1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@astron.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# https://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address 0x%x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address 0x%x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes 0x%x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries 0x%x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#https://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (https://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $ 253# 254# aes: magic file for AES encrypted files 255 256# Summary: AES Crypt Encrypted Data File 257# From: Joerg Jenderek 258# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard 259# Reference: https://www.aescrypt.com/aes_file_format.html 2600 string AES 261>3 ubyte <3 AES encrypted data, version %u 262#!:mime application/aes 263!:mime application/x-aes-encrypted 264!:ext aes 265# For Version 2 the encrypted file can have text tags 266>>3 ubyte =2 267# length of an extension identifier and contents like: 0 24 33 38 268#>>5 ubeshort x \b, tag length %u 269#>>5 pstring/H x '%s' 270# standard extension tags like CREATED_BY 271>>>7 string CREATED_BY \b, created by 272# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ... 273>>>>&1 string x "%s" 274# TODO: more other tags 275# tag CREATED_DATE like YYYY-MM-DD 276# tag CREATED_TIME like HH:MM:SS 277# 278 279 280#------------------------------------------------------------------------------ 281# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ 282# algol68: file(1) magic for Algol 68 source 283# 2840 search/8192 (input, Algol 68 source text 285!:mime text/x-Algol68 2860 regex/1024 \^PROC Algol 68 source text 287!:mime text/x-Algol68 2880 regex/1024 \bMODE[\t\ ] Algol 68 source text 289!:mime text/x-Algol68 2900 regex/1024 \bREF[\t\ ] Algol 68 source text 291!:mime text/x-Algol68 2920 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text 293!:mime text/x-Algol68 294#0 regex [\t\ ]OD Algol 68 source text 295#!:mime text/x-Algol68 296#0 regex [\t\ ]FI Algol 68 source text 297#!:mime text/x-Algol68 298 299#------------------------------------------------------------------------------ 300# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 301# allegro: file(1) magic for Allegro datafiles 302# Toby Deshane <hac@shoelace.digivill.net> 303# 3040 belong 0x736C6821 Allegro datafile (packed) 3050 belong 0x736C682E Allegro datafile (not packed/autodetect) 3060 belong 0x736C682B Allegro datafile (appended exe data) 307 308#------------------------------------------------------------------------------ 309# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 310# alliant: file(1) magic for Alliant FX series a.out files 311# 312# If the FX series is the one that had a processor with a 68K-derived 313# instruction set, the "short" should probably become "beshort" and the 314# "long" should probably become "belong". 315# If it's the i860-based one, they should probably become either the 316# big-endian or little-endian versions, depending on the mode they ran 317# the 860 in.... 318# 3190 short 0420 0420 Alliant virtual executable 320>2 short &0x0020 common library 321>16 long >0 not stripped 3220 short 0421 0421 Alliant compact executable 323>2 short &0x0020 common library 324>16 long >0 not stripped 325 326#------------------------------------------------------------------------------ 327# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 328# amanda: file(1) magic for amanda file format 329# 3300 string AMANDA:\ AMANDA 331>8 string TAPESTART\ DATE tape header file, 332>>23 string X 333>>>25 string >\ Unused %s 334>>23 string >\ DATE %s 335>8 string FILE\ dump file, 336>>13 string >\ DATE %s 337 338#------------------------------------------------------------------------------ 339# $File: amigaos,v 1.18 2020/08/02 16:42:00 christos Exp $ 340# amigaos: file(1) magic for AmigaOS binary formats: 341 342# 343# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 344# 3450 belong 0x000003fa AmigaOS shared library 3460 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3470 belong 0x000003e7 AmigaOS object/library data 348# 3490 beshort 0xe310 Amiga Workbench 350>2 beshort 1 351>>48 byte 1 disk icon 352>>48 byte 2 drawer icon 353>>48 byte 3 tool icon 354>>48 byte 4 project icon 355>>48 byte 5 garbage icon 356>>48 byte 6 device icon 357>>48 byte 7 kickstart icon 358>>48 byte 8 workbench application icon 359>2 beshort >1 icon, vers. %d 360# 361# various sound formats from the Amiga 362# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 363# 3640 string FC14 Future Composer 1.4 Module sound file 3650 string SMOD Future Composer 1.3 Module sound file 3660 string AON4artofnoise Art Of Noise Module sound file 3671 string MUGICIAN/SOFTEYES Mugician Module sound file 36858 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3690 string Synth4.0 Synthesis Module sound file 3700 string ARP. The Holy Noise Module sound file 3710 string BeEp\0 JamCracker Module sound file 3720 string COSO\0 Hippel-COSO Module sound file 373# Too simple (short, pure ASCII, deep), MPi 374#26 string V.3 Brian Postma's Soundmon Module sound file v3 375#26 string BPSM Brian Postma's Soundmon Module sound file v3 376#26 string V.2 Brian Postma's Soundmon Module sound file v2 377 378# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3790 beshort 0x0f00 AmigaOS bitmap font 3800 beshort 0x0f03 AmigaOS outline font 3810 belong 0x80001001 AmigaOS outline tag 3820 string ##\ version catalog translation 3830 string EMOD\0 Amiga E module 3848 string ECXM\0 ECX module 3850 string/c @database AmigaGuide file 386 387# Amiga disk types 388# display information like volume name of root block on Amiga (floppy) disk 3890 name adf-rootblock 390# block primary type = T_HEADER (value 2) 391>0x000 ubelong !2 \b, type %u 392# header_key; unused in rootblock (value 0) 393>0x004 ubelong !0 \b, header_key %u 394# high_seq; unused (value 0) 395>0x008 ubelong !0 \b, high_seq %u 396# ht_size; hash table size; 0x48 for flopies 397>0x00c ubelong !0x48 \b, hash table size 0x%x 398# bm_flag; bitmap flag, -1 means VALID 399>0x138 belong !-1 \b, bitmap flag 0x%x 400# bm_ext; first bitmap extension block (Hard disks only) 401>0x1A0 ubelong !0 \b, bitmap extension block 0x%x 402# name_len; volume name length; diskname[30]; volume name 403>0x1B0 pstring >\0 \b, "%s" 404# first directory cache block for FFS; otherwise 0 405>0x1F8 ubelong !0 \b, directory cache block 0x%x 406# block secondary type = ST_ROOT (value 1) 407>0x1FC ubelong !1 \b, sec_type 0x%x 408# 4090 string RDSK Rigid Disk Block 410>160 string x on %.24s 411# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga) 412# https://en.wikipedia.org/wiki/Amiga_Fast_File_System 413# Reference: http://lclevy.free.fr/adflib/adf_info.html 414# Update: Joerg Jenderek 415# Note: created by ADFOpus.exe 416# and verified by `unadf -l TURBO_SILVER_SV.ADF` 4170 string DOS 418# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG 419>3 ubyte <8 Amiga 420# https://reposcope.com/mimetype/application/x-amiga-disk-format 421!:mime application/x-amiga-disk-format 422!:ext adf 423>>3 ubyte 0 DOS disk 424>>3 ubyte 1 FFS disk 425>>3 ubyte 2 Inter DOS disk 426>>3 ubyte 3 Inter FFS disk 427# For Fastdir mode the international mode is also enabled, 428>>3 ubyte 4 Fastdir DOS disk 429>>3 ubyte 5 Fastdir FFS dis 430# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)" 431>>3 ubyte 6 Inter Fastdir DOS disk 432# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)" 433>>3 ubyte 7 Inter Fastdir FFS disk 434# but according to Wikipedia variants with long name support 435#>>3 ubyte 6 long name DOS disk 436#>>3 ubyte 7 long name FFS disk 437# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h 438#>>-0 offset x \b, %lld bytes 439# Correct file size, but next lines are NOT executed 440#>>-0 offset 901120 (DD 880 KiB floppy) 441# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2 442>>0x6E00C ubelong 0x48 443>>>0x6E000 ubelong 2 (DD 880 KiB) 444# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48 445>>0xDC00C ubelong 0x48 446>>>0xDC000 ubelong 2 (HD 1760 KiB) 447# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ... 448#>>4 ubelong x \b, CRC 0x%x 449# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF) 450>>8 ubelong >0 \b, probably root block %d 451# bootblock code 452>>12 quad !0 \b, bootable 453# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6) 454>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0 455>>>12 default x 456>>>>12 ubequad !0x43fa003e70254eae 0x%llx.. 457# 880 KiB Double Density floppy disk (901120 bytes) 458>>0x6E00C ubelong 0x48 459>>>0x6E000 ubelong 2 460>>>>0x6E000 use adf-rootblock 461# 1760 KiB High Density floppy disk (1802240 bytes) 462>>0xDC00C ubelong 0x48 463>>>0xDC000 ubelong 2 464>>>>0xDC000 use adf-rootblock 465# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq 466>>0x80000 ubelong 2 467>>>0x80004 quad 0 468>>>>0x80000 use adf-rootblock 469# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB 470#>>0x100000 ubelong x 2 MiB TEST 471#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock 472#>>>0x100000 use adf-rootblock 4730 string KICK Kickstart disk 474 475# From: Alex Beregszaszi <alex@fsn.hu> 4760 string LZX LZX compressed archive (Amiga) 477 478# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 4790 string .KEY AmigaDOS script 4800 string .key AmigaDOS script 481 482# AMOS Basic file formats 483# https://www.exotica.org.uk/wiki/AMOS_file_formats 4840 string AMOS\040Basic\040 AMOS Basic source code 485>11 byte =0x56 \b, tested 486>11 byte =0x76 \b, untested 4870 string AMOS\040Pro AMOS Basic source code 488>11 byte =0x56 \b, tested 489>11 byte =0x76 \b, untested 4900 string AmSp AMOS Basic sprite bank 491>4 beshort x \b, %d sprites 4920 string AmIc AMOS Basic icon bank 493>4 beshort x \b, %d icons 4940 string AmBk AMOS Basic memory bank 495>4 beshort x \b, bank number %d 496>8 belong&0xFFFFFFF x \b, length %d 497>12 regex .{8} \b, type %s 4980 string AmBs AMOS Basic memory banks 499>4 beshort x \b, %d banks 500 501#------------------------------------------------------------ 502# $File: android,v 1.18 2021/02/23 00:51:10 christos Exp $ 503# Various android related magic entries 504#------------------------------------------------------------ 505 506# Dalvik .dex format. http://retrodev.com/android/dexformat.html 507# From <mkf@google.com> "Mike Fleming" 508# Fixed to avoid regexec 17 errors on some dex files 509# From <diff@lookout.com> "Tim Strazzere" 5100 string dex\n 511>0 regex dex\n[0-9]{2}\0 Dalvik dex file 512>4 string >000 version %s 5130 string dey\n 514>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 515>4 string >000 version %s 516 517# Android bootimg format 518# From https://android.googlesource.com/\ 519# platform/system/core/+/master/mkbootimg/bootimg.h 520# https://github.com/djrbliss/loki/blob/master/loki.h#L43 5210 string ANDROID! Android bootimg 522>1024 string LOKI \b, LOKI'd 523>>1028 lelong 0 \b (boot) 524>>1028 lelong 1 \b (recovery) 525>8 lelong >0 \b, kernel 526>>12 lelong >0 \b (0x%x) 527>16 lelong >0 \b, ramdisk 528>>20 lelong >0 \b (0x%x) 529>24 lelong >0 \b, second stage 530>>28 lelong >0 \b (0x%x) 531>36 lelong >0 \b, page size: %d 532>38 string >0 \b, name: %s 533>64 string >0 \b, cmdline (%s) 534 535# Android Backup archive 536# From: Ariel Shkedi 537# Update: Joerg Jenderek 538# URL: https://github.com/android/platform_frameworks_base/blob/\ 539# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 540# android/server/BackupManagerService.java#L2367 541# Reference: https://sourceforge.net/projects/adbextractor/ 542# android-backup-extractor/perl/backupencrypt.pl 543# Note: only unix line feeds "\n" found 544# After the header comes a tar file 545# If compressed, the entire tar file is compressed with JAVA deflate 546# 547# Include the version number hardcoded with the magic string to avoid 548# false positives 5490 string/b ANDROID\ BACKUP\n Android Backup 550# maybe look for some more characteristics like linefeed '\n' or version 551#>16 string \n 552# No mime-type defined officially 553!:mime application/x-google-ab 554!:ext ab 555# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) 556>15 string >\0 \b, version %s 557# "1" on 3rd line means compressed 558>17 string 0\n \b, Not-Compressed 559>17 string 1\n \b, Compressed 560# The 4th line is encryption "none" or "AES-256" 561# any string as long as it's not the word none (which is matched below) 562>19 string none\n \b, Not-Encrypted 563# look for backup content after line with encryption info 564#>>19 search/7 \n 565# data part after header for not encrypted Android Backup 566#>>>&0 ubequad x \b, content 0x%16.16llx... 567# look for zlib compressed by ./compress after message with 1 space at end 568#>>>&0 indirect x \b; contains 569# look for tar archive block by ./archive for package name manifest 570>>288 string ustar \b; contains 571>>>31 use tar-file 572# look for zip/jar archive by ./archive ./zip after message with 1 space at end 573#>>2079 search/1025/s PK\003\004 \b; contains 574#>>>&0 indirect x 575>19 string !none 576>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 577# Commented out because they don't seem useful to print 578# (but they are part of the header - the tar file comes after them): 579# The 5th line is User Password Salt (128 Hex) 580# string length too high with standard src configuration 581#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" 582#>>>&1 regex/1l .* \b, Password salt: %s 583# The 6th line is Master Key Checksum Salt (128 Hex) 584#>>>>&1 regex/1l .* \b, Master salt: %s 585# The 7th line is Number of PBDKF2 Rounds (10000) 586#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 587# The 8th line is User key Initialization Vector (IV) (32 Hex) 588#>>>>>>&1 regex/1l .* \b, IV: %s 589#>>>>>>&1 regex/1l .* \b, IV: %s 590# The 9th line is Master IV+Key+Checksum (192 Hex) 591#>>>>>>>&1 regex/1l .* \b, Key: %s 592# look for new line separator char after line number 9 593#>>>0x204 ubyte 0x0a NL found 594#>>>>&1 ubequad x \b, Content magic %16.16llx 595 596# *.pit files by Joerg Jenderek 597# https://forum.xda-developers.com/showthread.php?p=9122369 598# https://forum.xda-developers.com/showthread.php?t=816449 599# Partition Information Table for Samsung's smartphone with Android 600# used by flash software Odin 6010 ulelong 0x12349876 602# 1st pit entry marker 603>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 604# minimal 13 and maximal 18 PIT entries found 605>>4 ulelong <128 Partition Information Table for Samsung smartphone 606>>>4 ulelong x \b, %d entries 607# 1. pit entry 608>>>4 ulelong >0 \b; #1 609>>>0x01C use PIT-entry 610>>>4 ulelong >1 \b; #2 611>>>0x0A0 use PIT-entry 612>>>4 ulelong >2 \b; #3 613>>>0x124 use PIT-entry 614>>>4 ulelong >3 \b; #4 615>>>0x1A8 use PIT-entry 616>>>4 ulelong >4 \b; #5 617>>>0x22C use PIT-entry 618>>>4 ulelong >5 \b; #6 619>>>0x2B0 use PIT-entry 620>>>4 ulelong >6 \b; #7 621>>>0x334 use PIT-entry 622>>>4 ulelong >7 \b; #8 623>>>0x3B8 use PIT-entry 624>>>4 ulelong >8 \b; #9 625>>>0x43C use PIT-entry 626>>>4 ulelong >9 \b; #10 627>>>0x4C0 use PIT-entry 628>>>4 ulelong >10 \b; #11 629>>>0x544 use PIT-entry 630>>>4 ulelong >11 \b; #12 631>>>0x5C8 use PIT-entry 632>>>4 ulelong >12 \b; #13 633>>>>0x64C use PIT-entry 634# 14. pit entry 635>>>4 ulelong >13 \b; #14 636>>>>0x6D0 use PIT-entry 637>>>4 ulelong >14 \b; #15 638>>>0x754 use PIT-entry 639>>>4 ulelong >15 \b; #16 640>>>0x7D8 use PIT-entry 641>>>4 ulelong >16 \b; #17 642>>>0x85C use PIT-entry 643# 18. pit entry 644>>>4 ulelong >17 \b; #18 645>>>0x8E0 use PIT-entry 646 6470 name PIT-entry 648# garbage value implies end of pit entries 649>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 650# skip empty partition name 651>>0x24 ubyte !0 652# partition name 653>>>0x24 string >\0 %-.32s 654# flags 655>>>0x0C ulelong&0x00000002 2 \b+RW 656# partition ID: 657# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER 658# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 659>>>0x08 ulelong x (0x%x) 660# filename 661>>>0x44 string >\0 "%-.64s" 662#>>>0x18 ulelong >0 663# blocksize in 512 byte units ? 664#>>>>0x18 ulelong x \b, %db 665# partition size in blocks ? 666#>>>>0x22 ulelong x \b*%d 667 668# Android sparse img format 669# From https://android.googlesource.com/\ 670# platform/system/core/+/master/libsparse/sparse_format.h 6710 lelong 0xed26ff3a Android sparse image 672>4 leshort x \b, version: %d 673>6 leshort x \b.%d 674>16 lelong x \b, Total of %d 675>12 lelong x \b %d-byte output blocks in 676>20 lelong x \b %d input chunks. 677 678# Android binary XML magic 679# In include/androidfw/ResourceTypes.h: 680# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 681# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 6820 lelong 0x00080003 Android binary XML 683 684# Android cryptfs footer 685# From https://android.googlesource.com/\ 686# platform/system/vold/+/refs/heads/master/cryptfs.h 6870 lelong 0xd0b5b1c4 Android cryptfs footer 688>4 leshort x \b, version: %d 689>6 leshort x \b.%d 690 691# Android Vdex format 692# From https://android.googlesource.com/\ 693# platform/art/+/master/runtime/vdex_file.h 6940 string vdex Android vdex file, 695>4 string >000 verifier deps version: %s, 696>8 string >000 dex section version: %s, 697>12 lelong >0 number of dex files: %d, 698>16 lelong >0 verifier deps size: %d 699 700# Android Vdex format, dexfile is currently being updated 701# by android system 702# From https://android.googlesource.com/\ 703# platform/art/+/master/dex2oat/dex2oat.cc 7040 string wdex Android vdex file, being processed by dex2oat, 705>4 string >000 verifier deps version: %s, 706>8 string >000 dex section version: %s, 707>12 lelong >0 number of dex files: %d, 708>16 lelong >0 verifier deps size: %d 709 710#------------------------------------------------------------------------------ 711# $File: animation,v 1.85 2021/03/14 16:36:53 christos Exp $ 712# animation: file(1) magic for animation/movie formats 713# 714# animation formats 715# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 716# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 717 718# SGI and Apple formats 7190 string MOVI Silicon Graphics movie file 720!:mime video/x-sgi-movie 7214 string moov Apple QuickTime 722!:mime video/quicktime 723>12 string mvhd \b movie (fast start) 724>12 string mdra \b URL 725>12 string cmov \b movie (fast start, compressed header) 726>12 string rmra \b multiple URLs 7274 string mdat Apple QuickTime movie (unoptimized) 728!:mime video/quicktime 729#4 string wide Apple QuickTime movie (unoptimized) 730#!:mime video/quicktime 731#4 string skip Apple QuickTime movie (modified) 732#!:mime video/quicktime 733#4 string free Apple QuickTime movie (modified) 734#!:mime video/quicktime 7354 string idsc Apple QuickTime image (fast start) 736!:mime image/x-quicktime 737#4 string idat Apple QuickTime image (unoptimized) 738#!:mime image/x-quicktime 7394 string pckg Apple QuickTime compressed archive 740!:mime application/x-quicktime-player 7414 string/W jP JPEG 2000 image 742!:mime image/jp2 743 744#### MP4 #### 745# https://www.ftyps.com/ with local additions 746# https://cconcolato.github.io/mp4ra/filetype.html 7474 string ftyp ISO Media 748# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 749>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 750>>96 string x \b, Audio "%.4s" 751>>118 beshort x at %dHz 752>>140 string x \b, Video "%.4s" 753>>168 beshort x %d 754>>170 beshort x \bx%d 755>8 string 3g2 \b, MPEG v4 system, 3GPP2 756!:mime video/3gpp2 757>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 758>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 759>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 760# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 761# Section 8.1.1, corresponds to a, b, c 762>>11 byte 0x61 \b C.S0050-0 V1.0 763>>11 byte 0x62 \b C.S0050-0-A V1.0.0 764>>11 byte 0x63 \b C.S0050-0-B V1.0 765>8 string 3ge \b, MPEG v4 system, 3GPP 766!:mime video/3gpp 767>>11 byte 6 \b, Release %d MBMS Extended Presentations 768>>11 byte 7 \b, Release %d MBMS Extended Presentations 769>>11 byte 9 \b, Release %d MBMS Extended Presentations 770>8 string 3gf \b, MPEG v4 system, 3GPP 771>>11 byte 9 \b, Release %d File-delivery profile 772>8 string 3gg \b, MPEG v4 system, 3GPP 773!:mime video/3gpp 774>>11 byte 6 \b, Release %d General Profile 775>>11 byte 9 \b, Release %d General Profile 776>8 string 3gh \b, MPEG v4 system, 3GPP 777!:mime video/3gpp 778>>11 byte 9 \b, Release %d Adaptive Streaming Profile 779>8 string 3gm \b, MPEG v4 system, 3GPP 780!:mime video/3gpp 781>>11 byte 9 \b, Release %d Media Segment Profile 782>8 string 3gp \b, MPEG v4 system, 3GPP 783!:mime video/3gpp 784>>11 byte 1 \b, Release %d (non existent) 785>>11 byte 2 \b, Release %d (non existent) 786>>11 byte 3 \b, Release %d (non existent) 787>>11 byte 4 \b, Release %d 788>>11 byte 5 \b, Release %d 789>>11 byte 6 \b, Release %d 790>>11 byte 7 \b, Release %d Streaming Servers 791>8 string 3gr \b, MPEG v4 system, 3GPP 792!:mime video/3gpp 793>>11 byte 6 \b, Release %d Progressive Download Profile 794>>11 byte 9 \b, Release %d Progressive Download Profile 795>8 string 3gs \b, MPEG v4 system, 3GPP 796!:mime video/3gpp 797>>11 byte 6 \b, Release %d Streaming Servers 798>>11 byte 7 \b, Release %d Streaming Servers 799>>11 byte 9 \b, Release %d Streaming Servers 800>8 string 3gt \b, MPEG v4 system, 3GPP 801!:mime video/3gpp 802>>11 byte 8 \b, Release %d Media Stream Recording Profile 803>>11 byte 9 \b, Release %d Media Stream Recording Profile 804>8 string ARRI \b, MPEG v4 system, ARRI Digital Camera 805!:mime video/mp4 806>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 807!:mime video/mp4 808>8 string bbxm \b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio 809!:mime video/mp4 810>8 string/W qt \b, Apple QuickTime movie 811!:mime video/quicktime 812>8 string CAEP \b, Canon Digital Camera 813>8 string caqv \b, Casio Digital Camera 814>8 string CDes \b, Convergent Design 815>8 string caaa \b, CMAF Media Profile - AAC Adaptive Audio 816>8 string caac \b, CMAF Media Profile - AAC Core 817>8 string caqv \b, Casio Digital Camera Casio 818>8 string ccea \b, CMAF Supplemental Data - CEA-608/708 819>8 string ccff \b, Common container file format 820>8 string cfhd \b, CMAF Media Profile - AVC HD 821>8 string cfsd \b, CMAF Media Profile - AVC SD 822>8 string chd1 \b, CMAF Media Profile - HEVC HDR10 823>8 string chdf \b, CMAF Media Profile - AVC HDHF 824>8 string chhd \b, CMAF Media Profile - HEVC HHD8 825>8 string chh1 \b, CMAF Media Profile - HEVC HHD10 826>8 string clg1 \b, CMAF Media Profile - HEVC HLG10 827>8 string cmfc \b, CMAF Track Format 828>8 string cmff \b, CMAF Fragment Format 829>8 string cmfl \b, CMAF Chunk Format 830>8 string cmfs \b, CMAF Segment Format 831>8 string cud1 \b, CMAF Media Profile - HEVC UHD10 832>8 string cud8 \b, CMAF Media Profile - HEVC UHD8 833>8 string cwvt \b, CMAF Media Profile - WebVTT 834>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 835>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 836>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 837>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 838>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 839>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 840>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 841>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 842>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 843!:mime video/mp4 844>8 string dby1 \b, MP4 files with Dolby content 845>8 string dsms \b, Media Segment DASH conformant 846>8 string dts1 \b, MP4 track file with audio codecs dtsc dtsh or dtse 847>8 string dts2 \b, MP4 track file with audio codec dtsx 848>8 string dts3 \b, MP4 track file with audio codec dtsy 849>8 string dxo$20 \b, DxO ONE camera 850>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 851>8 string dmpf \b, Digital Media Project 852>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 853>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 854>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 855>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 856>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 857>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 858>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 859>8 string dvr1 \b, DVB (.DVB) over RTP 860!:mime video/vnd.dvb.file 861>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 862>8 string emsg \b, Event message box present 863!:mime video/vnd.dvb.file 864>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 865!:mime video/mp4 866>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 867!:mime video/mp4 868>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 869!:mime audio/mp4 870>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 871!:mime audio/mp4 872>8 string ifrm \b, Apple iFrame Specification, Version 8.1 Jan 2013 873>8 string im1i \b, CMAF Media Profile - IMSC1 Image 874>8 string im1t \b, CMAF Media Profile - IMSC1 Text 875>8 string isc2 \b, ISMACryp 2.0 Encrypted File 876# ?/enc-isoff-generic 877>8 string iso \b, MP4 Base Media 878!:mime video/mp4 879>>11 string m v1 [ISO 14496-12:2003] 880>>11 string 2 v2 [ISO 14496-12:2005] 881>>11 string 4 v4 882>>11 string 5 v5 883>>11 string 6 v6 884>8 string isml \b, MP4 Base Media v2 [ISO 14496-12:2005] 885!:mime video/mp4 886>8 string J2P0 \b, JPEG2000 Profile 0 887>8 string J2P1 \b, JPEG2000 Profile 1 888>8 string/W jp2 \b, JPEG 2000 889!:mime image/jp2 890>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 891!:mime image/jp2 892>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 893>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 894!:mime image/jpm 895>8 string jpsi \b, The JPSearch data interchange format 896>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 897!:mime image/jpx 898>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 899!:mime video/3gpp2 900>8 string LCAG \b, Leica digital camera 901>8 string lmsg \b, Last Media Segment indicator for ISO base media file format. 902>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 903!:mime audio/x-m4a 904>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 905!:mime audio/mp4 906>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 907!:mime video/mp4 908>8 string M4V \b, Apple iTunes Video (.M4V) Video 909!:mime video/x-m4v 910>8 string M4VH \b, Apple TV (.M4V) 911!:mime video/x-m4v 912>8 string M4VP \b, Apple iPhone (.M4V) 913!:mime video/x-m4v 914>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 915!:mime video/mj2 916>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 917>8 string MFSM \b, Media File for Samsung video Metadata 918>8 string MGSV \b, Sony Home and Mobile Multimedia Platform (HMMP) 919!:mime video/mj2 920>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 921!:mime video/mp4 922>8 string mobi \b, MPEG-4, MOBI format 923!:mime video/mp4 924>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 925>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 926!:mime video/mp4 927>8 string mp42 \b, MP4 v2 [ISO 14496-14] 928!:mime video/mp4 929>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 930>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 931>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 932>8 string mpuf \b, Compliance with the MMT Processing Unit format 933>8 string msdh \b, Media Segment conforming to ISO base media file format. 934>8 string msix \b, Media Segment conforming to ISO base media file format. 935>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 936!:mime video/mp4 937>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 938>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 939!:mime video/quicktime 940>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 941!:mime audio/mp4 942>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 943!:mime audio/mp4 944>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 945!:mime video/mp4 946>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 947!:mime video/mp4 948>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 949!:mime video/mp4 950>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 951!:mime video/mp4 952>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 953!:mime video/mp4 954>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 955!:mime video/mp4 956>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 957!:mime video/mp4 958>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 959!:mime video/mp4 960>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 961!:mime video/mp4 962>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 963>8 string niko \b, Nikon Digital Camera 964!:mime video/mp4 965>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 966>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 967>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 968>8 string pana \b, Panasonic Digital Camera 969>8 string piff \b, Protected Interoperable File Format 970>8 string pnvi ]b, Panasonic Video Intercom 971>8 string qt \b, Apple QuickTime (.MOV/QT) 972!:mime video/quicktime 973# HEIF image format 974# see https://nokiatech.github.io/heif/technical.html 975>8 string mif1 \b, HEIF Image 976!:mime image/heif 977>8 string msf1 \b, HEIF Image Sequence 978!:mime image/heif-sequence 979>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 980!:mime image/heic 981>8 string heix \b, HEIF Image HEVC Main 10 Profile 982!:mime image/heic 983>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 984!:mime image/heic-sequence 985>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 986!:mime image/heic-sequence 987# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 988# but used in the reference implementation: 989# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 990>8 string heim \b, HEIF Image L-HEVC 991!:mime image/heif 992>8 string heis \b, HEIF Image L-HEVC 993!:mime image/heif 994>8 string avic \b, HEIF Image AVC 995!:mime image/heif 996>8 string hevm \b, HEIF Image Sequence L-HEVC 997!:mime image/heif-sequence 998>8 string hevs \b, HEIF Image Sequence L-HEVC 999!:mime image/heif-sequence 1000>8 string avcs \b, HEIF Image Sequence AVC 1001!:mime image/heif-sequence 1002# AVIF image format 1003# see https://aomediacodec.github.io/av1-avif/ 1004>8 string avif \b, AVIF Image 1005!:mime image/avif 1006>8 string avis \b, AVIF Image Sequence 1007!:mime image/avif 1008>8 string risx \b, Representation Index Segment for MPEG-2 TS Segments 1009>8 string ROSS \b, Ross Video 1010>8 string sdv \b, SD Memory Card Video 1011>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 1012>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 1013>8 string SEAU \b, Sony Home and Mobile Multimedia Platform (HMMP) 1014>8 string SEBK \b, Sony Home and Mobile Multimedia Platform (HMMP) 1015>8 string senv \b, Video contents Sony Entertainment Network 1016>8 string sims \b, Media Segment for Sub-Indexed Media Segment format 1017>8 string sisx \b, Single Index Segment forindex MPEG-2 TS 1018>8 string ssss \b, Subsegment Index Segment used to index MPEG-2 Segments 1019>8 string uvvu \b, UltraViolet file brand for DECE Common Format 1020 1021# MPEG sequences 1022# Scans for all common MPEG header start codes 10230 belong 0x00000001 1024>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 1025>>5 byte 66 \b, baseline 1026>>5 byte 77 \b, main 1027>>5 byte 88 \b, extended 1028>>7 byte x \b @ L %u 10290 belong&0xFFFFFF00 0x00000100 1030>3 byte 0xBA MPEG sequence 1031!:mime video/mpeg 1032# http://fileformats.archiveteam.org/wiki/Enhanced_VOB 1033# https://reposcope.com/mimetype/video/mpeg 1034!:ext vob/evo/mpg/mpeg 1035>>4 byte &0x40 \b, v2, program multiplex 1036>>4 byte ^0x40 \b, v1, system multiplex 1037>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 1038>3 byte&0x1F 0x07 MPEG sequence, H.264 video 1039>>4 byte 66 \b, baseline 1040>>4 byte 77 \b, main 1041>>4 byte 88 \b, extended 1042>>6 byte x \b @ L %u 1043# GRR too general as it catches also FoxPro Memo example NG.FPT 1044>3 byte 0xB0 MPEG sequence, v4 1045# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 1046#>>4 byte !0 MPEG sequence, v4 1047!:mime video/mpeg4-generic 1048>>5 belong 0x000001B5 1049>>>9 byte &0x80 1050>>>>10 byte&0xF0 16 \b, video 1051>>>>10 byte&0xF0 32 \b, still texture 1052>>>>10 byte&0xF0 48 \b, mesh 1053>>>>10 byte&0xF0 64 \b, face 1054>>>9 byte&0xF8 8 \b, video 1055>>>9 byte&0xF8 16 \b, still texture 1056>>>9 byte&0xF8 24 \b, mesh 1057>>>9 byte&0xF8 32 \b, face 1058>>4 byte 1 \b, simple @ L1 1059>>4 byte 2 \b, simple @ L2 1060>>4 byte 3 \b, simple @ L3 1061>>4 byte 4 \b, simple @ L0 1062>>4 byte 17 \b, simple scalable @ L1 1063>>4 byte 18 \b, simple scalable @ L2 1064>>4 byte 33 \b, core @ L1 1065>>4 byte 34 \b, core @ L2 1066>>4 byte 50 \b, main @ L2 1067>>4 byte 51 \b, main @ L3 1068>>4 byte 53 \b, main @ L4 1069>>4 byte 66 \b, n-bit @ L2 1070>>4 byte 81 \b, scalable texture @ L1 1071>>4 byte 97 \b, simple face animation @ L1 1072>>4 byte 98 \b, simple face animation @ L2 1073>>4 byte 99 \b, simple face basic animation @ L1 1074>>4 byte 100 \b, simple face basic animation @ L2 1075>>4 byte 113 \b, basic animation text @ L1 1076>>4 byte 114 \b, basic animation text @ L2 1077>>4 byte 129 \b, hybrid @ L1 1078>>4 byte 130 \b, hybrid @ L2 1079>>4 byte 145 \b, advanced RT simple @ L! 1080>>4 byte 146 \b, advanced RT simple @ L2 1081>>4 byte 147 \b, advanced RT simple @ L3 1082>>4 byte 148 \b, advanced RT simple @ L4 1083>>4 byte 161 \b, core scalable @ L1 1084>>4 byte 162 \b, core scalable @ L2 1085>>4 byte 163 \b, core scalable @ L3 1086>>4 byte 177 \b, advanced coding efficiency @ L1 1087>>4 byte 178 \b, advanced coding efficiency @ L2 1088>>4 byte 179 \b, advanced coding efficiency @ L3 1089>>4 byte 180 \b, advanced coding efficiency @ L4 1090>>4 byte 193 \b, advanced core @ L1 1091>>4 byte 194 \b, advanced core @ L2 1092>>4 byte 209 \b, advanced scalable texture @ L1 1093>>4 byte 210 \b, advanced scalable texture @ L2 1094>>4 byte 211 \b, advanced scalable texture @ L3 1095>>4 byte 225 \b, simple studio @ L1 1096>>4 byte 226 \b, simple studio @ L2 1097>>4 byte 227 \b, simple studio @ L3 1098>>4 byte 228 \b, simple studio @ L4 1099>>4 byte 229 \b, core studio @ L1 1100>>4 byte 230 \b, core studio @ L2 1101>>4 byte 231 \b, core studio @ L3 1102>>4 byte 232 \b, core studio @ L4 1103>>4 byte 240 \b, advanced simple @ L0 1104>>4 byte 241 \b, advanced simple @ L1 1105>>4 byte 242 \b, advanced simple @ L2 1106>>4 byte 243 \b, advanced simple @ L3 1107>>4 byte 244 \b, advanced simple @ L4 1108>>4 byte 245 \b, advanced simple @ L5 1109>>4 byte 247 \b, advanced simple @ L3b 1110>>4 byte 248 \b, FGS @ L0 1111>>4 byte 249 \b, FGS @ L1 1112>>4 byte 250 \b, FGS @ L2 1113>>4 byte 251 \b, FGS @ L3 1114>>4 byte 252 \b, FGS @ L4 1115>>4 byte 253 \b, FGS @ L5 1116>3 byte 0xB5 MPEG sequence, v4 1117!:mime video/mpeg4-generic 1118>>4 byte &0x80 1119>>>5 byte&0xF0 16 \b, video (missing profile header) 1120>>>5 byte&0xF0 32 \b, still texture (missing profile header) 1121>>>5 byte&0xF0 48 \b, mesh (missing profile header) 1122>>>5 byte&0xF0 64 \b, face (missing profile header) 1123>>4 byte&0xF8 8 \b, video (missing profile header) 1124>>4 byte&0xF8 16 \b, still texture (missing profile header) 1125>>4 byte&0xF8 24 \b, mesh (missing profile header) 1126>>4 byte&0xF8 32 \b, face (missing profile header) 1127>3 byte 0xB3 MPEG sequence 1128!:mime video/mpeg 1129>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1130>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1131>>12 belong 0x000001B5 \b, v2, 1132>>>16 byte&0x0F 1 \b HP 1133>>>16 byte&0x0F 2 \b Spt 1134>>>16 byte&0x0F 3 \b SNR 1135>>>16 byte&0x0F 4 \b MP 1136>>>16 byte&0x0F 5 \b SP 1137>>>17 byte&0xF0 64 \b@HL 1138>>>17 byte&0xF0 96 \b@H-14 1139>>>17 byte&0xF0 128 \b@ML 1140>>>17 byte&0xF0 160 \b@LL 1141>>>17 byte &0x08 \b progressive 1142>>>17 byte ^0x08 \b interlaced 1143>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 1144>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 1145>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 1146>>11 byte &0x02 1147>>>75 byte &0x01 1148>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1149>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1150>>>>140 belong 0x000001B5 \b, v2, 1151>>>>>144 byte&0x0F 1 \b HP 1152>>>>>144 byte&0x0F 2 \b Spt 1153>>>>>144 byte&0x0F 3 \b SNR 1154>>>>>144 byte&0x0F 4 \b MP 1155>>>>>144 byte&0x0F 5 \b SP 1156>>>>>145 byte&0xF0 64 \b@HL 1157>>>>>145 byte&0xF0 96 \b@H-14 1158>>>>>145 byte&0xF0 128 \b@ML 1159>>>>>145 byte&0xF0 160 \b@LL 1160>>>>>145 byte &0x08 \b progressive 1161>>>>>145 byte ^0x08 \b interlaced 1162>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 1163>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 1164>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 1165>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1166>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1167>>76 belong 0x000001B5 \b, v2, 1168>>>80 byte&0x0F 1 \b HP 1169>>>80 byte&0x0F 2 \b Spt 1170>>>80 byte&0x0F 3 \b SNR 1171>>>80 byte&0x0F 4 \b MP 1172>>>80 byte&0x0F 5 \b SP 1173>>>81 byte&0xF0 64 \b@HL 1174>>>81 byte&0xF0 96 \b@H-14 1175>>>81 byte&0xF0 128 \b@ML 1176>>>81 byte&0xF0 160 \b@LL 1177>>>81 byte &0x08 \b progressive 1178>>>81 byte ^0x08 \b interlaced 1179>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 1180>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 1181>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 1182>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 1183>>>7 byte&0xF0 0x10 \b, 16:9 1184>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 1185>>>7 byte&0xF0 0x10 \b, 16:9 1186>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 1187>>>7 byte&0xF0 0x10 \b, 4:3 1188>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 1189>>>5 beshort&0x0FFF 0x01E0 \b NTSC 1190>>>5 beshort&0x0FFF 0x0240 \b PAL 1191>>>7 byte&0xF0 0x20 \b, 4:3 1192>>>7 byte&0xF0 0x30 \b, 16:9 1193>>>7 byte&0xF0 0x40 \b, 11:5 1194>>>7 byte&0xF0 0x80 \b, PAL 4:3 1195>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1196>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 1197>>>7 byte&0xF0 0x10 \b, 4:3 1198>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 1199>>>7 byte&0xF0 0x10 \b, 4:3 1200>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 1201>>>7 byte&0xF0 0x10 \b, 4:3 1202>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 1203>>>7 byte&0xF0 0x10 \b, 4:3 1204>>4 beshort&0xFFF0 0x1600 \b, CIF 1205>>>5 beshort&0x0FFF 0x00F0 \b NTSC 1206>>>5 beshort&0x0FFF 0x0120 \b PAL 1207>>>7 byte&0xF0 0x20 \b, 4:3 1208>>>7 byte&0xF0 0x30 \b, 16:9 1209>>>7 byte&0xF0 0x40 \b, 11:5 1210>>>7 byte&0xF0 0x80 \b, PAL 4:3 1211>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1212>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1213>>>>7 byte&0xF0 0x20 \b, 4:3 1214>>>>7 byte&0xF0 0x30 \b, 16:9 1215>>>>7 byte&0xF0 0x40 \b, 11:5 1216>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 1217>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1218>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1219>>>7 byte&0xF0 0x20 \b, 4:3 1220>>>7 byte&0xF0 0x30 \b, 16:9 1221>>>7 byte&0xF0 0x40 \b, 11:5 1222>>4 beshort&0xFFF0 0x1E00 \b, SVCD 1223>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1224>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1225>>>7 byte&0xF0 0x20 \b, 4:3 1226>>>7 byte&0xF0 0x30 \b, 16:9 1227>>>7 byte&0xF0 0x40 \b, 11:5 1228>>7 byte&0x0F 1 \b, 23.976 fps 1229>>7 byte&0x0F 2 \b, 24 fps 1230>>7 byte&0x0F 3 \b, 25 fps 1231>>7 byte&0x0F 4 \b, 29.97 fps 1232>>7 byte&0x0F 5 \b, 30 fps 1233>>7 byte&0x0F 6 \b, 50 fps 1234>>7 byte&0x0F 7 \b, 59.94 fps 1235>>7 byte&0x0F 8 \b, 60 fps 1236>>11 byte &0x04 \b, Constrained 1237 1238# MPEG ADTS Audio (*.mpx/mxa/aac) 1239# from dreesen@math.fu-berlin.de 1240# modified to fully support MPEG ADTS 1241 1242# MP3, M1A 1243# modified by Joerg Jenderek 1244# GRR the original test are too common for many DOS files 1245# so don't accept as MP3 until we've tested the rate 1246# But also beat GEMDOS fonts 12470 beshort&0xFFFE 0xFFFA 1248# rates 1249>2 byte&0xF0 !0 1250>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 1251!:strength +20 1252!:mime audio/mpeg 1253>2 byte&0xF0 0x10 \b, 32 kbps 1254>2 byte&0xF0 0x20 \b, 40 kbps 1255>2 byte&0xF0 0x30 \b, 48 kbps 1256>2 byte&0xF0 0x40 \b, 56 kbps 1257>2 byte&0xF0 0x50 \b, 64 kbps 1258>2 byte&0xF0 0x60 \b, 80 kbps 1259>2 byte&0xF0 0x70 \b, 96 kbps 1260>2 byte&0xF0 0x80 \b, 112 kbps 1261>2 byte&0xF0 0x90 \b, 128 kbps 1262>2 byte&0xF0 0xA0 \b, 160 kbps 1263>2 byte&0xF0 0xB0 \b, 192 kbps 1264>2 byte&0xF0 0xC0 \b, 224 kbps 1265>2 byte&0xF0 0xD0 \b, 256 kbps 1266>2 byte&0xF0 0xE0 \b, 320 kbps 1267# timing 1268>2 byte&0x0C 0x00 \b, 44.1 kHz 1269>2 byte&0x0C 0x04 \b, 48 kHz 1270>2 byte&0x0C 0x08 \b, 32 kHz 1271# channels/options 1272>3 byte&0xC0 0x00 \b, Stereo 1273>3 byte&0xC0 0x40 \b, JntStereo 1274>3 byte&0xC0 0x80 \b, 2x Monaural 1275>3 byte&0xC0 0xC0 \b, Monaural 1276#>1 byte ^0x01 \b, Data Verify 1277#>2 byte &0x02 \b, Packet Pad 1278#>2 byte &0x01 \b, Custom Flag 1279#>3 byte &0x08 \b, Copyrighted 1280#>3 byte &0x04 \b, Original Source 1281#>3 byte&0x03 1 \b, NR: 50/15 ms 1282#>3 byte&0x03 3 \b, NR: CCIT J.17 1283 1284# MP2, M1A 12850 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1286!:mime audio/mpeg 1287# rates 1288>2 byte&0xF0 0x10 \b, 32 kbps 1289>2 byte&0xF0 0x20 \b, 48 kbps 1290>2 byte&0xF0 0x30 \b, 56 kbps 1291>2 byte&0xF0 0x40 \b, 64 kbps 1292>2 byte&0xF0 0x50 \b, 80 kbps 1293>2 byte&0xF0 0x60 \b, 96 kbps 1294>2 byte&0xF0 0x70 \b, 112 kbps 1295>2 byte&0xF0 0x80 \b, 128 kbps 1296>2 byte&0xF0 0x90 \b, 160 kbps 1297>2 byte&0xF0 0xA0 \b, 192 kbps 1298>2 byte&0xF0 0xB0 \b, 224 kbps 1299>2 byte&0xF0 0xC0 \b, 256 kbps 1300>2 byte&0xF0 0xD0 \b, 320 kbps 1301>2 byte&0xF0 0xE0 \b, 384 kbps 1302# timing 1303>2 byte&0x0C 0x00 \b, 44.1 kHz 1304>2 byte&0x0C 0x04 \b, 48 kHz 1305>2 byte&0x0C 0x08 \b, 32 kHz 1306# channels/options 1307>3 byte&0xC0 0x00 \b, Stereo 1308>3 byte&0xC0 0x40 \b, JntStereo 1309>3 byte&0xC0 0x80 \b, 2x Monaural 1310>3 byte&0xC0 0xC0 \b, Monaural 1311#>1 byte ^0x01 \b, Data Verify 1312#>2 byte &0x02 \b, Packet Pad 1313#>2 byte &0x01 \b, Custom Flag 1314#>3 byte &0x08 \b, Copyrighted 1315#>3 byte &0x04 \b, Original Source 1316#>3 byte&0x03 1 \b, NR: 50/15 ms 1317#>3 byte&0x03 3 \b, NR: CCIT J.17 1318 1319# MPA, M1A 1320# updated by Joerg Jenderek 1321# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1322# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1323# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1324#0 beshort&0xFFFE 0xFFFE 1325#>2 ubyte&0xF0 >0x0F 1326#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1327## rate 1328#>>>2 byte&0xF0 0x10 \b, 32 kbps 1329#>>>2 byte&0xF0 0x20 \b, 64 kbps 1330#>>>2 byte&0xF0 0x30 \b, 96 kbps 1331#>>>2 byte&0xF0 0x40 \b, 128 kbps 1332#>>>2 byte&0xF0 0x50 \b, 160 kbps 1333#>>>2 byte&0xF0 0x60 \b, 192 kbps 1334#>>>2 byte&0xF0 0x70 \b, 224 kbps 1335#>>>2 byte&0xF0 0x80 \b, 256 kbps 1336#>>>2 byte&0xF0 0x90 \b, 288 kbps 1337#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1338#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1339#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1340#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1341#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1342## timing 1343#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1344#>>>2 byte&0x0C 0x04 \b, 48 kHz 1345#>>>2 byte&0x0C 0x08 \b, 32 kHz 1346## channels/options 1347#>>>3 byte&0xC0 0x00 \b, Stereo 1348#>>>3 byte&0xC0 0x40 \b, JntStereo 1349#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1350#>>>3 byte&0xC0 0xC0 \b, Monaural 1351##>1 byte ^0x01 \b, Data Verify 1352##>2 byte &0x02 \b, Packet Pad 1353##>2 byte &0x01 \b, Custom Flag 1354##>3 byte &0x08 \b, Copyrighted 1355##>3 byte &0x04 \b, Original Source 1356##>3 byte&0x03 1 \b, NR: 50/15 ms 1357##>3 byte&0x03 3 \b, NR: CCIT J.17 1358 1359# MP3, M2A 13600 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1361!:mime audio/mpeg 1362# rate 1363>2 byte&0xF0 0x10 \b, 8 kbps 1364>2 byte&0xF0 0x20 \b, 16 kbps 1365>2 byte&0xF0 0x30 \b, 24 kbps 1366>2 byte&0xF0 0x40 \b, 32 kbps 1367>2 byte&0xF0 0x50 \b, 40 kbps 1368>2 byte&0xF0 0x60 \b, 48 kbps 1369>2 byte&0xF0 0x70 \b, 56 kbps 1370>2 byte&0xF0 0x80 \b, 64 kbps 1371>2 byte&0xF0 0x90 \b, 80 kbps 1372>2 byte&0xF0 0xA0 \b, 96 kbps 1373>2 byte&0xF0 0xB0 \b, 112 kbps 1374>2 byte&0xF0 0xC0 \b, 128 kbps 1375>2 byte&0xF0 0xD0 \b, 144 kbps 1376>2 byte&0xF0 0xE0 \b, 160 kbps 1377# timing 1378>2 byte&0x0C 0x00 \b, 22.05 kHz 1379>2 byte&0x0C 0x04 \b, 24 kHz 1380>2 byte&0x0C 0x08 \b, 16 kHz 1381# channels/options 1382>3 byte&0xC0 0x00 \b, Stereo 1383>3 byte&0xC0 0x40 \b, JntStereo 1384>3 byte&0xC0 0x80 \b, 2x Monaural 1385>3 byte&0xC0 0xC0 \b, Monaural 1386#>1 byte ^0x01 \b, Data Verify 1387#>2 byte &0x02 \b, Packet Pad 1388#>2 byte &0x01 \b, Custom Flag 1389#>3 byte &0x08 \b, Copyrighted 1390#>3 byte &0x04 \b, Original Source 1391#>3 byte&0x03 1 \b, NR: 50/15 ms 1392#>3 byte&0x03 3 \b, NR: CCIT J.17 1393 1394# MP2, M2A 13950 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1396!:mime audio/mpeg 1397# rate 1398>2 byte&0xF0 0x10 \b, 8 kbps 1399>2 byte&0xF0 0x20 \b, 16 kbps 1400>2 byte&0xF0 0x30 \b, 24 kbps 1401>2 byte&0xF0 0x40 \b, 32 kbps 1402>2 byte&0xF0 0x50 \b, 40 kbps 1403>2 byte&0xF0 0x60 \b, 48 kbps 1404>2 byte&0xF0 0x70 \b, 56 kbps 1405>2 byte&0xF0 0x80 \b, 64 kbps 1406>2 byte&0xF0 0x90 \b, 80 kbps 1407>2 byte&0xF0 0xA0 \b, 96 kbps 1408>2 byte&0xF0 0xB0 \b, 112 kbps 1409>2 byte&0xF0 0xC0 \b, 128 kbps 1410>2 byte&0xF0 0xD0 \b, 144 kbps 1411>2 byte&0xF0 0xE0 \b, 160 kbps 1412# timing 1413>2 byte&0x0C 0x00 \b, 22.05 kHz 1414>2 byte&0x0C 0x04 \b, 24 kHz 1415>2 byte&0x0C 0x08 \b, 16 kHz 1416# channels/options 1417>3 byte&0xC0 0x00 \b, Stereo 1418>3 byte&0xC0 0x40 \b, JntStereo 1419>3 byte&0xC0 0x80 \b, 2x Monaural 1420>3 byte&0xC0 0xC0 \b, Monaural 1421#>1 byte ^0x01 \b, Data Verify 1422#>2 byte &0x02 \b, Packet Pad 1423#>2 byte &0x01 \b, Custom Flag 1424#>3 byte &0x08 \b, Copyrighted 1425#>3 byte &0x04 \b, Original Source 1426#>3 byte&0x03 1 \b, NR: 50/15 ms 1427#>3 byte&0x03 3 \b, NR: CCIT J.17 1428 1429# MPA, M2A 14300 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1431!:mime audio/mpeg 1432# rate 1433>2 byte&0xF0 0x10 \b, 32 kbps 1434>2 byte&0xF0 0x20 \b, 48 kbps 1435>2 byte&0xF0 0x30 \b, 56 kbps 1436>2 byte&0xF0 0x40 \b, 64 kbps 1437>2 byte&0xF0 0x50 \b, 80 kbps 1438>2 byte&0xF0 0x60 \b, 96 kbps 1439>2 byte&0xF0 0x70 \b, 112 kbps 1440>2 byte&0xF0 0x80 \b, 128 kbps 1441>2 byte&0xF0 0x90 \b, 144 kbps 1442>2 byte&0xF0 0xA0 \b, 160 kbps 1443>2 byte&0xF0 0xB0 \b, 176 kbps 1444>2 byte&0xF0 0xC0 \b, 192 kbps 1445>2 byte&0xF0 0xD0 \b, 224 kbps 1446>2 byte&0xF0 0xE0 \b, 256 kbps 1447# timing 1448>2 byte&0x0C 0x00 \b, 22.05 kHz 1449>2 byte&0x0C 0x04 \b, 24 kHz 1450>2 byte&0x0C 0x08 \b, 16 kHz 1451# channels/options 1452>3 byte&0xC0 0x00 \b, Stereo 1453>3 byte&0xC0 0x40 \b, JntStereo 1454>3 byte&0xC0 0x80 \b, 2x Monaural 1455>3 byte&0xC0 0xC0 \b, Monaural 1456#>1 byte ^0x01 \b, Data Verify 1457#>2 byte &0x02 \b, Packet Pad 1458#>2 byte &0x01 \b, Custom Flag 1459#>3 byte &0x08 \b, Copyrighted 1460#>3 byte &0x04 \b, Original Source 1461#>3 byte&0x03 1 \b, NR: 50/15 ms 1462#>3 byte&0x03 3 \b, NR: CCIT J.17 1463 1464# MP3, M25A 14650 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1466!:mime audio/mpeg 1467# rate 1468>2 byte&0xF0 0x10 \b, 8 kbps 1469>2 byte&0xF0 0x20 \b, 16 kbps 1470>2 byte&0xF0 0x30 \b, 24 kbps 1471>2 byte&0xF0 0x40 \b, 32 kbps 1472>2 byte&0xF0 0x50 \b, 40 kbps 1473>2 byte&0xF0 0x60 \b, 48 kbps 1474>2 byte&0xF0 0x70 \b, 56 kbps 1475>2 byte&0xF0 0x80 \b, 64 kbps 1476>2 byte&0xF0 0x90 \b, 80 kbps 1477>2 byte&0xF0 0xA0 \b, 96 kbps 1478>2 byte&0xF0 0xB0 \b, 112 kbps 1479>2 byte&0xF0 0xC0 \b, 128 kbps 1480>2 byte&0xF0 0xD0 \b, 144 kbps 1481>2 byte&0xF0 0xE0 \b, 160 kbps 1482# timing 1483>2 byte&0x0C 0x00 \b, 11.025 kHz 1484>2 byte&0x0C 0x04 \b, 12 kHz 1485>2 byte&0x0C 0x08 \b, 8 kHz 1486# channels/options 1487>3 byte&0xC0 0x00 \b, Stereo 1488>3 byte&0xC0 0x40 \b, JntStereo 1489>3 byte&0xC0 0x80 \b, 2x Monaural 1490>3 byte&0xC0 0xC0 \b, Monaural 1491#>1 byte ^0x01 \b, Data Verify 1492#>2 byte &0x02 \b, Packet Pad 1493#>2 byte &0x01 \b, Custom Flag 1494#>3 byte &0x08 \b, Copyrighted 1495#>3 byte &0x04 \b, Original Source 1496#>3 byte&0x03 1 \b, NR: 50/15 ms 1497#>3 byte&0x03 3 \b, NR: CCIT J.17 1498 1499# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1500 1501# Stored AAC streams (instead of the MP4 format) 15020 string ADIF MPEG ADIF, AAC 1503!:mime audio/x-hx-aac-adif 1504>4 byte &0x80 1505>>13 byte &0x10 \b, VBR 1506>>13 byte ^0x10 \b, CBR 1507>>16 byte&0x1E 0x02 \b, single stream 1508>>16 byte&0x1E 0x04 \b, 2 streams 1509>>16 byte&0x1E 0x06 \b, 3 streams 1510>>16 byte &0x08 \b, 4 or more streams 1511>>16 byte &0x10 \b, 8 or more streams 1512>>4 byte &0x80 \b, Copyrighted 1513>>13 byte &0x40 \b, Original Source 1514>>13 byte &0x20 \b, Home Flag 1515>4 byte ^0x80 1516>>4 byte &0x10 \b, VBR 1517>>4 byte ^0x10 \b, CBR 1518>>7 byte&0x1E 0x02 \b, single stream 1519>>7 byte&0x1E 0x04 \b, 2 streams 1520>>7 byte&0x1E 0x06 \b, 3 streams 1521>>7 byte &0x08 \b, 4 or more streams 1522>>7 byte &0x10 \b, 8 or more streams 1523>>4 byte &0x40 \b, Original Stream(s) 1524>>4 byte &0x20 \b, Home Source 1525 1526# Live or stored single AAC stream (used with MPEG-2 systems) 15270 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1528!:mime audio/x-hx-aac-adts 1529>1 byte &0x08 \b, v2 1530>1 byte ^0x08 \b, v4 1531# profile 1532>>2 byte &0xC0 \b LTP 1533>2 byte&0xc0 0x00 \b Main 1534>2 byte&0xc0 0x40 \b LC 1535>2 byte&0xc0 0x80 \b SSR 1536# timing 1537>2 byte&0x3c 0x00 \b, 96 kHz 1538>2 byte&0x3c 0x04 \b, 88.2 kHz 1539>2 byte&0x3c 0x08 \b, 64 kHz 1540>2 byte&0x3c 0x0c \b, 48 kHz 1541>2 byte&0x3c 0x10 \b, 44.1 kHz 1542>2 byte&0x3c 0x14 \b, 32 kHz 1543>2 byte&0x3c 0x18 \b, 24 kHz 1544>2 byte&0x3c 0x1c \b, 22.05 kHz 1545>2 byte&0x3c 0x20 \b, 16 kHz 1546>2 byte&0x3c 0x24 \b, 12 kHz 1547>2 byte&0x3c 0x28 \b, 11.025 kHz 1548>2 byte&0x3c 0x2c \b, 8 kHz 1549# channels 1550>2 beshort&0x01c0 0x0040 \b, monaural 1551>2 beshort&0x01c0 0x0080 \b, stereo 1552>2 beshort&0x01c0 0x00c0 \b, stereo + center 1553>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1554>2 beshort&0x01c0 0x0140 \b, surround 1555>2 beshort&0x01c0 0x0180 \b, surround + LFE 1556>2 beshort &0x01C0 \b, surround + side 1557#>1 byte ^0x01 \b, Data Verify 1558#>2 byte &0x02 \b, Custom Flag 1559#>3 byte &0x20 \b, Original Stream 1560#>3 byte &0x10 \b, Home Source 1561#>3 byte &0x08 \b, Copyrighted 1562 1563# Live MPEG-4 audio streams (instead of RTP FlexMux) 15640 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1565!:mime audio/x-mp4a-latm 1566#>1 beshort&0x1FFF x \b, %hu byte packet 1567>3 byte&0xE0 0x40 1568>>4 byte&0x3C 0x04 \b, single stream 1569>>4 byte&0x3C 0x08 \b, 2 streams 1570>>4 byte&0x3C 0x0C \b, 3 streams 1571>>4 byte &0x08 \b, 4 or more streams 1572>>4 byte &0x20 \b, 8 or more streams 1573>3 byte&0xC0 0 1574>>4 byte&0x78 0x08 \b, single stream 1575>>4 byte&0x78 0x10 \b, 2 streams 1576>>4 byte&0x78 0x18 \b, 3 streams 1577>>4 byte &0x20 \b, 4 or more streams 1578>>4 byte &0x40 \b, 8 or more streams 1579# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1580#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1581#!:mime audio/x-mp4a-latm 1582 1583# Summary: FLI animation format 1584# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1585# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 15864 leshort 0xAF11 1587# standard FLI always has 320x200 resolution and 8 bit color 1588>8 leshort 320 1589>>10 leshort 200 1590>>>12 leshort 8 FLI animation, 320x200x8 1591!:mime video/x-fli 1592>>>>6 leshort x \b, %d frames 1593# frame speed is multiple of 1/70s 1594>>>>16 leshort x \b, %d/70s per frame 1595 1596# Summary: FLC animation format 1597# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1598# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 15994 leshort 0xAF12 1600# standard FLC always use 8 bit color 1601>12 leshort 8 FLC animation 1602!:mime video/x-flc 1603>>8 leshort x \b, %d 1604>>10 leshort x \bx%dx8 1605>>6 uleshort x \b, %d frames 1606>>16 uleshort x \b, %dms per frame 1607 1608# DL animation format 1609# XXX - collision with most `mips' magic 1610# 1611# I couldn't find a real magic number for these, however, this 1612# -appears- to work. Note that it might catch other files, too, so be 1613# careful! 1614# 1615# Note that title and author appear in the two 20-byte chunks 1616# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1617# 255 (hex FF)! The DL format is really bad. 1618# 1619#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1620#!:mime video/x-unknown 1621#>42 byte x - %d screens, 1622#>43 byte x %d commands 1623#0 byte 2 DL version 2 1624#!:mime video/x-unknown 1625#>1 byte 1 - large format (320x200,1 image/screen), 1626#>1 byte 2 - medium format (160x100,4 images/screen), 1627#>1 byte >2 - unknown format, 1628#>42 byte x %d screens, 1629#>43 byte x %d commands 1630# Based on empirical evidence, DL version 3 have several nulls following the 1631# \003. Most of them start with non-null values at hex offset 0x34 or so. 1632#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1633 1634# iso 13818 transport stream 1635# 1636# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1637# syncbyte 8 bit 0x47 1638# error_ind 1 bit - 1639# payload_start 1 bit 1 1640# priority 1 bit - 1641# PID 13 bit 0x0000 1642# scrambling 2 bit - 1643# adaptfld_ctrl 2 bit 1 or 3 1644# conti_count 4 bit - 16450 belong&0xFF5FFF10 0x47400010 1646>188 byte 0x47 MPEG transport stream data 1647!:mime video/MP2T 1648 1649# DIF digital video file format <mpruett@sgi.com> 16500 belong&0xffffff00 0x1f070000 DIF 1651>4 byte &0x01 (DVCPRO) movie file 1652>4 byte ^0x01 (DV) movie file 1653>3 byte &0x80 (PAL) 1654>3 byte ^0x80 (NTSC) 1655 1656# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 16570 string \x8aMNG MNG video data, 1658!:mime video/x-mng 1659>4 belong !0x0d0a1a0a CORRUPTED, 1660>4 belong 0x0d0a1a0a 1661>>16 belong x %d x 1662>>20 belong x %d 1663 1664# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 16650 string \x8bJNG JNG video data, 1666!:mime video/x-jng 1667>4 belong !0x0d0a1a0a CORRUPTED, 1668>4 belong 0x0d0a1a0a 1669>>16 belong x %d x 1670>>20 belong x %d 1671 1672# Vivo video (Wolfram Kleff) 16733 string \x0D\x0AVersion:Vivo Vivo video data 1674 1675# ABC (alembic.io 3d models) 16760 string 0gawa ABC 3d model 1677 1678# VRML (Virtual Reality Modelling Language) 16790 string/w #VRML\ V1.0\ ascii VRML 1 file 1680!:mime model/vrml 16810 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1682!:mime model/vrml 1683 1684# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] 1685# From Michel Briand <michelbriand@free.fr> 1686# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1687# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 16880 string/w \<?xml\ version= 1689!:strength + 5 1690>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1691!:mime model/x3d+xml 1692 1693#--------------------------------------------------------------------------- 1694# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1695# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1696# 16970 string HVQM4 %s 1698>6 string >\0 v%s 1699>0 byte x GameCube movie, 1700>0x34 ubeshort x %d x 1701>0x36 ubeshort x %d, 1702>0x26 ubeshort x %dus, 1703>0x42 ubeshort 0 no audio 1704>0x42 ubeshort >0 %dHz audio 1705 1706# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 1707# Update: Joerg Jenderek 1708# URL: https://en.wikipedia.org/wiki/VOB 17090 string DVDVIDEO-VTS Video title set, 1710!:mime video/x-ifo 1711!:ext ifo/bup 1712>0x21 byte x v%x 17130 string DVDVIDEO-VMG Video manager, 1714!:mime video/x-ifo 1715!:ext ifo/bup 1716>0x21 byte x v%x 1717 1718# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 17190 string xMovieSetter MovieSetter movie 17200 string xSceneEditor MovieSetter movie 1721 1722# From: Behan Webster <behanw@websterwood.com> 1723# NuppelVideo used by Mythtv (*.nuv) 1724# Note: there are two identical stanzas here differing only in the 1725# initial string matched. It used to be done with a regex, but we're 1726# trying to get rid of those. 17270 string NuppelVideo MythTV NuppelVideo 1728>12 string x v%s 1729>20 lelong x (%d 1730>24 lelong x \bx%d), 1731>36 string P \bprogressive, 1732>36 string I \binterlaced, 1733>40 ledouble x \baspect:%.2f, 1734>48 ledouble x \bfps:%.2f 17350 string MythTV MythTV NuppelVideo 1736>12 string x v%s 1737>20 lelong x (%d 1738>24 lelong x \bx%d), 1739>36 string P \bprogressive, 1740>36 string I \binterlaced, 1741>40 ledouble x \baspect:%.2f, 1742>48 ledouble x \bfps:%.2f 1743 1744# MPEG file 1745# MPEG sequences 1746# FIXME: This section is from the old magic.mime file and needs 1747# integrating with the rest 1748#0 belong 0x000001BA 1749#>4 byte &0x40 1750#!:mime video/mp2p 1751#>4 byte ^0x40 1752#!:mime video/mpeg 1753#0 belong 0x000001BB 1754#!:mime video/mpeg 1755#0 belong 0x000001B0 1756#!:mime video/mp4v-es 1757#0 belong 0x000001B5 1758#!:mime video/mp4v-es 1759#0 belong 0x000001B3 1760#!:mime video/mpv 1761#0 belong&0xFF5FFF10 0x47400010 1762#!:mime video/mp2t 1763#0 belong 0x00000001 1764#>4 byte&0x1F 0x07 1765#!:mime video/h264 1766 1767# Type: Bink Video 1768# Extension: .bik 1769# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container 1770# From: <hoehle@users.sourceforge.net> 2008-07-18 17710 name bik 1772#>4 ulelong x size %d 1773>20 ulelong x \b, %d 1774>24 ulelong x \bx%d 1775>8 ulelong x \b, %d frames 1776>32 ulelong x at rate %d/ 1777>28 ulelong >1 \b%d 1778>40 ulelong =0 \b, no audio 1779>40 ulelong !0 \b, %d audio track 1780>>40 ulelong !1 \bs 1781# follow properties of the first audio track only 1782>>48 uleshort x %dHz 1783>>51 byte&0x20 0 mono 1784>>51 byte&0x20 !0 stereo 1785#>>51 byte&0x10 0 FFT 1786#>>51 byte&0x10 !0 DCT 1787 17880 string BIK 1789>3 regex =[bdfghi] Bink Video rev.%s 1790>>0 use bik 1791 17920 string KB2 1793>3 regex =[adfghi] Bink Video 2 rev.%s 1794>>0 use bik 1795 1796# Type: NUT Container 1797# URL: https://wiki.multimedia.cx/index.php?title=NUT 1798# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17990 string nut/multimedia\ container\0 NUT multimedia container 1800 1801# Type: Nullsoft Video (NSV) 1802# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1803# From: Mike Melanson <mike@multimedia.cx> 18040 string NSVf Nullsoft Video 1805 1806# Type: REDCode Video 1807# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode 1808# From: Mike Melanson <mike@multimedia.cx> 18094 string RED1 REDCode Video 1810 1811# Type: MTV Multimedia File 1812# URL: https://wiki.multimedia.cx/index.php?title=MTV 1813# From: Mike Melanson <mike@multimedia.cx> 18140 string AMVS MTV Multimedia File 1815 1816# Type: ARMovie 1817# URL: https://wiki.multimedia.cx/index.php?title=ARMovie 1818# From: Mike Melanson <mike@multimedia.cx> 18190 string ARMovie\012 ARMovie 1820 1821# Type: Interplay MVE Movie 1822# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE 1823# From: Mike Melanson <mike@multimedia.cx> 18240 string Interplay\040MVE\040File\032 Interplay MVE Movie 1825 1826# Type: Windows Television DVR File 1827# URL: https://wiki.multimedia.cx/index.php?title=WTV 1828# From: Mike Melanson <mike@mutlimedia.cx> 1829# This takes the form of a Windows-style GUID 18300 bequad 0xB7D800203749DA11 1831>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1832 1833# Type: Sega FILM/CPK Multimedia 1834# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM 1835# From: Mike Melanson <mike@multimedia.cx> 18360 string FILM Sega FILM/CPK Multimedia, 1837>32 belong x %d x 1838>28 belong x %d 1839 1840# Type: Nintendo THP Multimedia 1841# URL: https://wiki.multimedia.cx/index.php?title=THP 1842# From: Mike Melanson <mike@multimedia.cx> 18430 string THP\0 Nintendo THP Multimedia 1844 1845# Type: BBC Dirac Video 1846# URL: https://wiki.multimedia.cx/index.php?title=Dirac 1847# From: Mike Melanson <mike@multimedia.cx> 18480 string BBCD BBC Dirac Video 1849 1850# Type: RAD Game Tools Smacker Multimedia 1851# URL: https://wiki.multimedia.cx/index.php?title=Smacker 1852# From: Mike Melanson <mike@multimedia.cx> 18530 string SMK RAD Game Tools Smacker Multimedia 1854>3 byte x version %c, 1855>4 lelong x %d x 1856>8 lelong x %d, 1857>12 lelong x %d frames 1858 1859# Material Exchange Format 1860# More information: 1861# https://en.wikipedia.org/wiki/Material_Exchange_Format 1862# http://www.freemxf.org/ 18630 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1864!:ext mxf 1865!:mime application/mxf 1866 1867# Recognize LucasArts Smush video files (cf. 1868# https://wiki.multimedia.cx/index.php/Smush) 18690 string ANIM 1870>8 string AHDR LucasArts Smush Animation Format (SAN) video 18710 string SANM 1872>8 string SHDR LucasArts Smush v2 (SANM) video 1873 1874# Type: Scaleform video 1875# Extension: .usm 1876# URL: https://wiki.multimedia.cx/index.php/USM 1877# From: David Korth <gerbilsoft@gerbilsoft.com> 18780 string CRID 1879>32 string @UTF Scaleform video 1880 1881# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html 18820 string TVS\015\012 1883>&0 string Version\040 TeamViewer Session File 1884>>&0 string x \b, version %s 1885 1886#------------------------------------------------------------------------------ 1887# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1888# aout: file(1) magic for a.out executable/object/etc entries that 1889# handle executables on multiple platforms. 1890# 1891 1892# 1893# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1894# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1895# 1896# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1897# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1898# works only for binaries using shared libraries. Grabbing the entry 1899# point from the a.out header, using it to find the first code executed 1900# in the program, and looking at that might help. 1901# 19020 lelong 0407 a.out little-endian 32-bit executable 1903>16 lelong >0 not stripped 1904>32 byte 0x6a (uses BSD/OS shared libs) 1905 19060 lelong 0410 a.out little-endian 32-bit pure executable 1907>16 lelong >0 not stripped 1908>32 byte 0x6a (uses BSD/OS shared libs) 1909 19100 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1911>16 lelong >0 not stripped 1912>32 byte 0x6a (uses BSD/OS shared libs) 1913 1914# 1915# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1916# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1917# 1918# XXX - is there anything we can look at to distinguish old SunOS 68010 1919# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1920# the first instruction or instructions in the program. 1921# 19220 belong 0407 a.out big-endian 32-bit executable 1923>16 belong >0 not stripped 1924 19250 belong 0410 a.out big-endian 32-bit pure executable 1926>16 belong >0 not stripped 1927 19280 belong 0413 a.out big-endian 32-bit demand paged executable 1929>16 belong >0 not stripped 1930 1931 1932#------------------------------------------------------------------------------ 1933# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1934# apache: file(1) magic for Apache Big Data formats 1935 1936# Avro files 19370 string Obj Apache Avro 1938>3 byte x version %d 1939 1940# ORC files 1941# Important information is in file footer, which we can't index to :( 19420 string ORC Apache ORC 1943 1944# Parquet files 19450 string PAR1 Apache Parquet 1946 1947# Hive RC files 19480 string RCF Apache Hive RC file 1949>3 byte x version %d 1950 1951# Sequence files (and the careless first version of RC file) 1952 19530 string SEQ 1954>3 byte <6 Apache Hadoop Sequence file version %d 1955>3 byte >6 Apache Hadoop Sequence file version %d 1956>3 byte =6 1957>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1958>>3 default x Apache Hadoop Sequence file version 6 1959 1960#------------------------------------------------------------------------------ 1961# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1962# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1963# workspaces) 1964# 19650 long 0100554 APL workspace (Ken's original?) 1966 1967#------------------------------------------------------------------------------ 1968# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ 1969# apple: file(1) magic for Apple file formats 1970# 19710 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 19720 string \x0aGL Binary II (apple ][) data 19730 string \x76\xff Squeezed (apple ][) data 19740 string NuFile NuFile archive (apple ][) data 19750 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 19760 belong 0x00051600 AppleSingle encoded Macintosh file 19770 belong 0x00051607 AppleDouble encoded Macintosh file 1978 1979# Type: Apple Emulator WOZ format 1980# From: Greg Wildman <greg@apple2.org.za> 1981# Ref: https://applesaucefdc.com/woz/reference/ 1982# Ref: https://applesaucefdc.com/woz/reference2/ 1983# 1984# Note: The following test are mostly identical. I would rather not 1985# use a regex to identify the WOZ format number. 19860 string WOZ1 1987>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 1988>12 string INFO 1989>>21 byte 01 \b, 5.25 inch 1990>>21 byte 02 \b, 3.5 inch 1991>>22 byte 01 \b, write protected 1992>>23 byte 01 \b, cross track synchronized 1993>>25 string/T x \b, %.32s 19940 string WOZ2 1995>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 1996>12 string INFO 1997>>21 byte 01 \b, 5.25 inch 1998>>21 byte 02 \b, 3.5 inch 1999>>22 byte 01 \b, write protected 2000>>23 byte 01 \b, cross track synchronized 2001>>25 string/T x \b, %.32s 2002 2003# Type: Apple Emulator disk images 2004# From: Greg Wildman <greg@apple2.org.za> 2005# ProDOS boot loader? 20060 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 2007# Detect Volume Directory block ($02) 2008>0x400 string \x00\x00\x03\x00 2009>>0x404 byte &0xF0 2010>>>0x405 string x \b, Volume /%s 2011>>>0x429 leshort x \b, %u Blocks 2012# ProDOS ordered ? 2013>0xb00 string \x00\x00\x03\x00 2014>>0xb04 byte &0xF0 2015>>>0xb05 string x \b, Volume /%s 2016>>>0xb29 leshort x \b, %u Blocks 2017# 2018# DOS3.3 boot loader? 20190 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B 2020>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image 2021>>0x11006 byte x \b, Volume %u 2022>>0x11034 byte x \b, %u Tracks 2023>>0x11035 byte x \b, %u Sectors 2024>>0x11036 leshort x \b, %u bytes per sector 2025# DOS3.2 ? 2026>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image 2027>>0x11006 byte x \b, Volume %u 2028>>0x11034 byte x \b, %u Tracks 2029>>0x11035 byte x \b, %u Sectors 2030>>0x11036 leshort x \b, %u bytes per sector 2031# DOS3.1 ? 2032>0x11001 string \x11\x0C\x01 2033>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image 2034# 2035# Pascal boot loader? 20360 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 2037>0xd6 pstring SYSTEM.APPLE 2038>>0xb00 leshort 0x0000 2039>>>0xb04 leshort 0x0000 Apple Pascal Image 2040>>>>0xb06 pstring x \b, Volume %s: 2041>>>>0xb0e leshort x \b, %u Blocks 2042>>>>0xb10 leshort x \b, %u Files 2043# 2044# Diversi Dos boot loader? 20450 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 2046>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 2047>>0x11006 byte x \b, Volume %u 2048>>0x11034 byte x \b, %u Tracks 2049>>0x11035 byte x \b, %u Sectors 2050>>0x11036 leshort x \b, %u bytes per sector 2051 2052# Type: Apple Emulator 2IMG format 2053# From: Radek Vokal <rvokal@redhat.com> 2054# Update: Greg Wildman <greg@apple2.org.za> 20550 string 2IMG Apple ][ 2IMG Disk Image 2056>4 clear x 2057>4 string XGS! \b, XGS 2058>4 string CTKG \b, Catakig 2059>4 string ShIm \b, Sheppy's ImageMaker 2060>4 string SHEP \b, Sheppy's ImageMaker 2061>4 string WOOF \b, Sweet 16 2062>4 string B2TR \b, Bernie ][ the Rescue 2063>4 string \!nfc \b, ASIMOV2 2064>4 string \>BD\< \b, Brutal Deluxe's Cadius 2065>4 string CdrP \b, CiderPress 2066>4 string Vi][ \b, Virtual ][ 2067>4 string PRFS \b, ProFUSE 2068>4 string FISH \b, FishWings 2069>4 string RVLW \b, Revival for Windows 2070>4 default x 2071>>4 string x \b, Creator tag "%-4.4s" 2072>0xc byte 00 \b, DOS 3.3 sector order 2073>>0x10 byte 00 \b, Volume 254 2074>>0x10 byte&0x7f x \b, Volume %u 2075>0xc byte 01 \b, ProDOS sector order 2076# Detect Volume Directory block ($02) + 2mg header offset 2077>>0x440 string \x00\x00\x03\x00 2078>>>0x444 byte &0xF0 2079>>>>0x445 string x \b, Volume /%s 2080>>>>0x469 leshort x \b, %u Blocks 2081>0xc byte 02 \b, NIB data 2082 2083# magic for Newton PDA package formats 2084# from Ruda Moura <ruda@helllabs.org> 20850 string package0 Newton package, NOS 1.x, 2086>12 belong &0x80000000 AutoRemove, 2087>12 belong &0x40000000 CopyProtect, 2088>12 belong &0x10000000 NoCompression, 2089>12 belong &0x04000000 Relocation, 2090>12 belong &0x02000000 UseFasterCompression, 2091>16 belong x version %d 2092 20930 string package1 Newton package, NOS 2.x, 2094>12 belong &0x80000000 AutoRemove, 2095>12 belong &0x40000000 CopyProtect, 2096>12 belong &0x10000000 NoCompression, 2097>12 belong &0x04000000 Relocation, 2098>12 belong &0x02000000 UseFasterCompression, 2099>16 belong x version %d 2100 21010 string package4 Newton package, 2102>8 byte 8 NOS 1.x, 2103>8 byte 9 NOS 2.x, 2104>12 belong &0x80000000 AutoRemove, 2105>12 belong &0x40000000 CopyProtect, 2106>12 belong &0x10000000 NoCompression, 2107 2108# The following entries for the Apple II are for files that have 2109# been transferred as raw binary data from an Apple, without having 2110# been encapsulated by any of the above archivers. 2111# 2112# In general, Apple II formats are hard to identify because Apple DOS 2113# and especially Apple ProDOS have strong typing in the file system and 2114# therefore programmers never felt much need to include type information 2115# in the files themselves. 2116# 2117# Eric Fischer <enf@pobox.com> 2118 2119# AppleWorks word processor: 2120# URL: https://en.wikipedia.org/wiki/AppleWorks 2121# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 2122# Update: Joerg Jenderek 2123# NOTE: 2124# The "O" is really the magic number, but that's so common that it's 2125# necessary to check the tab stops that follow it to avoid false positives. 2126# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 2127# the newer AppleWorks is from claris with extension CWK 21284 string O 2129# test for unused bits of zoom- , paginated-boolean bytes 2130>84 ubequad ^0x00Fe00000000Fe00 2131# look for tabstop definitions "=" no tab, "|" no tab 2132# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 2133# unofficial "!" other , "\x8a" other 2134# official only if SFMinVers is nonzero 2135>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 2136# AppleWorks Word Processor File (Apple II) 2137# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 2138# application/x-appleworks is mime type for claris version with cwk extension 2139!:mime application/x-appleworks3 2140# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 2141# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 2142# $70 $1A $F8 $FF is this the apple type ? 2143#:apple pdosp^Z\xf8\xff 2144!:ext awp 2145# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 2146>>>183 ubyte 30 3.0 2147>>>183 ubyte !30 2148>>>>183 ubyte !0 0x%x 2149# usual tabstop start sequence "=====<" 2150>>>5 string x \b, tabstop ruler "%6.6s" 2151# tabstop ruler 2152#>>>5 string >\0 \b, tabstops "%-79s" 2153# zoom switch 2154>>>85 byte&0x01 >0 \b, zoomed 2155# whether paginated 2156>>>90 byte&0x01 >0 \b, paginated 2157# contains any mail-merge commands 2158>>>92 byte&0x01 >0 \b, with mail merge 2159# left margin in 1/10 inches ( normally 0 or 10 ) 2160>>>91 ubyte >0 2161>>>>91 ubyte x \b, %d/10 inch left margin 2162 2163# AppleWorks database: 2164# 2165# This isn't really a magic number, but it's the closest thing to one 2166# that I could find. The 1 and 2 really mean "order in which you defined 2167# categories" and "left to right, top to bottom," respectively; the D and R 2168# mean that the cursor should move either down or right when you press Return. 2169 2170#30 string \x01D AppleWorks database data 2171#30 string \x02D AppleWorks database data 2172#30 string \x01R AppleWorks database data 2173#30 string \x02R AppleWorks database data 2174 2175# AppleWorks spreadsheet: 2176# 2177# Likewise, this isn't really meant as a magic number. The R or C means 2178# row- or column-order recalculation; the A or M means automatic or manual 2179# recalculation. 2180 2181#131 string RA AppleWorks spreadsheet data 2182#131 string RM AppleWorks spreadsheet data 2183#131 string CA AppleWorks spreadsheet data 2184#131 string CM AppleWorks spreadsheet data 2185 2186# Applesoft BASIC: 2187# 2188# This is incredibly sloppy, but will be true if the program was 2189# written at its usual memory location of 2048 and its first line 2190# number is less than 256. Yuck. 2191# update by Joerg Jenderek at Feb 2013 2192 2193# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 2194#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 21950 belong&0x00ff00ff 0x00080000 2196# assuming that line number must be positive 2197>2 leshort >0 Applesoft BASIC program data, first line number %d 2198#>2 leshort x \b, first line number %d 2199 2200# ORCA/EZ assembler: 2201# 2202# This will not identify ORCA/M source files, since those have 2203# some sort of date code instead of the two zero bytes at 6 and 7 2204# XXX Conflicts with ELF 2205#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 2206#>5 byte x \b, build number %d 2207 2208# Broderbund Fantavision 2209# 2210# I don't know what these values really mean, but they seem to recur. 2211# Will they cause too many conflicts? 2212 2213# Probably :-) 2214#2 belong&0xFF00FF 0x040008 Fantavision movie data 2215 2216# Some attempts at images. 2217# 2218# These are actually just bit-for-bit dumps of the frame buffer, so 2219# there's really no reasonably way to distinguish them except for their 2220# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 2221# or, occasionally, 8184. 2222# 2223# Nevertheless this will manage to catch a lot of images that happen 2224# to have a solid-colored line at the bottom of the screen. 2225 2226# GRR: Magic too weak 2227#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 2228#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 2229#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 2230#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 2231#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 2232 2233# Beagle Bros. Apple Mechanic fonts 2234 22350 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 2236 2237# Apple Universal Disk Image Format (UDIF) - dmg files. 2238# From Johan Gade. 2239# These entries are disabled for now until we fix the following issues. 2240# 2241# Note there might be some problems with the "VAX COFF executable" 2242# entry. Note this entry should be placed before the mac filesystem section, 2243# particularly the "Apple Partition data" entry. 2244# 2245# The intended meaning of these tests is, that the file is only of the 2246# specified type if both of the lines are correct - i.e. if the first 2247# line matches and the second doesn't then it is not of that type. 2248# 2249#0 long 0x7801730d 2250#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 2251# 2252# Note that this entry is recognized correctly by the "Apple Partition 2253# data" entry - however since this entry is more specific - this 2254# information seems to be more useful. 2255#0 long 0x45520200 2256#>0x410 string disk\ image UDIF read/write image (UDRW) 2257 2258# From: Toby Peterson <toby@apple.com> 22590 string bplist00 Apple binary property list 2260 2261# Apple binary property list (bplist) 2262# Assumes version bytes are hex. 2263# Provides content hints for version 0 files. Assumes that the root 2264# object is the first object (true for CoreFoundation implementation). 2265# From: David Remahl <dremahl@apple.com> 22660 string bplist 2267>6 byte x \bCoreFoundation binary property list data, version 0x%c 2268>>7 byte x \b%c 2269>6 string 00 \b 2270>>8 byte&0xF0 0x00 \b 2271>>>8 byte&0x0F 0x00 \b, root type: null 2272>>>8 byte&0x0F 0x08 \b, root type: false boolean 2273>>>8 byte&0x0F 0x09 \b, root type: true boolean 2274>>8 byte&0xF0 0x10 \b, root type: integer 2275>>8 byte&0xF0 0x20 \b, root type: real 2276>>8 byte&0xF0 0x30 \b, root type: date 2277>>8 byte&0xF0 0x40 \b, root type: data 2278>>8 byte&0xF0 0x50 \b, root type: ascii string 2279>>8 byte&0xF0 0x60 \b, root type: unicode string 2280>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 2281>>8 byte&0xF0 0xa0 \b, root type: array 2282>>8 byte&0xF0 0xd0 \b, root type: dictionary 2283 2284# Apple/NeXT typedstream data 2285# Serialization format used by NeXT and Apple for various 2286# purposes in YellowStep/Cocoa, including some nib files. 2287# From: David Remahl <dremahl@apple.com> 22882 string typedstream NeXT/Apple typedstream data, big endian 2289>0 byte x \b, version %d 2290>0 byte <5 \b 2291>>13 byte 0x81 \b 2292>>>14 ubeshort x \b, system %d 22932 string streamtyped NeXT/Apple typedstream data, little endian 2294>0 byte x \b, version %d 2295>0 byte <5 \b 2296>>13 byte 0x81 \b 2297>>>14 uleshort x \b, system %d 2298 2299#------------------------------------------------------------------------------ 2300# CAF: Apple CoreAudio File Format 2301# 2302# Container format for high-end audio purposes. 2303# From: David Remahl <dremahl@apple.com> 2304# 23050 string caff CoreAudio Format audio file 2306>4 beshort <10 version %d 2307>6 beshort x 2308 2309 2310#------------------------------------------------------------------------------ 2311# Keychain database files 23120 string kych Mac OS X Keychain File 2313 2314#------------------------------------------------------------------------------ 2315# Code Signing related file types 23160 belong 0xfade0c00 Mac OS X Code Requirement 2317>8 belong 1 (opExpr) 2318>4 belong x - %d bytes 2319 23200 belong 0xfade0c01 Mac OS X Code Requirement Set 2321>8 belong >1 containing %d items 2322>4 belong x - %d bytes 2323 23240 belong 0xfade0c02 Mac OS X Code Directory 2325>8 belong x version %x 2326>12 belong >0 flags 0x%x 2327>4 belong x - %d bytes 2328 23290 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 2330>4 belong x - %d bytes 2331 23320 belong 0xfade0cc1 Mac OS X Detached Code Signature 2333>8 belong >1 (%d elements) 2334>4 belong x - %d bytes 2335 2336# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2337# .vdi 23384 string innotek\ VirtualBox\ Disk\ Image %s 2339 2340# Apple disk partition stuff 2341# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2342# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 2343# Update: Joerg Jenderek 2344# "ER" is APPLE_DRVR_MAP_MAGIC signature 23450 beshort 0x4552 2346# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 2347#!:strength +0 2348# strengthen the magic by looking for used blocksizes 512 2048 2349>2 ubeshort&0xf1FF 0 Apple Driver Map 2350# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 2351#>>504 ubequad&0x0000FFffFFff0000 0 2352!:mime application/x-apple-diskimage 2353!:apple ????devr 2354# https://en.wikipedia.org/wiki/Apple_Disk_Image 2355!:ext dmg/iso 2356# sbBlkSize for driver descriptor map 512 2048 2357>>2 beshort x \b, blocksize %d 2358# sbBlkCount sometimes garbish like 2359# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 2360# 0xf2720100 for bunziped Firefox 48.0-2.dmg 2361# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 2362# 0x00009090 by syslinux-6.03/utils/isohybrid.c 2363>>4 ubelong x \b, blockcount %u 2364# following device/driver information not very useful 2365# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2366>>8 ubeshort x \b, devtype %u 2367# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2368>>10 ubeshort x \b, devid %u 2369# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2370>>12 ubelong >0 2371>>>12 ubelong x \b, driver data %u 2372# number of driver descriptors sbDrvrCount <= 61 2373# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2374>>16 ubeshort x \b, driver count %u 2375# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 2376# >>18 use apple-driver-map 2377# >>26 use apple-driver-map 2378# # ... 2379# >>500 use apple-driver-map 2380# number of partitions is always same in every partition (map block count) 2381#>>0x0204 ubelong x \b, %u partitions 2382>>0x0204 ubelong >0 \b, contains[@0x200]: 2383>>>0x0200 use apple-apm 2384>>0x0204 ubelong >1 \b, contains[@0x400]: 2385>>>0x0400 use apple-apm 2386>>0x0204 ubelong >2 \b, contains[@0x600]: 2387>>>0x0600 use apple-apm 2388>>0x0204 ubelong >3 \b, contains[@0x800]: 2389>>>0x0800 use apple-apm 2390>>0x0204 ubelong >4 \b, contains[@0xA00]: 2391>>>0x0A00 use apple-apm 2392>>0x0204 ubelong >5 \b, contains[@0xC00]: 2393>>>0x0C00 use apple-apm 2394>>0x0204 ubelong >6 \b, contains[@0xE00]: 2395>>>0x0E00 use apple-apm 2396>>0x0204 ubelong >7 \b, contains[@0x1000]: 2397>>>0x1000 use apple-apm 2398# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 23990 name apple-driver-map 2400>0 ubequad !0 2401# descBlock first block of driver 2402>>0 ubelong x \b, driver start block %u 2403# descSize driver size in blocks 2404>>4 ubeshort x \b, size %u 2405# descType driver system type 1 701h F8FFh FFFFh 2406>>6 ubeshort x \b, type 0x%x 2407 2408# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2409# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2410# Update: Joerg Jenderek 2411# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2412# magic stronger. 2413# for apple partition map stored as a single file 24140 belong 0x504d0000 2415# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2416#!:strength +0 2417>0 use apple-apm 2418# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2419# file: could not find any valid magic files! 2420#!:ext bin 2421# display apple partition map. Normally called after Apple driver map 24220 name apple-apm 2423>0 belong 0x504d0000 Apple Partition Map 2424# number of partitions 2425>>4 ubelong x \b, map block count %u 2426# logical block (512 bytes) start of partition 2427>>8 ubelong x \b, start block %u 2428>>12 ubelong x \b, block count %u 2429>>16 string >0 \b, name %s 2430>>48 string >0 \b, type %s 2431# processor type dpme_process_id[16] e.g. "68000" "68020" 2432>>120 string >0 \b, processor %s 2433# A/UX boot arguments BootArgs[128] 2434>>136 string >0 \b, boot arguments %s 2435# status of partition dpme_flags 2436>>88 belong & 1 \b, valid 2437>>88 belong & 2 \b, allocated 2438>>88 belong & 4 \b, in use 2439>>88 belong & 8 \b, has boot info 2440>>88 belong & 16 \b, readable 2441>>88 belong & 32 \b, writable 2442>>88 belong & 64 \b, pic boot code 2443>>88 belong & 128 \b, chain compatible driver 2444>>88 belong & 256 \b, real driver 2445>>88 belong & 512 \b, chain driver 2446# mount automatically at startup APPLE_PS_AUTO_MOUNT 2447>>88 ubelong &0x40000000 \b, mount at startup 2448# is the startup partition APPLE_PS_STARTUP 2449>>88 ubelong &0x80000000 \b, is the startup partition 2450 2451#https://wiki.mozilla.org/DS_Store_File_Format 2452#https://en.wikipedia.org/wiki/.DS_Store 24530 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2454 2455# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2456# Usually not in separate files, but have either filename rsrc with 2457# no extension, or a filename corresponding to another file, with 2458# extensions rsr/rsrc 24590 string \000\000\001\000 2460>4 leshort 0 2461>>16 lelong 0 Apple HFS/HFS+ resource fork 2462 2463#https://en.wikipedia.org/wiki/AppleScript 24640 string FasdUAS AppleScript compiled 2465 2466# AppleWorks/ClarisWorks 2467# https://github.com/joshenders/appleworks_format 2468# http://fileformats.archiveteam.org/wiki/AppleWorks 24690 name appleworks 2470>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2471>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2472>0 default x 2473>>0 belong x AppleWorks/ClarisWorks CWK Document 2474>0 byte x \b, version %d 2475>30 beshort x \b, %d 2476>32 beshort x \bx%d 2477!:ext cwk 2478 24794 string BOBO 2480>0 byte >4 2481>>12 belong 0 2482>>>26 belong 0 2483>>>>0 use appleworks 2484>0 belong 0x0481ad00 2485>>0 use appleworks 2486 2487# magic for Apple File System (APFS) 2488# from Alex Myczko <alex@aiei.ch> 248932 string NXSB Apple File System (APFS) 2490>36 ulelong x \b, blocksize %u 2491 2492# iTunes cover art (versions 1 and 2) 24934 string itch 2494>24 string artw 2495>>0x1e8 string data iTunes cover art 2496>>>0x1ed string PNG (PNG) 2497>>>0x1ec beshort 0xffd8 (JPEG) 2498 2499# MacPaint image 250065 string PNTGMPNT MacPaint image data 2501#0 belong 2 MacPaint image data 2502 2503#------------------------------------------------------------------------------ 2504# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2505# application: file(1) magic for applications on small devices 2506# 2507# Pebble Application 25080 string PBLAPP\000\000 Pebble application 2509 2510#------------------------------------------------------------------------------ 2511# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2512# applix: file(1) magic for Applixware 2513# From: Peter Soos <sp@osb.hu> 2514# 25150 string *BEGIN Applixware 2516>7 string WORDS Words Document 2517>7 string GRAPHICS Graphic 2518>7 string RASTER Bitmap 2519>7 string SPREADSHEETS Spreadsheet 2520>7 string MACRO Macro 2521>7 string BUILDER Builder Object 2522 2523#------------------------------------------------------------------------------ 2524# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2525# apt: file(1) magic for APT Cache files 2526# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2527# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2528 2529# before version 10 ("old format"), data was in arch-specific long/short 2530 2531# old format 64 bit 25320 name apt-cache-64bit-be 2533>12 beshort 1 \b, dirty 2534>40 bequad x \b, %llu packages 2535>48 bequad x \b, %llu versions 2536 2537# old format 32 bit 25380 name apt-cache-32bit-be 2539>8 beshort 1 \b, dirty 2540>40 belong x \b, %u packages 2541>44 belong x \b, %u versions 2542 2543# new format 25440 name apt-cache-be 2545>6 byte 1 \b, dirty 2546>24 belong x \b, %u packages 2547>28 belong x \b, %u versions 2548 25490 bequad 0x98FE76DC 2550>8 ubeshort <10 APT cache data, version %u 2551>>10 beshort x \b.%u, 64 bit big-endian 2552>>0 use apt-cache-64bit-be 2553 25540 lequad 0x98FE76DC 2555>8 uleshort <10 APT cache data, version %u 2556>>10 leshort x \b.%u, 64 bit little-endian 2557>>0 use \^apt-cache-64bit-be 2558 25590 belong 0x98FE76DC 2560>4 ubeshort <10 APT cache data, version %u 2561>>6 ubeshort x \b.%u, 32 bit big-endian 2562>>0 use apt-cache-32bit-be 2563>4 ubyte >9 APT cache data, version %u 2564>>5 ubyte x \b.%u, big-endian 2565>>0 use apt-cache-be 2566 25670 lelong 0x98FE76DC 2568>4 uleshort <10 APT cache data, version %u 2569>>6 uleshort x \b.%u, 32 bit little-endian 2570>>0 use \^apt-cache-32bit-be 2571>4 ubyte >9 APT cache data, version %u 2572>>5 ubyte x \b.%u, little-endian 2573>>0 use \^apt-cache-be 2574#------------------------------------------------------------------------------ 2575# $File: archive,v 1.145 2021/01/03 20:58:47 christos Exp $ 2576# archive: file(1) magic for archive formats (see also "msdos" for self- 2577# extracting compressed archives) 2578# 2579# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2580# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2581 2582# POSIX tar archives 2583# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2584# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2585# header mainly padded with nul bytes 2586500 quad 0 2587!:strength /2 2588# filename or extended attribute printable strings in range space null til umlaut ue 2589>0 ubeshort >0x1F00 2590>>0 ubeshort <0xFCFD 2591# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2592# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2593>>>508 ubelong&0x8B9E8DFF 0 2594# nul, space or ascii digit 0-7 at start of mode 2595>>>>100 ubyte&0xC8 =0 2596>>>>>101 ubyte&0xC8 =0 2597# nul, space at end of check sum 2598>>>>>>155 ubyte&0xDF =0 2599# space or ascii digit 0 at start of check sum 2600>>>>>>>148 ubyte&0xEF =0x20 2601>>>>>>>>0 use tar-file 2602# minimal check and then display tar archive information which can also be 2603# embedded inside others like Android Backup, Clam AntiVirus database 26040 name tar-file 2605>257 string !ustar 2606# header padded with nuls 2607>>257 ulong =0 2608# GNU tar version 1.29 with non pax format option without refusing 2609# creates misleading V7 header for Long path, Multi-volume, Volume type 2610>>>156 ubyte 0x4c GNU tar archive 2611!:mime application/x-gtar 2612!:ext tar/gtar 2613>>>156 ubyte 0x4d GNU tar archive 2614!:mime application/x-gtar 2615!:ext tar/gtar 2616>>>156 ubyte 0x56 GNU tar archive 2617!:mime application/x-gtar 2618!:ext tar/gtar 2619>>>156 default x tar archive (V7) 2620!:mime application/x-tar 2621!:ext tar 2622# other stuff in padding 2623# some implementations add new fields to the blank area at the end of the header record 2624# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2625>>257 ulong !0 tar archive (old) 2626!:mime application/x-tar 2627!:ext tar 2628# magic in newer, GNU, posix variants 2629>257 string =ustar 2630# 2 last char of magic and UStar version because string expression does not work 2631# 2 space characters followed by a null for GNU variant 2632>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2633!:mime application/x-gtar 2634!:ext tar/gtar 2635# UStar version with ASCII "00" 2636>>261 ubelong 0x72003030 POSIX 2637# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2638>>>156 ubyte 0x67 \b.1-2001 2639>>>156 ubyte 0x78 \b.1-2001 2640>>>156 ubyte x tar archive 2641!:mime application/x-ustar 2642!:ext tar/ustar 2643# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2644>>261 ubelong 0x72000000 tar archive (ustar) 2645!:mime application/x-ustar 2646!:ext tar/ustar 2647# not seen ustar variant with garbish version 2648>>261 default x tar archive (unknown ustar) 2649!:mime application/x-ustar 2650!:ext tar/ustar 2651# type flag of 1st tar archive member 2652#>156 ubyte x \b, %c-type 2653>156 ubyte x 2654>>156 ubyte 0 \b, file 2655>>156 ubyte 0x30 \b, file 2656>>156 ubyte 0x31 \b, hard link 2657>>156 ubyte 0x32 \b, symlink 2658>>156 ubyte 0x33 \b, char device 2659>>156 ubyte 0x34 \b, block device 2660>>156 ubyte 0x35 \b, directory 2661>>156 ubyte 0x36 \b, fifo 2662>>156 ubyte 0x37 \b, reserved 2663>>156 ubyte 0x4c \b, long path 2664>>156 ubyte 0x4d \b, multi volume 2665>>156 ubyte 0x56 \b, volume 2666>>156 ubyte 0x67 \b, global 2667>>156 ubyte 0x78 \b, extension 2668>>156 default x \b, type 2669>>>156 ubyte x '%c' 2670# name[100] 2671>0 string >\0 %-.60s 2672# mode mainly stored as an octal number in ASCII null or space terminated 2673>100 string >\0 \b, mode %-.7s 2674# user id mainly as octal numbers in ASCII null or space terminated 2675>108 string >\0 \b, uid %-.7s 2676# group id mainly as octal numbers in ASCII null or space terminated 2677>116 string >\0 \b, gid %-.7s 2678# size mainly as octal number in ASCII 2679>124 ubyte <0x38 2680>>124 string >\0 \b, size %-.12s 2681# coding indicated by setting the high-order bit of the leftmost byte 2682>124 ubyte >0xEF \b, size 0x 2683>>124 ubyte !0xff \b%2.2x 2684>>125 ubyte !0xff \b%2.2x 2685>>126 ubyte !0xff \b%2.2x 2686>>127 ubyte !0xff \b%2.2x 2687>>128 ubyte !0xff \b%2.2x 2688>>129 ubyte !0xff \b%2.2x 2689>>130 ubyte !0xff \b%2.2x 2690>>131 ubyte !0xff \b%2.2x 2691>>132 ubyte !0xff \b%2.2x 2692>>133 ubyte !0xff \b%2.2x 2693>>134 ubyte !0xff \b%2.2x 2694>>135 ubyte !0xff \b%2.2x 2695# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2696>136 string >\0 \b, seconds %-.11s 2697# header checksum stored as an octal number in ASCII null or space terminated 2698#>148 string x \b, cksum %.7s 2699# linkname[100] 2700>157 string >\0 \b, linkname %-.40s 2701# additional fields for ustar 2702>257 string =ustar 2703# owner user name null terminated 2704>>265 string >\0 \b, user %-.32s 2705# group name null terminated 2706>>297 string >\0 \b, group %-.32s 2707# device major minor if not zero 2708>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2709>>>329 string x \b, devmaj %-.7s 2710>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2711>>>337 string x \b, devmin %-.7s 2712# prefix[155] 2713>>345 string >\0 \b, prefix %-.155s 2714# old non ustar/POSIX tar 2715>257 string !ustar 2716>>508 string =tar\0 2717# padding[255] in old star 2718>>>257 string >\0 \b, padding: %-.40s 2719>>508 default x 2720# padding[255] in old tar sometimes comment field 2721>>>257 string >\0 \b, comment: %-.40s 2722 2723# Incremental snapshot gnu-tar format from: 2724# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 27250 string GNU\ tar- GNU tar incremental snapshot data 2726>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2727 2728# cpio archives 2729# 2730# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2731# The idea is to indicate archives produced on machines with the same 2732# byte order as the machine running "file" with "cpio archive", and 2733# to indicate archives produced on machines with the opposite byte order 2734# from the machine running "file" with "byte-swapped cpio archive". 2735# 2736# The SVR4 "cpio(4)" hints that there are additional formats, but they 2737# are defined as "short"s; I think all the new formats are 2738# character-header formats and thus are strings, not numbers. 27390 short 070707 cpio archive 2740!:mime application/x-cpio 27410 short 0143561 byte-swapped cpio archive 2742!:mime application/x-cpio # encoding: swapped 27430 string 070707 ASCII cpio archive (pre-SVR4 or odc) 27440 string 070701 ASCII cpio archive (SVR4 with no CRC) 27450 string 070702 ASCII cpio archive (SVR4 with CRC) 2746 2747# 2748# Various archive formats used by various versions of the "ar" 2749# command. 2750# 2751 2752# 2753# Original UNIX archive formats. 2754# They were written with binary values in host byte order, and 2755# the magic number was a host "int", which might have been 16 bits 2756# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2757# been ports to little-endian 16-bit-int or 32-bit-int platforms 2758# (x86?) using some of those formats; if none existed, feel free 2759# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2760# 32-bit. There might have been big-endian ports of that sort as 2761# well. 2762# 27630 leshort 0177555 very old 16-bit-int little-endian archive 27640 beshort 0177555 very old 16-bit-int big-endian archive 27650 lelong 0177555 very old 32-bit-int little-endian archive 27660 belong 0177555 very old 32-bit-int big-endian archive 2767 27680 leshort 0177545 old 16-bit-int little-endian archive 2769>2 string __.SYMDEF random library 27700 beshort 0177545 old 16-bit-int big-endian archive 2771>2 string __.SYMDEF random library 27720 lelong 0177545 old 32-bit-int little-endian archive 2773>4 string __.SYMDEF random library 27740 belong 0177545 old 32-bit-int big-endian archive 2775>4 string __.SYMDEF random library 2776 2777# 2778# From "pdp" (but why a 4-byte quantity?) 2779# 27800 lelong 0x39bed PDP-11 old archive 27810 lelong 0x39bee PDP-11 4.0 archive 2782 2783# 2784# XXX - what flavor of APL used this, and was it a variant of 2785# some ar archive format? It's similar to, but not the same 2786# as, the APL workspace magic numbers in pdp. 2787# 27880 long 0100554 apl workspace 2789 2790# 2791# System V Release 1 portable(?) archive format. 2792# 27930 string =<ar> System V Release 1 ar archive 2794!:mime application/x-archive 2795 2796# 2797# Debian package; it's in the portable archive format, and needs to go 2798# before the entry for regular portable archives, as it's recognized as 2799# a portable archive whose first member has a name beginning with 2800# "debian". 2801# 2802# Update: Joerg Jenderek 2803# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 28040 string =!<arch>\ndebian 2805# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 2806>14 string -split part of multipart Debian package 2807!:mime application/vnd.debian.binary-package 2808# udeb is used for stripped down deb file 2809!:ext deb/udeb 2810>14 string -binary Debian binary package 2811!:mime application/vnd.debian.binary-package 2812# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 2813!:ext deb/udeb/ipk 2814# This should not happen 2815>14 default x Unknown Debian package 2816# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split 2817>68 string >\0 (format %s) 2818#>68 string !2.0\n 2819#>>68 string x (format %.3s) 2820>68 string =2.0\n 2821# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 2822>>72 string >\0 \b, with %.14s 2823# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 2824>>0 search/0x93e4f data.tar. \b, data compression 2825# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 2826# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 2827>>>&0 string x %.2s 2828# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 2829>>>&2 ubyte !0x20 2830>>>>&-1 ubyte !0x2f 2831# display 3rd character of file name extension like 2 of bz2 or m of lzma 2832>>>>>&-1 ubyte x \b%c 2833>>>>>>&0 ubyte !0x20 2834>>>>>>>&-1 ubyte !0x2f 2835# display 4th character of file name extension like a of lzma 2836>>>>>>>>&-1 ubyte x \b%c 2837# split debian package case 2838>68 string =2.1\n 2839# dpkg-1.18.25/dpkg-split/info.c 2840# NL terminated ASCII package name like ckermit 2841>>&0 string x \b, %s 2842# NL terminated package version like 302-5.3 2843>>>&1 string x %s 2844# NL terminated MD5 checksum 2845>>>>&1 string x \b, MD5 %s 2846# NL terminated original package length 2847>>>>>&1 string x \b, unsplitted size %s 2848# NL terminated part length 2849>>>>>>&1 string x \b, part length %s 2850# NL terminated package part like n/m 2851>>>>>>>&1 string x \b, part %s 2852# NL terminated package architecture like armhf since dpkg 1.16.1 or later 2853>>>>>>>>&1 string x \b, %s 2854 2855# 2856# MIPS archive; they're in the portable archive format, and need to go 2857# before the entry for regular portable archives, as it's recognized as 2858# a portable archive whose first member has a name beginning with 2859# "__________E". 2860# 28610 string =!<arch>\n__________E MIPS archive 2862!:mime application/x-archive 2863>20 string U with MIPS Ucode members 2864>21 string L with MIPSEL members 2865>21 string B with MIPSEB members 2866>19 string L and an EL hash table 2867>19 string B and an EB hash table 2868>22 string X -- out of date 2869 2870# 2871# BSD/SVR2-and-later portable archive formats. 2872# 2873# Update: Joerg Jenderek 2874# URL: http://fileformats.archiveteam.org/wiki/AR 2875# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 2876# Note: Mach-O universal binary in ./cafebabe is dependent 2877# TODO: unify current ar archive, MIPS archive, Debian package 2878# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 2879# *.ar packages from *.a libraries. handle empty archive 28800 string =!<arch>\n current ar archive 2881# print first and possibly second ar_name[16] for debugging purpose 2882#>8 string x \b, 1st "%.16s" 2883#>68 string x \b, 2nd "%.16s" 2884!:mime application/x-archive 2885# a in most case for libraries; lib for Microsoft libraries; ar else cases 2886!:ext a/lib/ar 2887>8 string __.SYMDEF random library 2888# first member with long marked name __.SYMDEF SORTED implies BSD library 2889>68 string __.SYMDEF\ SORTED random library 2890# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 2891# "archive file" entry moved from ./hp 2892# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 2893# LST header a_magic 0619h~relocatable library 2894>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 2895>68 belong 0x02100619 - PA-RISC1.1 relocatable library 2896>68 belong 0x02110619 - PA-RISC1.2 relocatable library 2897>68 belong 0x02140619 - PA-RISC2.0 relocatable library 2898#EOF for common ar archives 2899 2900# 2901# "Thin" archive, as can be produced by GNU ar. 2902# 29030 string =!