1# Magic 2# Magic data for file(1) command. 3# Machine-generated from src/cmd/file/magdir/*; edit there only! 4# Format is described in magic(files), where: 5# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID. 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $Id: HtFileType-magic,v 1.1 2003/01/03 13:26:19 lha Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14# XXX promoted from tex so that *.tfm is not mis-identified as mc68k file. 15# There is no way to detect TeX Font Metric (*.tfm) files without 16# breaking them apart and reading the data. The following patterns 17# match most *.tfm files generated by METAFONT or afm2tfm. 182 string \000\021 TeX font metric data 19>33 string >\0 (%s) 202 string \000\022 TeX font metric data 21>33 string >\0 (%s) 22 23#------------------------------------------------------------------------------ 24# adi: file(1) magic for ADi's objects 25# From Gregory McGarry <g.mcgarry@ieee.org> 26# 270 leshort 0x521c COFF DSP21k 28>18 lelong &02 executable, 29>18 lelong ^02 30>>18 lelong &01 static object, 31>>18 lelong ^01 relocatable object, 32>18 lelong &010 stripped 33>18 lelong ^010 not stripped 34 35#------------------------------------------------------------------------------ 36# adventure: file(1) magic for Adventure game files 37# 38# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 39# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 40# 41# ALAN 42# I assume there are other, lower versions, but these are the only ones I 43# saw in the archive. 440 beshort 0x0206 ALAN text adventure code data 45>2 byte <10 version 2.6%d 46 47# Conflicts with too much other stuff! 48# Infocom 49# (Note: to avoid false matches Z-machine version 1 and 2 are not 50# recognized since only the oldest Zork I and II used them. Similarly 51# there are 4 Infocom games that use verion 4 that are not recognized.) 52#0 byte 3 Infocom game data (Z-machine 3, 53#>2 beshort <0x7fff Release %3d, 54#>26 beshort >0 Size %d*2 55#>18 string >\0 Serial %.6s) 56#0 byte 5 Infocom game data (Z-machine 5, 57#>2 beshort <0x7fff Release %3d, 58#>26 beshort >0 Size %d*4 59#>18 string >\0 Serial %.6s) 60#0 byte 6 Infocom game data (Z-machine 6, 61#>2 beshort <0x7fff Release %3d, 62#>26 beshort >0 Size %d*8 63#>18 string >\0 Serial %.6s) 64#0 byte 8 Infocom game data (Z-machine 8, 65#>2 beshort <0x7fff Release %3d, 66#>26 beshort >0 Size %d*8 67#>18 string >\0 Serial %.6s) 68 69# TADS (Text Adventure Development System) 700 string TADS TADS game data 71>13 string >\0 (ver. %.6s, 72>22 string >\0 date %s) 73#------------------------------------------------------------------------------ 74# allegro: file(1) magic for Allegro datafiles 75# Toby Deshane <hac@shoelace.digivill.net> 76# 770 belong 0x736C6821 Allegro datafile (packed) 780 belong 0x736C682E Allegro datafile (not packed/autodetect) 790 belong 0x736C682B Allegro datafile (appended exe data) 80 81#------------------------------------------------------------------------------ 82# alliant: file(1) magic for Alliant FX series a.out files 83# 84# If the FX series is the one that had a processor with a 68K-derived 85# instruction set, the "short" should probably become "beshort" and the 86# "long" should probably become "belong". 87# If it's the i860-based one, they should probably become either the 88# big-endian or little-endian versions, depending on the mode they ran 89# the 860 in.... 90# 910 short 0420 0420 Alliant virtual executable 92>2 short &0x0020 common library 93>16 long >0 not stripped 940 short 0421 0421 Alliant compact executable 95>2 short &0x0020 common library 96>16 long >0 not stripped 97#------------------------------------------------------------------------------ 98# alpha architecture description 99# 100 1010 leshort 0603 COFF format alpha 102>22 leshort&030000 !020000 executable 103>24 leshort 0410 pure 104>24 leshort 0413 paged 105>22 leshort&020000 !0 dynamically linked 106>16 lelong !0 not stripped 107>16 lelong 0 stripped 108>22 leshort&030000 020000 shared library 109>24 leshort 0407 object 110>27 byte x - version %d 111>26 byte x .%d 112>28 byte x -%d 113 114# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 115# 116# The actual magic number is just "Core", followed by a 2-byte version 117# number; however, treating any file that begins with "Core" as a Digital 118# UNIX core dump file may produce too many false hits, so we include one 119# byte of the version number as well; DU 5.0 appears only to be up to 120# version 2. 121# 1220 string Core\001 Alpha COFF format core dump (Digital UNIX) 123>24 string >\0 \b, from '%s' 1240 string Core\002 Alpha COFF format core dump (Digital UNIX) 125>24 string >\0 \b, from '%s' 126 127#------------------------------------------------------------------------------ 128# amanda: file(1) magic for amanda file format 129# 1300 string AMANDA:\ AMANDA 131>8 string TAPESTART\ DATE tape header file, 132>>23 string X 133>>>25 string >\ Unused %s 134>>23 string >\ DATE %s 135>8 string FILE\ dump file, 136>>13 string >\ DATE %s 137#------------------------------------------------------------------------------ 138# amigaos: file(1) magic for AmigaOS binary formats: 139 140# 141# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 142# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG 143# (the others should be separate, anyway) 144# 1450 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 1460 belong 0x000003e7 AmigaOS object/library data 147 148#------------------------------------------------------------------------------ 149# animation: file(1) magic for animation/movie formats 150# 151# animation formats 152# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 153# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 154 155# MPEG animation format 1560 belong 0x000001b3 MPEG video stream data 157#>4 beshort&0xfff0 x (%d x 158#>5 beshort&0x0fff x %d) 1590 belong 0x000001ba MPEG system stream data 160 161# MPEG Audio (*.mpx) 162# from dreesen@math.fu-berlin.de 163 164# XXX 165# This conflicts with the FF FE signature for UTF-16-encoded Unicode 166# text, which will be identified as an MP3 file. I don't have any MP3s 167# so I don't know how to (or even if it's possible to) change this to 168# tell the two apart. enf@pobox.com 169 1700 beshort &0xfff0 MP 171# MPEG 1.0 172>1 byte&0x08 =0x08 \b 173# Layer 3 174>>1 byte &0x02 \b3 175>>>2 byte&0xf0 =0x10 \b, 32 kBits 176>>>2 byte&0xf0 =0x20 \b, 40 kBits 177>>>2 byte&0xf0 =0x30 \b, 48 kBits 178>>>2 byte&0xf0 =0x40 \b, 56 kBits 179>>>2 byte&0xf0 =0x50 \b, 64 kBits 180>>>2 byte&0xf0 =0x60 \b, 80 kBits 181>>>2 byte&0xf0 =0x70 \b, 96 kBits 182>>>2 byte&0xf0 =0x80 \b, 112 kBits 183>>>2 byte&0xf0 =0x90 \b, 128 kBits 184>>>2 byte&0xf0 =0xA0 \b, 160 kBits 185>>>2 byte&0xf0 =0xB0 \b, 192 kBits 186>>>2 byte&0xf0 =0xC0 \b, 224 kBits 187>>>2 byte&0xf0 =0xD0 \b, 256 kBits 188>>>2 byte&0xf0 =0xE0 \b, 320 kBits 189# Layer 2 190>>1 byte &0x04 \b2 191>>>2 byte&0xf0 =0x10 \b, 32 kBits 192>>>2 byte&0xf0 =0x20 \b, 48 kBits 193>>>2 byte&0xf0 =0x30 \b, 56 kBits 194>>>2 byte&0xf0 =0x40 \b, 64 kBits 195>>>2 byte&0xf0 =0x50 \b, 80 kBits 196>>>2 byte&0xf0 =0x60 \b, 96 kBits 197>>>2 byte&0xf0 =0x70 \b, 112 kBits 198>>>2 byte&0xf0 =0x80 \b, 128 kBits 199>>>2 byte&0xf0 =0x90 \b, 160 kBits 200>>>2 byte&0xf0 =0xA0 \b, 192 kBits 201>>>2 byte&0xf0 =0xB0 \b, 224 kBits 202>>>2 byte&0xf0 =0xC0 \b, 256 kBits 203>>>2 byte&0xf0 =0xD0 \b, 320 kBits 204>>>2 byte&0xf0 =0xE0 \b, 384 kBits 205# freq 206>>2 byte&0x0C =0x00 \b, 44.1 kHz 207>>2 byte&0x0C =0x04 \b, 48 kHz 208>>2 byte&0x0C =0x08 \b, 32 kHz 209# MPEG 2.0 210>1 byte&0x08 =0x00 \b 211# Layer 3 212>>1 byte &0x02 \b3 213# Layer 2 214>>1 byte &0x04 \b2 215>>2 byte&0xf0 =0x10 \b, 8 kBits 216>>2 byte&0xf0 =0x20 \b, 16 kBits 217>>2 byte&0xf0 =0x30 \b, 24 kBits 218>>2 byte&0xf0 =0x40 \b, 32 kBits 219>>2 byte&0xf0 =0x50 \b, 40 kBits 220>>2 byte&0xf0 =0x60 \b, 48 kBits 221>>2 byte&0xf0 =0x70 \b, 56 kBits 222>>2 byte&0xf0 =0x80 \b, 64 kBits 223>>2 byte&0xf0 =0x90 \b, 80 kBits 224>>2 byte&0xf0 =0xA0 \b, 96 kBits 225>>2 byte&0xf0 =0xB0 \b, 112 kBits 226>>2 byte&0xf0 =0xC0 \b, 128 kBits 227>>2 byte&0xf0 =0xD0 \b, 144 kBits 228>>2 byte&0xf0 =0xE0 \b, 160 kBits 229# freq 230>>2 byte&0x0C =0x00 \b, 22.05 kHz 231>>2 byte&0x0C =0x04 \b, 24 kHz 232>>2 byte&0x0C =0x08 \b, 16 kHz 233# misc 234>3 byte&0xC0 =0x00 \b, Stereo 235>3 byte&0xC0 =0x40 \b, JStereo 236>3 byte&0xC0 =0x80 \b, Dual-Ch 237>3 byte&0xC0 =0xC0 \b, Mono 238#>1 byte&0x01 =0x00 \b, Error Protection 239#>2 byte&0x02 =0x02 \b, Padding 240#>2 byte&0x01 =0x01 \b, Private 241#>3 byte&0x08 =0x08 \b, Copyright 242#>3 byte&0x04 =0x04 \b, Original 243#>3 byte&0x03 1 \b, Emphasis 5 244#>3 byte&0x03 3 \b, Emphasis c 245 246# FLI animation format 2474 leshort 0xAF11 FLI file 248>6 leshort x - %d frames, 249>8 leshort x width=%d pixels, 250>10 leshort x height=%d pixels, 251>12 leshort x depth=%d, 252>16 leshort x ticks/frame=%d 253# FLC animation format 2544 leshort 0xAF12 FLC file 255>6 leshort x - %d frames 256>8 leshort x width=%d pixels, 257>10 leshort x height=%d pixels, 258>12 leshort x depth=%d, 259>16 leshort x ticks/frame=%d 260 261# DL animation format 262# XXX - collision with most `mips' magic 263# 264# I couldn't find a real magic number for these, however, this 265# -appears- to work. Note that it might catch other files, too, so be 266# careful! 267# 268# Note that title and author appear in the two 20-byte chunks 269# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 270# 255 (hex FF)! The DL format is really bad. 271# 272#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 273#>42 byte x - %d screens, 274#>43 byte x %d commands 275#0 byte 2 DL version 2 276#>1 byte 1 - large format (320x200,1 image/screen), 277#>1 byte 2 - medium format (160x100,4 images/screen), 278#>1 byte >2 - unknown format, 279#>42 byte x %d screens, 280#>43 byte x %d commands 281# Based on empirical evidence, DL version 3 have several nulls following the 282# \003. Most of them start with non-null values at hex offset 0x34 or so. 283#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 284 285# SGI and Apple formats 2860 string MOVI Silicon Graphics movie file 2874 string moov Apple QuickTime movie file (moov) 2884 string mdat Apple QuickTime movie file (mdat) 289 290# iso 13818 transport stream 291# 292# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 293# (the following is a little bit restrictive and works fine for a stream 294# that starts with PAT properly. it won't work for stream data, that is 295# cut from an input device data right in the middle, but this shouldn't 296# disturb) 297# syncbyte 8 bit 0x47 298# error_ind 1 bit - 299# payload_start 1 bit 1 300# priority 1 bit - 301# PID 13 bit 0x0000 302# scrambling 2 bit - 303# adaptfld_ctrl 2 bit 1 or 3 304# conti_count 4 bit 0 3050 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data 306>188 byte !0x47 CORRUPTED 307 308# DIF digital video file format <mpruett@sgi.com> 3090 belong&0xffffff00 0x1f070000 DIF 310>4 byte &0x01 (DVCPRO) movie file 311>4 byte ^0x01 (DV) movie file 312>3 byte &0x80 (PAL) 313>3 byte ^0x80 (NTSC) 314 315# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 3160 belong 0x3026b275 Microsoft ASF 317 318#------------------------------------------------------------------------------ 319# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 320# workspaces) 321# 3220 long 0100554 APL workspace (Ken's original?) 323 324#------------------------------------------------------------------------------ 325# apple: file(1) magic for Apple file formats 326# 3270 string FiLeStArTfIlEsTaRt binscii (apple ][) text 3280 string \x0aGL Binary II (apple ][) data 3290 string \x76\xff Squeezed (apple ][) data 3300 string NuFile NuFile archive (apple ][) data 3310 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 3320 belong 0x00051600 AppleSingle encoded Macintosh file 3330 belong 0x00051607 AppleDouble encoded Macintosh file 334 335# magic for Newton PDA package formats 336# from Ruda Moura <ruda@helllabs.org> 3370 string package0 Newton package, NOS 1.x, 338>12 belong &0x80000000 AutoRemove, 339>12 belong &0x40000000 CopyProtect, 340>12 belong &0x10000000 NoCompression, 341>12 belong &0x04000000 Relocation, 342>12 belong &0x02000000 UseFasterCompression, 343>16 belong x version %d 344 3450 string package1 Newton package, NOS 2.x, 346>12 belong &0x80000000 AutoRemove, 347>12 belong &0x40000000 CopyProtect, 348>12 belong &0x10000000 NoCompression, 349>12 belong &0x04000000 Relocation, 350>12 belong &0x02000000 UseFasterCompression, 351>16 belong x version %d 352 353# The following entries for the Apple II are for files that have 354# been transferred as raw binary data from an Apple, without having 355# been encapsulated by any of the above archivers. 356# 357# In general, Apple II formats are hard to identify because Apple DOS 358# and especially Apple ProDOS have strong typing in the file system and 359# therefore programmers never felt much need to include type information 360# in the files themselves. 361# 362# Eric Fischer <enf@pobox.com> 363 364# AppleWorks word processor: 365# 366# This matches the standard tab stops for an AppleWorks file, but if 367# a file has a tab stop set in the first four columns this will fail. 368# 369# The "O" is really the magic number, but that's so common that it's 370# necessary to check the tab stops that follow it to avoid false positives. 371 3724 string O==== AppleWorks word processor data 373>85 byte&0x01 >0 \b, zoomed 374>90 byte&0x01 >0 \b, paginated 375>92 byte&0x01 >0 \b, with mail merge 376#>91 byte x \b, left margin %d 377 378# AppleWorks database: 379# 380# This isn't really a magic number, but it's the closest thing to one 381# that I could find. The 1 and 2 really mean "order in which you defined 382# categories" and "left to right, top to bottom," respectively; the D and R 383# mean that the cursor should move either down or right when you press Return. 384 385#30 string \x01D AppleWorks database data 386#30 string \x02D AppleWorks database data 387#30 string \x01R AppleWorks database data 388#30 string \x02R AppleWorks database data 389 390# AppleWorks spreadsheet: 391# 392# Likewise, this isn't really meant as a magic number. The R or C means 393# row- or column-order recalculation; the A or M means automatic or manual 394# recalculation. 395 396#131 string RA AppleWorks spreadsheet data 397#131 string RM AppleWorks spreadsheet data 398#131 string CA AppleWorks spreadsheet data 399#131 string CM AppleWorks spreadsheet data 400 401# Applesoft BASIC: 402# 403# This is incredibly sloppy, but will be true if the program was 404# written at its usual memory location of 2048 and its first line 405# number is less than 256. Yuck. 406 4070 belong&0xff00ff 0x80000 Applesoft BASIC program data 408#>2 leshort x \b, first line number %d 409 410# ORCA/EZ assembler: 411# 412# This will not identify ORCA/M source files, since those have 413# some sort of date code instead of the two zero bytes at 6 and 7 414# XXX Conflicts with ELF 415#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 416#>5 byte x \b, build number %d 417 418# Broderbund Fantavision 419# 420# I don't know what these values really mean, but they seem to recur. 421# Will they cause too many conflicts? 422 423# Probably :-) 424#2 belong&0xFF00FF 0x040008 Fantavision movie data 425 426# Some attempts at images. 427# 428# These are actually just bit-for-bit dumps of the frame buffer, so 429# there's really no reasonably way to distinguish them except for their 430# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 431# or, occasionally, 8184. 432# 433# Nevertheless this will manage to catch a lot of images that happen 434# to have a solid-colored line at the bottom of the screen. 435 4368144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 4378144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 4388144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 4398144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 4408144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 441 442# Beagle Bros. Apple Mechanic fonts 443 4440 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 445 446#------------------------------------------------------------------------------ 447# applix: file(1) magic for Applixware 448# From: Peter Soos <sp@osb.hu> 449# 4500 string *BEGIN Applixware 451>7 string WORDS Words Document 452>7 string GRAPHICS Graphic 453>7 string RASTER Bitmap 454>7 string SPREADSHEETS Spreadsheet 455>7 string MACRO Macro 456>7 string BUILDER Builder Object 457 458#------------------------------------------------------------------------------ 459# archive: file(1) magic for archive formats (see also "msdos" for self- 460# extracting compressed archives) 461# 462# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 463# pre-POSIX "tar" archives are handled in the C code. 464 465# POSIX tar archives 466257 string ustar\0 POSIX tar archive 467257 string ustar\040\040\0 GNU tar archive 468 469# cpio archives 470# 471# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 472# The idea is to indicate archives produced on machines with the same 473# byte order as the machine running "file" with "cpio archive", and 474# to indicate archives produced on machines with the opposite byte order 475# from the machine running "file" with "byte-swapped cpio archive". 476# 477# The SVR4 "cpio(4)" hints that there are additional formats, but they 478# are defined as "short"s; I think all the new formats are 479# character-header formats and thus are strings, not numbers. 4800 short 070707 cpio archive 4810 short 0143561 byte-swapped cpio archive 4820 string 070707 ASCII cpio archive (pre-SVR4 or odc) 4830 string 070701 ASCII cpio archive (SVR4 with no CRC) 4840 string 070702 ASCII cpio archive (SVR4 with CRC) 485 486# Debian package (needs to go before regular portable archives) 487# 4880 string !<arch>\ndebian 489>8 string debian-split part of multipart Debian package 490>8 string debian-binary Debian binary package 491>68 string >\n (format %s) 492>136 ledate x created: %s 493 494# other archives 4950 long 0177555 very old archive 4960 short 0177555 very old PDP-11 archive 4970 long 0177545 old archive 4980 short 0177545 old PDP-11 archive 4990 long 0100554 apl workspace 5000 string =<ar> archive 501 502# MIPS archive (needs to go before regular portable archives) 503# 5040 string !<arch>\n__________E MIPS archive 505>20 string U with MIPS Ucode members 506>21 string L with MIPSEL members 507>21 string B with MIPSEB members 508>19 string L and an EL hash table 509>19 string B and an EB hash table 510>22 string X -- out of date 511 5120 string -h- Software Tools format archive text 513 514# 515# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is 516# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: 517# 518# 0 string !<arch> current ar archive 519# 0 long 0x213c6172 archive file 520# 521# and for SVR1 archives, we have: 522# 523# 0 string \<ar> System V Release 1 ar archive 524# 0 string =<ar> archive 525# 526# XXX - did Aegis really store shared libraries, breakpointed modules, 527# and absolute code program modules in the same format as new-style 528# "ar" archives? 529# 5300 string !<arch> current ar archive 531>8 string __.SYMDEF random library 532>0 belong =65538 - pre SR9.5 533>0 belong =65539 - post SR9.5 534>0 beshort 2 - object archive 535>0 beshort 3 - shared library module 536>0 beshort 4 - debug break-pointed module 537>0 beshort 5 - absolute code program module 5380 string \<ar> System V Release 1 ar archive 5390 string =<ar> archive 540# 541# XXX - from "vax", which appears to collect a bunch of byte-swapped 542# thingies, to help you recognize VAX files on big-endian machines; 543# with "leshort", "lelong", and "string", that's no longer necessary.... 544# 5450 belong 0x65ff0000 VAX 3.0 archive 5460 belong 0x3c61723e VAX 5.0 archive 547# 5480 long 0x213c6172 archive file 5490 lelong 0177555 very old VAX archive 5500 leshort 0177555 very old PDP-11 archive 551# 552# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus 553# be a random library (it said 0xff65 rather than 0177545). 554# 5550 lelong 0177545 old VAX archive 556>8 string __.SYMDEF random library 5570 leshort 0177545 old PDP-11 archive 558>8 string __.SYMDEF random library 559# 560# From "pdp" (but why a 4-byte quantity?) 561# 5620 lelong 0x39bed PDP-11 old archive 5630 lelong 0x39bee PDP-11 4.0 archive 564 565# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 566# 567# The first byte is the magic (0x1a), byte 2 is the compression type for 568# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 569# filename of the first file (null terminated). Since some types collide 570# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 571# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 5720 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 5730 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 5740 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 5750 lelong&0x8080ffff 0x0000031a ARC archive data, packed 5760 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 5770 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 578 579# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 580# I can't create either SPARK or ArcFS archives so I have not tested this stuff 581# [GRR: the original entries collide with ARC, above; replaced with combined 582# version (not tested)] 583#0 byte 0x1a RISC OS archive 584#>1 string archive (ArcFS format) 5850 string \032archive RISC OS archive (ArcFS format) 586 587# ARJ archiver (jason@jarthur.Claremont.EDU) 5880 leshort 0xea60 ARJ archive data 589>5 byte x \b, v%d, 590>8 byte &0x04 multi-volume, 591>8 byte &0x10 slash-switched, 592>8 byte &0x20 backup, 593>34 string x original name: %s, 594>7 byte 0 os: MS-DOS 595>7 byte 1 os: PRIMOS 596>7 byte 2 os: Unix 597>7 byte 3 os: Amiga 598>7 byte 4 os: Macintosh 599>7 byte 5 os: OS/2 600>7 byte 6 os: Apple ][ GS 601>7 byte 7 os: Atari ST 602>7 byte 8 os: NeXT 603>7 byte 9 os: VAX/VMS 604>3 byte >0 %d] 605 606# HA archiver (Greg Roelofs, newt@uchicago.edu) 607# This is a really bad format. A file containing HAWAII will match this... 608#0 string HA HA archive data, 609#>2 leshort =1 1 file, 610#>2 leshort >1 %u files, 611#>4 byte&0x0f =0 first is type CPY 612#>4 byte&0x0f =1 first is type ASC 613#>4 byte&0x0f =2 first is type HSC 614#>4 byte&0x0f =0x0e first is type DIR 615#>4 byte&0x0f =0x0f first is type SPECIAL 616 617# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 6180 string HPAK HPACK archive data 619 620# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 6210 string \351,\001JAM\ JAM archive, 622>7 string >\0 version %.4s 623>0x26 byte =0x27 - 624>>0x2b string >\0 label %.11s, 625>>0x27 lelong x serial %08x, 626>>0x36 string >\0 fstype %.8s 627 628# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 6292 string -lh0- LHarc 1.x archive data [lh0] 6302 string -lh1- LHarc 1.x archive data [lh1] 6312 string -lz4- LHarc 1.x archive data [lz4] 6322 string -lz5- LHarc 1.x archive data [lz5] 633# [never seen any but the last; -lh4- reported in comp.compression:] 6342 string -lzs- LHa 2.x? archive data [lzs] 6352 string -lh\40- LHa 2.x? archive data [lh ] 6362 string -lhd- LHa 2.x? archive data [lhd] 6372 string -lh2- LHa 2.x? archive data [lh2] 6382 string -lh3- LHa 2.x? archive data [lh3] 6392 string -lh4- LHa (2.x) archive data [lh4] 6402 string -lh5- LHa (2.x) archive data [lh5] 6412 string -lh6- LHa (2.x) archive data [lh6] 6422 string -lh7- LHa (2.x) archive data [lh7] 643>20 byte x - header level %d 644 645# RAR archiver (Greg Roelofs, newt@uchicago.edu) 6460 string Rar! RAR archive data 647 648# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 6490 string SQSH squished archive data (Acorn RISCOS) 650 651# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 652# I can't figure out the self-extracting form of these buggers... 6530 string UC2\x1a UC2 archive data 654 655# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 6560 string PK\003\004 Zip archive data 657>4 byte 0x09 \b, at least v0.9 to extract 658>4 byte 0x0a \b, at least v1.0 to extract 659>4 byte 0x0b \b, at least v1.1 to extract 660>4 byte 0x14 \b, at least v2.0 to extract 661 662# Zoo archiver 66320 lelong 0xfdc4a7dc Zoo archive data 664>4 byte >48 \b, v%c. 665>>6 byte >47 \b%c 666>>>7 byte >47 \b%c 667>32 byte >0 \b, modify: v%d 668>>33 byte x \b.%d+ 669>42 lelong 0xfdc4a7dc \b, 670>>70 byte >0 extract: v%d 671>>>71 byte x \b.%d+ 672 673# Shell archives 67410 string #\ This\ is\ a\ shell\ archive shell archive text 675 676# 677# LBR. NB: May conflict with the questionable 678# "binary Computer Graphics Metafile" format. 679# 6800 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 681# 682# PMA (CP/M derivative of LHA) 683# 6842 string -pm0- PMarc archive data [pm0] 6852 string -pm1- PMarc archive data [pm1] 6862 string -pm2- PMarc archive data [pm2] 6872 string -pms- PMarc SFX archive (CP/M, DOS) 6885 string -pc1- PopCom compressed executable (CP/M) 689 690# From rafael@icp.inpg.fr (Rafael Laboissiere) 691# The Project Revision Control System (see 692# http://www.XCF.Berkeley.EDU/~jmacd/prcs.html) generates a packaged project 693# file which is recognized by the following entry: 6940 leshort 0xeb81 PRCS packaged project 695 696# Microsoft cabinets 697# by David Necas (Yeti) <yeti@physics.muni.cz> 6980 string MSCF\0\0\0\0 Microsoft cabinet file data, 699>25 byte x v%d 700>24 byte x \b.%d 701 702# GTKtalog catalogs 703# by David Necas (Yeti) <yeti@physics.muni.cz> 7044 string gtktalog\ GTKtalog catalog data, 705>13 string 3 version 3 706>>14 beshort 0x677a (gzipped) 707>>14 beshort !0x677a (not gzipped) 708>13 string >3 version %s 709 710#------------------------------------------------------------------------------ 711# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 712# strings as "long" - we assume they're just strings: 713# From: guy@netapp.com (Guy Harris) 714# 7150 string *STA Aster*x 716>7 string WORD Words Document 717>7 string GRAP Graphic 718>7 string SPRE Spreadsheet 719>7 string MACR Macro 7200 string 2278 Aster*x Version 2 721>29 byte 0x36 Words Document 722>29 byte 0x35 Graphic 723>29 byte 0x32 Spreadsheet 724>29 byte 0x38 Macro 725 726 727#------------------------------------------------------------------------------ 728# att3b: file(1) magic for AT&T 3B machines 729# 730# The `versions' should be un-commented if they work for you. 731# (Was the problem just one of endianness?) 732# 733# 3B20 734# 735# The 3B20 conflicts with SCCS. 736#0 beshort 0550 3b20 COFF executable 737#>12 belong >0 not stripped 738#>22 beshort >0 - version %ld 739#0 beshort 0551 3b20 COFF executable (TV) 740#>12 belong >0 not stripped 741#>22 beshort >0 - version %ld 742# 743# WE32K 744# 7450 beshort 0560 WE32000 COFF 746>18 beshort ^00000020 object 747>18 beshort &00000020 executable 748>12 belong >0 not stripped 749>18 beshort ^00010000 N/A on 3b2/300 w/paging 750>18 beshort &00020000 32100 required 751>18 beshort &00040000 and MAU hardware required 752>20 beshort 0407 (impure) 753>20 beshort 0410 (pure) 754>20 beshort 0413 (demand paged) 755>20 beshort 0443 (target shared library) 756>22 beshort >0 - version %ld 7570 beshort 0561 WE32000 COFF executable (TV) 758>12 belong >0 not stripped 759#>18 beshort &00020000 - 32100 required 760#>18 beshort &00040000 and MAU hardware required 761#>22 beshort >0 - version %ld 762# 763# core file for 3b2 7640 string \000\004\036\212\200 3b2 core file 765>364 string >\0 of '%s' 766 767#------------------------------------------------------------------------------ 768# audio: file(1) magic for sound formats (see also "iff") 769# 770# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 771# and others 772# 773 774# Sun/NeXT audio data 7750 string .snd Sun/NeXT audio data: 776>12 belong 1 8-bit ISDN u-law, 777>12 belong 2 8-bit linear PCM [REF-PCM], 778>12 belong 3 16-bit linear PCM, 779>12 belong 4 24-bit linear PCM, 780>12 belong 5 32-bit linear PCM, 781>12 belong 6 32-bit IEEE floating point, 782>12 belong 7 64-bit IEEE floating point, 783>12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), 784>12 belong 24 compressed (8-bit G.722 ADPCM) 785>12 belong 25 compressed (3-bit G.723 ADPCM), 786>12 belong 26 compressed (5-bit G.723 ADPCM), 787>12 belong 27 8-bit A-law, 788>20 belong 1 mono, 789>20 belong 2 stereo, 790>20 belong 4 quad, 791>16 belong >0 %d Hz 792 793# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 794# that uses little-endian encoding and has a different magic number 7950 lelong 0x0064732E DEC audio data: 796>12 lelong 1 8-bit ISDN u-law, 797>12 lelong 2 8-bit linear PCM [REF-PCM], 798>12 lelong 3 16-bit linear PCM, 799>12 lelong 4 24-bit linear PCM, 800>12 lelong 5 32-bit linear PCM, 801>12 lelong 6 32-bit IEEE floating point, 802>12 lelong 7 64-bit IEEE floating point, 803>12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), 804>20 lelong 1 mono, 805>20 lelong 2 stereo, 806>20 lelong 4 quad, 807>16 lelong >0 %d Hz 808 809# Creative Labs AUDIO stuff 8100 string MThd Standard MIDI data 811>9 byte >0 (format %d) 812>11 byte >1 using %d tracks 8130 string CTMF Creative Music (CMF) data 8140 string SBI SoundBlaster instrument data 8150 string Creative\ Voice\ File Creative Labs voice data 816# is this next line right? it came this way... 817>19 byte 0x1A 818>23 byte >0 - version %d 819>22 byte >0 \b.%d 820 821# first entry is also the string "NTRK" 8220 belong 0x4e54524b MultiTrack sound data 823>4 belong x - version %ld 824 825# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 826# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 8270 string EMOD Extended MOD sound data, 828>4 byte&0xf0 x version %d 829>4 byte&0x0f x \b.%d, 830>45 byte x %d instruments 831>83 byte 0 (module) 832>83 byte 1 (song) 833 834# Real Audio (Magic .ra\0375) 8350 belong 0x2e7261fd RealAudio sound file 8360 string .RMF RealMedia file 837 838# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 839# Oct 31, 1995 8400 string MTM MultiTracker Module sound file 841#0 string if Composer 669 Module sound data 8420 string FAR Module sound data 8430 string MAS_U ULT(imate) Module sound data 8440x2c string SCRM ScreamTracker III Module sound data 8450 string Extended Module Extended Module sound data 846 847# Gravis UltraSound patches 848# From <ache@nagual.ru> 849 8500 string GF1PATCH110\0ID#000002\0 GUS patch 8510 string GF1PATCH100\0ID#000002\0 Old GUS patch 852 853# 854# Taken from loader code from mikmod version 2.14 855# by Steve McIntyre (stevem@chiark.greenend.org.uk) 8560 string JN extended 669 module data 8570 string MAS_UTrack_V00 858>14 string >/0 ultratracker V1.