25188>>18	beshort		7		Intel 80860,
25189>>18	beshort		8		MIPS R3000_BE,
25190>>18	beshort		9		Amdahl,
25191>>18	beshort		10		MIPS R3000_LE - invalid byte order,
25192>>18	beshort		11		RS6000,
25193>>18	beshort		15		PA-RISC,
25194>>18	beshort		16		nCUBE,
25195>>18	beshort		17		VPP500,
25196>>18	beshort		18		SPARC32PLUS,
25197>>18	beshort		20		PowerPC or cisco 4500,
25198>>18	beshort		21		cisco 7500,
25199>>18	beshort		24		cisco SVIP,
25200>>18	beshort		25		cisco 7200,
25201>>18	beshort		36		cisco 12000,
25202>>18	beshort		0x9026		Alpha,
25203>>20	belong		0		invalid version
25204>>20	belong		1		version 1
25205>>36	belong		1		MathCoPro/FPU/MAU Required
25206
25207#------------------------------------------------------------------------------
25208# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $
25209# openfs:  file(1) magic for OpenFST (Weighted finite-state tranducer library)
25210
252110	long		0x7eb2fdd6	OpenFst binary FST data
25212>&0	pstring/l	x		\b, fst type: %s
25213>>&0	pstring/l	x		\b, arc type: %s
25214>>>&0	long		x		\b, version: %d
25215>>>>&20	quad		x		\b, num states: %lld
25216>>>>>&0	quad		>0		\b, num arcs: %lld
25217
252180	long    0x56515c	OpenFst binary FAR data, far type: stlist
25219>4	long 	x		\b, version: %d
25220
252210	long	0x7eb2f35c	OpenFst binary FAR data, far type: sttable
25222>4	long	x		\b, version: %d
25223
25224#------------------------------------------------------------
25225# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $
25226# OpenTimestamps related magic entries
25227# https://opentimestamps.org/
25228# https://en.wikipedia.org/wiki/OpenTimestamps
25229# "Emanuele Cisbani" <emanuele.cisbani@gmail.com>
25230#------------------------------------------------------------
25231
25232# OpenTimestamps Proof .ots format.
25233# Magic is defined here:
25234# https://github.com/opentimestamps/python-opentimestamps/\
25235# blob/master/opentimestamps/core/timestamp.py#L273
25236
252370	string	\x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps
25238>16	string	\x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof
25239
25240#------------------------------------------------------------------------------
25241# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
25242# os2:  file(1) magic for OS/2 files
25243#
25244
25245# Provided 1998/08/22 by
25246# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
252471	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
25248>17	search/100	URL= 			(URL=<
25249>>&0	string		x			\b%s>)
25250
25251# OS/2 URL objects
25252# Provided 1998/08/22 by
25253# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
25254#0	string	http:			OS/2 URL object text
25255#>5	string	>\			(WWW) <http:%s>
25256#0	string	mailto:			OS/2 URL object text
25257#>7	string	>\			(email) <%s>
25258#0	string	news:			OS/2 URL object text
25259#>5	string	>\			(Usenet) <%s>
25260#0	string	ftp:			OS/2 URL object text
25261#>4	string	>\			(FTP) <ftp:%s>
25262#0	string	file:			OS/2 URL object text
25263#>5	string	>\			(Local file) <%s>
25264
25265# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
25266# Carl Hauser (chauser.parc@xerox.com) and
25267# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
25268# list the following header format in inf02a.doc:
25269#
25270#  int16 ID;           // ID magic word (5348h = "HS")
25271#  int8  unknown1;     // unknown purpose, could be third letter of ID
25272#  int8  flags;        // probably a flag word...
25273#                      //  bit 0: set if INF style file
25274#                      //  bit 4: set if HLP style file
25275#                      // patching this byte allows reading HLP files
25276#                      // using the VIEW command, while help files
25277#                      // seem to work with INF settings here as well.
25278#  int16 hdrsize;      // total size of header
25279#  int16 unknown2;     // unknown purpose
25280#
252810   string  HSP\x01\x9b\x00 OS/2 INF
25282>107 string >0                      (%s)
252830   string  HSP\x10\x9b\x00     OS/2 HLP
25284>107 string >0                      (%s)
25285
25286# OS/2 INI (this is a guess)
252870  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
25288
25289#------------------------------------------------------------------------------
25290# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
25291# os400:  file(1) magic for IBM OS/400 files
25292#
25293# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
25294# In spite of its quite variable format (due to internal memory page
25295# length differences between CISC and RISC versions of the OS) the
25296# SAVF structure hasn't suitable offsets to identify the catalog
25297# header in the first descriptor where there are some useful infos,
25298# so we must search in a somewhat large area for a particular string
25299# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
25300# descriptor space) preceded by a two byte constant.
25301#
253021090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
25303>&212	 byte		0x01			 \b, created with SAVOBJ
25304>&212	 byte		0x02			 \b, created with SAVLIB
25305>&212	 byte		0x07			 \b, created with SAVCFG
25306>&212	 byte		0x08			 \b, created with SAVSECDTA
25307>&212	 byte		0x0A			 \b, created with SAVSECDTA
25308>&212	 byte		0x0B			 \b, created with SAVDLO
25309>&212	 byte		0x0D			 \b, created with SAVLICPGM
25310>&212	 byte		0x11			 \b, created with SAVCHGOBJ
25311>&213	 byte		0x44			 \b, at least V5R4 to open
25312>&213	 byte		0x43			 \b, at least V5R3 to open
25313>&213	 byte		0x42			 \b, at least V5R2 to open
25314>&213	 byte		0x41			 \b, at least V5R1 to open
25315>&213	 byte		0x40			 \b, at least V4R5 to open
25316>&213	 byte		0x3F			 \b, at least V4R4 to open
25317>&213	 byte		0x3E			 \b, at least V4R3 to open
25318>&213	 byte		0x3C			 \b, at least V4R2 to open
25319>&213	 byte		0x3D			 \b, at least V4R1M4 to open
25320>&213	 byte		0x3B			 \b, at least V4R1 to open
25321>&213	 byte		0x3A			 \b, at least V3R7 to open
25322>&213	 byte		0x35			 \b, at least V3R6 to open
25323>&213	 byte		0x36			 \b, at least V3R2 to open
25324>&213	 byte		0x34			 \b, at least V3R1 to open
25325>&213	 byte		0x31			 \b, at least V3R0M5 to open
25326>&213	 byte		0x30			 \b, at least V2R3 to open
25327
25328#------------------------------------------------------------------------------
25329# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
25330#
25331# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
25332#
25333# Redistribution and use in source and binary forms, with or without
25334# modification, are permitted provided that the following conditions
25335# are met:
25336# 1. Redistributions of source code must retain the above copyright
25337#    notice, this list of conditions and the following disclaimer.
25338# 2. Redistributions in binary form must reproduce the above copyright
25339#    notice, this list of conditions and the following disclaimer in the
25340#    documentation and/or other materials provided with the distribution.
25341#
25342# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
25343# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25344# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25345# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25346# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25347# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
25348# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
25349# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
25350# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
25351# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25352#
25353#
25354#
25355# OS9/6809 module descriptions:
25356#
253570	beshort		0x87CD	OS9/6809 module:
25358#
25359>6	byte&0x0f	0x00	non-executable
25360>6	byte&0x0f	0x01	machine language
25361>6	byte&0x0f	0x02	BASIC I-code
25362>6	byte&0x0f	0x03	Pascal P-code
25363>6	byte&0x0f	0x04	C I-code
25364>6	byte&0x0f	0x05	COBOL I-code
25365>6	byte&0x0f	0x06	Fortran I-code
25366#
25367>6	byte&0xf0	0x10	program executable
25368>6	byte&0xf0	0x20	subroutine
25369>6	byte&0xf0	0x30	multi-module
25370>6	byte&0xf0	0x40	data module
25371#
25372>6	byte&0xf0	0xC0	system module
25373>6	byte&0xf0	0xD0	file manager
25374>6	byte&0xf0	0xE0	device driver
25375>6	byte&0xf0	0xF0	device descriptor
25376#
25377# OS9/m68k stuff (to be continued)
25378#
253790	beshort		0x4AFC	OS9/68K module:
25380#
25381# attr
25382>0x14	byte&0x80	0x80	re-entrant
25383>0x14	byte&0x40	0x40	ghost
25384>0x14	byte&0x20	0x20	system-state
25385#
25386# lang:
25387#
25388>0x13	byte		1	machine language
25389>0x13	byte		2	BASIC I-code
25390>0x13	byte		3	Pascal P-code
25391>0x13	byte		4	C I-code
25392>0x13	byte		5	COBOL I-code
25393>0x13	byte		6	Fortran I-code
25394#
25395#
25396# type:
25397#
25398>0x12	byte		1	program executable
25399>0x12	byte		2	subroutine
25400>0x12	byte		3	multi-module
25401>0x12	byte		4	data module
25402>0x12	byte		11	trap library
25403>0x12	byte		12	system module
25404>0x12	byte		13	file manager
25405>0x12	byte		14	device driver
25406>0x12	byte		15	device descriptor
25407
25408#------------------------------------------------------------------------------
25409# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
25410#
25411# Mach magic number info
25412#
254130	long		0xefbe	OSF/Rose object
25414# I386 magic number info
25415#
254160	short		0565	i386 COFF object
25417
25418#------------------------------------------------------------------------------
25419# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $
25420# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
25421#
25422# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
25423
25424# These are weak, byte 59 is not guaranteed to be 0 and there are
25425# 8 character identifiers at byte 60, one I found for appl is BIGb.
25426# What are the possibilities and where is this documented?
25427
25428# The common header format for PalmOS .pdb/.prc files is
25429# {
25430#         char            name[ 32 ];
25431#         Word            attributes;
25432#         Word            version;
25433#         DWord           creationDate;
25434#         DWord           modificationDate;
25435#         DWord           lastBackupDate;
25436#         DWord           modificationNumber;
25437#         DWord           appInfoID;
25438#         DWord           sortInfoID;
25439#         char            type[4];
25440#         char            creator[4];
25441#         DWord           uniqueIDSeed;
25442#         RecordListType  recordList;
25443# };
25444#
25445# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
25446# or Unix/POSIX time + 2082844800.
25447
254480		name		aportisdoc
25449# date is supposed to be big-endian seconds since 1 Jan 1904, but many
25450# files contain the timestamp in little-endian or a completely
25451# nonsensical value...
25452#>36		bedate-2082844800	>0	\b, created %s
25453# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
25454>(78.L)		beshort		=1		\b, uncompressed
25455# compressed
25456>(78.L)		beshort		>1
25457>>(78.L+4)	belong		x		\b, %d bytes uncompressed
25458
25459# appl
25460#60		string		appl		PalmOS application
25461#>0		string		>\0		"%s"
25462
25463# HACK
25464#60		string		HACK		HackMaster hack
25465#>0		string		>\0		"%s"
25466
25467# iSiloX e-book
2546860		string		SDocSilX	iSiloX E-book
25469>0		string		>\0		"%s"
25470
25471# Mobipocket (www.mobipocket.com), donated by Carl Witty
25472# expanded by Ralf Brown
2547360		string	 	BOOKMOBI	Mobipocket E-book
25474# MobiPocket stores a full title, pointed at by the belong at offset
25475# 0x54 in its header at (78.L), with length given by the belong at
25476# offset 0x58.
25477# there's no guarantee that the title string is null-terminated, but
25478# we currently can't specify a variable-length string where the length
25479# field is not at the start of the string; in practice, the data
25480# following the string always seems to start with a zero byte
25481>(78.L)		belong		x
25482>>&(&0x50.L-4)	string		>\0		"%s"
25483>0		use		aportisdoc
25484>>(78.L+0x68)	belong		>0		\b, version %d
25485>>(78.L+0x1C)	belong		!0		\b, codepage %d
25486>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
25487
25488# AportisDoc/PalmDOC
2548960		string		TEXtREAd	AportisDoc/PalmDOC E-book
25490>0		string		>\0		"%s"
25491>0		use		aportisdoc
25492
25493# Variety of PalmOS document types
25494# Michael-John Turner <mj@debian.org>
25495# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
2549660	string			BVokBDIC	BDicty PalmOS document
25497>0	string			>\0		"%s"
2549860	string			DB99DBOS	DB PalmOS document
25499>0	string			>\0		"%s"
2550060	string			vIMGView	FireViewer/ImageViewer PalmOS document
25501>0	string			>\0		"%s"
2550260	string			PmDBPmDB	HanDBase PalmOS document
25503>0	string			>\0		"%s"
2550460	string			InfoINDB	InfoView PalmOS document
25505>0	string			>\0		"%s"
2550660	string			ToGoToGo	iSilo PalmOS document
25507>0	string			>\0		"%s"
2550860	string			JfDbJBas	JFile PalmOS document
25509>0	string			>\0		"%s"
2551060	string			JfDbJFil	JFile Pro PalmOS document
25511>0	string			>\0		"%s"
2551260	string			DATALSdb	List PalmOS document
25513>0	string			>\0		"%s"
2551460	string			Mdb1Mdb1	MobileDB PalmOS document
25515>0	string			>\0		"%s"
2551660	string			PNRdPPrs	PeanutPress PalmOS document
25517>0	string			>\0		"%s"
2551860	string			DataPlkr	Plucker PalmOS document
25519>0	string			>\0		"%s"
2552060	string			DataSprd	QuickSheet PalmOS document
25521>0	string			>\0		"%s"
2552260	string			SM01SMem	SuperMemo PalmOS document
25523>0	string			>\0		"%s"
2552460	string			TEXtTlDc	TealDoc PalmOS document
25525>0	string			>\0		"%s"
2552660	string			InfoTlIf	TealInfo PalmOS document
25527>0	string			>\0		"%s"
2552860	string			DataTlMl	TealMeal PalmOS document
25529>0	string			>\0		"%s"
2553060	string			DataTlPt	TealPaint PalmOS document
25531>0	string			>\0		"%s"
2553260	string			dataTDBP	ThinkDB PalmOS document
25533>0	string			>\0		"%s"
2553460	string			TdatTide	Tides PalmOS document
25535>0	string			>\0		"%s"
2553660	string			ToRaTRPW	TomeRaider PalmOS document
25537>0	string			>\0		"%s"
25538
25539# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
25540# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
25541#   annotations.
25542# For other versions, just outputs version.
25543#
2554460		string		zTXT		A GutenPalm zTXT e-book
25545>0		string		>\0		"%s"
25546>(0x4E.L)	byte		0
25547>>(0x4E.L+1)	byte		x		(v0.%02d)
25548>(0x4E.L)	byte		1
25549>>(0x4E.L+1)	byte		x		(v1.%02d)
25550>>>(0x4E.L+10)	beshort		>0
25551>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
25552>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
25553>>>(0x4E.L+14)	beshort		>0
25554>>>>(0x4E.L+14) beshort		<2		- 1 annotation
25555>>>>(0x4E.L+14) beshort		>1		- %d annotations
25556>(0x4E.L)	byte		>1		(v%d.
25557>>(0x4E.L+1)	byte		x		%02d)
25558
25559# Palm OS .prc file types
2556060		string		libr
25561# flags, only bit 0 or bit 6
25562# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
25563# https://web.mit.edu/tytso/www/pilot/prc-format.html
25564>0x20		beshort&0xffbe	0
25565>>0		string		>\0		Palm OS dynamic library data "%s"
2556660		string		ptch		Palm OS operating system patch data
25567>0		string		>\0		"%s"
25568
25569# Mobipocket (www.mobipocket.com), donated by Carl Witty
2557060	string			BOOKMOBI	Mobipocket E-book
25571>0	string			>\0		"%s"
25572
25573#------------------------------------------------------------------------------
25574# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $
25575#
25576# Parix COFF executables
25577# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
25578#
255790	beshort&0xefff	0x8ACE	PARIX
25580>0	byte&0xf0	0x80	T800
25581>0	byte&0xf0	0x90	T9000
25582>19	byte&0x02	0x02	executable
25583>19	byte&0x02	0x00	object
25584>19	byte&0x0c	0x00	not stripped
25585#------------------------------------------------------------------------------
25586# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $
25587# parrot: file(1) magic for Parrot Virtual Machine
25588# URL:	https://www.lua.org/
25589# From: Lubomir Rintel <lkundrak@v3.sk>
25590
25591# Compiled Parrot byte code
255920	string	\376PBC\r\n\032\n	Parrot bytecode
25593>64	byte	x			%d.
25594>72	byte	x			\b%d,
25595>8	byte	>0			%d byte words,
25596>16	byte	0			little-endian,
25597>16	byte	1			big-endian,
25598>32	byte	0			IEEE-754 8 byte double floats,
25599>32	byte	1			x86 12 byte long double floats,
25600>32	byte	2			IEEE-754 16 byte long double floats,
25601>32	byte	3			MIPS 16 byte long double floats,
25602>32	byte	4			AIX 16 byte long double floats,
25603>32	byte	5			4-byte floats,
25604>40	byte	x			Parrot %d.
25605>48	byte	x			\b%d.
25606>56	byte	x			\b%d
25607#------------------------------------------------------------------------------
25608# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $
25609# pascal:  file(1) magic for Pascal source
25610#
256110	search/8192	(input,		Pascal source text
25612!:mime	text/x-pascal
25613#0	regex		\^program	Pascal source text
25614#!:mime	text/x-pascal
25615#0	regex           	\^record		Pascal source text
25616#!:mime	text/x-pascal
25617
25618# Free Pascal
256190	string	PPU	Pascal unit
25620>3	string	x	\b, version %s
25621
25622#------------------------------------------------------------------------------
25623# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $
25624# file(1) magic(5) data for OpenStreetMap
25625
25626# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
25627# https://wiki.openstreetmap.org/wiki/PBF_Format
25628# From: Markus Heidelberg <markus.heidelberg@web.de>
256290	belong&0xfffffff0	0
25630>4	beshort			0x0A09
25631>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
25632
25633#------------------------------------------------------------------------------
25634# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
25635# pbm:  file(1) magic for Portable Bitmap files
25636#
25637# XXX - byte order?
25638#
256390	short	0x2a17	"compact bitmap" format (Poskanzer)
25640#------------------------------------------------------------------------------
25641# pc88:  file(1) magic for the NEC Home Computer
25642# v1.0
25643# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
25644
25645# PC88 2D disk image
256460x20		ulelong&0xFFFFFEFF	0x2A0
25647>0x10		string		\0\0\0\0\0\0\0\0\0\0
25648>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
25649>>>0x1A		ubyte&0xEF	0
25650>>>>0x1B	ubyte&0x8F	0
25651>>>>>0x1B	ubyte&70	<0x40
25652>>>>>>0x1C	ulelong	>0x21
25653>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
25654>>>>>>>>0x1B	ubyte	0	\b, media=2D
25655>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
25656>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
25657>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
25658>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
25659>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
25660
25661
25662
25663
25664#------------------------------------------------------------------------------
25665# pc98:  file(1) magic for the MSX Home Computer
25666# v1.0
25667# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
25668
25669# Maki-chan v1 Graphic format
25670# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
25671# http://www.jisyo.com/viewer/faq/maki_tech.htm
256720	string/b		MAKI01 	Maki-chan v1.
25673>6	ubyte|0x20	x		\b%c image
25674>8	ubelong		>0x40404040	\b, system ID:
25675>>8	byte		x		%c
25676>>9	byte		x		\b%c
25677>>10	byte		x		\b%c
25678>>11	byte		x		\b%c
25679>44	ubeshort	x		\b, %dx
25680>46	ubeshort	x		\b%d
25681>38	ubeshort&2	0		\b, 16 paletted RGB colors
25682>38	ubeshort&2	2		\b, 8 fixed RGB colors
25683>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
25684
25685# Maki-chan v2 Graphic format
25686# http://www.jisyo.com/viewer/faq/mag_tech.htm
25687# https://mooncore.eu/bunny/txt/makichan.htm
25688# http://metanest.jp/mag/mag.xhtml
256890	string/b		MAKI02\ \ 	Maki-chan v2 image,
25690>8	byte		x		system ID: %c
25691>9	byte		x		\b%c
25692>10	byte		x		\b%c
25693>11	byte		x		\b%c,
25694>13	search/0x200	\x1A
25695#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
25696#1) When offset1(ubeshort) !=0x0344:
25697# 1.1) And  offset3(ubyte).b7=0:
25698# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
25699# - b1=number of colors: 0=16 colors, 1=8 colors
25700# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
25701# 1.2) And  offset3(ubyte).B7=1:
25702# - b0=256 paletted colors
25703# - b1=256 fixed colors using the MSX SCR8 palette
25704#2) When offset1(ubeshort) =0x0344:
25705# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
25706>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
25707>>&1	ubeshort	!0x0344
25708>>>&5	uleshort+1	x		%dx
25709>>>&7	uleshort+1	x		\b%d,
25710>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
25711>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
25712>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
25713>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
25714>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
25715>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
25716>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
25717
25718# XLD4 (Q4) picture
2571911	string/b	MAJYO		XLD4(Q4) picture
25720
25721# Yanagisawa Pi picture
25722#0	string		Pi\x1A\0	Yanagisawa Pi picture
25723#>3	search/0x200	\x04
257240	string		Pi
25725>2	search/0x200	\x1A
25726>>&0	ubyte		0
25727>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
25728>>>&4	byte		x		system ID: %c
25729>>>&5	byte		x		\b%c
25730>>>&6	byte		x		\b%c
25731>>>&7	byte		x		\b%c,
25732>>>&10	ubeshort	x		%dx
25733>>>&12	ubeshort	x		\b%d
25734>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
25735>>>&4	byte		x		system ID: %c
25736>>>&5	byte		x		\b%c
25737>>>&6	byte		x		\b%c
25738>>>&7	byte		x		\b%c,
25739>>>&10	ubeshort	x		%dx
25740>>>&12	ubeshort	x		\b%d
25741
25742#------------------------------------------------------------------------------
25743# $File: pdf,v 1.12 2020/01/30 01:48:44 christos Exp $
25744# pdf:  file(1) magic for Portable Document Format
25745#
25746
257470	name	pdf
25748>8	search/512	/Filter/FlateDecode/	(password protected)
25749
257500	string		%PDF-		PDF document
25751!:mime	application/pdf
25752!:strength +60
25753>5	byte		x		\b, version %c
25754>7	byte		x		\b.%c
25755>0	use		pdf
25756
257570	string		\012%PDF-	PDF document
25758!:mime	application/pdf
25759!:strength +60
25760>6	byte		x		\b, version %c
25761>8	byte		x		\b.%c
25762>0	use		pdf
25763
257640	string		\xef\xbb\xbf%PDF-	PDF document (UTF-8)
25765!:mime	application/pdf
25766!:strength +60
25767>6	byte		x		\b, version %c
25768>8	byte		x		\b.%c
25769>0	use		pdf
25770
25771# From: Nick Schmalenberger <nick@schmalenberger.us>
25772# Forms Data Format
257730       string          %FDF-           FDF document
25774!:mime application/vnd.fdf
25775!:strength +60
25776>5      byte            x               \b, version %c
25777>7      byte            x               \b.%c
25778
257790	search/256	%PDF-		PDF document
25780!:mime	application/pdf
25781!:strength +60
25782>&0	byte		x		\b, version %c
25783>&2	byte		x		\b.%c
25784>0	use		pdf
25785
25786#------------------------------------------------------------------------------
25787# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
25788# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
25789#
257900	lelong		0101555		PDP-11 single precision APL workspace
257910	lelong		0101554		PDP-11 double precision APL workspace
25792#
25793# PDP-11 a.out
25794#
257950	leshort		0407		PDP-11 executable
25796>8	leshort		>0		not stripped
25797>15	byte		>0		- version %d
25798
25799# updated by Joerg Jenderek at Mar 2013
25800# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
258010	leshort		0401
25802# skip *.PNF with WinDirPathOffset 58h
25803>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
25804# skip *.PNF with high byte of InfVersionDatumCount zero
25805#>>15	byte		!0		PDP-11 UNIX/RT ldp
258060	leshort		0405		PDP-11 old overlay
25807
258080	leshort		0410		PDP-11 pure executable
25809>8	leshort		>0		not stripped
25810>15	byte		>0		- version %d
25811
258120	leshort		0411		PDP-11 separate I&D executable
25813>8	leshort		>0		not stripped
25814>15	byte		>0		- version %d
25815
258160	leshort		0437		PDP-11 kernel overlay
25817
25818# These last three are derived from 2.11BSD file(1)
258190	leshort		0413		PDP-11 demand-paged pure executable
25820>8	leshort		>0		not stripped
25821
258220	leshort		0430		PDP-11 overlaid pure executable
25823>8	leshort		>0		not stripped
25824
258250	leshort		0431		PDP-11 overlaid separate executable
25826>8	leshort		>0		not stripped
25827#------------------------------------------------------------------------------
25828# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
25829# perl:  file(1) magic for Larry Wall's perl language.
25830#
25831# The `eval' lines recognizes an outrageously clever hack.
25832# Keith Waclena <keith@cerberus.uchicago.edu>
25833# Send additions to <perl5-porters@perl.org>
258340	search/1024	eval\ "exec\ perl		Perl script text
25835!:mime	text/x-perl
258360	search/1024	eval\ "exec\ /bin/perl		Perl script text
25837!:mime	text/x-perl
258380	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
25839!:mime	text/x-perl
258400	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
25841!:mime	text/x-perl
258420	search/1024	eval\ 'exec\ perl		Perl script text
25843!:mime	text/x-perl
258440	search/1024	eval\ 'exec\ /bin/perl		Perl script text
25845!:mime	text/x-perl
258460	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
25847!:mime	text/x-perl
258480	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
25849!:mime	text/x-perl
258500	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
25851!:mime	text/x-perl
258520	string	#!/usr/bin/env\ perl	Perl script text executable
25853!:mime	text/x-perl
258540	string	#!\ /usr/bin/env\ perl	Perl script text executable
25855!:mime	text/x-perl
258560	string	#!
25857>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
25858!:mime	text/x-perl
25859
25860# by Dmitry V. Levin and Alexey Tourbin
25861# check the first line
258620	search/8192	package
25863>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
25864!:strength + 40
25865# not 'p', check other lines
258660	search/8192	!p
25867>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
25868>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
25869!:strength + 75
25870
25871# Perl POD documents
25872# From: Tom Hukins <tom@eborcom.com>
258730	search/1024/W	\=pod\n		Perl POD document text
258740	search/1024/W	\n\=pod\n	Perl POD document text
258750	search/1024/W	\=head1\ 	Perl POD document text
258760	search/1024/W	\n\=head1\ 	Perl POD document text
258770	search/1024/W	\=head2\ 	Perl POD document text
258780	search/1024/W	\n\=head2\ 	Perl POD document text
258790	search/1024/W	\=encoding\ 	Perl POD document text
258800	search/1024/W	\n\=encoding\ 	Perl POD document text
25881
25882
25883# Perl Storable data files.
258840	string	perl-store	perl Storable (v0.6) data
25885>4	byte	>0	(net-order %d)
25886>>4	byte	&01	(network-ordered)
25887>>4	byte	=3	(major 1)
25888>>4	byte	=2	(major 1)
25889
258900	string	pst0	perl Storable (v0.7) data
25891>4	byte	>0
25892>>4	byte	&01	(network-ordered)
25893>>4	byte	=5	(major 2)
25894>>4	byte	=4	(major 2)
25895>>5	byte	>0	(minor %d)
25896
25897# This is Debian #742949 by Zefram <zefram@fysh.org>:
25898# -----------------------------------------------------------
25899# The Perl module Hash::SharedMem
25900# <https://metacpan.org/release/Hash-SharedMem> defines a file format
25901# for a key/value store.  Details of the file format are in the "DESIGN"
25902# file in the module distribution.  Magic:
259030	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
25904>8	bequad	<0x1000000
25905>>15	byte	>2	\b, line size 2^%d byte
25906>>14	byte	>2	\b, page size 2^%d byte
25907>>13	byte	&1
25908>>>13	byte	>1	\b, max fanout %d
259090	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
25910>8	lequad	<0x1000000
25911>>8	byte	>2	\b, line size 2^%d byte
25912>>9	byte	>2	\b, page size 2^%d byte
25913>>10	byte	&1
25914>>>10	byte	>1	\b, max fanout %d
259150	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
25916>8	bequad	<0x1000000
25917>>15	byte	>2	\b, line size 2^%d byte
25918>>14	byte	>2	\b, page size 2^%d byte
25919>>13	byte	&1
25920>>>13	byte	>1	\b, max fanout %d
259210	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
25922>8	lequad	<0x1000000
25923>>8	byte	>2	\b, line size 2^%d byte
25924>>9	byte	>2	\b, page size 2^%d byte
25925>>10	byte	&1
25926>>>10	byte	>1	\b, max fanout %d
25927
25928#------------------------------------------------------------------------------
25929# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
25930# pgf: file(1) magic for Progressive Graphics File (PGF)
25931#
25932# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
25933# 2013 by Philipp Hahn <pmhahn debian org>
259340 string PGF Progressive Graphics image data,
25935!:mime image/x-pgf
25936>3	string	2	version %s,
25937>3	string	4	version %s,
25938>3	string	5	version %s,
25939>3	string	6	version %s,
25940#	PGFPreHeader
25941#>>4	lelong	x	header size %d,
25942#	PGFHeader
25943>>8	lelong	x	%d x
25944>>12	lelong	x	%d,
25945>>16	byte	x	%d levels,
25946>>17	byte	x	compression level %d,
25947>>18	byte	x	%d bpp,
25948>>19	byte	x	%d channels,
25949>>20	clear	x
25950>>20	byte	0	bitmap,
25951>>20	byte	1	gray scale,
25952>>20	byte	2	indexed color,
25953>>20	byte	3	RGB color,
25954>>20	byte	4	CYMK color,
25955>>20	byte	5	HSL color,
25956>>20	byte	6	HSB color,
25957>>20	byte	7	multi-channel,
25958>>20	byte	8	duo tone,
25959>>20	byte	9	LAB color,
25960>>20	byte	10	gray scale 16,
25961>>20	byte	11	RGB color 48,
25962>>20	byte	12	LAB color 48,
25963>>20	byte	13	CYMK color 64,
25964>>20	byte	14	deep multi-channel,
25965>>20	byte	15	duo tone 16,
25966>>20	byte	17	RGBA color,
25967>>20	byte	18	gray scale 32,
25968>>20	byte	19	RGB color 12,
25969>>20	byte	20	RGB color 16,
25970>>20	byte	255	unknown format,
25971>>20	default	x	format
25972>>>20	byte	x	\b %d,
25973>>21	byte	x	%d bpc
25974#	PGFPostHeader
25975#	Level-Sizes
25976#>>(4.l+4)	lelong x level 0 size: %d
25977#>>(4.l+8)	lelong x level 1 size: %d
25978#>>(4.l+12)	lelong x level 2 size: %d
25979
25980#------------------------------------------------------------------------------
25981# $File: pgp,v 1.21 2020/03/20 17:11:05 christos Exp $
25982# pgp:  file(1) magic for Pretty Good Privacy
25983# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
25984#
25985# Update: Joerg Jenderek
25986# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP`
25987#0		byte	0x99		MAYBE PGP 0x99
259880		byte	0x99
25989# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
25990# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
25991#>1		ubeshort	x		\b, body length 0x%.4x
25992# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
25993#>3		ubyte		x		\b, V=%u
25994#>3		ubyte		<5		VERSION OK
25995>3		ubyte		<5
25996# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
25997#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
25998# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
25999#>>(1.S+3)	ubyte	>0x7F		TYPE OK,
26000>>(1.S+3)	ubyte	>0x7F
26001# old versions 2,3 implies Pretty Good Privacy
26002>>>3		ubyte		<4		PGP key public ring (v%u)
26003!:mime		application/pgp-keys
26004!:ext		pgp/ASD
26005>>>>4		beldate		x		created %s
26006# days that this key is valid. If this number is zero, then it does not expire
26007>>>>8		ubeshort	>0		\b, %u days valid
26008>>>>8		ubeshort	=0		\b, not expire
26009# display key algorithm 1~RSA (Encrypt or Sign)
26010>>>>10		use		key_algo
26011# Multiprecision Integers (MPI) size
26012>>>>11		ubeshort	x		%u bits
26013# MPI
26014>>>>13		ubequad		x		MPI=0x%16.16llx...
26015# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG)
26016>>>3		ubyte		>3		PGP/GPG key public ring (v%u)
26017!:mime		application/pgp-keys
26018!:ext		pgp/gpg/pkr/asd
26019>>>>4		beldate		x		created %s
26020# display key algorithm 17~DSA
26021>>>>8		use		key_algo
26022# Multiprecision Integers (MPI) size
26023>>>>9		ubeshort	x		%u bits
26024>>>>11		ubequad		x		MPI=0x%16.16llx...
26025
260260       beshort         0x9501                  PGP key security ring
26027!:mime	application/x-pgp-keyring
260280       beshort         0x9500                  PGP key security ring
26029!:mime	application/x-pgp-keyring
260300	beshort		0xa600			PGP encrypted data
26031#!:mime	application/pgp-encrypted
26032#0	string		-----BEGIN\040PGP	text/PGP armored data
26033!:mime	text/PGP # encoding: armored data
26034#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
26035#>15	string	MESSAGE-		message
26036#>15	string	SIGNED\040MESSAGE-	signed message
26037#>15	string	PGP\040SIGNATURE-	signature
26038
26039# Update:	Joerg Jenderek
26040# URL:		http://en.wikipedia.org/wiki/Pretty_Good_Privacy
26041# Reference:	https://reposcope.com/mimetype/application/pgp-keys
260422	string	---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK-	PGP private key block
26043#!:mime	text/PGP
26044!:mime	application/pgp-keys
26045!:ext	asc
260462	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
26047!:mime	application/pgp-keys
26048!:ext	asc
26049>10	search/100	\n\n
26050>>&0	use		pgp
260510	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
26052# https://reposcope.com/mimetype/application/pgp-encrypted
26053#!:mime	application/pgp
26054!:mime	application/pgp-encrypted
26055!:ext	asc
26056#!:ext	asc/pgp/gpg
26057>10	search/100	\n\n
26058>>&0	use		pgp
26059# Reference:	https://www.gnupg.org/gph/en/manual/x135.html
260600	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-	PGP signed message
26061#!:mime	text/plain
26062!:mime	text/PGP
26063#!:mime	application/pgp
26064!:ext	asc
260650	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
26066# https://reposcope.com/mimetype/application/pgp-signature
26067!:mime	application/pgp-signature
26068!:ext	asc
26069>10	search/100	\n\n
26070>>&0	use		pgp
26071
26072# Decode the type of the packet based on it's base64 encoding.
26073# Idea from Mark Martinec
26074# The specification is in RFC 4880, section 4.2 and 4.3:
26075# https://tools.ietf.org/html/rfc4880#section-4.2
26076
260770	name		pgp
26078>0	byte		0x67		Reserved (old)
26079>0	byte		0x68		Public-Key Encrypted Session Key (old)
26080>0	byte		0x69		Signature (old)
26081>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
26082>0	byte		0x6b		One-Pass Signature (old)
26083>0	byte		0x6c		Secret-Key (old)
26084>0	byte		0x6d		Public-Key (old)
26085>0	byte		0x6e		Secret-Subkey (old)
26086>0	byte		0x6f		Compressed Data (old)
26087>0	byte		0x70		Symmetrically Encrypted Data (old)
26088>0	byte		0x71		Marker (old)
26089>0	byte		0x72		Literal Data (old)
26090>0	byte		0x73		Trust (old)
26091>0	byte		0x74		User ID (old)
26092>0	byte		0x75		Public-Subkey (old)
26093>0	byte		0x76		Unused (old)
26094>0	byte		0x77
26095>>1	byte&0xc0	0x00		Reserved
26096>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
26097>>1	byte&0xc0	0x80		Signature
26098>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
26099>0	byte		0x78
26100>>1	byte&0xc0	0x00		One-Pass Signature
26101>>1	byte&0xc0	0x40		Secret-Key
26102>>1	byte&0xc0	0x80		Public-Key
26103>>1	byte&0xc0	0xc0		Secret-Subkey
26104>0	byte		0x79
26105>>1	byte&0xc0	0x00		Compressed Data
26106>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
26107>>1	byte&0xc0	0x80		Marker
26108>>1	byte&0xc0	0xc0		Literal Data
26109>0	byte		0x7a
26110>>1	byte&0xc0	0x00		Trust
26111>>1	byte&0xc0	0x40		User ID
26112>>1	byte&0xc0	0x80		Public-Subkey
26113>>1	byte&0xc0	0xc0		Unused [z%x]
26114>0	byte		0x30
26115>>1	byte&0xc0	0x00		Unused [0%x]
26116>>1	byte&0xc0	0x40		User Attribute
26117>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
26118>>1	byte&0xc0	0xc0		Modification Detection Code
26119
26120# magic signatures to detect PGP crypto material (from stef)
26121# detects and extracts metadata from:
26122#  - symmetric encrypted packet header
26123#  - RSA (e=65537) secret (sub-)keys
26124
26125# 1024b RSA encrypted data
26126
261270	string	\x84\x8c\x03		PGP RSA encrypted session key -
26128>3	belong	x			keyid: %08X
26129>7	belong	x			%08X
26130>11	byte	0x01			RSA (Encrypt or Sign) 1024b
26131>11	byte	0x02			RSA Encrypt-Only 1024b
26132>12	string	\x04\x00
26133>12	string	\x03\xff
26134>12	string	\x03\xfe
26135>12	string	\x03\xfd
26136>12	string	\x03\xfc
26137>12	string	\x03\xfb
26138>12	string	\x03\xfa
26139>12	string	\x03\xf9
26140>142	byte	0xd2			.
26141
26142# 2048b RSA encrypted data
26143
261440	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
26145>4	belong	x			keyid: %08X
26146>8	belong	x			%08X
26147>12	byte	0x01			RSA (Encrypt or Sign) 2048b
26148>12	byte	0x02			RSA Encrypt-Only 2048b
26149>13	string	\x08\x00
26150>13	string	\x07\xff
26151>13	string	\x07\xfe
26152>13	string	\x07\xfd
26153>13	string	\x07\xfc
26154>13	string	\x07\xfb
26155>13	string	\x07\xfa
26156>13	string	\x07\xf9
26157>271	byte	0xd2			.
26158
26159# 3072b RSA encrypted data
26160
261610	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
26162>4	belong	x			keyid: %08X
26163>8	belong	x			%08X
26164>12	byte	0x01			RSA (Encrypt or Sign) 3072b
26165>12	byte	0x02			RSA Encrypt-Only 3072b
26166>13	string	\x0c\x00
26167>13	string	\x0b\xff
26168>13	string	\x0b\xfe
26169>13	string	\x0b\xfd
26170>13	string	\x0b\xfc
26171>13	string	\x0b\xfb
26172>13	string	\x0b\xfa
26173>13	string	\x0b\xf9
26174>399	byte	0xd2			.
26175
26176# 4096b RSA encrypted data
26177
261780	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
26179>4	belong	x			keyid: %08X
26180>8	belong	x			%08X
26181>12	byte	0x01			RSA (Encrypt or Sign) 4096b
26182>12	byte	0x02			RSA Encrypt-Only 4096b
26183>13	string	\x10\x00
26184>13	string	\x0f\xff
26185>13	string	\x0f\xfe
26186>13	string	\x0f\xfd
26187>13	string	\x0f\xfc
26188>13	string	\x0f\xfb
26189>13	string	\x0f\xfa
26190>13	string	\x0f\xf9
26191>527	byte	0xd2			.
26192
26193# 8192b RSA encrypted data
26194
261950	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
26196>4	belong	x			keyid: %08X
26197>8	belong	x			%08X
26198>12	byte	0x01			RSA (Encrypt or Sign) 8192b
26199>12	byte	0x02			RSA Encrypt-Only 8192b
26200>13	string	\x20\x00
26201>13	string	\x1f\xff
26202>13	string	\x1f\xfe
26203>13	string	\x1f\xfd
26204>13	string	\x1f\xfc
26205>13	string	\x1f\xfb
26206>13	string	\x1f\xfa
26207>13	string	\x1f\xf9
26208>1039	byte	0xd2			.
26209
26210# 1024b Elgamal encrypted data
26211
262120	string	\x85\x01\x0e\x03	PGP Elgamal encrypted session key -
26213>4	belong	x			keyid: %08X
26214>8	belong	x			%08X
26215>12	byte	0x10			Elgamal Encrypt-Only 1024b.
26216>13	string	\x04\x00
26217>13	string	\x03\xff
26218>13	string	\x03\xfe
26219>13	string	\x03\xfd
26220>13	string	\x03\xfc
26221>13	string	\x03\xfb
26222>13	string	\x03\xfa
26223>13	string	\x03\xf9
26224
26225# 2048b Elgamal encrypted data
26226
262270	string	\x85\x02\x0e\x03	PGP Elgamal encrypted session key -
26228>4	belong	x			keyid: %08X
26229>8	belong	x			%08X
26230>12	byte	0x10			Elgamal Encrypt-Only 2048b.
26231>13	string	\x08\x00
26232>13	string	\x07\xff
26233>13	string	\x07\xfe
26234>13	string	\x07\xfd
26235>13	string	\x07\xfc
26236>13	string	\x07\xfb
26237>13	string	\x07\xfa
26238>13	string	\x07\xf9
26239
26240# 3072b Elgamal encrypted data
26241
262420	string	\x85\x03\x0e\x03	PGP Elgamal encrypted session key -
26243>4	belong	x			keyid: %08X
26244>8	belong	x			%08X
26245>12	byte	0x10			Elgamal Encrypt-Only 3072b.
26246>13	string	\x0c\x00
26247>13	string	\x0b\xff
26248>13	string	\x0b\xfe
26249>13	string	\x0b\xfd
26250>13	string	\x0b\xfc
26251>13	string	\x0b\xfb
26252>13	string	\x0b\xfa
26253>13	string	\x0b\xf9
26254
26255# crypto algo mapper
26256
262570	name	crypto
26258>0	byte	0x00			Plaintext or unencrypted data
26259>0	byte	0x01			IDEA
26260>0	byte	0x02			TripleDES
26261>0	byte	0x03			CAST5 (128 bit key)
26262>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
26263>0	byte	0x07			AES with 128-bit key
26264>0	byte	0x08			AES with 192-bit key
26265>0	byte	0x09			AES with 256-bit key
26266>0	byte	0x0a			Twofish with 256-bit key
26267
26268# hash algo mapper
26269
262700	name	hash
26271>0	byte	0x01			MD5
26272>0	byte	0x02			SHA-1
26273>0	byte	0x03			RIPE-MD/160
26274>0	byte	0x08			SHA256
26275>0	byte	0x09			SHA384
26276>0	byte	0x0a			SHA512
26277>0	byte	0x0b			SHA224
26278
26279# display public key algorithms as human readable text
262800	name	key_algo
26281>0	byte	0x01			RSA (Encrypt or Sign)
26282# keep old look of version 5.28 without parentheses
26283>0	byte	0x02			RSA Encrypt-Only
26284>0	byte	0x03			RSA (Sign-Only)
26285>0	byte	16			ElGamal (Encrypt-Only)
26286>0	byte	17			DSA
26287>0	byte	18			Elliptic Curve
26288>0	byte	19			ECDSA
26289>0	byte	20			ElGamal (Encrypt or Sign)
26290>0	byte	21			Diffie-Hellman
26291>0	default	x
26292>>0	ubyte	<22			unknown (pub %d)
26293# this should never happen
26294>>0	ubyte	>21			invalid (%d)
26295
26296# pgp symmetric encrypted data
26297
262980	byte	0x8c			PGP symmetric key encrypted data -
26299>1	byte	0x0d
26300>1	byte	0x0c
26301>2	byte	0x04
26302>3	use	crypto
26303>4	byte	0x01			salted -
26304>>5	use	hash
26305>>14	byte	0xd2			.