<thin>\n thin archive with 2904>68 belong 0 no symbol entries 2905>68 belong 1 %d symbol entry 2906>68 belong >1 %d symbol entries 2907 29080 search/1 -h- Software Tools format archive text 2909 2910# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2911# 2912# The first byte is the magic (0x1a), byte 2 is the compression type for 2913# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2914# filename of the first file (null terminated). Since some types collide 2915# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2916# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 29170 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2918!:mime application/x-arc 29190 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2920!:mime application/x-arc 29210 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2922!:mime application/x-arc 29230 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2924!:mime application/x-arc 29250 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2926!:mime application/x-arc 29270 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2928!:mime application/x-arc 2929# [JW] stuff taken from idarc, obviously ARC successors: 29300 lelong&0x8080ffff 0x00000a1a PAK archive data 2931!:mime application/x-arc 29320 lelong&0x8080ffff 0x0000141a ARC+ archive data 2933!:mime application/x-arc 29340 lelong&0x8080ffff 0x0000481a HYP archive data 2935!:mime application/x-arc 2936 2937# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2938# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2939# [GRR: the original entries collide with ARC, above; replaced with combined 2940# version (not tested)] 2941#0 byte 0x1a RISC OS archive (spark format) 29420 string \032archive RISC OS archive (ArcFS format) 29430 string Archive\000 RISC OS archive (ArcFS format) 2944 2945# All these were taken from idarc, many could not be verified. Unfortunately, 2946# there were many low-quality sigs, i.e. easy to trigger false positives. 2947# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2948# to get my hands on the actual archiver and see if I find something better. [JW] 2949# probably many can be enhanced by finding some 0-byte or control char near the start 2950 2951# idarc calls this Crush/Uncompressed... *shrug* 29520 string CRUSH Crush archive data 2953# Squeeze It (.sqz) 29540 string HLSQZ Squeeze It archive data 2955# SQWEZ 29560 string SQWEZ SQWEZ archive data 2957# HPack (.hpk) 29580 string HPAK HPack archive data 2959# HAP 29600 string \x91\x33HF HAP archive data 2961# MD/MDCD 29620 string MDmd MDCD archive data 2963# LIM 29640 string LIM\x1a LIM archive data 2965# SAR 29663 string LH5 SAR archive data 2967# BSArc/BS2 29680 string \212\3SB\020\0 BSArc/BS2 archive data 2969# Bethesda Softworks Archive (Oblivion) 29700 string BSA\0 BSArc archive data 2971>4 lelong x version %d 2972# MAR 29732 string =-ah MAR archive data 2974# ACB 2975#0 belong&0x00f800ff 0x00800000 ACB archive data 2976# CPZ 2977# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2978# JRC 29790 string JRchive JRC archive data 2980# Quantum 29810 string DS\0 Quantum archive data 2982# ReSOF 29830 string PK\3\6 ReSOF archive data 2984# QuArk 29850 string 7\4 QuArk archive data 2986# YAC 298714 string YC YAC archive data 2988# X1 29890 string X1 X1 archive data 29900 string XhDr X1 archive data 2991# CDC Codec (.dqt) 29920 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2993# AMGC 29940 string \xad6" AMGC archive data 2995# NuLIB 29960 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2997# PakLeo 29980 string LEOLZW PAKLeo archive data 2999# ChArc 30000 string SChF ChArc archive data 3001# PSA 30020 string PSA PSA archive data 3003# CrossePAC 30040 string DSIGDCC CrossePAC archive data 3005# Freeze 30060 string \x1f\x9f\x4a\x10\x0a Freeze archive data 3007# KBoom 30080 string \xc2\xa8MP\xc2\xa8 KBoom archive data 3009# NSQ, must go after CDC Codec 30100 string \x76\xff NSQ archive data 3011# DPA 30120 string Dirk\ Paehl DPA archive data 3013# BA 3014# TODO: idarc says "bytes 0-2 == bytes 3-5" 3015# TTComp 3016# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 3017# Update: Joerg Jenderek 3018# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 30190 string \0\6 3020# look for first keyword of Panorama database *.pan 3021>12 search/261 DESIGN 3022# skip keyword with low entropy 3023>12 default x TTComp archive, binary, 4K dictionary 3024# (version 5.25) labeled the above entry as "TTComp archive data" 3025# From: Joerg Jenderek 3026# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification 3027# reference: http://nulib.com/library/FTN.e00005.htm 30280x52 ubeshort 0x0100 3029# test for disk image size equal or above 400k 3030>0x40 ubelong >409599 3031# test also for disk image size equal or below 1440k to skip 3032# windows7en.mbr UNICODE.DAT 3033>>0x40 ubelong <1474561 3034# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes 3035# 00064000 for 400k GCR disks 3036# 000c8000 for 800k GCR disks 3037# 000b4000 for 720k MFM disks 3038# 00168000 for 1440k MFM disks 3039>>>0x40 ubelong&0xffE03fFF 0 3040>>>>0 use dc42-floppy 3041# display information of Apple DiskCopy 4.2 floppy image 30420 name dc42-floppy 3043# image pascal name padded with NULs like Microsoft Mail 3044>00 pstring/B x Apple DiskCopy 4.2 image %s 3045#!:mime application/octet-stream 3046!:mime application/x-dc42-floppy-image 3047!:apple dCpydImg 3048!:ext image/dc42 3049# data size in bytes like 409600 3050>0x40 ubelong x \b, %u bytes 3051# for debugging purpose size in hexadecimal 3052#>0x40 ubelong x (0x%8.8x) 3053# tag size in bytes 3054>0x44 ubelong >0 \b, 0x%x tag size 3055# data checksum 3056#>0x48 ubelong x \b, 0x%x checksum 3057# tag checksum 3058#>0x4c ubelong x \b, 0x%x tag checksum 3059# disk encoding 3060>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 3061>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 3062>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 3063>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 3064>0x50 ubyte >3 \b, 0x%x encoding 3065# format byte 3066>0x51 ubyte x \b, 0x%x format 3067#>0x54 ubequad x \b, data 0x%16.16llx 3068# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 30690 string ESP ESP archive data 3070# ZPack 30710 string \1ZPK\1 ZPack archive data 3072# Sky 30730 string \xbc\x40 Sky archive data 3074# UFA 30750 string UFA UFA archive data 3076# Dry 30770 string =-H2O DRY archive data 3078# FoxSQZ 30790 string FOXSQZ FoxSQZ archive data 3080# AR7 30810 string ,AR7 AR7 archive data 3082# PPMZ 30830 string PPMZ PPMZ archive data 3084# MS Compress 3085# Update: Joerg Jenderek 3086# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 3087# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 3088# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 30894 string \x88\xf0\x27 3090# KWAJ variant 3091>0 string KWAJ MS Compress archive data, KWAJ variant 3092!:mime application/x-ms-compress-kwaj 3093# extension not working in version 5.32 3094# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 3095# file: line 284: Bad magic entry ' ??_' 3096!:ext ??_ 3097# compression method (0-4) 3098>>8 uleshort x \b, %u method 3099# offset of compressed data 3100>>10 uleshort x \b, 0x%x offset 3101#>>(10.s) uleshort x 3102#>>>&-6 string x \b, TEST extension %-.3s 3103# header flags to mark header extensions 3104>>12 uleshort >0 \b, 0x%x flags 3105# 4 bytes: decompressed length of file 3106>>12 uleshort &0x01 3107>>>14 ulelong x \b, original size: %u bytes 3108# 2 bytes: unknown purpose 3109# 2 bytes: length of unknown data + mentioned bytes 3110# 1-9 bytes: null-terminated file name 3111# 1-4 bytes: null-terminated file extension 3112>>12 uleshort &0x08 3113>>>12 uleshort ^0x01 3114>>>>12 uleshort ^0x02 3115>>>>>12 uleshort ^0x04 3116>>>>>>12 uleshort ^0x10 3117>>>>>>>14 string x \b, %-.8s 3118>>>>>>12 uleshort &0x10 3119>>>>>>>14 string x \b, %-.8s 3120>>>>>>>>&1 string x \b.%-.3s 3121>>>>>12 uleshort &0x04 3122>>>>>>12 uleshort ^0x10 3123>>>>>>>(14.s) uleshort x 3124>>>>>>>>&14 string x \b, %-.8s 3125>>>>>>12 uleshort &0x10 3126>>>>>>>(14.s) uleshort x 3127>>>>>>>>&14 string x \b, %-.8s 3128>>>>>>>>>&1 string x \b.%-.3s 3129>>>>12 uleshort &0x02 3130>>>>>12 uleshort ^0x04 3131>>>>>>12 uleshort ^0x10 3132>>>>>>>16 string x \b, %-.8s 3133>>>>>>12 uleshort &0x10 3134>>>>>>>16 string x \b, %-.8s 3135>>>>>>>>&1 string x \b.%-.3s 3136>>>>>12 uleshort &0x04 3137>>>>>>12 uleshort ^0x10 3138>>>>>>>(16.s) uleshort x 3139>>>>>>>>&16 string x \b, %-.8s 3140>>>>>>12 uleshort &0x10 3141>>>>>>>(16.s) uleshort x 3142>>>>>>>&16 string x %-.8s 3143>>>>>>>>&1 string x \b.%-.3s 3144>>>12 uleshort &0x01 3145>>>>12 uleshort ^0x02 3146>>>>>12 uleshort ^0x04 3147>>>>>>12 uleshort ^0x10 3148>>>>>>>18 string x \b, %-.8s 3149>>>>>>12 uleshort &0x10 3150>>>>>>>18 string x \b, %-.8s 3151>>>>>>>>&1 string x \b.%-.3s 3152>>>>>12 uleshort &0x04 3153>>>>>>12 uleshort ^0x10 3154>>>>>>>(18.s) uleshort x 3155>>>>>>>>&18 string x \b, %-.8s 3156>>>>>>12 uleshort &0x10 3157>>>>>>>(18.s) uleshort x 3158>>>>>>>>&18 string x \b, %-.8s 3159>>>>>>>>>&1 string x \b.%-.3s 3160>>>>12 uleshort &0x02 3161>>>>>12 uleshort ^0x04 3162>>>>>>12 uleshort ^0x10 3163>>>>>>>20 string x \b, %-.8s 3164>>>>>>12 uleshort &0x10 3165>>>>>>>20 string x \b, %-.8s 3166>>>>>>>>&1 string x \b.%-.3s 3167>>>>>12 uleshort &0x04 3168>>>>>>12 uleshort ^0x10 3169>>>>>>>(20.s) uleshort x 3170>>>>>>>>&20 string x \b, %-.8s 3171>>>>>>12 uleshort &0x10 3172>>>>>>>(20.s) uleshort x 3173>>>>>>>>&20 string x \b, %-.8s 3174>>>>>>>>>&1 string x \b.%-.3s 3175# 2 bytes: length of data + mentioned bytes 3176# 3177# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 3178>0 string SZDD MS Compress archive data, SZDD variant 3179!:mime application/x-ms-compress-szdd 3180!:ext ??_ 3181# The character missing from the end of the filename (0=unknown) 3182>>9 string >\0 \b, %-.1s is last character of original name 3183# https://www.betaarchive.com/forum/viewtopic.php?t=26161 3184# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 3185>>8 string !A \b, %-.1s method 3186>>10 ulelong >0 \b, original size: %u bytes 3187# QBasic SZDD variant 31883 string \x88\xf0\x27 3189>0 string SZ\x20 MS Compress archive data, QBasic variant 3190!:mime application/x-ms-compress-sz 3191!:ext ??$ 3192>>8 ulelong >0 \b, original size: %u bytes 3193 3194# MP3 (archiver, not lossy audio compression) 31950 string MP3\x1a MP3-Archiver archive data 3196# ZET 31970 string OZ\xc3\x9d ZET archive data 3198# TSComp 31990 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 3200# ARQ 32010 string gW\4\1 ARQ archive data 3202# Squash 32033 string OctSqu Squash archive data 3204# Terse 32050 string \5\1\1\0 Terse archive data 3206# PUCrunch 32070 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 3208# UHarc 32090 string UHA UHarc archive data 3210# ABComp 32110 string \2AB ABComp archive data 32120 string \3AB2 ABComp archive data 3213# CMP 32140 string CO\0 CMP archive data 3215# Splint 32160 string \x93\xb9\x06 Splint archive data 3217# InstallShield 32180 string \x13\x5d\x65\x8c InstallShield Z archive Data 3219# Gather 32201 string GTH Gather archive data 3221# BOA 32220 string BOA BOA archive data 3223# RAX 32240 string ULEB\xa RAX archive data 3225# Xtreme 32260 string ULEB\0 Xtreme archive data 3227# Pack Magic 32280 string @\xc3\xa2\1\0 Pack Magic archive data 3229# BTS 32300 belong&0xfeffffff 0x1a034465 BTS archive data 3231# ELI 5750 32320 string Ora\ ELI 5750 archive data 3233# QFC 32340 string \x1aFC\x1a QFC archive data 32350 string \x1aQF\x1a QFC archive data 3236# PRO-PACK 32370 string RNC PRO-PACK archive data 3238# 777 32390 string 777 777 archive data 3240# LZS221 32410 string sTaC LZS221 archive data 3242# HPA 32430 string HPA HPA archive data 3244# Arhangel 32450 string LG Arhangel archive data 3246# EXP1, uses bzip2 32470 string 0123456789012345BZh EXP1 archive data 3248# IMP 32490 string IMP\xa IMP archive data 3250# NRV 32510 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 3252# Squish 32530 string \x73\xb2\x90\xf4 Squish archive data 3254# Par 32550 string PHILIPP Par archive data 32560 string PAR Par archive data 3257# HIT 32580 string UB HIT archive data 3259# SBX 32600 belong&0xfffff000 0x53423000 SBX archive data 3261# NaShrink 32620 string NSK NaShrink archive data 3263# SAPCAR 32640 string #\ CAR\ archive\ header SAPCAR archive data 32650 string CAR\ 2.00RG SAPCAR archive data 3266# Disintegrator 32670 string DST Disintegrator archive data 3268# ASD 32690 string ASD ASD archive data 3270# InstallShield CAB 32710 string ISc( InstallShield CAB 3272# TOP4 32730 string T4\x1a TOP4 archive data 3274# BatComp left out: sig looks like COM executable 3275# so TODO: get real 4dos batcomp file and find sig 3276# BlakHole 32770 string BH\5\7 BlakHole archive data 3278# BIX 32790 string BIX0 BIX archive data 3280# ChiefLZA 32810 string ChfLZ ChiefLZA archive data 3282# Blink 32830 string Blink Blink archive data 3284# Logitech Compress 32850 string \xda\xfa Logitech Compress archive data 3286# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 32871 string (C)\ STEPANYUK ARS-Sfx archive data 3288# AKT/AKT32 32890 string AKT32 AKT32 archive data 32900 string AKT AKT archive data 3291# NPack 32920 string MSTSM NPack archive data 3293# PFT 32940 string \0\x50\0\x14 PFT archive data 3295# SemOne 32960 string SEM SemOne archive data 3297# PPMD 32980 string \x8f\xaf\xac\x84 PPMD archive data 3299# FIZ 33000 string FIZ FIZ archive data 3301# MSXiE 33020 belong&0xfffff0f0 0x4d530000 MSXiE archive data 3303# DeepFreezer 33040 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 3305# DC 33060 string =<DC- DC archive data 3307# TPac 33080 string \4TPAC\3 TPac archive data 3309# Ai 33100 string Ai\1\1\0 Ai archive data 33110 string Ai\1\0\0 Ai archive data 3312# Ai32 33130 string Ai\2\0 Ai32 archive data 33140 string Ai\2\1 Ai32 archive data 3315# SBC 33160 string SBC SBC archive data 3317# Ybs 33180 string YBS Ybs archive data 3319# DitPack 33200 string \x9e\0\0 DitPack archive data 3321# DMS 33220 string DMS! DMS archive data 3323# EPC 33240 string \x8f\xaf\xac\x8c EPC archive data 3325# VSARC 33260 string VS\x1a VSARC archive data 3327# PDZ 33280 string PDZ PDZ archive data 3329# ReDuq 33300 string rdqx ReDuq archive data 3331# GCA 33320 string GCAX GCA archive data 3333# PPMN 33340 string pN PPMN archive data 3335# WinImage 33363 string WINIMAGE WinImage archive data 3337# Compressia 33380 string CMP0CMP Compressia archive data 3339# UHBC 33400 string UHB UHBC archive data 3341# WinHKI 33420 string \x61\x5C\x04\x05 WinHKI archive data 3343# WWPack data file 33440 string WWP WWPack archive data 3345# BSN (BSA, PTS-DOS) 33460 string \xffBSG BSN archive data 33471 string \xffBSG BSN archive data 33483 string \xffBSG BSN archive data 33491 string \0\xae\2 BSN archive data 33501 string \0\xae\3 BSN archive data 33511 string \0\xae\7 BSN archive data 3352# AIN 33530 string \x33\x18 AIN archive data 33540 string \x33\x17 AIN archive data 3355# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 3356# SZip (TODO: doesn't catch all versions) 33570 string SZ\x0a\4 SZip archive data 3358# XPack DiskImage 3359# *.XDI updated by Joerg Jenderek Sep 2015 3360# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 3361# GRR: this test is still too general as it catches also text files starting with jm 33620 string jm 3363# only found examples with this additional characteristic 2 bytes 3364>2 string \x2\x4 Xpack DiskImage archive data 3365#!:ext xdi 3366# XPack Data 3367# *.xpa updated by Joerg Jenderek Sep 2015 3368# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 33690 string xpa XPA 3370!:ext xpa 3371# XPA32 3372# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 3373# created by XPA32.EXE version 1.0.2 for Windows 3374>0 string xpa\0\1 \b32 archive data 3375# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 3376>3 ubeshort !0x0001 \bck archive data 3377# XPack Single Data 3378# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 3379# letter 'I'+ acute accent is equivalent to \xcd 33800 string \xcd\ jm Xpack single archive data 3381#!:mime application/x-xpa-compressed 3382!:ext xpa 3383 3384# TODO: missing due to unknown magic/magic at end of file: 3385#DWC 3386#ARG 3387#ZAR 3388#PC/3270 3389#InstallIt 3390#RKive 3391#RK 3392#XPack Diskimage 3393 3394# These were inspired by idarc, but actually verified 3395# Dzip archiver (.dz) 3396# Update: Joerg Jenderek 3397# URL: http://speeddemosarchive.com/dzip/ 3398# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 3399# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 34000 string DZ 3401# latest version is 2.9 dated 7 may 2003 3402>2 byte <4 Dzip archive data 3403!:mime application/x-dzip 3404!:ext dz 3405>>2 byte x \b, version %i 3406>>3 byte x \b.%i 3407>>4 ulelong x \b, offset 0x%x 3408>>8 ulelong x \b, %u files 3409# ZZip archiver (.zz) 34100 string ZZ\ \0\0 ZZip archive data 34110 string ZZ0 ZZip archive data 3412# PAQ archiver (.paq) 34130 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 34140 string PAQ PAQ archive data 3415>3 byte&0xf0 0x30 3416>>3 byte x (v%c) 3417# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 34180xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 34190 string JARCS JAR (ARJ Software, Inc.) archive data 3420 3421# ARJ archiver (jason@jarthur.Claremont.EDU) 34220 leshort 0xea60 ARJ archive data 3423!:mime application/x-arj 3424>5 byte x \b, v%d, 3425>8 byte &0x04 multi-volume, 3426>8 byte &0x10 slash-switched, 3427>8 byte &0x20 backup, 3428>34 string x original name: %s, 3429>7 byte 0 os: MS-DOS 3430>7 byte 1 os: PRIMOS 3431>7 byte 2 os: Unix 3432>7 byte 3 os: Amiga 3433>7 byte 4 os: Macintosh 3434>7 byte 5 os: OS/2 3435>7 byte 6 os: Apple ][ GS 3436>7 byte 7 os: Atari ST 3437>7 byte 8 os: NeXT 3438>7 byte 9 os: VAX/VMS 3439>3 byte >0 %d] 3440# [JW] idarc says this is also possible 34412 leshort 0xea60 ARJ archive data 3442 3443# HA archiver (Greg Roelofs, newt@uchicago.edu) 3444# This is a really bad format. A file containing HAWAII will match this... 3445#0 string HA HA archive data, 3446#>2 leshort =1 1 file, 3447#>2 leshort >1 %hu files, 3448#>4 byte&0x0f =0 first is type CPY 3449#>4 byte&0x0f =1 first is type ASC 3450#>4 byte&0x0f =2 first is type HSC 3451#>4 byte&0x0f =0x0e first is type DIR 3452#>4 byte&0x0f =0x0f first is type SPECIAL 3453# suggestion: at least identify small archives (<1024 files) 34540 belong&0xffff00fc 0x48410000 HA archive data 3455>2 leshort =1 1 file, 3456>2 leshort >1 %u files, 3457>4 byte&0x0f =0 first is type CPY 3458>4 byte&0x0f =1 first is type ASC 3459>4 byte&0x0f =2 first is type HSC 3460>4 byte&0x0f =0x0e first is type DIR 3461>4 byte&0x0f =0x0f first is type SPECIAL 3462 3463# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 34640 string HPAK HPACK archive data 3465 3466# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 34670 string \351,\001JAM\ JAM archive, 3468>7 string >\0 version %.4s 3469>0x26 byte =0x27 - 3470>>0x2b string >\0 label %.11s, 3471>>0x27 lelong x serial %08x, 3472>>0x36 string >\0 fstype %.8s 3473 3474# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 3475# Update: Joerg Jenderek 3476# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3477# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 3478# 3479# check and display information of lharc (LHa,PMarc) file 34800 name lharc-file 3481# check 1st character of method id like -lz4- -lh5- or -pm2- 3482>2 string - 3483# check 5th character of method id 3484>>6 string - 3485# check header level 0 1 2 3 3486>>>20 ubyte <4 3487# check 2nd, 3th and 4th character of method id 3488>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3489!:mime application/x-lzh-compressed 3490# creator type "LHA " 3491!:apple ????LHA 3492# display archive type name like "LHa/LZS archive data" or "LArc archive" 3493>>>>>2 string -lz \b 3494!:ext lzs 3495# already known -lzs- -lz4- -lz5- with old names 3496>>>>>>2 string -lzs LHa/LZS archive data 3497>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3498# missing -lz?- with wikipedia names 3499>>>>>>3 regex \^lz[2378] LArc archive 3500# display archive type name like "LHa (2.x) archive data" 3501>>>>>2 string -lh \b 3502# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3503>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3504# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3505# FOOBAR archiver use ".foo" as name extension instead usual one 3506# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3507>>>>>>>2 string -lh1 \b 3508!:ext lha/lzh/ice 3509>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3510>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3511>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3512>>>>>>>2 string -lh5 \b 3513# https://en.wikipedia.org/wiki/BIOS 3514# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like 3515# bios.rom , kd7_v14.bin, 1010.004, ... 3516!:ext lha/lzh/rom/bin 3517# missing -lh?- variants (Joe Jared) 3518>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3519# UNLHA32 2.67a 3520>>>>>>2 string -lhx LHa (UNLHA32) archive 3521# lha archives with standard file name extensions ".lha" ".lzh" 3522>>>>>>3 regex !\^(lh1|lh5) \b 3523!:ext lha/lzh 3524# this should not happen if all -lh variants are described 3525>>>>>>2 default x LHa (unknown) archive 3526#!:ext lha 3527# PMarc 3528>>>>>3 regex \^pm[012] PMarc archive data 3529!:ext pma 3530# append method id without leading and trailing minus character 3531>>>>>3 string x [%3.3s] 3532>>>>>>0 use lharc-header 3533# 3534# check and display information of lharc header 35350 name lharc-header 3536# header size 0x4 , 0x1b-0x61 3537>0 ubyte x 3538# compressed data size != compressed file size 3539#>7 ulelong x \b, data size %d 3540# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3541#>19 ubyte x \b, 19_0x%x 3542# level identifier 0 1 2 3 3543#>20 ubyte x \b, level %d 3544# time stamp 3545#>15 ubelong x DATE 0x%8.8x 3546# OS ID for level 1 3547>20 ubyte 1 3548# 0x20 types find for *.rom files 3549>>(21.b+24) ubyte <0x21 \b, 0x%x OS 3550# ascii type like M for MSDOS 3551>>(21.b+24) ubyte >0x20 \b, '%c' OS 3552# OS ID for level 2 3553>20 ubyte 2 3554#>>23 ubyte x \b, OS ID 0x%x 3555>>23 ubyte <0x21 \b, 0x%x OS 3556>>23 ubyte >0x20 \b, '%c' OS 3557# filename only for level 0 and 1 3558>20 ubyte <2 3559# length of filename 3560>>21 ubyte >0 \b, with 3561# filename 3562>>>21 pstring x "%s" 3563# 3564#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3565#!:mime application/x-lharc 35662 string -lh0- 3567>0 use lharc-file 3568#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3569#!:mime application/x-lharc 35702 string -lh1- 3571>0 use lharc-file 3572# NEW -lz2- ... -lz8- 35732 string -lz2- 3574>0 use lharc-file 35752 string -lz3- 3576>0 use lharc-file 35772 string -lz4- 3578>0 use lharc-file 35792 string -lz5- 3580>0 use lharc-file 35812 string -lz7- 3582>0 use lharc-file 35832 string -lz8- 3584>0 use lharc-file 3585# [never seen any but the last; -lh4- reported in comp.compression:] 3586#2 string -lzs- LHa/LZS archive data [lzs] 35872 string -lzs- 3588>0 use lharc-file 3589# According to wikipedia and others such a version does not exist 3590#2 string -lh\40- LHa 2.x? archive data [lh ] 3591#2 string -lhd- LHa 2.x? archive data [lhd] 35922 string -lhd- 3593>0 use lharc-file 3594#2 string -lh2- LHa 2.x? archive data [lh2] 35952 string -lh2- 3596>0 use lharc-file 3597#2 string -lh3- LHa 2.x? archive data [lh3] 35982 string -lh3- 3599>0 use lharc-file 3600#2 string -lh4- LHa (2.x) archive data [lh4] 36012 string -lh4- 3602>0 use lharc-file 3603#2 string -lh5- LHa (2.x) archive data [lh5] 36042 string -lh5- 3605>0 use lharc-file 3606#2 string -lh6- LHa (2.x) archive data [lh6] 36072 string -lh6- 3608>0 use lharc-file 3609#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 36102 string -lh7- 3611# !:mime application/x-lha 3612# >20 byte x - header level %d 3613>0 use lharc-file 3614# NEW -lh8- ... -lhe- , -lhx- 36152 string -lh8- 3616>0 use lharc-file 36172 string -lh9- 3618>0 use lharc-file 36192 string -lha- 3620>0 use lharc-file 36212 string -lhb- 3622>0 use lharc-file 36232 string -lhc- 3624>0 use lharc-file 36252 string -lhe- 3626>0 use lharc-file 36272 string -lhx- 3628>0 use lharc-file 3629# taken from idarc [JW] 36302 string -lZ PUT archive data 3631# already done by LHarc magics 3632# this should never happen if all sub types of LZS archive are identified 3633#2 string -lz LZS archive data 36342 string -sw1- Swag archive data 3635 36360 name rar-file-header 3637>24 byte 15 \b, v1.5 3638>24 byte 20 \b, v2.0 3639>24 byte 29 \b, v4 3640>15 byte 0 \b, os: MS-DOS 3641>15 byte 1 \b, os: OS/2 3642>15 byte 2 \b, os: Win32 3643>15 byte 3 \b, os: Unix 3644>15 byte 4 \b, os: Mac OS 3645>15 byte 5 \b, os: BeOS 3646 36470 name rar-archive-header 3648>3 leshort&0x1ff >0 \b, flags: 3649>>3 leshort &0x01 ArchiveVolume 3650>>3 leshort &0x02 Commented 3651>>3 leshort &0x04 Locked 3652>>3 leshort &0x10 NewVolumeNaming 3653>>3 leshort &0x08 Solid 3654>>3 leshort &0x20 Authenticated 3655>>3 leshort &0x40 RecoveryRecordPresent 3656>>3 leshort &0x80 EncryptedBlockHeader 3657>>3 leshort &0x100 FirstVolume 3658 3659# RAR (Roshal Archive) archive 36600 string Rar!\x1a\7\0 RAR archive data 3661!:mime application/x-rar 3662!:ext rar/cbr 3663# file header 3664>(0xc.l+9) byte 0x74 3665>>(0xc.l+7) use rar-file-header 3666# subblock seems to share information with file header 3667>(0xc.l+9) byte 0x7a 3668>>(0xc.l+7) use rar-file-header 3669>9 byte 0x73 3670>>7 use rar-archive-header 3671 36720 string Rar!\x1a\7\1\0 RAR archive data, v5 3673!:mime application/x-rar 3674!:ext rar 3675 3676# Very old RAR archive 3677# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 36780 string RE\x7e\x5e RAR archive data (<v1.5) 3679!:mime application/x-rar 3680!:ext rar/cbr 3681 3682# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 36830 string SQSH squished archive data (Acorn RISCOS) 3684 3685# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 3686# [JW] see exe section for self-extracting version 36870 string UC2\x1a UC2 archive data 3688 3689# PKZIP multi-volume archive 36900 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 3691!:mime application/zip 3692!:ext zip/cbz 3693 3694# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 36950 string PK\005\006 Zip archive data (empty) 3696!:mime application/zip 3697!:ext zip/cbz 3698!:strength +1 36990 string PK\003\004 3700!:strength +1 3701 3702# Specialised zip formats which start with a member named 'mimetype' 3703# (stored uncompressed, with no 'extra field') containing the file's MIME type. 3704# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 3705# contents starting with "application/": 3706>26 string \x8\0\0\0mimetypeapplication/ 3707 3708# KOffice / OpenOffice & StarOffice / OpenDocument formats 3709# From: Abel Cheung <abel@oaka.org> 3710 3711# KOffice (1.2 or above) formats 3712# (mimetype contains "application/vnd.kde.<SUBTYPE>") 3713>>50 string vnd.kde. KOffice (>=1.2) 3714>>>58 string karbon Karbon document 3715>>>58 string kchart KChart document 3716>>>58 string kformula KFormula document 3717>>>58 string kivio Kivio document 3718>>>58 string kontour Kontour document 3719>>>58 string kpresenter KPresenter document 3720>>>58 string kspread KSpread document 3721>>>58 string kword KWord document 3722 3723# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 3724# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 3725# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 3726# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 3727>>50 string vnd.sun.xml. OpenOffice.org 1.x 3728>>>62 string writer Writer 3729>>>>68 byte !0x2e document 3730!:mime application/vnd.sun.xml.writer 3731!:ext sxw 3732>>>>68 string .template template 3733!:mime application/vnd.sun.xml.writer.template 3734!:ext stw 3735>>>>68 string .web Web template 3736!:mime application/vnd.sun.xml.writer.web 3737!:ext stw 3738>>>>68 string .global global document 3739!:mime application/vnd.sun.xml.writer.global 3740!:ext sxg 3741>>>62 string calc Calc 3742>>>>66 byte !0x2e spreadsheet 3743!:mime application/vnd.sun.xml.calc 3744!:ext sxc 3745>>>>66 string .template template 3746!:mime application/vnd.sun.xml.calc.template 3747!:ext stc 3748>>>62 string draw Draw 3749>>>>66 byte !0x2e document 3750!:mime application/vnd.sun.xml.draw 3751!:ext sxd 3752>>>>66 string .template template 3753!:mime application/vnd.sun.xml.draw.template 3754!:ext std 3755>>>62 string impress Impress 3756>>>>69 byte !0x2e presentation 3757!:mime application/vnd.sun.xml.impress 3758!:ext sxi 3759>>>>69 string .template template 3760!:mime application/vnd.sun.xml.impress.template 3761!:ext sti 3762>>>62 string math Math document 3763!:mime application/vnd.sun.xml.math 3764!:ext sxm 3765>>>62 string base Database file 3766!:mime application/vnd.sun.xml.base 3767!:ext sdb 3768 3769# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 3770# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 3771# https://lists.oasis-open.org/archives/office/200505/msg00006.html 3772# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 3773>>50 string vnd.oasis.opendocument. OpenDocument 3774>>>73 string text 3775>>>>77 byte !0x2d Text 3776!:mime application/vnd.oasis.opendocument.text 3777!:ext odt 3778>>>>77 string -template Text Template 3779!:mime application/vnd.oasis.opendocument.text-template 3780!:ext ott 3781>>>>77 string -web HTML Document Template 3782!:mime application/vnd.oasis.opendocument.text-web 3783!:ext oth 3784>>>>77 string -master Master Document 3785!:mime application/vnd.oasis.opendocument.text-master 3786!:ext odm 3787>>>73 string graphics 3788>>>>81 byte !0x2d Drawing 3789!:mime application/vnd.oasis.opendocument.graphics 3790!:ext odg 3791>>>>81 string -template Drawing Template 3792!:mime application/vnd.oasis.opendocument.graphics-template 3793!:ext otg 3794>>>73 string presentation 3795>>>>85 byte !0x2d Presentation 3796!:mime application/vnd.oasis.opendocument.presentation 3797!:ext odp 3798>>>>85 string -template Presentation Template 3799!:mime application/vnd.oasis.opendocument.presentation-template 3800!:ext otp 3801>>>73 string spreadsheet 3802>>>>84 byte !0x2d Spreadsheet 3803!:mime application/vnd.oasis.opendocument.spreadsheet 3804!:ext ods 3805>>>>84 string -template Spreadsheet Template 3806!:mime application/vnd.oasis.opendocument.spreadsheet-template 3807!:ext ots 3808>>>73 string chart 3809>>>>78 byte !0x2d Chart 3810!:mime application/vnd.oasis.opendocument.chart 3811!:ext odc 3812>>>>78 string -template Chart Template 3813!:mime application/vnd.oasis.opendocument.chart-template 3814!:ext otc 3815>>>73 string formula 3816>>>>80 byte !0x2d Formula 3817!:mime application/vnd.oasis.opendocument.formula 3818!:ext odf 3819>>>>80 string -template Formula Template 3820!:mime application/vnd.oasis.opendocument.formula-template 3821!:ext otf 3822# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 3823>>>73 string database Database 3824!:mime application/vnd.oasis.opendocument.database 3825!:ext odb 3826# Valid for LibreOffice Base 6.0.1.1 at least 3827>>>73 string base Database 3828# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 3829!:mime application/vnd.oasis.opendocument.database 3830#!:mime application/vnd.oasis.opendocument.base 3831!:ext odb 3832>>>73 string image 3833>>>>78 byte !0x2d Image 3834!:mime application/vnd.oasis.opendocument.image 3835!:ext odi 3836>>>>78 string -template Image Template 3837!:mime application/vnd.oasis.opendocument.image-template 3838!:ext oti 3839 3840# EPUB (OEBPS) books using OCF (OEBPS Container Format) 3841# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 3842# From: Ralf Brown <ralf.brown@gmail.com> 3843>>50 string epub+zip EPUB document 3844!:mime application/epub+zip 3845 3846# From: Joerg Jenderek 3847# URL: http://en.wikipedia.org/wiki/CorelDRAW 3848# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 3849>>50 string x-vnd.corel. Corel 3850>>>62 string draw.document+zip Draw drawing, version 14-16 3851!:mime application/x-vnd.corel.draw.document+zip 3852!:ext cdr 3853>>>62 string draw.template+zip Draw template, version 14-16 3854!:mime application/x-vnd.corel.draw.template+zip 3855!:ext cdrt 3856>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 3857!:mime application/x-vnd.corel.zcf.draw.document+zip 3858!:ext cdr 3859>>>62 string zcf.draw.template+zip Draw template, version 17-22 3860!:mime application/x-vnd.corel.zcf.draw.template+zip 3861!:ext cdt/cdrt 3862# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 3863>>>62 string zcf.pattern+zip Draw pattern, version 22 3864!:mime application/x-vnd.corel.zcf.pattern+zip 3865!:ext pat 3866# URL: https://en.wikipedia.org/wiki/Corel_Designer 3867# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 3868# Note: called by TrID "Corel DESIGN graphics" 3869>>>62 string designer.document+zip DESIGNER graphics, version 14-16 3870!:mime application/x-vnd.corel.designer.document+zip 3871!:ext des 3872>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 3873!:mime application/x-vnd.corel.zcf.designer.document+zip 3874!:ext des 3875# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 3876# CorelDRAW-Corel-Symbol-Library-CSL.html 3877>>>62 string symbol.library+zip Symbol Library, version 6-16.3 3878!:mime application/x-vnd.corel.symbol.library+zip 3879!:ext csl 3880>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 3881!:mime application/x-vnd.corel.zcf.symbol.library+zip 3882!:ext csl 3883 3884# Catch other ZIP-with-mimetype formats 3885# In a ZIP file, the bytes immediately after a member's contents are 3886# always "PK". The 2 regex rules here print the "mimetype" member's 3887# contents up to the first 'P'. Luckily, most MIME types don't contain 3888# any capital 'P's. This is a kludge. 3889# (mimetype contains "application/<OTHER>") 3890>>50 default x Zip data 3891>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 3892!:mime application/zip 3893# (mimetype contents other than "application/*") 3894>26 string \x8\0\0\0mimetype 3895>>38 string !application/ 3896>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3897!:mime application/zip 3898 3899# Java Jar files 3900>(26.s+30) leshort 0xcafe Java archive data (JAR) 3901!:mime application/java-archive 3902 3903# iOS App 3904>(26.s+30) leshort !0xcafe 3905>>26 string !\x8\0\0\0mimetype 3906>>>30 string Payload/ 3907>>>>38 search/64 .app/ iOS App 3908!:mime application/x-ios-app 3909 3910>30 search/100/b application/epub+zip EPUB document 3911!:mime application/epub+zip 3912 3913# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3914# Next line excludes specialized formats: 3915>(26.s+30) leshort !0xcafe 3916>>30 search/100/b !application/epub+zip 3917>>>26 string !\x8\0\0\0mimetype Zip archive data 3918!:mime application/zip 3919>>>>4 beshort x \b, at least 3920>>>>4 use zipversion 3921>>>>4 beshort x to extract 3922>>>>8 beshort x \b, compression method= 3923>>>>8 use zipcompression 3924>>>>0x161 string WINZIP \b, WinZIP self-extracting 3925 3926# StarView Metafile 3927# From Pierre Ducroquet <pinaraf@pinaraf.info> 39280 string VCLMTF StarView MetaFile 3929>6 beshort x \b, version %d 3930>8 belong x \b, size %d 3931 3932# Zoo archiver 393320 lelong 0xfdc4a7dc Zoo archive data 3934!:mime application/x-zoo 3935>4 byte >48 \b, v%c. 3936>>6 byte >47 \b%c 3937>>>7 byte >47 \b%c 3938>32 byte >0 \b, modify: v%d 3939>>33 byte x \b.%d+ 3940>42 lelong 0xfdc4a7dc \b, 3941>>70 byte >0 extract: v%d 3942>>>71 byte x \b.%d+ 3943 3944# Shell archives 394510 string #\ This\ is\ a\ shell\ archive shell archive text 3946!:mime application/octet-stream 3947 3948# 3949# LBR. NB: May conflict with the questionable 3950# "binary Computer Graphics Metafile" format. 3951# 39520 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3953# 3954# PMA (CP/M derivative of LHA) 3955# Update: Joerg Jenderek 3956# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3957# 3958#2 string -pm0- PMarc archive data [pm0] 39592 string -pm0- 3960>0 use lharc-file 3961#2 string -pm1- PMarc archive data [pm1] 39622 string -pm1- 3963>0 use lharc-file 3964#2 string -pm2- PMarc archive data [pm2] 39652 string -pm2- 3966>0 use lharc-file 39672 string -pms- PMarc SFX archive (CP/M, DOS) 3968#!:mime application/x-foobar-exec 3969!:ext com 39705 string -pc1- PopCom compressed executable (CP/M) 3971#!:mime application/x- 3972#!:ext com 3973 3974# From Rafael Laboissiere <rafael@laboissiere.net> 3975# The Project Revision Control System (see 3976# http://prcs.sourceforge.net) generates a packaged project 3977# file which is recognized by the following entry: 39780 leshort 0xeb81 PRCS packaged project 3979 3980# Microsoft cabinets 3981# by David Necas (Yeti) <yeti@physics.muni.cz> 3982#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3983#>25 byte x v%d 3984#>24 byte x \b.%d 3985# MPi: All CABs have version 1.3, so this is pointless. 3986# Better magic in debian-additions. 3987 3988# GTKtalog catalogs 3989# by David Necas (Yeti) <yeti@physics.muni.cz> 39904 string gtktalog\ GTKtalog catalog data, 3991>13 string 3 version 3 3992>>14 beshort 0x677a (gzipped) 3993>>14 beshort !0x677a (not gzipped) 3994>13 string >3 version %s 3995 3996############################################################################ 3997# Parity archive reconstruction file, the 'par' file format now used on Usenet. 39980 string PAR\0 PARity archive data 3999>48 leshort =0 - Index file 4000>48 leshort >0 - file number %d 4001 4002# Felix von Leitner <felix-file@fefe.de> 40030 string d8:announce BitTorrent file 4004!:mime application/x-bittorrent 4005# Durval Menezes, <jmgthbfile at durval dot com> 40060 string d13:announce-list BitTorrent file 4007!:mime application/x-bittorrent 40080 string d7:comment BitTorrent file 4009!:mime application/x-bittorrent 40100 string d4:info BitTorrent file 4011!:mime application/x-bittorrent 4012 4013# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 40140 beshort 0x0e0f Atari MSA archive data 4015>2 beshort x \b, %d sectors per track 4016>4 beshort 0 \b, 1 sided 4017>4 beshort 1 \b, 2 sided 4018>6 beshort x \b, starting track: %d 4019>8 beshort x \b, ending track: %d 4020 4021# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 40220 string PK00PK\003\004 Zip archive data 4023!:mime application/zip 4024!:ext zip/cbz 4025 4026# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 4027# by Stefan `Sec` Zehl <sec@42.org> 40287 string **ACE** ACE archive data 4029>15 byte >0 version %d 4030>16 byte =0x00 \b, from MS-DOS 4031>16 byte =0x01 \b, from OS/2 4032>16 byte =0x02 \b, from Win/32 4033>16 byte =0x03 \b, from Unix 4034>16 byte =0x04 \b, from MacOS 4035>16 byte =0x05 \b, from WinNT 4036>16 byte =0x06 \b, from Primos 4037>16 byte =0x07 \b, from AppleGS 4038>16 byte =0x08 \b, from Atari 4039>16 byte =0x09 \b, from Vax/VMS 4040>16 byte =0x0A \b, from Amiga 4041>16 byte =0x0B \b, from Next 4042>14 byte x \b, version %d to extract 4043>5 leshort &0x0080 \b, multiple volumes, 4044>>17 byte x \b (part %d), 4045>5 leshort &0x0002 \b, contains comment 4046>5 leshort &0x0200 \b, sfx 4047>5 leshort &0x0400 \b, small dictionary 4048>5 leshort &0x0800 \b, multi-volume 4049>5 leshort &0x1000 \b, contains AV-String 4050>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 4051>5 leshort &0x2000 \b, with recovery record 4052>5 leshort &0x4000 \b, locked 4053>5 leshort &0x8000 \b, solid 4054# Date in MS-DOS format (whatever that is) 4055#>18 lelong x Created on 4056 4057# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 4058# <doj@cubic.org> 40590x1A string sfArk sfArk compressed Soundfont 4060>0x15 string 2 4061>>0x1 string >\0 Version %s 4062>>0x2A string >\0 : %s 4063 4064# DR-DOS 7.03 Packed File *.??_ 4065# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 4066# Note: unpacked by PNUNPACK.EXE 40670 string Packed\ File\ 4068# by looking for Control-Z skip ASCII text starting with Packed File 4069>0x18 ubyte 0x1a Personal NetWare Packed File 4070!:mime application/x-novell-compress 4071!:ext ??_ 4072>>12 string x \b, was "%.12s" 4073# 1 or 2 4074#>>0x19 ubyte x \b, at 0x19 %u 4075>>0x1b ulelong x with %u bytes 4076 4077# EET archive 4078# From: Tilman Sauerbeck <tilman@code-monkey.de> 40790 belong 0x1ee7ff00 EET archive 4080!:mime application/x-eet 4081 4082# rzip archives 40830 string RZIP rzip compressed data 4084>4 byte x - version %d 4085>5 byte x \b.%d 4086>6 belong x (%d bytes) 4087 4088# From: Joerg Jenderek 4089# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 4090# reference: http://mark0.net/download/triddefs_xml.7z/ 4091# defs/f/fzip.trid.xml 4092# Note: unknown compression; No "PK" zip magic; normally in directory like 4093# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 40940 ubequad 0x2506781901010000 Foxit add-on/update 4095!:mime application/x-fzip 4096!:ext fzip 4097 4098# From: "Robert Dale" <robdale@gmail.com> 40990 belong 123 dar archive, 4100>4 belong x label "%.8x 4101>>8 belong x %.8x 4102>>>12 beshort x %.4x" 4103>14 byte 0x54 end slice 4104>14 beshort 0x4e4e multi-part 4105>14 beshort 0x4e53 multi-part, with -S 4106 4107# Symbian installation files 4108# https://www.thouky.co.uk/software/psifs/sis.html 4109# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 41108 lelong 0x10000419 Symbian installation file 4111!:mime application/vnd.symbian.install 4112>4 lelong 0x1000006D (EPOC release 3/4/5) 4113>4 lelong 0x10003A12 (EPOC release 6) 41140 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 4115!:mime x-epoc/x-sisx-app 4116 4117# From "Nelson A. de Oliveira" <naoliv@gmail.com> 41180 string MPQ\032 MoPaQ (MPQ) archive 4119 4120# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4121# .kgb 41220 string KGB_arch KGB Archiver file 4123>10 string x with compression level %.1s 4124 4125# xar (eXtensible ARchiver) archive 4126# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 4127# xar archive format: https://code.google.com/p/xar/ 4128# From: "David Remahl" <dremahl@apple.com> 4129# Update: Joerg Jenderek 4130# TODO: lzma compression; X509Data for pkg and xip 4131# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 4132# 7z t -txar Xcode_10.2_beta_4.xip` 41330 string xar! xar archive 4134!:mime application/x-xar 4135# pkg for Mac OSX installer package like FullBundleUpdate.pkg 4136# xip for signed Apple software like Xcode_10.2_beta_4.xip 4137!:ext xar/pkg/xip 4138# always 28 in older archives 4139>4 ubeshort >28 \b, header size %u 4140# currently there exit only version 1 since about 2014 4141>6 ubeshort >1 version %u, 4142>8 ubequad x compressed TOC: %llu, 4143#>16 ubequad x uncompressed TOC: %llu, 4144# cksum_alg 0-2 in older and also 3-4 in newer 4145>24 belong 0 no checksum 4146>24 belong 1 SHA-1 checksum 4147>24 belong 2 MD5 checksum 4148>24 belong 3 SHA-256 checksum 4149>24 belong 4 SHA-512 checksum 4150>24 belong >4 unknown 0x%x checksum 4151#>24 belong >4 checksum 4152# For no compression jump 0 bytes 4153>24 belong 0 4154>>0 ubyte x 4155# jump more bytes forward by header size 4156>>>&(4.S) ubyte x 4157# jump more bytes forward by compressed table of contents size 4158#>>>>&(8.Q) ubequad x \b, heap data 0x%llx 4159>>>>&(8.Q) ubyte x 4160# look for data by ./compress after message with 1 space at end 4161>>>>>&-3 indirect x \b, contains 4162# For SHA-1 jump 20 minus 2 bytes 4163>24 belong 1 4164>>18 ubyte x 4165# jump more bytes forward by header size 4166>>>&(4.S) ubyte x 4167# jump more bytes forward by compressed table of contents size 4168>>>>&(8.Q) ubyte x 4169# data compressed by gzip, bzip, lzma or none 4170>>>>>&-1 indirect x \b, contains 4171# For SHA-256 jump 32 minus 2 bytes 4172>24 belong 3 4173>>30 ubyte x 4174# jump more bytes forward by header size 4175>>>&(4.S) ubyte x 4176# jump more bytes forward by compressed table of contents size 4177>>>>&(8.Q) ubyte x 4178>>>>>&-1 indirect x \b, contains 4179# For SHA-512 jump 64 minus 2 bytes 4180>24 belong 4 4181>>62 ubyte x 4182# jump more bytes forward by header size 4183>>>&(4.S) ubyte x 4184# jump more bytes forward by compressed table of contents size 4185>>>>&(8.Q) ubyte x 4186>>>>>&-1 indirect x \b, contains 4187 4188# Type: Parity Archive 4189# From: Daniel van Eeden <daniel_e@dds.nl> 41900 string PAR2 Parity Archive Volume Set 4191 4192# Bacula volume format. (Volumes always start with a block header.) 4193# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 4194# From: Adam Buchbinder <adam.buchbinder@gmail.com> 419512 string BB02 Bacula volume 4196>20 bedate x \b, started %s 4197 4198# ePub is XHTML + XML inside a ZIP archive. The first member of the 4199# archive must be an uncompressed file called 'mimetype' with contents 4200# 'application/epub+zip' 4201 4202 4203# From: "Michael Gorny" <mgorny@gentoo.org> 4204# ZPAQ: http://mattmahoney.net/dc/zpaq.html 42050 string zPQ ZPAQ stream 4206>3 byte x \b, level %d 4207# From: Barry Carter <carter.barry@gmail.com> 4208# https://encode.ru/threads/456-zpaq-updates/page32 42090 string 7kSt ZPAQ file 4210 4211# BBeB ebook, unencrypted (LRF format) 4212# URL: https://www.sven.de/librie/Librie/LrfFormat 4213# From: Adam Buchbinder <adam.buchbinder@gmail.com> 42140 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 4215>8 beshort x \b, version %d 4216>36 byte 1 \b, front-to-back 4217>36 byte 16 \b, back-to-front 4218>42 beshort x \b, (%dx, 4219>44 beshort x %d) 4220 4221# Symantec GHOST image by Joerg Jenderek at May 2014 4222# https://us.norton.com/ghost/ 4223# https://www.garykessler.net/library/file_sigs.html 42240 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 4225# *.GHO 4226>2 ubyte&0x08 0x00 \b, first file 4227# *.GHS or *.[0-9] with cns program option 4228>2 ubyte&0x08 0x08 \b, split file 4229# part of split index interesting for *.ghs 4230>>4 ubyte x id=0x%x 4231# compression tag minus one equals numeric compression command line switch z[1-9] 4232>3 ubyte 0 \b, no compression 4233>3 ubyte 2 \b, fast compression (Z1) 4234>3 ubyte 3 \b, medium compression (Z2) 4235>3 ubyte >3 4236>>3 ubyte <11 \b, compression (Z%d-1) 4237>2 ubyte&0x08 0x00 4238# ~ 30 byte password field only for *.gho 4239>>12 ubequad !0 \b, password protected 4240>>44 ubyte !1 4241# 1~Image All, sector-by-sector only for *.gho 4242>>>10 ubyte 1 \b, sector copy 4243# 1~Image Boot track only for *.gho 4244>>>43 ubyte 1 \b, boot track 4245# 1~Image Disc only for *.gho implies Image Boot track and sector copy 4246>>44 ubyte 1 \b, disc sector copy 4247# optional image description only *.gho 4248>>0xff string >\0 "%-.254s" 4249# look for DOS sector end sequence 4250>0xE08 search/7776 \x55\xAA 4251>>&-512 indirect x \b; contains 4252 4253# Google Chrome extensions 4254# https://developer.chrome.com/extensions/crx 4255# https://developer.chrome.com/extensions/hosting 42560 string Cr24 Google Chrome extension 4257!:mime application/x-chrome-extension 4258>4 ulong x \b, version %u 4259 4260# SeqBox - Sequenced container 4261# ext: sbx, seqbox 4262# Marco Pontello marcopon@gmail.com 4263# reference: https://github.com/MarcoPon/SeqBox 42640 string SBx SeqBox, 4265>3 byte x version %d 4266 4267# LyNX archive 426856 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 4269 4270# From: Joerg Jenderek 4271# URL: https://www.acronis.com/ 4272# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 4273# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 42740 ubequad 0xce24b9a220000000 Acronis True Image backup 4275!:mime application/x-acronis-tib 4276!:ext tib 4277# 01000000 4278#>20 ubelong x \b, at 20 0x%x 4279# 20000000 4280#>28 ubelong x \b, at 28 0x%x 4281# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 4282# ??? 4283# strings like "\Device\0000011e" "\Device\0000015a" 4284#>0 search/0x6852300/cs \\Device\\ 4285#>>&-1 pstring x \b, %s 4286# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 4287#>>>&1 search/180/cs \\Device\\ 4288#>>>>&-1 pstring x \b, %s 4289#>>>>>&0 search/29/cs \0\0\xc8\0 4290# disk label 4291#>>>>>>&10 lestring16 x \b, disk label %11.11s 4292#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 4293#>>>>>>&10 ubequad x %16.16llx 4294 4295 4296# Gentoo XPAK binary package 4297# by Michal Gorny <mgorny@gentoo.org> 4298# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 4299-4 string STOP 4300>-16 string XPAKSTOP Gentoo binary package (XPAK) 4301 4302# From: Joerg Jenderek 4303# URL: https://kodi.wiki/view/TexturePacker 4304# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 4305# /xbmc-Krypton/xbmc/guilib/XBTF.h 4306# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 43070 string XBTF 4308# skip ASCII text by looking for terminating \0 of path 4309>264 ubyte 0 XBMC texture package 4310!:mime application/x-xbmc-xbt 4311!:ext xbt 4312# XBTF_VERSION 2 4313>>4 string !2 \b, version %-.1s 4314# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 4315>>5 ulelong x \b, %u file 4316# plural s 4317>>5 ulelong >1 \bs 4318# path[CXBTFFile[MaximumPathLength=256] 4319>>9 string x \b, 1st %s 4320 4321# ALZIP archive 4322# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com> 4323# http://kippler.com/win/unalz/ 4324# https://salsa.debian.org/l10n-korean-team/unalz 43250 string ALZ\001 ALZ archive data 4326!:ext alz 4327 4328# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip 43290 string EGGA EGG archive data, 4330!:ext egg 4331>5 byte x version %u 4332>4 byte x \b.%u 4333>>0x0E ulelong =0x08E28222 4334>>0x0E ulelong =0x24F5A262 \b, split 4335>>0x0E ulelong =0x24E5A060 \b, solid 4336>>0x0E default x \b, unknown 4337 4338# PAQ9A archive 4339# URL: http://mattmahoney.net/dc/#paq9a 4340# Note: Line 1186 of paq9a.cpp gives the magic bytes 43410 string pQ9\001 PAQ9A archive 4342 4343#------------------------------------------------------------------------------ 4344# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $ 4345# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files 4346# http://www.staroceans.org/e-book/ASF_Specification.pdf 4347 43480 name asf-name 4349# ASF_Data_Object 4350#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C 4351#>16 lequad >0 4352#>>(16.q) use asf-object 4353# ASF_Simple_Index_Object 4354>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB 4355>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object 4356>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object 4357>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object 4358 4359# ASF_File_Properties_Object 4360>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365 4361 4362# ASF_Stream_Properties_Object 4363>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365 4364#>>56 lequad x Time Offset %lld 4365#>>64 lelong x Type-Specicic Data Length %d 4366#>>68 lelong x Error Correction Data Length %d 4367#>>72 leshort x Flags 0x%x 4368#>>74 lelong x Reserved %x 4369# ASF_Audio_Media 4370>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media ( 4371>>>78 leshort x \bCodec Id %d 4372>>>80 leshort x \b, Number of channels %d 4373>>>82 lelong x \b, Samples Per Second %d 4374>>>86 lelong x \b, Average Number of Bytes Per Second %d 4375>>>90 lelong x \b, Block Alignment %d 4376>>>94 leshort x \b, Bits Per Sample %d 4377# ASF_Video_Media 4378>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media ( 4379>>>78 lelong x \bEncoded Image Width %d 4380>>>82 lelong x \b, Encoded Image Height %d 4381#>>>85 leshort x \b, Format Data Size %x 4382>>>93 lelong x \b, Image Width %d 4383>>>97 lelong x \b, Image Height %d 4384#>>>101 leshort x \b, Reserved 0x%x 4385>>>103 leshort x \b, Bits Per Pixel Count %d 4386#>>>105 lelong x \b, Compression ID %d 4387#>>>109 lelong x \b, Image Size %d 4388#>>>113 lelong x \b, Horizontal Pixels Per Meter %d 4389#>>>117 lelong x \b, Vertical Pixels Per Meter %d 4390#>>>121 lelong x \b, Colors Used Count %d 4391#>>>125 lelong x \b, Important Colors Count %d 4392>>0 lelong x \b, Error correction type 4393>>40 use asf-name 4394>>0 lelong x \b) 4395#ASF_Header_Extension_Object 4396>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365 4397# ASF_Codec_List_Object 4398>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6 4399>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object 4400>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object 4401>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object 4402>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object 4403# ASF_Content_Description_Object 4404>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C 4405#>>24 leshort title length %d 4406#>>26 leshort author length %d 4407#>>28 leshort copyright length %d 4408#>>30 leshort descriptor length %d 4409#>>32 leshort rating length %d 4410>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object 4411>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object 4412>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object 4413>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object 4414>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object 4415>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object 4416# ASF_Padding_Object 4417>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8 4418>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object 4419>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object 4420>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object 4421>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object 4422>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object 4423>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object 4424>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object 4425>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object 4426>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object 4427>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object 4428>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object 4429>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object 4430>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object 4431>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media 4432>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media 4433>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media 4434>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media 4435>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media 4436>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype 4437>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format 4438>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction 4439>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread 4440>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1 4441>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM 4442# _Network_Devices 4443>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2 4444>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3 4445>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4 4446>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language 4447>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate 4448>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown 4449>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive 4450>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial 4451>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode 4452>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name 4453>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type 4454>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio 4455>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration 4456>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID 4457>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG 4458 44590 name asf-object 4460>0 use asf-name 4461#>>16 lequad >0 (size %lld) [ 4462>>16 lequad >0 4463>>>(16.q) use asf-object 4464#>>16 lequad 0 ] 4465 4466# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 44670 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF 4468!:mime video/x-ms-asf 4469#>16 lequad >0 (size %lld 4470#>>24 lelong x \b, %d header objects) 4471>16 lequad >0 4472>>30 use asf-object 4473>>(16.q) use asf-object 4474#------------------------------------------------------------------------------ 4475# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 4476# make: file(1) magic for assembler source 4477# 44780 regex \^[\040\t]{0,50}\\.asciiz assembler source text 4479!:mime text/x-asm 44800 regex \^[\040\t]{0,50}\\.byte assembler source text 4481!:mime text/x-asm 44820 regex \^[\040\t]{0,50}\\.even assembler source text 4483!:mime text/x-asm 44840 regex \^[\040\t]{0,50}\\.globl assembler source text 4485!:mime text/x-asm 44860 regex \^[\040\t]{0,50}\\.text assembler source text 4487!:mime text/x-asm 44880 regex \^[\040\t]{0,50}\\.file assembler source text 4489!:mime text/x-asm 44900 regex \^[\040\t]{0,50}\\.type assembler source text 4491!:mime text/x-asm 4492 4493#------------------------------------------------------------------------------ 4494# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 4495# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 4496# strings as "long" - we assume they're just strings: 4497# From: guy@netapp.com (Guy Harris) 4498# 44990 string *STA Aster*x 4500>7 string WORD Words Document 4501>7 string GRAP Graphic 4502>7 string SPRE Spreadsheet 4503>7 string MACR Macro 45040 string 2278 Aster*x Version 2 4505>29 byte 0x36 Words Document 4506>29 byte 0x35 Graphic 4507>29 byte 0x32 Spreadsheet 4508>29 byte 0x38 Macro 4509 4510 4511#------------------------------------------------------------------------------ 4512# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 4513# att3b: file(1) magic for AT&T 3B machines 4514# 4515# The `versions' should be un-commented if they work for you. 4516# (Was the problem just one of endianness?) 4517# 4518# 3B20 4519# 4520# The 3B20 conflicts with SCCS. 4521#0 beshort 0550 3b20 COFF executable 4522#>12 belong >0 not stripped 4523#>22 beshort >0 - version %d 4524#0 beshort 0551 3b20 COFF executable (TV) 4525#>12 belong >0 not stripped 4526#>22 beshort >0 - version %d 4527# 4528# WE32K 4529# 45300 beshort 0560 WE32000 COFF 4531>18 beshort ^00000020 object 4532>18 beshort &00000020 executable 4533>12 belong >0 not stripped 4534>18 beshort ^00010000 N/A on 3b2/300 w/paging 4535>18 beshort &00020000 32100 required 4536>18 beshort &00040000 and MAU hardware required 4537>20 beshort 0407 (impure) 4538>20 beshort 0410 (pure) 4539>20 beshort 0413 (demand paged) 4540>20 beshort 0443 (target shared library) 4541>22 beshort >0 - version %d 45420 beshort 0561 WE32000 COFF executable (TV) 4543>12 belong >0 not stripped 4544#>18 beshort &00020000 - 32100 required 4545#>18 beshort &00040000 and MAU hardware required 4546#>22 beshort >0 - version %d 4547# 4548# core file for 3b2 45490 string \000\004\036\212\200 3b2 core file 4550>364 string >\0 of '%s' 4551 4552#------------------------------------------------------------------------------ 4553# $File: audio,v 1.120 2021/02/23 00:51:10 christos Exp $ 4554# audio: file(1) magic for sound formats (see also "iff") 4555# 4556# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 4557# and others 4558# 4559 4560# Sun/NeXT audio data 45610 string .snd Sun/NeXT audio data: 4562>12 belong 1 8-bit ISDN mu-law, 4563!:mime audio/basic 4564>12 belong 2 8-bit linear PCM [REF-PCM], 4565!:mime audio/basic 4566>12 belong 3 16-bit linear PCM, 4567!:mime audio/basic 4568>12 belong 4 24-bit linear PCM, 4569!:mime audio/basic 4570>12 belong 5 32-bit linear PCM, 4571!:mime audio/basic 4572>12 belong 6 32-bit IEEE floating point, 4573!:mime audio/basic 4574>12 belong 7 64-bit IEEE floating point, 4575!:mime audio/basic 4576>12 belong 8 Fragmented sample data, 4577>12 belong 10 DSP program, 4578>12 belong 11 8-bit fixed point, 4579>12 belong 12 16-bit fixed point, 4580>12 belong 13 24-bit fixed point, 4581>12 belong 14 32-bit fixed point, 4582>12 belong 18 16-bit linear with emphasis, 4583>12 belong 19 16-bit linear compressed, 4584>12 belong 20 16-bit linear with emphasis and compression, 4585>12 belong 21 Music kit DSP commands, 4586>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4587!:mime audio/x-adpcm 4588>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4589>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4590>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4591>12 belong 27 8-bit A-law (CCITT G.711), 4592>20 belong 1 mono, 4593>20 belong 2 stereo, 4594>20 belong 4 quad, 4595>16 belong >0 %d Hz 4596 4597# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 4598# that uses little-endian encoding and has a different magic number 45990 lelong 0x0064732E DEC audio data: 4600>12 lelong 1 8-bit ISDN mu-law, 4601!:mime audio/x-dec-basic 4602>12 lelong 2 8-bit linear PCM [REF-PCM], 4603!:mime audio/x-dec-basic 4604>12 lelong 3 16-bit linear PCM, 4605!:mime audio/x-dec-basic 4606>12 lelong 4 24-bit linear PCM, 4607!:mime audio/x-dec-basic 4608>12 lelong 5 32-bit linear PCM, 4609!:mime audio/x-dec-basic 4610>12 lelong 6 32-bit IEEE floating point, 4611!:mime audio/x-dec-basic 4612>12 lelong 7 64-bit IEEE floating point, 4613!:mime audio/x-dec-basic 4614>12 belong 8 Fragmented sample data, 4615>12 belong 10 DSP program, 4616>12 belong 11 8-bit fixed point, 4617>12 belong 12 16-bit fixed point, 4618>12 belong 13 24-bit fixed point, 4619>12 belong 14 32-bit fixed point, 4620>12 belong 18 16-bit linear with emphasis, 4621>12 belong 19 16-bit linear compressed, 4622>12 belong 20 16-bit linear with emphasis and compression, 4623>12 belong 21 Music kit DSP commands, 4624>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4625!:mime audio/x-dec-basic 4626>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4627>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4628>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4629>12 belong 27 8-bit A-law (CCITT G.711), 4630>20 lelong 1 mono, 4631>20 lelong 2 stereo, 4632>20 lelong 4 quad, 4633>16 lelong >0 %d Hz 4634 4635# Creative Labs AUDIO stuff 46360 string MThd Standard MIDI data 4637!:mime audio/midi 4638>8 beshort x (format %d) 4639>10 beshort x using %d track 4640>10 beshort >1 \bs 4641>12 beshort&0x7fff x at 1/%d 4642>12 beshort&0x8000 >0 SMPTE 4643 46440 string CTMF Creative Music (CMF) data 4645!:mime audio/x-unknown 46460 string SBI SoundBlaster instrument data 4647!:mime audio/x-unknown 46480 string Creative\ Voice\ File Creative Labs voice data 4649!:mime audio/x-unknown 4650# is this next line right? it came this way... 4651>19 byte 0x1A 4652>23 byte >0 - version %d 4653>22 byte >0 \b.%d 4654 4655# first entry is also the string "NTRK" 46560 belong 0x4e54524b MultiTrack sound data 4657>4 belong x - version %d 4658 4659# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 4660# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 46610 string EMOD Extended MOD sound data, 4662>4 byte&0xf0 x version %d 4663>4 byte&0x0f x \b.%d, 4664>45 byte x %d instruments 4665>83 byte 0 (module) 4666>83 byte 1 (song) 4667 4668# Real Audio (Magic .ra\0375) 46690 belong 0x2e7261fd RealAudio sound file 4670!:mime audio/x-pn-realaudio 46710 string .RMF\0\0\0 RealMedia file 4672!:mime application/vnd.rn-realmedia 4673#video/x-pn-realvideo 4674#video/vnd.rn-realvideo 4675#application/vnd.rn-realmedia 4676# sigh, there are many mimes for that but the above are the most common. 4677 4678# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 4679# Oct 31, 1995 4680# fixed by <doj@cubic.org> 2003-06-24 4681# Too short... 4682#0 string MTM MultiTracker Module sound file 4683#0 string if Composer 669 Module sound data 4684#0 string JN Composer 669 Module sound data (extended format) 46850 string MAS_U ULT(imate) Module sound data 4686 4687#0 string FAR Module sound data 4688#>4 string >\15 Title: "%s" 4689 46900x2c string SCRM ScreamTracker III Module sound data 4691>0 string >\0 Title: "%s" 4692!:mime audio/x-s3m 4693 4694# .stm before it got above .s3m extension 46950x16 string \!Scream\! ScreamTracker Module sound data 4696>0 string >\0 Title: "%s" 4697 4698# Gravis UltraSound patches 4699# From <ache@nagual.ru> 4700 47010 string GF1PATCH110\0ID#000002\0 GUS patch 47020 string GF1PATCH100\0ID#000002\0 Old GUS patch 4703 4704# mime types according to http://www.geocities.com/nevilo/mod.htm: 4705# audio/it .it 4706# audio/x-zipped-it .itz 4707# audio/xm fasttracker modules 4708# audio/x-s3m screamtracker modules 4709# audio/s3m screamtracker modules 4710# audio/x-zipped-mod mdz 4711# audio/mod mod 4712# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 4713 4714# 4715# Taken from loader code from mikmod version 2.14 4716# by Steve McIntyre (stevem@chiark.greenend.org.uk) 4717# <doj@cubic.org> added title printing on 2003-06-24 47180 string MAS_UTrack_V00 4719>14 string >/0 ultratracker V1.%.1s module sound data 4720!:mime audio/x-mod 4721#audio/x-tracker-module 4722 47230 string UN05 MikMod UNI format module sound data 4724 47250 string Extended\ Module: Fasttracker II module sound data 4726!:mime audio/x-mod 4727#audio/x-tracker-module 4728>17 string >\0 Title: "%s" 4729 473021 string/c =!SCREAM! Screamtracker 2 module sound data 4731!:mime audio/x-mod 4732#audio/x-screamtracker-module 473321 string BMOD2STM Screamtracker 2 module sound data 4734!:mime audio/x-mod 4735#audio/x-screamtracker-module 47361080 string M.K. 4-channel Protracker module sound data 4737!:mime audio/x-mod 4738#audio/x-protracker-module 4739>0 string >\0 Title: "%s" 47401080 string M!K! 4-channel Protracker module sound data 4741!:mime audio/x-mod 4742#audio/x-protracker-module 4743>0 string >\0 Title: "%s" 47441080 string FLT4 4-channel Startracker module sound data 4745!:mime audio/x-mod 4746#audio/x-startracker-module 4747>0 string >\0 Title: "%s" 47481080 string FLT8 8-channel Startracker module sound data 4749!:mime audio/x-mod 4750#audio/x-startracker-module 4751>0 string >\0 Title: "%s" 47521080 string 4CHN 4-channel Fasttracker module sound data 4753!:mime audio/x-mod 4754#audio/x-fasttracker-module 4755>0 string >\0 Title: "%s" 47561080 string 6CHN 6-channel Fasttracker module sound data 4757!:mime audio/x-mod 4758#audio/x-fasttracker-module 4759>0 string >\0 Title: "%s" 47601080 string 8CHN 8-channel Fasttracker module sound data 4761!:mime audio/x-mod 4762#audio/x-fasttracker-module 4763>0 string >\0 Title: "%s" 47641080 string CD81 8-channel Octalyser module sound data 4765!:mime audio/x-mod 4766#audio/x-octalysertracker-module 4767>0 string >\0 Title: "%s" 47681080 string OKTA 8-channel Octalyzer module sound data 4769!:mime audio/x-mod 4770#audio/x-octalysertracker-module 4771>0 string >\0 Title: "%s" 4772# Not good enough. 4773#1082 string CH 4774#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 47751080 string 16CN 16-channel Taketracker module sound data 4776!:mime audio/x-mod 4777#audio/x-taketracker-module 4778>0 string >\0 Title: "%s" 47791080 string 32CN 32-channel Taketracker module sound data 4780!:mime audio/x-mod 4781#audio/x-taketracker-module 4782>0 string >\0 Title: "%s" 4783 4784# TOC sound files -Trevor Johnson <trevor@jpj.net> 4785# 47860 string TOC TOC sound file 4787 4788# sidfiles <pooka@iki.fi> 4789# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 47900 string SIDPLAY\ INFOFILE Sidplay info file 4791 47920 string PSID PlaySID v2.2+ (AMIGA) sidtune 4793>4 beshort >0 w/ header v%d, 4794>14 beshort =1 single song, 4795>14 beshort >1 %d songs, 4796>16 beshort >0 default song: %d 4797>0x16 string >\0 name: "%s" 4798>0x36 string >\0 author: "%s" 4799>0x56 string >\0 copyright: "%s" 4800 48010 string RSID RSID sidtune PlaySID compatible 4802>4 beshort >0 w/ header v%d, 4803>14 beshort =1 single song, 4804>14 beshort >1 %d songs, 4805>16 beshort >0 default song: %d 4806>0x16 string >\0 name: "%s" 4807>0x36 string >\0 author: "%s" 4808>0x56 string >\0 copyright: "%s" 4809 4810# IRCAM sound files - Michael Pruett <michael@68k.org> 4811# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 48120 belong 0x64a30100 IRCAM file (VAX little-endian) 48130 belong 0x0001a364 IRCAM file (VAX big-endian) 48140 belong 0x64a30200 IRCAM file (Sun big-endian) 48150 belong 0x0002a364 IRCAM file (Sun little-endian) 48160 belong 0x64a30300 IRCAM file (MIPS little-endian) 48170 belong 0x0003a364 IRCAM file (MIPS big-endian) 48180 belong 0x64a30400 IRCAM file (NeXT big-endian) 48190 belong 0x64a30400 IRCAM file (NeXT big-endian) 48200 belong 0x0004a364 IRCAM file (NeXT little-endian) 4821 4822# NIST SPHERE <mpruett@sgi.com> 48230 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 4824 4825# Sample Vision <mpruett@sgi.com> 48260 string SOUND\ SAMPLE\ DATA\ Sample Vision file 4827 4828# Audio Visual Research <tonigonenstein@users.sourceforge.net> 48290 string 2BIT Audio Visual Research file, 4830>12 beshort =0 mono, 4831>12 beshort =-1 stereo, 4832>14 beshort x %d bits 4833>16 beshort =0 unsigned, 4834>16 beshort =-1 signed, 4835>22 belong&0x00ffffff x %d Hz, 4836>18 beshort =0 no loop, 4837>18 beshort =-1 loop, 4838>21 ubyte <128 note %d, 4839>22 byte =0 replay 5.485 KHz 4840>22 byte =1 replay 8.084 KHz 4841>22 byte =2 replay 10.971 KHz 4842>22 byte =3 replay 16.168 KHz 4843>22 byte =4 replay 21.942 KHz 4844>22 byte =5 replay 32.336 KHz 4845>22 byte =6 replay 43.885 KHz 4846>22 byte =7 replay 47.261 KHz 4847 4848# SGI SoundTrack <mpruett@sgi.com> 48490 string _SGI_SoundTrack SGI SoundTrack project file 4850# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 48510 string ID3 Audio file with ID3 version 2 4852>3 byte x \b.%d 4853>4 byte x \b.%d 4854>>5 byte &0x80 \b, unsynchronized frames 4855>>5 byte &0x40 \b, extended header 4856>>5 byte &0x20 \b, experimental 4857>>5 byte &0x10 \b, footer present 4858>(6.I+10) indirect x \b, contains: 4859 4860# NSF (NES sound file) magic 48610 string NESM\x1a NES Sound File 4862>14 string >\0 ("%s" by 4863>46 string >\0 %s, copyright 4864>78 string >\0 %s), 4865>5 byte x version %d, 4866>6 byte x %d tracks, 4867>122 byte&0x2 =1 dual PAL/NTSC 4868>122 byte&0x1 =1 PAL 4869>122 byte&0x1 =0 NTSC 4870 4871# NSFE (Extended NES sound file) magic 4872# http://slickproductions.org/docs/NSF/nsfespec.txt 4873# From: David Pflug <david@pflug.email> 48740 string NSFE Extended NES Sound File 4875>48 search/0x1000 auth 4876>>&0 string >\0 ("%s" 4877>>>&1 string >\0 by %s 4878>>>>&1 string >\0 \b, copyright %s 4879>>>>>&1 string >\0 \b, ripped by %s 4880>20 byte x \b), %d tracks, 4881>18 byte&0x2 =1 dual PAL/NTSC 4882>18 byte&0x2 =0 4883>>18 byte&0x1 =1 PAL 4884>>18 byte&0x1 =0 NTSC 4885 4886# Type: SNES SPC700 sound files 4887# From: Josh Triplett <josh@freedesktop.org> 48880 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 4889>&0 string 0.30 \b, version %s 4890>>0x23 byte 0x1B \b, without ID666 tag 4891>>0x23 byte 0x1A \b, with ID666 tag 4892>>>0x2E string >\0 \b, song "%.32s" 4893>>>0x4E string >\0 \b, game "%.32s" 4894 4895# Impulse tracker module (audio/x-it) 48960 string IMPM Impulse Tracker module sound data - 4897!:mime audio/x-mod 4898>4 string >\0 "%s" 4899>40 leshort !0 compatible w/ITv%x 4900>42 leshort !0 created w/ITv%x 4901 4902# Imago Orpheus module (audio/x-imf) 490360 string IM10 Imago Orpheus module sound data - 4904>0 string >\0 "%s" 4905 4906# From <collver1@attbi.com> 4907# These are the /etc/magic entries to decode modules, instruments, and 4908# samples in Impulse Tracker's native format. 4909 49100 string IMPS Impulse Tracker Sample 4911>18 byte &2 16 bit 4912>18 byte ^2 8 bit 4913>18 byte &4 stereo 4914>18 byte ^4 mono 49150 string IMPI Impulse Tracker Instrument 4916>28 leshort !0 ITv%x 4917>30 byte !0 %d samples 4918 4919# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 4920# From <collver1@attbi.com> 49210 string LM8953 Yamaha TX Wave 4922>22 byte 0x49 looped 4923>22 byte 0xC9 non-looped 4924>23 byte 1 33kHz 4925>23 byte 2 50kHz 4926>23 byte 3 16kHz 4927 4928# scream tracker: file(1) magic for Scream Tracker sample files 4929# 4930# From <collver1@attbi.com> 493176 string SCRS Scream Tracker Sample 4932>0 byte 1 sample 4933>0 byte 2 adlib melody 4934>0 byte >2 adlib drum 4935>31 byte &2 stereo 4936>31 byte ^2 mono 4937>31 byte &4 16bit little endian 4938>31 byte ^4 8bit 4939>30 byte 0 unpacked 4940>30 byte 1 packed 4941 4942# audio 4943# From: Cory Dikkers <cdikkers@swbell.net> 49440 string MMD0 MED music file, version 0 49450 string MMD1 OctaMED Pro music file, version 1 49460 string MMD3 OctaMED Soundstudio music file, version 3 49470 string OctaMEDCmpr OctaMED Soundstudio compressed file 49480 string MED MED_Song 49490 string SymM Symphonie SymMOD music file 4950# 4951# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) 4952# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 49530 string THX AHX version 4954>3 byte =0 1 module data 4955>3 byte =1 2 module data 4956>10 byte x TRL: %u 4957>11 byte x TRK: %u 4958>12 byte x SMP: %u 4959>13 byte x SS: %u 4960# 49610 string OKTASONG Oktalyzer module data 4962# 49630 string DIGI\ Booster\ module\0 %s 4964>20 byte >0 %c 4965>>21 byte >0 \b%c 4966>>>22 byte >0 \b%c 4967>>>>23 byte >0 \b%c 4968>610 string >\0 \b, "%s" 4969# 49700 string DBM0 DIGI Booster Pro Module 4971>4 byte >0 V%X. 4972>>5 byte x \b%02X 4973>16 string >\0 \b, "%s" 4974# 49750 string FTMN FaceTheMusic module 4976>16 string >\0d \b, "%s" 4977 4978# From: <doj@cubic.org> 2003-06-24 49790 string AMShdr\32 Velvet Studio AMS Module v2.2 49800 string Extreme Extreme Tracker AMS Module v1.3 49810 string DDMF Xtracker DMF Module 4982>4 byte x v%i 4983>0xD string >\0 Title: "%s" 4984>0x2B string >\0 Composer: "%s" 49850 string DSM\32 Dynamic Studio Module DSM 49860 string SONG DigiTrekker DTM Module 49870 string DMDL DigiTrakker MDL Module 49880 string PSM\32 Protracker Studio PSM Module 498944 string PTMF Poly Tracker PTM Module 4990>0 string >\32 Title: "%s" 49910 string MT20 MadTracker 2.0 Module MT2 49920 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 49930 string RTMM RTM Module 49940x426 string MaDoKaN96 XMS Adlib Module 4995>0 string >\0 Composer: "%s" 49960 string AMF AMF Module 4997>4 string >\0 Title: "%s" 49980 string MODINFO1 Open Cubic Player Module Information MDZ 49990 string Extended\40Instrument: Fast Tracker II Instrument 5000 5001# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 5002# NOA Nancy Codec file 50030 string \210NOA\015\012\032 NOA Nancy Codec Movie file 5004# Yamaha SMAF format 50050 string MMMD Yamaha SMAF file 5006# Sharp Jisaku Melody format for PDC 50070 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 5008>20 string Ver01.00 Ver. 1.00 5009>>32 byte x , %d tracks 5010 5011# Free lossless audio codec <http://flac.sourceforge.net> 5012# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 50130 string fLaC FLAC audio bitstream data 5014!:mime audio/flac 5015>4 byte&0x7f >0 \b, unknown version 5016>4 byte&0x7f 0 \b 5017# some common bits/sample values 5018>>20 beshort&0x1f0 0x030 \b, 4 bit 5019>>20 beshort&0x1f0 0x050 \b, 6 bit 5020>>20 beshort&0x1f0 0x070 \b, 8 bit 5021>>20 beshort&0x1f0 0x0b0 \b, 12 bit 5022>>20 beshort&0x1f0 0x0f0 \b, 16 bit 5023>>20 beshort&0x1f0 0x170 \b, 24 bit 5024>>20 byte&0xe 0x0 \b, mono 5025>>20 byte&0xe 0x2 \b, stereo 5026>>20 byte&0xe 0x4 \b, 3 channels 5027>>20 byte&0xe 0x6 \b, 4 channels 5028>>20 byte&0xe 0x8 \b, 5 channels 5029>>20 byte&0xe 0xa \b, 6 channels 5030>>20 byte&0xe 0xc \b, 7 channels 5031>>20 byte&0xe 0xe \b, 8 channels 5032# sample rates derived from known oscillator frequencies; 5033# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 5034# 16.384 (other/fs=32kHz). 5035>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 5036>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 5037>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 5038>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 5039>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 5040>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 5041>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 5042>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 5043>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 5044>>17 belong&0xfffff0 0x177000 \b, 96 kHz 5045>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 5046>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 5047>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 5048>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 5049>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 5050>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 5051>>21 byte&0xf >0 \b, >4G samples 5052>>21 byte&0xf 0 \b 5053>>>22 belong >0 \b, %u samples 5054>>>22 belong 0 \b, length unknown 5055 5056# (ISDN) VBOX voice message file (Wolfram Kleff) 50570 string VBOX VBOX voice message data 5058 5059# ReBorn Song Files (.rbs) 5060# David J. Singer <doc@deadvirgins.org.uk> 50618 string RB40 RBS Song file 5062>29 string ReBorn created by ReBorn 5063>37 string Propellerhead created by ReBirth 5064 5065# Synthesizer Generator and Kimwitu share their file format 50660 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 5067# Kimwitu++ uses a slightly different magic 50680 string A#S#C#S#S#L#HUB Kimwitu++ data 5069 5070# From "Simon Hosie 50710 string TFMX-SONG TFMX module sound data 5072 5073# Monkey's Audio compressed audio format (.ape) 5074# From danny.milo@gmx.net (Danny Milosavljevic) 5075# New version from Abel Cheung <abel (@) oaka.org> 50760 string MAC\040 Monkey's Audio compressed format 5077!:mime audio/x-ape 5078>4 uleshort >0x0F8B version %d 5079>>(0x08.l) uleshort =1000 with fast compression 5080>>(0x08.l) uleshort =2000 with normal compression 5081>>(0x08.l) uleshort =3000 with high compression 5082>>(0x08.l) uleshort =4000 with extra high compression 5083>>(0x08.l) uleshort =5000 with insane compression 5084>>(0x08.l+18) uleshort =1 \b, mono 5085>>(0x08.l+18) uleshort =2 \b, stereo 5086>>(0x08.l+20) ulelong x \b, sample rate %d 5087>4 uleshort <0x0F8C version %d 5088>>6 uleshort =1000 with fast compression 5089>>6 uleshort =2000 with normal compression 5090>>6 uleshort =3000 with high compression 5091>>6 uleshort =4000 with extra high compression 5092>>6 uleshort =5000 with insane compression 5093>>10 uleshort =1 \b, mono 5094>>10 uleshort =2 \b, stereo 5095>>12 ulelong x \b, sample rate %d 5096 5097# adlib sound files 5098# From: Alex Myczko <alex@aiei.ch> 5099 5100# https://github.com/rerrahkr/BambooTracker 51010 string BambooTrackerMod BambooTracker module 5102>22 byte x \b, version %u 5103>21 byte x \b.%u 5104>20 byte x \b.%u 5105 51060 string BambooTrackerIst BambooTracker instrument 5107>22 byte x \b, version %u 5108>21 byte x \b.%u 5109>20 byte x \b.%u 5110 51110 string CC2x CheeseCutter 2 song 5112 51130 string RAWADATA RdosPlay RAW 5114 51151068 string RoR AMUSIC Adlib Tracker 5116 51170 string JCH EdLib 5118 51190 string mpu401tr MPU-401 Trakker 5120 51210 string SAdT Surprise! Adlib Tracker 5122>4 byte x Version %d 5123 51240 string XAD! eXotic ADlib 5125 51260 string ofTAZ! eXtra Simple Music 5127 51280 string FMK! FM Kingtracker Song 5129 51300 string DFM DFM Song 5131 51320 string \<CUD-FM-File\> CFF Song 5133 51340 string _A2module A2M Song 5135 5136# Spectrum 128 tunes (.ay files). 5137# From: Emanuel Haupt <ehaupt@critical.ch> 51380 string ZXAYEMUL Spectrum 128 tune 5139 51400 string \0BONK BONK, 5141#>5 byte x version %d 5142>14 byte x %d channel(s), 5143>15 byte =1 lossless, 5144>15 byte =0 lossy, 5145>16 byte x mid-side 5146 5147384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 5148 5149# format VQF (proprietary codec for sound) 5150# some infos on the header file available at : 5151# http://www.twinvq.org/english/technology_format.html 51520 string TWIN97012000 VQF data 5153>27 short 0 \b, Mono 5154>27 short 1 \b, Stereo 5155>31 short >0 \b, %d kbit/s 5156>35 short >0 \b, %d kHz 5157 5158# Nelson A. de Oliveira (naoliv@gmail.com) 5159# .eqf 51600 string Winamp\ EQ\ library\ file %s 5161# it will match only versions like v<digit>.<digit> 5162# Since I saw only eqf files with version v1.1 I think that it's OK 5163>23 string x \b%.4s 5164# .preset 51650 string [Equalizer\ preset] XMMS equalizer preset 5166# .m3u 51670 search/1 #EXTM3U M3U playlist text 5168# .pls 51690 search/1 [playlist] PLS playlist text 5170# licq.conf 51711 string [licq] LICQ configuration file 5172 5173# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 5174# NOTE: Most SNDH music is packed using ICE, which has 5175# magic numbers "ICE!" and "Ice!". Some SNDH music is 5176# not packed, so we check for both packed and unpacked. 517712 string SNDH SNDH Atari ST music 51780 belong&0xFFDFDFFF 0x49434521 5179>14 search/40 NDH SNDH Atari ST music 5180>14 search/40 TITL SNDH Atari ST music 51810 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 5182 5183# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 51840 string MP+ Musepack audio (MP+) 5185!:mime audio/x-musepack 5186>3 byte 255 \b, SV pre8 5187>3 byte&0xF 0x6 \b, SV 6 5188>3 byte&0xF 0x8 \b, SV 8 5189>3 byte&0xF 0x7 \b, SV 7 5190>>3 byte&0xF0 0x0 \b.0 5191>>3 byte&0xF0 0x10 \b.1 5192>>3 byte&0xF0 240 \b.15 5193>>10 byte&0xF0 0x0 \b, no profile 5194>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 5195>>10 byte&0xF0 0x50 \b, quality 0 5196>>10 byte&0xF0 0x60 \b, quality 1 5197>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 5198>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 5199>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 5200>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 5201>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 5202>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 5203>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 5204>>10 byte&0xF0 0xE0 \b, quality 9 5205>>10 byte&0xF0 0xF0 \b, quality 10 5206>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 5207>>27 byte 102 \b, Beta 1.02 5208>>27 byte 104 \b, Beta 1.04 5209>>27 byte 105 \b, Alpha 1.05 5210>>27 byte 106 \b, Beta 1.06 5211>>27 byte 110 \b, Release 1.1 5212>>27 byte 111 \b, Alpha 1.11 5213>>27 byte 112 \b, Beta 1.12 5214>>27 byte 113 \b, Alpha 1.13 5215>>27 byte 114 \b, Beta 1.14 5216>>27 byte 115 \b, Alpha 1.15 5217 52180 string MPCK Musepack audio (MPCK) 5219!:mime audio/x-musepack 5220 5221# IMY 5222# from http://filext.com/detaillist.php?extdetail=IMY 5223# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 5224# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 5225# http://www.wx800.com/msg/download/irda/iMelody.pdf 52260 string BEGIN:IMELODY iMelody Ringtone Format 5227 5228# From: "Mateus Caruccio" <mateus@caruccio.com> 5229# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 52300 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 5231 5232# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 523360 string SONG SoundFX Module sound file 5234 5235# Type: Adaptive Multi-Rate Codec 5236# URL: http://filext.com/detaillist.php?extdetail=AMR 5237# From: Russell Coker <russell@coker.com.au> 52380 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 5239!:mime audio/amr 5240!:ext amr 5241 5242# Type: SuperCollider 3 Synth Definition File Format 5243# From: Mario Lang <mlang@debian.org> 52440 string SCgf SuperCollider3 Synth Definition file, 5245>4 belong x version %d 5246 5247# Type: True Audio Lossless Audio 5248# URL: https://wiki.multimedia.cx/index.php?title=True_Audio 5249# From: Mike Melanson <mike@multimedia.cx> 52500 string TTA1 True Audio Lossless Audio 5251 5252# Type: WavPack Lossless Audio 5253# URL: https://wiki.multimedia.cx/index.php?title=WavPack 5254# From: Mike Melanson <mike@multimedia.cx> 52550 string wvpk WavPack Lossless Audio 5256 5257# From Fabio R. Schmidlin <frs@pop.com.br> 5258# VGM music file 52590 string Vgm\040 5260>9 ubyte >0 VGM Video Game Music dump v 5261!:mime audio/x-vgm 5262!:ext vgm 5263>>9 ubyte/16 >0 \b%d 5264>>9 ubyte&0x0F x \b%d 5265>>8 ubyte/16 x \b.%d 5266>>8 ubyte&0x0F >0 \b%d 5267#Get soundchips 5268>>8 ubyte x \b, soundchip(s)= 5269>>0x0C ulelong >0 SN76489 (PSG), 5270>>0x10 ulelong >0 YM2413 (OPLL), 5271>>0x2C ulelong >0 YM2612 (OPN2), 5272>>0x30 ulelong >0 YM2151 (OPM), 5273>>0x38 ulelong >0 Sega PCM, 5274>>0x34 ulelong >0xC 5275>>>0x40 ulelong >0 RF5C68 (PCM), 5276>>0x34 ulelong >0x10 5277>>>0x44 ulelong >0 YM2203 (OPN), 5278>>0x34 ulelong >0x14 5279>>>0x48 ulelong >0 YM2608 (OPNA), 5280>>0x34 ulelong >0x18 5281>>>0x4C lelong >0 YM2610 (OPNB), 5282>>>0x4C lelong <0 YM2610B (OPNB+2FM), 5283>>0x34 ulelong >0x1C 5284>>>0x50 ulelong >0 YM3812 (OPL2), 5285>>0x34 ulelong >0x20 5286>>>0x54 ulelong >0 YM3526 (OPL), 5287>>0x34 ulelong >0x24 5288>>>0x58 ulelong >0 Y8950 (MSX-Audio), 5289>>0x34 ulelong >0x28 5290>>>0x5C ulelong >0 YMF262 (OPL3), 5291>>0x34 ulelong >0x2C 5292>>>0x60 ulelong >0 YMF278B (OPL4), 5293>>0x34 ulelong >0x30 5294>>>0x64 ulelong >0 YMF271 (OPX), 5295>>0x34 ulelong >0x34 5296>>>0x68 ulelong >0 YMZ280B (PCMD8), 5297>>0x34 ulelong >0x38 5298>>>0x6C ulelong >0 RF5C164 (PCM), 5299>>0x34 ulelong >0x3C 5300>>>0x70 ulelong >0 PWM, 5301>>0x34 ulelong >0x40 5302>>>0x74 ulelong >0 5303>>>>0x78 ubyte 0x00 AY-3-8910, 5304>>>>0x78 ubyte 0x01 AY-3-8912, 5305>>>>0x78 ubyte 0x02 AY-3-8913, 5306>>>>0x78 ubyte 0x03 AY-3-8930, 5307>>>>0x78 ubyte 0x10 YM2149, 5308>>>>0x78 ubyte 0x11 YM3439, 5309>>>>0x78 ubyte 0x12 YMZ284, 5310>>>>0x78 ubyte 0x13 YMZ294, 5311# VGM 1.61 5312>>0x34 ulelong >0x4C 5313>>>0x80 ulelong >0 DMG, 5314>>0x34 ulelong >0x50 5315>>>0x84 lelong >0 NES APU, 5316>>>0x84 lelong <0 NES APU with FDS, 5317>>0x34 ulelong >0x54 5318>>>0x88 ulelong >0 MultiPCM, 5319>>0x34 ulelong >0x58 5320>>>0x8C ulelong >0 uPD7759 (ADPCM Speech), 5321>>0x34 ulelong >0x5C 5322>>>0x90 ulelong >0 OKIM6258 (ADPCM Speech), 5323>>0x34 ulelong >0x64 5324>>>0x98 ulelong >0 OKIM6295 (ADPCM), 5325>>0x34 ulelong >0x68 5326>>>0x9C ulelong >0 K051649, 5327>>0x34 ulelong >0x6C 5328>>>0xA0 ulelong >0 K054539, 5329>>0x34 ulelong >0x70 5330>>>0xA4 ulelong >0 HuC6280, 5331>>0x34 ulelong >0x74 5332>>>0xA8 ulelong >0 C140, 5333>>0x34 ulelong >0x78 5334>>>0xAC ulelong >0 K053260, 5335>>0x34 ulelong >0x7C 5336>>>0xB0 ulelong >0 Pokey, 5337>>0x34 ulelong >0x80 5338>>>0xB4 ulelong >0 QSound, 5339# VGM 1.71 5340>>0x34 ulelong >0x84 5341>>>0xB8 ulelong >0 SCSP, 5342>>0x34 ulelong >0x8C 5343>>>0xC0 ulelong >0 WonderSwan, 5344>>0x34 ulelong >0x90 5345>>>0xC4 ulelong >0 VSU, 5346>>0x34 ulelong >0x94 5347>>>0xC8 ulelong >0 SAA1099, 5348>>0x34 ulelong >0x98 5349>>>0xCC ulelong >0 ES5503 (DOC), 5350>>0x34 ulelong >0x9C 5351>>>0xD0 lelong >0 ES5505 (OTIS), 5352>>>0xD0 lelong <0 ES5506 (OTTO), 5353>>0x34 ulelong >0xA4 5354>>>0xD8 ulelong >0 X1-010, 5355>>0x34 ulelong >0xA8 5356>>>0xDC ulelong >0 C352, 5357>>0x34 ulelong >0xAC 5358>>>0xE0 ulelong >0 GA20, 5359 5360# GVOX Encore file format 5361# Since this is a proprietary file format and there is no publicly available 5362# format specification, this is just based on induction 5363# 53640 string SCOW 5365>4 byte 0xc4 GVOX Encore music, version 5.0 or above 5366>4 byte 0xc2 GVOX Encore music, version < 5.0 5367 53680 string ZBOT 5369>4 byte 0xc5 GVOX Encore music, version < 5.0 5370 5371# Summary: Garmin Voice Processing Module (WAVE audios) 5372# From: Joerg Jenderek 5373# URL: https://www.garmin.com/ 5374# Reference: http://www.poi-factory.com/node/19580 5375# NOTE: there exist 2 other Garmin VPM formats 53760 string AUDIMG 5377# skip text files starting with string "AUDIMG" 5378>13 ubyte <13 Garmin Voice Processing Module 5379!:mime audio/x-vpm-wav-garmin 5380!:ext vpm 5381# 3 bytes indicating the voice version (200,220) 5382>>6 string x \b, version %3.3s 5383# day of release (01-31) 5384>>12 ubyte x \b, %.2d 5385# month of release (01-12) 5386>>13 ubyte x \b.%.2d 5387# year of release (like 2006, 2007, 2008) 5388>>14 uleshort x \b.%.4d 5389# hour of release (0-23) 5390>>11 ubyte x %.2d 5391# minute of release (0-59) 5392>>10 ubyte x \b:%.2d 5393# second of release (0-59) 5394>>9 ubyte x \b:%.2d 5395# if you select a language like german on your garmin device 5396# you can only select voice modules with corresponding language byte ID like 1 5397>>18 ubyte x \b, language ID %d 5398# structure for phrases/sentences? 5399# number of voice sample in the 1st phrase? 5400#>>19 uleshort x \b, 0x%x samples 5401#>>>21 uleshort >0 \b, at 0x%4.4x 5402#>>>(21.s) ubequad x 0x%llx 5403# 2nd phrase? 5404#>>23 uleshort x \b, 0x%x samples 5405#>>>25 uleshort >0 \b, at 0x%4.4x 5406#>>>(25.s) ubequad x 0x%llx 5407# pointer to 1st audio WAV sample 5408>>16 uleshort >0 5409>>>(16.s) ulelong >0 \b, at 0x%x 5410# WAV length 5411# 1 space char after "bytes" to get phrase "bytes RIFF" 5412>>>>(16.s+4) ulelong >0 %u bytes 5413# look for magic 5414>>>>>(&-8.l) string RIFF 5415# determine type by ./riff 5416>>>>>>&-4 indirect x 5417# 2 - ~ 131 WAV samples following same way 5418# 5419# Summary: encrypted Garmin Voice Processing Module 5420# From: Joerg Jenderek 5421# URL: https://www.garmin.com/us/products/ontheroad/voicestudio 5422# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. 5423# There exist 2 other Garmin VPM formats 54240 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) 5425!:mime audio/x-vpm-garmin 5426!:ext vpm 5427 5428# From Martin Mueller Skarbiniks Pedersen 54290 string GDM 5430>0x3 byte 0xFE General Digital Music. 5431>0x4 string >\0 title: "%s" 5432>0x24 string >\0 musician: "%s" 5433>>0x44 beshort 0x0D0A 5434>>>0x46 byte 0x1A 5435>>>>0x47 string GMFS Version 5436>>>>0x4B byte x %d. 5437>>>>0x4C byte x \b%02d 5438>>>>0x4D beshort 0x000 (2GDM v 5439>>>>0x4F byte x \b%d. 5440>>>>>0x50 byte x \b%d) 5441 54420 string MTM Multitracker 5443>0x3 byte/16 x Version %d. 5444>0x3 byte&0x0F x \b%02d 5445>>0x4 string >\0 title: "%s" 5446 54470 string HVL 5448>3 byte <2 Hively Tracker Song 5449>3 byte 0 1 module data 5450>3 byte 1 2 module data 5451 54520 string MO3 5453>3 ubyte <6 MOdule with MP3 5454>>3 byte 0 Version 0 (With MP3 and lossless) 5455>>3 byte 1 Version 1 (With ogg and lossless) 5456>>3 byte 3 Version 2.2 5457>>3 byte 4 (With no LAME header) 5458>>3 byte 5 Version 2.4 5459 54600 string ADRVPACK AProSys module 5461 5462# ftp://ftp.modland.com/pub/documents/format_documentation/\ 5463# Art%20Of%20Noise%20(.aon).txt 54640 string AON 5465>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 5466>0x2e string NAME Art of Noise Tracker Song 5467>3 string <9 5468>3 string 4 (4 voices) 5469>3 string 8 (8 voices) 5470>>0x36 string >\0 Title: "%s" 5471 54720 string FAR 5473>0x2c byte 0x0d 5474>0x2d byte 0x0a 5475>0x2e byte 0x1a 5476>>0x3 byte 0xFE Farandole Tracker Song 5477>>>0x31 byte/16 x Version %d. 5478>>>0x31 byte&0x0F x \b%02d 5479>>>>0x4 string >\0 \b, title: "%s" 5480 5481# magic for Klystrack, https://kometbomb.github.io/klystrack/ 5482# from Alex Myczko <alex@aiei.ch> 54830 string cyd!song Klystrack song 5484>8 byte >0 \b, version %u 5485>8 byte >26 5486#>>9 byte x \b, channels %u 5487#>>10 leshort x \b, time signature %u 5488#>>12 leshort x \b, sequence step %u 5489#>>14 byte x \b, instruments %u 5490#>>15 leshort x \b, patterns %u 5491#>>17 leshort x \b, sequences %u 5492#>>19 leshort x \b, length %u 5493#>>21 leshort x \b, loop point %u 5494#>>23 byte x \b, master volume %u 5495#>>24 byte x \b, song speed %u 5496#>>25 byte x \b, song speed2 %u 5497#>>26 byte x \b, song rate %u 5498#>>27 belong x \b, flags %#x 5499#>>31 byte x \b, multiplex period %u 5500#>>32 byte x \b, pitch inaccuracy %u 5501>>149 pstring x \b, title %s 5502 55030 string cyd!inst Klystrack instrument 5504 5505# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 5506# see Specifications/WOPL-and-OPLI-Specification.txt 5507 55080 string WOPL3-INST\0 WOPL instrument 5509>11 leshort x \b, version %u 55100 string WOPL3-BANK\0 WOPL instrument bank 5511>11 leshort x \b, version %u 5512 5513# AdLib/OPL instrument files. Format specifications on 5514# http://www.shikadi.net/moddingwiki 55150 string Junglevision\ Patch\ File Junglevision instrument data 55160 string #OPL_II# DMX OP2 instrument data 55170 string IBK\x1a IBK instrument data 55180 string 2OP\x1a IBK instrument data, 2 operators 55190 string 4OP\x1a IBK instrument data, 4 operators 55202 string ADLIB- AdLib instrument data 5521>0 byte x \b, version %u 5522>1 byte x \b.%u 5523 5524# CRI ADX ADPCM audio 5525# Used by various Sega games. 5526# https://en.wikipedia.org/wiki/ADX_(file_format) 5527# https://wiki.multimedia.cx/index.php/CRI_ADX_file 5528# Added by David Korth <gerbilsoft@gerbilsoft.com> 55290x00 beshort 0x8000 5530>(2.S-2) string (c)CRI CRI ADX ADPCM audio 5531!:ext adx 5532!:mime audio/x-adx 5533!:strength +50 5534>>0x12 byte x v%u 5535>>0x04 byte 0x02 \b, pre-set prediction coefficients 5536>>0x04 byte 0x03 \b, standard ADX 5537>>0x04 byte 0x04 \b, exponential scale 5538>>0x04 byte 0x10 \b, AHX (Dreamcast) 5539>>0x04 byte 0x11 \b, AHX 5540>>0x08 belong x \b, %u Hz 5541>>0x12 byte 0x03 5542>>>0x02 beshort >0x2B 5543>>>>0x18 belong !0 \b, looping 5544>>0x12 byte 0x04 5545>>>0x02 beshort >0x37 5546>>>>0x24 belong !0 \b, looping 5547>>0x13 byte&0x08 0x08 \b, encrypted 5548 5549# Lossless audio (.la) (http://www.lossless-audio.com/) 55500 string LA 5551>2 string 03 Lossless audio version 0.3 5552>2 string 04 Lossless audio version 0.4 5553 5554# Sony PlayStation Audio (.xa) 55550 leshort 0x4158 Sony PlayStation Audio 5556 5557# Portable Sound Format 5558# Used for audio rips for various consoles. 5559# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format 5560# Added by David Korth <gerbilsoft@gerbilsoft.com> 55610 string PSF 5562>3 byte 0x01 5563>3 byte 0x02 5564>3 byte 0x11 5565>3 byte 0x12 5566>3 byte 0x13 5567>3 byte 0x21 5568>3 byte 0x22 5569>3 byte 0x23 5570>3 byte 0x41 5571>>0 string PSF Portable Sound Format 5572!:mime audio/x-psf 5573>>>3 byte 0x01 (Sony PlayStation) 5574>>>3 byte 0x02 (Sony PlayStation 2) 5575>>>3 byte 0x11 (Sega Saturn) 5576>>>3 byte 0x12 (Sega Dreamcast) 5577>>>3 byte 0x13 (Sega Mega Drive) 5578>>>3 byte 0x21 (Nintendo 64) 5579>>>3 byte 0x22 (Game Boy Advance) 5580>>>3 byte 0x23 (Super NES) 5581>>>3 byte 0x41 (Capcom QSound) 5582 5583# Atari 8-bit SAP audio format 5584# http://asap.sourceforge.net/sap-format.html 5585# Added by David Korth <gerbilsoft@gerbilsoft.com> 55860 string SAP\r\n Atari 8-bit SAP audio file 5587!:mime audio/x-sap 5588!:ext sap 5589>5 search/1024 NAME 5590>>&1 string x \b: %s 5591>>5 search/1024 AUTHOR 5592>>>&1 string x by %s 5593 5594# Nintendo Wii BRSTM audio format (fields) 5595# NOTE: Assuming HEAD starts at 0x40. 5596# FIXME: Replace 0x48 with HEAD offset plus 8. 55970 name nintendo-wii-brstm-fields 5598>(0x10.L) string HEAD \b: 5599>>(0x10.L+0x0C) belong x 5600>>>(&-4.L+0x48) belong x 5601>>>>&-4 byte 0 PCM, signed 8-bit, 5602>>>>&-4 byte 1 PCM, signed 16-bit, 5603>>>>&-4 byte 2 THP ADPCM, 5604>>>>&-3 byte !0 looping, 5605>>>>&-2 byte 1 mono 5606>>>>&-2 byte 2 stereo 5607>>>>&-2 byte 3 3 channels 5608>>>>&-2 byte 4 quad 5609>>>>&-2 byte >4 %u channels 5610>>>>&0 beshort !0 %u Hz 5611 5612# Nintendo Wii BRSTM audio format 5613# https://wiibrew.org/wiki/BRSTM_file 5614# Added by David Korth <gerbilsoft@gerbilsoft.com> 56150 string RSTM Nintendo Wii BRSTM audio file 5616!:mime audio/x-brstm 5617!:ext brstm 5618# Wii is big-endian, so default to BE. 5619>4 beshort 0xFEFF 5620>>0 use nintendo-wii-brstm-fields 5621>4 leshort 0xFEFF 5622>>0 use \^nintendo-wii-brstm-fields 5623 5624# Nintendo 3DS BCSTM audio format (fields) 56250 name nintendo-3ds-bcstm-fields 5626>(0x18.l) string INFO \b: 5627# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) 5628>>&0x1C byte 0 PCM, signed 8-bit, 5629>>&0x1C byte 1 PCM, signed 16-bit, 5630>>&0x1C byte 2 DSP ADPCM, 5631>>&0x1C byte 3 IMA ADPCM, 5632>>&0x1D byte !0 looping, 5633>>&0x1E byte 1 mono 5634>>&0x1E byte 2 stereo 5635>>&0x1E byte 3 3 channels 5636>>&0x1E byte 4 quad 5637>>&0x1E byte >4 %u channels 5638>>&0x20 lelong !0 %u Hz 5639 5640# Nintendo 3DS BCSTM audio format 5641# https://www.3dbrew.org/wiki/BCSTM 5642# Added by David Korth <gerbilsoft@gerbilsoft.com> 56430 string CSTM Nintendo 3DS BCSTM audio file 5644!:mime audio/x-bcstm 5645!:ext bcstm 5646# 3DS is little-endian, so default to LE. 5647>4 leshort 0xFEFF 5648>>0 use nintendo-3ds-bcstm-fields 5649>4 beshort 0xFEFF 5650>>0 use \^nintendo-3ds-bcstm-fields 5651 5652# Nintendo Wii U BFSTM audio format 5653# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) 5654# NOTE: This format is very similar to BCSTM. 5655# Added by David Korth <gerbilsoft@gerbilsoft.com> 56560 string FSTM Nintendo Wii U BFSTM audio file 5657!:mime audio/x-bfstm 5658!:ext bfstm 5659# BFSTM is used on both Wii U (BE) and Switch (LE), 5660# so default to LE. 5661>4 leshort 0xFEFF 5662>>0 use nintendo-3ds-bcstm-fields 5663>4 beshort 0xFEFF 5664>>0 use \^nintendo-3ds-bcstm-fields 5665 5666# Nintendo 3DS BCSTM audio format (fields) 56670 name nintendo-3ds-bcwav-fields 5668>(0x18.l) string INFO \b: 5669# INFO block (minus 4 for INFO magic) 5670>>&0x4 byte 0 PCM, signed 8-bit, 5671>>&0x4 byte 1 PCM, signed 16-bit, 5672>>&0x4 byte 2 DSP ADPCM, 5673>>&0x4 byte 3 IMA ADPCM, 5674>>&0x5 byte !0 looping, 5675>>&0x8 lelong x stereo 5676>>&0x8 lelong !0 %u Hz 5677 5678# Nintendo 3DS BCWAV audio format 5679# https://www.3dbrew.org/wiki/BCWAV 5680# Added by David Korth <gerbilsoft@gerbilsoft.com> 56810 string CWAV Nintendo 3DS BCWAV audio file 5682!:mime audio/x-bcwav 5683!:ext bcwav 5684# 3DS is little-endian, so default to LE. 5685>4 leshort 0xFEFF 5686>>0 use nintendo-3ds-bcwav-fields 5687>4 beshort 0xFEFF 5688>>0 use \^nintendo-3ds-bcwav-fields 5689 5690#------------------------------------------------------------------------------ 5691# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $ 5692# avm: file(1) magic for avm files; this is not use 5693 5694# Summary: FRITZ!Box router configuration backup 5695# From: Joerg Jenderek 5696# URL: https://en.wikipedia.org/wiki/Fritz!Box 5697# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2 5698# Note: only tested with models 4040 and 6490 Cable (lgi) 56990 string ****\ FRITZ!Box\ FRITZ!Box configuration backup 5700#!:mime text/plain 5701!:mime application/x-avm-export 5702!:ext export 5703# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT" 5704>15 string x of %-.4s 5705# on 2nd line hashed password 5706#>41 search/54 Password= \b, password 5707# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83 5708>41 search/172 FirmwareVersion= \b, firmware version 5709>>&0 string x %s 5710# on 5th line oem like: avme lgi 5711>41 search/285 OEM= \b, oem 5712>>&0 string x %s 5713# on 7th line language like: de en 5714>41 search/305 Language= \b, language 5715>>&0 string x %s 5716# on 10th line cfg file name like: /var/tmp.cfg 5717>41 search/349 tmp.cfg 5718# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015 5719>>&4 string x \b, %s 5720# 5721 5722 5723#---------------------------------------------------------------- 5724# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ 5725# basis: file(1) magic for BBx/Pro5-files 5726# Oliver Dammer <dammer@olida.de> 2005/11/07 5727# https://www.basis.com business-basic-files. 