%.1s module sound data 8590 string UN05 MikMod UNI format module sound data 8600 string Extended\ Module: Fasttracker II module sound data 86121 string !SCREAM! Screamtracker 2 module sound data 8621080 string M.K. 4-channel Protracker module sound data 8631080 string M!K! 4-channel Protracker module sound data 8641080 string FLT4 4-channel Startracker module sound data 8651080 string 4CHN 4-channel Fasttracker module sound data 8661080 string 6CHN 6-channel Fasttracker module sound data 8671080 string 8CHN 8-channel Fasttracker module sound data 8681080 string CD81 8-channel Oktalyzer module sound data 8691080 string OKTA 8-channel Oktalyzer module sound data 870# Not good enough. 871#1082 string CH 872#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 8731080 string 16CN 16-channel Taketracker module sound data 8741080 string 32CN 32-channel Taketracker module sound data 875 876# TOC sound files -Trevor Johnson <trevor@jpj.net> 877# 8780 string TOC TOC sound file 879 880# sidfiles <pooka@iki.fi> 8810 string SIDPLAY\ INFOFILE Sidplay info file 8820 string PSID PlaySID v2.2+ (AMIGA) sidtune 883>4 beshort >0 w/ header v%d, 884>14 beshort =1 single song, 885>14 beshort >1 %d songs, 886>16 beshort >0 default song: %d 887 888# IRCAM <mpruett@sgi.com> 889# VAX and MIPS files are little-endian; Sun and NeXT are big-endian 8900 belong 0x64a30100 IRCAM file (VAX) 8910 belong 0x64a30200 IRCAM file (Sun) 8920 belong 0x64a30300 IRCAM file (MIPS little-endian) 8930 belong 0x64a30400 IRCAM file (NeXT) 894 895# NIST SPHERE <mpruett@sgi.com> 8960 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 897 898# Sample Vision <mpruett@sgi.com> 8990 string SOUND\ SAMPLE\ DATA\ Sample Vision file 900 901# Audio Visual Research <mpruett@sgi.com> 9020 string 2BIT Audio Visual Research file 903 904# From Felix von Leitner <leitner@fefe.de> 9050 string OggS Ogg-Vorbis compressed sound file 906 907# SGI SoundTrack <mpruett@sgi.com> 9080 string _SGI_SoundTrack SGI SoundTrack project file 9090 string ID3 mp3 file with ID3 2.0 tag 910#------------------------------------------------------------------------------ 911# blender: file(1) magic for Blender 3D data files 912# 913# Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the 914# data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not 915# support the rule, so mail GSR if problems with it. Rule version: 1.1. 916# You can get latest version with comments and details about the format 917# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender 918 9190 string =BLENDER Blender3D, 920>7 string =_ saved as 32-bits 921>7 string =- saved as 64-bits 922>8 string =v little endian 923>8 string =V big endian 924>9 byte x with version %c. 925>10 byte x \b%c 926>11 byte x \b%c 927 928#------------------------------------------------------------------------------ 929# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 930# 931# Note that this 0407 conflicts with several other a.out formats... 932# 933# XXX - should this be redone with "be" and "le", so that it works on 934# little-endian machines as well? If so, what's the deal with 935# "VAX-order" and "VAX-order2"? 936# 937#0 long 0407 68K Blit (standalone) executable 938#0 short 0407 VAX-order2 68K Blit (standalone) executable 9390 short 03401 VAX-order 68K Blit (standalone) executable 9400 long 0406 68k Blit mpx/mux executable 9410 short 0406 VAX-order2 68k Blit mpx/mux executable 9420 short 03001 VAX-order 68k Blit mpx/mux executable 943# Need more values for WE32 DMD executables. 944# Note that 0520 is the same as COFF 945#0 short 0520 tty630 layers executable 946#------------------------------------------------------------------------------ 947# bsdi: file(1) magic for BSD/OS (from BSDI) objects 948# 949 9500 lelong 0314 386 compact demand paged pure executable 951>16 lelong >0 not stripped 952>32 byte 0x6a (uses shared libs) 953 9540 lelong 0407 386 executable 955>16 lelong >0 not stripped 956>32 byte 0x6a (uses shared libs) 957 9580 lelong 0410 386 pure executable 959>16 lelong >0 not stripped 960>32 byte 0x6a (uses shared libs) 961 9620 lelong 0413 386 demand paged pure executable 963>16 lelong >0 not stripped 964>32 byte 0x6a (uses shared libs) 965 966# same as in SunOS 4.x, except for static shared libraries 9670 belong&077777777 0600413 SPARC demand paged 968>0 byte &0x80 969>>20 belong <4096 shared library 970>>20 belong =4096 dynamically linked executable 971>>20 belong >4096 dynamically linked executable 972>0 byte ^0x80 executable 973>16 belong >0 not stripped 974>36 belong 0xb4100001 (uses shared libs) 975 9760 belong&077777777 0600410 SPARC pure 977>0 byte &0x80 dynamically linked executable 978>0 byte ^0x80 executable 979>16 belong >0 not stripped 980>36 belong 0xb4100001 (uses shared libs) 981 9820 belong&077777777 0600407 SPARC 983>0 byte &0x80 dynamically linked executable 984>0 byte ^0x80 executable 985>16 belong >0 not stripped 986>36 belong 0xb4100001 (uses shared libs) 987 988#------------------------------------------------------------------------------ 989# c-lang: file(1) magic for C programs (or REXX) 990# 991 992# XPM icons (Greg Roelofs, newt@uchicago.edu) 993# if you uncomment "/*" for C/REXX below, also uncomment this entry 994#0 string /*\ XPM\ */ X pixmap image data 995 996# this first will upset you if you're a PL/1 shop... 997# in which case rm it; ascmagic will catch real C programs 998#0 string /* C or REXX program text 9990 string // C++ program text 1000 1001#------------------------------------------------------------------------------ 1002# chi: file(1) magic for ChiWriter files 1003# 10040 string \\1cw\ ChiWriter file 1005>5 string >\0 version %s 10060 string \\1cw ChiWriter file 1007#------------------------------------------------------------------------------ 1008# cisco: file(1) magic for cisco Systems routers 1009# 1010# Most cisco file-formats are covered by the generic elf code 1011# 1012# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 10130 belong&0xffffff00 0x85011400 cisco IOS microcode 1014>7 string >\0 for '%s' 10150 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 1016>7 string >\0 for '%s' 1017 1018#------------------------------------------------------------------------------ 1019# claris: file(1) magic for claris 1020# "H. Nanosecond" <aldomel@ix.netcom.com> 1021# Claris Works a word processor, etc. 1022# Version 3.0 1023 1024# .pct claris works clip art files 1025#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 1026#* 1027#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 1028#null to byte 1000 octal 1029514 string \377\377\377\377\000 Claris clip art? 1030>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 1031514 string \377\377\377\377\001 Claris clip art? 1032>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. 1033 1034# Claris works files 1035# .cwk 10360 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 1037# .plt 10380 string \020\341\000\000\010\010 Claris Works pallete files .plt 1039 1040# .msp a dictionary file I am not sure about this I have only one .msp file 10410 string \002\271\262\000\040\002\000\164 Claris works dictionary 1042 1043# .usp are user dictionary bits 1044# I am not sure about a magic header: 1045#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 1046# soh S p f 8 U D sp ^ S cr nl p o d i 1047#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 1048# a t r i s t sp ^ S cr nl d i v sp # 1049 1050# .mth Thesaurus 1051# statrts with \0 but no magic header 1052 1053# .chy Hyphenation file 1054# I am not sure: 000 210 034 000 000 1055 1056# other claris files 1057#./windows/claris/useng.ndx: data 1058#./windows/claris/xtndtran.l32: data 1059#./windows/claris/xtndtran.lst: data 1060#./windows/claris/clworks.lbl: data 1061#./windows/claris/clworks.prf: data 1062#./windows/claris/userd.spl: data 1063 1064#------------------------------------------------------------------------------ 1065# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 1066# 1067# XXX - what byte order does the Clipper use? 1068# 1069# XXX - what's the "!" stuff: 1070# 1071# >18 short !074000,000000 C1 R1 1072# >18 short !074000,004000 C2 R1 1073# >18 short !074000,010000 C3 R1 1074# >18 short !074000,074000 TEST 1075# 1076# I shall assume it's ANDing the field with the first value and 1077# comparing it with the second, and rewrite it as: 1078# 1079# >18 short&074000 000000 C1 R1 1080# >18 short&074000 004000 C2 R1 1081# >18 short&074000 010000 C3 R1 1082# >18 short&074000 074000 TEST 1083# 1084# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 1085# sort, nor does SunOS 4.x, so either it's something Intergraph added 1086# in CLIX, or something AT&T added in SVR3.2 or later, or something 1087# somebody else thought was a good idea; it's not documented in the 1088# man page for this version of "magic", nor does it appear to be 1089# implemented (at least not after I blew off the bogus code to turn 1090# old-style "&"s into new-style "&"s, which just didn't work at all). 1091# 10920 short 0575 CLIPPER COFF executable (VAX #) 1093>20 short 0407 (impure) 1094>20 short 0410 (5.2 compatible) 1095>20 short 0411 (pure) 1096>20 short 0413 (demand paged) 1097>20 short 0443 (target shared library) 1098>12 long >0 not stripped 1099>22 short >0 - version %ld 11000 short 0577 CLIPPER COFF executable 1101>18 short&074000 000000 C1 R1 1102>18 short&074000 004000 C2 R1 1103>18 short&074000 010000 C3 R1 1104>18 short&074000 074000 TEST 1105>20 short 0407 (impure) 1106>20 short 0410 (pure) 1107>20 short 0411 (separate I&D) 1108>20 short 0413 (paged) 1109>20 short 0443 (target shared library) 1110>12 long >0 not stripped 1111>22 short >0 - version %ld 1112>48 long&01 01 alignment trap enabled 1113>52 byte 1 -Ctnc 1114>52 byte 2 -Ctsw 1115>52 byte 3 -Ctpw 1116>52 byte 4 -Ctcb 1117>53 byte 1 -Cdnc 1118>53 byte 2 -Cdsw 1119>53 byte 3 -Cdpw 1120>53 byte 4 -Cdcb 1121>54 byte 1 -Csnc 1122>54 byte 2 -Cssw 1123>54 byte 3 -Cspw 1124>54 byte 4 -Cscb 11254 string pipe CLIPPER instruction trace 11264 string prof CLIPPER instruction profile 1127 1128#------------------------------------------------------------------------------ 1129# commands: file(1) magic for various shells and interpreters 1130# 11310 string : shell archive or script for antique kernel text 11320 string/b #!\ /bin/sh Bourne shell script text executable 11330 string/b #!\ /bin/csh C shell script text executable 1134# korn shell magic, sent by George Wu, gwu@clyde.att.com 11350 string/b #!\ /bin/ksh Korn shell script text executable 11360 string/b #!\ /bin/tcsh Tenex C shell script text executable 11370 string/b #!\ /usr/local/tcsh Tenex C shell script text executable 11380 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable 1139 1140# 1141# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 11420 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 11430 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable 11440 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable 11450 string/b #!\ /bin/nawk new awk script text executable 11460 string/b #!\ /usr/bin/nawk new awk script text executable 11470 string/b #!\ /usr/local/bin/nawk new awk script text executable 11480 string/b #!\ /bin/gawk GNU awk script text executable 11490 string/b #!\ /usr/bin/gawk GNU awk script text executable 11500 string/b #!\ /usr/local/bin/gawk GNU awk script text executable 1151# 11520 string/b #!\ /bin/awk awk script text executable 11530 string/b #!\ /usr/bin/awk awk script text executable 11540 string BEGIN awk script text 1155 1156# For Larry Wall's perl language. The ``eval'' line recognizes an 1157# outrageously clever hack for USG systems. 1158# Keith Waclena <keith@cerberus.uchicago.edu> 11590 string/b #!\ /bin/perl perl script text executable 11600 string eval\ "exec\ /bin/perl perl script text 11610 string/b #!\ /usr/bin/perl perl script text executable 11620 string eval\ "exec\ /usr/bin/perl perl script text 11630 string/b #!\ /usr/local/bin/perl perl script text 11640 string eval\ "exec\ /usr/local/bin/perl perl script text executable 1165 1166# AT&T Bell Labs' Plan 9 shell 11670 string/b #!\ /bin/rc Plan 9 rc shell script text executable 1168 1169# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 11700 string/b #!\ /bin/bash Bourne-Again shell script text executable 11710 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable 1172 1173# using env 11740 string #!/usr/bin/env a 1175>15 string >\0 %s script text executable 11760 string #!\ /usr/bin/env a 1177>16 string >\0 %s script text executable 1178 1179 1180# generic shell magic 11810 string #!\ / a 1182>3 string >\0 %s script text executable 11830 string #!\ / a 1184>3 string >\0 %s script text executable 11850 string #!/ a 1186>2 string >\0 %s script text executable 11870 string #!\ script text executable 1188>3 string >\0 for %s 1189 1190#------------------------------------------------------------------------------ 1191# compress: file(1) magic for pure-compression formats (no archives) 1192# 1193# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 1194# 1195# Formats for various forms of compressed data 1196# Formats for "compress" proper have been moved into "compress.c", 1197# because it tries to uncompress it to figure out what's inside. 1198 1199# standard unix compress 12000 string \037\235 compress'd data 1201>2 byte&0x80 >0 block compressed 1202>2 byte&0x1f x %d bits 1203 1204# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 12050 string \037\213 gzip compressed data 1206>2 byte <8 \b, reserved method, 1207>2 byte 8 \b, deflated, 1208>3 byte &0x01 ASCII, 1209>3 byte &0x02 continuation, 1210>3 byte &0x04 extra field, 1211>3 byte &0x08 original filename, 1212>>10 string x `%s', 1213>3 byte &0x10 comment, 1214>3 byte &0x20 encrypted, 1215>4 ledate x last modified: %s, 1216>8 byte 2 max compression, 1217>8 byte 4 max speed, 1218>9 byte =0x00 os: MS-DOS 1219>9 byte =0x01 os: Amiga 1220>9 byte =0x02 os: VMS 1221>9 byte =0x03 os: Unix 1222>9 byte =0x05 os: Atari 1223>9 byte =0x06 os: OS/2 1224>9 byte =0x07 os: MacOS 1225>9 byte =0x0A os: Tops/20 1226>9 byte =0x0B os: Win/32 1227 1228# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 12290 string \037\036 packed data 1230>2 belong >1 \b, %d characters originally 1231>2 belong =1 \b, %d character originally 1232# 1233# This magic number is byte-order-independent. XXX - Does that mean this 1234# is big-endian, little-endian, either, or that you can't tell? 1235# this short is valid for SunOS 12360 short 017437 old packed data 1237 1238# XXX - why *two* entries for "compacted data", one of which is 1239# byte-order independent, and one of which is byte-order dependent? 1240# 12410 short 0x1fff compacted data 1242# This string is valid for SunOS (BE) and a matching "short" is listed 1243# in the Ultrix (LE) magic file. 12440 string \377\037 compacted data 12450 short 0145405 huf output 1246 1247# bzip2 12480 string BZh bzip2 compressed data 1249>3 byte >47 \b, block size = %c00k 1250 1251# squeeze and crunch 1252# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 12530 beshort 0x76FF squeezed data, 1254>4 string x original name %s 12550 beshort 0x76FE crunched data, 1256>2 string x original name %s 12570 beshort 0x76FD LZH compressed data, 1258>2 string x original name %s 1259 1260# Freeze 12610 string \037\237 frozen file 2.1 12620 string \037\236 frozen file 1.0 (or gzip 0.5) 1263 1264# SCO compress -H (LZH) 12650 string \037\240 SCO compress -H (LZH) data 1266 1267# European GSM 06.10 is a provisional standard for full-rate speech 1268# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 1269# excitation/long term prediction) coding at 13 kbit/s. 1270# 1271# There's only a magic nibble (4 bits); that nibble repeats every 33 1272# bytes. This isn't suited for use, but maybe we can use it someday. 1273# 1274# This will cause very short GSM files to be declared as data and 1275# mismatches to be declared as data too! 1276#0 byte&0xF0 0xd0 data 1277#>33 byte&0xF0 0xd0 1278#>66 byte&0xF0 0xd0 1279#>99 byte&0xF0 0xd0 1280#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 1281 1282# bzip a block-sorting file compressor 1283# by Julian Seward <sewardj@cs.man.ac.uk> and others 1284# 12850 string BZ bzip compressed data 1286>2 byte x \b, version: %c 1287>3 string =1 \b, compression block size 100k 1288>3 string =2 \b, compression block size 200k 1289>3 string =3 \b, compression block size 300k 1290>3 string =4 \b, compression block size 400k 1291>3 string =5 \b, compression block size 500k 1292>3 string =6 \b, compression block size 600k 1293>3 string =7 \b, compression block size 700k 1294>3 string =8 \b, compression block size 800k 1295>3 string =9 \b, compression block size 900k 1296 1297# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 12980 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 1299>9 beshort <0x0940 1300>>9 byte&0xf0 =0x00 - version 0. 1301>>9 beshort&0x0fff x \b%03x, 1302>>13 byte 1 LZO1X-1, 1303>>13 byte 2 LZO1X-1(15), 1304>>13 byte 3 LZO1X-999, 1305## >>22 bedate >0 last modified: %s, 1306>>14 byte =0x00 os: MS-DOS 1307>>14 byte =0x01 os: Amiga 1308>>14 byte =0x02 os: VMS 1309>>14 byte =0x03 os: Unix 1310>>14 byte =0x05 os: Atari 1311>>14 byte =0x06 os: OS/2 1312>>14 byte =0x07 os: MacOS 1313>>14 byte =0x0A os: Tops/20 1314>>14 byte =0x0B os: WinNT 1315>>14 byte =0x0E os: Win32 1316>9 beshort >0x0939 1317>>9 byte&0xf0 =0x00 - version 0. 1318>>9 byte&0xf0 =0x10 - version 1. 1319>>9 byte&0xf0 =0x20 - version 2. 1320>>9 beshort&0x0fff x \b%03x, 1321>>15 byte 1 LZO1X-1, 1322>>15 byte 2 LZO1X-1(15), 1323>>15 byte 3 LZO1X-999, 1324## >>25 bedate >0 last modified: %s, 1325>>17 byte =0x00 os: MS-DOS 1326>>17 byte =0x01 os: Amiga 1327>>17 byte =0x02 os: VMS 1328>>17 byte =0x03 os: Unix 1329>>17 byte =0x05 os: Atari 1330>>17 byte =0x06 os: OS/2 1331>>17 byte =0x07 os: MacOS 1332>>17 byte =0x0A os: Tops/20 1333>>17 byte =0x0B os: WinNT 1334>>17 byte =0x0E os: Win32 1335#------------------------------------------------------------------------------ 1336# Console game magic 1337# Toby Deshane <hac@shoelace.digivill.net> 1338# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 1339# ROM dump format 1340 13410 string NES\032 iNES ROM dump, 1342>4 byte x %dx16k PRG 1343>5 byte x \b, %dx8k CHR 1344>6 byte&0x01 =0x1 \b, [Vert.] 1345>6 byte&0x01 =0x0 \b, [Horiz.] 1346>6 byte&0x02 =0x2 \b, [SRAM] 1347>6 byte&0x04 =0x4 \b, [Trainer] 1348>6 byte&0x04 =0x8 \b, [4-Scr] 1349 1350#------------------------------------------------------------------------------ 1351# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 1352# 13530x104 belong 0xCEED6666 Gameboy ROM: 1354>0x134 string >\0 "%.16s" 1355>0x146 byte 0x03 \b,[SGB] 1356>0x147 byte 0x00 \b, [ROM ONLY] 1357>0x147 byte 0x01 \b, [ROM+MBC1] 1358>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 1359>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 1360>0x147 byte 0x05 \b, [ROM+MBC2] 1361>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 1362>0x147 byte 0x08 \b, [ROM+RAM] 1363>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 1364>0x147 byte 0x0B \b, [ROM+MMM01] 1365>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 1366>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 1367>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 1368>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 1369>0x147 byte 0x11 \b, [ROM+MBC3] 1370>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 1371>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 1372>0x147 byte 0x19 \b, [ROM+MBC5] 1373>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 1374>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 1375>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 1376>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 1377>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 1378>0x147 byte 0x1F \b, [Pocket Camera] 1379>0x147 byte 0xFD \b, [Bandai TAMA5] 1380>0x147 byte 0xFE \b, [Hudson HuC-3] 1381>0x147 byte 0xFF \b, [Hudson HuC-1] 1382 1383>0x148 byte 0 \b, ROM: 256Kbit 1384>0x148 byte 1 \b, ROM: 512Kbit 1385>0x148 byte 2 \b, ROM: 1Mbit 1386>0x148 byte 3 \b, ROM: 2Mbit 1387>0x148 byte 4 \b, ROM: 4Mbit 1388>0x148 byte 5 \b, ROM: 8Mbit 1389>0x148 byte 6 \b, ROM: 16Mbit 1390>0x148 byte 0x52 \b, ROM: 9Mbit 1391>0x148 byte 0x53 \b, ROM: 10Mbit 1392>0x148 byte 0x54 \b, ROM: 12Mbit 1393 1394>0x149 byte 1 \b, RAM: 16Kbit 1395>0x149 byte 2 \b, RAM: 64Kbit 1396>0x149 byte 3 \b, RAM: 128Kbit 1397>0x149 byte 4 \b, RAM: 1Mbit 1398 1399#>0x14e long x \b, CRC: %x 1400 1401#------------------------------------------------------------------------------ 1402# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 1403# 14040x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 1405>0x120 string >\0 Name: "%.16s" 1406>0x110 string >\0 %.16s 1407>0x1B0 string RA with SRAM 1408 1409#------------------------------------------------------------------------------ 1410# genesis: file(1) magic for the Super MegaDrive ROM dump format 1411# 14120x280 string EAGN Super MagicDrive ROM dump 1413>0 byte x %dx16k blocks 1414>2 byte 0 \b, last in series or standalone 1415>2 byte >0 \b, split ROM 1416>8 byte 0xAA 1417>9 byte 0xBB 1418 1419#------------------------------------------------------------------------------ 1420# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 1421# 14220x280 string EAMG Super MagicDrive ROM dump 1423>0 byte x %dx16k blocks 1424>2 byte x \b, last in series or standalone 1425>8 byte 0xAA 1426>9 byte 0xBB 1427 1428#------------------------------------------------------------------------------ 1429# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 1430# 1431# Does not detect all images. Very preliminary guesswork. Need more data 1432# on format. 1433# 1434# FIXME: need a little more info...;P 1435# 1436#0 byte 0xF3 1437#>1 byte 0xED Sega Master System/Game Gear ROM dump 1438#>1 byte 0x31 Sega Master System/Game Gear ROM dump 1439#>1 byte 0xDB Sega Master System/Game Gear ROM dump 1440#>1 byte 0xAF Sega Master System/Game Gear ROM dump 1441#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 1442 1443#------------------------------------------------------------------------------ 1444# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 1445# 14460 belong 0x21068028 Sega Dreamcast VMU game image 14470 string LCDi Dream Animator file 1448 1449#------------------------------------------------------------------------------ 1450# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 1451# 14520 belong 0x37804012 V64 Nintendo 64 ROM dump 1453 1454#------------------------------------------------------------------------------ 1455# msx: file(1) magic for MSX game cartridge dumps 14560 beshort 0x4142 MSX game cartridge dump 1457#------------------------------------------------------------------------------ 1458# convex: file(1) magic for Convex boxes 1459# 1460# Convexes are big-endian. 1461# 1462# /*\ 1463# * Below are the magic numbers and tests added for Convex. 1464# * Added at beginning, because they are expected to be used most. 1465# \*/ 14660 belong 0507 Convex old-style object 1467>16 belong >0 not stripped 14680 belong 0513 Convex old-style demand paged executable 1469>16 belong >0 not stripped 14700 belong 0515 Convex old-style pre-paged executable 1471>16 belong >0 not stripped 14720 belong 0517 Convex old-style pre-paged, non-swapped executable 1473>16 belong >0 not stripped 14740 belong 0x011257 Core file 1475# 1476# The following are a series of dump format magic numbers. Each one 1477# corresponds to a drastically different dump format. The first on is 1478# the original dump format on a 4.1 BSD or earlier file system. The 1479# second marks the change between the 4.1 file system and the 4.2 file 1480# system. The Third marks the changing of the block size from 1K 1481# to 2K to be compatible with an IDC file system. The fourth indicates 1482# a dump that is dependent on Convex Storage Manager, because data in 1483# secondary storage is not physically contained within the dump. 1484# The restore program uses these number to determine how the data is 1485# to be extracted. 1486# 148724 belong =60011 dump format, 4.1 BSD or earlier 148824 belong =60012 dump format, 4.2 or 4.3 BSD without IDC 148924 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 149024 belong =60014 dump format, Convex Storage Manager by-reference dump 1491# 1492# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 1493# If there is no `=' sign, assume just checking for whether the bit is set? 1494# 14950 belong 0601 Convex SOFF 1496>88 belong&0x000f0000 =0x00000000 c1 1497>88 belong &0x00010000 c2 1498>88 belong &0x00020000 c2mp 1499>88 belong &0x00040000 parallel 1500>88 belong &0x00080000 intrinsic 1501>88 belong &0x00000001 demand paged 1502>88 belong &0x00000002 pre-paged 1503>88 belong &0x00000004 non-swapped 1504>88 belong &0x00000008 POSIX 1505# 1506>84 belong &0x80000000 executable 1507>84 belong &0x40000000 object 1508>84 belong&0x20000000 =0 not stripped 1509>84 belong&0x18000000 =0x00000000 native fpmode 1510>84 belong&0x18000000 =0x10000000 ieee fpmode 1511>84 belong&0x18000000 =0x18000000 undefined fpmode 1512# 15130 belong 0605 Convex SOFF core 1514# 15150 belong 0607 Convex SOFF checkpoint 1516>88 belong&0x000f0000 =0x00000000 c1 1517>88 belong &0x00010000 c2 1518>88 belong &0x00020000 c2mp 1519>88 belong &0x00040000 parallel 1520>88 belong &0x00080000 intrinsic 1521>88 belong &0x00000008 POSIX 1522# 1523>84 belong&0x18000000 =0x00000000 native fpmode 1524>84 belong&0x18000000 =0x10000000 ieee fpmode 1525>84 belong&0x18000000 =0x18000000 undefined fpmode 1526 1527#------------------------------------------------------------------------------ 1528# database: file(1) magic for various databases 1529# 1530# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 1531# 1532# 1533# GDBM magic numbers 1534# Will be maintained as part of the GDBM distribution in the future. 1535# <downsj@teeny.org> 15360 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 15370 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 15380 string GDBM GNU dbm 2.x database 1539# 1540# Berkeley DB 1541# 1542# Ian Darwin's file /etc/magic files: big/little-endian version. 1543# 1544# Hash 1.85/1.86 databases store metadata in network byte order. 1545# Btree 1.85/1.86 databases store the metadata in host byte order. 1546# Hash and Btree 2.X and later databases store the metadata in host byte order. 1547 15480 long 0x00061561 Berkeley DB 1549>8 belong 4321 1550>>4 belong >2 1.86 1551>>4 belong <3 1.85 1552>>4 belong >0 (Hash, version %d, native byte-order) 1553>8 belong 1234 1554>>4 belong >2 1.86 1555>>4 belong <3 1.85 1556>>4 belong >0 (Hash, version %d, little-endian) 1557 15580 belong 0x00061561 Berkeley DB 1559>8 belong 4321 1560>>4 belong >2 1.86 1561>>4 belong <3 1.85 1562>>4 belong >0 (Hash, version %d, big-endian) 1563>8 belong 1234 1564>>4 belong >2 1.86 1565>>4 belong <3 1.85 1566>>4 belong >0 (Hash, version %d, native byte-order) 1567 15680 long 0x00053162 Berkeley DB 1.85/1.86 1569>4 long >0 (Btree, version %d, native byte-order) 15700 belong 0x00053162 Berkeley DB 1.85/1.86 1571>4 belong >0 (Btree, version %d, big-endian) 15720 lelong 0x00053162 Berkeley DB 1.85/1.86 1573>4 lelong >0 (Btree, version %d, little-endian) 1574 157512 long 0x00061561 Berkeley DB 1576>16 long >0 (Hash, version %d, native byte-order) 157712 belong 0x00061561 Berkeley DB 1578>16 belong >0 (Hash, version %d, big-endian) 157912 lelong 0x00061561 Berkeley DB 1580>16 lelong >0 (Hash, version %d, little-endian) 1581 158212 long 0x00053162 Berkeley DB 1583>16 long >0 (Btree, version %d, native byte-order) 158412 belong 0x00053162 Berkeley DB 1585>16 belong >0 (Btree, version %d, big-endian) 158612 lelong 0x00053162 Berkeley DB 1587>16 lelong >0 (Btree, version %d, little-endian) 1588 158912 long 0x00042253 Berkeley DB 1590>16 long >0 (Queue, version %d, native byte-order) 159112 belong 0x00042253 Berkeley DB 1592>16 belong >0 (Queue, version %d, big-endian) 159312 lelong 0x00042253 Berkeley DB 1594>16 lelong >0 (Queue, version %d, little-endian) 1595# 1596# 1597# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 15980 string RRD RRDTool DB 1599>4 string x version %s 1600 1601#------------------------------------------------------------------------------ 1602# diamond: file(1) magic for Diamond system 1603# 1604# ... diamond is a multi-media mail and electronic conferencing system.... 1605# 1606# XXX - I think it was either renamed Slate, or replaced by Slate.... 1607# 1608# The full deal is too long... 1609#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 16100 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 1611 1612#------------------------------------------------------------------------------ 1613# diff: file(1) magic for diff(1) output 1614# 16150 string diff\ 'diff' output text 16160 string ***\ 'diff' output text 16170 string Only\ in\ 'diff' output text 16180 string Common\ subdirectories:\ 'diff' output text 1619 1620# xdelta is like diff(1) for binary files (works for text, too). 1621# Available from: ftp://ftp.xcf.berkeley.edu/pub/xdelta/ 16220 string %XDZ xdelta diff file 1623>4 string >% version %.3s 1624# Digital UNIX - Info 1625# 16260 string !<arch>\n________64E Alpha archive 1627>22 string X -- out of date 1628# 1629# Alpha COFF Based Executables 1630# The stripped stuff really needs to be an 8 byte (64 bit) compare, 1631# but this works 16320 leshort 0x183 COFF format alpha 1633>22 leshort&020000 &010000 sharable library, 1634>22 leshort&020000 ^010000 dynamically linked, 1635>24 leshort 0410 pure 1636>24 leshort 0413 demand paged 1637>8 lelong >0 executable or object module, not stripped 1638>8 lelong 0 1639>>12 lelong 0 executable or object module, stripped 1640>>12 lelong >0 executable or object module, not stripped 1641>27 byte >0 - version %d. 1642>26 byte >0 %d- 1643>28 leshort >0 %d 1644# 1645# The next is incomplete, we could tell more about this format, 1646# but its not worth it. 16470 leshort 0x188 Alpha compressed COFF 16480 leshort 0x18f Alpha u-code object 1649# 1650# 1651# Some other interesting Digital formats, 16520 string \377\377\177 ddis/ddif 16530 string \377\377\174 ddis/dots archive 16540 string \377\377\176 ddis/dtif table data 16550 string \033c\033 LN03 output 16560 long 04553207 X image 1657# 16580 string !