26306>>14	byte	0xc9			.
26307>4	byte	0x03			salted & iterated -
26308>>5	use	hash
26309>>15	byte	0xd2			.
26310>>15	byte	0xc9			.
26311
26312# encrypted keymaterial needs s2k & can be checksummed/hashed
26313
263140	name	chkcrypto
26315>0	use	crypto
26316>1	byte	0x00			Simple S2K
26317>1	byte	0x01			Salted S2K
26318>1	byte	0x03			Salted&Iterated S2K
26319>2	use	hash
26320
26321# all PGP keys start with this prolog
26322# containing version, creation date, and purpose
26323
263240	name	keyprolog
26325>0	byte	0x04
26326>1	beldate	x			created on %s -
26327>5	byte	0x01			RSA (Encrypt or Sign)
26328>5	byte	0x02			RSA Encrypt-Only
26329
26330# end of secret keys known signature
26331# contains e=65537 and the prolog to
26332# the encrypted parameters
26333
263340	name	keyend
26335>0	string	\x00\x11\x01\x00\x01	e=65537
26336>5	use	crypto
26337>5	byte	0xff			checksummed
26338>>6	use	chkcrypto
26339>5	byte	0xfe			hashed
26340>>6	use	chkcrypto
26341
26342# PGP secret keys contain also the public parts
26343# these vary by bitsize of the key
26344
263450	name	x1024
26346>0	use	keyprolog
26347>6	string	\x03\xfe
26348>6	string	\x03\xff
26349>6	string	\x04\x00
26350>136	use	keyend
26351
263520	name	x2048
26353>0	use	keyprolog
26354>6	string	\x80\x00
26355>6	string	\x07\xfe
26356>6	string	\x07\xff
26357>264	use	keyend
26358
263590	name	x3072
26360>0	use	keyprolog
26361>6	string	\x0b\xfe
26362>6	string	\x0b\xff
26363>6	string	\x0c\x00
26364>392	use	keyend
26365
263660	name	x4096
26367>0	use	keyprolog
26368>6	string	\x10\x00
26369>6	string	\x0f\xfe
26370>6	string	\x0f\xff
26371>520	use	keyend
26372
26373# \x00|\x1f[\xfe\xff]).{1024})'
263740	name	x8192
26375>0	use	keyprolog
26376>6	string	\x20\x00
26377>6	string	\x1f\xfe
26378>6	string	\x1f\xff
26379>1032	use	keyend
26380
26381# depending on the size of the pkt
26382# we branch into the proper key size
26383# signatures defined as x{keysize}
26384
26385>0	name	pgpkey
26386>0	string	\x01\xd8	1024b
26387>>2	use	x1024
26388>0	string	\x01\xeb	1024b
26389>>2	use	x1024
26390>0	string	\x01\xfb	1024b
26391>>2	use	x1024
26392>0	string	\x01\xfd	1024b
26393>>2	use	x1024
26394>0	string	\x01\xf3	1024b
26395>>2	use	x1024
26396>0	string	\x01\xee	1024b
26397>>2	use	x1024
26398>0	string	\x01\xfe	1024b
26399>>2	use	x1024
26400>0	string	\x01\xf4	1024b
26401>>2	use	x1024
26402>0	string	\x02\x0d	1024b
26403>>2	use	x1024
26404>0	string	\x02\x03	1024b
26405>>2	use	x1024
26406>0	string	\x02\x05	1024b
26407>>2	use	x1024
26408>0	string	\x02\x15	1024b
26409>>2	use	x1024
26410>0	string	\x02\x00	1024b
26411>>2	use	x1024
26412>0	string	\x02\x10	1024b
26413>>2	use	x1024
26414>0	string	\x02\x04	1024b
26415>>2	use	x1024
26416>0	string	\x02\x06	1024b
26417>>2	use	x1024
26418>0	string	\x02\x16	1024b
26419>>2	use	x1024
26420>0	string	\x03\x98	2048b
26421>>2	use	x2048
26422>0	string	\x03\xab	2048b
26423>>2	use	x2048
26424>0	string	\x03\xbb	2048b
26425>>2	use	x2048
26426>0	string	\x03\xbd	2048b
26427>>2	use	x2048
26428>0	string	\x03\xcd	2048b
26429>>2	use	x2048
26430>0	string	\x03\xb3	2048b
26431>>2	use	x2048
26432>0	string	\x03\xc3	2048b
26433>>2	use	x2048
26434>0	string	\x03\xc5	2048b
26435>>2	use	x2048
26436>0	string	\x03\xd5	2048b
26437>>2	use	x2048
26438>0	string	\x03\xae	2048b
26439>>2	use	x2048
26440>0	string	\x03\xbe	2048b
26441>>2	use	x2048
26442>0	string	\x03\xc0	2048b
26443>>2	use	x2048
26444>0	string	\x03\xd0	2048b
26445>>2	use	x2048
26446>0	string	\x03\xb4	2048b
26447>>2	use	x2048
26448>0	string	\x03\xc4	2048b
26449>>2	use	x2048
26450>0	string	\x03\xc6	2048b
26451>>2	use	x2048
26452>0	string	\x03\xd6	2048b
26453>>2	use	x2048
26454>0	string	\x05X		3072b
26455>>2	use	x3072
26456>0	string	\x05k		3072b
26457>>2	use	x3072
26458>0	string	\x05{		3072b
26459>>2	use	x3072
26460>0	string	\x05}		3072b
26461>>2	use	x3072
26462>0	string	\x05\x8d	3072b
26463>>2	use	x3072
26464>0	string	\x05s		3072b
26465>>2	use	x3072
26466>0	string	\x05\x83	3072b
26467>>2	use	x3072
26468>0	string	\x05\x85	3072b
26469>>2	use	x3072
26470>0	string	\x05\x95	3072b
26471>>2	use	x3072
26472>0	string	\x05n		3072b
26473>>2	use	x3072
26474>0	string	\x05\x7e	3072b
26475>>2	use	x3072
26476>0	string	\x05\x80	3072b
26477>>2	use	x3072
26478>0	string	\x05\x90	3072b
26479>>2	use	x3072
26480>0	string	\x05t		3072b
26481>>2	use	x3072
26482>0	string	\x05\x84	3072b
26483>>2	use	x3072
26484>0	string	\x05\x86	3072b
26485>>2	use	x3072
26486>0	string	\x05\x96	3072b
26487>>2	use	x3072
26488>0	string	\x07[		4096b
26489>>2	use	x4096
26490>0	string	\x07\x18	4096b
26491>>2	use	x4096
26492>0	string	\x07+		4096b
26493>>2	use	x4096
26494>0	string	\x07;		4096b
26495>>2	use	x4096
26496>0	string	\x07=		4096b
26497>>2	use	x4096
26498>0	string	\x07M		4096b
26499>>2	use	x4096
26500>0	string	\x073		4096b
26501>>2	use	x4096
26502>0	string	\x07C		4096b
26503>>2	use	x4096
26504>0	string	\x07E		4096b
26505>>2	use	x4096
26506>0	string	\x07U		4096b
26507>>2	use	x4096
26508>0	string	\x07.		4096b
26509>>2	use	x4096
26510>0	string	\x07>		4096b
26511>>2	use	x4096
26512>0	string	\x07@		4096b
26513>>2	use	x4096
26514>0	string	\x07P		4096b
26515>>2	use	x4096
26516>0	string	\x074		4096b
26517>>2	use	x4096
26518>0	string	\x07D		4096b
26519>>2	use	x4096
26520>0	string	\x07F		4096b
26521>>2	use	x4096
26522>0	string	\x07V		4096b
26523>>2	use	x4096
26524>0	string	\x0e[		8192b
26525>>2	use	x8192
26526>0	string	\x0e\x18	8192b
26527>>2	use	x8192
26528>0	string	\x0e+		8192b
26529>>2	use	x8192
26530>0	string	\x0e;		8192b
26531>>2	use	x8192
26532>0	string	\x0e=		8192b
26533>>2	use	x8192
26534>0	string	\x0eM		8192b
26535>>2	use	x8192
26536>0	string	\x0e3		8192b
26537>>2	use	x8192
26538>0	string	\x0eC		8192b
26539>>2	use	x8192
26540>0	string	\x0eE		8192b
26541>>2	use	x8192
26542>0	string	\x0eU		8192b
26543>>2	use	x8192
26544>0	string	\x0e.		8192b
26545>>2	use	x8192
26546>0	string	\x0e>		8192b
26547>>2	use	x8192
26548>0	string	\x0e@		8192b
26549>>2	use	x8192
26550>0	string	\x0eP		8192b
26551>>2	use	x8192
26552>0	string	\x0e4		8192b
26553>>2	use	x8192
26554>0	string	\x0eD		8192b
26555>>2	use	x8192
26556>0	string	\x0eF		8192b
26557>>2	use	x8192
26558>0	string	\x0eV		8192b
26559>>2	use	x8192
26560
26561# PGP RSA (e=65537) secret (sub-)key header
26562
265630	byte	0x95			PGP Secret Key -
26564>1	use	pgpkey
265650	byte	0x97			PGP Secret Sub-key -
26566>1	use	pgpkey
265670	byte	0x9d
26568# Update: Joerg Jenderek
26569# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
26570# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
26571>1	ubeshort	>0
26572#>1	ubeshort	x		\b, body length 0x%x
26573# next packet type often 88h,89h~(tag 2)~Signature Packet
26574#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
26575# skip Dragon.SHR DEMO.INIT by looking for positive version
26576>>3	ubyte		>0
26577# skip BUISSON.13 GUITAR1 by looking for low version number
26578>>>3	ubyte		<5		PGP Secret Sub-key
26579# sub-key are normally part of secret key. So it does not occur as standalone file
26580#!:ext	bin
26581# version 2,3~old 4~new . Comment following line for version 5.28 look
26582>>>>3	ubyte		x		(v%d)
26583>>>>3	ubyte		x		-
26584# old versions 2 or 3 but no real example found
26585>>>>3	ubyte		<4
26586# 2 byte for key bits in version 5.28 look
26587>>>>>11		ubeshort	x	%db
26588>>>>>4		beldate		x	created on %s -
26589# old versions use 2 additional bytes after time stamp
26590#>>>>>8		ubeshort	x	0x%x
26591# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
26592>>>>>10	  	use		key_algo
26593>>>>>(11.S/8)	ubequad		x
26594# look after first key
26595>>>>>>&5	use		keyend
26596# new version
26597>>>>3	ubyte		>3
26598>>>>>9		ubeshort	x	%db
26599>>>>>4		beldate		x	created on %s -
26600# display key algorithm
26601>>>>>8		use		key_algo
26602>>>>>(9.S/8)	ubequad		x
26603# look after first key for something like s2k
26604>>>>>>&3	use		keyend
26605
26606#------------------------------------------------------------------------------
26607# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
26608# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
26609#
266100       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
26611!:mime	application/x-svr4-package
26612
26613#------------------------------------------------------------------------------
26614# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
26615# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
26616# From: "Stefan A. Haubenthal" <polluks@web.de>
26617#
266180	belong		0x00000107	Plan 9 executable, Motorola 68k
266190	belong		0x000001EB	Plan 9 executable, Intel 386
266200	belong		0x00000247	Plan 9 executable, Intel 960
266210	belong		0x000002AB	Plan 9 executable, SPARC
266220	belong		0x00000407	Plan 9 executable, MIPS R3000
266230	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
266240	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
266250	belong		0x000005AB	Plan 9 executable, AMD 29000
266260	belong		0x00000647	Plan 9 executable, ARM 7-something
266270	belong		0x000006EB	Plan 9 executable, PowerPC
266280	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
266290	belong		0x0000084B	Plan 9 executable, DEC Alpha
26630
26631#------------------------------------------------------------------------------
26632# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
26633# plus5:  file(1) magic for Plus Five's UNIX MUMPS
26634#
26635# XXX - byte order?  Paging Hokey....
26636#
266370	short		0x259		mumps avl global
26638>2	byte		>0		(V%d)
26639>6	byte		>0		with %d byte name
26640>7	byte		>0		and %d byte data cells
266410	short		0x25a		mumps blt global
26642>2	byte		>0		(V%d)
26643>8	short		>0		- %d byte blocks
26644>15	byte		0x00		- P/D format
26645>15	byte		0x01		- P/K/D format
26646>15	byte		0x02		- K/D format
26647>15	byte		>0x02		- Bad Flags
26648
26649#------------------------------------------------------------------------------
26650# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $
26651# pmem: file(1) magic for Persistent Memory Development Kit pool files
26652#
266530	string		PMEM
26654>4	string		POOLSET		Persistent Memory Poolset file
26655>>11	search		REPLICA		with replica
26656>4	regex		LOG|BLK|OBJ	Persistent Memory Pool file, type: %s,
26657>>8	lelong		>0		version: 0x%x,
26658>>12	lelong		x		compat: 0x%x,
26659>>16	lelong		x		incompat: 0x%x,
26660>>20	lelong		x		ro_compat: 0x%x,
26661
26662
26663>>120	leqldate	x		crtime: %s,
26664>>128	lequad		x		alignment_desc: 0x%016llx,
26665
26666>>136	clear		x
26667>>136	byte		2		machine_class: 64-bit,
26668>>136	default		x		machine_class: unknown
26669>>>136	byte		x		(0x%d),
26670
26671>>137	clear		x
26672>>137	byte		1		data: little-endian,
26673>>137	byte		2		data: big-endian,
26674>>137	default		x		data: unknown
26675>>>137	byte		x		(0x%d),
26676
26677>>138	byte		!0		reserved[0]: %d,
26678>>139	byte		!0		reserved[1]: %d,
26679>>140	byte		!0		reserved[2]: %d,
26680>>141	byte		!0		reserved[3]: %d,
26681
26682>>142	clear		x
26683>>142	leshort		62		machine: x86_64
26684>>142	leshort		183		machine: aarch64
26685>>142	default		x		machine: unknown
26686>>>142	leshort		x		(0x%d)
26687
26688>4	string		BLK
26689>>4096	lelong		x		\b, blk.bsize: %d
26690
26691>4	string		OBJ
26692>>4096	string		>0		\b, obj.layout: '%s'
26693>>4096	string		<0		\b, obj.layout: NULL
26694
26695#------------------------------------------------------------------------------
26696# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $
26697# polyml:  file(1) magic for PolyML
26698#
26699# PolyML
26700# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
26701# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
26702
26703# [0]: https://www.polyml.org/
26704# [1]: https://github.com/polyml/polyml/blob/master/\
26705#	libpolyml/savestate.cpp#L146-L147
26706# [2]: https://github.com/polyml/polyml/blob/master/\
26707#	libpolyml/savestate.cpp#L1262-L1263
26708
26709# Type: Poly/ML saved data
26710# From: Matthew Fernandez <matthew.fernandez@gmail.com>
26711
267120	string	POLYSAVE	Poly/ML saved state
26713>8	long	x		version %u
26714
267150	string  POLYMODU	Poly/ML saved module
26716>8	long	x		version %u
26717
26718#------------------------------------------------------------------------------
26719# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $
26720# printer:  file(1) magic for printer-formatted files
26721#
26722
26723# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
267240	string		%!		PostScript document text
26725!:mime	application/postscript
26726!:apple	ASPSTEXT
26727>2	string		PS-Adobe-	conforming
26728>>11	string		>\0		DSC level %.3s
26729>>>15	string		EPS		\b, type %s
26730>>>15	string		Query		\b, type %s
26731>>>15	string		ExitServer	\b, type %s
26732>>>15   search/1000		%%LanguageLevel:\040
26733>>>>&0	string		>\0		\b, Level %s
26734# Some PCs have the annoying habit of adding a ^D as a document separator
267350	string		\004%!		PostScript document text
26736!:mime	application/postscript
26737!:apple	ASPSTEXT
26738>3	string		PS-Adobe-	conforming
26739>>12	string		>\0		DSC level %.3s
26740>>>16	string		EPS		\b, type %s
26741>>>16	string		Query		\b, type %s
26742>>>16	string		ExitServer	\b, type %s
26743>>>16   search/1000		%%LanguageLevel:\040
26744>>>>&0	string		>\0		\b, Level %s
267450	string		\033%-12345X%!PS	PostScript document
26746
26747# DOS EPS Binary File Header
26748# From: Ed Sznyter <ews@Black.Market.NET>
267490       belong          0xC5D0D3C6      DOS EPS Binary File
26750>4      long            >0              Postscript starts at byte %d
26751>>8     long            >0              length %d
26752>>>12   long            >0              Metafile starts at byte %d
26753>>>>16  long            >0              length %d
26754>>>20   long            >0              TIFF starts at byte %d
26755>>>>24  long            >0              length %d
26756
26757# Summary: Adobe's PostScript Printer Description File
26758# Extension: .ppd
26759# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
26760# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
26761#
267620	string		*PPD-Adobe:\x20	PPD file
26763>&0	string		x		\b, version %s
26764
26765# HP Printer Job Language
267660	string		\033%-12345X@PJL	HP Printer Job Language data
26767# HP Printer Job Language
26768# The header found on Win95 HP plot files is the "Silliest Thing possible"
26769# (TM)
26770# Every driver puts the language at some random position, with random case
26771# (LANGUAGE and Language)
26772# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
26773# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
26774#
267750	string		\033%-12345X@PJL	HP Printer Job Language data
26776>&0	string		>\0			%s
26777>>&0	string		>\0			%s
26778>>>&0	string		>\0			%s
26779>>>>&0	string		>\0			%s
26780#>15	string		\ ENTER\ LANGUAGE\ =
26781#>31	string		PostScript		PostScript
26782
26783# From: Stefan Thurner <thurners@nicsys.de>
267840	string		\033%-12345X@PJL
26785>&0	search/10000	%!			PJL encapsulated PostScript document text
26786
26787# Rick Richardson <rickrich@gmail.com>
26788
26789# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
26790# For Oki Data Printers - HIPERC
26791# For Konica Minolta Printers - LAVAFLOW
26792# For Samsung Printers - QPDL
26793# For HP Printers - ZJS stands for Zenographics ZJStream
267940	string		\033%-12345X@PJL	HP Printer Job Language data
26795>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
26796>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
26797>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
26798>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
26799>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
26800>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
26801
26802
26803# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
268040	string		\033E\033	HP PCL printer data
26805>3	string		\&l0A		- default page size
26806>3	string		\&l1A		- US executive page size
26807>3	string		\&l2A		- US letter page size
26808>3	string		\&l3A		- US legal page size
26809>3	string		\&l26A		- A4 page size
26810>3	string		\&l80A		- Monarch envelope size
26811>3	string		\&l81A		- No. 10 envelope size
26812>3	string		\&l90A		- Intl. DL envelope size
26813>3	string		\&l91A		- Intl. C5 envelope size
26814>3	string		\&l100A		- Intl. B5 envelope size
26815>3	string		\&l-81A		- No. 10 envelope size (landscape)
26816>3	string		\&l-90A		- Intl. DL envelope size (landscape)
26817
26818# IMAGEN printer-ready files:
268190	string	@document(		Imagen printer
26820# this only works if "language xxx" is first item in Imagen header.
26821>10	string	language\ impress	(imPRESS data)
26822>10	string	language\ daisy		(daisywheel text)
26823>10	string	language\ diablo	(daisywheel text)
26824>10	string	language\ printer	(line printer emulation)
26825>10	string	language\ tektronix	(Tektronix 4014 emulation)
26826# Add any other languages that your Imagen uses - remember
26827# to keep the word `text' if the file is human-readable.
26828# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
26829#
26830# Now magic for IMAGEN font files...
268310	string		Rast		RST-format raster font data
26832>45	string		>0		face %s
26833# From Jukka Ukkonen
268340	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
26835
26836# From <mike@flyn.org>
26837# These are the /etc/magic entries to decode data sent to an Epson printer.
268380       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
26839
26840
26841#------------------------------------------------------------------------------
26842# zenographics:  file(1) magic for Zenographics ZjStream printer data
26843# Rick Richardson <rickrich@gmail.com>
268440	string		JZJZ
26845>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
268460	string		ZJZJ
26847>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
26848
26849
26850#------------------------------------------------------------------------------
26851# Oak Technologies printer stream
26852# Rick Richardson <rickrich@gmail.com>
268530       string          OAK
26854>0x07	byte		0
26855>0x0b	byte		0	Oak Technologies printer stream
26856
26857# This would otherwise be recognized as PostScript - nick@debian.org
268580	string		%!VMF 		SunClock's Vector Map Format data
26859
26860#------------------------------------------------------------------------------
26861# HP LaserJet 1000 series downloadable firmware file
268620	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
26863
26864# From: Paolo <oopla@users.sf.net>
26865# Epson ESC/Page, ESC/PageColor
268660	string	\x1b\x01@EJL	Epson ESC/Page language printer data
26867
26868#------------------------------------------------------------------------------
26869# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
26870# project:  file(1) magic for Project management
26871#
26872# Magic strings for ftnchek project files. Alexander Mai
268730	string	FTNCHEK_\ P	project file for ftnchek
26874>10	string	1		version 2.7
26875>10	string	2		version 2.8 to 2.10
26876>10	string	3		version 2.11 or later
26877
26878#------------------------------------------------------------------------------
26879# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
26880# psdbms:  file(1) magic for psdatabase
26881#
26882# Update: Joerg Jenderek
26883# GRR: line below too general as it catches also some Panorama database *.pan ,
26884# AppleWorks word processor
268850	belong&0xff00ffff	0x56000000
26886# assume version starts with digit
26887>1	regex/s			=^[0-9]		ps database
26888>>1	string	>\0	version %s
26889# kernel name
26890>>4	string	>\0	from kernel %s
26891
26892#------------------------------------------------------------------------------
26893# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $
26894# psl:  file(1) magic for Public Suffix List representations
26895# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
26896# URL: https://publicsuffix.org
26897# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
26898
268990	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
26900
269010	string	.DAFSA@PSL_
26902>15	string	\n	Public Suffix List data (optimized)
26903>>11	byte	>0x2f
26904>>>11	byte	<0x3a   (Version %c)
26905
26906#------------------------------------------------------------------------------
26907# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
26908# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
26909#
26910# http://pulsar.sourceforge.net
26911# mailto:rok.papez@lugos.si
26912#
26913
269140	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
26915>4	ubelong	x		Version: %d.
26916>8	ubelong	x		\b%d
26917
26918
26919#------------------------------------------------------------------------------
26920# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $
26921# pwsafe: file(1) magic for passwordsafe file
26922#
26923# Password Safe
26924# http://passwordsafe.sourceforge.net/
26925# file format specs
26926# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
26927# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
26928# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
26929# V2 and V1 have no easy identifier that I can find
26930# .psafe3
269310	string	PWS3	Password Safe V3 database
26932
26933#------------------------------------------------------------------------------
26934# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
26935# pyramid:  file(1) magic for Pyramids
26936#
26937# XXX - byte order?
26938#
269390	long		0x50900107	Pyramid 90x family executable
269400	long		0x50900108	Pyramid 90x family pure executable
26941>16	long		>0		not stripped
269420	long		0x5090010b	Pyramid 90x family demand paged pure executable
26943>16	long		>0		not stripped
26944
26945#------------------------------------------------------------------------------
26946# $File: python,v 1.42 2020/06/04 00:22:50 christos Exp $
26947# python:  file(1) magic for python
26948#
26949# Outlook puts """ too for urgent messages
26950# From: David Necas <yeti@physics.muni.cz>
26951# often the module starts with a multiline string
269520	string/t	"""	Python script text executable
26953# MAGIC as specified in Python/import.c (1.0 to 3.7)
26954# two bytes of magic followed by "\r\n" in little endian order
269550	belong		0x02099900	python 1.0 byte-compiled
26956!:mime text/x-bytecode.python
269570	belong		0x03099900	python 1.1/1.2 byte-compiled
26958!:mime text/x-bytecode.python
269590	belong		0x892e0d0a	python 1.3 byte-compiled
26960!:mime text/x-bytecode.python
269610	belong		0x04170d0a	python 1.4 byte-compiled
26962!:mime text/x-bytecode.python
269630	belong		0x994e0d0a	python 1.5 byte-compiled
26964!:mime text/x-bytecode.python
269650	belong		0xfcc40d0a	python 1.6 byte-compiled
26966!:mime text/x-bytecode.python
269670	belong		0xfdc40d0a	python 1.6 byte-compiled
26968!:mime text/x-bytecode.python
269690	belong		0x87c60d0a	python 2.0 byte-compiled
26970!:mime text/x-bytecode.python
269710	belong		0x88c60d0a	python 2.0 byte-compiled
26972!:mime text/x-bytecode.python
269730	belong		0x2aeb0d0a	python 2.1 byte-compiled
26974!:mime text/x-bytecode.python
269750	belong		0x2beb0d0a	python 2.1 byte-compiled
26976!:mime text/x-bytecode.python
269770	belong		0x2ded0d0a	python 2.2 byte-compiled
26978!:mime text/x-bytecode.python
269790	belong		0x2eed0d0a	python 2.2 byte-compiled
26980!:mime text/x-bytecode.python
269810	belong		0x3bf20d0a	python 2.3 byte-compiled
26982!:mime text/x-bytecode.python
269830	belong		0x3cf20d0a	python 2.3 byte-compiled
26984!:mime text/x-bytecode.python
269850	belong		0x45f20d0a	python 2.3 byte-compiled
26986!:mime text/x-bytecode.python
269870	belong		0x59f20d0a	python 2.4 byte-compiled
26988!:mime text/x-bytecode.python
269890	belong		0x63f20d0a	python 2.4 byte-compiled
26990!:mime text/x-bytecode.python
269910	belong		0x6df20d0a	python 2.4 byte-compiled
26992!:mime text/x-bytecode.python
269930	belong		0x6ef20d0a	python 2.4 byte-compiled
26994!:mime text/x-bytecode.python
269950	belong		0x77f20d0a	python 2.5 byte-compiled
26996!:mime text/x-bytecode.python
269970	belong		0x81f20d0a	python 2.5 byte-compiled
26998!:mime text/x-bytecode.python
269990	belong		0x8bf20d0a	python 2.5 byte-compiled
27000!:mime text/x-bytecode.python
270010	belong		0x8cf20d0a	python 2.5 byte-compiled
27002!:mime text/x-bytecode.python
270030	belong		0x95f20d0a	python 2.5 byte-compiled
27004!:mime text/x-bytecode.python
270050	belong		0x9ff20d0a	python 2.5 byte-compiled
27006!:mime text/x-bytecode.python
270070	belong		0xa9f20d0a	python 2.5 byte-compiled
27008!:mime text/x-bytecode.python
270090	belong		0xb3f20d0a	python 2.5 byte-compiled
27010!:mime text/x-bytecode.python
270110	belong		0xb4f20d0a	python 2.5 byte-compiled
27012!:mime text/x-bytecode.python
270130	belong		0xc7f20d0a	python 2.6 byte-compiled
27014!:mime text/x-bytecode.python
270150	belong		0xd1f20d0a	python 2.6 byte-compiled
27016!:mime text/x-bytecode.python
270170	belong		0xd2f20d0a	python 2.6 byte-compiled
27018!:mime text/x-bytecode.python
270190	belong		0xdbf20d0a	python 2.7 byte-compiled
27020!:mime text/x-bytecode.python
270210	belong		0xe5f20d0a	python 2.7 byte-compiled
27022!:mime text/x-bytecode.python
270230	belong		0xeff20d0a	python 2.7 byte-compiled
27024!:mime text/x-bytecode.python
270250	belong		0xf9f20d0a	python 2.7 byte-compiled
27026!:mime text/x-bytecode.python
270270	belong		0x03f30d0a	python 2.7 byte-compiled
27028!:mime text/x-bytecode.python
270290	belong		0x04f30d0a	python 2.7 byte-compiled
27030!:mime text/x-bytecode.python
270310	belong		0xb80b0d0a	python 3.0 byte-compiled
27032!:mime text/x-bytecode.python
270330	belong		0xc20b0d0a	python 3.0 byte-compiled
27034!:mime text/x-bytecode.python
270350	belong		0xcc0b0d0a	python 3.0 byte-compiled
27036!:mime text/x-bytecode.python
270370	belong		0xd60b0d0a	python 3.0 byte-compiled
27038!:mime text/x-bytecode.python
270390	belong		0xe00b0d0a	python 3.0 byte-compiled
27040!:mime text/x-bytecode.python
270410	belong		0xea0b0d0a	python 3.0 byte-compiled
27042!:mime text/x-bytecode.python
270430	belong		0xf40b0d0a	python 3.0 byte-compiled
27044!:mime text/x-bytecode.python
270450	belong		0xf50b0d0a	python 3.0 byte-compiled
27046!:mime text/x-bytecode.python
270470	belong		0xff0b0d0a	python 3.0 byte-compiled
27048!:mime text/x-bytecode.python
270490	belong		0x090c0d0a	python 3.0 byte-compiled
27050!:mime text/x-bytecode.python
270510	belong		0x130c0d0a	python 3.0 byte-compiled
27052!:mime text/x-bytecode.python
270530	belong		0x1d0c0d0a	python 3.0 byte-compiled
27054!:mime text/x-bytecode.python
270550	belong		0x1f0c0d0a	python 3.0 byte-compiled
27056!:mime text/x-bytecode.python
270570	belong		0x270c0d0a	python 3.0 byte-compiled
27058!:mime text/x-bytecode.python
270590	belong		0x3b0c0d0a	python 3.0 byte-compiled
27060!:mime text/x-bytecode.python
270610	belong		0x450c0d0a	python 3.1 byte-compiled
27062!:mime text/x-bytecode.python
270630	belong		0x4f0c0d0a	python 3.1 byte-compiled
27064!:mime text/x-bytecode.python
270650	belong		0x580c0d0a	python 3.2 byte-compiled
27066!:mime text/x-bytecode.python
270670	belong		0x620c0d0a	python 3.2 byte-compiled
27068!:mime text/x-bytecode.python
270690	belong		0x6c0c0d0a	python 3.2 byte-compiled
27070!:mime text/x-bytecode.python
270710	belong		0x760c0d0a	python 3.3 byte-compiled
27072!:mime text/x-bytecode.python
270730	belong		0x800c0d0a	python 3.3 byte-compiled
27074!:mime text/x-bytecode.python
270750	belong		0x8a0c0d0a	python 3.3 byte-compiled
27076!:mime text/x-bytecode.python
270770	belong		0x940c0d0a	python 3.3 byte-compiled
27078!:mime text/x-bytecode.python
270790	belong		0x9e0c0d0a	python 3.3 byte-compiled
27080!:mime text/x-bytecode.python
270810	belong		0xb20c0d0a	python 3.4 byte-compiled
27082!:mime text/x-bytecode.python
270830	belong		0xbc0c0d0a	python 3.4 byte-compiled
27084!:mime text/x-bytecode.python
270850	belong		0xc60c0d0a	python 3.4 byte-compiled
27086!:mime text/x-bytecode.python
270870	belong		0xd00c0d0a	python 3.4 byte-compiled
27088!:mime text/x-bytecode.python
270890	belong		0xda0c0d0a	python 3.4 byte-compiled
27090!:mime text/x-bytecode.python
270910	belong		0xe40c0d0a	python 3.4 byte-compiled
27092!:mime text/x-bytecode.python
270930	belong		0xee0c0d0a	python 3.4 byte-compiled
27094!:mime text/x-bytecode.python
270950	belong		0xf80c0d0a	python 3.5.1- byte-compiled
27096!:mime text/x-bytecode.python
270970	belong		0x020d0d0a	python 3.5.1- byte-compiled
27098!:mime text/x-bytecode.python
270990	belong		0x0c0d0d0a	python 3.5.1- byte-compiled
27100!:mime text/x-bytecode.python
271010	belong		0x160d0d0a	python 3.5.1- byte-compiled
27102!:mime text/x-bytecode.python
271030	belong		0x170d0d0a	python 3.5.2+ byte-compiled
27104!:mime text/x-bytecode.python
271050	belong		0x200d0d0a	python 3.6 byte-compiled
27106!:mime text/x-bytecode.python
271070	belong		0x210d0d0a	python 3.6 byte-compiled
27108!:mime text/x-bytecode.python
271090	belong		0x2a0d0d0a	python 3.6 byte-compiled
27110!:mime text/x-bytecode.python
271110	belong		0x2b0d0d0a	python 3.6 byte-compiled
27112!:mime text/x-bytecode.python
271130	belong		0x2c0d0d0a	python 3.6 byte-compiled
27114!:mime text/x-bytecode.python
271150	belong		0x2d0d0d0a	python 3.6 byte-compiled
27116!:mime text/x-bytecode.python
271170	belong		0x2f0d0d0a	python 3.6 byte-compiled
27118!:mime text/x-bytecode.python
271190	belong		0x300d0d0a	python 3.6 byte-compiled
27120!:mime text/x-bytecode.python
271210	belong		0x310d0d0a	python 3.6 byte-compiled
27122!:mime text/x-bytecode.python
271230	belong		0x320d0d0a	python 3.6 byte-compiled
27124!:mime text/x-bytecode.python
271250	belong		0x330d0d0a	python 3.6 byte-compiled
27126!:mime text/x-bytecode.python
271270	belong		0x3e0d0d0a	python 3.7 byte-compiled
27128!:mime text/x-bytecode.python
271290	belong		0x3f0d0d0a	python 3.7 byte-compiled
27130!:mime text/x-bytecode.python
271310	belong		0x400d0d0a	python 3.7 byte-compiled
27132!:mime text/x-bytecode.python
271330	belong		0x410d0d0a	python 3.7 byte-compiled
27134!:mime text/x-bytecode.python
271350	belong		0x420d0d0a	python 3.7 byte-compiled
27136!:mime text/x-bytecode.python
271370	belong		0x480d0d0a	python 3.8 byte-compiled
27138!:mime text/x-bytecode.python
271390	belong		0x490d0d0a	python 3.8 byte-compiled
27140!:mime text/x-bytecode.python
271410	belong		0x520d0d0a	python 3.8 byte-compiled
27142!:mime text/x-bytecode.python
271430	belong		0x530d0d0a	python 3.8 byte-compiled
27144!:mime text/x-bytecode.python
271450	belong		0x540d0d0a	python 3.8 byte-compiled
27146!:mime text/x-bytecode.python
271470	belong		0x550d0d0a	python 3.8 byte-compiled
27148!:mime text/x-bytecode.python
271490	belong		0x5c0d0d0a	python 3.9 byte-compiled
27150!:mime text/x-bytecode.python
271510	belong		0x5d0d0d0a	python 3.9 byte-compiled
27152!:mime text/x-bytecode.python
271530	belong		0x5e0d0d0a	python 3.9 byte-compiled
27154!:mime text/x-bytecode.python
271550	belong		0x5f0d0d0a	python 3.9 byte-compiled
27156!:mime text/x-bytecode.python
271570	belong		0x600d0d0a	python 3.9 byte-compiled
27158!:mime text/x-bytecode.python
271590	belong		0x610d0d0a	python 3.9 byte-compiled
27160!:mime text/x-bytecode.python
27161
271620	search/1/w	#!\040/usr/bin/python	Python script text executable
27163!:strength + 15
27164!:mime text/x-script.python
271650	search/1/w	#!\040/usr/local/bin/python	Python script text executable
27166!:strength + 15
27167!:mime text/x-script.python
271680	search/10/w	#!\040/usr/bin/env\040python	Python script text executable
27169!:strength + 15
27170!:mime text/x-script.python
27171
27172
27173# from module.submodule import func1, func2
271740	search/8192	import
27175>0	regex		\^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$	Python script text executable
27176!:strength + 15
27177!:mime text/x-script.python
27178
27179# def __init__ (self, ...):
271800	search/4096	def\ __init__
27181>&0	search/64 self	Python script text executable
27182!:strength + 15
27183!:mime text/x-script.python
27184
27185# if __name__ == "__main__":
271860 search/4096 if\ __name__
27187>&0 search/64 '__main__'	Python script text executable
27188>&0 search/64 "__main__"	Python script text executable
27189!:strength + 15
27190!:mime text/x-script.python
27191
27192# import module [as abrev]
271930	search/8192	import
27194>0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
27195!:mime text/x-script.python
27196
27197# comments
27198#0	search/4096	'''
27199#>&0	regex	.*'''$	Python script text executable
27200#!:mime text/x-script.python
27201
27202#0	search/4096	"""
27203#>&0	regex	.*"""$	Python script text executable
27204#!:mime text/x-script.python
27205
27206# try:
27207# except: or finally:
27208# block
272090	search/4096	try:
27210>&0	regex	\^[[:space:]]*except.*:$	Python script text executable
27211!:strength + 15
27212!:mime text/x-script.python
27213>&0	search/4096	finally:	Python script text executable
27214!:mime text/x-script.python
27215
27216# class name[(base classes,)]: [pass]
272170	search/8192	class
27218>0	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
27219!:strength + 15
27220!:mime text/x-script.python
27221
27222# def name(*args, **kwargs):
272230	search/8192	def\
27224>0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
27225>>&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
27226!:strength + 15
27227!:mime text/x-script.python
27228
27229# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html
272300	string	\223NUMPY		NumPy data file
27231!:mime  application/x-numpy-data
27232>6	byte	x			\b, version %d
27233>7	byte	x			\b.%d
27234#>8	leshort	x			\b, header length=%d
27235>10	string	x			\b, description %s
27236
27237#------------------------------------------------------------------------------
27238# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $
27239# qt:  file(1) magic for Qt
27240
27241# https://doc.qt.io/qt-5/resources.html
272420	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
27243
27244# https://qt.gitorious.org/qt/qtbase/source/\
27245# 5367fa356233da4c0f28172a8f817791525f5457:\
27246# src/tools/rcc/rcc.cpp#L840
272470	string		qres\0\0		Qt Binary Resource file
272480	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
27249
27250# https://qt.gitorious.org/qt/qtbase/source/\
27251# 5367fa356233da4c0f28172a8f817791525f5457:\
27252# src/corelib/kernel/qtranslator.cpp#L62
272530	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
27254>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
27255
27256#------------------------------------------------------------------------------
27257# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
27258# file(1) magic for revision control files
27259# From Hendrik Scholz <hendrik@scholz.net>
272600	string/t	/1\ :pserver:	cvs password text file
27261
27262# Conary changesets
27263# From: Jonathan Smith <smithj@rpath.com>
272640	belong	0xea3f81bb	Conary changeset data
27265
27266# Type: Git bundles (git-bundle)
27267# From: Josh Triplett <josh@freedesktop.org>
272680	string	#\ v2\ git\ bundle\n	Git bundle
27269
27270# Type: Git pack
27271# From: Adam Buchbinder <adam.buchbinder@gmail.com>
27272# Update: Joerg Jenderek
27273# URL: http://fileformats.archiveteam.org/wiki/Git
27274# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
27275# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
27276# those have a little-endian offset immediately following the magic 'PACK',
27277# the first byte of which is never 0, while the first byte of the Git pack
27278# version, since it's a tiny number stored in big-endian format, is always 0.