5728# 57290 string \074\074bbx\076\076 BBx 5730>7 string \000 indexed file 5731>7 string \001 serial file 5732>7 string \002 keyed file 5733>>13 short 0 (sort) 5734>7 string \004 program 5735>>18 byte x (LEVEL %d) 5736>>>23 string >\000 psaved 5737>7 string \006 mkeyed file 5738>>13 short 0 (sort) 5739>>8 string \000 (mkey) 5740#------------------------------------------------------------------------------ 5741# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 5742# beetle: file(1) magic for Beetle VM object files 5743# https://github.com/rrthomas/beetle/ 5744 5745# Beetle object module 57460 string BEETLE\000 Beetle VM object file 5747 5748#------------------------------------------------------------------------------ 5749# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ 5750# ber: file(1) magic for several BER formats used in the mobile 5751# telecommunications industry (Georg Sauthoff) 5752 5753# The file formats are standardized by the GSMA (GSM association). 5754# They are specified via ASN.1 schemas and some prose. Basic encoding 5755# rules (BER) is the used encoding. The formats are used for exchanging 5756# call data records (CDRs) between mobile operators and associated 5757# parties for roaming clearing purposes and fraud detection. 5758 5759# The magic file covers: 5760 5761# - TAP files (TD.57) - CDR batches and notifications 5762# - RAP files (TD.32) - return batches and acknowledgements 5763# - NRT files (TD.35) - CDR batches for 'near real time' processing 5764 5765# 5766# TAP 3 Files 5767# TAP -> Transferred Account Procedure 5768# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 5769# TransferBatch short tag 57700 byte 0x61 5771# BatchControlInfo short tag 5772>&1 search/b5 \x64 5773# Sender long tag #TAP 3.x (BER encoded) 5774>>&1 search/b8 \x5f\x81\x44 5775# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5776>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5777>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 5778 5779# Notification short tag 57800 byte 0x62 5781# Sender long tag 5782>2 search/b8 \x5f\x81\x44 5783# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5784>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5785>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 5786 5787 5788# NRT Files 5789# NRT a.k.a. NRTRDE 57900 byte 0x61 5791# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 5792>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 5793>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 5794 5795# RAP Files 5796# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 5797# Long ReturnBatch tag 57980 string \x7f\x84\x16 5799# Long RapBatchControlInfo tag 5800>&1 search/b8 \x7f\x84\x19 5801# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5802>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5803# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 5804>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 5805>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 5806>>>&0 byte x TAP 3.%d 5807 5808# Long Acknowledgement tag 58090 string \x7f\x84\x17 5810# Long Sender tag 5811>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 5812 5813#------------------------------------------------------------------------------ 5814# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 5815# bFLT: file(1) magic for BFLT uclinux binary files 5816# 5817# From Philippe De Muyter <phdm@macqel.be> 5818# 58190 string bFLT BFLT executable 5820>4 belong x - version %d 5821>4 belong 4 5822>>36 belong&0x1 0x1 ram 5823>>36 belong&0x2 0x2 gotpic 5824>>36 belong&0x4 0x4 gzip 5825>>36 belong&0x8 0x8 gzdata 5826 5827#------------------------------------------------------------------------------ 5828# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 5829# BlockHashLoc 5830# ext: bhl 5831# Marco Pontello marcopon@gmail.com 5832# reference: https://github.com/MarcoPon/BlockHashLoc 58330 string BlockHashLoc\x1a BlockHashLoc recovery info, 5834>13 byte x version %d 5835!:ext bhl 5836 5837#------------------------------------------------------------------------------ 5838# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ 5839# bioinfomatics: file(1) magic for Bioinfomatics file formats 5840 5841############################################################################### 5842# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 5843# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5844############################################################################### 58450 string \037\213 5846>3 byte &0x04 5847>>12 string BC 5848>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 5849>>>>16 leshort x \b, block length %d 5850!:mime application/x-gzip 5851 5852 5853############################################################################### 5854# Tabix index file 5855# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5856############################################################################### 58570 string TBI\1 SAMtools TBI (Tabix index format) 5858>0x04 lelong =1 \b, with %d reference sequence 5859>0x04 lelong >1 \b, with %d reference sequences 5860>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 5861>0x08 lelong ^0x10000 5862>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 5863>>0x08 lelong =1 \b, using SAM format 5864>>0x08 lelong =2 \b, using VCF format 5865>0x0c lelong x \b, sequence name column: %d 5866>0x10 lelong x \b, region start column: %d 5867>0x08 lelong =0 5868>>0x14 lelong x \b, region end column: %d 5869>0x18 byte x \b, comment character: %c 5870>0x1c lelong x \b, skip line count: %d 5871 5872 5873############################################################################### 5874# BAM (Binary Sequence Alignment/Map format) 5875# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5876# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5877############################################################################### 58780 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 5879>0x04 lelong >0 5880>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 5881>>>&0 regex =[0-9.]+ \b version %s 5882>>&(0x04) lelong >0 \b, with %d reference sequences 5883 5884 5885############################################################################### 5886# BAI (BAM indexing format) 5887# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5888############################################################################### 58890 string BAI\1 SAMtools BAI (BAM indexing format) 5890>0x04 lelong >0 \b, with %d reference sequences 5891 5892 5893############################################################################### 5894# CRAM (Binary Sequence Alignment/Map format) 5895############################################################################### 58960 string CRAM CRAM 5897>0x04 byte >-1 version %d. 5898>0x05 byte >-1 \b%d 5899>0x06 string >\0 (identified as %s) 5900 5901 5902############################################################################### 5903# BCF (Binary Call Format), version 1 5904# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 5905# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5906############################################################################### 59070 string BCF\4 5908# length of seqnm data in bytes is positive 5909>&0x00 lelong >0 5910# length of smpl data in bytes is positive 5911>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 5912# length of meta in bytes 5913>>>&(&-0x04) lelong >0 5914# have meta text string 5915>>>>&0x00 search ##samtoolsVersion= 5916>>>>>&0x00 string x \b, generated by SAMtools version %s 5917 5918 5919############################################################################### 5920# BCF (Binary Call Format), version 2.1 5921# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5922# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5923############################################################################### 59240 string BCF\2\1 Binary Call Format (BCF) version 2.1 5925# length of header text 5926>&0x00 lelong >0 5927# have header string 5928>>&0x00 search ##samtoolsVersion= 5929>>>&0x00 string x \b, generated by SAMtools version %s 5930 5931 5932############################################################################### 5933# BCF (Binary Call Format), version 2.2 5934# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5935# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5936############################################################################### 59370 string BCF\2\2 Binary Call Format (BCF) version 2.2 5938# length of header text 5939>&0x00 lelong >0 5940# have header string 5941>>&0x00 search ##samtoolsVersion= 5942>>>&0x00 string x \b, generated by SAMtools version %s 5943 5944############################################################################### 5945# VCF (Variant Call Format) 5946# used by VCFtools (http://vcftools.sourceforge.net/) 5947############################################################################### 59480 search ##fileformat=VCFv Variant Call Format (VCF) 5949>&0 string x \b version %s 5950 5951############################################################################### 5952# FASTQ 5953# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 5954############################################################################### 5955# XXX Broken? 5956# @<seqname> 5957#0 regex =^@[A-Za-z0-9_.:-]+\?\n 5958# <seq> 5959#>&1 regex =^[A-Za-z\n.~]++ 5960# +[<seqname>] 5961#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 5962# <qual> 5963#>>>&1 regex =^[!-~\n]+\n FASTQ 5964 5965############################################################################### 5966# FASTA 5967# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 5968############################################################################### 5969#0 byte 0x3e 5970# q>0 regex =^[>][!-~\t\ ]+$ 5971# Amino Acid codes: [A-IK-Z*-]+ 5972#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 5973# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 5974# not in IUPAC codes/gaps: [EFIJLOPQZ] 5975#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 5976#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 5977 5978############################################################################### 5979# SAM (Sequence Alignment/Map format) 5980# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5981############################################################################### 5982# Short-cut version to recognise SAM files with (optional) header at beginning 5983############################################################################### 59840 string @HD\t 5985>4 search VN: Sequence Alignment/Map (SAM), with header 5986>>&0 regex [0-9.]+ \b version %s 5987############################################################################### 5988# Longer version to recognise SAM alignment lines using (many) regexes 5989############################################################################### 5990# SAM Alignment QNAME 59910 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 5992# SAM Alignment FLAG 5993>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 5994# SAM Alignment RNAME 5995>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 5996# SAM Alignment POS 5997>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 5998# SAM Alignment MAPQ 5999>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 6000# SAM Alignment CIGAR 6001>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 6002# SAM Alignment RNEXT 6003>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 6004# SAM Alignment PNEXT 6005>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 6006# SAM Alignment TLEN 6007>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 6008# SAM Alignment SEQ 6009>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 6010# SAM Alignment QUAL 6011>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 6012>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 6013>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 6014 6015############################################################################## 6016# 6017# Magic ids for biomedical signal file formats 6018# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com> 6019# 6020# The list has been derived from biosig projects 6021# http://biosig.sourceforge.net 6022# https://pub.ist.ac.at/~schloegl/matlab/eeg/ 6023# https://pub.ist.ac.at/~schloegl/biosig/TESTED 6024# 6025############################################################################## 6026# 60270 string ABF\x20 Biosig/Axon Binary format 6028!:mime biosig/abf2 60290 string ABF2\0\0 Biosig/Axon Binary format 6030!:mime biosig/abf2 6031# 60320 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows 6033!:mime biosig/ates 6034# 60350 string ATF\x09 Biosig/Axon Text format 6036!:mime biosig/atf 6037# 60380 string ADU1 Biosig/Axona file format 6039!:mime biosig/axona 60400 string ADU2 Biosig/Axona file format 6041!:mime biosig/axona 6042# 60430 string ALPHA-TRACE-MEDICAL Biosig/alpha trace 6044!:mime biosig/alpha 6045# 60460 string AxGr Biosig/AXG 60470 string axgx Biosig/AXG 6048!:mime biosig/axg 6049# 60500 string HeaderLen= Biosig/BCI2000 60510 string BCI2000V Biosig/BCI2000 6052!:mime biosig/bci2000 6053# 6054### Specification: https://www.biosemi.com/faq/file_format.htm 60550 string \xffBIOSEMI Biosig/Biosemi data format 6056!:mime biosig/bdf 6057# 60580 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file 60590 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file 60600 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file 6061!:mime biosig/brainvision 6062# 60630 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format 6064!:mime biosig/ced 6065# 6066### Specification: https://www.edfplus.info/specs/index.html 60670 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format 6068!:mime biosig/edf 6069# 6070### Specifications: https://arxiv.org/abs/cs/0608052 60710 string GDF Biosig/GDF: General data format for biosignals 6072!:mime biosig/gdf 6073# 60740 string DATA\0\0\0\0 Biosig/Heka Patchmaster 60750 string DAT1\0\0\0\0 Biosig/Heka Patchmaster 60760 string DAT2\0\0\0\0 Biosig/Heka Patchmaster 6077!:mime biosig/heka 6078# 60790 string (C)\x20CED\x2087 Biosig/CED SMR 6080!:mime biosig/ced-smr 6081# 60820 string CFWB\1\0\0\0 Biosig/CFWB 6083!:mime biosig/cfwb 6084# 60850 string DEMG Biosig/DEMG 6086!:mime biosig/demg 6087# 60880 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS 6089!:mime biosig/ebs 6090# 60910 string Embla\x20data\x20file Biosig/Embla 6092!:mime biosig/embla 6093# 60940 string Header\r\nFile Version Biosig/ETG4000 6095!:mime biosig/etg4000 6096# 60970 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo 6098!:mime biosig/galileo 6099# 61000 string IGOR Biosig/IgorPro ITX file 6101!:mime biosig/igorpro 6102# 6103# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf 61040 string ISHNE1.0 Biosig/ISHNE 6105!:mime biosig/ishne 6106# 6107# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm 61080 string @\x20\x20MFER\x20 Biosig/MFER 61090 string @\x20MFR\x20 Biosig/MFER 6110!:mime biosig/mfer 6111# 61120 string NEURALEV Biosig/NEV 61130 string N.EV.\0 Biosig/NEV 6114!:mime biosig/nev 6115# 61160 string NEX1 Biosig/NEX 6117!:mime biosig/nex1 6118# 61190 string PLEX Biosig/Plexon v1.0 612010 string PLEXON Biosig/Plexon v2.0 6121!:mime biosig/plexon 6122# 61230 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format 6124# 6125# Specification: CEN 1064:2005/ISO 11073:91064 612616 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 6127!:mime biosig/scpecg 6128# 61290 string IAvSFo Biosig/SIGIF 6130!:mime biosig/sigif 6131# 61320 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 6133!:mime biosig/tms32 6134# 61350 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG 6136!:mime biosig/tmsilog 6137# 61384 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 6139>63 string CRawDataElement 6140>>85 string CRawDataBuffer Biosig/SYNERGY 6141!:mime biosig/synergy 6142# 61434 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO 6144!:mime biosig/unipro 6145# 61460 string VER=9\r\nCTIME= Biosig/WCP 6147!:mime biosig/wcp 6148# 61490 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek 61500 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek 61510 string \x55\x55\xFE\xAF Biosig/Walter Graphtek 6152!:mime biosig/walter-graphtek 6153# 61540 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 6155>32 string [PatInfo] Biosig/Sigma 6156!:mime biosig/sigma 6157# 61580 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) 6159!:mime biosig/fef 61600 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) 6161!:mime biosig/fef 6162# 61630 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 6164>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 6165>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF 6166!:mime biosig/fiff 6167# 6168 6169#------------------------------------------------------------------------------ 6170# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 6171# blackberry: file(1) magic for BlackBerry file formats 6172# 61735 belong 0 6174>8 belong 010010010 BlackBerry RIM ETP file 6175>>22 string x \b for %s 6176# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 6177# https://ftg.lbl.gov/checkpoint 61780 string C\0\0\0R\0\0\0 BLCR 6179>16 lelong 1 x86 6180>16 lelong 3 alpha 6181>16 lelong 5 x86-64 6182>16 lelong 7 ARM 6183>8 lelong x context data (little endian, version %d) 6184# Uncomment the following only of your "file" program supports "search" 6185#>0 search/1024 VMA\06 for kernel 6186#>>&1 byte x %d. 6187#>>&2 byte x %d. 6188#>>&3 byte x %d 61890 string \0\0\0C\0\0\0R BLCR 6190>16 belong 2 SPARC 6191>16 belong 4 ppc 6192>16 belong 6 ppc64 6193>16 belong 7 ARMEB 6194>16 belong 8 SPARC64 6195>8 belong x context data (big endian, version %d) 6196# Uncomment the following only of your "file" program supports "search" 6197#>0 search/1024 VMA\06 for kernel 6198#>>&1 byte x %d. 6199#>>&2 byte x \b%d. 6200#>>&3 byte x \b%d 6201 6202#------------------------------------------------------------------------------ 6203# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ 6204# blender: file(1) magic for Blender 3D related files 6205# 6206# Native format rule v1.2. For questions use the developers list 6207# https://lists.blender.org/mailman/listinfo/bf-committers 6208# GLOB chunk was moved near start and provides subversion info since 2.42 6209 62100 string =BLENDER Blender3D, 6211>7 string =_ saved as 32-bits 6212>>8 string =v little endian 6213>>>9 byte x with version %c. 6214>>>10 byte x \b%c 6215>>>11 byte x \b%c 6216>>>0x40 string =GLOB \b. 6217>>>>0x58 leshort x \b%.4d 6218>>8 string =V big endian 6219>>>9 byte x with version %c. 6220>>>10 byte x \b%c 6221>>>11 byte x \b%c 6222>>>0x40 string =GLOB \b. 6223>>>>0x58 beshort x \b%.4d 6224>7 string =- saved as 64-bits 6225>>8 string =v little endian 6226>>9 byte x with version %c. 6227>>10 byte x \b%c 6228>>11 byte x \b%c 6229>>0x44 string =GLOB \b. 6230>>>0x60 leshort x \b%.4d 6231>>8 string =V big endian 6232>>>9 byte x with version %c. 6233>>>10 byte x \b%c 6234>>>11 byte x \b%c 6235>>>0x44 string =GLOB \b. 6236>>>>0x60 beshort x \b%.4d 6237 6238# Scripts that run in the embedded Python interpreter 62390 string #!BPY Blender3D BPython script 6240 6241#------------------------------------------------------------------------------ 6242# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 6243# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 6244# 6245# Note that this 0407 conflicts with several other a.out formats... 6246# 6247# XXX - should this be redone with "be" and "le", so that it works on 6248# little-endian machines as well? If so, what's the deal with 6249# "VAX-order" and "VAX-order2"? 6250# 6251#0 long 0407 68K Blit (standalone) executable 6252#0 short 0407 VAX-order2 68K Blit (standalone) executable 62530 short 03401 VAX-order 68K Blit (standalone) executable 62540 long 0406 68k Blit mpx/mux executable 62550 short 0406 VAX-order2 68k Blit mpx/mux executable 62560 short 03001 VAX-order 68k Blit mpx/mux executable 6257# Need more values for WE32 DMD executables. 6258# Note that 0520 is the same as COFF 6259#0 short 0520 tty630 layers executable 6260 6261#------------------------------------------------------------------------------ 6262# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $ 6263# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm 6264 62650 string bm\001\244 Birtual Machine 6266>4 leshort x \b, version %d 6267>6 lelong x \b, program size %u 6268>14 lelong x \b, memory size %u 6269>22 lelong x \b, memory capacity %u 6270 6271#------------------------------------------------------------------------------ 6272# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 6273# i80960 b.out objects and archives 6274# 62750 long 0x10d i960 b.out relocatable object 6276>16 long >0 not stripped 6277# 6278# b.out archive (hp-rt on i960) 62790 string =!<bout> b.out archive 6280>8 string __.SYMDEF random library 6281 6282#------------------------------------------------------------------------------ 6283# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 6284# bsdi: file(1) magic for BSD/OS (from BSDI) objects 6285# Some object/executable formats use the same magic numbers as are used 6286# in other OSes; those are handled by entries in aout. 6287# 6288 62890 lelong 0314 386 compact demand paged pure executable 6290>16 lelong >0 not stripped 6291>32 byte 0x6a (uses shared libs) 6292 6293# same as in SunOS 4.x, except for static shared libraries 62940 belong&077777777 0600413 SPARC demand paged 6295>0 byte &0x80 6296>>20 belong <4096 shared library 6297>>20 belong =4096 dynamically linked executable 6298>>20 belong >4096 dynamically linked executable 6299>0 byte ^0x80 executable 6300>16 belong >0 not stripped 6301>36 belong 0xb4100001 (uses shared libs) 6302 63030 belong&077777777 0600410 SPARC pure 6304>0 byte &0x80 dynamically linked executable 6305>0 byte ^0x80 executable 6306>16 belong >0 not stripped 6307>36 belong 0xb4100001 (uses shared libs) 6308 63090 belong&077777777 0600407 SPARC 6310>0 byte &0x80 dynamically linked executable 6311>0 byte ^0x80 executable 6312>16 belong >0 not stripped 6313>36 belong 0xb4100001 (uses shared libs) 6314# Chiasmus is an encryption standard developed by the German Federal 6315# Office for Information Security (Bundesamt fuer Sicherheit in der 6316# Informationstechnik). 6317 6318# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html 63190 string XIA1\r Chiasmus Encrypted data 6320!:ext xia 6321 63220 string XIS Chiasmus key 6323!:ext xis 6324 6325#------------------------------------------------------------------------------ 6326# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 6327# BTSnoop: file(1) magic for BTSnoop files 6328# 6329# From <marcel@holtmann.org> 63300 string btsnoop\0 BTSnoop 6331>8 belong x version %d, 6332>12 belong 1001 Unencapsulated HCI 6333>12 belong 1002 HCI UART (H4) 6334>12 belong 1003 HCI BCSP 6335>12 belong 1004 HCI Serial (H5) 6336>>12 belong x type %d 6337 6338#------------------------------------------------------------------------------ 6339# $File: c64,v 1.8 2020/12/20 16:17:43 christos Exp $ 6340# c64: file(1) magic for various commodore 64 related files 6341# 6342# From: Dirk Jagdmann <doj@cubic.org> 6343 63440x16500 belong 0x12014100 D64 Image 63450x16500 belong 0x12014180 D71 Image 63460x61800 belong 0x28034400 D81 Image 63470 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 63480 belong 0x43154164 X64 Image 6349 63500 string GCR-1541 GCR Image 6351>8 byte x version: %i 6352>9 byte x tracks: %i 6353 63549 string PSUR ARC archive (c64) 63552 string -LH1- LHA archive (c64) 6356 63570 string C64File PC64 Emulator file 6358>8 string >\0 "%s" 63590 string C64Image PC64 Freezer Image 6360 63610 beshort 0x38CD C64 PCLink Image 63620 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 6363 63640 belong 0xFF424CFF WRAptor packer (c64) 6365 63660 string C64S\x20tape\x20file T64 tape Image 6367>32 leshort x Version:0x%x 6368>36 leshort !0 Entries:%i 6369>40 string x Name:%.24s 6370 63710 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6372>32 leshort x Version:0x%x 6373>36 leshort !0 Entries:%i 6374>40 string x Name:%.24s 6375 63760 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6377>32 leshort x Version:0x%x 6378>36 leshort !0 Entries:%i 6379>40 string x Name:%.24s 6380 6381# Raw tape file format (.tap files) 6382# Esa Hyyti <esa@netlab.tkk.fi> 63830 string C64-TAPE-RAW C64 Raw Tape File (.tap), 6384>0x0c byte x Version:%u, 6385>0x10 lelong x Length:%u cycles 6386 6387# magic for Goattracker2, http://covertbitops.c64.org/ 6388# from Alex Myczko <alex@aiei.ch> 63890 string GTS5 GoatTracker 2 song 6390>4 string >\0 \b, "%s" 6391>36 string >\0 \b by %s 6392>68 string >\0 \b (C) %s 6393>100 byte >0 \b, %u subsong(s) 6394 6395# CBM BASIC (cc65 compiled) 63960 leshort 0x0801 6397>2 leshort 0x080b 6398>6 string \x9e CBM BASIC 6399>7 string >\0 \b, SYS %s 6400 6401#------------------------------------------------------------------------------ 6402# $File: cad,v 1.25 2021/02/23 00:51:10 christos Exp $ 6403# autocad: file(1) magic for cad files 6404# 6405 6406# Microstation DGN/CIT Files (www.bentley.com) 6407# Last updated July 29, 2005 by Lester Hightower 6408# DGN is the default file extension of Microstation/Intergraph CAD files. 6409# CIT is the proprietary raster format (similar to TIFF) used to attach 6410# raster underlays to Microstation DGN (vector) drawings. 6411# 6412# http://www.wotsit.org/search.asp 6413# https://filext.com/detaillist.php?extdetail=DGN 6414# https://filext.com/detaillist.php?extdetail=CIT 6415# 6416# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 6417# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 6418# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 6419# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 6420# 6421# URL: https://en.wikipedia.org/wiki/MicroStation 6422# reference: http://dgnlib.maptools.org/dgn.html 6423# http://dgnlib.maptools.org/dl/ref18.pdf 6424# Update: Joerg Jenderek 6425# Note: verfied by command like `dgndump seed2d_b.dgn` 6426# test for level 8 and type 5 or 9 64270 beshort&0x3F73 0x0801 6428# level of element like 8 6429#>0 ubyte&0x3F x \b, level %u 6430#>0 ubyte &0x80 \b, complex 6431#>0 ubyte &0x40 \b, reserved 6432# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements 6433#>1 ubyte&0x7F x \b, type %u 6434# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT 6435#>2 uleshort x \b, words 0x%4.4x to follow 6436# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) 6437#>508 ubelong x \b, RESERVED %8.8x 6438>508 ubelong&0xFFffFF00 =0 6439# test for level 8 and type 9 for INGR raster image 6440>>0 beshort 0x0809 6441# test for length of 1st element is multiple of blocks a 512 bytes 6442>>>2 ubyte 0xfe 6443>>>>0 use ingr-image 6444# test for DGN or CEL by jump words (uleshort) forward to next element 6445>(2.s*2) ulong x 6446# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT 6447#>>&1 ubyte&0x7F x \b, 2nd type %u 6448# DGN 6449>>&1 ubyte&0x7F 8 6450>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing 6451!:mime application/x-bentley-dgn 6452!:ext dgn 6453# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 6454>>>>1214 ubyte &0x40 3D 6455>>>>1214 ubyte ^0x40 2D 6456# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 6457>>>>1120 string x \b, units %-.2s 6458# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 6459>>>>1122 string >\0 %-.2s 6460#>>>>1120 ubelong x \b, units 0x%8.8x 6461# element range low,high x y z like xlow=0 08010000h 01080000h 6462#>>>>4 ubelong !0 \b, xlow %8.8x 6463#>>>>8 ubelong !0 \b, ylow %8.8x 6464#>>>>12 ubelong !0 \b, zlow %8.8x 6465#>>>>16 ubelong !0 \b, xhigh %8.8x 6466#>>>>20 ubelong !0 \b, yhigh %8.8x 6467#>>>>24 ubelong !0 \b, zhigh %8.8x 6468# graphic group number; all other elements in that group have same non-0 number 6469#>>>>28 leshort x \b, grphgrp 0x%4.4x 6470# words to optional attribute linkage 6471#>>>>30 ubyte x \b, attindx \%o 6472#>>>>31 ubyte x \b\%o 6473# >>30 string \026\105 DGNFile 6474# >>30 string \034\105 DGNFile 6475# >>30 string \073\107 DGNFile 6476# >>30 string \073\110 DGNFile 6477# >>30 string \106\107 DGNFile 6478# >>30 string \110\103 DGNFile 6479# >>30 string \120\104 DGNFile 6480# >>30 string \172\104 DGNFile 6481# >>30 string \172\105 DGNFile 6482# >>30 string \172\106 DGNFile 6483# >>30 string \234\106 DGNFile 6484# >>30 string \273\105 DGNFile 6485# >>30 string \306\106 DGNFile 6486# >>30 string \310\104 DGNFile 6487# >>30 string \341\104 DGNFile 6488# >>30 string \372\103 DGNFile 6489# >>30 string \372\104 DGNFile 6490# >>30 string \372\106 DGNFile 6491# >>30 string \376\103 DGNFile 6492# elements properties indicator 6493#>>>>32 uleshort !0 \b, properties 0x%4.4x 6494# class 0~Primary 6495#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x 6496# Symbology 6497#>>>>>34 uleshort x \b, Symbology 0x%4.4x 6498# test for 2nd element type 1~library cell header 6499>>&1 ubyte&0x7F 1 6500# test for 1st element with level 8 and type 5 for cell library 6501>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library 6502!:mime application/x-bentley-cel 6503!:ext cel 6504# 6505# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster 6506# reference: https://web.archive.org/web/20140903185431/ 6507# http://oreilly.com/www/centers/gff/formats/ingr/index.htm 6508# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` 6509# display information for intergraph raster bitmap 65100 name ingr-image 6511# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" 6512# DataTypeCode indicates format, depth of the pixel data and used compression 6513>4 uleshort x Intergraph raster image 6514>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit 6515!:mime image/x-intergraph-rle 6516!:ext rel 6517>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit 6518!:mime image/x-intergraph-cit 6519!:ext cit 6520>>4 uleshort 27 \b, Adaptive RLE RGB 6521!:mime image/x-intergraph-rgb 6522!:ext rgb 6523>>4 default x 6524>>>4 uleshort x \b, Type %u 6525!:mime image/x-intergraph 6526# TODO: 6527#>4 uleshort 0 \b, no data 6528# ... 6529#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) 6530# ApplicationType: 0~generic raster image 3~drawing, scanning 6531# 8~I/IMAGE and MicroStation Imager 9~ModelView 6532>6 uleshort !0 \b, ApplicationType %u 6533#>6 uleshort x \b, ApplicationType %u 6534# XViewOrigin; Raster grid data X origin 6535#>8 ulequad !0 \b, XViewOrigin %llx 6536# PixelsPerLine is the number of pixels in a scan line of bitmapp 6537>184 ulelong x \b, %u x 6538# NumberOfLines is height of the raster data in scanlines 6539>188 ulelong x %u 6540# DeviceResolution; resolution of scanning device 6541# positive indicates number of micros between lines; negative indicates DPI 6542#>192 leshort x \b, DeviceResolution %d 6543# ScanlineOrient indicates the origin and the orientation of the scan lines 6544#>194 ubyte x \b, ScanlineOrient %x 6545>194 ubyte x \b, orientation 6546>194 ubyte &0x01 right 6547>194 ubyte ^0x01 left 6548>194 ubyte &0x02 down 6549>194 ubyte ^0x02 top 6550>194 ubyte &0x04 horizontal 6551>194 ubyte ^0x04 vertical 6552# ScannableFlag; Scanline indexing method used 6553#>195 ubyte !0 \b, ScannableFlag 0x%x 6554# RotationAngle; Rotation angle of raster data 6555#>196 ubequad !0 \b, RotationAngle 0x%llx 6556# SkewAngle; Skew angle of raster data 6557#>204 ubequad !0 \b, SkewAngle %llx 6558# DataTypeModifier; Additional raster data format info 6559#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x 6560# DesignFile[66]; Name of the design file 6561>214 string >\0 \b, DesignFile %-.66s 6562# DatabaseFile[66]; Name of the database file 6563>280 string >\0 \b, DatabaseFile %-.66s 6564# ParentGridFile[66]; Name of parent grid file 6565>346 string >\0 \b, ParentGridFile %-.66s 6566# FileDescription[80]; Text description of file and contents 6567>412 string >\0 \b, FileDescription %-.80s 6568# MinValue 6569#>492 ubequad !0 \b, MinValue 0x%llx 6570# MaxValue 6571#>500 ubequad !0 \b, MaxValue 0x%llx 6572# Reserved[3]; Unused (always 0) 6573#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x 6574# GridFileVersion; Grid File Version like 2 3 6575#>511 ubyte x \b, GridFileVersion %x 6576 6577# AutoCAD 6578# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg 6579# and https://www.iana.org/assignments/media-types/image/vnd.dwg 65800 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 6581!:mime image/vnd.dwg 65820 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 6583!:mime image/vnd.dwg 65840 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 6585!:mime image/vnd.dwg 65860 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 6587!:mime image/vnd.dwg 65880 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 6589!:mime image/vnd.dwg 65900 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 6591!:mime image/vnd.dwg 65920 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 6593!:mime image/vnd.dwg 65940 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 6595!:mime image/vnd.dwg 65960 string AC1001 DWG AutoDesk AutoCAD Release 2.22 6597!:mime image/vnd.dwg 65980 string AC1002 DWG AutoDesk AutoCAD Release 2.50 6599!:mime image/vnd.dwg 66000 string AC1003 DWG AutoDesk AutoCAD Release 2.60 6601!:mime image/vnd.dwg 66020 string AC1004 DWG AutoDesk AutoCAD Release 9 6603!:mime image/vnd.dwg 66040 string AC1006 DWG AutoDesk AutoCAD Release 10 6605!:mime image/vnd.dwg 66060 string AC1009 DWG AutoDesk AutoCAD Release 11/12 6607!:mime image/vnd.dwg 6608# AutoCAD DWG versions R13/R14 (www.autodesk.com) 6609# Written December 01, 2003 by Lester Hightower 6610# Based on the DWG File Format Specifications at http://www.opendwg.org/ 6611# AutoCad, from Nahuel Greco 6612# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 66130 string AC1012 DWG AutoDesk AutoCAD Release 13 6614!:mime image/vnd.dwg 66150 string AC1013 DWG AutoDesk AutoCAD Release 13c3 6616!:mime image/vnd.dwg 66170 string AC1014 DWG AutoDesk AutoCAD Release 14 6618!:mime image/vnd.dwg 66190 string AC1015 DWG AutoDesk AutoCAD 2000 6620!:mime image/vnd.dwg 6621 6622# A new version of AutoCAD DWG 6623# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6624# ICQ 358572321) 6625# From various sources like: 6626# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 66270 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 6628!:mime image/vnd.dwg 66290 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 6630!:mime image/vnd.dwg 66310 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 6632!:mime image/vnd.dwg 66330 string AC1027 DWG AutoDesk AutoCAD 2013-2017 6634!:mime image/vnd.dwg 6635 6636# From GNU LibreDWG 66370 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020 6638!:mime image/vnd.dwg 66390 string AC1035 DWG AutoDesk AutoCAD 2021 6640!:mime image/vnd.dwg 6641 6642# KOMPAS 2D drawing from ASCON 6643# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 6644# gathered nor specification 6645# ASCON https://ascon.net/main/ in English, 6646# https://ascon.ru/ main site in Russian 6647# Extension is CDW for drawing and FRW for fragment of drawing 6648# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6649# ICQ 358572321, https://vkontakte.ru/id16076543) 6650# From: 6651# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 6652# (in russian) and my experiments 66530 string KF 6654>2 belong 0x4E00000C Kompas drawing 12.0 SP1 6655>2 belong 0x4D00000C Kompas drawing 12.0 6656>2 belong 0x3200000B Kompas drawing 11.0 SP1 6657>2 belong 0x3100000B Kompas drawing 11.0 6658>2 belong 0x2310000A Kompas drawing 10.0 SP1 6659>2 belong 0x2110000A Kompas drawing 10.0 6660>2 belong 0x08000009 Kompas drawing 9.0 SP1 6661>2 belong 0x05000009 Kompas drawing 9.0 6662>2 belong 0x33010008 Kompas drawing 8+ 6663>2 belong 0x1A000008 Kompas drawing 8.0 6664>2 belong 0x2C010107 Kompas drawing 7+ 6665>2 belong 0x05000007 Kompas drawing 7.0 6666>2 belong 0x32000006 Kompas drawing 6+ 6667>2 belong 0x09000006 Kompas drawing 6.0 6668>2 belong 0x5C009005 Kompas drawing 5.11R03 6669>2 belong 0x54009005 Kompas drawing 5.11R02 6670>2 belong 0x51009005 Kompas drawing 5.11R01 6671>2 belong 0x22009005 Kompas drawing 5.10R03 6672>2 belong 0x22009005 Kompas drawing 5.10R02 mar 6673>2 belong 0x21009005 Kompas drawing 5.10R02 febr 6674>2 belong 0x19009005 Kompas drawing 5.10R01 6675>2 belong 0xF4008005 Kompas drawing 5.9R01.003 6676>2 belong 0x1C008005 Kompas drawing 5.9R01.002 6677>2 belong 0x11008005 Kompas drawing 5.8R01.003 6678 6679# CAD: file(1) magic for computer aided design files 6680# Phillip Griffith <phillip dot griffith at gmail dot com> 6681# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 6682# 6683 6684# 3DS (3d Studio files) 66850 leshort 0x4d4d 6686>6 leshort 0x2 6687>>8 lelong 0xa 6688>>>16 leshort 0x3d3d 3D Studio model 6689!:mime image/x-3ds 6690!:ext 3ds 6691 6692# MegaCAD 2D/3D drawing (.prt) 6693# https://megacad.de/ 6694# From: Markus Heidelberg <markus.heidelberg@web.de> 66950 string MegaCad23\0 MegaCAD 2D/3D drawing 6696 6697# Hoops CAD files 6698# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 6699# HSF_architecture.html 6700# Stephane Charette <stephane.charette@gmail.com> 67010 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 6702>7 regex/9 V[.0-9]{4,5}\020 %s 6703!:ext hsf 6704 6705# AutoCAD Drawing Exchange Format 67060 regex \^[\ \t]*0\r?\000$ 6707>1 regex \^[\ \t]*SECTION\r?$ 6708>>2 regex \^[\ \t]*2\r?$ 6709>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format 6710!:mime application/x-dxf 6711!:ext dxf 6712>>>>&1 search/8192 AC1006 \b, R10 6713>>>>&1 search/8192 AC1009 \b, R11/R12 6714>>>>&1 search/8192 AC1012 \b, R13 6715>>>>&1 search/8192 AC1013 \b, R13c3 6716>>>>&1 search/8192 AC1014 \b, R14 6717>>>>&1 search/8192 AC1015 \b, version 2000 6718>>>>&1 search/8192 AC1018 \b, version 2004 6719>>>>&1 search/8192 AC1021 \b, version 2007 6720>>>>&1 search/8192 AC1024 \b, version 2010 6721>>>>&1 search/8192 AC1027 \b, version 2013 6722>>>>&1 search/8192 AC1032 \b, version 2018 6723>>>>&1 search/8192 AC1035 \b, version 2021 6724 6725# The Sketchup 3D model format https://www.sketchup.com/ 67260 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model 6727!:mime application/vnd.sketchup.skp 6728!:ext skp 6729 67304 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s 6731!:strength +40 6732 6733#------------------------------------------------------------------------------ 6734# $File: cafebabe,v 1.26 2020/12/12 20:01:47 christos Exp $ 6735# Cafe Babes unite! 6736# 6737# Since Java bytecode and Mach-O universal binaries have the same magic number, 6738# the test must be performed in the same "magic" sequence to get both right. 6739# The long at offset 4 in a Mach-O universal binary tells the number of 6740# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 6741# version and the short at offset 6 is the JVM major version. Since there are only 6742# only 18 labeled Mach-O architectures at current, and the first released 6743# Java class format was version 43.0, we can safely choose any number 6744# between 18 and 39 to test the number of architectures against 6745# (and use as a hack). Let's not use 18, because the Mach-O people 6746# might add another one or two as time goes by... 6747# 6748### JAVA START ### 6749# Reference: http://en.wikipedia.org/wiki/Java_class_file 6750# Update: Joerg Jenderek 67510 belong 0xcafebabe 6752>4 ubelong >30 compiled Java class data, 6753!:mime application/x-java-applet 6754#!:mime application/java-byte-code 6755!:ext class 6756>>6 ubeshort x version %d. 6757>>4 ubeshort x \b%d 6758# for debugging purpose version as hexadecimal to compare with Mach-O universal binary 6759#>>4 ubelong x (0x%8.8x) 6760# Which is which? 6761# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html 6762#>>4 belong 0x002b (Java 0.?) 6763#>>4 belong 0x032d (Java 1.0) 6764#>>4 belong 0x032d (Java 1.1) 6765>>4 belong 0x002e (Java 1.2) 6766>>4 belong 0x002f (Java 1.3) 6767>>4 belong 0x0030 (Java 1.4) 6768>>4 belong 0x0031 (Java 1.5) 6769>>4 belong 0x0032 (Java 1.6) 6770>>4 belong 0x0033 (Java 1.7) 6771>>4 belong 0x0034 (Java 1.8) 6772>>4 belong 0x0035 (Java SE 9) 6773>>4 belong 0x0036 (Java SE 10) 6774>>4 belong 0x0037 (Java SE 11) 6775>>4 belong 0x0038 (Java SE 12) 6776>>4 belong 0x0039 (Java SE 13) 6777>>4 belong 0x003A (Java SE 14) 6778# pool count unequal zero 6779#>>8 beshort x \b, pool count 0x%x 6780# pool table 6781#>>10 ubequad x \b, pool 0x%16.16llx... 6782 67830 belong 0xcafed00d JAR compressed with pack200, 6784>5 byte x version %d. 6785>4 byte x \b%d 6786!:mime application/x-java-pack200 6787 6788 67890 belong 0xcafed00d JAR compressed with pack200, 6790>5 byte x version %d. 6791>4 byte x \b%d 6792!:mime application/x-java-pack200 6793 6794### JAVA END ### 6795### MACH-O START ### 6796# URL: https://en.wikipedia.org/wiki/Mach-O 6797 67980 name mach-o \b [ 6799# for debugging purpose CPU type as hexadecimal 6800#>0 ubequad x CPU=%16.16llx 6801# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 6802>0 use mach-o-cpu \b 6803# for debugging purpose print offset to 1st mach_header like: 6804# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h 6805#>8 ubelong x at 0x%x offset 6806>(8.L) indirect x \b: 6807>0 belong x \b] 6808 6809# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 6810# include/mach-o/fat.h 6811# include/mach/machine.h 68120 belong 0xcafebabe 6813>4 belong 1 Mach-O universal binary with 1 architecture: 6814!:mime application/x-mach-binary 6815>>8 use mach-o \b 6816# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020 6817>4 ubelong >1 6818>>4 ubelong <20 Mach-O universal binary with %d architectures: 6819!:mime application/x-mach-binary 6820>>>8 use mach-o \b 6821>>>4 ubelong >1 6822>>>>28 use mach-o \b 6823>>>4 ubelong >2 6824>>>>48 use mach-o \b 6825>>>4 ubelong >3 6826>>>>68 use mach-o \b 6827>>>4 ubelong >4 6828>>>>88 use mach-o \b 6829>>>4 ubelong >5 6830>>>>108 use mach-o \b 6831 6832### MACH-O END ### 6833 6834#------------------------------------------------------------------------------ 6835# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 6836# cbor: file(1) magic for CBOR files as defined in RFC 7049 6837 68380 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 6839!:mime application/cbor 6840>3 ubyte <0x20 (positive integer) 6841>3 ubyte <0x40 6842>>3 ubyte >0x1f (negative integer) 6843>3 ubyte <0x60 6844>>3 ubyte >0x3f (byte string) 6845>3 ubyte <0x80 6846>>3 ubyte >0x5f (text string) 6847>3 ubyte <0xa0 6848>3 ubyte >0x7f (array) 6849>3 ubyte <0xc0 6850>>3 ubyte >0x9f (map) 6851>3 ubyte <0xe0 6852>>3 ubyte >0xbf (tagged) 6853>3 ubyte >0xdf (other) 6854 6855#------------------------------------------------------------------------------ 6856# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 6857# CDDB: file(1) magic for CDDB(tm) format CD text data files 6858# 6859# From <steve@gracenote.com> 6860# 6861# This is the /etc/magic entry to decode datafiles as used by 6862# CDDB-enabled CD player applications. 6863# 6864 68650 search/1/w #\040xmcd CDDB(tm) format CD text data 6866 6867#------------------------------------------------------------------------------ 6868# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 6869# chord: file(1) magic for Chord music sheet typesetting utility input files 6870# 6871# From Philippe De Muyter <phdm@macqel.be> 6872# File format is actually free, but many distributed files begin with `{title' 6873# 68740 string {title Chord text file 6875 6876# Type: PowerTab file format 6877# URL: http://www.power-tab.net/ 6878# From: Jelmer Vernooij <jelmer@samba.org> 68790 string ptab\003\000 Power-Tab v3 Tablature File 68800 string ptab\004\000 Power-Tab v4 Tablature File 6881 6882#------------------------------------------------------------------------------ 6883# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 6884# cisco: file(1) magic for cisco Systems routers 6885# 6886# Most cisco file-formats are covered by the generic elf code 6887# 6888# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 68890 belong&0xffffff00 0x85011400 cisco IOS microcode 6890>7 string >\0 for '%s' 68910 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 6892>7 string >\0 for '%s' 6893 6894#------------------------------------------------------------------------------ 6895# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $ 6896# citrus locale declaration 6897# 6898 68990 string RuneCT Citrus locale declaration for LC_CTYPE 69000 string CtrsME Citrus locale declaration for LC_MESSAGES 69010 string CtrsMO Citrus locale declaration for LC_MONETARY 69020 string CtrsNU Citrus locale declaration for LC_NUMERIC 69030 string CtrsTI Citrus locale declaration for LC_TIME 6904 6905#------------------------------------------------------------------------------ 6906# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $ 6907# c-lang: file(1) magic for C and related languages programs 6908# 6909# The strength is to beat standard HTML 6910 6911# BCPL 69120 search/8192 "libhdr" BCPL source text 6913!:mime text/x-bcpl 69140 search/8192 "LIBHDR" BCPL source text 6915!:mime text/x-bcpl 6916 6917# C 6918# Check for class if include is found, otherwise class is beaten by include because of lowered strength 69190 search/8192 #include 6920>0 regex \^#include C 6921>>0 regex \^class[[:space:]]+ 6922>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 6923>>&0 clear x source text 6924!:strength + 13 6925!:mime text/x-c 69260 search/8192 pragma 6927>0 regex \^#[[:space:]]*pragma C source text 6928!:mime text/x-c 69290 search/8192 endif 6930>0 regex \^#[[:space:]]*(if\|ifn)def 6931>>&0 regex \^#[[:space:]]*endif$ C source text 6932!:mime text/x-c 69330 search/8192 define 6934>0 regex \^#[[:space:]]*(if\|ifn)def 6935>>&0 regex \^#[[:space:]]*define C source text 6936!:mime text/x-c 69370 search/8192 char 6938>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6939!:mime text/x-c 69400 search/8192 double 6941>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6942!:mime text/x-c 69430 search/8192 extern 6944>0 regex \^[[:space:]]*extern[[:space:]]+ C source text 6945!:mime text/x-c 69460 search/8192 float 6947>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6948!:mime text/x-c 69490 search/8192 struct 6950>0 regex \^struct[[:space:]]+ C source text 6951!:mime text/x-c 69520 search/8192 union 6953>0 regex \^union[[:space:]]+ C source text 6954!:mime text/x-c 69550 search/8192 main( 6956>&0 regex \\)[[:space:]]*\\{ C source text 6957!:mime text/x-c 6958 6959# C++ 6960# The strength of these rules is increased so they beat the C rules above 69610 search/8192 namespace 6962>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 6963!:strength + 30 6964!:mime text/x-c++ 6965# using namespace [namespace] or using std::[lib] 69660 search/8192 using 6967>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 6968!:strength + 30 6969!:mime text/x-c++ 69700 search/8192 template 6971>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 6972!:strength + 30 6973!:mime text/x-c++ 69740 search/8192 virtual 6975>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 6976!:strength + 30 6977!:mime text/x-c++ 6978# But class alone is reduced to avoid beating php (Jens Schleusener) 69790 search/8192 class 6980>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 6981!:strength + 13 6982!:mime text/x-c++ 69830 search/8192 public 6984>0 regex \^[[:space:]]*public: C++ source text 6985!:strength + 30 6986!:mime text/x-c++ 69870 search/8192 private 6988>0 regex \^[[:space:]]*private: C++ source text 6989!:strength + 30 6990!:mime text/x-c++ 69910 search/8192 protected 6992>0 regex \^[[:space:]]*protected: C++ source text 6993!:strength + 30 6994!:mime text/x-c++ 6995 6996# Objective-C 69970 search/8192 #import 6998>0 regex \^#import Objective-C source text 6999!:strength + 25 7000!:mime text/x-objective-c 7001 7002# From: Mikhail Teterin <mi@aldan.algebra.com> 70030 string cscope cscope reference data 7004>7 string x version %.2s 7005# We skip the path here, because it is often long (so file will 7006# truncate it) and mostly redundant. 7007# The inverted index functionality was added some time between 7008# versions 11 and 15, so look for -q if version is above 14: 7009>7 string >14 7010>>10 search/100 \ -q\ with inverted index 7011>10 search/100 \ -c\ text (non-compressed) 7012 7013#------------------------------------------------------------------------------ 7014# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 7015# clarion: file(1) magic for # Clarion Personal/Professional Developer 7016# (v2 and above) 7017# From: Julien Blache <jb@jblache.org> 7018 7019# Database files 7020# signature 70210 leshort 0x3343 Clarion Developer (v2 and above) data file 7022# attributes 7023>2 leshort &0x0001 \b, locked 7024>2 leshort &0x0004 \b, encrypted 7025>2 leshort &0x0008 \b, memo file exists 7026>2 leshort &0x0010 \b, compressed 7027>2 leshort &0x0040 \b, read only 7028# number of records 7029>5 lelong x \b, %d records 7030 7031# Memo files 70320 leshort 0x334d Clarion Developer (v2 and above) memo data 7033 7034# Key/Index files 7035# No magic? :( 7036 7037# Help files 70380 leshort 0x49e0 Clarion Developer (v2 and above) help data 7039 7040#------------------------------------------------------------------------------ 7041# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 7042# claris: file(1) magic for claris 7043# "H. Nanosecond" <aldomel@ix.netcom.com> 7044# Claris Works a word processor, etc. 7045# Version 3.0 7046 7047# .pct claris works clip art files 7048#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 7049#* 7050#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 7051#null to byte 1000 octal 7052514 string \377\377\377\377\000 7053>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7054514 string \377\377\377\377\001 7055>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7056 7057# Claris works files 7058# .cwk 7059# Moved to Apple AppleWorks document 7060#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 7061# .plt 70620 string \020\341\000\000\010\010 Claris Works palette files .plt 7063 7064# .msp a dictionary file I am not sure about this I have only one .msp file 70650 string \002\271\262\000\040\002\000\164 Claris works dictionary 7066 7067# .usp are user dictionary bits 7068# I am not sure about a magic header: 7069#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 7070# soh S p f 8 U D sp ^ S cr nl p o d i 7071#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 7072# a t r i s t sp ^ S cr nl d i v sp # 7073 7074# .mth Thesaurus 7075# starts with \0 but no magic header 7076 7077# .chy Hyphenation file 7078# I am not sure: 000 210 034 000 000 7079 7080# other claris files 7081#./windows/claris/useng.ndx: data 7082#./windows/claris/xtndtran.l32: data 7083#./windows/claris/xtndtran.lst: data 7084#./windows/claris/clworks.lbl: data 7085#./windows/claris/clworks.prf: data 7086#./windows/claris/userd.spl: data 7087 7088#------------------------------------------------------------------------------ 7089# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $ 7090# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 7091# 7092# XXX - what byte order does the Clipper use? 7093# 7094# XXX - what's the "!" stuff: 7095# 7096# >18 short !074000,000000 C1 R1 7097# >18 short !074000,004000 C2 R1 7098# >18 short !074000,010000 C3 R1 7099# >18 short !074000,074000 TEST 7100# 7101# I shall assume it's ANDing the field with the first value and 7102# comparing it with the second, and rewrite it as: 7103# 7104# >18 short&074000 000000 C1 R1 7105# >18 short&074000 004000 C2 R1 7106# >18 short&074000 010000 C3 R1 7107# >18 short&074000 074000 TEST 7108# 7109# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 7110# sort, nor does SunOS 4.x, so either it's something Intergraph added 7111# in CLIX, or something AT&T added in SVR3.2 or later, or something 7112# somebody else thought was a good idea; it's not documented in the 7113# man page for this version of "magic", nor does it appear to be 7114# implemented (at least not after I blew off the bogus code to turn 7115# old-style "&"s into new-style "&"s, which just didn't work at all). 7116# 71170 short 0575 CLIPPER COFF executable (VAX #) 7118>20 short 0407 (impure) 7119>20 short 0410 (5.2 compatible) 7120>20 short 0411 (pure) 7121>20 short 0413 (demand paged) 7122>20 short 0443 (target shared library) 7123>12 long >0 not stripped 7124>22 short >0 - version %d 71250 short 0577 CLIPPER COFF executable 7126>18 short&074000 000000 C1 R1 7127>18 short&074000 004000 C2 R1 7128>18 short&074000 010000 C3 R1 7129>18 short&074000 074000 TEST 7130>20 short 0407 (impure) 7131>20 short 0410 (pure) 7132>20 short 0411 (separate I&D) 7133>20 short 0413 (paged) 7134>20 short 0443 (target shared library) 7135>12 long >0 not stripped 7136>22 short >0 - version %d 7137>48 long&01 01 alignment trap enabled 7138>52 byte 1 -Ctnc 7139>52 byte 2 -Ctsw 7140>52 byte 3 -Ctpw 7141>52 byte 4 -Ctcb 7142>53 byte 1 -Cdnc 7143>53 byte 2 -Cdsw 7144>53 byte 3 -Cdpw 7145>53 byte 4 -Cdcb 7146>54 byte 1 -Csnc 7147>54 byte 2 -Cssw 7148>54 byte 3 -Cspw 7149>54 byte 4 -Cscb 7150#4 string pipe CLIPPER instruction trace 7151#4 string prof CLIPPER instruction profile 7152#------------------------------------------------------------------------------ 7153# file: file(1) magic for Clojure 7154# URL: https://clojure.org/ 7155# From: Jason Felice <jason.m.felice@gmail.com> 7156 71570 string/w #!\ /usr/bin/clj Clojure script text executable 7158!:mime text/x-clojure 71590 string/w #!\ /usr/local/bin/clj Clojure script text executable 7160!:mime text/x-clojure 71610 string/w #!\ /usr/bin/clojure Clojure script text executable 7162!:mime text/x-clojure 71630 string/w #!\ /usr/local/bin/clojure Clojure script text executable 7164!:mime text/x-clojure 71650 string/W #!/usr/bin/env\ clj Clojure script text executable 7166!:mime text/x-clojure 71670 string/W #!/usr/bin/env\ clojure Clojure script text executable 7168!:mime text/x-clojure 71690 string/W #!\ /usr/bin/env\ clj Clojure script text executable 7170!:mime text/x-clojure 71710 string/W #!\ /usr/bin/env\ clojure Clojure script text executable 7172!:mime text/x-clojure 7173 71740 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text 7175!:mime text/x-clojure 7176 71770 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text 7178!:mime text/x-clojure 7179 71800 regex \^\\\(defn-?[[:space:]] Clojure module source text 7181!:mime text/x-clojure 7182 7183#------------------------------------------------------------------------------ 7184# $File: coff,v 1.4 2021/02/10 00:37:02 christos Exp $ 7185# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 7186# 7187# COFF 7188# 7189# by Joerg Jenderek at Oct 2015, Feb 2021 7190# https://en.wikipedia.org/wiki/COFF 7191# https://de.wikipedia.org/wiki/Common_Object_File_Format 7192# http://www.delorie.com/djgpp/doc/coff/filhdr.html 7193 7194# display name+variables+flags of Common Object Files Format (32bit) 7195# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 7196# mips,motorola,msdos,osf1,sharc,varied.out,vax 71970 name display-coff 7198# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 7199>18 uleshort&0x8E80 0 7200# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections 7201>>2 uleshort >0 7202# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections 7203>>>2 uleshort <4207 7204>>>>0 clear x 7205# f_magic - magic number 7206# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 7207>>>>0 uleshort 0x014C Intel 80386 7208# Hitachi SH big-endian COFF (./hitachi-sh) 7209>>>>0 uleshort 0x0500 Hitachi SH big-endian 7210# Hitachi SH little-endian COFF (./hitachi-sh) 7211>>>>0 uleshort 0x0550 Hitachi SH little-endian 7212# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 7213#>>>>0 uleshort 0x01DF 7214# MS Windows COFF Intel Itanium, AMD64 7215# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 7216>>>>0 uleshort 0x0200 Intel ia64 7217>>>>0 uleshort 0x8664 Intel amd64 7218# TODO for other COFFs 7219#>>>>0 uleshort 0xABCD COFF_TEMPLATE 7220>>>>0 default x 7221>>>>>0 uleshort x type 0x%04x 7222>>>>0 uleshort x COFF 7223# F_EXEC flag bit 7224>>>>18 leshort ^0x0002 object file 7225!:mime application/x-coff 7226!:ext o/obj/lib 7227# no cof sample found 7228#!:ext cof/o/obj/lib 7229>>>>18 leshort &0x0002 executable 7230#!:mime application/x-coffexec 7231# F_RELFLG flag bit,static object 7232>>>>18 leshort &0x0001 \b, no relocation info 7233# F_LNNO flag bit 7234>>>>18 leshort &0x0004 \b, no line number info 7235# F_LSYMS flag bit 7236>>>>18 leshort &0x0008 \b, stripped 7237>>>>18 leshort ^0x0008 \b, not stripped 7238# flags in other COFF versions 7239#0x0010 F_FDPR_PROF 7240#0x0020 F_FDPR_OPTI 7241#0x0040 F_DSA 7242# F_AR32WR flag bit 7243#>>>>18 leshort &0x0100 \b, 32 bit little endian 7244#0x1000 F_DYNLOAD 7245#0x2000 F_SHROBJ 7246#0x4000 F_LOADONLY 7247# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124 7248>>>>2 uleshort <2 \b, %u section 7249>>>>2 uleshort >1 \b, %u sections 7250# f_symptr - symbol table pointer, only for not stripped 7251# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0 7252>>>>8 ulelong >0 \b, symbol offset=0x%x 7253# f_nsyms - number of symbols, only for not stripped 7254# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546 7255>>>>12 ulelong >0 \b, %d symbols 7256# f_opthdr - optional header size. An object file should have a value of 0 7257>>>>16 uleshort >0 \b, optional header size %u 7258# f_timdat - file time & date stamp only for little endian 7259>>>>4 ledate >0 \b, created %s 7260# at offset 20 can be optional header, extra bytes FILHSZ-20 because 7261# do not rely on sizeof(FILHDR) to give the correct size for header. 7262# or first section header 7263# additional variables for other COFF files 7264>>>>16 uleshort =0 7265# first section name s_name[8] like: .text .data .debug$S .drectve .testseg 7266>>>>>20 string x \b, 1st section name "%.8s" 7267# >20 beshort 0407 (impure) 7268# >20 beshort 0410 (pure) 7269# >20 beshort 0413 (demand paged) 7270# >20 beshort 0421 (standalone) 7271# >22 leshort >0 - version %d 7272# >168 string .lowmem Apple toolbox 7273 7274 7275#------------------------------------------------------------------------------ 7276# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $ 7277# commands: file(1) magic for various shells and interpreters 7278# 7279#0 string/w : shell archive or script for antique kernel text 72800 string/wt #!\ /bin/sh POSIX shell script text executable 7281!:mime text/x-shellscript 72820 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 7283!:mime text/x-shellscript 7284 72850 string/wt #!\ /bin/csh C shell script text executable 7286!:mime text/x-shellscript 7287 7288# korn shell magic, sent by George Wu, gwu@clyde.att.com 72890 string/wt #!\ /bin/ksh Korn shell script text executable 7290!:mime text/x-shellscript 72910 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 7292!:mime text/x-shellscript 7293 72940 string/wt #!\ /bin/tcsh Tenex C shell script text executable 7295!:mime text/x-shellscript 72960 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 7297!:mime text/x-shellscript 72980 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 7299!:mime text/x-shellscript 73000 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 7301!:mime text/x-shellscript 7302 7303# 7304# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 73050 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 7306!:mime text/x-shellscript 73070 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 7308!:mime text/x-shellscript 73090 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 7310!:mime text/x-shellscript 73110 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable 7312!:mime text/x-shellscript 7313 73140 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 7315!:mime text/x-shellscript 73160 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 7317!:mime text/x-shellscript 73180 string/wt #!\ /bin/nawk new awk script text executable 7319!:mime text/x-nawk 73200 string/wt #!\ /usr/bin/nawk new awk script text executable 7321!:mime text/x-nawk 73220 string/wt #!\ /usr/local/bin/nawk new awk script text executable 7323!:mime text/x-nawk 73240 string/wt #!\ /bin/gawk GNU awk script text executable 7325!:mime text/x-gawk 73260 string/wt #!\ /usr/bin/gawk GNU awk script text executable 7327!:mime text/x-gawk 73280 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 7329!:mime text/x-gawk 7330# 73310 string/wt #!\ /bin/awk awk script text executable 7332!:mime text/x-awk 73330 string/wt #!\ /usr/bin/awk awk script text executable 7334!:mime text/x-awk 73350 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 7336 7337# AT&T Bell Labs' Plan 9 shell 73380 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 7339 7340# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 73410 string/wt #!\ /bin/bash Bourne-Again shell script text executable 7342!:mime text/x-shellscript 73430 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 7344!:mime text/x-shellscript 73450 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 7346!:mime text/x-shellscript 73470 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 7348!:mime text/x-shellscript 73490 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 7350!:mime text/x-shellscript 73510 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 7352!:mime text/x-shellscript 73530 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 7354!:mime text/x-shellscript 73550 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 7356!:mime text/x-shellscript 73570 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 7358!:mime text/x-shellscript 7359 7360# Fish shell magic 7361# From: Benjamin Lowry <ben@ben.gmbh> 73620 string/wt #!\ /usr/local/bin/fish fish shell script text executable 7363!:mime text/x-shellscript 73640 string/wt #!\ /usr/bin/fish fish shell script text executable 7365!:mime text/x-shellscript 73660 string/wt #!\ /usr/bin/env\ fish fish shell script text executable 7367!:mime text/x-shellscript 7368 7369 73700 search/1/wt #!\ /usr/bin/tclsh Tcl/Tk script text executable 7371!:mime text/x-tcl 7372 73730 search/1/wt #!\ /usr/bin/texlua LuaTex script text executable 7374!:mime text/x-luatex 7375 73760 search/1/wt #!\ /usr/bin/luatex LuaTex script text executable 7377!:mime text/x-luatex 7378 73790 search/1/wt #!\ /usr/bin/stap Systemtap script text executable 7380!:mime text/x-systemtap 7381 7382 7383 7384# PHP scripts 7385# Ulf Harnhammar <ulfh@update.uu.se> 73860 search/1/c =<?php PHP script text 7387!:strength + 30 7388!:mime text/x-php 73890 search/1 =<?\n PHP script text 7390!:mime text/x-php 73910 search/1 =<?\r PHP script text 7392!:mime text/x-php 73930 search/1/w #!\ /usr/local/bin/php PHP script text executable 7394!:strength + 10 7395!:mime text/x-php 73960 search/1/w #!\ /usr/bin/php PHP script text executable 7397!:strength + 10 7398!:mime text/x-php 7399# Smarty compiled template, https://www.smarty.net/ 7400# Elan Ruusamae <glen@delfi.ee> 74010 string =<?php 7402>5 regex [\ \n] 7403>>6 string /*\ Smarty\ version Smarty compiled template 7404>>>24 regex [0-9.]+ \b, version %s 7405!:mime text/x-php 7406 74070 string Zend\x00 PHP script Zend Optimizer data 7408 74090 string/t $! DCL command file 7410 7411# Type: Pdmenu 7412# URL: https://packages.debian.org/pdmenu 7413# From: Edward Betts <edward@debian.org> 74140 string #!/usr/bin/pdmenu Pdmenu configuration file text 7415 7416# From Danny Weldon 74170 string \x0b\x13\x08\x00 7418>0x04 uleshort <4 ksh byte-code version %d 7419 7420#---------------------------------------------------------------------------- 7421# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 7422# communication 7423 7424# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 7425# It is used for conformance testing of communication protocols. 7426# Added by W. Borgert <debacle@debian.org>. 74270 string $Suite TTCN Abstract Test Suite 7428>&1 string $SuiteId 7429>>&1 string >\n %s 7430>&2 string $SuiteId 7431>>&1 string >\n %s 7432>&3 string $SuiteId 7433>>&1 string >\n %s 7434 7435# MSC (message sequence charts) are a formal description technique, 7436# described in ITU-T Z.120, mainly used for communication protocols. 7437# Added by W. Borgert <debacle@debian.org>. 74380 string mscdocument Message Sequence Chart (document) 74390 string msc Message Sequence Chart (chart) 74400 string submsc Message Sequence Chart (subchart) 7441#------------------------------------------------------------------------------ 7442# $File: compress,v 1.80 2021/03/15 17:49:24 christos Exp $ 7443# compress: file(1) magic for pure-compression formats (no archives) 7444# 7445# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 7446# 7447# Formats for various forms of compressed data 7448# Formats for "compress" proper have been moved into "compress.c", 7449# because it tries to uncompress it to figure out what's inside. 7450 7451# standard unix compress 74520 string \037\235 compress'd data 7453!:mime application/x-compress 7454!:apple LZIVZIVU 7455>2 byte&0x80 >0 block compressed 7456>2 byte&0x1f x %d bits 7457 7458# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 7459# URL: https://en.wikipedia.org/wiki/Gzip 7460# Reference: https://tools.ietf.org/html/rfc1952 7461# Update: Joerg Jenderek, Apr 2019 7462# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 7463# * Original filename is only at offset 10 if "extra field" absent 7464# * Produce shorter output - notably, only report compression methods 7465# other than 8 ("deflate", the only method defined in RFC 1952). 7466# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls 7467# TODO: 7468# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ 7469# KPR KOffice/Calligra KPresenter application/x-kpresenter 7470# KPT KOffice/Calligra KPresenter template? application/x-kpresenter 7471# SAV Diggles Saved Game File http://www.innonics.com 7472# SAV FarCry (demo) saved game http://www.farcry-thegame.com 7473# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter 74740 string \037\213 7475# to display gzip compressed (strength=100=2*50) before other (strength=50)? 7476#!:strength * 2 7477# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary 7478>3 byte&0x18 =0 7479# For binary gzipped no ASCII text should occur 7480# mcd-monu-cad.trid.xml 7481>>10 string MCD Monu-Cad Drawing, Component or Font 7482#>>36 string Created\ with\ MONU-CAD 7483#!:mime application/octet-stream 7484# http://fileformats.archiveteam.org/wiki/Monu-CAD 7485# http://www.monucad.com/downloads/FullDemo-2005.EXE 7486# /HANDS96.MCC Component 7487# /DEMO_DD01.MCD Drawing 7488# /MCALF020.FNT Font 7489!:ext mcc/mcd/fnt 7490# http://www.generalcadd.com 7491>>10 string GXD General CADD, Drawing or Component 7492#!:mime application/octet-stream 7493# /gxc/BUILDINGEDGE.gxc Component 7494# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing 7495# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 7496!:ext gxc/gxd 7497#>>>13 ubyte 0 \b, version 0 7498>>>13 string 09 \b, version 9 7499# other gzipped binary like gzipped tar, VirtualBox extension package,... 7500>>10 default x gzip compressed data 7501!:mime application/gzip 7502>>>0 use gzip-info 7503# size of the original (uncompressed) input data modulo 2^32 7504>>-0 offset >48 7505>>>-4 ulelong x \b, original size modulo 2^32 %u 7506>>-0 offset <48 \b, truncated 7507# gzipped TAR or VirtualBox extension package 7508#!:mime application/x-compressed-tar 7509#!:mime application/x-virtualbox-vbox-extpack 7510# https://www.w3.org/TR/SVG/mimereg.html 7511#!:mime image/image/svg+xml-compressed 7512# zlib.3.gz 7513# microcode-20180312.tgz 7514# tpz same as tgz 7515# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg 7516# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack 7517!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz 7518# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text 7519>3 byte&0x18 >0 gzip compressed data 7520!:mime application/gzip 7521# gzipped tar, gzipped Abiword document 7522#!:mime application/x-compressed-tar 7523#!:mime application/x-abiword-compressed 7524#!:mime image/image/svg+xml-compressed 7525# kleopatra_splashscreen.svgz gzipped .svg 7526!:ext gz/tgz/tpz/zabw/svgz 7527>>0 use gzip-info 7528# size of the original (uncompressed) input data modulo 2^32 7529>>-0 offset >48 7530>>>-4 ulelong x \b, original size modulo 2^32 %u 7531>>-0 offset <48 \b, truncated 7532# display information of gzip compressed files 75330 name gzip-info 7534#>2 byte x THIS iS GZIP 7535>2 byte <8 \b, reserved method 7536>2 byte >8 \b, unknown method 7537>3 byte &0x01 \b, ASCII 7538>3 byte &0x02 \b, has CRC 7539>3 byte &0x04 \b, extra field 7540>3 byte&0xC =0x08 7541>>10 string x \b, was "%s" 7542>3 byte &0x10 \b, has comment 7543>3 byte &0x20 \b, encrypted 7544>4 ledate >0 \b, last modified: %s 7545>8 byte 2 \b, max compression 7546>8 byte 4 \b, max speed 7547>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 7548>9 byte =0x01 \b, from Amiga 7549>9 byte =0x02 \b, from VMS 7550>9 byte =0x03 \b, from Unix 7551>9 byte =0x04 \b, from VM/CMS 7552>9 byte =0x05 \b, from Atari 7553>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 7554>9 byte =0x07 \b, from MacOS 7555>9 byte =0x08 \b, from Z-System 7556>9 byte =0x09 \b, from CP/M 7557>9 byte =0x0A \b, from TOPS/20 7558>9 byte =0x0B \b, from NTFS filesystem (NT) 7559>9 byte =0x0C \b, from QDOS 7560>9 byte =0x0D \b, from Acorn RISCOS 7561# size of the original (uncompressed) input data modulo 2^32 7562#>-4 ulelong x \b, original size modulo 2^32 %u 7563#ERROR: line 114: non zero offset 1048572 at level 1 7564 7565# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 75660 string \037\036 packed data 7567!:mime application/octet-stream 7568>2 belong >1 \b, %d characters originally 7569>2 belong =1 \b, %d character originally 7570# 7571# This magic number is byte-order-independent. 75720 short 0x1f1f old packed data 7573!:mime application/octet-stream 7574 7575# XXX - why *two* entries for "compacted data", one of which is 7576# byte-order independent, and one of which is byte-order dependent? 7577# 75780 short 0x1fff compacted data 7579!:mime application/octet-stream 7580# This string is valid for SunOS (BE) and a matching "short" is listed 7581# in the Ultrix (LE) magic file. 75820 string \377\037 compacted data 7583!:mime application/octet-stream 75840 short 0145405 huf output 7585!:mime application/octet-stream 7586 7587# bzip2 75880 string BZh bzip2 compressed data 7589!:mime application/x-bzip2 7590>3 byte >47 \b, block size = %c00k 7591 7592# bzip a block-sorting file compressor 7593# by Julian Seward <sewardj@cs.man.ac.uk> and others 75940 string BZ0 bzip compressed data 7595!:mime application/x-bzip 7596>3 byte >47 \b, block size = %c00k 7597 7598# lzip 75990 string LZIP lzip compressed data 7600!:mime application/x-lzip 7601>4 byte x \b, version: %d 7602 7603# squeeze and crunch 7604# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 76050 beshort 0x76FF squeezed data, 7606>4 string x original name %s 76070 beshort 0x76FE crunched data, 7608>2 string x original name %s 76090 beshort 0x76FD LZH compressed data, 7610>2 string x original name %s 7611 7612# Freeze 76130 string \037\237 frozen file 2.1 76140 string \037\236 frozen file 1.0 (or gzip 0.5) 7615 7616# SCO compress -H (LZH) 76170 string \037\240 SCO compress -H (LZH) data 7618 7619# European GSM 06.10 is a provisional standard for full-rate speech 7620# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 7621# excitation/long term prediction) coding at 13 kbit/s. 7622# 7623# There's only a magic nibble (4 bits); that nibble repeats every 33 7624# bytes. This isn't suited for use, but maybe we can use it someday. 7625# 7626# This will cause very short GSM files to be declared as data and 7627# mismatches to be declared as data too! 7628#0 byte&0xF0 0xd0 data 7629#>33 byte&0xF0 0xd0 7630#>66 byte&0xF0 0xd0 7631#>99 byte&0xF0 0xd0 7632#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 7633 7634# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 76350 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 7636>9 beshort <0x0940 7637>>9 byte&0xf0 =0x00 - version 0. 7638>>9 beshort&0x0fff x \b%03x, 7639>>13 byte 1 LZO1X-1, 7640>>13 byte 2 LZO1X-1(15), 7641>>13 byte 3 LZO1X-999, 7642## >>22 bedate >0 last modified: %s, 7643>>14 byte =0x00 os: MS-DOS 7644>>14 byte =0x01 os: Amiga 7645>>14 byte =0x02 os: VMS 7646>>14 byte =0x03 os: Unix 7647>>14 byte =0x05 os: Atari 7648>>14 byte =0x06 os: OS/2 7649>>14 byte =0x07 os: MacOS 7650>>14 byte =0x0A os: Tops/20 7651>>14 byte =0x0B os: WinNT 7652>>14 byte =0x0E os: Win32 7653>9 beshort >0x0939 7654>>9 byte&0xf0 =0x00 - version 0. 7655>>9 byte&0xf0 =0x10 - version 1. 7656>>9 byte&0xf0 =0x20 - version 2. 7657>>9 beshort&0x0fff x \b%03x, 7658>>15 byte 1 LZO1X-1, 7659>>15 byte 2 LZO1X-1(15), 7660>>15 byte 3 LZO1X-999, 7661## >>25 bedate >0 last modified: %s, 7662>>17 byte =0x00 os: MS-DOS 7663>>17 byte =0x01 os: Amiga 7664>>17 byte =0x02 os: VMS 7665>>17 byte =0x03 os: Unix 7666>>17 byte =0x05 os: Atari 7667>>17 byte =0x06 os: OS/2 7668>>17 byte =0x07 os: MacOS 7669>>17 byte =0x0A os: Tops/20 7670>>17 byte =0x0B os: WinNT 7671>>17 byte =0x0E os: Win32 7672 7673# 4.3BSD-Quasijarus Strong Compression 7674# https://minnie.tuhs.org/Quasijarus/compress.html 76750 string \037\241 Quasijarus strong compressed data 7676 7677# From: Cory Dikkers <cdikkers@swbell.net> 76780 string XPKF Amiga xpkf.library compressed data 76790 string PP11 Power Packer 1.1 compressed data 76800 string PP20 Power Packer 2.0 compressed data, 7681>4 belong 0x09090909 fast compression 7682>4 belong 0x090A0A0A mediocre compression 7683>4 belong 0x090A0B0B good compression 7684>4 belong 0x090A0C0C very good compression 7685>4 belong 0x090A0C0D best compression 7686 7687# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 7688# https://www.7-zip.org or DOC/7zFormat.txt 7689# 76900 string 7z\274\257\047\034 7-zip archive data, 7691>6 byte x version %d 7692>7 byte x \b.%d 7693!:mime application/x-7z-compressed 7694!:ext 7z/cb7 7695 7696# Type: LZMA 76970 lelong&0xffffff =0x5d 7698>12 leshort 0xff LZMA compressed data, 7699!:mime application/x-lzma 7700>>5 lequad =0xffffffffffffffff streamed 7701>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7702>12 leshort 0 LZMA compressed data, 7703>>5 lequad =0xffffffffffffffff streamed 7704>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7705 7706# http://tukaani.org/xz/xz-file-format.txt 77070 ustring \xFD7zXZ\x00 XZ compressed data, checksum 7708>7 byte&0xf 0x0 NONE 7709>7 byte&0xf 0x1 CRC32 7710>7 byte&0xf 0x4 CRC64 7711>7 byte&0xf 0xa SHA-256 7712 7713!:strength * 2 7714!:mime application/x-xz 7715 7716# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 77170 string LRZI LRZIP compressed data 7718>4 byte x - version %d 7719>5 byte x \b.%d 7720!:mime application/x-lrzip 7721 7722# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 77230 lelong 0x184d2204 LZ4 compressed data (v1.4+) 7724!:mime application/x-lz4 7725# Added by osm0sis@xda-developers.com 77260 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 7727!:mime application/x-lz4 77280 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 7729!:mime application/x-lz4 7730 7731# Zstandard/LZ4 skippable frames 7732# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77330 lelong&0xFFFFFFF0 0x184D2A50 7734>(4.l+8) indirect x 7735 7736# Zstandard Dictionary ID subroutine 77370 name zstd-dictionary-id 7738# Single Segment = True 7739>0 byte &0x20 \b, Dictionary ID: 7740>>0 byte&0x03 0 None 7741>>0 byte&0x03 1 7742>>>1 byte x %u 7743>>0 byte&0x03 2 7744>>>1 leshort x %u 7745>>0 byte&0x03 3 7746>>>1 lelong x %u 7747# Single Segment = False 7748>0 byte ^0x20 \b, Dictionary ID: 7749>>0 byte&0x03 0 None 7750>>0 byte&0x03 1 7751>>>2 byte x %u 7752>>0 byte&0x03 2 7753>>>2 leshort x %u 7754>>0 byte&0x03 3 7755>>>2 lelong x %u 7756 7757# Zstandard compressed data 7758# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77590 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 7760!:mime application/zstd 77610 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 7762!:mime application/zstd 77630 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 7764!:mime application/zstd 77650 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 7766!:mime application/zstd 77670 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 7768!:mime application/zstd 77690 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 7770!:mime application/zstd 7771>4 use zstd-dictionary-id 77720 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 7773!:mime application/zstd 7774>4 use zstd-dictionary-id 7775 7776# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77770 lelong 0xEC30A437 Zstandard dictionary 7778!:mime application/x-std-dictionary 7779>4 lelong x (ID %u) 7780 7781# AFX compressed files (Wolfram Kleff) 77822 string -afx- AFX compressed file data 7783 7784# Supplementary magic data for the file(1) command to support 7785# rzip(1). The format is described in magic(5). 7786# 7787# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 7788# this file. 7789# 77900 string RZIP rzip compressed data 7791>4 byte x - version %d 7792>5 byte x \b.%d 7793>6 belong x (%d bytes) 7794 77950 string ArC\x01 FreeArc archive <http://freearc.org> 7796 7797# Type: DACT compressed files 77980 long 0x444354C3 DACT compressed data 7799>4 byte >-1 (version %i. 7800>5 byte >-1 %i. 7801>6 byte >-1 %i) 7802>7 long >0 , original size: %i bytes 7803>15 long >30 , block size: %i bytes 7804 7805# Valve Pack (VPK) files 78060 lelong 0x55aa1234 Valve Pak file 7807>0x4 lelong x \b, version %u 7808>0x8 lelong x \b, %u entries 7809 7810# Snappy framing format 7811# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 78120 string \377\006\0\0sNaPpY snappy framed data 7813!:mime application/x-snappy-framed 7814 7815# qpress, https://www.quicklz.com/ 78160 string qpress10 qpress compressed data 7817!:mime application/x-qpress 7818 7819# Zlib https://www.ietf.org/rfc/rfc6713.txt 78200 string/b x 7821>0 beshort%31 =0 7822>>0 byte&0xf =8 7823>>>0 byte&0x80 =0 zlib compressed data 7824!:mime application/zlib 7825 7826# BWC compression 78270 string BWC 7828>3 byte 0 BWC compressed data 7829 7830# UCL compression 78310 bequad 0x00e955434cff011a UCL compressed data 7832 7833# Softlib archive 78340 string SLIB Softlib archive 7835>4 leshort x \b, version %d 7836>6 leshort x (contains %d files) 7837 7838# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 7839# From: Eric Hall <eric.hall@darkart.com> 78400 string bvx- lzfse encoded, no compression 78410 string bvx1 lzfse compressed, uncompressed tables 78420 string bvx2 lzfse compressed, compressed tables 78430 string bvxn lzfse encoded, lzvn compressed 7844 7845# pcxLib.exe compression program 7846# http://www.shikadi.net/moddingwiki/PCX_Library 78470 string/b pcxLib 7848>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed 7849 7850#------------------------------------------------------------------------------ 7851# $File: console,v 1.62 2021/02/05 21:51:06 christos Exp $ 7852# Console game magic 7853# Toby Deshane <hac@shoelace.digivill.net> 7854 7855# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 7856# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7857# References: 7858# - https://wiki.nesdev.com/w/index.php/INES 7859# - https://wiki.nesdev.com/w/index.php/NES_2.0 7860 7861# Common header for iNES, NES 2.0, and Wii U iNES. 78620 name nes-rom-image-ines 7863>7 byte&0x0C =0x8 (NES 2.0) 7864>4 byte x \b: %ux16k PRG 7865>5 byte x \b, %ux8k CHR 7866>6 byte&0x08 =0x8 [4-Scr] 7867>6 byte&0x09 =0x0 [H-mirror] 7868>6 byte&0x09 =0x1 [V-mirror] 7869>6 byte&0x02 =0x2 [SRAM] 7870>6 byte&0x04 =0x4 [Trainer] 7871>7 byte&0x03 =0x2 [PC10] 7872>7 byte&0x03 =0x1 [VS] 7873>>7 byte&0x0C =0x8 7874# NES 2.0: VS PPU 7875>>>13 byte&0x0F =0x0 \b, RP2C03B 7876>>>13 byte&0x0F =0x1 \b, RP2C03G 7877>>>13 byte&0x0F =0x2 \b, RP2C04-0001 7878>>>13 byte&0x0F =0x3 \b, RP2C04-0002 7879>>>13 byte&0x0F =0x4 \b, RP2C04-0003 7880>>>13 byte&0x0F =0x5 \b, RP2C04-0004 7881>>>13 byte&0x0F =0x6 \b, RP2C03B 7882>>>13 byte&0x0F =0x7 \b, RP2C03C 7883>>>13 byte&0x0F =0x8 \b, RP2C05-01 7884>>>13 byte&0x0F =0x9 \b, RP2C05-02 7885>>>13 byte&0x0F =0xA \b, RP2C05-03 7886>>>13 byte&0x0F =0xB \b, RP2C05-04 7887>>>13 byte&0x0F =0xC \b, RP2C05-05 7888# TODO: VS protection hardware? 7889>>7 byte x \b] 7890# NES 2.0-specific flags. 7891>7 byte&0x0C =0x8 7892>>12 byte&0x03 =0x0 [NTSC] 7893>>12 byte&0x03 =0x1 [PAL] 7894>>12 byte&0x02 =0x2 [NTSC+PAL] 7895 7896# Standard iNES ROM header. 78970 string NES\x1A NES ROM image (iNES) 7898!:mime application/x-nes-rom 7899>0 use nes-rom-image-ines 7900 7901# Wii U Virtual Console iNES ROM header. 79020 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 7903!:mime application/x-nes-rom 7904>0 use nes-rom-image-ines 7905 7906#------------------------------------------------------------------------------ 7907# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 7908# Reference: https://wiki.nesdev.com/w/index.php/UNIF 7909# From: David Korth <gerbilsoft@gerbilsoft.com> 7910# 7911# NOTE: The UNIF format uses chunks instead of a fixed header, 7912# so most of the data isn't easily parseable. 7913# 79140 string UNIF 7915>4 lelong <16 NES ROM image (UNIF v%d format) 7916!:mime application/x-nes-rom 7917 7918#------------------------------------------------------------------------------ 7919# fds: file(1) magic for Famciom Disk System disk images 7920# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 7921# From: David Korth <gerbilsoft@gerbilsoft.com> 7922# TODO: Check "Disk info block" and get info from that in addition to the optional header. 7923 7924# Disk info block. (block 1) 79250 name nintendo-fds-disk-info-block 7926>23 byte !1 FMC- 7927>23 byte 1 FSC- 7928>16 string x \b%.3s 7929>15 byte x \b, mfr %02X 7930>20 byte x (Rev.%02u) 7931 7932# Headered version. 79330 string FDS\x1A 7934>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 7935!:mime application/x-fds-disk 7936>>0x10 use nintendo-fds-disk-info-block 7937>4 byte 1 (%u side) 7938>4 byte !1 (%u sides) 7939 7940# Unheadered version. 79411 string *NINTENDO-HVC* Famicom Disk System disk image: 7942!:mime application/x-fds-disk 7943>0 use nintendo-fds-disk-info-block 7944 7945#------------------------------------------------------------------------------ 7946# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 7947# Used by Nintendo 3DS NES Virtual Console games. 7948# From: David Korth <gerbilsoft@gerbilsoft.com> 7949# 79500 string TNES NES ROM image (Nintendo 3DS Virtual Console) 7951!:mime application/x-nes-rom 7952>4 byte 100 \b: FDS, 7953>>0x2010 use nintendo-fds-disk-info-block 7954>4 byte !100 \b: TNES mapper %u 7955>>5 byte x \b, %ux8k PRG 7956>>6 byte x \b, %ux8k CHR 7957>>7 byte&0x08 =1 [WRAM] 7958>>8 byte&0x09 =1 [H-mirror] 7959>>8 byte&0x09 =2 [V-mirror] 7960>>8 byte&0x02 =3 [VRAM] 7961 7962#------------------------------------------------------------------------------ 7963# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 7964# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 7965# 79660x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 7967# TODO: application/x-gameboy-color-rom for GBC. 7968!:mime application/x-gameboy-rom 7969>0x143 byte&0x80 0x80 7970>>0x134 string >\0 \b: "%.15s" 7971>0x143 byte&0x80 !0x80 7972>>0x134 string >\0 \b: "%.16s" 7973>0x14c byte x (Rev.%02u) 7974 7975# Machine type. (SGB, CGB, SGB+CGB) 7976# Old licensee code 0x33 is required for SGB, but not CGB. 7977>0x14b byte 0x33 7978>>0x146 byte 0x03 7979>>>0x143 byte&0x80 0x80 [SGB+CGB] 7980>>>0x143 byte&0x80 !0x80 [SGB] 7981>>0x146 byte !0x03 7982>>>0x143 byte&0xC0 0x80 [CGB] 7983>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7984>0x14b byte !0x33 7985>>0x143 byte&0xC0 0x80 [CGB] 7986>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7987 7988# Mapper. 7989>0x147 byte 0x00 [ROM ONLY] 7990>0x147 byte 0x01 [MBC1] 7991>0x147 byte 0x02 [MBC1+RAM] 7992>0x147 byte 0x03 [MBC1+RAM+BATT] 7993>0x147 byte 0x05 [MBC2] 7994>0x147 byte 0x06 [MBC2+BATTERY] 7995>0x147 byte 0x08 [ROM+RAM] 7996>0x147 byte 0x09 [ROM+RAM+BATTERY] 7997>0x147 byte 0x0B [MMM01] 7998>0x147 byte 0x0C [MMM01+SRAM] 7999>0x147 byte 0x0D [MMM01+SRAM+BATT] 8000>0x147 byte 0x0F [MBC3+TIMER+BATT] 8001>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 8002>0x147 byte 0x11 [MBC3] 8003>0x147 byte 0x12 [MBC3+RAM] 8004>0x147 byte 0x13 [MBC3+RAM+BATT] 8005>0x147 byte 0x19 [MBC5] 8006>0x147 byte 0x1A [MBC5+RAM] 8007>0x147 byte 0x1B [MBC5+RAM+BATT] 8008>0x147 byte 0x1C [MBC5+RUMBLE] 8009>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 8010>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 8011>0x147 byte 0xFC [Pocket Camera] 8012>0x147 byte 0xFD [Bandai TAMA5] 8013>0x147 byte 0xFE [Hudson HuC-3] 8014>0x147 byte 0xFF [Hudson HuC-1] 8015 8016# ROM size. 8017>0x148 byte 0 \b, ROM: 256Kbit 8018>0x148 byte 1 \b, ROM: 512Kbit 8019>0x148 byte 2 \b, ROM: 1Mbit 8020>0x148 byte 3 \b, ROM: 2Mbit 8021>0x148 byte 4 \b, ROM: 4Mbit 8022>0x148 byte 5 \b, ROM: 8Mbit 8023>0x148 byte 6 \b, ROM: 16Mbit 8024>0x148 byte 7 \b, ROM: 32Mbit 8025>0x148 byte 0x52 \b, ROM: 9Mbit 8026>0x148 byte 0x53 \b, ROM: 10Mbit 8027>0x148 byte 0x54 \b, ROM: 12Mbit 8028 8029# RAM size. 8030>0x149 byte 1 \b, RAM: 16Kbit 8031>0x149 byte 2 \b, RAM: 64Kbit 8032>0x149 byte 3 \b, RAM: 256Kbit 8033>0x149 byte 4 \b, RAM: 1Mbit 8034>0x149 byte 5 \b, RAM: 512Kbit 8035 8036#------------------------------------------------------------------------------ 8037# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 8038# Updated by David Korth <gerbilsoft@gerbilsoft.com> 8039# References: 8040# - https://www.retrodev.com/segacd.html 8041# - http://devster.monkeeh.com/sega/32xguide1.txt 8042# 8043 8044# Common Sega Mega Drive header format. 8045# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 80460 name sega-mega-drive-header 8047# ROM title. (Use domestic if present; if not, use international.) 8048>0x120 byte >0x20 8049>>0x120 string >\0 \b: "%.16s" 8050>0x120 byte <0x21 8051>>0x150 string >\0 \b: "%.16s" 8052# Other information. 8053>0x180 string >\0 (%.14s 8054>>0x110 string >\0 \b, %.16s 8055>0x180 byte 0 8056>>0x110 string >\0 (%.16s 8057>0 byte x \b) 8058 8059# TODO: Check for 32X CD? 8060# Sega Mega CD disc images: 2048-byte sectors. 80610 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 8062!:mime application/x-sega-cd-rom 8063>0 use sega-mega-drive-header 8064>0 byte x \b, 2048-byte sectors 80650 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 8066!:mime application/x-sega-cd-rom 8067>0 use sega-mega-drive-header 8068>0 byte x \b, 2048-byte sectors 8069# Sega Mega CD disc images: 2352-byte sectors. 80700x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 8071!:mime application/x-sega-cd-rom 8072>0x10 use sega-mega-drive-header 8073>0 byte x \b, 2352-byte sectors 80740x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 8075!:mime application/x-sega-cd-rom 8076>0x10 use sega-mega-drive-header 8077>0 byte x \b, 2352-byte sectors 8078 8079# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 80800x100 string SEGA 8081>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 8082!:mime application/x-genesis-32x-rom 8083>>0 use sega-mega-drive-header 8084>0x3C0 bequad !0x4D41525320434845 8085>>0x105 belong 0x5049434F Sega Pico ROM image 8086!:mime application/x-sega-pico-rom 8087>>>0 use sega-mega-drive-header 8088>>0x105 belong !0x5049434F 8089>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 8090!:mime application/x-genesis-rom 8091>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 8092!:mime application/x-genesis-rom 8093>>>0 use sega-mega-drive-header 8094 8095#------------------------------------------------------------------------------ 8096# genesis: file(1) magic for the Super MegaDrive ROM dump format 8097# 8098 8099# NOTE: Due to interleaving, we can't display anything 8100# other than the copier header information. 81010 name sega-genesis-smd-header 8102>0 byte x %dx16k blocks 8103>2 byte 0 \b, last in series or standalone 8104>2 byte >0 \b, split ROM 8105 8106# "Sega Genesis" header. 81070x280 string EAGN 8108>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 8109!:mime application/x-genesis-rom 8110>>0 use sega-genesis-smd-header 8111 8112# "Sega Mega Drive" header. 81130x280 string EAMG 8114>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 8115!:mime application/x-genesis-rom 8116>>0 use sega-genesis-smd-header 8117 8118#------------------------------------------------------------------------------ 8119# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 8120# Detects all Game Gear and export Sega Master System ROM images, 8121# and some Japanese Sega Master System ROM images. 8122# From: David Korth <gerbilsoft@gerbilsoft.com> 8123# Reference: https://www.smspower.org/Development/ROMHeader 8124# 8125 8126# General SMS header rule. 8127# The SMS boot ROM checks the header at three locations. 81280 name sega-master-system-rom-header 8129# Machine type. 8130>0x0F byte&0xF0 0x30 Sega Master System 8131!:mime application/x-sms-rom 8132>0x0F byte&0xF0 0x40 Sega Master System 8133!:mime application/x-sms-rom 8134>0x0F byte&0xF0 0x50 Sega Game Gear 8135!:mime application/x-gamegear-rom 8136>0x0F byte&0xF0 0x60 Sega Game Gear 8137!:mime application/x-gamegear-rom 8138>0x0F byte&0xF0 0x70 Sega Game Gear 8139!:mime application/x-gamegear-rom 8140>0x0F default x Sega Master System / Game Gear 8141!:mime application/x-sms-rom 8142>0 byte x ROM image: 8143# Product code. 8144>0x0E byte&0xF0 0x10 1 8145>0x0E byte&0xF0 0x20 2 8146>0x0E byte&0xF0 0x30 3 8147>0x0E byte&0xF0 0x40 4 8148>0x0E byte&0xF0 0x50 5 8149>0x0E byte&0xF0 0x60 6 8150>0x0E byte&0xF0 0x70 7 8151>0x0E byte&0xF0 0x80 8 8152>0x0E byte&0xF0 0x90 9 8153>0x0E byte&0xF0 0xA0 10 8154>0x0E byte&0xF0 0xB0 11 8155>0x0E byte&0xF0 0xC0 12 8156>0x0E byte&0xF0 0xD0 13 8157>0x0E byte&0xF0 0xE0 14 8158>0x0E byte&0xF0 0xF0 15 8159# If the product code is 5 digits, we'll need to backspace here. 8160>0x0E byte&0xF0 !0 8161>>0x0C leshort x \b%04x 8162>0x0E byte&0xF0 0 8163>>0x0C leshort x %04x 8164# Revision. 8165>0x0E byte&0x0F x (Rev.%02d) 8166# ROM size. (Used for the boot ROM checksum routine.) 8167>0x0F byte&0x0F 0x0A (8 KB) 8168>0x0F byte&0x0F 0x0B (16 KB) 8169>0x0F byte&0x0F 0x0C (32 KB) 8170>0x0F byte&0x0F 0x0D (48 KB) 8171>0x0F byte&0x0F 0x0E (64 KB) 8172>0x0F byte&0x0F 0x0F (128 KB) 8173>0x0F byte&0x0F 0x00 (256 KB) 8174>0x0F byte&0x0F 0x01 (512 KB) 8175>0x0F byte&0x0F 0x02 (1 MB) 8176 8177# SMS/GG header locations. 81780x7FF0 string TMR\ SEGA 8179>0x7FF0 use sega-master-system-rom-header 81800x3FF0 string TMR\ SEGA 8181>0x3FF0 use sega-master-system-rom-header 81820x1FF0 string TMR\ SEGA 8183>0x1FF0 use sega-master-system-rom-header 8184 8185#------------------------------------------------------------------------------ 8186# saturn: file(1) magic for the Sega Saturn disc image format. 8187# From: David Korth <gerbilsoft@gerbilsoft.com> 8188# 8189 8190# Common Sega Saturn disc header format. 8191# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 8192# TODO: Release date, device information, region code, others? 81930 name sega-saturn-disc-header 8194>0x60 string >\0 \b: "%.32s" 8195>0x20 string >\0 (%.10s 8196>>0x2A string >\0 \b, %.6s) 8197>>0x2A byte 0 \b) 8198 8199# 2048-byte sector version. 82000 string SEGA\ SEGASATURN\ Sega Saturn disc image 8201!:mime application/x-saturn-rom 8202>0 use sega-saturn-disc-header 8203>0 byte x (2048-byte sectors) 8204# 2352-byte sector version. 82050x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 8206!:mime application/x-saturn-rom 8207>0x10 use sega-saturn-disc-header 8208>0 byte x (2352-byte sectors) 8209 8210#------------------------------------------------------------------------------ 8211# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 8212# From: David Korth <gerbilsoft@gerbilsoft.com> 8213# Reference: https://mc.pp.se/dc/ip0000.bin.html 8214# 8215 8216# Common Sega Dreamcast disc header format. 8217# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 8218# TODO: Release date, device information, region code, others? 82190 name sega-dreamcast-disc-header 8220>0x80 string >\0 \b: "%.32s" 8221>0x40 string >\0 (%.10s 8222>>0x4A string >\0 \b, %.6s) 8223>>0x4A byte 0 \b) 8224 8225# 2048-byte sector version. 82260 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 8227!:mime application/x-dc-rom 8228>0 use sega-dreamcast-disc-header 8229>0 byte x (2048-byte sectors) 8230# 2352-byte sector version. 82310x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 8232!:mime application/x-dc-rom 8233>0x10 use sega-dreamcast-disc-header 8234>0 byte x (2352-byte sectors) 8235 8236#------------------------------------------------------------------------------ 8237# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 8238# 82390 belong 0x21068028 Sega Dreamcast VMU game image 82400 string LCDi Dream Animator file 8241 8242#------------------------------------------------------------------------------ 8243# z64: file(1) magic for the Z64 format N64 ROM dumps 8244# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 8245# From: David Korth <gerbilsoft@gerbilsoft.com> 8246# 82470 bequad 0x803712400000000F Nintendo 64 ROM image 8248!:mime application/x-n64-rom 8249>0x20 string >\0 \b: "%.20s" 8250>0x3B string x (%.4s 8251>0x3F byte x \b, Rev.%02u) 8252 8253#------------------------------------------------------------------------------ 8254# v64: file(1) magic for the V64 format N64 ROM dumps 8255# Same as z64 format, but with 16-bit byteswapping. 8256# 82570 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 8258!:mime application/x-n64-rom 8259 8260#------------------------------------------------------------------------------ 8261# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 8262# Same as z64 format, but with swapped 16-bit words. 8263# 82640 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 8265!:mime application/x-n64-rom 8266 8267#------------------------------------------------------------------------------ 8268# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 8269# Same as z64 format, but with 32-bit byteswapping. 8270# 82710 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 8272!:mime application/x-n64-rom 8273 8274#------------------------------------------------------------------------------ 8275# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 8276# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader 8277# 8278# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 8279# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 8280# 82814 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 8282!:mime application/x-gba-rom 8283>0xA0 string >\0 \b: "%.12s" 8284>0xAC string x (%.6s 8285>0xBC byte x \b, Rev.%02u) 8286 8287#------------------------------------------------------------------------------ 8288# nds: file(1) magic for the Nintendo DS(i) raw ROM format 8289# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader 8290# 8291# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 8292# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 8293# 82940xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 8295!:mime application/x-nintendo-ds-rom 8296>0x00 string >\0 \b: "%.12s" 8297>0x0C string x (%.6s 8298>0x1E byte x \b, Rev.%02u) 8299>0x12 byte 2 (DSi enhanced) 8300>0x12 byte 3 (DSi only) 8301# Secure Area check. 8302>0x20 lelong <0x4000 (homebrew) 8303>0x20 lelong >0x3FFF 8304>>0x4000 lequad 0x0000000000000000 (multiboot) 8305>>0x4000 lequad !0x0000000000000000 8306>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 8307>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 8308>>>>0x1000 lequad 0x0000000000000000 (encrypted) 8309>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 8310 8311#------------------------------------------------------------------------------ 8312# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 8313# This is also used for loading .nds files using the MSET exploit on 3DS. 8314# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 83150xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 8316!:mime application/x-nintendo-ds-rom 8317 8318#------------------------------------------------------------------------------ 8319# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 8320# From: David Korth <gerbilsoft@gerbilsoft.com> 8321# References: 8322# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 8323# - https://www.devrs.com/ngp/files/ngpctech.txt 8324# 83250x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 8326!:mime application/x-neo-geo-pocket-rom 8327>0x23 byte 0x10 Color 8328>0 byte x ROM image 8329>0x24 string >\0 \b: "%.12s" 8330>0x1F byte 0xFF (debug mode enabled) 8331 8332#------------------------------------------------------------------------------ 8333# msx: file(1) magic for MSX game cartridge dumps 8334# Too simple - MPi 8335#0 beshort 0x4142 MSX game cartridge dump 8336 8337#------------------------------------------------------------------------------ 8338# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 83390 string PS-X\ EXE Sony Playstation executable 8340>16 lelong x PC=0x%08x, 8341>20 lelong !0 GP=0x%08x, 8342>24 lelong !0 .text=[0x%08x, 8343>>28 lelong x \b0x%x], 8344>32 lelong !0 .data=[0x%08x, 8345>>36 lelong x \b0x%x], 8346>40 lelong !0 .bss=[0x%08x, 8347>>44 lelong x \b0x%x], 8348>48 lelong !0 Stack=0x%08x, 8349>48 lelong =0 No Stack!, 8350>52 lelong !0 StackSize=0x%x, 8351#>76 string >\0 (%s) 8352# Area: 8353>113 string x (%s) 8354 8355# CPE executables 83560 string CPE CPE executable 8357>3 byte x (version %d) 8358 8359#------------------------------------------------------------------------------ 8360# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 83610 string XBEH Microsoft Xbox executable 8362!:mime audio/x-xbox-executable 8363!:ext xbe 8364# expect base address of 0x10000 8365>0x0104 ulelong =0x10000 8366>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" 8367>>(0x0118.l-0x0FFF5) byte x (%c 8368>>(0x0118.l-0x0FFF6) byte x \b%c- 8369>>(0x0118.l-0x0FFF8) uleshort x \b%03u) 8370>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 8371>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 8372>>>(0x0118.l-0x0FF60) ulelong >0 (regions: 8373>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA 8374>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan 8375>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World 8376>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer 8377>>>(0x0118.l-0x0FF60) ulelong >0 \b) 8378# probabilistic checks whether signed or not 8379>0x0004 ulelong =0x0 8380>>&2 ulelong =0x0 8381>>>&2 ulelong =0x0 \b, not signed 8382>0x0004 ulelong >0 8383>>&2 ulelong >0 8384>>>&2 ulelong >0 \b, signed 8385 8386# -------------------------------- 8387# Microsoft Xbox data file formats 83880 string XIP0 XIP, Microsoft Xbox data 83890 string XTF0 XTF, Microsoft Xbox data 8390 8391#------------------------------------------------------------------------------ 8392# Microsoft Xbox 360 executables (.xex) 8393# From: David Korth <gerbilsoft@gerbilsoft.com> 8394# References: 8395# - https://free60project.github.io/wiki/XEX.html 8396# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8397 8398# Title ID (part of Execution ID section) 83990 name xbox-360-xex-execution-id 8400>(0.L+0xC) byte x (%c 8401>(0.L+0xD) byte x \b%c 8402>(0.L+0xE) beshort x \b-%04u, media ID: 8403>(0.L) belong x %08X) 8404 8405# Region code (part of Security Info) 84060 name xbox-360-xex-region-code 8407>0 ubelong 0xFFFFFFFF \b, all regions 8408>0 ubelong !0xFFFFFFFF 8409>>0 ubelong >0 (regions: 8410>>0 ubelong&0x000000FF 0x000000FF USA 8411>>0 ubelong&0x00000100 0x00000100 Japan 8412>>0 ubelong&0x00000200 0x00000200 China 8413>>0 ubelong&0x0000FC00 0x0000FC00 Asia 8414>>0 ubelong&0x00FF0000 0x00FF0000 PAL 8415>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] 8416>>0 ubelong&0x00FF0000 0x00010000 AU/NZ 8417>>0 ubelong&0xFF000000 0xFF000000 Other 8418>>0 ubelong >0 \b) 8419 84200 string XEX2 Microsoft Xbox 360 executable 8421!:mime audio/x-xbox360-executable 8422!:ext xex 8423>0x18 search/0x100 \x00\x04\x00\x06 8424>>&0 use xbox-360-xex-execution-id 8425>(0x010.L+0x178) use xbox-360-xex-region-code 8426 84270 string XEX1 Microsoft Xbox 360 executable (XEX1) 8428!:mime audio/x-xbox360-executable 8429!:ext xex 8430>0x18 search/0x100 \x00\x04\x00\x06 8431>>&0 use xbox-360-xex-execution-id 8432>(0x010.L+0x154) use xbox-360-xex-region-code 8433 8434#------------------------------------------------------------------------------ 8435# Microsoft Xbox 360 packages 8436# From: David Korth <gerbilsoft@gerbilsoft.com> 8437# References: 8438# - https://free60project.github.io/wiki/STFS.html 8439# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8440 8441# TODO: More information for console-signed packages. 