<PDF>!\n profiling data file 1659# 1660# Locale data tables (MIPS and Alpha). 1661# 16620 short 0x0501 locale data table 1663>6 short 0x24 for MIPS 1664>6 short 0x40 for Alpha 1665 1666#------------------------------------------------------------------------------ 1667# dump: file(1) magic for dump file format--for new and old dump filesystems 1668# 1669# We specify both byte orders in order to recognize byte-swapped dumps. 1670# 167124 belong 60012 new-fs dump file (big endian), 1672>4 bedate x Previous dump %s, 1673>8 bedate x This dump %s, 1674>12 belong >0 Volume %ld, 1675>692 belong 0 Level zero, type: 1676>692 belong >0 Level %d, type: 1677>0 belong 1 tape header, 1678>0 belong 2 beginning of file record, 1679>0 belong 3 map of inodes on tape, 1680>0 belong 4 continuation of file record, 1681>0 belong 5 end of volume, 1682>0 belong 6 map of inodes deleted, 1683>0 belong 7 end of medium (for floppy), 1684>676 string >\0 Label %s, 1685>696 string >\0 Filesystem %s, 1686>760 string >\0 Device %s, 1687>824 string >\0 Host %s, 1688>888 belong >0 Flags %x 1689 169024 belong 60011 old-fs dump file (big endian), 1691#>4 bedate x Previous dump %s, 1692#>8 bedate x This dump %s, 1693>12 belong >0 Volume %ld, 1694>692 belong 0 Level zero, type: 1695>692 belong >0 Level %d, type: 1696>0 belong 1 tape header, 1697>0 belong 2 beginning of file record, 1698>0 belong 3 map of inodes on tape, 1699>0 belong 4 continuation of file record, 1700>0 belong 5 end of volume, 1701>0 belong 6 map of inodes deleted, 1702>0 belong 7 end of medium (for floppy), 1703>676 string >\0 Label %s, 1704>696 string >\0 Filesystem %s, 1705>760 string >\0 Device %s, 1706>824 string >\0 Host %s, 1707>888 belong >0 Flags %x 1708 170924 lelong 60012 new-fs dump file (little endian), 1710>4 ledate x This dump %s, 1711>8 ledate x Previous dump %s, 1712>12 lelong >0 Volume %ld, 1713>692 lelong 0 Level zero, type: 1714>692 lelong >0 Level %d, type: 1715>0 lelong 1 tape header, 1716>0 lelong 2 beginning of file record, 1717>0 lelong 3 map of inodes on tape, 1718>0 lelong 4 continuation of file record, 1719>0 lelong 5 end of volume, 1720>0 lelong 6 map of inodes deleted, 1721>0 lelong 7 end of medium (for floppy), 1722>676 string >\0 Label %s, 1723>696 string >\0 Filesystem %s, 1724>760 string >\0 Device %s, 1725>824 string >\0 Host %s, 1726>888 lelong >0 Flags %x 1727 172824 lelong 60011 old-fs dump file (little endian), 1729#>4 ledate x Previous dump %s, 1730#>8 ledate x This dump %s, 1731>12 lelong >0 Volume %ld, 1732>692 lelong 0 Level zero, type: 1733>692 lelong >0 Level %d, type: 1734>0 lelong 1 tape header, 1735>0 lelong 2 beginning of file record, 1736>0 lelong 3 map of inodes on tape, 1737>0 lelong 4 continuation of file record, 1738>0 lelong 5 end of volume, 1739>0 lelong 6 map of inodes deleted, 1740>0 lelong 7 end of medium (for floppy), 1741>676 string >\0 Label %s, 1742>696 string >\0 Filesystem %s, 1743>760 string >\0 Device %s, 1744>824 string >\0 Host %s, 1745>888 lelong >0 Flags %x 1746 1747#------------------------------------------------------------------------------ 1748# elf: file(1) magic for ELF executables 1749# 1750# We have to check the byte order flag to see what byte order all the 1751# other stuff in the header is in. 1752# 1753# MIPS R3000 may also be for MIPS R2000. 1754# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 1755# 1756# updated by Daniel Quinlan (quinlan@yggdrasil.com) 17570 string \177ELF ELF 1758>4 byte 0 invalid class 1759>4 byte 1 32-bit 1760# only for MIPS 1761>>18 beshort 8 1762>>18 beshort 10 1763>>>36 belong &0x20 N32 1764>4 byte 2 64-bit 1765>5 byte 0 invalid byte order 1766>5 byte 1 LSB 1767# only for MIPS R3000_BE 1768>>18 leshort 8 1769# only for 32-bit 1770>>>4 byte 1 1771>>>>36 lelong&0xf0000000 0x00000000 mips-1 1772>>>>36 lelong&0xf0000000 0x10000000 mips-2 1773>>>>36 lelong&0xf0000000 0x20000000 mips-3 1774>>>>36 lelong&0xf0000000 0x30000000 mips-4 1775>>>>36 lelong&0xf0000000 0x40000000 mips-5 1776>>>>36 lelong&0xf0000000 0x50000000 mips-6 1777# only for 64-bit 1778>>>4 byte 2 1779>>>>48 lelong&0xf0000000 0x00000000 mips-1 1780>>>>48 lelong&0xf0000000 0x10000000 mips-2 1781>>>>48 lelong&0xf0000000 0x20000000 mips-3 1782>>>>48 lelong&0xf0000000 0x30000000 mips-4 1783>>>>48 lelong&0xf0000000 0x40000000 mips-5 1784>>>>48 lelong&0xf0000000 0x50000000 mips-6 1785>>16 leshort 0 no file type, 1786>>16 leshort 1 relocatable, 1787>>16 leshort 2 executable, 1788>>16 leshort 3 shared object, 1789# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 1790# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 1791>>16 leshort 4 core file 1792>>>(0x38+0xcc) string >\0 of '%s' 1793>>>(0x38+0x10) lelong >0 (signal %d), 1794>>16 leshort &0xff00 processor-specific, 1795>>18 leshort 0 no machine, 1796>>18 leshort 1 AT&T WE32100 - invalid byte order, 1797>>18 leshort 2 SPARC - invalid byte order, 1798>>18 leshort 3 Intel 80386, 1799>>18 leshort 4 Motorola 68000 - invalid byte order, 1800>>18 leshort 5 Motorola 88000 - invalid byte order, 1801>>18 leshort 6 Intel 80486, 1802>>18 leshort 7 Intel 80860, 1803# "officially" big endian, but binutils bfd only emits magic #8 for MIPS. 1804>>18 leshort 8 MIPS R3000_LE [bfd bug], 1805>>18 leshort 9 Amdahl - invalid byte order, 1806>>18 leshort 10 MIPS R3000_LE, 1807>>18 leshort 11 RS6000 - invalid byte order, 1808>>18 leshort 15 PA-RISC - invalid byte order, 1809>>>50 leshort 0x0214 2.0 1810>>>48 leshort &0x0008 (LP64), 1811>>18 leshort 16 nCUBE, 1812>>18 leshort 17 Fujitsu VPP500, 1813>>18 leshort 18 SPARC32PLUS, 1814>>18 leshort 20 PowerPC, 1815>>18 leshort 36 NEC V800, 1816>>18 leshort 37 Fujitsu FR20, 1817>>18 leshort 38 TRW RH-32, 1818>>18 leshort 39 Motorola RCE, 1819>>18 leshort 40 ARM, 1820>>18 leshort 41 Alpha, 1821>>18 leshort 42 Hitachi SH, 1822>>18 leshort 43 SPARC V9 - invalid byte order, 1823>>18 leshort 44 Siemens Tricore Embedded Processor, 1824>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 1825>>18 leshort 46 Hitachi H8/300, 1826>>18 leshort 47 Hitachi H8/300H, 1827>>18 leshort 48 Hitachi H8S, 1828>>18 leshort 49 Hitachi H8/500, 1829>>18 leshort 50 IA-64 (Intel 64 bit architecture) 1830>>18 leshort 51 Stanford MIPS-X, 1831>>18 leshort 52 Motorola Coldfire, 1832>>18 leshort 53 Motorola M68HC12, 1833>>18 leshort 62 AMD x86-64, 1834>>18 leshort 75 Digital VAX, 1835>>18 leshort 0x9026 Alpha (unofficial), 1836>>20 lelong 0 invalid version 1837>>20 lelong 1 version 1 1838>>36 lelong 1 MathCoPro/FPU/MAU Required 1839>5 byte 2 MSB 1840# only for MIPS R3000_BE 1841>>18 beshort 8 1842# only for 32-bit 1843>>>4 byte 1 1844>>>>36 belong&0xf0000000 0x00000000 mips-1 1845>>>>36 belong&0xf0000000 0x10000000 mips-2 1846>>>>36 belong&0xf0000000 0x20000000 mips-3 1847>>>>36 belong&0xf0000000 0x30000000 mips-4 1848>>>>36 belong&0xf0000000 0x40000000 mips-5 1849>>>>36 belong&0xf0000000 0x50000000 mips-6 1850# only for 64-bit 1851>>>4 byte 2 1852>>>>48 belong&0xf0000000 0x00000000 mips-1 1853>>>>48 belong&0xf0000000 0x10000000 mips-2 1854>>>>48 belong&0xf0000000 0x20000000 mips-3 1855>>>>48 belong&0xf0000000 0x30000000 mips-4 1856>>>>48 belong&0xf0000000 0x40000000 mips-5 1857>>>>48 belong&0xf0000000 0x50000000 mips-6 1858>>16 beshort 0 no file type, 1859>>16 beshort 1 relocatable, 1860>>16 beshort 2 executable, 1861>>16 beshort 3 shared object, 1862>>16 beshort 4 core file, 1863>>>(0x38+0xcc) string >\0 of '%s' 1864>>>(0x38+0x10) belong >0 (signal %d), 1865>>16 beshort &0xff00 processor-specific, 1866>>18 beshort 0 no machine, 1867>>18 beshort 1 AT&T WE32100, 1868>>18 beshort 2 SPARC, 1869>>18 beshort 3 Intel 80386 - invalid byte order, 1870>>18 beshort 4 Motorola 68000, 1871>>18 beshort 5 Motorola 88000, 1872>>18 beshort 6 Intel 80486 - invalid byte order, 1873>>18 beshort 7 Intel 80860, 1874>>18 beshort 8 MIPS R3000_BE, 1875>>18 beshort 9 Amdahl, 1876>>18 beshort 10 MIPS R3000_LE - invalid byte order, 1877>>18 beshort 11 RS6000, 1878>>18 beshort 15 PA-RISC 1879>>>50 beshort 0x0214 2.0 1880>>>48 beshort &0x0008 (LP64) 1881>>18 beshort 16 nCUBE, 1882>>18 beshort 17 Fujitsu VPP500, 1883>>18 beshort 18 SPARC32PLUS, 1884>>>36 belong&0xffff00 &0x000100 V8+ Required, 1885>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required, 1886>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required, 1887>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, 1888>>18 beshort 20 PowerPC or cisco 4500, 1889>>18 beshort 21 cisco 7500, 1890>>18 beshort 24 cisco SVIP, 1891>>18 beshort 25 cisco 7200, 1892>>18 beshort 36 NEC V800 or cisco 12000, 1893>>18 beshort 37 Fujitsu FR20, 1894>>18 beshort 38 TRW RH-32, 1895>>18 beshort 39 Motorola RCE, 1896>>18 beshort 40 ARM, 1897>>18 beshort 41 Alpha, 1898>>18 beshort 42 Hitachi SH, 1899>>18 beshort 43 SPARC V9, 1900>>18 beshort 44 Siemens Tricore Embedded Processor, 1901>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 1902>>18 beshort 46 Hitachi H8/300, 1903>>18 beshort 47 Hitachi H8/300H, 1904>>18 beshort 48 Hitachi H8S, 1905>>18 beshort 49 Hitachi H8/500, 1906>>18 beshort 50 Intel Merced Processor, 1907>>18 beshort 51 Stanford MIPS-X, 1908>>18 beshort 52 Motorola Coldfire, 1909>>18 beshort 53 Motorola M68HC12, 1910>>18 beshort 73 Cray NV1, 1911>>18 beshort 75 Digital VAX, 1912>>18 beshort 0x9026 Alpha (unofficial), 1913>>20 belong 0 invalid version 1914>>20 belong 1 version 1 1915>>36 belong 1 MathCoPro/FPU/MAU Required 1916>8 string >\0 (%s) 1917>8 string \0 1918>>7 byte 0 (SYSV) 1919>>7 byte 1 (HP-UX) 1920>>7 byte 2 (NetBSD) 1921>>7 byte 3 (GNU/Linux) 1922>>7 byte 4 (GNU/Hurd) 1923>>7 byte 5 (86Open) 1924>>7 byte 6 (Solaris) 1925>>7 byte 7 (Monterey) 1926>>7 byte 8 (IRIX) 1927>>7 byte 9 (FreeBSD) 1928>>7 byte 10 (Tru64) 1929>>7 byte 11 (Novell Modesto) 1930>>7 byte 12 (OpenBSD) 1931>>7 byte 97 (ARM) 1932>>7 byte 255 (embedded) 1933 1934#------------------------------------------------------------------------------ 1935# encore: file(1) magic for Encore machines 1936# 1937# XXX - needs to have the byte order specified (NS32K was little-endian, 1938# dunno whether they run the 88K in little-endian mode or not). 1939# 19400 short 0x154 Encore 1941>20 short 0x107 executable 1942>20 short 0x108 pure executable 1943>20 short 0x10b demand-paged executable 1944>20 short 0x10f unsupported executable 1945>12 long >0 not stripped 1946>22 short >0 - version %ld 1947>22 short 0 - 1948#>4 date x stamp %s 19490 short 0x155 Encore unsupported executable 1950>12 long >0 not stripped 1951>22 short >0 - version %ld 1952>22 short 0 - 1953#>4 date x stamp %s 1954 1955#------------------------------------------------------------------------------ 1956# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris 1957# Stefan Praszalowicz (hpicollo@worldnet.fr) 1958#0 lelong 0x10000037 Epoc32 1959>4 lelong 0x1000006D 1960>>8 lelong 0x1000007F Word 1961>>8 lelong 0x10000088 Sheet 1962>>8 lelong 0x1000007D Sketch 1963>>8 lelong 0x10000085 TextEd 1964 1965#------------------------------------------------------------------------------ 1966# filesystems: file(1) magic for different filesystems 1967# 19680 string \366\366\366\366 PC formatted floppy with no filesystem 1969# Sun disk labels 1970# From /usr/include/sun/dklabel.h: 19710774 beshort 0xdabe Sun disk label 1972>0 string x '%s 1973>>31 string >\0 \b%s 1974>>>63 string >\0 \b%s 1975>>>>95 string >\0 \b%s 1976>0 string x \b' 1977>0734 short >0 %d rpm, 1978>0736 short >0 %d phys cys, 1979>0740 short >0 %d alts/cyl, 1980>0746 short >0 %d interleave, 1981>0750 short >0 %d data cyls, 1982>0752 short >0 %d alt cyls, 1983>0754 short >0 %d heads/partition, 1984>0756 short >0 %d sectors/track, 1985>0764 long >0 start cyl %ld, 1986>0770 long x %ld blocks 1987# Is there a boot block written 1 sector in? 1988>512 belong&077777777 0600407 \b, boot block present 19890x1FE leshort 0xAA55 x86 boot sector 1990>2 string OSBS \b, OS/BS MBR 1991>0x8C string Invalid\ partition\ table \b, MS-DOS MBR 1992>0 string \0\0\0\0 \b, extended partition table 1993>0 leshort 0x3CEB \b, system 1994>>3 string >\0 %s 1995>>0x36 string FAT \b, %s 1996>>>0x39 string 12 (%s bit) 1997>>>0x39 string 16 (%s bit) 1998>0x52 string FAT32 \b, FAT (32 bit) 1999>>>43 string >NO\ NAME label: %.11s, 2000>>>43 string <NO\ NAME label: %.11s, 2001>>>43 string NO\ NAME unlabeled, 2002>>>19 leshort >0 %d sectors 2003>>>19 leshort 0 2004>>>>32 lelong x %d sectors 2005>0x200 lelong 0x82564557 \b, BSD disklabel 2006 2007# Minix filesystems - Juan Cespedes <cespedes@debian.org> 20080x410 leshort 0x137f Minix filesystem 20090x410 leshort 0x138f Minix filesystem, 30 char names 20100x410 leshort 0x2468 Minix filesystem, version 2 20110x410 leshort 0x2478 Minix filesystem, version 2, 30 char names 2012 2013# romfs filesystems - Juan Cespedes <cespedes@debian.org> 20140 string -rom1fs-\0 romfs filesystem, version 1 2015>8 belong x %d bytes, 2016>16 string x named %s. 2017 2018# netboot image - Juan Cespedes <cespedes@debian.org> 20190 lelong 0x1b031336L Netboot image, 2020>4 lelong&0xFFFFFF00 0 2021>>4 lelong&0x100 0x000 mode 2 2022>>4 lelong&0x100 0x100 mode 3 2023>4 lelong&0xFFFFFF00 !0 unknown mode 2024 20250x18b string OS/2 OS/2 Boot Manager 2026 20279564 lelong 0x00011954 Unix Fast File system (little-endian), 2028>8404 string x last mounted on %s, 2029#>9504 ledate x last checked at %s, 2030>8224 ledate x last written at %s, 2031>8401 byte x clean flag %d, 2032>8228 lelong x number of blocks %d, 2033>8232 lelong x number of data blocks %d, 2034>8236 lelong x number of cylinder groups %d, 2035>8240 lelong x block size %d, 2036>8244 lelong x fragment size %d, 2037>8252 lelong x minimum percentage of free blocks %d, 2038>8256 lelong x rotational delay %dms, 2039>8260 lelong x disk rotational speed %drps, 2040>8320 lelong 0 TIME optimization 2041>8320 lelong 1 SPACE optimization 2042 20439564 belong 0x00011954 Unix Fast File system (big-endian), 2044>8404 string x last mounted on %s, 2045#>9504 bedate x last checked at %s, 2046>8224 bedate x last written at %s, 2047>8401 byte x clean flag %d, 2048>8228 belong x number of blocks %d, 2049>8232 belong x number of data blocks %d, 2050>8236 belong x number of cylinder groups %d, 2051>8240 belong x block size %d, 2052>8244 belong x fragment size %d, 2053>8252 belong x minimum percentage of free blocks %d, 2054>8256 belong x rotational delay %dms, 2055>8260 belong x disk rotational speed %drps, 2056>8320 belong 0 TIME optimization 2057>8320 belong 1 SPACE optimization 2058 2059# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> 20600x438 leshort 0xEF53 Linux 2061>0x44c lelong x rev %d 2062>0x43e leshort x \b.%d 2063>0x45c lelong ^0x0000004 ext2 filesystem data 2064>>0x43a leshort ^0x0000001 (mounted or unclean) 2065>0x45c lelong &0x0000004 ext3 filesystem data 2066>>0x460 lelong &0x0000004 (needs journal recovery) 2067>0x43a leshort &0x0000002 (errors) 2068>0x460 lelong &0x0000001 (compressed) 2069#>0x460 lelong &0x0000002 (filetype) 2070#>0x464 lelong &0x0000001 (sparse_super) 2071>0x464 lelong &0x0000002 (large files) 2072 2073# SGI disk labels - Nathan Scott <nathans@debian.org> 20740 belong 0x0BE5A941 SGI disk label (volume header) 2075 2076# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 20770 belong 0x58465342 SGI XFS filesystem data 2078>0x4 belong x (blksz=3D%d, 2079>0x68 beshort x inosz=3D%d, 2080>0x64 beshort ^0x2004 v1 dirs) 2081>0x64 beshort &0x2004 v2 dirs) 2082 2083#------------------------------------------------------------------------------ 2084# flash: file(1) magic for Macromedia Flash file format 2085# 2086# See 2087# 2088# http://www.macromedia.com/software/flash/open/ 2089# 20900 string FWS Macromedia Flash data, 2091>3 byte x version %d 2092 2093#------------------------------------------------------------------------------ 2094# fonts: file(1) magic for font data 2095# 20960 string FONT ASCII vfont text 20970 short 0436 Berkeley vfont data 20980 short 017001 byte-swapped Berkeley vfont data 2099 2100# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 21010 string %!PS-AdobeFont-1.0 PostScript Type 1 font text 2102>20 string >\0 (%s) 21036 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data 2104 2105# X11 font files in SNF (Server Natural Format) format 21060 belong 00000004 X11 SNF font data, MSB first 21070 lelong 00000004 X11 SNF font data, LSB first 2108 2109# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 21100 string STARTFONT\040 X11 BDF font text 2111 2112# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 2113# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 21140 string \001fcp X11 Portable Compiled Font data 2115>12 byte 0x02 \b, LSB first 2116>12 byte 0x0a \b, MSB first 21170 string D1.0\015 X11 Speedo font data 2118 2119#------------------------------------------------------------------------------ 2120# FIGlet fonts and controlfiles 2121# From figmagic supplied with Figlet version 2.2 2122# "David E. O'Brien" <obrien@FreeBSD.ORG> 21230 string flf FIGlet font 2124>3 string >2a version %-2.2s 21250 string flc FIGlet controlfile 2126>3 string >2a version %-2.2s 2127 2128# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 2129# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 21300 belong 0x14025919 libGrx font data, 2131>8 leshort x %dx 2132>10 leshort x \b%d 2133>40 string x %s 2134# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 21350 belong 0xff464f4e DOS code page font data collection 21367 belong 0x00454741 DOS code page font data 21377 belong 0x00564944 DOS code page font data (from Linux?) 21384098 string DOSFONT DOSFONT2 encrypted font data 2139 2140# downloadable fonts for browser (prints type) anthon@mnt.org 21410 string PFR1 PFR1 font 2142>102 string >0 \b: %s 2143 2144#------------------------------------------------------------------------------ 2145# frame: file(1) magic for FrameMaker files 2146# 2147# This stuff came on a FrameMaker demo tape, most of which is 2148# copyright, but this file is "published" as witness the following: 2149# 21500 string \<MakerFile FrameMaker document 2151>11 string 5.5 (5.5 2152>11 string 5.0 (5.0 2153>11 string 4.0 (4.0 2154>11 string 3.0 (3.0 2155>11 string 2.0 (2.0 2156>11 string 1.0 (1.0 2157>14 byte x %c) 21580 string \<MIFFile FrameMaker MIF (ASCII) file 2159>9 string 4.0 (4.0) 2160>9 string 3.0 (3.0) 2161>9 string 2.0 (2.0) 2162>9 string 1.0 (1.x) 21630 string \<MakerDictionary FrameMaker Dictionary text 2164>17 string 3.0 (3.0) 2165>17 string 2.0 (2.0) 2166>17 string 1.0 (1.x) 21670 string \<MakerScreenFont FrameMaker Font file 2168>17 string 1.01 (%s) 21690 string \<MML FrameMaker MML file 21700 string \<BookFile FrameMaker Book file 2171>10 string 3.0 (3.0 2172>10 string 2.0 (2.0 2173>10 string 1.0 (1.0 2174>13 byte x %c) 2175# XXX - this book entry should be verified, if you find one, uncomment this 2176#0 string \<Book\ FrameMaker Book (ASCII) file 2177#>6 string 3.0 (3.0) 2178#>6 string 2.0 (2.0) 2179#>6 string 1.0 (1.0) 21800 string \<Maker Intermediate Print File FrameMaker IPL file 2181 2182#------------------------------------------------------------------------------ 2183# freebsd: file(1) magic for FreeBSD objects 2184# 2185# All new-style FreeBSD magic numbers are in host byte order (i.e., 2186# little-endian on x86). 2187# 2188# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 2189# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 2190# schemes for distinguishing between executable images, shared libraries, 2191# and object files. 2192# 2193# FreeBSD says: 2194# 2195# Regardless of whether it's pure, demand-paged, or none of the 2196# above: 2197# 2198# if the entry point is < 4096, then it's a shared library if 2199# the "has run-time loader information" bit is set, and is 2200# position-independent if the "is position-independent" bit 2201# is set; 2202# 2203# if the entry point is >= 4096 (or >4095, same thing), then it's 2204# an executable, and is dynamically-linked if the "has run-time 2205# loader information" bit is set. 2206# 2207# On x86, NetBSD says: 2208# 2209# If it's neither pure nor demand-paged: 2210# 2211# if it has the "has run-time loader information" bit set, it's 2212# a dynamically-linked executable; 2213# 2214# if it doesn't have that bit set, then: 2215# 2216# if it has the "is position-independent" bit set, it's 2217# position-independent; 2218# 2219# if the entry point is non-zero, it's an executable, otherwise 2220# it's an object file. 2221# 2222# If it's pure: 2223# 2224# if it has the "has run-time loader information" bit set, it's 2225# a dynamically-linked executable, otherwise it's just an 2226# executable. 2227# 2228# If it's demand-paged: 2229# 2230# if it has the "has run-time loader information" bit set, 2231# then: 2232# 2233# if the entry point is < 4096, it's a shared library; 2234# 2235# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 2236# it's a dynamically-linked executable); 2237# 2238# if it doesn't have the "has run-time loader information" bit 2239# set, then it's just an executable. 2240# 2241# (On non-x86, NetBSD does much the same thing, except that it uses 2242# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 2243# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 2244# had 8K pages; dunno about MIPS.) 2245# 2246# I suspect the two will differ only in perverse and uninteresting cases 2247# ("shared" libraries that aren't demand-paged and whose pages probably 2248# won't actually be shared, executables with entry points <4096). 2249# 2250# I leave it to those more familiar with FreeBSD and NetBSD to figure out 2251# what the right answer is (although using ">4095", FreeBSD-style, is 2252# probably better than separately checking for "=4096" and ">4096", 2253# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 2254# executables using the NetBSD technique.) 2255# 22560 lelong&0377777777 041400407 FreeBSD/i386 2257>20 lelong <4096 2258>>3 byte&0xC0 &0x80 shared library 2259>>3 byte&0xC0 0x40 PIC object 2260>>3 byte&0xC0 0x00 object 2261>20 lelong >4095 2262>>3 byte&0x80 0x80 dynamically linked executable 2263>>3 byte&0x80 0x00 executable 2264>16 lelong >0 not stripped 2265 22660 lelong&0377777777 041400410 FreeBSD/i386 pure 2267>20 lelong <4096 2268>>3 byte&0xC0 &0x80 shared library 2269>>3 byte&0xC0 0x40 PIC object 2270>>3 byte&0xC0 0x00 object 2271>20 lelong >4095 2272>>3 byte&0x80 0x80 dynamically linked executable 2273>>3 byte&0x80 0x00 executable 2274>16 lelong >0 not stripped 2275 22760 lelong&0377777777 041400413 FreeBSD/i386 demand paged 2277>20 lelong <4096 2278>>3 byte&0xC0 &0x80 shared library 2279>>3 byte&0xC0 0x40 PIC object 2280>>3 byte&0xC0 0x00 object 2281>20 lelong >4095 2282>>3 byte&0x80 0x80 dynamically linked executable 2283>>3 byte&0x80 0x00 executable 2284>16 lelong >0 not stripped 2285 22860 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 2287>20 lelong <4096 2288>>3 byte&0xC0 &0x80 shared library 2289>>3 byte&0xC0 0x40 PIC object 2290>>3 byte&0xC0 0x00 object 2291>20 lelong >4095 2292>>3 byte&0x80 0x80 dynamically linked executable 2293>>3 byte&0x80 0x00 executable 2294>16 lelong >0 not stripped 2295 2296# XXX gross hack to identify core files 2297# cores start with a struct tss; we take advantage of the following: 2298# byte 7: highest byte of the kernel stack pointer, always 0xfe 2299# 8/9: kernel (ring 0) ss value, always 0x0010 2300# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 2301# 28: low order byte of the current PTD entry, always 0 since the 2302# PTD is page-aligned 2303# 23047 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 2305>1039 string >\0 from '%s' 2306 2307# /var/run/ld.so.hints 2308# What are you laughing about? 23090 lelong 011421044151 ld.so hints file (Little Endian 2310>4 lelong >0 \b, version %d) 2311>4 belong <=0 \b) 23120 belong 011421044151 ld.so hints file (Big Endian 2313>4 belong >0 \b, version %d) 2314>4 belong <=0 \b) 2315 2316# 2317# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 2318# 23190 string SCRSHOT_ scrshot(1) screenshot, 2320>8 byte x version %d, 2321>9 byte 2 %d bytes in header, 2322>>10 byte x %d chars wide by 2323>>11 byte x %d chars high 2324 2325#------------------------------------------------------------------------------ 2326# fsav: file(1) magic for datafellows fsav virus definition files 2327# Anthon van der Neut (anthon@mnt.org) 23280 beshort 0x1575 fsav (linux) macro virus 2329>8 leshort >0 (%d- 2330>11 byte >0 \b%02d- 2331>10 byte >0 \b%02d) 2332 2333# comment this out for now because it regognizes every file where 2334# the eighth character is \n 2335#8 byte 0x0a 2336#>12 byte 0x07 2337#>11 leshort >0 fsav (linux) virus (%d- 2338#>10 byte 0 \b01- 2339#>10 byte 1 \b02- 2340#>10 byte 2 \b03- 2341#>10 byte 3 \b04- 2342#>10 byte 4 \b05- 2343#>10 byte 5 \b06- 2344#>10 byte 6 \b07- 2345#>10 byte 7 \b08- 2346#>10 byte 8 \b08- 2347#>10 byte 9 \b10- 2348#>10 byte 10 \b11- 2349#>10 byte 11 \b12- 2350#>9 byte >0 \b%02d) 2351#------------------------------------------------------------------------------ 2352# GIMP Gradient: file(1) magic for the GIMP's gradient data files 2353# by Federico Mena <federico@nuclecu.unam.mx> 2354 23550 string GIMP\ Gradient GIMP gradient data 2356 2357#------------------------------------------------------------------------------ 2358# XCF: file(1) magic for the XCF image format used in the GIMP developed 2359# by Spencer Kimball and Peter Mattis 2360# ('Bucky' LaDieu, nega@vt.edu) 2361 23620 string gimp\ xcf GIMP XCF image data, 2363>9 string file version 0, 2364>9 string v version 2365>>10 string >\0 %s, 2366>14 belong x %lu x 2367>18 belong x %lu, 2368>22 belong 0 RGB Color 2369>22 belong 1 Greyscale 2370>22 belong 2 Indexed Color 2371>22 belong >2 Unknown Image Type. 2372 2373#------------------------------------------------------------------------------ 2374# XCF: file(1) magic for the patterns used in the GIMP, developed 2375# by Spencer Kimball and Peter Mattis 2376# ('Bucky' LaDieu, nega@vt.edu) 2377 237820 string GPAT GIMP pattern data, 2379>24 string x %s 2380 2381#------------------------------------------------------------------------------ 2382# XCF: file(1) magic for the brushes used in the GIMP, developed 2383# by Spencer Kimball and Peter Mattis 2384# ('Bucky' LaDieu, nega@vt.edu) 2385 238620 string GIMP GIMP brush data 2387# 2388# GNU nlsutils message catalog file format 2389# 23900 string \336\22\4\225 GNU message catalog (little endian), 2391>4 lelong x revision %d, 2392>8 lelong x %d messages 23930 string \225\4\22\336 GNU message catalog (big endian), 2394>4 belong x revision %d, 2395>8 belong x %d messages 2396# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 23970 string *nazgul* Nazgul style compiled message catalog 2398>8 lelong >0 \b, version %ld 2399 2400#------------------------------------------------------------------------------ 2401# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 2402# 2403# ACE/gr binary 24040 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 2405>39 byte >0 - version %c 2406# ACE/gr ascii 24070 string #\ xvgr\ parameter\ file ACE/gr ascii file 24080 string #\ xmgr\ parameter\ file ACE/gr ascii file 24090 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 2410# Grace projects 24110 string #\ Grace\ project\ file Grace project file 2412>23 string @version\ (version 2413>>32 byte >0 %c 2414>>33 string >\0 \b.%.2s 2415>>35 string >\0 \b.%.2s) 2416# ACE/gr fit description files 24170 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 2418# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 2419 2420#------------------------------------------------------------------------------ 2421# hp: file(1) magic for Hewlett Packard machines (see also "printer") 2422# 2423# XXX - somebody should figure out whether any byte order needs to be 2424# applied to the "TML" stuff; I'm assuming the Apollo stuff is 2425# big-endian as it was mostly 68K-based. 2426# 2427# I think the 500 series was the old stack-based machines, running a 2428# UNIX environment atop the "SUN kernel"; dunno whether it was 2429# big-endian or little-endian. 2430# 2431# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 2432# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 2433# HP magic is useful for reference, but using "long" magic is a better 2434# practice in order to avoid collisions. 2435# 2436# Guy Harris (guy@netapp.com): some additions to this list came from 2437# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 2438# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 2439# "/etc/magic", though, except for the "archive file relocatable library" 2440# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 2441# used in executables, or have they just not yet updated "/etc/magic" 2442# completely? 2443# 2444# 0 beshort 200 hp200 (68010) BSD binary 2445# 0 beshort 300 hp300 (68020+68881) BSD binary 2446# 0 beshort 0x20c hp200/300 HP-UX binary 2447# 0 beshort 0x20d hp400 (68030) HP-UX binary 2448# 0 beshort 0x20e hp400 (68040?) HP-UX binary 2449# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 2450# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 2451# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 2452# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 2453 2454# 2455# The "misc" stuff needs a byte order; the archives look suspiciously 2456# like the old 177545 archives (0xff65 = 0177545). 