272790	string	PACK
27280# GRR: line above is too general as it matches also PackDir archive ./acorn
27281# test for major version. Git 2017 accepts version number 2 or 3
27282>4	ubelong	<9
27283# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
27284# or SystemDevice::foobar
27285>>9	search/13 ::
27286# but in git binary
27287>>9	default	x	Git pack
27288!:mime	application/x-git
27289!:ext	pack
27290# 4 GB limit implies unsigned integer
27291>>>4	ubelong	x		\b, version %u
27292>>>8	ubelong	x		\b, %u objects
27293
27294# Type: Git pack index
27295# From: Adam Buchbinder <adam.buchbinder@gmail.com>
272960	string	\377tOc		Git pack index
27297>4	belong	=2		\b, version 2
27298
27299# Type: Git index file
27300# From: Frederic Briare <fbriere@fbriere.net>
273010	string	DIRC		Git index
27302>4	belong	>0		\b, version %d
27303>>8	belong	>0		\b, %d entries
27304
27305# Type:	Mercurial bundles
27306# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
273070	string	HG10		Mercurial bundle,
27308>4	string	UN		uncompressed
27309>4	string	BZ		bzip2 compressed
27310
27311# Type:	Subversion (SVN) dumps
27312# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
273130	string	SVN-fs-dump-format-version:	Subversion dumpfile
27314>28	string	>\0				(version: %s)
27315
27316# Type:	Bazaar revision bundles and merge requests
27317# URL:	https://www.bazaar-vcs.org/
27318# From:	Jelmer Vernooij <jelmer@samba.org>
273190	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
273200	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
27321
27322#------------------------------------------------------------------------------
27323# $File: riff,v 1.35 2020/06/05 17:15:03 christos Exp $
27324# riff:  file(1) magic for RIFF format
27325# See
27326#
27327#	https://www.seanet.com/users/matts/riffmci/riffmci.htm
27328#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
27329#
27330
27331# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
273320   name    riff-wave
27333>0	leshort		1		\b, Microsoft PCM
27334>>14	leshort		>0
27335>>>14	leshort		<1024	\b, %d bit
27336>0	leshort		2		\b, Microsoft ADPCM
27337>0	leshort		6		\b, ITU G.711 A-law
27338>0	leshort		7		\b, ITU G.711 mu-law
27339>0	leshort		8		\b, Microsoft DTS
27340>0	leshort		17		\b, IMA ADPCM
27341>0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
27342>0	leshort		49		\b, GSM 6.10
27343>0	leshort		64		\b, ITU G.721 ADPCM
27344>0	leshort		80		\b, MPEG
27345>0	leshort		85		\b, MPEG Layer 3
27346>0	leshort		0x2001		\b, DTS
27347>2	leshort		=1		\b, mono
27348>2	leshort		=2		\b, stereo
27349>2	leshort		>2
27350>>2	leshort		<128	\b, %d channels
27351>4	lelong		>0
27352>>4	lelong		<1000000	%d Hz
27353
27354# try to find "fmt "
273550   name    riff-walk
27356>0  string  fmt\x20
27357>>4 lelong  <0x80
27358>>>8 use    riff-wave
27359>0  string  LIST
27360>>&(4.l+4)  use riff-walk
27361>0  string  DISP
27362>>&(4.l+4)  use riff-walk
27363>0  string  bext
27364>>&(4.l+4)  use riff-walk
27365>0  string  Fake
27366>>&(4.l+4)  use riff-walk
27367>0  string  fact
27368>>&(4.l+4)  use riff-walk
27369>0  string  VP8
27370>>11		byte		0x9d
27371>>>12		byte		0x01
27372>>>>13		byte		0x2a	\b, VP8 encoding
27373>>>>>14		leshort&0x3fff	x	\b, %d
27374>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
27375>>>>>14		leshort&0xc000	0x0000	\b [none]
27376>>>>>14		leshort&0xc000	0x1000	\b [5/4]
27377>>>>>14		leshort&0xc000	0x2000	\b [5/3]
27378>>>>>14		leshort&0xc000	0x3000	\b [2]
27379>>>>>14		leshort&0xc000	0x0000	\bx[none]
27380>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
27381>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
27382>>>>>14		leshort&0xc000	0x3000	\bx[2]
27383>>>>>15		byte&0x80	=0x00	\b, YUV color
27384>>>>>15		byte&0x80	=0x80	\b, bad color specification
27385>>>>>15		byte&0x40	=0x40	\b, no clamping required
27386>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
27387#>0  string  x		we got %s
27388#>>&(4.l+4)  use riff-walk
27389
27390# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
27391#
273920	string		RIFF		RIFF (little-endian) data
27393# RIFF Palette format
27394# Update: Joerg Jenderek
27395# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
27396# Reference: https://worms2d.info/Palette_file
27397>8	string		PAL\ 		\b, palette
27398!:mime	application/x-riff
27399# color palette by Microsoft Corporation
27400!:ext	pal
27401# file size =  chunk size + 8 in most cases
27402>>4	ulelong+8	x		\b, %u bytes
27403# Extended PAL Format
27404>>12	string		plth		\b, extended
27405# Simple PAL Format
27406>>12	string		data
27407# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
27408>>>16	ulelong		x		\b, data size %u
27409# palVersion is always 0x0300
27410#>>>20	leshort		x		\b, version 0x%4.4x
27411# palNumEntries specifies the number of palette color entries
27412>>>22	uleshort	x		\b, %u entries
27413# after palPalEntry sized (number of color entries * 4 ) vector
27414>>>(22.s*4)	ubequad	x
27415# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
27416# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
27417>>>>&16		ubelong	x		\b, extra bytes
27418>>>>>&-4	ubelong	>0		0x%8.8x
27419# RIFF Device Independent Bitmap format
27420>8	string		RDIB		\b, device-independent bitmap
27421>>16	string		BM
27422>>>30	leshort		12		\b, OS/2 1.x format
27423>>>>34	leshort		x		\b, %d x
27424>>>>36	leshort		x		%d
27425>>>30	leshort		64		\b, OS/2 2.x format
27426>>>>34	leshort		x		\b, %d x
27427>>>>36	leshort		x		%d
27428>>>30	leshort		40		\b, Windows 3.x format
27429>>>>34	lelong		x		\b, %d x
27430>>>>38	lelong		x		%d x
27431>>>>44	leshort		x		%d
27432# RIFF MIDI format
27433>8	string		RMID		\b, MIDI
27434# RIFF Multimedia Movie File format
27435>8	string		RMMP		\b, multimedia movie
27436# RIFF wrapper for MP3
27437>8	string		RMP3		\b, MPEG Layer 3 audio
27438# Microsoft WAVE format (*.wav)
27439>8	string		WAVE		\b, WAVE audio
27440!:mime	audio/x-wav
27441>>12    string  >\0
27442>>>12   use     riff-walk
27443# Update:	Joerg Jenderek
27444# lower case for Corel Draw version 8 Bidi
27445>8	string/c	cdr
27446# skip Corel CCX Clipart
27447>>8	string		!CDRXcont
27448# Corel Draw Picture
27449>>>0	use     corel-draw
27450# URL:		http://fileformats.archiveteam.org/wiki/CCX_(Corel)
27451# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml
27452>>8	string		=CDRXcont	\b, Corel Clipart
27453!:mime	application/x-corel-ccx
27454!:ext	ccx
27455# 3rd chunk data {Corel\040Binary\040Meta\040File}
27456#>>>20	string		x		\b, 3rd '%-s'
27457>>>4	ulelong+8	x		\b, %u bytes
27458# From:		Joerg Jenderek
27459# URL:		https://en.wikipedia.org/wiki/CorelDRAW
27460# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
27461# Picture templates created by newer software start with RIFF type CDT
27462>8	string		CDT
27463>>0	use		corel-draw
27464# Picture templates with version 4.4
27465>8	string		CDST
27466>>0	use		corel-draw
27467# pattern created by newer software start with RIFF type PAT
27468>8	string		PAT
27469>>0	use		corel-draw
27470>8	string		NUNDROOT	\b, Steinberg CuBase
27471# AVI == Audio Video Interleave
27472>8	string		AVI\040		\b, AVI
27473!:mime	video/x-msvideo
27474>>12    string          LIST
27475>>>20   string          hdrlavih
27476>>>>&36 lelong          x               \b, %u x
27477>>>>&40 lelong          x               %u,
27478>>>>&4  lelong          >1000000        <1 fps,
27479>>>>&4  lelong          1000000         1.00 fps,
27480>>>>&4  lelong          500000          2.00 fps,
27481>>>>&4  lelong          333333          3.00 fps,
27482>>>>&4  lelong          250000          4.00 fps,
27483>>>>&4  lelong          200000          5.00 fps,
27484>>>>&4  lelong          166667          6.00 fps,
27485>>>>&4  lelong          142857          7.00 fps,
27486>>>>&4  lelong          125000          8.00 fps,
27487>>>>&4  lelong          111111          9.00 fps,
27488>>>>&4  lelong          100000          10.00 fps,
27489# ]9.9,10.1[
27490>>>>&4  lelong          <101010
27491>>>>>&-4        lelong  >99010
27492>>>>>>&-4       lelong  !100000         ~10 fps,
27493>>>>&4  lelong          83333           12.00 fps,
27494# ]11.9,12.1[
27495>>>>&4  lelong          <84034
27496>>>>>&-4        lelong  >82645
27497>>>>>>&-4       lelong  !83333          ~12 fps,
27498>>>>&4  lelong          66667           15.00 fps,
27499# ]14.9,15.1[
27500>>>>&4  lelong          <67114
27501>>>>>&-4        lelong  >66225
27502>>>>>>&-4       lelong  !66667          ~15 fps,
27503>>>>&4  lelong          50000           20.00 fps,
27504>>>>&4  lelong          41708           23.98 fps,
27505>>>>&4  lelong          41667           24.00 fps,
27506# ]23.9,24.1[
27507>>>>&4  lelong          <41841
27508>>>>>&-4        lelong  >41494
27509>>>>>>&-4       lelong  !41708
27510>>>>>>>&-4      lelong  !41667          ~24 fps,
27511>>>>&4  lelong          40000           25.00 fps,
27512# ]24.9,25.1[
27513>>>>&4  lelong          <40161
27514>>>>>&-4        lelong  >39841
27515>>>>>>&-4       lelong  !40000          ~25 fps,
27516>>>>&4  lelong          33367           29.97 fps,
27517>>>>&4  lelong          33333           30.00 fps,
27518# ]29.9,30.1[
27519>>>>&4  lelong          <33445
27520>>>>>&-4        lelong  >33223
27521>>>>>>&-4       lelong  !33367
27522>>>>>>>&-4      lelong  !33333          ~30 fps,
27523>>>>&4  lelong          <32224          >30 fps,
27524##>>>>&4  lelong          x               (%lu)
27525##>>>>&20 lelong          x               %lu frames,
27526# Note: The tests below assume that the AVI has 1 or 2 streams,
27527#       "vids" optionally followed by "auds".
27528#       (Should cover 99.9% of all AVIs.)
27529# assuming avih length = 56
27530>>>88   string  LIST
27531>>>>96  string  strlstrh
27532>>>>>108        string  vids    video:
27533>>>>>>&0        lelong  0               uncompressed
27534# skip past vids strh
27535>>>>>>(104.l+108)       string  strf
27536>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
27537>>>>>>>(104.l+132)      string/c        cvid    Cinepak
27538>>>>>>>(104.l+132)      string/c        i263    Intel I.263
27539>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
27540>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
27541>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
27542>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
27543>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
27544>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
27545>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
27546>>>>>>>(104.l+132)      string/c        div3    DivX 3
27547>>>>>>>>112             string/c        div3    Low-Motion
27548>>>>>>>>112             string/c        div4    Fast-Motion
27549>>>>>>>(104.l+132)      string/c        divx    DivX 4
27550>>>>>>>(104.l+132)      string/c        dx50    DivX 5
27551>>>>>>>(104.l+132)      string/c        xvid    XviD
27552>>>>>>>(104.l+132)	string/c	h264	H.264
27553>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
27554>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
27555>>>>>>>(104.l+132)      lelong  0
27556##>>>>>>>(104.l+132)      string  x       (%.4s)
27557# skip past first (video) LIST
27558>>>>(92.l+96)   string  LIST
27559>>>>>(92.l+104) string  strlstrh
27560>>>>>>(92.l+116)        string          auds    \b, audio:
27561# auds strh length = 56:
27562>>>>>>>(92.l+172)       string          strf
27563>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
27564>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
27565>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
27566>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
27567>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
27568>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
27569>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
27570>>>>>>>>(92.l+180)      leshort 0x0161  DivX
27571##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
27572>>>>>>>>(92.l+182)      leshort 1       (mono,
27573>>>>>>>>(92.l+182)      leshort 2       (stereo,
27574>>>>>>>>(92.l+182)      leshort >2      (%d channels,
27575>>>>>>>>(92.l+184)      lelong  x       %d Hz)
27576# auds strh length = 64:
27577>>>>>>>(92.l+180)       string          strf
27578>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
27579>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
27580>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
27581>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
27582>>>>>>>>(92.l+188)      leshort 0x0161  DivX
27583##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
27584>>>>>>>>(92.l+190)      leshort 1       (mono,
27585>>>>>>>>(92.l+190)      leshort 2       (stereo,
27586>>>>>>>>(92.l+190)      leshort >2      (%d channels,
27587>>>>>>>>(92.l+192)      lelong  x       %d Hz)
27588# Animated Cursor format
27589>8	string		ACON		\b, animated cursor
27590# SoundFont 2 <mpruett@sgi.com>
27591>8	string		sfbk		SoundFont/Bank
27592# MPEG-1 wrapped in a RIFF, apparently
27593>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
27594>8	string		4XMV		\b, 4X Movie file
27595# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV
27596>8	string		AMV\040		\b, AMV
27597>8      string          WEBP            \b, Web/P image
27598!:mime	image/webp
27599>>12	use		riff-walk
27600# From:		Joerg Jenderek
27601# URL:		https://en.wikipedia.org/wiki/CorelDRAW
27602# Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
27603# Note:		Since version 3 CorelDraw Pictures are RIFF based
27604# but data chunks remain proprietary.
27605# Since version 14 til 15 packed as "content/riffData.cdr" and
27606# since 16 "content/root.dat" in ZIP container
27607# TODO:		distinguish templates with version 12.5 from Designer illustration 12
27608#	display information of RIFF based Corel Draw pictures, templates and patterns
276090	name   	corel-draw
27610# display second chunk for debugging
27611#>8	string		x		\b, [8]=%.8s
27612>0	string		x		\b, Corel Draw
27613#!:mime	image/x-coreldraw
27614!:mime	application/vnd.corel-draw
27615# used by newer pictures templates
27616>>8	string		CDT
27617# used by templates with newer versions since 16
27618>>>12	string		=fver		Picture template (root.dat)
27619!:ext	dat
27620# used by templates with older versions with vrsn tag
27621>>>12	string		!fver
27622# used by templates with older versions 14-15
27623>>>>11	string		>E		Picture template (riffData.cdr)
27624!:ext	cdr
27625# used by templates with older versions 11-13
27626>>>>11	string		<F		Picture template
27627!:ext	cdt/cdrt
27628# used by older templates with version 4.4
27629>>8	string		CDST		Picture template
27630!:ext	cdt
27631# used by templates with version 12.5
27632>>8	string		DESC		Picture template
27633!:ext	cdt
27634# used by newer patterns with version 22
27635>>8	string		PAT		Pattern
27636!:ext	dat
27637# remaining older templates, patterns, drawings
27638>>8	default		x
27639# pattern with old version 4.y
27640>>>26	ulelong		=0x0000206C	Pattern
27641!:ext	pat
27642# pattern with newer versions
27643>>>26	ulelong		=0x00000D2C	Pattern
27644!:ext	pat
27645# remaining older templates or pictures
27646>>>26	default		x
27647# used by older versions 5 - 15
27648>>>>12	string		=vrsn
27649# 4th chunk size unequal 282Ch only found for CDR
27650>>>>>26	ulelong		!0x0000282c	Picture
27651!:ext	cdr
27652>>>>>26	default		x		Picture or template
27653!:ext	cdr/cdt
27654# used by newer versions since 16
27655>>>>12	string		=fver		Picture (root.dat)
27656!:ext	dat
27657# version marked by 1 ASCII char: space~3, ... , F~15,  ... , N~22, ... R~22 template
27658>11	string		x		\b, version
27659>11	string		>\040		'%-.1s'
27660>0	use		corel-version
27661>4	ulelong+8	x		\b, %u bytes
27662#
27663#	display numeric version of RIFF based Corel after 3rd RIFF tag
276640	name   	corel-version
27665# for debugging purpose; vrsn for short content; fver for 16 byte size
27666#>12	string		x		\b, TAG "%-4.4s"
27667# 1st data chunk length 2 implies short content version
27668>16	ulelong		2
27669# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion
27670>>20	uleshort/100	x		%u
27671>>20	uleshort%100	>0		\b.%u
27672# for debugging purpose display next chunk like: DISP LIST
27673#>>22	string		x		\b, 4th "%-4.4s"
27674#>>26	ulelong		x		\b, 4th SIZE 0x%x
27675# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp
27676#>>(26.l+30)	string	x		\b, 5th "%-4.4s"
27677# 1st data chunk length 10h implies 16 byte content with version info
27678>16	ulelong		0x10
27679>>34	ubyte		x		%u
27680>>>33	ubyte		>0		\b.%u
27681#
27682# XXX - some of the below may only appear in little-endian form.
27683#
27684# Also "MV93" appears to be for one form of Macromedia Director
27685# files, and "GDMF" appears to be another multimedia format.
27686#
276870	string		RIFX		RIFF (big-endian) data
27688# RIFF Palette format
27689>8	string		PAL		\b, palette
27690>>16	beshort		x		\b, version %d
27691>>18	beshort		x		\b, %d entries
27692# RIFF Device Independent Bitmap format
27693>8	string		RDIB		\b, device-independent bitmap
27694>>16	string		BM
27695>>>30	beshort		12		\b, OS/2 1.x format
27696>>>>34	beshort		x		\b, %d x
27697>>>>36	beshort		x		%d
27698>>>30	beshort		64		\b, OS/2 2.x format
27699>>>>34	beshort		x		\b, %d x
27700>>>>36	beshort		x		%d
27701>>>30	beshort		40		\b, Windows 3.x format
27702>>>>34	belong		x		\b, %d x
27703>>>>38	belong		x		%d x
27704>>>>44	beshort		x		%d
27705# RIFF MIDI format
27706>8	string		RMID		\b, MIDI
27707# RIFF Multimedia Movie File format
27708>8	string		RMMP		\b, multimedia movie
27709# Microsoft WAVE format (*.wav)
27710>8	string		WAVE		\b, WAVE audio
27711>>20	leshort		1		\b, Microsoft PCM
27712>>>34	leshort		>0		\b, %d bit
27713>>22	beshort		=1		\b, mono
27714>>22	beshort		=2		\b, stereo
27715>>22	beshort		>2		\b, %d channels
27716>>24	belong		>0		%d Hz
27717# Corel Draw Picture big endian not tested by real examples
27718#>8	string		CDRA		\b, Corel Draw Picture
27719#>8	string		CDR6		\b, Corel Draw Picture, version 6
27720>8	string		CDR
27721>>0	use     \^corel-draw
27722
27723# AVI == Audio Video Interleave
27724>8	string		AVI\040		\b, AVI
27725# Animated Cursor format
27726>8	string		ACON		\b, animated cursor
27727# Notation Interchange File Format (big-endian only)
27728>8	string		NIFF		\b, Notation Interchange File Format
27729# SoundFont 2 <mpruett@sgi.com>
27730>8	string		sfbk		SoundFont/Bank
27731
27732#------------------------------------------------------------------------------
27733# Sony Wave64
27734# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
27735# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
277360	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
27737# 128 bit + total file size (64 bits) so 24 bytes
27738# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
27739>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
27740!:mime	audio/x-w64
27741# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
27742>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
27743>>>&10	leshort		=1		\b, mono
27744>>>&10	leshort		=2		\b, stereo
27745>>>&10	leshort		>2		\b, %d channels
27746>>>&12	lelong		>0		%d Hz
27747
27748#------------------------------------------------------------------------------
27749# MBWF/RF64
27750# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf
277510	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
27752!:mime	audio/x-wav
27753>40	search/256	fmt\x20		\b
27754>>&6	leshort		=1		\b, mono
27755>>&6	leshort		=2		\b, stereo
27756>>&6	leshort		>2		\b, %d channels
27757>>&8	lelong		>0		%d Hz
27758
27759#------------------------------------------------------------------------------
27760# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $
27761# rpi:  file(1) magic for Raspberry Pi images
27762-44		lelong	0
27763>4		lelong	0
27764>>8		lelong	1
27765>>12		lelong	4
27766>>>16		string	283x
27767>>>>20		lelong	1
27768>>>>>24		lelong	4
27769>>>>>>28	string	DTOK
27770>>>>>>>32	lelong	44
27771>>>>>>>>36	lelong	4
27772>>>>>>>>>40	string	RPTL		Raspberry PI kernel image
27773
27774-56		lelong	0
27775>4		lelong	0
27776>>8		lelong	1
27777>>12		lelong	4
27778>>>16		string	283x
27779>>>>20		lelong	1
27780>>>>>24		lelong	4
27781>>>>>>28	string	DTOK
27782>>>>>>>32	lelong	1
27783>>>>>>>>36	lelong	4
27784>>>>>>>>>40	string	DDTK8
27785>>>>>>>>>>48	lelong	4
27786>>>>>>>>>>>52	string	RPTL		Raspberry PI kernel image
27787
27788#------------------------------------------------------------------------------
27789# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
27790#
27791# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
27792#
277930	belong		0xedabeedb	RPM
27794!:mime	application/x-rpm
27795>4	byte		x		v%d
27796>5	byte		x		\b.%d
27797>6	beshort		1		src
27798>6	beshort		0		bin
27799>>8	beshort		1		i386/x86_64
27800>>8	beshort		2		Alpha/Sparc64
27801>>8	beshort		3		Sparc
27802>>8	beshort		4		MIPS
27803>>8	beshort		5		PowerPC
27804>>8	beshort		6		68000
27805>>8	beshort		7		SGI
27806>>8	beshort		8		RS6000
27807>>8	beshort		9		IA64
27808>>8	beshort		10		Sparc64
27809>>8	beshort		11		MIPSel
27810>>8	beshort		12		ARM
27811>>8	beshort		13		MiNT
27812>>8	beshort		14		S/390
27813>>8	beshort		15		S/390x
27814>>8	beshort		16		PowerPC64
27815>>8	beshort		17		SuperH
27816>>8	beshort		18		Xtensa
27817>>8	beshort		255		noarch
27818>>10	string		x		%s
27819
27820#delta RPM    Daniel Novotny (dnovotny@redhat.com)
278210	string		drpm		Delta RPM
27822!:mime  application/x-rpm
27823>12	string 	x	%s
27824>>8	beshort		11		MIPSel
27825>>8	beshort		12		ARM
27826>>8	beshort		13		MiNT
27827>>8	beshort		14		S/390
27828>>8	beshort		15		S/390x
27829>>8	beshort		16		PowerPC64
27830>>8	beshort		17		SuperH
27831>>8	beshort		18		Xtensa
27832>>10	string		x		%s
27833
27834#------------------------------------------------------------------------------
27835# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $
27836# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages)
27837# see https://en.wikipedia.org/wiki/Rpmsg
27838
278390	string	\x76\xe8\x04\x60\xc4\x11\xe3\x86	rpmsg Restricted Permission Message
27840
27841#------------------------------------------------------------------------------
27842# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $
27843# rst: ReStructuredText http://docutils.sourceforge.net/rst.html
278440	search/256	\=\=
27845!:strength + 30
27846>&0	regex/256	\^[\=]+$
27847>>&0	search/512	:Author:	ReStructuredText file
27848>>&0	default		x
27849>>>&0	regex/512	\^\\.\\.[A-Za-z]	ReStructuredText file
27850!:ext	rst
27851
27852#------------------------------------------------------------------------------
27853# $File: rtf,v 1.8 2020/05/17 19:28:49 christos Exp $
27854# rtf:	file(1) magic for Rich Text Format (RTF)
27855#
27856# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
27857# Update:	Joerg Jenderek
27858# URL:		https://en.wikipedia.org/wiki/Rich_Text_Format
27859# Reference:	http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf
27860#		http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf
278610	string		{\\rtf
27862# skip DROID fmt-355-signature-id-522.rtf by looking for valid version
27863>5	ubyte		!0xAB
27864# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version
27865>>5	ubyte		!0x5C		Rich Text Format data
27866!:mime	text/rtf
27867!:apple	????RTF
27868!:ext	rtf
27869>>>0	use		rtf-info
27870#	display information like version, language and code page of RTF
278710	name		rtf-info
27872# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf
27873>5	ubyte		!0x7b		\b, version %c
27874# The word for character set must precede any text or most other control words
27875>6	string		\\mac		\b, Apple Macintosh
27876>6	string		\\pc
27877# control word \pca
27878>>9	ubyte		=0x61		\b, IBM PS/2, code page 850
27879>>9	ubyte		!0x61		\b, IBM PC, code page 437
27880# unknown character set or ANSI later after control words like
27881# \adeflang1025 \info \title \author \category \manager
27882# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
27883#>6	search/105	\\ansi		\b, ANSI
27884>6	search/502	\\ansi		\b, ANSI
27885>6	default		x		\b, unknown character set
27886# look for explict codepage keyword
27887# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
27888#>5	search/110	\\ansicpg
27889>5	search/500	\\ansicpg
27890# skip unknown or buggy codepage string 0 like in fdo78502.rtf
27891>>&0	ubyte		!0x30		\b, code page
27892# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi
27893>>>&-1		string	x		%-.3s
27894# skip space or \ and display possible 4th digit of code page string
27895>>>&2		ubyte	>0x2F
27896>>>>&-1		ubyte	<0x3A		\b%c
27897# possible 5th digit of code page string
27898>>>>>&0		ubyte	>0x2F
27899>>>>>>&-1	ubyte	<0x3A		\b%c
27900# look again at version byte to use default clause
27901>5	ubyte		x
27902# Default language ID for South Asian/Middle Eastern text
27903# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica
27904# Readme-0.72-Persian.rtf
27905#>6	search/1	\\adeflang	\b, default middle east language ID
27906>>6	search/497	\\adeflang	\b, default middle east language ID
27907# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a
27908>>>&0	string		x		%.4s
27909# skip \ and NL and show possible 5th digit of language string
27910>>>&4	ubyte		>0x2F
27911>>>>&-1	ubyte		<0x3A		\b%c
27912# else look for default language to be used when the \plain control word is encountered
27913>>6	default		x
27914# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
27915#>>>6	search/127	\\deflang
27916>>>6	search/505	\\deflang
27917>>>>&0	string		>0		\b, default language ID %-.4s
27918# possible 5th digit of language string
27919>>>>&4		ubyte	>0x2F
27920>>>>>&-1	ubyte	<0x3A		\b%c
27921
27922# Reference:	http://latex2rtf.sourceforge.net/rtfspec_63.html
27923# Note:		no real world example found
279240	string		{\\urtf		Rich Text Format unicoded data
27925!:mime	text/rtf
27926#!:apple	????RTF
27927!:ext	rtf
27928>1	use		rtf-info
27929
27930# URL:		https://en.wikipedia.org/wiki/Microsoft_Word
27931# Reference:	http://fileformats.archiveteam.org/wiki/Microsoft_Word
27932# Note:	called by TrID "Pocket Word document"
27933#	by PlanMaker "Pocket Word-Handheld PC" for pwd
27934#	by PlanMaker "Pocket Word-Pocket PC" for psw
279350	string		{\\pwd		Pocket Word document or template
27936# by SoftMaker Office	http://extension.nirsoft.net/pwd
27937#!:mime	application/msword
27938# https://reposcope.com/mimetype/application/x-pocket-word
27939!:mime	application/x-pocket-word
27940# PWD for Handheld PC variant and PSW for Pocket PC variant
27941# PWT for template
27942!:ext	pwd/psw/pwt
27943>0	use		rtf-info
27944
27945
27946#------------------------------------------------------------------------------
27947# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $
27948# ruby:  file(1) magic for Ruby scripting language
27949# URL:  https://www.ruby-lang.org/
27950# From: Reuben Thomas <rrt@sc3d.org>
27951
27952# Ruby scripts
279530	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
27954!:strength + 15
27955!:mime text/x-ruby
279560	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
27957!:strength + 15
27958!:mime text/x-ruby
279590	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
27960!:strength + 15
27961!:mime text/x-ruby
279620	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
27963!:strength + 15
27964!:mime text/x-ruby
27965
27966# What looks like ruby, but does not have a shebang
27967# (modules and such)
27968# From: Lubomir Rintel <lkundrak@v3.sk>
279690	search/8192	require
27970>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'
27971>>0	regex		def\ [a-z]|\ do$
27972>>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
27973!:strength + 30
27974!:mime	text/x-ruby
279750	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
27976>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
27977>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
27978!:strength + 30
27979!:mime	text/x-ruby
27980# Classes with no modules or defs, beats simple ASCII
279810	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
27982>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
27983!:strength + 10
27984!:mime	text/x-ruby
27985# Looks for function definition to balance python magic
27986# def name (args)
27987# end
279880	search/8192	def\
27989>0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
27990>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
27991!:strength + 10
27992!:mime	text/x-ruby
27993
279940	search/8192	require
27995>0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'	Ruby script text
27996!:mime	text/x-ruby
279970	search/8192	include
27998>0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
27999!:mime	text/x-ruby
28000
28001#------------------------------------------------------------------------------
28002# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
28003# sc:  file(1) magic for "sc" spreadsheet
28004#
2800538	string		Spreadsheet	sc spreadsheet file
28006!:mime	application/x-sc
28007
28008#------------------------------------------------------------------------------
28009# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
28010# sccs:  file(1) magic for SCCS archives
28011#
28012# SCCS archive structure:
28013# \001h01207
28014# \001s 00276/00000/00000
28015# \001d D 1.1 87/09/23 08:09:20 ian 1 0
28016# \001c date and time created 87/09/23 08:09:20 by ian
28017# \001e
28018# \001u
28019# \001U
28020# ... etc.
28021# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
28022# *Sigh*. And these both came from various parts of the USG.
28023# Maybe we should just switch everybody from SCCS to RCS!
28024# Further, you can't just say '\001h0', because the five-digit number
28025# is a checksum that could (presumably) have any leading digit,
28026# and we don't have regular expression matching yet.
28027# Hence the following official kludge:
280288	string		\001s\ 			SCCS archive data
28029
28030#------------------------------------------------------------------------------
28031# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $
28032# scientific:  file(1) magic for scientific formats
28033#
28034# From: Joe Krahn <krahn@niehs.nih.gov>
28035
28036########################################################
28037# CCP4 data and plot files:
280380	string		MTZ\040		MTZ reflection file
28039
2804092	string		PLOT%%84	Plot84 plotting file
28041>52	byte		1		, Little-endian
28042>55	byte		1		, Big-endian
28043
28044########################################################
28045# Electron density MAP/MASK formats
28046
280470	string		EZD_MAP	NEWEZD Electron Density Map
28048109	string		MAP\040(  Old EZD Electron Density Map
28049
280500	string/c	:-)\040Origin	BRIX Electron Density Map
28051>170	string		>0	, Sigma:%.12s
28052#>4	string		>0	%.178s
28053#>4	addr		x	%.178s
28054
280557	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
280569	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
28057
28058208	string		MAP\040	CCP4 Electron Density Map
28059# Assumes same stamp for float and double (normal case)
28060>212	byte		17	\b, Big-endian
28061>212	byte		34	\b, VAX format
28062>212	byte		68	\b, Little-endian
28063>212	byte		85	\b, Convex native
28064
28065############################################################
28066# X-Ray Area Detector images
280670	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
28068>796	lelong	<20		Little-endian, IP #%d,
28069>>768	lelong	>0		Size=%dx
28070>>772	lelong	>0		\b%d
28071>796	belong	<20		Big-endian, IP #%d,
28072>>768	belong	>0		Size=%dx
28073>>772	belong	>0		\b%d
28074
280750	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
28076>796	lelong	<20		Little-endian, IP #%d,
28077>>768	lelong	>0		Size=%dx
28078>>772	lelong	>0		\b%d
28079>796	belong	<20		Big-endian, IP #%d,
28080>>768	belong	>0		Size=%dx
28081>>772	belong	>0		\b%d
28082
28083
280841028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
28085>1072	ulong	>1		Compressed(%d),
28086>1100	ulong	>1		%d headers,
28087>1104	ulong	>0		%d x
28088>1108	ulong	>0		%d,
28089>1120	ulong	>0		%d bits/pixel
28090
28091# Type: GEDCOM genealogical (family history) data
28092# From: Giuseppe Bilotta
280930       search/1/c	0\ HEAD         GEDCOM genealogy text
28094>&0     search		1\ GEDC
28095>>&0    search		2\ VERS         version
28096>>>&1   string		>\0		%s
28097# From: Phil Endecott <phil05@chezphil.org>
280980	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
280990	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
281000	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
281010	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
28102
28103# PDB: Protein Data Bank files
28104# Adam Buchbinder <adam.buchbinder@gmail.com>
28105#
28106# https://www.wwpdb.org/documentation/format32/sect2.html
28107# https://www.ch.ic.ac.uk/chemime/
28108#
28109# The PDB file format is fixed-field, 80 columns. From the spec:
28110#
28111# COLS        DATA
28112#  1 -  6      "HEADER"
28113#  11 - 50     String(40)
28114#  51 - 59     Date
28115#  63 - 66     IDcode
28116#
28117# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
28118# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
28119# uppercase letters. However, examples have been seen without the date string,
28120# e.g., the example on the chemime site.
281210	string	HEADER\ \ \ \040
28122>&0	regex/1l	\^.{40}
28123>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
28124>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
28125>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
28126!:mime	chemical/x-pdb
28127>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
28128
28129# Type:	GDSII Stream file
281300	belong	0x00060002	GDSII Stream file
28131>4	byte	0x00
28132>>5	byte	x		version %d.0
28133>4	byte	>0x00		version %d
28134>>5	byte	x		\b.%d
28135
28136# Type: LXT (interLaced eXtensible Trace)
28137# chrysn <chrysn@fsfe.org>
281380	beshort	0x0138	interLaced eXtensible Trace (LXT) file
28139>2	beshort	>0	(Version %u)
28140
28141#------------------------------------------------------------------------------
28142# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
281430	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
281440	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
281450	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
28146
281470	string \0volume_key	volume_key escrow packet
28148# Type:	SE Linux policy modules *.pp reference policy
28149#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
28150# URL:	https://doc.coker.com.au/computers/selinux-magic
28151# From:	Russell Coker <russell@coker.com.au>
28152
281530		lelong	0xf97cff8f	SE Linux modular policy
28154>4		lelong	x		version %d,
28155>8		lelong	x		%d sections,
28156>>(12.l)	lelong	0xf97cff8d
28157>>>(12.l+27)	lelong	x		mod version %d,
28158>>>(12.l+31)	lelong	0		Not MLS,
28159>>>(12.l+31)	lelong	1		MLS,
28160>>>(12.l+23)	lelong	2
28161>>>>(12.l+47)	string	>\0		module name %s
28162>>>(12.l+23)	lelong	1		base
28163
281641	string	policy_module(	SE Linux policy module source
281652	string	policy_module(	SE Linux policy module source
28166
281670	string	##\ <summary>	SE Linux policy interface source
28168
28169#0	search	gen_context(	SE Linux policy file contexts
28170
28171#0	search	gen_sens(	SE Linux policy MLS constraints source
28172
28173#------------------------------------------------------------------------------
28174# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $
28175# sendmail:  file(1) magic for sendmail config files
28176#
28177# XXX - byte order?
28178#
28179# Update: Joerg Jenderek
28180# GRR: this test is too general as it catches also
28181# READ.ME.FIRST.AWP Sendmail frozen configuration
28182# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
28183# Email_23_f217153422.ts Sendmail frozen configuration
28184# - version \330jK\354
281850	byte	046
28186# https://www.sendmail.com/sm/open_source/docs/older_release_notes/
28187# freezed configuration file (dbm format?) created from sendmal.cf with -bz
28188# by older sendmail. til version 8.6 support for frozen configuration files is removed
28189# valid version numbers look like "7.14.4" and should be similar to output of commands
28190# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
28191>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
28192# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
28193!:ext fc
28194>>16	string	>\0			- version %s
281950	short	0x271c
28196# look for valid version number
28197>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
28198!:ext fc
28199>>16	string	>\0			- version %s
28200
28201#------------------------------------------------------------------------------
28202# sendmail:  file(1) magic for sendmail m4(1) files
28203#
28204# From Hendrik Scholz <hendrik@scholz.net>
28205# i.e. files in /usr/share/sendmail/cf/
28206#
282070   string  divert(-1)\n    sendmail m4 text file
28208
28209
28210#------------------------------------------------------------------------------
28211# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $
28212# sequent:  file(1) magic for Sequent machines
28213#
28214# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
28215# For Sequent's multiprocessor systems (incomplete).
282160	lelong	0x00ea        	BALANCE NS32000 .o
28217>16	lelong	>0		not stripped
28218>124	lelong	>0		version %d
282190	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
28220>16	lelong  >0            	not stripped
28221>124	lelong	>0		version %d
282220	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
28223>16	lelong  >0            	not stripped
28224>124	lelong	>0		version %d
282250	lelong	0x30ea        	BALANCE NS32000 standalone executable
28226>16	lelong  >0          	not stripped
28227>124	lelong	>0		version %d
28228#
28229# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
28230# Symmetry magic nums will not be reached if DOS COM comes before them;
28231# byte 0xeb is matched before these get a chance.
282320	leshort	0x12eb		SYMMETRY i386 .o
28233>16	lelong	>0		not stripped
28234>124	lelong	>0		version %d
282350	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
28236>16	lelong	>0		not stripped
28237>124	lelong	>0		version %d
282380	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
28239>16	lelong	>0		not stripped
28240>124	lelong	>0		version %d
28241# https://en.wikipedia.org/wiki/Sequent_Computer_Systems
28242# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
28243#0	leshort	0x42eb		SYMMETRY i386 standalone executable
282440	leshort	0x42eb
28245# skip unlike negative version
28246>124	lelong	>-1
28247# assuming version 28867614 is very low probable
28248>>124	lelong	!28867614	SYMMETRY i386 standalone executable
28249>>>16	lelong	>0		not stripped
28250>>>124	lelong	>0		version %d
28251
28252#------------------------------------------------------------------------------
28253# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
28254# sereal: file(1) magic the Sereal binary serialization format
28255#
28256# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
28257#
28258# See the specification of the format at
28259# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
28260#
28261# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
28262# doing (byte&0xF0)>>4 here, but unfortunately that's not
28263# supported. So when we print out a message about an unknown format
28264# we'll print out e.g. 0x30 instead of the more human-readable
28265# 0x30>>4.
28266#
28267# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
28268# Sereal.git repository for test Sereal data.
282690	name		sereal
28270>4	byte&0x0F	x		(version %d,
28271>4	byte&0xF0	0x00		uncompressed)
28272>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
28273>4	byte&0xF0	0x20		compressed with incremental Snappy)
28274>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
28275
282760	string/b	\=srl		Sereal data packet
28277!:mime application/sereal
28278>&0	use		sereal
282790	string/b	\=\xF3rl	Sereal data packet
28280!:mime application/sereal
28281>&0	use		sereal
282820	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
28283!:mime application/sereal
28284>&0	use		sereal
28285
28286
28287#------------------------------------------------------------------------------
28288# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $
28289# sgi:  file(1) magic for Silicon Graphics operating systems and applications
28290#
28291# Executable images are handled either in aout (for old-style a.out
28292# files for 68K; they are indistinguishable from other big-endian 32-bit
28293# a.out files) or in mips (for MIPS ECOFF and Ucode files)
28294#
28295
28296# kbd file definitions
282970	string	kbd!map		kbd map file
28298>8	byte	>0		Ver %d:
28299>10	short	>0		with %d table(s)
28300
283010	beshort	0x8765		disk quotas file
28302
283030	beshort	0x0506		IRIS Showcase file
28304>2	byte	0x49		-
28305>3	byte	x		- version %d
283060	beshort	0x0226		IRIS Showcase template
28307>2	byte	0x63		-
28308>3	byte	x		- version %d
283090	belong	0x5343464d	IRIS Showcase file
28310>4	byte	x		- version %d
283110	belong	0x5443464d	IRIS Showcase template
28312>4	byte	x		- version %d
283130	belong	0xdeadbabe	IRIX Parallel Arena
28314>8	belong	>0		- version %d
28315
28316# core files
28317#
28318# 32bit core file
283190	belong	0xdeadadb0	IRIX core dump
28320>4	belong	1		of
28321>16	string	>\0		'%s'
28322# 64bit core file
283230	belong	0xdeadad40	IRIX 64-bit core dump
28324>4	belong	1		of
28325>16	string	>\0		'%s'
28326# N32bit core file
283270       belong	0xbabec0bb	IRIX N32 core dump
28328>4      belong	1               of
28329>16     string	>\0             '%s'
28330# New style crash dump file
283310	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
28332>36	string	>\0					'%s'
28333
28334# Trusted IRIX info
283350	string	SGIAUDIT	SGI Audit file
28336>8	byte	x		- version %d
28337>9	byte	x		\b.%d
28338#
283390	string	WNGZWZSC	Wingz compiled script
283400	string	WNGZWZSS	Wingz spreadsheet
283410	string	WNGZWZHP	Wingz help file
28342#
283430	string	#Inventor\040V	IRIS Inventor 1.0 file
283440	string	#Inventor\040V2	Open Inventor 2.0 file
28345# GLF is OpenGL stream encoding
283460	string	glfHeadMagic();		GLF_TEXT
283474	belong	0x7d000000		GLF_BINARY_LSB_FIRST
28348!:strength -30
283494	belong	0x0000007d		GLF_BINARY_MSB_FIRST
28350!:strength -30
28351# GLS is OpenGL stream encoding; GLS is the successor of GLF
283520	string	glsBeginGLS(		GLS_TEXT
283534	belong	0x10000000		GLS_BINARY_LSB_FIRST
28354!:strength -30
283554	belong	0x00000010		GLS_BINARY_MSB_FIRST
28356!:strength -30
28357
28358# Performance Co-Pilot file types
283590	string	PmNs				PCP compiled namespace (V.0)
283600	string	PmN				PCP compiled namespace
28361>3	string	>\0				(V.%1.1s)
28362#3	lelong	0x84500526			PCP archive
283633	belong	0x84500526			PCP archive
28364>7	byte	x				(V.%d)
28365#>20	lelong	-2				temporal index
28366#>20	lelong	-1				metadata
28367#>20	lelong	0				log volume #0
28368#>20	lelong	>0				log volume #%d
28369>20	belong	-2				temporal index
28370>20	belong	-1				metadata
28371>20	belong	0				log volume #0
28372>20	belong	>0				log volume #%d
28373>24	string	>\0				host: %s
283740	string	PCPFolio			PCP
28375>9	string	Version:			Archive Folio
28376>18	string	>\0				(V.%s)
283770	string	#pmchart			PCP pmchart view
28378>9	string	Version
28379>17	string	>\0				(V%-3.3s)
283800	string	#kmchart			PCP kmchart view
28381>9	string	Version
28382>17	string	>\0				(V.%s)
283830	string	pmview				PCP pmview config
28384>7	string	Version
28385>15	string	>\0				(V%-3.3s)
283860	string	#pmlogger			PCP pmlogger config
28387>10	string	Version
28388>18	string	>\0				(V%1.1s)
283890	string	#pmdahotproc			PCP pmdahotproc config
28390>13	string	Version
28391>21	string	>\0				(V%-3.3s)
283920	string	PcPh				PCP Help
28393>4	string	1				Index
28394>4	string	2				Text
28395>5	string	>\0				(V.%1.1s)
283960	string	#pmieconf-rules			PCP pmieconf rules
28397>16	string	>\0				(V.%1.1s)
283983	string	pmieconf-pmie			PCP pmie config
28399>17	string	>\0				(V.%1.1s)
284000	string	MMV				PCP memory mapped values
28401>4	long	x				(V.%d)
28402
28403# SpeedShop data files
284040	lelong	0x13130303			SpeedShop data file
28405
28406# mdbm files
284070	lelong	0x01023962			mdbm file, version 0 (obsolete)
284080	string	mdbm				mdbm file,
28409>5	byte	x				version %d,
28410>6	byte	x				2^%d pages,
28411>7	byte	x				pagesize 2^%d,
28412>17	byte	x				hash %d,
28413>11	byte	x				dataformat %d
28414
28415# Alias Maya files
284160	string/t	//Maya\040ASCII	Alias Maya Ascii File,
28417>13	string	>\0	version %s
284188	string	MAYAFOR4	Alias Maya Binary File,
28419>32	string	>\0	version %s scene
284208	string	MayaFOR4	Alias Maya Binary File,
28421>32	string	>\0	version %s scene
284228	string	CIMG		Alias Maya Image File
284238	string	DEEP		Alias Maya Image File
28424
28425#------------------------------------------------------------------------------
28426# $File: sgml,v 1.41 2020/06/07 18:16:43 christos Exp $
28427# Type:	SVG Vectorial Graphics
28428# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
284290	string		\<?xml\ version=
28430>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
28431>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
28432!:mime	image/svg+xml
28433>>19	search/4096	\<gnc-v2		GnuCash file
28434!:mime	application/x-gnucash
284350	string		\<svg			SVG Scalable Vector Graphics image
28436!:mime	image/svg+xml
28437
28438# Sitemap file
284390	string/t		\<?xml\ version=
28440>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
28441>>19	search/4096	\<urlset		XML Sitemap document text
28442!:mime	application/xml-sitemap
28443
28444# OpenStreetMap XML (.osm)
28445# https://wiki.openstreetmap.org/wiki/OSM_XML
28446# From: Markus Heidelberg <markus.heidelberg@web.de>
284470	string		\<?xml\ version=
28448>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
28449>>19	search/4096	\<osm			OpenStreetMap XML data
28450
28451# xhtml
284520	string/t		\<?xml\ version="
28453>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
28454>>15	string		>\0	(version %.3s)
28455!:mime	text/html
284560	string/t		\<?xml\ version='
28457>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
28458>>15	string		>\0	(version %.3s)
28459!:mime	text/html
284600	string/t		\<?xml\ version="
28461>19	search/4096/cWbt	\<html	broken XHTML document text
28462>>15	string		>\0	(version %.3s)
28463!:mime	text/html
28464
28465#------------------------------------------------------------------------------
28466# sgml:  file(1) magic for Standard Generalized Markup Language
28467# HyperText Markup Language (HTML) is an SGML document type,
28468# from Daniel Quinlan (quinlan@yggdrasil.com)
28469# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
284700	search/4096/cWt	\<!doctype\ html	HTML document text
28471!:mime	text/html
28472!:strength + 5
28473
28474# SVG document
28475# https://www.w3.org/TR/SVG/single-page.html
284760	search/4096/cWbt	\<!doctype\ svg	SVG XML document
28477!:mime  image/svg+xml
28478!:strength + 5
28479
284800	search/4096/cwt	\<head\>		HTML document text
28481!:mime	text/html
28482!:strength + 5
284830	search/4096/cWt	\<head\ 		HTML document text
28484!:mime	text/html
28485!:strength + 5
284860	search/4096/cwt	\<title\>		HTML document text
28487!:mime	text/html
28488!:strength + 5
284890	search/4096/cWt	\<title\ 		HTML document text
28490!:mime	text/html
28491!:strength + 5
284920	search/4096/cwt	\<html\>		HTML document text
28493!:mime	text/html
28494!:strength + 5
284950	search/4096/cWt	\<html\ 		HTML document text
28496!:mime	text/html
28497!:strength + 5
284980	search/4096/cwt	\<script\> 		HTML document text
28499!:mime	text/html
28500!:strength + 5
285010	search/4096/cWt	\<script\ 		HTML document text
28502!:mime	text/html
28503!:strength + 5
285040	search/4096/cwt	\<style\> 		HTML document text
28505!:mime	text/html
28506!:strength + 5
285070	search/4096/cWt	\<style\  		HTML document text
28508!:mime	text/html
28509!:strength + 5
285100	search/4096/cwt	\<table\>		HTML document text
28511!:mime	text/html
28512!:strength + 5
285130	search/4096/cWt	\<table\ 		HTML document text
28514!:mime	text/html
28515!:strength + 5
28516
285170	search/4096/cwt	\<a\ href=		HTML document text
28518!:mime	text/html
28519!:strength + 5
28520
28521# Extensible markup language (XML), a subset of SGML
28522# from Marc Prud'hommeaux (marc@apocalypse.org)
285230	search/1/cwt	\<?xml			XML document text
28524!:mime	text/xml
28525!:strength + 5
285260	string/t		\<?xml\ version\ "	XML
28527!:mime	text/xml
28528!:strength + 5
285290	string/t		\<?xml\ version="	XML
28530!:mime	text/xml
28531!:strength + 5
28532>15	string/t	>\0			%.3s document text
28533>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
28534>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
285350	string/t	\<?xml\ version='	XML
28536!:mime	text/xml
28537!:strength + 5
28538>15	string/t	>\0			%.3s document text
28539>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
28540>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
285410	search/1/wt	\<?XML			broken XML document text
28542!:mime	text/xml
28543!:strength - 10
28544
28545
28546# SGML, mostly from rph@sq
285470	search/4096/cwt	\<!doctype		exported SGML document text
285480	search/4096/cwt	\<!subdoc		exported SGML subdocument text
285490	search/4096/cwt	\<!--			exported SGML document text
28550!:strength - 10
28551
28552# Web browser cookie files
28553# (Mozilla, Galeon, Netscape 4, Konqueror..)