8442 84430 name xbox-360-package 8444>0x360 byte x (%c 8445>0x361 byte x \b%c 8446>0x362 beshort x \b-%04u, media ID: 8447>0x354 belong x %08X) 8448>0x344 belong x \b, content type: 8449>>0x344 belong 0x1 Saved Game 8450>>0x344 belong 0x2 Marketplace Content 8451>>0x344 belong 0x3 Publisher 8452>>0x344 belong 0x1000 Xbox 360 Title 8453>>0x344 belong 0x2000 IPTV Pause Buffer 8454>>0x344 belong 0x4000 Installed Game 8455>>0x344 belong 0x5000 Original Xbox Game 8456>>0x344 belong 0x9000 Avatar Item 8457>>0x344 belong 0x10000 Profile 8458>>0x344 belong 0x20000 Gamer Picture 8459>>0x344 belong 0x30000 Theme 8460>>0x344 belong 0x40000 Cache File 8461>>0x344 belong 0x50000 Storage Download 8462>>0x344 belong 0x60000 Xbox Saved Game 8463>>0x344 belong 0x70000 Xbox Download 8464>>0x344 belong 0x80000 Game Demo 8465>>0x344 belong 0x90000 Video 8466>>0x344 belong 0xA0000 Game 8467>>0x344 belong 0xB0000 Installer 8468>>0x344 belong 0xC0000 Game Trailer 8469>>0x344 belong 0xD0000 Arcade Title 8470>>0x344 belong 0xE0000 XNA 8471>>0x344 belong 0xF0000 License Store 8472>>0x344 belong 0x100000 Movie 8473>>0x344 belong 0x200000 TV 8474>>0x344 belong 0x300000 Music Video 8475>>0x344 belong 0x400000 Game Video 8476>>0x344 belong 0x500000 Podcast Video 8477>>0x344 belong 0x600000 Viral Video 8478>>0x344 belong 0x2000000 Community Game 8479 84800 string CON\x20 Microsoft Xbox 360 package (console-signed) 8481>0 use xbox-360-package 84820 string PIRS 8483>0 belong 0 Microsoft Xbox 360 package (non-Xbox Live) 8484>>0 use xbox-360-package 84850 string LIVE 8486>0x104 belong 0 Microsoft Xbox 360 package (Xbox Live) 8487>>0 use xbox-360-package 8488 8489# Atari Lynx cartridge dump (EXE/BLL header) 8490# From: "Stefan A. Haubenthal" <polluks@web.de> 8491 8492# Double-check that the image type matches too, 0x8008 conflicts with 8493# 8 character OMF-86 object file headers. 84940 beshort 0x8008 8495>6 string BS93 Lynx homebrew cartridge 8496!:mime application/x-atari-lynx-rom 8497>>2 beshort x \b, RAM start $%04x 8498>6 string LYNX Lynx cartridge 8499!:mime application/x-atari-lynx-rom 8500>>2 beshort x \b, RAM start $%04x 8501 8502# Opera file system that is used on the 3DO console 8503# From: Serge van den Boom <svdb@stack.nl> 85040 string \x01ZZZZZ\x01 3DO "Opera" file system 8505 8506# From: Alex Myczko <alex@aiei.ch> 8507# From: David Pflug <david@pflug.email> 8508# is the offset 12 or the offset 16 correct? 8509# GBS (Game Boy Sound) magic 8510# ftp://ftp.modland.com/pub/documents/format_documentation/\ 8511# Gameboy%20Sound%20System%20(.gbs).txt 85120 string GBS Nintendo Gameboy Music/Audio Data 8513#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 8514>16 string >\0 ("%.32s" by 8515>48 string >\0 %.32s, copyright 8516>80 string >\0 %.32s), 8517>3 byte x version %u, 8518>4 byte x %u tracks 8519 8520# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 8521# see https://zerosoft.zophar.net/ips.php 85220 string PATCH IPS patch file 8523!:ext ips 8524 8525# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8526# Reference: https://www.romhacking.net/documents/746/ 85270 string BPS1 BPS patch file 8528!:ext bps 8529 8530# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8531# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64) 85320 string APS10 APS patch file 8533!:ext aps 8534>5 byte 0 \b, simple patch 8535>5 byte 1 \b, N64-specific patch for 8536>>58 byte x N%c 8537>>59 byte x \b%c 8538>>60 byte x \b%c 8539>7 byte !0x20 8540# FIXME: /T specifier isn't working with a fixed-length string. 8541>>7 string x \b: "%.50s" 8542 8543# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8544# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format) 85450 string UPS1 UPS patch file 8546!:ext ups 8547 8548# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 85490 string PPF30 Playstation Patch File version 3.0 8550>5 byte 0 \b, PPF 1.0 patch 8551>5 byte 1 \b, PPF 2.0 patch 8552>5 byte 2 \b, PPF 3.0 patch 8553>>56 byte 0 \b, Imagetype BIN (any) 8554>>56 byte 1 \b, Imagetype GI (PrimoDVD) 8555>>57 byte 0 \b, Blockcheck disabled 8556>>57 byte 1 \b, Blockcheck enabled 8557>>58 byte 0 \b, Undo data not available 8558>>58 byte 1 \b, Undo data available 8559>6 string x \b, description: %s 8560 85610 string PPF20 Playstation Patch File version 2.0 8562>5 byte 0 \b, PPF 1.0 patch 8563>5 byte 1 \b, PPF 2.0 patch 8564>>56 lelong >0 \b, size of file to patch %d 8565>6 string x \b, description: %s 8566 85670 string PPF10 Playstation Patch File version 1.0 8568>5 byte 0 \b, Simple Encoding 8569>6 string x \b, description: %s 8570 8571# From: Daniel Dawson <ddawson@icehouse.net> 8572# SNES9x .smv "movie" file format. 85730 string SMV\x1A SNES9x input recording 8574>0x4 lelong x \b, version %d 8575# version 4 is latest so far 8576>0x4 lelong <5 8577>>0x8 ledate x \b, recorded at %s 8578>>0xc lelong >0 \b, rerecorded %d times 8579>>0x10 lelong x \b, %d frames long 8580>>0x14 byte >0 \b, data for controller(s): 8581>>>0x14 byte &0x1 #1 8582>>>0x14 byte &0x2 #2 8583>>>0x14 byte &0x4 #3 8584>>>0x14 byte &0x8 #4 8585>>>0x14 byte &0x10 #5 8586>>0x15 byte ^0x1 \b, begins from snapshot 8587>>0x15 byte &0x1 \b, begins from reset 8588>>0x15 byte ^0x2 \b, NTSC standard 8589>>0x15 byte &0x2 \b, PAL standard 8590>>0x17 byte &0x1 \b, settings: 8591# WIP1Timing not used as of version 4 8592>>>0x4 lelong <4 8593>>>>0x17 byte &0x2 WIP1Timing 8594>>>0x17 byte &0x4 Left+Right 8595>>>0x17 byte &0x8 VolumeEnvX 8596>>>0x17 byte &0x10 FakeMute 8597>>>0x17 byte &0x20 SyncSound 8598# New flag as of version 4 8599>>>0x4 lelong >3 8600>>>>0x17 byte &0x80 NoCPUShutdown 8601>>0x4 lelong <4 8602>>>0x18 lelong >0x23 8603>>>>0x20 leshort !0 8604>>>>>0x20 lestring16 x \b, metadata: "%s" 8605>>0x4 lelong >3 8606>>>0x24 byte >0 \b, port 1: 8607>>>>0x24 byte 1 joypad 8608>>>>0x24 byte 2 mouse 8609>>>>0x24 byte 3 SuperScope 8610>>>>0x24 byte 4 Justifier 8611>>>>0x24 byte 5 multitap 8612>>>0x24 byte >0 \b, port 2: 8613>>>>0x25 byte 1 joypad 8614>>>>0x25 byte 2 mouse 8615>>>>0x25 byte 3 SuperScope 8616>>>>0x25 byte 4 Justifier 8617>>>>0x25 byte 5 multitap 8618>>>0x18 lelong >0x43 8619>>>>0x40 leshort !0 8620>>>>>0x40 lestring16 x \b, metadata: "%s" 8621>>0x17 byte &0x40 \b, ROM: 8622>>>(0x18.l-26) lelong x CRC32 0x%08x 8623>>>(0x18.l-23) string x "%s" 8624 8625# Type: scummVM savegame files 8626# From: Sven Hartge <debian@ds9.argh.org> 86270 string SCVM ScummVM savegame 8628>12 string >\0 "%s" 8629 8630#------------------------------------------------------------------------------ 8631# Nintendo GameCube / Wii file formats. 8632# 8633 8634# Type: Nintendo GameCube/Wii common disc header data. 8635# From: David Korth <gerbilsoft@gerbilsoft.com> 8636# Reference: https://wiibrew.org/wiki/Wii_Disc 86370 name nintendo-gcn-disc-common 8638>0x20 string x "%.64s" 8639>0x00 string x (%.6s 8640>0x06 byte >0 8641>>0x06 byte 1 \b, Disc 2 8642>>0x06 byte 2 \b, Disc 3 8643>>0x06 byte 3 \b, Disc 4 8644>0x07 byte x \b, Rev.%02u) 8645>0x18 belong 0x5D1C9EA3 8646>>0x60 beshort 0x0101 \b (Unencrypted) 8647>0x200 string NKIT \b (NKit compressed) 8648 8649 8650# Type: Nintendo GameCube disc image 8651# From: David Korth <gerbilsoft@gerbilsoft.com> 8652# Reference: https://wiibrew.org/wiki/Wii_Disc 86530x1C belong 0xC2339F3D Nintendo GameCube disc image: 8654!:mime application/x-gamecube-rom 8655>0 use nintendo-gcn-disc-common 8656 8657# Type: Nintendo GameCube embedded disc image 8658# Commonly found on demo discs. 8659# From: David Korth <gerbilsoft@gerbilsoft.com> 8660# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 86610 belong 0xAE0F38A2 8662>0x0C belong 0x00100000 8663>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 8664!:mime application/x-gamecube-rom 8665>>>(8.L) use nintendo-gcn-disc-common 8666 8667# Type: Nintendo Wii disc image 8668# From: David Korth <gerbilsoft@gerbilsoft.com> 8669# Reference: https://wiibrew.org/wiki/Wii_Disc 86700x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 8671>0 use nintendo-gcn-disc-common 8672 8673# Type: Nintendo Wii disc image (WBFS format) 8674# From: David Korth <gerbilsoft@gerbilsoft.com> 8675# Reference: https://wiibrew.org/wiki/Wii_Disc 86760 string WBFS 8677>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 8678!:mime application/x-wii-rom 8679>>0x200 use nintendo-gcn-disc-common 8680 8681# Type: Nintendo GameCube/Wii disc image (CISO format) 8682# NOTE: This is NOT the same as Compact ISO or PSP CISO, 8683# though it has the same magic number. 86840 string CISO 8685# Other fields are used to determine what type of CISO this is: 8686# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 8687# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 8688# - None of the above: Compact ISO. 8689>4 lelong 0x200000 8690>>8 byte 1 8691>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 8692!:mime application/x-wii-rom 8693>>>>0x8000 use nintendo-gcn-disc-common 8694>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 8695!:mime application/x-wii-rom 8696>>>>0x8000 use nintendo-gcn-disc-common 8697 8698# Type: Nintendo GameCube/Wii disc image (GCZ format) 8699# Due to zlib compression, we can't get the actual disc information. 87000 lelong 0xB10BC001 8701>4 lelong 0 Nintendo GameCube disc image (GCZ format) 8702!:mime application/x-gamecube-rom 8703>4 lelong 1 Nintendo Wii disc image (GCZ format) 8704!:mime application/x-wii-rom 8705>4 default x Nintendo GameCube/Wii disc image (GCZ format) 8706 8707# Type: Nintendo GameCube/Wii disc image (WDF format) 87080 string WII\001DISC 8709>8 belong 1 8710# WDFv1 8711>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 8712!:mime application/x-gamecube-rom 8713>>>0x38 use nintendo-gcn-disc-common 8714>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 8715!:mime application/x-wii-rom 8716>>>0x38 use nintendo-gcn-disc-common 8717>8 belong 2 8718# WDFv2 8719>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 8720!:mime application/x-gamecube-rom 8721>>>(12.L) use nintendo-gcn-disc-common 8722>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 8723!:mime application/x-wii-rom 8724>>>(12.L) use nintendo-gcn-disc-common 8725 8726# Type: Nintendo GameCube/Wii disc image (WIA format) 87270 string WIA\001 Nintendo 8728>0x48 belong 1 GameCube 8729!:mime application/x-gamecube-rom 8730>0x48 belong 2 Wii 8731!:mime application/x-wii-rom 8732>0x48 default x GameCube/Wii 8733>0x48 belong x disc image (WIA format): 8734>>0x58 use nintendo-gcn-disc-common 8735 8736# Type: Nintendo GameCube/Wii disc image (with SDK header) 8737# From: David Korth <gerbilsoft@gerbilsoft.com> 8738# Reference: https://wiibrew.org/wiki/Wii_Disc 87390 belong 0xFFFF0000 8740>0x18 belong 0x00000000 8741>>0x1C belong 0x00000000 8742>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 8743!:mime application/x-wii-rom 8744>>>>0x8000 use nintendo-gcn-disc-common 8745>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 8746!:mime application/x-gamecube-rom 8747>>>>0x8000 use nintendo-gcn-disc-common 8748 8749#------------------------------------------------------------------------------ 8750# Nintendo 3DS file formats. 8751# 8752 8753# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 8754# From: David Korth <gerbilsoft@gerbilsoft.com> 8755# Reference: https://www.3dbrew.org/wiki/NCSD 87560x100 string NCSD 8757>0x118 lequad 0 Nintendo 3DS Game Card image 8758# NCCH header for partition 0. (game data) 8759>>0x1150 string >\0 \b: "%.16s" 8760>>0x312 byte x (Rev.%02u) 8761>>0x118C byte 2 (New3DS only) 8762>>0x18D byte 0 (inner device) 8763>>0x18D byte 1 (Card1) 8764>>0x18D byte 2 (Card2) 8765>>0x18D byte 3 (extended device) 8766>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 8767>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 8768 8769# Nintendo 3DS version code. 8770# Reference: https://www.3dbrew.org/wiki/Titles 8771# Format: leshort containing three fields: 8772# - 6-bit: Major 8773# - 6-bit: Minor 8774# - 4-bit: Revision 8775# NOTE: Only supporting major/minor versions from 0-15 right now. 8776# NOTE: Should be prefixed with "v". 87770 name nintendo-3ds-version-code 8778# Raw version. 8779>0 leshort x \b%u, 8780# Major version. 8781>0 leshort&0xFC00 0x0000 0 8782>0 leshort&0xFC00 0x0400 1 8783>0 leshort&0xFC00 0x0800 2 8784>0 leshort&0xFC00 0x0C00 3 8785>0 leshort&0xFC00 0x1000 4 8786>0 leshort&0xFC00 0x1400 5 8787>0 leshort&0xFC00 0x1800 6 8788>0 leshort&0xFC00 0x1C00 7 8789>0 leshort&0xFC00 0x2000 8 8790>0 leshort&0xFC00 0x2400 9 8791>0 leshort&0xFC00 0x2800 10 8792>0 leshort&0xFC00 0x2C00 11 8793>0 leshort&0xFC00 0x3000 12 8794>0 leshort&0xFC00 0x3400 13 8795>0 leshort&0xFC00 0x3800 14 8796>0 leshort&0xFC00 0x3C00 15 8797# Minor version. 8798>0 leshort&0x03F0 0x0000 \b.0 8799>0 leshort&0x03F0 0x0010 \b.1 8800>0 leshort&0x03F0 0x0020 \b.2 8801>0 leshort&0x03F0 0x0030 \b.3 8802>0 leshort&0x03F0 0x0040 \b.4 8803>0 leshort&0x03F0 0x0050 \b.5 8804>0 leshort&0x03F0 0x0060 \b.6 8805>0 leshort&0x03F0 0x0070 \b.7 8806>0 leshort&0x03F0 0x0080 \b.8 8807>0 leshort&0x03F0 0x0090 \b.9 8808>0 leshort&0x03F0 0x00A0 \b.10 8809>0 leshort&0x03F0 0x00B0 \b.11 8810>0 leshort&0x03F0 0x00C0 \b.12 8811>0 leshort&0x03F0 0x00D0 \b.13 8812>0 leshort&0x03F0 0x00E0 \b.14 8813>0 leshort&0x03F0 0x00F0 \b.15 8814# Revision. 8815>0 leshort&0x000F x \b.%u 8816 8817# Type: Nintendo 3DS "NCCH" container. 8818# https://www.3dbrew.org/wiki/NCCH 88190x100 string NCCH Nintendo 3DS 8820>0x18D byte&2 0 File Archive (CFA) 8821>0x18D byte&2 2 Executable Image (CXI) 8822>0x150 string >\0 \b: "%.16s" 8823>0x18D byte 0x05 8824>>0x10E leshort x (Old3DS System Update v 8825>>0x10E use nintendo-3ds-version-code 8826>>0x10E leshort x \b) 8827>0x18D byte 0x15 8828>>0x10E leshort x (New3DS System Update v 8829>>0x10E use nintendo-3ds-version-code 8830>>0x10E leshort x \b) 8831>0x18D byte !0x05 8832>>0x18D byte !0x15 8833>>>0x112 byte x (v 8834>>>0x112 use nintendo-3ds-version-code 8835>>>0x112 byte x \b) 8836>0x18C byte 2 (New3DS only) 8837 8838# Type: Nintendo 3DS "SMDH" file. (application description) 8839# From: David Korth <gerbilsoft@gerbilsoft.com> 8840# Reference: https://3dbrew.org/wiki/SMDH 88410 string SMDH Nintendo 3DS SMDH file 8842>0x208 leshort !0 8843>>0x208 lestring16 x \b: "%.128s" 8844>>0x388 leshort !0 8845>>>0x388 lestring16 x by %.128s 8846>0x208 leshort 0 8847>>0x008 leshort !0 8848>>>0x008 lestring16 x \b: "%.128s" 8849>>>0x188 leshort !0 8850>>>>0x188 lestring16 x by %.128s 8851 8852# Type: Nintendo 3DS Homebrew Application. 8853# From: David Korth <gerbilsoft@gerbilsoft.com> 8854# Reference: https://3dbrew.org/wiki/3DSX_Format 88550 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 8856 8857# Type: Nintendo 3DS Banner Model Data. 8858# From: David Korth <gerbilsoft@gerbilsoft.com> 8859# Reference: https://3dbrew.org/wiki/CBMD 88600 string CBMD\0\0\0\0 Nintendo 3DS Banner Model Data 8861 8862#------------------------------------------------------------------------------ 8863# a7800: file(1) magic for the Atari 7800 raw ROM format. 8864# From: David Korth <gerbilsoft@gerbilsoft.com> 8865# Reference: https://sites.google.com/site/atari7800wiki/a78-header 8866 88670 byte >0 8868>0 byte <3 8869>>1 string ATARI7800 Atari 7800 ROM image 8870!:mime application/x-atari-7800-rom 8871>>>0x11 string >\0 \b: "%.32s" 8872# Display type. 8873>>>0x39 byte 0 (NTSC) 8874>>>0x39 byte 1 (PAL) 8875>>>0x36 byte&1 1 (POKEY) 8876 8877#------------------------------------------------------------------------------ 8878# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 8879# From: David Korth <gerbilsoft@gerbilsoft.com> 8880# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 8881# 8882# NOTE: Title is terminated with 0x80, not 0. 8883# The header is terminated with a 0, so that will 8884# terminate the title as well. 8885# 88860 string g\ GCE Vectrex ROM image 8887>0x11 string >\0 \b: "%.16s" 8888 8889#------------------------------------------------------------------------------ 8890# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 8891# From: David Korth <gerbilsoft@gerbilsoft.com> 8892# Reference: https://www.3dbrew.org/wiki/Amiibo 88930x00 byte 0x04 8894>0x0A beshort 0x0FE0 8895>>0x0C belong 0xF110FFEE 8896>>>0x208 beshort 0x0100 8897>>>>0x020A byte 0x0F 8898>>>>>0x020C bequad 0x000000045F000000 8899>>>>>>0x5B byte 0x02 8900>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 8901>>>>>>>0x58 belong x \b%08X 8902 8903#------------------------------------------------------------------------------ 8904# Type: Nintendo Switch XCI (Game Cartridge Image) 8905# From: Benjamin Lowry <ben@ben.gmbh> 8906# Reference: https://switchbrew.org/wiki/Gamecard_Format 89070x100 string HEAD 8908>0x10D byte 0xFA Nintendo Switch cartridge image (XCI), 1GB 8909>0x10D byte 0xF8 Nintendo Switch cartridge image (XCI), 2GB 8910>0x10D byte 0xF0 Nintendo Switch cartridge image (XCI), 4GB 8911>0x10D byte 0xE0 Nintendo Switch cartridge image (XCI), 8GB 8912>0x10D byte 0xE1 Nintendo Switch cartridge image (XCI), 16GB 8913>0x10D byte 0xE2 Nintendo Switch cartridge image (XCI), 32GB 8914 8915#------------------------------------------------------------------------------ 8916# Type: Nintendo Switch Executable 8917# From: Benjamin Lowry <ben@ben.gmbh> 8918# Reference: https://switchbrew.org/wiki/NSO 89190x00 string NSO0 Nintendo Switch executable (NSO) 8920 8921#------------------------------------------------------------------------------ 8922# Type: Nintendo Switch PFS0 8923# From: Benjamin Lowry <ben@ben.gmbh> 8924# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0 89250x00 string PFS0 Nintendo Switch partition filesystem (PFS0) 8926>0x04 ulelong x \b, %d files 8927 8928#------------------------------------------------------------------------------ 8929# amiibo: file(1) magic for Nintendo Badge Arcade files. 8930# From: David Korth <gerbilsoft@gerbilsoft.com> 8931# References: 8932# - https://github.com/GerbilSoft/rom-properties/issues/92 8933# - https://github.com/CaitSith2/BadgeArcadeTool 8934# - https://github.com/TheMachinumps/Advanced-badge-editor 8935 8936# PRBS: Individual badge and/or mega badge. 89370 string PRBS 8938>0x44 byte >0x20 Nintendo Badge Arcade 8939>>0xB8 ulelong <2 8940>>>0xBC ulelong <2 badge: 8941>>>0xBC ulelong >1 Mega Badge 8942>>>>0xB8 ulelong x (%ux 8943>>>>0xBC ulelong x \b%u): 8944>>0xB8 ulelong >1 Mega Badge 8945>>>0xB8 ulelong x (%ux 8946>>>0xBC ulelong x \b%u): 8947>0x44 string x "%s" 8948>0x3C ulelong x \b, badge ID: %u 8949>0x74 byte >0x20 8950>>0x74 string x \b, set: "%s" 8951>0xA8 ulelong !0xFFFFFFFF 8952>>0xA8 ulelong x \b, launch title ID: %08X 8953>>0xA4 ulelong x \b-%08X 8954 8955# CABS: Badge set. 89560 string CABS 8957>0x2C byte >0x20 Nintendo Badge Arcade badge set: 8958>>0x2C string x "%.48s" 8959>>0x24 ulelong x \b, set ID: %u 8960 8961#------------------------------------------------------------------------------ 8962# sufami: file(1) magic for Sufami Turbo ROM images. 8963# From: David Korth <gerbilsoft@gerbilsoft.com> 8964# References: 8965# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor 89660 string BANDAI\ SFC-ADX 8967>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image: 8968>>0x10 string/T x "%.14s" 8969>>0x30 byte x \b, ID %02X 8970>>0x31 byte x \b%02X 8971>>0x32 byte x \b%02X 8972>>0x33 ubyte >0 \b, series index %u 8973>>0x34 ubyte 0 [SlowROM] 8974>>0x34 ubyte 1 [FastROM] 8975>>0x35 ubyte 1 [SRAM] 8976>>0x35 ubyte 3 [Special] 8977 8978# Type: Nintendo GameCube/Wii disc image (RVZ format) 89790 string RVZ\001 Nintendo 8980>0x48 belong 1 GameCube 8981!:mime application/x-gamecube-rom 8982>0x48 belong 2 Wii 8983!:mime application/x-wii-rom 8984>0x48 default x GameCube/Wii 8985>0x48 belong x disc image (RVZ format): 8986>>0x58 use nintendo-gcn-disc-common 8987 8988 8989#------------------------------------------------------------------------------ 8990# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 8991# convex: file(1) magic for Convex boxes 8992# 8993# Convexes are big-endian. 8994# 8995# /*\ 8996# * Below are the magic numbers and tests added for Convex. 8997# * Added at beginning, because they are expected to be used most. 8998# \*/ 89990 belong 0507 Convex old-style object 9000>16 belong >0 not stripped 90010 belong 0513 Convex old-style demand paged executable 9002>16 belong >0 not stripped 90030 belong 0515 Convex old-style pre-paged executable 9004>16 belong >0 not stripped 90050 belong 0517 Convex old-style pre-paged, non-swapped executable 9006>16 belong >0 not stripped 90070 belong 0x011257 Core file 9008# 9009# The following are a series of dump format magic numbers. Each one 9010# corresponds to a drastically different dump format. The first on is 9011# the original dump format on a 4.1 BSD or earlier file system. The 9012# second marks the change between the 4.1 file system and the 4.2 file 9013# system. The Third marks the changing of the block size from 1K 9014# to 2K to be compatible with an IDC file system. The fourth indicates 9015# a dump that is dependent on Convex Storage Manager, because data in 9016# secondary storage is not physically contained within the dump. 9017# The restore program uses these number to determine how the data is 9018# to be extracted. 9019# 902024 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 902124 belong =60014 dump format, Convex Storage Manager by-reference dump 9022# 9023# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 9024# If there is no `=' sign, assume just checking for whether the bit is set? 9025# 90260 belong 0601 Convex SOFF 9027>88 belong&0x000f0000 =0x00000000 c1 9028>88 belong &0x00010000 c2 9029>88 belong &0x00020000 c2mp 9030>88 belong &0x00040000 parallel 9031>88 belong &0x00080000 intrinsic 9032>88 belong &0x00000001 demand paged 9033>88 belong &0x00000002 pre-paged 9034>88 belong &0x00000004 non-swapped 9035>88 belong &0x00000008 POSIX 9036# 9037>84 belong &0x80000000 executable 9038>84 belong &0x40000000 object 9039>84 belong&0x20000000 =0 not stripped 9040>84 belong&0x18000000 =0x00000000 native fpmode 9041>84 belong&0x18000000 =0x10000000 ieee fpmode 9042>84 belong&0x18000000 =0x18000000 undefined fpmode 9043# 90440 belong 0605 Convex SOFF core 9045# 90460 belong 0607 Convex SOFF checkpoint 9047>88 belong&0x000f0000 =0x00000000 c1 9048>88 belong &0x00010000 c2 9049>88 belong &0x00020000 c2mp 9050>88 belong &0x00040000 parallel 9051>88 belong &0x00080000 intrinsic 9052>88 belong &0x00000008 POSIX 9053# 9054>84 belong&0x18000000 =0x00000000 native fpmode 9055>84 belong&0x18000000 =0x10000000 ieee fpmode 9056>84 belong&0x18000000 =0x18000000 undefined fpmode 9057 9058#------------------------------------------------------------------------------ 9059# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $ 9060# xoverage: file(1) magic for test coverage data 9061 9062# File formats used to store test coverage data 9063# 2016-05-21, Georg Sauthoff <mail@georg.so> 9064 9065 9066# - GCC gcno - written by GCC at compile time when compiling with 9067# gcc -ftest-coverage 9068# - GCC gcda - written by a program that was compiled with 9069# gcc -fprofile-arcs 9070# - LLVM raw profiles - generated by a program compiled with 9071# clang -fprofile-instr-generate -fcoverage-mapping ... 9072# - LLVM indexed profiles - generated by 9073# llvm-profdata 9074# - GCOV reports, i.e. the annotated source code 9075# - LCOV trace files, i.e. aggregated GCC profiles 9076# 9077# GCC coverage tracefiles 9078# .gcno file are created during compile time, 9079# while data collected during runtime is stored in .gcda files 9080# cf. gcov-io.h 9081# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 9082# Examples: 9083# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 9084# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 90850 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 9086>&3 byte x version %c. 9087>&1 byte x \b%c 9088 9089# big endian 90900 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 9091>&0 byte x version %c. 9092>&2 byte x \b%c (big-endian) 9093 9094# Examples: 9095# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 9096# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 90970 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 9098>&3 byte x version %c. 9099>&1 byte x \b%c 9100 9101# big endian 91020 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 9103>&0 byte x version %c. 9104>&2 byte x \b%c (big-endian) 9105 9106 9107# LCOV tracefiles 9108# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 91090 string TN: 9110>&0 search/64 \nSF:/ LCOV coverage tracefile 9111 9112 9113# Coverage reports generated by gcov 9114# i.e. source code annotated with coverage information 91150 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 9116>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 9117>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 9118 9119 9120# LLVM coverage files 9121 9122# raw data after running a program compiled with: 9123# `clang -fprofile-instr-generate -fcoverage-mapping ...` 9124# default name: default.profraw 9125# magic is: \xFF lprofr \x81 9126# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 91270 lequad 0xff6c70726f667281 LLVM raw profile data, 9128>&0 byte x version %d 9129 9130# big endian 91310 bequad 0xff6c70726f667281 LLVM raw profile data, 9132>&7 byte x version %d (big-endian) 9133 9134 9135# LLVM indexed instruction profile (as generated by llvm-profdata) 9136# magic is: reverse(\xFF lprofi \x81) 9137# cf. https://llvm.org/docs/CoverageMappingFormat.html 9138# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 9139# https://llvm.org/docs/CommandGuide/llvm-cov.html 9140# https://llvm.org/docs/CommandGuide/llvm-profdata.html 91410 lequad 0x8169666f72706cff LLVM indexed profile data, 9142>&0 byte x version %d 9143 9144# big endian 91450 bequad 0x8169666f72706cff LLVM indexed profile data, 9146>&7 byte x version %d (big-endian) 9147 9148 9149#------------------------------------------------------------------------------ 9150# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 9151# cracklib: file (1) magic for cracklib v2.7 9152 91530 lelong 0x70775631 Cracklib password index, little endian 9154>4 long >0 (%i words) 9155>4 long 0 ("64-bit") 9156>>8 long >-1 (%i words) 91570 belong 0x70775631 Cracklib password index, big endian 9158>4 belong >-1 (%i words) 9159# really bellong 0x0000000070775631 91600 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 9161>12 belong >0 (%i words) 9162 9163#------------------------------------------------------------------------------ 9164# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $ 9165# crypto: file(1) magic for crypto formats 9166# 9167 9168# ---------------------------------------------------------------------------- 9169# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 9170# ctags: file (1) magic for Exuberant Ctags files 9171# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 91720 search/1 =!_TAG Exuberant Ctags tag file text 9173 9174#-------------------------------------------------------------- 9175# ctf: file(1) magic for CTF (Common Trace Format) trace files 9176# 9177# Specs. available here: <https://www.efficios.com/ctf> 9178#-------------------------------------------------------------- 9179 9180# CTF trace data 91810 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 91820 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 9183 9184# CTF metadata (packetized) 91850 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 9186>35 byte x \b, v%d 9187>36 byte x \b.%d 91880 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 9189>35 byte x \b, v%d 9190>36 byte x \b.%d 9191 9192# CTF metadata (plain text) 91930 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 9194!:strength + 5 # this is to make sure we beat C 9195>&0 regex [0-9]+\.[0-9]+ \b, v%s 9196 9197#------------------------------------------------------------------------------ 9198# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 9199# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 9200# 92010 string ACMP Map file for the AssaultCube FPS game 92020 string CUBE Map file for cube and cube2 engine games 92030 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 9204 9205#------------------------------------------------------------------------------ 9206# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ 9207# Cups: file(1) magic for the cups raster file format 9208# From: Laurent Martelli <martellilaurent@gmail.com> 9209# https://www.cups.org/documentation.php/spec-raster.html 9210# 9211 92120 name cups-le 9213>280 lelong x \b, %d 9214>284 lelong x \bx%d dpi 9215>376 lelong x \b, %dx 9216>380 lelong x \b%d pixels 9217>388 lelong x %d bits/color 9218>392 lelong x %d bits/pixel 9219>400 lelong 0 ColorOrder=Chunky 9220>400 lelong 1 ColorOrder=Banded 9221>400 lelong 2 ColorOrder=Planar 9222>404 lelong 0 ColorSpace=gray 9223>404 lelong 1 ColorSpace=RGB 9224>404 lelong 2 ColorSpace=RGBA 9225>404 lelong 3 ColorSpace=black 9226>404 lelong 4 ColorSpace=CMY 9227>404 lelong 5 ColorSpace=YMC 9228>404 lelong 6 ColorSpace=CMYK 9229>404 lelong 7 ColorSpace=YMCK 9230>404 lelong 8 ColorSpace=KCMY 9231>404 lelong 9 ColorSpace=KCMYcm 9232>404 lelong 10 ColorSpace=GMCK 9233>404 lelong 11 ColorSpace=GMCS 9234>404 lelong 12 ColorSpace=WHITE 9235>404 lelong 13 ColorSpace=GOLD 9236>404 lelong 14 ColorSpace=SILVER 9237>404 lelong 15 ColorSpace=CIE XYZ 9238>404 lelong 16 ColorSpace=CIE Lab 9239>404 lelong 17 ColorSpace=RGBW 9240>404 lelong 18 ColorSpace=sGray 9241>404 lelong 19 ColorSpace=sRGB 9242>404 lelong 20 ColorSpace=AdobeRGB 9243 9244# Cups Raster image format, Big Endian 92450 string RaS 9246>3 string t Cups Raster version 1, Big Endian 9247>3 string 2 Cups Raster version 2, Big Endian 9248>3 string 3 Cups Raster version 3, Big Endian 9249!:mime application/vnd.cups-raster 9250>0 use \^cups-le 9251 9252 9253# Cups Raster image format, Little Endian 92541 string SaR 9255>0 string t Cups Raster version 1, Little Endian 9256>0 string 2 Cups Raster version 2, Little Endian 9257>0 string 3 Cups Raster version 3, Little Endian 9258!:mime application/vnd.cups-raster 9259>0 use cups-le 9260 9261#------------------------------------------------------------------------------ 9262# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 9263# dact: file(1) magic for DACT compressed files 9264# 92650 long 0x444354C3 DACT compressed data 9266>4 byte >-1 (version %i. 9267>5 byte >-1 $BS%i. 9268>6 byte >-1 $BS%i) 9269>7 long >0 $BS, original size: %i bytes 9270>15 long >30 $BS, block size: %i bytes 9271 9272#------------------------------------------------------------------------------ 9273# $File: database,v 1.61 2021/02/23 00:51:10 christos Exp $ 9274# database: file(1) magic for various databases 9275# 9276# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 9277# 9278# 9279# GDBM magic numbers 9280# Will be maintained as part of the GDBM distribution in the future. 9281# <downsj@teeny.org> 92820 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 9283!:mime application/x-gdbm 92840 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 9285!:mime application/x-gdbm 92860 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 9287!:mime application/x-gdbm 92880 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 9289!:mime application/x-gdbm 92900 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 9291!:mime application/x-gdbm 92920 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 9293!:mime application/x-gdbm 92940 string GDBM GNU dbm 2.x database 9295!:mime application/x-gdbm 9296# 9297# Berkeley DB 9298# 9299# Ian Darwin's file /etc/magic files: big/little-endian version. 9300# 9301# Hash 1.85/1.86 databases store metadata in network byte order. 9302# Btree 1.85/1.86 databases store the metadata in host byte order. 9303# Hash and Btree 2.X and later databases store the metadata in host byte order. 9304 93050 long 0x00061561 Berkeley DB 9306!:mime application/x-dbm 9307>8 belong 4321 9308>>4 belong >2 1.86 9309>>4 belong <3 1.85 9310>>4 belong >0 (Hash, version %d, native byte-order) 9311>8 belong 1234 9312>>4 belong >2 1.86 9313>>4 belong <3 1.85 9314>>4 belong >0 (Hash, version %d, little-endian) 9315 93160 belong 0x00061561 Berkeley DB 9317>8 belong 4321 9318>>4 belong >2 1.86 9319>>4 belong <3 1.85 9320>>4 belong >0 (Hash, version %d, big-endian) 9321>8 belong 1234 9322>>4 belong >2 1.86 9323>>4 belong <3 1.85 9324>>4 belong >0 (Hash, version %d, native byte-order) 9325 93260 long 0x00053162 Berkeley DB 1.85/1.86 9327>4 long >0 (Btree, version %d, native byte-order) 93280 belong 0x00053162 Berkeley DB 1.85/1.86 9329>4 belong >0 (Btree, version %d, big-endian) 93300 lelong 0x00053162 Berkeley DB 1.85/1.86 9331>4 lelong >0 (Btree, version %d, little-endian) 9332 933312 long 0x00061561 Berkeley DB 9334>16 long >0 (Hash, version %d, native byte-order) 933512 belong 0x00061561 Berkeley DB 9336>16 belong >0 (Hash, version %d, big-endian) 933712 lelong 0x00061561 Berkeley DB 9338>16 lelong >0 (Hash, version %d, little-endian) 9339 934012 long 0x00053162 Berkeley DB 9341>16 long >0 (Btree, version %d, native byte-order) 934212 belong 0x00053162 Berkeley DB 9343>16 belong >0 (Btree, version %d, big-endian) 934412 lelong 0x00053162 Berkeley DB 9345>16 lelong >0 (Btree, version %d, little-endian) 9346 934712 long 0x00042253 Berkeley DB 9348>16 long >0 (Queue, version %d, native byte-order) 934912 belong 0x00042253 Berkeley DB 9350>16 belong >0 (Queue, version %d, big-endian) 935112 lelong 0x00042253 Berkeley DB 9352>16 lelong >0 (Queue, version %d, little-endian) 9353 9354# From Max Bowsher. 935512 long 0x00040988 Berkeley DB 9356>16 long >0 (Log, version %d, native byte-order) 935712 belong 0x00040988 Berkeley DB 9358>16 belong >0 (Log, version %d, big-endian) 935912 lelong 0x00040988 Berkeley DB 9360>16 lelong >0 (Log, version %d, little-endian) 9361 9362# 9363# 9364# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 93650 string/b RRD\0 RRDTool DB 9366>4 string/b x version %s 9367 9368>>10 short !0 16bit aligned 9369>>>10 bedouble 8.642135e+130 big-endian 9370>>>>18 short x 32bit long (m68k) 9371 9372>>10 short 0 9373>>>12 long !0 32bit aligned 9374>>>>12 bedouble 8.642135e+130 big-endian 9375>>>>>20 long 0 64bit long 9376>>>>>20 long !0 32bit long 9377>>>>12 ledouble 8.642135e+130 little-endian 9378>>>>>24 long 0 64bit long 9379>>>>>24 long !0 32bit long (i386) 9380>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 9381>>>>>24 short !0 32bit long (arm) 9382 9383>>8 quad 0 64bit aligned 9384>>>16 bedouble 8.642135e+130 big-endian 9385>>>>24 long 0 64bit long (s390x) 9386>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 9387>>>16 ledouble 8.642135e+130 little-endian 9388>>>>28 long 0 64bit long (alpha/amd64/ia64) 9389>>>>28 long !0 32bit long (armel/mipsel) 9390 9391#---------------------------------------------------------------------- 9392# ROOT: file(1) magic for ROOT databases 9393# 93940 string root\0 ROOT file 9395>4 belong x Version %d 9396>33 belong x (Compression: %d) 9397 9398# XXX: Weak magic. 9399# Alex Ott <ott@jet.msk.su> 9400## Paradox file formats 9401#2 leshort 0x0800 Paradox 9402#>0x39 byte 3 v. 3.0 9403#>0x39 byte 4 v. 3.5 9404#>0x39 byte 9 v. 4.x 9405#>0x39 byte 10 v. 5.x 9406#>0x39 byte 11 v. 5.x 9407#>0x39 byte 12 v. 7.x 9408#>>0x04 byte 0 indexed .DB data file 9409#>>0x04 byte 1 primary index .PX file 9410#>>0x04 byte 2 non-indexed .DB data file 9411#>>0x04 byte 3 non-incrementing secondary index .Xnn file 9412#>>0x04 byte 4 secondary index .Ynn file 9413#>>0x04 byte 5 incrementing secondary index .Xnn file 9414#>>0x04 byte 6 non-incrementing secondary index .XGn file 9415#>>0x04 byte 7 secondary index .YGn file 9416#>>>0x04 byte 8 incrementing secondary index .XGn file 9417 9418## XBase database files 9419# updated by Joerg Jenderek at Feb 2013 9420# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 9421# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 9422# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 94230 ubelong&0x0000FFFF <0x00000C20 9424# skip Infocom game Z-machine 9425>2 ubyte >0 9426# skip Androids *.xml 9427>>3 ubyte >0 9428>>>3 ubyte <32 9429# 1 < version VV 9430>>>>0 ubyte >1 9431# skip HELP.CA3 by test for reserved byte ( NULL ) 9432>>>>>27 ubyte 0 9433# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 9434#>>>>>30 ubeshort x 30NULL?%x 9435# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9436>>>>>>24 ubelong&0xffFFFFff >0x01302000 9437# .DBF or .MDX 9438>>>>>>24 ubelong&0xffFFFFff <0x01302001 9439# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 9440>>>>>>>24 ubelong&0xffFFFFff =0 9441# test for 2 reserved NULL bytes,transaction and encryption byte flag 9442>>>>>>>>12 ubelong&0xFFFFfEfE 0 9443# test for MDX flag 9444>>>>>>>>>28 ubyte x 9445>>>>>>>>>28 ubyte&0xf8 0 9446# header size >= 32 9447>>>>>>>>>>8 uleshort >31 9448# skip PIC15736.PCX by test for language driver name or field name 9449>>>>>>>>>>>32 ubyte >0 9450#!:mime application/x-dbf; charset=unknown-8bit ?? 9451#!:mime application/x-dbase 9452>>>>>>>>>>>>0 use xbase-type 9453# database file 9454>>>>>>>>>>>>0 ubyte x \b DBF 9455>>>>>>>>>>>>4 lelong 0 \b, no records 9456>>>>>>>>>>>>4 lelong >0 \b, %d record 9457# plural s appended 9458>>>>>>>>>>>>>4 lelong >1 \bs 9459# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 9460# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 9461>>>>>>>>>>>>10 uleshort x * %d 9462# file size = records * record size + header size 9463>>>>>>>>>>>>1 ubyte x \b, update-date 9464>>>>>>>>>>>>1 use xbase-date 9465# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 9466#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 9467# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 9468>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 9469#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 9470>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 9471>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 9472>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 9473# 1st record offset + 1 = header size 9474>>>>>>>>>>>>8 uleshort >0 9475>>>>>>>>>>>>(8.s+1) ubyte >0 9476>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 9477>>>>>>>>>>>>>(8.s+1) ubyte >0 9478>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 9479# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9480>>>>>>>24 ubelong&0x0133f7ff >0 9481# test for reserved NULL byte 9482>>>>>>>>47 ubyte 0 9483# test for valid TAG key format (0x10 or 0) 9484>>>>>>>>>559 ubyte&0xeF 0 9485# test MM <= 12 9486>>>>>>>>>>45 ubeshort <0x0C20 9487>>>>>>>>>>>45 ubyte >0 9488>>>>>>>>>>>>46 ubyte <32 9489>>>>>>>>>>>>>46 ubyte >0 9490#!:mime application/x-mdx 9491>>>>>>>>>>>>>>0 use xbase-type 9492>>>>>>>>>>>>>>0 ubyte x \b MDX 9493>>>>>>>>>>>>>>1 ubyte x \b, creation-date 9494>>>>>>>>>>>>>>1 use xbase-date 9495>>>>>>>>>>>>>>44 ubyte x \b, update-date 9496>>>>>>>>>>>>>>44 use xbase-date 9497# No.of tags in use (1,2,5,12) 9498>>>>>>>>>>>>>>28 uleshort x \b, %d 9499# No. of entries in tag (0x30) 9500>>>>>>>>>>>>>>25 ubyte x \b/%d tags 9501# Length of tag 9502>>>>>>>>>>>>>>26 ubyte x * %d 9503# 1st tag name_ 9504>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 9505# 2nd tag name 9506#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 9507# 9508# Print the xBase names of different version variants 95090 name xbase-type 9510>0 ubyte <2 9511# 1 < version 9512>0 ubyte >1 9513>>0 ubyte 0x02 FoxBase 9514# FoxBase+/dBaseIII+, no memo 9515>>0 ubyte 0x03 FoxBase+/dBase III 9516!:mime application/x-dbf 9517# dBASE IV no memo file 9518>>0 ubyte 0x04 dBase IV 9519!:mime application/x-dbf 9520# dBASE V no memo file 9521>>0 ubyte 0x05 dBase V 9522!:mime application/x-dbf 9523>>0 ubyte 0x30 Visual FoxPro 9524!:mime application/x-dbf 9525>>0 ubyte 0x31 Visual FoxPro, autoincrement 9526!:mime application/x-dbf 9527# Visual FoxPro, with field type Varchar or Varbinary 9528>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 9529!:mime application/x-dbf 9530# dBASE IV SQL, no memo;dbv memo var size (Flagship) 9531>>0 ubyte 0x43 dBase IV, with SQL table 9532!:mime application/x-dbf 9533# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9534#>>0 ubyte 0x62 dBase IV, with SQL table 9535#!:mime application/x-dbf 9536# dBASE IV, with memo!! 9537>>0 ubyte 0x7b dBase IV, with memo 9538!:mime application/x-dbf 9539# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9540#>>0 ubyte 0x82 dBase IV, with SQL system 9541#!:mime application/x-dbf 9542# FoxBase+/dBaseIII+ with memo .DBT! 9543>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 9544!:mime application/x-dbf 9545# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 9546>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 9547!:mime application/x-dbf 9548# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9549#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 9550#!:mime application/x-dbf 9551# dBASE IV with memo! 9552>>0 ubyte 0x8B dBase IV, with memo .DBT 9553!:mime application/x-dbf 9554# dBase IV with SQL Table,no memo? 9555>>0 ubyte 0x8E dBase IV, with SQL table 9556!:mime application/x-dbf 9557# .dbv and .dbt memo (Flagship)? 9558>>0 ubyte 0xB3 Flagship 9559# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9560#>>0 ubyte 0xCA dBase IV with memo .DBT 9561#!:mime application/x-dbf 9562# dBASE IV with SQL table, with memo .DBT 9563>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 9564!:mime application/x-dbf 9565# HiPer-Six format;Clipper SIX, with SMT memo file 9566>>0 ubyte 0xE5 Clipper SIX with memo 9567!:mime application/x-dbf 9568# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9569#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 9570#!:mime application/x-dbf 9571>>0 ubyte 0xF5 FoxPro with memo 9572!:mime application/x-dbf 9573# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9574#>>0 ubyte 0xFA FoxPro 2.x, with memo 9575#!:mime application/x-dbf 9576# unknown version (should not happen) 9577>>0 default x xBase 9578!:mime application/x-dbf 9579>>>0 ubyte x (0x%x) 9580# flags in version byte 9581# DBT flag (with dBASE III memo .DBT)!! 9582# >>0 ubyte&0x80 >0 DBT_FLAG=%x 9583# memo flag ?? 9584# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 9585# SQL flag ?? 9586# >>0 ubyte&0x70 >0 SQL_FLAG=%x 9587# test and print the date of xBase .DBF .MDX 95880 name xbase-date 9589# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 9590>0 ubelong x 9591>1 ubyte <13 9592>>1 ubyte >0 9593>>>2 ubyte >0 9594>>>>2 ubyte <32 9595>>>>>0 ubyte x 9596# YY is interpreted as 20YY or 19YY 9597>>>>>>0 ubyte <100 \b %.2d 9598# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 9599>>>>>>0 ubyte >99 \b %d 9600>>>>>1 ubyte x \b-%d 9601>>>>>2 ubyte x \b-%d 9602 9603# dBase memo files .DBT or .FPT 9604# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 960516 ubyte <4 9606>16 ubyte !2 9607>>16 ubyte !1 9608# next free block index is positive 9609>>>0 ulelong >0 9610# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 9611>>>>17 ubelong&0xFFfdFEff 0x00000000 9612# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 9613>>>>>20 ubelong&0xFF01209B 0x00000000 9614# dBASE III 9615>>>>>>16 ubyte 3 9616# dBASE III DBT 9617>>>>>>>0 use dbase3-memo-print 9618# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 9619>>>>>>16 ubyte 0 9620# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 9621>>>>>>>20 uleshort 0 9622# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 9623>>>>>>>>8 ulong =0 9624>>>>>>>>>6 ubeshort >0 9625# skip emacs.PIF 9626>>>>>>>>>>4 ushort 0 9627# check for valid FoxPro field type 9628>>>>>>>>>>>512 ubelong <3 9629>>>>>>>>>>>>0 use foxpro-memo-print 9630# dBASE III DBT , garbage 9631# skip WORD1XW.DOC with improbably high free block index 9632>>>>>>>>>0 ulelong <0x400000 9633# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item 9634>>>>>>>>>>513 ubyte >037 9635# unusual dBASE III DBT like adressen.dbt 9636>>>>>>>>>>>0 use dbase3-memo-print 9637# dBASE III DBT like angest.dbt, or garbage PCX DBF 9638>>>>>>>>8 ubelong !0 9639# skip PCX and some DBF by test for for reserved NULL bytes 9640>>>>>>>>>510 ubeshort 0 9641# skip bad symples with improbably high free block index above 2 GiB file limit 9642>>>>>>>>>>0 ulelong <0x400000 9643# skip AI070GEP.EPS by printable 1st character of 1st memo item 9644>>>>>>>>>>>512 ubyte >037 9645# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character 9646>>>>>>>>>>>>513 ubyte >037 9647>>>>>>>>>>>>>0 use dbase3-memo-print 9648# dBASE IV DBT with positive block size 9649>>>>>>>20 uleshort >0 9650# dBASE IV DBT with valid block length like 512, 1024 9651# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 9652# skip also 3600h 3E00h size 9653>>>>>>>>20 uleshort&0xE00f 0 9654>>>>>>>>>0 use dbase4-memo-print 9655 9656# Print the information of dBase III DBT memo file 96570 name dbase3-memo-print 9658>0 ubyte x dBase III DBT 9659!:mime application/x-dbt 9660!:ext dbt 9661# instead 3 as version number 0 for unusual examples like biblio.dbt 9662>16 ubyte !3 \b, version number %u 9663# Number of next available block for appending data 9664#>0 lelong =0 \b, next free block index %u 9665>0 lelong !0 \b, next free block index %u 9666# no positive block length 9667#>20 uleshort =0 \b, block length %u 9668>20 uleshort !0 \b, block length %u 9669# dBase III memo field terminated by \032\032 9670>512 string >\0 \b, 1st item "%s" 9671# https://www.clicketyclick.dk/databases/xbase/format/dbt.html 9672# Print the information of dBase IV DBT memo file 96730 name dbase4-memo-print 9674>0 lelong x dBase IV DBT 9675!:mime application/x-dbt 9676!:ext dbt 9677# 8 character shorted main name of corresponding dBASE IV DBF file 9678>8 ubelong >0x20000000 9679# skip unusual like for angest.dbt 9680>>20 uleshort >0 9681>>>8 string >\0 \b of %-.8s.DBF 9682# value 0 implies 512 as size 9683#>4 ulelong =0 \b, blocks size %u 9684# size of blocks not reliable like 0x2020204C in angest.dbt 9685>4 ulelong !0 9686>>4 ulelong&0x0000003f 0 \b, blocks size %u 9687# dBase IV DBT with positive block length (found 512 , 1024) 9688>20 uleshort >0 \b, block length %u 9689# next available block 9690#>0 lelong =0 \b, next free block index %u 9691>0 lelong !0 \b, next free block index %u 9692>20 uleshort >0 9693>>(20.s) ubelong x 9694>>>&-4 use dbase4-memofield-print 9695# unusual dBase IV DBT without block length (implies 512 as length) 9696>20 uleshort =0 9697>>512 ubelong x 9698>>>&-4 use dbase4-memofield-print 9699# Print the information of dBase IV memo field 97000 name dbase4-memofield-print 9701# free dBase IV memo field 9702>0 ubelong !0xFFFF0800 9703>>0 lelong x \b, next free block %u 9704>>4 lelong x \b, next used block %u 9705# used dBase IV memo field 9706>0 ubelong =0xFFFF0800 9707# length of memo field 9708>>4 lelong x \b, field length %d 9709>>>8 string >\0 \b, 1st used item "%s" 9710# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm 9711# Print the information of FoxPro FPT memo file 97120 name foxpro-memo-print 9713>0 belong x FoxPro FPT 9714!:mime application/x-fpt 9715!:ext fpt 9716# Size of blocks for FoxPro ( 64,256 ) 9717>6 ubeshort x \b, blocks size %u 9718# next available block 9719#>0 belong =0 \b, next free block index %u 9720>0 belong !0 \b, next free block index %u 9721# field type ( 0~picture, 1~memo, 2~object ) 9722>512 ubelong <3 \b, field type %u 9723# length of memo field 9724>512 ubelong 1 9725>>516 belong >0 \b, field length %d 9726>>>520 string >\0 \b, 1st item "%s" 9727 9728# TODO: 9729# DBASE index file *.NDX 9730# DBASE Compound Index file *.CDX 9731# dBASE IV Printer Driver *.PRF 9732## End of XBase database stuff 9733 9734# MS Access database 97354 string Standard\ Jet\ DB Microsoft Access Database 9736!:mime application/x-msaccess 97374 string Standard\ ACE\ DB Microsoft Access Database 9738!:mime application/x-msaccess 9739 9740# From: Joerg Jenderek 9741# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 9742# Reference: https://github.com/libyal/libesedb/archive/master.zip 9743# libesedb-master/documentation/ 9744# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 9745# Note: also known as "JET Blue". Used by numerous Windows components such as 9746# Windows Search, Mail, Exchange and Active Directory. 97474 ubelong 0xefcdab89 9748# unknown1 9749>132 ubelong 0 Extensible storage engine 9750!:mime application/x-ms-ese 9751# file_type 0~database 1~stream 9752>>12 ulelong 0 DataBase 9753# Security DataBase (sdb) 9754!:ext edb/sdb 9755>>12 ulelong 1 STreaMing 9756!:ext stm 9757# format_version 620h 9758>>8 uleshort x \b, version 0x%x 9759>>10 uleshort >0 revision 0x%4.4x 9760>>0 ubelong x \b, checksum 0x%8.8x 9761# Page size 4096 8192 32768 9762>>236 ulequad x \b, page size %lld 9763# database_state 9764>>52 ulelong 1 \b, JustCreated 9765>>52 ulelong 2 \b, DirtyShutdown 9766#>>52 ulelong 3 \b, CleanShutdown 9767>>52 ulelong 4 \b, BeingConverted 9768>>52 ulelong 5 \b, ForceDetach 9769# Windows NT major version when the databases indexes were updated. 9770>>216 ulelong x \b, Windows version %d 9771# Windows NT minor version 9772>>220 ulelong x \b.%d 9773 9774# From: Joerg Jenderek 9775# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 9776# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 97778 string sdbf 9778>7 ubyte 0 9779# TAG_TYPE_LIST+TAG_INDEXES 9780>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 9781# version? 2 3 9782#>>>0 ulelong x \b, version %d 9783!:mime application/x-ms-sdb 9784!:ext sdb 9785 9786# TDB database from Samba et al - Martin Pool <mbp@samba.org> 97870 string TDB\ file TDB database 9788>32 lelong 0x2601196D version 6, little-endian 9789>>36 lelong x hash size %d bytes 9790 9791# SE Linux policy database 97920 lelong 0xf97cff8c SE Linux policy 9793>16 lelong x v%d 9794>20 lelong 1 MLS 9795>24 lelong x %d symbols 9796>28 lelong x %d ocons 9797 9798# ICE authority file data (Wolfram Kleff) 97992 string ICE ICE authority data 9800 9801# X11 Xauthority file (Wolfram Kleff) 980210 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980311 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980412 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980513 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980614 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980715 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980816 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980917 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 981018 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 9811 9812# From: Maxime Henrion <mux@FreeBSD.org> 9813# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 98140 string PGDMP PostgreSQL custom database dump 9815>5 byte x - v%d 9816>6 byte x \b.%d 9817>5 beshort <0x101 \b-0 9818>5 beshort >0x100 9819>>7 byte x \b-%d 9820 9821# Type: Advanced Data Format (ADF) database 9822# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 9823# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 98240 string @(#)ADF\ Database CGNS Advanced Data Format 9825 9826# Tokyo Cabinet magic data 9827# http://tokyocabinet.sourceforge.net/index.html 98280 string ToKyO\ CaBiNeT\n Tokyo Cabinet 9829>14 string x \b (%s) 9830>32 byte 0 \b, Hash 9831!:mime application/x-tokyocabinet-hash 9832>32 byte 1 \b, B+ tree 9833!:mime application/x-tokyocabinet-btree 9834>32 byte 2 \b, Fixed-length 9835!:mime application/x-tokyocabinet-fixed 9836>32 byte 3 \b, Table 9837!:mime application/x-tokyocabinet-table 9838>33 byte &1 \b, [open] 9839>33 byte &2 \b, [fatal] 9840>34 byte x \b, apow=%d 9841>35 byte x \b, fpow=%d 9842>36 byte &0x01 \b, [large] 9843>36 byte &0x02 \b, [deflate] 9844>36 byte &0x04 \b, [bzip] 9845>36 byte &0x08 \b, [tcbs] 9846>36 byte &0x10 \b, [excodec] 9847>40 lequad x \b, bnum=%lld 9848>48 lequad x \b, rnum=%lld 9849>56 lequad x \b, fsiz=%lld 9850 9851# Type: QDBM Quick Database Manager 9852# From: Benoit Sibaud <bsibaud@april.org> 98530 string \\[depot\\]\n\f Quick Database Manager, little endian 98540 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 9855 9856# Type: TokyoCabinet database 9857# URL: http://tokyocabinet.sourceforge.net/ 9858# From: Benoit Sibaud <bsibaud@april.org> 98590 string ToKyO\ CaBiNeT\n TokyoCabinet database 9860>14 string x (version %s) 9861 9862# From: Stephane Blondon https://www.yaal.fr 9863# Database file for Zope (done by FileStorage) 98640 string FS21 Zope Object Database File Storage v3 (data) 98650 string FS30 Zope Object Database File Storage v4 (data) 9866 9867# Cache file for the database of Zope (done by ClientStorage) 98680 string ZEC3 Zope Object Database Client Cache File (data) 9869 9870# IDA (Interactive Disassembler) database 98710 string IDA1 IDA (Interactive Disassembler) database 9872 9873# Hopper (reverse engineering tool) https://www.hopperapp.com/ 98740 string hopperdb Hopper database 9875 9876# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 9877# Reference: http://www.provue.com/Panorama/ 9878# From: Joerg Jenderek 9879# NOTE: test only versions 4 and 6.0 with Windows 9880# length of Panorama database name 98815 ubyte >0 9882# look after database name for "some" null bits 9883>(5.B+7) ubelong&0xF3ffF000 0 9884# look for first keyword 9885>>&1 search/2 DESIGN Panorama database 9886#!:mime application/x-panorama-database 9887!:apple KASXZEPD 9888!:ext pan 9889# database name 9890>>>5 pstring x \b, "%s" 9891 9892# 9893# 9894# askSam Database by Stefan A. Haubenthal <polluks@web.de> 98950 string askw40\0 askSam DB 9896 9897# 9898# 9899# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 99000 string MBSTV\040 MUIbase DB 9901>6 string x version %s 9902 9903# 9904# CDB database 99050 string NBCDB\012 NetBSD Constant Database 9906>7 byte x \b, version %d 9907>8 string x \b, for '%s' 9908>24 lelong x \b, datasize %d 9909>28 lelong x \b, entries %d 9910>32 lelong x \b, index %d 9911>36 lelong x \b, seed %#x 9912 9913# 9914# Redis RDB - https://redis.io/topics/persistence 99150 string REDIS Redis RDB file, 9916>5 regex [0-9][0-9][0-9][0-9] version %s 9917 9918# Mork database. 9919# Used by older versions of Mozilla Suite and Firefox, 9920# and current versions of Thunderbird. 9921# From: David Korth <gerbilsoft@gerbilsoft.com> 99220 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 9923>23 string x \b, version %.3s 9924 9925# URL: https://en.wikipedia.org/wiki/Management_Information_Format 9926# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf 9927# From: Joerg Jenderek 9928# Note: only tested with monitor asset reports of Dell Display Manager 9929# skip start like Language=fr|CA|iso8859-1 99300 search/27/C Start\040Component DMI Management Information Format 9931#!:mime text/plain 9932!:mime text/x-dmtf-mif 9933!:ext mif 9934 9935 9936#------------------------------------------------------------------------------ 9937# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $ 9938# 9939# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 9940# Pratik Shrivastava <pratikshrivastava23@gmail.com> 9941# 9942# file formats: https://cn.dataone.org/cn/v2/formats 9943#------------------------------------------------------------------------------ 9944 9945# EML (Ecological Metadata Language Format) 99460 string <?xml 9947>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s 9948 9949# onedcx (DataONE Dublin Core Extended v1.0) 9950>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 9951 9952# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 9953# version 001-1998) 9954>&0 regex fgdc FGDC-STD-001-1998 9955 9956# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 9957>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 9958 9959# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 9960>&0 regex isotc211 9961>>&0 regex eng;USA https://www.isotc211.org/2005/gmd 9962 9963# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 9964>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa 9965 9966# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 9967>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea 9968!:mime text/xml 9969 9970 9971# Object Reuse and Exchange Vocabulary 99720 string <?xml 9973>&0 regex rdf 9974>>&0 regex openarchives https://www.openarchives.org/ore/terms 9975!:mime application/rdf+xml 9976 9977 9978# Dryad Metadata Application Profile Version 3.1 99790 string <DryadData 9980>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1 9981!:mime text/xml 9982 9983#------------------------------------------------------------------------------ 9984# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ 9985# dppf: Maxis Database Packed Files, the stored data file format used by all 9986# Maxis games after the Sims: http://wiki.niotso.org/DBPF 9987# https://www.wiki.sc4devotion.com/index.php?title=DBPF 9988# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 99890 string DBPF Maxis Database Packed File 9990>4 ulelong x \b, version: %u. 9991>>8 ulelong x \b%u 9992>>>36 ulelong x \b, files: %u 9993>>24 ledate !0 \b, created: %s 9994>>28 ledate !0 \b, modified: %s 9995!:ext dbpf/package/dat/sc4 9996!:mime application/x-maxis-dbpf 9997#------------------------------------------------------------------------------ 9998# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $ 9999# der: file(1) magic for DER encoded files 10000# 10001 10002# Certificate information piece 100030 name certinfo 10004>0 der seq 10005>>&0 der set 10006>>>&0 der seq 10007>>>>&0 der obj_id3=550406 10008>>>>&0 der prt_str=x \b, countryName=%s 10009>>&0 der set 10010>>>&0 der seq 10011>>>>&0 der obj_id3=550408 10012>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 10013>>&0 der set 10014>>>&0 der seq 10015>>>>&0 der obj_id3=55040a 10016>>>>&0 der utf8_str=x \b, organizationName=%s 10017>>&0 der set 10018>>>&0 der seq 10019>>>>&0 der obj_id3=550403 10020>>>>&0 der utf8_str=x \b, commonName=%s 10021>>&0 der seq 10022 10023# Certificate requests 100240 der seq 10025>&0 der seq 10026>>&0 der int1=00 DER Encoded Certificate request 10027>>&0 use certinfo 10028 10029# Key Pairs 100300 der seq 10031>&0 der int1=00 10032>&0 der int65=x 10033>&0 der int3=010001 DER Encoded Key Pair, 512 bits 10034 100350 der seq 10036>&0 der int1=00 10037>&0 der int129=x 10038>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 10039 100400 der seq 10041>&0 der int1=00 10042>&0 der int257=x 10043>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 10044 100450 der seq 10046>&0 der int1=00 10047>&0 der int513=x 10048>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 10049 100500 der seq 10051>&0 der int1=00 10052>&0 der int1025=x 10053>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 10054 100550 der seq 10056>&0 der int1=00 10057>&0 der int2049=x 10058>&0 der int3=010001 DER Encoded Key Pair, 16k bits 10059 100600 der seq 10061>&0 der int1=00 10062>&0 der int4097=x 10063>&0 der int3=010001 DER Encoded Key Pair, 32k bits 10064 10065# Certificates 100660 der seq 10067>&0 der seq 10068>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 10069>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 10070>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 10071>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 10072>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 10073>>&0 der int2=0dff DER Encoded Certificate, 16k bits 10074>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 10075>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 10076>>&0 der seq 10077>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 10078>>>&0 der obj_id9=x \b, ? Encryption (%s) 10079>>>&0 der null 10080>>&0 der seq 10081>>>&0 der set 10082>>>>&0 der seq 10083>>>>>&0 der obj_id3=550406 10084>>>>>&0 der prt_str=x \b, countryName=%s 10085>>>&0 der set 10086>>>>&0 der seq 10087>>>>>&0 der obj_id3=550408 10088>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 10089>>>&0 der set 10090>>>>&0 der seq 10091>>>>>&0 der obj_id3=550407 10092>>>>>&0 der prt_str=x \b, localityName=%s 10093>>>&0 der set 10094>>>>&0 der seq 10095>>>>>&0 der obj_id3=55040a 10096>>>>>&0 der prt_str=x \b, organizationName=%s 10097>>>&0 der set 10098>>>>&0 der seq 10099>>>>>&0 der obj_id3=55040b 10100>>>>>&0 der prt_str=x \b, organizationUnitName=%s 10101>>>&0 der set 10102>>>>&0 der seq 10103>>>>>&0 der obj_id3=550403 10104>>>>>&0 der prt_str=x \b, commonName=%s 10105>>>&0 der set 10106>>>>&0 der seq 10107>>>>>&0 der obj_id9=2a864886f70d010901 10108>>>>>&0 der ia5_str=x \b, emailAddress=%s 10109>>&0 der seq 10110>>>&0 der utc_time=x \b, utcTime=%s 10111>>>&0 der utc_time=x \b, utcTime=%s 10112>>&0 use certinfo 10113 101140 der seq 10115>&0 der seq 10116>>&0 der eoc 10117>>>&0 der int1=02 Certificate, Version=3 10118>>>&0 der int1=x Certificate, Version=%s 10119>>&0 der int9=x \b, Serial=%s 10120>>&0 der seq 10121>>>&0 der obj_id9=2a864886f70d01010b 10122>>>&0 der null 10123>>&0 der seq 10124>>>&0 der set 10125>>>>&0 der seq 10126>>>>>&0 der obj_id3=550403 10127>>>>>&0 der utf8_str=x \b, Issuer=%s 10128>>&0 der seq 10129>>>&0 der utc_time=x \b, not-valid-before=%s 10130>>>&0 der utc_time=x \b, not-valid-after=%s 10131>>&0 der seq 10132>>>&0 der set 10133>>>>&0 der seq 10134>>>>>&0 der obj_id3=550403 10135>>>>>&0 der utf8_str=x \b, Subject=%s 10136 10137#------------------------------------------------------------------------------ 10138# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 10139# diamond: file(1) magic for Diamond system 10140# 10141# ... diamond is a multi-media mail and electronic conferencing system.... 10142# 10143# XXX - I think it was either renamed Slate, or replaced by Slate.... 10144# 10145# The full deal is too long... 10146#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 101470 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 10148 10149#------------------------------------------------------------------------------ 10150# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $ 10151# dif: file(1) magic for DIF text files 10152 10153#------------------------------------------------------------------------------ 10154# From: Joerg Jenderek 10155# URL: http://en.wikipedia.org/wiki/Data_Interchange_Format 10156# http://fileformats.archiveteam.org/wiki/Data_Interchange_Format 10157# Note: called by TrID "Data Interchange Format", 10158# by DROID x-fmt/368 "VisiCalc Database" 101590 string TABLE 10160# skip text starting with TABLE by looking for numeric version on 2nd line 10161>6 search/2 0, 10162# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning 10163>>27 search/128 TUPLES Data Interchange Format 10164# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html 10165#!:mime application/x-dif-spreadsheet Gnumeric 10166# https://github.com/LibreOffice/online/blob/master/discovery.xml 10167#!:mime application/x-dif-document LibreOffice 10168# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats 10169!:mime application/x-dif 10170# https://extension.nirsoft.net/dif 10171#!:mime application/vnd.ms-excel 10172#!:mime text/plain 10173!:ext dif 10174# look for double quote 0x22 on 3rd line 10175>>>10 search/3 " 10176# skip if next character also double quote 10177>>>>&0 ubyte !0x22 \b, generator or table name 10178# comment like EXCEL, pwm enclosed in double quotes 10179>>>>>&-2 string x %s 10180 10181 10182#------------------------------------------------------------------------------ 10183# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $ 10184# diff: file(1) magic for diff(1) output 10185# 101860 search/1 diff\040 diff output text 10187!:mime text/x-diff 101880 search/1 ***\040 10189>&0 search/1024 \n---\040 context diff output text 10190!:mime text/x-diff 101910 search/1 Only\040in\040 diff output text 10192!:mime text/x-diff 101930 search/1 Common\040subdirectories:\040 diff output text 10194!:mime text/x-diff 10195 101960 search/1 Index: RCS/CVS diff output text 10197!:mime text/x-diff 10198 10199# bsdiff: file(1) magic for bsdiff(1) output 102000 string/b BSDIFF40 bsdiff(1) patch file 10201 10202 10203# unified diff 102040 search/4096 ---\040 10205>&0 search/1024 \n 10206>>&0 search/1 +++\040 10207>>>&0 search/1024 \n 10208>>>>&0 search/1 @@ unified diff output text 10209!:mime text/x-diff 10210!:strength + 90 10211 10212# librsync -- the library for network deltas 10213# 10214# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 10215# this file. 10216# 102170 belong 0x72730236 rdiff network-delta data 10218 102190 belong 0x72730136 rdiff network-delta signature data 10220>4 belong x (block length=%d, 10221>8 belong x signature strength=%d) 10222 10223#------------------------------------------------------------------------------ 10224# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 10225# Digital UNIX - Info 10226# 102270 string =!<arch>\n________64E Alpha archive 10228>22 string X -- out of date 10229# 10230 102310 leshort 0603 10232>24 leshort 0410 COFF format alpha pure 10233>24 leshort 0413 COFF format alpha demand paged 10234>>22 leshort&030000 !020000 executable 10235>>22 leshort&020000 !0 dynamically linked 10236>>16 lelong !0 not stripped 10237>>16 lelong 0 stripped 10238>>27 byte x - version %d 10239>>26 byte x \b.%d 10240>>28 byte x \b-%d 10241>24 leshort 0407 COFF format alpha object 10242>>22 leshort&030000 020000 shared library 10243>>27 byte x - version %d 10244>>26 byte x \b.%d 10245>>28 byte x \b-%d 10246 10247# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 10248# 10249# The actual magic number is just "Core", followed by a 2-byte version 10250# number; however, treating any file that begins with "Core" as a Digital 10251# UNIX core dump file may produce too many false hits, so we include one 10252# byte of the version number as well; DU 5.0 appears only to be up to 10253# version 2. 10254# 102550 string Core\001 Alpha COFF format core dump (Digital UNIX) 10256>24 string >\0 \b, from '%s' 102570 string Core\002 Alpha COFF format core dump (Digital UNIX) 10258>24 string >\0 \b, from '%s' 10259# 10260# The next is incomplete, we could tell more about this format, 10261# but its not worth it. 102620 leshort 0x188 Alpha compressed COFF 102630 leshort 0x18f Alpha u-code object 10264# 10265# 10266# Some other interesting Digital formats, 102670 string \377\377\177 ddis/ddif 102680 string \377\377\174 ddis/dots archive 102690 string \377\377\176 ddis/dtif table data 102700 string \033c\033 LN03 output 102710 long 04553207 X image 10272# 102730 string =!<PDF>!\n profiling data file 10274# 10275# Locale data tables (MIPS and Alpha). 10276# 102770 short 0x0501 locale data table 10278>6 short 0x24 for MIPS 10279>6 short 0x40 for Alpha 10280 10281#------------------------------------------------------------------------------ 10282# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ 10283# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 10284# from https://www.atsc.org/standards/a_52a.pdf 10285# corrections, additions, etc. are always welcome! 10286# 10287# syncword 102880 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 10289# Proposed audio/ac3 RFC/4184 10290!:mime audio/vnd.dolby.dd-raw 10291# fscod 10292>4 byte&0xc0 = 0x00 48 kHz, 10293>4 byte&0xc0 = 0x40 44.1 kHz, 10294>4 byte&0xc0 = 0x80 32 kHz, 10295# is this one used for 96 kHz? 10296>4 byte&0xc0 = 0xc0 reserved frequency, 10297# 10298>5 byte&0x07 = 0x00 \b, complete main (CM) 10299>5 byte&0x07 = 0x01 \b, music and effects (ME) 10300>5 byte&0x07 = 0x02 \b, visually impaired (VI) 10301>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 10302>5 byte&0x07 = 0x04 \b, dialogue (D) 10303>5 byte&0x07 = 0x05 \b, commentary (C) 10304>5 byte&0x07 = 0x06 \b, emergency (E) 10305>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 10306>5 beshort&0x07e0 >0x0720 \b, karaoke 10307# acmod 10308>6 byte&0xe0 = 0x00 1+1 front, 10309>>6 byte&0x10 = 0x10 LFE on, 10310>6 byte&0xe0 = 0x20 1 front/0 rear, 10311>>6 byte&0x10 = 0x10 LFE on, 10312>6 byte&0xe0 = 0x40 2 front/0 rear, 10313# dsurmod (for stereo only) 10314>>6 byte&0x18 = 0x00 Dolby Surround not indicated 10315>>6 byte&0x18 = 0x08 not Dolby Surround encoded 10316>>6 byte&0x18 = 0x10 Dolby Surround encoded 10317>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 10318>>6 byte&0x04 = 0x04 LFE on, 10319>6 byte&0xe0 = 0x60 3 front/0 rear, 10320>>6 byte&0x04 = 0x04 LFE on, 10321>6 byte&0xe0 = 0x80 2 front/1 rear, 10322>>6 byte&0x04 = 0x04 LFE on, 10323>6 byte&0xe0 = 0xa0 3 front/1 rear, 10324>>6 byte&0x01 = 0x01 LFE on, 10325>6 byte&0xe0 = 0xc0 2 front/2 rear, 10326>>6 byte&0x04 = 0x04 LFE on, 10327>6 byte&0xe0 = 0xe0 3 front/2 rear, 10328>>6 byte&0x01 = 0x01 LFE on, 10329# 10330>4 byte&0x3e = 0x00 \b, 32 kbit/s 10331>4 byte&0x3e = 0x02 \b, 40 kbit/s 10332>4 byte&0x3e = 0x04 \b, 48 kbit/s 10333>4 byte&0x3e = 0x06 \b, 56 kbit/s 10334>4 byte&0x3e = 0x08 \b, 64 kbit/s 10335>4 byte&0x3e = 0x0a \b, 80 kbit/s 10336>4 byte&0x3e = 0x0c \b, 96 kbit/s 10337>4 byte&0x3e = 0x0e \b, 112 kbit/s 10338>4 byte&0x3e = 0x10 \b, 128 kbit/s 10339>4 byte&0x3e = 0x12 \b, 160 kbit/s 10340>4 byte&0x3e = 0x14 \b, 192 kbit/s 10341>4 byte&0x3e = 0x16 \b, 224 kbit/s 10342>4 byte&0x3e = 0x18 \b, 256 kbit/s 10343>4 byte&0x3e = 0x1a \b, 320 kbit/s 10344>4 byte&0x3e = 0x1c \b, 384 kbit/s 10345>4 byte&0x3e = 0x1e \b, 448 kbit/s 10346>4 byte&0x3e = 0x20 \b, 512 kbit/s 10347>4 byte&0x3e = 0x22 \b, 576 kbit/s 10348>4 byte&0x3e = 0x24 \b, 640 kbit/s 10349 10350#------------------------------------------------------------------------------ 10351# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 10352# dump: file(1) magic for dump file format--for new and old dump filesystems 10353# 10354# We specify both byte orders in order to recognize byte-swapped dumps. 10355# 103560 name new-dump-be 10357>4 bedate x This dump %s, 10358>8 bedate x Previous dump %s, 10359>12 belong >0 Volume %d, 10360>692 belong 0 Level zero, type: 10361>692 belong >0 Level %d, type: 10362>0 belong 1 tape header, 10363>0 belong 2 beginning of file record, 10364>0 belong 3 map of inodes on tape, 10365>0 belong 4 continuation of file record, 10366>0 belong 5 end of volume, 10367>0 belong 6 map of inodes deleted, 10368>0 belong 7 end of medium (for floppy), 10369>676 string >\0 Label %s, 10370>696 string >\0 Filesystem %s, 10371>760 string >\0 Device %s, 10372>824 string >\0 Host %s, 10373>888 belong >0 Flags %x 10374 103750 name old-dump-be 10376#>4 bedate x This dump %s, 10377#>8 bedate x Previous dump %s, 10378>12 belong >0 Volume %d, 10379>692 belong 0 Level zero, type: 10380>692 belong >0 Level %d, type: 10381>0 belong 1 tape header, 10382>0 belong 2 beginning of file record, 10383>0 belong 3 map of inodes on tape, 10384>0 belong 4 continuation of file record, 10385>0 belong 5 end of volume, 10386>0 belong 6 map of inodes deleted, 10387>0 belong 7 end of medium (for floppy), 10388>676 string >\0 Label %s, 10389>696 string >\0 Filesystem %s, 10390>760 string >\0 Device %s, 10391>824 string >\0 Host %s, 10392>888 belong >0 Flags %x 10393 103940 name ufs2-dump-be 10395>896 beqdate x This dump %s, 10396>904 beqdate x Previous dump %s, 10397>12 belong >0 Volume %d, 10398>692 belong 0 Level zero, type: 10399>692 belong >0 Level %d, type: 10400>0 belong 1 tape header, 10401>0 belong 2 beginning of file record, 10402>0 belong 3 map of inodes on tape, 10403>0 belong 4 continuation of file record, 10404>0 belong 5 end of volume, 10405>0 belong 6 map of inodes deleted, 10406>0 belong 7 end of medium (for floppy), 10407>676 string >\0 Label %s, 10408>696 string >\0 Filesystem %s, 10409>760 string >\0 Device %s, 10410>824 string >\0 Host %s, 10411>888 belong >0 Flags %x 10412 1041324 belong 60012 new-fs dump file (big endian), 10414>0 use new-dump-be 10415 1041624 belong 60011 old-fs dump file (big endian), 10417>0 use old-dump-be 10418 1041924 lelong 60012 new-fs dump file (little endian), 10420# to correctly recognize '*.mo' GNU message catalog (little endian) 10421!:strength - 15 10422>0 use \^new-dump-be 10423 1042424 lelong 60011 old-fs dump file (little endian), 10425>0 use \^old-dump-be 10426 10427 1042824 belong 0x19540119 new-fs dump file (ufs2, big endian), 10429>0 use ufs2-dump-be 10430 1043124 lelong 0x19540119 new-fs dump file (ufs2, little endian), 10432>0 use \^ufs2-dump-be 10433 1043418 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 10435>2 medate x Previous dump %s, 10436>6 medate x This dump %s, 10437>10 leshort >0 Volume %d, 10438>0 leshort 1 tape header. 10439>0 leshort 2 beginning of file record. 10440>0 leshort 3 map of inodes on tape. 10441>0 leshort 4 continuation of file record. 10442>0 leshort 5 end of volume. 10443>0 leshort 6 map of inodes deleted. 10444>0 leshort 7 end of medium (for floppy). 10445 10446#------------------------------------------------------------------------------ 10447# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ 10448# Dyadic: file(1) magic for Dyalog APL. 10449# 10450# updated by Joerg Jenderek at Oct 2013 10451# https://en.wikipedia.org/wiki/Dyalog_APL 10452# https://www.dyalog.com/ 10453# .DXV Dyalog APL External Variable 10454# .DIN Dyalog APL Input Table 10455# .DOT Dyalog APL Output Table 10456# .DFT Dyalog APL Format File 104570 ubeshort&0xFF60 0xaa00 10458# skip biblio.dbt 10459>1 byte !4 10460# real Dyalog APL have non zero version numbers like 7.3 or 13.4 10461>>2 ubeshort >0x0000 Dyalog APL 10462>>>1 byte 0x00 aplcore 10463#>>>1 byte 0x00 incomplete workspace 10464# *.DCF Dyalog APL Component File 10465>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 10466#>>>1 byte 0x01 component file 10467>>>1 byte 0x02 external variable exclusive 10468#>>>1 byte 0x02 external variable 10469# *.DWS Dyalog APL Workspace 10470>>>1 byte 0x03 workspace 10471>>>>7 byte&0x28 0x00 32-bit 10472>>>>7 byte&0x28 0x20 64-bit 10473>>>>7 byte&0x0c 0x00 classic 10474>>>>7 byte&0x0c 0x04 unicode 10475>>>>7 byte&0x88 0x00 big-endian 10476>>>>7 byte&0x88 0x80 little-endian 10477>>>1 byte 0x06 external variable shared 10478# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 10479>>>1 byte 0x07 session 10480>>>1 byte 0x08 mapped file 32-bit 10481>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 10482>>>1 byte 0x0a mapped file 64-bit 10483>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 10484>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 10485>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 10486>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 10487>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 10488>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 10489>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 10490>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 10491>>>1 byte 0x13 component file 32-bit non-journaled checksummed 10492>>>1 byte 0x14 component file 64-bit non-journaled checksummed 10493>>>1 byte 0x15 component file under construction 10494>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 10495>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 10496>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 10497>>>1 byte 0x19 external workspace 10498>>>1 byte 0x80 DDB 10499>>>2 byte x version %d 10500>>>3 byte x \b.%d 10501#>>>2 byte x type %d 10502#>>>3 byte x subtype %d 10503 10504# *.DXF Dyalog APL Transfer File 105050 short 0x6060 Dyalog APL transfer 10506 10507#------------------------------------------------------------------------------ 10508# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ 10509# ebml: file(1) magic for various Extensible Binary Meta Language 10510# https://www.matroska.org/technical/specs/index.html#track 105110 belong 0x1a45dfa3 EBML file 10512>4 search/b/100 \102\202 10513>>&1 string x \b, creator %.8s 10514 10515#------------------------------------------------------------------------------ 10516# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ 10517# edid: file(1) magic for EDID dump files 10518 105190 quad 0x00ffffffffffff00 Extended display identification data dump 10520!:mime application/x-edid-dump 10521>18 byte 0x01 Version 1 10522>>19 byte <0x04 \b.%d 10523>18 byte 0x02 Version 2 10524>>19 byte 0x00 \b.0 10525 10526#------------------------------------------------------------------------------ 10527# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $ 10528# T602 editor documents 10529# by David Necas <yeti@physics.muni.cz> 105300 string @CT\ T602 document data, 10531>4 string 0 Kamenicky 10532>4 string 1 CP 852 10533>4 string 2 KOI8-CS 10534>4 string >2 unknown encoding 10535 10536# Vi IMproved Encrypted file 10537# by David Necas <yeti@physics.muni.cz> 10538# updated by Osman Surkatty 105390 string VimCrypt~ Vim encrypted file data 10540>9 string 01! with zip cryptmethod 10541>9 string 02! with blowfish cryptmethod 10542>9 string 03! with blowfish2 cryptmethod 10543 105440 name vimnanoswap 10545>67 byte 0 10546>>107 byte 0 10547#>>>2 string x %s swap file 10548>>>24 ulelong x \b, pid %d 10549>>>28 string >\0 \b, user %s 10550>>>68 string >\0 \b, host %s 10551>>>108 string >\0 \b, file %s 10552>>>1007 byte 0x55 \b, modified 10553 10554# Vi IMproved Swap file 10555# by Sven Wegener <swegener@gentoo.org> 105560 string b0VIM\ Vim swap file 10557>&0 string >\0 \b, version %s 10558>0 use vimnanoswap 10559 10560 10561# Lock/swap file for several editors, at least 10562# Vi IMproved and nano 105630 string b0nano Nano swap file 10564>0 use vimnanoswap 10565 10566# kate (K Advanced Text Editor) 105670 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 10568 10569#------------------------------------------------------------------------------ 10570# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 10571# efi: file(1) magic for Universal EFI binaries 10572 105730 lelong 0x0ef1fab9 10574>4 lelong 1 Universal EFI binary with 1 architecture 10575>>&0 lelong 7 \b, i386 10576>>&0 lelong 0x01000007 \b, x86_64 10577>4 lelong 2 Universal EFI binary with 2 architectures 10578>>&0 lelong 7 \b, i386 10579>>&0 lelong 0x01000007 \b, x86_64 10580>>&20 lelong 7 \b, i386 10581>>&20 lelong 0x01000007 \b, x86_64 10582>4 lelong >2 Universal EFI binary with %d architectures 10583 10584#------------------------------------------------------------------------------ 10585# $File: elf,v 1.85 2021/03/27 20:18:38 christos Exp $ 10586# elf: file(1) magic for ELF executables 10587# 10588# We have to check the byte order flag to see what byte order all the 10589# other stuff in the header is in. 10590# 10591# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 10592# 10593# Created by: unknown 10594# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 10595# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 10596# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 10597# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 10598# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 10599 106000 name elf-mips 10601>0 lelong&0xf0000000 0x00000000 MIPS-I 10602>0 lelong&0xf0000000 0x10000000 MIPS-II 10603>0 lelong&0xf0000000 0x20000000 MIPS-III 10604>0 lelong&0xf0000000 0x30000000 MIPS-IV 10605>0 lelong&0xf0000000 0x40000000 MIPS-V 10606>0 lelong&0xf0000000 0x50000000 MIPS32 10607>0 lelong&0xf0000000 0x60000000 MIPS64 10608>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 10609>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 10610>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 10611>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 10612 106130 name elf-sparc 10614>0 lelong&0x00ffff00 0x00000100 V8+ Required, 10615>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 10616>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 10617>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 10618>0 lelong&0x3 0 total store ordering, 10619>0 lelong&0x3 1 partial store ordering, 10620>0 lelong&0x3 2 relaxed memory ordering, 10621 106220 name elf-pa-risc 10623>2 leshort 0x020b 1.0 10624>2 leshort 0x0210 1.1 10625>2 leshort 0x0214 2.0 10626>0 leshort &0x0008 (LP64) 10627 106280 name elf-riscv 10629>0 lelong&0x00000001 0x00000001 RVC, 10630>0 lelong&0x00000008 0x00000008 RVE, 10631>0 lelong&0x00000006 0x00000000 soft-float ABI, 10632>0 lelong&0x00000006 0x00000002 single-float ABI, 10633>0 lelong&0x00000006 0x00000004 double-float ABI, 10634>0 lelong&0x00000006 0x00000006 quad-float ABI, 10635 106360 name elf-le 10637>16 leshort 0 no file type, 10638!:mime application/octet-stream 10639>16 leshort 1 relocatable, 10640!:mime application/x-object 10641>16 leshort 2 executable, 10642!:mime application/x-executable 10643>16 leshort 3 ${x?pie executable:shared object}, 10644 10645!:mime application/x-${x?pie-executable:sharedlib} 10646>16 leshort 4 core file, 10647!:mime application/x-coredump 10648# OS-specific 10649>7 byte 202 10650>>16 leshort 0xFE01 executable, 10651!:mime application/x-executable 10652# Core file detection is not reliable. 10653#>>>(0x38+0xcc) string >\0 of '%s' 10654#>>>(0x38+0x10) lelong >0 (signal %d), 10655>16 leshort &0xff00 10656>>18 leshort !8 processor-specific, 10657>>18 leshort 8 10658>>>16 leshort 0xFF80 PlayStation 2 IOP module, 10659!:mime application/x-sharedlib 10660>>>16 leshort !0xFF80 processor-specific, 10661>18 clear x 10662>18 leshort 0 no machine, 10663>18 leshort 1 AT&T WE32100, 10664>18 leshort 2 SPARC, 10665>18 leshort 3 Intel 80386, 10666>18 leshort 4 Motorola m68k, 10667>>4 byte 1 10668>>>36 lelong &0x01000000 68000, 10669>>>36 lelong &0x00810000 CPU32, 10670>>>36 lelong 0 68020, 10671>18 leshort 5 Motorola m88k, 10672>18 leshort 6 Intel 80486, 10673>18 leshort 7 Intel 80860, 10674# The official e_machine number for MIPS is now #8, regardless of endianness. 10675# The second number (#10) will be deprecated later. For now, we still 10676# say something if #10 is encountered, but only gory details for #8. 10677>18 leshort 8 MIPS, 10678>>4 byte 1 10679>>>36 lelong &0x20 N32 10680>18 leshort 10 MIPS, 10681>>4 byte 1 10682>>>36 lelong &0x20 N32 10683>18 leshort 8 10684# only for 32-bit 10685>>4 byte 1 10686>>>36 use elf-mips 10687# only for 64-bit 10688>>4 byte 2 10689>>>48 use elf-mips 10690>18 leshort 9 Amdahl, 10691>18 leshort 10 MIPS (deprecated), 10692>18 leshort 11 RS6000, 10693>18 leshort 15 PA-RISC, 10694# only for 32-bit 10695>>4 byte 1 10696>>>36 use elf-pa-risc 10697# only for 64-bit 10698>>4 byte 2 10699>>>48 use elf-pa-risc 10700>18 leshort 16 nCUBE, 10701>18 leshort 17 Fujitsu VPP500, 10702>18 leshort 18 SPARC32PLUS, 10703# only for 32-bit 10704>>4 byte 1 10705>>>36 use elf-sparc 10706>18 leshort 19 Intel 80960, 10707>18 leshort 20 PowerPC or cisco 4500, 10708>18 leshort 21 64-bit PowerPC or cisco 7500, 10709>>48 lelong 0 Unspecified or Power ELF V1 ABI, 10710>>48 lelong 1 Power ELF V1 ABI, 10711>>48 lelong 2 OpenPOWER ELF V2 ABI, 10712>18 leshort 22 IBM S/390, 10713>18 leshort 23 Cell SPU, 10714>18 leshort 24 cisco SVIP, 10715>18 leshort 25 cisco 7200, 10716>18 leshort 36 NEC V800 or cisco 12000, 10717>18 leshort 37 Fujitsu FR20, 10718>18 leshort 38 TRW RH-32, 10719>18 leshort 39 Motorola RCE, 10720>18 leshort 40 ARM, 10721>>4 byte 1 10722>>>36 lelong&0xff000000 0x04000000 EABI4 10723>>>36 lelong&0xff000000 0x05000000 EABI5 10724>>>36 lelong &0x00800000 BE8 10725>>>36 lelong &0x00400000 LE8 10726>18 leshort 41 Alpha, 10727>18 leshort 42 Renesas SH, 10728>18 leshort 43 SPARC V9, 10729>>4 byte 2 10730>>>48 use elf-sparc 10731>18 leshort 44 Siemens Tricore Embedded Processor, 10732>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 10733>18 leshort 46 Renesas H8/300, 10734>18 leshort 47 Renesas H8/300H, 10735>18 leshort 48 Renesas H8S, 10736>18 leshort 49 Renesas H8/500, 10737>18 leshort 50 IA-64, 10738>18 leshort 51 Stanford MIPS-X, 10739>18 leshort 52 Motorola Coldfire, 10740>18 leshort 53 Motorola M68HC12, 10741>18 leshort 54 Fujitsu MMA, 10742>18 leshort 55 Siemens PCP, 10743>18 leshort 56 Sony nCPU, 10744>18 leshort 57 Denso NDR1, 10745>18 leshort 58 Start*Core, 10746>18 leshort 59 Toyota ME16, 10747>18 leshort 60 ST100, 10748>18 leshort 61 Tinyj emb., 10749>18 leshort 62 x86-64, 10750>18 leshort 63 Sony DSP, 10751>18 leshort 64 DEC PDP-10, 10752>18 leshort 65 DEC PDP-11, 10753>18 leshort 66 FX66, 10754>18 leshort 67 ST9+ 8/16 bit, 10755>18 leshort 68 ST7 8 bit, 10756>18 leshort 69 MC68HC16, 10757>18 leshort 70 MC68HC11, 10758>18 leshort 71 MC68HC08, 10759>18 leshort 72 MC68HC05, 10760>18 leshort 73 SGI SVx or Cray NV1, 10761>18 leshort 74 ST19 8 bit, 10762>18 leshort 75 Digital VAX, 10763>18 leshort 76 Axis cris, 10764>18 leshort 77 Infineon 32-bit embedded, 10765>18 leshort 78 Element 14 64-bit DSP, 10766>18 leshort 79 LSI Logic 16-bit DSP, 10767>18 leshort 80 MMIX, 10768>18 leshort 81 Harvard machine-independent, 10769>18 leshort 82 SiTera Prism, 10770>18 leshort 83 Atmel AVR 8-bit, 10771>18 leshort 84 Fujitsu FR30, 10772>18 leshort 85 Mitsubishi D10V, 10773>18 leshort 86 Mitsubishi D30V, 10774>18 leshort 87 NEC v850, 10775>18 leshort 88 Renesas M32R, 10776>18 leshort 89 Matsushita MN10300, 10777>18 leshort 90 Matsushita MN10200, 10778>18 leshort 91 picoJava, 10779>18 leshort 92 OpenRISC, 10780>18 leshort 93 Synopsys ARCompact ARC700 cores, 10781>18 leshort 94 Tensilica Xtensa, 10782>18 leshort 95 Alphamosaic VideoCore, 10783>18 leshort 96 Thompson Multimedia, 10784>18 leshort 97 NatSemi 32k, 10785>18 leshort 98 Tenor Network TPC, 10786>18 leshort 99 Trebia SNP 1000, 10787>18 leshort 100 STMicroelectronics ST200, 10788>18 leshort 101 Ubicom IP2022, 10789>18 leshort 102 MAX Processor, 10790>18 leshort 103 NatSemi CompactRISC, 10791>18 leshort 104 Fujitsu F2MC16, 10792>18 leshort 105 TI msp430, 10793>18 leshort 106 Analog Devices Blackfin, 10794>18 leshort 107 S1C33 Family of Seiko Epson, 10795>18 leshort 108 Sharp embedded, 10796>18 leshort 109 Arca RISC, 10797>18 leshort 110 PKU-Unity Ltd., 10798>18 leshort 111 eXcess: 16/32/64-bit, 10799>18 leshort 112 Icera Deep Execution Processor, 10800>18 leshort 113 Altera Nios II, 10801>18 leshort 114 NatSemi CRX, 10802>18 leshort 115 Motorola XGATE, 10803>18 leshort 116 Infineon C16x/XC16x, 10804>18 leshort 117 Renesas M16C series, 10805>18 leshort 118 Microchip dsPIC30F, 10806>18 leshort 119 Freescale RISC core, 10807>18 leshort 120 Renesas M32C series, 10808>18 leshort 131 Altium TSK3000 core, 10809>18 leshort 132 Freescale RS08, 10810>18 leshort 134 Cyan Technology eCOG2, 10811>18 leshort 135 Sunplus S+core7 RISC, 10812>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 10813>18 leshort 137 Broadcom VideoCore III, 10814>18 leshort 138 LatticeMico32, 10815>18 leshort 139 Seiko Epson C17 family, 10816>18 leshort 140 TI TMS320C6000 DSP family, 10817>18 leshort 141 TI TMS320C2000 DSP family, 10818>18 leshort 142 TI TMS320C55x DSP family, 10819>18 leshort 144 TI Programmable Realtime Unit 10820>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 10821>18 leshort 161 Cypress M8C, 10822>18 leshort 162 Renesas R32C series, 10823>18 leshort 163 NXP TriMedia family, 10824>18 leshort 164 QUALCOMM DSP6, 10825>18 leshort 165 Intel 8051 and variants, 10826>18 leshort 166 STMicroelectronics STxP7x family, 10827>18 leshort 167 Andes embedded RISC, 10828>18 leshort 168 Cyan eCOG1X family, 10829>18 leshort 169 Dallas MAXQ30, 10830>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 10831>18 leshort 171 M2000 Reconfigurable RISC, 10832>18 leshort 172 Cray NV2 vector architecture, 10833>18 leshort 173 Renesas RX family, 10834>18 leshort 174 META, 10835>18 leshort 175 MCST Elbrus, 10836>18 leshort 176 Cyan Technology eCOG16 family, 10837>18 leshort 177 NatSemi CompactRISC, 10838>18 leshort 178 Freescale Extended Time Processing Unit, 10839>18 leshort 179 Infineon SLE9X, 10840>18 leshort 180 Intel L1OM, 10841>18 leshort 181 Intel K1OM, 10842>18 leshort 183 ARM aarch64, 10843>18 leshort 185 Atmel 32-bit family, 10844>18 leshort 186 STMicroeletronics STM8 8-bit, 10845>18 leshort 187 Tilera TILE64, 10846>18 leshort 188 Tilera TILEPro, 10847>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 10848>18 leshort 190 NVIDIA CUDA architecture, 10849>18 leshort 191 Tilera TILE-Gx, 10850>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores, 10851>18 leshort 197 Renesas RL78 family, 10852>18 leshort 199 Renesas 78K0R, 10853>18 leshort 200 Freescale 56800EX, 10854>18 leshort 201 Beyond BA1, 10855>18 leshort 202 Beyond BA2, 10856>18 leshort 203 XMOS xCORE, 10857>18 leshort 204 Microchip 8-bit PIC(r), 10858>18 leshort 210 KM211 KM32, 10859>18 leshort 211 KM211 KMX32, 10860>18 leshort 212 KM211 KMX16, 10861>18 leshort 213 KM211 KMX8, 10862>18 leshort 214 KM211 KVARC, 10863>18 leshort 215 Paneve CDP, 10864>18 leshort 216 Cognitive Smart Memory, 10865>18 leshort 217 iCelero CoolEngine, 10866>18 leshort 218 Nanoradio Optimized RISC, 10867>18 leshort 243 UCB RISC-V, 10868# only for 32-bit 10869>>4 byte 1 10870>>>36 use elf-riscv 10871# only for 64-bit 10872>>4 byte 2 10873>>>48 use elf-riscv 10874>18 leshort 244 Lanai 32-bit processor, 10875>18 leshort 245 CEVA Processor Architecture Family, 10876>18 leshort 246 CEVA X2 Processor Family, 10877>18 leshort 247 eBPF, 10878>18 leshort 248 Graphcore Intelligent Processing Unit, 10879>18 leshort 249 Imagination Technologies, 10880>18 leshort 250 Netronome Flow Processor, 10881>18 leshort 251 NEC Vector Engine, 10882>18 leshort 252 C-SKY processor family, 10883>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores, 10884>18 leshort 254 MOS Technology MCS 6502 processor, 10885>18 leshort 255 Synopsys ARCv3 32-bit, 10886>18 leshort 256 Kalray VLIW core of the MPPA family, 10887>18 leshort 257 WDC 65816/65C816, 10888>18 leshort 258 Loongson Loongarch, 10889>18 leshort 259 ChipON KungFu32, 10890>18 leshort 0x1057 AVR (unofficial), 10891>18 leshort 0x1059 MSP430 (unofficial), 10892>18 leshort 0x1223 Adapteva Epiphany (unofficial), 10893>18 leshort 0x2530 Morpho MT (unofficial), 10894>18 leshort 0x3330 FR30 (unofficial), 10895>18 leshort 0x3426 OpenRISC (obsolete), 10896>18 leshort 0x4688 Infineon C166 (unofficial), 10897>18 leshort 0x5441 Cygnus FRV (unofficial), 10898>18 leshort 0x5aa5 DLX (unofficial), 10899>18 leshort 0x7650 Cygnus D10V (unofficial), 10900>18 leshort 0x7676 Cygnus D30V (unofficial), 10901>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 10902>18 leshort 0x8472 OpenRISC (obsolete), 10903>18 leshort 0x9025 Cygnus PowerPC (unofficial), 10904>18 leshort 0x9026 Alpha (unofficial), 10905>18 leshort 0x9041 Cygnus M32R (unofficial), 10906>18 leshort 0x9080 Cygnus V850 (unofficial), 10907>18 leshort 0xa390 IBM S/390 (obsolete), 10908>18 leshort 0xabc7 Old Xtensa (unofficial), 10909>18 leshort 0xad45 xstormy16 (unofficial), 10910>18 leshort 0xbaab Old MicroBlaze (unofficial),, 10911>18 leshort 0xbeef Cygnus MN10300 (unofficial), 10912>18 leshort 0xdead Cygnus MN10200 (unofficial), 10913>18 leshort 0xf00d Toshiba MeP (unofficial), 10914>18 leshort 0xfeb0 Renesas M32C (unofficial), 10915>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 10916>18 leshort 0xfebb NIOS (unofficial), 10917>18 leshort 0xfeed Moxie (unofficial), 10918>18 default x 10919>>18 leshort x *unknown arch 0x%x* 10920>20 lelong 0 invalid version 10921>20 lelong 1 version 1 10922 109230 string \177ELF ELF 10924!:strength *2 10925>4 byte 0 invalid class 10926>4 byte 1 32-bit 10927>4 byte 2 64-bit 10928>5 byte 0 invalid byte order 10929>5 byte 1 LSB 10930>>0 use elf-le 10931>5 byte 2 MSB 10932>>0 use \^elf-le 10933>7 byte 0 (SYSV) 10934>7 byte 1 (HP-UX) 10935>7 byte 2 (NetBSD) 10936>7 byte 3 (GNU/Linux) 10937>7 byte 4 (GNU/Hurd) 10938>7 byte 5 (86Open) 10939>7 byte 6 (Solaris) 10940>7 byte 7 (Monterey) 10941>7 byte 8 (IRIX) 10942>7 byte 9 (FreeBSD) 10943>7 byte 10 (Tru64) 10944>7 byte 11 (Novell Modesto) 10945>7 byte 12 (OpenBSD) 10946>7 byte 13 (OpenVMS) 10947>7 byte 14 (HP NonStop Kernel) 10948>7 byte 15 (AROS Research Operating System) 10949>7 byte 16 (FenixOS) 10950>7 byte 17 (Nuxi CloudABI) 10951>7 byte 97 (ARM) 10952>7 byte 202 (Cafe OS) 10953>7 byte 255 (embedded) 10954 10955#------------------------------------------------------------------------------ 10956# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 10957# encore: file(1) magic for Encore machines 10958# 10959# XXX - needs to have the byte order specified (NS32K was little-endian, 10960# dunno whether they run the 88K in little-endian mode or not). 10961# 109620 short 0x154 Encore 10963>20 short 0x107 executable 10964>20 short 0x108 pure executable 10965>20 short 0x10b demand-paged executable 10966>20 short 0x10f unsupported executable 10967>12 long >0 not stripped 10968>22 short >0 - version %d 10969>22 short 0 - 10970#>4 date x stamp %s 109710 short 0x155 Encore unsupported executable 10972>12 long >0 not stripped 10973>22 short >0 - version %d 10974>22 short 0 - 10975#>4 date x stamp %s 10976 10977#------------------------------------------------------------------------------ 10978# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 10979# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 10980# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 10981# Useful information for improving this file can be found at: 10982# http://software.frodo.looijaard.name/psiconv/formats/Index.html 10983#------------------------------------------------------------------------------ 109840 lelong 0x10000037 Psion Series 5 10985>4 lelong 0x10000039 font file 10986>4 lelong 0x1000003A printer driver 10987>4 lelong 0x1000003B clipboard 10988>4 lelong 0x10000042 multi-bitmap image 10989!:mime image/x-epoc-mbm 10990>4 lelong 0x1000006A application information file 10991>4 lelong 0x1000006D 10992>>8 lelong 0x1000007D Sketch image 10993!:mime image/x-epoc-sketch 10994>>8 lelong 0x1000007E voice note 10995>>8 lelong 0x1000007F Word file 10996!:mime application/x-epoc-word 10997>>8 lelong 0x10000085 OPL program (TextEd) 10998!:mime application/x-epoc-opl 10999>>8 lelong 0x10000087 Comms settings 11000>>8 lelong 0x10000088 Sheet file 11001!:mime application/x-epoc-sheet 11002>>8 lelong 0x100001C4 EasyFax initialisation file 11003>4 lelong 0x10000073 OPO module 11004!:mime application/x-epoc-opo 11005>4 lelong 0x10000074 OPL application 11006!:mime application/x-epoc-app 11007>4 lelong 0x1000008A exported multi-bitmap image 11008>4 lelong 0x1000016D 11009>>8 lelong 0x10000087 Comms names 11010 110110 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 11012 110130 lelong 0x10000050 Psion Series 5 11014>4 lelong 0x1000006D database 11015>>8 lelong 0x10000084 Agenda file 11016!:mime application/x-epoc-agenda 11017>>8 lelong 0x10000086 Data file 11018!:mime application/x-epoc-data 11019>>8 lelong 0x10000CEA Jotter file 11020!:mime application/x-epoc-jotter 11021>4 lelong 0x100000E4 ini file 11022 110230 lelong 0x10000079 Psion Series 5 binary: 11024>4 lelong 0x00000000 DLL 11025>4 lelong 0x10000049 comms hardware library 11026>4 lelong 0x1000004A comms protocol library 11027>4 lelong 0x1000005D OPX 11028>4 lelong 0x1000006C application 11029>4 lelong 0x1000008D DLL 11030>4 lelong 0x100000AC logical device driver 11031>4 lelong 0x100000AD physical device driver 11032>4 lelong 0x100000E5 file transfer protocol 11033>4 lelong 0x100000E5 file transfer protocol 11034>4 lelong 0x10000140 printer definition 11035>4 lelong 0x10000141 printer definition 11036 110370 lelong 0x1000007A Psion Series 5 executable 11038 11039#------------------------------------------------------------------------------ 11040# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ 11041# erlang: file(1) magic for Erlang JAM and BEAM files 11042# URL: https://www.erlang.org/faq/x779.html#AEN812 11043 11044# OTP R3-R4 110450 string \0177BEAM! Old Erlang BEAM file 11046>6 short >0 - version %d 11047 11048# OTP R5 and onwards 110490 string FOR1 11050>8 string BEAM Erlang BEAM file 11051 11052# 4.2 version may have a copyright notice! 110534 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 1105479 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 11055 110564 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 11057 110580 bequad 0x0000000000ABCDEF Erlang DETS file 11059 11060# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $ 11061# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif 11062# URL: https://github.com/arendst/Sonoff-Tasmota/ 11063# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ 11064# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h 11065# From: Joerg Jenderek 11066# 11067# cfg_holder=4617=0x1209 110680 uleshort 4617 11069# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e 11070>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) 11071!:mime application/x-tasmota-dmp 11072!:ext dmp 11073# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 11074>>11 ubyte^0x65 x \b, version %u 11075>>10 ubyte^0x64 x \b.%u 11076>>9 ubyte^0x63 x \b.%u 11077>>8 ubyte^0x62 x \b.