2457# 2458#### Old Apollo stuff 24590 beshort 0627 Apollo m68k COFF executable 2460>18 beshort ^040000 not stripped 2461>22 beshort >0 - version %ld 24620 beshort 0624 apollo a88k COFF executable 2463>18 beshort ^040000 not stripped 2464>22 beshort >0 - version %ld 24650 long 01203604016 TML 0123 byte-order format 24660 long 01702407010 TML 1032 byte-order format 24670 long 01003405017 TML 2301 byte-order format 24680 long 01602007412 TML 3210 byte-order format 2469#### PA-RISC 1.1 24700 belong 0x02100106 PA-RISC1.1 relocatable object 24710 belong 0x02100107 PA-RISC1.1 executable 2472>168 belong &0x00000004 dynamically linked 2473>(144) belong 0x054ef630 dynamically linked 2474>96 belong >0 - not stripped 2475 24760 belong 0x02100108 PA-RISC1.1 shared executable 2477>168 belong&0x4 0x4 dynamically linked 2478>(144) belong 0x054ef630 dynamically linked 2479>96 belong >0 - not stripped 2480 24810 belong 0x0210010b PA-RISC1.1 demand-load executable 2482>168 belong&0x4 0x4 dynamically linked 2483>(144) belong 0x054ef630 dynamically linked 2484>96 belong >0 - not stripped 2485 24860 belong 0x0210010e PA-RISC1.1 shared library 2487>96 belong >0 - not stripped 2488 24890 belong 0x0210010d PA-RISC1.1 dynamic load library 2490>96 belong >0 - not stripped 2491 2492#### PA-RISC 2.0 24930 belong 0x02140106 PA-RISC2.0 relocatable object 2494 24950 belong 0x02140107 PA-RISC2.0 executable 2496>168 belong &0x00000004 dynamically linked 2497>(144) belong 0x054ef630 dynamically linked 2498>96 belong >0 - not stripped 2499 25000 belong 0x02140108 PA-RISC2.0 shared executable 2501>168 belong &0x00000004 dynamically linked 2502>(144) belong 0x054ef630 dynamically linked 2503>96 belong >0 - not stripped 2504 25050 belong 0x0214010b PA-RISC2.0 demand-load executable 2506>168 belong &0x00000004 dynamically linked 2507>(144) belong 0x054ef630 dynamically linked 2508>96 belong >0 - not stripped 2509 25100 belong 0x0214010e PA-RISC2.0 shared library 2511>96 belong >0 - not stripped 2512 25130 belong 0x0214010d PA-RISC2.0 dynamic load library 2514>96 belong >0 - not stripped 2515 2516#### 800 25170 belong 0x020b0106 PA-RISC1.0 relocatable object 2518 25190 belong 0x020b0107 PA-RISC1.0 executable 2520>168 belong&0x4 0x4 dynamically linked 2521>(144) belong 0x054ef630 dynamically linked 2522>96 belong >0 - not stripped 2523 25240 belong 0x020b0108 PA-RISC1.0 shared executable 2525>168 belong&0x4 0x4 dynamically linked 2526>(144) belong 0x054ef630 dynamically linked 2527>96 belong >0 - not stripped 2528 25290 belong 0x020b010b PA-RISC1.0 demand-load executable 2530>168 belong&0x4 0x4 dynamically linked 2531>(144) belong 0x054ef630 dynamically linked 2532>96 belong >0 - not stripped 2533 25340 belong 0x020b010e PA-RISC1.0 shared library 2535>96 belong >0 - not stripped 2536 25370 belong 0x020b010d PA-RISC1.0 dynamic load library 2538>96 belong >0 - not stripped 2539 25400 belong 0x213c6172 archive file 2541>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 2542>68 belong 0x02100619 - PA-RISC1.1 relocatable library 2543>68 belong 0x02110619 - PA-RISC1.2 relocatable library 2544>68 belong 0x02140619 - PA-RISC2.0 relocatable library 2545 2546#### 500 25470 long 0x02080106 HP s500 relocatable executable 2548>16 long >0 - version %ld 2549 25500 long 0x02080107 HP s500 executable 2551>16 long >0 - version %ld 2552 25530 long 0x02080108 HP s500 pure executable 2554>16 long >0 - version %ld 2555 2556#### 200 25570 belong 0x020c0108 HP s200 pure executable 2558>4 beshort >0 - version %ld 2559>8 belong &0x80000000 save fp regs 2560>8 belong &0x40000000 dynamically linked 2561>8 belong &0x20000000 debuggable 2562>36 belong >0 not stripped 2563 25640 belong 0x020c0107 HP s200 executable 2565>4 beshort >0 - version %ld 2566>8 belong &0x80000000 save fp regs 2567>8 belong &0x40000000 dynamically linked 2568>8 belong &0x20000000 debuggable 2569>36 belong >0 not stripped 2570 25710 belong 0x020c010b HP s200 demand-load executable 2572>4 beshort >0 - version %ld 2573>8 belong &0x80000000 save fp regs 2574>8 belong &0x40000000 dynamically linked 2575>8 belong &0x20000000 debuggable 2576>36 belong >0 not stripped 2577 25780 belong 0x020c0106 HP s200 relocatable executable 2579>4 beshort >0 - version %ld 2580>6 beshort >0 - highwater %d 2581>8 belong &0x80000000 save fp regs 2582>8 belong &0x20000000 debuggable 2583>8 belong &0x10000000 PIC 2584 25850 belong 0x020a0108 HP s200 (2.x release) pure executable 2586>4 beshort >0 - version %ld 2587>36 belong >0 not stripped 2588 25890 belong 0x020a0107 HP s200 (2.x release) executable 2590>4 beshort >0 - version %ld 2591>36 belong >0 not stripped 2592 25930 belong 0x020c010e HP s200 shared library 2594>4 beshort >0 - version %ld 2595>6 beshort >0 - highwater %d 2596>36 belong >0 not stripped 2597 25980 belong 0x020c010d HP s200 dynamic load library 2599>4 beshort >0 - version %ld 2600>6 beshort >0 - highwater %d 2601>36 belong >0 not stripped 2602 2603#### MISC 26040 long 0x0000ff65 HP old archive 26050 long 0x020aff65 HP s200 old archive 26060 long 0x020cff65 HP s200 old archive 26070 long 0x0208ff65 HP s500 old archive 2608 26090 long 0x015821a6 HP core file 2610 26110 long 0x4da7eee8 HP-WINDOWS font 2612>8 byte >0 - version %ld 26130 string Bitmapfile HP Bitmapfile 2614 26150 string IMGfile CIS compimg HP Bitmapfile 2616# XXX - see "lif" 2617#0 short 0x8000 lif file 26180 long 0x020c010c compiled Lisp 2619 26200 string msgcat01 HP NLS message catalog, 2621>8 long >0 %d messages 2622 2623# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 26240 string HPHP48- HP48 binary 2625>7 byte >0 - Rev %c 2626>8 beshort 0x1129 (ADR) 2627>8 beshort 0x3329 (REAL) 2628>8 beshort 0x5529 (LREAL) 2629>8 beshort 0x7729 (COMPLX) 2630>8 beshort 0x9d29 (LCOMPLX) 2631>8 beshort 0xbf29 (CHAR) 2632>8 beshort 0xe829 (ARRAY) 2633>8 beshort 0x0a2a (LNKARRAY) 2634>8 beshort 0x2c2a (STRING) 2635>8 beshort 0x4e2a (HXS) 2636>8 beshort 0x742a (LIST) 2637>8 beshort 0x962a (DIR) 2638>8 beshort 0xb82a (ALG) 2639>8 beshort 0xda2a (UNIT) 2640>8 beshort 0xfc2a (TAGGED) 2641>8 beshort 0x1e2b (GROB) 2642>8 beshort 0x402b (LIB) 2643>8 beshort 0x622b (BACKUP) 2644>8 beshort 0x882b (LIBDATA) 2645>8 beshort 0x9d2d (PROG) 2646>8 beshort 0xcc2d (CODE) 2647>8 beshort 0x482e (GNAME) 2648>8 beshort 0x6d2e (LNAME) 2649>8 beshort 0x922e (XLIB) 26500 string %%HP: HP48 text 2651>6 string T(0) - T(0) 2652>6 string T(1) - T(1) 2653>6 string T(2) - T(2) 2654>6 string T(3) - T(3) 2655>10 string A(D) A(D) 2656>10 string A(R) A(R) 2657>10 string A(G) A(G) 2658>14 string F(.) F(.); 2659>14 string F(,) F(,); 2660 2661# hpBSD magic numbers 26620 beshort 200 hp200 (68010) BSD 2663>2 beshort 0407 impure binary 2664>2 beshort 0410 read-only binary 2665>2 beshort 0413 demand paged binary 26660 beshort 300 hp300 (68020+68881) BSD 2667>2 beshort 0407 impure binary 2668>2 beshort 0410 read-only binary 2669>2 beshort 0413 demand paged binary 2670# 2671# From David Gero <dgero@nortelnetworks.com> 2672# HP-UX 10.20 core file format from /usr/include/sys/core.h 2673# Unfortunately, HP-UX uses corehead blocks without specifying the order 2674# There are four we care about: 2675# CORE_KERNEL, which starts with the string "HP-UX" 2676# CORE_EXEC, which contains the name of the command 2677# CORE_PROC, which contains the signal number that caused the core dump 2678# CORE_FORMAT, which contains the version of the core file format (== 1) 2679# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 2680# but we include all 6 variations of the order of the first 3, and 2681# assume that PROC will always be last 2682# Order 1: KERNEL, EXEC, FORMAT, PROC 26830x10 string HP-UX 2684>0 belong 2 2685>>0xC belong 0x3C 2686>>>0x4C belong 0x100 2687>>>>0x58 belong 0x44 2688>>>>>0xA0 belong 1 2689>>>>>>0xAC belong 4 2690>>>>>>>0xB0 belong 1 2691>>>>>>>>0xB4 belong 4 core file 2692>>>>>>>>>0x90 string >\0 from '%s' 2693>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2694>>>>>>>>>0xC4 belong 4 - received SIGILL 2695>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2696>>>>>>>>>0xC4 belong 6 - received SIGABRT 2697>>>>>>>>>0xC4 belong 7 - received SIGEMT 2698>>>>>>>>>0xC4 belong 8 - received SIGFPE 2699>>>>>>>>>0xC4 belong 10 - received SIGBUS 2700>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2701>>>>>>>>>0xC4 belong 12 - received SIGSYS 2702>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2703>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2704# Order 2: KERNEL, FORMAT, EXEC, PROC 2705>>>0x4C belong 1 2706>>>>0x58 belong 4 2707>>>>>0x5C belong 1 2708>>>>>>0x60 belong 0x100 2709>>>>>>>0x6C belong 0x44 2710>>>>>>>>0xB4 belong 4 core file 2711>>>>>>>>>0xA4 string >\0 from '%s' 2712>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2713>>>>>>>>>0xC4 belong 4 - received SIGILL 2714>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2715>>>>>>>>>0xC4 belong 6 - received SIGABRT 2716>>>>>>>>>0xC4 belong 7 - received SIGEMT 2717>>>>>>>>>0xC4 belong 8 - received SIGFPE 2718>>>>>>>>>0xC4 belong 10 - received SIGBUS 2719>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2720>>>>>>>>>0xC4 belong 12 - received SIGSYS 2721>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2722>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2723# Order 3: FORMAT, KERNEL, EXEC, PROC 27240x24 string HP-UX 2725>0 belong 1 2726>>0xC belong 4 2727>>>0x10 belong 1 2728>>>>0x14 belong 2 2729>>>>>0x20 belong 0x3C 2730>>>>>>0x60 belong 0x100 2731>>>>>>>0x6C belong 0x44 2732>>>>>>>>0xB4 belong 4 core file 2733>>>>>>>>>0xA4 string >\0 from '%s' 2734>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2735>>>>>>>>>0xC4 belong 4 - received SIGILL 2736>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2737>>>>>>>>>0xC4 belong 6 - received SIGABRT 2738>>>>>>>>>0xC4 belong 7 - received SIGEMT 2739>>>>>>>>>0xC4 belong 8 - received SIGFPE 2740>>>>>>>>>0xC4 belong 10 - received SIGBUS 2741>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2742>>>>>>>>>0xC4 belong 12 - received SIGSYS 2743>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2744>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2745# Order 4: EXEC, KERNEL, FORMAT, PROC 27460x64 string HP-UX 2747>0 belong 0x100 2748>>0xC belong 0x44 2749>>>0x54 belong 2 2750>>>>0x60 belong 0x3C 2751>>>>>0xA0 belong 1 2752>>>>>>0xAC belong 4 2753>>>>>>>0xB0 belong 1 2754>>>>>>>>0xB4 belong 4 core file 2755>>>>>>>>>0x44 string >\0 from '%s' 2756>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2757>>>>>>>>>0xC4 belong 4 - received SIGILL 2758>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2759>>>>>>>>>0xC4 belong 6 - received SIGABRT 2760>>>>>>>>>0xC4 belong 7 - received SIGEMT 2761>>>>>>>>>0xC4 belong 8 - received SIGFPE 2762>>>>>>>>>0xC4 belong 10 - received SIGBUS 2763>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2764>>>>>>>>>0xC4 belong 12 - received SIGSYS 2765>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2766>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2767# Order 5: FORMAT, EXEC, KERNEL, PROC 27680x78 string HP-UX 2769>0 belong 1 2770>>0xC belong 4 2771>>>0x10 belong 1 2772>>>>0x14 belong 0x100 2773>>>>>0x20 belong 0x44 2774>>>>>>0x68 belong 2 2775>>>>>>>0x74 belong 0x3C 2776>>>>>>>>0xB4 belong 4 core file 2777>>>>>>>>>0x58 string >\0 from '%s' 2778>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2779>>>>>>>>>0xC4 belong 4 - received SIGILL 2780>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2781>>>>>>>>>0xC4 belong 6 - received SIGABRT 2782>>>>>>>>>0xC4 belong 7 - received SIGEMT 2783>>>>>>>>>0xC4 belong 8 - received SIGFPE 2784>>>>>>>>>0xC4 belong 10 - received SIGBUS 2785>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2786>>>>>>>>>0xC4 belong 12 - received SIGSYS 2787>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2788>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2789# Order 6: EXEC, FORMAT, KERNEL, PROC 2790>0 belong 0x100 2791>>0xC belong 0x44 2792>>>0x54 belong 1 2793>>>>0x60 belong 4 2794>>>>>0x64 belong 1 2795>>>>>>0x68 belong 2 2796>>>>>>>0x74 belong 0x2C 2797>>>>>>>>0xB4 belong 4 core file 2798>>>>>>>>>0x44 string >\0 from '%s' 2799>>>>>>>>>0xC4 belong 3 - received SIGQUIT 2800>>>>>>>>>0xC4 belong 4 - received SIGILL 2801>>>>>>>>>0xC4 belong 5 - received SIGTRAP 2802>>>>>>>>>0xC4 belong 6 - received SIGABRT 2803>>>>>>>>>0xC4 belong 7 - received SIGEMT 2804>>>>>>>>>0xC4 belong 8 - received SIGFPE 2805>>>>>>>>>0xC4 belong 10 - received SIGBUS 2806>>>>>>>>>0xC4 belong 11 - received SIGSEGV 2807>>>>>>>>>0xC4 belong 12 - received SIGSYS 2808>>>>>>>>>0xC4 belong 33 - received SIGXCPU 2809>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 2810 2811#------------------------------------------------------------------------------ 2812# ibm370: file(1) magic for IBM 370 and compatibles. 2813# 2814# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 2815# What the heck *is* "USS/370"? 2816# AIX 4.1's "/etc/magic" has 2817# 2818# 0 short 0535 370 sysV executable 2819# >12 long >0 not stripped 2820# >22 short >0 - version %d 2821# >30 long >0 - 5.2 format 2822# 0 short 0530 370 sysV pure executable 2823# >12 long >0 not stripped 2824# >22 short >0 - version %d 2825# >30 long >0 - 5.2 format 2826# 2827# instead of the "USS/370" versions of the same magic numbers. 2828# 28290 beshort 0537 370 XA sysV executable 2830>12 belong >0 not stripped 2831>22 beshort >0 - version %d 2832>30 belong >0 - 5.2 format 28330 beshort 0532 370 XA sysV pure executable 2834>12 belong >0 not stripped 2835>22 beshort >0 - version %d 2836>30 belong >0 - 5.2 format 28370 beshort 054001 370 sysV pure executable 2838>12 belong >0 not stripped 28390 beshort 055001 370 XA sysV pure executable 2840>12 belong >0 not stripped 28410 beshort 056401 370 sysV executable 2842>12 belong >0 not stripped 28430 beshort 057401 370 XA sysV executable 2844>12 belong >0 not stripped 28450 beshort 0531 SVR2 executable (Amdahl-UTS) 2846>12 belong >0 not stripped 2847>24 belong >0 - version %ld 28480 beshort 0534 SVR2 pure executable (Amdahl-UTS) 2849>12 belong >0 not stripped 2850>24 belong >0 - version %ld 28510 beshort 0530 SVR2 pure executable (USS/370) 2852>12 belong >0 not stripped 2853>24 belong >0 - version %ld 28540 beshort 0535 SVR2 executable (USS/370) 2855>12 belong >0 not stripped 2856>24 belong >0 - version %ld 2857 2858#------------------------------------------------------------------------------ 2859# ibm6000: file(1) magic for RS/6000 and the RT PC. 2860# 28610 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 2862>12 belong >0 not stripped 2863# Breaks sun4 statically linked execs. 2864#0 beshort 0x0103 executable (RT Version 2) or obj module 2865#>2 byte 0x50 pure 2866#>28 belong >0 not stripped 2867#>6 beshort >0 - version %ld 28680 beshort 0x0104 shared library 28690 beshort 0x0105 ctab data 28700 beshort 0xfe04 structured file 28710 string 0xabcdef AIX message catalog 28720 belong 0x000001f9 AIX compiled message catalog 28730 string \<aiaff> archive 2874 2875#------------------------------------------------------------------------------ 2876# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 2877# 2878# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 2879# Arts for file interchange. It has also been used by Apple, SGI, and 2880# especially Commodore-Amiga. 2881# 2882# IFF files begin with an 8 byte FORM header, followed by a 4 character 2883# FORM type, which is followed by the first chunk in the FORM. 2884 28850 string FORM IFF data 2886#>4 belong x \b, FORM is %d bytes long 2887# audio formats 2888>8 string AIFF \b, AIFF audio 2889>8 string AIFC \b, AIFF-C compressed audio 2890>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 2891>8 string SAMP \b, SAMP sampled audio 2892# image formats 2893>8 string ILBMBMHD \b, ILBM interleaved image 2894>>20 beshort x \b, %d x 2895>>22 beshort x %d 2896>8 string RGBN \b, RGBN 12-bit RGB image 2897>8 string RGB8 \b, RGB8 24-bit RGB image 2898>8 string DR2D \b, DR2D 2-D object 2899>8 string TDDD \b, TDDD 3-D rendering 2900# other formats 2901>8 string FTXT \b, FTXT formatted text 2902 2903#------------------------------------------------------------------------------ 2904# images: file(1) magic for image formats (see also "iff") 2905# 2906# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 2907# additions by janl@ifi.uio.no as well as others. Jan also suggested 2908# merging several one- and two-line files into here. 2909# 2910# little magic: PCX (first byte is 0x0a) 2911 2912# Targa - matches `povray', `ppmtotga' and `xv' outputs 2913# by Philippe De Muyter <phdm@macqel.be> 2914# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 2915# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 2916# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 2917# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 2918# `tgatoppm' recognizes a superset (Index may be anything) 29191 belong&0xfff7ffff 0x01010000 Targa image data - Map 2920>2 byte&8 8 - RLE 29211 belong&0xfff7ffff 0x00020000 Targa image data - RGB 2922>2 byte&8 8 - RLE 29231 belong&0xfff7ffff 0x00030000 Targa image data - Mono 2924>2 byte&8 8 - RLE 2925 2926# PBMPLUS images 2927# The next byte following the magic is always whitespace. 29280 string P1 Netpbm PBM image text 29290 string P2 Netpbm PGM image text 29300 string P3 Netpbm PPM image text 29310 string P4 Netpbm PBM "rawbits" image data 29320 string P5 Netpbm PGM "rawbits" image data 29330 string P6 Netpbm PPM "rawbits" image data 29340 string P7 Netpbm PAM image file 2935 2936# From: bryanh@giraffe-data.com (Bryan Henderson) 29370 string \117\072 Solitaire Image Recorder format 2938>4 string \013 MGI Type 11 2939>4 string \021 MGI Type 17 29400 string .MDA MicroDesign data 2941>21 byte 48 version 2 2942>21 byte 51 version 3 29430 string .MDP MicroDesign page data 2944>21 byte 48 version 2 2945>21 byte 51 version 3 2946 2947# NIFF (Navy Interchange File Format, a modification of TIFF) images 29480 string IIN1 NIFF image data 2949 2950# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 2951# The second word of TIFF files is the TIFF version number, 42, which has 2952# never changed. The TIFF specification recommends testing for it. 29530 string MM\x00\x2a TIFF image data, big-endian 29540 string II\x2a\x00 TIFF image data, little-endian 2955 2956# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 2957# (Greg Roelofs, newt@uchicago.edu) 2958# (Albert Cahalan, acahalan@cs.uml.edu) 2959# 2960# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 2961# 29620 string \x89PNG PNG image data, 2963>4 belong !0x0d0a1a0a CORRUPTED, 2964>4 belong 0x0d0a1a0a 2965>>16 belong x %ld x 2966>>20 belong x %ld, 2967>>24 byte x %d-bit 2968>>25 byte 0 grayscale, 2969>>25 byte 2 \b/color RGB, 2970>>25 byte 3 colormap, 2971>>25 byte 4 gray+alpha, 2972>>25 byte 6 \b/color RGBA, 2973#>>26 byte 0 deflate/32K, 2974>>28 byte 0 non-interlaced 2975>>28 byte 1 interlaced 29761 string PNG PNG image data, CORRUPTED 2977 2978# GIF 29790 string GIF8 GIF image data 2980>4 string 7a \b, version 8%s, 2981>4 string 9a \b, version 8%s, 2982>6 leshort >0 %hd x 2983>8 leshort >0 %hd, 2984#>10 byte &0x80 color mapped, 2985#>10 byte&0x07 =0x00 2 colors 2986#>10 byte&0x07 =0x01 4 colors 2987#>10 byte&0x07 =0x02 8 colors 2988#>10 byte&0x07 =0x03 16 colors 2989#>10 byte&0x07 =0x04 32 colors 2990#>10 byte&0x07 =0x05 64 colors 2991#>10 byte&0x07 =0x06 128 colors 2992#>10 byte&0x07 =0x07 256 colors 2993 2994# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 2995# 1 plane, no encoding. 29960 string \361\0\100\273 CMU window manager raster image data 2997>4 lelong >0 %d x 2998>8 lelong >0 %d, 2999>12 lelong >0 %d-bit 3000 3001# Magick Image File Format 30020 string id=ImageMagick MIFF image data 3003 3004# Artisan 30050 long 1123028772 Artisan image data 3006>4 long 1 \b, rectangular 24-bit 3007>4 long 2 \b, rectangular 8-bit with colormap 3008>4 long 3 \b, rectangular 32-bit (24-bit with matte) 3009 3010# FIG (Facility for Interactive Generation of figures), an object-based format 30110 string #FIG FIG image text 3012>5 string x \b, version %.3s 3013 3014# PHIGS 30150 string ARF_BEGARF PHIGS clear text archive 30160 string @(#)SunPHIGS SunPHIGS 3017# version number follows, in the form m.n 3018>40 string SunBin binary 3019>32 string archive archive 3020 3021# GKS (Graphics Kernel System) 30220 string GKSM GKS Metafile 3023>24 string SunGKS \b, SunGKS 3024 3025# CGM image files 30260 string BEGMF clear text Computer Graphics Metafile 3027# XXX - questionable magic 30280 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 30290 beshort 0x3020 character Computer Graphics Metafile 3030 3031# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 30320 string yz MGR bitmap, modern format, 8-bit aligned 30330 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 30340 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 30350 string yx MGR bitmap, modern format, squeezed 3036 3037# Fuzzy Bitmap (FBM) images 30380 string %bitmap\0 FBM image data 3039>30 long 0x31 \b, mono 3040>30 long 0x33 \b, color 3041 3042# facsimile data 30431 string PC\ Research,\ Inc group 3 fax data 3044>29 byte 0 \b, normal resolution (204x98 DPI) 3045>29 byte 1 \b, fine resolution (204x196 DPI) 3046 3047# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) 30480 string BM PC bitmap data 3049>14 leshort 12 \b, OS/2 1.x format 3050>>18 leshort x \b, %d x 3051>>20 leshort x %d 3052>14 leshort 64 \b, OS/2 2.x format 3053>>18 leshort x \b, %d x 3054>>20 leshort x %d 3055>14 leshort 40 \b, Windows 3.x format 3056>>18 lelong x \b, %d x 3057>>22 lelong x %d x 3058>>28 leshort x %d 30590 string IC PC icon data 30600 string PI PC pointer image data 30610 string CI PC color icon data 30620 string CP PC color pointer image data 3063# Conflicts with other entries [BABYL] 3064#0 string BA PC bitmap array data 3065 3066# XPM icons (Greg Roelofs, newt@uchicago.edu) 3067# note possible collision with C/REXX entry in c-lang; currently commented out 30680 string /*\ XPM\ */ X pixmap image text 3069 3070# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 30710 leshort 0xcc52 RLE image data, 3072>6 leshort x %d x 3073>8 leshort x %d 3074>2 leshort >0 \b, lower left corner: %d 3075>4 leshort >0 \b, lower right corner: %d 3076>10 byte&0x1 =0x1 \b, clear first 3077>10 byte&0x2 =0x2 \b, no background 3078>10 byte&0x4 =0x4 \b, alpha channel 3079>10 byte&0x8 =0x8 \b, comment 3080>11 byte >0 \b, %d color channels 3081>12 byte >0 \b, %d bits per pixel 3082>13 byte >0 \b, %d color map channels 3083 3084# image file format (Robert Potter, potter@cs.rochester.edu) 30850 string Imagefile\ version- iff image data 3086# this adds the whole header (inc. version number), informative but longish 3087>10 string >\0 %s 3088 3089# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 30900 belong 0x59a66a95 Sun raster image data 3091>4 belong >0 \b, %d x 3092>8 belong >0 %d, 3093>12 belong >0 %d-bit, 3094#>16 belong >0 %d bytes long, 3095>20 belong 0 old format, 3096#>20 belong 1 standard, 3097>20 belong 2 compressed, 3098>20 belong 3 RGB, 3099>20 belong 4 TIFF, 3100>20 belong 5 IFF, 3101>20 belong 0xffff reserved for testing, 3102>24 belong 0 no colormap 3103>24 belong 1 RGB colormap 3104>24 belong 2 raw colormap 3105#>28 belong >0 colormap is %d bytes long 3106 3107# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 3108# 3109# See 3110# http://reality.sgi.com/grafica/sgiimage.html 3111# 31120 beshort 474 SGI image data 3113#>2 byte 0 \b, verbatim 3114>2 byte 1 \b, RLE 3115#>3 byte 1 \b, normal precision 3116>3 byte 2 \b, high precision 3117>4 beshort x \b, %d-D 3118>6 beshort x \b, %d x 3119>8 beshort x %d 3120>10 beshort x \b, %d channel 3121>10 beshort !1 \bs 3122>80 string >0 \b, "%s" 3123 31240 string IT01 FIT image data 3125>4 belong x \b, %d x 3126>8 belong x %d x 3127>12 belong x %d 3128# 31290 string IT02 FIT image data 3130>4 belong x \b, %d x 3131>8 belong x %d x 3132>12 belong x %d 3133# 31342048 string PCD_IPI Kodak Photo CD image pack file 3135>0xe02 byte&0x03 0x00 , landscape mode 3136>0xe02 byte&0x03 0x01 , portrait mode 3137>0xe02 byte&0x03 0x02 , landscape mode 3138>0xe02 byte&0x03 0x03 , portrait mode 31390 string PCD_OPA Kodak Photo CD overview pack file 3140 3141# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 3142# FITS is the Flexible Image Transport System, the de facto standard for 3143# data and image transfer, storage, etc., for the astronomical community. 3144# (FITS floating point formats are big-endian.) 31450 string SIMPLE\ \ = FITS image data 3146>109 string 8 \b, 8-bit, character or unsigned binary integer 3147>108 string 16 \b, 16-bit, two's complement binary integer 3148>107 string \ 32 \b, 32-bit, two's complement binary integer 3149>107 string -32 \b, 32-bit, floating point, single precision 3150>107 string -64 \b, 64-bit, floating point, double precision 3151 3152# other images 31530 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 31540 string !! Bennet Yee's "face" format 3155 3156# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 3157# stuff. 3158# 31590 beshort 0x1010 PEX Binary Archive 3160 3161# Visio drawings 316203000 string Visio\ (TM)\ Drawing %s 3163 3164# Tgif files 31650 string \%TGIF\ x Tgif file version %s 3166 3167# DICOM medical imaging data 3168128 string DICM DICOM medical imaging data 3169 3170# XWD - X-Windows Dump file. 3171# As described in /usr/X11R6/include/X11/XWDFile.h 3172# used by the xwd program. 3173# Bradford Castalia, idaeim, 1/01 31744 belong 7 XWD X-Windows Dump image data 3175>100 string >\0 \b, "%s" 3176>16 belong x \b, %dx 3177>20 belong x \b%dx 3178>12 belong x \b%d 3179 3180# PDS - Planetary Data System 3181# These files use Parameter Value Language in the header section. 3182# Unfortunately, there is no certain magic, but the following 3183# strings have been found to be most likely. 31840 string NJPL1I00 PDS (JPL) image data 31852 string NJPL1I PDS (JPL) image data 31860 string CCSD3ZF PDS (CCSD) image data 31872 string CCSD3Z PDS (CCSD) image data 31880 string PDS_ PDS image data 31890 string LBLSIZE= PDS (VICAR) image data 3190 3191# pM8x: ATARI STAD compressed bitmap format 3192# 3193# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 3194# p M 8 5/6 xx yy zz data... 3195# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 3196# bytes either run horizontally (pM85) or vertically (pM86). yy is the 3197# most frequent byte, xx and zz are runlength escape codes, where xx is 3198# used for runs of yy. 3199# 32000 string pM85 Atari ST STAD bitmap image data (hor) 3201>5 byte 0x00 (white background) 3202>5 byte 0xFF (black background) 32030 string pM86 Atari ST STAD bitmap image data (vert) 3204>5 byte 0x00 (white background) 3205>5 byte 0xFF (black background) 3206 3207# XXX: 3208# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 3209# magic. 3210# SGI RICE image file <mpruett@sgi.com> 3211#0 beshort 0x5249 RICE image 3212#>2 beshort x v%d 3213#>4 beshort x (%d x 3214#>6 beshort x %d) 3215#>8 beshort 0 8 bit 3216#>8 beshort 1 10 bit 3217#>8 beshort 2 12 bit 3218#>8 beshort 3 13 bit 3219#>10 beshort 0 4:2:2 3220#>10 beshort 1 4:2:2:4 3221#>10 beshort 2 4:4:4 3222#>10 beshort 3 4:4:4:4 3223#>12 beshort 1 RGB 3224#>12 beshort 2 CCIR601 3225#>12 beshort 3 RP175 3226#>12 beshort 4 YUV 3227 3228#------------------------------------------------------------------------------ 3229# 3230# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format 3231# for the EPOC operating system, which is used with PDAs like those from Psion 3232# 3233# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description 3234# of various EPOC file formats 3235 32360 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file 3237 3238#------------------------------------------------------------------------------ 3239# intel: file(1) magic for x86 Unix 3240# 3241# Various flavors of x86 UNIX executable/object (other than Xenix, which 3242# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 3243# Windows as well. 3244# 3245# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 3246# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 3247# as well, if, as, and when IBM makes it portable. 3248# 3249# The `versions' should be un-commented if they work for you. 3250# (Was the problem just one of endianness?) 3251# 32520 leshort 0502 basic-16 executable 3253>12 lelong >0 not stripped 3254#>22 leshort >0 - version %ld 32550 leshort 0503 basic-16 executable (TV) 3256>12 lelong >0 not stripped 3257#>22 leshort >0 - version %ld 32580 leshort 0510 x86 executable 3259>12 lelong >0 not stripped 32600 leshort 0511 x86 executable (TV) 3261>12 lelong >0 not stripped 32620 leshort =0512 iAPX 286 executable small model (COFF) 3263>12 lelong >0 not stripped 3264#>22 leshort >0 - version %ld 32650 leshort =0522 iAPX 286 executable large model (COFF) 3266>12 lelong >0 not stripped 3267#>22 leshort >0 - version %ld 3268# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 32690 leshort =0514 80386 COFF executable 3270>12 lelong >0 not stripped 3271>22 leshort >0 - version %ld 3272 3273#------------------------------------------------------------------------------ 3274# interleaf: file(1) magic for InterLeaf TPS: 3275# 32760 string =\210OPS Interleaf saved data 32770 string =<!OPS Interleaf document text 3278>5 string ,\ Version\ = \b, version 3279>>17 string >\0 %.3s 3280 3281#------------------------------------------------------------------------------ 3282# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 3283# "/etc/magic": 3284# From: guy@netapp.com (Guy Harris) 3285# 32864 string pgscriptver IslandWrite document 328713 string DrawFile IslandDraw document 3288 3289 3290#------------------------------------------------------------------------------ 3291# ispell: file(1) magic for ispell 3292# 3293# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 3294# will match 0x9600 through 0x9603 in *both* little endian and big endian. 3295# (No other current magic entries collide.) 