28554# Ulf Harnhammar <ulfh@update.uu.se>
285550	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
285560	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
285570	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
28558
28559# XML-based format representing braille pages in a digital format.
28560#
28561# Specification:
28562# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
28563#
28564# Simon Aittamaa <simon.aittamaa@gmail.com>
285650   string      \<?xml\ version=
28566>14 regex       ['"\ \t]*[0-9.]+['"\ \t]*
28567>>19    search/4096 \<pef           Portable Embosser Format
28568!:mime  application/x-pef+xml
28569
28570#------------------------------------------------------------------------
28571# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
28572# file(1) magic for sharc files
28573#
28574# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
28575# FutureGroove Music (dsp@futuregroove.de)
28576
28577#------------------------------------------------------------------------
28578#0	string			Draw		RiscOS Drawfile
28579#0	string			PACK		RiscOS PackdDir archive
28580
28581#------------------------------------------------------------------------
28582# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
28583
28584#0	string			=!		Assembler source
28585#0	string			Analog		ADi asm listing file
285860	string			.SYSTEM		SHARC architecture file
285870	string			.system		SHARC architecture file
28588
285890	leshort			0x521C		SHARC COFF binary
28590>2	leshort			>1		, %d sections
28591>>12	lelong			>0		, not stripped
28592
28593#------------------------------------------------------------------------------
28594# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
28595# sinclair:  file(1) sinclair QL
28596
28597# additions to /etc/magic by Thomas M. Ott (ThMO)
28598
28599# Sinclair QL floppy disk formats (ThMO)
286000	string	=QL5		QL disk dump data,
28601>3	string	=A		720 KB,
28602>3	string	=B		1.44 MB,
28603>3	string	=C		3.2 MB,
28604>4	string	>\0		label:%.10s
28605
28606# Sinclair QL OS dump (ThMO)
286070		belong	=0x30000
28608>49124		belong	<47104
28609>>49128		belong	<47104
28610>>>49132	belong	<47104
28611>>>>49136	belong	<47104	QL OS dump data,
28612>>>>>49148	string	>\0	type %.3s,
28613>>>>>49142	string	>\0	version %.4s
28614
28615# Sinclair QL firmware executables (ThMO)
286160	string	NqNqNq`\004	QL firmware executable (BCPL)
28617
28618# Sinclair QL libraries (was ThMO)
286190	beshort	0xFB01		QDOS object
28620>2	pstring	x		'%s'
28621
28622# Sinclair QL executables (was ThMO)
286234	belong	0x4AFB		QDOS executable
28624>9	pstring	x		'%s'
28625
28626# Sinclair QL ROM (ThMO)
286270	belong	=0x4AFB0001	QL plugin-ROM data,
28628>9	pstring	=\0		un-named
28629>9	pstring	>\0		named: %s
28630# Type: SiSU Markup Language
28631# URL:  http://www.sisudoc.org/
28632# From: Ralph Amissah <ralph.amissah@gmail.com>
28633
286340	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
28635>5	regex	[0-9.]+				%s
28636
286370	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
28638>5	regex	[0-9.]+				%s
28639
286400	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
28641>5	regex	[0-9.]+				%s
28642
286430	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
28644>5	regex	[0-9.]+				%s
28645
286460	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
28647>5	regex	[0-9.]+				%s
28648
28649#------------------------------------------------------------------------------
28650# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
28651# Sketch Drawings: http://sketch.sourceforge.net/
28652# From: Edwin Mons <e@ik.nu>
286530	search/1	##Sketch	Sketch document text
28654
28655#-----------------------------------------------
28656# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
28657# GNU Smalltalk image, starting at version 1.6.2
28658# From: catull_us@yahoo.com
28659#
286600	string	GSTIm\0\0	GNU SmallTalk
28661# little-endian
28662>7	byte&1	=0		LE image version
28663>>10	byte	x		%d.
28664>>9	byte	x		\b%d.
28665>>8	byte	x		\b%d
28666#>>12	lelong	x		, data: %ld
28667#>>16	lelong	x		, table: %ld
28668#>>20	lelong	x		, memory: %ld
28669# big-endian
28670>7	byte&1	=1		BE image version
28671>>8	byte	x		%d.
28672>>9	byte	x		\b%d.
28673>>10	byte	x		\b%d
28674#>>12	belong	x		, data: %ld
28675#>>16	belong	x		, table: %ld
28676#>>20	belong	x		, memory: %ld
28677
28678
28679
28680#------------------------------------------------------------------------------
28681# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
28682# smile:  file(1) magic for Smile serialization
28683#
28684# The Smile serialization format uses a 4-byte header:
28685#
28686#   Constant byte #0: 0x3A (ASCII ':')
28687#   Constant byte #1: 0x29 (ASCII ')')
28688#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
28689#   Variable byte #3, consisting of bits:
28690#     Bits 4-7 (4 MSB): 4-bit version number
28691#     Bits 3: Reserved
28692#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
28693#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
28694#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
28695#
28696# Reference: http://wiki.fasterxml.com/SmileFormatSpec
28697# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
28698
28699# Detection
287000	string		:)\n	Smile binary data
28701
28702# Versioning
28703>3	byte&0xF0	x		version %d:
28704
28705# Properties
28706>3	byte&0x04	0x04		binary raw,
28707>3	byte&0x04	0x00		binary encoded,
28708>3	byte&0x02	0x02		shared String values enabled,
28709>3	byte&0x02	0x00		shared String values disabled,
28710>3	byte&0x01	0x01		shared field names enabled
28711>3	byte&0x01	0x00		shared field names disabled
28712
28713
28714#------------------------------------------------------------------------------
28715# $File: sniffer,v 1.28 2020/03/13 16:47:29 christos Exp $
28716# sniffer:  file(1) magic for packet capture files
28717#
28718# From: guy@alum.mit.edu (Guy Harris)
28719#
28720
28721#
28722# Microsoft Network Monitor 1.x capture files.
28723#
287240	string		RTSS		NetMon capture file
28725>5	byte		x		- version %d
28726>4	byte		x		\b.%d
28727>6	leshort		0		(Unknown)
28728>6	leshort		1		(Ethernet)
28729>6	leshort		2		(Token Ring)
28730>6	leshort		3		(FDDI)
28731>6	leshort		4		(ATM)
28732>6	leshort		>4		(type %d)
28733
28734#
28735# Microsoft Network Monitor 2.x capture files.
28736#
287370	string		GMBU		NetMon capture file
28738>5	byte		x		- version %d
28739>4	byte		x		\b.%d
28740>6	leshort		0		(Unknown)
28741>6	leshort		1		(Ethernet)
28742>6	leshort		2		(Token Ring)
28743>6	leshort		3		(FDDI)
28744>6	leshort		4		(ATM)
28745>6	leshort		5		(IP-over-IEEE 1394)
28746>6	leshort		6		(802.11)
28747>6	leshort		7		(Raw IP)
28748>6	leshort		8		(Raw IP)
28749>6	leshort		9		(Raw IP)
28750>6	leshort		>9		(type %d)
28751
28752#
28753# Network General Sniffer capture files.
28754# Sorry, make that "Network Associates Sniffer capture files."
28755# Sorry, make that "Network General old DOS Sniffer capture files."
28756#
287570	string		TRSNIFF\040data\040\040\040\040\032	Sniffer capture file
28758>33	byte		2		(compressed)
28759>23	leshort		x		- version %d
28760>25	leshort		x		\b.%d
28761>32	byte		0		(Token Ring)
28762>32	byte		1		(Ethernet)
28763>32	byte		2		(ARCNET)
28764>32	byte		3		(StarLAN)
28765>32	byte		4		(PC Network broadband)
28766>32	byte		5		(LocalTalk)
28767>32	byte		6		(Znet)
28768>32	byte		7		(Internetwork Analyzer)
28769>32	byte		9		(FDDI)
28770>32	byte		10		(ATM)
28771
28772#
28773# Cinco Networks NetXRay capture files.
28774# Sorry, make that "Network General Sniffer Basic capture files."
28775# Sorry, make that "Network Associates Sniffer Basic capture files."
28776# Sorry, make that "Network Associates Sniffer Basic, and Windows
28777# Sniffer Pro", capture files."
28778# Sorry, make that "Network General Sniffer capture files."
28779# Sorry, make that "NetScout Sniffer capture files."
28780#
287810	string		XCP\0		NetXRay capture file
28782>4	string		>\0		- version %s
28783>44	leshort		0		(Ethernet)
28784>44	leshort		1		(Token Ring)
28785>44	leshort		2		(FDDI)
28786>44	leshort		3		(WAN)
28787>44	leshort		8		(ATM)
28788>44	leshort		9		(802.11)
28789
28790#
28791# "libpcap" capture files.
28792# https://www.tcpdump.org/manpages/pcap-savefile.5.html
28793# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
28794# the main program that uses that format, but there are other programs
28795# that use "libpcap", or that use the same capture file format.)
28796#
287970	name		pcap-be
28798>4	beshort		x		- version %d
28799>6	beshort		x		\b.%d
28800# clear that continuation level match
28801>20	clear		x
28802>20	belong&0x03FFFFFF		0		(No link-layer encapsulation
28803>20	belong&0x03FFFFFF		1		(Ethernet
28804>20	belong&0x03FFFFFF		2		(3Mb Ethernet
28805>20	belong&0x03FFFFFF		3		(AX.25
28806>20	belong&0x03FFFFFF		4		(ProNET
28807>20	belong&0x03FFFFFF		5		(CHAOS
28808>20	belong&0x03FFFFFF		6		(Token Ring
28809>20	belong&0x03FFFFFF		7		(BSD ARCNET
28810>20	belong&0x03FFFFFF		8		(SLIP
28811>20	belong&0x03FFFFFF		9		(PPP
28812>20	belong&0x03FFFFFF		10		(FDDI
28813>20	belong&0x03FFFFFF		11		(RFC 1483 ATM
28814>20	belong&0x03FFFFFF		12		(Raw IP
28815>20	belong&0x03FFFFFF		13		(BSD/OS SLIP
28816>20	belong&0x03FFFFFF		14		(BSD/OS PPP
28817>20	belong&0x03FFFFFF		19		(Linux ATM Classical IP
28818>20	belong&0x03FFFFFF		50		(PPP or Cisco HDLC
28819>20	belong&0x03FFFFFF		51		(PPP-over-Ethernet
28820>20	belong&0x03FFFFFF		99		(Symantec Enterprise Firewall
28821>20	belong&0x03FFFFFF		100		(RFC 1483 ATM
28822>20	belong&0x03FFFFFF		101		(Raw IP
28823>20	belong&0x03FFFFFF		102		(BSD/OS SLIP
28824>20	belong&0x03FFFFFF		103		(BSD/OS PPP
28825>20	belong&0x03FFFFFF		104		(BSD/OS Cisco HDLC
28826>20	belong&0x03FFFFFF		105		(802.11
28827>20	belong&0x03FFFFFF		106		(Linux Classical IP over ATM
28828>20	belong&0x03FFFFFF		107		(Frame Relay
28829>20	belong&0x03FFFFFF		108		(OpenBSD loopback
28830>20	belong&0x03FFFFFF		109		(OpenBSD IPsec encrypted
28831>20	belong&0x03FFFFFF		112		(Cisco HDLC
28832>20	belong&0x03FFFFFF		113		(Linux cooked v1
28833>20	belong&0x03FFFFFF		114		(LocalTalk
28834>20	belong&0x03FFFFFF		117		(OpenBSD PFLOG
28835>20	belong&0x03FFFFFF		119		(802.11 with Prism header
28836>20	belong&0x03FFFFFF		122		(RFC 2625 IP over Fibre Channel
28837>20	belong&0x03FFFFFF		123		(SunATM
28838>20	belong&0x03FFFFFF		127		(802.11 with radiotap header
28839>20	belong&0x03FFFFFF		129		(Linux ARCNET
28840>20	belong&0x03FFFFFF		130		(Juniper Multi-Link PPP
28841>20	belong&0x03FFFFFF		131		(Juniper Multi-Link Frame Relay
28842>20	belong&0x03FFFFFF		132		(Juniper Encryption Services PIC
28843>20	belong&0x03FFFFFF		133		(Juniper GGSN PIC
28844>20	belong&0x03FFFFFF		134		(Juniper FRF.16 Frame Relay
28845>20	belong&0x03FFFFFF		135		(Juniper ATM2 PIC
28846>20	belong&0x03FFFFFF		136		(Juniper Advanced Services PIC
28847>20	belong&0x03FFFFFF		137		(Juniper ATM1 PIC
28848>20	belong&0x03FFFFFF		138		(Apple IP over IEEE 1394
28849>20	belong&0x03FFFFFF		139		(SS7 MTP2 with pseudo-header
28850>20	belong&0x03FFFFFF		140		(SS7 MTP2
28851>20	belong&0x03FFFFFF		141		(SS7 MTP3
28852>20	belong&0x03FFFFFF		142		(SS7 SCCP
28853>20	belong&0x03FFFFFF		143		(DOCSIS
28854>20	belong&0x03FFFFFF		144		(Linux IrDA
28855>20	belong&0x03FFFFFF		147		(Private use 0
28856>20	belong&0x03FFFFFF		148		(Private use 1
28857>20	belong&0x03FFFFFF		149		(Private use 2
28858>20	belong&0x03FFFFFF		150		(Private use 3
28859>20	belong&0x03FFFFFF		151		(Private use 4
28860>20	belong&0x03FFFFFF		152		(Private use 5
28861>20	belong&0x03FFFFFF		153		(Private use 6
28862>20	belong&0x03FFFFFF		154		(Private use 7
28863>20	belong&0x03FFFFFF		155		(Private use 8
28864>20	belong&0x03FFFFFF		156		(Private use 9
28865>20	belong&0x03FFFFFF		157		(Private use 10
28866>20	belong&0x03FFFFFF		158		(Private use 11
28867>20	belong&0x03FFFFFF		159		(Private use 12
28868>20	belong&0x03FFFFFF		160		(Private use 13
28869>20	belong&0x03FFFFFF		161		(Private use 14
28870>20	belong&0x03FFFFFF		162		(Private use 15
28871>20	belong&0x03FFFFFF		163		(802.11 with AVS header
28872>20	belong&0x03FFFFFF		164		(Juniper Passive Monitor PIC
28873>20	belong&0x03FFFFFF		165		(BACnet MS/TP
28874>20	belong&0x03FFFFFF		166		(PPPD
28875>20	belong&0x03FFFFFF		167		(Juniper PPPoE
28876>20	belong&0x03FFFFFF		168		(Juniper PPPoE/ATM
28877>20	belong&0x03FFFFFF		169		(GPRS LLC
28878>20	belong&0x03FFFFFF		170		(GPF-T
28879>20	belong&0x03FFFFFF		171		(GPF-F
28880>20	belong&0x03FFFFFF		174		(Juniper PIC Peer
28881>20	belong&0x03FFFFFF		175		(Ethernet with Endace ERF header
28882>20	belong&0x03FFFFFF		176		(Packet-over-SONET with Endace ERF header
28883>20	belong&0x03FFFFFF		177		(Linux LAPD
28884>20	belong&0x03FFFFFF		178		(Juniper Ethernet
28885>20	belong&0x03FFFFFF		179		(Juniper PPP
28886>20	belong&0x03FFFFFF		180		(Juniper Frame Relay
28887>20	belong&0x03FFFFFF		181		(Juniper C-HDLC
28888>20	belong&0x03FFFFFF		182		(FRF.16 Frame Relay
28889>20	belong&0x03FFFFFF		183		(Juniper Voice PIC
28890>20	belong&0x03FFFFFF		184		(Arinc 429
28891>20	belong&0x03FFFFFF		185		(Arinc 653 Interpartition Communication
28892>20	belong&0x03FFFFFF		186		(USB with FreeBSD header
28893>20	belong&0x03FFFFFF		187		(Bluetooth HCI H4
28894>20	belong&0x03FFFFFF		188		(802.16 MAC Common Part Sublayer
28895>20	belong&0x03FFFFFF		189		(Linux USB
28896>20	belong&0x03FFFFFF		190		(Controller Area Network (CAN) v. 2.0B
28897>20	belong&0x03FFFFFF		191		(802.15.4 with Linux padding
28898>20	belong&0x03FFFFFF		192		(PPI
28899>20	belong&0x03FFFFFF		193		(802.16 MAC Common Part Sublayer plus radiotap header
28900>20	belong&0x03FFFFFF		194		(Juniper Integrated Service Module
28901>20	belong&0x03FFFFFF		195		(802.15.4 with FCS
28902>20	belong&0x03FFFFFF		196		(SITA
28903>20	belong&0x03FFFFFF		197		(Endace ERF
28904>20	belong&0x03FFFFFF		198		(Ethernet with u10 Networks pseudo-header
28905>20	belong&0x03FFFFFF		199		(IPMB
28906>20	belong&0x03FFFFFF		200		(Juniper Secure Tunnel
28907>20	belong&0x03FFFFFF		201		(Bluetooth HCI H4 with pseudo-header
28908>20	belong&0x03FFFFFF		202		(AX.25 with KISS header
28909>20	belong&0x03FFFFFF		203		(LAPD
28910>20	belong&0x03FFFFFF		204		(PPP with direction pseudo-header
28911>20	belong&0x03FFFFFF		205		(Cisco HDLC with direction pseudo-header
28912>20	belong&0x03FFFFFF		206		(Frame Relay with direction pseudo-header
28913>20	belong&0x03FFFFFF		209		(Linux IPMB
28914>20	belong&0x03FFFFFF		215		(802.15.4 with non-ASK PHY header
28915>20	belong&0x03FFFFFF		216		(Linux evdev events
28916>20	belong&0x03FFFFFF		219		(MPLS with label as link-layer header
28917>20	belong&0x03FFFFFF		220		(Memory-mapped Linux USB
28918>20	belong&0x03FFFFFF		221		(DECT
28919>20	belong&0x03FFFFFF		222		(AOS Space Data Link protocol
28920>20	belong&0x03FFFFFF		223		(Wireless HART
28921>20	belong&0x03FFFFFF		224		(Fibre Channel FC-2
28922>20	belong&0x03FFFFFF		225		(Fibre Channel FC-2 with frame delimiters
28923>20	belong&0x03FFFFFF		226		(Solaris IPNET
28924>20	belong&0x03FFFFFF		227		(SocketCAN
28925>20	belong&0x03FFFFFF		228		(Raw IPv4
28926>20	belong&0x03FFFFFF		229		(Raw IPv6
28927>20	belong&0x03FFFFFF		230		(802.15.4 without FCS
28928>20	belong&0x03FFFFFF		231		(D-Bus messages
28929>20	belong&0x03FFFFFF		232		(Juniper Virtual Server
28930>20	belong&0x03FFFFFF		233		(Juniper SRX E2E
28931>20	belong&0x03FFFFFF		234		(Juniper Fibre Channel
28932>20	belong&0x03FFFFFF		235		(DVB-CI
28933>20	belong&0x03FFFFFF		236		(MUX27010
28934>20	belong&0x03FFFFFF		237		(STANAG 5066 D_PDUs
28935>20	belong&0x03FFFFFF		238		(Juniper ATM CEMIC
28936>20	belong&0x03FFFFFF		239		(Linux netfilter log messages
28937>20	belong&0x03FFFFFF		240		(Hilscher netAnalyzer
28938>20	belong&0x03FFFFFF		241		(Hilscher netAnalyzer with delimiters
28939>20	belong&0x03FFFFFF		242		(IP-over-Infiniband
28940>20	belong&0x03FFFFFF		243		(MPEG-2 Transport Stream packets
28941>20	belong&0x03FFFFFF		244		(ng4t ng40
28942>20	belong&0x03FFFFFF		245		(NFC LLCP
28943>20	belong&0x03FFFFFF		246		(Packet filter state syncing
28944>20	belong&0x03FFFFFF		247		(InfiniBand
28945>20	belong&0x03FFFFFF		248		(SCTP
28946>20	belong&0x03FFFFFF		249		(USB with USBPcap header
28947>20	belong&0x03FFFFFF		250		(Schweitzer Engineering Laboratories RTAC packets
28948>20	belong&0x03FFFFFF		251		(Bluetooth Low Energy air interface
28949>20	belong&0x03FFFFFF		252		(Wireshark Upper PDU export
28950>20	belong&0x03FFFFFF		253		(Linux netlink
28951>20	belong&0x03FFFFFF		254		(Bluetooth Linux Monitor
28952>20	belong&0x03FFFFFF		255		(Bluetooth Basic Rate/Enhanced Data Rate baseband packets
28953>20	belong&0x03FFFFFF		256		(Bluetooth Low Energy air interface with pseudo-header
28954>20	belong&0x03FFFFFF		257		(PROFIBUS data link layer
28955>20	belong&0x03FFFFFF		258		(Apple DLT_PKTAP
28956>20	belong&0x03FFFFFF		259		(Ethernet with 802.3 Clause 65 EPON preamble
28957>20	belong&0x03FFFFFF		260		(IPMI trace packets
28958>20	belong&0x03FFFFFF		261		(Z-Wave RF profile R1 and R2 packets
28959>20	belong&0x03FFFFFF		262		(Z-Wave RF profile R3 packets
28960>20	belong&0x03FFFFFF		263		(WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto
28961>20	belong&0x03FFFFFF		264		(ISO 14443 messages
28962>20	belong&0x03FFFFFF		265		(IEC 62106 Radio Data System groups
28963>20	belong&0x03FFFFFF		266		(USB with Darwin header
28964>20	belong&0x03FFFFFF		267		(OpenBSD DLT_OPENFLOW
28965>20	belong&0x03FFFFFF		268		(IBM SDLC frames
28966>20	belong&0x03FFFFFF		269		(TI LLN sniffer frames
28967>20	belong&0x03FFFFFF		271		(Linux vsock
28968>20	belong&0x03FFFFFF		272		(Nordic Semiconductor Bluetooth LE sniffer frames
28969>20	belong&0x03FFFFFF		273		(Excentis XRA-31 DOCSIS 3.1 RF sniffer frames
28970>20	belong&0x03FFFFFF		274		(802.3br mPackets
28971>20	belong&0x03FFFFFF		275		(DisplayPort AUX channel monitoring data
28972>20	belong&0x03FFFFFF		276		(Linux cooked v2
28973>20	belong&0x03FFFFFF		278		(OpenVizsla USB
28974>20	belong&0x03FFFFFF		279		(Elektrobit High Speed Capture and Replay (EBHSCR)
28975>20	belong&0x03FFFFFF		281		(Broadcom tag
28976>20	belong&0x03FFFFFF		282		(Broadcom tag (prepended)
28977>20	belong&0x03FFFFFF		284		(Marvell DSA
28978>20	belong&0x03FFFFFF		285		(Marvell EDSA
28979# print default match
28980>20	default		x
28981>>20	belong		x		(linktype#%u
28982>16	belong		x		\b, capture length %u)
28983
28984# packets time stamps in seconds and microseconds.
289850	ubelong		0xa1b2c3d4	pcap capture file, microseconds ts (big-endian)
28986!:mime	application/vnd.tcpdump.pcap
28987>0	use	pcap-be
289880	ulelong		0xa1b2c3d4	pcap capture file, microsecond ts (little-endian)
28989!:mime	application/vnd.tcpdump.pcap
28990>0	use	\^pcap-be
28991
28992# packets time stamps in seconds and nanoseconds.
289930	ubelong		0xa1b23c4d	pcap capture file, nanosecond ts (big-endian)
28994!:mime	application/vnd.tcpdump.pcap
28995>0	use	pcap-be
289960	ulelong		0xa1b23c4d	pcap capture file, nanosecond ts (little-endian)
28997!:mime	application/vnd.tcpdump.pcap
28998>0	use	\^pcap-be
28999
29000#
29001# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
29002#
290030	ubelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (big-endian)
29004>0	use	pcap-be
290050	ulelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (little-endian)
29006>0	use	\^pcap-be
29007
29008#
29009# "pcapng" capture files.
29010# https://github.com/pcapng/pcapng
29011# Pcapng files can contain multiple sections. Printing the endianness,
29012# snaplen, or other information from the first SHB may be misleading.
29013#
290140	ubelong		0x0a0d0d0a
29015>8	ubelong		0x1a2b3c4d	pcapng capture file
29016>>12	beshort		x		- version %d
29017>>14	beshort		x		\b.%d
290180	ulelong		0x0a0d0d0a
29019>8	ulelong		0x1a2b3c4d	pcapng capture file
29020>>12	leshort		x		- version %d
29021>>14	leshort		x		\b.%d
29022
29023#
29024# AIX "iptrace" capture files.
29025#
290260	string		iptrace\0401.0	AIX iptrace capture file
290270	string		iptrace\0402.0	AIX iptrace capture file
29028
29029#
29030# Novell LANalyzer capture files.
29031#
290320	leshort		0x1001		Novell LANalyzer capture file
290330	leshort		0x1007		Novell LANalyzer capture file
29034
29035#
29036# HP-UX "nettl" capture files.
29037#
290380	string		\x54\x52\x00\x64\x00	HP/UX nettl capture file
29039
29040#
29041# RADCOM WAN/LAN Analyzer capture files.
29042#
290430	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
29044
29045#
29046# NetStumbler log files.  Not really packets, per se, but about as
29047# close as you can get.  These are log files from NetStumbler, a
29048# Windows program, that scans for 802.11b networks.
29049#
290500	string		NetS		NetStumbler log file
29051>8	lelong		x		\b, %d stations found
29052
29053#
29054# *Peek tagged capture files.
29055#
290560	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
29057
29058#
29059# Visual Networks traffic capture files.
29060#
290610	string		\x05VNF		Visual Networks traffic capture file
29062
29063#
29064# Network Instruments Observer capture files.
29065#
290660	string		ObserverPktBuffe	Network Instruments Observer capture file
29067
29068#
29069# Files from Accellent Group's 5View products.
29070#
290710	string		\xaa\xaa\xaa\xaa	5View capture file
29072
29073#------------------------------------------------------------------------------
29074# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
29075# softquad:  file(1) magic for SoftQuad Publishing Software
29076#
29077# Author/Editor and RulesBuilder
29078#
29079# XXX - byte order?
29080#
290810	string		\<!SQ\ DTD>	Compiled SGML rules file
29082>9	string		>\0		 Type %s
290830	string		\<!SQ\ A/E>	A/E SGML Document binary
29084>9	string		>\0		 Type %s
290850	string		\<!SQ\ STS>	A/E SGML binary styles file
29086>9	string		>\0		 Type %s
290870	short		0xc0de		Compiled PSI (v1) data
290880	short		0xc0da		Compiled PSI (v2) data
29089>3	string		>\0		(%s)
29090# Binary sqtroff font/desc files...
290910	short		0125252		SoftQuad DESC or font file binary
29092>2	short		>0		- version %d
29093# Bitmaps...
290940	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
29095#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
29096# sqtroff intermediate language (replacement for ditroff int. lang.)
290970	string		X\ 		SoftQuad troff Context intermediate
29098>2	string		495		for AT&T 495 laser printer
29099>2	string		hp		for Hewlett-Packard LaserJet
29100>2	string		impr		for IMAGEN imPRESS
29101>2	string		ps		for PostScript
29102
29103# From: Michael Piefel <piefel@debian.org>
29104# sqtroff intermediate language (replacement for ditroff int. lang.)
291050	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
291060	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
291070	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
291080	string		X\ ps		SoftQuad troff Context intermediate for PostScript
29109
29110#------------------------------------------------------------------------------
29111# $File: sosi,v 1.1 2019/05/20 17:25:09 christos Exp $
29112# SOSI
29113# Summary: Systematic Organization of Spatial Information
29114# Long description: Norwegian text based map format
29115# File extension: .sos
29116# Full name:    Petter Reinholdtsen (pere@hungry.com)
29117# Reference: https://en.wikipedia.org/wiki/SOSI
29118#
29119# Example SOSI files available from
29120# https://trac.osgeo.org/gdal/ticket/3638
29121# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/
29122# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/
29123#
29124# Start with optional comments (from "!" to the next line end)
29125# followed by ".HODE" and end with "\n.SLUTT" followed by an optional
29126# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at
29127# the start and following ".HODE" near the start there is "..OMR=C3=85DE"
29128# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on
29129# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a
29130# separator, as well as "..SOSI-VERSJON " followed by the format
29131# version and a separator.
29132#
29133# FIXME figure out how to accept any of [space], [tab], [newline] and
29134# [carrige return] as separators, not only line end.
29135
29136# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8
29137# character sets
291380	search	..OMR
29139>0	search	..TRANSPAR
29140>>0       search  .HODE           SOSI map data
29141>>>&0      search  ..SOSI-VERSJON
29142>>>>&1	string	x		\b, version %s
29143# FIXME could not figure out way to make a match for .SLUTT at the end required
29144#>-7      string  \n.SLUTT	slutt
29145#>-8      string  \n.SLUTT\n	slutt-nl
29146#>-9      string  \n.SLUTT\r\n	slutt-crnl2
29147!:mime text/vnd.sosi
29148!:ext sos
29149
29150#------------------------------------------------------------------------------
29151# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
29152# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
29153#
29154# Cloyce D. Spradling <cloyce@headgear.org>
29155
291560	string	spec			SPEC
29157>4	string	.cpu			CPU
29158>>8	string	<:			\b%.4s
29159>>12	string	.			raw result text
29160
2916117	string	version=SPECjbb		SPECjbb
29162>32	string	<:			\b%.4s
29163>>37	string	<:			v%.4s raw result text
29164
291650	string	BEGIN\040SPECWEB	SPECweb
29166>13	string	<:			\b%.2s
29167>>15	string	_SSL			\b_SSL
29168>>>20	string	<:			v%.4s raw result text
29169>>16	string	<:			v%.4s raw result text
29170
29171#------------------------------------------------------------------------------
29172# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $
29173# spectrum:  file(1) magic for Spectrum emulator files.
29174#
29175# John Elliott <jce@seasip.demon.co.uk>
29176
29177#
29178# Spectrum +3DOS header
29179#
291800       string          PLUS3DOS\032    Spectrum +3 data
29181>15     byte            0               - BASIC program
29182>15     byte            1               - number array
29183>15     byte            2               - character array
29184>15     byte            3               - memory block
29185>>16    belong          0x001B0040      (screen)
29186>15     byte            4               - Tasword document
29187>15     string          TAPEFILE        - ZXT tapefile
29188#
29189# Tape file. This assumes the .TAP starts with a Spectrum-format header,
29190# which nearly all will.
29191#
29192# Update: Sanity-check string contents to be printable.
29193#  -Adam Buchbinder <adam.buchbinder@gmail.com>
29194#
291950       string          \023\000\000
29196>4      string          >\0
29197>>4     string          <\177           Spectrum .TAP data "%-10.10s"
29198>>>3    byte            0               - BASIC program
29199>>>3    byte            1               - number array
29200>>>3    byte            2               - character array
29201>>>3    byte            3               - memory block
29202>>>>14  belong          0x001B0040      (screen)
29203
29204# The following three blocks are from pak21-spectrum@srcf.ucam.org
29205# TZX tape images
292060      string          ZXTape!\x1a     Spectrum .TZX data
29207>8     byte            x               version %d
29208>9     byte            x               \b.%d
29209
29210# RZX input recording files
292110      string          RZX!            Spectrum .RZX data
29212>4     byte            x               version %d
29213>5     byte            x               \b.%d
29214
29215# Floppy disk images
292160      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
292170      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
292180      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
292190      string          SINCLAIR        Spectrum .SCL Betadisk image
29220
29221# Hard disk images
292220      string          RS-IDE\x1a      Spectrum .HDF hard disk image
29223>7     byte            x               \b, version 0x%02x
29224
29225# SZX snapshots (fuse and spectaculator)
29226# Martin M. S. Pedersen <martin@linux.com>
29227# http://www.spectaculator.com/docs/zx-state/header.shtml
29228#
292290      string		ZXST	       zx-state snapshot
29230>4     byte		x	       version %d
29231>5     byte		x	       \b.%d
29232>>6    byte		0	       16k ZX Spectrum
29233>>6    byte		1	       48k ZX Spectrum/ZX Spectrum+
29234>>6    byte		2	       ZX Spectrum 128
29235>>6    byte		3	       ZX Spectrum +2
29236>>6    byte		4	       ZX Spectrum +2A/+2B
29237>>6    byte		5	       ZX Spectrum +3
29238>>6    byte		6	       ZX Spectrum +3e
29239>>6    byte		7	       Pentagon 128
29240>>6    byte		8	       Timex Sinclair TC2048
29241>>6    byte		9	       Timex Sinclair TC2068
29242>>6    byte	       10	       Scorpion ZS-256
29243>>6    byte	       11	       ZX Spectrum SE
29244>>6    byte	       12	       Timex Sinclair TS2068
29245>>6    byte	       13	       Pentagon 512
29246>>6    byte	       14	       Pentagon 1024
29247>>6    byte	       15	       48k ZX Spectrum (NTSC)
29248>>6    byte	       16	       ZX Spectrum 12Ke
29249>>>7   byte		1	       (alternate timings)
29250
29251#------------------------------------------------------------------------------
29252# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $
29253# sql:  file(1) magic for SQL files
29254#
29255# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
29256# Recognize some MySQL files.
29257# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
29258# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
29259#
292600	beshort			0xfe01		MySQL table definition file
29261>2	byte			x		Version %d
29262>3	byte			0		\b, type UNKNOWN
29263>3	byte			1		\b, type DIAM_ISAM
29264>3	byte			2		\b, type HASH
29265>3	byte			3		\b, type MISAM
29266>3	byte			4		\b, type PISAM
29267>3	byte			5		\b, type RMS_ISAM
29268>3	byte			6		\b, type HEAP
29269>3	byte			7		\b, type ISAM
29270>3	byte			8		\b, type MRG_ISAM
29271>3	byte			9		\b, type MYISAM
29272>3	byte			10		\b, type MRG_MYISAM
29273>3	byte			11		\b, type BERKELEY_DB
29274>3	byte			12		\b, type INNODB
29275>3	byte			13		\b, type GEMINI
29276>3	byte			14		\b, type NDBCLUSTER
29277>3	byte			15		\b, type EXAMPLE_DB
29278>3	byte			16		\b, type CSV_DB
29279>3	byte			17		\b, type FEDERATED_DB
29280>3	byte			18		\b, type BLACKHOLE_DB
29281>3	byte			19		\b, type PARTITION_DB
29282>3	byte			20		\b, type BINLOG
29283>3	byte			21		\b, type SOLID
29284>3	byte			22		\b, type PBXT
29285>3	byte			23		\b, type TABLE_FUNCTION
29286>3	byte			24		\b, type MEMCACHE
29287>3	byte			25		\b, type FALCON
29288>3	byte			26		\b, type MARIA
29289>3	byte			27		\b, type PERFORMANCE_SCHEMA
29290>3	byte			127		\b, type DEFAULT
29291>0x0033	ulong			x		\b, MySQL version %d
292920	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
29293>3	byte			x		Version %d
292940	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
29295>3	byte			x		Version %d
292960	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
29297>3	byte			x		Version %d
29298>14	beshort			x		\b, %d key parts
29299>16	beshort			x		\b, %d unique key parts
29300>18	byte			x		\b, %d keys
29301>28	bequad			x		\b, %lld records
29302>36	bequad			x		\b, %lld deleted records
293030	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
29304>3	byte			x		Version %d
293050	belong&0xffffff00	0xfefe0900	MySQL Maria index file
29306>3	byte			x		Version %d
293070	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
29308>3	byte			x		Version %d
293090	belong&0xffffff00	0xfefe0c00
29310>4	string			MACF		MySQL Maria control file
29311>>3	byte			x		Version %d
293120	string			\376bin	MySQL replication log,
29313>9	long			x		server id %d
29314>8	byte			1
29315>>13	long			69		\b, MySQL V3.2.3
29316>>>19	string			x		\b, server version %s
29317>>13	long			75		\b, MySQL V4.0.2-V4.1
29318>>>25	string			x		\b, server version %s
29319>8	byte			15		MySQL V5+,
29320>>25	string			x		server version %s
29321>4	string			MARIALOG	MySQL Maria transaction log file
29322>>3	byte			x		Version %d
29323
29324#------------------------------------------------------------------------------
29325# iRiver H Series database file
29326# From Ken Guest <ken@linux.ie>
29327# As observed from iRivNavi.iDB and unencoded firmware
29328#
293290   string		iRivDB	iRiver Database file
29330>11  string	>\0	Version %s
29331>39  string		iHP-100	[H Series]
29332
29333#------------------------------------------------------------------------------
29334# SQLite database files
29335# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
29336#
29337# Version 1 used GDBM internally; its files cannot be distinguished
29338# from other GDBM files.
29339#
29340# Version 2 used this format:
293410	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
29342
29343# Version 3 of SQLite allows applications to embed their own "user version"
29344# number in the database at offset 60.  Later, SQLite added an "application id"
29345# at offset 68 that is preferred over "user version" for indicating the
29346# associated application.
29347#
293480   string  SQLite\ format\ 3	SQLite 3.x database
29349!:mime	application/x-sqlite3
29350# seldom found extension sqlite3 like in SyncData.sqlite3
29351# db
29352# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
29353# Unfortunately extension sqlite also used for other databases starting with string
29354# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
29355# and with string "ZV-zlib" in like extra.sqlite
29356!:ext sqlite/sqlite3/db/dbe
29357>60 belong  =0x5f4d544e  (Monotone source repository)
29358>68 belong  =0x0f055112  (Fossil checkout)
29359>68 belong  =0x0f055113  (Fossil global configuration)
29360>68 belong  =0x0f055111  (Fossil repository)
29361>68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
29362>68 belong  =0x42654c6e  (Bentley Systems Localization File)
29363>68 belong  =0x47504b47  (OGC GeoPackage file)
29364>68 default x
29365>>68 belong  !0          \b, application id %u
29366>>60 belong  !0          \b, user version %d
29367>96 belong  x            \b, last written using SQLite version %d
29368
29369
29370# SQLite Write-Ahead Log from SQLite version >= 3.7.0
29371# https://www.sqlite.org/fileformat.html#walformat
293720	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
29373!:ext sqlite-wal/db-wal
29374>4	belong	x	version %d
29375
29376# SQLite Rollback Journal
29377# https://www.sqlite.org/fileformat.html#rollbackjournal
293780	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
29379
29380# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
29381# https://github.com/PredatH0r/ChanSort
293820	string		PSDB\0			Panasonic channel list DataBase
29383!:ext db/bin
29384#!:mime	application/x-db-svl-panasonic
29385>126	string		SQLite\ format\ 3
29386#!:mime	application/x-panasonic-sqlite3
29387>>&-15	indirect	x			\b; contains
29388
29389# H2 Database from https://www.h2database.com/
293900	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
29391# Type:	OpenSSH key files
29392# From:	Nicolas Collignon <tsointsoin@gmail.com>
29393
293940	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
29395>28	string	>\0			version %s
293960	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
29397
293980	string	ssh-dss\ 		OpenSSH DSA public key
293990	string	ssh-rsa\ 		OpenSSH RSA public key
294000	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
294010	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
294020	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
294030	string	ssh-ed25519		OpenSSH ED25519 public key
29404
294050	string	SSHKRL\n\0
29406>8	ubelong	1		OpenSSH key/certificate revocation list, format %u
29407>>12	ubequad	x		\b, version %llx
29408>>>20	beqdate	x		\b, generated %s
29409
29410# From:		Joerg Jenderek
29411# URL:		https://en.wikipedia.org/wiki/PuTTY
29412# Reference:	https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz
29413#		/sshpubk.c
294140	string		PuTTY-User-Key-File-	PuTTY Private Key File
29415#!:mime	text/plain
29416# https://github.com/github/putty/blob/master/windows/installer.wxs
29417!:mime	application/x-putty-private-key
29418!:ext	ppk
29419# version 1 or 2
29420>20	string		x			\b, version %.1s
29421# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519
29422>23	string		x			\b, algorithm %s
29423# next line says "Encryption: " plus an encryption type like aes256-cbc or none
29424>32	search/13	Encryption:\040		\b, Encryption
29425>>&0	string		x			%s
29426# next line says "Comment: " plus the comment string
29427>>>&0	search/3	Comment:\040
29428>>>>&0	string		x			"%s"
29429
29430
29431#------------------------------------------------------------------------------
29432# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
29433# ssl:  file(1) magic for SSL file formats
29434
29435# Type: OpenSSL certificates/key files
29436# From: Nicolas Collignon <tsointsoin@gmail.com>
29437
294380	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
294390	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
294400	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
294410	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
294420	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
294430	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
29444
29445# From Luc Gommans
29446# OpenSSL enc file (recognized by a magic string preceding the password's salt)
294470	string	Salted__	openssl enc'd data with salted password
29448# Using the -a or -base64 option, OpenSSL will base64-encode the data.