%u 11078#>8 ubelong x (0x%x) 11079# hostname[33] XORed 11080>>0x165 ubyte^0x1BF x \b, hostname %c 11081>>0x166 ubyte^0x1C0 >037 \b%c 11082>>0x167 ubyte^0x1C1 >037 \b%c 11083>>0x168 ubyte^0x1C2 >037 \b%c 11084>>0x169 ubyte^0x1C3 >037 \b%c 11085>>0x16A ubyte^0x1C4 >037 \b%c 11086>>0x16B ubyte^0x1C5 >037 \b%c 11087>>0x16C ubyte^0x1C6 >037 \b%c 11088>>0x16D ubyte^0x1C7 >037 \b%c 11089>>0x16E ubyte^0x1C8 >037 \b%c 11090>>0x16F ubyte^0x1C9 >037 \b%c 11091>>0x170 ubyte^0x1CA >037 \b%c 11092>>0x171 ubyte^0x1CB >037 \b%c 11093>>0x172 ubyte^0x1CC >037 \b%c 11094>>0x173 ubyte^0x1CD >037 \b%c 11095>>0x174 ubyte^0x1CE >037 \b%c 11096>>0x175 ubyte^0x1CF >037 \b%c 11097>>0x176 ubyte^0x1D0 >037 \b%c 11098>>0x177 ubyte^0x1D1 >037 \b%c 11099>>0x178 ubyte^0x1D2 >037 \b%c 11100>>0x179 ubyte^0x1D3 >037 \b%c 11101>>0x17A ubyte^0x1D4 >037 \b%c 11102>>0x17B ubyte^0x1D5 >037 \b%c 11103>>0x17C ubyte^0x1D6 >037 \b%c 11104>>0x17D ubyte^0x1D7 >037 \b%c 11105>>0x17E ubyte^0x1D8 >037 \b%c 11106>>0x17F ubyte^0x1D9 >037 \b%c 11107>>0x180 ubyte^0x1DA >037 \b%c 11108>>0x181 ubyte^0x1DB >037 \b%c 11109>>0x182 ubyte^0x1DC >037 \b%c 11110>>0x183 ubyte^0x1DD >037 \b%c 11111>>0x184 ubyte^0x1DE >037 \b%c 11112>>0x185 ubyte^0x1DF >037 \b%c 11113#>>0x165 string x (%.33s) 11114 11115 11116 11117#------------------------------------------------------------------------------ 11118# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ 11119# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 11120# Based on info from 11121# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 111220 belong 9994 ESRI Shapefile 11123>4 belong =0 11124>8 belong =0 11125>12 belong =0 11126>16 belong =0 11127>20 belong =0 11128>28 lelong x version %d 11129>24 belong x length %d 11130>32 lelong =0 type Null Shape 11131>32 lelong =1 type Point 11132>32 lelong =3 type PolyLine 11133>32 lelong =5 type Polygon 11134>32 lelong =8 type MultiPoint 11135>32 lelong =11 type PointZ 11136>32 lelong =13 type PolyLineZ 11137>32 lelong =15 type PolygonZ 11138>32 lelong =18 type MultiPointZ 11139>32 lelong =21 type PointM 11140>32 lelong =23 type PolyLineM 11141>32 lelong =25 type PolygonM 11142>32 lelong =28 type MultiPointM 11143>32 lelong =31 type MultiPatch 11144 11145#------------------------------------------------------------------------------ 11146# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 11147# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 11148# From Roger Leigh <roger@whinlatter.uklinux.net> 111490 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 111500 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 111510 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 11152 11153#------------------------------------------------------------------------------ 11154# $File: filesystems,v 1.140 2021/02/23 00:51:10 christos Exp $ 11155# filesystems: file(1) magic for different filesystems 11156# 111570 name partid 11158>0 ubyte 0x00 Unused 11159>0 ubyte 0x01 12-bit FAT 11160>0 ubyte 0x02 XENIX / 11161>0 ubyte 0x03 XENIX /usr 11162>0 ubyte 0x04 16-bit FAT, less than 32M 11163>0 ubyte 0x05 extended partition 11164>0 ubyte 0x06 16-bit FAT, more than 32M 11165>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 11166>0 ubyte 0x08 AIX or os, or etc. 11167>0 ubyte 0x09 AIX boot partition or Coherent 11168>0 ubyte 0x0a O/2 boot manager or Coherent swap 11169>0 ubyte 0x0b 32-bit FAT 11170>0 ubyte 0x0c 32-bit FAT, LBA-mapped 11171>0 ubyte 0x0d 7XXX, LBA-mapped 11172>0 ubyte 0x0e 16-bit FAT, LBA-mapped 11173>0 ubyte 0x0f extended partition, LBA-mapped 11174>0 ubyte 0x10 OPUS 11175>0 ubyte 0x11 OS/2 DOS 12-bit FAT 11176>0 ubyte 0x12 Compaq diagnostics 11177>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 11178>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 11179>0 ubyte 0x17 OS/2 hidden IFS 11180>0 ubyte 0x18 AST Windows swapfile 11181>0 ubyte 0x19 Willowtech Photon coS 11182>0 ubyte 0x1b hidden win95 fat 32 11183>0 ubyte 0x1c hidden win95 fat 32 lba 11184>0 ubyte 0x1d hidden win95 fat 16 lba 11185>0 ubyte 0x20 Willowsoft OFS1 11186>0 ubyte 0x21 reserved 11187>0 ubyte 0x23 reserved 11188>0 ubyte 0x24 NEC DOS 11189>0 ubyte 0x26 reserved 11190>0 ubyte 0x31 reserved 11191>0 ubyte 0x32 Alien Internet Services NOS 11192>0 ubyte 0x33 reserved 11193>0 ubyte 0x34 reserved 11194>0 ubyte 0x35 JFS on OS2 11195>0 ubyte 0x36 reserved 11196>0 ubyte 0x38 Theos 11197>0 ubyte 0x39 Plan 9, or Theos spanned 11198>0 ubyte 0x3a Theos ver 4 4gb partition 11199>0 ubyte 0x3b Theos ve 4 extended partition 11200>0 ubyte 0x3c PartitionMagic recovery 11201>0 ubyte 0x3d Hidden Netware 11202>0 ubyte 0x40 VENIX 286 or LynxOS 11203>0 ubyte 0x41 PReP 11204>0 ubyte 0x42 linux swap sharing DRDOS disk 11205>0 ubyte 0x43 linux sharing DRDOS disk 11206>0 ubyte 0x44 GoBack change utility 11207>0 ubyte 0x45 Boot US Boot manager 11208>0 ubyte 0x46 EUMEL/Elan or Ergos 3 11209>0 ubyte 0x47 EUMEL/Elan or Ergos 3 11210>0 ubyte 0x48 EUMEL/Elan or Ergos 3 11211>0 ubyte 0x4a ALFX/THIN filesystem for DOS 11212>0 ubyte 0x4c Oberon partition 11213>0 ubyte 0x4d QNX4.x 11214>0 ubyte 0x4e QNX4.x 2nd part 11215>0 ubyte 0x4f QNX4.x 3rd part 11216>0 ubyte 0x50 DM (disk manager) 11217>0 ubyte 0x51 DM6 Aux1 (or Novell) 11218>0 ubyte 0x52 CP/M or Microport SysV/AT 11219>0 ubyte 0x53 DM6 Aux3 11220>0 ubyte 0x54 DM6 DDO 11221>0 ubyte 0x55 EZ-Drive (disk manager) 11222>0 ubyte 0x56 Golden Bow (disk manager) 11223>0 ubyte 0x57 Drive PRO 11224>0 ubyte 0x5c Priam Edisk (disk manager) 11225>0 ubyte 0x61 SpeedStor 11226>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 11227>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 11228>0 ubyte 0x65 Novell Netware 3.xx 11229>0 ubyte 0x66 Novell 386 Netware 11230>0 ubyte 0x67 Novell 11231>0 ubyte 0x68 Novell 11232>0 ubyte 0x69 Novell 11233>0 ubyte 0x70 DiskSecure Multi-Boot 11234>0 ubyte 0x71 reserved 11235>0 ubyte 0x73 reserved 11236>0 ubyte 0x74 reserved 11237>0 ubyte 0x75 PC/IX 11238>0 ubyte 0x76 reserved 11239>0 ubyte 0x77 M2FS/M2CS partition 11240>0 ubyte 0x78 XOSL boot loader filesystem 11241>0 ubyte 0x80 MINIX until 1.4a 11242>0 ubyte 0x81 MINIX since 1.4b 11243>0 ubyte 0x82 Linux swap or Solaris 11244>0 ubyte 0x83 Linux native 11245>0 ubyte 0x84 OS/2 hidden C: drive 11246>0 ubyte 0x85 Linux extended partition 11247>0 ubyte 0x86 NT FAT volume set 11248>0 ubyte 0x87 NTFS volume set or HPFS mirrored 11249>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 11250>0 ubyte 0x8b Legacy Fault tolerant FAT32 11251>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 11252>0 ubyte 0x8d Hidden free FDISK FAT12 11253>0 ubyte 0x8e Linux Logical Volume Manager 11254>0 ubyte 0x90 Hidden free FDISK FAT16 11255>0 ubyte 0x91 Hidden free FDISK DOS EXT 11256>0 ubyte 0x92 Hidden free FDISK FAT16 Big 11257>0 ubyte 0x93 Amoeba filesystem 11258>0 ubyte 0x94 Amoeba bad block table 11259>0 ubyte 0x95 MIT EXOPC native partitions 11260>0 ubyte 0x97 Hidden free FDISK FAT32 11261>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 11262>0 ubyte 0x99 Mylex EISA SCSI 11263>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 11264>0 ubyte 0x9b Hidden free FDISK EXT LBA 11265>0 ubyte 0x9f BSDI? 11266>0 ubyte 0xa0 IBM Thinkpad hibernation 11267>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 11268>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 11269>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 11270>0 ubyte 0xa5 386BSD partition type 11271>0 ubyte 0xa6 OpenBSD partition type 11272>0 ubyte 0xa7 NeXTSTEP 486 11273>0 ubyte 0xa8 Apple UFS 11274>0 ubyte 0xa9 NetBSD partition type 11275>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 11276>0 ubyte 0xab Apple Boot 11277>0 ubyte 0xae SHAG OS filesystem 11278>0 ubyte 0xaf Apple HFS 11279>0 ubyte 0xb0 BootStar Dummy 11280>0 ubyte 0xb1 reserved 11281>0 ubyte 0xb3 reserved 11282>0 ubyte 0xb4 reserved 11283>0 ubyte 0xb6 reserved 11284>0 ubyte 0xb7 BSDI BSD/386 filesystem 11285>0 ubyte 0xb8 BSDI BSD/386 swap 11286>0 ubyte 0xbb Boot Wizard Hidden 11287>0 ubyte 0xbe Solaris 8 partition type 11288>0 ubyte 0xbf Solaris partition type 11289>0 ubyte 0xc0 CTOS 11290>0 ubyte 0xc1 DRDOS/sec (FAT-12) 11291>0 ubyte 0xc2 Hidden Linux 11292>0 ubyte 0xc3 Hidden Linux swap 11293>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 11294>0 ubyte 0xc5 DRDOS/sec (EXT) 11295>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 11296>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 11297>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 11298>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 11299>0 ubyte 0xca Reserved for DR-DOS 8.0+ 11300>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 11301>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 11302>0 ubyte 0xcd CTOS Memdump 11303>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 11304>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 11305>0 ubyte 0xd0 REAL/32 secure big partition 11306>0 ubyte 0xd1 Old Multiuser DOS FAT12 11307>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 11308>0 ubyte 0xd5 Old Multiuser DOS Extended 11309>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 11310>0 ubyte 0xd8 CP/M 86 11311>0 ubyte 0xdb CP/M or Concurrent CP/M 11312>0 ubyte 0xdd Hidden CTOS Memdump 11313>0 ubyte 0xde Dell PowerEdge Server utilities 11314>0 ubyte 0xdf DG/UX virtual disk manager 11315>0 ubyte 0xe0 STMicroelectronics ST AVFS 11316>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 11317>0 ubyte 0xe3 DOS R/O or Storage Dimensions 11318>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 11319>0 ubyte 0xe5 reserved 11320>0 ubyte 0xe6 reserved 11321>0 ubyte 0xeb BeOS 11322>0 ubyte 0xee GPT Protective MBR 11323>0 ubyte 0xef EFI system partition 11324>0 ubyte 0xf0 Linux PA-RISC boot loader 11325>0 ubyte 0xf1 SpeedStor or Storage Dimensions 11326>0 ubyte 0xf2 DOS 3.3+ Secondary 11327>0 ubyte 0xf3 reserved 11328>0 ubyte 0xf4 SpeedStor large partition 11329>0 ubyte 0xf5 Prologue multi-volumen partition 11330>0 ubyte 0xf6 reserved 11331>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 11332>0 ubyte 0xfa Bochs x86 emulator 11333>0 ubyte 0xfb VMware File System 11334>0 ubyte 0xfc VMware Swap 11335>0 ubyte 0xfd Linux RAID partition persistent sb 11336>0 ubyte 0xfe LANstep or IBM PS/2 IML 11337>0 ubyte 0xff Xenix Bad Block Table 11338 113390 string \366\366\366\366 PC formatted floppy with no filesystem 11340# Sun disk labels 11341# From /usr/include/sun/dklabel.h: 113420774 beshort 0xdabe 11343# modified by Joerg Jenderek, because original test 11344# succeeds for Cabinet archive dao360.dl_ with negative blocks 11345>0770 long >0 Sun disk label 11346>>0 string x '%s 11347>>>31 string >\0 \b%s 11348>>>>63 string >\0 \b%s 11349>>>>>95 string >\0 \b%s 11350>>0 string x \b' 11351>>0734 short >0 %d rpm, 11352>>0736 short >0 %d phys cys, 11353>>0740 short >0 %d alts/cyl, 11354>>0746 short >0 %d interleave, 11355>>0750 short >0 %d data cyls, 11356>>0752 short >0 %d alt cyls, 11357>>0754 short >0 %d heads/partition, 11358>>0756 short >0 %d sectors/track, 11359>>0764 long >0 start cyl %d, 11360>>0770 long x %d blocks 11361# Is there a boot block written 1 sector in? 11362>512 belong&077777777 0600407 \b, boot block present 11363 11364# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 11365# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 113660 string SBMBAKUP_ Smart Boot Manager backup file 11367>9 string x \b, version %-5.5s 11368>>14 string =_ 11369>>>15 string x %-.1s 11370>>>>16 string =_ \b. 11371>>>>>17 string x \b%-.1s 11372>>>>>>18 string =_ \b. 11373>>>>>>>19 string x \b%-.1s 11374>>>22 ubyte 0 11375>>>>21 ubyte x \b, from drive 0x%x 11376>>>22 ubyte >0 11377>>>>21 string x \b, from drive %s 11378>>>535 search/17 \x55\xAA 11379>>>>&-512 indirect x \b; contains 11380 11381# updated by Joerg Jenderek at Nov 2012 11382# DOS Emulator image is 128 byte, null right padded header + harddisc image 113830 string DOSEMU\0 11384>0x27E leshort 0xAA55 11385#offset is 128 11386>>19 ubyte 128 11387>>>(19.b-1) ubyte 0x0 DOS Emulator image 11388>>>>7 ulelong >0 \b, %u heads 11389>>>>11 ulelong >0 \b, %d sectors/track 11390>>>>15 ulelong >0 \b, %d cylinders 11391>>>>128 indirect x \b; contains 11392 11393# added by Joerg Jenderek at Nov 2012 11394# http://www.thenakedpc.com/articles/v04/08/0408-05.html 11395# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 113960 string PNCIHISK\0 Norton Utilities disc image data 11397# real x86 boot sector with jump instruction 11398>509 search/1026 \x55\xAA\xeb 11399>>&-1 indirect x \b; contains 11400# http://file-extension.net/seeker/file_extension_dat 114010 string PNCIUNDO Norton Disk Doctor UnDo file 11402# 11403 11404# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 11405# for any allowed sector sizes 1140630 search/481 \x55\xAA 11407# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 11408# DOS BPB information (70) and after DOS floppy (120) like in previous file version 11409!:strength +65 11410# for sector sizes < 512 Bytes 11411>11 uleshort <512 11412>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 11413# for sector sizes with 512 or more Bytes 11414>0x1FE leshort 0xAA55 DOS/MBR boot sector 11415 11416# ExFAT 114173 string/w =EXFAT 11418>0x1FE leshort 0xAA55 11419>>0x6E ubyte 1 11420>>>0x6F ubyte 0x80 11421>>>0 ubyte 0xEB DOS/MBR boot sector, 11422>>>0x69 ubyte x ExFAT Filesystem version %d. 11423>>>0x68 ubyte x \b%d 11424>>>0x6d ubyte x \b, (1<<%d) sectors per cluster 11425>>>0x48 ulequad x \b, sectors %lld 11426>>>0x64 ulelong x \b, serial number 0x%x 11427 11428# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 11429# only for sector sizes with 512 or more Bytes 114300x1FE leshort 0xAA55 DOS/MBR boot sector 11431# 11432# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 11433!:strength +65 11434>2 string OSBS OS/BS MBR 11435# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ 11436# and https://en.wikipedia.org/wiki/Master_Boot_Record 11437# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 11438# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 11439>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 11440# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 11441# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 11442>>8 ubequad 0x8bf45007501ffbfc 11443# https://thestarman.pcministry.com/asm/mbr/200MBR.htm 11444>>>0x16 ubyte 0xF3 \b,DOS 2 11445>>>>219 regex Author\ -\ Author: 11446# found "David Litton" , "A Pehrsson " 11447>>>>>&0 string x "%s" 11448>>>0x16 ubyte 0xF2 11449# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 11450# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 11451>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 11452# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 11453>>>>0x22 default x \b,D0S version 3.3-7.0 11454# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 11455# where nn is string offset varying for different languages 11456# "Invalid partition table" nn=0x8b for english version 11457>>>>>(0x49.b) string Invalid\ partition\ table english 11458>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 11459>>>>>(0x49.b) string Table\ de\ partition\ invalide french 11460>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 11461>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 11462>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 11463>>>>>0x49 ubyte >0 at offset 0x%x 11464>>>>>>(0x49.b) string >\0 "%s" 11465# "Error loading operating system" nn=0xa3 for english version 11466# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 11467# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 11468# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 11469# "Error al cargar sistema operativo" nn=0xa8 for spanish version 11470# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 11471>>>>>0x74 ubyte >0 at offset 0x%x 11472>>>>>>(0x74.b) string >\0 "%s" 11473# "Missing operating system" nn=0xc2 for english version 11474# "Betriebssystem fehlt" nn=0xcd for german version 11475# "Syst\212me d'exploitation absent" nn=0xd2 for french version 11476# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 11477# "Falta sistema operativo" nn=0xca for spanish version 11478# "Sistema operativo mancante" nn=0xe2 for italian version 11479>>>>>0x79 ubyte >0 at offset 0x%x 11480>>>>>>(0x79.b) string >\0 "%s" 11481# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 11482# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 11483>>8 ubequad 0x5007501ffcbe1b7c 11484# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 11485>>>24 ubequad 0xf3a4cbbebe07b104 9M 11486# "Invalid partition table" nn=0x10F for english version 11487# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 11488# "Table de partition erron\202e" nn=0x10F for french version 11489# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 11490>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 11491>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 11492>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 11493>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 11494>>>>0x3C ubyte x at offset 0x%x+0xFF 11495>>>>(0x3C.b+0x0FF) string >\0 "%s" 11496# "Error loading operating system" nn=0x127 for english version 11497# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 11498# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 11499# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 11500>>>>0xBD ubyte x at offset 0x1%x 11501>>>>(0xBD.b+0x100) string >\0 "%s" 11502# "Missing operating system" nn=0x146 for english version 11503# "Betriebssystem fehlt" nn=0x151 for german version 11504# "Syst\212me d'exploitation manquant" nn=0x15e for french version 11505# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 11506>>>>0xA9 ubyte x at offset 0x1%x 11507>>>>(0xA9.b+0x100) string >\0 "%s" 11508# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 11509# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 11510>>>24 ubequad 0xf3a4cbbdbe07b104 XP 11511# where xxyyzz are lower bits from offsets of error messages varying for different languages 11512>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 11513>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 11514# "Invalid partition table" xx=0x12C for english version 11515# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 11516>>>>0x1b5 ubyte >0 at offset 0x1%x 11517>>>>(0x1b5.b+0x100) string >\0 "%s" 11518# "Error loading operating system" yy=0x144 for english version 11519# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 11520>>>>0x1b6 ubyte >0 at offset 0x1%x 11521>>>>(0x1b6.b+0x100) string >\0 "%s" 11522# "Missing operating system" zz=0x163 for english version 11523# "Betriebssystem nicht vorhanden" zz=0x16e for german version 11524>>>>0x1b7 ubyte >0 at offset 0x1%x 11525>>>>(0x1b7.b+0x100) string >\0 "%s" 11526# Microsoft Windows Vista or 7 11527# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 11528>>8 ubequad 0xc08ed8be007cbf00 11529# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 11530# assembler instructions: jnz 0729;cmp ebx,"TCPA" 11531>>>0xEC ubequad 0x753b6681fb544350 Vista 11532# where xxyyzz are lower bits from offsets of error messages varying for different languages 11533>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 11534#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11535# "Invalid partition table" xx=0x162 for english version 11536# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11537>>>>0x1b5 ubyte >0 at offset 0x1%x 11538>>>>(0x1b5.b+0x100) string >\0 "%s" 11539# "Error loading operating system" yy=0x17a for english version 11540# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 11541>>>>0x1b6 ubyte >0 at offset 0x1%x 11542>>>>(0x1b6.b+0x100) string >\0 "%s" 11543# "Missing operating system" zz=0x199 for english version 11544# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11545>>>>0x1b7 ubyte >0 at offset 0x1%x 11546>>>>(0x1b7.b+0x100) string >\0 "%s" 11547# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 11548# assembler instructions: cmp ebx,"TCPA";cmp 11549>>>0xEC ubequad 0x6681fb5443504175 Windows 7 11550# where xxyyzz are lower bits from offsets of error messages varying for different languages 11551>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 11552#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11553# "Invalid partition table" xx=0x163 for english version 11554# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11555>>>>0x1b5 ubyte >0 at offset 0x1%x 11556>>>>(0x1b5.b+0x100) string >\0 "%s" 11557# "Error loading operating system" yy=0x17b for english version 11558# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 11559>>>>0x1b6 ubyte >0 at offset 0x1%x 11560>>>>(0x1b6.b+0x100) string >\0 "%s" 11561# "Missing operating system" zz=0x19a for english version 11562# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11563>>>>0x1b7 ubyte >0 at offset 0x1%x 11564>>>>(0x1b7.b+0x100) string >\0 "%s" 11565# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 11566# https://en.wikipedia.org/wiki/MBR_disk_signature#ID 11567>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 11568# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm 11569>>0xDA uleshort 0 11570>>>0xDC ulelong >0 \b, created 11571# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 11572>>>>0xDC ubyte x with driveID 0x%x 11573# hours, minutes and seconds 11574>>>>0xDf ubyte x at %x 11575>>>>0xDe ubyte x \b:%x 11576>>>>0xDd ubyte x \b:%x 11577# special case for Microsoft MS-DOS 3.21 spanish 11578# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 11579>0 ubequad 0xfab830008ed0bc00 11580# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 11581>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 11582# Microsoft MBR IPL end 11583 11584# dr-dos with some upper-, lowercase variants 11585>0x9D string Invalid\ partition\ table$ 11586>>181 string No\ Operating\ System$ 11587>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11588>0x9D string Invalid\ partition\ table$ 11589>>181 string No\ operating\ system$ 11590>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11591>342 string Invalid\ partition\ table$ 11592>>366 string No\ operating\ system$ 11593>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 11594>295 string NEWLDR\0 11595>>302 string Bad\ PT\ $ 11596>>>310 string No\ OS\ $ 11597>>>>317 string OS\ load\ err$ 11598>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 11599>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 11600>>>>>>>387 string Copyright\ (c)\ 1984,1998 11601>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 11602# 11603# tests for different MS-DOS Master Boot Records (MBR) moved and merged 11604# 11605#>0x145 string Default:\ F \b, FREE-DOS MBR 11606#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 11607>0x145 search/7 Default:\ F \b, FREE-DOS MBR 11608#>>313 string F0\ .\ .\ . 11609#>>>322 string disk\ 1 11610#>>>>382 string FAT3 11611>64 string no\ active\ partition\ found 11612>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 11613# Ranish Partition Manager http://www.ranish.com/part/ 11614>387 search/4 \0\ Error!\r 11615>>378 search/7 Virus! 11616>>>397 search/4 Booting\040 11617>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 11618>>>>>416 string Writing\ changes... \b2.37 11619>>>>>>438 ubyte x \b,0x%x dots 11620>>>>>>440 ubyte >0 \b,virus check 11621>>>>>>441 ubyte >0 \b,partition %c 11622#2.38,2.42,2.44 11623>>>>>416 string !Writing\ changes... \b 11624>>>>>>418 ubyte 1 \bvirus check, 11625>>>>>>419 ubyte x \b0x%x seconds 11626>>>>>>420 ubyte&0x0F >0 \b,partition 11627>>>>>>>420 ubyte&0x0F <5 \b %x 11628>>>>>>>420 ubyte&0x0F 0Xf \b ask 11629>>>>>420 ubyte x \b) 11630# 11631# SYSLINUX MBR moved 11632# https://www.acronis.de/ 11633>362 string MBR\ Error\ \0\r 11634>>376 string ress\ any\ key\ to\040 11635>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 11636# added by Joerg Jenderek 11637# https://www.visopsys.org/ 11638# https://partitionlogic.org.uk/ 11639>309 string No\ bootable\ partition\ found\r 11640>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 11641>349 string No\ bootable\ partition\ found\r 11642>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 11643# bootloader, bootmanager 11644>0x40 string SBML 11645# label with 11 characters of FAT 12 bit filesystem 11646>>43 string SMART\ BTMGR 11647>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 11648# OEM-ID not always "SBM" 11649#>>>>3 strings SBM 11650>>>>6 string >\0 \b, version %s 11651>382 string XOSLLOADXCF \b, eXtended Operating System Loader 11652>6 string LILO \b, LInux i386 boot LOader 11653>>120 string LILO \b, version 22.3.4 SuSe 11654>>172 string LILO \b, version 22.5.8 Debian 11655# updated by Joerg Jenderek at Oct 2008 11656# variables according to grub-0.97/stage1/stage1.S or 11657# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 11658# usual values are marked with comments to get only information of strange GRUB loaders 11659>342 search/60 \0Geom\0 11660#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 11661>>0x41 ubyte <2 11662>>>0x3E ubyte >2 \b; GRand Unified Bootloader 11663# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 11664>>>>0x3E ubyte x \b, stage1 version 0x%x 11665#If it is 0xFF, use a drive passed by BIOS 11666>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 11667# in most case 0,1,0x2e for GRUB 0.5.95 11668>>>>0x41 ubyte >0 \b, LBA flag 0x%x 11669>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 11670#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 11671>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 11672#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 11673>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 11674>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 11675#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 11676>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 11677>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 11678>>>>>394 string stage1 \b, GRUB version 0.5.95 11679>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 11680>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 11681>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 11682>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 11683>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 11684>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 11685>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 11686>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 11687# unknown version 11688>>>343 string Geom\0Read\0\ Error\0 11689>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 11690>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 11691>>>>374 string GRUB\ \0 \b, GRUB version n.m 11692# SYSLINUX bootloader moved 11693>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 11694# http://www.bcdwb.de/bcdw/index_e.htm 11695>3 string BCDL 11696>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 11697# mbr partition table entries updated by Joerg Jenderek at Sep 2013 11698# skip Norton Utilities disc image data 11699>3 string !IHISK 11700# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax; 11701>>0 belong !0xb8c0078e 11702# not Linux kernel 11703>>>514 string !HdrS 11704# not BeOS 11705>>>>422 string !Be\ Boot\ Loader 11706# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 11707>>>>>0 ubelong&0xFD000000 =0xE9000000 11708# AdvanceMAME mbr 11709>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 11710>>>>>>>446 use partition-table 11711# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 11712>>>>>0 ubelong&0xFD000000 !0xE9000000 11713# skip FSInfosector 11714>>>>>>0 string !RRaA 11715# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 11716# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 11717>>>>>>>0 ubequad !0xfa660fb64610668b 11718# skip 13rd sector of MS x86 bootloader 11719>>>>>>>>0 ubequad !0x660fb64610668b4e 11720# skip sector starting with DOS new line 11721>>>>>>>>>0 string !\r\n 11722# allowed active flag 0,80h-FFh 11723>>>>>>>>>>446 ubyte 0 11724>>>>>>>>>>>446 use partition-table 11725>>>>>>>>>>446 ubyte >0x7F 11726>>>>>>>>>>>446 use partition-table 11727# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 11728# mbr partition table entries end 11729# https://www.acronis.de/ 11730#FAT label=ACRONIS\ SZ 11731#OEM-ID=BOOTWIZ0 11732>442 string Non-system\ disk,\040 11733>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 11734# updated by Joerg Jenderek at Nov 2012, Sep 2013 11735# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 11736# display 1 space 11737>>>447 ubyte x \b 11738>>>477 use DOS-filename 11739# 11740>185 string FDBOOT\ Version\040 11741>>204 string \rNo\ Systemdisk.\040 11742>>>220 string Booting\ from\ harddisk.\n\r 11743>>>245 string Cannot\ load\ from\ harddisk.\n\r 11744>>>>273 string Insert\ Systemdisk\040 11745>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 11746>>>>>>200 string >\0 \b, version %-3s 11747>242 string Bootsector\ from\ C.H.\ Hochst\204 11748# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 11749# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 11750# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 11751>242 search/127 Bootsector\ from\ C.H.\ Hochst 11752>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 11753# followed by variants with point,CR-NL or NL-CR 11754>>>208 search/261 Cannot\ load\ from\ harddisk. 11755# followed by variants CR-NL or NL-CR 11756>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 11757# followed by variants with point,CR-NL or NL-CR 11758>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 11759# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 11760>>>>>>&0 string x \b, version %-4.4s 11761>(1.b+2) ubyte 0xe 11762>>(1.b+3) ubyte 0x1f 11763>>>(1.b+4) ubyte 0xbe 11764# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 11765>>>>(1.b+5) ubyte&0xd3 0x53 11766>>>>>(1.b+6) ubyte 0x7c 11767# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 11768>>>>>>(1.b+7) ubyte 0xac 11769>>>>>>>(1.b+8) ubyte 0x22 11770>>>>>>>>(1.b+9) ubyte 0xc0 11771>>>>>>>>>(1.b+10) ubyte 0x74 11772>>>>>>>>>>(1.b+11) ubyte 0x0b 11773>>>>>>>>>>>(1.b+12) ubyte 0x56 11774>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 11775# FAT1X version 11776>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 11777>>>>>>>>>>>>>>0x5b string >\0 "%-s" 11778# FAT32 version 11779>>>>>>>>>>>>>(1.b+5) ubyte 0x77 11780>>>>>>>>>>>>>>0x77 string >\0 "%-s" 11781>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 11782#>>244 string from\ dosemu-freedos-*-bin.tgz\r 11783#>>>170 string Sorry,\ could\ not\ load\ an\040 11784#>>>>195 string operating\ system.\r\n 11785# 11786>103 string This\ is\ not\ a\ bootable\ disk.\040 11787>>132 string Please\ insert\ a\ bootable\040 11788>>>157 string floppy\ and\r\n 11789>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 11790# 11791>66 string Solaris\ Boot\ Sector 11792>>99 string Incomplete\ MDBoot\ load. 11793>>>89 string Version \b, Sun Solaris Bootloader 11794>>>>97 byte x version %c 11795# 11796>408 string OS/2\ !!\ SYS01475\r\0 11797>>429 string OS/2\ !!\ SYS02025\r\0 11798>>>450 string OS/2\ !!\ SYS02027\r\0 11799>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 11800# 11801>409 string OS/2\ !!\ SYS01475\r\0 11802>>430 string OS/2\ !!\ SYS02025\r\0 11803>>>451 string OS/2\ !!\ SYS02027\r\0 11804>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 11805>112 string This\ disk\ is\ not\ bootable\r 11806>>142 string If\ you\ wish\ to\ make\ it\ bootable 11807>>>176 string run\ the\ DOS\ program\ SYS\040 11808>>>200 string after\ the\r 11809>>>>216 string system\ has\ been\ loaded\r\n 11810>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 11811>>>>>271 string into\r\n\ the\ drive\ and\040 11812>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 11813# XP 11814>430 string NTLDR\ is\ missing\xFF\r\n 11815>>449 string Disk\ error\xFF\r\n 11816>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 11817# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 11818>>>>417 ubyte&0xDF >0 11819>>>>>417 string x %-.5s 11820>>>>>>422 ubyte&0xDF >0 11821>>>>>>>422 string x \b%-.3s 11822>>>>>425 ubyte&0xDF >0 11823>>>>>>425 string >\ \b.%-.3s 11824# 11825>>>>371 ubyte >0x20 11826>>>>>368 ubyte&0xDF >0 11827>>>>>>368 string x %-.5s 11828>>>>>>>373 ubyte&0xDF >0 11829>>>>>>>>373 string x \b%-.3s 11830>>>>>>376 ubyte&0xDF >0 11831>>>>>>>376 string x \b.%-.3s 11832# 11833>430 string NTLDR\ nicht\ gefunden\xFF\r\n 11834>>453 string Datentr\204gerfehler\xFF\r\n 11835>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 11836>>>>417 ubyte&0xDF >0 11837>>>>>417 string x %-.5s 11838>>>>>>422 ubyte&0xDF >0 11839>>>>>>>422 string x \b%-.3s 11840>>>>>425 ubyte&0xDF >0 11841>>>>>>425 string >\ \b.%-.3s 11842# offset variant 11843>>>>379 string \0 11844>>>>>368 ubyte&0xDF >0 11845>>>>>>368 string x %-.5s 11846>>>>>>>373 ubyte&0xDF >0 11847>>>>>>>>373 string x \b%-.3s 11848# 11849>430 string NTLDR\ fehlt\xFF\r\n 11850>>444 string Datentr\204gerfehler\xFF\r\n 11851>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 11852>>>>417 ubyte&0xDF >0 11853>>>>>417 string x %-.5s 11854>>>>>>422 ubyte&0xDF >0 11855>>>>>>>422 string x \b%-.3s 11856>>>>>425 ubyte&0xDF >0 11857>>>>>>425 string >\ \b.%-.3s 11858# variant 11859>>>>371 ubyte >0x20 11860>>>>>368 ubyte&0xDF >0 11861>>>>>>368 string x %-.5s 11862>>>>>>>373 ubyte&0xDF >0 11863>>>>>>>>373 string x \b%-.3s 11864>>>>>>376 ubyte&0xDF >0 11865>>>>>>>376 string x \b.%-.3s 11866# 11867>430 string NTLDR\ fehlt\xFF\r\n 11868>>444 string Medienfehler\xFF\r\n 11869>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 11870>>>>371 ubyte >0x20 11871>>>>>368 ubyte&0xDF >0 11872>>>>>>368 string x %-.5s 11873>>>>>>>373 ubyte&0xDF >0 11874>>>>>>>>373 string x \b%-.3s 11875>>>>>>376 ubyte&0xDF >0 11876>>>>>>>376 string x \b.%-.3s 11877# variant 11878>>>>417 ubyte&0xDF >0 11879>>>>>417 string x %-.5s 11880>>>>>>422 ubyte&0xDF >0 11881>>>>>>>422 string x \b%-.3s 11882>>>>>425 ubyte&0xDF >0 11883>>>>>>425 string >\ \b.%-.3s 11884# 11885>430 string Datentr\204ger\ entfernen\xFF\r\n 11886>>454 string Medienfehler\xFF\r\n 11887>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 11888>>>>379 string \0 11889>>>>>368 ubyte&0xDF >0 11890>>>>>>368 string x %-.5s 11891>>>>>>>373 ubyte&0xDF >0 11892>>>>>>>>373 string x \b%-.3s 11893>>>>>>376 ubyte&0xDF >0 11894>>>>>>>376 string x \b.%-.3s 11895# variant 11896>>>>417 ubyte&0xDF >0 11897>>>>>417 string x %-.5s 11898>>>>>>422 ubyte&0xDF >0 11899>>>>>>>422 string x \b%-.3s 11900>>>>>425 ubyte&0xDF >0 11901>>>>>>425 string >\ \b.%-.3s 11902# 11903 11904#>3 string NTFS\ \ \ \040 11905>389 string Fehler\ beim\ Lesen\040 11906>>407 string des\ Datentr\204gers 11907>>>426 string NTLDR\ fehlt 11908>>>>440 string NTLDR\ ist\ komprimiert 11909>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 11910#>3 string NTFS\ \ \ \040 11911>313 string A\ disk\ read\ error\ occurred.\r 11912>>345 string A\ kernel\ file\ is\ missing\040 11913>>>370 string from\ the\ disk.\r 11914>>>>484 string NTLDR\ is\ compressed 11915>>>>>429 string Insert\ a\ system\ diskette\040 11916>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 11917# DOS loader variants different languages,offsets 11918>472 ubyte&0xDF >0 11919>>389 string Invalid\ system\ disk\xFF\r\n 11920>>>411 string Disk\ I/O\ error 11921>>>>428 string Replace\ the\ disk,\ and\040 11922>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 11923#IO.SYS 11924>>>>>>472 ubyte&0xDF >0 11925>>>>>>>472 string x \b %-.2s 11926>>>>>>>>474 ubyte&0xDF >0 11927>>>>>>>>>474 string x \b%-.5s 11928>>>>>>>>>>479 ubyte&0xDF >0 11929>>>>>>>>>>>479 string x \b%-.1s 11930>>>>>>>480 ubyte&0xDF >0 11931>>>>>>>>480 string x \b.%-.3s 11932#MSDOS.SYS 11933>>>>>>>483 ubyte&0xDF >0 \b+ 11934>>>>>>>>483 string x \b%-.5s 11935>>>>>>>>>488 ubyte&0xDF >0 11936>>>>>>>>>>488 string x \b%-.3s 11937>>>>>>>>491 ubyte&0xDF >0 11938>>>>>>>>>491 string x \b.%-.3s 11939# 11940>>390 string Invalid\ system\ disk\xFF\r\n 11941>>>412 string Disk\ I/O\ error\xFF\r\n 11942>>>>429 string Replace\ the\ disk,\ and\040 11943>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 11944>>388 string Ungueltiges\ System\ \xFF\r\n 11945>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 11946>>>>427 string Datentraeger\ wechseln\ und\040 11947>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 11948#WINBOOT.SYS only not spaces (0xDF) 11949>>>>>>497 ubyte&0xDF >0 11950>>>>>>>497 string x %-.5s 11951>>>>>>>>502 ubyte&0xDF >0 11952>>>>>>>>>502 string x \b%-.1s 11953>>>>>>>>>>503 ubyte&0xDF >0 11954>>>>>>>>>>>503 string x \b%-.1s 11955>>>>>>>>>>>>504 ubyte&0xDF >0 11956>>>>>>>>>>>>>504 string x \b%-.1s 11957>>>>>>505 ubyte&0xDF >0 11958>>>>>>>505 string x \b.%-.3s 11959#IO.SYS 11960>>>>>>472 ubyte&0xDF >0 or 11961>>>>>>>472 string x \b %-.2s 11962>>>>>>>>474 ubyte&0xDF >0 11963>>>>>>>>>474 string x \b%-.5s 11964>>>>>>>>>>479 ubyte&0xDF >0 11965>>>>>>>>>>>479 string x \b%-.1s 11966>>>>>>>480 ubyte&0xDF >0 11967>>>>>>>>480 string x \b.%-.3s 11968#MSDOS.SYS 11969>>>>>>>483 ubyte&0xDF >0 \b+ 11970>>>>>>>>483 string x \b%-.5s 11971>>>>>>>>>488 ubyte&0xDF >0 11972>>>>>>>>>>488 string x \b%-.3s 11973>>>>>>>>491 ubyte&0xDF >0 11974>>>>>>>>>491 string x \b.%-.3s 11975# 11976>>390 string Ungueltiges\ System\ \xFF\r\n 11977>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 11978>>>>429 string Datentraeger\ wechseln\ und\040 11979>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 11980#WINBOOT.SYS only not spaces (0xDF) 11981>>>>>>497 ubyte&0xDF >0 11982>>>>>>>497 string x %-.7s 11983>>>>>>>>504 ubyte&0xDF >0 11984>>>>>>>>>504 string x \b%-.1s 11985>>>>>>505 ubyte&0xDF >0 11986>>>>>>>505 string x \b.%-.3s 11987#IO.SYS 11988>>>>>>472 ubyte&0xDF >0 or 11989>>>>>>>472 string x \b %-.2s 11990>>>>>>>>474 ubyte&0xDF >0 11991>>>>>>>>>474 string x \b%-.6s 11992>>>>>>>480 ubyte&0xDF >0 11993>>>>>>>>480 string x \b.%-.3s 11994#MSDOS.SYS 11995>>>>>>>483 ubyte&0xDF >0 \b+ 11996>>>>>>>>483 string x \b%-.5s 11997>>>>>>>>>488 ubyte&0xDF >0 11998>>>>>>>>>>488 string x \b%-.3s 11999>>>>>>>>491 ubyte&0xDF >0 12000>>>>>>>>>491 string x \b.%-.3s 12001# 12002>>389 string Ungueltiges\ System\ \xFF\r\n 12003>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 12004>>>>428 string Datentraeger\ wechseln\ und\040 12005>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 12006# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 12007>>>>>>472 string x %-.2s 12008>>>>>>>474 ubyte&0xDF >0 12009>>>>>>>>474 string x \b%-.5s 12010>>>>>>>>479 ubyte&0xDF >0 12011>>>>>>>>>479 string x \b%-.1s 12012>>>>>>480 ubyte&0xDF >0 12013>>>>>>>480 string x \b.%-.3s 12014>>>>>>483 ubyte&0xDF >0 \b+ 12015>>>>>>>483 string x \b%-.5s 12016>>>>>>>488 ubyte&0xDF >0 12017>>>>>>>>488 string x \b%-.2s 12018>>>>>>>>490 ubyte&0xDF >0 12019>>>>>>>>>490 string x \b%-.1s 12020>>>>>>>491 ubyte&0xDF >0 12021>>>>>>>>491 string x \b.%-.3s 12022>479 ubyte&0xDF >0 12023>>416 string Kein\ System\ oder\040 12024>>>433 string Laufwerksfehler 12025>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 12026#IO.SYS 12027>>>>>479 string x \b %-.2s 12028>>>>>>481 ubyte&0xDF >0 12029>>>>>>>481 string x \b%-.6s 12030>>>>>487 ubyte&0xDF >0 12031>>>>>>487 string x \b.%-.3s 12032#MSDOS.SYS 12033>>>>>>490 ubyte&0xDF >0 \b+ 12034>>>>>>>490 string x \b%-.5s 12035>>>>>>>>495 ubyte&0xDF >0 12036>>>>>>>>>495 string x \b%-.3s 12037>>>>>>>498 ubyte&0xDF >0 12038>>>>>>>>498 string x \b.%-.3s 12039# 12040>376 search/41 Non-System\ disk\ or\040 12041>>395 search/41 disk\ error\r 12042>>>407 search/41 Replace\ and\040 12043>>>>419 search/41 press\ \b, 12044>>>>419 search/41 strike\ \b, old 12045>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 12046#449 Disk\ Boot\ failure\r MS 3.21 12047#466 Boot\ Failure\r MS 3.30 12048>>>>>468 search/18 \0 12049#IO.SYS,IBMBIO.COM 12050>>>>>>&0 string x \b %-.2s 12051>>>>>>>&-20 ubyte&0xDF >0 12052>>>>>>>>&-1 string x \b%-.4s 12053>>>>>>>>>&-16 ubyte&0xDF >0 12054>>>>>>>>>>&-1 string x \b%-.2s 12055>>>>>>&8 ubyte&0xDF >0 \b. 12056>>>>>>>&-1 string x \b%-.3s 12057#MSDOS.SYS,IBMDOS.COM 12058>>>>>>&11 ubyte&0xDF >0 \b+ 12059>>>>>>>&-1 string x \b%-.5s 12060>>>>>>>>&-6 ubyte&0xDF >0 12061>>>>>>>>>&-1 string x \b%-.1s 12062>>>>>>>>>>&-5 ubyte&0xDF >0 12063>>>>>>>>>>>&-1 string x \b%-.2s 12064>>>>>>>&7 ubyte&0xDF >0 \b. 12065>>>>>>>>&-1 string x \b%-.3s 12066>441 string Cannot\ load\ from\ harddisk.\n\r 12067>>469 string Insert\ Systemdisk\040 12068>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 12069#>43 string \224R-LOADER\ \ SYS =label 12070>54 string SYS 12071>>324 string VASKK 12072>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 12073# 12074>98 string Press\ a\ key\ to\ retry\0\r 12075>>120 string Cannot\ find\ file\ \0\r 12076>>>139 string Disk\ read\ error\0\r 12077>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 12078#DRBIOS.SYS 12079>>>>>44 ubyte&0xDF >0 12080>>>>>>44 string x \b %-.6s 12081>>>>>>>50 ubyte&0xDF >0 12082>>>>>>>>50 string x \b%-.2s 12083>>>>>>52 ubyte&0xDF >0 12084>>>>>>>52 string x \b.%-.3s 12085# 12086>70 string IBMBIO\ \ COM 12087>>472 string Cannot\ load\ DOS!\040 12088>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 12089>>471 string Cannot\ load\ DOS\040 12090>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 12091#?? 12092>444 string KERNEL\ \ SYS 12093>>314 string BOOT\ error! \b, FREE-DOS Bootloader 12094>499 string KERNEL\ \ SYS 12095>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 12096>449 string KERNEL\ \ SYS 12097>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 12098# 12099>449 string Loading\ FreeDOS 12100>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 12101>>>497 ubyte&0xDF >0 12102>>>>497 string x \b %-.6s 12103>>>>>503 ubyte&0xDF >0 12104>>>>>>503 string x \b%-.1s 12105>>>>>>>504 ubyte&0xDF >0 12106>>>>>>>>504 string x \b%-.1s 12107>>>>505 ubyte&0xDF >0 12108>>>>>505 string x \b.%-.3s 12109# 12110>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 12111# 12112>125 string Loading\ FreeDOS...\r 12113>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 12114>>>441 ubyte&0xDF >0 12115>>>>441 string x \b %-.6s 12116>>>>>447 ubyte&0xDF >0 12117>>>>>>447 string x \b%-.1s 12118>>>>>>>448 ubyte&0xDF >0 12119>>>>>>>>448 string x \b%-.1s 12120>>>>449 ubyte&0xDF >0 12121>>>>>449 string x \b.%-.3s 12122>124 string FreeDOS\0 12123>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 12124# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 12125>>>497 ubyte&0xDF >0 12126>>>>497 string x \b %-.6s 12127>>>>>503 ubyte&0xDF >0 12128>>>>>>503 string x \b%-.1s 12129>>>>>>>504 ubyte&0xDF >0 12130>>>>>>>>504 string x \b%-.1s 12131>>>>505 ubyte&0xDF >0 12132>>>>>505 string x \b.%-.3s 12133>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 12134>>>497 ubyte&0xDF >0 12135>>>>497 string x \b %-.6s 12136>>>>>503 ubyte&0xDF >0 12137>>>>>>503 string x \b%-.1s 12138>>>>>>>504 ubyte&0xDF >0 12139>>>>>>>>504 string x \b%-.1s 12140>>>>505 ubyte&0xDF >0 12141>>>>>505 string x \b.%-.3s 12142>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 12143>>>497 ubyte&0xDF >0 12144>>>>497 string x \b %-.6s 12145>>>>>503 ubyte&0xDF >0 12146>>>>>>503 string x \b%-.1s 12147>>>>>>>504 ubyte&0xDF >0 12148>>>>>>>>504 string x \b%-.1s 12149>>>>505 ubyte&0xDF >0 12150>>>>>505 string x \b.%-.3s 12151>336 string Error!\040 12152>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 12153>>>497 ubyte&0xDF >0 12154>>>>497 string x \b %-.6s 12155>>>>>503 ubyte&0xDF >0 12156>>>>>>503 string x \b%-.1s 12157>>>>>>>504 ubyte&0xDF >0 12158>>>>>>>>504 string x \b%-.1s 12159>>>>505 ubyte&0xDF >0 12160>>>>>505 string x \b.%-.3s 12161# added by Joerg Jenderek 12162# https://www.visopsys.org/ 12163# https://partitionlogic.org.uk/ 12164# OEM-ID=Visopsys 12165>478 ulelong 0 12166>>(1.b+326) string I/O\ Error\ reading\040 12167>>>(1.b+344) string Visopsys\ loader\r 12168>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 12169# http://alexfru.chat.ru/epm.html#bootprog 12170>494 ubyte >0x4D 12171>>495 string >E 12172>>>495 string <S 12173#OEM-ID is not reliable 12174>>>>3 string BootProg 12175# It just looks for a program file name at the root directory 12176# and loads corresponding file with following execution. 12177# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 12178>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 12179>>>>>499 use DOS-filename 12180#If the boot sector fails to read any other sector, 12181#it prints a very short message ("RE") to the screen and hangs the computer. 12182#If the boot sector fails to find needed program in the root directory, 12183#it also hangs with another message ("NF"). 12184>>>>>492 string RENF \b, FAT (12 bit) 12185>>>>>495 string RENF \b, FAT (16 bit) 12186#If the boot sector fails to read any other sector, 12187#it prints a very short message ("RE") to the screen and hangs the computer. 12188# x86 bootloader end 12189 12190# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 12191# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 12192>0 string RRaA 12193>>0x1E4 string rrAa \b, FSInfosector 12194#>>0x1FC uleshort =0 SHOULD BE ZERO 12195>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 12196>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 12197 12198# updated by Joerg Jenderek at Sep 2007 12199>3 ubyte 0 12200#no active flag 12201>>446 ubyte 0 12202# partition 1 not empty 12203>>>450 ubyte >0 12204# partitions 3,4 empty 12205>>>>482 ubyte 0 12206>>>>>498 ubyte 0 12207# partition 2 ID=0,5,15 12208>>>>>>466 ubyte <0x10 12209>>>>>>>466 ubyte 0x05 \b, extended partition table 12210>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 12211>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 12212 12213# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 12214 12215>0x200 lelong 0x82564557 \b, BSD disklabel 12216 12217# by Joerg Jenderek at Apr 2013 12218# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 12219# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 122200 name DOS-filename 12221# space=0x20 (00100000b) means empty 12222>0 ubyte&0xDF >0 12223>>0 ubyte x \b%c 12224>>>1 ubyte&0xDF >0 12225>>>>1 ubyte x \b%c 12226>>>>>2 ubyte&0xDF >0 12227>>>>>>2 ubyte x \b%c 12228>>>>>>>3 ubyte&0xDF >0 12229>>>>>>>>3 ubyte x \b%c 12230>>>>>>>>>4 ubyte&0xDF >0 12231>>>>>>>>>>4 ubyte x \b%c 12232>>>>>>>>>>>5 ubyte&0xDF >0 12233>>>>>>>>>>>>5 ubyte x \b%c 12234>>>>>>>>>>>>>6 ubyte&0xDF >0 12235>>>>>>>>>>>>>>6 ubyte x \b%c 12236>>>>>>>>>>>>>>>7 ubyte&0xDF >0 12237>>>>>>>>>>>>>>>>7 ubyte x \b%c 12238# DOS filename extension 12239>>8 ubyte&0xDF >0 \b. 12240>>>8 ubyte x \b%c 12241>>>>9 ubyte&0xDF >0 12242>>>>>9 ubyte x \b%c 12243>>>>>>10 ubyte&0xDF >0 12244>>>>>>>10 ubyte x \b%c 12245# Print 2 following DOS filenames from directory entry form 12246# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 122470 name 2xDOS-filename 12248# display 1 space 12249>0 ubyte x \b 12250>0 use DOS-filename 12251>11 ubyte x \b+ 12252>11 use DOS-filename 12253 12254# https://en.wikipedia.org/wiki/Master_boot_record#PTE 12255# display standard partition table 122560 name partition-table 12257#>0 ubyte x PARTITION-TABLE 12258# test and display 1st til 4th partition table entry 12259>0 use partition-entry-test 12260>16 use partition-entry-test 12261>32 use partition-entry-test 12262>48 use partition-entry-test 12263# test for entry of partition table 122640 name partition-entry-test 12265# partition type ID > 0 12266>4 ubyte >0 12267# active flag 0 12268>>0 ubyte 0 12269>>>0 use partition-entry 12270# active flag 0x80, 0x81, ... 12271>>0 ubyte >0x7F 12272>>>0 use partition-entry 12273# Print entry of partition table 122740 name partition-entry 12275# partition type ID > 0 12276>4 ubyte >0 \b; partition 12277>>64 leshort 0xAA55 1 12278>>48 leshort 0xAA55 2 12279>>32 leshort 0xAA55 3 12280>>16 leshort 0xAA55 4 12281>>4 ubyte x : ID=0x%x 12282>>0 ubyte&0x80 0x80 \b, active 12283>>0 ubyte >0x80 0x%x 12284>>1 ubyte x \b, start-CHS ( 12285>>1 use partition-chs 12286>>5 ubyte x \b), end-CHS ( 12287>>5 use partition-chs 12288>>8 ulelong x \b), startsector %u 12289>>12 ulelong x \b, %u sectors 12290# Print cylinder,head,sector (CHS) of partition entry 122910 name partition-chs 12292# cylinder 12293>1 ubyte x \b0x 12294>1 ubyte&0xC0 0x40 \b1 12295>1 ubyte&0xC0 0x80 \b2 12296>1 ubyte&0xC0 0xC0 \b3 12297>2 ubyte x \b%x 12298# head 12299>0 ubyte x \b,%u 12300# sector 12301>1 ubyte&0x3F x \b,%u 12302 12303# FATX 123040 string FATX FATX filesystem data 12305 12306# romfs filesystems - Juan Cespedes <cespedes@debian.org> 123070 string -rom1fs- romfs filesystem, version 1 12308>8 belong x %d bytes, 12309>16 string x named %s. 12310 12311# netboot image - Juan Cespedes <cespedes@debian.org> 123120 lelong 0x1b031336L Netboot image, 12313>4 lelong&0xFFFFFF00 0 12314>>4 lelong&0x100 0x000 mode 2 12315>>4 lelong&0x100 0x100 mode 3 12316>4 lelong&0xFFFFFF00 !0 unknown mode 12317 123180x18b string OS/2 OS/2 Boot Manager 12319 12320# updated by Joerg Jenderek at Oct 2008 and Sep 2012 12321# https://syslinux.zytor.com/iso.php 12322# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 12323# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 123240 ulequad&0x909000007cc0eafa 0x909000007c40eafa 12325>631 search/689 ISOLINUX\ isolinux Loader 12326>>&0 string x (version %-4.4s) 12327# https://syslinux.zytor.com/pxe.php 12328# assembler instructions: jmp 7C05 123290 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 12330# assembler instructions: pushfd;pushad 123310 ulelong 0x60669c66 pxelinux loader 12332# assembler instructions: jmp 05 123330 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 12334# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 123350 string LDLINUX\ SYS\ SYSLINUX loader 12336>12 string x (older version %-4.4s) 123370 string \r\nSYSLINUX\ SYSLINUX loader 12338>11 string x (version %-4.4s) 12339# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 12340# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 123410 ulelong&0x80909bEB 0x009018EB 12342# OEM-ID not always "SYSLINUX" 12343>434 search/47 Boot\ failed 12344# followed by \r\n\0 or :\ 12345>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 12346>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 12347>459 search/30 Boot\ error\r\n\0 12348>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 12349# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 12350# assembler instructions: mov di,0600h;mov cx,0100h 1235116 search/4 \xbf\x00\x06\xb9\x00\x01 12352# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 12353!:strength +36 12354>94 search/249 Missing\ operating\ system 12355# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 12356# skip Ranish MBR 12357>>408 search/4 HD1/\0 12358>>408 default x 12359>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 12360# followed by "ing " or space 12361>>>>292 search/98 error 12362>>>>>&0 string \r (version 3.35 or older) 12363>>>>>&0 string .\r (version 3.52 or newer) 12364>>>>>&0 default x (version 3.36-3.51 ) 12365>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 12366>>156 search/10 \0Boot\ partition\ not\ found\r\n 12367>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 12368>>174 search/10 \0Missing\ OS\r\n 12369>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 12370# SYSLINUX END 12371 12372# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 12373# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 123740 ubequad 0x31c08ed0bc007c8e 12375# mbr_bootsel magic before partition table not reliable with small ipl fragments 12376#>444 uleshort 0xb5e1 12377>0004 uleshort x 12378# ERRorTeXT 12379>>181 search/166 Error\ \0\r\n NetBSD mbr 12380# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 12381>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 12382# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 12383>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 12384# BOOT_EXTENDED definitions contains assembler instructions: 12385# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 12386>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 12387# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 12388>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 12389# not TERSE_ERROR 12390>>>196 search/106 No\ active\ partition\0 12391>>>>&0 string Disk\ read\ error\0 12392>>>>>&0 string No\ operating\ system\0 \b,verbose 12393# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 12394>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 12395# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 12396>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 12397# assembler instructions: movw nametab,bx 12398>>>0x26 search/21 \xBB\x94\x07 12399# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 12400>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 12401>>>>>181 search/166 Error\ \0 12402# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 12403>>>>>>&3 string x \b,"%s" 12404>>>446 use partition-table 12405# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 12406# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 12407# assembler instructions: jmp short 0x58;nop;ASCII 124080 ubequad&0xeb58908000000000 0xeb58900000000000 12409# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 12410>(1.b+2) ubequad 0xfa31c08ed88ec08e 12411# Error messages at end of code 12412>>376 string No\ operating\ system\r\n\0 12413>>>398 string Disk\ error\r\n\0FDD\0HDD\0 12414>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 12415 12416# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ 12417# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 12418# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 12419# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 124200 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 12421# pointer to the data starting with Neil Turton signature string 12422>(0x1BC.s) string NDTmbr 12423>>&-14 string 1234F\0 Turton mbr ( 12424# parameters also viewed by install-mbr --list 12425>>>(0x1BC.s+7) ubyte x \b%u<= 12426>>>(0x1BC.s+9) ubyte x \bVersion<=%u 12427#>>>(0x1BC.s+8) ubyte x asm_flag_%x 12428>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 12429# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode 12430>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 12431#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 12432#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 12433#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 12434#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 12435# for older versions 12436>>>(0x1BC.s+9) ubyte <2 12437#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 12438>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 12439# floppy A: or B: 12440>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 12441>>>>(0x1BC.s+13) ubyte >1 12442# 1st hard disc 12443#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 12444# not 1st hard disc 12445>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 12446# for version >= 2 maximal timeout can be 65534 12447>>>(0x1BC.s+9) ubyte >1 12448#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 12449>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 12450# floppy A: or B: 12451>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 12452>>>>(0x1BC.s+14) ubyte >1 12453# 1st hard disc 12454#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 12455# not 1st hard disc 12456>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 12457>>>0 ubyte x \b) 12458 12459# added by Joerg Jenderek 12460# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 12461# grub-1.94/kern/i386/pc/startup.S 12462# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 12463# usual values are marked with comments to get only information of strange GRUB loaders 124640x200 uleshort 0x70EA 12465# found only version 3.{1,2} 12466>0x206 ubeshort >0x0300 12467# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 12468>>0x212 ubyte >0x29 12469>>>0x213 ubyte >0x29 12470# not iso9660_stage1_5 12471#>>>0 ulelong&0x00BE5652 0x00BE5652 12472>>>>0x213 ubyte >0x29 GRand Unified Bootloader 12473# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 12474>>>>0x217 ubyte 0xFF stage1_5 12475>>>>0x217 ubyte <0xFF stage2 12476>>>>0x206 ubyte x \b version %u 12477>>>>0x207 ubyte x \b.%u 12478# module_size for 1.94 12479>>>>0x208 ulelong <0xffffff \b, installed partition %u 12480#>>>>0x208 ulelong =0xffffff \b, %lu (default) 12481>>>>0x208 ulelong >0xffffff \b, installed partition %u 12482# GRUB 0.5.95 unofficial 12483>>>>0x20C ulelong&0x2E300000 0x2E300000 12484# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 12485>>>>>0x20C ubyte x \b, identifier 0x%x 12486#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 12487>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 12488# GRUB version as string 12489>>>>>0x20E string >\0 \b, GRUB version %-s 12490# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12491>>>>>>0x215 ulong 0xffffffff 12492>>>>>>>0x219 string >\0 \b, configuration file %-s 12493>>>>>>0x215 ulong !0xffffffff 12494>>>>>>>0x215 string >\0 \b, configuration file %-s 12495# newer GRUB versions 12496>>>>0x20C ulelong&0x2E300000 !0x2E300000 12497##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 12498>>>>>0x20C ulelong >0 \b, saved entry %d 12499# for 1.94 contains kernel image size 12500# for 0.93,0.94,0.96,0.97 12501# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 12502>>>>>0x210 ubyte x \b, identifier 0x%x 12503# The flag for LBA forcing is in most cases 0 12504#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 12505>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 12506# GRUB version as string 12507>>>>>0x212 string >\0 \b, GRUB version %-s 12508# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12509>>>>>0x217 ulong 0xffffffff 12510>>>>>>0x21b string >\0 \b, configuration file %-s 12511>>>>>0x217 ulong !0xffffffff 12512>>>>>>0x217 string >\0 \b, configuration file %-s 12513 12514# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 12515# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 12516# over BIOS parameter block (BPB) 12517# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 12518# older drives may use Near JuMP instruction E9 xx xx 12519# minimal short forward jump found 0x29 for bootloaders or 0x0 12520# maximal short forward jump is 0x7f 12521# OEM-ID is empty or contain readable bytes 125220 ulelong&0x804000E9 0x000000E9 12523!:strength +60 12524# mtools-3.9.8/msdos.h 12525# usual values are marked with comments to get only information of strange FAT systems 12526# valid sectorsize must be a power of 2 from 32 to 32768 12527>11 uleshort&0x001f 0 12528>>11 uleshort <32769 12529>>>11 uleshort >31 12530>>>>21 ubyte&0xf0 0xF0 12531>>>>>0 ubyte 0xEB DOS/MBR boot sector 12532>>>>>>1 ubyte x \b, code offset 0x%x+2 12533>>>>>0 ubyte 0xE9 12534>>>>>>1 uleshort x \b, code offset 0x%x+3 12535>>>>>3 string >\0 \b, OEM-ID "%-.8s" 12536#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 12537>>>>>>8 string IHC \b cached by Windows 9M 12538>>>>>11 uleshort >512 \b, Bytes/sector %u 12539#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 12540>>>>>11 uleshort <512 \b, Bytes/sector %u 12541>>>>>13 ubyte >1 \b, sectors/cluster %u 12542#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 12543# for lazy FAT32 implementation like Transcend digital photo frame PF830 12544>>>>>82 string/c fat32 12545>>>>>>14 uleshort !32 \b, reserved sectors %u 12546#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 12547>>>>>82 string/c !fat32 12548>>>>>>14 uleshort >1 \b, reserved sectors %u 12549#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 12550#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 12551>>>>>16 ubyte >2 \b, FATs %u 12552#>>>>>16 ubyte =2 \b, FATs %u (usual) 12553>>>>>16 ubyte =1 \b, FAT %u 12554>>>>>16 ubyte >0 12555>>>>>17 uleshort >0 \b, root entries %u 12556#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 12557>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 12558#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 12559>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 12560#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 12561>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 12562>>>>>22 uleshort >0 \b, sectors/FAT %u 12563#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 12564>>>>>24 uleshort x \b, sectors/track %u 12565>>>>>26 ubyte >2 \b, heads %u 12566#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 12567>>>>>26 ubyte =1 \b, heads %u 12568# valid only for sector sizes with more then 32 Bytes 12569>>>>>11 uleshort >32 12570# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 12571# skip for values 2,2Ah,70h,73h,DFh 12572# and continue for extended boot signature values 0,28h,29h,80h 12573>>>>>>38 ubyte&0x56 =0 12574>>>>>>>28 ulelong >0 \b, hidden sectors %u 12575#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 12576>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 12577#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 12578# FAT<32 bit specific 12579>>>>>>>82 string/c !fat32 12580#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 12581#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 12582>>>>>>>>36 ubyte !0x80 12583>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 12584# VGA-copy CRC or 12585# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12586>>>>>>>>37 ubyte >0 \b, reserved 0x%x 12587#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 12588# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others 12589>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12590>>>>>>>>38 ubyte&0xFE =0x28 12591>>>>>>>>>39 ulelong x \b, serial number 0x%x 12592>>>>>>>>38 ubyte =0x29 12593>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 12594>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 12595>>>>>>>>>43 string =NO\ NAME \b, unlabeled 12596# there exist some old floppies without word FAT at offset 54 12597# a word like "FATnm " is only a hint for a FAT size on nm-bits 12598# Normally the number of clusters is calculated by the values of BPP. 12599# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 12600# otherwise FAT is 16 bit. 12601# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 12602>>>>>82 string/c !fat32 12603>>>>>>54 string FAT12 \b, FAT (12 bit) 12604>>>>>>54 string FAT16 \b, FAT (16 bit) 12605>>>>>>54 default x 12606# determinate FAT bit size by media descriptor 12607# small floppies implies FAT12 12608>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 12609# with media descriptor F0h floppy or maybe superfloppy with FAT16 12610>>>>>>>21 ubyte =0xF0 12611# superfloppy (many sectors) implies FAT16 12612>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 12613# no superfloppy with media descriptor F0h implies FAT12 12614>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 12615# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 12616>>>>>>>21 ubyte =0xF8 12617# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 12618>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 12619# hard disc with FAT12 or FAT16 12620>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12621# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 12622>>>>>>>21 ubyte =0xFA 12623# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 12624>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 12625# RAM disc with FAT12 or FAT16 or Tandy hard disc 12626>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12627# others are floppy 12628>>>>>>>21 default x \b, FAT (12 bit by descriptor) 12629# FAT32 bit specific 12630>>>>>82 string/c fat32 \b, FAT (32 bit) 12631>>>>>>36 ulelong x \b, sectors/FAT %u 12632# https://technet.microsoft.com/en-us/library/cc977221.aspx 12633>>>>>>40 uleshort >0 \b, extension flags 0x%x 12634#>>>>>>40 uleshort =0 \b, extension flags %hu 12635>>>>>>42 uleshort >0 \b, fsVersion %u 12636#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 12637>>>>>>44 ulelong >2 \b, rootdir cluster %u 12638#>>>>>>44 ulelong =2 \b, rootdir cluster %u 12639#>>>>>>44 ulelong =1 \b, rootdir cluster %u 12640>>>>>>48 uleshort >1 \b, infoSector %u 12641#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 12642>>>>>>48 uleshort <1 \b, infoSector %u 12643# 0 or 0xFFFF instead of usual 6 means no backup sector 12644>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 12645>>>>>>50 uleshort =0 \b, no Backup boot sector 12646#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 12647>>>>>>50 default x 12648>>>>>>>50 uleshort x \b, Backup boot sector %u 12649# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 12650>>>>>>52 ulelong >0 \b, reserved1 0x%x 12651>>>>>>56 ulelong >0 \b, reserved2 0x%x 12652>>>>>>60 ulelong >0 \b, reserved3 0x%x 12653# same structure as FAT1X 12654#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 12655#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 12656>>>>>>64 ubyte !0x80 12657>>>>>>>64 ubyte >0 \b, physical drive 0x%x 12658# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12659>>>>>>65 ubyte >0 \b, reserved 0x%x 12660>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12661>>>>>>66 ubyte =0x29 12662>>>>>>>67 ulelong x \b, serial number 0x%x 12663>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 12664>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 12665>>>>>>>71 string =NO\ NAME \b, unlabeled 12666# additional tests for floppy image added by Joerg Jenderek 12667# no fixed disk 12668>>>>>21 ubyte !0xF8 12669# floppy media with 12 bit FAT 12670>>>>>>54 string !FAT16 12671# test for FAT after bootsector 12672>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 12673# floppy image 12674!:mime application/x-ima 12675# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 12676# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 12677# 0 FATs 12678>>>>>16 ubyte =0 12679# 0 root entries 12680>>>>>>17 uleshort =0 12681# 0 DOS sectors 12682>>>>>>>19 uleshort =0 12683# 0 sectors/FAT 12684# dos < 4.0 BootSector value found is 0x80 12685#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 12686>>>>>>>>22 uleshort =0 \b; NTFS 12687>>>>>>>>>24 uleshort >0 \b, sectors/track %u 12688>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 12689>>>>>>>>>40 ulequad >0 \b, sectors %lld 12690>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 12691>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 12692# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 12693# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 12694>>>>>>>>>64 lelong <256 12695>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 12696>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 12697# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 12698# Values 128 to 255 represent index block sizes of 2^(256-N) byte 12699>>>>>>>>>68 ulelong <256 12700>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 12701#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 12702>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 12703>>>>>>>>>72 ulequad x \b, serial number 0%llx 12704>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 12705#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 12706# unicode loadername size jump 12707>>>>>>>>>(0x200.s*2) ubyte x 12708# in next sector loadername terminated by unicode CTRL-D and $ 12709>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains 12710# if 2nd NTFS sectors is found then assume whole filesystem 12711#!:mime application/x-raw-disk-image 12712!:ext img/bin/ntfs 12713>>>>>>>>>>>0x200 use ntfs-sector2 12714 12715# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 12716# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 12717# unused assembler instructions short JMP y2;NOP;NOP 127180x056 ulelong&0xFFFF0FFF 0x909002EB NTFS 12719#!:mime application/octet-stream 12720!:ext bin 12721>0 use ntfs-sector2 12722# https://memory.dataram.com/products-and-services/software/ramdisk 12723# assembler instructions JMP C000;NOP 127240x056 ulelong 0x9000c0e9 NTFS 12725#!:mime application/octet-stream 12726!:ext bin 12727>0 use ntfs-sector2 12728# check for characteristics of second NTFS sector and then display loader name 127290 name ntfs-sector2 12730# number of utf16 characters of loadername 12731>0 uleshort <8 12732# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP 12733>>0x056 ulelong&0xFF0000FD 0x900000E9 12734# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 12735>>>0x002 lestring16 x bootstrap %-5.5s 12736# check for 7 character length of loader name like BOOTMGR 12737>>>0 uleshort 7 12738>>>>0x0c lestring16 x \b%-2.2s 12739### DOS,NTFS boot sectors end 12740 12741# ntfsclone-image is a special save format for NTFS volumes, 12742# created and restored by the ntfsclone program 127430 string \0ntfsclone-image ntfsclone image, 12744>0x10 byte x version %d. 12745>0x11 byte x \b%d, 12746>0x12 lelong x cluster size %d, 12747>0x16 lequad x device size %lld, 12748>0x1e lequad x %lld total clusters, 12749>0x26 lequad x %lld clusters in use 12750 127519564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 12752>8404 string x last mounted on %s, 12753#>9504 ledate x last checked at %s, 12754>8224 ledate x last written at %s, 12755>8401 byte x clean flag %d, 12756>8228 lelong x number of blocks %d, 12757>8232 lelong x number of data blocks %d, 12758>8236 lelong x number of cylinder groups %d, 12759>8240 lelong x block size %d, 12760>8244 lelong x fragment size %d, 12761>8252 lelong x minimum percentage of free blocks %d, 12762>8256 lelong x rotational delay %dms, 12763>8260 lelong x disk rotational speed %drps, 12764>8320 lelong 0 TIME optimization 12765>8320 lelong 1 SPACE optimization 12766 1276742332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12768>&-1164 string x last mounted on %s, 12769>&-696 string >\0 volume name %s, 12770>&-304 leqldate x last written at %s, 12771>&-1167 byte x clean flag %d, 12772>&-1168 byte x readonly flag %d, 12773>&-296 lequad x number of blocks %lld, 12774>&-288 lequad x number of data blocks %lld, 12775>&-1332 lelong x number of cylinder groups %d, 12776>&-1328 lelong x block size %d, 12777>&-1324 lelong x fragment size %d, 12778>&-180 lelong x average file size %d, 12779>&-176 lelong x average number of files in dir %d, 12780>&-272 lequad x pending blocks to free %lld, 12781>&-264 lelong x pending inodes to free %d, 12782>&-664 lequad x system-wide uuid %0llx, 12783>&-1316 lelong x minimum percentage of free blocks %d, 12784>&-1248 lelong 0 TIME optimization 12785>&-1248 lelong 1 SPACE optimization 12786 1278766908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12788>&-1164 string x last mounted on %s, 12789>&-696 string >\0 volume name %s, 12790>&-304 leqldate x last written at %s, 12791>&-1167 byte x clean flag %d, 12792>&-1168 byte x readonly flag %d, 12793>&-296 lequad x number of blocks %lld, 12794>&-288 lequad x number of data blocks %lld, 12795>&-1332 lelong x number of cylinder groups %d, 12796>&-1328 lelong x block size %d, 12797>&-1324 lelong x fragment size %d, 12798>&-180 lelong x average file size %d, 12799>&-176 lelong x average number of files in dir %d, 12800>&-272 lequad x pending blocks to free %lld, 12801>&-264 lelong x pending inodes to free %d, 12802>&-664 lequad x system-wide uuid %0llx, 12803>&-1316 lelong x minimum percentage of free blocks %d, 12804>&-1248 lelong 0 TIME optimization 12805>&-1248 lelong 1 SPACE optimization 12806 128079564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 12808>7168 belong 0x4c41424c Apple UFS Volume 12809>>7186 string x named %s, 12810>>7176 belong x volume label version %d, 12811>>7180 bedate x created on %s, 12812>8404 string x last mounted on %s, 12813#>9504 bedate x last checked at %s, 12814>8224 bedate x last written at %s, 12815>8401 byte x clean flag %d, 12816>8228 belong x number of blocks %d, 12817>8232 belong x number of data blocks %d, 12818>8236 belong x number of cylinder groups %d, 12819>8240 belong x block size %d, 12820>8244 belong x fragment size %d, 12821>8252 belong x minimum percentage of free blocks %d, 12822>8256 belong x rotational delay %dms, 12823>8260 belong x disk rotational speed %drps, 12824>8320 belong 0 TIME optimization 12825>8320 belong 1 SPACE optimization 12826 1282742332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12828>&-1164 string x last mounted on %s, 12829>&-696 string >\0 volume name %s, 12830>&-304 beqldate x last written at %s, 12831>&-1167 byte x clean flag %d, 12832>&-1168 byte x readonly flag %d, 12833>&-296 bequad x number of blocks %lld, 12834>&-288 bequad x number of data blocks %lld, 12835>&-1332 belong x number of cylinder groups %d, 12836>&-1328 belong x block size %d, 12837>&-1324 belong x fragment size %d, 12838>&-180 belong x average file size %d, 12839>&-176 belong x average number of files in dir %d, 12840>&-272 bequad x pending blocks to free %lld, 12841>&-264 belong x pending inodes to free %d, 12842>&-664 bequad x system-wide uuid %0llx, 12843>&-1316 belong x minimum percentage of free blocks %d, 12844>&-1248 belong 0 TIME optimization 12845>&-1248 belong 1 SPACE optimization 12846 1284766908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12848>&-1164 string x last mounted on %s, 12849>&-696 string >\0 volume name %s, 12850>&-304 beqldate x last written at %s, 12851>&-1167 byte x clean flag %d, 12852>&-1168 byte x readonly flag %d, 12853>&-296 bequad x number of blocks %lld, 12854>&-288 bequad x number of data blocks %lld, 12855>&-1332 belong x number of cylinder groups %d, 12856>&-1328 belong x block size %d, 12857>&-1324 belong x fragment size %d, 12858>&-180 belong x average file size %d, 12859>&-176 belong x average number of files in dir %d, 12860>&-272 bequad x pending blocks to free %lld, 12861>&-264 belong x pending inodes to free %d, 12862>&-664 bequad x system-wide uuid %0llx, 12863>&-1316 belong x minimum percentage of free blocks %d, 12864>&-1248 belong 0 TIME optimization 12865>&-1248 belong 1 SPACE optimization 12866 128670 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 12868>0x90 lelong+1 x volume %d 12869>0x94 lelong x (of %d), 12870>0x50 string x name %s, 12871>0x98 ulelong x version %u, 12872>0xa0 ulelong x flags 0x%x 12873 12874# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 12875# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 12876# volume label and UUID Russell Coker 12877# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 128780x438 leshort 0xEF53 Linux 12879>0x44c lelong x rev %d 12880>0x43e leshort x \b.%d 12881# No journal? ext2 12882>0x45c lelong ^0x0000004 ext2 filesystem data 12883>>0x43a leshort ^0x0000001 (mounted or unclean) 12884# Has a journal? ext3 or ext4 12885>0x45c lelong &0x0000004 12886# and small INCOMPAT? 12887>>0x460 lelong <0x0000040 12888# and small RO_COMPAT? 12889>>>0x464 lelong <0x0000008 ext3 filesystem data 12890# else large RO_COMPAT? 12891>>>0x464 lelong >0x0000007 ext4 filesystem data 12892# else large INCOMPAT? 12893>>0x460 lelong >0x000003f ext4 filesystem data 12894>0x468 belong x \b, UUID=%08x 12895>0x46c beshort x \b-%04x 12896>0x46e beshort x \b-%04x 12897>0x470 beshort x \b-%04x 12898>0x472 belong x \b-%08x 12899>0x476 beshort x \b%04x 12900>0x478 string >0 \b, volume name "%s" 12901# General flags for any ext* fs 12902>0x460 lelong &0x0000004 (needs journal recovery) 12903>0x43a leshort &0x0000002 (errors) 12904# INCOMPAT flags 12905>0x460 lelong &0x0000001 (compressed) 12906#>0x460 lelong &0x0000002 (filetype) 12907#>0x460 lelong &0x0000010 (meta bg) 12908>0x460 lelong &0x0000040 (extents) 12909>0x460 lelong &0x0000080 (64bit) 12910#>0x460 lelong &0x0000100 (mmp) 12911#>0x460 lelong &0x0000200 (flex bg) 12912# RO_INCOMPAT flags 12913#>0x464 lelong &0x0000001 (sparse super) 12914>0x464 lelong &0x0000002 (large files) 12915>0x464 lelong &0x0000008 (huge files) 12916#>0x464 lelong &0x0000010 (gdt checksum) 12917#>0x464 lelong &0x0000020 (many subdirs) 12918#>0x463 lelong &0x0000040 (extra isize) 12919 12920# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 129210x400 lelong 0xF2F52010 F2FS filesystem 12922>0x46c belong x \b, UUID=%08x 12923>0x470 beshort x \b-%04x 12924>0x472 beshort x \b-%04x 12925>0x474 beshort x \b-%04x 12926>0x476 belong x \b-%08x 12927>0x47a beshort x \b%04x 12928>0x147c lestring16 x \b, volume name "%s" 12929 12930# Minix filesystems - Juan Cespedes <cespedes@debian.org> 129310x410 leshort 0x137f 12932!:strength / 2 12933>0x402 beshort < 100 12934>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 12935>0x1e string minix \b, bootable 129360x410 beshort 0x137f 12937!:strength / 2 12938>0x402 beshort < 100 12939>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 12940>0x1e string minix \b, bootable 129410x410 leshort 0x138f 12942!:strength / 2 12943>0x402 beshort < 100 12944>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 12945>0x1e string minix \b, bootable 129460x410 beshort 0x138f 12947!:strength / 2 12948>0x402 beshort < 100 12949>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 12950>0x1e string minix \b, bootable 12951# Weak Magic: this is $x 12952#0x410 leshort 0x2468 12953#>0x402 beshort < 100 12954#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 12955#>0x1e string minix \b, bootable 12956#0x410 beshort 0x2468 12957#>0x402 beshort < 100 12958#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 12959#>0x1e string minix \b, bootable 12960#0x410 leshort 0x2478 12961#>0x402 beshort < 100 12962#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12963#>0x1e string minix \b, bootable 12964#0x410 leshort 0x2478 12965#>0x402 beshort < 100 12966#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12967#>0x1e string minix \b, bootable 12968#0x410 beshort 0x2478 12969#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 12970#>0x1e string minix \b, bootable 12971# Weak Magic! this is MD 12972#0x418 leshort 0x4d5a 12973#>0x402 beshort <100 12974#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 12975 12976# SGI disk labels - Nathan Scott <nathans@debian.org> 129770 belong 0x0BE5A941 SGI disk label (volume header) 12978 12979# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 129800 belong 0x58465342 SGI XFS filesystem data 12981>0x4 belong x (blksz %d, 12982>0x68 beshort x inosz %d, 12983>0x64 beshort ^0x2004 v1 dirs) 12984>0x64 beshort &0x2004 v2 dirs) 12985 12986############################################################################ 12987# Minix-ST kernel floppy 129880x800 belong 0x46fc2700 Atari-ST Minix kernel image 12989# https://en.wikipedia.org/wiki/BIOS_parameter_block 12990# floppies with valid BPB and any instruction at beginning 12991>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 12992>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 12993 12994############################################################################ 12995# Hmmm, is this a better way of detecting _standard_ floppy images ? 1299619 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 12997>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1299819 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 12999>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1300019 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 13001>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 13002 1300319 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 13004>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1300519 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 13006>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 13007 1300819 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1300919 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 13010# | | | | | 13011# | | | | heads 13012# | | | sectors/track 13013# | | sectors/FAT 13014# | media descriptor 13015# BPB: sectors 13016 13017# Valid media descriptor bytes for MS-DOS: 13018# 13019# Byte Capacity Media Size and Type 13020# ------------------------------------------------- 13021# 13022# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 13023# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 13024# F9 720K 3.5-inch, 2-sided, 9-sector 13025# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 13026# FD 360K 5.25-inch, 2-sided, 9-sector 13027# FF 320K 5.25-inch, 2-sided, 8-sector 13028# FC 180K 5.25-inch, 1-sided, 9-sector 13029# FE 160K 5.25-inch, 1-sided, 8-sector 13030# FE 250K 8-inch, 1-sided, single-density 13031# FD 500K 8-inch, 2-sided, single-density 13032# FE 1.2 MB 8-inch, 2-sided, double-density 13033# F8 ----- Fixed disk 13034# 13035# FC xxxK Apricot 70x1x9 boot disk. 13036# 13037# Originally a bitmap: 13038# xxxxxxx0 Not two sided 13039# xxxxxxx1 Double sided 13040# xxxxxx0x Not 8 SPT 13041# xxxxxx1x 8 SPT 13042# xxxxx0xx Not Removable drive 13043# xxxxx1xx Removable drive 13044# 11111xxx Must be one. 13045# 13046# But now it's rather random: 13047# 111111xx Low density disk 13048# 00 SS, Not 8 SPT 13049# 01 DS, Not 8 SPT 13050# 10 SS, 8 SPT 13051# 11 DS, 8 SPT 13052# 13053# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 13054# 11110000 High density 3 1/2 floppy disk 13055# 11111000 Hard disk any format 13056# 13057 13058# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 13059# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 13060# Too Weak. 13061#512 ubelong&0xE0ffff00 0xE0ffff00 13062# without valid Media descriptor in place of BPB, cases with are done at other places 13063#>21 ubyte <0xE5 floppy with old FAT filesystem 13064# but valid Media descriptor at begin of FAT 13065#>>512 ubyte =0xed 720k 13066#>>512 ubyte =0xf0 1440k 13067#>>512 ubyte =0xf8 720k 13068#>>512 ubyte =0xf9 1220k 13069#>>512 ubyte =0xfa 320k 13070#>>512 ubyte =0xfb 640k 13071#>>512 ubyte =0xfc 180k 13072# look like an old DOS directory entry 13073#>>>0xA0E ubequad 0 13074#>>>>0xA00 ubequad !0 13075#!:mime application/x-ima 13076#>>512 ubyte =0xfd 13077# look for 2nd FAT at different location to distinguish between 360k and 500k 13078#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 13079#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 13080#>>>0xA0E ubequad 0 13081#!:mime application/x-ima 13082#>>512 ubyte =0xfe 13083#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 13084#>>>>0x60E ubequad 0 13085#>>>>>0x600 ubequad !0 13086#!:mime application/x-ima 13087#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 13088#>>512 ubyte =0xff 320k 13089#>>>0x60E ubequad 0 13090#>>>>0x600 ubequad !0 13091#!:mime application/x-ima 13092#>>512 ubyte x \b, Media descriptor 0x%x 13093# without x86 jump instruction 13094#>>0 ulelong&0x804000E9 !0x000000E9 13095# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 13096#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 13097# IOSYS.COM+MSDOS.COM 13098#>>>>0xc4 use 2xDOS-filename 13099#>>0 ulelong&0x804000E9 =0x000000E9 13100# only x86 short jump instruction found 13101#>>>0 ubyte =0xEB 13102#>>>>1 ubyte x \b, code offset 0x%x+2 13103# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm 13104# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 13105#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 13106# ibmbio.com+ibmdos.com 13107#>>>>>0x176 use DOS-filename 13108#>>>>>0x181 ubyte x \b+ 13109#>>>>>0x182 use DOS-filename 13110# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm 13111# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 13112#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 13113# ibmbio.com+ibmdos.com 13114#>>>>>0x18b use DOS-filename 13115#>>>>>0x196 ubyte x \b+ 13116#>>>>>0x197 use DOS-filename 13117# https://en.wikipedia.org/wiki/Zenith_Data_Systems 13118# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 13119#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 13120# IO.SYS+MSDOS.SYS 13121#>>>>>0x20 use 2xDOS-filename 13122# https://en.wikipedia.org/wiki/Corona_Data_Systems 13123# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 13124#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 13125# IO.SYS+MSDOS.SYS 13126#>>>>>0x69 use 2xDOS-filename 13127# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 13128#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 13129# defect IO.SYS+MSDOS.SYS ? 13130#>>>>>0x162 use 2xDOS-filename 13131 131320 name cdrom 13133>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 13134!:mime application/x-iso9660-image 13135!:ext iso/iso9660 13136>38913 string NSR0 UDF filesystem data 13137!:mime application/x-iso9660-image 13138!:ext iso/udf 13139>>38917 string 1 (version 1.0) 13140>>38917 string 2 (version 1.5) 13141>>38917 string 3 (version 2.0) 13142>>38917 byte >0x33 (unknown version, ID 0x%X) 13143>>38917 byte <0x31 (unknown version, ID 0x%X) 13144# The next line is not necessary because the MBR staff is done looking for boot signature 13145>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 13146# "application id" which appears to be used as a volume label 13147>32808 string/T >\0 '%.32s' 13148>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1314937633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 13150!:mime application/x-iso9660-image 1315132777 string CDROM High Sierra CD-ROM filesystem data 13152# "application id" which appears to be used as a volume label 13153>32816 string/T >\0 '%.32s' 13154 13155 13156# CDROM Filesystems 13157# https://en.wikipedia.org/wiki/ISO_9660 13158# Modified for UDF by gerardo.cacciari@gmail.com 1315932769 string CD001 13160# mime line at that position does not work 13161# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 13162#!:strength -11 13163# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 13164!:strength +35 13165>0 use cdrom 13166 13167# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 13168# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 13169# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 13170# From: Joerg Jenderek 13171# Note: Only for nero disc with once (DAO) type after 300 KB header 13172339969 string CD001 Nero CD image at 0x4B000 13173!:mime application/x-nrg 13174!:ext nrg 13175>307200 use cdrom 13176 13177# .cso files 13178# Reference: https://pismotec.com/ciso/ciso.h 13179# NOTE: There are two other formats with the same magic but 13180# completely incompatible specifications: 13181# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 13182# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 131830 string CISO 13184# Other fields are used to determine what type of CISO this is: 13185# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 13186# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 13187# - 0x10 == 0x00004000: For >2GB files using maxcso... 13188# https://github.com/unknownbrackets/maxcso/issues/26 13189# - None of the above: Compact ISO. 13190>4 lelong !0 13191>>4 lelong !0x200000 13192>>>16 lelong !0x800 13193>>>>16 lelong !0x4000 Compressed ISO CD image 13194 13195# cramfs filesystem - russell@coker.com.au 131960 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 13197>4 lelong x size %u 13198>8 lelong &1 version #2 13199>8 lelong &2 sorted_dirs 13200>8 lelong &4 hole_support 13201>32 lelong x CRC 0x%x, 13202>36 lelong x edition %u, 13203>40 lelong x %u blocks, 13204>44 lelong x %u files 13205 132060 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 13207>4 belong x size %u 13208>8 belong &1 version #2 13209>8 belong &2 sorted_dirs 13210>8 belong &4 hole_support 13211>32 belong x CRC 0x%x, 13212>36 belong x edition %u, 13213>40 belong x %u blocks, 13214>44 belong x %u files 13215 13216# reiserfs - russell@coker.com.au 132170x10034 string ReIsErFs ReiserFS V3.5 132180x10034 string ReIsEr2Fs ReiserFS V3.6 132190x10034 string ReIsEr3Fs ReiserFS V3.6.19 13220>0x1002c leshort x block size %d 13221>0x10032 leshort &2 (mounted or unclean) 13222>0x10000 lelong x num blocks %d 13223>0x10040 lelong 1 tea hash 13224>0x10040 lelong 2 yura hash 13225>0x10040 lelong 3 r5 hash 13226 13227# EST flat binary format (which isn't, but anyway) 13228# From: Mark Brown <broonie@sirena.org.uk> 132290 string ESTFBINR EST flat binary 13230 13231# Aculab VoIP firmware 13232# From: Mark Brown <broonie@sirena.org.uk> 132330 string VoIP\ Startup\ and Aculab VoIP firmware 13234>35 string x format %s 13235 13236# From: Mark Brown <broonie@sirena.org.uk> [old] 13237# From: Behan Webster <behanw@websterwood.com> 132380 belong 0x27051956 u-boot legacy uImage, 13239>32 string x %s, 13240>28 byte 0 Invalid os/ 13241>28 byte 1 OpenBSD/ 13242>28 byte 2 NetBSD/ 13243>28 byte 3 FreeBSD/ 13244>28 byte 4 4.4BSD/ 13245>28 byte 5 Linux/ 13246>28 byte 6 SVR4/ 13247>28 byte 7 Esix/ 13248>28 byte 8 Solaris/ 13249>28 byte 9 Irix/ 13250>28 byte 10 SCO/ 13251>28 byte 11 Dell/ 13252>28 byte 12 NCR/ 13253>28 byte 13 LynxOS/ 13254>28 byte 14 VxWorks/ 13255>28 byte 15 pSOS/ 13256>28 byte 16 QNX/ 13257>28 byte 17 Firmware/ 13258>28 byte 18 RTEMS/ 13259>28 byte 19 ARTOS/ 13260>28 byte 20 Unity OS/ 13261>28 byte 21 INTEGRITY/ 13262>29 byte 0 \bInvalid CPU, 13263>29 byte 1 \bAlpha, 13264>29 byte 2 \bARM, 13265>29 byte 3 \bIntel x86, 13266>29 byte 4 \bIA64, 13267>29 byte 5 \bMIPS, 13268>29 byte 6 \bMIPS 64-bit, 13269>29 byte 7 \bPowerPC, 13270>29 byte 8 \bIBM S390, 13271>29 byte 9 \bSuperH, 13272>29 byte 10 \bSparc, 13273>29 byte 11 \bSparc 64-bit, 13274>29 byte 12 \bM68K, 13275>29 byte 13 \bNios-32, 13276>29 byte 14 \bMicroBlaze, 13277>29 byte 15 \bNios-II, 13278>29 byte 16 \bBlackfin, 13279>29 byte 17 \bAVR32, 13280>29 byte 18 \bSTMicroelectronics ST200, 13281>29 byte 19 \bSandbox architecture, 13282>29 byte 20 \bANDES Technology NDS32, 13283>29 byte 21 \bOpenRISC 1000, 13284>29 byte 22 \bARM 64-bit, 13285>29 byte 23 \bDesignWare ARC, 13286>29 byte 24 \bx86_64, 13287>29 byte 25 \bXtensa, 13288>29 byte 26 \bRISC-V, 13289>30 byte 0 Invalid Image 13290>30 byte 1 Standalone Program 13291>30 byte 2 OS Kernel Image 13292>30 byte 3 RAMDisk Image 13293>30 byte 4 Multi-File Image 13294>30 byte 5 Firmware Image 13295>30 byte 6 Script File 13296>30 byte 7 Filesystem Image (any type) 13297>30 byte 8 Binary Flat Device Tree BLOB 13298>31 byte 0 (Not compressed), 13299>31 byte 1 (gzip), 13300>31 byte 2 (bzip2), 13301>31 byte 3 (lzma), 13302>12 belong x %d bytes, 13303>8 bedate x %s, 13304>16 belong x Load Address: 0x%08X, 13305>20 belong x Entry Point: 0x%08X, 13306>4 belong x Header CRC: 0x%08X, 13307>24 belong x Data CRC: 0x%08X 13308 13309# JFFS2 file system 133100 leshort 0x1984 Linux old jffs2 filesystem data little endian 133110 beshort 0x1984 Linux old jffs2 filesystem data big endian 133120 leshort 0x1985 Linux jffs2 filesystem data little endian 133130 beshort 0x1985 Linux jffs2 filesystem data big endian 13314 13315# Squashfs 133160 name squashfs 13317>28 beshort x version %d. 13318>30 beshort x \b%d, 13319>20 beshort 0 uncompressed, 13320>20 beshort 1 zlib 13321>20 beshort 2 lzma 13322>20 beshort 3 lzo 13323>20 beshort 4 xz 13324>20 beshort 5 lz4 13325>20 beshort 6 zstd 13326>20 beshort >0 compressed, 13327>28 beshort <3 13328>>8 belong x %d bytes, 13329>28 beshort >2 13330>>28 beshort <4 13331>>>63 bequad x %lld bytes, 13332>>28 beshort >3 13333>>>40 bequad x %lld bytes, 13334#>>67 belong x %d bytes, 13335>4 belong x %d inodes, 13336>28 beshort <2 13337>>32 beshort x blocksize: %d bytes, 13338>28 beshort >1 13339>>28 beshort <4 13340>>>51 belong x blocksize: %d bytes, 13341>>28 beshort >3 13342>>>12 belong x blocksize: %d bytes, 13343>28 beshort <4 13344>>39 bedate x created: %s 13345>28 beshort >3 13346>>8 bedate x created: %s 13347 133480 string sqsh Squashfs filesystem, big endian, 13349>0 use squashfs 13350 133510 string hsqs Squashfs filesystem, little endian, 13352>0 use \^squashfs 13353 13354# AFS Dump Magic 13355# From: Ty Sarna <tsarna@sarna.org> 133560 string \x01\xb3\xa1\x13\x22 AFS Dump 13357>&0 belong x (v%d) 13358>>&0 byte 0x76 13359>>>&0 belong x Vol %d, 13360>>>>&0 byte 0x6e 13361>>>>>&0 string x %s 13362>>>>>>&1 byte 0x74 13363>>>>>>>&0 beshort 2 13364>>>>>>>>&4 bedate x on: %s 13365>>>>>>>>&0 bedate =0 full dump 13366>>>>>>>>&0 bedate !0 incremental since: %s 13367 13368#---------------------------------------------------------- 13369#delta ISO Daniel Novotny (dnovotny@redhat.com) 133700 string DISO Delta ISO data 13371!:strength +50 13372>4 belong x version %d 13373 13374# VMS backup savesets - gerardo.cacciari@gmail.com 13375# 133764 string \x01\x00\x01\x00\x01\x00 13377>(0.s+16) string \x01\x01 13378>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 13379>>>40 lelong x (block size %d, 13380>>>49 string >\0 original name '%s', 13381>>>2 short 1024 VAX generated) 13382>>>2 short 2048 AXP generated) 13383>>>2 short 4096 I64 generated) 13384 13385# Summary: Oracle Clustered Filesystem 13386# Created by: Aaron Botsis <redhat@digitalmafia.org> 133878 string OracleCFS Oracle Clustered Filesystem, 13388>4 long x rev %d 13389>0 long x \b.%d, 13390>560 string x label: %.64s, 13391>136 string x mountpoint: %.128s 13392 13393# Summary: Oracle ASM tagged volume 13394# Created by: Aaron Botsis <redhat@digitalmafia.org> 1339532 string ORCLDISK Oracle ASM Volume, 13396>40 string x Disk Name: %0.12s 1339732 string ORCLCLRD Oracle ASM Volume (cleared), 13398>40 string x Disk Name: %0.12s 13399 13400# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 134018 string OracleCFS Oracle Clustered Filesystem, 13402>4 long x rev %d 13403>0 long x \b.%d, 13404>560 string x label: %.64s, 13405>136 string x mountpoint: %.128s 13406 13407# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1340832 string ORCLDISK Oracle ASM Volume, 13409>40 string x Disk Name: %0.12s 1341032 string ORCLCLRD Oracle ASM Volume (cleared), 13411>40 string x Disk Name: %0.12s 13412 13413# Compaq/HP RILOE floppy image 13414# From: Dirk Jagdmann <doj@cubic.org> 134150 string CPQRFBLO Compaq/HP RILOE floppy image 13416 13417#------------------------------------------------------------------------------ 13418# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 13419# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 13420# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 13421# 134221008 string DECFILE11 Files-11 On-Disk Structure 13423>525 byte x (ODS-%d); 13424>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 13425>1017 string B 13426>>525 byte 2 VAX/VMS or OpenVMS file system; 13427>>525 byte 5 OpenVMS Alpha or Itanium file system; 13428>984 string x volume label is '%-12.12s' 13429 13430# From: Thomas Klausner <wiz@NetBSD.org> 13431# https://filext.com/file-extension/DAA 13432# describes the daa file format. The magic would be: 134330 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 13434 13435# From Albert Cahalan <acahalan@gmail.com> 13436# really le32 operation,destination,payloadsize (but quite predictable) 13437# 01 00 00 00 00 00 00 c0 00 02 00 00 134380 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 13439 13440# From Eric Sandeen 13441# GFS2 134420x10000 belong 0x01161970 13443>0x10018 belong 0x0000051d GFS1 Filesystem 13444>>0x10024 belong x (blocksize %d, 13445>>0x10060 string >\0 lockproto %s) 13446>0x10018 belong 0x00000709 GFS2 Filesystem 13447>>0x10024 belong x (blocksize %d, 13448>>0x10060 string >\0 lockproto %s) 13449 13450# Russell Coker <russell@coker.com.au> 134510x10040 string _BHRfS_M BTRFS Filesystem 13452>0x1012b string >\0 label "%s", 13453>0x10090 lelong x sectorsize %d, 13454>0x10094 lelong x nodesize %d, 13455>0x10098 lelong x leafsize %d, 13456>0x10020 belong x UUID=%08x- 13457>0x10024 beshort x \b%04x- 13458>0x10026 beshort x \b%04x- 13459>0x10028 beshort x \b%04x- 13460>0x1002a beshort x \b%04x 13461>0x1002c belong x \b%08x, 13462>0x10078 lequad x %lld/ 13463>0x10070 lequad x \b%lld bytes used, 13464>0x10088 lequad x %lld devices 13465 13466# dvdisaster's .ecc 13467# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 134680 string *dvdisaster* dvdisaster error correction file 13469 13470# xfs metadump image 13471# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 13472# but can we do the << ? For now it's always 512 (0x200) anyway. 134730 string XFSM 13474>0x200 string XFSB XFS filesystem metadump image 13475 13476# Type: CROM filesystem 13477# From: Werner Fink <werner@suse.de> 134780 string CROMFS CROMFS 13479>6 string >\0 \b version %2.2s, 13480>8 ulequad >0 \b block data at %lld, 13481>16 ulequad >0 \b fblock table at %lld, 13482>24 ulequad >0 \b inode table at %lld, 13483>32 ulequad >0 \b root at %lld, 13484>40 ulelong >0 \b fblock size = %d, 13485>44 ulelong >0 \b block size = %d, 13486>48 ulequad >0 \b bytes = %lld 13487 13488# Type: xfs metadump image 13489# From: Daniel Novotny <dnovotny@redhat.com> 13490# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 13491# but can we do the << ? For now it's always 512 (0x200) anyway. 134920 string XFSM 13493>0x200 string XFSB XFS filesystem metadump image 13494 13495# Type: delta ISO 13496# From: Daniel Novotny <dnovotny@redhat.com> 134970 string DISO Delta ISO data, 13498>4 belong x version %d 13499 13500# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 13501# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 13502# From: Adam Buchbinder <adam.buchbinder@gmail.com> 135030x8000 string JFS1 13504# Because it's text-only magic, check a binary value (version) to be sure. 13505# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 13506# mountable. 13507>&0 lelong <3 JFS2 filesystem image 13508# Label is followed by a UUID; we have to limit string length to avoid 13509# appending the UUID in the case of a 16-byte label. 13510>>&144 regex [\x20-\x7E]{1,16} (label "%s") 13511>>&0 lequad x \b, %lld blocks 13512>>&8 lelong x \b, blocksize %d 13513>>&32 lelong&0x00000006 >0 (dirty) 13514>>&36 lelong >0 (compressed) 13515 13516# LFS 135170 lelong 0x070162 LFS filesystem image 13518>4 lelong 1 version 1, 13519>>8 lelong x \b blocks %u, 13520>>12 lelong x \b blocks per segment %u, 13521>4 lelong 2 version 2, 13522>>8 lelong x \b fragments %u, 13523>>12 lelong x \b bytes per segment %u, 13524>16 lelong x \b disk blocks %u, 13525>20 lelong x \b block size %u, 13526>24 lelong x \b fragment size %u, 13527>28 lelong x \b fragments per block %u, 13528>32 lelong x \b start for free list %u, 13529>36 lelong x \b number of free blocks %d, 13530>40 lelong x \b number of files %u, 13531>44 lelong x \b blocks available for writing %d, 13532>48 lelong x \b inodes in cache %d, 13533>52 lelong x \b inode file disk address 0x%x, 13534>56 lelong x \b inode file inode number %u, 13535>60 lelong x \b address of last segment written 0x%x, 13536>64 lelong x \b address of next segment to write 0x%x, 13537>68 lelong x \b address of current segment written 0x%x 13538 135390 string td\000 floppy image data (TeleDisk, compressed) 135400 string TD\000 floppy image data (TeleDisk) 13541 135420 string CQ\024 floppy image data (CopyQM, 13543>16 leshort x %d sectors, 13544>18 leshort x %d heads.) 13545 135460 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 13547 135480 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 135490 beshort 0xAA59 floppy image data (IBM SaveDskF) 135500 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 13551 135520 string \074CPM_Disk\076 disk image data (YAZE) 13553 13554# ReFS 13555# Richard W.M. Jones <rjones@redhat.com> 135560 string \0\0\0ReFS\0 ReFS filesystem image 13557 13558# EFW encase image file format: 13559# Gregoire Passault 13560# http://www.forensicswiki.org/wiki/Encase_image_file_format 135610 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 13562 13563# UBIfs 13564# Linux kernel sources: fs/ubifs/ubifs-media.h 135650 lelong 0x06101831 13566>0x16 leshort 0 UBIfs image 13567>0x08 lequad x \b, sequence number %llu 13568>0x10 leshort x \b, length %u 13569>0x04 lelong x \b, CRC 0x%08x 13570 135710 lelong 0x23494255 13572>0x04 leshort <2 13573>0x05 string \0\0\0 13574>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13575>0x04 leshort x UBI image, version %u 13576 13577# NEC PC-88 2D disk image 13578# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 135790x20 ulelong&0xFFFFFEFF 0x2A0 13580>0x10 string \0\0\0\0\0\0\0\0\0\0 13581>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13582>>>0x1A ubyte&0xEF 0 13583>>>>0x1B ubyte&0x8F 0 13584>>>>>0x1B ubyte&70 <0x40 13585>>>>>>0x1C ulelong >0x21 13586>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 13587>>>>>>>>0x1B ubyte 0 \b, media=2D 13588>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 13589>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 13590>>>>>>>>0x1B ubyte 0x30 \b, media=1D 13591>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 13592>>>>>>>>0x1A ubyte 0x10 \b, write-protected 13593 13594# HDD Raw Copy Tool disk image, file extension: .imgc 13595# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 135960 pstring HDD\ Raw\ Copy\ Tool %s 13597>0x100 pstring x %s 13598>0x200 pstring x - HD model: %s 13599#>0x300 pstring x unknown %s 13600>0x400 pstring x serial: %s 13601#>0x500 pstring x unknown: %s 13602!:ext imgc 13603 13604# http://martin.hinner.info/fs/bfs/bfs-structure.html 136050 lelong 0x1BADFACE SCO UnixWare BFS filesystem 13606 13607# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/ 1360832 lelong 0x42465331 BE/OS BFS1 filesystem 13609>36 lelong x \b, byte order %d 13610>40 lelong x \b, block size %d 13611>44 lelong x \b, block shift %d 13612>48 lequad x \b, total blocks %lld 13613>56 lequad x \b, used blocks %lld 13614 13615 136160 name next 13617>0 lelong x \b, size %d 13618>4 string x \b, label %s 13619 13620# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\ 13621# /IONeXTPartitionScheme.h 136220 string NeXT NeXT version 1 disklabel 13623>12 use next 136240 string dlV1 NeXT version 2 disklabel 13625>12 use next 136260 string dlV2 NeXT version 3 disklabel 13627>12 use next 13628 13629#------------------------------------------------------------------------------ 13630# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ 13631# fingerprint: file(1) magic for fingerprint data 13632# XPM bitmaps) 13633# 13634 13635# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 13636 136370 string FP1 libfprint fingerprint data V1 13638>3 beshort x \b, driver_id %x 13639>5 belong x \b, devtype %x 13640 136410 string FP2 libfprint fingerprint data V2 13642>3 beshort x \b, driver_id %x 13643>5 belong x \b, devtype %x 13644 13645#------------------------------------------------------------------------------ 13646# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ 13647# flash: file(1) magic for Macromedia Flash file format 13648# 13649# See 13650# 13651# https://www.macromedia.com/software/flash/open/ 13652# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 13653# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 13654# 13655 136560 name swf-details 13657 13658>0 string F 13659>>8 byte&0xfd 0x08 Macromedia Flash data 13660!:mime application/x-shockwave-flash 13661>>>3 byte x \b, version %d 13662>>8 byte&0xfe 0x10 Macromedia Flash data 13663!:mime application/x-shockwave-flash 13664>>>3 byte x \b, version %d 13665>>8 byte 0x18 Macromedia Flash data 13666!:mime application/x-shockwave-flash 13667>>>3 byte x \b, version %d 13668>>8 beshort&0xff87 0x2000 Macromedia Flash data 13669!:mime application/x-shockwave-flash 13670>>>3 byte x \b, version %d 13671>>8 beshort&0xffe0 0x3000 Macromedia Flash data 13672!:mime application/x-shockwave-flash 13673>>>3 byte x \b, version %d 13674>>8 byte&0x7 0 13675>>>8 ubyte >0x2f 13676>>>>9 ubyte <0x20 Macromedia Flash data 13677!:mime application/x-shockwave-flash 13678>>>>>3 byte x \b, version %d 13679 13680>0 string C 13681>>8 byte 0x78 Macromedia Flash data (compressed) 13682!:mime application/x-shockwave-flash 13683>>>3 byte x \b, version %d 13684 13685>0 string Z 13686>>8 byte 0x5d Macromedia Flash data (lzma compressed) 13687!:mime application/x-shockwave-flash 13688>>>3 byte x \b, version %d 13689 13690 136911 string WS 13692>4 ulelong >14 13693>>3 ubyte !0 13694>>>0 use swf-details 13695 13696# From: Cal Peake <cp@absolutedigital.net> 136970 string FLV\x01 Macromedia Flash Video 13698!:mime video/x-flv 13699 13700# 13701# Yosu Gomez 137020 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 137030 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 13704# From Dave Wilson 137050 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 13706 13707#------------------------------------------------------------------------------ 13708# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 13709# flif: Magic data for file(1) command. 