3296# 3297# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 3298# 32990 leshort&0xFFFC 0x9600 little endian ispell 3300>0 byte 0 hash file (?), 3301>0 byte 1 3.0 hash file, 3302>0 byte 2 3.1 hash file, 3303>0 byte 3 hash file (?), 3304>2 leshort 0x00 8-bit, no capitalization, 26 flags 3305>2 leshort 0x01 7-bit, no capitalization, 26 flags 3306>2 leshort 0x02 8-bit, capitalization, 26 flags 3307>2 leshort 0x03 7-bit, capitalization, 26 flags 3308>2 leshort 0x04 8-bit, no capitalization, 52 flags 3309>2 leshort 0x05 7-bit, no capitalization, 52 flags 3310>2 leshort 0x06 8-bit, capitalization, 52 flags 3311>2 leshort 0x07 7-bit, capitalization, 52 flags 3312>2 leshort 0x08 8-bit, no capitalization, 128 flags 3313>2 leshort 0x09 7-bit, no capitalization, 128 flags 3314>2 leshort 0x0A 8-bit, capitalization, 128 flags 3315>2 leshort 0x0B 7-bit, capitalization, 128 flags 3316>2 leshort 0x0C 8-bit, no capitalization, 256 flags 3317>2 leshort 0x0D 7-bit, no capitalization, 256 flags 3318>2 leshort 0x0E 8-bit, capitalization, 256 flags 3319>2 leshort 0x0F 7-bit, capitalization, 256 flags 3320>4 leshort >0 and %d string characters 33210 beshort&0xFFFC 0x9600 big endian ispell 3322>1 byte 0 hash file (?), 3323>1 byte 1 3.0 hash file, 3324>1 byte 2 3.1 hash file, 3325>1 byte 3 hash file (?), 3326>2 beshort 0x00 8-bit, no capitalization, 26 flags 3327>2 beshort 0x01 7-bit, no capitalization, 26 flags 3328>2 beshort 0x02 8-bit, capitalization, 26 flags 3329>2 beshort 0x03 7-bit, capitalization, 26 flags 3330>2 beshort 0x04 8-bit, no capitalization, 52 flags 3331>2 beshort 0x05 7-bit, no capitalization, 52 flags 3332>2 beshort 0x06 8-bit, capitalization, 52 flags 3333>2 beshort 0x07 7-bit, capitalization, 52 flags 3334>2 beshort 0x08 8-bit, no capitalization, 128 flags 3335>2 beshort 0x09 7-bit, no capitalization, 128 flags 3336>2 beshort 0x0A 8-bit, capitalization, 128 flags 3337>2 beshort 0x0B 7-bit, capitalization, 128 flags 3338>2 beshort 0x0C 8-bit, no capitalization, 256 flags 3339>2 beshort 0x0D 7-bit, no capitalization, 256 flags 3340>2 beshort 0x0E 8-bit, capitalization, 256 flags 3341>2 beshort 0x0F 7-bit, capitalization, 256 flags 3342>4 beshort >0 and %d string characters 3343# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 3344# Ispell 4.0 33450 string ISPL ispell 3346>4 long x hash file version %d, 3347>8 long x lexletters %d, 3348>12 long x lexsize %d, 3349>16 long x hashsize %d, 3350>20 long x stblsize %d 3351#------------------------------------------------------------ 3352# Java ByteCode 3353# From Larry Schwimmer (schwim@cs.stanford.edu) 33540 belong 0xcafebabe compiled Java class data, 3355>6 beshort x version %d. 3356>4 beshort x \b%d 3357#------------------------------------------------------------ 3358# Java serialization 3359# From Martin Pool (m.pool@pharos.com.au) 33600 beshort 0xaced Java serialization data 3361>2 beshort >0x0004 \b, version %d 3362 3363#------------------------------------------------------------------------------ 3364# JPEG images 3365# SunOS 5.5.1 had 3366# 3367# 0 string \377\330\377\340 JPEG file 3368# 0 string \377\330\377\356 JPG file 3369# 3370# both of which turn into "JPEG image data" here. 3371# 33720 beshort 0xffd8 JPEG image data 3373>6 string JFIF \b, JFIF standard 3374>6 string Exif \b, EXIF standard 3375# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 3376# in a vain attempt to add image size reporting for JFIF. Note that these 3377# tests are not fool-proof since some perfectly valid JPEGs are currently 3378# impossible to specify in magic(4) format. 3379# First, a little JFIF version info: 3380>11 byte x \b %d. 3381>12 byte x \b%02d 3382# Next, the resolution or aspect ratio of the image: 3383>13 byte 0 \b, aspect ratio 3384>13 byte 1 \b, resolution (DPI) 3385>13 byte 2 \b, resolution (DPCM) 3386#>4 beshort x \b, segment length %d 3387# Next, show thumbnail info, if it exists: 3388>18 byte !0 \b, thumbnail %dx 3389>>19 byte x \b%d 3390# Here things get sticky. We can do ONE MORE marker segment with 3391# indirect addressing, and that's all. It would be great if we could 3392# do pointer arithemetic like in an assembler language. Christos? 3393# And if there was some sort of looping construct to do searches, plus a few 3394# named accumulators, it would be even more effective... 3395# At least we can show a comment if no other segments got inserted before: 3396>(4.S+5) byte 0xFE 3397>>(4.S+8) string >\0 \b, "%s" 3398#>(4.S+5) byte 0xFE \b, comment 3399#>>(4.S+6) beshort x \b length=%d 3400#>>(4.S+8) string >\0 \b, "%s" 3401# Or, we can show the encoding type (I've included only the three most common) 3402# and image dimensions if we are lucky and the SOFn (image segment) is here: 3403>(4.S+5) byte 0xC0 \b, baseline 3404>>(4.S+6) byte x \b, precision %d 3405>>(4.S+7) beshort x \b, %dx 3406>>(4.S+9) beshort x \b%d 3407>(4.S+5) byte 0xC1 \b, extended sequential 3408>>(4.S+6) byte x \b, precision %d 3409>>(4.S+7) beshort x \b, %dx 3410>>(4.S+9) beshort x \b%d 3411>(4.S+5) byte 0xC2 \b, progressive 3412>>(4.S+6) byte x \b, precision %d 3413>>(4.S+7) beshort x \b, %dx 3414>>(4.S+9) beshort x \b%d 3415# I've commented-out quantisation table reporting. I doubt anyone cares yet. 3416#>(4.S+5) byte 0xDB \b, quantisation table 3417#>>(4.S+6) beshort x \b length=%d 3418>14 beshort x \b, %d x 3419>16 beshort x \b %d 3420 3421# HSI is Handmade Software's proprietary JPEG encoding scheme 34220 string hsi1 JPEG image data, HSI proprietary 3423 3424#------------------------------------------------------------------------------ 3425# karma: file(1) magic for Karma data files 3426# 3427# From <rgooch@atnf.csiro.au> 3428 34290 string KarmaRHD Version Karma Data Structure Version 3430>16 belong x %lu 3431#------------------------------------------------------------------------------ 3432# DEC SRC Virtual Paper: Lectern files 3433# Karl M. Hegbloom <karlheg@inetarena.com> 34340 string lect DEC SRC Virtual Paper Lectern file 3435 3436#------------------------------------------------------------------------------ 3437# lex: file(1) magic for lex 3438# 3439# derived empirically, your offsets may vary! 344053 string yyprevious C program text (from lex) 3441>3 string >\0 for %s 3442# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 344321 string generated\ by\ flex C program text (from flex) 3444# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 34450 string %{ lex description text 3446 3447#------------------------------------------------------------------------------ 3448# lif: file(1) magic for lif 3449# 3450# (Daniel Quinlan <quinlan@yggdrasil.com>) 3451# 34520 beshort 0x8000 lif file 3453 3454#------------------------------------------------------------------------------ 3455# linux: file(1) magic for Linux files 3456# 3457# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 3458# The following basic Linux magic is useful for reference, but using 3459# "long" magic is a better practice in order to avoid collisions. 3460# 3461# 2 leshort 100 Linux/i386 3462# >0 leshort 0407 impure executable (OMAGIC) 3463# >0 leshort 0410 pure executable (NMAGIC) 3464# >0 leshort 0413 demand-paged executable (ZMAGIC) 3465# >0 leshort 0314 demand-paged executable (QMAGIC) 3466# 34670 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 3468>16 lelong 0 \b, stripped 34690 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 3470>16 lelong 0 \b, stripped 34710 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 3472>16 lelong 0 \b, stripped 34730 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 3474>16 lelong 0 \b, stripped 3475# 34760 string \007\001\000 Linux/i386 object file 3477>20 lelong >0x1020 \b, DLL library 3478# Linux-8086 stuff: 34790 string \01\03\020\04 Linux-8086 impure executable 3480>28 long !0 not stripped 34810 string \01\03\040\04 Linux-8086 executable 3482>28 long !0 not stripped 3483# 34840 string \243\206\001\0 Linux-8086 object file 3485# 34860 string \01\03\020\20 Minix-386 impure executable 3487>28 long !0 not stripped 34880 string \01\03\040\20 Minix-386 executable 3489>28 long !0 not stripped 3490# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 3491216 lelong 0421 Linux/i386 core file 3492>220 string >\0 of '%s' 3493>200 lelong >0 (signal %d) 3494# 3495# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 3496# this can be overridden by the DOS executable (COM) entry 34972 string LILO Linux/i386 LILO boot/chain loader 3498# 3499# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de> 35000 string 0.9 3501>8 byte 0x0a old Debian Binary Package 3502>>3 byte >0 \b, created by dpkg 0.9%c 3503>>4 byte >0 pl%c 3504# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 35050 leshort 0x0436 Linux/i386 PC Screen Font data, 3506>2 byte 0 256 characters, no directory, 3507>2 byte 1 512 characters, no directory, 3508>2 byte 2 256 characters, Unicode directory, 3509>2 byte 3 512 characters, Unicode directory, 3510>3 byte >0 8x%d 3511# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 35124086 string SWAP-SPACE Linux/i386 swap file 3513# ECOFF magic for OSF/1 and Linux (only tested under Linux though) 3514# 3515# from Erik Troan (ewt@redhat.com) examining od dumps, so this 3516# could be wrong 3517# updated by David Mosberger (davidm@azstarnet.com) based on 3518# GNU BFD and MIPS info found below. 3519# 35200 leshort 0x0183 ECOFF alpha 3521>24 leshort 0407 executable 3522>24 leshort 0410 pure 3523>24 leshort 0413 demand paged 3524>8 long >0 not stripped 3525>8 long 0 stripped 3526>23 leshort >0 - version %ld. 3527# 3528# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 3529# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 3530# and Nicol�s Lichtmaier <nick@debian.org> 3531# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 3532514 string HdrS Linux kernel 3533>518 leshort >0 3534>>529 byte 0 zImage data, 3535>>529 byte 1 bzImage data, 3536>0x048c byte 0x31 3537>>0x048c string x version %s 3538>0x0493 byte 0x31 3539>>0x0493 string x version %s 3540>0x048c byte 0x32 3541>>0x048c string x version %s 3542>0x0493 byte 0x32 3543>>0x0493 string x version %s 3544>0x04df byte 0x32 3545>>0x04df string x version %s 3546>0x04fb byte 0x32 3547>>0x04fb string x version %s 3548# This also matches new kernels, which were caught above by "HdrS". 35490 belong 0xb8c0078e Linux kernel 3550>0x1e3 string Loading version 1.3.79 or older 3551>0x1e9 string Loading from prehistoric times 3552# LSM entries - Nicol�s Lichtmaier <nick@feedback.net.ar> 35530 string Begin3 Linux Software Map entry text 3554 3555#------------------------------------------------------------------------------ 3556# lisp: file(1) magic for lisp programs 3557# 3558# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 35590 string ;; Lisp/Scheme program text 3560# Emacs 18 - this is always correct, but not very magical. 35610 string \012( byte-compiled Emacs-Lisp program data 3562# Emacs 19+ - ver. recognition added by Ian Springer 35630 string ;ELC byte-compiled Emacs-Lisp program data, 3564>4 byte >0 version %d 3565# 3566# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 35670 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text 35680 long 0x70768BD2 CLISP memory image data 35690 long 0xD28B7670 CLISP memory image data, other endian 3570# Files produced by GNU gettext 35710 long 0xDE120495 GNU-format message catalog data 35720 long 0x950412DE GNU-format message catalog data 3573 3574#.com and .bin for MIT scheme 35750 string \372\372\372\372 MIT scheme (library?) 3576#------------------------------------------------------------------------------ 3577# mach file description 3578# 35790 belong 0xcafebabe Mach-O fat file 3580>4 belong 1 with 1 architecture 3581>4 belong >1 3582>>4 belong x with %ld architectures 3583# 35840 belong 0xfeedface Mach-O 3585>12 belong 1 object 3586>12 belong 2 executable 3587>12 belong 3 shared library 3588>12 belong 4 core 3589>12 belong 5 preload executable 3590>12 belong >5 3591>>12 belong x filetype=%ld 3592>4 belong <0 3593>>4 belong x architecture=%ld 3594>4 belong 1 vax 3595>4 belong 2 romp 3596>4 belong 3 architecture=3 3597>4 belong 4 ns32032 3598>4 belong 5 ns32332 3599>4 belong 6 for m68k architecture 3600# from NeXTstep 3.0 <mach/machine.h> 3601# i.e. mc680x0_all, ignore 3602# >>8 belong 1 (mc68030) 3603>>8 belong 2 (mc68040) 3604>>8 belong 3 (mc68030 only) 3605>4 belong 7 i386 3606>4 belong 8 mips 3607>4 belong 9 ns32532 3608>4 belong 10 architecture=10 3609>4 belong 11 hp pa-risc 3610>4 belong 12 acorn 3611>4 belong 13 m88k 3612>4 belong 14 SPARC 3613>4 belong 15 i860-big 3614>4 belong 16 i860 3615>4 belong 17 rs6000 3616>4 belong 18 powerPC 3617>4 belong >18 3618>>4 belong x architecture=%ld 3619 3620#------------------------------------------------------------------------------ 3621# macintosh description 3622# 3623# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 3624# Daniel Quinlan, quinlan@yggdrasil.com 362511 string must\ be\ converted\ with\ BinHex BinHex binary text 3626>41 string x \b, version %.3s 3627 3628# Stuffit archives are the de facto standard of compression for Macintosh 3629# files obtained from most archives. (franklsm@tuns.ca) 36300 string SIT! StuffIt Archive (data) 3631>2 string x : %s 36320 string SITD StuffIt Deluxe (data) 3633>2 string x : %s 36340 string Seg StuffIt Deluxe Segment (data) 3635>2 string x : %s 3636 3637# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 36380 string APPL Macintosh Application (data) 3639>2 string x \b: %s 3640 3641# Macintosh System files (franklsm@tuns.ca) 36420 string zsys Macintosh System File (data) 36430 string FNDR Macintosh Finder (data) 36440 string libr Macintosh Library (data) 3645>2 string x : %s 36460 string shlb Macintosh Shared Library (data) 3647>2 string x : %s 36480 string cdev Macintosh Control Panel (data) 3649>2 string x : %s 36500 string INIT Macintosh Extension (data) 3651>2 string x : %s 36520 string FFIL Macintosh Truetype Font (data) 3653>2 string x : %s 36540 string LWFN Macintosh Postscript Font (data) 3655>2 string x : %s 3656 3657# Additional Macintosh Files (franklsm@tuns.ca) 36580 string PACT Macintosh Compact Pro Archive (data) 3659>2 string x : %s 36600 string ttro Macintosh TeachText File (data) 3661>2 string x : %s 36620 string TEXT Macintosh TeachText File (data) 3663>2 string x : %s 36640 string PDF Macintosh PDF File (data) 3665>2 string x : %s 3666 3667# MacBinary format (Eric Fischer, enf@pobox.com) 3668# 3669# Unfortunately MacBinary doesn't really have a magic number prior 3670# to the MacBinary III format. The checksum is really the way to 3671# do it, but the magic file format isn't up to the challenge. 3672# 3673# 0 byte 0 3674# 1 byte # filename length 3675# 2 string # filename 3676# 65 string # file type 3677# 69 string # file creator 3678# 73 byte # Finder flags 3679# 74 byte 0 3680# 75 beshort # vertical posn in window 3681# 77 beshort # horiz posn in window 3682# 79 beshort # window or folder ID 3683# 81 byte # protected? 3684# 82 byte 0 3685# 83 belong # length of data segment 3686# 87 belong # length of resource segment 3687# 91 belong # file creation date 3688# 95 belong # file modification date 3689# 99 beshort # length of comment after resource 3690# 101 byte # new Finder flags 3691# 102 string mBIN # (only in MacBinary III) 3692# 106 byte # char. code of file name 3693# 107 byte # still more Finder flags 3694# 116 belong # total file length 3695# 120 beshort # length of add'l header 3696# 122 byte 129 # for MacBinary II 3697# 122 byte 130 # for MacBinary III 3698# 123 byte 129 # minimum version that can read fmt 3699# 124 beshort # checksum 3700# 3701# This attempts to use the version numbers as a magic number, requiring 3702# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 3703# be 0x81. This works for the files I have, but maybe not for everyone's. 3704 3705122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 3706 3707# MacBinary I doesn't have the version number field at all, but MacBinary II 3708# has been in use since 1987 so I hope there aren't many really old files 3709# floating around that this will miss. The original spec calls for using 3710# the nulls in 0, 74, and 82 as the magic number. 3711# 3712# Another possibility, that would also work for MacBinary I, is to use 3713# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 3714# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 3715# and that 74 will be 0. So something like 3716# 3717# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 3718# 3719# >73 byte&0x01 0x01 \b, inited 3720# >73 byte&0x02 0x02 \b, changed 3721# >73 byte&0x04 0x04 \b, busy 3722# >73 byte&0x08 0x08 \b, bozo 3723# >73 byte&0x10 0x10 \b, system 3724# >73 byte&0x10 0x20 \b, bundle 3725# >73 byte&0x10 0x40 \b, invisible 3726# >73 byte&0x10 0x80 \b, locked 3727 3728>65 string x \b, type "%4.4s" 3729 3730>65 string 8BIM (PhotoShop) 3731>65 string ALB3 (PageMaker 3) 3732>65 string ALB4 (PageMaker 4) 3733>65 string ALT3 (PageMaker 3) 3734>65 string APPL (application) 3735>65 string AWWP (AppleWorks word processor) 3736>65 string CIRC (simulated circuit) 3737>65 string DRWG (MacDraw) 3738>65 string EPSF (Encapsulated PostScript) 3739>65 string FFIL (font suitcase) 3740>65 string FKEY (function key) 3741>65 string FNDR (Macintosh Finder) 3742>65 string GIFf (GIF image) 3743>65 string Gzip (GNU gzip) 3744>65 string INIT (system extension) 3745>65 string LIB\ (library) 3746>65 string LWFN (PostScript font) 3747>65 string MSBC (Microsoft BASIC) 3748>65 string PACT (Compact Pro archive) 3749>65 string PDF\ (Portable Document Format) 3750>65 string PICT (picture) 3751>65 string PNTG (MacPaint picture) 3752>65 string PREF (preferences) 3753>65 string PROJ (Think C project) 3754>65 string QPRJ (Think Pascal project) 3755>65 string SCFL (Defender scores) 3756>65 string SCRN (startup screen) 3757>65 string SITD (StuffIt Deluxe) 3758>65 string SPn3 (SuperPaint) 3759>65 string STAK (HyperCard stack) 3760>65 string Seg\ (StuffIt segment) 3761>65 string TARF (Unix tar archive) 3762>65 string TEXT (ASCII) 3763>65 string TIFF (TIFF image) 3764>65 string TOVF (Eudora table of contents) 3765>65 string WDBN (Microsoft Word word processor) 3766>65 string WORD (MacWrite word processor) 3767>65 string XLS\ (Microsoft Excel) 3768>65 string ZIVM (compress (.Z)) 3769>65 string ZSYS (Pre-System 7 system file) 3770>65 string acf3 (Aldus FreeHand) 3771>65 string cdev (control panel) 3772>65 string dfil (Desk Acessory suitcase) 3773>65 string libr (library) 3774>65 string nX^d (WriteNow word processor) 3775>65 string nX^w (WriteNow dictionary) 3776>65 string rsrc (resource) 3777>65 string scbk (Scrapbook) 3778>65 string shlb (shared library) 3779>65 string ttro (SimpleText read-only) 3780>65 string zsys (system file) 3781 3782>69 string x \b, creator "%4.4s" 3783 3784# Somewhere, Apple has a repository of registered Creator IDs. These are 3785# just the ones that I happened to have files from and was able to identify. 3786 3787>69 string 8BIM (Adobe Photoshop) 3788>69 string ALD3 (PageMaker 3) 3789>69 string ALD4 (PageMaker 4) 3790>69 string ALFA (Alpha editor) 3791>69 string APLS (Apple Scanner) 3792>69 string APSC (Apple Scanner) 3793>69 string BRKL (Brickles) 3794>69 string BTFT (BitFont) 3795>69 string CCL2 (Common Lisp 2) 3796>69 string CCL\ (Common Lisp) 3797>69 string CDmo (The Talking Moose) 3798>69 string CPCT (Compact Pro) 3799>69 string CSOm (Eudora) 3800>69 string DMOV (Font/DA Mover) 3801>69 string DSIM (DigSim) 3802>69 string EDIT (Macintosh Edit) 3803>69 string ERIK (Macintosh Finder) 3804>69 string EXTR (self-extracting archive) 3805>69 string Gzip (GNU gzip) 3806>69 string KAHL (Think C) 3807>69 string LWFU (LaserWriter Utility) 3808>69 string LZIV (compress) 3809>69 string MACA (MacWrite) 3810>69 string MACS (Macintosh operating system) 3811>69 string MAcK (MacKnowledge terminal emulator) 3812>69 string MLND (Defender) 3813>69 string MPNT (MacPaint) 3814>69 string MSBB (Microsoft BASIC (binary)) 3815>69 string MSWD (Microsoft Word) 3816>69 string NCSA (NCSA Telnet) 3817>69 string PJMM (Think Pascal) 3818>69 string PSAL (Hunt the Wumpus) 3819>69 string PSI2 (Apple File Exchange) 3820>69 string R*ch (BBEdit) 3821>69 string RMKR (Resource Maker) 3822>69 string RSED (Resource Editor) 3823>69 string Rich (BBEdit) 3824>69 string SIT! (StuffIt) 3825>69 string SPNT (SuperPaint) 3826>69 string Unix (NeXT Mac filesystem) 3827>69 string VIM! (Vim editor) 3828>69 string WILD (HyperCard) 3829>69 string XCEL (Microsoft Excel) 3830>69 string aCa2 (Fontographer) 3831>69 string aca3 (Aldus FreeHand) 3832>69 string dosa (Macintosh MS-DOS file system) 3833>69 string movr (Font/DA Mover) 3834>69 string nX^n (WriteNow) 3835>69 string pdos (Apple ProDOS file system) 3836>69 string scbk (Scrapbook) 3837>69 string ttxt (SimpleText) 3838>69 string ufox (Foreign File Access) 3839 3840# Just in case... 3841 3842102 string mBIN MacBinary III data with surprising version number 3843 3844# sas magic from Bruce Foster (bef@nwu.edu) 3845# 3846#0 string SAS SAS 3847#>8 string x %s 38480 string SAS SAS 3849>24 string DATA data file 3850>24 string CATALOG catalog 3851>24 string INDEX data file index 3852>24 string VIEW data view 3853# spss magic for SPSS system and portable files, 3854# from Bruce Foster (bef@nwu.edu). 3855 38560 long 0xc1e2c3c9 SPSS Portable File 3857>40 string x %s 3858 38590 string $FL2 SPSS System File 3860>24 string x %s 3861 3862# Macintosh filesystem data 3863# From "Tom N Harris" <telliamed@mac.com> 3864# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 3865# entries depend on the data arithmetic added after v.35 3866# There's also some Pascal strings in here, ditto... 3867 3868# The boot block signature, according to IM:Files, is 3869# "for HFS volumes, this field always contains the value 0x4C4B." 3870# But if this is true for MFS or HFS+ volumes, I don't know. 3871# Alternatively, the boot block is supposed to be zeroed if it's 3872# unused, so a simply >0 should suffice. 3873 38740x400 beshort 0xD2D7 Macintosh MFS data 3875>0 beshort 0x4C4B (bootable) 3876>0x40a beshort &0x8000 (locked) 3877>0x402 beldate-0x7C25B080 x created: %s, 3878>0x406 beldate-0x7C25B080 >0 last backup: %s, 3879>0x414 belong x block size: %d, 3880>0x412 beshort x number of blocks: %d, 3881>0x424 pstring x volume name: %s 3882 38830x400 beshort 0x4244 Macintosh HFS data 3884>0 beshort 0x4C4B (bootable) 3885>0x40a beshort &0x8000 (locked) 3886>0x40a beshort ^0x0100 (mounted) 3887>0x40a beshort &0x0800 (unclean) 3888>0x402 beldate-0x7C25B080 x created: %s, 3889>0x406 beldate-0x7C25B080 x last modified: %s, 3890>0x440 beldate-0x7C25B080 >0 last backup: %s, 3891>0x414 belong x block size: %d, 3892>0x412 beshort x number of blocks: %d, 3893>0x424 pstring x volume name: %s 3894#>0x480 beshort =0x482B Embedded HFS+ Volume: 3895#>>((0x482*(0x414))+(0x41c*512)) x \b 3896# Well, this is (theoretically) how we could do this. But it occurs to 3897# me that we likely don't read in a large enough chunk. I don't have any 3898# HFS+ volumes to see what a typical offset would be. 3899 39000x400 beshort 0x482B Macintosh HFS Extended 3901>&2 beshort x version %d data 3902>0 beshort 0x4C4B (bootable) 3903>&4 belong ^0x00000100 (mounted) 3904>&4 belong &0x00000800 (unclean) 3905>&4 belong &0x00008000 (locked) 3906>&8 string x last mounted by: '%.4s', 3907# really, that should be treated as a belong and we print a string 3908# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 3909>&16 beldate-0x7C25B080 x created: %s, 3910>&20 beldate-0x7C25B080 x last modified: %s, 3911>&24 beldate-0x7C25B080 >0 last backup: %s, 3912>&28 beldate-0x7C25B080 >0 last checked: %s, 3913>&40 belong x block size: %d, 3914>&44 belong x number of blocks: %d, 3915>&48 belong x free blocks: %d 3916 3917# I don't think this is really necessary since it doesn't do much and 3918# anything with a valid driver descriptor will also have a valid 3919# partition map 3920#0 beshort 0x4552 Apple Device Driver data 3921#>&24 beshort =1 \b, MacOS 3922 3923# Is that the partition type a cstring or a pstring? Well, IM says "strings 3924# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 3925# cstring. Of course, partitions can contain more than four entries, but 3926# what're you gonna do? 39270x200 beshort 0x504D Apple Partition data 3928>&2 beshort x block size: %d 3929>&48 string x first type: %s, 3930>&12 belong x number of blocks: %d, 3931>(&0x2.S) beshort 0x504D 3932>>&48 string x second type: %s 3933>>&12 belong x number of blocks: %d, 3934>>(&0x2.S) beshort 0x504D 3935>>>&48 string x third type: %s 3936>>>&12 belong x number of blocks: %d, 3937>>>(&0x2.S) beshort 0x504D 3938>>>>&48 string x fourth type: %s 3939>>>>&12 belong x number of blocks: %d, 3940# AFAIK, only the signature is different 39410x200 beshort 0x5453 Apple Old Partition data 3942>&2 beshort x block size: %d 3943>&48 string x first type: %s, 3944>&12 belong x number of blocks: %d, 3945>(&0x2.S) beshort 0x504D 3946>>&48 string x second type: %s 3947>>&12 belong x number of blocks: %d, 3948>>(&0x2.S) beshort 0x504D 3949>>>&48 string x third type: %s 3950>>>&12 belong x number of blocks: %d, 3951>>>(&0x2.S) beshort 0x504D 3952>>>>&48 string x fourth type: %s 3953>>>>&12 belong x number of blocks: %d, 3954 3955#------------------------------------------------------------------------------ 3956# magic: file(1) magic for magic files 3957# 39580 string #\ Magic magic text file for file(1) cmd 39590 lelong 0xF11E041C magic binary file for file(1) cmd 3960>4 lelong x (version %d) (little endian) 39610 belong 0xF11E041C magic binary file for file(1) cmd 3962>4 belong x (version %d) (big endian) 3963 3964#------------------------------------------------------------------------------ 3965# mail.news: file(1) magic for mail and news 3966# 3967# Unfortunately, saved netnews also has From line added in some news software. 3968#0 string From mail text 3969# There are tests to ascmagic.c to cope with mail and news. 39700 string Relay-Version: old news text 39710 string #!\ rnews batched news text 39720 string N#!\ rnews mailed, batched news text 39730 string Forward\ to mail forwarding text 39740 string Pipe\ to mail piping text 39750 string Return-Path: smtp mail text 39760 string Path: news text 39770 string Xref: news text 39780 string From: news or mail text 39790 string Article saved news text 39800 string BABYL Emacs RMAIL text 39810 string Received: RFC 822 mail text 39820 string MIME-Version: MIME entity text 3983#0 string Content- MIME entity text 3984 3985# TNEF files... 39860 lelong 0x223E9F78 Transport Neutral Encapsulation Format 3987 3988# From: Kevin Sullivan <ksulliva@psc.edu> 39890 string *mbx* MBX mail folder 3990 3991 3992#------------------------------------------------------------------------------ 3993# maple: file(1) magic for maple files 3994# "H. Nanosecond" <aldomel@ix.netcom.com> 3995# Maple V release 4, a multi-purpose math program 3996# 3997 3998# maple library .lib 39990 string \000MVR4\nI MapleVr4 library 4000 4001# .ind 4002# no magic for these :-( 4003# they are compiled indexes for maple files 4004 4005# .hdb 40060 string \000\004\000\000 Maple help database 4007 4008# .mhp 4009# this has the form <PACKAGE=name> 40100 string \<PACKAGE= Maple help file 40110 string \<HELP\ NAME= Maple help file 40120 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 40130 string #\ Newton Maple help file, old style 40140 string #\ daub Maple help file, old style 40150 string #=========== Maple help file, old style 4016 4017# .mws 40180 string \000\000\001\044\000\221 Maple worksheet 4019#this is anomalous 40200 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 4021# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 4022# that is {VERSION major_version miunor_version computer_type version_string} 40230 string {VERSION\ Maple worksheet 4024>9 string >\0 version %.1s. 4025>>10 string 4026>>>11 string >\0 %.1s 4027 4028# .mps 40290 string \0\0\001$ Maple something 4030# from byte 4 it is either 'nul E' or 'soh R' 4031# I think 'nul E' means a file that was saved as a different name 4032# a sort of revision marking 4033# 'soh R' means new 4034>4 string \000\105 An old revision 4035>4 string \001\122 The latest save 4036 4037# .mpl 4038# some of these are the same as .mps above 4039#0000000 000 000 001 044 000 105 same as .mps 4040#0000000 000 000 001 044 001 122 same as .mps 4041 40420 string #\n##\ <SHAREFILE= Maple something 40430 string \n#\n##\ <SHAREFILE= Maple something 40440 string ##\ <SHAREFILE= Maple something 40450 string #\r##\ <SHAREFILE= Maple something 40460 string \r#\r##\ <SHAREFILE= Maple something 40470 string #\ \r##\ <DESCRIBE> Maple something anomalous. 4048 4049#------------------------------------------------------------------------------ 4050# mathematica: file(1) magic for mathematica files 4051# "H. Nanosecond" <aldomel@ix.netcom.com> 4052# Mathematica a multi-purpose math program 4053# versions 2.2 and 3.0 4054 4055#mathematica .mb 40560 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 40570 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 4058 4059# .ma 4060# multiple possibilites: 4061 40620 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 4063#>41 string >\0 %s 4064 4065#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 4066 4067#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 4068#>675 string >\0 %s #doesn't work well 4069 4070# there may be 'cr' instread of 'nl' in some does this matter? 4071 4072# generic: 40730 string (*^\r\r::[\011 Mathematica notebook version 2.x 40740 string \(\*\^\r\n\r\n\:\:\[\011 Mathematica notebook version 2.x 40750 string (*^\015 Mathematica notebook version 2.x 40760 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 40770 string (*^\r::[\011 Mathematica notebook version 2.x 40780 string (*^\r\n::[\011 Mathematica notebook version 2.x 40790 string (*^\n\n::[\011 Mathematica notebook version 2.x 40800 string (*^\n::[\011 Mathematica notebook version 2.x 4081 4082 4083# Mathematica .mx files 4084 4085#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 40860 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 4087#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 4088# >71... is optional 4089>88 string >\0 from %s 4090 4091 4092# Mathematica files PBF: 4093# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 40940 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 4095 4096# .ml files These are menu resources I think 4097# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 4098# how to put that into a magic rule? 40994 string \ A~ MAthematica .ml file 4100 4101# .nb files 4102#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 41030 string (*********************** Mathematica 3.0 notebook 4104 4105# other (* matches it is a comment start in these langs 41060 string (* Mathematica, or Pascal, Modula-2 or 3 code 4107#------------------------------------------------------------------------------ 4108# Mavroyanopoulos Nikos <nmav@hellug.gr> 4109# mcrypt: file(1) magic for mcrypt 2.2.x; 41100 string \0m\2 mcrypt 2.2 encrypted data, 4111>3 byte 0 algorithm: blowfish-448, 4112>3 byte 1 algorithm: DES, 4113>3 byte 2 algorithm: 3DES, 4114>3 byte 3 algorithm: 3-WAY, 4115>3 byte 4 algorithm: GOST, 4116>3 byte 6 algorithm: SAFER-SK64, 4117>3 byte 7 algorithm: SAFER-SK128, 4118>3 byte 8 algorithm: CAST-128, 4119>3 byte 9 algorithm: xTEA, 4120>3 byte 10 algorithm: TWOFISH-128, 4121>3 byte 11 algorithm: RC2, 4122>3 byte 12 algorithm: TWOFISH-192, 4123>3 byte 13 algorithm: TWOFISH-256, 4124>3 byte 14 algorithm: blowfish-128, 4125>3 byte 15 algorithm: blowfish-192, 4126>3 byte 16 algorithm: blowfish-256, 4127>3 byte 100 algorithm: RC6, 4128>3 byte 101 algorithm: IDEA, 4129>4 byte 0 mode: CBC, 4130>4 byte 1 mode: ECB, 4131>4 byte 2 mode: CFB, 4132>4 byte 3 mode: OFB, 4133>4 byte 4 mode: nOFB, 4134>5 byte 0 keymode: 8bit 4135>5 byte 1 keymode: 4bit 4136>5 byte 2 keymode: SHA-1 hash 4137>5 byte 3 keymode: MD5 hash 4138#------------------------------------------------------------------------------ 4139# mime: file(1) magic for MIME encoded files 4140# 41410 string Content-Type:\ 4142>14 string >\0 %s 41430 string Content-Type: 4144>13 string >\0 %s 4145 4146#------------------------------------------------------------------------------ 4147# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) 4148# Dec Ultrix (MIPS) 4149# all of SGI's *current* machines and OSes run in big-endian mode on the 4150# MIPS machines, as far as I know. 4151# 4152# XXX - what is the blank "-" line? 4153# 4154# kbd file definitions 41550 string kbd!map kbd map file 4156>8 byte >0 Ver %d: 4157>10 short >0 with %d table(s) 41580 belong 0407 old SGI 68020 executable 41590 belong 0410 old SGI 68020 pure executable 41600 beshort 0x8765 disk quotas file 41610 beshort 0x0506 IRIS Showcase file 4162>2 byte 0x49 - 4163>3 byte x - version %ld 41640 beshort 0x0226 IRIS Showcase template 4165>2 byte 0x63 - 4166>3 byte x - version %ld 41670 belong 0x5343464d IRIS Showcase file 4168>4 byte x - version %ld 41690 belong 0x5443464d IRIS Showcase template 4170>4 byte x - version %ld 41710 belong 0xdeadbabe IRIX Parallel Arena 4172>8 belong >0 - version %ld 4173# 41740 beshort 0x0160 MIPSEB ECOFF executable 4175>20 beshort 0407 (impure) 4176>20 beshort 0410 (swapped) 4177>20 beshort 0413 (paged) 4178>8 belong >0 not stripped 4179>8 belong 0 stripped 4180>22 byte x - version %ld 4181>23 byte x .