294490	string U2FsdGVkX1	openssl enc'd data with salted password, base64 encoded
29450
29451#------------------------------------------------------------------------------
29452# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $
29453# sun:  file(1) magic for Sun machines
29454#
29455# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
29456# releases.  (5.x uses ELF.)  Entries for executables without an
29457# architecture type, used before the 68020-based Sun-3's came out,
29458# are in aout, as they're indistinguishable from other big-endian
29459# 32-bit a.out files.
29460#
294610	belong&077777777	0600413		a.out SunOS SPARC demand paged
29462>0	byte		&0x80
29463>>20	belong		<4096		shared library
29464>>20	belong		=4096		dynamically linked executable
29465>>20	belong		>4096		dynamically linked executable
29466>0	byte		^0x80		executable
29467>16	belong		>0		not stripped
29468
294690	belong&077777777	0600410		a.out SunOS SPARC pure
29470>0	byte		&0x80		dynamically linked executable
29471>0	byte		^0x80		executable
29472>16	belong		>0		not stripped
29473
294740	belong&077777777	0600407		a.out SunOS SPARC
29475>0	byte		&0x80		dynamically linked executable
29476>0	byte		^0x80		executable
29477>16	belong		>0		not stripped
29478
294790	belong&077777777	0400413		a.out SunOS mc68020 demand paged
29480>0	byte		&0x80
29481>>20	belong		<4096		shared library
29482>>20	belong		=4096		dynamically linked executable
29483>>20	belong		>4096		dynamically linked executable
29484>0	byte		^0x80		executable
29485>16	belong		>0		not stripped
29486
294870	belong&077777777	0400410		a.out SunOS mc68020 pure
29488>0	byte		&0x80		dynamically linked executable
29489>0	byte		^0x80		executable
29490>16	belong		>0		not stripped
29491
294920	belong&077777777	0400407		a.out SunOS mc68020
29493>0	byte		&0x80		dynamically linked executable
29494>0	byte		^0x80		executable
29495>16	belong		>0		not stripped
29496
294970	belong&077777777	0200413		a.out SunOS mc68010 demand paged
29498>0	byte		&0x80
29499>>20	belong		<4096		shared library
29500>>20	belong		=4096		dynamically linked executable
29501>>20	belong		>4096		dynamically linked executable
29502>0	byte		^0x80		executable
29503>16	belong		>0		not stripped
29504
295050	belong&077777777	0200410		a.out SunOS mc68010 pure
29506>0	byte		&0x80		dynamically linked executable
29507>0	byte		^0x80		executable
29508>16	belong		>0		not stripped
29509
295100	belong&077777777	0200407		a.out SunOS mc68010
29511>0	byte		&0x80		dynamically linked executable
29512>0	byte		^0x80		executable
29513>16	belong		>0		not stripped
29514
29515#
29516# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
29517# binary executed in compatibility mode under SunOS 5.x".
29518#
295190	belong		0x080456	SunOS core file
29520>4	belong		432		(SPARC)
29521>>132	string		>\0		from '%s'
29522>>116	belong		=3		(quit)
29523>>116	belong		=4		(illegal instruction)
29524>>116	belong		=5		(trace trap)
29525>>116	belong		=6		(abort)
29526>>116	belong		=7		(emulator trap)
29527>>116	belong		=8		(arithmetic exception)
29528>>116	belong		=9		(kill)
29529>>116	belong		=10		(bus error)
29530>>116	belong		=11		(segmentation violation)
29531>>116	belong		=12		(bad argument to system call)
29532>>116	belong		=29		(resource lost)
29533>>120	belong		x		(T=%dK,
29534>>124	belong		x		D=%dK,
29535>>128	belong		x		S=%dK)
29536>4	belong		826		(68K)
29537>>128	string		>\0		from '%s'
29538>4	belong		456		(SPARC 4.x BCP)
29539>>152	string		>\0		from '%s'
29540# Sun SunPC
295410	long		0xfa33c08e	SunPC 4.0 Hard Disk
295420	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
29543# Sun snoop (see RFC 1761, which describes the capture file format,
29544# RFC 3827, which describes some additional datalink types, and
29545# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
29546# which is the IANA registry of Snoop datalink types)
29547#
295480	string		snoop		Snoop capture file
29549>8	belong		>0		- version %d
29550>12	belong		0		(IEEE 802.3)
29551>12	belong		1		(IEEE 802.4)
29552>12	belong		2		(IEEE 802.5)
29553>12	belong		3		(IEEE 802.6)
29554>12	belong		4		(Ethernet)
29555>12	belong		5		(HDLC)
29556>12	belong		6		(Character synchronous)
29557>12	belong		7		(IBM channel-to-channel adapter)
29558>12	belong		8		(FDDI)
29559>12	belong		9		(Other)
29560>12	belong		10		(type %d)
29561>12	belong		11		(type %d)
29562>12	belong		12		(type %d)
29563>12	belong		13		(type %d)
29564>12	belong		14		(type %d)
29565>12	belong		15		(type %d)
29566>12	belong		16		(Fibre Channel)
29567>12	belong		17		(ATM)
29568>12	belong		18		(ATM Classical IP)
29569>12	belong		19		(type %d)
29570>12	belong		20		(type %d)
29571>12	belong		21		(type %d)
29572>12	belong		22		(type %d)
29573>12	belong		23		(type %d)
29574>12	belong		24		(type %d)
29575>12	belong		25		(type %d)
29576>12	belong		26		(IP over Infiniband)
29577>12	belong		>26		(type %d)
29578
29579#---------------------------------------------------------------------------
29580# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
29581# lead Sun/Cobalt developer) who agrees that they are good and worthy of
29582# inclusion.
29583
29584# Boot ROM images for Sun/Cobalt Linux server appliances
295850       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
29586>38     string x        V%.4s
29587
29588# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
29589# at the very end where file(1) can't get it.
295900       string CRfs     COBALT boot rom data (Flat boot rom or file system)
29591
29592#------------------------------------------------------------------------------
29593# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $
29594# sylk:  file(1) magic for SYLK text files
29595
29596# From:	Joerg Jenderek
29597# URL:	https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29
29598#	http://fileformats.archiveteam.org/wiki/SYLK
29599# Note:	called by TrID "SYLK - SYmbolic LinK data",
29600#	by DROID "Microsoft Symbolic Link (SYLK) File"
29601#	by FreeDesktop.org "spreadsheet interchange document"
296020	string		ID;P
29603# skip short DROID x-fmt-106-signature-id-603.slk
29604>7	ubyte		>0		spreadsheet interchange document
29605# https://reposcope.com/mimetype/text/spreadsheet
29606#!:mime	text/spreadsheet
29607# https://reposcope.com/mimetype/application/x-sylk	by Gnumeric
29608!:mime	application/x-sylk
29609!:ext	slk/sylk
29610>>4	ubyte		>037		\b, created by
29611# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice
29612# MP~Multiplan, XL~Excel WXL~Excel Windows
29613>>>4	string		Gnumeric	Gnumeric
29614>>>4	string		pmw		PlanMaker
29615>>>4	string		CALCOOO32	Libre/OpenOffice Calc
29616>>>4	string		SCALC3		StarOffice Calc
29617>>>4	string		XL		Excel
29618# Excel, version probably running on Windows
29619>>>4	string		WXL		Excel
29620# not tested
29621>>>4	string		MP		Multiplan
29622# unknown spreadsheet software
29623>>>4	default		x
29624>>>>4	string		x		%s
29625
29626
29627
29628#------------------------------------------------------------------------------
29629# msx:  file(1) magic for the SymbOS operating system
29630# http://www.symbos.de
29631# Fabio R. Schmidlin <frs@pop.com.br>
29632
29633# SymbOS EXE file
296340x30	string		SymExe		SymbOS executable
29635>0x36	ubyte		x		v%c
29636>0x37	ubyte		x		\b.%c
29637>0xF	string		x		\b, name: %s
29638
29639# SymbOS DOX document
296400	string		INFOq\0		SymbOS DOX document
29641
29642# Symbos driver
296430	string		SMD1		SymbOS driver
29644>19	byte		x		\b, name: %c
29645>20	byte		x		\b%c
29646>21	byte		x		\b%c
29647>22	byte		x		\b%c
29648>23	byte		x		\b%c
29649>24	byte		x		\b%c
29650>25	byte		x		\b%c
29651>26	byte		x		\b%c
29652>27	byte		x		\b%c
29653>28	byte		x		\b%c
29654>29	byte		x		\b%c
29655>30	byte		x		\b%c
29656>31	byte		x		\b%c
29657
29658# Symbos video
296590	string		SymVid		SymbOS video
29660>6	ubyte		x		v%c
29661>7	ubyte		x		\b.%c
29662
29663# Soundtrakker 128 ST2 music
296640	byte		0
29665>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
29666>>1	string		x		name: %s
29667
29668
29669
29670#------------------------------------------------------------------------
29671# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $
29672# sysex: file(1) magic for MIDI sysex files
29673#
29674# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
29675# where real SYStem EXclusive messages at offset 1 are limited to seven bits
29676# https://en.wikipedia.org/wiki/MIDI
296770	ubeshort&0xFF80		0xF000		SysEx File -
29678
29679# North American Group
29680>1	byte			0x01		Sequential
29681>1	byte			0x02		IDP
29682>1	byte			0x03		OctavePlateau
29683>1	byte			0x04		Moog
29684>1	byte			0x05		Passport
29685>1	byte			0x06		Lexicon
29686>1	byte			0x07		Kurzweil/Future Retro
29687>>3	byte			0x77		777
29688>>4	byte			0x00		Bank
29689>>4	byte			0x01		Song
29690>>5	byte			0x0f		16
29691>>5	byte			0x0e		15
29692>>5	byte			0x0d		14
29693>>5	byte			0x0c		13
29694>>5	byte			0x0b		12
29695>>5	byte			0x0a		11
29696>>5	byte			0x09		10
29697>>5	byte			0x08		9
29698>>5	byte			0x07		8
29699>>5	byte			0x06		7
29700>>5	byte			0x05		6
29701>>5	byte			0x04		5
29702>>5	byte			0x03		4
29703>>5	byte			0x02		3
29704>>5	byte			0x01		2
29705>>5	byte			0x00		1
29706>>5	byte			0x10		(ALL)
29707>>2	byte			x			\b, Channel %d
29708>1	byte			0x08		Fender
29709>1	byte			0x09		Gulbransen
29710>1	byte			0x0a		AKG
29711>1	byte			0x0b		Voyce
29712>1	byte			0x0c		Waveframe
29713>1	byte			0x0d		ADA
29714>1	byte			0x0e		Garfield
29715>1	byte			0x0f		Ensoniq
29716>1	byte			0x10		Oberheim
29717>>2	byte			0x06		Matrix 6 series
29718>>3	byte			0x0A		Dump (All)
29719>>3	byte			0x01		Dump (Bank)
29720>>4 belong			0x0002040E		Matrix 1000
29721>>>11 byte			<2			User bank %d
29722>>>11 byte			>1			Preset bank %d
29723>1	byte			0x11		Apple
29724>1	byte			0x12		GreyMatter
29725>1	byte			0x14		PalmTree
29726>1	byte			0x15		JLCooper
29727>1	byte			0x16		Lowrey
29728>1	byte			0x17		AdamsSmith
29729>1	byte			0x18		E-mu
29730>1	byte			0x19		Harmony
29731>1	byte			0x1a		ART
29732>1	byte			0x1b		Baldwin
29733>1	byte			0x1c		Eventide
29734>1	byte			0x1d		Inventronics
29735>1	byte			0x1f		Clarity
29736
29737# European Group
29738>1	byte			0x21		SIEL
29739>1	byte			0x22		Synthaxe
29740>1	byte			0x24		Hohner
29741>1	byte			0x25		Twister
29742>1	byte			0x26		Solton
29743>1	byte			0x27		Jellinghaus
29744>1	byte			0x28		Southworth
29745>1	byte			0x29		PPG
29746>1	byte			0x2a		JEN
29747>1	byte			0x2b		SSL
29748>1	byte			0x2c		AudioVertrieb
29749
29750>1	byte			0x2f		ELKA
29751>>3	byte			0x09		EK-44
29752
29753>1	byte			0x30		Dynacord
29754>1	byte			0x31		Jomox
29755>1	byte			0x33		Clavia
29756>1	byte			0x39		Soundcraft
29757# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
29758>1	byte			0x3e		Waldorf
29759>>2	byte			0x00		microWave
29760>>2	byte			0x0E		microwave2 / XT
29761>>2	byte			0x0F		Q / Q+
29762>>3	byte			=0			(default id)
29763>>3 byte			>0			(
29764>>>3 byte			<0x7F		\bdevice %d)
29765>>>3 byte			=0x7F		\bbroadcast id)
29766>>3	byte			0x7f		Microwave I
29767>>>4	byte			0x00		SNDR (Sound Request)
29768>>>4	byte			0x10		SNDD (Sound Dump)
29769>>>4	byte			0x20		SNDP (Sound Parameter Change)
29770>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
29771>>>4	byte			0x70		BOOT (Sound Reserved)
29772>>>4	byte			0x01		MULR (Multi Request)
29773>>>4	byte			0x11		MULD (Multi Dump)
29774>>>4	byte			0x21		MULP (Multi Parameter Change)
29775>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
29776>>>4	byte			0x71		OS (Multi Reserved)
29777>>>4	byte			0x02		DRMR (Drum Map Request)
29778>>>4	byte			0x12		DRMD (Drum Map Dump)
29779>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
29780>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
29781>>>4	byte			0x72		BIN (Drum Map Reserved)
29782>>>4	byte			0x03		PATR (Sequencer Pattern Request)
29783>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
29784>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
29785>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
29786>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
29787>>>4	byte			0x04		GLBR (Global Parameter Request)
29788>>>4	byte			0x14		GLBD (Global Parameter Dump)
29789>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
29790>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
29791>>>4	byte			0x07		MODR (Mode Parameter Request)
29792>>>4	byte			0x17		MODD (Mode Parameter Dump)
29793>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
29794>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
29795>>2	byte			0x10		microQ
29796>>>4	byte			0x00		SNDR (Sound Request)
29797>>>4	byte			0x10		SNDD (Sound Dump)
29798>>>4	byte			0x20		SNDP (Sound Parameter Change)
29799>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
29800>>>4	byte			0x70		(Sound Reserved)
29801>>>4	byte			0x01		MULR (Multi Request)
29802>>>4	byte			0x11		MULD (Multi Dump)
29803>>>4	byte			0x21		MULP (Multi Parameter Change)
29804>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
29805>>>4	byte			0x71		OS (Multi Reserved)
29806>>>4	byte			0x02		DRMR (Drum Map Request)
29807>>>4	byte			0x12		DRMD (Drum Map Dump)
29808>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
29809>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
29810>>>4	byte			0x72		BIN (Drum Map Reserved)
29811>>>4	byte			0x04		GLBR (Global Parameter Request)
29812>>>4	byte			0x14		GLBD (Global Parameter Dump)
29813>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
29814>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
29815>>2	byte			0x11		rackAttack
29816>>>4	byte			0x00		SNDR (Sound Parameter Request)
29817>>>4	byte			0x10		SNDD (Sound Parameter Dump)
29818>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
29819>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
29820>>>4	byte			0x01		PRGR (Program Parameter Request)
29821>>>4	byte			0x11		PRGD (Program Parameter Dump)
29822>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
29823>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
29824>>>4	byte			0x71		OS (Program Parameter Reserved)
29825>>>4	byte			0x03		PATR (Pattern Parameter Request)
29826>>>4	byte			0x13		PATD (Pattern Parameter Dump)
29827>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
29828>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
29829>>>4	byte			0x04		GLBR (Global Parameter Request)
29830>>>4	byte			0x14		GLBD (Global Parameter Dump)
29831>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
29832>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
29833>>>4	byte			0x05		EFXR (FX Parameter Request)
29834>>>4	byte			0x15		EFXD (FX Parameter Dump)
29835>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
29836>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
29837>>>4	byte			0x07		MODR (Mode Command Request)
29838>>>4	byte			0x17		MODD (Mode Command Dump)
29839>>>4	byte			0x27		MODP (Mode Command Parameter Change)
29840>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
29841>>2	byte			0x03		Wave
29842>>>4	byte			0x00		SBPR (Soundprogram)
29843>>>4	byte			0x01		SAPR (Performance)
29844>>>4	byte			0x02		SWAVE (Wave)
29845>>>4	byte			0x03		SWTBL (Wave control table)
29846>>>4	byte			0x04		SVT (Velocity Curve)
29847>>>4	byte			0x05		STT (Tuning Table)
29848>>>4	byte			0x06		SGLB (Global Parameters)
29849>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
29850>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
29851>>>4	byte			0x09		SBPRPAR (Sound Parameter)
29852>>>4	byte			0x0A		SARRPAR (Performance Parameter)
29853>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
29854>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
29855
29856# Japanese Group
29857>1	byte			0x40		Kawai
29858>>3	byte			0x20		K1
29859>>3	byte			0x22		K4
29860
29861>1	byte			0x41		Roland
29862>>3	byte			0x14		D-50
29863>>3	byte			0x2b		U-220
29864>>3	byte			0x02		TR-707
29865
29866>1	byte			0x42		Korg
29867>>3	byte			0x19		M1
29868
29869>1	byte			0x43		Yamaha
29870>1	byte			0x44		Casio
29871>1	byte			0x46		Kamiya
29872>1	byte			0x47		Akai
29873>1	byte			0x48		Victor
29874>1	byte			0x49		Mesosha
29875>1	byte			0x4b		Fujitsu
29876>1	byte			0x4c		Sony
29877>1	byte			0x4e		Teac
29878>1	byte			0x50		Matsushita
29879>1	byte			0x51		Fostex
29880>1	byte			0x52		Zoom
29881>1	byte			0x54		Matsushita
29882>1	byte			0x57		Acoustic tech. lab.
29883# https://www.midi.org/techspecs/manid.php
29884>1	belong&0xffffff00	0x00007400	Ta Horng
29885>1	belong&0xffffff00	0x00007500	e-Tek
29886>1	belong&0xffffff00	0x00007600	E-Voice
29887>1	belong&0xffffff00	0x00007700	Midisoft
29888>1	belong&0xffffff00	0x00007800	Q-Sound
29889>1	belong&0xffffff00	0x00007900	Westrex
29890>1	belong&0xffffff00	0x00007a00	Nvidia*
29891>1	belong&0xffffff00	0x00007b00	ESS
29892>1	belong&0xffffff00	0x00007c00	Mediatrix
29893>1	belong&0xffffff00	0x00007d00	Brooktree
29894>1	belong&0xffffff00	0x00007e00	Otari
29895>1	belong&0xffffff00	0x00007f00	Key Electronics
29896>1	belong&0xffffff00	0x00010000	Shure
29897>1	belong&0xffffff00	0x00010100	AuraSound
29898>1	belong&0xffffff00	0x00010200	Crystal
29899>1	belong&0xffffff00	0x00010300	Rockwell
29900>1	belong&0xffffff00	0x00010400	Silicon Graphics
29901>1	belong&0xffffff00	0x00010500	Midiman
29902>1	belong&0xffffff00	0x00010600	PreSonus
29903>1	belong&0xffffff00	0x00010800	Topaz
29904>1	belong&0xffffff00	0x00010900	Cast Lightning
29905>1	belong&0xffffff00	0x00010a00	Microsoft
29906>1	belong&0xffffff00	0x00010b00	Sonic Foundry
29907>1	belong&0xffffff00	0x00010c00	Line 6
29908>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
29909>1	belong&0xffffff00	0x00010e00	Van Koerving
29910>1	belong&0xffffff00	0x00010f00	Altech Systems
29911>1	belong&0xffffff00	0x00011000	S & S Research
29912>1	belong&0xffffff00	0x00011100	VLSI Technology
29913>1	belong&0xffffff00	0x00011200	Chromatic
29914>1	belong&0xffffff00	0x00011300	Sapphire
29915>1	belong&0xffffff00	0x00011400	IDRC
29916>1	belong&0xffffff00	0x00011500	Justonic Tuning
29917>1	belong&0xffffff00	0x00011600	TorComp
29918>1	belong&0xffffff00	0x00011700	Newtek Inc.
29919>1	belong&0xffffff00	0x00011800	Sound Sculpture
29920>1	belong&0xffffff00	0x00011900	Walker Technical
29921>1	belong&0xffffff00	0x00011a00	Digital Harmony
29922>1	belong&0xffffff00	0x00011b00	InVision
29923>1	belong&0xffffff00	0x00011c00	T-Square
29924>1	belong&0xffffff00	0x00011d00	Nemesys
29925>1	belong&0xffffff00	0x00011e00	DBX
29926>1	belong&0xffffff00	0x00011f00	Syndyne
29927>1	belong&0xffffff00	0x00012000	Bitheadz
29928>1	belong&0xffffff00	0x00012100	Cakewalk
29929>1	belong&0xffffff00	0x00012200	Staccato
29930>1	belong&0xffffff00	0x00012300	National Semicon.
29931>1	belong&0xffffff00	0x00012400	Boom Theory
29932>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
29933>1	belong&0xffffff00	0x00012600	Antares
29934>1	belong&0xffffff00	0x00012700	Angel Software
29935>1	belong&0xffffff00	0x00012800	St Louis Music
29936>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
29937>1	belong&0xffffff00	0x00012a00	Ashley Audio
29938>1	belong&0xffffff00	0x00012b00	Vari-Lite
29939>1	belong&0xffffff00	0x00012c00	Summit Audio
29940>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
29941>1	belong&0xffffff00	0x00012e00	SeaSound
29942>1	belong&0xffffff00	0x00012f00	U.S. Robotics
29943>1	belong&0xffffff00	0x00013000	Aurisis
29944>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
29945>1	belong&0xffffff00	0x00013200	FM7 Inc.
29946>1	belong&0xffffff00	0x00013300	Swivel Systems
29947>1	belong&0xffffff00	0x00013400	Hyperactive
29948>1	belong&0xffffff00	0x00013500	MidiLite
29949>1	belong&0xffffff00	0x00013600	Radical
29950>1	belong&0xffffff00	0x00013700	Roger Linn
29951>1	belong&0xffffff00	0x00013800	Helicon
29952>1	belong&0xffffff00	0x00013900	Event
29953>1	belong&0xffffff00	0x00013a00	Sonic Network
29954>1	belong&0xffffff00	0x00013b00	Realtime Music
29955>1	belong&0xffffff00	0x00013c00	Apogee Digital
29956
29957>1	belong&0xffffff00	0x00202b00	Medeli Electronics
29958>1	belong&0xffffff00	0x00202c00	Charlie Lab
29959>1	belong&0xffffff00	0x00202d00	Blue Chip Music
29960>1	belong&0xffffff00	0x00202e00	BEE OH Corp
29961>1	belong&0xffffff00	0x00202f00	LG Semicon America
29962>1	belong&0xffffff00	0x00203000	TESI
29963>1	belong&0xffffff00	0x00203100	EMAGIC
29964>1	belong&0xffffff00	0x00203200	Behringer
29965>1	belong&0xffffff00	0x00203300	Access Music
29966>1	belong&0xffffff00	0x00203400	Synoptic
29967>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
29968>1	belong&0xffffff00	0x00203600	Terratec
29969>1	belong&0xffffff00	0x00203700	Proel SpA
29970>1	belong&0xffffff00	0x00203800	IBK MIDI
29971>1	belong&0xffffff00	0x00203900	IRCAM
29972>1	belong&0xffffff00	0x00203a00	Propellerhead Software
29973>1	belong&0xffffff00	0x00203b00	Red Sound Systems
29974>1	belong&0xffffff00	0x00203c00	Electron ESI AB
29975>1	belong&0xffffff00	0x00203d00	Sintefex Audio
29976>1	belong&0xffffff00	0x00203e00	Music and More
29977>1	belong&0xffffff00	0x00203f00	Amsaro
29978>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
29979>1	belong&0xffffff00	0x00204100	Touched by Sound
29980>1	belong&0xffffff00	0x00204200	DSP Arts
29981>1	belong&0xffffff00	0x00204300	Phil Rees Music
29982>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
29983>1	belong&0xffffff00	0x00204500	Soundart
29984>1	belong&0xffffff00	0x00204600	C-Mexx Software
29985>1	belong&0xffffff00	0x00204700	Klavis Tech.
29986>1	belong&0xffffff00	0x00204800	Noteheads AB
29987
299880	string			T707		Roland TR-707 Data
29989#------------------------------------------------------------------------------
29990# file:  file(1) magic for Tcl scripting language
29991# URL:  https://www.tcl.tk/
29992# From: gustaf neumann
29993
29994# Tcl scripts
299950	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
29996!:mime	text/x-tcl
299970	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
29998!:mime	text/x-tcl
299990	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
30000!:mime	text/x-tcl
300010	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
30002!:mime	text/x-tcl
300030	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
30004!:mime	text/x-tcl
300050	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
30006!:mime	text/x-tcl
300070	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
30008!:mime	text/x-tcl
300090	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
30010!:mime	text/x-tcl
30011
30012# check the first line
300130	search/1	package\ req
30014>0	regex		\^package[\ \t]+req	Tcl script
30015# not 'p', check other lines
300160	search/1	!p
30017>0	regex		\^package[\ \t]+req	Tcl script
30018
30019#------------------------------------------------------------------------------
30020# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
30021# teapot:  file(1) magic for "teapot" spreadsheet
30022#
300230       string          #!teapot\012xdr      teapot work sheet (XDR format)
30024
30025#------------------------------------------------------------------------------
30026# $File: terminfo,v 1.11 2019/04/19 00:42:27 christos Exp $
30027# terminfo:  file(1) magic for terminfo
30028#
30029# URL: https://invisible-island.net/ncurses/man/term.5.html
30030# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html
30031#
30032# Workaround for Targa image type by Joerg Jenderek
30033# GRR: line below too general as it catches also
30034# Targa image type 1 with 26 long identification field
30035# and HELP.DSK
300360	string		\032\001
30037# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
30038>16	ubyte		>32
30039# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
30040>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
30041!:mime	application/x-terminfo
30042# no extension
30043#!:ext
30044#
30045#------------------------------------------------------------------------------
30046# The following was added for ncurses6 development:
30047#------------------------------------------------------------------------------
30048#
300490	string		\036\002
30050# imitate the legacy compiled-format, to get the entry-name printed
30051>16	ubyte		>32
30052# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1"
30053>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry "%-s"
30054!:mime	application/x-terminfo2
30055#
30056# While the compiled terminfo uses little-endian format irregardless of
30057# platform, SystemV screen dumps do not.  They came later, and that detail was
30058# overlooked.
30059#
30060# AIX and HPUX use the SVr4 big-endian format
30061# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
300620	beshort		0433 		SVr2 curses screen image, big-endian
300630	beshort		0434		SVr3 curses screen image, big-endian
300640	beshort		0435		SVr4 curses screen image, big-endian
30065#
300660	leshort		0433		SVr2 curses screen image, little-endian
300670	leshort		0434		SVr3 curses screen image, little-endian
300680	leshort		0435		SVr4 curses screen image, little-endian
30069#
30070# Rather than SVr4, Solaris "xcurses" writes this header:
300710	regex		\^MAX=[0-9]+,[0-9]+$
30072>1	regex		\^BEG=[0-9]+,[0-9]+$
30073>2	regex		\^SCROLL=[0-9]+,[0-9]+$
30074>3	regex		\^VMIN=[0-9]+$
30075>4	regex		\^VTIME=[0-9]+$
30076>5	regex		\^FLAGS=0x[[:xdigit:]]+$
30077>6	regex		\^FG=[0-9],[0-9]+$
30078>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
30079#
30080# ncurses5 (and before) did not use a magic number, making screen dumps "data".
30081# ncurses6 (2015) uses this format, ignoring byte-order
300820	string	\210\210\210\210ncurses	ncurses6 screen image
30083#
30084# PDCurses added this in 2005
300850	string		PDC\001		PDCurses screen image
30086
30087#------------------------------------------------------------------------------
30088# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $
30089# tex:  file(1) magic for TeX files
30090#
30091# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
30092#
30093# From <conklin@talisman.kaleida.com>
30094
30095# Although we may know the offset of certain text fields in TeX DVI
30096# and font files, we can't use them reliably because they are not
30097# zero terminated. [but we do anyway, christos]
300980	string		\367\002	TeX DVI file
30099!:mime	application/x-dvi
30100>16	string		>\0		(%s)
301010	string		\367\203	TeX generic font data
301020	string		\367\131	TeX packed font data
30103>3	string		>\0		(%s)
301040	string		\367\312	TeX virtual font data
301050	search/1	This\ is\ TeX,	TeX transcript text
301060	search/1	This\ is\ METAFONT,	METAFONT transcript text
30107
30108# There is no way to detect TeX Font Metric (*.tfm) files without
30109# breaking them apart and reading the data.  The following patterns
30110# match most *.tfm files generated by METAFONT or afm2tfm.
301112	string		\000\021	TeX font metric data
30112!:mime	application/x-tex-tfm
30113>33	string		>\0		(%s)
301142	string		\000\022	TeX font metric data
30115!:mime	application/x-tex-tfm
30116>33	string		>\0		(%s)
30117
30118# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
301190	search/1	\\input\ texinfo	Texinfo source text
30120!:mime	text/x-texinfo
301210	search/1	This\ is\ Info\ file	GNU Info text
30122!:mime	text/x-info
30123
30124# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
301250	search/4096	\\input		TeX document text
30126!:mime	text/x-tex
30127!:strength + 15
301280	search/4096	\\begin		LaTeX document text
30129!:mime	text/x-tex
30130!:strength + 15
301310	search/4096	\\section	LaTeX document text
30132!:mime	text/x-tex
30133!:strength + 18
301340	search/4096	\\setlength	LaTeX document text
30135!:mime	text/x-tex
30136!:strength + 15
301370	search/4096	\\documentstyle	LaTeX document text
30138!:mime	text/x-tex
30139!:strength + 18
301400	search/4096	\\chapter	LaTeX document text
30141!:mime	text/x-tex
30142!:strength + 18
301430	search/4096	\\documentclass	LaTeX 2e document text
30144!:mime	text/x-tex
30145!:strength + 15
301460	search/4096	\\relax		LaTeX auxiliary file
30147!:mime	text/x-tex
30148!:strength + 15
301490	search/4096	\\contentsline	LaTeX table of contents
30150!:mime	text/x-tex
30151!:strength + 15
301520	search/4096	%\ -*-latex-*-	LaTeX document text
30153!:mime	text/x-tex
30154
30155# Tex document, from Hendrik Scholz <hendrik@scholz.net>
301560   	search/1	\\ifx		TeX document text
30157
30158# Index and glossary files
301590	search/4096	\\indexentry	LaTeX raw index file
301600	search/4096	\\begin{theindex}	LaTeX sorted index
301610	search/4096	\\glossaryentry	LaTeX raw glossary
301620	search/4096	\\begin{theglossary}	LaTeX sorted glossary
301630	search/4096	This\ is\ makeindex	Makeindex log file
30164
30165# End of TeX
30166
30167#------------------------------------------------------------------------------
30168# file(1) magic for BibTex text files
30169# From Hendrik Scholz <hendrik@scholz.net>
30170
301710	search/1/c	@article{	BibTeX text file
301720	search/1/c	@book{		BibTeX text file
301730	search/1/c	@inbook{	BibTeX text file
301740	search/1/c	@incollection{	BibTeX text file
301750	search/1/c	@inproceedings{	BibTeX text file
301760	search/1/c	@manual{	BibTeX text file
301770	search/1/c	@misc{		BibTeX text file
301780	search/1/c	@preamble{	BibTeX text file
301790	search/1/c	@phdthesis{	BibTeX text file
301800	search/1/c	@techreport{	BibTeX text file
301810	search/1/c	@unpublished{	BibTeX text file
30182
3018373	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
30184
3018573	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
30186
301870	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
30188
301890	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
30190
301910	search/1	@c\ @mapfile{	TeX font aliases text file
30192
301930	string		#LyX		LyX document text
30194
30195# ConTeXt documents
30196#	https://wiki.contextgarden.net/
301970	search/4096	\\setupcolors[		ConTeXt document text
30198!:strength + 15
301990	search/4096	\\definecolor[		ConTeXt document text
30200!:strength + 15
302010	search/4096	\\setupinteraction[	ConTeXt document text
30202!:strength + 15
302030	search/4096	\\useURL[		ConTeXt document text
30204!:strength + 15
302050	search/4096	\\setuppapersize[	ConTeXt document text
30206!:strength + 15
302070	search/4096	\\setuplayout[		ConTeXt document text
30208!:strength + 15
302090	search/4096	\\setupfooter[		ConTeXt document text
30210!:strength + 15
302110	search/4096	\\setupfootertexts[	ConTeXt document text
30212!:strength + 15
302130	search/4096	\\setuppagenumbering[	ConTeXt document text
30214!:strength + 15
302150	search/4096	\\setupbodyfont[	ConTeXt document text
30216!:strength + 15
302170	search/4096	\\setuphead[		ConTeXt document text
30218!:strength + 15
302190	search/4096	\\setupitemize[		ConTeXt document text
30220!:strength + 15
302210	search/4096	\\setupwhitespace[	ConTeXt document text
30222!:strength + 15
302230	search/4096	\\setupindenting[	ConTeXt document text
30224!:strength + 15
30225
30226#------------------------------------------------------------------------------
30227# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
30228# file(1) magic for tgif(1) files
30229# From Hendrik Scholz <hendrik@scholz.net>
302300	string	%TGIF\ 			Tgif file version
30231>6	string	x			%s
30232
30233#------------------------------------------------------------------------------
30234# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $
30235# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
30236#
30237# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
30238#
30239# Update: Romain Lievin (roms@lpg.ticalc.org).
30240#
30241# NOTE: This list is not complete.
30242# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
30243# program/group magic numbers in here because I cannot find any.
302440		string		**TI80**	TI-80 Graphing Calculator File.
302450		string		**TI81**	TI-81 Graphing Calculator File.
30246#
30247# Magic Numbers for the TI-73
30248#
302490		string		**TI73**	TI-73 Graphing Calculator
30250>0x00003B	byte		0x00		(real number)
30251>0x00003B	byte		0x01		(list)
30252>0x00003B	byte		0x02		(matrix)
30253>0x00003B	byte		0x03		(equation)
30254>0x00003B	byte		0x04		(string)
30255>0x00003B	byte		0x05		(program)
30256>0x00003B	byte		0x06		(assembly program)
30257>0x00003B	byte		0x07		(picture)
30258>0x00003B	byte		0x08		(gdb)
30259>0x00003B	byte		0x0C		(complex number)
30260>0x00003B	byte		0x0F		(window settings)
30261>0x00003B	byte		0x10		(zoom)
30262>0x00003B	byte		0x11		(table setup)
30263>0x00003B	byte		0x13		(backup)
30264
30265# Magic Numbers for the TI-82
30266#
302670		string		**TI82**	TI-82 Graphing Calculator
30268>0x00003B	byte		0x00		(real)
30269>0x00003B	byte		0x01		(list)
30270>0x00003B	byte		0x02		(matrix)
30271>0x00003B	byte		0x03		(Y-variable)
30272>0x00003B	byte		0x05		(program)
30273>0x00003B	byte		0x06		(protected prgm)
30274>0x00003B	byte		0x07		(picture)
30275>0x00003B	byte		0x08		(gdb)
30276>0x00003B	byte		0x0B		(window settings)
30277>0x00003B	byte		0x0C		(window settings)
30278>0x00003B	byte		0x0D		(table setup)
30279>0x00003B	byte		0x0E		(screenshot)
30280>0x00003B	byte		0x0F		(backup)
30281#
30282# Magic Numbers for the TI-83
30283#
302840		string		**TI83**	TI-83 Graphing Calculator
30285>0x00003B	byte		0x00		(real)
30286>0x00003B	byte		0x01		(list)
30287>0x00003B	byte		0x02		(matrix)
30288>0x00003B	byte		0x03		(Y-variable)
30289>0x00003B	byte		0x04		(string)
30290>0x00003B	byte		0x05		(program)
30291>0x00003B	byte		0x06		(protected prgm)
30292>0x00003B	byte		0x07		(picture)
30293>0x00003B	byte		0x08		(gdb)
30294>0x00003B	byte		0x0B		(window settings)
30295>0x00003B	byte		0x0C		(window settings)
30296>0x00003B	byte		0x0D		(table setup)
30297>0x00003B	byte		0x0E		(screenshot)
30298>0x00003B	byte		0x13		(backup)
30299#
30300# Magic Numbers for the TI-83+
30301#
303020		string		**TI83F*	TI-83+ Graphing Calculator
30303>0x00003B	byte		0x00		(real number)
30304>0x00003B	byte		0x01		(list)
30305>0x00003B	byte		0x02		(matrix)
30306>0x00003B	byte		0x03		(equation)
30307>0x00003B	byte		0x04		(string)
30308>0x00003B	byte		0x05		(program)
30309>0x00003B	byte		0x06		(assembly program)
30310>0x00003B	byte		0x07		(picture)
30311>0x00003B	byte		0x08		(gdb)
30312>0x00003B	byte		0x0C		(complex number)
30313>0x00003B	byte		0x0F		(window settings)
30314>0x00003B	byte		0x10		(zoom)
30315>0x00003B	byte		0x11		(table setup)
30316>0x00003B	byte		0x13		(backup)
30317>0x00003B	byte		0x15		(application variable)
30318>0x00003B	byte		0x17		(group of variable)
30319
30320#
30321# Magic Numbers for the TI-85
30322#
303230		string		**TI85**	TI-85 Graphing Calculator
30324>0x00003B	byte		0x00		(real number)
30325>0x00003B	byte		0x01		(complex number)
30326>0x00003B	byte		0x02		(real vector)
30327>0x00003B	byte		0x03		(complex vector)
30328>0x00003B	byte		0x04		(real list)
30329>0x00003B	byte		0x05		(complex list)
30330>0x00003B	byte		0x06		(real matrix)
30331>0x00003B	byte		0x07		(complex matrix)
30332>0x00003B	byte		0x08		(real constant)
30333>0x00003B	byte		0x09		(complex constant)
30334>0x00003B	byte		0x0A		(equation)
30335>0x00003B	byte		0x0C		(string)
30336>0x00003B	byte		0x0D		(function GDB)
30337>0x00003B	byte		0x0E		(polar GDB)
30338>0x00003B	byte		0x0F		(parametric GDB)
30339>0x00003B	byte		0x10		(diffeq GDB)
30340>0x00003B	byte		0x11		(picture)
30341>0x00003B	byte		0x12		(program)
30342>0x00003B	byte		0x13		(range)
30343>0x00003B	byte		0x17		(window settings)
30344>0x00003B	byte		0x18		(window settings)
30345>0x00003B	byte		0x19		(window settings)
30346>0x00003B	byte		0x1A		(window settings)
30347>0x00003B	byte		0x1B		(zoom)
30348>0x00003B	byte		0x1D		(backup)
30349>0x00003B	byte		0x1E		(unknown)
30350>0x00003B	byte		0x2A		(equation)
30351>0x000032	string		ZS4		- ZShell Version 4 File.
30352>0x000032	string		ZS3		- ZShell Version 3 File.