13710# FLIF (Free Lossless Image Format) 13711 137120 string FLIF FLIF 13713>4 string <H image data 13714>>6 beshort x \b, %u 13715>>8 beshort x \bx%u 13716>>5 string 1 \b, 8-bit/color, 13717>>5 string 2 \b, 16-bit/color, 13718>>4 string 1 \b, grayscale, non-interlaced 13719>>4 string 3 \b, RGB, non-interlaced 13720>>4 string 4 \b, RGBA, non-interlaced 13721>>4 string A \b, grayscale 13722>>4 string C \b, RGB, interlaced 13723>>4 string D \b, RGBA, interlaced 13724>4 string >H \b, animation data 13725>>5 ubyte <255 \b, %i frames 13726>>>7 beshort x \b, %u 13727>>>9 beshort x \bx%u 13728>>>6 string =1 \b, 8-bit/color 13729>>>6 string =2 \b, 16-bit/color 13730>>5 ubyte 0xFF 13731>>>6 beshort x \b, %i frames, 13732>>>9 beshort x \b, %u 13733>>>11 beshort x \bx%u 13734>>>8 string =1 \b, 8-bit/color 13735>>>8 string =2 \b, 16-bit/color 13736>>4 string =Q \b, grayscale, non-interlaced 13737>>4 string =S \b, RGB, non-interlaced 13738>>4 string =T \b, RGBA, non-interlaced 13739>>4 string =a \b, grayscale 13740>>4 string =c \b, RGB, interlaced 13741>>4 string =d \b, RGBA, interlaced 13742 13743#------------------------------------------------------------------------------ 13744# $File: fonts,v 1.45 2021/01/03 21:00:11 christos Exp $ 13745# fonts: file(1) magic for font data 13746# 137470 search/1 FONT ASCII vfont text 137480 short 0436 Berkeley vfont data 137490 short 017001 byte-swapped Berkeley vfont data 13750 13751# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 137520 string %!PS-AdobeFont-1. PostScript Type 1 font text 13753>20 string >\0 (%s) 137546 string %!PS-AdobeFont-1. PostScript Type 1 font program data 13755>26 string >\0 (%s) 137560 string %!FontType1 PostScript Type 1 font program data 137576 string %!FontType1 PostScript Type 1 font program data 137580 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 13759 13760# Summary: PostScript Type 1 Printer Font Metrics 13761# URL: https://en.wikipedia.org/wiki/PostScript_fonts 13762# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 13763# Modified by: Joerg Jenderek 13764# Note: moved from ./msdos magic 13765# dfVersion 256=0100h 137660 uleshort 0x0100 13767# GRR: line above is too general as it catches also TrueType font, 13768# raw G3 data FAX, WhatsApp encrypted and Panorama database 13769# dfType 129=0081h 13770>66 uleshort 0x0081 13771# dfVertRes 300=012Ch not needed as additional test 13772#>>70 uleshort 0x012c 13773# dfHorizRes 300=012Ch 13774#>>>72 uleshort 0x012c 13775# dfDriverInfo points to postscript information section 13776>>(101.l) string/c Postscript Printer Font Metrics 13777# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 13778!:mime application/x-font-pfm 13779# AppleShare Print Server 13780#!:apple ASPS???? 13781!:ext pfm 13782# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 13783#>>>6 string >\060 - %-.60s 13784# dfDriverInfo 13785>>>139 ulelong >0 13786# often abbreviated and same as filename 13787>>>>(139.l) string x %s 13788# dfSize 13789>>>2 ulelong x \b, %d bytes 13790# dfFace 210=D2h 9Eh 13791>>>105 ulelong >0 13792# Windows font name 13793>>>>(105.l) string x \b, %s 13794# dfItalic 13795>>>80 ubyte 1 italic 13796# dfUnderline 13797>>>81 ubyte 1 underline 13798# dfStrikeOut 13799>>>82 ubyte 1 strikeout 13800# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 13801>>>83 uleshort >699 bold 13802# dfPitchAndFamily 16 17 48 49 64 65 13803>>>90 ubyte 16 serif 13804>>>90 ubyte 17 serif proportional 13805#>>>90 ubyte 48 other 13806>>>90 ubyte 49 proportional 13807>>>90 ubyte 64 script 13808>>>90 ubyte 65 script proportional 13809 13810# X11 font files in SNF (Server Natural Format) format 13811# updated by Joerg Jenderek at Feb 2013 13812# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 138130 belong 00000004 X11 SNF font data, MSB first 13814#>104 belong 00000004 X11 SNF font data, MSB first 13815!:mime application/x-font-sfn 13816# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 138170 lelong 00000004 13818>104 lelong 00000004 X11 SNF font data, LSB first 13819!:mime application/x-font-sfn 13820 13821# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 138220 search/1 STARTFONT\ X11 BDF font text 13823 13824# From: Joerg Jenderek 13825# URL: https://grub.gibibit.com/New_font_format 13826# Reference: util/grub-mkfont.c 13827# include/grub/fontformat.h 13828# FONT_FORMAT_SECTION_NAMES_FILE 138290 string FILE 13830# FONT_FORMAT_PFF2_MAGIC 13831>8 string PFF2 13832# leng 4 only at the moment 13833>>4 ubelong 4 13834# FONT_FORMAT_SECTION_NAMES_FONT_NAME 13835>>>12 string NAME GRUB2 font 13836!:mime application/x-font-pf2 13837!:ext pf2 13838# length of font_name 13839>>>>16 ubelong >0 13840# font_name 13841>>>>>20 string >\0 "%-s" 13842 13843# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 13844# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 138450 string \001fcp X11 Portable Compiled Font data, 13846>12 lelong ^0x08 bit: LSB, 13847>12 lelong &0x08 bit: MSB, 13848>12 lelong ^0x04 byte: LSB first 13849>12 lelong &0x04 byte: MSB first 138500 string D1.0\015 X11 Speedo font data 13851 13852#------------------------------------------------------------------------------ 13853# FIGlet fonts and controlfiles 13854# From figmagic supplied with Figlet version 2.2 13855# "David E. O'Brien" <obrien@FreeBSD.ORG> 138560 string flf FIGlet font 13857>3 string >2a version %-2.2s 138580 string flc FIGlet controlfile 13859>3 string >2a version %-2.2s 13860 13861# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 13862# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 138630 belong 0x14025919 libGrx font data, 13864>8 leshort x %dx 13865>10 leshort x \b%d 13866>40 string x %s 13867# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 13868# Update: Joerg Jenderek 13869# URL: http://fileformats.archiveteam.org/wiki/CPI 13870# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html 138710 belong 0xff464f4e DOS code page font data collection 13872!:mime font/x-dos-cpi 13873!:ext cpi 138740 string \x7fDRFONT DR-DOS code page font data collection 13875!:mime font/x-drdos-cpi 13876!:ext cpi 138777 belong 0x00454741 DOS code page font data 138787 belong 0x00564944 DOS code page font data (from Linux?) 138794098 string DOSFONT DOSFONT2 encrypted font data 13880 13881# From: Joerg Jenderek 13882# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font 13883# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt 13884# 13885# usual case with lightening mask and skewing mask 5555h~UU 13886#62 ulelong 0x55555555 13887# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 13888#>2 uleshort <73 13889#>>0 use gdos-font 13890# BOX18.GFT COWBOY30.GFT ROYALK30.GFT 13891#62 ulelong 0 13892# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size 13893#>2 uleshort >2 13894# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 13895#>>2 uleshort <73 13896# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE 13897#>>>4 ulelong >0x001F1f1F 13898# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data 13899#>>>>76 ulelong >83 13900#>>>>>0 use gdos-font 139010 name gdos-font 13902>0 uleshort x GEM GDOS font 13903!:mime application/x-font-gdos 13904# also .eps found like AA070GEP.EPS AI360GEP.EPS 13905!:ext fnt/gtf 13906# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE 13907>4 string x %.32s 13908# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT 13909>2 uleshort x %u 13910# face ID (must be unique) 13911>0 uleshort x \b, ID 0x%4.4x 13912# lowest character index in face (4 but usually 32 for disk-loaded fonts) 13913#>36 uleshort !32 \b, unusual character index %u 13914# width of the widest character like 0 8 10 12 16 24 32 13915#>50 uleshort x \b, %u char width 13916# width of the widest character cell like 8 11 12 14 15 16 33 67 13917#>52 uleshort x \b, %u cell width 13918# thickening size in pixel like 0 1 2 3 4 5 6 7 8 13919#>58 uleshort x \b, %u thick 13920# lightening mask to eliminate pixels, usually 5555h 13921>62 uleshort !0x5555 \b, lightening mask 0x%x 13922# skewing mask to determine when to perform additional rotation when skewing, usually 5555h 13923>64 uleshort !0x5555 \b, skewing mask 0x%x 13924# offset to optional horizontal offset table 0 58h~88 5eh 252h 13925#>68 ulelong x \b, 0x%x horizontal table offset 13926# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h 13927#>72 ulelong x \b, 0x%x coffset 13928# offset to font data like 116h 118h 158 20Ah 20Eh 13929>76 ulelong x \b, 0x%x foffset 13930# form width in bytes like 58 67 156 190 227 317 345 13931#>80 uleshort x \b, %u fwidth 13932# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 13933#>82 uleshort x \b, %u fheight 13934# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h 13935#>84 ulelong x \b, 0x%x noffset 13936 13937# downloadable fonts for browser (prints type) anthon@mnt.org 13938# https://tools.ietf.org/html/rfc3073 139390 string PFR1 Portable Font Resource font data (new) 13940>102 string >0 \b: %s 139410 string PFR0 Portable Font Resource font data (old) 13942>4 beshort >0 version %d 13943 13944# True Type fonts 13945# Modified by: Joerg Jenderek 13946# URL: https://en.wikipedia.org/wiki/TrueType 13947# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 13948# 13949# sfnt version "typ1" used by some Apple, but no example found 139500 string typ1 13951>0 use sfnt-font 13952>0 use sfnt-names 13953# sfnt version "true" used by some Apple 139540 string true 13955>0 use sfnt-font 13956>0 use sfnt-names 13957# GRR: below test is too general 13958# sfnt version often 0x00010000 139590 string \000\001\000\000 13960>0 use sfnt-font 13961>0 use sfnt-names 13962# validate and display sfnt font data like number of tables 139630 name sfnt-font 13964# file 5.30 version assumes 00FFh as maximal number of tables 13965#>4 ubeshort <0x0100 13966# maximal 27 tables found like in Skia.ttf 13967# 46 different table names mentioned on Apple specification 13968# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 13969>4 ubeshort <47 13970# skip bad examples with garbage table names like in a5.show HYPERC MAC 13971# tag names consist of up to four characters padded with spaces at end like 13972# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 13973>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 13974#>>>0 ubelong x \b, sfnt version 0x%x 13975>>>0 ubelong !0x4f54544f TrueType 13976!:mime font/sfnt 13977!:apple ????tfil 13978# .ttf for TrueType font 13979# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 13980!:ext ttf/tte 13981# sfnt version 4F54544Fh~OTTO 13982>>>0 ubelong =0x4f54544f OpenType 13983!:mime font/otf 13984!:apple ????OTTO 13985!:ext otf 13986>>>0 ubelong x Font data 13987# DSIG=44454947h table name implies a digitally signed font 13988# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 13989>>>12 search/432 DSIG \b, digitally signed 13990>>>4 ubeshort x \b, %d tables 13991# minimal 9 tables found like in NISC18030.ttf 13992#>>>4 ubeshort <10 TMIN 13993#>>>4 ubeshort >24 TBIG 13994# table directory entries 13995>>>12 string x \b, 1st "%4.4s" 13996 13997# search and display 1st name in sfnt font which is often copyright text 13998# does not work inside font collections 139990 name sfnt-names 14000# search for naming table 14001>12 search/432/s name 14002# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 14003#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 14004>>&8 ubelong >0x00100000 14005# offset of name table 14006>>>&-4 ubelong x \b, name offset 0x%x 14007# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 14008>>&8 ubelong <0x00100000 14009>>>&-16 ubelong x 14010# name table 14011>>>>(&8.L) ubequad x 14012# invalid format selector 14013#>>>>>&-8 ubeshort !0 \b, invalid selector %x 14014# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 14015# maximal 1227 name records found like in Apple Chancery.ttf 14016#>>>>>&-6 ubeshort <0x4 mincount 14017#>>>>>&-6 ubeshort >130 maxcount 14018>>>>>&-6 ubeshort x \b, %d names 14019# offset to start of string storage from start of table 14020#>>>>>&-4 ubeshort x \b, record offset %d 14021# 1st name record 14022# string offset from start of storage area 14023#>>>>>&8 ubeshort x \b, string offset %d 14024# string length 14025#>>>>>&6 ubeshort x \b, string length %d 14026# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 14027# also found 0 like in SWZCONLN.TTF 14028#>>>>>&6 ubeshort <8 MIN STRING 14029# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 14030#>>>>>&6 ubeshort >805 MAX STRING 14031# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 14032#>>>>>&-2 ubeshort >3 BAD PLATFORM 14033>>>>>&-2 ubeshort 0 \b, Unicode 14034>>>>>&-2 ubeshort 1 \b, Macintosh 14035>>>>>&-2 ubeshort 3 \b, Microsoft 14036# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 14037>>>>>&2 ubeshort >0 \b, language 0x%x 14038# name identifiers 14039# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 14040>>>>>&4 ubeshort >0 \b, type %d string 14041# platform specific encoding: 14042# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 14043#>>>>>&0 ubeshort x \b, %d encoding 14044>>>>>&0 ubeshort 0 14045# handle only name string offset 0 because do not know how to add 2 relative offsets 14046>>>>>>&6 ubeshort 0 14047>>>>>>>&(&-14.S-18) ubyte !0 14048# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 14049# often copyright string that starts like \251 2006 The Monotype Corporation 14050>>>>>>>>&-1 string x \b, %-11.96s 14051# test for unicode string 14052>>>>>>>&(&-14.S-18) ubyte 0 14053>>>>>>>>&0 lestring16 x \b, %-11.96s 14054# unicode encoding 14055>>>>>&0 ubeshort >0 14056>>>>>>&6 ubeshort 0 14057>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 14058 140590 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 140600 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 14061 14062# TrueType/OpenType font collections (.ttc) 14063# URL: https://en.wikipedia.org/wiki/OpenType 14064# https://www.microsoft.com/typography/otspec/otff.htm 14065# Modified by: Joerg Jenderek 14066# Note: container for TrueType, OpenType font 140670 string ttcf 14068# skip ASCII text 14069>4 ubyte 0 14070# sfnt version often 0x00010000 of 1st table is TrueType 14071>>(12.L) ubelong !0x4f54544f TrueType 14072!:mime font/ttf 14073!:apple ????tfil 14074!:ext ttc 14075# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 14076>>(12.L) ubelong =0x4f54544f OpenType 14077!:mime font/otf 14078!:apple ????OTTO 14079# no example found for otc 14080!:ext ttc/otc 14081>>4 ubyte x font collection data 14082#!:mime font/collection 14083# TCC version 14084>>4 belong 0x00010000 \b, 1.0 14085>>4 belong 0x00020000 \b, 2.0 14086>>8 ubelong >0 \b, %d fonts 14087# array offset size = fonts * offsetsize = fonts * 4 14088>>(8.L*4) ubequad x 14089# 0x44454947 = 'DSIG' 14090>>>&4 belong 0x44534947 \b, digitally signed 14091# offset to 1st font 14092>>12 ubelong x \b, at 0x%x 14093# point to 1st font that starts with sfnt version 14094>>(12.L) use sfnt-font 14095 14096# Opentype font data from Avi Bercovich 140970 string OTTO OpenType font data 14098!:mime application/vnd.ms-opentype 14099 14100# From: Alex Myczko <alex@aiei.ch> 141010 string SplineFontDB: Spline Font Database 14102!:mime application/vnd.font-fontforge-sfd 14103>14 string x version %s 14104 14105# EOT 141060x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14107>0x22 string LP Embedded OpenType (EOT) 14108# workaround until there's lepstring16 14109# >>0x52 lepstring16/h >\0 \b, %s family 14110>>0x52 short !0 14111>>>0x54 lestring16 x \b, %s family 14112!:mime application/vnd.ms-fontobject 14113 14114# Web Open Font Format (.woff) 141150 name woff 14116>4 belong 0x00010000 \b, TrueType 14117>4 belong 0x4F54544F \b, CFF 14118>4 belong 0x74727565 \b, TrueType 14119>4 default x 14120>>4 belong x \b, flavor %d 14121>8 belong x \b, length %d 14122#>12 beshort x \b, numTables %d 14123#>14 beshort x \b, reserved %d 14124#>16 belong x \b, totalSfntSize %d 14125 14126# https://www.w3.org/TR/WOFF/ 141270 string wOFF Web Open Font Format 14128>0 use woff 14129>20 beshort x \b, version %d 14130>22 beshort x \b.%d 14131# https://www.w3.org/TR/WOFF2/ 141320 string wOF2 Web Open Font Format (Version 2) 14133>0 use woff 14134#>20 belong x \b, totalCompressedSize %d 14135>24 beshort x \b, version %d 14136>26 beshort x \b.%d 14137 14138#------------------------------------------------------------------------------ 14139# $File: forth,v 1.3 2020/12/12 20:01:47 christos Exp $ 14140# forth: file(1) magic for various Forth environments 14141# From: Lubomir Rintel <lkundrak@v3.sk> 14142# 14143 14144# Has a FORTH stack diagram and something that looks very much like a FORTH 14145# multi-line word definition. Probably a FORTH source. 141460 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\) 14147>0 regex \^:\[[:space:]] 14148>>0 regex \^;$ FORTH program 14149!:mime text/x-forth 14150 14151# Inline word definition complete with a stack diagram 141520 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program 14153!:mime text/x-forth 14154 14155# Various dictionary images used by OpenFirware FORTH environment 14156 141570 lelong 0xe1a00000 14158>8 lelong 0xe1a00000 14159# skip raspberry pi kernel image kernel7.img by checking for positive text length 14160>>24 lelong >0 ARM OpenFirmware FORTH Dictionary, 14161>>>24 lelong x Text length: %d bytes, 14162>>>28 lelong x Data length: %d bytes, 14163>>>32 lelong x Text Relocation Table length: %d bytes, 14164>>>36 lelong x Data Relocation Table length: %d bytes, 14165>>>40 lelong x Entry Point: 0x%08X, 14166>>>44 lelong x BSS length: %d bytes 14167 141680 string MP 14169>28 lelong 1 x86 OpenFirmware FORTH Dictionary, 14170>>4 leshort x %d blocks 14171>>2 leshort x + %d bytes, 14172>>6 leshort x %d relocations, 14173>>8 leshort x Header length: %d paragraphs, 14174>>10 leshort x Data Size: %d 14175>>12 leshort x - %d 4K pages, 14176>>14 lelong x Initial Stack Pointer: 0x%08X, 14177>>20 lelong x Entry Point: 0x%08X, 14178>>24 lelong x First Relocation Item: %d, 14179>>26 lelong x Overlay Number: %d, 14180>>18 leshort x Checksum: 0x%08X 14181 141820 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary, 14183>4 belong x Text length: %d bytes, 14184>8 belong x Data length: %d bytes, 14185>12 belong x BSS length: %d bytes, 14186>16 belong x Symbol Table length: %d bytes, 14187>20 belong x Entry Point: 0x%08X, 14188>24 belong x Text Relocation Table length: %d bytes, 14189>28 belong x Data Relocation Table length: %d bytes 14190 141910 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary, 14192>4 lelong x Text length: %d bytes, 14193>8 lelong x Data length: %d bytes, 14194>12 lelong x BSS length: %d bytes, 14195>16 lelong x Symbol Table length: %d bytes, 14196>20 lelong x Entry Point: 0x%08X, 14197>24 lelong x Text Relocation Table length: %d bytes, 14198>28 lelong x Data Relocation Table length: %d bytes 14199 14200# Dictionary images used by minimal C FORTH environments, any platform, 14201# using native byte order. 14202 14203# Weak. 14204#0 short 0x5820 cForth 16-bit Dictionary, 14205#>2 short x Serial: 0x%08X, 14206#>4 short x Dictionary Start: 0x%08X, 14207#>6 short x Dictionary Size: %d bytes, 14208#>8 short x User Area Start: 0x%08X, 14209#>10 short x User Area Size: %d bytes, 14210#>12 short x Entry Point: 0x%08X 14211 142120 long 0x581120 cForth 32-bit Dictionary, 14213>4 long x Serial: 0x%08X, 14214>8 long x Dictionary Start: 0x%08X, 14215>12 long x Dictionary Size: %d bytes, 14216>16 long x User Area Start: 0x%08X, 14217>20 long x User Area Size: %d bytes, 14218>24 long x Entry Point: 0x%08X 14219 14220#------------------------------------------------------------------------------ 14221# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 14222# FORTRAN source 14223# Check that the first 100 lines start with C or whitespace first. 142240 regex/100l !\^[^Cc\ \t].*$ 14225>0 regex/100l \^[Cc][\ \t] FORTRAN program text 14226!:mime text/x-fortran 14227!:strength - 5 14228 14229#------------------------------------------------------------------------------ 14230# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $ 14231# frame: file(1) magic for FrameMaker files 14232# 14233# This stuff came on a FrameMaker demo tape, most of which is 14234# copyright, but this file is "published" as witness the following: 14235# 14236# Note that this is the Framemaker Maker Interchange Format, not the 14237# Normal format which would be application/vnd.framemaker. 14238# 142390 string \<MakerFile FrameMaker document 14240!:mime application/x-mif 14241>11 string 5.5 (5.5 14242>11 string 5.0 (5.0 14243>11 string 4.0 (4.0 14244>11 string 3.0 (3.0 14245>11 string 2.0 (2.0 14246>11 string 1.0 (1.0 14247>14 byte x %c) 14248# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format 14249# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf 14250# Update: Joerg Jenderek 2019 Nov 142510 string \<MIFFile FrameMaker MIF (ASCII) file 14252# https://www.iana.org/assignments/media-types/application/vnd.mif 14253!:mime application/vnd.mif 14254# mif most but also find bookTOC.framemif 14255!:ext mif/framemif 14256# followed by space~20h 14257#>8 ubyte 0x20 \b, space before version 14258# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ... 14259>9 string x (%.3s 14260# if not greater sign then display 4th character of version 14261>12 ubyte =0x3e \b) 14262>12 ubyte !0x3e \b%c) 14263# comment starting with # shows the name+version number of generating program 14264>13 search/3 # 14265>>&0 string x "%s" 142660 search/1 \<MakerDictionary FrameMaker Dictionary text 14267!:mime application/x-mif 14268>17 string 3.0 (3.0) 14269>17 string 2.0 (2.0) 14270>17 string 1.0 (1.x) 142710 string \<MakerScreenFont FrameMaker Font file 14272!:mime application/x-mif 14273>17 string 1.01 (%s) 142740 string \<MML FrameMaker MML file 14275!:mime application/x-mif 142760 string \<BookFile FrameMaker Book file 14277!:mime application/x-mif 14278>10 string 3.0 (3.0 14279>10 string 2.0 (2.0 14280>10 string 1.0 (1.0 14281>13 byte x %c) 14282# XXX - this book entry should be verified, if you find one, uncomment this 14283#0 string \<Book\040 FrameMaker Book (ASCII) file 14284#!:mime application/x-mif 14285#>6 string 3.0 (3.0) 14286#>6 string 2.0 (2.0) 14287#>6 string 1.0 (1.0) 142880 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 14289!:mime application/x-mif 14290 14291#------------------------------------------------------------------------------ 14292# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 14293# freebsd: file(1) magic for FreeBSD objects 14294# 14295# All new-style FreeBSD magic numbers are in host byte order (i.e., 14296# little-endian on x86). 14297# 14298# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 14299# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 14300# schemes for distinguishing between executable images, shared libraries, 14301# and object files. 14302# 14303# FreeBSD says: 14304# 14305# Regardless of whether it's pure, demand-paged, or none of the 14306# above: 14307# 14308# if the entry point is < 4096, then it's a shared library if 14309# the "has run-time loader information" bit is set, and is 14310# position-independent if the "is position-independent" bit 14311# is set; 14312# 14313# if the entry point is >= 4096 (or >4095, same thing), then it's 14314# an executable, and is dynamically-linked if the "has run-time 14315# loader information" bit is set. 14316# 14317# On x86, NetBSD says: 14318# 14319# If it's neither pure nor demand-paged: 14320# 14321# if it has the "has run-time loader information" bit set, it's 14322# a dynamically-linked executable; 14323# 14324# if it doesn't have that bit set, then: 14325# 14326# if it has the "is position-independent" bit set, it's 14327# position-independent; 14328# 14329# if the entry point is non-zero, it's an executable, otherwise 14330# it's an object file. 14331# 14332# If it's pure: 14333# 14334# if it has the "has run-time loader information" bit set, it's 14335# a dynamically-linked executable, otherwise it's just an 14336# executable. 14337# 14338# If it's demand-paged: 14339# 14340# if it has the "has run-time loader information" bit set, 14341# then: 14342# 14343# if the entry point is < 4096, it's a shared library; 14344# 14345# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 14346# it's a dynamically-linked executable); 14347# 14348# if it doesn't have the "has run-time loader information" bit 14349# set, then it's just an executable. 14350# 14351# (On non-x86, NetBSD does much the same thing, except that it uses 14352# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 14353# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 14354# had 8K pages; dunno about MIPS.) 14355# 14356# I suspect the two will differ only in perverse and uninteresting cases 14357# ("shared" libraries that aren't demand-paged and whose pages probably 14358# won't actually be shared, executables with entry points <4096). 14359# 14360# I leave it to those more familiar with FreeBSD and NetBSD to figure out 14361# what the right answer is (although using ">4095", FreeBSD-style, is 14362# probably better than separately checking for "=4096" and ">4096", 14363# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 14364# executables using the NetBSD technique.) 14365# 143660 lelong&0377777777 041400407 FreeBSD/i386 14367>20 lelong <4096 14368>>3 byte&0xC0 &0x80 shared library 14369>>3 byte&0xC0 0x40 PIC object 14370>>3 byte&0xC0 0x00 object 14371>20 lelong >4095 14372>>3 byte&0x80 0x80 dynamically linked executable 14373>>3 byte&0x80 0x00 executable 14374>16 lelong >0 not stripped 14375 143760 lelong&0377777777 041400410 FreeBSD/i386 pure 14377>20 lelong <4096 14378>>3 byte&0xC0 &0x80 shared library 14379>>3 byte&0xC0 0x40 PIC object 14380>>3 byte&0xC0 0x00 object 14381>20 lelong >4095 14382>>3 byte&0x80 0x80 dynamically linked executable 14383>>3 byte&0x80 0x00 executable 14384>16 lelong >0 not stripped 14385 143860 lelong&0377777777 041400413 FreeBSD/i386 demand paged 14387>20 lelong <4096 14388>>3 byte&0xC0 &0x80 shared library 14389>>3 byte&0xC0 0x40 PIC object 14390>>3 byte&0xC0 0x00 object 14391>20 lelong >4095 14392>>3 byte&0x80 0x80 dynamically linked executable 14393>>3 byte&0x80 0x00 executable 14394>16 lelong >0 not stripped 14395 143960 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 14397>20 lelong <4096 14398>>3 byte&0xC0 &0x80 shared library 14399>>3 byte&0xC0 0x40 PIC object 14400>>3 byte&0xC0 0x00 object 14401>20 lelong >4095 14402>>3 byte&0x80 0x80 dynamically linked executable 14403>>3 byte&0x80 0x00 executable 14404>16 lelong >0 not stripped 14405 14406# XXX gross hack to identify core files 14407# cores start with a struct tss; we take advantage of the following: 14408# byte 7: highest byte of the kernel stack pointer, always 0xfe 14409# 8/9: kernel (ring 0) ss value, always 0x0010 14410# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 14411# 28: low order byte of the current PTD entry, always 0 since the 14412# PTD is page-aligned 14413# 144147 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 14415>1039 string >\0 from '%s' 14416 14417# /var/run/ld.so.hints 14418# What are you laughing about? 144190 lelong 011421044151 ld.so hints file (Little Endian 14420>4 lelong >0 \b, version %d) 14421>4 belong <1 \b) 144220 belong 011421044151 ld.so hints file (Big Endian 14423>4 belong >0 \b, version %d) 14424>4 belong <1 \b) 14425 14426# 14427# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 14428# 144290 string SCRSHOT_ scrshot(1) screenshot, 14430>8 byte x version %d, 14431>9 byte 2 %d bytes in header, 14432>>10 byte x %d chars wide by 14433>>11 byte x %d chars high 14434 14435#------------------------------------------------------------------------------ 14436# $File: fsav,v 1.21 2021/02/23 00:51:10 christos Exp $ 14437# fsav: file(1) magic for datafellows fsav virus definition files 14438# Anthon van der Neut (anthon@mnt.org) 14439 14440# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 144410 beshort 0x1575 fsav macro virus signatures 14442>8 leshort >0 (%d- 14443>11 byte >0 \b%02d- 14444>10 byte >0 \b%02d) 14445# ftp://ftp.f-prot.com/pub/sign.zip 14446#10 ubyte <12 14447#>9 ubyte <32 14448#>>8 ubyte 0x0a 14449#>>>12 ubyte 0x07 14450#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 14451#>>>>10 byte 0 \b01- 14452#>>>>10 byte 1 \b02- 14453#>>>>10 byte 2 \b03- 14454#>>>>10 byte 3 \b04- 14455#>>>>10 byte 4 \b05- 14456#>>>>10 byte 5 \b06- 14457#>>>>10 byte 6 \b07- 14458#>>>>10 byte 7 \b08- 14459#>>>>10 byte 8 \b09- 14460#>>>>10 byte 9 \b10- 14461#>>>>10 byte 10 \b11- 14462#>>>>10 byte 11 \b12- 14463#>>>>9 ubyte >0 \b%02d) 14464# ftp://ftp.f-prot.com/pub/sign2.zip 14465#0 ubyte 0x62 14466#>1 ubyte 0xF5 14467#>>2 ubyte 0x1 14468#>>>3 ubyte 0x1 14469#>>>>4 ubyte 0x0e 14470#>>>>>13 ubyte >0 fsav virus signatures 14471#>>>>>>11 ubyte x size 0x%02x 14472#>>>>>>12 ubyte x \b%02x 14473#>>>>>>13 ubyte x \b%02x bytes 14474 14475# Joerg Jenderek: joerg dot jenderek at web dot de 14476# clamav-0.100.2\docs\html\node60.html 14477# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf 14478# ClamAV virus database files start with a 512 bytes colon separated header 14479# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 14480# + gzipped (optional) tarball files 14481# output can often be verified by `sigtool --info=FILE` 144820 string ClamAV-VDB: Clam AntiVirus 14483# padding spaces implies database 14484>511 ubyte =0x20 database 14485!:mime application/x-clamav-database 14486# empty build time 14487>>10 string =:: (unsigned) 14488# sigtool(1) man page 14489!:ext cud 14490# display some text to avoid error like: 14491# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type 14492# file: could not find any valid magic files! (No error) 14493>>10 default x (with buildtime) 14494#>>10 default x 14495# clamtmp is used for temporarily database like update process 14496# for pure tar database only cld extension found 14497!:ext cld/cvd/clamtmp/cud 14498>511 default x file 14499!:mime application/x-clamav 14500!:ext info 14501>11 string >\0 14502# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` 14503>>11 regex \^[^:]{0,23} \b, %s 14504# version like 25170 14505>>>&1 regex \^[^:]{1,6} \b, version %s 14506# signaturesNumbers like 4566249 14507>>>>&1 regex \^[^:]{1,10} \b, %s signatures 14508# functionalityLevelRequired like 60 14509>>>>>&1 regex \^[^:]{1,4} \b, level %s 14510# X for nothing or MD5 14511#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" 14512>>>>>>&1 regex \^[^:]{1,32} 14513# X for nothing or digital signature starting like AIzk/LYbX 14514#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" 14515>>>>>>>&1 regex \^[^:]{1,255} 14516# builder like neo 14517>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s 14518# buildTime like 1506611558 14519#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s 14520>>>>>>>>>&1 regex \^[^:]{1,10} 14521# padding with spaces 14522#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx 14523>510 ubyte =0x20 14524# inspect real database content 14525#>>512 ubeshort x \b, database MAGIC 0x%x 14526# ./archive handle pure tar archives 14527>>1012 quad =0 \b, with 14528>>>512 use tar-file 14529# not pure tar 14530>>1012 quad !0 14531# one space at the end of text and then handles gzipped archives by ./compress 14532>>>512 string \037\213 \b, with 14533>>>>512 indirect x 14534 14535# Type: Grisoft AVG AntiVirus 14536# From: David Newgas <david@newgas.net> 145370 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 14538 145390 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 14540>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 14541 14542# From: Joerg Jenderek 14543# URL: https://www.avira.com/ 14544# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) 14545# tested with version 15.0.43.23 at November 2019 145460 string AntiVir\ Qua Avira AntiVir quarantined 14547!:mime application/x-avira-qua 14548#!:mime application/octet-stream 14549!:ext qua 14550>156 string SUSPICIOUS_FILE 14551# file path of suspicious file 14552>>220 lestring16 x %s 14553>156 string !SUSPICIOUS_FILE 14554# file path of virus file 14555>>228 lestring16 x %s 14556# quarantined date 14557>60 ldate x at %s 14558# virus/danger name 14559>156 string !SUSPICIOUS_FILE 14560>>156 string x \b, category "%s" 14561 14562 14563#------------------------------------------------------------------------------ 14564# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 14565# fusecompress: file(1) magic for fusecompress 145660 string \037\135\211 FuseCompress(ed) data 14567>3 byte 0x00 (none format) 14568>3 byte 0x01 (bz2 format) 14569>3 byte 0x02 (gz format) 14570>3 byte 0x03 (lzo format) 14571>3 byte 0x04 (xor format) 14572>3 byte >0x04 (unknown format) 14573>4 long x uncompressed size: %d 14574 14575#------------------------------------------------------------------------------ 14576# $File: games,v 1.22 2021/02/23 00:51:10 christos Exp $ 14577# games: file(1) for games 14578 14579# Fabio Bonelli <fabiobonelli@libero.it> 14580# Quake II - III data files 145810 string IDP2 Quake II 3D Model file, 14582>20 long x %u skin(s), 14583>8 long x (%u x 14584>12 long x %u), 14585>40 long x %u frame(s), 14586>16 long x Frame size %u bytes, 14587>24 long x %u vertices/frame, 14588>28 long x %u texture coordinates, 14589>32 long x %u triangles/frame 14590 145910 string IBSP Quake 14592>4 long 0x26 II Map file (BSP) 14593>4 long 0x2E III Map file (BSP) 14594 145950 string IDS2 Quake II SP2 sprite file 14596 14597#--------------------------------------------------------------------------- 14598# Doom and Quake 14599# submitted by Nicolas Patrois 14600 146010 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 14602# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 14603 1460424 string LxD\ 203 Linuxdoom save 14605>0 string x , name=%s 14606>44 string x , world=%s 14607 14608# Quake 14609 14610# Update: Joerg Jenderek 14611# URL: http://fileformats.archiveteam.org/wiki/PAK 14612# reference: https://quakewiki.org/wiki/.pak 14613# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 14614# and Git pack ./revision 146150 string PACK 14616# real Quake examples like pak0.pak have only some hundreds like 150 files 14617# So test for few files 14618>8 ulelong <0x01000000 14619# in file version 5.32 test for null terminator is only true for 14620# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 14621# look for null terminator of 1st entry name 14622>>(4.l+55) ubyte 0 Quake I or II world or extension 14623!:mime application/x-dzip 14624!:ext pak 14625#>>>8 ulelong x \b, table size %u 14626# dividing this by entry size (64) gives number of files 14627>>>8 ulelong/64 x \b, %u files 14628# offset to the beginning of the file table 14629>>>4 ulelong x \b, offset 0x%x 14630# 1st file entry 14631>>>(4.l) use pak-entry 14632# 2nd file entry 14633#>>>4 ulelong+64 x \b, offset 0x%x 14634#>>>(4.l+64) use pak-entry 14635# 14636# display file table entry of Quake PAK archive 146370 name pak-entry 14638# normally entry start after header which implies offset 12 or higher 14639>56 ulelong >11 14640# the offset from the beginning of pak to beginning of this entry file contents 14641>>56 ulelong x at 0x%x 14642# the size of file for this entry 14643>>60 ulelong x %u bytes 14644# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 14645>>0 string x '%-.56s' 14646# inspect entry content by jumping to entry offset 14647>>(56) indirect x \b: 14648 14649#0 string -1\x0a Quake I demo 14650#>30 string x version %.4s 14651#>61 string x level %s 14652 14653#0 string 5\x0a Quake I save 14654 14655# The levels 14656 14657# Quake 1 14658 146590 string 5\x0aIntroduction Quake I save: start Introduction 146600 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 146610 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 146620 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 146630 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 146640 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 146650 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 146660 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 146670 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 146680 string 5\x0athe_Installation Quake I save: e2m1 The installation 146690 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 146700 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 146710 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 146720 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 146730 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 146740 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 146750 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 146760 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 146770 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 146780 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 146790 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 146800 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 146810 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 146820 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 146830 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 146840 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 146850 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 146860 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 146870 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 146880 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 146890 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 146900 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 14691 14692# Quake DeathMatch levels 14693 146940 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 146950 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 146960 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 146970 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 146980 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 146990 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 14700 14701# Scourge of Armagon 14702 147030 string 5\x0aCommand_HQ Quake I save: start Command HQ 147040 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 147050 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 147060 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 147070 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 147080 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 147090 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 147100 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 147110 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 147120 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 147130 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 147140 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 147150 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 147160 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 147170 string 5\x0aLimbo Quake I save: hip3m3 Limbo 147180 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 147190 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 147200 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 14721 14722# Malice 14723 147240 string 5\x0aThe_Academy Quake I save: start The academy 147250 string 5\x0aThe_Lab Quake I save: d1 The lab 147260 string 5\x0aArea_33 Quake I save: d1b Area 33 147270 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 147280 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 147290 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 147300 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 147310 string 5\x0aArea44 Quake I save: d1c Area 44 147320 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 147330 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 147340 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 147350 string 5\x0aThe_Flood Quake I save: d5 The flood 147360 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 147370 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 147380 string 5\x0aThe_Foundry Quake I save: d7b The foundry 147390 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 147400 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 147410 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 147420 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 147430 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 147440 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 14745 14746# Malice DeathMatch levels 14747 147480 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 147490 string 5\x0aSub_Station Quake I save: ddm2 Sub station 147500 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 147510 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 147520 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 147530 string 5\x0aDOMINO Quake I save: ddm6 Domino 147540 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 14755 14756 147570 string MComprHD MAME CHD compressed hard disk image, 14758>12 belong x version %u 14759 14760# doom - submitted by Jon Dowland 14761 147620 string =IWAD doom main IWAD data 14763>4 lelong x containing %d lumps 147640 string =PWAD doom patch PWAD data 14765>4 lelong x containing %d lumps 14766 14767# Build engine group files (Duke Nukem, Shadow Warrior, ...) 14768# Extension: .grp 14769# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 147700 string KenSilverman Build engine group file 14771>12 lelong x containing %d files 14772 14773# Summary: Warcraft 3 save 14774# Extension: .w3g 14775# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 147760 string Warcraft\ III\ recorded\ game %s 14777 14778 14779# Summary: Warcraft 3 map 14780# Extension: .w3m 14781# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 147820 string HM3W Warcraft III map file 14783 14784 14785# Summary: SGF Smart Game Format 14786# Extension: .sgf 14787# Reference: https://www.red-bean.com/sgf/ 14788# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 14789# Modified by (1): Abel Cheung (regex, more game format) 14790# FIXME: Some games don't have GM (game type) 147910 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14792>2 search/0x200/b GM[ 14793>>&0 string 1] (Go) 14794>>&0 string 2] (Othello) 14795>>&0 string 3] (chess) 14796>>&0 string 4] (Gomoku+Renju) 14797>>&0 string 5] (Nine Men's Morris) 14798>>&0 string 6] (Backgammon) 14799>>&0 string 7] (Chinese chess) 14800>>&0 string 8] (Shogi) 14801>>&0 string 9] (Lines of Action) 14802>>&0 string 10] (Ataxx) 14803>>&0 string 11] (Hex) 14804>>&0 string 12] (Jungle) 14805>>&0 string 13] (Neutron) 14806>>&0 string 14] (Philosopher's Football) 14807>>&0 string 15] (Quadrature) 14808>>&0 string 16] (Trax) 14809>>&0 string 17] (Tantrix) 14810>>&0 string 18] (Amazons) 14811>>&0 string 19] (Octi) 14812>>&0 string 20] (Gess) 14813>>&0 string 21] (Twixt) 14814>>&0 string 22] (Zertz) 14815>>&0 string 23] (Plateau) 14816>>&0 string 24] (Yinsh) 14817>>&0 string 25] (Punct) 14818>>&0 string 26] (Gobblet) 14819>>&0 string 27] (hive) 14820>>&0 string 28] (Exxit) 14821>>&0 string 29] (Hnefatal) 14822>>&0 string 30] (Kuba) 14823>>&0 string 31] (Tripples) 14824>>&0 string 32] (Chase) 14825>>&0 string 33] (Tumbling Down) 14826>>&0 string 34] (Sahara) 14827>>&0 string 35] (Byte) 14828>>&0 string 36] (Focus) 14829>>&0 string 37] (Dvonn) 14830>>&0 string 38] (Tamsk) 14831>>&0 string 39] (Gipf) 14832>>&0 string 40] (Kropki) 14833 14834############################################## 14835# NetImmerse/Gamebryo game engine entries 14836 14837# Summary: Gamebryo game engine file 14838# Extension: .nif, .kf 14839# Created by: Abel Cheung <abelcheung@gmail.com> 148400 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 14841>&0 regex [0-9a-z.]+ \b, version %s 14842 14843# Summary: Gamebryo game engine file 14844# Extension: .kfm 14845# Created by: Abel Cheung <abelcheung@gmail.com> 148460 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 14847>&0 regex [0-9a-z.]+ \b, version %s 14848 14849# Summary: NetImmerse game engine file 14850# Extension .nif 14851# Created by: Abel Cheung <abelcheung@gmail.com> 148520 string NetImmerse\ File\ Format,\ Version 14853>&0 string n\ NetImmerse game engine file 14854>>&0 regex [0-9a-z.]+ \b, version %s 14855 14856# Type: SGF Smart Game Format 14857# URL: https://www.red-bean.com/sgf/ 14858# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 148592 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14860>2 regex/c GM\\[1\\] - Go Game 14861>2 regex/c GM\\[6\\] - BackGammon Game 14862>2 regex/c GM\\[11\\] - Hex Game 14863>2 regex/c GM\\[18\\] - Amazons Game 14864>2 regex/c GM\\[19\\] - Octi Game 14865>2 regex/c GM\\[20\\] - Gess Game 14866>2 regex/c GM\\[21\\] - twix Game 14867 14868# Epic Games/Unreal Engine Package 14869# 148700 lelong 0x9E2A83C1 Unreal Engine Package, 14871>4 leshort x version: %i 14872>12 lelong !0 \b, names: %i 14873>28 lelong !0 \b, imports: %i 14874>20 lelong !0 \b, exports: %i 14875 148760 string ESVG 14877>4 lelong 0x00160000 14878>10 string TOC\020 Empire Deluxe for DOS saved game 14879 14880# Sid Meier's Civilization V/VI 14881# From: Benjamin Lowry <ben@ben.gmbh> 148820 string CIV5 14883>4 byte 0x08 Sid Meier's Civilization V saved game, 14884>>12 regex [0-9a-z.]+ saved by game version %s 14885>4 byte 0x01 Sid Meier's Civilization V replay data, 14886>>12 regex [0-9a-z.]+ saved by game version %s 14887 148880 string CIV6 Sid Meier's Civilization VI saved game 14889 14890# https://syzygy-tables.info/ 14891# From Michel Van den Bergh 148920 string \327f\f\245 Syzygy DTZ tablebase 14893!:mime application/syzygy 148940 string q\350#] Syzygy WDL tablebase 14895!:mime application/syzygy 14896 14897#------------------------------------------------------------------------------ 14898# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 14899# gcc: file(1) magic for GCC special files 14900# 149010 string gpch GCC precompiled header 14902 14903# The version field is annoying. It's 3 characters, not zero-terminated. 14904>5 byte x (version %c 14905>6 byte x \b%c 14906>7 byte x \b%c) 14907 14908# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 14909>4 byte 67 for C 14910>4 byte 111 for Objective-C 14911>4 byte 43 for C++ 14912>4 byte 79 for Objective-C++ 14913 14914#------------------------------------------------------------------------------ 14915# $File: gconv 14916# gconv: file(1) magic for iconv/gconv module configuration cache 14917# 14918# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 14919# 14920# From: Marek Cermak <macermak@redhat.com> 14921# 149220 lelong 0x20010324 gconv module configuration cache data 14923 14924#------------------------------------------------------------------------------ 14925# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $ 14926# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 14927 14928###################################################################### 14929# 14930# Acoustic Doppler Current Profilers (ADCP) 14931# 14932###################################################################### 14933 149340 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 14935 14936###################################################################### 14937# 14938# Metadata 14939# 14940###################################################################### 14941 149420 string Identification_Information FGDC ASCII metadata 14943 14944###################################################################### 14945# 14946# Seimsic / Subbottom 14947# 14948###################################################################### 14949 14950# Knudsen subbottom chirp profiler - Binary File Format: B9 14951# KEB D409-03167 V1.75 Huffman 149520 string KEB\ Knudsen seismic KEL binary (KEB) - 14953>4 regex [-A-Z0-9]* Software: %s 14954>>&1 regex V[0-9]*\.[0-9]* version %s 14955 14956###################################################################### 14957# 14958# LIDAR - Laser altimetry or bathy 14959# 14960###################################################################### 14961 14962 14963# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 149640 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 14965>4 regex [0-9]*\.[0-9]* version %s 14966 149670 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 14968>3 byte x version %d . 14969>4 byte x %d 14970 14971 14972###################################################################### 14973# 14974# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 14975# 14976###################################################################### 14977 14978# GeoAcoustics - GeoSwath Plus 149794 beshort 0x2002 GeoSwath RDF 149800 string Start:- GeoSwatch auf text file 14981 14982# Seabeam 2100 14983# mbsystem code mb41 149840 string SB2100 SeaBeam 2100 multibeam sonar 149850 string SB2100DR SeaBeam 2100 DR multibeam sonar 149860 string SB2100PR SeaBeam 2100 PR multibeam sonar 14987 14988# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 14989# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 149900 string $HSF XSE multibeam 14991 14992# mb121 https://www.saic.com/maritime/gsf/ 149938 string GSF-v SAIC generic sensor format (GSF) sonar data, 14994>&0 regex [0-9]*\.[0-9]* version %s 14995 14996# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 14997# mb161 149989 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 14999 15000# MBSystem processing caches the mbinfo output 150011 string Swath\ Data\ File: mbsystem info cache 15002 15003# Caris John Hughes Clark format 150040 string HDCS Caris multibeam sonar related data 150051 string Start/Stop\ parameter\ header: Caris ASCII project summary 15006 15007###################################################################### 15008# 15009# Visualization and 3D modeling 15010# 15011###################################################################### 15012 15013# IVS - IVS3d.com Tagged Data Represetation 150140 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 15015 15016# http://www.ecma-international.org/publications/standards/Ecma-363.htm 15017# 3D in PDFs 150180 string U3D ECMA-363, Universal 3D 15019 15020###################################################################### 15021# 15022# Support files 15023# 15024###################################################################### 15025 15026# https://midas.psi.ch/elog/ 150270 string $@MID@$ elog journal entry 15028 15029# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 150300 string DSBB Surfer 6 binary grid file 15031>4 leshort x \b, %d 15032>6 leshort x \bx%d 15033>8 ledouble x \b, minx=%g 15034>16 ledouble x \b, maxx=%g 15035>24 ledouble x \b, miny=%g 15036>32 ledouble x \b, maxy=%g 15037>40 ledouble x \b, minz=%g 15038>48 ledouble x \b, maxz=%g 15039 15040# magic for LAS format files 15041# alex myczko <alex@aiei.ch> 15042# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 150430 string LASF LIDAR point data records 15044>24 byte >0 \b, version %u 15045>25 byte >0 \b.%u 15046>26 string >\0 \b, SYSID %s 15047>58 string >\0 \b, Generating Software %s 15048 15049# magic for PCD format files 15050# alex myczko <alex@aiei.ch> 15051# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 150520 string #\ .PCD Point Cloud Data 15053 15054#------------------------------------------------------------------------------ 15055# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 15056# GEOS files (Vidar Madsen, vidar@gimp.org) 15057# semi-commonly used in embedded and handheld systems. 150580 belong 0xc745c153 GEOS 15059>40 byte 1 executable 15060>40 byte 2 VMFile 15061>40 byte 3 binary 15062>40 byte 4 directory label 15063>40 byte <1 unknown 15064>40 byte >4 unknown 15065>4 string >\0 \b, name "%s" 15066#>44 short x \b, version %d 15067#>46 short x \b.%d 15068#>48 short x \b, rev %d 15069#>50 short x \b.%d 15070#>52 short x \b, proto %d 15071#>54 short x \br%d 15072#>168 string >\0 \b, copyright "%s" 15073 15074#------------------------------------------------------------------------------ 15075# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $ 15076# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 15077# by Federico Mena <federico@nuclecu.unam.mx> 15078 150790 string/t GIMP\ Gradient GIMP gradient data 15080#!:mime text/plain 15081!:mime text/x-gimp-ggr 15082!:ext ggr 15083 15084# GIMP palette (.gpl) 15085# From: Markus Heidelberg <markus.heidelberg@web.de> 150860 string/t GIMP\ Palette GIMP palette data 15087# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html 15088# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette 15089#!:mime text/plain 15090!:mime text/x-gimp-gpl 15091!:ext gpl 15092 15093#------------------------------------------------------------------------------ 15094# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 15095# by Spencer Kimball and Peter Mattis 15096# ('Bucky' LaDieu, nega@vt.edu) 15097 15098# URL: https://en.wikipedia.org/wiki/XCF_(file_format) 15099# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt 151000 string gimp\ xcf GIMP XCF image data, 15101!:mime image/x-xcf 15102!:ext xcf 15103>9 string file version 0, 15104>9 string v version 15105>>10 string >\0 %s, 15106>14 belong x %u x 15107>18 belong x %u, 15108>22 belong 0 RGB Color 15109>22 belong 1 Greyscale 15110>22 belong 2 Indexed Color 15111>22 belong >2 Unknown Image Type. 15112 15113#------------------------------------------------------------------------------ 15114# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 15115# by Spencer Kimball and Peter Mattis 15116# ('Bucky' LaDieu, nega@vt.edu) 15117 15118# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern 1511920 string GPAT GIMP pattern data, 15120>24 string x %s 15121!:mime image/x-gimp-pat 15122!:ext pat 15123 15124#------------------------------------------------------------------------------ 15125# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 15126# by Spencer Kimball and Peter Mattis 15127# ('Bucky' LaDieu, nega@vt.edu) 15128 1512920 string GIMP GIMP brush data 15130# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush 15131!:mime image/x-gimp-gbr 15132# some sources also list gpb 15133!:ext gbr 15134 15135# From: Joerg Jenderek 15136# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html 15137# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush 15138# share\gimp\2.0\brushes\Legacy\confetti.gih 151390 search/21/b \040ncells: GIMP animated brush data 15140!:mime image/x-gimp-gih 15141!:ext gih 15142 15143# GIMP Curves File 15144# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 151450 string #\040GIMP\040Curves\040File GIMP curve file 15146#!:mime text/plain 15147!:mime text/x-gimp-curve 15148!:ext /txt 15149 15150 15151#------------------------------------------------------------------------------ 15152# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $ 15153# git: file(1) magic for Git objects 15154 151550 string blob\040 15156>5 regex [0-9a-f]+ Git blob %s 15157 151580 string tree\040 15159>5 regex [0-9a-f]+ Git tree %s 15160 151610 string commit\040 15162>7 regex [0-9a-f]+ Git commit %s 15163 15164#------------------------------------------------------------------------------ 15165# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ 15166# glibc locale files 15167# 15168# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 15169 151700 belong 0x20070920 glibc locale file LC_CTYPE 151710 belong 0x14110320 glibc locale file LC_NUMERIC 151720 belong 0x17110320 glibc locale file LC_TIME 151730 belong 0x17100520 glibc locale file LC_COLLATE 151740 belong 0x11110320 glibc locale file LC_MONETARY 151750 belong 0x10110320 glibc locale file LC_MESSAGES 151760 belong 0x13110320 glibc locale file LC_ALL 151770 belong 0x12110320 glibc locale file LC_PAPER 151780 belong 0x1d110320 glibc locale file LC_NAME 151790 belong 0x1c110320 glibc locale file LC_ADDRESS 151800 belong 0x1f110320 glibc locale file LC_TELEPHONE 151810 belong 0x1e110320 glibc locale file LC_MEASUREMENT 151820 belong 0x19110320 glibc locale file LC_IDENTIFICATION 15183 15184 15185#------------------------------------------------------------------------------ 15186# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $ 15187# GNOME related files 15188 15189# Contributed by Josh Triplett 15190# FIXME: Could be simplified if pstring supported two-byte counts 151910 string GnomeKeyring\n\r\0\n GNOME keyring 15192>&0 ubyte 0 \b, major version 0 15193>>&0 ubyte 0 \b, minor version 0 15194>>>&0 ubyte 0 \b, crypto type 0 (AES) 15195>>>&0 ubyte >0 \b, crypto type %u (unknown) 15196>>>&1 ubyte 0 \b, hash type 0 (MD5) 15197>>>&1 ubyte >0 \b, hash type %u (unknown) 15198>>>&2 ubelong 0xFFFFFFFF \b, name NULL 15199>>>&2 ubelong !0xFFFFFFFF 15200>>>>&-4 ubelong >255 \b, name too long for file's pstring type 15201>>>>&-4 ubelong <256 15202>>>>>&-1 pstring x \b, name "%s" 15203>>>>>>&0 ubeqdate x \b, last modified %s 15204>>>>>>&8 ubeqdate x \b, created %s 15205>>>>>>&16 ubelong &1 15206>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 15207>>>>>>&16 ubelong ^1 \b, not locked if idle 15208>>>>>>&24 ubelong x \b, hash iterations %u 15209>>>>>>&28 ubequad x \b, salt %llu 15210>>>>>>&52 ubelong x \b, %u item(s) 15211 15212# From: Alex Beregszaszi <alex@fsn.hu> 152134 string gtktalog GNOME Catalogue (gtktalog) 15214>13 string >\0 version %s 15215 15216# Summary: GStreamer binary registry 15217# Extension: .bin 15218# Submitted by: Josh Triplett <josh@joshtriplett.org> 152190 belong 0xc0def00d GStreamer binary registry 15220>4 string x \b, version %s 15221 15222# GVariant Database file 15223# By Elan Ruusamae <glen@delfi.ee> 15224# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 15225# It's always "GVariant", it's byte swapped on incompatible archs 15226# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 15227# file_builder_serialise() 15228# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 152290 string GVariant GVariant Database file, 15230# version is never filled. probably future extension 15231>8 lelong x version %d 15232# not sure are these usable, so commented out 15233#>>16 lelong x start %d, 15234#>>>20 lelong x end %d 15235 15236# G-IR database made by gobject-introspect toolset, 15237# https://live.gnome.org/GObjectIntrospection 152380 string GOBJ\nMETADATA\r\n\032 G-IR binary database 15239>16 byte x \b, v%d 15240>17 byte x \b.%d 15241>20 short x \b, %d entries 15242>22 short x \b/%d local 15243 15244#------------------------------------------------------------------------------ 15245# $File: gnu,v 1.23 2021/02/23 00:51:10 christos Exp $ 15246# gnu: file(1) magic for various GNU tools 15247# 15248# GNU nlsutils message catalog file format 15249# 15250# GNU message catalog (.mo and .gmo files) 15251 15252# Update: Joerg Jenderek 15253# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 15254# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 15255# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 15256# Note: maybe call it like "GNU translation gettext machine object" 152570 string \336\22\4\225 GNU message catalog (little endian), 15258#0 ulelong 0x950412DE GNU-format message catalog data 15259# TODO: write lines in such a way that code can also be called for big endian variant 15260#>0 use gettext-object 15261#0 name gettext-object 15262>4 ulelong x revision 15263!:mime application/x-gettext-translation 15264# mo extension is also used for Easeus Partition Master PE32 executable module 15265# like ConvertFatToNTFS.mo 15266!:ext gmo/mo 15267# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 15268# major revision 15269>4 ulelong/0xFFff x %u. 15270# minor revision 15271>4 ulelong&0x0000FFff x \b%u 15272>>8 ulelong x \b, %u message 15273# plural s 15274>>8 ulelong >1 \bs 15275# size of hashing table 15276#>20 ulelong x \b, %u hash 15277#>20 ulelong >1 \bes 15278#>24 ulelong x at 0x%x 15279# for revision x.0 offset of table with originals is 1Ch if directly after header 15280>4 ulelong&0x0000FFff =0 15281>>12 ulelong !0x1C \b, at 0x%x string table 15282# but for x.1 table offset i found is 30h. That means directly after bigger header 15283>4 ulelong&0x0000FFff >0 15284>>12 ulelong !0x30 \b, at 0x%x string table 15285# The following variables are only used in .mo files with minor revision >= 1 15286# number of system dependent segments 15287#>>28 ulelong x \b, %u segment 15288#>>28 ulelong >1 \bs 15289# offset of table describing system dependent segments 15290#>>32 ulelong x at 0x%x 15291# number of system dependent strings pairs 15292>>36 ulelong x \b, %u sysdep message 15293>>36 ulelong >1 \bs 15294# offset of table with start offsets of original sysdep strings 15295#>>40 ulelong x \b, at 0x%x sysdep strings 15296# offset of table with start offsets of translated sysdep strings 15297#>>44 ulelong x \b, at 0x%x sysdep translations 15298# >>(44.l) ulelong x 0x%x chars 15299# >>>&0 ulelong x at 0x%x 15300# >>>>(&-4) string x "%s" 15301# string table after big header 15302#>>48 ubequad x \b, string table 0x%llx 15303# 15304# 0th string length seems to be always 0 15305#>(12.l) ulelong x \b, %u chars 15306#>>&0 ulelong x at 0x%x 15307# if 1st string length positive inspect offset and string 15308#>(12.l+8) ulelong >0 \b, %u chars 15309#>>&0 ulelong x at 0x%x 15310# if 2nd string length positive inspect offset and string 15311# >(12.l+16) ulelong >0 \b, %u chars 15312# >>&0 ulelong x at 0x%x 15313# skip newline byte 15314#>>>(&-4) ubyte =0x0A 15315#>>>>&0 string x "%s" 15316#>>>(&-4) ubyte !0x0A 15317#>>>>&-1 string x '%s' 15318# offset of table with translation strings 15319#>16 ulelong x \b, at 0x%x translation table 15320# check translation 0 length and offset 15321>(16.l) ulelong >0 15322>>&0 ulelong x 15323# translation 0 seems to be often Project-Id with name and version 15324>>>(&-4) string x \b, %s 15325# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 15326>(16.l+8) ulelong >1 15327>>&0 ulelong x 15328>>>(&-4) ubyte !0x0A 15329>>>>&-1 string x '%s' 15330# 1 New Line like in tar-1.29\po\de.gmo 15331>>>(&-4) ubyte =0x0A 15332>>>>&0 ubyte !0x0A 15333>>>>>&-1 string x '%s' 15334# 2nd New Line like in parted-3.1\po\de.gmo 15335>>>>&0 ubyte =0x0A 15336>>>>>&0 string x '%s' 15337 153380 string \225\4\22\336 GNU message catalog (big endian), 15339#0 ubelong 0x950412DE GNU-format message catalog data 15340!:mime application/x-gettext-translation 15341!:ext gmo/mo 15342# TODO: for big endian use same code as for little endian 15343#>0 use \^gettext-object 15344# DEBUG code 15345#>16 ubelong x \b, at 0x%x translation table 15346#>(16.L) ubelong x 0x%x chars 15347#>>&0 ubelong x at 0x%x 15348# unexpected value HERE! 15349#>>>(&-4) ubequad x 0x%llx 15350# 15351>4 beshort x revision %d. 15352>6 beshort >0 \b%d, 15353>>8 belong x %d messages, 15354>>36 belong x %d sysdep messages 15355>6 beshort =0 \b%d, 15356>>8 belong x %d messages 15357 15358 15359# GnuPG 15360# The format is very similar to pgp 153610 string \001gpg GPG key trust database 15362>4 byte x version %d 15363# Note: magic.mime had 0x8501 for the next line instead of 0x8502 153640 beshort 0x8502 GPG encrypted data 15365!:mime text/PGP # encoding: data 15366 15367# Update: Joerg Jenderek 15368# Note: PGP and GPG use same data structure. 15369# So recognition is now done by ./pgp with start test for byte 0x99 15370# This magic is not particularly good, as the keyrings don't have true 15371# magic. Nevertheless, it covers many keyrings. 15372# 0 ubeshort-0x9901 <2 15373# >3 byte 4 15374# >>4 bedate x GPG key public ring, created %s 15375# !:mime application/x-gnupg-keyring 15376 15377# Symmetric encryption 153780 leshort 0x0d8c 15379>4 leshort 0x0203 15380>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 15381>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 15382>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 15383>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 15384>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 15385>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 15386>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 15387>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 15388>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 15389>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 15390 15391 15392# GnuPG Keybox file 15393# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 15394# From: Philipp Hahn <hahn@univention.de> 153950 belong 32 15396>4 byte 1 15397>>8 string KBXf GPG keybox database 15398>>>5 byte 1 version %d 15399>>>16 bedate x \b, created-at %s 15400>>>20 bedate x \b, last-maintained %s 15401 15402 15403# From: James Youngman <jay@gnu.org> 15404# gnu find magic 154050 string \0LOCATE GNU findutils locate database data 15406>7 string >\0 \b, format %s 15407>7 string 02 \b (frcode) 15408 15409# Files produced by GNU gettext 15410 15411# gettext message catalogue 154120 search/1024 \nmsgid 15413>&0 search/1024 \nmsgstr GNU gettext message catalogue text 15414!:strength +100 15415!:mime text/x-po 15416 15417#------------------------------------------------------------------------------ 15418# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 15419# gnumeric: file(1) magic for Gnumeric spreadsheet 15420# This entry is only semi-helpful, as Gnumeric compresses its files, so 15421# they will ordinarily reported as "compressed", but at least -z helps 1542239 string =<gmr:Workbook Gnumeric spreadsheet 15423!:mime application/x-gnumeric 15424 15425#------------------------------------------------------------------------------ 15426# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $ 15427# 15428# GPT Partition table patterns. 15429# Author: Rogier Goossens (goossens.rogier@gmail.com) 15430# Note that a GPT-formatted disk must contain an MBR as well. 15431# 15432 15433# The initial segment (up to >>>>>>>>422) was copied from the X86 15434# partition table code (aka MBR). 15435# This is kept separate, so that MBR partitions are not reported as well. 15436# (use -k if you do want them as well) 15437 15438# First, detect the MBR partition table 15439# If more than one GPT protective MBR partition exists, don't print anything 15440# (the other MBR detection code will then just print the MBR partition table) 154410x1FE leshort 0xAA55 15442>3 string !MS 15443>>3 string !SYSLINUX 15444>>>3 string !MTOOL 15445>>>>3 string !NEWLDR 15446>>>>>5 string !DOS 15447# not FAT (32 bit) 15448>>>>>>82 string !FAT32 15449#not Linux kernel 15450>>>>>>>514 string !HdrS 15451#not BeOS 15452>>>>>>>>422 string !Be\ Boot\ Loader 15453# GPT with protective MBR entry in partition 1 (only) 15454>>>>>>>>>450 ubyte 0xee 15455>>>>>>>>>>466 ubyte !0xee 15456>>>>>>>>>>>482 ubyte !0xee 15457>>>>>>>>>>>>498 ubyte !0xee 15458#>>>>>>>>>>>>>446 use gpt-mbr-partition 15459>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 15460>>>>>>>>>>>>>>0 use gpt-mbr-type 15461>>>>>>>>>>>>>>&-8 use gpt-table 15462>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15463>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 15464>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 15465>>>>>>>>>>>>>>>0 use gpt-mbr-type 15466>>>>>>>>>>>>>>>&-8 use gpt-table 15467>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15468>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 15469>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 15470>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15471>>>>>>>>>>>>>>>>&-8 use gpt-table 15472>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15473>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 15474>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 15475>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15476>>>>>>>>>>>>>>>>>&-8 use gpt-table 15477>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15478>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 15479>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 15480>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15481>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15482>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15483# GPT with protective MBR entry in partition 2 (only) 15484>>>>>>>>>450 ubyte !0xee 15485>>>>>>>>>>466 ubyte 0xee 15486>>>>>>>>>>>482 ubyte !0xee 15487>>>>>>>>>>>>498 ubyte !0xee 15488#>>>>>>>>>>>>>462 use gpt-mbr-partition 15489>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 15490>>>>>>>>>>>>>>0 use gpt-mbr-type 15491>>>>>>>>>>>>>>&-8 use gpt-table 15492>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15493>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 15494>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 15495>>>>>>>>>>>>>>>0 use gpt-mbr-type 15496>>>>>>>>>>>>>>>&-8 use gpt-table 15497>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15498>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 15499>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 15500>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15501>>>>>>>>>>>>>>>>&-8 use gpt-table 15502>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15503>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 15504>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 15505>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15506>>>>>>>>>>>>>>>>>&-8 use gpt-table 15507>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15508>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 15509>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 15510>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15511>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15512>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15513# GPT with protective MBR entry in partition 3 (only) 15514>>>>>>>>>450 ubyte !0xee 15515>>>>>>>>>>466 ubyte !0xee 15516>>>>>>>>>>>482 ubyte 0xee 15517>>>>>>>>>>>>498 ubyte !0xee 15518#>>>>>>>>>>>>>478 use gpt-mbr-partition 15519>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 15520>>>>>>>>>>>>>>0 use gpt-mbr-type 15521>>>>>>>>>>>>>>&-8 use gpt-table 15522>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15523>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 15524>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 15525>>>>>>>>>>>>>>>0 use gpt-mbr-type 15526>>>>>>>>>>>>>>>&-8 use gpt-table 15527>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15528>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 15529>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 15530>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15531>>>>>>>>>>>>>>>>&-8 use gpt-table 15532>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15533>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 15534>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 15535>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15536>>>>>>>>>>>>>>>>>&-8 use gpt-table 15537>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15538>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 15539>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 15540>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15541>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15542>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15543# GPT with protective MBR entry in partition 4 (only) 15544>>>>>>>>>450 ubyte !0xee 15545>>>>>>>>>>466 ubyte !0xee 15546>>>>>>>>>>>482 ubyte !0xee 15547>>>>>>>>>>>>498 ubyte 0xee 15548#>>>>>>>>>>>>>494 use gpt-mbr-partition 15549>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 15550>>>>>>>>>>>>>>0 use gpt-mbr-type 15551>>>>>>>>>>>>>>&-8 use gpt-table 15552>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15553>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 15554>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 15555>>>>>>>>>>>>>>>0 use gpt-mbr-type 15556>>>>>>>>>>>>>>>&-8 use gpt-table 15557>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15558>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 15559>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 15560>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15561>>>>>>>>>>>>>>>>&-8 use gpt-table 15562>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15563>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 15564>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 15565>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15566>>>>>>>>>>>>>>>>>&-8 use gpt-table 15567>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15568>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 15569>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 15570>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15571>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15572>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15573 15574# The following code does GPT detection and processing, including 15575# sector size detection. 15576# It has to be duplicated above because the top-level pattern 15577# (i.e. not called using 'use') must print *something* for file 15578# to count it as a match. Text only printed in named patterns is 15579# not counted, and causes file to continue, and try and match 15580# other patterns. 15581# 15582# Unfortunately, when assuming sector sizes >=16k, if the sector size 15583# happens to be 512 instead, we may find confusing data after the GPT 15584# table... If the GPT table has less than 128 entries, this may even 15585# happen for assumed sector sizes as small as 4k 15586# This could be solved by checking for the presence of the backup GPT 15587# header as well, but that makes the logic extremely complex 15588##0 name gpt-mbr-partition 15589##>(8.l*8192) string EFI\ PART 15590##>>(8.l*8192) use gpt-mbr-type 15591##>>&-8 use gpt-table 15592##>>0 ubyte x of 8192 bytes 15593##>(8.l*8192) string !EFI\ PART 15594##>>(8.l*4096) string EFI\ PART GPT partition table 15595##>>>0 use gpt-mbr-type 15596##>>>&-8 use gpt-table 15597##>>>0 ubyte x of 4096 bytes 15598##>>(8.l*4096) string !EFI\ PART 15599##>>>(8.l*2048) string EFI\ PART GPT partition table 15600##>>>>0 use gpt-mbr-type 15601##>>>>&-8 use gpt-table 15602##>>>>0 ubyte x of 2048 bytes 15603##>>>(8.l*2048) string !EFI\ PART 15604##>>>>(8.l*1024) string EFI\ PART GPT partition table 15605##>>>>>0 use gpt-mbr-type 15606##>>>>>&-8 use gpt-table 15607##>>>>>0 ubyte x of 1024 bytes 15608##>>>>(8.l*1024) string !EFI\ PART 15609##>>>>>(8.l*512) string EFI\ PART GPT partition table 15610##>>>>>>0 use gpt-mbr-type 15611##>>>>>>&-8 use gpt-table 15612##>>>>>>0 ubyte x of 512 bytes 15613 15614# Print details of MBR type for a GPT-disk 15615# Calling code ensures that there is only one 0xee partition. 156160 name gpt-mbr-type 15617# GPT with protective MBR entry in partition 1 15618>450 ubyte 0xee 15619>>454 ulelong 1 15620>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15621>>454 ulelong !1 \b (nonstandard: not at LBA 1) 15622# GPT with protective MBR entry in partition 2 15623>466 ubyte 0xee 15624>>470 ulelong 1 15625>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15626>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15627>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15628>>470 ulelong !1 \b (nonstandard: not at LBA 1) 15629# GPT with protective MBR entry in partition 3 15630>482 ubyte 0xee 15631>>486 ulelong 1 15632>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15633>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15634>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15635>>486 ulelong !1 \b (nonstandard: not at LBA 1) 15636# GPT with protective MBR entry in partition 4 15637>498 ubyte 0xee 15638>>502 ulelong 1 15639>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15640>>502 ulelong !1 \b (nonstandard: not at LBA 1) 15641 15642# Print the information from a GPT partition table structure 156430 name gpt-table 15644>10 uleshort x \b, version %u 15645>8 uleshort x \b.%u 15646>56 ulelong x \b, GUID: %08x 15647>60 uleshort x \b-%04x 15648>62 uleshort x \b-%04x 15649>64 ubeshort x \b-%04x 15650>66 ubeshort x \b-%04x 15651>68 ubelong x \b%08x 15652#>80 uleshort x \b, %d partition entries 15653>32 ulequad+1 x \b, disk size: %lld sectors 15654 15655# In case a GPT data-structure is at LBA 0, report it as well 15656# This covers systems which are not GPT-aware, and which show 15657# and allow access to the protective partition. This code will 15658# detect the contents of such a partition. 156590 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 15660>0 use gpt-table 15661>0 ubyte x (sector size unknown) 15662 15663 15664 15665#------------------------------------------------------------------------------ 15666# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 15667# gpu: file(1) magic for GPU input files 15668 15669# Standard Portable Intermediate Representation (SPIR) 15670# Documentation: https://www.khronos.org/spir 15671# Typical file extension: .spv 15672 156730 belong 0x07230203 Khronos SPIR-V binary, big-endian 15674>4 belong x \b, version 0x%08x 15675>8 belong x \b, generator 0x%08x 15676 156770 lelong 0x07230203 Khronos SPIR-V binary, little-endian 15678>4 lelong x \b, version 0x%08x 15679>8 lelong x \b, generator 0x%08x 15680 15681# Vulkan Trace file 15682# Documentation: 15683# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 15684# vktrace_trace_packet_identifiers.h 15685# Typical file extension: .vktrace 15686 156878 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 15688>0 leshort x \b, version %d 15689 156908 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 15691>0 beshort x \b, version %d 15692 15693#------------------------------------------------------------------------------ 15694# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 15695# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15696# 15697# ACE/gr binary 156980 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 15699>39 byte >0 - version %c 15700# ACE/gr ascii 157010 string #\ xvgr\ parameter\ file ACE/gr ascii file 157020 string #\ xmgr\ parameter\ file ACE/gr ascii file 157030 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 15704# Grace projects 157050 string #\ Grace\ project\ file Grace project file 15706>23 string @version\ (version 15707>>32 byte >0 %c 15708>>33 string >\0 \b.%.2s 15709>>35 string >\0 \b.%.2s) 15710# ACE/gr fit description files 157110 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 15712# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15713 15714#------------------------------------------------------------------------------ 15715# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ 15716# graphviz: file(1) magic for https://www.graphviz.org/ 15717 15718# FIXME: These patterns match too generally. For example, the first 15719# line matches a LaTeX file containing the word "graph" (with a { 15720# following later) and the second line matches this file. 15721#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 15722#!:mime text/vnd.graphviz 15723#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 15724#!:mime text/vnd.graphviz 15725 15726#------------------------------------------------------------------------------ 15727# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 15728# gringotts: file(1) magic for Gringotts 15729# http://devel.pluto.linux.it/projects/Gringotts/ 15730# author: Germano Rizzo <mano@pluto.linux.it> 15731#GRG3????Y 157320 string GRG Gringotts data file 15733#file format 1 15734>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 15735#file format 2 15736>3 string 2 v.2, MCRYPT S2K, 15737>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15738>>8 byte&0x70 0x10 SERPENT crypt, 15739>>8 byte&0x70 0x20 TWOFISH crypt, 15740>>8 byte&0x70 0x30 CAST-256 crypt, 15741>>8 byte&0x70 0x40 SAFER+ crypt, 15742>>8 byte&0x70 0x50 LOKI97 crypt, 15743>>8 byte&0x70 0x60 3DES crypt, 15744>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15745>>8 byte&0x08 0x00 SHA1 hash, 15746>>8 byte&0x08 0x08 RIPEMD-160 hash, 15747>>8 byte&0x04 0x00 ZLib 15748>>8 byte&0x04 0x04 BZip2 15749>>8 byte&0x03 0x00 lvl.0 15750>>8 byte&0x03 0x01 lvl.3 15751>>8 byte&0x03 0x02 lvl.6 15752>>8 byte&0x03 0x03 lvl.9 15753#file format 3 15754>3 string 3 v.3, OpenPGP S2K, 15755>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15756>>8 byte&0x70 0x10 SERPENT crypt, 15757>>8 byte&0x70 0x20 TWOFISH crypt, 15758>>8 byte&0x70 0x30 CAST-256 crypt, 15759>>8 byte&0x70 0x40 SAFER+ crypt, 15760>>8 byte&0x70 0x50 LOKI97 crypt, 15761>>8 byte&0x70 0x60 3DES crypt, 15762>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15763>>8 byte&0x08 0x00 SHA1 hash, 15764>>8 byte&0x08 0x08 RIPEMD-160 hash, 15765>>8 byte&0x04 0x00 ZLib 15766>>8 byte&0x04 0x04 BZip2 15767>>8 byte&0x03 0x00 lvl.0 15768>>8 byte&0x03 0x01 lvl.3 15769>>8 byte&0x03 0x02 lvl.6 15770>>8 byte&0x03 0x03 lvl.9 15771#file format >3 15772>3 string >3 v.%.1s (unknown details) 15773 15774#------------------------------------------------------------------------------ 15775# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $ 15776# Guile file magic from <dalepsmith@gmail.com> 15777# https://www.gnu.org/s/guile/ 15778# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 15779 157800 string GOOF---- Guile Object 15781>8 string LE \b, little endian 15782>8 string BE \b, big endian 15783>11 string 4 \b, 32bit 15784>11 string 8 \b, 64bit 15785>13 regex .\.. \b, bytecode v%s 15786 15787#------------------------------------------------------------------------------ 15788# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ 15789# hardware magic 15790 15791# EDID 15792# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data 157930 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 15794>19 byte x 15795>>18 byte x EDID data, version %u. 15796>>19 byte x \b%u 15797#>>17 ubyte+1990 <255 \b, manufactured %u 15798 15799#------------------------------------------------------------------------------ 15800# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $ 15801# hitach-sh: file(1) magic for Hitachi Super-H 15802# 15803# Super-H COFF 15804# 15805# updated by Joerg Jenderek at Oct 2015 15806# https://en.wikipedia.org/wiki/COFF 15807# https://de.wikipedia.org/wiki/Common_Object_File_Format 15808# http://www.delorie.com/djgpp/doc/coff/filhdr.html 15809# below test line conflicts with 2nd NTFS filesystem sector 15810# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 15811# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 158120 beshort 0x0500 15813# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 15814>18 ubeshort&0x8E80 0 15815# use big endian variant of subroutine to display name+variables+flags 15816# for common object formatted files 15817>>0 use \^display-coff 15818!:strength -10 15819 158200 leshort 0x0550 15821# test for unused flag bits in f_flags 15822>18 uleshort&0x8E80 0 15823# use little endian variant of subroutine to 15824# display name+variables+flags for common object formatted files 15825>>0 use display-coff 15826!:strength -10 15827 15828 15829#------------------------------------------------------------------------------ 15830# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ 15831# hp: file(1) magic for Hewlett Packard machines (see also "printer") 15832# 15833# XXX - somebody should figure out whether any byte order needs to be 15834# applied to the "TML" stuff; I'm assuming the Apollo stuff is 15835# big-endian as it was mostly 68K-based. 15836# 15837# I think the 500 series was the old stack-based machines, running a 15838# UNIX environment atop the "SUN kernel"; dunno whether it was 15839# big-endian or little-endian. 15840# 15841# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 15842# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 15843# HP magic is useful for reference, but using "long" magic is a better 15844# practice in order to avoid collisions. 15845# 15846# Guy Harris (guy@netapp.com): some additions to this list came from 15847# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 15848# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 15849# "/etc/magic", though, except for the "archive file relocatable library" 15850# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 15851# used in executables, or have they just not yet updated "/etc/magic" 15852# completely? 15853# 15854# 0 beshort 200 hp200 (68010) BSD binary 15855# 0 beshort 300 hp300 (68020+68881) BSD binary 15856# 0 beshort 0x20c hp200/300 HP-UX binary 15857# 0 beshort 0x20d hp400 (68030) HP-UX binary 15858# 0 beshort 0x20e hp400 (68040?) HP-UX binary 15859# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 15860# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 15861# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 15862# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 15863 15864# 15865# The "misc" stuff needs a byte order; the archives look suspiciously 15866# like the old 177545 archives (0xff65 = 0177545). 15867# 15868#### Old Apollo stuff 158690 beshort 0627 Apollo m68k COFF executable 15870>18 beshort ^040000 not stripped 15871>22 beshort >0 - version %d 158720 beshort 0624 apollo a88k COFF executable 15873>18 beshort ^040000 not stripped 15874>22 beshort >0 - version %d 158750 long 01203604016 TML 0123 byte-order format 158760 long 01702407010 TML 1032 byte-order format 158770 long 01003405017 TML 2301 byte-order format 158780 long 01602007412 TML 3210 byte-order format 15879#### PA-RISC 1.1 158800 belong 0x02100106 PA-RISC1.1 relocatable object 158810 belong 0x02100107 PA-RISC1.1 executable 15882>168 belong &0x00000004 dynamically linked 15883>(144) belong 0x054ef630 dynamically linked 15884>96 belong >0 - not stripped 15885 158860 belong 0x02100108 PA-RISC1.1 shared executable 15887>168 belong&0x4 0x4 dynamically linked 15888>(144) belong 0x054ef630 dynamically linked 15889>96 belong >0 - not stripped 15890 158910 belong 0x0210010b PA-RISC1.1 demand-load executable 15892>168 belong&0x4 0x4 dynamically linked 15893>(144) belong 0x054ef630 dynamically linked 15894>96 belong >0 - not stripped 15895 158960 belong 0x0210010e PA-RISC1.1 shared library 15897>96 belong >0 - not stripped 15898 158990 belong 0x0210010d PA-RISC1.1 dynamic load library 15900>96 belong >0 - not stripped 15901 15902#### PA-RISC 2.0 159030 belong 0x02140106 PA-RISC2.0 relocatable object 15904 159050 belong 0x02140107 PA-RISC2.0 executable 15906>168 belong &0x00000004 dynamically linked 15907>(144) belong 0x054ef630 dynamically linked 15908>96 belong >0 - not stripped 15909 159100 belong 0x02140108 PA-RISC2.0 shared executable 15911>168 belong &0x00000004 dynamically linked 15912>(144) belong 0x054ef630 dynamically linked 15913>96 belong >0 - not stripped 15914 159150 belong 0x0214010b PA-RISC2.0 demand-load executable 15916>168 belong &0x00000004 dynamically linked 15917>(144) belong 0x054ef630 dynamically linked 15918>96 belong >0 - not stripped 15919 159200 belong 0x0214010e PA-RISC2.0 shared library 15921>96 belong >0 - not stripped 15922 159230 belong 0x0214010d PA-RISC2.0 dynamic load library 15924>96 belong >0 - not stripped 15925 15926#### 800 159270 belong 0x020b0106 PA-RISC1.0 relocatable object 15928 159290 belong 0x020b0107 PA-RISC1.0 executable 15930>168 belong&0x4 0x4 dynamically linked 15931>(144) belong 0x054ef630 dynamically linked 15932>96 belong >0 - not stripped 15933 159340 belong 0x020b0108 PA-RISC1.0 shared executable 15935>168 belong&0x4 0x4 dynamically linked 15936>(144) belong 0x054ef630 dynamically linked 15937>96 belong >0 - not stripped 15938 159390 belong 0x020b010b PA-RISC1.0 demand-load executable 15940>168 belong&0x4 0x4 dynamically linked 15941>(144) belong 0x054ef630 dynamically linked 15942>96 belong >0 - not stripped 15943 159440 belong 0x020b010e PA-RISC1.0 shared library 15945>96 belong >0 - not stripped 15946 159470 belong 0x020b010d PA-RISC1.0 dynamic load library 15948>96 belong >0 - not stripped 15949 15950#### 500 159510 long 0x02080106 HP s500 relocatable executable 15952>16 long >0 - version %d 15953 159540 long 0x02080107 HP s500 executable 15955>16 long >0 - version %d 15956 159570 long 0x02080108 HP s500 pure executable 15958>16 long >0 - version %d 15959 15960#### 200 159610 belong 0x020c0108 HP s200 pure executable 15962>4 beshort >0 - version %d 15963>8 belong &0x80000000 save fp regs 15964>8 belong &0x40000000 dynamically linked 15965>8 belong &0x20000000 debuggable 15966>36 belong >0 not stripped 15967 159680 belong 0x020c0107 HP s200 executable 15969>4 beshort >0 - version %d 15970>8 belong &0x80000000 save fp regs 15971>8 belong &0x40000000 dynamically linked 15972>8 belong &0x20000000 debuggable 15973>36 belong >0 not stripped 15974 159750 belong 0x020c010b HP s200 demand-load executable 15976>4 beshort >0 - version %d 15977>8 belong &0x80000000 save fp regs 15978>8 belong &0x40000000 dynamically linked 15979>8 belong &0x20000000 debuggable 15980>36 belong >0 not stripped 15981 159820 belong 0x020c0106 HP s200 relocatable executable 15983>4 beshort >0 - version %d 15984>6 beshort >0 - highwater %d 15985>8 belong &0x80000000 save fp regs 15986>8 belong &0x20000000 debuggable 15987>8 belong &0x10000000 PIC 15988 159890 belong 0x020a0108 HP s200 (2.x release) pure executable 15990>4 beshort >0 - version %d 15991>36 belong >0 not stripped 15992 159930 belong 0x020a0107 HP s200 (2.x release) executable 15994>4 beshort >0 - version %d 15995>36 belong >0 not stripped 15996 159970 belong 0x020c010e HP s200 shared library 15998>4 beshort >0 - version %d 15999>6 beshort >0 - highwater %d 16000>36 belong >0 not stripped 16001 160020 belong 0x020c010d HP s200 dynamic load library 16003>4 beshort >0 - version %d 16004>6 beshort >0 - highwater %d 16005>36 belong >0 not stripped 16006 16007#### MISC 160080 long 0x0000ff65 HP old archive 160090 long 0x020aff65 HP s200 old archive 160100 long 0x020cff65 HP s200 old archive 160110 long 0x0208ff65 HP s500 old archive 16012 160130 long 0x015821a6 HP core file 16014 160150 long 0x4da7eee8 HP-WINDOWS font 16016>8 byte >0 - version %d 160170 string Bitmapfile HP Bitmapfile 16018 160190 string IMGfile CIS compimg HP Bitmapfile 16020# XXX - see "lif" 16021#0 short 0x8000 lif file 160220 long 0x020c010c compiled Lisp 16023 160240 string msgcat01 HP NLS message catalog, 16025>8 long >0 %d messages 16026 16027# Summary: HP-48/49 calculator 16028# Created by: phk@data.fls.dk 16029# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 16030# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 160310 string HPHP HP 16032>4 string 48 48 binary 16033>4 string 49 49 binary 16034>7 byte >64 - Rev %c 16035>8 leshort 0x2911 (ADR) 16036>8 leshort 0x2933 (REAL) 16037>8 leshort 0x2955 (LREAL) 16038>8 leshort 0x2977 (COMPLX) 16039>8 leshort 0x299d (LCOMPLX) 16040>8 leshort 0x29bf (CHAR) 16041>8 leshort 0x29e8 (ARRAY) 16042>8 leshort 0x2a0a (LNKARRAY) 16043>8 leshort 0x2a2c (STRING) 16044>8 leshort 0x2a4e (HXS) 16045>8 leshort 0x2a74 (LIST) 16046>8 leshort 0x2a96 (DIR) 16047>8 leshort 0x2ab8 (ALG) 16048>8 leshort 0x2ada (UNIT) 16049>8 leshort 0x2afc (TAGGED) 16050>8 leshort 0x2b1e (GROB) 16051>8 leshort 0x2b40 (LIB) 16052>8 leshort 0x2b62 (BACKUP) 16053>8 leshort 0x2b88 (LIBDATA) 16054>8 leshort 0x2d9d (PROG) 16055>8 leshort 0x2dcc (CODE) 16056>8 leshort 0x2e48 (GNAME) 16057>8 leshort 0x2e6d (LNAME) 16058>8 leshort 0x2e92 (XLIB) 16059 160600 string %%HP: HP text 16061>6 string T(0) - T(0) 16062>6 string T(1) - T(1) 16063>6 string T(2) - T(2) 16064>6 string T(3) - T(3) 16065>10 string A(D) A(D) 16066>10 string A(R) A(R) 16067>10 string A(G) A(G) 16068>14 string F(.) F(.); 16069>14 string F(,) F(,); 16070 16071 16072# Summary: HP-38/39 calculator 16073# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 160740 string HP3 16075>3 string 8 HP 38 16076>3 string 9 HP 39 16077>4 string Bin binary 16078>4 string Asc ASCII 16079>7 string A (Directory List) 16080>7 string B (Zaplet) 16081>7 string C (Note) 16082>7 string D (Program) 16083>7 string E (Variable) 16084>7 string F (List) 16085>7 string G (Matrix) 16086>7 string H (Library) 16087>7 string I (Target List) 16088>7 string J (ASCII Vector specification) 16089>7 string K (wildcard) 16090 16091# Summary: HP-38/39 calculator 16092# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 160930 string HP3 16094>3 string 8 HP 38 16095>3 string 9 HP 39 16096>4 string Bin binary 16097>4 string Asc ASCII 16098>7 string A (Directory List) 16099>7 string B (Zaplet) 16100>7 string C (Note) 16101>7 string D (Program) 16102>7 string E (Variable) 16103>7 string F (List) 16104>7 string G (Matrix) 16105>7 string H (Library) 16106>7 string I (Target List) 16107>7 string J (ASCII Vector specification) 16108>7 string K (wildcard) 16109 16110# hpBSD magic numbers 161110 beshort 200 hp200 (68010) BSD 16112>2 beshort 0407 impure binary 16113>2 beshort 0410 read-only binary 16114>2 beshort 0413 demand paged binary 161150 beshort 300 hp300 (68020+68881) BSD 16116>2 beshort 0407 impure binary 16117>2 beshort 0410 read-only binary 16118>2 beshort 0413 demand paged binary 16119# 16120# From David Gero <dgero@nortelnetworks.com> 16121# HP-UX 10.20 core file format from /usr/include/sys/core.h 16122# Unfortunately, HP-UX uses corehead blocks without specifying the order 16123# There are four we care about: 16124# CORE_KERNEL, which starts with the string "HP-UX" 16125# CORE_EXEC, which contains the name of the command 16126# CORE_PROC, which contains the signal number that caused the core dump 16127# CORE_FORMAT, which contains the version of the core file format (== 1) 16128# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 16129# but we include all 6 variations of the order of the first 3, and 16130# assume that PROC will always be last 16131# Order 1: KERNEL, EXEC, FORMAT, PROC 161320x10 string HP-UX 16133>0 belong 2 16134>>0xC belong 0x3C 16135>>>0x4C belong 0x100 16136>>>>0x58 belong 0x44 16137>>>>>0xA0 belong 1 16138>>>>>>0xAC belong 4 16139>>>>>>>0xB0 belong 1 16140>>>>>>>>0xB4 belong 4 core file 16141>>>>>>>>>0x90 string >\0 from '%s' 16142>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16143>>>>>>>>>0xC4 belong 4 - received SIGILL 16144>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16145>>>>>>>>>0xC4 belong 6 - received SIGABRT 16146>>>>>>>>>0xC4 belong 7 - received SIGEMT 16147>>>>>>>>>0xC4 belong 8 - received SIGFPE 16148>>>>>>>>>0xC4 belong 10 - received SIGBUS 16149>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16150>>>>>>>>>0xC4 belong 12 - received SIGSYS 16151>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16152>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16153# Order 2: KERNEL, FORMAT, EXEC, PROC 16154>>>0x4C belong 1 16155>>>>0x58 belong 4 16156>>>>>0x5C belong 1 16157>>>>>>0x60 belong 0x100 16158>>>>>>>0x6C belong 0x44 16159>>>>>>>>0xB4 belong 4 core file 16160>>>>>>>>>0xA4 string >\0 from '%s' 16161>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16162>>>>>>>>>0xC4 belong 4 - received SIGILL 16163>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16164>>>>>>>>>0xC4 belong 6 - received SIGABRT 16165>>>>>>>>>0xC4 belong 7 - received SIGEMT 16166>>>>>>>>>0xC4 belong 8 - received SIGFPE 16167>>>>>>>>>0xC4 belong 10 - received SIGBUS 16168>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16169>>>>>>>>>0xC4 belong 12 - received SIGSYS 16170>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16171>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16172# Order 3: FORMAT, KERNEL, EXEC, PROC 161730x24 string HP-UX 16174>0 belong 1 16175>>0xC belong 4 16176>>>0x10 belong 1 16177>>>>0x14 belong 2 16178>>>>>0x20 belong 0x3C 16179>>>>>>0x60 belong 0x100 16180>>>>>>>0x6C belong 0x44 16181>>>>>>>>0xB4 belong 4 core file 16182>>>>>>>>>0xA4 string >\0 from '%s' 16183>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16184>>>>>>>>>0xC4 belong 4 - received SIGILL 16185>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16186>>>>>>>>>0xC4 belong 6 - received SIGABRT 16187>>>>>>>>>0xC4 belong 7 - received SIGEMT 16188>>>>>>>>>0xC4 belong 8 - received SIGFPE 16189>>>>>>>>>0xC4 belong 10 - received SIGBUS 16190>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16191>>>>>>>>>0xC4 belong 12 - received SIGSYS 16192>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16193>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16194# Order 4: EXEC, KERNEL, FORMAT, PROC 161950x64 string HP-UX 16196>0 belong 0x100 16197>>0xC belong 0x44 16198>>>0x54 belong 2 16199>>>>0x60 belong 0x3C 16200>>>>>0xA0 belong 1 16201>>>>>>0xAC belong 4 16202>>>>>>>0xB0 belong 1 16203>>>>>>>>0xB4 belong 4 core file 16204>>>>>>>>>0x44 string >\0 from '%s' 16205>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16206>>>>>>>>>0xC4 belong 4 - received SIGILL 16207>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16208>>>>>>>>>0xC4 belong 6 - received SIGABRT 16209>>>>>>>>>0xC4 belong 7 - received SIGEMT 16210>>>>>>>>>0xC4 belong 8 - received SIGFPE 16211>>>>>>>>>0xC4 belong 10 - received SIGBUS 16212>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16213>>>>>>>>>0xC4 belong 12 - received SIGSYS 16214>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16215>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16216# Order 5: FORMAT, EXEC, KERNEL, PROC 162170x78 string HP-UX 16218>0 belong 1 16219>>0xC belong 4 16220>>>0x10 belong 1 16221>>>>0x14 belong 0x100 16222>>>>>0x20 belong 0x44 16223>>>>>>0x68 belong 2 16224>>>>>>>0x74 belong 0x3C 16225>>>>>>>>0xB4 belong 4 core file 16226>>>>>>>>>0x58 string >\0 from '%s' 16227>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16228>>>>>>>>>0xC4 belong 4 - received SIGILL 16229>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16230>>>>>>>>>0xC4 belong 6 - received SIGABRT 16231>>>>>>>>>0xC4 belong 7 - received SIGEMT 16232>>>>>>>>>0xC4 belong 8 - received SIGFPE 16233>>>>>>>>>0xC4 belong 10 - received SIGBUS 16234>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16235>>>>>>>>>0xC4 belong 12 - received SIGSYS 16236>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16237>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16238# Order 6: EXEC, FORMAT, KERNEL, PROC 16239>0 belong 0x100 16240>>0xC belong 0x44 16241>>>0x54 belong 1 16242>>>>0x60 belong 4 16243>>>>>0x64 belong 1 16244>>>>>>0x68 belong 2 16245>>>>>>>0x74 belong 0x2C 16246>>>>>>>>0xB4 belong 4 core file 16247>>>>>>>>>0x44 string >\0 from '%s' 16248>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16249>>>>>>>>>0xC4 belong 4 - received SIGILL 16250>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16251>>>>>>>>>0xC4 belong 6 - received SIGABRT 16252>>>>>>>>>0xC4 belong 7 - received SIGEMT 16253>>>>>>>>>0xC4 belong 8 - received SIGFPE 16254>>>>>>>>>0xC4 belong 10 - received SIGBUS 16255>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16256>>>>>>>>>0xC4 belong 12 - received SIGSYS 16257>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16258>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16259 16260 16261 16262#------------------------------------------------------------------------------ 16263# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 16264# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 16265# Magic too short! 