%ld 4182# 41830 beshort 0x0162 MIPSEL-BE ECOFF executable 4184>20 beshort 0407 (impure) 4185>20 beshort 0410 (swapped) 4186>20 beshort 0413 (paged) 4187>8 belong >0 not stripped 4188>8 belong 0 stripped 4189>23 byte x - version %d 4190>22 byte x .%ld 4191# 41920 beshort 0x6001 MIPSEB-LE ECOFF executable 4193>20 beshort 03401 (impure) 4194>20 beshort 04001 (swapped) 4195>20 beshort 05401 (paged) 4196>8 belong >0 not stripped 4197>8 belong 0 stripped 4198>23 byte x - version %d 4199>22 byte x .%ld 4200# 42010 beshort 0x6201 MIPSEL ECOFF executable 4202>20 beshort 03401 (impure) 4203>20 beshort 04001 (swapped) 4204>20 beshort 05401 (paged) 4205>8 belong >0 not stripped 4206>8 belong 0 stripped 4207>23 byte x - version %ld 4208>22 byte x .%ld 4209# 4210# MIPS 2 additions 4211# 42120 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 4213>20 beshort 0407 (impure) 4214>20 beshort 0410 (swapped) 4215>20 beshort 0413 (paged) 4216>8 belong >0 not stripped 4217>8 belong 0 stripped 4218>22 byte x - version %ld 4219>23 byte x .%ld 4220# 42210 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 4222>20 beshort 0407 (impure) 4223>20 beshort 0410 (swapped) 4224>20 beshort 0413 (paged) 4225>8 belong >0 not stripped 4226>8 belong 0 stripped 4227>22 byte x - version %ld 4228>23 byte x .%ld 4229# 42300 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 4231>20 beshort 03401 (impure) 4232>20 beshort 04001 (swapped) 4233>20 beshort 05401 (paged) 4234>8 belong >0 not stripped 4235>8 belong 0 stripped 4236>23 byte x - version %ld 4237>22 byte x .%ld 4238# 42390 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 4240>20 beshort 03401 (impure) 4241>20 beshort 04001 (swapped) 4242>20 beshort 05401 (paged) 4243>8 belong >0 not stripped 4244>8 belong 0 stripped 4245>23 byte x - version %ld 4246>22 byte x .%ld 4247# 4248# MIPS 3 additions 4249# 42500 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 4251>20 beshort 0407 (impure) 4252>20 beshort 0410 (swapped) 4253>20 beshort 0413 (paged) 4254>8 belong >0 not stripped 4255>8 belong 0 stripped 4256>22 byte x - version %ld 4257>23 byte x .%ld 4258# 42590 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 4260>20 beshort 0407 (impure) 4261>20 beshort 0410 (swapped) 4262>20 beshort 0413 (paged) 4263>8 belong >0 not stripped 4264>8 belong 0 stripped 4265>22 byte x - version %ld 4266>23 byte x .%ld 4267# 42680 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 4269>20 beshort 03401 (impure) 4270>20 beshort 04001 (swapped) 4271>20 beshort 05401 (paged) 4272>8 belong >0 not stripped 4273>8 belong 0 stripped 4274>23 byte x - version %ld 4275>22 byte x .%ld 4276# 42770 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 4278>20 beshort 03401 (impure) 4279>20 beshort 04001 (swapped) 4280>20 beshort 05401 (paged) 4281>8 belong >0 not stripped 4282>8 belong 0 stripped 4283>23 byte x - version %ld 4284>22 byte x .%ld 4285# 42860 beshort 0x180 MIPSEB Ucode 42870 beshort 0x182 MIPSEL-BE Ucode 4288# 32bit core file 42890 belong 0xdeadadb0 IRIX core dump 4290>4 belong 1 of 4291>16 string >\0 '%s' 4292# 64bit core file 42930 belong 0xdeadad40 IRIX 64-bit core dump 4294>4 belong 1 of 4295>16 string >\0 '%s' 4296# N32bit core file 42970 belong 0xbabec0bb IRIX N32 core dump 4298>4 belong 1 of 4299>16 string >\0 '%s' 4300# New style crash dump file 43010 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 4302>36 string >\0 '%s' 4303# Trusted IRIX info 43040 string SGIAUDIT SGI Audit file 4305>8 byte x - version %d 4306>9 byte x .%ld 4307# 43080 string WNGZWZSC Wingz compiled script 43090 string WNGZWZSS Wingz spreadsheet 43100 string WNGZWZHP Wingz help file 4311# 43120 string \#Inventor V IRIS Inventor 1.0 file 43130 string \#Inventor V2 Open Inventor 2.0 file 4314# GLF is OpenGL stream encoding 43150 string glfHeadMagic(); GLF_TEXT 43164 belong 0x7d000000 GLF_BINARY_LSB_FIRST 43174 belong 0x0000007d GLF_BINARY_MSB_FIRST 4318# GLS is OpenGL stream encoding; GLS is the successor of GLF 43190 string glsBeginGLS( GLS_TEXT 43204 belong 0x10000000 GLS_BINARY_LSB_FIRST 43214 belong 0x00000010 GLS_BINARY_MSB_FIRST 4322 4323#------------------------------------------------------------------------------ 4324# mirage: file(1) magic for Mirage executables 4325# 4326# XXX - byte order? 4327# 43280 long 31415 Mirage Assembler m.out executable 4329 4330#------------------------------------------------------------------------------ 4331# mkid: file(1) magic for mkid(1) databases 4332# 4333# ID is the binary tags database produced by mkid(1). 4334# 4335# XXX - byte order? 4336# 43370 string \311\304 ID tags data 4338>2 short >0 version %d 4339 4340#------------------------------------------------------------------------------ 4341# mmdf: file(1) magic for MMDF mail files 4342# 43430 string \001\001\001\001 MMDF mailbox 4344#------------------------------------------------------------------------------ 4345# modem: file(1) magic for modem programs 4346# 4347# From: Florian La Roche <florian@knorke.saar.de> 43484 string Research, Digifax-G3-File 4349>29 byte 1 , fine resolution 4350>29 byte 0 , normal resolution 4351 43520 short 0x0100 raw G3 data, byte-padded 43530 short 0x1400 raw G3 data 4354# 4355# Magic data for vgetty voice formats 4356# (Martin Seine & Marc Eberhard) 4357 4358# 4359# raw modem data version 1 4360# 43610 string RMD1 raw modem data 4362>4 string >\0 (%s / 4363>20 short >0 compression type 0x%04x) 4364 4365# 4366# portable voice format 1 4367# 43680 string PVF1\n portable voice format 4369>5 string >\0 (binary %s) 4370 4371# 4372# portable voice format 2 4373# 43740 string PVF2\n portable voice format 4375>5 string >\0 (ascii %s) 4376 4377 4378#------------------------------------------------------------------------------ 4379# motorola: file(1) magic for Motorola 68K and 88K binaries 4380# 4381# 68K 4382# 43830 beshort 0520 mc68k COFF 4384>18 beshort ^00000020 object 4385>18 beshort &00000020 executable 4386>12 belong >0 not stripped 4387>168 string .lowmem Apple toolbox 4388>20 beshort 0407 (impure) 4389>20 beshort 0410 (pure) 4390>20 beshort 0413 (demand paged) 4391>20 beshort 0421 (standalone) 43920 beshort 0521 mc68k executable (shared) 4393>12 belong >0 not stripped 43940 beshort 0522 mc68k executable (shared demand paged) 4395>12 belong >0 not stripped 4396# 4397# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 4398# 43990 beshort 0554 68K BCS executable 4400# 4401# 88K 4402# 4403# Motorola/88Open BCS 4404# 44050 beshort 0555 88K BCS executable 4406# 4407# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 44080 string S0 Motorola S-Record; binary data in text format 4409 4410# ATARI ST relocatable PRG 4411# 4412# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 4413# (according to Roland Waldi, Oct 21, 1987) 4414# besides the magic 0x601a, the text segment size is checked to be 4415# not larger than 1 MB (which is a lot on ST). 4416# The additional 0x601b distinction I took from Doug Lee's magic. 44170 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 4418>2 belong x (txt=%ld, 4419>6 belong x dat=%ld, 4420>10 belong x bss=%ld, 4421>14 belong x sym=%ld) 44220 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 4423>2 belong x (txt=%ld, 4424>6 belong x dat=%ld, 4425>10 belong x bss=%ld, 4426>14 belong x sym=%ld) 4427 4428#------------------------------------------------------------------------------ 4429# msdos: file(1) magic for MS-DOS files 4430# 4431 4432# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 44330 string @echo\ off MS-DOS batch file text 4434 4435# XXX - according to Microsoft's spec, at an offset of 0x3c in a 4436# PE-format executable is the offset in the file of the PE header; 4437# unfortunately, that's a little-endian offset, and there's no way 4438# to specify an indirect offset with a specified byte order. 4439# So, for now, we assume the standard MS-DOS stub, which puts the 4440# PE header at 0x80 = 128. 4441# 4442# Required OS version and subsystem version were 4.0 on some NT 3.51 4443# executables built with Visual C++ 4.0, so it's not clear that 4444# they're interesting. The user version was 0.0, but there's 4445# probably some linker directive to set it. The linker version was 4446# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). 4447# 4448128 string PE\0\0 MS Windows PE 4449>150 leshort&0x0100 >0 32-bit 4450>132 leshort 0x0 unknown processor 4451>132 leshort 0x14c Intel 80386 4452>132 leshort 0x166 MIPS R4000 4453>132 leshort 0x184 Alpha 4454>132 leshort 0x268 Motorola 68000 4455>132 leshort 0x1f0 PowerPC 4456>132 leshort 0x290 PA-RISC 4457>148 leshort >27 4458>>220 leshort 0 unknown subsystem 4459>>220 leshort 1 native 4460>>220 leshort 2 GUI 4461>>220 leshort 3 console 4462>>220 leshort 7 POSIX 4463>150 leshort&0x2000 =0 executable 4464#>>136 ledate x stamp %s, 4465>>150 leshort&0x0001 >0 not relocatable 4466#>>150 leshort&0x0004 =0 with line numbers, 4467#>>150 leshort&0x0008 =0 with local symbols, 4468#>>150 leshort&0x0200 =0 with debug symbols, 4469>>150 leshort&0x1000 >0 system file 4470#>>148 leshort >0 4471#>>>154 byte x linker %d 4472#>>>155 byte x \b.%d, 4473#>>148 leshort >27 4474#>>>192 leshort x requires OS %d 4475#>>>194 leshort x \b.%d, 4476#>>>196 leshort x user version %d 4477#>>>198 leshort x \b.%d, 4478#>>>200 leshort x subsystem version %d 4479#>>>202 leshort x \b.%d, 4480>150 leshort&0x2000 >0 DLL 4481#>>136 ledate x stamp %s, 4482>>150 leshort&0x0001 >0 not relocatable 4483#>>150 leshort&0x0004 =0 with line numbers, 4484#>>150 leshort&0x0008 =0 with local symbols, 4485#>>150 leshort&0x0200 =0 with debug symbols, 4486>>150 leshort&0x1000 >0 system file 4487#>>148 leshort >0 4488#>>>154 byte x linker %d 4489#>>>155 byte x \b.%d, 4490#>>148 leshort >27 4491#>>>192 leshort x requires OS %d 4492#>>>194 leshort x \b.%d, 4493#>>>196 leshort x user version %d 4494#>>>198 leshort x \b.%d, 4495#>>>200 leshort x subsystem version %d 4496#>>>202 leshort x \b.%d, 44970 leshort 0x14c MS Windows COFF Intel 80386 object file 4498#>4 ledate x stamp %s 44990 leshort 0x166 MS Windows COFF MIPS R4000 object file 4500#>4 ledate x stamp %s 45010 leshort 0x184 MS Windows COFF Alpha object file 4502#>4 ledate x stamp %s 45030 leshort 0x268 MS Windows COFF Motorola 68000 object file 4504#>4 ledate x stamp %s 45050 leshort 0x1f0 MS Windows COFF PowerPC object file 4506#>4 ledate x stamp %s 45070 leshort 0x290 MS Windows COFF PA-RISC object file 4508#>4 ledate x stamp %s 4509 4510# .EXE formats (Greg Roelofs, newt@uchicago.edu) 4511# 45120 string MZ MS-DOS executable (EXE) 4513>24 string @ \b, OS/2 or MS Windows 4514>>0xe7 string LH/2\ Self-Extract \b, %s 4515>>0xe9 string PKSFX2 \b, %s 4516>>122 string Windows\ self-extracting\ ZIP \b, %s 4517>0x1c string RJSX\xff\xff \b, ARJ SFX 4518>0x1c string diet\xf9\x9c \b, diet compressed 4519>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX 4520# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0" 4521>0x1e string PKLITE\ Copr. \b, %.6s compressed 4522>0x24 string LHa's\ SFX \b, %.15s 4523>0x24 string LHA's\ SFX \b, %.15s 4524>1638 string -lh5- \b, LHa SFX archive v2.13S 4525>7195 string Rar! \b, RAR self-extracting archive 4526# 4527# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than 4528# 8161 bytes are ignored. To make the following entries work, increase 4529# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, 4530# NT/Win32 and VMS.] 4531# [GRR: some company sells a self-extractor/displayer for image data(!)] 4532# 4533>11696 string PK\003\004 \b, PKZIP SFX archive v1.1 4534>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a 4535>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09 4536>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g 4537>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02 4538# 4539# Info-ZIP self-extractors 4540# these are the DOS versions: 4541>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12 4542>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 4543# these are the OS/2 versions (OS/2 is flagged above): 4544>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12 4545>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 4546# this is the NT/Win32 version: 4547>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption 4548# 4549# TELVOX Teleinformatica CODEC self-extractor for OS/2: 4550>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 4551>>49824 leshort =1 \b, 1 file 4552>>49824 leshort >1 \b, %u files 4553 4554# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 4555# Uncommenting only the first two lines will cover about 2/3 of COM files, 4556# but it isn't feasible to match all COM files since there must be at least 4557# two dozen different one-byte "magics". 4558#0 byte 0xe9 MS-DOS executable (COM) 4559#>6 string SFX\ of\ LHarc (%s) 4560#0 byte 0x8c MS-DOS executable (COM) 4561# 0xeb conflicts with "sequent" magic 4562#0 byte 0xeb MS-DOS executable (COM) 4563#0 byte 0xb8 MS-DOS executable (COM) 4564 4565# miscellaneous formats 45660 string LZ MS-DOS executable (built-in) 4567#0 byte 0xf0 MS-DOS program library data 4568# 4569 4570# 4571# Windows NT Registry files. 4572# 45730 string regf Windows NT Registry file 4574 4575# Popular applications 45762080 string Microsoft\ Word\ 6.0\ Document %s 45772080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 4578# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 45792112 string MSWordDoc Microsoft Word document data 4580# 45810 belong 0x31be0000 Microsoft Word Document 4582# 45830 string PO^Q` Microsoft Word 6.0 Document 4584# 45850 string \376\067\0\043 Microsoft Office Document 45860 string \320\317\021\340\241\261 Microsoft Office Document 45870 string \333\245-\0\0\0 Microsoft Office Document 4588# 45892080 string Microsoft\ Excel\ 5.0\ Worksheet %s 4590# 4591# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 45922114 string Biff5 Microsoft Excel 5.0 Worksheet 4593# 45940 belong 0x00001a00 Lotus 1-2-3 4595>4 belong 0x00100400 wk3 document data 4596>4 belong 0x02100400 wk4 document data 4597>4 belong 0x07800100 fm3 or fmb document data 4598>4 belong 0x07800000 fm3 or fmb document data 4599# 46000 belong 0x00000200 Lotus 1-2-3 4601>4 belong 0x06040600 wk1 document data 4602>4 belong 0x06800200 fmt document data 4603 4604# Help files 46050 string ?_\3\0 MS Windows Help Data 4606 4607# Microsoft CAB distribution format Dale Worley <root@dworley.ny.mediaone.net> 46080 string MSCF\000\000\000\000 Microsoft CAB file 4609 4610# DeIsL1.isu what this is I don't know 46110 string \161\250\000\000\001\002 DeIsL1.isu whatever that is 4612 4613# Winamp .avs 4614#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 46150 string Nullsoft\ AVS\ Preset\ Winamp plug in 4616 4617# Hyper terminal: 46180 string HyperTerminal\ hyperterm 4619>15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal 4620 4621# Windows Metafont .WMF 46220 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf 4623 4624#tz3 files whatever that is (MS Works files) 46250 string \003\001\001\004\070\001\000\000 tz3 ms-works file 46260 string \003\002\001\004\070\001\000\000 tz3 ms-works file 46270 string \003\003\001\004\070\001\000\000 tz3 ms-works file 4628 4629# PGP sig files .sig 4630#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 46310 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 46320 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 46330 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 46340 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 46350 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 46360 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 4637 4638# windows zips files .dmf 46390 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file 4640 4641 4642# Windows help file FTG FTS 46430 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cache 4644 4645# grp old windows 3.1 group files 46460 string \120\115\103\103 Ms-windows 3.1 group files 4647 4648 4649# lnk files windows symlinks 46500 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut 4651 4652#ico files 46530 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows 4654 4655# Windows icons (Ian Springer <ips@fpk.hp.com>) 46560 string \000\000\001\000 ms-windows icon resource 4657>4 byte 1 - 1 icon 4658>4 byte >1 - %d icons 4659>>6 byte >0 \b, %dx 4660>>>7 byte >0 \b%d 4661>>8 byte 0 \b, 256-colors 4662>>8 byte >0 \b, %d-colors 4663 4664 4665# True Type fonts currently misidentified as raw G3 data 4666 46670 string \000\001\000\000\000 MS-Windows true type font .ttf 4668 4669 4670# .chr files 46710 string PK\010\010BGI Borland font 4672>4 string >\0 %s 4673# then there is a copyright notice 4674 4675 4676# .bgi files 46770 string pk\010\010BGI Borland device 4678>4 string >\0 %s 4679# then there is a copyright notice 4680 4681 4682# recycled/info the windows trash bin index 46839 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info 4684 4685 4686##### put in Either Magic/font or Magic/news 4687# Acroread or something files wrongly identified as G3 .pfm 4688# these have the form \000 \001 any? \002 \000 \000 4689# or \000 \001 any? \022 \000 \000 46900 string \000\001 pfm? 4691>3 string \022\000\000Copyright\ yes 4692>3 string \002\000\000Copyright\ yes 4693#>3 string >\0 oops, not a font file. Cancel that. 4694#it clashes with ttf files so put it lower down. 4695 4696# From Doug Lee via a FreeBSD pr 46979 string GERBILDOC First Choice document 46989 string GERBILDB First Choice database 46999 string GERBILCLIP First Choice database 47000 string GERBIL First Choice device file 47019 string RABBITGRAPH RabbitGraph file 47020 string DCU1 Borland Delphi .DCU file 47030 string !<spell> MKS Spell hash list (old format) 47040 string !<spell2> MKS Spell hash list 47050 string AH Halo(TM) bitmapped font file 47060 lelong 0x08086b70 TurboC BGI file 47070 lelong 0x08084b50 TurboC Font file 4708 4709# WARNING: below line conflicts with Infocom game data Z-machine 3 47100 byte 0x03 DBase 3 data file 4711>0x04 lelong 0 (no records) 4712>0x04 lelong >0 (%ld records) 47130 byte 0x83 DBase 3 data file with memo(s) 4714>0x04 lelong 0 (no records) 4715>0x04 lelong >0 (%ld records) 47160 leshort 0x0006 DBase 3 index file 47170 string PMCC Windows 3.x .GRP file 47181 string RDC-meg MegaDots 4719>8 byte >0x2F version %c 4720>9 byte >0x2F \b.%c file 47210 lelong 0x4C 4722>4 lelong 0x00021401 Windows shortcut file 4723 4724# DOS EPS Binary File Header 4725# From: Ed Sznyter <ews@Black.Market.NET> 47260 belong 0xC5D0D3C6 DOS EPS Binary File 4727>4 long >0 Postscript starts at byte %d 4728>>8 long >0 length %d 4729>>>12 long >0 Metafile starts at byte %d 4730>>>>16 long >0 length %d 4731>>>20 long >0 TIFF starts at byte %d 4732>>>>24 long >0 length %d 4733 4734# TNEF magic From "Joomy" <joomy@se-ed.net> 47350 leshort 0x223e9f78 TNEF 4736 4737#------------------------------------------------------------------------------ 4738# msvc: file(1) magic for msvc 4739# "H. Nanosecond" <aldomel@ix.netcom.com> 4740# Microsoft visual C 4741# 4742# I have version 1.0 4743 4744# .aps 47450 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 4746 4747# .ide 4748#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 47490 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 4750 4751# .res 47520 string \000\000\000\000\040\000\000\000\377 MSVC .res 47530 string \377\003\000\377\001\000\020\020\350 MSVC .res 47540 string \377\003\000\377\001\000\060\020\350 MSVC .res 4755 4756#.lib 47570 string \360\015\000\000 Microsoft Visual C library 47580 string \360\075\000\000 Microsoft Visual C library 47590 string \360\175\000\000 Microsoft Visual C library 4760 4761#.pch 47620 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 4763 4764# .pdb 4765# too long 0 string Microsoft\ C/C++\ program\ database\ 47660 string Microsoft\ C/C++\ MSVC program database 4767>18 string program\ database\ 4768>33 string >\0 ver %s 4769 4770#.sbr 47710 string \000\002\000\007\000 MSVC .sbr 4772>5 string >\0 %s 4773 4774#.bsc 47750 string \002\000\002\001 MSVC .bsc 4776 4777#.wsp 47780 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 4779# these seem to start with the version and contain menus 4780 4781#------------------------------------------------------------------------------ 4782# ncr: file(1) magic for NCR Tower objects 4783# 4784# contributed by 4785# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 4786# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 4787# 47880 beshort 000610 Tower/XP rel 2 object 4789>12 belong >0 not stripped 4790>20 beshort 0407 executable 4791>20 beshort 0410 pure executable 4792>22 beshort >0 - version %ld 47930 beshort 000615 Tower/XP rel 2 object 4794>12 belong >0 not stripped 4795>20 beshort 0407 executable 4796>20 beshort 0410 pure executable 4797>22 beshort >0 - version %ld 47980 beshort 000620 Tower/XP rel 3 object 4799>12 belong >0 not stripped 4800>20 beshort 0407 executable 4801>20 beshort 0410 pure executable 4802>22 beshort >0 - version %ld 48030 beshort 000625 Tower/XP rel 3 object 4804>12 belong >0 not stripped 4805>20 beshort 0407 executable 4806>20 beshort 0410 pure executable 4807>22 beshort >0 - version %ld 48080 beshort 000630 Tower32/600/400 68020 object 4809>12 belong >0 not stripped 4810>20 beshort 0407 executable 4811>20 beshort 0410 pure executable 4812>22 beshort >0 - version %ld 48130 beshort 000640 Tower32/800 68020 4814>18 beshort &020000 w/68881 object 4815>18 beshort &040000 compatible object 4816>18 beshort &~060000 object 4817>20 beshort 0407 executable 4818>20 beshort 0413 pure executable 4819>12 belong >0 not stripped 4820>22 beshort >0 - version %ld 48210 beshort 000645 Tower32/800 68010 4822>18 beshort &040000 compatible object 4823>18 beshort &~060000 object 4824>20 beshort 0407 executable 4825>20 beshort 0413 pure executable 4826>12 belong >0 not stripped 4827>22 beshort >0 - version %ld 4828 4829#------------------------------------------------------------------------------ 4830# netbsd: file(1) magic for NetBSD objects 4831# 4832# All new-style magic numbers are in network byte order. 4833# 4834 48350 lelong 000000407 NetBSD little-endian object file 4836>16 lelong >0 not stripped 48370 belong 000000407 NetBSD big-endian object file 4838>16 belong >0 not stripped 4839 48400 belong&0377777777 041400413 NetBSD/i386 demand paged 4841>0 byte &0x80 4842>>20 lelong <4096 shared library 4843>>20 lelong =4096 dynamically linked executable 4844>>20 lelong >4096 dynamically linked executable 4845>0 byte ^0x80 executable 4846>16 lelong >0 not stripped 48470 belong&0377777777 041400410 NetBSD/i386 pure 4848>0 byte &0x80 dynamically linked executable 4849>0 byte ^0x80 executable 4850>16 lelong >0 not stripped 48510 belong&0377777777 041400407 NetBSD/i386 4852>0 byte &0x80 dynamically linked executable 4853>0 byte ^0x80 4854>>0 byte &0x40 position independent 4855>>20 lelong !0 executable 4856>>20 lelong =0 object file 4857>16 lelong >0 not stripped 48580 belong&0377777777 041400507 NetBSD/i386 core 4859>12 string >\0 from '%s' 4860>32 lelong !0 (signal %d) 4861 48620 belong&0377777777 041600413 NetBSD/m68k demand paged 4863>0 byte &0x80 4864>>20 belong <8192 shared library 4865>>20 belong =8192 dynamically linked executable 4866>>20 belong >8192 dynamically linked executable 4867>0 byte ^0x80 executable 4868>16 belong >0 not stripped 48690 belong&0377777777 041600410 NetBSD/m68k pure 4870>0 byte &0x80 dynamically linked executable 4871>0 byte ^0x80 executable 4872>16 belong >0 not stripped 48730 belong&0377777777 041600407 NetBSD/m68k 4874>0 byte &0x80 dynamically linked executable 4875>0 byte ^0x80 4876>>0 byte &0x40 position independent 4877>>20 belong !0 executable 4878>>20 belong =0 object file 4879>16 belong >0 not stripped 48800 belong&0377777777 041600507 NetBSD/m68k core 4881>12 string >\0 from '%s' 4882>32 belong !0 (signal %d) 4883 48840 belong&0377777777 042000413 NetBSD/m68k4k demand paged 4885>0 byte &0x80 4886>>20 belong <4096 shared library 4887>>20 belong =4096 dynamically linked executable 4888>>20 belong >4096 dynamically linked executable 4889>0 byte ^0x80 executable 4890>16 belong >0 not stripped 48910 belong&0377777777 042000410 NetBSD/m68k4k pure 4892>0 byte &0x80 dynamically linked executable 4893>0 byte ^0x80 executable 4894>16 belong >0 not stripped 48950 belong&0377777777 042000407 NetBSD/m68k4k 4896>0 byte &0x80 dynamically linked executable 4897>0 byte ^0x80 4898>>0 byte &0x40 position independent 4899>>20 belong !0 executable 4900>>20 belong =0 object file 4901>16 belong >0 not stripped 49020 belong&0377777777 042000507 NetBSD/m68k4k core 4903>12 string >\0 from '%s' 4904>32 belong !0 (signal %d) 4905 49060 belong&0377777777 042200413 NetBSD/ns32532 demand paged 4907>0 byte &0x80 4908>>20 lelong <4096 shared library 4909>>20 lelong =4096 dynamically linked executable 4910>>20 lelong >4096 dynamically linked executable 4911>0 byte ^0x80 executable 4912>16 lelong >0 not stripped 49130 belong&0377777777 042200410 NetBSD/ns32532 pure 4914>0 byte &0x80 dynamically linked executable 4915>0 byte ^0x80 executable 4916>16 lelong >0 not stripped 49170 belong&0377777777 042200407 NetBSD/ns32532 4918>0 byte &0x80 dynamically linked executable 4919>0 byte ^0x80 4920>>0 byte &0x40 position independent 4921>>20 lelong !0 executable 4922>>20 lelong =0 object file 4923>16 lelong >0 not stripped 49240 belong&0377777777 042200507 NetBSD/ns32532 core 4925>12 string >\0 from '%s' 4926>32 lelong !0 (signal %d) 4927 49280 belong&0377777777 045200507 NetBSD/powerpc core 4929>12 string >\0 from '%s' 4930 49310 belong&0377777777 042400413 NetBSD/SPARC demand paged 4932>0 byte &0x80 4933>>20 belong <8192 shared library 4934>>20 belong =8192 dynamically linked executable 4935>>20 belong >8192 dynamically linked executable 4936>0 byte ^0x80 executable 4937>16 belong >0 not stripped 49380 belong&0377777777 042400410 NetBSD/SPARC pure 4939>0 byte &0x80 dynamically linked executable 4940>0 byte ^0x80 executable 4941>16 belong >0 not stripped 49420 belong&0377777777 042400407 NetBSD/SPARC 4943>0 byte &0x80 dynamically linked executable 4944>0 byte ^0x80 4945>>0 byte &0x40 position independent 4946>>20 belong !0 executable 4947>>20 belong =0 object file 4948>16 belong >0 not stripped 49490 belong&0377777777 042400507 NetBSD/SPARC core 4950>12 string >\0 from '%s' 4951>32 belong !0 (signal %d) 4952 49530 belong&0377777777 042600413 NetBSD/pmax demand paged 4954>0 byte &0x80 4955>>20 lelong <4096 shared library 4956>>20 lelong =4096 dynamically linked executable 4957>>20 lelong >4096 dynamically linked executable 4958>0 byte ^0x80 executable 4959>16 lelong >0 not stripped 49600 belong&0377777777 042600410 NetBSD/pmax pure 4961>0 byte &0x80 dynamically linked executable 4962>0 byte ^0x80 executable 4963>16 lelong >0 not stripped 49640 belong&0377777777 042600407 NetBSD/pmax 4965>0 byte &0x80 dynamically linked executable 4966>0 byte ^0x80 4967>>0 byte &0x40 position independent 4968>>20 lelong !0 executable 4969>>20 lelong =0 object file 4970>16 lelong >0 not stripped 49710 belong&0377777777 042600507 NetBSD/pmax core 4972>12 string >\0 from '%s' 4973>32 lelong !0 (signal %d) 4974 49750 belong&0377777777 043000413 NetBSD/vax 1k demand paged 4976>0 byte &0x80 4977>>20 lelong <4096 shared library 4978>>20 lelong =4096 dynamically linked executable 4979>>20 lelong >4096 dynamically linked executable 4980>0 byte ^0x80 executable 4981>16 lelong >0 not stripped 49820 belong&0377777777 043000410 NetBSD/vax 1k pure 4983>0 byte &0x80 dynamically linked executable 4984>0 byte ^0x80 executable 4985>16 lelong >0 not stripped 49860 belong&0377777777 043000407 NetBSD/vax 1k 4987>0 byte &0x80 dynamically linked executable 4988>0 byte ^0x80 4989>>0 byte &0x40 position independent 4990>>20 lelong !0 executable 4991>>20 lelong =0 object file 4992>16 lelong >0 not stripped 49930 belong&0377777777 043000507 NetBSD/vax 1k core 4994>12 string >\0 from '%s' 4995>32 lelong !0 (signal %d) 4996 49970 belong&0377777777 045400413 NetBSD/vax 4k demand paged 4998>0 byte &0x80 4999>>20 lelong <4096 shared library 5000>>20 lelong =4096 dynamically linked executable 5001>>20 lelong >4096 dynamically linked executable 5002>0 byte ^0x80 executable 5003>16 lelong >0 not stripped 50040 belong&0377777777 045400410 NetBSD/vax 4k pure 5005>0 byte &0x80 dynamically linked executable 5006>0 byte ^0x80 executable 5007>16 lelong >0 not stripped 50080 belong&0377777777 045400407 NetBSD/vax 4k 5009>0 byte &0x80 dynamically linked executable 5010>0 byte ^0x80 5011>>0 byte &0x40 position independent 5012>>20 lelong !0 executable 5013>>20 lelong =0 object file 5014>16 lelong >0 not stripped 50150 belong&0377777777 045400507 NetBSD/vax 4k core 5016>12 string >\0 from '%s' 5017>32 lelong !0 (signal %d) 5018 5019# NetBSD/alpha does not support (and has never supported) a.out objects, 5020# so no rules are provided for them. NetBSD/alpha ELF objects are 5021# dealt with in "elf". 