30353#
30354# Magic Numbers for the TI-86
30355#
303560		string		**TI86**	TI-86 Graphing Calculator
30357>0x00003B	byte		0x00		(real number)
30358>0x00003B	byte		0x01		(complex number)
30359>0x00003B	byte		0x02		(real vector)
30360>0x00003B	byte		0x03		(complex vector)
30361>0x00003B	byte		0x04		(real list)
30362>0x00003B	byte		0x05		(complex list)
30363>0x00003B	byte		0x06		(real matrix)
30364>0x00003B	byte		0x07		(complex matrix)
30365>0x00003B	byte		0x08		(real constant)
30366>0x00003B	byte		0x09		(complex constant)
30367>0x00003B	byte		0x0A		(equation)
30368>0x00003B	byte		0x0C		(string)
30369>0x00003B	byte		0x0D		(function GDB)
30370>0x00003B	byte		0x0E		(polar GDB)
30371>0x00003B	byte		0x0F		(parametric GDB)
30372>0x00003B	byte		0x10		(diffeq GDB)
30373>0x00003B	byte		0x11		(picture)
30374>0x00003B	byte		0x12		(program)
30375>0x00003B	byte		0x13		(range)
30376>0x00003B	byte		0x17		(window settings)
30377>0x00003B	byte		0x18		(window settings)
30378>0x00003B	byte		0x19		(window settings)
30379>0x00003B	byte		0x1A		(window settings)
30380>0x00003B	byte		0x1B		(zoom)
30381>0x00003B	byte		0x1D		(backup)
30382>0x00003B	byte		0x1E		(unknown)
30383>0x00003B	byte		0x2A		(equation)
30384#
30385# Magic Numbers for the TI-89
30386#
303870		string		**TI89**	TI-89 Graphing Calculator
30388>0x000048	byte		0x00		(expression)
30389>0x000048	byte		0x04		(list)
30390>0x000048	byte		0x06		(matrix)
30391>0x000048	byte		0x0A		(data)
30392>0x000048	byte		0x0B		(text)
30393>0x000048	byte		0x0C		(string)
30394>0x000048	byte		0x0D		(graphic data base)
30395>0x000048	byte		0x0E		(figure)
30396>0x000048	byte		0x10		(picture)
30397>0x000048	byte		0x12		(program)
30398>0x000048	byte		0x13		(function)
30399>0x000048	byte		0x14		(macro)
30400>0x000048	byte		0x1C		(zipped)
30401>0x000048	byte		0x21		(assembler)
30402#
30403# Magic Numbers for the TI-92
30404#
304050		string		**TI92**	TI-92 Graphing Calculator
30406>0x000048	byte		0x00		(expression)
30407>0x000048	byte		0x04		(list)
30408>0x000048	byte		0x06		(matrix)
30409>0x000048	byte		0x0A		(data)
30410>0x000048	byte		0x0B		(text)
30411>0x000048	byte		0x0C		(string)
30412>0x000048	byte		0x0D		(graphic data base)
30413>0x000048	byte		0x0E		(figure)
30414>0x000048	byte		0x10		(picture)
30415>0x000048	byte		0x12		(program)
30416>0x000048	byte		0x13		(function)
30417>0x000048	byte		0x14		(macro)
30418>0x000048	byte		0x1D		(backup)
30419#
30420# Magic Numbers for the TI-92+/V200
30421#
304220		string		**TI92P*	TI-92+/V200 Graphing Calculator
30423>0x000048	byte		0x00		(expression)
30424>0x000048	byte		0x04		(list)
30425>0x000048	byte		0x06		(matrix)
30426>0x000048	byte		0x0A		(data)
30427>0x000048	byte		0x0B		(text)
30428>0x000048	byte		0x0C		(string)
30429>0x000048	byte		0x0D		(graphic data base)
30430>0x000048	byte		0x0E		(figure)
30431>0x000048	byte		0x10		(picture)
30432>0x000048	byte		0x12		(program)
30433>0x000048	byte		0x13		(function)
30434>0x000048	byte		0x14		(macro)
30435>0x000048	byte		0x1C		(zipped)
30436>0x000048	byte		0x21		(assembler)
30437#
30438# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
30439#
30440#0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
304410		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
30442>8		byte		>0		- Revision %d
30443>>9 		byte		x		\b.%d,
30444>12		byte		>0		Revision date %02x
30445>>13		byte		x		\b/%02x
30446>>14		beshort		x		\b/%04x,
30447>17		string		>/0		name: '%s',
30448>48		byte		0x74		device: TI-73,
30449>48		byte		0x73		device: TI-83+,
30450>48		byte		0x98		device: TI-89,
30451>48		byte		0x88		device: TI-92+,
30452>49		byte		0x23		type: OS upgrade,
30453>49		byte		0x24		type: application,
30454>49		byte		0x25		type: certificate,
30455>49		byte		0x3e		type: license,
30456>74		lelong		>0		size: %d bytes
30457
30458# VTi & TiEmu skins (TI Graphing Calculators).
30459# From: Romain Lievin (roms@lpg.ticalc.org).
30460# Magic Numbers for the VTi skins
304610               string          VTI		Virtual TI skin
30462>3		string		v		- Version
30463>>4		byte		>0		\b %c
30464>>6		byte		x		\b.%c
30465# Magic Numbers for the TiEmu skins
304660		string		TiEmu		TiEmu skin
30467>6              string          v               - Version
30468>>7             byte            >0              \b %c
30469>>9             byte            x               \b.%c
30470>>10		byte		x		\b%c
30471
30472#------------------------------------------------------------------------------
30473# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
30474# timezone:  file(1) magic for timezone data
30475#
30476# from Daniel Quinlan (quinlan@yggdrasil.com)
30477# this should work on Linux, SunOS, and maybe others
30478# Added new official magic number for recent versions of the Olson code
304790	string	TZif	timezone data
30480>4	byte	0	\b, old version
30481>4	byte	>0	\b, version %c
30482>20	belong	0	\b, no gmt time flags
30483>20	belong	1	\b, 1 gmt time flag
30484>20	belong	>1	\b, %d gmt time flags
30485>24	belong	0	\b, no std time flags
30486>20	belong	1	\b, 1 std time flag
30487>24	belong	>1	\b, %d std time flags
30488>28	belong	0	\b, no leap seconds
30489>28	belong	1	\b, 1 leap second
30490>28	belong  >1	\b, %d leap seconds
30491>32	belong	0	\b, no transition times
30492>32	belong	1	\b, 1 transition time
30493>32	belong  >1	\b, %d transition times
30494>36	belong	0	\b, no abbreviation chars
30495>36	belong	1	\b, 1 abbreviation char
30496>36	belong	>1	\b, %d abbreviation chars
304970	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
304980	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
304990	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
305000	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
305010	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
305020	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
30503
30504#------------------------------------------------------------------------------
30505# $File: tplink,v 1.5 2020/03/28 23:14:26 christos Exp $
30506# tplink: File magic for openwrt firmware files
30507
30508# URL: https://wiki.openwrt.org/doc/techref/header
30509# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
30510# From: Joerg Jenderek
30511# check for valid header version 1 or 2
305120		ulelong		<3
30513>0		ulelong		!0
30514# test for header padding with nulls
30515>>0x100		long		0
30516# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor
30517>>>4		ubelong		>0x1F000000
30518# skip user.dbt by looking for positive hardware id
30519>>>>0x40	ubeshort	>0
30520>>>>>0		use		firmware-tplink
30521
305220		name		firmware-tplink
30523>0		ubyte		x		firmware
30524!:mime application/x-tplink-bin
30525!:ext	bin
30526# hardware id like 10430001 07410001 09410004 09410006
30527>0x40		ubeshort	x		%x
30528>0x42		ubeshort	x		v%x
30529# hardware revision like 1
30530>0x44		ubelong		!1		(revision %u)
30531# vendor_name[24] like OpenWrt or TP-LINK Technologies
30532>4		string		x		%.24s
30533# fw_version[36] like r49389 or ver. 1.0
30534>0x1c		string		x		%.36s
30535# header version 1 or 2
30536>0		ubyte		!1		V%X
30537# ver_hi.ver_mid.ver_lo
30538>0x98		long		!0		\b, version
30539>>0x98		ubeshort	x		%u
30540>>0x9A		ubeshort	x		\b.%u
30541>>0x9C		ubeshort	x		\b.%u
30542# region code 0~universal 1~US
30543>0x48		ubelong		x
30544#>>0x48		ubelong		0		(universal)
30545>>0x48		ubelong		1		(US)
30546>>0x48		ubelong		>1		(region %u)
30547# total length of the firmware. not always true
30548>0x7C		ubelong		x		\b, %u bytes or less
30549# unknown 1
30550>0x48		ubelong		!0		\b, UNKNOWN1 0x%x
30551# md5sum1[16]
30552#>0x4c		ubequad		x		\b, MD5 %llx
30553#>>0x54		ubequad		x		\b%llx
30554# unknown 2
30555>0x5c		ubelong		!0		\b, UNKNOWN2 0x%x
30556# md5sum2[16]
30557#>0x60		ubequad		!0		\b, 2nd MD5 %llx
30558#>>0x68		ubequad		x		\b%llx
30559# unknown 3
30560>0x70		ubelong		!0		\b, UNKNOWN3 0x%x
30561# kernel load address
30562#>0x74		ubelong		x		\b, 0x%x load
30563# kernel entry point
30564#>0x78		ubelong		x		\b, 0x%x entry
30565# kernel data offset. 200h means direct after header
30566>0x80		ubelong		x		\b, at 0x%x
30567# kernel data length and 1 space
30568>0x84		ubelong		x		%u bytes
30569# look for kernel type (gzip compressed vmlinux.bin by ./compress)
30570>(0x80.L)	indirect	x
30571# root file system data offset
30572# WRONG in 5.35 with above indirect expression
30573>0x88		ubelong		x		\b, at 0x%x
30574# rootfs data length and 1 space
30575>0x8C		ubelong		x		%u bytes
30576# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h
30577>(0x88.L)	indirect	x
30578# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin
30579#>(0x88.L)	string		x		\b, file system '%.4s'
30580#>(0x88.L)	ubequad		x		\b, file system 0x%llx
30581# bootloader data offset
30582>0x90		ubelong		!0		\b, at 0x%x
30583# bootloader data length only resonable if bootloader offset not null
30584>>0x94		ubelong		!0		%u bytes
30585# pad[354] should be 354 null bytes.
30586#>0x9E		ubequad		!0		\b, padding 0x%llx
30587# But at 0x120 18 non null bytes in examples like
30588# wr940nv4_eu_3_16_9_up_boot(160620).bin
30589# wr940nv6_us_3_18_1_up_boot(171030).bin
30590#>0x120		ubequad		!0		\b, other padding 0x%llx
30591
30592#------------------------------------------------------------------------------
30593# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $
30594# troff:  file(1) magic for *roff
30595#
30596# updated by Daniel Quinlan (quinlan@yggdrasil.com)
30597
30598# troff input
305990	search/1	.\\"		troff or preprocessor input text
30600!:mime	text/troff
306010	search/1	'\\"		troff or preprocessor input text
30602!:mime	text/troff
306030	search/1	'.\\"		troff or preprocessor input text
30604!:mime	text/troff
306050	search/1	\\"		troff or preprocessor input text
30606!:mime	text/troff
30607#0	search/1	'''		troff or preprocessor input text
30608#!:mime	text/troff
306090	regex/20l	\^\\.[A-Za-z][A-Za-z0-9][\ \t]	troff or preprocessor input text
30610!:mime	text/troff
306110	regex/20l	\^\\.[A-Za-z][A-Za-z0-9]$	troff or preprocessor input text
30612!:mime	text/troff
30613
30614# ditroff intermediate output text
306150	search/1	x\ T		ditroff output text
30616>4	search/1	cat		for the C/A/T phototypesetter
30617>4	search/1	ps		for PostScript
30618>4	search/1	dvi		for DVI
30619>4	search/1	ascii		for ASCII
30620>4	search/1	lj4		for LaserJet 4
30621>4	search/1	latin1		for ISO 8859-1 (Latin 1)
30622>4	search/1	X75		for xditview at 75dpi
30623>>7	search/1	-12		(12pt)
30624>4	search/1	X100		for xditview at 100dpi
30625>>8	search/1	-12		(12pt)
30626
30627# output data formats
306280	string		\100\357	very old (C/A/T) troff output data
30629
30630#------------------------------------------------------------------------------
30631# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
30632# tuxedo:	file(1) magic for BEA TUXEDO data files
30633#
30634# from Ian Springer <ispringer@hotmail.com>
30635#
306360	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
30637
30638#------------------------------------------------------------------------------
30639# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
30640# typeset:  file(1) magic for other typesetting
30641#
306420	string		Interpress/Xerox	Xerox InterPress data
30643>16	string		/			(version
30644>>17	string		>\0			%s)
30645
30646#------------------------------------------------------------------------------
30647# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $
30648# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
30649# These types are recognised in file_ascmagic so these encodings can be
30650# treated by text patterns.  Missing types are already dealt with internally.
30651#
306520	string	+/v8			Unicode text, UTF-7
306530	string	+/v9			Unicode text, UTF-7
306540	string	+/v+			Unicode text, UTF-7
306550	string	+/v/			Unicode text, UTF-7
306560	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
306570	string	\000\000\376\377	Unicode text, UTF-32, big-endian
306580	string	\377\376\000\000	Unicode text, UTF-32, little-endian
306590	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
30660
30661#------------------------------------------------------------------------------
30662# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $
30663# unisig:  file(1) magic for files carrying a uniform signature (Unisig)
30664# From: Lassi Kortela, John Cowan
30665# URL:	https://github.com/unisig
30666#
306670	string	\xDC\xDC\x0D\x0A\x1A\x0A\x00	Unisig:
30668>7	ubyte	=0				UUID
30669>>8	guid	x				%s
30670>7	ubyte	>0				URI
30671>>7	pstring x				%s
30672
30673#------------------------------------------------------------------------------
30674# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
30675# unknown:  file(1) magic for unknown machines
30676#
30677# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
30678# (executable, pure, and split I&D, respectively), but the PDP-11 version
30679# doesn't have the "version %ld", which may be a bogus COFFism (I don't
30680# think there was ever COFF for the PDP-11).
30681#
30682# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
30683# long, as it would be on a VAX.  In any case, that could collide with
30684# VAX demand-paged files, as the magic number is little-endian on those
30685# binaries, so the first 16 bits of the file would contain 0x10B.
30686#
30687# Therefore, those entries are commented out.
30688#
30689# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
30690#
30691#0	short		0x107		unknown machine executable
30692#>8	short		>0		not stripped
30693#>15	byte		>0		- version %ld
30694#0	short		0x108		unknown pure executable
30695#>8	short		>0		not stripped
30696#>15	byte		>0		- version %ld
30697#0	short		0x109		PDP-11 separate I&D
30698#>8	short		>0		not stripped
30699#>15	byte		>0		- version %ld
30700#0	short		0x10b		unknown pure executable
30701#>8	short		>0		not stripped
30702#>15	byte		>0		- version %ld
307030	long		0x10c		unknown demand paged pure executable
30704>16	long		>0		not stripped
307050	long		0x10e		unknown readable demand paged pure executable
30706
30707#------------------------------------------------------------------------------
30708# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $
30709#
30710# From Christian Schmidbauer
30711#
30712# https://github.com/PixarAnimationStudios/USD
30713
30714# USD crate file
30715# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450
307160	string		PXR-USDC	USD crate
30717>8	byte		x		\b, version %x.
30718>9	byte		x		\b%x.
30719>10	byte		x		\b%x
30720!:ext	usd
30721
30722# USD ASCII file
307230	string		#usda\040	USD ASCII
30724>6	string		x		\b, version %s
30725!:mime	text/plain
30726!:ext	usd
30727
30728#------------------------------------------------------------------------------
30729# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
30730# file(1) magic for uterus files
30731# http://freecode.com/projects/uterus
30732#
307330	string		UTE+	uterus file
30734>4	string		v	\b, version
30735>5	byte		x	%c
30736>6	string		.	\b.
30737>7	byte		x	\b%c
30738>8	string		\<\>	\b, big-endian
30739>>16	belong		>0	\b, slut size %u
30740>8	string		\>\<	\b, litte-endian
30741>>16	lelong		>0	\b, slut size %u
30742>10	byte		&8	\b, compressed
30743
30744#------------------------------------------------------------------------------
30745# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $
30746# uuencode:  file(1) magic for ASCII-encoded files
30747#
30748
30749# GRR:  the first line of xxencoded files is identical to that in uuencoded
30750# files, but the first character in most subsequent lines is 'h' instead of
30751# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
30752# punctuation and survives BITNET gateways better.)  If regular expressions
30753# were supported, this entry could possibly be split into two with
30754# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
307550	search/1	begin\ 		uuencoded or xxencoded text
30756
30757# btoa(1) is an alternative to uuencode that requires less space.
307580	search/1	xbtoa\ Begin	btoa'd text
30759
30760# ship(1) is another, much cooler alternative to uuencode.
30761# Greg Roelofs, newt@uchicago.edu
307620	search/1	$\012ship	ship'd binary text
30763
30764# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
30765# Greg Roelofs, newt@uchicago.edu
307660	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
30767
30768# GRR: handle BASE64
30769
30770#------------------------------------------------------------------------------
30771# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
30772# vacuum cleaner magic by Thomas M. Ott (ThMO)
30773#
30774# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
30775# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
30776# -> yyyymmdd: year, month, day of cleaning
30777# -> hhmmss: hour, minute, second of cleaning
30778# -> xxxxxx: 6 digits
30779# -> cc: cleaning runs counter
30780# size: 136044 bytes
30781#
30782# struct maphdr {
30783#     int32_t  map_cnt;	     /*  0: single map */
30784#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
30785#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
30786#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
30787#     int32_t  unknown;	     /* 16: 50000 ??? */
30788#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
30789#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
30790#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
30791#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
30792#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
30793#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
30794# #if	0
30795#     struct {		     /* 44: 1000 blocks for 10x10 cells */
30796#         int32_t  yoffset;
30797#         int32_t  xoffset;
30798#         int32_t  posxy;
30799#         int32_t  timecode;
30800#       }      blocks[ 1000];
30801#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
30802#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
30803# #endif
30804#   };
30805
308060                lelong =1
30807>4               lelong =100
30808>>8              lelong =10000
30809>>>12            lelong =50
30810>>>>16           lelong =50000
30811>>>>>20          lelong =100
30812>>>>>>24         lelong =1000
30813>>>>>>>28        lelong =1000
30814>>>>>>>>36       lelong =10
30815>>>>>>>>>40      lelong =100
30816>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
30817>>>>>>>>>>136040 lelong =-1     reuse map data
30818>>>>>>>>>>136040 lelong =0      map data
30819>>>>>>>>>>136040 lelong >0      spurious map data
30820>>>>>>>>>>136040 lelong <-1     spurious map data
30821
30822
30823
30824#------------------------------------------------------------------------------
30825# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
30826# varied.out:  file(1) magic for various USG systems
30827#
30828#	Herewith many of the object file formats used by USG systems.
30829#	Most have been moved to files for a particular processor,
30830#	and deleted if they duplicate other entries.
30831#
308320	short		0610		Perkin-Elmer executable
30833# AMD 29K
308340	beshort		0572		amd 29k coff noprebar executable
308350	beshort		01572		amd 29k coff prebar executable
308360	beshort		0160007		amd 29k coff archive
30837# Cray
308386	beshort		0407		unicos (cray) executable
30839# Ultrix 4.3
30840596	string		\130\337\377\377	Ultrix core file
30841>600	string		>\0		from '%s'
30842# BeOS and MAcOS PEF executables
30843# From: hplus@zilker.net (Jon Watte)
308440	string		Joy!peffpwpc	header for PowerPC PEF executable
30845#
30846# ava assembler/linker Uros Platise <uros.platise@ijs.si>
308470       string          avaobj  AVR assembler object code
30848>7      string          >\0     version '%s'
30849# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
308500	string		gmon		GNU prof performance data
30851>4	long		x		- version %d
30852# From: Dave Pearson <davep@davep.org>
30853# Harbour <URL:http://harbour-project.org/> HRB files.
308540	string		\xc0HRB		Harbour HRB file
30855>4	leshort		x		version %d
30856# Harbour HBV files
308570	string		\xc0HBV		Harbour variable dump file
30858>4	leshort		x		version %d
30859
30860# From: Alex Beregszaszi <alex@fsn.hu>
30861# 0	string		exec 		BugOS executable
30862# 0	string		pack		BugOS archive
30863
30864# From: Jason Spence <jspence@lightconsulting.com>
30865# Generated by the "examples" in STM's ST40 devkit, and derived code.
308660	lelong		0x13a9f17e	ST40 component image format
30867>4	string		>\0		\b, name '%s'
30868
30869#------------------------------------------------------------------------------
30870# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $
30871# varied.script:  file(1) magic for various interpreter scripts
30872
308730	string/t		#!\ /			a
30874>3	string		>\0			%s script text executable
30875!:strength / 2
30876
308770	string/b		#!\ /			a
30878>3	string		>\0			%s script executable (binary data)
30879!:strength / 2
30880
308810	string/t		#!\t/			a
30882>3	string		>\0			%s script text executable
30883!:strength / 2
30884
308850	string/b		#!\t/			a
30886>3	string		>\0			%s script executable (binary data)
30887!:strength / 2
30888
308890	string/t		#!/			a
30890>2	string		>\0			%s script text executable
30891!:strength / 2
30892
308930	string/b		#!/			a
30894>2	string		>\0			%s script executable (binary data)
30895!:strength / 2
30896
308970	string/t		#!\ 			script text executable
30898>3	string		>\0			for %s
30899!:strength / 2
30900
309010	string/b		#!\ 			script executable
30902>3	string		>\0			for %s (binary data)
30903!:strength / 2
30904
30905# using env
309060	string/t	#!/usr/bin/env		a
30907>15	string/t	>\0			%s script text executable
30908!:strength / 10
30909
309100	string/b	#!/usr/bin/env		a
30911>15	string/b	>\0			%s script executable (binary data)
30912!:strength / 10
30913
309140	string/t	#!\ /usr/bin/env	a
30915>16	string/t	>\0			%s script text executable
30916!:strength / 10
30917
309180	string/b	#!\ /usr/bin/env	a
30919>16	string/b	>\0			%s script executable (binary data)
30920!:strength / 10
30921
30922# From: arno <arenevier@fdn.fr>
30923# mozilla xpconnect typelib
30924# see https://www.mozilla.org/scriptable/typelib_file.html
309250	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
30926>0x10  byte        x       version %d
30927>>0x11 byte        x      \b.%d
30928
30929#------------------------------------------------------------------------------
30930# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $
30931# vax:  file(1) magic for VAX executable/object and APL workspace
30932#
309330	lelong		0101557		VAX single precision APL workspace
309340	lelong		0101556		VAX double precision APL workspace
30935
30936#
30937# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
30938# executables, and are handled in aout)
30939#
309400	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
30941>16	lelong		>0		not stripped
30942
30943#
30944# VAX COFF
30945#
30946# The `versions' were commented out, but have been un-commented out.
30947# (Was the problem just one of endianness?)
30948#
309490	leshort		0570
30950>2	uleshort	<100		VAX COFF executable, sections %d
30951>>4	ledate		x		\b, created %s
30952>>12	lelong		>0		\b, not stripped
30953>>22	leshort		>0		\b, version %d
30954
309550	leshort		0575
30956>2	uleshort	<100		VAX COFF pure executable, sections %d
30957>>4	ledate		x		\b, created %s
30958>>12	lelong		>0		\b, not stripped
30959>>22	leshort		>0		\b, version %d
30960
30961#------------------------------------------------------------------------------
30962# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
30963# vicar:  file(1) magic for VICAR files.
30964#
30965# From: Ossama Othman <othman@astrosun.tn.cornell.edu
30966# VICAR is JPL's in-house spacecraft image processing program
30967# VICAR image
309680	string	LBLSIZE=	VICAR image data
30969>32	string	BYTE		\b, 8 bits  = VAX byte
30970>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
30971>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
30972>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
30973>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
30974>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
30975# VICAR label file
3097643	string	SFDU_LABEL	VICAR label file
30977
30978#------------------------------------------------------------------------------
30979# $File: virtual,v 1.12 2020/02/15 01:20:15 christos Exp $
30980# From: James Nobis <quel@quelrod.net>
30981# Microsoft hard disk images for:
30982# Virtual Server
30983# Virtual PC
30984# VirtualBox
30985# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk)
30986# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
30987# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
309880	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
30989# alternative shorter names
30990#0	string	conectix	Microsoft Virtual Hard Disk image
30991#0	string	conectix	Microsoft Virtual HD image
30992!:mime	application/x-virtualbox-vhd
30993!:ext   vhd
30994# Features is a bit field used to indicate specific feature support
30995#>8	ubelong		!0x00000002	\b, Features 0x%x
30996# Reserved. This bit must always be set to 1.
30997#>8	ubelong		&0x00000002	\b, Reserved 0x%x
30998# File Format Version for the current specification 0x00010000
30999#>12	ubelong		!0x00010000	\b, Version 0x%8.8x
31000# Data Offset only found 0x200
31001#>16	ubequad		!0x200		\b, Data Offset 0x%llx
31002#>16	ubequad		x		\b, at 0x%llx
31003# Dynamic Disk Header cookie like cxsparse
31004#>(16.Q)	string		x		"%-.8s"
31005# This field contains a Unicode string (UTF-16) of the parent hard disk filename
31006#>(16.Q+64)	ubequad	x		\b, parent name 0x%llx
31007# Creator Application
31008# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd
31009>28	string		x		\b, Creator %-4.4s
31010# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004
31011# holds the major/minor version of the application that created the image
31012>32	ubeshort	x		%x
31013>34	ubeshort	x		\b.%x
31014#>32	ubelong		x		\b, Version 0x%8.8x
31015# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac)
31016>36	ubelong		x		(
31017>>36	ubelong		0x5769326B	\bW2k
31018>>36	ubelong		0x4D616320	\bMac
31019>>36	default		x		\b0x
31020>>>36	ubelong		x		\b%8.8x
31021# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch
31022>24	bedate+946684800	x	\b) %s
31023# Original Size
31024#>40	ubequad		x		\b, o.-Size 0x%llx
31025# Current Size is same as original size, but change when disk is expanded
31026#>48	ubequad		x		\b, Size 0x%llx
31027>48	ubequad		x		\b, %llu bytes
31028# Disk Geometry: cylinder, heads, and sectors/track for hard disk
31029#>56	ubeshort	x		\b, Cylinder 0x%x
31030>56	ubeshort	x		\b, CHS %u
31031# Heads
31032#>58	ubyte		x		\b, Heads 0x%x
31033>58	ubyte		x		\b/%u
31034# Sectors per track
31035#>59	ubyte		x		\b, Sectors 0x%x
31036>59	ubyte		x		\b/%u
31037# Disk Type: 3~Dynamic hard disk
31038>60	ubelong		!0x3		\b, type 0x%x
31039# Checksum
31040#>64	ubelong		x		\b, cksum 0x%x
31041# universally unique identifier (UUID) to associate a parent with its differencing image
31042#>68	ubequad		x		\b, id 0x%16.16llx
31043#>76	ubequad		x		\b-%16.16llx
31044# Saved State: 1~Saved State
31045>84	ubyte		!0		\b, State 0x%x
31046# Reserved 427 bytes with nils
31047#>85	ubequad	!0			\b, Reserved 0x%16.16llx
31048
31049# From: Joerg Jenderek
31050# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx
31051# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/
31052# MS-VHDX/[MS-VHDX].pdf
31053# Note: extends the VHD format with new capabilities, such as a 16TB maximum size
31054# TODO:	find and display values like virtual size, disk size, cluster_size, etc
31055#	display id in GUID format
31056#
31057# VHDX_FILE_IDENTIFIER signature 0x656C696678646876
310580	string			vhdxfile
31059# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB
31060>0x10000	string		head		Microsoft Disk Image eXtended
31061#>0x20000	string			head	\b, 2nd header
31062#!:mime	application/x-virtualbox-vhdx
31063!:ext	vhdx
31064# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512"
31065>>8		lestring16		x	\b, by %.256s
31066# The Checksum field is a CRC-32C hash over the entire 4 KB structure
31067#>>0x10004	ulelong			x	\b, CRC 0x%x
31068# SequenceNumber
31069>>0x10008	ulequad			x	\b, sequence 0x%llx
31070# FileWriteGuid
31071#>>0x10010	ubequad			x	\b, file id 0x%llx
31072#>>>0x10018	ubequad			x	\b-%llx
31073# DataWriteGuid
31074#>>0x10020	ubequad			x	\b, data id 0x%llx
31075#>>>0x10028	ubequad			x	\b-%llx
31076# LogGuid. If this field is zero, then the log is empty or has no valid entries
31077>>0x10030	ubequad			>0	\b, log id 0x%llx
31078>>>0x10038	ubequad			x	\b-%llx
31079# LogVersion. If not 0 there is a log to replay
31080>>0x10040	uleshort		>0	\b, LogVersion 0x%x
31081# Version. This field must be set to 1
31082>>0x10042	uleshort		!1	\b, Version 0x%x
31083# LogLength must be multiples of 1 MB
31084>>0x10044	ulelong/1048576		>1	\b, LogLength %u MB
31085# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB
31086>>0x10048	ulequad			!0x100000 \b, LogOffset 0x%llx
31087# Log Entry Signature must be 0x65676F6C~loge
31088>>(0x10048.q)	ulelong			!0x65676F6C \b, NO Log Signature
31089>>(0x10048.q)	ulelong			=0x65676F6C	\b; LOG
31090# Log Entry Checksum
31091#>>>(0x10048.q+4)	ulelong		x	\b, Log CRC 0x%x
31092# Log Entry Length must be a multiple of 4 KB
31093>>>(0x10048.q+8)	ulelong/1024	>4	\b, EntryLength %u KB
31094# Log Entry Tail must be a multiple of 4 KB
31095#>>>(0x10048.q+12)	ulelong		x	\b, Tail 0x%x
31096# Log Entry SequenceNumber
31097#>>>(0x10048.q+16)	ulequad		x	\b, # 0x%llx
31098# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8
31099#>>>(0x10048.q+24)	ulelong		x	\b, DescriptorCount 0x%llx
31100# Log Entry Reserved must be set to 0
31101>>>(0x10048.q+28)	ulelong		!0	\b, Reserved 0x%x
31102# Log Entry LogGuid
31103#>>>(0x10048.q+32)	ubequad		x	\b, Log id 0x%llx
31104#>>>(0x10048.q+40)	ubequad		x	\b-%llx
31105# Log Entry FlushedFileOffset should VHDX size when entry is written.
31106#>>>(0x10048.q+48)	ulequad		x	\b, FlushedFileOffset %llu
31107# Log Entry LastFileOffset
31108#>>>(0x10048.q+56)	ulequad		x	\b, LastFileOffset %llu
31109# filling
31110#>>>(0x10048.q+64)	ulequad		>0	\b, filling %llx
31111# Reserved[4016]
31112#>>0x10050	ulequad			>0	\b, Reserved 0x%llx
31113# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB
31114>0x30000	ulelong			!0x69676572 \b, 1st region INVALID
31115>0x30000	ulelong			=0x69676572 \b; region
31116# region Checksum. CRC-32C hash over the entire 64-KB table
31117#>>0x30004	ulelong			x	\b, CRC 0x%x
31118# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047.
31119>>0x30008	ulelong			x	\b, %u entries
31120# reserved must be zero
31121#>>0x3000C	ulelong			!0	\b, RESERVED 0x%x
31122# Region Table Entry starts with identifier for the object. often BAT id
31123>>0x30010	use			vhdx-id
31124# FileOffset
31125>>0x30020	ulequad		x		\b, at 0x%llx
31126# Length. Specifies the length of the object within the file
31127#>>0x30028	ulelong		x		\b, Length 0x%x
31128# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
31129>>0x3002C	ulelong		x		\b, Required %u
31130# 2nd region entry often metadata id
31131>>0x30030	use			vhdx-id
31132# 2nd entry FileOffset
31133>>0x30040	ulequad		x		\b, at 0x%llx
31134# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX
31135>>0x3004C	ulelong		x		\b, Required %u
31136# 2nd region
31137>>0x40000	ulelong		!0x69676572	\b, 2nd region INVALID
31138# check in vhdx images for known id and show names instead hexadecimal
311390	name		vhdx-id
31140# https://www.windowstricks.in/online-windows-guid-converter
31141# 2DC27766-F623-4200-9D64-115E9BFD4A08		BAT GUID
31142# 6677C22D23F600429D64115E9BFD4A08		BAT ID
31143>0	ubequad		=0x6677C22D23F60042
31144>>8	ubequad		=0x9D64115E9BFD4A08	\b, id BAT
31145# no BAT id
31146>>8	default		x
31147>>>0	use		vhdx-id-hex
31148# 8B7CA206-4790-4B9A-B8FE-575F050F886E		Metadata region GUID
31149# 06A27C8B90479A4BB8FE575F050F886E		Metadata region ID
31150>0	ubequad		=0x06A27C8B90479A4B
31151>>8	ubequad		=0xB8FE575F050F886E	\b, id Metadata
31152# no Metadata id
31153>>8	default		x
31154>>>0	use		vhdx-id-hex
31155# 2FA54224-CD1B-4876-B211-5DBED83BF4B8		Virtual Disk Size GUID
31156# 2442A52F1BCD7648B2115DBED83BF4B8		Virtual Disk Size ID
31157# value "virtual size" can be verified by command `qemu-img info `
31158>0	ubequad		=0x2442A52F1BCD7648
31159>>8	ubequad		=0xB2115DBED83BF4B8	\b, id vsize
31160# no Virtual Disk Size ID
31161>>8	default		x
31162>>>0	use		vhdx-id-hex
31163# other ids
31164>0	default		x
31165>>0	use		vhdx-id-hex
31166# in vhdx images show id as hexadecimal
311670	name		vhdx-id-hex
31168>0	ubequad		x			\b, ID 0x%16.16llx
31169>8	ubequad		x			\b-%16.16llx
31170#
31171# libvirt
31172# From: Philipp Hahn <hahn@univention.de>
311730	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
31174>0x10	lelong	x	\b, version %u
31175>0x14	lelong	x	\b, XML length %u
31176>0x18	lelong	1	\b, running
31177>0x1c	lelong	1	\b, compressed
31178
311790	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
31180# From: Alex Beregszaszi <alex@fsn.hu>
311810	string/b	COWD		VMWare3
31182>4	byte	3		disk image
31183>>32	lelong	x		(%d/
31184>>36	lelong	x		\b%d/
31185>>40	lelong	x		\b%d)
31186>4	byte	2		undoable disk image
31187>>32	string	>\0		(%s)
31188
311890	string/b	VMDK		 VMware4 disk image
311900	string/b	KDMV		 VMware4 disk image
31191
31192#--------------------------------------------------------------------
31193# Qemu Emulator Images
31194# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
31195# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
31196# Made by reading sources, reading documentation, and doing trial and error
31197# on existing QCOW files
311980	string/b	QFI\xFB
31199
31200# Uncomment the following line to display Magic (only used for debugging
31201# this magic number)
31202#>0	string/b	x	, Magic: %s
31203
31204# There are currently 2 Versions: "1" and "2".
31205# https://www.gnome.org/~markmc/qcow-image-format-version-1.html
31206>4	belong		!1	QEMU QCOW2 Image
31207>4	belong		1	QEMU QCOW Image (v1)
31208
31209# Using the existence of the Backing File Offset to determine whether
31210# to read Backing File Information
31211>>12	belong	 >0	 \b, has backing file (
31212# Note that this isn't a null-terminated string; the length is actually
31213# (16.L). Assuming a null-terminated string happens to work usually, but it
31214# may spew junk until it reaches a \0 in some cases.
31215>>>(12.L)	 string >\0	\bpath %s
31216
31217# Modification time of the Backing File
31218# Really useful if you want to know if your backing
31219# file is still usable together with this image
31220>>>>20	bedate >0	\b, mtime %s)
31221>>>>20	default x	\b)
31222
31223# Size is stored in bytes in a big-endian u64.
31224>>24	bequad	x	 \b, %lld bytes
31225
31226# 1 for AES encryption, 0 for none.
31227>>36	belong	1	\b, AES-encrypted
31228
31229# https://www.gnome.org/~markmc/qcow-image-format.html
31230>4	belong	2	(v2)
31231# Using the existence of the Backing File Offset to determine whether
31232# to read Backing File Information
31233>>8	bequad  >0	 \b, has backing file
31234# Note that this isn't a null-terminated string; the length is actually
31235# (16.L). Assuming a null-terminated string happens to work usually, but it
31236# may spew junk until it reaches a \0 in some cases. Also, since there's no
31237# .Q modifier, we just use the bottom four bytes as an offset. Note that if
31238# the file is over 4G, and the backing file path is stored after the first 4G,
31239# the wrong filename will be printed. (This should be (8.Q), when that syntax
31240# is introduced.)
31241>>>(12.L)	 string >\0	(path %s)
31242>>24	bequad	x	\b, %lld bytes
31243>>32	belong	1	\b, AES-encrypted
31244
31245>4	belong	3	(v3)
31246# Using the existence of the Backing File Offset to determine whether
31247# to read Backing File Information
31248>>8	bequad  >0	 \b, has backing file
31249# Note that this isn't a null-terminated string; the length is actually
31250# (16.L). Assuming a null-terminated string happens to work usually, but it
31251# may spew junk until it reaches a \0 in some cases. Also, since there's no
31252# .Q modifier, we just use the bottom four bytes as an offset. Note that if
31253# the file is over 4G, and the backing file path is stored after the first 4G,
31254# the wrong filename will be printed. (This should be (8.Q), when that syntax
31255# is introduced.)
31256>>>(12.L)	 string >\0	(path %s)
31257>>24	bequad	x	\b, %lld bytes
31258>>32	belong	1	\b, AES-encrypted
31259
31260>4	default x	(unknown version)
31261
312620	string/b	QEVM		QEMU suspend to disk image
31263
31264# QEMU QED Image
31265# https://wiki.qemu.org/Features/QED/Specification
312660	string/b	QED\0		QEMU QED Image
31267
31268# VDI Image
31269# Sun xVM VirtualBox Disk Image
31270# From: Richard W.M. Jones <rich@annexia.org>
31271# VirtualBox Disk Image
312720x40	ulelong		0xbeda107f	VirtualBox Disk Image
31273>0x44	uleshort	>0		\b, major %u
31274>0x46	uleshort	>0		\b, minor %u
31275>0	string		>\0		(%s)
31276>368	lequad		x		 \b, %lld bytes
31277
312780	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
31279>32	string	x				type %s,
31280>48	string	x				subtype %s
31281
312820	lelong	0x02468ace			Bochs Sparse disk image
31283
31284
31285#------------------------------------------------------------------------------
31286# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
31287# Virtutech Compressed Random Access File Format
31288#
31289# From <gustav@virtutech.com>
312900      string          \211\277\036\203        Virtutech CRAFF
31291>4     belong          x               v%d
31292>20    belong          0               uncompressed
31293>20    belong          1               bzipp2ed
31294>20    belong          2               gzipped
31295>24    belong          0               not clean
31296
31297#------------------------------------------------------------------------------
31298# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
31299# visx:  file(1) magic for Visx format files
31300#
313010	short		0x5555		VISX image file
31302>2	byte		0		(zero)
31303>2	byte		1		(unsigned char)
31304>2	byte		2		(short integer)
31305>2	byte		3		(float 32)
31306>2	byte		4		(float 64)
31307>2	byte		5		(signed char)
31308>2	byte		6		(bit-plane)
31309>2	byte		7		(classes)
31310>2	byte		8		(statistics)
31311>2	byte		10		(ascii text)
31312>2	byte		15		(image segments)
31313>2	byte		100		(image set)
31314>2	byte		101		(unsigned char vector)
31315>2	byte		102		(short integer vector)
31316>2	byte		103		(float 32 vector)
31317>2	byte		104		(float 64 vector)
31318>2	byte		105		(signed char vector)
31319>2	byte		106		(bit plane vector)
31320>2	byte		121		(feature vector)
31321>2	byte		122		(feature vector library)
31322>2	byte		124		(chain code)
31323>2	byte		126		(bit vector)
31324>2	byte		130		(graph)
31325>2	byte		131		(adjacency graph)
31326>2	byte		132		(adjacency graph library)
31327>2	string		.VISIX		(ascii text)
31328
31329#------------------------------------------------------------------------------
31330# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
31331# vms:  file(1) magic for VMS executables (experimental)
31332#
31333# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
31334
31335# GRR 950122:  I'm just guessing on these, based on inspection of the headers
31336# of three executables each for Alpha and VAX architectures.  The VAX files
31337# all had headers similar to this:
31338#
31339#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
31340#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
31341#
313420	string	\xb0\0\x30\0	VMS VAX executable
31343>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
31344#
31345# The AXP files all looked like this, except that the byte at offset 0x22
31346# was 06 in some of them and 07 in others:
31347#
31348#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
31349#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
31350#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
31351#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
31352#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
31353#
31354# GRR this test is still too general as it catches example adressen.dbt
313550	belong	0x03000000
31356>8	ubelong	0xec020000	VMS Alpha executable
31357>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
31358
31359#------------------------------------------------------------------------------
31360# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
31361# VMware specific files (deducted from version 1.1 and log file entries)
31362# Anthon van der Neut (anthon@mnt.org)
313630	belong	0x4d52564e	VMware nvram
31364
31365#------------------------------------------------------------------------------
31366# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $
31367# vorbis:  file(1) magic for Ogg/Vorbis files
31368#
31369# From Felix von Leitner <leitner@fefe.de>
31370# Extended by Beni Cherniavsky <cben@crosswinds.net>
31371# Further extended by Greg Wooledge <greg@wooledge.org>
31372#
31373# Most (everything but the number of channels and bitrate) is commented
31374# out with `##' as it's not interesting to the average user.  The most
31375# probable things advanced users would want to uncomment are probably
31376# the number of comments and the encoder version.
31377#
31378# FIXME: The first match has been made a search, so that it can skip
31379# over prepended ID3 tags. This will work for MIME type detection, but
31380# won't work for detecting other properties of the file (they all need
31381# to be made relative to the search). In any case, if the file has ID3
31382# tags, the ID3 information will be printed, not the Ogg information,
31383# so until that's fixed, this doesn't matter.
31384# FIXME[2]: Disable the above for now, since search assumes text mode.
31385#
31386# --- Ogg Framing ---
31387#0		search/1000	OggS		Ogg data
313880		string	OggS		Ogg data
31389>4		byte		!0		UNKNOWN REVISION %u
31390##>4		byte		0		revision 0
31391>4		byte		0
31392##>>14		lelong		x		(Serial %lX)
31393# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
31394>>28		string		\x7fFLAC	\b, FLAC audio
31395# non-Vorbis content: Theora
31396!:mime		audio/ogg
31397>>28		string		\x80theora	\b, Theora video
31398!:mime		video/ogg
31399# non-Vorbis content: Kate
31400>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
31401!:mime		application/ogg
31402>>>37		ubyte		x		v%u
31403>>>38		ubyte		x		\b.%u,
31404>>>40		byte		0		utf8 encoding,
31405>>>40		byte		!0		unknown character encoding,
31406>>>60		string		>\0		language %s,
31407>>>60		string		\0		no language set,
31408>>>76		string		>\0		category %s
31409>>>76		string		\0		no category set
31410# non-Vorbis content: Skeleton
31411>>28		string		fishead\0	\b, Skeleton
31412!:mime		video/ogg
31413>>>36		leshort		x		v%u
31414>>>40		leshort		x		\b.%u
31415# non-Vorbis content: Speex
31416>>28		string		Speex\ \ \ 	\b, Speex audio
31417!:mime		audio/ogg
31418# non-Vorbis content: OGM
31419>>28		string		\x01video\0\0\0	\b, OGM video
31420!:mime		video/ogg
31421>>>37		string/c	div3		(DivX 3)
31422>>>37		string/c	divx		(DivX 4)
31423>>>37		string/c	dx50		(DivX 5)
31424>>>37		string/c	xvid		(XviD)
31425# --- First vorbis packet - general header ---
31426>>28		string		\x01vorbis	\b, Vorbis audio,
31427!:mime		audio/ogg
31428>>>35		lelong		!0		UNKNOWN VERSION %u,
31429##>>>35		lelong		0		version 0,
31430>>>35		lelong		0
31431>>>>39		ubyte		1		mono,
31432>>>>39		ubyte		2		stereo,
31433>>>>39		ubyte		>2		%u channels,
31434>>>>40		lelong		x		%u Hz
31435# Minimal, nominal and maximal bitrates specified when encoding
31436>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
31437# The above tests if at least one of these is specified:
31438>>>>>52		lelong		!-1
31439# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
31440# instead of -1.