16266#0 string HU Human68k 16267#>68 string LZX LZX compressed 16268#>>72 string >\0 (version %s) 16269#>(8.L+74) string LZX LZX compressed 16270#>>(8.L+78) string >\0 (version %s) 16271#>60 belong >0 binded 16272#>(8.L+66) string #HUPAIR hupair 16273#>0 string HU X executable 16274#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 16275#>4 belong >0 - base address 0x%x 16276#>28 belong >0 not stripped 16277#>32 belong >0 with debug information 16278#0 beshort 0x601a Human68k Z executable 16279#0 beshort 0x6000 Human68k object file 16280#0 belong 0xd1000000 Human68k ar binary archive 16281#0 belong 0xd1010000 Human68k ar ascii archive 16282#0 beshort 0x0068 Human68k lib archive 16283#4 string LZX Human68k LZX compressed 16284#>8 string >\0 (version %s) 16285#>4 string LZX R executable 16286#2 string #HUPAIR Human68k hupair R executable 16287 16288#------------------------------------------------------------------------------ 16289# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $ 16290# ibm370: file(1) magic for IBM 370 and compatibles. 16291# 16292# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 16293# What the heck *is* "USS/370"? 16294# AIX 4.1's "/etc/magic" has 16295# 16296# 0 short 0535 370 sysV executable 16297# >12 long >0 not stripped 16298# >22 short >0 - version %d 16299# >30 long >0 - 5.2 format 16300# 0 short 0530 370 sysV pure executable 16301# >12 long >0 not stripped 16302# >22 short >0 - version %d 16303# >30 long >0 - 5.2 format 16304# 16305# instead of the "USS/370" versions of the same magic numbers. 16306# 163070 beshort 0537 370 XA sysV executable 16308>12 belong >0 not stripped 16309>22 beshort >0 - version %d 16310>30 belong >0 - 5.2 format 163110 beshort 0532 370 XA sysV pure executable 16312>12 belong >0 not stripped 16313>22 beshort >0 - version %d 16314>30 belong >0 - 5.2 format 163150 beshort 054001 370 sysV pure executable 16316>12 belong >0 not stripped 163170 beshort 055001 370 XA sysV pure executable 16318>12 belong >0 not stripped 163190 beshort 056401 370 sysV executable 16320>12 belong >0 not stripped 163210 beshort 057401 370 XA sysV executable 16322>12 belong >0 not stripped 163230 beshort 0531 SVR2 executable (Amdahl-UTS) 16324>12 belong >0 not stripped 16325>24 belong >0 - version %d 163260 beshort 0534 SVR2 pure executable (Amdahl-UTS) 16327>12 belong >0 not stripped 16328>24 belong >0 - version %d 163290 beshort 0530 SVR2 pure executable (USS/370) 16330>12 belong >0 not stripped 16331>24 belong >0 - version %d 163320 beshort 0535 SVR2 executable (USS/370) 16333>12 belong >0 not stripped 16334>24 belong >0 - version %d 16335 16336# NETDATA (https://en.wikipedia.org/wiki/NETDATA) 16337# -\INMR01 In EBCDIC 163380 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file 16339 16340#------------------------------------------------------------------------------ 16341# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $ 16342# ibm6000: file(1) magic for RS/6000 and the RT PC. 16343# 163440 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 16345>12 belong >0 not stripped 16346# Breaks sun4 statically linked execs. 16347#0 beshort 0x0103 executable (RT Version 2) or obj module 16348#>2 byte 0x50 pure 16349#>28 belong >0 not stripped 16350#>6 beshort >0 - version %ld 163510 beshort 0x0104 shared library 163520 beshort 0x0105 ctab data 163530 beshort 0xfe04 structured file 163540 string 0xabcdef AIX message catalog 163550 belong 0x000001f9 AIX compiled message catalog 163560 string \<aiaff> archive 163570 string \<bigaf> archive (big format) 163580 belong 0x09006bea AIX backup/restore format file 163590 belong 0x09006fea AIX backup/restore format file 16360 163610 beshort 0x01f7 64-bit XCOFF executable or object module 16362>20 belong 0 not stripped 16363# GRR: this test is still too general as it catches also many FATs of DOS filesystems 163644 belong &0x0feeddb0 16365# real core dump could not be 32-bit and 64-bit together 16366>7 byte&0x03 !3 AIX core file 16367>>1 byte &0x01 fulldump 16368>>7 byte &0x01 32-bit 16369>>>0x6e0 string >\0 \b, %s 16370>>7 byte &0x02 64-bit 16371>>>0x524 string >\0 \b, %s 16372 16373#------------------------------------------------------------------------------ 16374# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $ 16375# icc: file(1) magic for International Color Consortium file formats 16376 16377# 16378# Color profiles as per the ICC's "Image technology colour management - 16379# Architecture, profile format, and data structure" specification. 16380# See 16381# 16382# http://www.color.org/specification/ICC1v43_2010-12.pdf 16383# 16384# for Specification ICC.1:2010 (Profile version 4.3.0.0). 16385# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 16386# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 16387# Update: Joerg Jenderek 16388# 16389# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 16390# bytes 40 to 43 "may be used to identify the primary platform/operating 16391# system framework for which the profile was created". 16392# 16393# check and display ICC/ICM color profile 163940 name color-profile 16395>36 string acsp 16396# skip ASCII like Cognacspirit.txt by month <= 12 16397>>26 ubeshort <13 16398# platform/operating system. Only 5 mentioned 16399 16400# 16401# This appears to be what's used for Apple ColorSync profiles. 16402# Instead of adding that, Apple just changed the generic "acsp" entry 16403# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 16404# Management System, ICC Profile". 16405# Yes, it's "APPL", not "AAPL"; see the spec. 16406>>>40 string APPL ColorSync 16407 16408# Microsoft ICM color profile 16409>>>40 string MSFT Microsoft 16410 16411# Yes, that's a blank after "SGI". 16412>>>40 string SGI\ SGI 16413 16414# XXX - is this what's used for the Sun KCMS or not? The standard file 16415# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 16416# and there *is* an identified "primary platform" value of SUNW. 16417>>>40 string SUNW Sun KCMS 16418 16419# 5th platform 16420>>>40 string TGNT Taligent 16421 16422# remaining "l" "e" of "color profile" printed later to avoid error 16423>>>40 string x color profi 16424#>>>40 string x (%.4s) 16425!:mime application/vnd.iccprofile 16426# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 16427>>>8 ubyte =2 16428# do not use empty message text to avoid error like 16429# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 16430# file.exe: could not find any valid magic files! 16431>>>>9 ubyte !0 \ble 16432!:ext icc/icm 16433# minor version 16434>>>>9 ubyte =0 \bl 16435# Kodak colour management system 16436>>>>>4 string =KCMS \be 16437!:ext icc/icm/cc 16438>>>>>4 string !KCMS \be 16439!:ext icc/icm 16440>>>8 ubyte !2 \ble 16441!:ext icc 16442# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 16443>>>8 ubyte x %u 16444>>>9 ubyte/16 x \b.%u 16445# reserved and shall be null but 205.205 in umx1220u.icm 16446>>>10 ubyte >0 \b.%u 16447>>>>11 ubyte >0 \b.%u 16448# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 16449# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 16450>>>4 string >\ \b, type %.2s 16451>>>>6 string >\ \b%.1s 16452>>>>>7 string >\ \b%.1s 16453# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 16454>>>16 string x \b, %.3s 16455>>>19 string >\ \b%.1s 16456# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 16457# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 16458>>>20 string >\0 \b/%.3s 16459>>>>23 string >\ \b%.1s 16460# eleven device classes 16461>>>12 string x \b-%.4s device 16462# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 16463>>>52 string >\040 16464# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 16465>>>>52 ubelong !0x6e6f6e65 16466# device manufacturer field like "HP " "IBM " EPSO 16467>>>>>48 string x \b, %.2s 16468>>>>>50 string >\ \b%.1s 16469>>>>>51 string >\ \b%.1s 16470# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 16471>>>>>52 string >\ \ \b/%.3s 16472>>>>>>55 string >\ \b%.1s 16473>>>>>52 string x model 16474# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 16475>>>80 string >\0 by %.2s 16476>>>>82 string >\ \b%.1s 16477>>>>>83 string >\ \b%.1s 16478# profile size 16479>>>0 ubelong x \b, %u bytes 16480# skip invalid date 0 like in linearSRGB.icc 16481>>>24 ubequad !0 16482# datetime dd-mm-yyyy hh:mm:ss 16483>>>>28 ubeshort x \b, %u 16484# month <= 12 16485>>>>26 ubeshort x \b-%u 16486# year 16487>>>>24 ubeshort x \b-%u 16488# do not display midnight time like in CNHP8308.ICC 16489>>>>30 ubequad&0xFFffFFffFFff0000 !0 16490# hour <= 24 16491>>>>>30 ubeshort x %u 16492# minutes <= 59 16493>>>>>32 ubeshort x \b:%.2u 16494# seconds <= 59 16495>>>>>34 ubeshort x \b:%.2u 16496# vendor specific flags like 2 in HPCLJ5.ICM 16497>>>44 ubeshort >0 \b, 0x%x vendor flags 16498# profile flags bits 0-2 of least 16 used by ICC 16499#>>>44 ubelong >0 \b, 0x%x flags 16500# icEmbeddedProfileTrue 16501>>>44 ubelong &1 \b, embedded 16502# icEmbeddedProfileFalse 16503#>>>44 ubelong ^1 \b, not embedded 16504# icUseWithEmbeddedDataOnly 16505>>>44 ubelong &2 \b, dependently 16506# icUseAnywhere 16507#>>>44 ubelong ^2 \b, independently 16508>>>44 ubelong &4 \b, MCS 16509#>>>44 ubelong ^4 \b, no MCS 16510# vendor specific device attributes 1~srgb.icc 16511# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 16512>>>56 ubelong >0 \b, 0x%x vendor attribute 16513# ICC device attributes bits 0-7 used 16514#>>>60 ubelong x \b, 0x%x attribute 16515# http://www.color.org/icc34.h 16516>>>60 ubelong &0x01 \b, transparent 16517#>>>60 ubelong ^0x01 \b, reflective 16518>>>60 ubelong &0x02 \b, matte 16519#>>>60 ubelong ^0x02 \b, glossy 16520>>>60 ubelong &0x04 \b, negative 16521#>>>60 ubelong ^0x04 \b, positive 16522>>>60 ubelong &0x08 \b, black&white 16523#>>>60 ubelong ^0x08 \b, colour 16524>>>60 ubelong &0x10 \b, non-paper 16525#>>>60 ubelong ^0x10 \b, paper 16526>>>60 ubelong &0x20 \b, non-textured 16527#>>>60 ubelong ^0x20 \b, textured 16528>>>60 ubelong &0x40 \b, non-isotropic 16529#>>>60 ubelong ^0x40 \b, isotropic 16530>>>60 ubelong &0x80 \b, self-luminous 16531#>>>60 ubelong ^0x80 \b, non-self-luminous 16532# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 16533>>>64 ubelong >3 \b, 0x%x rendering intent 16534#>>>64 ubelong =0 \b, perceptual 16535>>>64 ubelong =1 \b, relative colorimetric 16536>>>64 ubelong =2 \b, saturation 16537>>>64 ubelong =3 \b, absolute colorimetric 16538# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 16539>>>71 ubequad !0xd6000100000000d3 \b, PCS 16540# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 16541# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 16542>>>>68 ubelong !0x0000f6d5 X=0x%x 16543# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 16544>>>>72 ubelong !0x00010000 Y=0x%x 16545# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 16546# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 16547>>>>76 ubelong !0x0000d32d Z=0x%x 16548# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 16549>>>84 ubequad >0 \b, 0x%llx MD5 16550# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 16551#>>100 ubequad x \b 0x%llx reserved 16552# tag table 16553# 6 <= tags count <= 43 16554#>>>128 ubelong >43 \b, %u tags 16555>>>128 ubelong x 16556# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 16557# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 16558>>>>132 search/508 cprt 16559# but no copyright tag in linearSRGB.icc 16560# beneath /System/Library/Frameworks/WebKit.framework/ 16561# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 16562>>>>132 default x \b, no copyright tag 16563# 1st tag 16564#>>>132 string x \b, 1st tag %.4s 16565#>>>136 ubelong x 0x%x offset 16566#>>>140 ubelong x 0x%x len 16567# 2nd tag,... 16568# look also for profileDescriptionTag "desc" 16569>>>132 search/508 desc 16570# look further for TextDescriptionType "desc" signature 16571>>>>(&0.L) string =desc 16572>>>>>&4 pstring/l x "%s" 16573# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 16574>>>>(&0.L) string =mluc 16575>>>>>&(&8.L) ubequad x 16576>>>>>>&4 bestring16 x '%s' 16577 16578# Any other profile. 16579# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 16580# and use "acsp" for everything else and dump the "primary platform" 16581# string in those cases? 1658236 string acsp 16583>0 use color-profile 16584 16585 16586 16587#------------------------------------------------------------------------------ 16588# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $ 16589# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 16590# 16591# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 16592# Arts for file interchange. It has also been used by Apple, SGI, and 16593# especially Commodore-Amiga. 16594# 16595# IFF files begin with an 8 byte FORM header, followed by a 4 character 16596# FORM type, which is followed by the first chunk in the FORM. 16597 165980 string FORM IFF data 16599#>4 belong x \b, FORM is %d bytes long 16600# audio formats 16601>8 string AIFF \b, AIFF audio 16602!:mime audio/x-aiff 16603>8 string AIFC \b, AIFF-C compressed audio 16604!:mime audio/x-aiff 16605>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 16606!:mime audio/x-aiff 16607>8 string 16SV \b, 16SV 16-bit sampled sound voice 16608>8 string SAMP \b, SAMP sampled audio 16609>8 string MAUD \b, MAUD MacroSystem audio 16610>8 string SMUS \b, SMUS simple music 16611>8 string CMUS \b, CMUS complex music 16612# image formats 16613>8 string ILBMBMHD \b, ILBM interleaved image 16614>>20 beshort x \b, %d x 16615>>22 beshort x %d 16616>8 string RGBN \b, RGBN 12-bit RGB image 16617>8 string RGB8 \b, RGB8 24-bit RGB image 16618>8 string DEEP \b, DEEP TVPaint/XiPaint image 16619>8 string DR2D \b, DR2D 2-D object 16620>8 string TDDD \b, TDDD 3-D rendering 16621>8 string LWOB \b, LWOB 3-D object 16622>8 string LWO2 \b, LWO2 3-D object, v2 16623>8 string LWLO \b, LWLO 3-D layered object 16624>8 string REAL \b, REAL Real3D rendering 16625>8 string MC4D \b, MC4D MaxonCinema4D rendering 16626>8 string ANIM \b, ANIM animation 16627>8 string YAFA \b, YAFA animation 16628>8 string SSA\ \b, SSA super smooth animation 16629>8 string FANT \b, Fantavision animation 16630>8 string ACBM \b, ACBM continuous image 16631>8 string FAXX \b, FAXX fax image 16632>8 string STFX \b, ST-Fax image 16633# other formats 16634>8 string FTXT \b, FTXT formatted text 16635>8 string CTLG \b, CTLG message catalog 16636>8 string PREF \b, PREF preferences 16637>8 string DTYP \b, DTYP datatype description 16638>8 string PTCH \b, PTCH binary patch 16639>8 string AMFF \b, AMFF AmigaMetaFile format 16640>8 string WZRD \b, WZRD StormWIZARD resource 16641>8 string DOC\040 \b, DOC desktop publishing document 16642>8 string SWRT \b, SWRT Final Copy/Writer document 16643>8 string WORD \b, ProWrite document 16644>8 string WTXT \b, WTXT Wordworth document 16645>8 string WOWO \b, WOWO Wordworth document 16646>8 string WVQA \b, Westwood Studios VQA Multimedia, 16647>>24 leshort x %d video frames, 16648>>26 leshort x %d x 16649>>28 leshort x %d 16650>8 string MOVE \b, Wing Commander III Video 16651>>12 string _PC_ \b, PC version 16652>>12 string 3DO_ \b, 3DO version 16653 16654# These go at the end of the iff rules 16655# 16656# David Griffith <dave@661.org> 16657# I don't see why these might collide with anything else. 16658# 16659# Interactive Fiction related formats 16660# 16661>8 string IFRS \b, Blorb Interactive Fiction 16662>>24 string Exec with executable chunk 16663>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 16664!:mime application/x-blorb 16665 16666#------------------------------------------------------------------------------ 16667# $File: images,v 1.194 2021/02/09 22:59:38 christos Exp $ 16668# images: file(1) magic for image formats (see also "iff", and "c-lang" for 16669# XPM bitmaps) 16670# 16671# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 16672# additions by janl@ifi.uio.no as well as others. Jan also suggested 16673# merging several one- and two-line files into here. 16674# 16675# little magic: PCX (first byte is 0x0a) 16676 16677# Targa - matches `povray', `ppmtotga' and `xv' outputs 16678# by Philippe De Muyter <phdm@macqel.be> 16679# URL: http://justsolve.archiveteam.org/wiki/TGA 16680# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 16681# Update: Joerg Jenderek 16682# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 16683# ,32 or 33 (both not observed) 16684# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 16685# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 16686# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 16687# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 16688# `tgatoppm' recognizes a superset (Index may be anything) 16689# 16690# test of Color Map Type 0~no 1~color map 16691# and Image Type 1 2 3 9 10 11 32 33 16692# and Color Map Entry Size 0 15 16 24 32 166930 ubequad&0x00FeC400000000C0 0 16694# Conflict with MPEG sequences. 16695!:strength -40 16696# Prevent conflicts with CRI ADX. 16697#>(2.S-2) belong !0x28632943 16698# above line does not work for rgb32_top_left_rle.tga 16699# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits 16700>17 ubyte&0xC0 !0xC0 16701# skip more garbage like *.iso by looking for positive image type 16702>>2 ubyte >0 16703# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 16704>>>2 ubyte <34 16705# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11 16706>>>>17 ubyte&0x0F !11 16707# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 16708>>>>>16 ubyte 1 16709>>>>>>0 use tga-image 16710>>>>>16 ubyte 8 16711>>>>>>0 use tga-image 16712>>>>>16 ubyte 15 16713>>>>>>0 use tga-image 16714>>>>>16 ubyte 16 16715>>>>>>0 use tga-image 16716>>>>>16 ubyte 24 16717>>>>>>0 use tga-image 16718>>>>>16 ubyte 32 16719>>>>>>0 use tga-image 16720# display tga bitmap image information 167210 name tga-image 16722>2 ubyte <34 Targa image data 16723!:mime image/x-tga 16724!:apple ????TPIC 16725# normal extension .tga but some Truevision products used others: 16726# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 16727!:ext tga/tpic/icb/vda/vst 16728# image type 1 2 3 9 10 11 32 33 16729>2 ubyte&0xF7 1 - Map 16730>2 ubyte&0xF7 2 - RGB 16731# alpha channel 16732>>17 ubyte&0x0F >0 \bA 16733>2 ubyte&0xF7 3 - Mono 16734# type not found, but by http://www.fileformat.info/format/tga/corion.htm 16735# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 16736>2 ubyte 32 - Color 16737# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 16738>2 ubyte 33 - Color 16739# Color Map Type 0~no 1~color map 16740>1 ubyte 1 ( 16741# first color map entry, 0 normal 16742>>3 uleshort >0 \b%d- 16743# color map length 0 2 1dh 3bh d9h 100h 16744>>5 uleshort x \b%d) 16745# 8~run length encoding bit 16746>2 ubyte&0x08 8 - RLE 16747# gimp can create big pictures! 16748>12 uleshort >0 %d x 16749>12 uleshort =0 65536 x 16750# image height. 0 interpreted as 65536 16751>14 uleshort >0 %d 16752>14 uleshort =0 65536 16753# Image Pixel depth 1 8 15 16 24 32 16754>16 ubyte x x %d 16755# X origin of image. 0 normal 16756>8 uleshort >0 +%d 16757# Y origin of image. 0 normal; positive for top 16758>10 uleshort >0 +%d 16759# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 16760# alpha depth like: 1 8 16761>17 ubyte&0x0F >0 - %d-bit alpha 16762# bits 5-4 give direction. normal bottom left 16763>17 ubyte &0x20 - top 16764#>17 ubyte ^0x20 - bottom 16765>17 ubyte &0x10 - right 16766#>17 ubyte ^0x10 - left 16767# some info say other bits 6-7 should be zero 16768# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 16769# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 16770#>17 ubyte&0xC0 0x00 - no interleave 16771>17 ubyte&0xC0 0x40 - interleave 16772>17 ubyte&0xC0 0x80 - four way interleave 16773>17 ubyte&0xC0 0xC0 - reserved 16774# positive length implies identification field 16775>0 ubyte >0 16776>>18 string x "%s" 16777# last 18 bytes of newer tga file footer signature 16778>18 search/4261301/s TRUEVISION-XFILE.\0 16779# extension area offset if not 0 16780>>&-8 ulelong >0 16781# length of the extension area. normal 495 for version 2.0 16782>>>(&-4.l) uleshort 0x01EF 16783# AuthorName[41] 16784>>>>&0 string >\0 - author "%-.40s" 16785# Comment[324]=4 * 80 null terminated 16786>>>>&41 string >\0 - comment "%-.80s" 16787# date 16788>>>>&365 ubequad&0xffffFFFFffff0000 !0 16789# Day 16790>>>>>&-6 uleshort x %d 16791# Month 16792>>>>>&-8 uleshort x \b-%d 16793# Year 16794>>>>>&-4 uleshort x \b-%d 16795# time 16796>>>>&371 ubequad&0xffffFFFFffff0000 !0 16797# hour 16798>>>>>&-8 uleshort x %d 16799# minutes 16800>>>>>&-6 uleshort x \b:%.2d 16801# second 16802>>>>>&-4 uleshort x \b:%.2d 16803# JobName[41] 16804>>>>&377 string >\0 - job "%-.40s" 16805# JobHour Jobminute Jobsecond 16806>>>>&418 ubequad&0xffffFFFFffff0000 !0 16807>>>>>&-8 uleshort x %d 16808>>>>>&-6 uleshort x \b:%.2d 16809>>>>>&-4 uleshort x \b:%.2d 16810# SoftwareId[41] 16811>>>>&424 string >\0 - %-.40s 16812# SoftwareVersionNumber 16813>>>>&424 ubyte >0 16814>>>>>&40 uleshort/100 x %d 16815>>>>>&40 uleshort%100 x \b.%d 16816# VersionLetter 16817>>>>>&42 ubyte >0x20 \b%c 16818# KeyColor 16819>>>>&468 ulelong >0 - keycolor 0x%8.8x 16820# Denominator of Pixel ratio. 0~no pixel aspect 16821>>>>&474 uleshort >0 16822# Numerator 16823>>>>>&-4 uleshort >0 - aspect %d 16824>>>>>&-2 uleshort x \b/%d 16825# Denominator of Gamma ratio. 0~no Gamma value 16826>>>>&478 uleshort >0 16827# Numerator 16828>>>>>&-4 uleshort >0 - gamma %d 16829>>>>>&-2 uleshort x \b/%d 16830# ColorOffset 16831#>>>>&480 ulelong x - col offset 0x%8.8x 16832# StampOffset 16833#>>>>&484 ulelong x - stamp offset 0x%8.8x 16834# ScanOffset 16835#>>>>&488 ulelong x - scan offset 0x%8.8x 16836# AttributesType 16837#>>>>&492 ubyte x - Attributes 0x%x 16838## EndOfTGA 16839 16840# PBMPLUS images 16841# URL: https://en.wikipedia.org/wiki/Netpbm 16842# The next byte following the magic is always whitespace. 16843# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or 16844# "DOS/MBR boot sector" identified by ./filesystems is probably not needed 16845# because files are different 168460 name netpbm 16847>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 16848>>&0 regex =[0-9]{1,50} \b, size = %s x 16849>>>&0 regex =[0-9]{1,50} \b %s 16850 168510 search/1 P1 16852# test for whitespace after 2 byte magic 16853>2 regex/2 [\040\t\f\r\n] 16854# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits 16855>>3 string !000000000 16856>>>0 use netpbm 16857>>>0 string x \b, bitmap 16858#!:strength + 65 16859!:mime image/x-portable-bitmap 16860!:ext pbm 16861# check for character # starting a comment line 16862>>>3 ubyte =0x23 16863>>>>4 string x %s 16864 168650 search/1 P2 16866>0 regex/4 P2[\040\t\f\r\n] 16867>>0 use netpbm 16868>>0 string x \b, greymap 16869#!:strength + 65 16870# american spelling gray 16871!:mime image/x-portable-graymap 16872!:ext pgm 16873 168740 search/1 P3 16875>0 regex/4 P3[\040\t\f\r\n] 16876>>0 use netpbm 16877>>0 string x \b, pixmap 16878#!:strength + 65 16879!:mime image/x-portable-pixmap 16880!:ext ppm 16881 168820 string P4 16883>0 regex/4 P4[\040\t\f\r\n] 16884>>0 use netpbm 16885>>0 string x \b, rawbits, bitmap 16886#!:strength + 65 16887!:mime image/x-portable-bitmap 16888!:ext pbm 16889 168900 string P5 16891>0 regex/4 P5[\040\t\f\r\n] 16892>>0 use netpbm 16893>>0 string x \b, rawbits, greymap 16894#!:strength + 65 16895!:mime image/x-portable-greymap 16896!:ext pgm 16897 168980 string P6 16899>0 regex/4 P6[\040\t\f\r\n] 16900>>0 use netpbm 16901>>0 string x \b, rawbits, pixmap 16902#!:strength + 65 16903!:mime image/x-portable-pixmap 16904!:ext ppm/pnm 16905 16906# URL: https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format 16907# Reference: http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map 16908# Update: Joerg Jenderek 169090 string P7 16910# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line 16911>2 ubyte !0xAB 16912#>2 ubyte =0x0A 16913>>3 search/256/b WIDTH Netpbm PAM image file, size = 16914!:mime image/x-portable-arbitrarymap 16915!:ext pam 16916>>>&1 string x %s 16917>>>3 search/256/b HEIGHT x 16918>>>>&1 string x %s 16919# at offset 2 a New Line character (0xA) should appear 16920>>>2 ubyte !0x0A \b, 0x%x at offset 2 instead new line 16921 16922# From: bryanh@giraffe-data.com (Bryan Henderson) 169230 string \117\072 Solitaire Image Recorder format 16924>4 string \013 MGI Type 11 16925>4 string \021 MGI Type 17 169260 string .MDA MicroDesign data 16927>21 byte 48 version 2 16928>21 byte 51 version 3 169290 string .MDP MicroDesign page data 16930>21 byte 48 version 2 16931>21 byte 51 version 3 16932 16933# NIFF (Navy Interchange File Format, a modification of TIFF) images 16934# [GRR: this *must* go before TIFF] 169350 string IIN1 NIFF image data 16936!:mime image/x-niff 16937 16938# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 16939# (CIFF) file. These are apparently all little-endian. 16940# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16941# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 169420 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 16943!:mime image/x-canon-crw 16944>16 leshort x \b, version %d. 16945>14 leshort x \b%d 16946 16947# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 16948# number. Put this above the TIFF test to make sure we detect them. 16949# These are apparently all little-endian. 16950# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16951# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 169520 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 16953!:mime image/x-canon-cr2 16954!:strength +80 16955>10 byte x \b, version %d. 16956>11 byte x \b%d 16957 16958# Fujifilm RAF RAW image files with embedded JPEG data and compressed 16959# or uncompressed CFA RAW data. Byte order: Big Endian. 16960# URL: https://libopenraw.freedesktop.org/formats/raf/ 169610 string FUJIFILMCCD-RAW Fujifilm RAF raw image data 16962!:mime image/x-fuji-raf 16963 16964# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 16965# The second word of TIFF files is the TIFF version number, 42, which has 16966# never changed. The TIFF specification recommends testing for it. 169670 string MM\x00\x2a TIFF image data, big-endian 16968!:strength +70 16969!:mime image/tiff 16970!:ext tif,tiff 16971>(4.L) use \^tiff_ifd 169720 string II\x2a\x00 TIFF image data, little-endian 16973!:mime image/tiff 16974!:strength +70 16975!:ext tif,tiff 16976>(4.l) use tiff_ifd 16977 169780 name tiff_ifd 16979>0 leshort x \b, direntries=%d 16980>2 use tiff_entry 16981 169820 name tiff_entry 16983# NewSubFileType 16984>0 leshort 0xfe 16985>>12 use tiff_entry 16986>0 leshort 0x100 16987>>4 lelong 1 16988>>>12 use tiff_entry 16989>>>8 leshort x \b, width=%d 16990>0 leshort 0x101 16991>>4 lelong 1 16992>>>8 leshort x \b, height=%d 16993>>>12 use tiff_entry 16994>0 leshort 0x102 16995>>8 leshort x \b, bps=%d 16996>>12 use tiff_entry 16997>0 leshort 0x103 16998>>4 lelong 1 \b, compression= 16999>>>8 leshort 1 \bnone 17000>>>8 leshort 2 \bhuffman 17001>>>8 leshort 3 \bbi-level group 3 17002>>>8 leshort 4 \bbi-level group 4 17003>>>8 leshort 5 \bLZW 17004>>>8 leshort 6 \bJPEG (old) 17005>>>8 leshort 7 \bJPEG 17006>>>8 leshort 8 \bdeflate 17007>>>8 leshort 9 \bJBIG, ITU-T T.85 17008>>>8 leshort 0xa \bJBIG, ITU-T T.43 17009>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 17010>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 17011>>>8 leshort 0x8029 \bThunderscan RLE 17012>>>8 leshort 0x807f \bRasterPadding (CT or MP) 17013>>>8 leshort 0x8080 \bRLE (Line Work) 17014>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 17015>>>8 leshort 0x8082 \bRLE (Binary Line Work) 17016>>>8 leshort 0x80b2 \bDeflate (PKZIP) 17017>>>8 leshort 0x80b3 \bKodak DCS 17018>>>8 leshort 0x8765 \bJBIG 17019>>>8 leshort 0x8798 \bJPEG2000 17020>>>8 leshort 0x8799 \bNikon NEF Compressed 17021>>>8 default x 17022>>>>8 leshort x \b(unknown 0x%x) 17023>>>12 use tiff_entry 17024>0 leshort 0x106 \b, PhotometricIntepretation= 17025>>8 clear x 17026>>8 leshort 0 \bWhiteIsZero 17027>>8 leshort 1 \bBlackIsZero 17028>>8 leshort 2 \bRGB 17029>>8 leshort 3 \bRGB Palette 17030>>8 leshort 4 \bTransparency Mask 17031>>8 leshort 5 \bCMYK 17032>>8 leshort 6 \bYCbCr 17033>>8 leshort 8 \bCIELab 17034>>8 default x 17035>>>8 leshort x \b(unknown=0x%x) 17036>>12 use tiff_entry 17037# FillOrder 17038>0 leshort 0x10a 17039>>4 lelong 1 17040>>>12 use tiff_entry 17041# DocumentName 17042>0 leshort 0x10d 17043>>(8.l) string x \b, name=%s 17044>>>12 use tiff_entry 17045# ImageDescription 17046>0 leshort 0x10e 17047>>(8.l) string x \b, description=%s 17048>>>12 use tiff_entry 17049# Make 17050>0 leshort 0x10f 17051>>(8.l) string x \b, manufacturer=%s 17052>>>12 use tiff_entry 17053# Model 17054>0 leshort 0x110 17055>>(8.l) string x \b, model=%s 17056>>>12 use tiff_entry 17057# StripOffsets 17058>0 leshort 0x111 17059>>12 use tiff_entry 17060# Orientation 17061>0 leshort 0x112 \b, orientation= 17062>>8 leshort 1 \bupper-left 17063>>8 leshort 3 \blower-right 17064>>8 leshort 6 \bupper-right 17065>>8 leshort 8 \blower-left 17066>>8 leshort 9 \bundefined 17067>>8 default x 17068>>>8 leshort x \b[*%d*] 17069>>12 use tiff_entry 17070# XResolution 17071>0 leshort 0x11a 17072>>8 lelong x \b, xresolution=%d 17073>>12 use tiff_entry 17074# YResolution 17075>0 leshort 0x11b 17076>>8 lelong x \b, yresolution=%d 17077>>12 use tiff_entry 17078# ResolutionUnit 17079>0 leshort 0x128 17080>>8 leshort x \b, resolutionunit=%d 17081>>12 use tiff_entry 17082# Software 17083>0 leshort 0x131 17084>>(8.l) string x \b, software=%s 17085>>12 use tiff_entry 17086# Datetime 17087>0 leshort 0x132 17088>>(8.l) string x \b, datetime=%s 17089>>12 use tiff_entry 17090# HostComputer 17091>0 leshort 0x13c 17092>>(8.l) string x \b, hostcomputer=%s 17093>>12 use tiff_entry 17094# WhitePoint 17095>0 leshort 0x13e 17096>>12 use tiff_entry 17097# PrimaryChromaticities 17098>0 leshort 0x13f 17099>>12 use tiff_entry 17100# YCbCrCoefficients 17101>0 leshort 0x211 17102>>12 use tiff_entry 17103# YCbCrPositioning 17104>0 leshort 0x213 17105>>12 use tiff_entry 17106# ReferenceBlackWhite 17107>0 leshort 0x214 17108>>12 use tiff_entry 17109# Copyright 17110>0 leshort 0x8298 17111>>(8.l) string x \b, copyright=%s 17112>>12 use tiff_entry 17113# ExifOffset 17114>0 leshort 0x8769 17115>>12 use tiff_entry 17116# GPS IFD 17117>0 leshort 0x8825 \b, GPS-Data 17118>>12 use tiff_entry 17119 17120#>0 leshort x \b, unknown=0x%x 17121#>>12 use tiff_entry 17122 171230 string MM\x00\x2b Big TIFF image data, big-endian 17124!:mime image/tiff 171250 string II\x2b\x00 Big TIFF image data, little-endian 17126!:mime image/tiff 17127 17128# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 17129# (Greg Roelofs, newt@uchicago.edu) 17130# (Albert Cahalan, acahalan@cs.uml.edu) 17131# 17132# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 17133# 17134 17135# IHDR parser 171360 name png-ihdr 17137>0 belong x \b, %d x 17138>4 belong x %d, 17139>8 byte x %d-bit 17140>9 byte 0 grayscale, 17141>9 byte 2 \b/color RGB, 17142>9 byte 3 colormap, 17143>9 byte 4 gray+alpha, 17144>9 byte 6 \b/color RGBA, 17145#>10 byte 0 deflate/32K, 17146>12 byte 0 non-interlaced 17147>12 byte 1 interlaced 17148 17149# Standard PNG image. 171500 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 17151!:mime image/png 17152!:ext png 17153!:strength +10 17154>16 use png-ihdr 17155 17156# Apple CgBI PNG image. 171570 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 17158>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 17159!:mime image/png 17160!:ext png 17161!:strength +10 17162>>32 use png-ihdr 17163 17164# possible GIF replacements; none yet released! 17165# (Greg Roelofs, newt@uchicago.edu) 17166# 17167# GRR 950115: this was mine ("Zip GIF"): 171680 string GIF94z ZIF image (GIF+deflate alpha) 17169!:mime image/x-unknown 17170# 17171# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 17172# 171730 string FGF95a FGF image (GIF+deflate beta) 17174!:mime image/x-unknown 17175# 17176# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 17177# (best; not yet implemented): 17178# 171790 string PBF PBF image (deflate compression) 17180!:mime image/x-unknown 17181 17182# GIF 17183# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 171840 string GIF8 GIF image data 17185!:strength +80 17186!:mime image/gif 17187!:apple 8BIMGIFf 17188!:ext gif 17189>4 string 7a \b, version 8%s, 17190>4 string 9a \b, version 8%s, 17191>6 leshort >0 %d x 17192>8 leshort >0 %d 17193#>10 byte &0x80 color mapped, 17194#>10 byte&0x07 =0x00 2 colors 17195#>10 byte&0x07 =0x01 4 colors 17196#>10 byte&0x07 =0x02 8 colors 17197#>10 byte&0x07 =0x03 16 colors 17198#>10 byte&0x07 =0x04 32 colors 17199#>10 byte&0x07 =0x05 64 colors 17200#>10 byte&0x07 =0x06 128 colors 17201#>10 byte&0x07 =0x07 256 colors 17202 17203# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 17204# 1 plane, no encoding. 172050 string \361\0\100\273 CMU window manager raster image data 17206>4 lelong >0 %d x 17207>8 lelong >0 %d, 17208>12 lelong >0 %d-bit 17209 17210# Magick Image File Format 17211# URL: https://imagemagick.org/script/miff.php 17212# Reference: http://fileformats.archiveteam.org/wiki/MIFF 17213# Update: Joerg Jenderek 17214# http://www.nationalarchives.gov.uk/pronom/fmt/930 172150 search/256/bc id=imagemagick 17216# skip bad ASCII text by following new line~0x0A or space~0x20 character 17217#>&0 ubyte x \b, next character 0x%x 17218# called by TriD ImageMagick Machine independent File Format bitmap 17219>&0 ubyte&0xD5 0 MIFF image data 17220# https://reposcope.com/mimetype/image/miff 17221#!:mime image/miff 17222!:mime image/x-miff 17223!:ext miff/mif 17224# examples with standard file(1) magic 17225#>>0 string =id=ImageMagick with standard magic 17226# examples with unusual file(1) magic like 17227>>0 string !id=ImageMagick starting with 17228# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF 17229>>>0 ubyte =0x7b comment 17230# skip second character which is often a newline and show comment 17231>>>>2 string x "%s" 17232# does not start with comment, probably letters with other case like Id=ImageMagick 17233# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff 17234>>>0 ubyte !0x7b 17235>>>>0 string >\0 '%-.14s' 17236# URL: https://imagemagick.org/ 17237# Reference: https://imagemagick.org/script/magick-vector-graphics.php 17238# From: Joerg Jenderek 17239# Note: all white-spaces between commands are ignored 172400 string push 17241# skip some white spaces 17242>5 search/3 graphic-context ImageMagick Vector Graphic 17243# TODO: look for dangerous commands like CVE-2016-3715 17244#!:mime text/plain 17245!:mime image/x-mvg 17246!:ext mvg 17247 17248# Artisan 172490 long 1123028772 Artisan image data 17250>4 long 1 \b, rectangular 24-bit 17251>4 long 2 \b, rectangular 8-bit with colormap 17252>4 long 3 \b, rectangular 32-bit (24-bit with matte) 17253 17254# FIG (Facility for Interactive Generation of figures), an object-based format 172550 search/1 #FIG FIG image text 17256>5 string x \b, version %.3s 17257 17258# PHIGS 172590 string ARF_BEGARF PHIGS clear text archive 172600 string @(#)SunPHIGS SunPHIGS 17261# version number follows, in the form m.n 17262>40 string SunBin binary 17263>32 string archive archive 17264 17265# GKS (Graphics Kernel System) 172660 string GKSM GKS Metafile 17267>24 string SunGKS \b, SunGKS 17268 17269# CGM image files 172700 string BEGMF clear text Computer Graphics Metafile 17271 17272# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 172730 string yz MGR bitmap, modern format, 8-bit aligned 172740 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 172750 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 172760 string yx MGR bitmap, modern format, squeezed 17277 17278# Fuzzy Bitmap (FBM) images 172790 string %bitmap\0 FBM image data 17280>30 long 0x31 \b, mono 17281>30 long 0x33 \b, color 17282 17283# facsimile data 172841 string PC\ Research,\ Inc group 3 fax data 17285>29 byte 0 \b, normal resolution (204x98 DPI) 17286>29 byte 1 \b, fine resolution (204x196 DPI) 17287# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 172880 string Sfff structured fax file 17289 17290# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 17291# most files with the extension .EPA and some with .BMP 172920 string \x11\x06 Award BIOS Logo, 136 x 84 17293!:mime image/x-award-bioslogo 172940 string \x11\x09 Award BIOS Logo, 136 x 126 17295!:mime image/x-award-bioslogo 17296#0 string \x07\x1f BIOS Logo corrupted? 17297# http://www.blackfiveservices.co.uk/awbmtools.shtml 17298# http://biosgfx.narod.ru/v3/ 17299# http://biosgfx.narod.ru/abr-2/ 173000 string AWBM 17301>4 leshort <1981 Award BIOS bitmap 17302!:mime image/x-award-bmp 17303# image width is a multiple of 4 17304>>4 leshort&0x0003 0 17305>>>4 leshort x \b, %d 17306>>>6 leshort x x %d 17307>>4 leshort&0x0003 >0 \b, 17308>>>4 leshort&0x0003 =1 17309>>>>4 leshort x %d+3 17310>>>4 leshort&0x0003 =2 17311>>>>4 leshort x %d+2 17312>>>4 leshort&0x0003 =3 17313>>>>4 leshort x %d+1 17314>>>6 leshort x x %d 17315# at offset 8 starts imagedata followed by "RGB " marker 17316 17317# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 17318# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 17319# 28bitmap_information_header.29 17320# Note: variant starting direct with DIB header see 17321# http://fileformats.archiveteam.org/wiki/BMP 17322# verified by ImageMagick version 6.8.9-8 command `identify *.dib` 173230 leshort 40 17324# skip bad samples like GAME by looking for valid number of color planes 17325>12 uleshort 1 Device independent bitmap graphic 17326!:mime image/x-ms-bmp 17327!:apple ????BMPp 17328!:ext dib 17329>>4 lelong x \b, %d x 17330>>8 lelong x %d x 17331>>14 leshort x %d 17332# number of color planes (must be 1) 17333#>>12 uleshort >1 \b, %u color planes 17334# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D 17335#>>16 ulelong 3 \b, Huffman 1D compression 17336>>16 ulelong >0 \b, %u compression 17337# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 17338>>20 ulelong x \b, image size %u 17339# horizontal and vertical resolution of the image (pixel per metre, signed integer) 17340>>24 lelong >0 \b, resolution %d x 17341>>>28 lelong x %d px/m 17342# number of colors in palette, or 0 to default to 2**n 17343#>>32 ulelong >0 \b, %u colors 17344# number of important colors used, or 0 when every color is important 17345>>36 ulelong >0 \b, %u important colors 173460 string BM 17347>14 leshort 12 PC bitmap, OS/2 1.x format 17348!:mime image/x-ms-bmp 17349>>18 leshort x \b, %d x 17350>>20 leshort x %d 17351>14 leshort 64 PC bitmap, OS/2 2.x format 17352!:mime image/x-ms-bmp 17353!:apple ????BMPp 17354!:ext bmp 17355# image width and height fields are unsigned integers for OS/2 17356>>18 ulelong x \b, %u x 17357>>22 ulelong x %u 17358# number of bits per pixel (color depth); found 1 4 8 17359>>28 uleshort >1 x %u 17360# x, y coordinates of the hotspot 17361>>6 uleshort >0 \b, hotspot %ux 17362>>>8 uleshort x \b%u 17363>>26 uleshort >1 \b, %u color planes 17364# cbSize; size of file or headers 17365>>2 ulelong x \b, cbSize %u 17366#>>2 ulelong x \b, cbSize 0x%x 17367# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh 17368>>10 ulelong x \b, bits offset %u 17369#>>10 ulelong x \b, bits offset 0x%x 17370#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17371# BITMAPV2INFOHEADER adds RGB bit masks 17372>14 leshort 52 PC bitmap, Adobe Photoshop 17373!:mime image/x-ms-bmp 17374!:apple ????BMPp 17375!:ext bmp 17376>>18 lelong x \b, %d x 17377>>22 lelong x %d x 17378>>28 leshort x %d 17379# BITMAPV3INFOHEADER adds alpha channel bit mask 17380>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask 17381!:mime image/x-ms-bmp 17382!:apple ????BMPp 17383!:ext bmp 17384>>18 lelong x \b, %d x 17385>>22 lelong x %d x 17386>>28 leshort x %d 17387>14 leshort 40 17388# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib 17389# broken for large bitmaps 17390#>>(2.l-4) ulong x PC bitmap, Windows 3.x format 17391>>14 leshort 40 PC bitmap, Windows 3.x format 17392!:mime image/x-ms-bmp 17393!:apple ????BMPp 17394>>>18 lelong x \b, %d x 17395>>>22 lelong x %d 17396# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS 17397>>>18 ulequad =0x0000019000000140 x 17398!:ext bmp/sys 17399>>>18 ulequad !0x0000019000000140 17400# compression method 2~RLE 4-bit/pixel implies also extension rle 17401>>>>30 ulelong 2 x 17402!:ext bmp/rle 17403>>>>30 default x x 17404!:ext bmp 17405# number of bits per pixel (color depth); found 1 2 4 8 16 24 32 17406>>>28 leshort x %d 17407# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0 17408#>>>6 uleshort >0 \b, hotspot %ux 17409#>>>>8 uleshort x \b%u 17410# number of color planes (must be 1), except badplanes.bmp for testing 17411#>>>26 uleshort >1 \b, %u color planes 17412# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks 17413#>>>30 ulelong 3 \b, Huffman 1D compression 17414>>>30 ulelong >0 \b, %u compression 17415# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 17416>>>34 ulelong >0 \b, image size %u 17417# horizontal and vertical resolution of the image (pixel per metre, signed integer) 17418>>>38 lelong >0 \b, resolution %d x 17419>>>>42 lelong x %d px/m 17420# number of colors in palette 16 256, or 0 to default to 2**n 17421#>>>46 ulelong >0 \b, %u colors 17422# number of important colors used, or 0 when every color is important 17423>>>50 ulelong >0 \b, %u important colors 17424# cbSize; often size of file 17425>>>2 ulelong x \b, cbSize %u 17426#>>>2 ulelong x \b, cbSize 0x%x 17427# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h 17428>>>10 ulelong x \b, bits offset %u 17429#>>>10 ulelong x \b, bits offset 0x%x 17430#>>>(10.l) ubequad !0 \b, bits 0x%16.16llxd 17431>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 17432!:mime image/x-ms-bmp 17433>>18 lelong x \b, %d x 17434>>22 lelong x %d x 17435>>28 leshort x %d 17436>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 17437!:mime image/x-ms-bmp 17438>>18 lelong x \b, %d x 17439>>22 lelong x %d x 17440>>28 leshort x %d 17441>14 leshort 128 PC bitmap, Windows NT/2000 format 17442!:mime image/x-ms-bmp 17443>>18 lelong x \b, %d x 17444>>22 lelong x %d x 17445>>28 leshort x %d 17446# Update: Joerg Jenderek 17447# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon 17448# Reference: http://www.fileformat.info 17449# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm 17450# Note: verified by command like `deark -l -d3 OS2MEMU.ICO` 174510 string IC 17452# skip Lotus smart icon *.smi by looking for valid hotspot coordinates 17453>6 ulelong&0xFF00FF00 =0 OS/2 icon 17454# jump 4 bytes before end of header/file and test for accessibility 17455#>>(2.l-4) ubelong x End of header is OK! 17456!:mime image/x-os2-ico 17457!:ext ico 17458# cbSize; size of header or file in bytes like 1ah 120h 420h 17459>>2 ulelong x \b, cbSize %u 17460# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32 17461>>6 uleshort x \b, hotspot %ux 17462>>8 uleshort x \b%u 17463# offBits; offset in bytes to the beginning of the bit-map pel data like 20h 17464>>10 ulelong x \b, bits offset %u 17465#>>(10.l) ubequad x \b, bits 0x%16.16llx 17466#0 string PI PC pointer image data 17467#0 string CI PC color icon data 174680 string CI 17469# test also for valid dib header sizes 12 or 64 17470>14 ulelong <65 OS/2 17471# test also for valid hotspot coordinates 17472#>>6 ulelong&0xFE00FE00 =0 OS/2 17473!:mime image/x-os2-ico 17474!:ext ico 17475>>14 ulelong 12 1.x color icon 17476# image width and height fields are unsigned integers for OS/2 17477>>>18 uleshort x %u x 17478# stored height = 2 * real height 17479>>>20 uleshort/2 x %u 17480# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 17481>>>24 uleshort >1 x %u 17482# color planes; must be 1 17483#>>>22 uleshort >1 \b, %u color planes 17484>>14 ulelong 64 2.x color icon 17485# image width and height 17486>>>18 ulelong x %u x 17487# stored height = 2 * real height 17488>>>22 ulelong/2 x %u 17489# number of bits per pixel (color depth). only 1 found 17490>>>28 uleshort >1 x %u 17491#>>>26 uleshort >1 \b, %u color planes 17492# compression method: 0~no 3~Huffman 1D 17493>>>30 ulelong 3 \b, Huffman 1D compression 17494#>>>30 ulelong >0 \b, %u compression 17495# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64 17496>>6 uleshort x \b, hotspot %ux 17497>>8 uleshort x \b%u 17498# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh 17499>>2 ulelong x \b, cbSize %u 17500#>>2 ulelong x \b, cbSize %x 17501# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h 17502>>10 ulelong x \b, bits offset %u 17503#>>10 ulelong x \b, bits offset 0x%x 17504#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17505# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 17506#>>14 ulelong x \b, dib header size %u 17507#0 string CP PC color pointer image data 17508# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer 17509# Reference: http://www.fileformat.info/format/os2bmp/egff.htm 175100 string CP 17511# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset 17512>10 ulelong >0 17513# skip CPU-Z Report by checking for valid dib header sizes 12 or 64 17514>>14 ulelong =12 17515>>>0 use os2-ptr 17516>>14 ulelong =64 17517>>>0 use os2-ptr 17518# display information of OS/2 pointer bitmaps 175190 name os2-ptr 17520>14 ulelong x OS/2 17521# http://extension.nirsoft.net/PTR 17522!:mime image/x-ibm-pointer 17523!:ext ptr 17524>>14 ulelong 12 1.x color pointer 17525# image width and height fields are unsigned integers for OS/2 17526>>>18 uleshort x %u x 17527# stored height = 2 * real height 17528>>>20 uleshort/2 x %u 17529# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 17530>>>24 uleshort >1 x %u 17531# color planes; must be 1 17532#>>>22 uleshort >1 \b, %u color planes 17533>>14 ulelong 64 2.x color pointer 17534# image width and height 17535>>>18 ulelong x %u x 17536# stored height = 2 * real height 17537>>>22 ulelong/2 x %u 17538# number of bits per pixel (color depth). only 1 found 17539>>>28 uleshort >1 x %u 17540#>>>26 uleshort >1 \b, %u color planes 17541# compression method: 0~no 3~Huffman 1D 17542>>>30 ulelong 3 \b, Huffman 1D compression 17543#>>>30 ulelong >0 \b, %u compression 17544# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31 17545>>6 uleshort x \b, hotspot %ux 17546>>8 uleshort x \b%u 17547# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 17548>>2 ulelong x \b, cbSize %u 17549#>>2 ulelong x \b, cbSize %x 17550# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h 17551>>10 ulelong x \b, bits offset %u 17552#>>10 ulelong x \b, bits offset 0x%x 17553#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17554# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 17555#>>14 ulelong x \b, dib header size %u 17556# Conflicts with other entries [BABYL] 17557# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array 17558# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM" 17559#0 string BA PC bitmap array data 175600 string BA 17561# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size 17562>2 ulelong <0x004c5942 OS/2 graphic array 17563!:mime image/x-os2-graphics 17564#!:apple ????BMPf 17565# cbSize; size of header like 28h 5Ch 17566>>2 ulelong x \b, cbSize %u 17567#>>2 ulelong x \b, cbSize 0x%x 17568# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h 17569>>6 ulelong >0 \b, data offset %u 17570#>>6 ulelong >0 \b, data offset 0x%x 17571#>>(6.l) ubequad !0 \b, data 0x%16.16llx 17572# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768 17573>>10 uleshort >0 \b, display %u 17574>>>12 uleshort >0 x %u 17575# usType of first array element 17576#>>14 string x \b, usType %2.2s 17577# 1 space char after "1st" 17578# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342 17579>>14 string BM \b; 1st 17580!:ext bmp/bga 17581>>14 string CI \b; 1st 17582!:ext ico 17583>>14 string CP \b; 1st 17584!:ext ico 17585>>14 string IC \b; 1st 17586!:ext ico 17587# no white-black pointer found 17588#>>14 string PT \b; 1st 17589#!:ext 17590>>14 indirect x 17591 17592# XPM icons (Greg Roelofs, newt@uchicago.edu) 175930 search/1 /*\ XPM\ */ X pixmap image text 17594!:mime image/x-xpmi 17595 17596# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 175970 leshort 0xcc52 RLE image data, 17598>6 leshort x %d x 17599>8 leshort x %d 17600>2 leshort >0 \b, lower left corner: %d 17601>4 leshort >0 \b, lower right corner: %d 17602>10 byte&0x1 =0x1 \b, clear first 17603>10 byte&0x2 =0x2 \b, no background 17604>10 byte&0x4 =0x4 \b, alpha channel 17605>10 byte&0x8 =0x8 \b, comment 17606>11 byte >0 \b, %d color channels 17607>12 byte >0 \b, %d bits per pixel 17608>13 byte >0 \b, %d color map channels 17609 17610# image file format (Robert Potter, potter@cs.rochester.edu) 176110 string Imagefile\ version- iff image data 17612# this adds the whole header (inc. version number), informative but longish 17613>10 string >\0 %s 17614 17615# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 176160 belong 0x59a66a95 Sun raster image data 17617>4 belong >0 \b, %d x 17618>8 belong >0 %d, 17619>12 belong >0 %d-bit, 17620#>16 belong >0 %d bytes long, 17621>20 belong 0 old format, 17622#>20 belong 1 standard, 17623>20 belong 2 compressed, 17624>20 belong 3 RGB, 17625>20 belong 4 TIFF, 17626>20 belong 5 IFF, 17627>20 belong 0xffff reserved for testing, 17628>24 belong 0 no colormap 17629>24 belong 1 RGB colormap 17630>24 belong 2 raw colormap 17631#>28 belong >0 colormap is %d bytes long 17632 17633# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 17634# 17635# See 17636# http://reality.sgi.com/grafica/sgiimage.html 17637# 176380 beshort 474 SGI image data 17639#>2 byte 0 \b, verbatim 17640>2 byte 1 \b, RLE 17641#>3 byte 1 \b, normal precision 17642>3 byte 2 \b, high precision 17643>4 beshort x \b, %d-D 17644>6 beshort x \b, %d x 17645>8 beshort x %d 17646>10 beshort x \b, %d channel 17647>10 beshort !1 \bs 17648>80 string >0 \b, "%s" 17649 176500 string IT01 FIT image data 17651>4 belong x \b, %d x 17652>8 belong x %d x 17653>12 belong x %d 17654# 176550 string IT02 FIT image data 17656>4 belong x \b, %d x 17657>8 belong x %d x 17658>12 belong x %d 17659# 176602048 string PCD_IPI Kodak Photo CD image pack file 17661>0xe02 byte&0x03 0x00 , landscape mode 17662>0xe02 byte&0x03 0x01 , portrait mode 17663>0xe02 byte&0x03 0x02 , landscape mode 17664>0xe02 byte&0x03 0x03 , portrait mode 176650 string PCD_OPA Kodak Photo CD overview pack file 17666 17667# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 17668# FITS is the Flexible Image Transport System, the de facto standard for 17669# data and image transfer, storage, etc., for the astronomical community. 17670# (FITS floating point formats are big-endian.) 176710 string SIMPLE\ \ = FITS image data 17672!:mime image/fits 17673!:ext fits/fts 17674>109 string 8 \b, 8-bit, character or unsigned binary integer 17675>108 string 16 \b, 16-bit, two's complement binary integer 17676>107 string \ 32 \b, 32-bit, two's complement binary integer 17677>107 string -32 \b, 32-bit, floating point, single precision 17678>107 string -64 \b, 64-bit, floating point, double precision 17679 17680# other images 176810 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 17682 17683# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 17684# stuff. 17685# 176860 beshort 0x1010 PEX Binary Archive 17687 17688# DICOM medical imaging data 17689# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 17690# Note: "dcm" is the official file name extension 17691# XnView mention also "dc3" and "acr" as file name extension 17692128 string DICM DICOM medical imaging data 17693!:mime application/dicom 17694!:ext dcm/dicom/dic 17695 17696# XWD - X Window Dump file. 17697# As described in /usr/X11R6/include/X11/XWDFile.h 17698# used by the xwd program. 17699# Bradford Castalia, idaeim, 1/01 17700# updated by Adam Buchbinder, 2/09 17701# The following assumes version 7 of the format; the first long is the length 17702# of the header, which is at least 25 4-byte longs, and the one at offset 8 17703# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 17704# which is a maximum of 32. 177050 belong >100 17706>8 belong <3 17707>>12 belong <33 17708>>>4 belong 7 XWD X Window Dump image data 17709!:mime image/x-xwindowdump 17710>>>>100 string >\0 \b, "%s" 17711>>>>16 belong x \b, %dx 17712>>>>20 belong x \b%dx 17713>>>>12 belong x \b%d 17714 17715# PDS - Planetary Data System 17716# These files use Parameter Value Language in the header section. 17717# Unfortunately, there is no certain magic, but the following 17718# strings have been found to be most likely. 177190 string NJPL1I00 PDS (JPL) image data 177202 string NJPL1I PDS (JPL) image data 177210 string CCSD3ZF PDS (CCSD) image data 177222 string CCSD3Z PDS (CCSD) image data 177230 string PDS_ PDS image data 177240 string LBLSIZE= PDS (VICAR) image data 17725 17726# pM8x: ATARI STAD compressed bitmap format 17727# 17728# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 17729# p M 8 5/6 xx yy zz data... 17730# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 17731# bytes either run horizontally (pM85) or vertically (pM86). yy is the 17732# most frequent byte, xx and zz are runlength escape codes, where xx is 17733# used for runs of yy. 17734# 177350 string pM85 Atari ST STAD bitmap image data (hor) 17736>5 byte 0x00 (white background) 17737>5 byte 0xFF (black background) 177380 string pM86 Atari ST STAD bitmap image data (vert) 17739>5 byte 0x00 (white background) 17740>5 byte 0xFF (black background) 17741 17742# From: Alex Myczko <alex@aiei.ch> 17743# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 177440 leshort 0x0296 Atari ATR image 17745 17746# XXX: 17747# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 17748# magic. 17749# SGI RICE image file <mpruett@sgi.com> 17750#0 beshort 0x5249 RICE image 17751#>2 beshort x v%d 17752#>4 beshort x (%d x 17753#>6 beshort x %d) 17754#>8 beshort 0 8 bit 17755#>8 beshort 1 10 bit 17756#>8 beshort 2 12 bit 17757#>8 beshort 3 13 bit 17758#>10 beshort 0 4:2:2 17759#>10 beshort 1 4:2:2:4 17760#>10 beshort 2 4:4:4 17761#>10 beshort 3 4:4:4:4 17762#>12 beshort 1 RGB 17763#>12 beshort 2 CCIR601 17764#>12 beshort 3 RP175 17765#>12 beshort 4 YUV 17766 17767# PCX image files 17768# From: Dan Fandrich <dan@coneharvesters.com> 17769# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX 17770# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 17771# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 17772# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 177730 ubelong&0xffF8fe00 0x0a000000 17774# for PCX bit depth > 0 17775>3 ubyte >0 17776# test for valid versions 17777>>1 ubyte <6 17778>>>1 ubyte !1 PCX 17779!:mime image/x-pcx 17780#!:mime image/pcx 17781>>>>1 ubyte 0 ver. 2.5 image data 17782>>>>1 ubyte 2 ver. 2.8 image data, with palette 17783>>>>1 ubyte 3 ver. 2.8 image data, without palette 17784>>>>1 ubyte 4 for Windows image data 17785>>>>1 ubyte 5 ver. 3.0 image data 17786>>>>4 uleshort x bounding box [%d, 17787>>>>6 uleshort x %d] - 17788>>>>8 uleshort x [%d, 17789>>>>10 uleshort x %d], 17790>>>>65 ubyte >1 %d planes each of 17791>>>>3 ubyte x %d-bit 17792>>>>68 byte 1 colour, 17793>>>>68 byte 2 grayscale, 17794# this should not happen 17795>>>>68 default x image, 17796>>>>12 leshort >0 %d x 17797>>>>>14 uleshort x %d dpi, 17798>>>>2 byte 0 uncompressed 17799>>>>2 byte 1 RLE compressed 17800 17801# Adobe Photoshop 17802# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 178030 string 8BPS Adobe Photoshop Image 17804!:mime image/vnd.adobe.photoshop 17805!:ext psd 17806>4 beshort 2 (PSB) 17807>18 belong x \b, %d x 17808>14 belong x %d, 17809>24 beshort 0 bitmap 17810>24 beshort 1 grayscale 17811>>12 beshort 2 with alpha 17812>24 beshort 2 indexed 17813>24 beshort 3 RGB 17814>>12 beshort 4 \bA 17815>24 beshort 4 CMYK 17816>>12 beshort 5 \bA 17817>24 beshort 7 multichannel 17818>24 beshort 8 duotone 17819>24 beshort 9 lab 17820>12 beshort > 1 17821>>12 beshort x \b, %dx 17822>12 beshort 1 \b, 17823>22 beshort x %d-bit channel 17824>12 beshort > 1 \bs 17825 17826# XV thumbnail indicator (ThMO) 17827# URL: https://en.wikipedia.org/wiki/Xv_(software) 17828# Reference: http://fileformats.archiveteam.org/wiki/XV_thumbnail 17829# Update: Joerg Jenderek 178300 string P7\ 332 XV thumbnail image data 17831#0 string P7\ 332 XV "thumbnail file" (icon) data 17832!:mime image/x-xv-thumbnail 17833# thumbnail .xvpic/foo.bar for graphic foo.bar 17834!:ext p7/gif/tif/xpm/jpg 17835 17836# NITF is defined by United States MIL-STD-2500A 178370 string NITF National Imagery Transmission Format 17838>25 string >\0 dated %.14s 17839 17840# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 17841# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 17842# Update: Joerg Jenderek 17843# See http://fileformats.archiveteam.org/wiki/GEM_Raster 17844# For variations, also see: 17845# https://www.seasip.info/Gem/ff_img.html (Ventura) 17846# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 17847# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 17848# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 178490 beshort 0x0001 17850# header_size 17851>2 beshort 0x0008 17852>>0 use gem_info 17853>2 beshort 0x0009 17854>>0 use gem_info 17855# no example for NOSIG 17856>2 beshort 24 17857>>0 use gem_info 17858# no example for HYPERPAINT 17859>2 beshort 25 17860>>0 use gem_info 1786116 string XIMG\0 17862>0 use gem_info 17863# no example 1786416 string STTT\0\x10 17865>0 use gem_info 17866# no example or description 1786716 string TIMG\0 17868>0 use gem_info 17869 178700 name gem_info 17871# version is 2 for some XIMG and 1 for all others 17872>0 beshort <0x0003 GEM 17873# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 17874!:mime image/x-gem 17875# header_size 24 25 27 59 779 words for colored bitmaps 17876>>2 beshort >9 17877>>>16 string STTT\0\x10 STTT 17878>>>16 string TIMG\0 TIMG 17879# HYPERPAINT or NOSIG variant 17880>>>16 string \0\x80 17881>>>>2 beshort =24 NOSIG 17882>>>>2 beshort !24 HYPERPAINT 17883# NOSIG or XIMG variant 17884>>>16 default x 17885>>>>16 string !XIMG\0 NOSIG 17886>>16 string =XIMG\0 XIMG Image data 17887!:ext img/ximg 17888# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 17889>>16 string !XIMG\0 Image data 17890!:ext img 17891# header_size is 9 for Ventura files and 8 for other GEM Paint files 17892>>2 beshort 9 (Ventura) 17893#>>2 beshort 8 (Paint) 17894>>12 beshort x %d x 17895>>14 beshort x %d, 17896# 1 4 8 17897>>4 beshort x %d planes, 17898# in tenths of a millimetre 17899>>8 beshort x %d x 17900>>10 beshort x %d pixelsize 17901# pattern_size 1-8. 2 for GEM Paint 17902>>6 beshort !2 \b, pattern size %d 17903 17904# GEM Metafile (Wolfram Kleff) 179050 lelong 0x0018FFFF GEM Metafile data 17906>4 leshort x version %d 17907 17908# 17909# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 17910# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 17911# 179120 string \0\nSMJPEG SMJPEG 17913>8 belong x %d.x data 17914# According to the specification you could find any number of _TXT 17915# headers here, but I can't think of any way of handling that. None of 17916# the SMJPEG files I tried it on used this feature. Even if such a 17917# file is encountered the output should still be reasonable. 17918>16 string _SND \b, 17919>>24 beshort >0 %d Hz 17920>>26 byte 8 8-bit 17921>>26 byte 16 16-bit 17922>>28 string NONE uncompressed 17923# >>28 string APCM ADPCM compressed 17924>>27 byte 1 mono 17925>>28 byte 2 stereo 17926# Help! Isn't there any way to avoid writing this part twice? 17927>>32 string _VID \b, 17928# >>>48 string JFIF JPEG 17929>>>40 belong >0 %d frames 17930>>>44 beshort >0 (%d x 17931>>>46 beshort >0 %d) 17932>16 string _VID \b, 17933# >>32 string JFIF JPEG 17934>>24 belong >0 %d frames 17935>>28 beshort >0 (%d x 17936>>30 beshort >0 %d) 17937 179380 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 17939 17940# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 179410 string KiSS KISS/GS 17942>4 byte 16 color 17943>>5 byte x %d bit 17944>>8 leshort x %d colors 17945>>10 leshort x %d groups 17946>4 byte 32 cell 17947>>5 byte x %d bit 17948>>8 leshort x %d x 17949>>10 leshort x %d 17950>>12 leshort x +%d 17951>>14 leshort x +%d 17952 17953# Webshots (www.webshots.com), by John Harrison 179540 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 17955 17956# Hercules DASD image files 17957# From Jan Jaeger <jj@septa.nl> 179580 string CKD_P370 Hercules CKD DASD image file 17959>8 long x \b, %d heads per cylinder 17960>12 long x \b, track size %d bytes 17961>16 byte x \b, device type 33%2.2X 17962 179630 string CKD_C370 Hercules compressed CKD DASD image file 17964>8 long x \b, %d heads per cylinder 17965>12 long x \b, track size %d bytes 17966>16 byte x \b, device type 33%2.2X 17967 179680 string CKD_S370 Hercules CKD DASD shadow file 17969>8 long x \b, %d heads per cylinder 17970>12 long x \b, track size %d bytes 17971>16 byte x \b, device type 33%2.2X 17972 17973# Squeak images and programs - etoffi@softhome.net 179740 string \146\031\0\0 Squeak image data 179750 search/1 'From\040Squeak Squeak program text 17976 17977# partimage: file(1) magic for PartImage files (experimental, incomplete) 17978# Author: Hans-Joachim Baader <hjb@pro-linux.de> 179790 string PaRtImAgE-VoLuMe PartImage 17980>0x0020 string 0.6.1 file version %s 17981>>0x0060 lelong >-1 volume %d 17982#>>0x0064 8 byte identifier 17983#>>0x007c reserved 17984>>0x0200 string >\0 type %s 17985>>0x1400 string >\0 device %s, 17986>>0x1600 string >\0 original filename %s, 17987# Some fields omitted 17988>>0x2744 lelong 0 not compressed 17989>>0x2744 lelong 1 gzip compressed 17990>>0x2744 lelong 2 bzip2 compressed 17991>>0x2744 lelong >2 compressed with unknown algorithm 17992>0x0020 string >0.6.1 file version %s 17993>0x0020 string <0.6.1 file version %s 17994 17995# DCX is multi-page PCX, using a simple header of up to 1024 17996# offsets for the respective PCX components. 17997# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 179980 lelong 987654321 DCX multi-page PCX image data 17999 18000# Simon Walton <simonw@matteworld.com> 18001# Kodak Cineon format for scanned negatives 18002# http://www.kodak.com/US/en/motion/support/dlad/ 180030 lelong 0xd75f2a80 Cineon image data 18004>200 belong >0 \b, %d x 18005>204 belong >0 %d 18006 18007 18008# Bio-Rad .PIC is an image format used by microscope control systems 18009# and related image processing software used by biologists. 18010# From: Vebjorn Ljosa <vebjorn@ljosa.com> 18011# BOOL values are two-byte integers; use them to rule out false positives. 18012# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 18013# Samples: https://www.loci.wisc.edu/software/sample-data 1801414 leshort <2 18015>62 leshort <2 18016>>54 leshort 12345 Bio-Rad .PIC Image File 18017>>>0 leshort >0 %d x 18018>>>2 leshort >0 %d, 18019>>>4 leshort =1 1 image in file 18020>>>4 leshort >1 %d images in file 18021 18022# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 18023# The description of *.mrw format can be found at 18024# http://www.dalibor.cz/minolta/raw_file_format.htm 180250 string \000MRM Minolta Dimage camera raw image data 18026 18027# Summary: DjVu image / document 18028# Extension: .djvu 18029# Reference: http://djvu.org/docs/DjVu3Spec.djvu 18030# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 18031# Modified by (1): Abel Cheung <abelcheung@gmail.com> 180320 string AT&TFORM 18033>12 string DJVM DjVu multiple page document 18034!:mime image/vnd.djvu 18035>12 string DJVU DjVu image or single page document 18036!:mime image/vnd.djvu 18037>12 string DJVI DjVu shared document 18038!:mime image/vnd.djvu 18039>12 string THUM DjVu page thumbnails 18040!:mime image/vnd.djvu 18041 18042# Originally by Marc Espie 18043# Modified by Robert Minsk <robertminsk at yahoo.com> 18044# https://www.openexr.com/openexrfilelayout.pdf 180450 lelong 20000630 OpenEXR image data, 18046!:mime image/x-exr 18047>4 lelong&0x000000ff x version %d, 18048>4 lelong ^0x00000200 storage: scanline 18049>4 lelong &0x00000200 storage: tiled 18050>8 search/0x1000 compression\0 \b, compression: 18051>>&16 byte 0 none 18052>>&16 byte 1 rle 18053>>&16 byte 2 zips 18054>>&16 byte 3 zip 18055>>&16 byte 4 piz 18056>>&16 byte 5 pxr24 18057>>&16 byte 6 b44 18058>>&16 byte 7 b44a 18059>>&16 byte 8 dwaa 18060>>&16 byte 9 dwab 18061>>&16 byte >9 unknown 18062>8 search/0x1000 dataWindow\0 \b, dataWindow: 18063>>&10 lelong x (%d 18064>>&14 lelong x %d)- 18065>>&18 lelong x \b(%d 18066>>&22 lelong x %d) 18067>8 search/0x1000 displayWindow\0 \b, displayWindow: 18068>>&10 lelong x (%d 18069>>&14 lelong x %d)- 18070>>&18 lelong x \b(%d 18071>>&22 lelong x %d) 18072>8 search/0x1000 lineOrder\0 \b, lineOrder: 18073>>&14 byte 0 increasing y 18074>>&14 byte 1 decreasing y 18075>>&14 byte 2 random y 18076>>&14 byte >2 unknown 18077 18078# SMPTE Digital Picture Exchange Format, SMPTE DPX 18079# 18080# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 18081# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 18082# Robert Minsk <robertminsk at yahoo.com> 18083# Modified by Harry Mallon <hjmallon at gmail.com> 180840 string SDPX DPX image data, big-endian, 18085!:mime image/x-dpx 18086>0 use dpx_info 180870 string XPDS DPX image data, little-endian, 18088!:mime image/x-dpx 18089>0 use \^dpx_info 18090 180910 name dpx_info 18092>768 beshort <4 18093>>772 belong x %dx 18094>>776 belong x \b%d, 18095>768 beshort >3 18096>>776 belong x %dx 18097>>772 belong x \b%d, 18098>768 beshort 0 left to right/top to bottom 18099>768 beshort 1 right to left/top to bottom 18100>768 beshort 2 left to right/bottom to top 18101>768 beshort 3 right to left/bottom to top 18102>768 beshort 4 top to bottom/left to right 18103>768 beshort 5 top to bottom/right to left 18104>768 beshort 6 bottom to top/left to right 18105>768 beshort 7 bottom to top/right to left 18106 18107# From: Tom Hilinski <tom.hilinski@comcast.net> 18108# https://www.unidata.ucar.edu/packages/netcdf/ 181090 string CDF\001 NetCDF Data Format data 18110# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications 181110 string CDF\002 NetCDF Data Format data (64-bit offset) 18112 18113#----------------------------------------------------------------------- 18114# Hierarchical Data Format, used to facilitate scientific data exchange 18115# specifications at http://hdf.ncsa.uiuc.edu/ 181160 belong 0x0e031301 Hierarchical Data Format (version 4) data 18117!:mime application/x-hdf 181180 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 18119!:mime application/x-hdf 18120512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 18121!:mime application/x-hdf 181221024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 18123!:mime application/x-hdf 181242048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 18125!:mime application/x-hdf 181264096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 18127!:mime application/x-hdf 18128 18129 18130# From: Tobias Burnus <burnus@net-b.de> 18131# Xara (for a while: Corel Xara) is a graphic package, see 18132# http://www.xara.com/ for Windows and as GPL application for Linux 181330 string XARA\243\243 Xara graphics file 18134 18135# From: Joerg Jenderek 18136# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 18137# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml 18138# Note: called "Corel Binary Material Format" by TrID and 18139# "Corel Flow" by XnView 181400 string @CorelBMF\n\rCorel\040Corporation Corel GALLERY Clipart 18141!:mime image/x-corel-bmf 18142!:ext bmf 18143 18144# https://www.cartesianinc.com/Tech/ 18145# Reference: http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression 181460 string CPC\262 Cartesian Perceptual Compression image 18147!:mime image/x-cpi 18148!:ext cpi/cpc 18149 18150# From Albert Cahalan <acahalan@gmail.com> 18151# puredigital used it for the CVS disposable camcorder 18152#8 lelong 4 ZBM bitmap image data 18153#>4 leshort x %u x 18154#>6 leshort x %u 18155 18156# From Albert Cahalan <acahalan@gmail.com> 18157# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 181580 string C565 OLPC firmware icon image data 18159>4 leshort x %u x 18160>6 leshort x %u 18161 18162# Applied Images - Image files from Cytovision 18163# Gustavo Junior Alves <gjalves@gjalves.com.br> 181640 string \xce\xda\xde\xfa Cytovision Metaphases file 181650 string \xed\xad\xef\xac Cytovision Karyotype file 181660 string \x0b\x00\x03\x00 Cytovision FISH Probe file 181670 string \xed\xfe\xda\xbe Cytovision FLEX file 181680 string \xed\xab\xed\xfe Cytovision FLEX file 181690 string \xad\xfd\xea\xad Cytovision RATS file 18170 18171# Wavelet Scalar Quantization format used in gray-scale fingerprint images 18172# From Tano M Fotang <mfotang@quanteq.com> 181730 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 18174 18175# Type: PCO B16 image files 18176# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 18177# From: Florian Philipp <florian.philipp@binarywings.net> 18178# Extension: .b16 18179# Description: Pixel image format produced by PCO Camware, typically used 18180# together with PCO cameras. 18181# Note: Different versions exist for e.g. 8 bit and 16 bit images. 18182# Documentation is incomplete. 181830 string/b PCO- PCO B16 image data 18184>12 lelong x \b, %dx 18185>16 lelong x \b%d 18186>20 lelong 0 \b, short header 18187>20 lelong -1 \b, extended header 18188>>24 lelong 0 \b, grayscale 18189>>>36 lelong 0 linear LUT 18190>>>36 lelong 1 logarithmic LUT 18191>>>28 lelong x [%d 18192>>>32 lelong x \b,%d] 18193>>24 lelong 1 \b, color 18194>>>64 lelong 0 linear LUT 18195>>>64 lelong 1 logarithmic LUT 18196>>>40 lelong x r[%d 18197>>>44 lelong x \b,%d] 18198>>>48 lelong x g[%d 18199>>>52 lelong x \b,%d] 18200>>>56 lelong x b[%d 18201>>>60 lelong x \b,%d] 18202 18203# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 18204# From: Markus Heidelberg <markus.heidelberg at web.de> 182050 string/t [BitmapInfo2] Polar Monitor Bitmap text 18206!:mime image/x-polar-monitor-bitmap 18207 18208# From: Rick Richardson <rickrich@gmail.com> 18209# updated by: Joerg Jenderek 18210# URL: http://techmods.net/nuvi/ 182110 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 18212# extension is also used for 18213# Sony SRF raw image (image/x-sony-srf) 18214# SRF map 18215# Terragen Surface Map (https://www.planetside.co.uk/terragen) 18216# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) 18217!:ext srf 18218#!:mime image/x-garmin-srf 18219# version 1.00,2.00,2.10,2.40,2.50 18220>0x2f string >0 \b, version %4.4s 18221# width (2880,2881,3240) 18222>0x55 uleshort >0 \b, %dx 18223# height (80,90) 18224>>0x53 uleshort x \b%d 18225 18226# Type: Ulead Photo Explorer5 (.pe5) 18227# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 18228# From: Simon Horman <horms@debian.org> 182290 string IIO2H Ulead Photo Explorer5 18230 18231# Type: X11 cursor 18232# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 18233# From: Mathias Brodala <info@noctus.net> 182340 string Xcur X11 cursor 18235 18236# Type: Olympus ORF raw images. 18237# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF 18238# From: Adam Buchbinder <adam.buchbinder@gmail.com> 182390 string MMOR Olympus ORF raw image data, big-endian 18240!:mime image/x-olympus-orf 182410 string IIRO Olympus ORF raw image data, little-endian 18242!:mime image/x-olympus-orf 182430 string IIRS Olympus ORF raw image data, little-endian 18244!:mime image/x-olympus-orf 18245 18246# Type: files used in modern AVCHD camcoders to store clip information 18247# Extension: .cpi 18248# From: Alexander Danilov <alexander.a.danilov@gmail.com> 182490 string HDMV0100 AVCHD Clip Information 18250 18251# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18252# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 18253# Radiance HDR; usually has .pic or .hdr extension. 182540 string #?RADIANCE\n Radiance HDR image data 18255#!mime image/vnd.radiance 18256 18257# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18258# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 18259# Used by the pfstools packages. The regex matches for the image size could 18260# probably use some work. The MIME type is made up; if there's one in 18261# actual common use, it should replace the one below. 182620 string PFS1\x0a PFS HDR image data 18263#!mime image/x-pfs 18264>1 regex [0-9]*\ \b, %s 18265>>1 regex \ [0-9]{4} \bx%s 18266 18267# Type: Foveon X3F 18268# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf 18269# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18270# Note that the MIME type isn't defined anywhere that I can find; if 18271# there's a canonical type for this format, it should replace this one. 182720 string FOVb Foveon X3F raw image data 18273!:mime image/x-x3f 18274>6 leshort x \b, version %d. 18275>4 leshort x \b%d 18276>28 lelong x \b, %dx 18277>32 lelong x \b%d 18278 18279# Paint.NET file 18280# From Adam Buchbinder <adam.buchbinder@gmail.com> 182810 string PDN3 Paint.NET image data 18282!:mime image/x-paintnet 18283 18284# Not really an image. 18285# From: "Tano M. Fotang" <mfotang@quanteq.com> 182860 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 18287 18288# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 18289# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1829090 bequad 0x574D50484F544F00 JPEG-XR Image 18291>98 byte&0x08 =0x08 \b, hard tiling 18292>99 byte&0x80 =0x80 \b, tiling present 18293>99 byte&0x40 =0x40 \b, codestream present 18294>99 byte&0x38 x \b, spatial xform= 18295>99 byte&0x38 0x00 \bTL 18296>99 byte&0x38 0x08 \bBL 18297>99 byte&0x38 0x10 \bTR 18298>99 byte&0x38 0x18 \bBR 18299>99 byte&0x38 0x20 \bBT 18300>99 byte&0x38 0x28 \bRB 18301>99 byte&0x38 0x30 \bLT 18302>99 byte&0x38 0x38 \bLB 18303>100 byte&0x80 =0x80 \b, short header 18304>>102 beshort+1 x \b, %d 18305>>104 beshort+1 x \bx%d 18306>100 byte&0x80 =0x00 \b, long header 18307>>102 belong+1 x \b, %x 18308>>106 belong+1 x \bx%x 18309>101 beshort&0xf x \b, bitdepth= 18310>>101 beshort&0xf 0x0 \b1-WHITE=1 18311>>101 beshort&0xf 0x1 \b8 18312>>101 beshort&0xf 0x2 \b16 18313>>101 beshort&0xf 0x3 \b16-SIGNED 18314>>101 beshort&0xf 0x4 \b16-FLOAT 18315>>101 beshort&0xf 0x5 \b(reserved 5) 18316>>101 beshort&0xf 0x6 \b32-SIGNED 18317>>101 beshort&0xf 0x7 \b32-FLOAT 18318>>101 beshort&0xf 0x8 \b5 18319>>101 beshort&0xf 0x9 \b10 18320>>101 beshort&0xf 0xa \b5-6-5 18321>>101 beshort&0xf 0xb \b(reserved %d) 18322>>101 beshort&0xf 0xc \b(reserved %d) 18323>>101 beshort&0xf 0xd \b(reserved %d) 18324>>101 beshort&0xf 0xe \b(reserved %d) 18325>>101 beshort&0xf 0xf \b1-BLACK=1 18326>101 beshort&0xf0 x \b, colorfmt= 18327>>101 beshort&0xf0 0x00 \bYONLY 18328>>101 beshort&0xf0 0x10 \bYUV240 18329>>101 beshort&0xf0 0x20 \bYWV422 18330>>101 beshort&0xf0 0x30 \bYWV444 18331>>101 beshort&0xf0 0x40 \bCMYK 18332>>101 beshort&0xf0 0x50 \bCMYKDIRECT 18333>>101 beshort&0xf0 0x60 \bNCOMPONENT 18334>>101 beshort&0xf0 0x70 \bRGB 18335>>101 beshort&0xf0 0x80 \bRGBE 18336>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 18337 18338# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 18339# 18340# BPG (Better Portable Graphics) format 18341# https://bellard.org/bpg/ 18342# http://fileformats.archiveteam.org/wiki/BPG 18343# 183440 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 18345!:mime image/bpg 18346 18347# From: Joerg Jenderek 18348# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 183490 string icns Mac OS X icon 18350!:mime image/x-icns 18351!:apple ????icns 18352!:ext icns 18353>4 ubelong >0 18354# file size 18355>>4 ubelong x \b, %d bytes 18356# icon type 18357>>8 string x \b, "%4.4s" type 18358 18359# TIM images 183600 lelong 0x00000010 TIM image, 18361>4 lelong 0x8 4-Bit, 18362>4 lelong 0x9 8-Bit, 18363>4 lelong 0x2 15-Bit, 18364>4 lelong 0x3 24-Bit, 18365>4 lelong &8 18366>>(8.l+12) leshort x Pixel at (%d, 18367>>(8.l+14) leshort x \b%d) 18368>>(8.l+16) leshort x Size=%dx 18369>>(8.l+18) leshort x \b%d, 18370>>4 lelong 0x8 16 CLUT Entries at 18371>>4 lelong 0x9 256 CLUT Entries at 18372>>12 leshort x (%d, 18373>>14 leshort x \b%d) 18374>4 lelong ^8 18375>>12 leshort x Pixel at (%d, 18376>>14 leshort x \b%d) 18377>>16 leshort x Size=%dx 18378>>18 leshort x \b%d 18379 18380# MDEC streams 183810 lelong 0x80010160 MDEC video stream, 18382>16 leshort x %dx 18383>18 leshort x \b%d 18384#>8 lelong x %d frames 18385#>4 leshort x secCount=%d; 18386#>6 leshort x nSectors=%d; 18387#>12 lelong x frameSize=%d; 18388 18389# BS encoded bitstreams 183902 leshort 0x3800 BS image, 18391>6 leshort x Version %d, 18392>4 leshort x Quantization %d, 18393>0 leshort x (Decompresses to %d words) 18394 18395# Type: farbfeld image. 18396# Url: http://tools.suckless.org/farbfeld/ 18397# From: Ian D. Scott <ian@iandouglasscott.com> 18398# 183990 string farbfeld farbfeld image data, 18400>8 ubelong x %dx 18401>12 ubelong x \b%d 18402 18403# Type: Microsoft DirectDraw Surface (common data) 18404# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 18405# From: Morten Hustveit <morten@debian.org> 18406# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 184070 name ms-directdraw-surface 18408>0x10 ulelong x %u x 18409>0x0C ulelong x %u 18410# Color depth. 18411>0x58 ulelong >0 \b, %u-bit color 18412# Determine the pixel format. 18413>0x50 ulelong&0x4 4 18414# FIXME: Handle DX10 and XBOX formats. 18415>>0x54 string x \b, compressed using %.4s 18416>0x50 ulelong&0x2 0x2 \b, alpha only 18417>0x50 ulelong&0x200 0x200 \b, YUV 18418>0x50 ulelong&0x20000 0x20000 \b, luminance 18419# RGB pixel format 18420>0x50 ulelong&0x40 0x40 18421 18422# Determine the RGB format using the color masks. 18423# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 18424 18425>>0x58 ulelong 16 18426 18427# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 18428>>>0x5C ulequad 0x000003E000007C00 18429>>>>0x64 ulequad 0x000000000000001F \b, RGB555 18430>>>0x5C ulequad 0x000003E000001F00 18431>>>>0x64 ulequad 0x000000000000007C \b, BGR555 18432 18433>>>0x5C ulequad 0x000007E00000F800 18434>>>>0x64 ulequad 0x000000000000001F \b, RGB565 18435>>>0x5C ulequad 0x000007E000001F00 18436>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 18437 18438>>>0x5C ulequad 0x000000F000000F00 18439>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 18440>>>0x5C ulequad 0x000000F00000000F 18441>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 18442 18443>>>0x5C ulequad 0x00000F000000F000 18444>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 18445>>>0x5C ulequad 0x00000F00000000F0 18446>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 18447 18448>>>0x5C ulequad 0x000000F000000F00 18449>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 18450>>>0x5C ulequad 0x000000F00000000F 18451>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 18452 18453>>>0x5C ulequad 0x00000F000000F000 18454>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 18455>>>0x5C ulequad 0x00000F00000000F0 18456>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 18457 18458>>>0x5C ulequad 0x000003E000007C00 18459>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 18460>>>0x5C ulequad 0x000003E000001F00 18461>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 18462>>>0x5C ulequad 0x000007C00000F800 18463>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 18464>>>0x5C ulequad 0x000007C00000003E 18465>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 18466 18467>>88 ulelong 24 18468>>>0x5C ulequad 0x0000FF0000FF0000 18469>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 18470>>>0x5C ulequad 0x0000FF00000000FF 18471>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 18472 18473>>88 ulelong 32 18474>>>0x5C ulequad 0x0000FF0000FF0000 18475>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 18476>>>0x5C ulequad 0x0000FF00000000FF 18477>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 18478 18479>>>0x5C ulequad 0x00FF0000FF000000 18480>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 18481>>>0x5C ulequad 0x00FF00000000FF00 18482>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 18483 18484>>>0x5C ulequad 0x0000FF0000FF0000 18485>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 18486>>>0x5C ulequad 0x0000FF00000000FF 18487>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 18488 18489>>>0x5C ulequad 0x00FF0000FF000000 18490>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 18491>>>0x5C ulequad 0x00FF00000000FF00 18492>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 18493 18494# Less common 32-bit color formats. 18495>>>0x5C ulequad 0xFFFF00000000FFFF 18496>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 18497>>>0x5C ulequad 0x0000FFFFFFFF0000 18498>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 18499 18500>>>0x5C ulequad 0x000FFC003FF00000 18501>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 18502>>>0x5C ulequad 0x000FFC00000003FF 18503>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 18504 18505# Type: Microsoft DirectDraw Surface 18506# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 18507# From: Morten Hustveit <morten@debian.org> 18508# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 185090 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 18510>0 use ms-directdraw-surface 18511 18512# Type: Sega PVR image. 18513# From: David Korth <gerbilsoft@gerbilsoft.com> 18514# References: 18515# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 18516# - https://github.com/yazgoo/pvrx2png 18517# - https://github.com/nickworonekin/puyotools 18518 18519# Sega PVR header. 185200 name sega-pvr-image-header 18521>0x0C leshort x %u x 18522>0x0E leshort x %u 18523# Image format. 18524>0x08 byte 0 \b, ARGB1555 18525>0x08 byte 1 \b, RGB565 18526>0x08 byte 2 \b, ARGB4444 18527>0x08 byte 3 \b, YUV442 18528>0x08 byte 4 \b, Bump 18529>0x08 byte 5 \b, 4bpp 18530>0x08 byte 6 \b, 8bpp 18531# Image data type. 18532>0x09 byte 0x01 \b, square twiddled 18533>0x09 byte 0x02 \b, square twiddled & mipmap 18534>0x09 byte 0x03 \b, VQ 18535>0x09 byte 0x04 \b, VQ & mipmap 18536>0x09 byte 0x05 \b, 8-bit CLUT twiddled 18537>0x09 byte 0x06 \b, 4-bit CLUT twiddled 18538>0x09 byte 0x07 \b, 8-bit direct twiddled 18539>0x09 byte 0x08 \b, 4-bit direct twiddled 18540>0x09 byte 0x09 \b, rectangle 18541>0x09 byte 0x0B \b, rectangular stride 18542>0x09 byte 0x0D \b, rectangular twiddled 18543>0x09 byte 0x10 \b, small VQ 18544>0x09 byte 0x11 \b, small VQ & mipmap 18545>0x09 byte 0x12 \b, square twiddled & mipmap 18546 18547# Sega PVR image. 185480 string PVRT 18549>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 18550>>0x20 use ms-directdraw-surface 18551>0x10 belong !0x44445320 Sega PVR image: 18552>>0 use sega-pvr-image-header 18553 18554# Sega PVR image with GBIX. 185550 string GBIX 18556>0x10 string PVRT 18557>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 18558>>>0x20 use ms-directdraw-surface 18559>>0x10 belong !0x44445320 Sega PVR image: 18560>>>0x10 use sega-pvr-image-header 18561>>0x08 lelong x \b, global index = %u 18562 18563# Sega GVR header. 185640 name sega-gvr-image-header 18565>0x0C beshort x %u x 18566>0x0E beshort x %u 18567# Image data format. 18568>0x0B byte 0 \b, I4 18569>0x0B byte 1 \b, I8 18570>0x0B byte 2 \b, IA4 18571>0x0B byte 3 \b, IA8 18572>0x0B byte 4 \b, RGB565 18573>0x0B byte 5 \b, RGB5A3 18574>0x0B byte 6 \b, ARGB8888 18575>0x0B byte 8 \b, CI4 18576>0x0B byte 9 \b, CI8 18577>0x0B byte 14 \b, DXT1 18578 18579# Sega GVR image. 185800 string GVRT Sega GVR image: 18581>0x10 use sega-gvr-image-header 18582 18583# Sega GVR image with GBIX. 185840 string GBIX 18585>0x10 string GVRT Sega GVR image: 18586>>0x10 use sega-gvr-image-header 18587>>0x08 belong x \b, global index = %u 18588 18589# Sega GVR image with GCIX. (Wii) 185900 string GCIX 18591>0x10 string GVRT Sega GVR image: 18592>>0x10 use sega-gvr-image-header 18593>>0x08 belong x \b, global index = %u 18594 18595# Light Field Picture 18596# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 18597# Typical file extensions: .lfp .lfr .lfx 18598 185990 belong 0x894C4650 18600>4 belong 0x0D0A1A0A 18601>12 belong 0x00000000 Lytro Light Field Picture 18602>8 belong x \b, version %d 18603 18604# Type: Vision Research Phantom CINE Format 18605# URL: https://www.phantomhighspeed.com/ 18606# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 18607# From: Harry Mallon <hjmallon at gmail.com> 18608# 18609# This has a short "CI" code but the 44 is the size of the struct which is 18610# stable 186110 string CI 18612>2 leshort 44 Vision Research CINE Video, 18613>>4 leshort 0 Grayscale, 18614>>4 leshort 1 JPEG Compressed, 18615>>4 leshort 2 RAW, 18616>>6 leshort x version %d, 18617>>20 lelong x %d frames, 18618>>48 lelong x %dx 18619>>52 lelong x \b%d 18620 18621# Type: ARRI Raw Image 18622# Info: SMPTE RDD30:2014 18623# From: Harry Mallon <hjmallon at gmail.com> 186240 string ARRI ARRI ARI image data, 18625>4 lelong 0x78563412 little-endian, 18626>4 lelong 0x12345678 big-endian, 18627>12 lelong x version %d, 18628>20 lelong x %dx 18629>24 lelong x \b%d 18630 18631# Type: Khronos KTX texture. 18632# From: David Korth <gerbilsoft@gerbilsoft.com> 18633# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 18634 18635# glEnum decoding. 18636# NOTE: Only the most common formats are listed here. 186370 name khronos-ktx-glEnum 18638>0 lelong 0x1907 \b, RGB 18639>0 lelong 0x1908 \b, RGBA 18640>0 lelong 0x1909 \b, LUMINANCE 18641>0 lelong 0x190A \b, LUMINANCE_ALPHA 18642>0 lelong 0x80E1 \b, BGR 18643>0 lelong 0x80E2 \b, BGRA 18644>0 lelong 0x83A0 \b, RGB_S3TC 18645>0 lelong 0x83A1 \b, RGB4_S3TC 18646>0 lelong 0x83A2 \b, RGBA_S3TC 18647>0 lelong 0x83A3 \b, RGBA4_S3TC 18648>0 lelong 0x83A4 \b, RGBA_DXT5_S3TC 18649>0 lelong 0x83A5 \b, RGBA4_DXT5_S3TC 18650>0 lelong 0x83F0 \b, COMPRESSED_RGB_S3TC_DXT1_EXT 18651>0 lelong 0x83F1 \b, COMPRESSED_RGBA_S3TC_DXT1_EXT 18652>0 lelong 0x83F2 \b, COMPRESSED_RGBA_S3TC_DXT3_EXT 18653>0 lelong 0x83F3 \b, COMPRESSED_RGBA_S3TC_DXT5_EXT 18654>0 lelong 0x8D64 \b, ETC1_RGB8_OES 18655>0 lelong 0x9270 \b, COMPRESSED_R11_EAC 18656>0 lelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 18657>0 lelong 0x9272 \b, COMPRESSED_RG11_EAC 18658>0 lelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 18659>0 lelong 0x9274 \b, COMPRESSED_RGB8_ETC2 18660>0 lelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 18661>0 lelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 18662>0 lelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 18663>0 lelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 18664>0 lelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 18665>0 lelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 18666>0 lelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 18667>0 lelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 18668>0 lelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 18669>0 lelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 18670>0 lelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 18671>0 lelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 18672>0 lelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 18673>0 lelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 18674>0 lelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 18675>0 lelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 18676>0 lelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 18677>0 lelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 18678>0 lelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 18679>0 lelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 18680>0 lelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 18681>0 lelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 18682>0 lelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 18683>0 lelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 18684>0 lelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 18685>0 lelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 18686>0 lelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 18687>0 lelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 18688>0 lelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 18689>0 lelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 18690>0 lelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 18691>0 lelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 18692>0 lelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 18693 18694# Endian-specific KTX header. 18695# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 186960 name khronos-ktx-endian-header 18697>20 lelong x \b, %u 18698>24 lelong >1 x %u 18699>28 lelong >1 x %u 18700>8 lelong >0 18701>>8 use khronos-ktx-glEnum 18702>8 lelong 0 18703>>12 use khronos-ktx-glEnum 18704 18705# Main KTX header. 18706# Determine endianness, then check the rest of the header. 187070 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 18708>12 lelong 0x04030201 (little-endian) 18709>>16 use khronos-ktx-endian-header 18710>12 belong 0x04030201 (big-endian) 18711>>16 use \^khronos-ktx-endian-header 18712 18713# Type: Khronos KTX2 texture. 18714# From: David Korth <gerbilsoft@gerbilsoft.com> 18715# Based on draft19. 18716# Reference: http://github.khronos.org/KTX-Specification/ 18717 18718# Supercompression enum. 187190 name khronos-ktx2-supercompression 18720>0 lelong 1 BasisLZ 18721>0 lelong 2 Zstandard 18722>0 lelong 3 ZLIB 18723 18724# Vulkan format identifier. 18725# NOTE: Formats prohibited from KTX2 are commented out. 187260 name khronos-ktx2-vkFormat 18727>0 lelong 0 UNDEFINED 18728>0 lelong 1 R4G4_UNORM_PACK8 18729>0 lelong 2 R4G4B4A4_UNORM_PACK16 18730>0 lelong 3 B4G4R4A4_UNORM_PACK16 18731>0 lelong 4 R5G6B5_UNORM_PACK16 18732>0 lelong 5 B5G6R5_UNORM_PACK16 18733>0 lelong 6 R5G5B5A1_UNORM_PACK16 18734>0 lelong 7 B5G5R5A1_UNORM_PACK16 18735>0 lelong 8 A1R5G5B5_UNORM_PACK16 18736>0 lelong 9 R8_UNORM 18737>0 lelong 10 R8_SNORM 18738#>0 lelong 11 R8_USCALED 18739#>0 lelong 12 R8_SSCALED 18740>0 lelong 13 R8_UINT 18741>0 lelong 14 R8_SINT 18742>0 lelong 15 R8_SRGB 18743>0 lelong 16 R8G8_UNORM 18744>0 lelong 17 R8G8_SNORM 18745#>0 lelong 18 R8G8_USCALED 18746#>0 lelong 19 R8G8_SSCALED 18747>0 lelong 20 R8G8_UINT 18748>0 lelong 21 R8G8_SINT 18749>0 lelong 22 R8G8_SRGB 18750>0 lelong 23 R8G8B8_UNORM 18751>0 lelong 24 R8G8B8_SNORM 18752#>0 lelong 25 R8G8B8_USCALED 18753#>0 lelong 26 R8G8B8_SSCALED 18754>0 lelong 27 R8G8B8_UINT 18755>0 lelong 28 R8G8B8_SINT 18756>0 lelong 29 R8G8B8_SRGB 18757>0 lelong 30 B8G8R8_UNORM 18758>0 lelong 31 B8G8R8_SNORM 18759#>0 lelong 32 B8G8R8_USCALED 18760#>0 lelong 33 B8G8R8_SSCALED 18761>0 lelong 34 B8G8R8_UINT 18762>0 lelong 35 B8G8R8_SINT 18763>0 lelong 36 B8G8R8_SRGB 18764>0 lelong 37 R8G8B8A8_UNORM 18765>0 lelong 38 R8G8B8A8_SNORM 18766#>0 lelong 39 R8G8B8A8_USCALED 18767#>0 lelong 40 R8G8B8A8_SSCALED 18768>0 lelong 41 R8G8B8A8_UINT 18769>0 lelong 42 R8G8B8A8_SINT 18770>0 lelong 43 R8G8B8A8_SRGB 18771>0 lelong 44 B8G8R8A8_UNORM 18772>0 lelong 45 B8G8R8A8_SNORM 18773#>0 lelong 46 B8G8R8A8_USCALED 18774#>0 lelong 47 B8G8R8A8_SSCALED 18775>0 lelong 48 B8G8R8A8_UINT 18776>0 lelong 49 B8G8R8A8_SINT 18777>0 lelong 50 B8G8R8A8_SRGB 18778#>0 lelong 51 A8B8G8R8_UNORM_PACK32 18779#>0 lelong 52 A8B8G8R8_SNORM_PACK32 18780#>0 lelong 53 A8B8G8R8_USCALED_PACK32 18781#>0 lelong 54 A8B8G8R8_SSCALED_PACK32 18782#>0 lelong 55 A8B8G8R8_UINT_PACK32 18783#>0 lelong 56 A8B8G8R8_SINT_PACK32 18784#>0 lelong 57 A8B8G8R8_SRGB_PACK32 18785>0 lelong 58 A2R10G10B10_UNORM_PACK32 18786>0 lelong 59 A2R10G10B10_SNORM_PACK32 18787#>0 lelong 60 A2R10G10B10_USCALED_PACK32 18788#>0 lelong 61 A2R10G10B10_SSCALED_PACK32 18789>0 lelong 62 A2R10G10B10_UINT_PACK32 18790>0 lelong 63 A2R10G10B10_SINT_PACK32 18791>0 lelong 64 A2B10G10R10_UNORM_PACK32 18792>0 lelong 65 A2B10G10R10_SNORM_PACK32 18793#>0 lelong 66 A2B10G10R10_USCALED_PACK32 18794#>0 lelong 67 A2B10G10R10_SSCALED_PACK32 18795>0 lelong 68 A2B10G10R10_UINT_PACK32 18796>0 lelong 69 A2B10G10R10_SINT_PACK32 18797>0 lelong 70 R16_UNORM 18798>0 lelong 71 R16_SNORM 18799#>0 lelong 72 R16_USCALED 18800#>0 lelong 73 R16_SSCALED 18801>0 lelong 74 R16_UINT 18802>0 lelong 75 R16_SINT 18803>0 lelong 76 R16_SFLOAT 18804>0 lelong 77 R16G16_UNORM 18805>0 lelong 78 R16G16_SNORM 18806#>0 lelong 79 R16G16_USCALED 18807#>0 lelong 80 R16G16_SSCALED 18808>0 lelong 81 R16G16_UINT 18809>0 lelong 82 R16G16_SINT 18810>0 lelong 83 R16G16_SFLOAT 18811>0 lelong 84 R16G16B16_UNORM 18812>0 lelong 85 R16G16B16_SNORM 18813#>0 lelong 86 R16G16B16_USCALED 18814#>0 lelong 87 R16G16B16_SSCALED 18815>0 lelong 88 R16G16B16_UINT 18816>0 lelong 89 R16G16B16_SINT 18817>0 lelong 90 R16G16B16_SFLOAT 18818>0 lelong 91 R16G16B16A16_UNORM 18819>0 lelong 92 R16G16B16A16_SNORM 18820#>0 lelong 93 R16G16B16A16_USCALED 18821#>0 lelong 94 R16G16B16A16_SSCALED 18822>0 lelong 95 R16G16B16A16_UINT 18823>0 lelong 96 R16G16B16A16_SINT 18824>0 lelong 97 R16G16B16A16_SFLOAT 18825>0 lelong 98 R32_UINT 18826>0 lelong 99 R32_SINT 18827>0 lelong 100 R32_SFLOAT 18828>0 lelong 101 R32G32_UINT 18829>0 lelong 102 R32G32_SINT 18830>0 lelong 103 R32G32_SFLOAT 18831>0 lelong 104 R32G32B32_UINT 18832>0 lelong 105 R32G32B32_SINT 18833>0 lelong 106 R32G32B32_SFLOAT 18834>0 lelong 107 R32G32B32A32_UINT 18835>0 lelong 108 R32G32B32A32_SINT 18836>0 lelong 109 R32G32B32A32_SFLOAT 18837>0 lelong 110 R64_UINT 18838>0 lelong 111 R64_SINT 18839>0 lelong 112 R64_SFLOAT 18840>0 lelong 113 R64G64_UINT 18841>0 lelong 114 R64G64_SINT 18842>0 lelong 115 R64G64_SFLOAT 18843>0 lelong 116 R64G64B64_UINT 18844>0 lelong 117 R64G64B64_SINT 18845>0 lelong 118 R64G64B64_SFLOAT 18846>0 lelong 119 R64G64B64A64_UINT 18847>0 lelong 120 R64G64B64A64_SINT 18848>0 lelong 121 R64G64B64A64_SFLOAT 18849>0 lelong 122 B10G11R11_UFLOAT_PACK32 18850>0 lelong 123 E5B9G9R9_UFLOAT_PACK32 18851>0 lelong 124 D16_UNORM 18852>0 lelong 125 X8_D24_UNORM_PACK32 18853>0 lelong 126 D32_SFLOAT 18854>0 lelong 127 S8_UINT 18855>0 lelong 128 D16_UNORM_S8_UINT 18856>0 lelong 129 D24_UNORM_S8_UINT 18857>0 lelong 130 D32_SFLOAT_S8_UINT 18858 18859>0 lelong 131 BC1_RGB_UNORM_BLOCK 18860>0 lelong 132 BC1_RGB_SRGB_BLOCK 18861>0 lelong 133 BC1_RGBA_UNORM_BLOCK 18862>0 lelong 134 BC1_RGBA_SRGB_BLOCK 18863>0 lelong 135 BC2_UNORM_BLOCK 18864>0 lelong 136 BC2_SRGB_BLOCK 18865>0 lelong 137 BC3_UNORM_BLOCK 18866>0 lelong 138 BC3_SRGB_BLOCK 18867>0 lelong 139 BC4_UNORM_BLOCK 18868>0 lelong 140 BC4_SNORM_BLOCK 18869>0 lelong 141 BC5_UNORM_BLOCK 18870>0 lelong 142 BC5_SNORM_BLOCK 18871>0 lelong 143 BC6H_UFLOAT_BLOCK 18872>0 lelong 144 BC6H_SFLOAT_BLOCK 18873>0 lelong 145 BC7_UNORM_BLOCK 18874>0 lelong 146 BC7_SRGB_BLOCK 18875 18876>0 lelong 147 ETC2_R8G8B8_UNORM_BLOCK 18877>0 lelong 148 ETC2_R8G8B8_SRGB_BLOCK 18878>0 lelong 149 ETC2_R8G8B8A1_UNORM_BLOCK 18879>0 lelong 150 ETC2_R8G8B8A1_SRGB_BLOCK 18880>0 lelong 151 ETC2_R8G8B8A8_UNORM_BLOCK 18881>0 lelong 152 ETC2_R8G8B8A8_SRGB_BLOCK 18882 18883>0 lelong 153 EAC_R11_UNORM_BLOCK 18884>0 lelong 154 EAC_R11_SNORM_BLOCK 18885>0 lelong 155 EAC_R11G11_UNORM_BLOCK 18886>0 lelong 156 EAC_R11G11_SNORM_BLOCK 18887 18888>0 lelong 157 ASTC_4x4_UNORM_BLOCK 18889>0 lelong 158 ASTC_4x4_SRGB_BLOCK 18890>0 lelong 159 ASTC_5x4_UNORM_BLOCK 18891>0 lelong 160 ASTC_5x4_SRGB_BLOCK 18892>0 lelong 161 ASTC_5x5_UNORM_BLOCK 18893>0 lelong 162 ASTC_5x5_SRGB_BLOCK 18894>0 lelong 163 ASTC_6x5_UNORM_BLOCK 18895>0 lelong 164 ASTC_6x5_SRGB_BLOCK 18896>0 lelong 165 ASTC_6x6_UNORM_BLOCK 18897>0 lelong 166 ASTC_6x6_SRGB_BLOCK 18898>0 lelong 167 ASTC_8x5_UNORM_BLOCK 18899>0 lelong 168 ASTC_8x5_SRGB_BLOCK 18900>0 lelong 169 ASTC_8x6_UNORM_BLOCK 18901>0 lelong 170 ASTC_8x6_SRGB_BLOCK 18902>0 lelong 171 ASTC_8x8_UNORM_BLOCK 18903>0 lelong 172 ASTC_8x8_SRGB_BLOCK 18904>0 lelong 173 ASTC_10x5_UNORM_BLOCK 18905>0 lelong 174 ASTC_10x5_SRGB_BLOCK 18906>0 lelong 175 ASTC_10x6_UNORM_BLOCK 18907>0 lelong 176 ASTC_10x6_SRGB_BLOCK 18908>0 lelong 177 ASTC_10x8_UNORM_BLOCK 18909>0 lelong 178 ASTC_10x8_SRGB_BLOCK 18910>0 lelong 179 ASTC_10x10_UNORM_BLOCK 18911>0 lelong 180 ASTC_10x10_SRGB_BLOCK 18912>0 lelong 181 ASTC_12x10_UNORM_BLOCK 18913>0 lelong 182 ASTC_12x10_SRGB_BLOCK 18914>0 lelong 183 ASTC_12x12_UNORM_BLOCK 18915>0 lelong 184 ASTC_12x12_SRGB_BLOCK 18916 18917>0 lelong 1000156000 G8B8G8R8_422_UNORM 18918>0 lelong 1000156001 B8G8R8G8_422_UNORM 18919>0 lelong 1000156002 G8_B8_R8_3PLANE_420_UNORM 18920>0 lelong 1000156003 G8_B8R8_2PLANE_420_UNORM 18921>0 lelong 1000156004 G8_B8_R8_3PLANE_422_UNORM 18922>0 lelong 1000156005 G8_B8R8_2PLANE_422_UNORM 18923>0 lelong 1000156006 G8_B8_R8_3PLANE_444_UNORM 18924>0 lelong 1000156007 R10X6_UNORM_PACK16 18925>0 lelong 1000156008 R10X6G10X6_UNORM_2PACK16 18926>0 lelong 1000156009 R10X6G10X6B10X6A10X6_UNORM_4PACK16 18927>0 lelong 1000156010 G10X6B10X6G10X6R10X6_422_UNORM_4PACK16 18928>0 lelong 1000156011 B10X6G10X6R10X6G10X6_422_UNORM_4PACK16 18929>0 lelong 1000156012 G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16 18930>0 lelong 1000156013 G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16 18931>0 lelong 1000156014 G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16 18932>0 lelong 1000156015 G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16 18933>0 lelong 1000156016 G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16 18934>0 lelong 1000156017 R12X4_UNORM_PACK16 18935>0 lelong 1000156018 R12X4G12X4_UNORM_2PACK16 18936>0 lelong 1000156019 R12X4G12X4B12X4A12X4_UNORM_4PACK16 18937>0 lelong 1000156020 G12X4B12X4G12X4R12X4_422_UNORM_4PACK16 18938>0 lelong 1000156021 B12X4G12X4R12X4G12X4_422_UNORM_4PACK16 18939>0 lelong 1000156022 G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16 18940>0 lelong 1000156023 G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16 18941>0 lelong 1000156024 G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16 18942>0 lelong 1000156025 G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16 18943>0 lelong 1000156026 G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16 18944>0 lelong 1000156027 G16B16G16R16_422_UNORM 18945>0 lelong 1000156028 B16G16R16G16_422_UNORM 18946>0 lelong 1000156029 G16_B16_R16_3PLANE_420_UNORM 18947>0 lelong 1000156030 G16_B16R16_2PLANE_420_UNORM 18948>0 lelong 1000156031 G16_B16_R16_3PLANE_422_UNORM 18949>0 lelong 1000156032 G16_B16R16_2PLANE_422_UNORM 18950>0 lelong 1000156033 G16_B16_R16_3PLANE_444_UNORM 18951 18952>0 lelong 1000054000 PVRTC1_2BPP_UNORM_BLOCK_IMG 18953>0 lelong 1000054001 PVRTC1_4BPP_UNORM_BLOCK_IMG 18954>0 lelong 1000054002 PVRTC2_2BPP_UNORM_BLOCK_IMG 18955>0 lelong 1000054003 PVRTC2_4BPP_UNORM_BLOCK_IMG 18956>0 lelong 1000054004 PVRTC1_2BPP_SRGB_BLOCK_IMG 18957>0 lelong 1000054005 PVRTC1_4BPP_SRGB_BLOCK_IMG 18958>0 lelong 1000054006 PVRTC2_2BPP_SRGB_BLOCK_IMG 18959>0 lelong 1000054007 PVRTC2_4BPP_SRGB_BLOCK_IMG 18960 18961>0 lelong 1000066000 ASTC_4x4_SFLOAT_BLOCK_EXT 18962>0 lelong 1000066001 ASTC_5x4_SFLOAT_BLOCK_EXT 18963>0 lelong 1000066002 ASTC_5x5_SFLOAT_BLOCK_EXT 18964>0 lelong 1000066003 ASTC_6x5_SFLOAT_BLOCK_EXT 18965>0 lelong 1000066004 ASTC_6x6_SFLOAT_BLOCK_EXT 18966>0 lelong 1000066005 ASTC_8x5_SFLOAT_BLOCK_EXT 18967>0 lelong 1000066006 ASTC_8x6_SFLOAT_BLOCK_EXT 18968>0 lelong 1000066007 ASTC_8x8_SFLOAT_BLOCK_EXT 18969>0 lelong 1000066008 ASTC_10x5_SFLOAT_BLOCK_EXT 18970>0 lelong 1000066009 ASTC_10x6_SFLOAT_BLOCK_EXT 18971>0 lelong 1000066010 ASTC_10x8_SFLOAT_BLOCK_EXT 18972>0 lelong 1000066011 ASTC_10x10_SFLOAT_BLOCK_EXT 18973>0 lelong 1000066012 ASTC_12x10_SFLOAT_BLOCK_EXT 18974>0 lelong 1000066013 ASTC_12x12_SFLOAT_BLOCK_EXT 18975 18976# Main KTX2 header. 