50220 lelong 0x00070185 ECOFF NetBSD/alpha binary 5023>10 leshort 0x0001 not stripped 5024>10 leshort 0x0000 stripped 50250 belong&0377777777 043200507 NetBSD/alpha core 5026>12 string >\0 from '%s' 5027>32 lelong !0 (signal %d) 5028 50290 belong&0377777777 043400413 NetBSD/mips demand paged 5030>0 byte &0x80 5031>>20 belong <8192 shared library 5032>>20 belong =8192 dynamically linked executable 5033>>20 belong >8192 dynamically linked executable 5034>0 byte ^0x80 executable 5035>16 belong >0 not stripped 50360 belong&0377777777 043400410 NetBSD/mips pure 5037>0 byte &0x80 dynamically linked executable 5038>0 byte ^0x80 executable 5039>16 belong >0 not stripped 50400 belong&0377777777 043400407 NetBSD/mips 5041>0 byte &0x80 dynamically linked executable 5042>0 byte ^0x80 5043>>0 byte &0x40 position independent 5044>>20 belong !0 executable 5045>>20 belong =0 object file 5046>16 belong >0 not stripped 50470 belong&0377777777 043400507 NetBSD/mips core 5048>12 string >\0 from '%s' 5049>32 belong !0 (signal %d) 5050 50510 belong&0377777777 043600413 NetBSD/arm32 demand paged 5052>0 byte &0x80 5053>>20 lelong <4096 shared library 5054>>20 lelong =4096 dynamically linked executable 5055>>20 lelong >4096 dynamically linked executable 5056>0 byte ^0x80 executable 5057>16 lelong >0 not stripped 50580 belong&0377777777 043600410 NetBSD/arm32 pure 5059>0 byte &0x80 dynamically linked executable 5060>0 byte ^0x80 executable 5061>16 lelong >0 not stripped 50620 belong&0377777777 043600407 NetBSD/arm32 5063>0 byte &0x80 dynamically linked executable 5064>0 byte ^0x80 5065>>0 byte &0x40 position independent 5066>>20 lelong !0 executable 5067>>20 lelong =0 object file 5068>16 lelong >0 not stripped 5069# NetBSD/arm26 has always used ELF objects, but it shares a core file 5070# format with NetBSD/arm32. 50710 belong&0377777777 043600507 NetBSD/arm core 5072>12 string >\0 from '%s' 5073>32 lelong !0 (signal %d) 5074 5075#------------------------------------------------------------------------------ 5076# netscape: file(1) magic for Netscape files 5077# "H. Nanosecond" <aldomel@ix.netcom.com> 5078# version 3 and 4 I think 5079# 5080 5081# Netscape Address book .nab 50820 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 5083 5084# .snm Caches 50850 string #\ Netscape\ folder\ cache Netscape folder cache 50860 string \000\036\204\220\000 Netscape folder cache 5087# .n2p 5088# Net 2 Phone 5089#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 50900 string SX961999 Net2phone 5091 5092# 5093#This is files ending in .art, FIXME add more rules 50940 string JG\004\016\0\0\0\0 ART 5095 5096#------------------------------------------------------------------------------ 5097# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 5098# 50990 string StartFontMetrics ASCII font metrics 51000 string StartFont ASCII font bits 51010 belong 0x137A2944 NeWS bitmap font 51020 belong 0x137A2947 NeWS font family 51030 belong 0x137A2950 scalable OpenFont binary 51040 belong 0x137A2951 encrypted scalable OpenFont binary 51058 belong 0x137A2B45 X11/NeWS bitmap font 51068 belong 0x137A2B48 X11/NeWS font family 5107#------------------------------------------------------------------------------ 5108# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 51090 string Octave-1-L Octave binary data (little endian) 51100 string Octave-1-B Octave binary data (big endian) 5111 5112#------------------------------------------------------------------------------ 5113# olf: file(1) magic for OLF executables 5114# 5115# We have to check the byte order flag to see what byte order all the 5116# other stuff in the header is in. 5117# 5118# MIPS R3000 may also be for MIPS R2000. 5119# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 5120# 5121# Created by Erik Theisen <etheisen@openbsd.org> 5122# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 51230 string \177OLF OLF 5124>4 byte 0 invalid class 5125>4 byte 1 32-bit 5126>4 byte 2 64-bit 5127>7 byte 0 invalid os 5128>7 byte 1 OpenBSD 5129>7 byte 2 NetBSD 5130>7 byte 3 FreeBSD 5131>7 byte 4 4.4BSD 5132>7 byte 5 Linux 5133>7 byte 6 SVR4 5134>7 byte 7 esix 5135>7 byte 8 Solaris 5136>7 byte 9 Irix 5137>7 byte 10 SCO 5138>7 byte 11 Dell 5139>7 byte 12 NCR 5140>5 byte 0 invalid byte order 5141>5 byte 1 LSB 5142>>16 leshort 0 no file type, 5143>>16 leshort 1 relocatable, 5144>>16 leshort 2 executable, 5145>>16 leshort 3 shared object, 5146# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 5147# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 5148>>16 leshort 4 core file 5149>>>(0x38+0xcc) string >\0 of '%s' 5150>>>(0x38+0x10) lelong >0 (signal %d), 5151>>16 leshort &0xff00 processor-specific, 5152>>18 leshort 0 no machine, 5153>>18 leshort 1 AT&T WE32100 - invalid byte order, 5154>>18 leshort 2 SPARC - invalid byte order, 5155>>18 leshort 3 Intel 80386, 5156>>18 leshort 4 Motorola 68000 - invalid byte order, 5157>>18 leshort 5 Motorola 88000 - invalid byte order, 5158>>18 leshort 6 Intel 80486, 5159>>18 leshort 7 Intel 80860, 5160>>18 leshort 8 MIPS R3000_BE - invalid byte order, 5161>>18 leshort 9 Amdahl - invalid byte order, 5162>>18 leshort 10 MIPS R3000_LE, 5163>>18 leshort 11 RS6000 - invalid byte order, 5164>>18 leshort 15 PA-RISC - invalid byte order, 5165>>18 leshort 16 nCUBE, 5166>>18 leshort 17 VPP500, 5167>>18 leshort 18 SPARC32PLUS, 5168>>18 leshort 20 PowerPC, 5169>>18 leshort 0x9026 Alpha, 5170>>20 lelong 0 invalid version 5171>>20 lelong 1 version 1 5172>>36 lelong 1 MathCoPro/FPU/MAU Required 5173>8 string >\0 (%s) 5174>5 byte 2 MSB 5175>>16 beshort 0 no file type, 5176>>16 beshort 1 relocatable, 5177>>16 beshort 2 executable, 5178>>16 beshort 3 shared object, 5179>>16 beshort 4 core file, 5180>>>(0x38+0xcc) string >\0 of '%s' 5181>>>(0x38+0x10) belong >0 (signal %d), 5182>>16 beshort &0xff00 processor-specific, 5183>>18 beshort 0 no machine, 5184>>18 beshort 1 AT&T WE32100, 5185>>18 beshort 2 SPARC, 5186>>18 beshort 3 Intel 80386 - invalid byte order, 5187>>18 beshort 4 Motorola 68000, 5188>>18 beshort 5 Motorola 88000, 5189>>18 beshort 6 Intel 80486 - invalid byte order, 5190>>18 beshort 7 Intel 80860, 5191>>18 beshort 8 MIPS R3000_BE, 5192>>18 beshort 9 Amdahl, 5193>>18 beshort 10 MIPS R3000_LE - invalid byte order, 5194>>18 beshort 11 RS6000, 5195>>18 beshort 15 PA-RISC, 5196>>18 beshort 16 nCUBE, 5197>>18 beshort 17 VPP500, 5198>>18 beshort 18 SPARC32PLUS, 5199>>18 beshort 20 PowerPC or cisco 4500, 5200>>18 beshort 21 cisco 7500, 5201>>18 beshort 24 cisco SVIP, 5202>>18 beshort 25 cisco 7200, 5203>>18 beshort 36 cisco 12000, 5204>>18 beshort 0x9026 Alpha, 5205>>20 belong 0 invalid version 5206>>20 belong 1 version 1 5207>>36 belong 1 MathCoPro/FPU/MAU Required 5208 5209#------------------------------------------------------------------------------ 5210# os2: file(1) magic for OS/2 files 5211# 5212 5213# Provided 1998/08/22 by 5214# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 52151 string InternetShortcut MS Windows 95 Internet shortcut text 5216>24 string >\ (URL=<%s>) 5217 5218# OS/2 URL objects 5219# Provided 1998/08/22 by 5220# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 52210 string http: OS/2 URL object text 5222>5 string >\ (WWW) <http:%s> 52230 string mailto: OS/2 URL object text 5224>7 string >\ (email) <%s> 52250 string news: OS/2 URL object text 5226>5 string >\ (Usenet) <%s> 52270 string ftp: OS/2 URL object text 5228>4 string >\ (FTP) <ftp:%s> 52290 string file: OS/2 URL object text 5230>5 string >\ (Local file) <%s> 5231 5232# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 5233# Carl Hauser (chauser.parc@xerox.com) and 5234# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 5235# list the following header format in inf02a.doc: 5236# 5237# int16 ID; // ID magic word (5348h = "HS") 5238# int8 unknown1; // unknown purpose, could be third letter of ID 5239# int8 flags; // probably a flag word... 5240# // bit 0: set if INF style file 5241# // bit 4: set if HLP style file 5242# // patching this byte allows reading HLP files 5243# // using the VIEW command, while help files 5244# // seem to work with INF settings here as well. 5245# int16 hdrsize; // total size of header 5246# int16 unknown2; // unknown purpose 5247# 52480 string HSP\x01\x9b\x00 OS/2 INF 5249>107 string >0 (%s) 52500 string HSP\x10\x9b\x00 OS/2 HLP 5251>107 string >0 (%s) 5252 5253# OS/2 INI (this is a guess) 52540 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 5255# 5256# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 5257# 5258# Redistribution and use in source and binary forms, with or without 5259# modification, are permitted provided that the following conditions 5260# are met: 5261# 1. Redistributions of source code must retain the above copyright 5262# notice, this list of conditions and the following disclaimer. 5263# 2. Redistributions in binary form must reproduce the above copyright 5264# notice, this list of conditions and the following disclaimer in the 5265# documentation and/or other materials provided with the distribution. 5266# 3. All advertising materials mentioning features or use of this software 5267# must display the following acknowledgement: 5268# This product includes software developed by Ignatios Souvatzis for 5269# the NetBSD project. 5270# 4. The name of the author may not be used to endorse or promote products 5271# derived from this software without specific prior written permission. 5272# 5273# 5274# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 5275# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 5276# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 5277# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 5278# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 5279# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 5280# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 5281# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 5282# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 5283# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 5284# 5285# 5286# 5287# OS9/6809 module descriptions: 5288# 52890 beshort 0x87CD OS9/6809 module: 5290# 5291>6 byte&0x0f 0x00 non-executable 5292>6 byte&0x0f 0x01 machine language 5293>6 byte&0x0f 0x02 BASIC I-code 5294>6 byte&0x0f 0x03 P-code 5295>6 byte&0x0f 0x04 C I-code 5296>6 byte&0x0f 0x05 COBOL I-code 5297>6 byte&0x0f 0x06 FORTRAN I-code 5298# 5299>6 byte&0xf0 0x10 program executable 5300>6 byte&0xf0 0x20 subroutine 5301>6 byte&0xf0 0x30 multi-module 5302>6 byte&0xf0 0x40 data module 5303# 5304>6 byte&0xf0 0xC0 system module 5305>6 byte&0xf0 0xD0 file manager 5306>6 byte&0xf0 0xE0 device driver 5307>6 byte&0xf0 0xF0 device descriptor 5308# 5309# OS9/m68k stuff (to be continued) 5310# 53110 beshort 0x4AFC OS9/68K module: 5312# 5313# attr 5314>14 byte&0x80 0x80 re-entrant 5315>14 byte&0x40 0x40 ghost 5316>14 byte&0x20 0x20 system-state 5317# 5318# lang: 5319# 5320>13 byte 1 machine language 5321>13 byte 2 BASIC I-code 5322>13 byte 3 P-code 5323>13 byte 4 C I-code 5324>13 byte 5 COBOL I-code 5325>13 byte 6 Fortran I-code 5326# 5327# 5328# type: 5329# 5330>12 byte 1 program executable 5331>12 byte 2 subroutine 5332>12 byte 3 multi-module 5333>12 byte 4 data module 5334>12 byte 11 trap library 5335>12 byte 12 system module 5336>12 byte 13 file manager 5337>12 byte 14 device driver 5338>12 byte 15 device descriptor 5339# 5340# Mach magic number info 5341# 53420 long 0xefbe OSF/Rose object 5343# I386 magic number info 5344# 53450 short 0565 i386 COFF object 5346 5347#------------------------------------------------------------------------------ 5348# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 5349# 5350# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 5351 5352# appl 535360 belong 0x6170706c PalmOS application 5354>0 string >\0 "%s" 5355# TEXt 535660 belong 0x54455874 AportisDoc file 5357>0 string >\0 "%s" 5358# HACK 535960 belong 0x4841434b HackMaster hack 5360>0 string >\0 "%s" 5361 5362#------------------------------------------------------------------------------ 5363# pbm: file(1) magic for Portable Bitmap files 5364# 5365# XXX - byte order? 5366# 53670 short 0x2a17 "compact bitmap" format (Poskanzer) 5368#------------------------------------------------------------------------------ 5369# pdf: file(1) magic for Portable Document Format 5370# 5371 53720 string %PDF- PDF document 5373>5 byte x \b, version %c 5374>7 byte x \b.%c 5375 5376#------------------------------------------------------------------------------ 5377# pdp: file(1) magic for PDP-11 executable/object and APL workspace 5378# 53790 lelong 0101555 PDP-11 single precision APL workspace 53800 lelong 0101554 PDP-11 double precision APL workspace 5381# 5382# PDP-11 a.out 5383# 53840 leshort 0407 PDP-11 executable 5385>8 leshort >0 not stripped 5386>15 byte >0 - version %ld 5387 53880 leshort 0401 PDP-11 UNIX/RT ldp 53890 leshort 0405 PDP-11 old overlay 5390 53910 leshort 0410 PDP-11 pure executable 5392>8 leshort >0 not stripped 5393>15 byte >0 - version %ld 5394 53950 leshort 0411 PDP-11 separate I&D executable 5396>8 leshort >0 not stripped 5397>15 byte >0 - version %ld 5398 53990 leshort 0437 PDP-11 kernel overlay 5400 5401# These last three are derived from 2.11BSD file(1) 54020 leshort 0413 PDP-11 demand-paged pure executable 5403>8 leshort >0 not stripped 5404 54050 leshort 0430 PDP-11 overlaid pure executable 5406>8 leshort >0 not stripped 5407 54080 leshort 0431 PDP-11 overlaid separate executable 5409>8 leshort >0 not stripped 5410 5411#------------------------------------------------------------------------------ 5412# pgp: file(1) magic for Pretty Good Privacy 5413# 54140 beshort 0x9900 PGP key public ring 54150 beshort 0x9501 PGP key security ring 54160 beshort 0x9500 PGP key security ring 54170 beshort 0xa600 PGP encrypted data 54180 string -----BEGIN\040PGP PGP armored data 5419>15 string PUBLIC\040KEY\040BLOCK- public key block 5420>15 string MESSAGE- message 5421>15 string SIGNED\040MESSAGE- signed message 5422>15 string PGP\040SIGNATURE- signature 5423 5424#------------------------------------------------------------------------------ 5425# pkgadd: file(1) magic for SysV R4 PKG Datastreams 5426# 54270 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 5428 5429#------------------------------------------------------------------------------ 5430# plus5: file(1) magic for Plus Five's UNIX MUMPS 5431# 5432# XXX - byte order? Paging Hokey.... 5433# 54340 short 0x259 mumps avl global 5435>2 byte >0 (V%d) 5436>6 byte >0 with %d byte name 5437>7 byte >0 and %d byte data cells 54380 short 0x25a mumps blt global 5439>2 byte >0 (V%d) 5440>8 short >0 - %d byte blocks 5441>15 byte 0x00 - P/D format 5442>15 byte 0x01 - P/K/D format 5443>15 byte 0x02 - K/D format 5444>15 byte >0x02 - Bad Flags 5445 5446#------------------------------------------------------------------------------ 5447# printer: file(1) magic for printer-formatted files 5448# 5449 5450# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 54510 string %! PostScript document text 5452>2 string PS-Adobe- conforming 5453>>11 string >\0 at level %.3s 5454>>>15 string EPS - type %s 5455>>>15 string Query - type %s 5456>>>15 string ExitServer - type %s 5457# Some PCs have the annoying habit of adding a ^D as a document separator 54580 string \004%! PostScript document text 5459>3 string PS-Adobe- conforming 5460>>12 string >\0 at level %.3s 5461>>>16 string EPS - type %s 5462>>>16 string Query - type %s 5463>>>16 string ExitServer - type %s 54640 string \033%-12345X%!PS PostScript document 5465 5466 5467# DOS EPS Binary File Header 5468# From: Ed Sznyter <ews@Black.Market.NET> 54690 belong 0xC5D0D3C6 DOS EPS Binary File 5470>4 long >0 Postscript starts at byte %d 5471>>8 long >0 length %d 5472>>>12 long >0 Metafile starts at byte %d 5473>>>>16 long >0 length %d 5474>>>20 long >0 TIFF starts at byte %d 5475>>>>24 long >0 length %d 5476 5477# Adobe's PostScript Printer Description (PPD) files 5478# Yves Arrouye <arrouye@marin.fdn.fr> 5479# 54800 string *PPD-Adobe: PPD file 5481>13 string x \b, ve 5482 5483# HP Printer Job Language 54840 string \033%-12345X@PJL HP Printer Job Language data 5485# HP Printer Job Language 5486# The header found on Win95 HP plot files is the "Silliest Thing possible" 5487# (TM) 5488# Every driver puts the language at some random position, with random case 5489# (LANGUAGE and Language) 5490# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 5491# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 5492# 54930 string \033%-12345X@PJL HP Printer Job Language data 5494>&0 string >\0 %s 5495>>&0 string >\0 %s 5496>>>&0 string >\0 %s 5497>>>>&0 string >\0 %s 5498#>15 string \ ENTER\ LANGUAGE\ = 5499#>31 string PostScript PostScript 5500 5501# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 55020 string \033E\033 HP PCL printer data 5503>3 string \&l0A - default page size 5504>3 string \&l1A - US executive page size 5505>3 string \&l2A - US letter page size 5506>3 string \&l3A - US legal page size 5507>3 string \&l26A - A4 page size 5508>3 string \&l80A - Monarch envelope size 5509>3 string \&l81A - No. 10 envelope size 5510>3 string \&l90A - Intl. DL envelope size 5511>3 string \&l91A - Intl. C5 envelope size 5512>3 string \&l100A - Intl. B5 envelope size 5513>3 string \&l-81A - No. 10 envelope size (landscape) 5514>3 string \&l-90A - Intl. DL envelope size (landscape) 5515 5516# IMAGEN printer-ready files: 55170 string @document( Imagen printer 5518# this only works if "language xxx" is first item in Imagen header. 5519>10 string language\ impress (imPRESS data) 5520>10 string language\ daisy (daisywheel text) 5521>10 string language\ diablo (daisywheel text) 5522>10 string language\ printer (line printer emulation) 5523>10 string language\ tektronix (Tektronix 4014 emulation) 5524# Add any other languages that your Imagen uses - remember 5525# to keep the word `text' if the file is human-readable. 5526# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 5527# 5528# Now magic for IMAGEN font files... 55290 string Rast RST-format raster font data 5530>45 string >0 face % 5531# From Jukka Ukkonen 55320 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 5533 5534#------------------------------------------------------------------------------ 5535# project: file(1) magic for Project management 5536# 5537# Magic strings for ftnchek project files. Alexander Mai 55380 string FTNCHEK_\ P project file for ftnchek 5539>10 string 1 version 2.7 5540>10 string 2 version 2.8 to 2.10 5541>10 string 3 version 2.11 or later 5542 5543#------------------------------------------------------------------------------ 5544# psdbms: file(1) magic for psdatabase 5545# 55460 belong&0xff00ffff 0x56000000 ps database 5547>1 string >\0 version %s 5548>4 string >\0 from kernel %s 5549 5550#------------------------------------------------------------------------------ 5551# pyramid: file(1) magic for Pyramids 5552# 5553# XXX - byte order? 5554# 55550 long 0x50900107 Pyramid 90x family executable 55560 long 0x50900108 Pyramid 90x family pure executable 5557>16 long >0 not stripped 55580 long 0x5090010b Pyramid 90x family demand paged pure executable 5559>16 long >0 not stripped 5560# often the module starts with a multiline string 55610 string """ a python script text executable 5562# MAGIC as specified in Python/import.c (1.5.2/1.6) 5563# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 55640 belong 0x994e0d0a python compiled 5565 5566#------------------------------------------------------------------------------ 5567# riff: file(1) magic for RIFF format 5568# See 5569# 5570# http://www.seanet.com/users/matts/riffmci/riffmci.htm 5571# 5572# and 5573# 5574# http://www.ora.com/centers/gff/formats/micriff/index.htm 5575# 5576# and 5577# 5578# http://www.jtauber.com/music/encoding/niff/spec/ 5579# 55800 string RIFF RIFF (little-endian) data 5581# RIFF Palette format 5582>8 string PAL \b, palette 5583>>16 leshort x \b, version %d 5584>>18 leshort x \b, %d entries 5585# RIFF Device Independent Bitmap format 5586>8 string RDIB \b, device-independent bitmap 5587>>16 string BM 5588>>>30 leshort 12 \b, OS/2 1.x format 5589>>>>34 leshort x \b, %d x 5590>>>>36 leshort x %d 5591>>>30 leshort 64 \b, OS/2 2.x format 5592>>>>34 leshort x \b, %d x 5593>>>>36 leshort x %d 5594>>>30 leshort 40 \b, Windows 3.x format 5595>>>>34 lelong x \b, %d x 5596>>>>38 lelong x %d x 5597>>>>44 leshort x %d 5598# RIFF MIDI format 5599>8 string RMID \b, MIDI 5600# RIFF Multimedia Movie File format 5601>8 string RMMP \b, multimedia movie 5602# Microsoft WAVE format (*.wav) 5603>8 string WAVE \b, WAVE audio 5604>>20 leshort 1 \b, Microsoft PCM 5605>>>34 leshort >0 \b, %d bit 5606>>20 leshort 2 \b, Microsoft ADPCM 5607>>20 leshort 6 \b, ITU G.711 a-law 5608>>20 leshort 7 \b, ITU G.711 u-law 5609>>20 leshort 17 \b, IMA ADPCM 5610>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 5611>>20 leshort 49 \b, GSM 6.10 5612>>20 leshort 64 \b, ITU G.721 ADPCM 5613>>20 leshort 80 \b, MPEG 5614>>20 leshort 85 \b, MPEG Layer 3 5615>>22 leshort =1 \b, mono 5616>>22 leshort =2 \b, stereo 5617>>22 leshort >2 \b, %d channels 5618>>24 lelong >0 %d Hz 5619# AVI == Audio Video Interleave 5620>8 string AVI\ \b, AVI 5621# Animated Cursor format 5622>8 string ACON \b, animated cursor 5623 5624# 5625# XXX - some of the below may only appear in little-endian form. 5626# 5627# Also "MV93" appears to be for one form of Macromedia Director 5628# files, and "GDMF" appears to be another multimedia format. 5629# 56300 string RIFX RIFF (big-endian) data 5631# RIFF Palette format 5632>8 string PAL \b, palette 5633>>16 beshort x \b, version %d 5634>>18 beshort x \b, %d entries 5635# RIFF Device Independent Bitmap format 5636>8 string RDIB \b, device-independent bitmap 5637>>16 string BM 5638>>>30 beshort 12 \b, OS/2 1.x format 5639>>>>34 beshort x \b, %d x 5640>>>>36 beshort x %d 5641>>>30 beshort 64 \b, OS/2 2.x format 5642>>>>34 beshort x \b, %d x 5643>>>>36 beshort x %d 5644>>>30 beshort 40 \b, Windows 3.x format 5645>>>>34 belong x \b, %d x 5646>>>>38 belong x %d x 5647>>>>44 beshort x %d 5648# RIFF MIDI format 5649>8 string RMID \b, MIDI 5650# RIFF Multimedia Movie File format 5651>8 string RMMP \b, multimedia movie 5652# Microsoft WAVE format (*.wav) 5653>8 string WAVE \b, WAVE audio 5654>>20 leshort 1 \b, Microsoft PCM 5655>>>34 leshort >0 \b, %d bit 5656>>22 beshort =1 \b, mono 5657>>22 beshort =2 \b, stereo 5658>>22 beshort >2 \b, %d channels 5659>>24 belong >0 %d Hz 5660# AVI == Audio Video Interleave 5661>8 string AVI\ \b, AVI 5662# Animated Cursor format 5663>8 string ACON \b, animated cursor 5664# Notation Interchange File Format (big-endian only) 5665>8 string NIFF \b, Notation Interchange File Format 5666 5667# SoundFont 2 <mpruett@sgi.com> 5668>8 string sfbk SoundFont 2 5669#------------------------------------------------------------------------------ 5670# 5671# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 5672# 56730 beshort 0xedab 5674>2 beshort 0xeedb RPM 5675>>4 byte x v%d 5676>>6 beshort 0 bin 5677>>6 beshort 1 src 5678>>8 beshort 1 i386 5679>>8 beshort 2 Alpha 5680>>8 beshort 3 Sparc 5681>>8 beshort 4 MIPS 5682>>8 beshort 5 PowerPC 5683>>8 beshort 6 68000 5684>>8 beshort 7 SGI 5685>>10 string x %s 5686 5687#------------------------------------------------------------------------------ 5688# rtf: file(1) magic for Rich Text Format (RTF) 5689# 5690# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 5691# 56920 string {\\rtf Rich Text Format data, 5693>5 byte x version %c, 5694>6 string \\ansi ANSI 5695>6 string \\mac Apple Macintosh 5696>6 string \\pc IBM PC, code page 437 5697>6 string \\pca IBM PS/2, code page 850 5698 5699#------------------------------------------------------------------------------ 5700# sc: file(1) magic for "sc" spreadsheet 5701# 570238 string Spreadsheet sc spreadsheet file 5703 5704#------------------------------------------------------------------------------ 5705# sccs: file(1) magic for SCCS archives 5706# 5707# SCCS archive structure: 5708# \001h01207 5709# \001s 00276/00000/00000 5710# \001d D 1.1 87/09/23 08:09:20 ian 1 0 5711# \001c date and time created 87/09/23 08:09:20 by ian 5712# \001e 5713# \001u 5714# \001U 5715# ... etc. 5716# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 5717# *Sigh*. And these both came from various parts of the USG. 5718# Maybe we should just switch everybody from SCCS to RCS! 5719# Further, you can't just say '\001h0', because the five-digit number 5720# is a checksum that could (presumably) have any leading digit, 5721# and we don't have regular expression matching yet. 5722# Hence the following official kludge: 57238 string \001s\ SCCS archive data 5724 5725#------------------------------------------------------------------------------ 5726# sendmail: file(1) magic for sendmail config files 5727# 5728# XXX - byte order? 5729# 57300 byte 046 Sendmail frozen configuration 5731>16 string >\0 - version %s 57320 short 0x271c Sendmail frozen configuration 5733>16 string >\0 - version %s 5734 5735#------------------------------------------------------------------------------ 5736# sequent: file(1) magic for Sequent machines 5737# 5738# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 5739# For Sequent's multiprocessor systems (incomplete). 57400 lelong 0x00ea BALANCE NS32000 .o 5741>16 lelong >0 not stripped 5742>124 lelong >0 version %ld 57430 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 5744>16 lelong >0 not stripped 5745>124 lelong >0 version %ld 57460 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 5747>16 lelong >0 not stripped 5748>124 lelong >0 version %ld 57490 lelong 0x30ea BALANCE NS32000 standalone executable 5750>16 lelong >0 not stripped 5751>124 lelong >0 version %ld 5752# 5753# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 5754# Symmetry magic nums will not be reached if DOS COM comes before them; 5755# byte 0xeb is matched before these get a chance. 57560 leshort 0x12eb SYMMETRY i386 .o 5757>16 lelong >0 not stripped 5758>124 lelong >0 version %ld 57590 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 5760>16 lelong >0 not stripped 5761>124 lelong >0 version %ld 57620 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 5763>16 lelong >0 not stripped 5764>124 lelong >0 version %ld 57650 leshort 0x42eb SYMMETRY i386 standalone executable 5766>16 lelong >0 not stripped 5767>124 lelong >0 version %ld 5768 5769#------------------------------------------------------------------------------ 5770# sgml: file(1) magic for Standard Generalized Markup Language 5771# HyperText Markup Language (HTML) is an SGML document type, 5772# from Daniel Quinlan (quinlan@yggdrasil.com) 5773# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 57740 string/cb \ \<!doctype\ html HTML document text 57750 string/cb \ \<head HTML document text 57760 string/cb \ \<title HTML document text 57770 string/cb \ \<html HTML document text 5778 5779# Extensible markup language (XML), a subset of SGML 5780# from Marc Prud'hommeaux (marc@apocalypse.org) 57810 string/cb \ \<?xml XML document text 5782 5783 5784# SGML, mostly from rph@sq 57850 string/cb \ \<!doctype exported SGML document text 57860 string/cb \ \<!subdoc exported SGML subdocument text 57870 string/b \ \<!-- exported SGML document text 57880 string \<!\ possible SGML document text 5789 5790#------------------------------------------------------------------------------ 5791# Sketch Drawings: http://sketch.sourceforge.net/ 5792# From: Edwin Mons <e@ik.nu> 57930 string ##Sketch Sketch document text 5794 5795#------------------------------------------------------------------------------ 5796# sniffer: file(1) magic for packet capture files 5797# 5798# From: guy@alum.mit.edu (Guy Harris) 5799# 5800 5801# 5802# Microsoft Network Monitor 1.x capture files. 5803# 58040 string RTSS NetMon capture file 5805>4 byte x - version %d 5806>5 byte x \b.%d 5807>6 leshort 0 (Unknown) 5808>6 leshort 1 (Ethernet) 5809>6 leshort 2 (Token Ring) 5810>6 leshort 3 (FDDI) 5811 5812# 5813# Microsoft Network Monitor 2.x capture files. 5814# 58150 string GMBU NetMon capture file 5816>4 byte x - version %d 5817>5 byte x \b.%d 5818>6 leshort 0 (Unknown) 5819>6 leshort 1 (Ethernet) 5820>6 leshort 2 (Token Ring) 5821>6 leshort 3 (FDDI) 5822 5823# 5824# Network General Sniffer capture files. 5825# Sorry, make that "Network Associates Sniffer capture files." 5826# 58270 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 5828>33 byte 2 (compressed) 5829>23 leshort x - version %d 5830>25 leshort x \b.%d 5831>32 byte 0 (Token Ring) 5832>32 byte 1 (Ethernet) 5833>32 byte 2 (ARCNET) 5834>32 byte 3 (StarLAN) 5835>32 byte 4 (PC Network broadband) 5836>32 byte 5 (LocalTalk) 5837>32 byte 6 (Znet) 5838>32 byte 7 (Internetwork Analyzer) 5839>32 byte 9 (FDDI) 5840>32 byte 10 (ATM) 5841 5842# 5843# Cinco Networks NetXRay capture files. 5844# Sorry, make that "Network General Sniffer Basic capture files." 5845# Sorry, make that "Network Associates Sniffer Basic capture files." 5846# Sorry, make that "Network Associates Sniffer Basic, and Windows 5847# Sniffer Pro", capture files." 5848# 58490 string XCP\0 NetXRay capture file 5850>4 string >\0 - version %s 5851>44 leshort 0 (Ethernet) 5852>44 leshort 1 (Token Ring) 5853>44 leshort 2 (FDDI) 5854 5855# 5856# "libpcap" capture files. 5857# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 5858# the main program that uses that format, but there are other programs 5859# that use "libpcap", or that use the same capture file format.) 5860# 58610 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 5862>4 beshort x - version %d 5863>6 beshort x \b.%d 5864>20 belong 0 (No link-layer encapsulation 5865>20 belong 1 (Ethernet 5866>20 belong 2 (3Mb Ethernet 5867>20 belong 3 (AX.25 5868>20 belong 4 (ProNET 5869>20 belong 5 (CHAOS 5870>20 belong 6 (Token Ring 5871>20 belong 7 (ARCNET 5872>20 belong 8 (SLIP 5873>20 belong 9 (PPP 5874>20 belong 10 (FDDI 5875>20 belong 11 (RFC 1483 ATM 5876>20 belong 12 (raw IP 5877>20 belong 13 (BSD/OS SLIP 5878>20 belong 14 (BSD/OS PPP 5879>20 belong 50 (PPP or Cisco HDLC 5880>20 belong 51 (PPP-over-Ethernet 5881>20 belong 100 (RFC 1483 ATM 5882>20 belong 101 (raw IP 5883>20 belong 102 (BSD/OS SLIP 5884>20 belong 103 (BSD/OS PPP 5885>20 belong 104 (BSD/OS Cisco HDLC 5886>20 belong 105 (802.11 5887>20 belong 106 (Linux Classical IP over ATM 5888>20 belong 108 (OpenBSD loopback 5889>20 belong 109 (OpenBSD IPSEC encrypted 5890>20 belong 113 (Linux "cooked" 5891>20 belong 114 (LocalTalk 5892>16 belong x \b, capture length %d) 58930 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 5894>4 leshort x - version %d 5895>6 leshort x \b.