31441# Vorbis 1.0 uses 0 instead of -1.
31442>>>>>>52	lelong		!0
31443>>>>>>>52	lelong		!-1000
31444>>>>>>>>52	lelong		x		<%u
31445>>>>>48		lelong		!-1
31446>>>>>>48	lelong		x		~%u
31447>>>>>44		lelong		!-1
31448>>>>>>44	lelong		!-1000
31449>>>>>>>44	lelong		!0
31450>>>>>>>>44	lelong		x		>%u
31451>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
31452# -- Second vorbis header packet - the comments
31453# A kludge to read the vendor string.  It's a counted string, not a
31454# zero-terminated one, so file(1) can't read it in a generic way.
31455# libVorbis is the only one existing currently, so I detect specifically
31456# it.  The interesting value is the cvs date (8 digits decimal).
31457# Post-RC1 Ogg files have the second header packet (and thus the version)
31458# in a different place, so we must use an indirect offset.
31459>>>(84.b+85)		string		\x03vorbis
31460>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
31461>>>>>(84.b+120)		string		>00000000
31462# Map to beta version numbers:
31463>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
31464>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
31465>>>>>>(84.b+120)	string		>20000508
31466>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
31467>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
31468>>>>>>(84.b+120)	string		>20001031
31469>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
31470>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
31471>>>>>>(84.b+120)	string		>20010225
31472>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
31473>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
31474>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
31475>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
31476>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
31477>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
31478>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
31479# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
31480>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
31481# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
31482>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
31483>>>>>(84.b+117)		string		>00000000
31484>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
31485>>>>>>(84.b+117)	string		20020717	(1.0)
31486>>>>>>(84.b+117)	string		20030909	(1.0.1)
31487>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
31488>>>>>>(84.b+117)	string		20050304	(1.1.2)
31489>>>>>>(84.b+117)	string		20070622	(1.2.0)
31490>>>>>>(84.b+117)	string		20090624	(1.2.2)
31491>>>>>>(84.b+117)	string		20090709	(1.2.3)
31492>>>>>>(84.b+117)	string		20100325	(1.3.1)
31493>>>>>>(84.b+117)	string		20101101	(1.3.2)
31494>>>>>>(84.b+117)	string		20120203	(1.3.3)
31495>>>>>>(84.b+117)	string		20140122	(1.3.4)
31496>>>>>>(84.b+117)	string		20150105	(1.3.5)
31497
31498# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
31499>>28		string		OpusHead	\b, Opus audio,
31500!:mime		audio/ogg
31501>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
31502>>>36		ubyte		&0x0F		version 0.%d
31503>>>>46		ubyte		>1
31504>>>>>46		ubyte		!255		unknown channel mapping family %u,
31505>>>>>37		ubyte		x		%u channels
31506>>>>46		ubyte		0
31507>>>>>37		ubyte		1		mono
31508>>>>>37		ubyte		2		stereo
31509>>>>46		ubyte		1
31510>>>>>37		ubyte		1		mono
31511>>>>>37		ubyte		2		stereo
31512>>>>>37		ubyte		3		linear surround
31513>>>>>37		ubyte		4		quadraphonic
31514>>>>>37		ubyte		5		5.0 surround
31515>>>>>37		ubyte		6		5.1 surround
31516>>>>>37		ubyte		7		6.1 surround
31517>>>>>37		ubyte		8		7.1 surround
31518>>>>40		lelong		!0		\b, %u Hz
31519
31520#------------------------------------------------------------------------------
31521# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
31522# VXL: file(1) magic for VXL binary IO data files
31523#
31524# from Ian Scott <scottim@sf.net>
31525#
31526# VXL is a collection of C++ libraries for Computer Vision.
31527# See the vsl chapter in the VXL Book for more info
31528# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
31529# http:/vxl.sf.net
31530
315312	lelong	0x472b2c4e	VXL data file,
31532>0	leshort	>0		schema version no %d
31533
31534#------------------------------------------------------------------------------
31535# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $
31536# warc:  file(1) magic for WARC files
31537
315380	string	WARC/	WARC Archive
31539>5	string	x	version %.4s
31540!:mime application/warc
31541
31542#------------------------------------------------------------------------------
31543# Arc File Format from Internet Archive
31544# see https://www.archive.org/web/researcher/ArcFileFormat.php
315450      string          filedesc://     Internet Archive File
31546!:mime application/x-ia-arc
31547>11    search/256      \x0A    \b
31548>>&0   ubyte   >0      \b version %c
31549
31550#------------------------------------------------------------------------------
31551# weak:  file(1) magic for very weak magic entries, disabled by default
31552#
31553# These entries are so weak that they might interfere identification of
31554# other formats. Example include:
31555# - Only identify for 1 or 2 bytes
31556# - Match against very wide range of values
31557# - Match against generic word in some spoken languages (e.g. English)
31558
31559# Summary: Computer Graphics Metafile
31560# Extension: .cgm
31561#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
31562#0	beshort		0x3020		character Computer Graphics Metafile
31563
31564#0	string		=!!		Bennet Yee's "face" format
31565
31566#------------------------------------------------------------------------------
31567# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $
31568
31569# http://www.rdfhdt.org/
31570# From Christoph Biedl
31571# http://www.rdfhdt.org/hdt-internals/
31572# https://github.com/rdfhdt/hdt-cpp
31573
315740	string	$HDT\x01 HDT file (binary compressed indexed RDF triples) type 1
31575!:mime application/vnd.hdt
31576!:ext hdt
31577#------------------------------------------------------------------------------
31578# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $
31579# webassembly:  file(1) magic for WebAssembly modules
31580#
31581# WebAssembly is a virtual architecture developed by a W3C Community
31582# Group at https://webassembly.org/. The file extension is .wasm, and
31583# the MIME type is application/wasm.
31584#
31585# https://webassembly.org/docs/binary-encoding/ is the main
31586# document describing the binary format.
31587# From: Pip Cet <pipcet@gmail.com> and Joel Martin
31588
315890	string	\0asm	WebAssembly (wasm) binary module
31590>4	lelong	=1	version %#x (MVP)
31591>4	lelong	>1	version %#x
31592
31593#------------------------------------------------------------------------------
31594# $File: windows,v 1.31 2020/03/15 16:44:37 christos Exp $
31595# windows:  file(1) magic for Microsoft Windows
31596#
31597# This file is mainly reserved for files where programs
31598# using them are run almost always on MS Windows 3.x or
31599# above, or files only used exclusively in Windows OS,
31600# where there is no better category to allocate for.
31601# For example, even though WinZIP almost run on Windows
31602# only, it is better to treat them as "archive" instead.
31603# For format usable in DOS, such as generic executable
31604# format, please specify under "msdos" file.
31605#
31606
31607
31608# Summary: Outlook Express DBX file
31609# Extension: .dbx
31610# Created by: Christophe Monniez
316110	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
31612>4	byte	=0xC5			\b, message database
31613>4	byte	=0xC6			\b, folder database
31614>4	byte	=0xC7			\b, account information
31615>4	byte	=0x30			\b, offline database
31616
31617
31618# Summary: Windows crash dump
31619# Extension: .dmp
31620# Created by: Andreas Schuster (https://computer.forensikblog.de/)
31621# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html
31622# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
316230	string		PAGE
31624>4	string		DUMP		MS Windows 32bit crash dump
31625>>0x05c	byte            0		\b, no PAE
31626>>0x05c	byte            1		\b, PAE
31627>>0xf88	lelong		1		\b, full dump
31628>>0xf88	lelong		2		\b, kernel dump
31629>>0xf88	lelong		3		\b, small dump
31630>>0x068	lelong		x		\b, %d pages
31631>4	string		DU64		MS Windows 64bit crash dump
31632>>0xf98	lelong		1		\b, full dump
31633>>0xf98	lelong		2		\b, kernel dump
31634>>0xf98	lelong		3		\b, small dump
31635>>0x090	lequad		x		\b, %lld pages
31636
31637
31638# Summary: Vista Event Log
31639# Extension: .evtx
31640# Created by: Andreas Schuster (https://computer.forensikblog.de/)
31641# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html
316420	string		ElfFile\0	MS Windows Vista Event Log
31643>0x2a	leshort		x		\b, %d chunks
31644>>0x10	lelong		x		\b (no. %d in use)
31645>0x18	lelong		>1		\b, next record no. %d
31646>0x18	lelong		=1		\b, empty
31647>0x78	lelong		&1		\b, DIRTY
31648>0x78	lelong		&2		\b, FULL
31649
31650# Summary: Windows System Deployment Image
31651# Created by: Joerg Jenderek
31652# URL: http://en.wikipedia.org/wiki/System_Deployment_Image
31653# Reference: http://skolk.livejournal.com/1320.html
316540	string			$SDI
31655>4	string			0001		System Deployment Image
31656!:mime	application/x-ms-sdi
31657#!:mime	application/octet-stream
31658# \Boot\boot.sdi
31659!:ext	sdi
31660# MDBtype: 0~Unspecified 1~RAM 2~ROM
31661>>8	ulequad			!0		\b, MDBtype 0x%llx
31662# BootCodeOffset
31663>>16	ulequad			!0		\b, BootCodeOffset 0x%llx
31664# BootCodeSize
31665>>24	ulequad			!0		\b, BootCodeSize 0x%llx
31666# VendorID
31667>>32	ulequad			!0		\b, VendorID 0x%llx
31668# DeviceID
31669>>40	ulequad			!0		\b, DeviceID 0x%llx
31670# DeviceModel
31671>>48	ulequad			!0		\b, DeviceModel 0x%llx
31672>>>56	ulequad			!0		\b%llx
31673# DeviceRole
31674>>64	ulequad			!0		\b, DeviceRole 0x%llx
31675# Reserved1; reserved fields and gaps between BLOBs are padded with \0
31676#>>72	ulequad			!0		\b, Reserved1 0x%llx
31677# RuntimeGUID
31678>>80	ulequad			!0		\b, RuntimeGUID 0x%llx
31679>>>88	ulequad			!0		\b%llx
31680# RuntimeOEMrev
31681>>96	ulequad			!0		\b, RuntimeOEMrev 0x%llx
31682# Reserved2
31683#>>104	ulequad			!0		\b, Reserved2 0x%llx
31684# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k
31685>>112	ulequad			!0		\b, PageAlignment %llu
31686# Reserved3[48]
31687#>>120	ulequad			!0		\b, Reserved3 0x%llx
31688# SDI checksum 39h
31689>>0x1f8	ulequad			x		\b, checksum 0x%llx
31690# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK
31691>>0x400	string			>\0		\b, type %-3.8s
31692# 0~non-filesystem 7~NTFS 6~BIGFAT
31693>>>0x420	ulequad		!0		(0x%llx)
31694# ATTRibutes
31695>>>0x408	ulequad		!0		0x%llx attributes
31696# Offset
31697>>>0x410	ulequad		x		at 0x%llx
31698# print 1 space after size and then handles NTFS boot sector by ./filesystems
31699>>>0x418	ulequad		>0		%llu bytes
31700>>>>(0x410.l)	indirect	x
31701# 2nd BLOB: WIM
31702>>0x440		string		>\0		\b, type %-3.8s
31703>>>0x428	ulequad		!0		(0x%llx)
31704# ATTRibutes
31705>>>0x448	ulequad		!0		0x%llx attributes
31706# Offset
31707>>>0x450	ulequad		x		at 0x%llx
31708>>>0x458	ulequad		>0		%llu bytes
31709>>>>(0x450.l)	indirect	x
31710# 3rd BLOB
31711>>0x480		string		>\0		\b, type %-3.8s
31712
31713# Summary:	Windows boot status log BOOTSTAT.DAT
31714# From:		Joerg Jenderek
31715# Reference:	https://www.geoffchappell.com/notes/windows/boot/bsd.htm
31716# Note:		mainly refers to older Windows Vista, sometimes
31717#		BOOTSTAT.DAT only contains nulls or invalid data
31718# checking for valid version below 5
317190		ulelong		<5
31720# skip many ISO images by checking for valid 64 KiB file size
31721>8		ulelong		=0x00010000
31722>>0		use		bootstat-dat
31723# display information of BOOTSTAT.DAT
317240	name		bootstat-dat
31725>0		ulelong		x		Windows boot log
31726#!:mime	application/octet-stream
31727!:mime	application/x-ms-dat
31728# BOOTSTAT.DAT in BOOT subdirectory
31729!:ext	dat
31730# apparently a version number: 2 for older like Vista, 3, 4 Windows 10
31731>0		ulelong		>2		\b, version %u
31732# apparently the size of the header: often 10h in older Windows, 14h, 18h
31733>4		ulelong		!0x10		\b, header size 0x%x
31734#>4		ulelong		!0x10		\b, header size %u
31735# apparently the size of the file: always 0x00010000~64KiB
31736# the file is acceptable to BOOTMGR only if it is exactly 64 KiB
31737>8		ulelong		!0x00010000	\b, file size 0x%x
31738# size of valid data, in bytes: C8h 50h 172h 5D5Ch
31739>0xc		ulelong		x		\b, 0x%x valid bytes
31740# skip header and jump to first bootstat entry and display information
31741>(0x4.l-1)	ubyte		x
31742>>&0		use		bootstat-entry
31743# jump to first entry again because pointer are bad after "use"
31744>(0x4.l-1)	ubyte		x
31745# by 1st entry size jump to 2nd entry and display information
31746>>&(&0x18.l-1)	ubyte		x
31747>>>&0		use		bootstat-entry
31748# jump to possible 3rd boot entry and display information
31749# >(0x4.l-1)	ubyte		x
31750# >>&(&0x18.l-1)	ubyte		x
31751# >>>&(&0x18.l-1)	ubyte		x
31752# >>>>&0		use		bootstat-entry
31753#	display BOOTSTAT.DAT entry
317540	name		bootstat-entry
31755#>0x00		ubequad		x		\b, ENTRY %16.16llx
31756# size of entry, in bytes: 40h(init) 78h(launced) 9Ch
31757#>0x18		ulelong		x		\b; entry size %u
31758>0x18		ulelong		x		\b; entry size 0x%x
31759# time stamp, in seconds
31760>0x00		ulelong		x		\b, 0x%x seconds
31761# always zero, significance unknown
31762>0x04		ulelong		!0		\b, not null %u
31763# GUID of event source; but empty if event source is BOOTMGR
31764>0x08		ubequad		!0		\b, GUID 0x%16.16llx
31765>>0x10		ubequad		x		\b%16.16llx
31766# severity code: 1~informational 3~errors
31767>0x1C		ulelong		!1		\b, severity 0x%x
31768# apparently a version number: 2
31769>0x20		ulelong		!2		\b, version %u
31770# event identifier 1~log file initialised 11h~boot application launched
31771#>0x24		ulelong		x		\b, event 0x%x
31772>0x24		ulelong		!1
31773>>0x24		ulelong		!0x11		\b, event 0x%x
31774# entry data; size depends on event identifier
31775#>0x28		ubequad		x		\b, data 0x%16.16llx
31776>0x24		ulelong		=0x1		\b, Init
31777# always 0, significance unknown
31778>>0x34		uleshort	!0		\b, not null %u
31779# always 7, significance unknown
31780>>0x36		uleshort	!7		\b, not seven %u
31781# year
31782>>0x28		uleshort	x		%u
31783# month
31784>>0x2A		uleshort	x		\b-%u
31785# day
31786>>0x2C		uleshort	x		\b-%u
31787# hour
31788>>0x2E		uleshort	x		%u
31789# minute
31790>>0x30		uleshort	x		\b:%u
31791# second
31792>>0x32		uleshort	x		\b:%u
31793# boot application launched
31794>0x24		ulelong		=0x11		\b, launched
31795# type of start: 0 normally, 1 or 2 maybe in a recovery sequence
31796>>0x38		uleshort	!0		\b, type %u
31797# pathname of boot application, as null-terminated Unicode string; typically
31798# \Windows\system32\winload.exe \Windows\system32\winload.efi
31799>>0x3C		lestring16	x		%s
31800
31801# Summary:	Windows Error Report text files
31802# URL:		https://en.wikipedia.org/wiki/Windows_Error_Reporting
31803# Reference:	https://www.nirsoft.net/utils/app_crash_view.html
31804# Created by:	Joerg Jenderek
31805# Note:		in directories	%ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
31806#				%LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue}
318070	lestring16	Version=
31808>22	lestring16	EventType	Windows Error Report
31809!:mime	text/plain
31810# Report.wer
31811!:ext	wer
31812
31813# Summary: Windows 3.1 group files
31814# Extension: .grp
31815# Created by: unknown
318160	string		\120\115\103\103	MS Windows 3.1 group files
31817
31818
31819# Summary: Old format help files
31820# URL: https://en.wikipedia.org/wiki/WinHelp
31821# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm
31822# Update: Joerg Jenderek
31823# Created by: Dirk Jagdmann <doj@cubic.org>
31824#
31825# check and then display version and date inside MS Windows HeLP file fragment
318260	name				help-ver-date
31827# look for Magic of SYSTEMHEADER
31828>0	leshort		0x036C
31829# version Major		1 for right file fragment
31830>>4	leshort		1		Windows
31831# print non empty string above to avoid error message
31832# Warning: Current entry does not yet have a description for adding a MIME type
31833!:mime	application/winhelp
31834!:ext	hlp
31835# version Minor of help file format is hint for windows version
31836>>>2	leshort		0x0F		3.x
31837>>>2	leshort		0x15		3.0
31838>>>2	leshort		0x21		3.1
31839>>>2	leshort		0x27		x.y
31840>>>2	leshort		0x33		95
31841>>>2	default		x		y.z
31842>>>>2	leshort		x		0x%x
31843# to complete message string like "MS Windows 3.x help file"
31844>>>2	leshort		x		help
31845# GenDate often older than file creation date
31846>>>6	ldate		x		\b, %s
31847#
31848# Magic for HeLP files
318490	lelong		0x00035f3f
31850# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
31851# file header magic 0x293B at DirectoryStart+9
31852>(4.l+9)	uleshort	0x293B		MS
31853# look for @VERSION	bmf.. like IBMAVW.ANN
31854>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
31855!:mime	application/x-winhelp
31856!:ext	ann
31857>>0xD4		string	!\x62\x6D\x66\x01\x00
31858# "GID Help index" by TrID
31859>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
31860!:mime	application/x-winhelp
31861!:ext	gid
31862# HeLP Bookmark or
31863# "Windows HELP File" by TrID
31864>>>(4.l+0x65)		string		!|Pete
31865# maybe there exist a cleaner way to detect HeLP fragments
31866# brute search for Magic 0x036C with matching Major maximal 7 iterations
31867# discapp.hlp
31868>>>>16			search/0x49AF/s	\x6c\x03
31869>>>>>&0			use 		help-ver-date
31870>>>>>&4			leshort		!1
31871# putty.hlp
31872>>>>>>&0		search/0x69AF/s	\x6c\x03
31873>>>>>>>&0		use 		help-ver-date
31874>>>>>>>&4		leshort		!1
31875>>>>>>>>&0		search/0x49AF/s	\x6c\x03
31876>>>>>>>>>&0		use 		help-ver-date
31877>>>>>>>>>&4		leshort		!1
31878>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
31879>>>>>>>>>>>&0		use 		help-ver-date
31880>>>>>>>>>>>&4		leshort		!1
31881>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
31882>>>>>>>>>>>>>&0		use 		help-ver-date
31883>>>>>>>>>>>>>&4		leshort		!1
31884>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
31885>>>>>>>>>>>>>>>&0	use 		help-ver-date
31886>>>>>>>>>>>>>>>&4	leshort		!1
31887>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
31888# GCC.HLP is detected after 7 iterations
31889>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
31890# this only happens if bigger hlp file is detected after used search iterations
31891>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
31892!:mime	application/winhelp
31893!:ext	hlp
31894# repeat search again or following default line does not work
31895>>>>16			search/0x49AF/s	\x6c\x03
31896# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
31897>>>>16	default				x	Windows help Bookmark
31898!:mime	application/x-winhelp
31899!:ext	bmk
31900## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
31901##>>8	lelong			x		\b, FirstFreeBlock 0x%8.8x
31902# EntireFileSize
31903>>12	lelong			x		\b, %d bytes
31904## ReservedSpace normally 042Fh AFh for *.ANN
31905#>>(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
31906## UsedSpace normally 0426h A6h for *.ANN
31907#>>(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
31908## FileFlags normally 04...
31909#>>(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
31910## file header magic 0x293B
31911#>>(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
31912## file header Flags		0x0402
31913#>>(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
31914## file header PageSize	0400h 80h for *.ANN
31915#>>(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
31916## Structure[16]		z4
31917#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
31918## MustBeZero			0
31919#>>(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
31920## PageSplits
31921#>>(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
31922## RootPage
31923#>>(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
31924## MustBeNegOne			0xffff
31925#>>(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
31926## TotalPages			1
31927#>>(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
31928## NLevels			0x0001
31929#>>(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
31930## TotalBtreeEntries
31931#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
31932## pages of the B+ tree
31933#>>(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx
31934
31935# start with colon or semicolon for comment line like Back2Life.cnt
319360		regex		\^(:|;)
31937# look for first keyword Base
31938>0		search/45	:Base
31939>>&0				use 		cnt-name
31940# only solution to search again from beginning , because relative offsets changes when use is called
31941>0		search/45	:Base
31942>0		default		x
31943# look for other keyword Title like in putty.cnt
31944>>0		search/45	:Title
31945>>>&0				use 		cnt-name
31946#
31947# display mime type and name of Windows help Content source
319480	name				cnt-name
31949# skip space at beginning
31950>0     string		\040
31951# name without extension and greater character or name with hlp extension
31952>>1	regex/c		\^([^\xd>]*|.*\.hlp)	MS Windows help file Content, based "%s"
31953!:mime	text/plain
31954!:apple	????TEXT
31955!:ext	cnt
31956#
31957# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
319580	string		tfMR			MS Windows help Full Text Search index
31959!:mime application/x-winhelp-fts
31960!:ext	fts
31961>16	string		>\0			for "%s"
31962
31963# Summary: Hyper terminal
31964# Extension: .ht
31965# Created by: unknown
319660	string		HyperTerminal\040
31967>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
31968
31969# https://ithreats.files.wordpress.com/2009/05/\040
31970# lnk_the_windows_shortcut_file_format.pdf
31971# Summary: Windows shortcut
31972# Extension: .lnk
31973# Created by: unknown
31974# 'L' + GUUID
319750	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
31976>20	lelong&1	1	\b, Item id list present
31977>20	lelong&2	2	\b, Points to a file or directory
31978>20	lelong&4	4	\b, Has Description string
31979>20	lelong&8	8	\b, Has Relative path
31980>20	lelong&16	16	\b, Has Working directory
31981>20	lelong&32	32	\b, Has command line arguments
31982>20	lelong&64	64	\b, Icon
31983>>56	lelong		x	\b number=%d
31984>24	lelong&1	1	\b, Read-Only
31985>24	lelong&2	2	\b, Hidden
31986>24	lelong&4	4	\b, System
31987>24	lelong&8	8	\b, Volume Label
31988>24	lelong&16	16	\b, Directory
31989>24	lelong&32	32	\b, Archive
31990>24	lelong&64	64	\b, Encrypted
31991>24	lelong&128	128	\b, Normal
31992>24	lelong&256	256	\b, Temporary
31993>24	lelong&512	512	\b, Sparse
31994>24	lelong&1024	1024	\b, Reparse point
31995>24	lelong&2048	2048	\b, Compressed
31996>24	lelong&4096	4096	\b, Offline
31997>28	leqwdate	x	\b, ctime=%s
31998>36	leqwdate	x	\b, mtime=%s
31999>44	leqwdate	x	\b, atime=%s
32000>52	lelong		x	\b, length=%u, window=
32001>60	lelong&1	1	\bhide
32002>60	lelong&2	2	\bnormal
32003>60	lelong&4	4	\bshowminimized
32004>60	lelong&8	8	\bshowmaximized
32005>60	lelong&16	16	\bshownoactivate
32006>60	lelong&32	32	\bminimize
32007>60	lelong&64	64	\bshowminnoactive
32008>60	lelong&128	128	\bshowna
32009>60	lelong&256	256	\brestore
32010>60	lelong&512	512	\bshowdefault
32011#>20	lelong&1	0
32012#>>20	lelong&2	2
32013#>>>(72.l-64)	pstring/h	x	\b [%s]
32014#>20	lelong&1	1
32015#>>20	lelong&2	2
32016#>>>(72.s)	leshort	x
32017#>>>&75	pstring/h	x	\b [%s]
32018
32019# Summary: Outlook Personal Folders
32020# Created by: unknown
320210	lelong		0x4E444221	Microsoft Outlook email folder
32022>10	leshort		0x0e		(<=2002)
32023>10	leshort		0x17		(>=2003)
32024
32025
32026# Summary: Windows help cache
32027# Created by: unknown
320280	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
32029
32030
32031# Summary: IE cache file
32032# Created by: Christophe Monniez
320330	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
32034>20	string	>\0			version %s
32035
32036
32037# Summary: Registry files
32038# Created by: unknown
32039# Modified by (1): Joerg Jenderek
320400	string		regf		MS Windows registry file, NT/2000 or above
320410	string		CREG		MS Windows 95/98/ME registry file
320420	string		SHCC3		MS Windows 3.1 registry file
32043
32044
32045# Summary: Windows Registry text
32046# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
32047# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
32048# Submitted by: Abel Cheung <abelcheung@gmail.com>
32049# Update: Joerg Jenderek
32050#		Windows 3-9X variant
320510	string		REGEDIT
32052# skip ASCII text like "REGEDITor.txt" but match
32053# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
32054>7	search/3	\n			Windows Registry text
32055!:mime	text/x-ms-regedit
32056!:ext	reg
32057#		Windows 9X variant
32058>>0	string		REGEDIT4		(Win95 or above)
32059#		Windows 2K ANSI variant
320600	string		Windows\ Registry\ Editor\
32061>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
32062!:mime	text/x-ms-regedit
32063!:ext	reg
32064#		Windows 2K UTF-16 variant
320652	lestring16	Windows\ Registry\ Editor\
32066>0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
32067# relative offset not working
32068#>&0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
32069!:mime	text/x-ms-regedit
32070!:ext	reg
32071#		WINE variant
32072# URL: https://en.wikipedia.org/wiki/Wine_(software)
32073# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
32074# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
32075#	instead binary hiv structure like Windows
320760	string	WINE\ REGISTRY\ Version\ 	WINE registry text
32077# version 2
32078>&0	string	x				\b, version %s
32079!:mime	text/x-wine-extension-reg
32080!:ext	reg
32081
32082# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
32083# empty ,comment , section
32084# PR/383: remove unicode BOM because it is not portable across regex impls
32085#0	regex/s		\\`(\\r\\n|;|[[])
32086# empty line CRLF
320870	ubeshort	0x0D0A
32088>0	use		ini-file
32089# comment line
320900	string		;
32091>0	use		ini-file
32092# section line
320930	string		[
32094>0	use		ini-file
32095# check and then display Windows INItialization configuration
320960	name		ini-file
32097# look for left bracket in section line
32098>0	search/8192	[
32099# https://en.wikipedia.org/wiki/Autorun.inf
32100# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
32101# space after right bracket
32102# or AutoRun.Amd64 for 64 bit systems
32103# or only NL separator
32104>>&0	regex/c		\^(autorun)
32105# but sometimes total commander directory tree file "treeinfo.wc" with lines like
32106# [AUTORUN]
32107# [boot]
32108>>>&0	string		=]\r\n[					Total commander directory treeinfo.wc
32109!:mime text/plain
32110!:ext	wc
32111# From: Pal Tamas <folti@balabit.hu>
32112# Autorun File
32113>>>&0	string		!]\r\n[					Microsoft Windows Autorun file
32114!:mime application/x-setupscript
32115!:ext	inf
32116# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
32117# version strings ASCII coded case-independent for Windows setup information script file
32118>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
32119!:mime	application/x-setupscript
32120#!:mime application/x-wine-extension-inf
32121!:ext	inf
32122# NETCRC.INF OEMCPL.INF
32123>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
32124!:mime	application/x-setupscript
32125!:ext	inf
32126# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
32127# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
32128# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
32129>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
32130!:mime application/x-wine-extension-ini
32131#!:mime text/plain
32132# https://support.microsoft.com/kb/84709/
32133>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
32134!:mime application/x-wine-extension-ini
32135!:ext	ini
32136>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
32137!:mime application/x-wine-extension-ini
32138!:ext	ini
32139# https://technet.microsoft.com/en-us/library/cc722567.aspx
32140# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
32141>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
32142!:mime application/x-wine-extension-ini
32143!:ext	ini
32144# https://en.wikipedia.org/wiki/SYSTEM.INI
32145>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
32146!:mime application/x-wine-extension-ini
32147!:ext	ini
32148# http://www.mdgx.com/newtip6.htm
32149>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
32150!:mime application/x-wine-extension-ini
32151!:ext	ini
32152# https://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
32153>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
32154!:mime application/x-wine-extension-ini
32155!:ext	ini
32156# https://en.wikipedia.org/wiki/CONFIG.SYS
32157>>&0	regex/c		\^(menu)]					MS-DOS CONFIG.SYS
32158# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
32159# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE
32160# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE
32161# dos and w40 used in dual booting scene
32162!:ext	sys/dos/w40
32163# https://support.microsoft.com/kb/118579/
32164>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
32165!:ext	sys/dos
32166# http://chmspec.nongnu.org/latest/INI.html#HHP
32167>>&0	regex/c		\^(options)]\r\n				Microsoft HTML Help Project
32168!:mime text/plain
32169!:ext	hhp
32170# unknown keyword after opening bracket
32171>>&0	default				x
32172#>>>&0	string/c			x	UNKNOWN [%s
32173# look for left bracket of second section
32174>>>&0	search/8192			[
32175# version Strings FileIdentification
32176>>>>&0	string/c			version				Windows setup INFormation
32177!:mime application/x-setupscript
32178!:ext	inf
32179# https://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
32180>>>>&0	default				x
32181>>>>>&0	ubyte				x
32182# characters, digits, underscore and white space followed by right bracket
32183# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
32184>>>>>>&-1	regex			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
32185# NETDEF.INF multiarc.ini
32186#!:mime	application/x-setupscript
32187!:mime	application/x-wine-extension-ini
32188#!:mime	text/plain
32189!:ext	ini/inf
32190# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
321910	ubelong&0xFFff89FF	=0xFFFE0900
32192# look for left bracket in section line
32193>2	search/8192		[
32194# keyword without 1st letter which is maybe up-/down-case
32195>>&3	lestring16		ersion]			Windows setup INFormation
32196!:mime	application/x-setupscript
32197!:ext	inf
32198>>&3	lestring16		trings]			Windows setup INFormation
32199!:mime	application/x-setupscript
32200!:ext	inf
32201>>&3	lestring16		ourceDisksNames]	Windows setup INFormation
32202!:mime	application/x-setupscript
32203!:ext	inf
32204# netnwcli.inf start with ;---[ NetNWCli.INX ]
32205>>&3	default			x
32206# look for NL followed by left bracket
32207>>>&0	search/8192		\x0A\x00\x5b
32208>>>>&3	lestring16		ersion]			Windows setup INFormation
32209!:mime	application/x-setupscript
32210!:ext	inf
32211
32212# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
32213# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
32214# URL:		http://fileformats.archiveteam.org/wiki/INF_(Windows)
32215# Reference:	http://en.verysource.com/code/10350344_1/inf.h.html
32216# Note:		stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository
32217# check for valid major and minor versions: 101h - 303h
322180		leshort&0xFcFc	=0x0000
32219# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp
32220>0		leshort&0x0303	!0x0000
32221# test for valid InfStyles: 1 2
32222>>2		uleshort	>0
32223>>>2		uleshort	<3
32224# look for colon in WinDirPath after PNF header
32225#>>>>0x59	search/18	:
32226>>>>0	use	PreCompiledInf
322270	name	PreCompiledInf
32228>0		uleshort	x	Windows Precompiled iNF
32229!:mime	application/x-pnf
32230!:ext	pnf
32231# major version 1 for older Windows like XP and 3 since about Windows Vista
32232# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362
32233>1		ubyte		x		\b, version %u
32234>0		ubyte		x		\b.%u
32235>0		uleshort	=0x0101		(Windows
32236>>4	ulelong&0x00000001	!0x00000001	98)
32237>>4	ulelong&0x00000001	=0x00000001	XP)
32238>0		uleshort	=0x0301		(Windows Vista-8.1)
32239>0		uleshort	=0x0302		(Windows 10 older)
32240>0		uleshort	=0x0303		(Windows 10)
32241# 1 ,2 (windows 98 SE)
32242>2		uleshort	!2		\b, InfStyle %u
32243#	PNF_FLAG_IS_UNICODE		0x00000001
32244#	PNF_FLAG_HAS_STRINGS		0x00000002
32245#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
32246#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
32247#	PNF_FLAG_INF_VERIFIED		0x00000010
32248#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
32249#	UNKNOWN8			0x00000080
32250#	UNKNOWN				0x00000100
32251#	UNKNOWN1			0x01000000
32252#	UNKNOWN2			0x02000000
32253>4	ulelong&0x03000180	>0		\b, flags
32254>>4	ulelong			x		0x%x
32255>4	ulelong&0x00000001	0x00000001	\b, unicoded
32256>4	ulelong&0x00000002	0x00000002	\b, has strings
32257>4	ulelong&0x00000004	0x00000004	\b, src URL
32258>4	ulelong&0x00000008	0x00000008	\b, volatile dir ids
32259>4	ulelong&0x00000010	0x00000010	\b, verified
32260>4	ulelong&0x00000020	0x00000020	\b, digitally signed
32261# >4	ulelong&0x00000080	0x00000080	\b, UNKNOWN8
32262# >4	ulelong&0x00000100	0x00000100	\b, UNKNOWN
32263# >4	ulelong&0x01000000	0x01000000	\b, UNKNOWN1
32264# >4	ulelong&0x02000000	0x02000000	\b, UNKNOWN2
32265#>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
32266# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
32267# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF
32268#>12		uleshort	x		\b, InfSubstValueCount 0x%x
32269# only < 9 found: 8 hcw85b64.PNF
32270#>14		uleshort	x		\b, InfVersionDatumCount 0x%x
32271# only found values lower 0x0000ffff ??
32272#>16		ulelong		x		\b, InfVersionDataSize 0x%x
32273# only found positive values lower 0x00ffFFff for InfVersionDataOffset
32274>20		ulelong		x		\b, at 0x%x
32275>4	ulelong&0x00000001	=0x00000001
32276# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
32277>>(20.l)	lestring16	x		"%s"
32278>4	ulelong&0x00000001	!0x00000001
32279>>(20.l)	string		x		"%s"
32280# FILETIME is number of 100-nanosecond intervals since 1 January 1601
32281#>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
32282#>24		foodate-0xbar	x		\b, InfVersionLastWriteTime %s
32283# for Windows 98, XP
32284>0		uleshort	<0x0102
32285# only found values lower 0x00ffFFff
32286# often 70 but also 78h for corelist.PNF
32287# >>32		ulelong		x		\b, StringTableBlockOffset 0x%x
32288# >>36		ulelong		x		\b, StringTableBlockSize 0x%x
32289# >>40		ulelong		x		\b, InfSectionCount 0x%x
32290# >>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
32291# >>48		ulelong		x		\b, InfSectionBlockSize 0x%x
32292# >>52		ulelong		x		\b, InfLineBlockOffset 0x%x
32293# >>56		ulelong		x		\b, InfLineBlockSize 0x%x
32294# >>60		ulelong		x		\b, InfValueBlockOffset 0x%x
32295# >>64		ulelong		x		\b, InfValueBlockSize 0x%x
32296# WinDirPathOffset
32297# like 58h, which means direct after PNF header
32298#>>68		ulelong		x		\b, at 0x%x
32299>>68		ulelong		x
32300>>>4	ulelong&0x00000001	=0x00000001
32301#>>>>(68.l)	ubequad		=0x43003a005c005700
32302# normally unicoded C:\Windows
32303#>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
32304>>>>(68.l)	ubequad		!0x43003a005c005700
32305>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
32306>>>4	ulelong&0x00000001	!0x00000001
32307# normally ASCII C:\WINDOWS
32308#>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
32309>>>>(68.l)	string		!C:\\WINDOWS
32310>>>>>(68.l)	string		x		\b, WinDirPath "%s"
32311# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
32312>>>72		ulelong		>0		\b,
32313>>>>4	ulelong&0x00000001	=0x00000001
32314>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
32315>>>>4	ulelong&0x00000001	!0x00000001
32316# seldom C:\ instead empty
32317>>>>>(72.l)	string		x		OsLoaderPath "%s"
32318# 1fdh
32319#>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
32320# only 407h found
32321>>>78		uleshort	!0x409		\b, LanguageID %x
32322#>>>78		uleshort	=0x409		\b, LanguageID %x
32323# InfSourcePathOffset often 0
32324>>>80		ulelong		>0		\b, at 0x%x
32325>>>>4	ulelong&0x00000001	=0x00000001
32326>>>>>(80.l)	lestring16	x		SourcePath "%s"
32327>>>>4	ulelong&0x00000001	!0x00000001
32328>>>>>(80.l)	string		>\0		SourcePath "%s"
32329# OriginalInfNameOffset often 0
32330>>>84		ulelong		>0		\b, at 0x%x
32331>>>>4	ulelong&0x00000001	=0x00000001
32332>>>>>(84.l)	lestring16	x		InfName "%s"
32333>>>>4	ulelong&0x00000001	!0x00000001
32334>>>>>(84.l)	string		>\0		InfName "%s"
32335
32336# for newer Windows like Vista, 7 , 8.1 , 10
32337>0		uleshort	>0x0101
32338>>80	ulelong			x		\b, at 0x%x WinDirPath
32339>>>4	ulelong&0x00000001	0x00000001
32340# normally unicoded C:\Windows
32341#>>>>(80.l)	ubequad		=0x43003a005c005700
32342#>>>>>(80.l)	lestring16	x		"%s"
32343>>>>(80.l)	ubequad		!0x43003a005c005700
32344>>>>>(80.l)	lestring16	x		"%s"
32345# language id: 0 407h~german 409h~English_US
32346>>90		uleshort	!0x409		\b, LanguageID %x
32347#>>90		uleshort	=0x409		\b, LanguageID %x
32348>>92	ulelong			>0		\b, at 0x%x
32349>>>4	ulelong&0x00000001	0x00000001
32350# language string like: de-DE en-US
32351>>>>(92.l)	lestring16	x		language %s
32352
32353# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
32354# Extension: .bkf
32355# Created by: Joerg Jenderek
32356# URL: https://en.wikipedia.org/wiki/NTBackup
32357# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
32358# Descriptor BloCK name of Microsoft Tape Format
323590	string			TAPE
32360# Format Logical Address is zero
32361>20	ulequad			0
32362# Reserved for MBC is zero
32363>>28	uleshort		0
32364# Control Block ID is zero
32365>>>36	ulelong			0
32366# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
32367>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
32368#!:mime application/x-ntbackup
32369!:ext bkf
32370# OS ID
32371>>>>>10	ubyte			1		\b NetWare
32372>>>>>10	ubyte			13		\b NetWare SMS
32373>>>>>10	ubyte			14		\b NT
32374>>>>>10	ubyte			24		\b 3
32375>>>>>10	ubyte			25		\b OS/2
32376>>>>>10	ubyte			26		\b 95
32377>>>>>10	ubyte			27		\b Macintosh
32378>>>>>10	ubyte			28		\b UNIX
32379# OS Version (2)
32380#>>>>>11	ubyte			x		OS V=%x
32381# MTF_CONTINUATION	Media Sequence Number > 1
32382#>>>>>4	ulelong&0x00000001	!0		\b, continued
32383# MTF_COMPRESSION
32384>>>>>4	ulelong&0x00000004	!0		\b, compressed
32385# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
32386>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
32387>>>>>4	ulelong&0x00020000	0
32388# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
32389>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
32390# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
32391>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
32392# Offset To First Event 238h,240h,28Ch
32393#>>>>>8	uleshort		x		\b, event offset %4.4x
32394# Displayable Size (20e0230h 20e024ch 20e0224h)
32395#>>>>>8	ulequad			x		dis. size %16.16llx
32396# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
32397#>>>>>52	ulelong			x		family ID %8.8x
32398# TAPE Attributes (3)
32399#>>>>>56	ulelong			x		TAPE %8.8x
32400# Media Sequence Number
32401>>>>>60	uleshort		>1		\b, sequence %u
32402# Password Encryption Algorithm (3)
32403>>>>>62	uleshort		>0		\b, 0x%x encrypted
32404# Soft Filemark Block Size * 512 (2)
32405#>>>>>64	uleshort		=2		\b, soft size %u*512
32406>>>>>64	uleshort		!2		\b, soft size %u*512
32407# Media Based Catalog Type (1,2)
32408#>>>>>66	uleshort		x		\b, catalog type %4.4x
32409# size of Media Name (66,68,6Eh)
32410>>>>>68	uleshort		>0
32411# offset of Media Name (5Eh)
32412>>>>>>70	uleshort	>0
32413# 0~, 1~ANSI, 2~UNICODE
32414>>>>>>>48	ubyte		1
32415# size terminated ansi coded string normally followed by "MTF Media Label"
32416>>>>>>>>(70.s)	string		>\0		\b, name: %s
32417>>>>>>>48	ubyte		2
32418# Not null, but size terminated unicoded string
32419>>>>>>>>(70.s)	lestring16	x		\b, name: %s
32420# size of Media Label (104h)
32421>>>>>72	uleshort		>0
32422# offset of Media Label (C4h,C6h,CCh)
32423>>>>>74		uleshort	>0
32424>>>>>>48	ubyte		1
32425#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
32426>>>>>>>(74.s)	string		>\0		\b, label: %s
32427>>>>>>48	ubyte		2
32428>>>>>>>(74.s)	lestring16	x		\b, label: %s
32429# size of password name (0,1Ch)
32430#>>>>>76	uleshort		>0		\b, password size %4.4x
32431# Software Vendor ID (CBEh)
32432>>>>>86	uleshort		x		\b, software (0x%x)
32433# size of Software Name (6Eh)
32434>>>>>80	uleshort		>0
32435# offset of Software Name (1C8h,1CAh,1D0h)
32436>>>>>>82	uleshort	>0
32437# 1~ANSI, 2~UNICODE
32438>>>>>>>48	ubyte		1
32439>>>>>>>>(82.s)	string		>\0		\b: %s
32440>>>>>>>48	ubyte		2
32441# size terminated unicoded coded string normally followed by "SPAD"
32442>>>>>>>>(82.s)	lestring16	x		\b: %s
32443# Format Logical Block Size (512,1024)
32444#>>>>>84	uleshort		=1024		\b, block size %u
32445>>>>>84	uleshort		!1024		\b, block size %u
32446# Media Date of MTF_DATE_TIME type with 5 bytes
32447#>>>>>>88	ubequad			x		DATE %16.16llx
32448# MTF Major Version (1)
32449#>>>>>>93	ubyte		x		\b, MFT version %x
32450#
32451
32452# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
32453# Reference: https://www.cryer.co.uk/file-types/p/pal.htm
32454# Created by: Joerg Jenderek
32455# Note: there exist other color palette formats also with .pal extension
324560	string	JASC-PAL\r\n	PaintShop Pro color palette
32457#!:mime	text/plain
32458# PspPalette extension is used by newer (probably 8) PaintShopPro versions
32459!:ext	pal/PspPalette
32460# 2nd line contains palette file version. For example "0100"
32461>10	string	!0100		\b, version %.4s
32462# third line contains the number of colours: 16 256 ...