%d 5896>20 lelong 0 (No link-layer encapsulation 5897>20 lelong 1 (Ethernet 5898>20 lelong 2 (3Mb Ethernet 5899>20 lelong 3 (AX.25 5900>20 lelong 4 (ProNET 5901>20 lelong 5 (CHAOS 5902>20 lelong 6 (Token Ring 5903>20 lelong 7 (ARCNET 5904>20 lelong 8 (SLIP 5905>20 lelong 9 (PPP 5906>20 lelong 10 (FDDI 5907>20 lelong 11 (RFC 1483 ATM 5908>20 lelong 12 (raw IP 5909>20 lelong 13 (BSD/OS SLIP 5910>20 lelong 14 (BSD/OS PPP 5911>20 lelong 50 (PPP or Cisco HDLC 5912>20 lelong 51 (PPP-over-Ethernet 5913>20 lelong 100 (RFC 1483 ATM 5914>20 lelong 101 (raw IP 5915>20 lelong 102 (BSD/OS SLIP 5916>20 lelong 103 (BSD/OS PPP 5917>20 lelong 104 (BSD/OS Cisco HDLC 5918>20 lelong 105 (802.11 5919>20 lelong 106 (Linux Classical IP over ATM 5920>20 lelong 108 (OpenBSD loopback 5921>20 lelong 109 (OpenBSD IPSEC encrypted 5922>20 lelong 113 (Linux "cooked" 5923>20 lelong 114 (LocalTalk 5924>16 lelong x \b, capture length %d) 5925 5926# 5927# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 5928# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 5929# the main program that uses that format, but there are other programs 5930# that use "libpcap", or that use the same capture file format.) 5931# 59320 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 5933>4 beshort x - version %d 5934>6 beshort x \b.%d 5935>20 belong 0 (No link-layer encapsulation 5936>20 belong 1 (Ethernet 5937>20 belong 2 (3Mb Ethernet 5938>20 belong 3 (AX.25 5939>20 belong 4 (ProNET 5940>20 belong 5 (CHAOS 5941>20 belong 6 (Token Ring 5942>20 belong 7 (ARCNET 5943>20 belong 8 (SLIP 5944>20 belong 9 (PPP 5945>20 belong 10 (FDDI 5946>20 belong 11 (RFC 1483 ATM 5947>20 belong 12 (raw IP 5948>20 belong 13 (BSD/OS SLIP 5949>20 belong 14 (BSD/OS PPP 5950>16 belong x \b, capture length %d) 59510 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 5952>4 leshort x - version %d 5953>6 leshort x \b.%d 5954>20 lelong 0 (No link-layer encapsulation 5955>20 lelong 1 (Ethernet 5956>20 lelong 2 (3Mb Ethernet 5957>20 lelong 3 (AX.25 5958>20 lelong 4 (ProNET 5959>20 lelong 5 (CHAOS 5960>20 lelong 6 (Token Ring 5961>20 lelong 7 (ARCNET 5962>20 lelong 8 (SLIP 5963>20 lelong 9 (PPP 5964>20 lelong 10 (FDDI 5965>20 lelong 11 (RFC 1483 ATM 5966>20 lelong 12 (raw IP 5967>20 lelong 13 (BSD/OS SLIP 5968>20 lelong 14 (BSD/OS PPP 5969>16 lelong x \b, capture length %d) 5970 5971# 5972# AIX "iptrace" capture files. 5973# 59740 string iptrace\ 2.0 "iptrace" capture file 5975 5976# 5977# Novell LANalyzer capture files. 5978# 59790 leshort 0x1001 LANalyzer capture file 59800 leshort 0x1007 LANalyzer capture file 5981 5982# 5983# HP-UX "nettl" capture files. 5984# 59850 string \x54\x52\x00\x64\x00 "nettl" capture file 5986 5987# 5988# RADCOM WAN/LAN Analyzer capture files. 5989# 59900 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 5991 5992# 5993# NetStumbler log files. Not really packets, per se, but about as 5994# close as you can get. These are log files from NetStumbler, a 5995# Windows program, that scans for 802.11b networks. 5996# 59970 string NetS NetStumbler log file 5998>8 lelong x \b, %d stations found 5999 6000#------------------------------------------------------------------------------ 6001# softquad: file(1) magic for SoftQuad Publishing Software 6002# 6003# Author/Editor and RulesBuilder 6004# 6005# XXX - byte order? 6006# 60070 string \<!SQ\ DTD> Compiled SGML rules file 6008>9 string >\0 Type %s 60090 string \<!SQ\ A/E> A/E SGML Document binary 6010>9 string >\0 Type %s 60110 string \<!SQ\ STS> A/E SGML binary styles file 6012>9 string >\0 Type %s 60130 short 0xc0de Compiled PSI (v1) data 60140 short 0xc0da Compiled PSI (v2) data 6015>3 string >\0 (%s) 6016# Binary sqtroff font/desc files... 60170 short 0125252 SoftQuad DESC or font file binary 6018>2 short >0 - version %d 6019# Bitmaps... 60200 string SQ\ BITMAP1 SoftQuad Raster Format text 6021#0 string SQ\ BITMAP2 SoftQuad Raster Format data 6022# sqtroff intermediate language (replacement for ditroff int. lang.) 60230 string X\ SoftQuad troff Context intermediate 6024>2 string 495 for AT&T 495 laser printer 6025>2 string hp for Hewlett-Packard LaserJet 6026>2 string impr for IMAGEN imPRESS 6027>2 string ps for PostScript 6028 6029#------------------------------------------------------------------------------ 6030# spectrum: file(1) magic for Spectrum emulator files. 6031# 6032# John Elliott <jce@seasip.demon.co.uk> 6033 6034# 6035# Spectrum +3DOS header 6036# 60370 string PLUS3DOS\032 Spectrum +3 data 6038>15 byte 0 - BASIC program 6039>15 byte 1 - number array 6040>15 byte 2 - character array 6041>15 byte 3 - memory block 6042>>16 belong 0x001B0040 (screen) 6043>15 byte 4 - Tasword document 6044>15 string TAPEFILE - ZXT tapefile 6045# 6046# Tape file. This assumes the .TAP starts with a Spectrum-format header, 6047# which nearly all will. 6048# 60490 string \023\000\000 Spectrum .TAP data 6050>4 string x "%-10.10s" 6051>3 byte 0 - BASIC program 6052>3 byte 1 - number array 6053>3 byte 2 - character array 6054>3 byte 3 - memory block 6055>>14 belong 0x001B0040 (screen) 6056 6057#------------------------------------------------------------------------------ 6058# sun: file(1) magic for Sun machines 6059# 6060# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 6061# releases. (5.x uses ELF.) 6062# 60630 belong&077777777 0600413 SPARC demand paged 6064>0 byte &0x80 6065>>20 belong <4096 shared library 6066>>20 belong =4096 dynamically linked executable 6067>>20 belong >4096 dynamically linked executable 6068>0 byte ^0x80 executable 6069>16 belong >0 not stripped 60700 belong&077777777 0600410 SPARC pure 6071>0 byte &0x80 dynamically linked executable 6072>0 byte ^0x80 executable 6073>16 belong >0 not stripped 60740 belong&077777777 0600407 SPARC 6075>0 byte &0x80 dynamically linked executable 6076>0 byte ^0x80 executable 6077>16 belong >0 not stripped 6078 60790 belong&077777777 0400413 mc68020 demand paged 6080>0 byte &0x80 6081>>20 belong <4096 shared library 6082>>20 belong =4096 dynamically linked executable 6083>>20 belong >4096 dynamically linked executable 6084>16 belong >0 not stripped 60850 belong&077777777 0400410 mc68020 pure 6086>0 byte &0x80 dynamically linked executable 6087>0 byte ^0x80 executable 6088>16 belong >0 not stripped 60890 belong&077777777 0400407 mc68020 6090>0 byte &0x80 dynamically linked executable 6091>0 byte ^0x80 executable 6092>16 belong >0 not stripped 6093 60940 belong&077777777 0200413 mc68010 demand paged 6095>0 byte &0x80 6096>>20 belong <4096 shared library 6097>>20 belong =4096 dynamically linked executable 6098>>20 belong >4096 dynamically linked executable 6099>16 belong >0 not stripped 61000 belong&077777777 0200410 mc68010 pure 6101>0 byte &0x80 dynamically linked executable 6102>0 byte ^0x80 executable 6103>16 belong >0 not stripped 61040 belong&077777777 0200407 mc68010 6105>0 byte &0x80 dynamically linked executable 6106>0 byte ^0x80 executable 6107>16 belong >0 not stripped 6108 6109# reworked these to avoid anything beginning with zero becoming "old sun-2" 61100 belong 0407 old sun-2 executable 6111>16 belong >0 not stripped 61120 belong 0410 old sun-2 pure executable 6113>16 belong >0 not stripped 61140 belong 0413 old sun-2 demand paged executable 6115>16 belong >0 not stripped 6116 6117# 6118# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 6119# binary executed in compatibility mode under SunOS 5.x". 6120# 61210 belong 0x080456 SunOS core file 6122>4 belong 432 (SPARC) 6123>>132 string >\0 from '%s' 6124>>116 belong =3 (quit) 6125>>116 belong =4 (illegal instruction) 6126>>116 belong =5 (trace trap) 6127>>116 belong =6 (abort) 6128>>116 belong =7 (emulator trap) 6129>>116 belong =8 (arithmetic exception) 6130>>116 belong =9 (kill) 6131>>116 belong =10 (bus error) 6132>>116 belong =11 (segmentation violation) 6133>>116 belong =12 (bad argument to system call) 6134>>116 belong =29 (resource lost) 6135>>120 belong x (T=%dK, 6136>>124 belong x D=%dK, 6137>>128 belong x S=%dK) 6138>4 belong 826 (68K) 6139>>128 string >\0 from '%s' 6140>4 belong 456 (SPARC 4.x BCP) 6141>>152 string >\0 from '%s' 6142# Sun SunPC 61430 long 0xfa33c08e SunPC 4.0 Hard Disk 61440 string #SUNPC_CONFIG SunPC 4.0 Properties Values 6145# Sun snoop (see RFC 1761, which describes the capture file format). 6146# 61470 string snoop Snoop capture file 6148>8 belong >0 - version %ld 6149>12 belong 0 (IEEE 802.3) 6150>12 belong 1 (IEEE 802.4) 6151>12 belong 2 (IEEE 802.5) 6152>12 belong 3 (IEEE 802.6) 6153>12 belong 4 (Ethernet) 6154>12 belong 5 (HDLC) 6155>12 belong 6 (Character synchronous) 6156>12 belong 7 (IBM channel-to-channel adapter) 6157>12 belong 8 (FDDI) 6158>12 belong 9 (Unknown) 6159# Sun KCMS 616036 string acsp Kodak Color Management System, ICC Profile 6161 6162 6163#------------------------------------------------------------------------------ 6164# teapot: file(1) magic for "teapot" spreadsheet 6165# 61660 string #!teapot\012xdr teapot work sheet (XDR format) 6167 6168#------------------------------------------------------------------------------ 6169# terminfo: file(1) magic for terminfo 6170# 6171# XXX - byte order for screen images? 6172# 61730 string \032\001 Compiled terminfo entry 61740 short 0433 Curses screen image 61750 short 0434 Curses screen image 6176 6177#------------------------------------------------------------------------------ 6178# tex: file(1) magic for TeX files 6179# 6180# From <conklin@talisman.kaleida.com> 6181 6182# Although we may know the offset of certain text fields in TeX DVI 6183# and font files, we can't use them reliably because they are not 6184# zero terminated. [but we do anyway, christos] 61850 string \367\002 TeX DVI file 6186>16 string >\0 (%s) 61870 string \367\203 TeX generic font data 61880 string \367\131 TeX packed font data 6189>3 string >\0 (%s) 61900 string \367\312 TeX virtual font data 61910 string This\ is\ TeX, TeX transcript text 61920 string This\ is\ METAFONT, METAFONT transcript text 6193 6194# There is no way to detect TeX Font Metric (*.tfm) files without 6195# breaking them apart and reading the data. The following patterns 6196# match most *.tfm files generated by METAFONT or afm2tfm. 61972 string \000\021 TeX font metric data 6198>33 string >\0 (%s) 61992 string \000\022 TeX font metric data 6200>33 string >\0 (%s) 6201 6202# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 62030 string \\input\ texinfo Texinfo source text 62040 string This\ is\ Info\ file GNU Info text 6205 6206# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 62070 string \\input TeX document text 62080 string \\section LaTeX document text 62090 string \\setlength LaTeX document text 62100 string \\documentstyle LaTeX document text 62110 string \\chapter LaTeX document text 62120 string \\documentclass LaTeX 2e document text 62130 string \\relax LaTeX auxiliary file 62140 string \\contentsline LaTeX table of contents 6215 6216# Index and glossary files 62170 string \\indexentry LaTeX raw index file 62180 string \\begin{theindex} LaTeX sorted index 62190 string \\glossaryentry LaTeX raw glossary 62200 string \\begin{theglossary} LaTeX sorted glossary 62210 string This\ is\ makeindex Makeindex log file 6222# End of TeX 6223# ------------------------------------------------------------------------ 6224# ti-8x: file(1) magic for the TI-8x and TI-92 Graphing Calculators. 6225# 6226# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 6227# 6228# NOTE: This list is not complete. 6229# 6230# Magic Numbers for the TI-82 6231# 62320 string **TI82** TI-82 Graphing Calculator 6233>0x000037 byte 0x0B TI-BASIC Group/Program File. 6234# 6235# Magic Numbers for the TI-83 6236# 62370 string **TI83** TI-83 Graphing Calculator 6238>0x000037 byte 0x0B TI-BASIC Group/Program File. 6239# 6240# Magic Numbers for the TI-85 6241# 62420 string **TI85** TI-85 Graphing Calculator 6243>11 string Backup Backup File. 6244>0x000032 string ZS4 - ZShell Version 4 File. 6245>0x000032 string ZS3 - ZShell Version 3 File. 6246>0x00000B string GDatabase Graphics Database. 6247>0x00003B byte 0x12 TI-BASIC Group/Program File. 6248# 6249# Magic Numbers for the TI-92 6250# 62510 string **TI92** TI-92 Graphing Calculator 6252>0x000058 byte 0x12 TI-BASIC Group File. 6253>0x000012 string Function Function. 6254>0x000048 byte 0x12 TI-BASIC Program. 6255# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 6256# program/group magic numbers in here because I cannot find any. 62570 string **TI80** TI-80 Graphing Calculator File. 62580 string **TI81** TI-81 Graphing Calculator File. 6259 6260#------------------------------------------------------------------------------ 6261# timezone: file(1) magic for timezone data 6262# 6263# from Daniel Quinlan (quinlan@yggdrasil.com) 6264# this should work on Linux, SunOS, and maybe others 6265# Added new official magic number for recent versions of the Olson code 62660 string TZif timezone data 62670 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 62680 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 62690 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 62700 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 62710 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 62720 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 6273 6274#------------------------------------------------------------------------------ 6275# troff: file(1) magic for *roff 6276# 6277# updated by Daniel Quinlan (quinlan@yggdrasil.com) 6278 6279# troff input 62800 string .\\" troff or preprocessor input text 62810 string '\\" troff or preprocessor input text 62820 string '.\\" troff or preprocessor input text 62830 string \\" troff or preprocessor input text 62840 string ''' troff or preprocessor input text 6285 6286# ditroff intermediate output text 62870 string x\ T ditroff output text 6288>4 string cat for the C/A/T phototypesetter 6289>4 string ps for PostScript 6290>4 string dvi for DVI 6291>4 string ascii for ASCII 6292>4 string lj4 for LaserJet 4 6293>4 string latin1 for ISO 8859-1 (Latin 1) 6294>4 string X75 for xditview at 75dpi 6295>>7 string -12 (12pt) 6296>4 string X100 for xditview at 100dpi 6297>>8 string -12 (12pt) 6298 6299# output data formats 63000 string \100\357 very old (C/A/T) troff output data 6301 6302#------------------------------------------------------------------------------ 6303# typeset: file(1) magic for other typesetting 6304# 63050 string Interpress/Xerox Xerox InterPress data 6306>16 string / (version 6307>>17 string >\0 %s) 6308 6309#------------------------------------------------------------------------------ 6310# unknown: file(1) magic for unknown machines 6311# 6312# XXX - this probably should be pruned, as it'll match PDP-11 and 6313# VAX image formats. 6314# 6315# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, 6316# respectively). 6317# 6318# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't 6319# have the "version %ld", which may be a bogus COFFism (I don't think 6320# there ever was COFF for the PDP-11). 6321# 6322# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 6323# long, as it would be on a VAX. 6324# 6325# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown. 6326# 63270 short 0x107 unknown machine executable 6328>8 short >0 not stripped 6329>15 byte >0 - version %ld 63300 short 0x108 unknown pure executable 6331>8 short >0 not stripped 6332>15 byte >0 - version %ld 63330 short 0x109 PDP-11 separate I&D 6334>8 short >0 not stripped 6335>15 byte >0 - version %ld 63360 short 0x10b unknown pure executable 6337>8 short >0 not stripped 6338>15 byte >0 - version %ld 63390 long 0x10c unknown demand paged pure executable 6340>16 long >0 not stripped 63410 long 0x10d unknown demand paged pure executable 6342>16 long >0 not stripped 63430 long 0x10e unknown readable demand paged pure executable 6344 6345#------------------------------------------------------------------------------ 6346# uuencode: file(1) magic for ASCII-encoded files 6347# 6348 6349# GRR: the first line of xxencoded files is identical to that in uuencoded 6350# files, but the first character in most subsequent lines is 'h' instead of 6351# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 6352# punctuation and survives BITNET gateways better.) If regular expressions 6353# were supported, this entry could possibly be split into two with 6354# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 63550 string begin\040 uuencoded or xxencoded text 6356 6357# btoa(1) is an alternative to uuencode that requires less space. 63580 string xbtoa\ Begin btoa'd text 6359 6360# ship(1) is another, much cooler alternative to uuencode. 6361# Greg Roelofs, newt@uchicago.edu 63620 string $\012ship ship'd binary text 6363 6364# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 6365# Greg Roelofs, newt@uchicago.edu 63660 string Decode\ the\ following\ with\ bdeco bencoded News text 6367 6368# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 6369# Daniel Quinlan, quinlan@yggdrasil.com 637011 string must\ be\ converted\ with\ BinHex BinHex binary text 6371>41 string x \b, version %.3s 6372 6373# GRR: is MIME BASE64 encoding handled somewhere? 6374 6375#------------------------------------------------------------------------------ 6376# varied.out: file(1) magic for various USG systems 6377# 6378# Herewith many of the object file formats used by USG systems. 6379# Most have been moved to files for a particular processor, 6380# and deleted if they duplicate other entries. 6381# 63820 short 0610 Perkin-Elmer executable 6383# AMD 29K 63840 beshort 0572 amd 29k coff noprebar executable 63850 beshort 01572 amd 29k coff prebar executable 63860 beshort 0160007 amd 29k coff archive 6387# Cray 63886 beshort 0407 unicos (cray) executable 6389# Ultrix 4.3 6390596 string \130\337\377\377 Ultrix core file 6391>600 string >\0 from '%s' 6392# BeOS and MAcOS PEF executables 6393# From: hplus@zilker.net (Jon Watte) 63940 string Joy!peffpwpc header for PowerPC PEF executable 6395# 6396# ava assembler/linker Uros Platise <uros.platise@ijs.si> 63970 string avaobj AVR assembler object code 6398>7 string >\0 version '%s' 6399# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 64000 string gmon GNU prof performance data 6401>4 long x - version %ld 6402 6403#------------------------------------------------------------------------------ 6404# vax: file(1) magic for VAX executable/object and APL workspace 6405# 64060 lelong 0101557 VAX single precision APL workspace 64070 lelong 0101556 VAX double precision APL workspace 6408 6409# 6410# VAX a.out (32V, BSD) 6411# 64120 lelong 0407 VAX executable 6413>16 lelong >0 not stripped 6414 64150 lelong 0410 VAX pure executable 6416>16 lelong >0 not stripped 6417 64180 lelong 0413 VAX demand paged pure executable 6419>16 lelong >0 not stripped 6420 64210 lelong 0420 VAX demand paged (first page unmapped) pure executable 6422>16 lelong >0 not stripped 6423 6424# 6425# VAX COFF 6426# 6427# The `versions' should be un-commented if they work for you. 6428# (Was the problem just one of endianness?) 6429# 64300 leshort 0570 VAX COFF executable 6431>12 lelong >0 not stripped 6432>22 leshort >0 - version %ld 64330 leshort 0575 VAX COFF pure executable 6434>12 lelong >0 not stripped 6435>22 leshort >0 - version %ld 6436 6437#------------------------------------------------------------------------------ 6438# vicar: file(1) magic for VICAR files. 6439# 6440# From: Ossama Othman <othman@astrosun.tn.cornell.edu 6441# VICAR is JPL's in-house spacecraft image processing program 6442# VICAR image 64430 string LBLSIZE= VICAR image data 6444>32 string BYTE \b, 8 bits = VAX byte 6445>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 6446>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 6447>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 6448>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 6449>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 6450# VICAR label file 645143 string SFDU_LABEL VICAR label file 6452 6453#------------------------------------------------------------------------------ 6454# visx: file(1) magic for Visx format files 6455# 64560 short 0x5555 VISX image file 6457>2 byte 0 (zero) 6458>2 byte 1 (unsigned char) 6459>2 byte 2 (short integer) 6460>2 byte 3 (float 32) 6461>2 byte 4 (float 64) 6462>2 byte 5 (signed char) 6463>2 byte 6 (bit-plane) 6464>2 byte 7 (classes) 6465>2 byte 8 (statistics) 6466>2 byte 10 (ascii text) 6467>2 byte 15 (image segments) 6468>2 byte 100 (image set) 6469>2 byte 101 (unsigned char vector) 6470>2 byte 102 (short integer vector) 6471>2 byte 103 (float 32 vector) 6472>2 byte 104 (float 64 vector) 6473>2 byte 105 (signed char vector) 6474>2 byte 106 (bit plane vector) 6475>2 byte 121 (feature vector) 6476>2 byte 122 (feature vector library) 6477>2 byte 124 (chain code) 6478>2 byte 126 (bit vector) 6479>2 byte 130 (graph) 6480>2 byte 131 (adjacency graph) 6481>2 byte 132 (adjacency graph library) 6482>2 string .VISIX (ascii text) 6483 6484#------------------------------------------------------------------------------ 6485# vms: file(1) magic for VMS executables (experimental) 6486# 6487# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 6488 6489# GRR 950122: I'm just guessing on these, based on inspection of the headers 6490# of three executables each for Alpha and VAX architectures. The VAX files 6491# all had headers similar to this: 6492# 6493# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 6494# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 6495# 64960 string \xb0\0\x30\0 VMS VAX executable 6497>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 6498# 6499# The AXP files all looked like this, except that the byte at offset 0x22 6500# was 06 in some of them and 07 in others: 6501# 6502# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 6503# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 6504# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 6505# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 6506# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 6507# 65080 belong 0x03000000 VMS Alpha executable 6509>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 6510 6511# ----------------------------------------------------------- 6512# VMware specific files (deducted from version 1.1 and log file entries) 6513# Anthon van der Neut (anthon@mnt.org) 65140 belong 0x4d52564e VMware nvram 65150 belong 0x434f5744 6516>8 byte 3 VMware virtual disk 6517>>32 lelong x (%d/ 6518>>36 lelong x \b%d/ 6519>>40 lelong x \b%d) 6520>8 byte 2 VMware undoable disk 6521>>32 string >\0 (%s) 6522#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 65230 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text 6524>15 byte 0 Optimized for Intel 6525>15 byte 1 Optimized for Non-Intel 65261 string WPC (Corel/WP) 6527>8 short 257 WordPerfect macro 6528>8 short 258 WordPerfect help file 6529>8 short 259 WordPerfect keyboard file 6530>8 short 266 WordPerfect document 6531>8 short 267 WordPerfect dictionary 6532>8 short 268 WordPerfect thesaurus 6533>8 short 269 WordPerfect block 6534>8 short 270 WordPerfect rectangular block 6535>8 short 271 WordPerfect column block 6536>8 short 272 WordPerfect printer data 6537>8 short 275 WordPerfect printer data 6538>8 short 276 WordPerfect driver resource data 6539>8 short 279 WordPerfect hyphenation code 6540>8 short 280 WordPerfect hyphenation data 6541>8 short 281 WordPerfect macro resource data 6542>8 short 283 WordPerfect hyphenation lex 6543>8 short 285 WordPerfect wordlist 6544>8 short 286 WordPerfect equation resource data 6545>8 short 289 WordPerfect spell rules 6546>8 short 290 WordPerfect dictionary rules 6547>8 short 295 WordPerfect spell rules (Microlytics) 6548>8 short 299 WordPerfect settings file 6549>8 short 301 WordPerfect 4.2 document 6550>8 short 325 WordPerfect dialog file 6551>8 short 332 WordPerfect button bar 6552>8 short 513 Shell macro 6553>8 short 522 Shell definition 6554>8 short 769 Notebook macro 6555>8 short 770 Notebook help file 6556>8 short 771 Notebook keyboard file 6557>8 short 778 Notebook definition 6558>8 short 1026 Calculator help file 6559>8 short 1538 Calendar help file 6560>8 short 1546 Calendar data file 6561>8 short 1793 Editor macro 6562>8 short 1794 Editor help file 6563>8 short 1795 Editor keyboard file 6564>8 short 1817 Editor macro resource file 6565>8 short 2049 Macro editor macro 6566>8 short 2050 Macro editor help file 6567>8 short 2051 Macro editor keyboard file 6568>8 short 2305 PlanPerfect macro 6569>8 short 2306 PlanPerfect help file 6570>8 short 2307 PlanPerfect keyboard file 6571>8 short 2314 PlanPerfect worksheet 6572>8 short 2319 PlanPerfect printer definition 6573>8 short 2322 PlanPerfect graphic definition 6574>8 short 2323 PlanPerfect data 6575>8 short 2324 PlanPerfect temporary printer 6576>8 short 2329 PlanPerfect macro resource data 6577>8 byte 11 Mail 6578>8 short 2818 help file 6579>8 short 2821 distribution list 6580>8 short 2826 out box 6581>8 short 2827 in box 6582>8 short 2836 users archived mailbox 6583>8 short 2837 archived message database 6584>8 short 2838 archived attachments 6585>8 short 3083 Printer temporary file 6586>8 short 3330 Scheduler help file 6587>8 short 3338 Scheduler in file 6588>8 short 3339 Scheduler out file 6589>8 short 3594 GroupWise settings file 6590>8 short 3601 GroupWise directory services 6591>8 short 3627 GroupWise settings file 6592>8 short 4362 Terminal resource data 6593>8 short 4363 Terminal resource data 6594>8 short 4395 Terminal resource data 6595>8 short 4619 GUI loadable text 6596>8 short 4620 graphics resource data 6597>8 short 4621 printer settings file 6598>8 short 4622 port definition file 6599>8 short 4623 print queue parameters 6600>8 short 4624 compressed file 6601>8 short 5130 Network service msg file 6602>8 short 5131 Network service msg file 6603>8 short 5132 Async gateway login msg 6604>8 short 5134 GroupWise message file 6605>8 short 7956 GroupWise admin domain database 6606>8 short 7957 GroupWise admin host database 6607>8 short 7959 GroupWise admin remote host database 6608>8 short 7960 GroupWise admin ADS deferment data file 6609>8 short 8458 IntelliTAG (SGML) compiled DTD 6610>8 long 18219264 WordPerfect graphic image (1.0) 6611>8 long 18219520 WordPerfect graphic image (2.0) 6612#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 6613 6614#------------------------------------------------------------------------------ 6615# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 6616# 66170 string %XDELTA% XDelta binary patch file 0.14 66180 string %XDZ000% XDelta binary patch file 0.18 66190 string %XDZ001% XDelta binary patch file 0.20 66200 string %XDZ002% XDelta binary patch file 1.0 66210 string %XDZ003% XDelta binary patch file 1.0.4 66220 string %XDZ004% XDelta binary patch file 1.1 6623 6624#------------------------------------------------------------------------------ 6625# xenix: file(1) magic for Microsoft Xenix 6626# 6627# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 6628# model" lifted from "magic.xenix", with comment "derived empirically; 6629# treat as folklore until proven" 6630# 6631# "small model", "large model", "huge model" stuff lifted from XXX 6632# 6633# XXX - "x.out" collides with PDP-11 archives 6634# 66350 string core core file (Xenix) 66360 byte 0x80 8086 relocatable (Microsoft) 66370 leshort 0xff65 x.out 6638>2 string __.SYMDEF randomized 6639>0 byte x archive 66400 leshort 0x206 Microsoft a.out 6641>8 leshort 1 Middle model 6642>0x1e leshort &0x10 overlay 6643>0x1e leshort &0x2 separate 6644>0x1e leshort &0x4 pure 6645>0x1e leshort &0x800 segmented 6646>0x1e leshort &0x400 standalone 6647>0x1e leshort &0x8 fixed-stack 6648>0x1c byte &0x80 byte-swapped 6649>0x1c byte &0x40 word-swapped 6650>0x10 lelong >0 not-stripped 6651>0x1e leshort ^0xc000 pre-SysV 6652>0x1e leshort &0x4000 V2.3 6653>0x1e leshort &0x8000 V3.0 6654>0x1c byte &0x4 86 6655>0x1c byte &0xb 186 6656>0x1c byte &0x9 286 6657>0x1c byte &0xa 386 6658>0x1f byte <0x040 small model 6659>0x1f byte =0x048 large model 6660>0x1f byte =0x049 huge model 6661>0x1e leshort &0x1 executable 6662>0x1e leshort ^0x1 object file 6663>0x1e leshort &0x40 Large Text 6664>0x1e leshort &0x20 Large Data 6665>0x1e leshort &0x120 Huge Objects Enabled 6666>0x10 lelong >0 not stripped 6667 66680 leshort 0x140 old Microsoft 8086 x.out 6669>0x3 byte &0x4 separate 6670>0x3 byte &0x2 pure 6671>0 byte &0x1 executable 6672>0 byte ^0x1 relocatable 6673>0x14 lelong >0 not stripped 6674 66750 lelong 0x206 b.out 6676>0x1e leshort &0x10 overlay 6677>0x1e leshort &0x2 separate 6678>0x1e leshort &0x4 pure 6679>0x1e leshort &0x800 segmented 6680>0x1e leshort &0x400 standalone 6681>0x1e leshort &0x1 executable 6682>0x1e leshort ^0x1 object file 6683>0x1e leshort &0x4000 V2.3 6684>0x1e leshort &0x8000 V3.0 6685>0x1c byte &0x4 86 6686>0x1c byte &0xb 186 6687>0x1c byte &0x9 286 6688>0x1c byte &0x29 286 6689>0x1c byte &0xa 386 6690>0x1e leshort &0x4 Large Text 6691>0x1e leshort &0x2 Large Data 6692>0x1e leshort &0x102 Huge Objects Enabled 6693 66940 leshort 0x580 XENIX 8086 relocatable or 80286 small model 6695 6696#------------------------------------------------------------------------------ 6697# zilog: file(1) magic for Zilog Z8000. 6698# 6699# Was it big-endian or little-endian? My Product Specification doesn't 6700# say. 6701# 67020 long 0xe807 object file (z8000 a.out) 67030 long 0xe808 pure object file (z8000 a.out) 67040 long 0xe809 separate object file (z8000 a.out) 67050 long 0xe805 overlay object file (z8000 a.out) 6706 6707#------------------------------------------------------------------------------ 6708# zyxel: file(1) magic for ZyXEL modems 6709# 6710# From <rob@pe1chl.ampr.org> 6711# These are the /etc/magic entries to decode datafiles as used for the 6712# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 6713# ZyXEL-defined standard) 6714 67150 string ZyXEL\002 ZyXEL voice data 6716>10 byte 0 - CELP encoding 6717>10 byte&0x0B 1 - ADPCM2 encoding 6718>10 byte&0x0B 2 - ADPCM3 encoding 6719>10 byte&0x0B 3 - ADPCM4 encoding 6720>10 byte&0x0B 8 - New ADPCM3 encoding 6721>10 byte&0x04 4 with resync 6722