32463>16	string	x		\b, %.3s colors
32464
32465# URL: https://en.wikipedia.org/wiki/Innosetup
32466# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
32467# Created by: Joerg Jenderek
32468# Note:	created by like "InnoSetup self-extracting archive" inside ./msdos
32469# TrID labeles the entry as "Inno Setup Uninstall Log"
32470#	TUninstallLogID
324710	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
32472!:mime	application/x-innosetup
32473# unins000.dat, unins001.dat, ...
32474!:ext	dat
32475# " 64-bit" variant
32476>0x1c	string		>\0				\b%.7s
32477# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
32478>0xc0	string		x				%s
32479# AppId[0x80] is similar to AppName or
32480# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
32481>0x40	ubyte		0x7b
32482>>0x40	string		x				%-.38s
32483# do not know how this log version correlates to program version
32484>0x140	ulelong		x				\b, version 0x%x
32485# NumRecs
32486#>0x144	ulelong		x				\b, 0x%4.4x records
32487# EndOffset means files size
32488>0x148	ulelong		x				\b, %u bytes
32489# Flags 5 25h 35h
32490#>0x14c	ulelong		x				\b, flags %8.8x
32491# Reserved: array[0..26] of Longint
32492# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
32493>0x140	ulelong		<1000
32494# hostname
32495>>0x1d6	pstring		x				\b, %s
32496# user name
32497>>>&0	pstring		x				\b\%s
32498# directory like C:\Program Files (x86)\GnuWin32
32499>>>>&0	pstring		x				\b, "%s"
32500# version 1000 or higher implies unicode
32501>0x140	ulelong		>999
32502# hostname
32503>>0x1db	lestring16	x				\b, %-.9s
32504# utf string variant with prepending fe??ffFFff
32505>>0x1db	search/43	\xFF\xFF\xFF
32506# user name
32507>>>&0	lestring16	x				\b\%-.9s
32508>>>&0	search/43	\xFF\xFF\xFF
32509# directory like C:\Program Files\GIMP 2
32510>>>>&0	lestring16	x				\b, %-.42s
32511
32512# Windows Imaging (WIM) Image
32513# Update: Joerg Jenderek at Mar 2019
32514# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
32515# Reference: https://download.microsoft.com/download/f/e/f/
32516# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
32517# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
325180	string		MSWIM\000\000\000
32519>0	use		wim-archive
32520# https://wimlib.net/man1/wimoptimize.html
325210	string		WLPWM\000\000\000
32522>0	use		wim-archive
325230	name		wim-archive
32524# _WIMHEADER_V1_PACKED ImageTag[8]
32525>0	string		x			Windows imaging
32526!:mime	application/x-ms-wim
32527# TO avoid in file version 5.36 error like
32528# Magdir/windows, 760: Warning: Current entry does not yet have a description
32529# file: could not find any valid magic files! (No error)
32530# splitted WIM
32531>16	ulelong		&0x00000008		(SWM
32532!:ext	swm
32533# usPartNumber; 1, unless the file was split into multiple parts
32534>>40	uleshort	x			\b %u
32535# usTotalParts; The total number of WIM file parts in a spanned set
32536>>42	uleshort	x			\b of %u) image
32537# non splitted WIM
32538>16	ulelong		^0x00000008
32539# https://wimlib.net/man1/wimmount.html
32540# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
32541>>12	ulelong		3584			(ESD) image
32542!:ext	esd
32543>>12	ulelong		!3584			(WIM) image
32544!:ext	wim
32545>0	string/b	WLPWM\000\000\000	\b, wimlib pipable format
32546# cbSize size of the WIM header in bytes like 208
32547#>8	ulelong		x			\b, headersize %u
32548# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14
32549>14	uleshort	x			v%u
32550>13	ubyte		x			\b.%u
32551# dwImageCount; The number of images contained in the WIM file
32552>44	ulelong		>1			\b, %u images
32553# dwBootIndex
32554# 1-based index of the bootable image of the WIM, or 0 if no image is bootable
32555>0x78	ulelong		>0			\b, bootable no. %u
32556# dwFlags
32557#>16	ulelong		x			\b, flags 0x%8.8x
32558#define FLAG_HEADER_COMPRESSION		0x00000002
32559#define FLAG_HEADER_READONLY            0x00000004
32560#define FLAG_HEADER_SPANNED		0x00000008
32561#define FLAG_HEADER_RESOURCE_ONLY       0x00000010
32562#define FLAG_HEADER_METADATA_ONLY       0x00000020
32563#define FLAG_HEADER_WRITE_IN_PROGRESS   0x00000040
32564#define FLAG_HEADER_RP_FIX		0x00000080 reparse point fixup
32565#define FLAG_HEADER_COMPRESS_RESERVED   0x00010000
32566#define FLAG_HEADER_COMPRESS_XPRESS     0x00020000
32567#define FLAG_HEADER_COMPRESS_LZX	0x00040000
32568#define FLAG_HEADER_COMPRESS_LZMS	0x00080000
32569#define FLAG_HEADER_COMPRESS_XPRESS2    0x00100000 wimlib-1.13.0\include\wimlib\header.h
32570# XPRESS, with small chunk size
32571>16	ulelong		&0x00100000		\b, XPRESS2
32572>16	ulelong		&0x00080000		\b, LZMS
32573>16	ulelong		&0x00040000		\b, LZX
32574>16	ulelong		&0x00020000		\b, XPRESS
32575>16	ulelong		&0x00000002		compressed
32576>16	ulelong		&0x00000004		\b, read only
32577>16	ulelong		&0x00000010		\b, resource only
32578>16	ulelong		&0x00000020		\b, metadata only
32579>16	ulelong		&0x00000080		\b, reparse point fixup
32580#>16	ulelong		&0x00010000		\b, RESERVED
32581# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed
32582#>20	ulelong		>0			\b, chunk size %u bytes
32583# gWIMGuid
32584#>24	ubequad		x			\b, GUID 0x%16.16llx
32585#>>32	ubequad		x			\b%16.16llx
32586# rhOffsetTable; the location of the resource lookup table
32587# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size
32588#>48	ubequad		x			\b, rhOffsetTable 0x%16.16llx
32589# rhXmlData; the location of the XML data
32590#>0x50	ulelong		x			\b, at 0x%8.8x
32591# NOT WORKING \xff\xfe<\0W\0I\0M\0
32592#>(0x50.l)	ubequad	x			\b, xml=%16.16llx
32593# rhBootMetadata; the location of the metadata resource
32594#>0x60	ubequad		x			\b, rhBootMetadata 0x%16.16llx
32595# rhIntegrity; the location of integrity table used to verify files
32596#>0x7c	ubequad		x			\b, rhIntegrity 0x%16.16llx
32597# Unused[60]
32598#>148	ubequad		!0			\b,unused 0x%16.16llx
32599#
32600
32601# From:		Joerg Jenderek
32602# URL:		https://en.wikipedia.org/wiki/Windows_Easy_Transfer
32603# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml
32604# Note:		called "Windows Easy Transfer migration data" by TrID,
32605#		"Migration Store" or "EasyTransfer file" by Microsoft
326060		string		1giM	Windows Easy Transfer migration data
32607#!:mime		application/octet-stream
32608!:mime		application/x-ms-mig
32609!:ext		mig
32610>0x18		string		=MRTS	without password
32611# data offset with 1 space at end
32612>>0x1c		ulelong+0x38	x	\b, at 0x%x
32613# look for zlib compressed data by ./compress
32614>>(0x1c.l+0x38)	ubyte		x
32615>>>&-1	indirect	x
32616# in password protected examples MRTS comes some bytes further
32617>0x18		string		!MRTS	with password
32618# look for first MRTS tag
32619>0x18		search/29/b	MRTS
32620# probably first file name length like 178, ...
32621#>>&0		ulelong		x	\b, 1st length %u
32622# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
32623>>&20		lestring16	x	\b, 1st %-s
32624
32625# Microsoft SYLK
32626# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK)
32627# https://outflank.nl/upload/sylksum.txt
326280	string	ID;P	Microsoft SYLK program
32629>4	string	>0	\b, created by %s
32630!:ext	slk/sylk
32631
32632#------------------------------------------------------------------------------
32633# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
32634# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
32635#
326360	string	RGDB	CRDA wireless regulatory database file
32637>4	belong	19	(Version 1)
32638
32639#------------------------------------------------------------------------------
32640# $File: wordprocessors,v 1.24 2020/05/22 19:28:47 christos Exp $
32641# wordprocessors:  file(1) magic fo word processors.
32642#
32643####### PWP file format used on Smith Corona Personal Word Processors:
326442	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
32645>24	byte	2	\b, single spaced
32646>24	byte	3	\b, 1.5 spaced
32647>24	byte	4	\b, double spaced
32648>25	byte	0x42	\b, letter
32649>25	byte	0x54	\b, legal
32650>26	byte	0x46	\b, A4
32651
32652# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
32653# reference:	http://mark0.net/download/triddefs_xml.7z
32654#		/defs/w/wps-works-dos.trid.xml
32655# From:	Joerg Jenderek
32656# Note:	older non OLE 2 Compound based versions
326570	ubeshort	=0x01FE
32658>112	ubeshort	=0x0100		Microsoft Works 1-3 (DOS) or 2 (Windows) document
32659# title like THE GREAT KHAN GAME
32660>>0x100	string		x		%s
32661!:mime	application/vnd-ms-works
32662#!:mime	application/x-msworks
32663# https://www.macdisk.com/macsigen.php
32664!:apple	????AWWP
32665!:ext	wps
32666
32667# Corel/WordPerfect
326680	string	\xffWPC
32669# WordPerfect
32670>8	byte	1
32671>>9	byte	1	WordPerfect macro
32672>>9	byte	2	WordPerfect help file
32673>>9	byte	3	WordPerfect keyboard file
32674>>9	byte	10	WordPerfect document
32675>>9	byte	11	WordPerfect dictionary
32676>>9	byte	12	WordPerfect thesaurus
32677>>9	byte	13	WordPerfect block
32678>>9	byte	14	WordPerfect rectangular block
32679>>9	byte	15	WordPerfect column block
32680>>9	byte	16	WordPerfect printer data
32681>>9	byte	19	WordPerfect printer data
32682>>9	byte	20	WordPerfect driver resource data
32683>>9	byte	22	WordPerfect graphic image
32684>>9	byte	23	WordPerfect hyphenation code
32685>>9	byte	24	WordPerfect hyphenation data
32686>>9	byte	25	WordPerfect macro resource data
32687>>9	byte	27	WordPerfect hyphenation lex
32688>>9	byte	29	WordPerfect wordlist
32689>>9	byte	30	WordPerfect equation resource data
32690>>9	byte	33	WordPerfect spell rules
32691>>9	byte	34	WordPerfect dictionary rules
32692>>9	byte	39	WordPerfect spell rules (Microlytics)
32693>>9	byte	43	WordPerfect settings file
32694>>9	byte	44	WordPerfect 3.5 document
32695>>9	byte	45	WordPerfect 4.2 document
32696>>9	byte	69	WordPerfect dialog file
32697>>9	byte	76	WordPerfect button bar
32698>>9	default x
32699>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
32700# Corel Shell
32701>8	byte	2
32702>>9	byte	1	Corel shell macro
32703>>9	byte	10	Corel shell definition
32704>>9	default x
32705>>>9	byte	x	Corel Shell: Unknown filetype %d
32706# Corel Notebook
32707>8	byte	3
32708>>9	byte	1	Corel Notebook macro
32709>>9	byte	2	Corel Notebook help file
32710>>9	byte	3	Corel Notebook keyboard file
32711>>9	byte	10	Corel Notebook definition
32712>>9	default	x
32713>>>9	byte	x	Corel Notebook: Unknown filetype %d
32714# Corel Calculator
32715>8	byte	4
32716>>9	byte	2	Corel Calculator help file
32717>>9	default	x
32718>>>9	byte	x	Corel Calculator: Unknown filetype %d
32719# Corel File Manager
32720>8	byte	5
32721>>9	default	x
32722>>>9	byte	x	Corel File Manager: Unknown filetype %d
32723# Corel Calendar
32724>8	byte	6
32725>>9	byte 	2	Corel Calendar help file
32726>>9	byte 	10	Corel Calendar data file
32727>>9	default	x
32728>>>9	byte	x	Corel Calendar: Unknown filetype %d
32729# Corel Program Editor/Ed Editor
32730>8	byte	7
32731>>9	byte	1	Corel Editor macro
32732>>9	byte	2	Corel Editor help file
32733>>9	byte	3	Corel Editor keyboard file
32734>>9	byte	25	Corel Editor macro resource file
32735>>9	default	x
32736>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
32737# Corel Macro Editor
32738>8	byte	8
32739>>9	byte 	1	Corel Macro editor macro
32740>>9	byte 	2	Corel Macro editor help file
32741>>9	byte	3	Corel Macro editor keyboard file
32742>>9	default	x
32743>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
32744# Corel Plan Perfect
32745>8	byte	9
32746>>9	default	x
32747>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
32748# Corel DataPerfect
32749>8	byte	10
32750# CHECK: Don't these belong into product 9?
32751>>9	byte	1	Corel PlanPerfect macro
32752>>9	byte	2	Corel PlanPerfect help file
32753>>9	byte	3	Corel PlanPerfect keyboard file
32754>>9	byte	10	Corel PlanPerfect worksheet
32755>>9	byte	15	Corel PlanPerfect printer definition
32756>>9	byte	18	Corel PlanPerfect graphic definition
32757>>9	byte	19	Corel PlanPerfect data
32758>>9	byte	20	Corel PlanPerfect temporary printer
32759>>9	byte	25	Corel PlanPerfect macro resource data
32760>>9	default	x
32761>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
32762# Corel Mail
32763>8	byte	11
32764>>9	byte	2	Corel Mail help file
32765>>9	byte	5	Corel Mail distribution list
32766>>9	byte	10	Corel Mail out box
32767>>9	byte	11	Corel Mail in box
32768>>9	byte	20	Corel Mail users archived mailbox
32769>>9	byte	21	Corel Mail archived message database
32770>>9	byte	22	Corel Mail archived attachments
32771>>9	default	x
32772>>>9	byte	x	Corel Mail: Unknown filetype %d
32773# Corel Printer
32774>8	byte	12
32775>>9	byte	11	Corel Printer temporary file
32776>>9	default	x
32777>>>9	byte	x	Corel Printer: Unknown filetype %d
32778# Corel Scheduler
32779>8	byte	13
32780>>9	byte	2	Corel Scheduler help file
32781>>9	byte	10	Corel Scheduler in file
32782>>9	byte	11	Corel Scheduler out file
32783>>9	default	x
32784>>>9	byte	x	Corel Scheduler: Unknown filetype %d
32785# Corel WordPerfect Office
32786>8	byte	14
32787>>9	byte	10	Corel GroupWise settings file
32788>>9	byte	17	Corel GroupWise directory services
32789>>9	byte	43	Corel GroupWise settings file
32790>>9	default	x
32791>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
32792# Corel DrawPerfect
32793>8	byte	15
32794>>9	default	x
32795>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
32796# Corel LetterPerfect
32797>8	byte	16
32798>>9	default	x
32799>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
32800# Corel Terminal
32801>8	byte	17
32802>>9	byte	10	Corel Terminal resource data
32803>>9	byte	11	Corel Terminal resource data
32804>>9	byte	43	Corel Terminal resource data
32805>>9	default	x
32806>>>9	byte	x	Corel Terminal: Unknown filetype %d
32807# Corel loadable file
32808>8	byte	18
32809>>9	byte	10	Corel loadable file
32810>>9	byte	11	Corel GUI loadable text
32811>>9	byte	12	Corel graphics resource data
32812>>9	byte	13	Corel printer settings file
32813>>9	byte	14	Corel port definition file
32814>>9	byte	15	Corel print queue parameters
32815>>9	byte	16	Corel compressed file
32816>>9	default	x
32817>>>9	byte	x	Corel loadable file: Unknown filetype %d
32818>>15	byte	0	\b, optimized for Intel
32819>>15	byte	1	\b, optimized for Non-Intel
32820# Network service
32821>8	byte	20
32822>>9	byte	10	Corel Network service msg file
32823>>9	byte	11	Corel Network service msg file
32824>>9	byte	12	Corel Async gateway login msg
32825>>9	byte	14	Corel GroupWise message file
32826>>9	default	x
32827>>>9	byte	x	Corel Network service: Unknown filetype %d
32828# GroupWise
32829>8	byte	31
32830>>9	byte	20	GroupWise admin domain database
32831>>9	byte	21	GroupWise admin host database
32832>>9	byte	23	GroupWise admin remote host database
32833>>9	byte	24	GroupWise admin ADS deferment data file
32834>>9	default	x
32835>>>9	byte	x	GroupWise: Unknown filetype %d
32836# IntelliTAG
32837>8	byte	33
32838>>9	byte	10	IntelliTAG (SGML) compiled DTD
32839>>9	default	x
32840>>>9	byte	x	IntelliTAG: Unknown filetype %d
32841# everything else
32842>8	default x
32843>>8	byte	x	Unknown Corel/Wordperfect product %d,
32844>>>9	byte	x	file type %d
32845>10	byte	0	\b, v5.
32846>10	byte	!0	\b, v%d.
32847>11	byte	x	\b%d
32848
32849# Hangul (Korean) Word Processor File
328500	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
32851
32852# CosmicBook, from Benoit Rouits
328530       string  CSBK    Ted Neslson's CosmicBook hypertext file
32854
328552       string  EYWR    AmigaWriter file
32856
32857# chi:  file(1) magic for ChiWriter files
328580       string          \\1cw\          ChiWriter file
32859>5      string          >\0             version %s
328600       string          \\1cw           ChiWriter file
32861
32862# Quark Express from https://www.garykessler.net/library/file_sigs.html
328632	string	IIXPR3			Intel Quark Express Document (English)
328642	string	IIXPRa			Intel Quark Express Document (Korean)
328652	string	MMXPR3			Motorola Quark Express Document (English)
32866!:mime	application/x-quark-xpress-3
328672	string	MMXPRa			Motorola Quark Express Document (Korean)
32868
32869# adobe indesign (document, whatever...) from querkan
328700	belong	0x0606edf5		Adobe InDesign
32871>16	string	DOCUMENT		Document
32872
32873#------------------------------------------------------------------------------
32874# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
32875#
32876# Contributor kenzo-:
32877# Reversed-engineered JS Ichitaro magic numbers
32878#
32879
328800	string		DOC
32881>43	byte		0x14	Just System Word Processor Ichitaro v4
32882!:mime	application/x-ichitaro4
32883>144	string	JDASH		application/x-ichitaro4
32884
328850	string		DOC
32886>43	byte		0x15	Just System Word Processor Ichitaro v5
32887!:mime	application/x-ichitaro5
32888
328890	string		DOC
32890>43	byte		0x16	Just System Word Processor Ichitaro v6
32891!:mime	application/x-ichitaro6
32892
32893# Type: Freemind mindmap documents
32894# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
328950	string/w	\<map\ version	Freemind document
32896!:mime	application/x-freemind
32897
32898# Type: Freeplane mindmap documents
32899# From: Felix Natter <fnatter@gmx.net>
329000       string/w        \<map\ version="freeplane  Freeplane document
32901!:mime  application/x-freeplane
32902
32903# Type:        Scribus
32904# From:        Werner Fink <werner@suse.de>
329050	string	\<SCRIBUSUTF8\ Version		Scribus Document
329060	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
32907!:mime	application/x-scribus
32908
32909# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
32910# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
329110	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
32912
32913# From:		Joerg Jenderek
32914# URL:		https://en.wikipedia.org/wiki/StarOffice
32915# Note:		used in Star-, Open- and Libre-Office
32916# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others
329170		ubeshort	0x0400
32918#>(2.s+8)	ubequad		x		\b, gap 0x%16.16llx
32919# test for null value in gap after theme name maybe unreliable
32920#>(2.s+9)	ubyte		0		\b, 0-byte
32921# look for keyword GALRESRV near the end
32922# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects
32923#>0		search/8415	GALRESRV	\b, GALRESRV found
32924# "neues thema6.thm" MorePictures, 315 objects
32925#>0		search/19299	GALRESRV	\b, GALRESRV FOUND
32926#>2		uleshort	x		\b, name length %u
32927# skip file2147.chk by check for positive name length like for sg16.thm "3D"
32928>2		uleshort	>0		StarOffice Gallery theme
32929!:mime		application/x-stargallery-thm
32930!:ext		thm
32931# gallery name
32932>>2		pstring/h	x		%s
32933# number of objects
32934>>(2.s+4)	ulelong		x		\b, %u object
32935# plural s
32936>>(2.s+4)	ulelong		!1		\bs
32937# if available then display first object name
32938>>(2.s+4)	ulelong		>0
32939# partial file name, URL or internal name like "dd2*" of 1st object or RESRV
32940>>>(2.s+11)	pstring/h	x		\b, 1st %s
32941
32942# From:	Joerg Jenderek
32943# URL:	http://fileformats.archiveteam.org/wiki/StarOffice_Gallery
32944# Note:	used in Star-, Open- and Libre-Office and found in directories like
32945#	%APPDATA%\Roaming\LibreOffice\4\user\gallery
32946#	$HOME/.config/libreoffice/4/user/gallery
329470	string		SGA3	StarOffice Gallery thumbnails
32948# Unknown like 0x04000?0001000142
32949#>4	ubequad		x	\b, UNKNOWN 0x%16.16llx
32950#!:mime	application/x-sdg
32951!:mime	application/x-stargallery-sdg
32952!:ext	sdg
32953# display image magic for debugging purpose like 'BM'
32954# looking like PC bitmap, Windows 3.x format with unknown compression
32955#>11	string		x	\b, image magic '%-.2s'
32956# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end
32957#>11	indirect	x	\b; contains
32958
32959
32960#------------------------------------------------------------------------------
32961# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $
32962# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php
32963# Cache format extracted from source:
32964# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
32965# Requires file >= 5.05
32966# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
329670		string		wsdl		PHP WSDL cache,
32968>4		byte		x		version 0x%02x
32969>6		ledate		x		\b, created %s
32970
32971# uri
32972>10		lelong		<0x7fffffff
32973>>10		pstring/l	x		\b, uri: "%s"
32974
32975# source
32976>>>&0		lelong		<0x7fffffff
32977>>>>&-4		pstring/l	x		\b, source: "%s"
32978
32979# target_ns
32980>>>>>&0		lelong		<0x7fffffff
32981>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
32982#------------------------------------------------------------------------------
32983# x68000:  file(1) magic for the Sharp Home Computer
32984# v1.0
32985# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
32986
32987# Yanagisawa PIC picture
329880	string		PIC
32989>3	search/0x200	\x1A
32990>>&0	search/0x200	\x0
32991>>>&0	ubyte		0		Yanagisawa PIC image file,
32992>>>>&0	ubyte&15	0		model: X68000,
32993>>>>&0	ubyte&15	1		model: PC-88VA,
32994>>>>&0	ubyte&15	2		model: FM-TOWNS,
32995>>>>&0	ubyte&15	3		model: MAC,
32996>>>>&0	ubyte&15	15		model: Generic,
32997>>>>&3	ubeshort	x		%dx
32998>>>>&5	ubeshort	x		\b%d,
32999>>>>&1	ubeshort	4		colors: 16
33000>>>>&1	ubeshort	8		colors: 256
33001>>>>&1	ubeshort	12		colors: 4096
33002>>>>&1	ubeshort	15		colors: 32768
33003>>>>&1	ubeshort	16		colors: 65536
33004>>>>&1	ubeshort	>16		colors: %d-bit
33005
33006
33007
33008#------------------------------------------------------------------------------
33009# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
33010# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
33011#
330120	string	%XDELTA%	XDelta binary patch file 0.14
330130	string	%XDZ000%	XDelta binary patch file 0.18
330140	string	%XDZ001%	XDelta binary patch file 0.20
330150	string	%XDZ002%	XDelta binary patch file 1.0
330160	string	%XDZ003%	XDelta binary patch file 1.0.4
330170	string	%XDZ004%	XDelta binary patch file 1.1
33018
330190	string \xD6\xC3\xC4\x00	VCDIFF binary diff
33020
33021#------------------------------------------------------------------------------
33022# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
33023# xenix:  file(1) magic for Microsoft Xenix
33024#
33025# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
33026# model" lifted from "magic.xenix", with comment "derived empirically;
33027# treat as folklore until proven"
33028#
33029# "small model", "large model", "huge model" stuff lifted from XXX
33030#
33031# XXX - "x.out" collides with PDP-11 archives
33032#
330330	string		core		core file (Xenix)
33034# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
33035# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
33036# Update: Joerg Jenderek
33037# recordtype~TranslatorHEADerRecord
330380	byte		0x80
33039# GRR: line above is too general as it catches also Extensible storage engine DataBase
33040# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
33041>1	uleshort	<1022
33042# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
33043>>1	uleshort	>0
33044# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
33045>>>3	ubyte		>0
33046# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
33047>>>>4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
33048#!:mime	application/octet-stream
33049!:mime	application/x-object
33050!:ext	o/a
33051>>>>>3	pstring		x		\b, "%s"
33052# checksum
33053#>>>>>(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
330540	leshort		0xff65		x.out
33055>2	string		__.SYMDEF	 randomized
33056>0	byte		x		archive
330570	leshort		0x206		Microsoft a.out
33058>8	leshort		1		Middle model
33059>0x1e	leshort		&0x10		overlay
33060>0x1e	leshort		&0x2		separate
33061>0x1e	leshort		&0x4		pure
33062>0x1e	leshort		&0x800		segmented
33063>0x1e	leshort		&0x400		standalone
33064>0x1e	leshort		&0x8		fixed-stack
33065>0x1c	byte		&0x80		byte-swapped
33066>0x1c	byte		&0x40		word-swapped
33067>0x10	lelong		>0		not-stripped
33068>0x1e	leshort		^0xc000		pre-SysV
33069>0x1e	leshort		&0x4000		V2.3
33070>0x1e	leshort		&0x8000		V3.0
33071>0x1c	byte		&0x4		86
33072>0x1c	byte		&0xb		186
33073>0x1c	byte		&0x9		286
33074>0x1c	byte		&0xa		386
33075>0x1f	byte		<0x040		small model
33076>0x1f	byte		=0x048		large model
33077>0x1f	byte		=0x049		huge model
33078>0x1e	leshort		&0x1		executable
33079>0x1e	leshort		^0x1		object file
33080>0x1e	leshort		&0x40		Large Text
33081>0x1e	leshort		&0x20		Large Data
33082>0x1e	leshort		&0x120		Huge Objects Enabled
33083>0x10	lelong		>0		not stripped
33084
330850	leshort		0x140		old Microsoft 8086 x.out
33086>0x3	byte		&0x4		separate
33087>0x3	byte		&0x2		pure
33088>0	byte		&0x1		executable
33089>0	byte		^0x1		relocatable
33090>0x14	lelong		>0		not stripped
33091
330920	lelong		0x206		b.out
33093>0x1e	leshort		&0x10		overlay
33094>0x1e	leshort		&0x2		separate
33095>0x1e	leshort		&0x4		pure
33096>0x1e	leshort		&0x800		segmented
33097>0x1e	leshort		&0x400		standalone
33098>0x1e	leshort		&0x1		executable
33099>0x1e	leshort		^0x1		object file
33100>0x1e	leshort		&0x4000		V2.3
33101>0x1e	leshort		&0x8000		V3.0
33102>0x1c	byte		&0x4		86
33103>0x1c	byte		&0xb		186
33104>0x1c	byte		&0x9		286
33105>0x1c	byte		&0x29		286
33106>0x1c	byte		&0xa		386
33107>0x1e	leshort		&0x4		Large Text
33108>0x1e	leshort		&0x2		Large Data
33109>0x1e	leshort		&0x102		Huge Objects Enabled
33110
331110	leshort		0x580		XENIX 8086 relocatable or 80286 small model
33112
33113#------------------------------------------------------------------------------
33114# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
33115# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
33116# Xilinx-Magic@RevRagnarok.com
33117# Got the info from FPGA-FAQ 0026
33118#
33119# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
33120# fixes at least reading of bitfiles from Spartan 2, 3, 6.
33121# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
33122#
33123# First there is the sync header and its length
331240	beshort 0x0009
33125>2 	belong	=0x0ff00ff0
33126>>&0	belong  =0x0ff00ff0
33127>>>&0	byte    =0x00
33128>>>&1   beshort =0x0001
33129>>>&3	string	a	Xilinx BIT data
33130# Next is a Pascal-style string with the NCD name. We want to capture that.
33131>>>>&0	   pstring/H	x	- from %s
33132# And then 'b'
33133>>>>>&1    string b
33134# Then the model / part number:
33135>>>>>>&0   pstring/H    x       - for %s
33136# Then 'c'
33137>>>>>>>&1 string c
33138# Then the build-date
33139>>>>>>>>&0 pstring/H    x       - built %s
33140# Then 'd'
33141>>>>>>>>>&1   string d
33142# Then the build-time
33143>>>>>>>>>>&0  pstring/H x        \b(%s)
33144# Then 'e'
33145>>>>>>>>>>>&1  string e
33146# And length of data
33147>>>>>>>>>>>>&0 belong x          - data length 0x%x
33148
33149# Raw bitstream files
331500      long    0xffffffff
33151>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
33152
33153#------------------------------------------------------------------------------
33154# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
33155# xo65 object files
33156# From: "Ullrich von Bassewitz" <uz@cc65.org>
33157#
331580	string		\x55\x7A\x6E\x61	xo65 object,
33159>4	leshort		x			version %d,
33160>6	leshort&0x0001 =0x0001			with debug info
33161>6	leshort&0x0001 =0x0000			no debug info
33162
33163# xo65 library files
331640	string		\x6E\x61\x55\x7A	xo65 library,
33165>4	leshort		x			version %d
33166
33167# o65 object files
331680	string		\x01\x00\x6F\x36\x35	o65
33169>6	leshort&0x1000	=0x0000			executable,
33170>6	leshort&0x1000	=0x1000			object,
33171>5	byte		x			version %d,
33172>6	leshort&0x8000	=0x8000			65816,
33173>6	leshort&0x8000	=0x0000			6502,
33174>6	leshort&0x2000	=0x2000			32 bit,
33175>6	leshort&0x2000	=0x0000			16 bit,
33176>6	leshort&0x4000	=0x4000			page reloc,
33177>6	leshort&0x4000	=0x0000			byte reloc,
33178>6	leshort&0x0003	=0x0000			alignment 1
33179>6	leshort&0x0003	=0x0001			alignment 2
33180>6	leshort&0x0003	=0x0002			alignment 4
33181>6	leshort&0x0003	=0x0003			alignment 256
33182
33183#------------------------------------------------------------------------------
33184# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $
33185# xwindows:  file(1) magic for various X/Window system file formats.
33186
33187# Compiled X Keymap
33188# XKM (compiled X keymap) files (including version and byte ordering)
331891	string	mkx				Compiled XKB Keymap: lsb,
33190>0	byte	>0				version %d
33191>0	byte	=0				obsolete
331920	string	xkm				Compiled XKB Keymap: msb,
33193>3	byte	>0				version %d
33194>3	byte	=0				obsolete
33195
33196# xfsdump archive
331970	string	xFSdump0			xfsdump archive
33198>8	belong	x	(version %d)
33199
33200# Jaleo XFS files
332010	long	395726				Jaleo XFS file
33202>4	long	x				- version %d
33203>8	long	x				- [%d -
33204>20	long	x				\b%dx
33205>24	long	x				\b%dx
33206>28	long	1008				\bYUV422]
33207>28	long	1000				\bRGB24]
33208
33209# Xcursor data
33210# X11 mouse cursor format defined in libXcursor, see
33211# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
33212# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
332130	string		Xcur		Xcursor data
33214!:mime	image/x-xcursor
33215>10	leshort		x		version %d
33216>>8	leshort		x		\b.%d
33217
33218
33219#------------------------------------------------------------------------------
33220# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $
33221# yara:  file(1) magic for https://virustotal.github.io/yara/
33222#
33223
332240	string	YARA
33225>4	lelong	>2047
33226>8	byte	<20	YARA 3.x compiled rule set
33227# version
33228>>8	clear	x
33229>>8	byte	6	created with version 3.3.0
33230>>8	byte	8	created with version 3.4.0
33231>>8	byte	11	created with version 3.5.0
33232>>8	default	x
33233>>>8	byte	x	development version 0x%02x
33234#------------------------------------------------------------------------------
33235# zfs:	file(1) magic for ZFS dumps
33236#
33237# From <rea-fbsd@codelabs.ru>
33238# ZFS dump header has the following structure (as per zfs_ioctl.h
33239# in FreeBSD with drr_type is set to DRR_BEGIN)
33240#
33241#   enum {
33242#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
33243#	DRR_WRITE, DRR_FREE, DRR_END,
33244#   } drr_type;
33245#   uint32_t drr_pad;
33246#   uint64_t drr_magic;
33247#   uint64_t drr_version;
33248#   uint64_t drr_creation_time;
33249#   dmu_objset_type_t drr_type;
33250#   uint32_t drr_pad;
33251#   uint64_t drr_toguid;
33252#   uint64_t drr_fromguid;
33253#   char drr_toname[MAXNAMELEN];
33254#
33255# Backup magic is 0x00000002f5bacbac (quad word)
33256# The drr_type is defined as
33257#   typedef enum dmu_objset_type {
33258#	  DMU_OST_NONE,
33259#	  DMU_OST_META,
33260#	  DMU_OST_ZFS,
33261#	  DMU_OST_ZVOL,
33262#	  DMU_OST_OTHER,		  /* For testing only! */
33263#	  DMU_OST_ANY,			  /* Be careful! */
33264#	  DMU_OST_NUMTYPES
33265#  } dmu_objset_type_t;
33266#
33267# Almost all uint64_t fields are printed as the 32-bit ones (with high
33268# 32 bits zeroed), because there is no simple way to print them as the
33269# full 64-bit values.
33270
33271# Big-endian values
332728	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
33273>20	belong	x	version %u,
33274>32	belong	0	type: NONE,
33275>32	belong	1	type: META,
33276>32	belong	2	type: ZFS,
33277>32	belong	3	type: ZVOL,
33278>32	belong	4	type: OTHER,
33279>32	belong	5	type: ANY,
33280>32	belong	>5	type: UNKNOWN (%u),
33281>40	byte	x	destination GUID: %02X
33282>41	byte	x	%02X
33283>42	byte	x	%02X
33284>43	byte	x	%02X
33285>44	byte	x	%02X
33286>45	byte	x	%02X
33287>46	byte	x	%02X
33288>47	byte	x	%02X,
33289>48	ulong	>0
33290>>52	ulong	>0
33291>>>48	byte	x	source GUID: %02X
33292>>>49	byte	x	%02X
33293>>>50	byte	x	%02X
33294>>>51	byte	x	%02X
33295>>>52	byte	x	%02X
33296>>>53	byte	x	%02X
33297>>>54	byte	x	%02X
33298>>>55	byte	x	%02X,
33299>56	string	>\0	name: '%s'
33300
33301# Little-endian values
333028	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
33303>16	lelong	x	version %u,
33304>32	lelong	0	type: NONE,
33305>32	lelong	1	type: META,
33306>32	lelong	2	type: ZFS,
33307>32	lelong	3	type: ZVOL,
33308>32	lelong	4	type: OTHER,
33309>32	lelong	5	type: ANY,
33310>32	lelong	>5	type: UNKNOWN (%u),
33311>47	byte	x	destination GUID: %02X
33312>46	byte	x	%02X
33313>45	byte	x	%02X
33314>44	byte	x	%02X
33315>43	byte	x	%02X
33316>42	byte	x	%02X
33317>41	byte	x	%02X
33318>40	byte	x	%02X,
33319>48	ulong	>0
33320>>52	ulong	>0
33321>>>55	byte	x	source GUID: %02X
33322>>>54	byte	x	%02X
33323>>>53	byte	x	%02X
33324>>>52	byte	x	%02X
33325>>>51	byte	x	%02X
33326>>>50	byte	x	%02X
33327>>>49	byte	x	%02X
33328>>>48	byte	x	%02X,
33329>56	string	>\0	name: '%s'
33330
33331#------------------------------------------------------------------------------
33332# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
33333# zilog:  file(1) magic for Zilog Z8000.
33334#
33335# Was it big-endian or little-endian?  My Product Specification doesn't
33336# say.
33337#
333380	long		0xe807		object file (z8000 a.out)
333390	long		0xe808		pure object file (z8000 a.out)
333400	long		0xe809		separate object file (z8000 a.out)
333410	long		0xe805		overlay object file (z8000 a.out)
33342#------------------------------------------------------------------------------
33343# $File: zip,v 1.4 2020/03/03 13:46:52 christos Exp $
33344# zip:  file(1) magic for zip files; this is not use
33345# Note the version of magic in archive is currently stronger, this is
33346# just an example until negative offsets are supported better
33347
33348# Zip Central Directory record
333490	name		zipcd
33350>0	string		PK\001\002	Zip archive data
33351>>4	leshort		x		\b, made by
33352>>4	use		zipversion
33353>>4	use		ziphost
33354>>6	leshort		x		\b, extract using at least
33355>>6	use		zipversion
33356>>12	ledate		x		\b, last modified %s
33357>>24	lelong		>0		\b, uncompressed size %d
33358>>10	leshort		x		\b, method=
33359>>10	use		zipcompression
33360
33361# URL:		https://en.wikipedia.org/wiki/Zip_(file_format)
33362# reference:	https://pkware.cachefly.net/webdocs/APPNOTE/APPNOTE-6.3.6.TXT
33363# Zip known compressions
333640	name		zipcompression
33365>0	leshort		0		\bstore
33366>0	leshort		1		\bShrinking
33367>0	leshort		6		\bImploding
33368>0	leshort		7		\bTokenizing
33369>0	leshort		8		\bdeflate
33370>0	leshort		9		\bdeflate64
33371>0	leshort		10		\bLibrary imploding
33372#>0	leshort		11 		\bReserved by PKWARE
33373>0	leshort		12		\bbzip2
33374#>0	leshort		13 		\bReserved by PKWARE
33375>0	leshort		14		\blzma
33376#>0	leshort		15 		\bReserved by PKWARE
33377>0	leshort		16		\bCMPSC Compression
33378#>0	leshort		17 		\bReserved by PKWARE
33379>0	leshort		18		\bIBM TERSE
33380>0	leshort		19		\bIBM LZ77
33381# https://support.winzip.com/hc/en-us/articles/115012122828-Compression-method-used-for-this-file-is-94
33382>0	leshort		94		\bMP3
33383>0	leshort		95		\bxz
33384>0	leshort		96		\bJpeg
33385>0	leshort		97		\bWavPack
33386>0	leshort		98		\bPPMd
33387>0	leshort		99		\bAES Encrypted
33388>0	default		x
33389>>0	leshort		x		\b[%#x]
33390
33391# Zip known versions
333920	name		zipversion
33393# The lower byte indicates the ZIP version of this file. The value/10 indicates
33394# the major version number, and the value mod 10 is the minor version number.
33395>0	ubyte/10	x		v%u
33396>0	ubyte%10	x		\b.%u
33397# >0	leshort		0x09		v0.9
33398# >0	leshort		0x0a		v1.0
33399# >0	leshort		0x0b		v1.1
33400# >0	leshort		0x14		v2.0
33401# >0	leshort		0x15		v2.1
33402# >0	leshort		0x19		v2.5
33403# >0	leshort		0x1b		v2.7
33404# >0	leshort		0x2d		v4.5
33405# >0	leshort		0x2e		v4.6
33406# >0	leshort		0x32		v5.0
33407# >0	leshort		0x33		v5.1
33408# >0	leshort		0x34		v5.2
33409# >0	leshort		0x3d		v6.1
33410# >0	leshort		0x3e		v6.2
33411# >0	leshort		0x3f		v6.3
33412# >0	default		x
33413# >>0	leshort		x		v?[%#x]
33414
33415#	display compatible host system name of ZIP archive
334160	name		ziphost
33417# The upper byte indicates the compatibility of the file attribute information.
33418# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero.
33419#>1	ubyte		0		DOS
33420>1	ubyte		1 		Amiga
33421>1	ubyte		2		OpenVMS
33422>1	ubyte		3		UNIX
33423>1	ubyte		4		VM/CMS
33424>1	ubyte		6		OS/2
33425>1	ubyte		7		Macintosh
33426>1	ubyte		11		MVS
33427>1	ubyte		13		Acorn Risc
33428>1	ubyte		16		BeOS
33429>1	ubyte		17		Tandem
33430# 9 untested
33431>1	ubyte		5		Atari ST
33432>1	ubyte		8		Z-System
33433>1	ubyte		9		CP/M
33434>1	ubyte		10		Windows NTFS
33435>1	ubyte		12		VSE
33436>1	ubyte		14		VFAT
33437>1	ubyte		15		alternate MVS
33438>1	ubyte		18		OS/400
33439>1	ubyte		19		OS X
33440# unused
33441#>1	ubyte		>19		unused 0x%x
33442
33443# Zip End Of Central Directory record
33444-22	string		PK\005\006
33445#>4	leshort		>1		\b, %d disks
33446#>6	leshort		>1		\b, central directory disk %d
33447#>8	leshort		>1		\b, %d central directories on this disk
33448#>10	leshort		>1		\b, %d central directories
33449#>12	lelong		x		\b, %d central directory bytes
33450>(16.l)	use		zipcd
33451>>20	pstring/l	>0		\b, %s
33452
33453#------------------------------------------------------------------------------
33454# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
33455# zyxel:  file(1) magic for ZyXEL modems
33456#
33457# From <rob@pe1chl.ampr.org>
33458# These are the /etc/magic entries to decode datafiles as used for the
33459# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
33460# ZyXEL-defined standard)
33461
334620	string		ZyXEL\002	ZyXEL voice data
33463>10	byte		0		- CELP encoding
33464>10	byte&0x0B	1		- ADPCM2 encoding
33465>10	byte&0x0B	2		- ADPCM3 encoding
33466>10	byte&0x0B	3		- ADPCM4 encoding
33467>10	byte&0x0B	8		- New ADPCM3 encoding
33468>10	byte&0x04	4		with resync
33469