189770 string \xABKTX\ 20\xBB\r\n\x1A\n Khronos KTX2 texture 18978>20 lelong x \b, %u 18979>24 lelong >1 x %u 18980>28 lelong >1 x %u 18981>32 lelong >1 \b, %u layers 18982>36 lelong >1 \b, %u faces 18983>40 lelong >1 \b, %u mipmaps 18984>44 lelong >0 \b, 18985>>44 use khronos-ktx2-supercompression 18986>12 lelong >0 \b, 18987>>12 use khronos-ktx2-vkFormat 18988 18989# Type: Valve VTF texture. 18990# From: David Korth <gerbilsoft@gerbilsoft.com> 18991# References: 18992# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 18993 18994# VTF image formats. 189950 name vtf-image-format 18996>0 lelong 0 RGBA8888 18997>0 lelong 1 ABGR8888 18998>0 lelong 2 RGB888 18999>0 lelong 3 BGR888 19000>0 lelong 4 RGB565 19001>0 lelong 5 I8 19002>0 lelong 6 IA88 19003>0 lelong 7 P8 19004>0 lelong 8 A8 19005>0 lelong 9 RGB888 (bluescreen) 19006>0 lelong 10 BGR888 (bluescreen) 19007>0 lelong 11 ARGB8888 19008>0 lelong 12 BGRA8888 19009>0 lelong 13 DXT1 19010>0 lelong 14 DXT3 19011>0 lelong 15 DXT5 19012>0 lelong 16 BGRx8888 19013>0 lelong 17 BGR565 19014>0 lelong 18 BGRx5551 19015>0 lelong 19 BGRA4444 19016>0 lelong 20 DXT1+A1 19017>0 lelong 21 BGRA5551 19018>0 lelong 22 UV88 19019>0 lelong 23 UVWQ8888 19020>0 lelong 24 RGBA16161616F 19021>0 lelong 25 RGBA16161616 19022>0 lelong 26 UVLX8888 19023 19024# Main VTF header. 190250 string VTF\0 Valve Texture Format 19026>4 lelong x v%u 19027>8 lelong x \b.%u 19028>0x10 leshort x \b, %u 19029>0x12 leshort >1 x %u 19030>4 lequad 0x0000000700000002 19031>>0x3F leshort >1 x %u 19032>0x18 leshort >1 \b, %u frames 19033>0x38 byte x \b, mipmaps: %u 19034>0x34 lelong >-1 \b, 19035>>0x34 use vtf-image-format 19036 19037# Type: Valve VTF3 (PS3) texture. 19038# From: David Korth <gerbilsoft@gerbilsoft.com> 190390 string VTF3 Valve Texture Format (PS3) 19040>0x14 beshort x \b, %u 19041>0x16 beshort x \b x %u 19042>0x10 belong&0x2000 0 \b, DXT1 19043>0x10 belong&0x2000 0x2000 \b, DXT5 19044 19045# Type: ASTC texture. 19046# From: David Korth <gerbilsoft@gerbilsoft.com> 19047# References: 19048# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 19049# - https://stackoverflow.com/a/22682244 190500 lelong 0x5ca1ab13 ASTC 19051>4 byte x %u 19052>5 byte x \bx%u 19053>6 byte >1 \bx%u 19054# X, Y, and Z dimensions are stored as 24-bit LE. 19055# Pretend it's 32-bit and mask off the high byte. 19056>7 lelong&0x00FFFFFF x texture, %u 19057>10 lelong&0x00FFFFFF x x %u 19058>13 lelong&0x00FFFFFF >1 x %u 19059 19060# Zebra Metafile graphic 19061# http://www.fileformat.info/format/zbr/egff.htm 190620 beshort 0x9a02 Zebra Metafile graphic 19063>2 leshort 1 (version 1.x) 19064>2 leshort 2 (version 1.1x or 1.2x) 19065>2 leshort 3 (version 1.49) 19066>2 leshort 4 (version 1.50) 19067>4 string x (comment = %s) 19068 19069# Microsoft Paint graphic 19070# http://www.fileformat.info/format/mspaint/egff.htm 190710 string DanM icrosoft Paint image data (version 1.x) 19072>4 leshort x (%d 19073>>6 leshort x x %d) 190740 string LinS Microsoft Paint image data (version 2.0) 19075>4 leshort x (%d 19076>>6 leshort x x %d) 19077 19078# reMarkable tablet internal file format (https://www.remarkable.com/) 19079# https://github.com/ax3l/lines-are-beautiful 19080# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ 19081# reMarkable-lines-file-format.html#what-to-do-next 19082# from Axel Huebl 190830 string reMarkable 19084>11 string lines 19085>>17 string with 19086>>>22 string selections 19087>>>>33 string and 19088>>>>>37 string layers 19089>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) 19090 19091# newer per-page files for the reMarkable 190920 string reMarkable 19093>11 string .lines 19094>>18 string file, 19095>>>24 string version= 19096>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872, 19097>>>>>43 lelong x %d layer(s) 19098 19099# Type: PVR3 texture. 19100# From: David Korth <gerbilsoft@gerbilsoft.com> 19101# References: 19102# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf 19103 19104# PVR3 pixel formats. 191050 name pvr3-pixel-format 19106>0 ulelong 0 PVRTC 2bpp RGB 19107>0 ulelong 1 PVRTC 2bpp RGBA 19108>0 ulelong 2 PVRTC 4bpp RGB 19109>0 ulelong 3 PVRTC 4bpp RGBA 19110>0 ulelong 4 PVRTC-II 2bpp 19111>0 ulelong 5 PVRTC-II 4bpp 19112>0 ulelong 6 ETC1 19113>0 ulelong 7 DXT1 19114>0 ulelong 8 DXT2 19115>0 ulelong 9 DXT3 19116>0 ulelong 10 DXT4 19117>0 ulelong 11 DXT5 19118>0 ulelong 12 BC4 19119>0 ulelong 13 BC5 19120>0 ulelong 14 BC6 19121>0 ulelong 15 BC7 19122>0 ulelong 16 UYVY 19123>0 ulelong 17 YUY2 19124>0 ulelong 18 BW1bpp 19125>0 ulelong 19 R9G9B9E5 Shared Exponent 19126>0 ulelong 20 RGBG8888 19127>0 ulelong 21 GRGB8888 19128>0 ulelong 22 ETC2 RGB 19129>0 ulelong 23 ETC2 RGBA 19130>0 ulelong 24 ETC2 RGB A1 19131>0 ulelong 25 EAC R11 19132>0 ulelong 26 EAC RG11 19133>0 ulelong 27 ASTC_4x4 19134>0 ulelong 28 ASTC_5x4 19135>0 ulelong 29 ASTC_5x5 19136>0 ulelong 30 ASTC_6x5 19137>0 ulelong 31 ASTC_6x6 19138>0 ulelong 32 ASTC_8x5 19139>0 ulelong 33 ASTC_8x6 19140>0 ulelong 34 ASTC_8x8 19141>0 ulelong 35 ASTC_10x5 19142>0 ulelong 36 ASTC_10x6 19143>0 ulelong 37 ASTC_10x8 19144>0 ulelong 38 ASTC_10x10 19145>0 ulelong 39 ASTC_12x10 19146>0 ulelong 40 ASTC_12x12 19147>0 ulelong 41 ASTC_3x3x3 19148>0 ulelong 42 ASTC_4x3x3 19149>0 ulelong 43 ASTC_4x4x3 19150>0 ulelong 44 ASTC_4x4x4 19151>0 ulelong 45 ASTC_5x4x4 19152>0 ulelong 46 ASTC_5x5x4 19153>0 ulelong 47 ASTC_5x5x5 19154>0 ulelong 48 ASTC_6x5x5 19155>0 ulelong 49 ASTC_6x6x5 19156>0 ulelong 50 ASTC_6x6x6 19157 191580 string PVR\x03 PowerVR 3.0 texture: 19159>0x18 ulelong x %u x 19160>0x1C ulelong x %u 19161>0x20 ulelong >1 x %u 19162>0x08 byte x \b, 19163>0x0C ulelong 0 19164>>0x08 use pvr3-pixel-format 19165>0x0C ulelong !0 19166>>0x08 byte !0 %c 19167>>>0x0C byte !0 \b%u 19168>>0x09 byte !0 \b%c 19169>>>0x0D byte !0 \b%u 19170>>0x0A byte !0 \b%c 19171>>>0x0E byte !0 \b%u 19172>>0x0B byte !0 \b%c 19173>>>0x0F byte !0 \b%u 19174>0x10 ulelong 1 \b, sRGB 19175>0x04 ulelong&0x02 0x02 \b, premultiplied alpha 19176 191770 string \x03RVP PowerVR 3.0 texture: BE, 19178>0x18 ubelong x %u x 19179>0x1C ubelong x %u 19180>0x20 ubelong >1 x %u 19181>0x08 byte x \b, 19182>0x0C ubelong 0 19183>>0x08 use pvr3-pixel-format 19184>0x0C ubelong !0 19185>>0x0B byte !0 %c 19186>>>0x0F byte !0 \b%u 19187>>0x0A byte !0 \b%c 19188>>>0x0E byte !0 \b%u 19189>>0x09 byte !0 \b%c 19190>>>0x0D byte !0 \b%u 19191>>0x08 byte !0 \b%c 19192>>>0x0C byte !0 \b%u 19193>0x10 ubelong 1 \b, sRGB 19194>0x04 ubelong&0x02 0x02 \b, premultiplied alpha 19195 19196# Type: Microsoft Xbox XPR0 texture. 19197# From: David Korth <gerbilsoft@gerbilsoft.com> 19198# References: 19199# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h 19200 19201# XPR pixel formats. 192020 name xbox-xpr-pixel-format 19203>0 byte 0x00 L8 19204>0 byte 0x01 AL8 19205>0 byte 0x02 ARGB1555 19206>0 byte 0x03 RGB555 19207>0 byte 0x04 ARGB4444 19208>0 byte 0x05 RGB565 19209>0 byte 0x06 ARGB8888 19210>0 byte 0x07 xRGB8888 19211>0 byte 0x0B P8 19212>0 byte 0x0C DXT1 19213>0 byte 0x0E DXT2 19214>0 byte 0x0F DXT4 19215>0 byte 0x10 Linear ARGB1555 19216>0 byte 0x11 Linear RGB565 19217>0 byte 0x12 Linear ARGB8888 19218>0 byte 0x13 Linear L8 19219>0 byte 0x16 Linear R8B8 19220>0 byte 0x17 Linear G8B8 19221>0 byte 0x19 A8 19222>0 byte 0x1A A8L8 19223>0 byte 0x1B Linear AL8 19224>0 byte 0x1C Linear RGB555 19225>0 byte 0x1D Linear ARGB4444 19226>0 byte 0x1E Linear xRGB8888 19227>0 byte 0x1F Linear A8 19228>0 byte 0x20 Linear A8L8 19229>0 byte 0x24 YUY2 19230>0 byte 0x25 UYVY 19231>0 byte 0x27 L6V5U5 19232>0 byte 0x28 V8U8 19233>0 byte 0x29 R8B8 19234>0 byte 0x2A D24S8 19235>0 byte 0x2B F24S8 19236>0 byte 0x2C D16 19237>0 byte 0x2D F16 19238>0 byte 0x2E Linear D24S8 19239>0 byte 0x2F Linear F24S8 19240>0 byte 0x30 Linear D16 19241>0 byte 0x31 Linear F16 19242>0 byte 0x32 L16 19243>0 byte 0x33 V16U16 19244>0 byte 0x35 Linear L16 19245>0 byte 0x36 Linear V16U16 19246>0 byte 0x37 Linear L6V5U5 19247>0 byte 0x38 RGBA5551 19248>0 byte 0x39 RGBA4444 19249>0 byte 0x3A QWVU8888 19250>0 byte 0x3B BGRA8888 19251>0 byte 0x3C RGBA8888 19252>0 byte 0x3D Linear RGBA5551 19253>0 byte 0x3E Linear RGBA4444 19254>0 byte 0x3F Linear ABGR8888 19255>0 byte 0x40 Linear BGRA8888 19256>0 byte 0x41 Linear RGBA8888 19257>0 byte 0x64 Vertex Data 19258 192590 string XPR0 Microsoft Xbox XPR0 texture 19260>0x19 byte x \b, format: 19261>>0x19 use xbox-xpr-pixel-format 19262 19263# ILDA Image Data Transfer Format 19264# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf 19265# 19266# Updated by Chuck Hein (laser@geekdude.com) 19267# 192680 string ILDA ILDA Image Data Transfer Format 19269>7 byte 0x00 3D Coordinates with Indexed Color 19270>7 byte 0x01 2D Coordinates with Indexed Color 19271>7 byte 0x02 Color Palette 19272>7 byte 0x04 3D Coordinates with True Color 19273>7 byte 0x05 2D Coordinates with True Color 19274>8 string >0 \b, palette %s 19275>16 string >0 \b, company %s 19276>24 beshort >0 \b, number of records %d 19277>>26 beshort x \b, palette number %d 19278>>28 beshort >0 \b, number of frames %d 19279>>30 byte >0 \b, projector number %d 19280 19281# Dropbox "lepton" compressed jpeg format 19282# https://github.com/dropbox/lepton 192830 belong&0xfffff0ff 0xcf84005a Lepton image file 19284>2 byte x (version %d) 19285 19286# Apple QuickTake camera raw images 19287# https://en.wikipedia.org/wiki/Apple_QuickTake 19288# dcraw can decode them 192890 name quicktake 19290>4 belong 8 19291>>544 beshort x \b, %dx 19292>>546 beshort x \b%d 19293>4 belong 4 19294>>546 beshort x \b, %dx 19295>>544 beshort x \b%d 19296 192970 string qktk Apple QuickTake 100 Raw Image 19298>0 use quicktake 19299 193000 string qktn 19301>4 byte 0 Apple QuickTake 150 Raw Image 19302>4 byte >0 Apple QuickTake 200 Raw Image 19303>0 use quicktake 19304 19305# From: Joerg Jenderek 19306# URL: http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image 19307# Reference: http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf 193080 string CPT 19309>4 string FILE Corel Photo-Paint image, version 19310# version like 7, 9 or 8 19311>>3 ubyte x %c, 19312!:mime image/x-corel-cpt 19313!:ext cpt 19314# if blocks_array_offset available jump blockNumber*8 bytes 19315>>0x34 ulelong >0 19316>>>(0x28.l*8) ubyte x 19317# jump additional stored blocks_array_offset bytes forward to object block 19318>>>>&(0x34.l-1) ulelong x %u 19319# object height in pixels 19320>>>>>&0 ulelong x x %u 19321# if no blocks_array_offset available jump blockNumber*8 bytes 19322>>0x34 ulelong =0 19323>>>(0x28.l*8) ubyte x 19324# jump additional 0x13C bytes forward to object block 19325>>>>&0x13B ulelong x %u 19326>>>>>&0 ulelong x x %u 19327# image color model used 19328>>0x8 ulelong x 19329>>>0x8 ulelong 0x1 RGB 24 bits 19330>>>0x8 ulelong 0x3 CMYK 24 bits 19331>>>0x8 ulelong 0x5 greyscale 8 bits 19332>>>0x8 ulelong 0x6 black and white 1 bit 19333>>>0x8 ulelong 0xA RGB 8 bits 19334# palette_length number of colors * 3 in case of 8-bit RGB paletted image 19335# 0 otherwise. Allowed values: 0 or [1..256] * 3 19336#>>0xC ulelong >0 \b, palette length %u 19337>>>>0xC ulelong/3 <256 \b, %u colors 19338>>>0x8 ulelong 0xB LAB 19339>>>0x8 ulelong 0xC RGB 48 bits 19340>>>0x8 ulelong 0xE greyscale 16 bits 19341# this should not happen 19342>>>0x8 default x color model 19343>>>>0x8 ulelong x 0x%x 19344# bit 1 in CPT file flags: UCS-2 file comment present 19345>>0x31 ubyte &0x02 19346# look for comment marker 19347>>>0x100 search/0xc9d \4\2\0\0 19348# UCS-2 file comment 19349>>>>&0 lestring16 x "%s" 19350# if no UCS-2 is present show ANSI file comment[112] if available 19351>>0x31 ubyte&0x02 =0 19352>>>0x3C string >\0 "%-.112s" 19353# reserved seems to be always 0 19354#>>0x10 ulelong >0 \b, reserved1 %u 19355# horizontal real dpi = dpi_h * 25.4 / 10**6 19356>>0x18 ulelong x \b, %u micro dots/mm 19357# image vertical DPI in CPT DPI unit 19358#>>0x1C ulelong x \b, %u micro dots/mm 19359# reserved seems to be always 0 19360#>>0x20 ulelong >0 \b, reserved2 %u 19361#>>0x24 ulelong >0 \b, reserved3 %u 19362# blocks_count; number of CPT_Block blocks. Allowed values: > 0 19363>>0x28 ulelong x \b, %u block 19364# plural s 19365>>0x28 ulelong !1 \bs 19366# CPT file flags 19367# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE 19368#>>0x30 ubyte x \b, lower flags 0x%x 19369# upper byte of CPT file flags: 19370#>>0x31 ubyte >0 \b, upper flags 0x%x 19371# bit 2 in CPT file flags: unknown 19372#>>0x31 ubyte &0x04 \b, with UNKNOWN 19373# bits 3-7 in CPT file flags: unknown, seem to be often 0 19374# show unusual flag combinations 19375>>0x31 ubyte&0xFC >0 19376>>>0x30 uleshort x \b, flags 0x%4.4x 19377# reserved seems to be always 0 19378#>>0x32 uleshort >0 \b, reserved4 0x%x 19379# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8 19380# typical values like: 13Ch 154h 43Ch 4F0h DA8h 19381>>0x34 ulelong x \b, array offset 0x%x 19382# reserved seems to be often 0 19383>>0x38 ulelong >0 \b, reserved5 0x%x 19384# possible next master block 19385#>>0x100 ubequad !0 \b, next block=0x%llx... 19386# bit 0: ICC profile block present 19387>>0x31 ubyte &0x01 \b, with ICC profile 19388# check for characteristic string acsp of color profile for DEBUGGING 19389#>>>0x178 string x icc=%.4s 19390# display ICC/ICM color profile by ./icc 19391#>>>0x154 use color-profile 19392 19393# Type: Crunch compressed texture. 19394# From: David Korth <gerbilsoft@gerbilsoft.com> 19395# References: 19396# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267 193970 ubelong 0x4878004A Crunch compressed texture: 19398>0x0C ubeshort x %u x 19399>0x0E ubeshort x %u 19400>0x12 ubyte 0 \b, DXT1 19401>0x12 ubyte 1 \b, DXT3 19402>0x12 ubyte 2 \b, DXT5 19403>0x12 ubyte 3 \b, DXT5 CCxY 19404>0x12 ubyte 4 \b, DXT5 xGxR 19405>0x12 ubyte 5 \b, DXT5 xGBR 19406>0x12 ubyte 6 \b, DXT5 AGBR 19407>0x12 ubyte 7 \b, DXn XY 19408>0x12 ubyte 8 \b, DXn YX 19409>0x12 ubyte 9 \b, DXT5 Alpha 19410>0x12 ubyte 10 \b, ETC1 19411>0x10 ubyte >1 \b, %u images 19412>0x11 ubyte >1 \b, %u faces 19413# TODO: Flags at 0x13? (ubeshort) 19414 19415# Type: BasisLZ compressed texture. 19416# From: David Korth <gerbilsoft@gerbilsoft.com> 19417# References: 19418# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt 194190 uleshort 0x4273 19420>0x04 uleshort 0x4D BasisLZ 19421>>0x02 uleshort x v%x compressed texture: 19422>>0x14 ubyte 0 ETC1S 19423>>0x14 ubyte 1 UASTC 4x4 19424>>0x0E ulelong&0xFFFFFF >1 \b, %u slices 19425>>0x11 ulelong&0xFFFFFF >1 \b, %u images 19426>>0x15 uleshort&0x02 2 \b, Y-flipped 19427 19428# MIME registration: https://www.iana.org/assignments/media-types/model/e57 19429# Sample files: http://www.libe57.org/data.html 19430# Reference implementation: http://www.libe57.org/ 19431# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf 194320 string ASTM-E57 ASTM E57 three-dimensional model 19433!:mime model/e57 19434!:ext e57 19435 19436#------------------------------------------------------------------------------ 19437# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 19438# inform: file(1) magic for Inform interactive fiction language 19439 19440# URL: http://www.inform-fiction.org/ 19441# From: Reuben Thomas <rrt@sc3d.org> 19442 194430 search/100/cW constant\ story Inform source text 19444 19445#------------------------------------------------------------------------------ 19446# $File: intel,v 1.19 2020/12/12 20:01:47 christos Exp $ 19447# intel: file(1) magic for x86 Unix 19448# 19449# Various flavors of x86 UNIX executable/object (other than Xenix, which 19450# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 19451# Windows as well. 19452# 19453# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 19454# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 19455# as well, if, as, and when IBM makes it portable. 19456# 19457# The `versions' should be un-commented if they work for you. 19458# (Was the problem just one of endianness?) 19459# 194600 leshort 0502 basic-16 executable 19461>12 lelong >0 not stripped 19462#>22 leshort >0 - version %d 194630 leshort 0503 basic-16 executable (TV) 19464>12 lelong >0 not stripped 19465#>22 leshort >0 - version %d 194660 leshort 0510 x86 executable 19467>12 lelong >0 not stripped 194680 leshort 0511 x86 executable (TV) 19469>12 lelong >0 not stripped 194700 leshort =0512 iAPX 286 executable small model (COFF) 19471>12 lelong >0 not stripped 19472#>22 leshort >0 - version %d 194730 leshort =0522 iAPX 286 executable large model (COFF) 19474>12 lelong >0 not stripped 19475#>22 leshort >0 - version %d 19476# updated by Joerg Jenderek at Oct 2015 19477# https://de.wikipedia.org/wiki/Common_Object_File_Format 19478# http://www.delorie.com/djgpp/doc/coff/filhdr.html 19479# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 19480# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 19481# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 194820 leshort =0514 19483# use subroutine to display name+flags+variables for common object formatted files 19484>0 use display-coff 19485#>12 lelong >0 not stripped 19486# no hint found, that at offset 22 is version 19487#>22 leshort >0 - version %d 194880 leshort 0x0200 19489>0 use display-coff 194900 leshort 0x8664 19491>0 use display-coff 19492 19493# rom: file(1) magic for BIOS ROM Extensions found in intel machines 19494# mapped into memory between 0xC0000 and 0xFFFFF 19495# From: Alex Myczko <alex@aiei.ch> 19496# updated by Joerg Jenderek 19497# https://en.wikipedia.org/wiki/Option_ROM 194980 beshort 0x55AA BIOS (ia32) ROM Ext. 19499!:mime application/octet-stream 19500!:ext rom/bin 19501>5 string USB USB 19502>7 string LDR UNDI image 19503>30 string IBM IBM comp. Video 19504>26 string Adaptec Adaptec 19505>28 string Adaptec Adaptec 19506>42 string PROMISE Promise 19507>2 byte x (%d*512) 19508 19509# Flash descriptors for Intel SPI flash roms. 19510# From Dr. Jesus <j@hug.gs> 195110 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1951216 lelong 0x0ff0a55a Intel serial flash for PCH ROM 19513 19514# From: Joerg Jenderek 19515# URL: https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface 19516# Reference: https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf 19517# Note: generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml` 195180 string DSDT 19519>0 use acpi-table 19520# not tested or other file format 195210 string APIC 19522>0 use acpi-table 19523#0 string ASF! 19524#>0 use acpi-table 195250 string FACP 19526>0 use acpi-table 19527#0 string FACS 19528#>0 use acpi-table 195290 string MCFG 19530>0 use acpi-table 195310 string SLIC 19532>0 use acpi-table 195330 string SSDT 19534>0 use acpi-table 195350 name acpi-table 19536# skip ASCII text starting with DSDT by looking for valid "low" revision 19537>8 ubyte <17 ACPI Machine Language file 19538# assume that ACPI tables size are lower than 16 MiB 19539#>4 ulelong <0x01000000 19540# DSDT for Differentiated System Description Table 19541>>0 string x '%.4s' 19542#!:mime application/octet-stream 19543!:mime application/x-intel-aml 19544!:ext aml 19545# the manufacture model ID like: VBOXBIOS BXDSDT 19546>>16 string >\0 %.8s 19547# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511 19548>>>24 ulelong x %x 19549# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml 19550>>10 ubyte >040 by %c 19551>>>11 ubyte >040 \b%c 19552>>>>12 ubyte >040 \b%c 19553>>>>>13 ubyte >040 \b%c 19554>>>>>>14 ubyte >040 \b%c 19555>>>>>>>15 ubyte >040 \b%c 19556# This field also sets the global integer width for the AML interpreter. 19557# Values less than two will cause the interpreter to use 32-bit. 19558# Values of two and greater will cause the interpreter to use full 64-bit. 19559# 16 for asf!.aml, 67 fo rsdp.aml 19560>>8 ubyte x \b, revision %u 19561# length, in bytes, of the entire DSDT (including the header) 19562>>4 ulelong x \b, %u bytes 19563# entire table must sum to zero 19564#>>9 ubyte x \b, checksum 0x%x 19565# vendor ID for the ASL Compiler like: INTL MSFT ... 19566>>28 string >\0 \b, created by %.4s 19567# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ... 19568>>>32 ulelong x %x 19569 19570 19571#------------------------------------------------------------------------------ 19572# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 19573# interleaf: file(1) magic for InterLeaf TPS: 19574# 195750 string =\210OPS Interleaf saved data 195760 string =<!OPS Interleaf document text 19577>5 string ,\ Version\ = \b, version 19578>>17 string >\0 %.3s 19579 19580#------------------------------------------------------------------------------ 19581# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 19582# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 19583# "/etc/magic": 19584# From: guy@netapp.com (Guy Harris) 19585# 195864 string pgscriptver IslandWrite document 1958713 string DrawFile IslandDraw document 19588 19589 19590#------------------------------------------------------------------------------ 19591# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 19592# ispell: file(1) magic for ispell 19593# 19594# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 19595# will match 0x9600 through 0x9603 in *both* little endian and big endian. 19596# (No other current magic entries collide.) 19597# 19598# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 19599# 196000 leshort&0xFFFC 0x9600 little endian ispell 19601>0 byte 0 hash file (?), 19602>0 byte 1 3.0 hash file, 19603>0 byte 2 3.1 hash file, 19604>0 byte 3 hash file (?), 19605>2 leshort 0x00 8-bit, no capitalization, 26 flags 19606>2 leshort 0x01 7-bit, no capitalization, 26 flags 19607>2 leshort 0x02 8-bit, capitalization, 26 flags 19608>2 leshort 0x03 7-bit, capitalization, 26 flags 19609>2 leshort 0x04 8-bit, no capitalization, 52 flags 19610>2 leshort 0x05 7-bit, no capitalization, 52 flags 19611>2 leshort 0x06 8-bit, capitalization, 52 flags 19612>2 leshort 0x07 7-bit, capitalization, 52 flags 19613>2 leshort 0x08 8-bit, no capitalization, 128 flags 19614>2 leshort 0x09 7-bit, no capitalization, 128 flags 19615>2 leshort 0x0A 8-bit, capitalization, 128 flags 19616>2 leshort 0x0B 7-bit, capitalization, 128 flags 19617>2 leshort 0x0C 8-bit, no capitalization, 256 flags 19618>2 leshort 0x0D 7-bit, no capitalization, 256 flags 19619>2 leshort 0x0E 8-bit, capitalization, 256 flags 19620>2 leshort 0x0F 7-bit, capitalization, 256 flags 19621>4 leshort >0 and %d string characters 196220 beshort&0xFFFC 0x9600 big endian ispell 19623>1 byte 0 hash file (?), 19624>1 byte 1 3.0 hash file, 19625>1 byte 2 3.1 hash file, 19626>1 byte 3 hash file (?), 19627>2 beshort 0x00 8-bit, no capitalization, 26 flags 19628>2 beshort 0x01 7-bit, no capitalization, 26 flags 19629>2 beshort 0x02 8-bit, capitalization, 26 flags 19630>2 beshort 0x03 7-bit, capitalization, 26 flags 19631>2 beshort 0x04 8-bit, no capitalization, 52 flags 19632>2 beshort 0x05 7-bit, no capitalization, 52 flags 19633>2 beshort 0x06 8-bit, capitalization, 52 flags 19634>2 beshort 0x07 7-bit, capitalization, 52 flags 19635>2 beshort 0x08 8-bit, no capitalization, 128 flags 19636>2 beshort 0x09 7-bit, no capitalization, 128 flags 19637>2 beshort 0x0A 8-bit, capitalization, 128 flags 19638>2 beshort 0x0B 7-bit, capitalization, 128 flags 19639>2 beshort 0x0C 8-bit, no capitalization, 256 flags 19640>2 beshort 0x0D 7-bit, no capitalization, 256 flags 19641>2 beshort 0x0E 8-bit, capitalization, 256 flags 19642>2 beshort 0x0F 7-bit, capitalization, 256 flags 19643>4 beshort >0 and %d string characters 19644# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 19645# Ispell 4.0 196460 string ISPL ispell 19647>4 long x hash file version %d, 19648>8 long x lexletters %d, 19649>12 long x lexsize %d, 19650>16 long x hashsize %d, 19651>20 long x stblsize %d 19652 19653#------------------------------------------------------------------------------ 19654# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ 19655# ISO Zipped file format 19656# https://www.ezbsystems.com/isz/iszspec.txt 196570 string IsZ! ISO Zipped file 19658>4 byte x \b, header size %u 19659>5 byte x \b, version %u 19660>8 lelong x \b, serial %u 19661#12 leshort x \b, sector size %u 19662#>16 lelong x \b, total sectors %u 19663>17 byte >0 \b, password protected 19664#>24 lequad x \b, segment size %llu 19665#>32 lelong x \b, blocks %u 19666#>36 lelong x \b, block size %u 19667 19668#------------------------------------------------------------ 19669# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 19670# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 19671# same magic number, 0xcafebabe, so they are both handled 19672# in the entry called "cafebabe". 19673#------------------------------------------------------------ 19674# Java serialization 19675# From Martin Pool (m.pool@pharos.com.au) 196760 beshort 0xaced Java serialization data 19677>2 beshort >0x0004 \b, version %d 19678 196790 belong 0xfeedfeed Java KeyStore 19680!:mime application/x-java-keystore 196810 belong 0xcececece Java JCE KeyStore 19682!:mime application/x-java-jce-keystore 19683 19684# Java source 196850 regex \^import.*;$ Java source 19686!:mime text/x-java 19687 19688# Java HPROF dumps 19689# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 196900 string JAVA\x20PROFILE\x201.0. 19691>0x12 byte 0 19692>>0x11 ubyte-0x31 <2 Java HPROF dump, 19693>>>0x17 beqdate/1000 x created %s 19694 19695# Java jmod module 19696# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 19697# Grr. 2 byte magic "JM", really? In 2019? 196980 belong 0x4a4d0100 Java jmod module version 1.0 19699!:mime application/x-java-jmod 19700 19701# Java jlinked image 19702# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 197030 belong 0xcafedada Java module image (big endian) 19704>4 beshort >0x00 \b, version %d 19705>6 beshort x \b.%d 19706!:mime application/x-java-image 19707 197080 lelong 0xcafedada Java module image (little endian) 19709>6 leshort >0x00 \b, version %d 19710>4 leshort x \b.%d 19711!:mime application/x-java-image 19712 19713#------------------------------------------------------------------------------ 19714# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $ 19715# javascript: magic for javascript and node.js scripts. 19716# 197170 search/1/w #!/bin/node Node.js script text executable 19718!:mime application/javascript 197190 search/1/w #!/usr/bin/node Node.js script text executable 19720!:mime application/javascript 197210 search/1/w #!/bin/nodejs Node.js script text executable 19722!:mime application/javascript 197230 search/1/w #!/usr/bin/nodejs Node.js script text executable 19724!:mime application/javascript 197250 search/1 #!/usr/bin/env\ node Node.js script text executable 19726!:mime application/javascript 197270 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 19728!:mime application/javascript 19729# Hermes by Facebook https://hermesengine.dev/ 19730# https://github.com/facebook/hermes/blob/master/include/hermes/\ 19731# BCGen/HBC/BytecodeFileFormat.h#L24 197320 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode 19733>8 lelong x \b, version %d 19734 19735#------------------------------------------------------------------------------ 19736# $File: jpeg,v 1.33 2021/03/21 15:04:50 christos Exp $ 19737# JPEG images 19738# SunOS 5.5.1 had 19739# 19740# 0 string \377\330\377\340 JPEG file 19741# 0 string \377\330\377\356 JPG file 19742# 19743# both of which turn into "JPEG image data" here. 19744# 197450 beshort 0xffd8 JPEG image data 19746!:mime image/jpeg 19747!:apple 8BIMJPEG 19748!:strength *3 19749!:ext jpeg/jpg/jpe/jfif 19750>6 string JFIF \b, JFIF standard 19751# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 19752# in a vain attempt to add image size reporting for JFIF. Note that these 19753# tests are not fool-proof since some perfectly valid JPEGs are currently 19754# impossible to specify in magic(4) format. 19755# First, a little JFIF version info: 19756>>11 byte x \b %d. 19757>>12 byte x \b%02d 19758# Next, the resolution or aspect ratio of the image: 19759>>13 byte 0 \b, aspect ratio 19760>>13 byte 1 \b, resolution (DPI) 19761>>13 byte 2 \b, resolution (DPCM) 19762>>14 beshort x \b, density %dx 19763>>16 beshort x \b%d 19764>>4 beshort x \b, segment length %d 19765# Next, show thumbnail info, if it exists: 19766>>18 byte !0 \b, thumbnail %dx 19767>>>19 byte x \b%d 19768>6 string Exif \b, Exif standard: [ 19769>>12 indirect/r x 19770>>12 string x \b] 19771 19772# Jump to the first segment 19773>(4.S+4) use jpeg_segment 19774 19775# This uses recursion... 197760 name jpeg_segment 19777>0 beshort 0xFFFE 19778# Recursion handled by FFE0 19779#>>(2.S+2) use jpeg_segment 19780>>2 pstring/HJ x \b, comment: "%s" 19781 19782>0 beshort 0xFFC0 19783>>(2.S+2) use jpeg_segment 19784>>4 byte x \b, baseline, precision %d 19785>>7 beshort x \b, %dx 19786>>5 beshort x \b%d 19787>>9 byte x \b, components %d 19788 19789>0 beshort 0xFFC1 19790>>(2.S+2) use jpeg_segment 19791>>4 byte x \b, extended sequential, precision %d 19792>>7 beshort x \b, %dx 19793>>5 beshort x \b%d 19794>>9 byte x \b, components %d 19795 19796>0 beshort 0xFFC2 19797>>(2.S+2) use jpeg_segment 19798>>4 byte x \b, progressive, precision %d 19799>>7 beshort x \b, %dx 19800>>5 beshort x \b%d 19801>>9 byte x \b, components %d 19802 19803# Define Huffman Tables 19804>0 beshort 0xFFC4 19805>>(2.S+2) use jpeg_segment 19806 19807>0 beshort 0xFFE1 19808# Recursion handled by FFE0 19809#>>(2.S+2) use jpeg_segment 19810>>4 string Exif \b, Exif Standard: [ 19811>>>10 indirect/r x 19812>>>10 string x \b] 19813 19814# Application specific markers 19815>0 beshort&0xFFE0 =0xFFE0 19816>>(2.S+2) use jpeg_segment 19817 19818# DB: Define Quantization tables 19819# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 19820# D8: Start of image 19821# D9: End of image 19822# Dn: Restart 19823>0 beshort&0xFFD0 =0xFFD0 19824>>0 beshort&0xFFE0 !0xFFE0 19825>>>(2.S+2) use jpeg_segment 19826 19827#>0 beshort x unknown 0x%x 19828#>>(2.S+2) use jpeg_segment 19829 19830# HSI is Handmade Software's proprietary JPEG encoding scheme 198310 string hsi1 JPEG image data, HSI proprietary 19832 19833# From: David Santinoli <david@santinoli.com> 198340 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 19835# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 19836# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 19837# https://github.com/bitsgalore/jp2kMagic 19838# 19839# Now read value of 'Brand' field, which yields a few possibilities: 19840>20 string \x6a\x70\x32\x20 Part 1 (JP2) 19841!:mime image/jp2 19842>20 string \x6a\x70\x78\x20 Part 2 (JPX) 19843!:mime image/jpx 19844>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 19845!:mime image/jpm 19846>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 19847!:mime video/mj2 19848 19849# Type: JPEG 2000 codesream 19850# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 198510 belong 0xff4fff51 JPEG 2000 codestream 1985245 beshort 0xff52 19853 19854# JPEG extended range 198550 string \x49\x49\xbc 19856>3 byte 1 19857>>4 lelong%2 0 JPEG-XR 19858!:mime image/jxr 19859!:ext jxr 19860 19861# JPEG XL 19862# From: Ian Tester 198630 string \xff\x0a JPEG XL codestream 19864!:mime image/jxl 19865!:ext jxl 19866 19867# JPEG XL (transcoded JPEG file) 198680 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container 19869!:mime image/jxl 19870!:ext jxl 19871 19872#------------------------------------------------------------------------------ 19873# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 19874# karma: file(1) magic for Karma data files 19875# 19876# From <rgooch@atnf.csiro.au> 19877 198780 string KarmaRHD\040Version Karma Data Structure Version 19879>16 belong x %u 19880 19881#------------------------------------------------------------------------------ 19882# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 19883# kde: file(1) magic for KDE 19884 198850 string/t [KDE\ Desktop\ Entry] KDE desktop entry 19886!:mime application/x-kdelnk 198870 string/t #\ KDE\ Config\ File KDE config file 19888!:mime application/x-kdelnk 198890 string/t #\ xmcd xmcd database file for kscd 19890!:mime text/x-xmcd 19891 19892#------------------------------------------------------------------------------ 19893# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ 19894# keepass: file(1) magic for KeePass file 19895# 19896# Keepass Password Safe: 19897# * original one: https://keepass.info/ 19898# * *nix port: https://www.keepassx.org/ 19899# * android port: https://code.google.com/p/keepassdroid/ 19900 199010 lelong 0x9AA2D903 Keepass password database 19902>4 lelong 0xB54BFB65 1.x KDB 19903>>48 lelong >0 \b, %d groups 19904>>52 lelong >0 \b, %d entries 19905>>8 lelong&0x0f 1 \b, SHA-256 19906>>8 lelong&0x0f 2 \b, AES 19907>>8 lelong&0x0f 4 \b, RC4 19908>>8 lelong&0x0f 8 \b, Twofish 19909>>120 lelong >0 \b, %d key transformation rounds 19910>4 lelong 0xB54BFB67 2.x KDBX 19911 19912#------------------------------------------------------------------------------ 19913# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ 19914# kerberos: MIT kerberos file binary formats 19915# 19916 19917# This magic entry is for demonstration purposes and could be improved 19918# if the following features were implemented in file: 19919# 19920# Strings inside [[ .. ]] in the descriptions have special meanings and 19921# are not printed. 19922# 19923# - Provide some form of iteration in number of components 19924# [[${counter}=%d]] in the description 19925# then append 19926# [${counter}--] in the offset of the entries 19927# - Provide a way to round the next offset 19928# Add [R:4] after the offset? 19929# - Provide a way to have optional entries 19930# XXX: Syntax: 19931# - Provide a way to "save" entries to print them later. 19932# if the description is [[${name}=%s]], then nothing is 19933# printed and a subsequent entry in the same magic file 19934# can refer to ${name} 19935# - Provide a way to format strings as hex values 19936# 19937# https://www.gnu.org/software/shishi/manual/html_node/\ 19938# The-Keytab-Binary-File-Format.html 19939# 19940 199410 name keytab_entry 19942#>0 beshort x \b, size=%d 19943#>2 beshort x \b, components=%d 19944>4 pstring/H x \b, realm=%s 19945>>&0 pstring/H x \b, principal=%s/ 19946>>>&0 pstring/H x \b%s 19947>>>>&0 belong x \b, type=%d 19948>>>>>&0 bedate x \b, date=%s 19949>>>>>>&0 byte x \b, kvno=%u 19950#>>>>>>>&0 pstring/H x 19951#>>>>>>>>&0 belong x 19952#>>>>>>>>>>&0 use keytab_entry 19953 199540 belong 0x05020000 Kerberos Keytab file 19955>4 use keytab_entry 19956 19957#------------------------------------------------------------------------------ 19958# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $ 19959# kicad: file(1) magic for KiCad files 19960# 19961# See 19962# 19963# http://kicad-pcb.org 19964# 19965 19966# KiCad Schematic Document 199670 string (kicad_sch 19968>10 byte 0x20 KiCad Schematic Document 19969!:ext kicad_sch/kicad_sch-bak 19970>>11 string (version 19971>>>19 byte 0x20 19972>>>>20 regex [0-9.]+ (Version %s) 19973 19974# KiCad Schematic Document (Legacy) 199750 string EESchema 19976>8 byte 0x20 19977>>9 string Schematic 19978>>>18 byte 0x20 KiCad Schematic Document (Legacy) 19979!:ext sch/bak 19980>>>>24 string Version 19981>>>>>31 byte 0x20 19982>>>>>>32 string x (Version %s) 19983 19984# KiCad Symbol Library 199850 string (kicad_symbol_lib 19986>17 byte 0x20 KiCad Symbol Library 19987!:ext kicad_sym 19988>>18 string (version 19989>>>26 byte 0x20 19990>>>>27 regex [0-9.]+ (Version %s) 19991 19992# KiCad Symbol Library (Legacy) 199930 string EESchema-LIBRARY 19994>16 byte 0x20 KiCad Symbol Library (Legacy) 19995!:ext lib 19996>>17 string Version 19997>>>24 byte 0x20 19998>>>>25 string x (Version %s) 19999 20000# KiCad Symbol Library Documentation (Legacy) 200010 string EESchema-DOCLIB 20002>15 byte 0x20 KiCad Symbol Library Documentation (Legacy) 20003!:ext dcm 20004>>17 string Version 20005>>>24 byte 0x20 20006>>>>25 string x (Version %s) 20007 20008# KiCad Board Layout 200090 string (kicad_pcb 20010>10 byte 0x20 KiCad Board Layout 20011!:ext kicad_pcb/kicad_pcb-bak 20012>>11 string (version 20013>>>19 byte 0x20 20014>>>>20 regex [0-9.]+ (Version %s) 20015 20016# KiCad Footprint 200170 string (module 20018>7 byte 0x20 KiCad Footprint 20019!:ext kicad_mod 20020 20021# KiCad Footprint (Legacy) 200220 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) 20023!:ext mod 20024 20025# KiCad Netlist 200260 string (export 20027>7 byte 0x20 KiCad Netlist 20028!:ext net 20029 20030# KiCad Symbol Library Table 200310 string (sym_lib_table 20032>14 byte 0xA KiCad Symbol Library Table 20033>14 byte 0xD KiCad Symbol Library Table 20034>14 byte 0x20 KiCad Symbol Library Table 20035 20036# KiCad Footprint Library Table 200370 string (fp_lib_table 20038>13 byte 0xA KiCad Footprint Library Table 20039>13 byte 0xD KiCad Footprint Library Table 20040>13 byte 0x20 KiCad Footprint Library Table 20041 20042#------------------------------------------------------------------------------ 20043# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $ 20044# Type: Google KML, formerly Keyhole Markup Language 20045# Future development of this format has been handed 20046# over to the Open Geospatial Consortium. 20047# https://www.opengeospatial.org/standards/kml/ 20048# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 200490 string/t \<?xml 20050>20 search/400 \ xmlns= 20051>>&0 regex ['"]http://earth.google.com/kml Google KML document 20052!:mime application/vnd.google-earth.kml+xml 20053>>>&1 string 2.0' \b, version 2.0 20054>>>&1 string 2.1' \b, version 2.1 20055>>>&1 string 2.2' \b, version 2.2 20056 20057#------------------------------------------------------------------------------ 20058# Type: OpenGIS KML, formerly Keyhole Markup Language 20059# This standard is maintained by the 20060# Open Geospatial Consortium. 20061# https://www.opengeospatial.org/standards/kml/ 20062# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 20063>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 20064!:mime application/vnd.google-earth.kml+xml 20065>>>&1 string/t 2.2 \b, version 2.2 20066 20067#------------------------------------------------------------------------------ 20068# Type: Google KML Archive (ZIP based) 20069# https://code.google.com/apis/kml/documentation/kml_tut.html 20070# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 200710 string PK\003\004 20072>4 byte 0x14 20073>>30 string doc.kml Compressed Google KML Document, including resources. 20074!:mime application/vnd.google-earth.kmz 20075#------------------------------------------------------------------------------ 20076# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $ 20077# 20078 20079# Magic file patterns for use with file(1) for the 20080# LAMMPS molecular dynamics simulation software. 20081# https://lammps.sandia.gov 20082# 20083# Updated: 2021-03-14 by akohlmey@gmail.com 20084 20085# Binary restart file for the LAMMPS MD code 200860 string LammpS\ RestartT LAMMPS binary restart file 20087>0x14 long x (rev %d), 20088>>0x20 string x Version %s, 20089>>>0x10 lelong 0x0001 Little Endian 20090>>>0x10 lelong 0x1000 Big Endian 20091 20092# Atom style binary dump file for the LAMMPS MD code 20093# written on a little endian machine 200940 lequad -8 20095>0x08 string DUMPATOM LAMMPS atom style binary dump 20096>>0x14 long x (rev %d), 20097>>>0x10 lelong 0x0001 Little Endian, 20098>>>>0x18 lequad x First time step: %lld 20099 20100# written on a big endian machine 201010 bequad -8 20102>0x08 string DUMPATOM LAMMPS atom style binary dump 20103>>0x14 belong x (rev %d), 20104>>>0x10 lelong 0x1000 Big Endian, 20105>>>>0x18 bequad x First time step: %lld 20106 20107# Atom style binary dump file for the LAMMPS MD code 20108# written on a little endian machine 201090 lequad -10 20110>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 20111>>0x16 lelong x (rev %d), 20112>>>0x12 lelong 0x0001 Little Endian, 20113>>>>0x1a lequad x First time step: %lld 20114 20115# written on a big endian machine 201160 bequad -10 20117>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 20118>>0x16 belong x (rev %d), 20119>>>0x12 lelong 0x1000 Big Endian, 20120>>>>0x1a bequad x First time step: %lld 20121 20122# LAMMPS log file 201230 string LAMMPS\ ( LAMMPS log file 20124>8 regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+ written by version %s 20125 20126# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools 201270 string LAMMPS\ data\ file LAMMPS data file 20128>0x12 string CGCMM\ style written by TopoTools 20129>0x12 string msi2lmp written by msi2lmp 20130>0x11 string via\ write_data written by LAMMPS 20131 20132# LAMMPS data file written by OVITO 201330 string #\ LAMMPS\ data\ file LAMMPS data file 20134>0x13 string written\ by\ OVITO written by OVITO 20135 20136# LAMMPS text mode dump file 201370 string ITEM:\ TIMESTEP LAMMPS text mode dump, 20138>15 regex/16 [0-9]+ First time step: %s 20139 20140#------------------------------------------------------------------------------ 20141# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 20142# DEC SRC Virtual Paper: Lectern files 20143# Karl M. Hegbloom <karlheg@inetarena.com> 201440 string lect DEC SRC Virtual Paper Lectern file 20145 20146#------------------------------------------------------------------------------ 20147# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 20148# lex: file(1) magic for lex 20149# 20150# derived empirically, your offsets may vary! 201510 search/100 yyprevious C program text (from lex) 20152>3 search/1 >\0 for %s 20153# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 201540 search/100 generated\ by\ flex C program text (from flex) 20155# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 201560 search/1 %{ lex description text 20157 20158#------------------------------------------------------------------------------ 20159# $File: lif,v 1.9 2021/02/26 03:13:48 christos Exp $ 20160# lif: file(1) magic for lif 20161# 20162# (Daniel Quinlan <quinlan@yggdrasil.com>) 20163# 20164# Modified by: Joerg Jenderek 20165# URL: https://www.hp9845.net/9845/projects/hpdir/ 20166# https://github.com/bug400/lifutils 20167# Reference: https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf 20168# Note: called by TrID "HP Logical Interchange Format disk image" 201690 beshort 0x8000 20170# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1 20171# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes 20172>14 beshort =0 20173# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number 20174>>20 ubeshort <0x0100 20175# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name 20176#>>>2 ubelong >0x2020201F 20177>>>0 use lif-file 201780 name lif-file 20179# LIF ID 20180>0 beshort x lif file 20181!:mime application/x-lif-disk 20182# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir 20183!:ext lif/hpi/dat 20184# volume label; A-Z 0-9 _ ; default are 6 spaces 20185>2 string x "%.6s" 20186# version number; 0 for systems without extensions or 1 for model 64000 20187>20 ubeshort x \b, version %u 20188# LIF identifier; 010000 for system 3000 20189>12 beshort !0x1000 \b, LIF identifier 0x%x 20190# directory start address in units like: 2 20191>8 ubelong x \b, directory 20192>8 ubelong !2 start address %u 20193# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80 20194>16 ubelong x length %u 20195# level 1 extensions 20196>20 beshort =0 20197>>24 ubequad !0 \b, for extensions 0x%llx... 20198>20 beshort >0 20199>>24 ubequad !0 \b, extensions 0x%llx... 20200# word 21-126 reserved for extensions and future use; set to nil 20201>42 ubequad !0 \b, RESERVED 0x%llx 20202# lif first file name for standard directory; 0xffff... means uninitialized 20203>8 ubelong 2 20204>>512 string <\xff\xff \b, 1st file %-.10s 20205 20206 20207#------------------------------------------------------------------------------ 20208# $File: linux,v 1.77 2021/02/24 23:05:02 christos Exp $ 20209# linux: file(1) magic for Linux files 20210# 20211# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 20212# The following basic Linux magic is useful for reference, but using 20213# "long" magic is a better practice in order to avoid collisions. 20214# 20215# 2 leshort 100 Linux/i386 20216# >0 leshort 0407 impure executable (OMAGIC) 20217# >0 leshort 0410 pure executable (NMAGIC) 20218# >0 leshort 0413 demand-paged executable (ZMAGIC) 20219# >0 leshort 0314 demand-paged executable (QMAGIC) 20220# 202210 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 20222>16 lelong 0 \b, stripped 202230 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 20224>16 lelong 0 \b, stripped 202250 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 20226>16 lelong 0 \b, stripped 202270 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 20228>16 lelong 0 \b, stripped 20229# 202300 string \007\001\000 Linux/i386 object file 20231>20 lelong >0x1020 \b, DLL library 20232# Linux-8086 stuff: 202330 string \01\03\020\04 Linux-8086 impure executable 20234>28 long !0 not stripped 202350 string \01\03\040\04 Linux-8086 executable 20236>28 long !0 not stripped 20237# 202380 string \243\206\001\0 Linux-8086 object file 20239# 202400 string \01\03\020\20 Minix-386 impure executable 20241>28 long !0 not stripped 202420 string \01\03\040\20 Minix-386 executable 20243>28 long !0 not stripped 202440 string \01\03\04\20 Minix-386 NSYM/GNU executable 20245>28 long !0 not stripped 20246# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 20247216 lelong 0421 Linux/i386 core file 20248!:strength / 2 20249>220 string >\0 of '%s' 20250>200 lelong >0 (signal %d) 20251# 20252# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 20253# this can be overridden by the DOS executable (COM) entry 202542 string LILO Linux/i386 LILO boot/chain loader 20255# 20256# Linux make config build file, from Ole Aamot <oka@oka.no> 20257# Updated by Ken Sharp 2025828 string make\ config Linux make config build file (old) 2025949 search/70 Kernel\ Configuration Linux make config build file 20260 20261# 20262# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 20263# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 20264# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 202650 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 20266>2 byte&0x01 0 256 characters, 20267>2 byte&0x01 !0 512 characters, 20268>2 byte&0x02 0 no directory, 20269>2 byte&0x02 !0 Unicode directory, 20270>3 byte >0 8x%d 202710 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 20272>16 lelong x %d characters, 20273>12 lelong&0x01 0 no directory, 20274>12 lelong&0x01 !0 Unicode directory, 20275>24 lelong x %d 20276>28 lelong x \bx%d 20277 20278# Linux swap and hibernate files 20279# Linux kernel: include/linux/swap.h 20280# util-linux: libblkid/src/superblocks/swap.c 20281 20282# format v0, unsupported since 2002 202830xff6 string SWAP-SPACE Linux old swap file, 4k page size 202840x1ff6 string SWAP-SPACE Linux old swap file, 8k page size 202850x3ff6 string SWAP-SPACE Linux old swap file, 16k page size 202860x7ff6 string SWAP-SPACE Linux old swap file, 32k page size 202870xfff6 string SWAP-SPACE Linux old swap file, 64k page size 20288 20289# format v1, supported since 1998 202900 name linux-swap 20291>0x400 lelong 1 little endian, version %u, 20292>>0x404 lelong x size %u pages, 20293>>0x408 lelong x %u bad pages, 20294>0x400 belong 1 big endian, version %u, 20295>>0x404 belong x size %u pages, 20296>>0x408 belong x %u bad pages, 20297>0x41c string \0 no label, 20298>0x41c string >\0 LABEL=%s, 20299>0x40c belong x UUID=%08x 20300>0x410 beshort x \b-%04x 20301>0x412 beshort x \b-%04x 20302>0x414 beshort x \b-%04x 20303>0x416 belong x \b-%08x 20304>0x41a beshort x \b%04x 20305 203060xff6 string SWAPSPACE2 Linux swap file, 4k page size, 20307>0 use linux-swap 203080x1ff6 string SWAPSPACE2 Linux swap file, 8k page size, 20309>0 use linux-swap 203100x3ff6 string SWAPSPACE2 Linux swap file, 16k page size, 20311>0 use linux-swap 203120x7ff6 string SWAPSPACE2 Linux swap file, 32k page size, 20313>0 use linux-swap 203140xfff6 string SWAPSPACE2 Linux swap file, 64k page size, 20315>0 use linux-swap 20316 203170 name linux-hibernate 20318>0 string S1SUSPEND \b, with SWSUSP1 image 20319>0 string S2SUSPEND \b, with SWSUSP2 image 20320>0 string ULSUSPEND \b, with uswsusp image 20321>0 string LINHIB0001 \b, with compressed hibernate image 20322>0 string \xed\xc3\x02\xe9\x98\x56\xe5\x0c \b, with tuxonice image 20323>0 default x \b, with unknown hibernate image 20324 203250xfec string SWAPSPACE2 Linux swap file, 4k page size, 20326>0 use linux-swap 20327>0xff6 use linux-hibernate 203280x1fec string SWAPSPACE2 Linux swap file, 8k page size, 20329>0 use linux-swap 20330>0x1ff6 use linux-hibernate 203310x3fec string SWAPSPACE2 Linux swap file, 16k page size, 20332>0 use linux-swap 20333>0x3ff6 use linux-hibernate 203340x7fec string SWAPSPACE2 Linux swap file, 32k page size, 20335>0 use linux-swap 20336>0x7ff6 use linux-hibernate 203370xffec string SWAPSPACE2 Linux swap file, 64k page size, 20338>0 use linux-swap 20339>0xfff6 use linux-hibernate 20340 20341# 20342# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 20343# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 20344# and Nicolas Lichtmaier <nick@debian.org> 20345# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 20346# Linux kernel boot images (i386 arch) (Wolfram Kleff) 20347# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 20348514 string HdrS Linux kernel 20349!:strength + 55 20350# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes 20351# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin 20352# DamnSmallLinux 1.5 damnsmll.lnx 20353!:ext /dat/bin/lnx 20354>510 leshort 0xAA55 x86 boot executable 20355>>518 leshort >0x1ff 20356>>>529 byte 0 zImage, 20357>>>529 byte 1 bzImage, 20358>>>526 lelong >0 20359>>>>(526.s+0x200) string >\0 version %s, 20360>>498 leshort 1 RO-rootFS, 20361>>498 leshort 0 RW-rootFS, 20362>>508 leshort >0 root_dev 0x%X, 20363>>502 leshort >0 swap_dev 0x%X, 20364>>504 leshort >0 RAMdisksize %u KB, 20365>>506 leshort 0xFFFF Normal VGA 20366>>506 leshort 0xFFFE Extended VGA 20367>>506 leshort 0xFFFD Prompt for Videomode 20368>>506 leshort >0 Video mode %d 20369# This also matches new kernels, which were caught above by "HdrS". 203700 belong 0xb8c0078e Linux kernel 20371>0x1e3 string Loading version 1.3.79 or older 20372>0x1e9 string Loading from prehistoric times 20373 20374# System.map files - Nicolas Lichtmaier <nick@debian.org> 203758 search/1 \ A\ _text Linux kernel symbol map text 20376 20377# LSM entries - Nicolas Lichtmaier <nick@debian.org> 203780 search/1 Begin3 Linux Software Map entry text 203790 search/1 Begin4 Linux Software Map entry text (new format) 20380 20381# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 203820 belong 0x4f4f4f4d User-mode Linux COW file 20383>4 belong <3 \b, version %d 20384>>8 string >\0 \b, backing file %s 20385>4 belong >2 \b, version %d 20386>>32 string >\0 \b, backing file %s 20387 20388############################################################################ 20389# Linux kernel versions 20390 203910 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 20392>497 leshort 0 x86 boot sector 20393>>514 belong 0x8e of a kernel from the dawn of time! 20394>>514 belong 0x908ed8b4 version 0.99-1.1.42 20395>>514 belong 0x908ed8b8 for memtest86 20396 20397>497 leshort !0 x86 kernel 20398>>504 leshort >0 RAMdisksize=%u KB 20399>>502 leshort >0 swap=0x%X 20400>>508 leshort >0 root=0x%X 20401>>>498 leshort 1 \b-ro 20402>>>498 leshort 0 \b-rw 20403>>506 leshort 0xFFFF vga=normal 20404>>506 leshort 0xFFFE vga=extended 20405>>506 leshort 0xFFFD vga=ask 20406>>506 leshort >0 vga=%d 20407>>514 belong 0x908ed881 version 1.1.43-1.1.45 20408>>514 belong 0x15b281cd 20409>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 20410>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 20411>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 20412>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 20413>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 20414>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 20415>>514 string HdrS 20416>>>518 leshort >0x1FF 20417>>>>529 byte 0 \b, zImage 20418>>>>529 byte 1 \b, bzImage 20419>>>>(526.s+0x200) string >\0 \b, version %s 20420 20421# Linux boot sector thefts. 204220 belong 0xb8c0078e Linux 20423>0x1e6 belong 0x454c4b53 ELKS Kernel 20424>0x1e6 belong !0x454c4b53 style boot sector 20425 20426############################################################################ 20427# Linux S390 kernel image 20428# Created by: Jan Kaluza <jkaluza@redhat.com> 204298 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 20430>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 20431# 64bit 20432>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 20433>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 20434>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 20435>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 20436# 32bit 20437>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 20438>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 20439>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 20440>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 20441 20442############################################################################ 20443# Linux ARM compressed kernel image 20444# From: Kevin Cernekee <cernekee@gmail.com> 20445# Update: Joerg Jenderek 204460x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage 20447# There are three possible situations: LE, BE with LE bootloader and pure BE. 20448# In order to aid telling these apart a new endian flag was added. In order 20449# to support kernels before the flag and BE with LE bootloader was added we'll 20450# do a negative check against the BE variant of the flag when we see a LE magic. 20451>0x30 belong !0x04030201 (little-endian) 20452# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" 20453!:ext img/bin 20454>0x30 belong 0x04030201 (big-endian) 204550x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 20456 20457############################################################################ 20458# Linux AARCH64 kernel image 204590x38 lelong 0x644d5241 Linux kernel ARM64 boot executable Image 20460>0x18 lelong ^1 \b, little-endian 20461>0x18 lelong &1 \b, big-endian 20462>0x18 lelong &2 \b, 4K pages 20463>0x18 lelong &4 \b, 16K pages 20464>0x18 lelong &6 \b, 32K pages 20465 20466############################################################################ 20467# Linux 8086 executable 204680 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 20469>5 string . 20470>>4 string >\0 \b, libc version %s 20471 204720 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 20473>2 byte&0x01 !0 \b, unmapped zero page 20474>2 byte&0x20 0 \b, impure 20475>2 byte&0x20 !0 20476>>2 byte&0x10 !0 \b, A_EXEC 20477>2 byte&0x02 !0 \b, A_PAL 20478>2 byte&0x04 !0 \b, A_NSYM 20479>2 byte&0x08 !0 \b, A_STAND 20480>2 byte&0x40 !0 \b, A_PURE 20481>2 byte&0x80 !0 \b, A_TOVLY 20482>28 long !0 \b, not stripped 20483>37 string . 20484>>36 string >\0 \b, libc version %s 20485 20486# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 20487# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 20488# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 20489# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 20490 20491# SYSLINUX boot logo files (from 'ppmtolss16' sources) 20492# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 20493# file extension .lss .16 204940 lelong =0x1413f33d SYSLINUX' LSS16 image data 20495# syslinux-4.05/mime/image/x-lss16.xml 20496!:mime image/x-lss16 20497>4 leshort x \b, width %d 20498>6 leshort x \b, height %d 20499 205000 string OOOM User-Mode-Linux's Copy-On-Write disk image 20501>4 belong x version %d 20502 20503# SE Linux policy database 20504# From: Mike Frysinger <vapier@gentoo.org> 205050 lelong 0xf97cff8c SE Linux policy 20506>16 lelong x v%d 20507>20 lelong 1 MLS 20508>24 lelong x %d symbols 20509>28 lelong x %d ocons 20510 20511# Linux Logical Volume Manager (LVM) 20512# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 20513# 20514# System ID, UUID and volume group name are 128 bytes long 20515# but they should never be full and initialized with zeros... 20516# 20517# LVM1 20518# 205190x0 string/b HM\001 LVM1 (Linux Logical Volume Manager), version 1 20520>0x12c string/b >\0 , System ID: %s 20521 205220x0 string/b HM\002 LVM1 (Linux Logical Volume Manager), version 2 20523>0x12c string/b >\0 , System ID: %s 20524 20525# LVM2 20526# 20527# It seems that the label header can be in one the four first sector 20528# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 20529# 20530# 0x200 seems to be the common case 205310 name lvm2 20532# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 20533>0x0 string >\x2f \b, UUID: %.6s 20534>0x6 string >\x2f \b-%.4s 20535>0xa string >\x2f \b-%.4s 20536>0xe string >\x2f \b-%.4s 20537>0x12 string >\x2f \b-%.4s 20538>0x16 string >\x2f \b-%.4s 20539>0x1a string >\x2f \b-%.6s 20540>0x20 lequad x \b, size: %lld 20541 20542 20543# read the offset to add to the start of the header, and the header 20544# start in 0x200 205450x218 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20546>&(&-12.l-0x20) use lvm2 20547 205480x018 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20549>&(&-12.l-0x20) use lvm2 20550 205510x418 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20552>&(&-12.l-0x20) use lvm2 20553 205540x618 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20555>&(&-12.l-0x20) use lvm2 20556 20557# LVM snapshot 20558# from Jason Farrel 205590 string SnAp LVM Snapshot (CopyOnWrite store) 20560>4 lelong !0 - valid, 20561>4 lelong 0 - invalid, 20562>8 lelong x version %d, 20563>12 lelong x chunk_size %d 20564 20565# SE Linux policy database 205660 lelong 0xf97cff8c SE Linux policy 20567>16 lelong x v%d 20568>20 lelong 1 MLS 20569>24 lelong x %d symbols 20570>28 lelong x %d ocons 20571 20572# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 20573# Anthon van der Neut (anthon@mnt.org) 205740 string LUKS\xba\xbe LUKS encrypted file, 20575>6 beshort x ver %d 20576>8 string x [%s, 20577>40 string x %s, 20578>72 string x %s] 20579>168 string x UUID: %s 20580 20581 20582# Summary: Xen saved domain file 20583# Created by: Radek Vokal <rvokal@redhat.com> 205840 string LinuxGuestRecord Xen saved domain 20585>20 search/256 (name 20586>>&1 string x (name %s) 20587 20588# Type: Xen, the virtual machine monitor 20589# From: Radek Vokal <rvokal@redhat.com> 205900 string LinuxGuestRecord Xen saved domain 20591#>2 regex \(name\ [^)]*\) %s 20592>20 search/256 (name (name 20593>>&1 string x %s...) 20594 20595# Systemd journald files 20596# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. 20597# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 20598 20599# check magic 206000 string LPKSHHRH 20601# check that state is one of known values 20602>16 ubyte&252 0 20603# check that each half of three unique id128s is non-zero 20604>>24 ubequad >0 20605>>>32 ubequad >0 20606>>>>40 ubequad >0 20607>>>>>48 ubequad >0 20608>>>>>>56 ubequad >0 20609>>>>>>>64 ubequad >0 Journal file 20610!:mime application/octet-stream 20611# provide more info 20612>>>>>>>>184 leqdate 0 empty 20613>>>>>>>>16 ubyte 0 \b, offline 20614>>>>>>>>16 ubyte 1 \b, online 20615>>>>>>>>16 ubyte 2 \b, archived 20616>>>>>>>>8 ulelong&1 1 \b, sealed 20617>>>>>>>>12 ulelong&1 1 \b, compressed 20618 20619# BCache backing and cache devices 20620# From: Gabriel de Perthuis <g2p.code@gmail.com> 206210x1008 lequad 8 20622>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 20623>>0x1010 ulequad 0 cache device 20624>>0x1010 ulequad 1 backing device 20625>>0x1010 ulequad 3 cache device 20626>>0x1010 ulequad 4 backing device 20627>>0x1048 string >0 \b, label "%.32s" 20628>>0x1028 ubelong x \b, uuid %08x 20629>>0x102c ubeshort x \b-%04x 20630>>0x102e ubeshort x \b-%04x 20631>>0x1030 ubeshort x \b-%04x 20632>>0x1032 ubelong x \b-%08x 20633>>0x1036 ubeshort x \b%04x 20634>>0x1038 ubelong x \b, set uuid %08x 20635>>0x103c ubeshort x \b-%04x 20636>>0x103e ubeshort x \b-%04x 20637>>0x1040 ubeshort x \b-%04x 20638>>0x1042 ubelong x \b-%08x 20639>>0x1046 ubeshort x \b%04x 20640 20641# Linux device tree: 20642# File format description can be found in the Linux kernel sources at 20643# Documentation/devicetree/booting-without-of.txt 20644# From Christoph Biedl 206450 belong 0xd00dfeed 20646# structure must be within blob, strings are omitted to handle devicetrees > 1M 20647>&(8.L) byte x 20648>>20 belong >1 Device Tree Blob version %d 20649>>>4 belong x \b, size=%d 20650>>>20 belong >1 20651>>>>28 belong x \b, boot CPU=%d 20652>>>20 belong >2 20653>>>>32 belong x \b, string block size=%d 20654>>>20 belong >16 20655>>>>36 belong x \b, DT structure block size=%d 20656 20657# glibc locale archive as defined in glibc locale/locarchive.h 206580 lelong 0xde020109 locale archive 20659>24 lelong x %d strings 20660 20661# Linux Software RAID (mdadm) 20662# Russell Coker <russell@coker.com.au> 206630 name linuxraid 20664>16 belong x UUID=%8x: 20665>20 belong x \b%8x: 20666>24 belong x \b%8x: 20667>28 belong x \b%8x 20668>32 string x name=%s 20669>72 lelong x level=%d 20670>92 lelong x disks=%d 20671 206724096 lelong 0xa92b4efc Linux Software RAID 20673>4100 lelong x version 1.2 (%d) 20674>4096 use linuxraid 20675 206760 lelong 0xa92b4efc Linux Software RAID 20677>4 lelong x version 1.1 (%d) 20678>0 use linuxraid 20679 20680# Summary: Database file for mlocate 20681# Description: A database file as used by mlocate, a fast implementation 20682# of locate/updatedb. It uses merging to reuse the existing 20683# database and avoid rereading most of the filesystem. It's 20684# the default version of locate on Arch Linux (and others). 20685# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 20686# Site: https://fedorahosted.org/mlocate/ 20687# Format docs: https://linux.die.net/man/5/mlocate.db 20688# Type: mlocate database file 20689# URL: https://fedorahosted.org/mlocate/ 20690# From: Wander Nauta <info@wandernauta.nl> 206910 string \0mlocate mlocate database 20692>12 byte x \b, version %d 20693>13 byte 1 \b, require visibility 20694>16 string x \b, root %s 20695 20696# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 20697# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 20698# From: Pavel Emelyanov <xemul@parallels.com> 206990 lelong 0x45311224 iproute2 routes dump 207000 lelong 0x47361222 iproute2 addresses dump 20701 20702# Image and service files for CRIU tool. 20703# URL: https://criu.org 20704# From: Pavel Emelyanov <xemul@parallels.com> 207050 lelong 0x54564319 CRIU image file v1.1 207060 lelong 0x55105940 CRIU service file 207070 lelong 0x58313116 CRIU inventory 20708 20709# Kdump compressed dump files 20710# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 20711 207120 string KDUMP Kdump compressed dump 20713>8 long x v%d 20714>12 string >\0 \b, system %s 20715>77 string >\0 \b, node %s 20716>142 string >\0 \b, release %s 20717>207 string >\0 \b, version %s 20718>272 string >\0 \b, machine %s 20719>337 string >\0 \b, domain %s 20720 20721# Device Tree files 207220 search/1024 /dts-v1/ Device Tree File (v1) 20723# beat c code 20724!:strength +14 20725 20726 20727# e2fsck undo file 20728# David Gilman <davidgilman1@gmail.com> 207290 string E2UNDO02 e2fsck undo file, version 2 20730>44 lelong x \b, undo file is 20731>>44 lelong&1 0 not finished 20732>>44 lelong&1 1 finished 20733>48 lelong x \b, undo file features: 20734>>48 lelong&1 0 lacks filesystem offset 20735>>48 lelong&1 1 has filesystem offset 20736>>>64 lequad x at 0x%llx 20737 20738# ansible vault (does not really belong here) 207390 string $ANSIBLE_VAULT; Ansible Vault 20740>&0 regex [0-9]*\.[0-9]* \b, version %s 20741>>&0 string ; 20742>>>&0 regex [A-Z0-9]* \b, encryption %s 20743 20744#------------------------------------------------------------------------------ 20745# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $ 20746# lisp: file(1) magic for lisp programs 20747# 20748# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 20749 20750# updated by Joerg Jenderek 20751# GRR: This lot is too weak 20752#0 string ;; 20753# windows INF files often begin with semicolon and use CRLF as line end 20754# lisp files are mainly created on unix system with LF as line end 20755#>2 search/4096 !\r Lisp/Scheme program text 20756#>2 search/4096 \r Windows INF file 20757 207580 search/4096 (setq\ Lisp/Scheme program text 20759!:mime text/x-lisp 207600 search/4096 (defvar\ Lisp/Scheme program text 20761!:mime text/x-lisp 207620 search/4096 (defparam\ Lisp/Scheme program text 20763!:mime text/x-lisp 207640 search/4096 (defun\ Lisp/Scheme program text 20765!:mime text/x-lisp 207660 search/4096 (autoload\ Lisp/Scheme program text 20767!:mime text/x-lisp 207680 search/4096 (custom-set-variables\ Lisp/Scheme program text 20769!:mime text/x-lisp 20770 20771# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 20772# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 20773# Update: Joerg Jenderek 20774# Emacs 18 - this is always correct, but not very magical. 207750 string \012( 20776# look for emacs lisp keywords 20777# GRR: split regex because it is too long or get error like 20778# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 20779>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 20780!:mime application/x-elc 20781# https://searchcode.com/codesearch/view/2173420/ 20782# not really pure text 20783!:apple EMAxTEXT 20784!:ext elc 20785# remaining regex 20786>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 20787!:mime application/x-elc 20788!:apple EMAxTEXT 20789!:ext elc 20790# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 20791 20792# Emacs 19+ - ver. recognition added by Ian Springer 20793# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 20794# - Chris Chittleborough <cchittleborough@yahoo.com.au> 20795# Update: Joerg Jenderek 207960 string ;ELC 20797# version\0\0\0 20798>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 20799# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 20800#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 20801!:mime application/x-elc 20802!:apple EMAxTEXT 20803!:ext elc 20804 20805# Files produced by GNU/Emacs pdumper 208060 string DUMPEDGNUEMACS GNU/Emacs pdumper image 20807 20808# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 208090 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 208100 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 20811 208120 long 0x70768BD2 CLISP memory image data 208130 long 0xD28B7670 CLISP memory image data, other endian 20814 20815#.com and .bin for MIT scheme 208160 string \372\372\372\372 MIT scheme (library?) 20817 20818# From: David Allouche <david@allouche.net> 208190 search/1 \<TeXmacs| TeXmacs document text 20820!:mime text/texmacs 20821 20822#------------------------------------------------------------------------------ 20823# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ 20824# llvm: file(1) magic for LLVM byte-codes 20825# URL: https://llvm.org/docs/BitCodeFormat.html 20826# From: Al Stone <ahs3@fc.hp.com> 20827 208280 string llvm LLVM byte-codes, uncompressed 208290 string llvc0 LLVM byte-codes, null compression 208300 string llvc1 LLVM byte-codes, gzip compression 208310 string llvc2 LLVM byte-codes, bzip2 compression 20832 208330 lelong 0x0b17c0de LLVM bitcode, wrapper 20834# Are these Mach-O ABI values? They appear to be. 20835>16 lelong 0x01000007 x86_64 20836>16 lelong 0x00000007 i386 20837>16 lelong 0x00000012 ppc 20838>16 lelong 0x01000012 ppc64 20839>16 lelong 0x0000000c arm 20840 208410 string BC\xc0\xde LLVM IR bitcode 20842 20843#------------------------------------------------------------------------------ 20844# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $ 20845# locoscript: file(1) magic for LocoScript documents and related files 20846# 20847# See http://fileformats.archiveteam.org/wiki/LocoScript 208480 string JOY\x01\x01 LocoScript 1 document 208490 string JOY\x01\x02 LocoScript 2 document 208500 string JOY\x01\x04 LocoScript 3 document 208510 string JOY\x01\x06 LocoScript 4 document 208520 string DOC\x01\x01 LocoScript PC document 208530 string DOC\x01\x03 LocoScript Professional document 20854 20855#------------------------------------------------------------------------------ 20856# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $ 20857# lua: file(1) magic for Lua scripting language 20858# URL: https://www.lua.org/ 20859# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 20860 20861# Lua scripts 208620 search/1/w #!\ /usr/bin/lua Lua script text executable 20863!:mime text/x-lua 208640 search/1/w #!\ /usr/local/bin/lua Lua script text executable 20865!:mime text/x-lua 208660 search/1 #!/usr/bin/env\ lua Lua script text executable 20867!:mime text/x-lua 208680 search/1 #!\ /usr/bin/env\ lua Lua script text executable 20869!:mime text/x-lua 20870 20871# Lua bytecode 208720 string \033Lua Lua bytecode, 20873# 2.4 uses 0x23 as its version byte because it shares the format 20874# with 2.3 (which was never released publicly). 20875>4 byte 0x23 version 2.4 20876>4 byte 0x25 version 2.5/3.0 20877>4 byte 0x31 version 3.1 20878>4 byte 0x32 version 3.2 20879>4 byte 0x40 version 4.0 20880>4 byte 0x50 version 5.0 20881>4 byte 0x51 version 5.1 20882>4 byte 0x52 version 5.2 20883>4 byte 0x53 version 5.3 20884>4 byte 0x54 version 5.4 20885 20886#------------------------------------------------------------------------------ 20887# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 20888# luks: file(1) magic for Linux Unified Key Setup 20889# URL: http://luks.endorphin.org/spec 20890# From: Anthon van der Neut <anthon@mnt.org> 20891 208920 string LUKS\xba\xbe LUKS encrypted file, 20893>6 beshort x ver %d 20894>8 string x [%s, 20895>40 string x %s, 20896>72 string x %s] 20897>168 string x UUID: %s 20898#------------------------------------------------------------------------------ 20899# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ 20900# make: file(1) magic for M4 scripts 20901# 209020 search/8192 dnl 20903>0 regex \^dnl\ M4 macro processor script text 20904!:mime text/x-m4 209050 search/8192 AC_DEFUN 20906>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 20907!:strength + 15 20908!:mime text/x-m4 20909 20910#------------------------------------------------------------ 20911# $File: mach,v 1.28 2020/12/12 20:01:47 christos Exp $ 20912# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 20913# Unfortunately the first, cafebabe, is shared with 20914# Java ByteCode, so they are both handled in the file "cafebabe". 20915# The "feedface" ones are handled herein. 20916#------------------------------------------------------------ 20917# if set, it's for the 64-bit version of the architecture 20918# yes, this is separate from the low-order magic number bit 20919# it's also separate from the "64-bit libraries" bit in the 20920# upper 8 bits of the CPU subtype 20921 20922# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 20923# include/mach-o/loader.h 20924# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 209250 name mach-o-cpu 20926>0 belong&0xff000000 0 20927# 20928# 32-bit ABIs. 20929# 20930# 1 vax 20931>>0 belong&0x00ffffff 1 20932>>>4 belong&0x00ffffff 0 vax 20933>>>4 belong&0x00ffffff 1 vax11/780 20934>>>4 belong&0x00ffffff 2 vax11/785 20935>>>4 belong&0x00ffffff 3 vax11/750 20936>>>4 belong&0x00ffffff 4 vax11/730 20937>>>4 belong&0x00ffffff 5 uvaxI 20938>>>4 belong&0x00ffffff 6 uvaxII 20939>>>4 belong&0x00ffffff 7 vax8200 20940>>>4 belong&0x00ffffff 8 vax8500 20941>>>4 belong&0x00ffffff 9 vax8600 20942>>>4 belong&0x00ffffff 10 vax8650 20943>>>4 belong&0x00ffffff 11 vax8800 20944>>>4 belong&0x00ffffff 12 uvaxIII 20945>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 20946>>0 belong&0x00ffffff 2 romp 20947>>0 belong&0x00ffffff 3 architecture=3 20948>>0 belong&0x00ffffff 4 ns32032 20949>>0 belong&0x00ffffff 5 ns32332 20950>>0 belong&0x00ffffff 6 m68k 20951# 7 x86 20952>>0 belong&0x00ffffff 7 20953>>>4 belong&0x0000000f 3 i386 20954>>>4 belong&0x0000000f 4 i486 20955>>>>4 belong&0x00fffff0 0 20956>>>>4 belong&0x00fffff0 0x80 \bsx 20957>>>4 belong&0x0000000f 5 i586 20958>>>4 belong&0x0000000f 6 20959>>>>4 belong&0x00fffff0 0 p6 20960>>>>4 belong&0x00fffff0 0x10 pentium_pro 20961>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 20962>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 20963>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 20964>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 20965>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 20966>>>4 belong&0x0000000f 7 celeron 20967>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 20968>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 20969>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 20970>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 20971>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 20972>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 20973>>>>4 belong&0x00fffff0 0x60 20974>>>>4 belong&0x00fffff0 0x70 \b_mobile 20975>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 20976>>>4 belong&0x0000000f 8 pentium_3 20977>>>>4 belong&0x00fffff0 0x00 20978>>>>4 belong&0x00fffff0 0x10 \b_m 20979>>>>4 belong&0x00fffff0 0x20 \b_xeon 20980>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 20981>>>4 belong&0x0000000f 9 pentiumM 20982>>>>4 belong&0x00fffff0 0x00 20983>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 20984>>>4 belong&0x0000000f 10 pentium_4 20985>>>>4 belong&0x00fffff0 0x00 20986>>>>4 belong&0x00fffff0 0x10 \b_m 20987>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20988>>>4 belong&0x0000000f 11 itanium 20989>>>>4 belong&0x00fffff0 0x00 20990>>>>4 belong&0x00fffff0 0x10 \b_2 20991>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20992>>>4 belong&0x0000000f 12 xeon 20993>>>>4 belong&0x00fffff0 0x00 20994>>>>4 belong&0x00fffff0 0x10 \b_mp 20995>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20996>>>4 belong&0x0000000f >12 ia32 family=%d 20997>>>>4 belong&0x00fffff0 0x00 20998>>>>4 belong&0x00fffff0 >0x00 model=%x 20999>>0 belong&0x00ffffff 8 mips 21000>>>4 belong&0x00ffffff 1 R2300 21001>>>4 belong&0x00ffffff 2 R2600 21002>>>4 belong&0x00ffffff 3 R2800 21003>>>4 belong&0x00ffffff 4 R2000a 21004>>>4 belong&0x00ffffff 5 R2000 21005>>>4 belong&0x00ffffff 6 R3000a 21006>>>4 belong&0x00ffffff 7 R3000 21007>>>4 belong&0x00ffffff >7 subarchitecture=%d 21008>>0 belong&0x00ffffff 9 ns32532 21009>>0 belong&0x00ffffff 10 mc98000 21010>>0 belong&0x00ffffff 11 hppa 21011>>>4 belong&0x00ffffff 0 7100 21012>>>4 belong&0x00ffffff 1 7100LC 21013>>>4 belong&0x00ffffff >1 subarchitecture=%d 21014>>0 belong&0x00ffffff 12 arm 21015>>>4 belong&0x00ffffff 0 21016>>>4 belong&0x00ffffff 1 subarchitecture=%d 21017>>>4 belong&0x00ffffff 2 subarchitecture=%d 21018>>>4 belong&0x00ffffff 3 subarchitecture=%d 21019>>>4 belong&0x00ffffff 4 subarchitecture=%d 21020>>>4 belong&0x00ffffff 5 \bv4t 21021>>>4 belong&0x00ffffff 6 \bv6 21022>>>4 belong&0x00ffffff 7 \bv5tej 21023>>>4 belong&0x00ffffff 8 \bxscale 21024>>>4 belong&0x00ffffff 9 \bv7 21025>>>4 belong&0x00ffffff 10 \bv7f 21026>>>4 belong&0x00ffffff 11 \bv7s 21027>>>4 belong&0x00ffffff 12 \bv7k 21028>>>4 belong&0x00ffffff 13 \bv8 21029>>>4 belong&0x00ffffff 14 \bv6m 21030>>>4 belong&0x00ffffff 15 \bv7m 21031>>>4 belong&0x00ffffff 16 \bv7em 21032>>>4 belong&0x00ffffff >16 subarchitecture=%d 21033# 13 m88k 21034>>0 belong&0x00ffffff 13 21035>>>4 belong&0x00ffffff 0 mc88000 21036>>>4 belong&0x00ffffff 1 mc88100 21037>>>4 belong&0x00ffffff 2 mc88110 21038>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 21039>>0 belong&0x00ffffff 14 SPARC 21040>>0 belong&0x00ffffff 15 i860g 21041>>0 belong&0x00ffffff 16 alpha 21042>>0 belong&0x00ffffff 17 rs6000 21043>>0 belong&0x00ffffff 18 ppc 21044>>>4 belong&0x00ffffff 0 21045>>>4 belong&0x00ffffff 1 \b_601 21046>>>4 belong&0x00ffffff 2 \b_602 21047>>>4 belong&0x00ffffff 3 \b_603 21048>>>4 belong&0x00ffffff 4 \b_603e 21049>>>4 belong&0x00ffffff 5 \b_603ev 21050>>>4 belong&0x00ffffff 6 \b_604 21051>>>4 belong&0x00ffffff 7 \b_604e 21052>>>4 belong&0x00ffffff 8 \b_620 21053>>>4 belong&0x00ffffff 9 \b_750 21054>>>4 belong&0x00ffffff 10 \b_7400 21055>>>4 belong&0x00ffffff 11 \b_7450 21056>>>4 belong&0x00ffffff 100 \b_970 21057>>>4 belong&0x00ffffff >100 subarchitecture=%d 21058>>0 belong&0x00ffffff >18 architecture=%d 21059>0 belong&0xff000000 0x01000000 21060# 21061# 64-bit ABIs. 21062# 21063>>0 belong&0x00ffffff 0 64-bit architecture=%d 21064>>0 belong&0x00ffffff 1 64-bit architecture=%d 21065>>0 belong&0x00ffffff 2 64-bit architecture=%d 21066>>0 belong&0x00ffffff 3 64-bit architecture=%d 21067>>0 belong&0x00ffffff 4 64-bit architecture=%d 21068>>0 belong&0x00ffffff 5 64-bit architecture=%d 21069>>0 belong&0x00ffffff 6 64-bit architecture=%d 21070>>0 belong&0x00ffffff 7 x86_64 21071>>>4 belong&0x00ffffff 0 subarchitecture=%d 21072>>>4 belong&0x00ffffff 1 subarchitecture=%d 21073>>>4 belong&0x00ffffff 2 subarchitecture=%d 21074>>>4 belong&0x00ffffff 3 21075>>>4 belong&0x00ffffff 4 \b_arch1 21076>>>4 belong&0x00ffffff 8 \b_haswell 21077>>>4 belong&0x00ffffff >4 subarchitecture=%d 21078>>0 belong&0x00ffffff 8 64-bit architecture=%d 21079>>0 belong&0x00ffffff 9 64-bit architecture=%d 21080>>0 belong&0x00ffffff 10 64-bit architecture=%d 21081>>0 belong&0x00ffffff 11 64-bit architecture=%d 21082>>0 belong&0x00ffffff 12 arm64 21083>>>4 belong&0x00ffffff 0 21084>>>4 belong&0x00ffffff 1 \bv8 21085>>>4 belong&0x00ffffff 2 \be 21086>>>>7 ubyte&0xff >0 (caps: 21087>>>>7 ubyte&0xff <0x80 0x%02x 21088>>>>7 ubyte&0xc0 0x80 PAC 21089>>>>>7 ubyte&0x3f x \b%02d 21090>>>>7 ubyte&0xc0 0xc0 PAK 21091>>>>>7 ubyte&0x3f x \b%02d 21092>>>>7 ubyte&0xff x \b) 21093>>>4 belong&0x00ffffff >2 subarchitecture=%d 21094>>0 belong&0x00ffffff 13 64-bit architecture=%d 21095>>0 belong&0x00ffffff 14 64-bit architecture=%d 21096>>0 belong&0x00ffffff 15 64-bit architecture=%d 21097>>0 belong&0x00ffffff 16 64-bit architecture=%d 21098>>0 belong&0x00ffffff 17 64-bit architecture=%d 21099>>0 belong&0x00ffffff 18 ppc64 21100>>>4 belong&0x00ffffff 0 21101>>>4 belong&0x00ffffff 1 \b_601 21102>>>4 belong&0x00ffffff 2 \b_602 21103>>>4 belong&0x00ffffff 3 \b_603 21104>>>4 belong&0x00ffffff 4 \b_603e 21105>>>4 belong&0x00ffffff 5 \b_603ev 21106>>>4 belong&0x00ffffff 6 \b_604 21107>>>4 belong&0x00ffffff 7 \b_604e 21108>>>4 belong&0x00ffffff 8 \b_620 21109>>>4 belong&0x00ffffff 9 \b_650 21110>>>4 belong&0x00ffffff 10 \b_7400 21111>>>4 belong&0x00ffffff 11 \b_7450 21112>>>4 belong&0x00ffffff 100 \b_970 21113>>>4 belong&0x00ffffff >100 subarchitecture=%d 21114>>0 belong&0x00ffffff >18 64-bit architecture=%d 21115>0 belong&0xff000000 0x02000000 21116# 21117# 64_32-bit ABIs. 21118# 21119>>0 belong&0x00ffffff 0 64_32-bit architecture=%d 21120>>0 belong&0x00ffffff 1 64_32-bit architecture=%d 21121>>0 belong&0x00ffffff 2 64_32-bit architecture=%d 21122>>0 belong&0x00ffffff 3 64_32-bit architecture=%d 21123>>0 belong&0x00ffffff 4 64_32-bit architecture=%d 21124>>0 belong&0x00ffffff 5 64_32-bit architecture=%d 21125>>0 belong&0x00ffffff 6 64_32-bit architecture=%d 21126>>0 belong&0x00ffffff 7 64_32-bit architecture=%d 21127>>0 belong&0x00ffffff 8 64_32-bit architecture=%d 21128>>0 belong&0x00ffffff 9 64_32-bit architecture=%d 21129>>0 belong&0x00ffffff 10 64_32-bit architecture=%d 21130>>0 belong&0x00ffffff 11 64_32-bit architecture=%d 21131>>0 belong&0x00ffffff 12 64_32-bit arm 21132>>>4 belong&0x00ffffff 0 21133>>>4 belong&0x00ffffff 1 \bv8 21134>>>4 belong&0x00ffffff >1 subarchitecture=%d 21135>>0 belong&0x00ffffff 13 64_32-bit architecture=%d 21136>>0 belong&0x00ffffff 14 64_32-bit architecture=%d 21137>>0 belong&0x00ffffff 15 64_32-bit architecture=%d 21138>>0 belong&0x00ffffff 16 64_32-bit architecture=%d 21139>>0 belong&0x00ffffff 17 64_32-bit architecture=%d 21140>>0 belong&0x00ffffff 18 64_32-bit architecture=%d 21141>>0 belong&0x00ffffff >18 64_32-bit architecture=%d 21142 211430 name mach-o-be 21144>0 byte 0xcf 64-bit 21145>4 use mach-o-cpu 21146>12 belong 1 object 21147# GRR: Does not work for Mach-O with 2 architectures; instead display oo 21148#!:ext o 21149!:ext o/ 21150>12 belong 2 executable 21151# the executables normally have no file extension like perl, 21152# but exceptions like perl5.18 perl5.16 21153!:ext 16/18/ 21154>12 belong 3 fixed virtual memory shared library 21155>12 belong 4 core 21156>12 belong 5 preload executable 21157>12 belong 6 dynamically linked shared library 21158# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib 21159#!:ext dylib 21160!:ext dylib/ 21161>12 belong 7 dynamic linker 21162>12 belong 8 bundle 21163# normally name extension bundle; but exceptions like: AMDil_r700.dylib 21164!:ext bundle/dylib/ 21165>12 belong 9 dynamically linked shared library stub 21166>12 belong 10 dSYM companion file 21167>12 belong 11 kext bundle 21168>12 belong >11 21169>>12 belong x filetype=%d 21170>24 belong >0 \b, flags:< 21171>>24 belong &0x00000001 \bNOUNDEFS 21172>>24 belong &0x00000002 \b|INCRLINK 21173>>24 belong &0x00000004 \b|DYLDLINK 21174>>24 belong &0x00000008 \b|BINDATLOAD 21175>>24 belong &0x00000010 \b|PREBOUND 21176>>24 belong &0x00000020 \b|SPLIT_SEGS 21177>>24 belong &0x00000040 \b|LAZY_INIT 21178>>24 belong &0x00000080 \b|TWOLEVEL 21179>>24 belong &0x00000100 \b|FORCE_FLAT 21180>>24 belong &0x00000200 \b|NOMULTIDEFS 21181>>24 belong &0x00000400 \b|NOFIXPREBINDING 21182>>24 belong &0x00000800 \b|PREBINDABLE 21183>>24 belong &0x00001000 \b|ALLMODSBOUND 21184>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS 21185>>24 belong &0x00004000 \b|CANONICAL 21186>>24 belong &0x00008000 \b|WEAK_DEFINES 21187>>24 belong &0x00010000 \b|BINDS_TO_WEAK 21188>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION 21189>>24 belong &0x00040000 \b|ROOT_SAFE 21190>>24 belong &0x00080000 \b|SETUID_SAFE 21191>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS 21192>>24 belong &0x00200000 \b|PIE 21193>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB 21194>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS 21195>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION 21196>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE 21197>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO 21198>>24 belong &0x08000000 \b|SIM_SUPPORT 21199>>24 belong &0x80000000 \b|DYLIB_IN_CACHE 21200>>24 belong x \b> 21201 21202# 212030 lelong&0xfffffffe 0xfeedface Mach-O 21204!:strength +1 21205!:mime application/x-mach-binary 21206>0 use \^mach-o-be 21207 212080 belong&0xfffffffe 0xfeedface Mach-O 21209!:strength +1 21210!:mime application/x-mach-binary 21211>0 use mach-o-be 21212 21213#------------------------------------------------------------------------------ 21214# $File: macintosh,v 1.31 2020/12/12 20:01:47 christos Exp $ 21215# macintosh description 21216# 21217# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 21218# Daniel Quinlan, quinlan@yggdrasil.com 21219# Update: Joerg Jenderek 21220# URL: https://en.wikipedia.org/wiki/BinHex 21221# Reference: http://fileformats.archiveteam.org/wiki/BinHex 21222# Note: only tested with version 4.0 and hqx extension 21223# Any text/binary before the characteristic comment sentence is to be ignored like in 21224# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 212250 search/1602 (This\ file\ 21226>&0 use binhex 21227# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 212280 search/2652/b (This\ file\ 21229>&0 use binhex 212300 name binhex 21231# keep split search string format similar like in version 5.37 21232>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 21233# http://www.macdisk.com/binhexen.php3 21234!:apple BNHQTEXT 21235# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 21236>>&0 string 1.0 1.0 21237!:mime application/mac-binhex 21238!:ext hex 21239>>&0 string 2.0 2.0 21240!:mime application/mac-binhex 21241!:ext hcx 21242# BinHex 3.0 never existed 21243>>&0 string 4.0 4.0 21244!:mime application/mac-binhex40 21245!:ext hqx 21246# BinHex 5.0 also MacBinary I 21247>>&0 string 5.0 5.0 21248!:mime application/mac-binhex40 21249!:ext hqx 21250# this should never happen 21251>>&0 default x 21252>>>&0 string x %.3s 21253!:mime application/mac-binhex 21254!:ext hqx 21255 21256# Stuffit archives are the de facto standard of compression for Macintosh 21257# files obtained from most archives. (franklsm@tuns.ca) 212580 string SIT! StuffIt Archive (data) 21259!:mime application/x-stuffit 21260!:apple SIT!SIT! 21261>2 string x : %s 212620 string SITD StuffIt Deluxe (data) 21263>2 string x : %s 212640 string Seg StuffIt Deluxe Segment (data) 21265>2 string x : %s 21266 21267# Newer StuffIt archives (grant@netbsd.org) 212680 string StuffIt StuffIt Archive 21269!:mime application/x-stuffit 21270!:apple SIT!SIT! 21271#>162 string >0 : %s 21272 21273# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 21274# GRR: Too weak 21275#0 string APPL Macintosh Application (data) 21276#>2 string x \b: %s 21277 21278# Macintosh System files (franklsm@tuns.ca) 21279# GRR: Too weak 21280#0 string zsys Macintosh System File (data) 21281#0 string FNDR Macintosh Finder (data) 21282#0 string libr Macintosh Library (data) 21283#>2 string x : %s 21284#0 string shlb Macintosh Shared Library (data) 21285#>2 string x : %s 21286#0 string cdev Macintosh Control Panel (data) 21287#>2 string x : %s 21288#0 string INIT Macintosh Extension (data) 21289#>2 string x : %s 21290#0 string FFIL Macintosh Truetype Font (data) 21291#>2 string x : %s 21292#0 string LWFN Macintosh Postscript Font (data) 21293#>2 string x : %s 21294 21295# Additional Macintosh Files (franklsm@tuns.ca) 21296# GRR: Too weak 21297#0 string PACT Macintosh Compact Pro Archive (data) 21298#>2 string x : %s 21299#0 string ttro Macintosh TeachText File (data) 21300#>2 string x : %s 21301#0 string TEXT Macintosh TeachText File (data) 21302#>2 string x : %s 21303#0 string PDF Macintosh PDF File (data) 21304#>2 string x : %s 21305 21306# MacBinary format (Eric Fischer, enf@pobox.com) 21307# Update: Joerg Jenderek 21308# URL: https://en.wikipedia.org/wiki/MacBinary 21309# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 21310# 21311# Unfortunately MacBinary doesn't really have a magic number prior 21312# to the MacBinary III format. 21313# 21314 21315# old version number, must be kept at zero for compatibility 213160 byte 0 21317# length of filename (must be in the range 1-63) 21318>1 ubyte >0 21319# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 21320>>1 ubyte <64 21321# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 21322# by looking for printable characters at beginning of file name 21323>>>2 ubelong >0x1F000000 21324# zero fill, must be zero for compatibility 21325>>>>74 byte 0 21326# zero fill, must be zero for compatibility 21327>>>>>82 byte 0 21328# MacBinary I test for valid version numbers 21329>>>>>>122 ubeshort 0 21330# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 21331#>>>>>>>91 ubelong >0x7c25b07F 21332# additional check for undefined header fields in MacBinary I 21333#>>>>>>>101 ulong 0 21334>>>>>>>0 use mac-bin 21335# MacBinary II the newer versions begins at 129 21336>>>>>>122 ubeshort 0x8181 21337>>>>>>>0 use mac-bin 21338# MacBinary III with MacBinary II to read 21339>>>>>122 ubeshort 0x8281 21340>>>>>>0 use mac-bin 21341 21342# display information of MacBinary file 213430 name mac-bin 21344>122 ubyte x MacBinary 21345# versions for MacBinary II/III 21346>122 ubyte 129 II 21347>122 ubyte 130 III 21348# only in MacBinary III 21349>>102 string !mBIN with surprising version 21350!:mime application/x-macbinary 21351!:apple PSPTBINA 21352!:ext bin/macbin 21353# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 21354#>1 ubyte >63 \b, name length %u too BIG! 21355#>122 ubeshort x \b, version 0x%x 21356# Finder flags if not 0 21357# >73 byte !0 \b, flags 0x 21358# >73 byte =0 21359# >>101 byte !0 \b, flags 0x 21360# # original Finder flags (Bits 8-15) 21361# >73 byte !0 \b%x 21362# # finder flags, bits 0-7 21363# >101 byte !0 \b%x 21364>73 byte &0x01 \b, inited 21365>73 byte &0x02 \b, changed 21366>73 byte &0x04 \b, busy 21367>73 byte &0x08 \b, bozo 21368>73 byte &0x10 \b, system 21369>73 byte &0x20 \b, bundle 21370>73 byte &0x40 \b, invisible 21371>73 byte &0x80 \b, locked 21372 21373# 75 beshort # vertical posn in window 21374#>75 beshort !0 \b, v.pos %u 21375# 77 beshort # horiz posn in window 21376#>77 beshort !0 \b, h.pos %u 21377# 79 beshort # window or folder ID 21378>79 ubeshort !0 \b, ID 0x%x 21379# protected flag 21380>81 byte !0 \b, protected 0x%x 21381# length of comment after resource 21382>99 ubeshort !0 \b, comment length %u 21383# char. code of file name 21384>106 ubyte !0 \b, char. code 0x%x 21385# still more Finder flags 21386>107 ubyte !0 \b, more flags 0x%x 21387# length of total files when unpacked only used when pack and unpack on the fly 21388>116 ubelong !0 \b, total length %u 21389# 120 beshort # length of add'l header 21390>120 ubeshort !0 \b, 2nd header length %u 21391# 124 beshort # checksum 21392#>124 ubeshort !0 \b, CRC 0x%x 21393# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 21394>91 beldate-0x7C25B080 x \b, %s 21395# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 21396>91 ubelong <0x7c25b080 INVALID date 21397#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 21398# last modified date 21399>95 beldate-0x7C25B080 x \b, modified %s 21400# Apple creator+typ if not null 21401# file creator (normally expressed as four characters) 21402>69 ulong !0 \b, creator 21403# instead 4 character code display full creator name 21404>>69 use apple-creator 21405# file type (normally expressed as four characters) 21406>65 ulong !0 \b, type 21407>>65 use apple-type 21408# length of data segment 21409>83 ubelong !0 \b, %u bytes 21410# filename (in the range 1-63) 21411>1 pstring x "%s" 21412# print 1 space and then at offset 128 inspect data fork content if it has one 21413>83 ubelong !0 \b 21414>>128 indirect x 21415# Afterwards resource fork if length of resource segment not zero 21416>87 ubelong !0 21417# calculate resource fork offset 21418>>83 ubelong+128 x \b, at 0x%x 21419# length of resource segment 21420>>87 ubelong !0 %u bytes 21421>>(83.S+128) ubequad x resource 21422# further resource fork content inspection 21423>>>&-8 indirect x 21424 21425# Apple Type/Creator Database 21426# URL: https://en.wikipedia.org/wiki/Type_code 21427# Reference: https://www.lacikam.co.il/tcdb/ 21428# https://www.macdisk.com/macsigen.php 21429# Note: classic Mac OS files have two 4 character codes for type and creator. 21430# Thereby the Finder attach documents types to applications. 21431 21432#>65 string x \b, type "%4.4s" 21433 21434# display information about apple type 214350 name apple-type 21436>0 string 8BIM PhotoShop 21437>0 string ALB3 PageMaker 3 21438>0 string ALB4 PageMaker 4 21439>0 string ALT3 PageMaker 3 21440>0 string APPL application 21441>0 string AWWP AppleWorks word processor 21442>0 string CIRC simulated circuit 21443>0 string DRWG MacDraw 21444>0 string EPSF Encapsulated PostScript 21445>0 string FFIL font suitcase 21446>0 string FKEY function key 21447>0 string FNDR Macintosh Finder 21448>0 string GIFf GIF image 21449>0 string Gzip GNU gzip 21450>0 string INIT system extension 21451>0 string LIB\ library 21452>0 string LWFN PostScript font 21453>0 string MSBC Microsoft BASIC 21454>0 string PACT Compact Pro archive 21455>0 string PDF\ Portable Document Format 21456>0 string PICT picture 21457>0 string PNTG MacPaint picture 21458>0 string PREF preferences 21459>0 string PROJ Think C project 21460>0 string QPRJ Think Pascal project 21461>0 string SCFL Defender scores 21462>0 string SCRN startup screen 21463>0 string SITD StuffIt Deluxe 21464>0 string SPn3 SuperPaint 21465>0 string STAK HyperCard stack 21466>0 string Seg\ StuffIt segment 21467>0 string TARF Unix tar archive 21468>0 string TEXT ASCII 21469>0 string TIFF TIFF image 21470>0 string TOVF Eudora table of contents 21471>0 string WDBN Microsoft Word word processor 21472>0 string WORD MacWrite word processor 21473>0 string XLS\ Microsoft Excel 21474>0 string ZIVM compress (.Z) 21475>0 string ZSYS Pre-System 7 system file 21476>0 string acf3 Aldus FreeHand 21477>0 string cdev control panel 21478>0 string dfil Desk Accessory suitcase 21479>0 string libr library 21480>0 string nX^d WriteNow word processor 21481>0 string nX^w WriteNow dictionary 21482>0 string rsrc resource 21483>0 string scbk Scrapbook 21484>0 string shlb shared library 21485>0 string ttro SimpleText read-only 21486>0 string zsys system file 21487 21488# additional types added in Dec 2017 21489>0 string BINA binary file 21490>0 string BMPp BMP image 21491>0 string JPEG JPEG image 21492#>0 string W4BN Microsoft Word x.y word processor? 21493# if type name is not known display 4 character identifier 21494>0 default x 21495>>0 string x '%4.4s' 21496 21497#>69 string x \b, creator "%4.4s" 21498 21499# Now Apple has no repository of registered Creator IDs any more. These are 21500# just the ones that I happened to have files from and was able to identify. 21501 21502# display information about apple creator 215030 name apple-creator 21504>0 string 8BIM Adobe Photoshop 21505>0 string ALD3 PageMaker 3 21506>0 string ALD4 PageMaker 4 21507>0 string ALFA Alpha editor 21508>0 string APLS Apple Scanner 21509>0 string APSC Apple Scanner 21510>0 string BRKL Brickles 21511>0 string BTFT BitFont 21512>0 string CCL2 Common Lisp 2 21513>0 string CCL\ Common Lisp 21514>0 string CDmo The Talking Moose 21515>0 string CPCT Compact Pro 21516>0 string CSOm Eudora 21517>0 string DMOV Font/DA Mover 21518>0 string DSIM DigSim 21519>0 string EDIT Macintosh Edit 21520>0 string ERIK Macintosh Finder 21521>0 string EXTR self-extracting archive 21522>0 string Gzip GNU gzip 21523>0 string KAHL Think C 21524>0 string LWFU LaserWriter Utility 21525>0 string LZIV compress 21526>0 string MACA MacWrite 21527>0 string MACS Macintosh operating system 21528>0 string MAcK MacKnowledge terminal emulator 21529>0 string MLND Defender 21530>0 string MPNT MacPaint 21531>0 string MSBB Microsoft BASIC (binary) 21532>0 string MSWD Microsoft Word 21533>0 string NCSA NCSA Telnet 21534>0 string PJMM Think Pascal 21535>0 string PSAL Hunt the Wumpus 21536#>0 string PSI2 Apple File Exchange 21537>0 string R*ch BBEdit 21538>0 string RMKR Resource Maker 21539>0 string RSED Resource Editor 21540>0 string Rich BBEdit 21541>0 string SIT! StuffIt 21542>0 string SPNT SuperPaint 21543>0 string Unix NeXT Mac filesystem 21544>0 string VIM! Vim editor 21545>0 string WILD HyperCard 21546>0 string XCEL Microsoft Excel 21547>0 string aCa2 Fontographer 21548>0 string aca3 Aldus FreeHand 21549>0 string dosa Macintosh MS-DOS file system 21550>0 string movr Font/DA Mover 21551>0 string nX^n WriteNow 21552>0 string pdos Apple ProDOS file system 21553>0 string scbk Scrapbook 21554>0 string ttxt SimpleText 21555>0 string ufox Foreign File Access 21556# additional creators added in Dec 2017 21557# Claris/Apple Works 21558>0 string BOBO Apple Works 21559# CU-SeeMe_0.87b3_(68K).bin 21560#>0 string CUce bar 21561>0 string PSPT Apple File Exchange 21562# Disk_Copy_4.2.sea.bin 21563#>0 string NCse foo 21564# probably StuffIt/Aladdin by Smith Micro Software, Inc. 21565>0 string STi0 stuffit 21566# MacGzip-1.1.3.sea.bin 21567#>0 string aust bar 21568# D-Disk_Copy_6.3.3.smi.bin 21569>0 string oneb Disk Copy Self Mounting 21570# if creator name is not known display 4 character identifier 21571>0 default x 21572>>0 string x '%4.4s' 21573 21574# sas magic from Bruce Foster (bef@nwu.edu) 21575# 21576#0 string SAS SAS 21577#>8 string x %s 215780 string SAS SAS 21579>24 string DATA data file 21580>24 string CATALOG catalog 21581>24 string INDEX data file index 21582>24 string VIEW data view 21583# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 21584# 215850x54 string SAS SAS 7+ 21586>0x9C string DATA data file 21587>0x9C string CATALOG catalog 21588>0x9C string INDEX data file index 21589>0x9C string VIEW data view 21590 21591# spss magic for SPSS system and portable files, 21592# from Bruce Foster (bef@nwu.edu). 21593 215940 long 0xc1e2c3c9 SPSS Portable File 21595>40 string x %s 21596 215970 string $FL2 SPSS System File 21598>24 string x %s 21599 216000 string $FL3 SPSS System File 21601>24 string x %s 21602 21603# Macintosh filesystem data 21604# From "Tom N Harris" <telliamed@mac.com> 21605# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 21606# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 21607# entries depend on the data arithmetic added after v.35 21608# There's also some Pascal strings in here, ditto... 21609 21610# The boot block signature, according to IM:Files, is 21611# "for HFS volumes, this field always contains the value 0x4C4B." 21612# But if this is true for MFS or HFS+ volumes, I don't know. 21613# Alternatively, the boot block is supposed to be zeroed if it's 21614# unused, so a simply >0 should suffice. 21615 216160x400 beshort 0xD2D7 Macintosh MFS data 21617>0 beshort 0x4C4B (bootable) 21618>0x40a beshort &0x8000 (locked) 21619>0x402 beldate-0x7C25B080 x created: %s, 21620>0x406 beldate-0x7C25B080 >0 last backup: %s, 21621>0x414 belong x block size: %d, 21622>0x412 beshort x number of blocks: %d, 21623>0x424 pstring x volume name: %s 21624 21625# *.hfs updated by Joerg Jenderek 21626# https://en.wikipedia.org/wiki/Hierarchical_File_System 21627# "BD" gives many false positives 216280x400 beshort 0x4244 21629# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 21630# first block of volume bit map (always 3) 21631>0x40e ubeshort 0x0003 21632# maximal length of volume name is 27 21633>>0x424 ubyte <28 Macintosh HFS data 21634!:mime application/x-apple-diskimage 21635#!:apple hfsdINIT 21636#!:apple MACSdisk 21637# https://www.macdisk.com/macsigen.php 21638#!:apple ddskdevi 21639!:apple ????devi 21640# https://en.wikipedia.org/wiki/Apple_Disk_Image 21641!:ext hfs/dmg 21642>>>0 beshort 0x4C4B (bootable) 21643#>>>0 beshort 0x0000 (not bootable) 21644>>>0x40a beshort &0x8000 (locked) 21645>>>0x40a beshort ^0x0100 (mounted) 21646>>>0x40a beshort &0x0200 (spared blocks) 21647>>>0x40a beshort &0x0800 (unclean) 21648>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 21649# https://www.epochconverter.com/ 21650# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 21651# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 21652# construct not working 21653#>>>0x402 beldate-0x7C25B080 x created: %s, 21654#>>>0x406 beldate-0x7C25B080 x last modified: %s, 21655#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 21656# found block sizes 200h,1200h,2800h 21657>>>0x414 belong x block size: %d, 21658>>>0x412 beshort x number of blocks: %d, 21659>>>0x424 pstring x volume name: %s 21660 216610x400 beshort 0x482B Macintosh HFS Extended 21662>&0 beshort x version %d data 21663>0 beshort 0x4C4B (bootable) 21664>0x404 belong ^0x00000100 (mounted) 21665>&2 belong &0x00000200 (spared blocks) 21666>&2 belong &0x00000800 (unclean) 21667>&2 belong &0x00008000 (locked) 21668>&6 string x last mounted by: '%.4s', 21669# really, that should be treated as a belong and we print a string 21670# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 21671>&14 beldate-0x7C25B080 x created: %s, 21672# only the creation date is local time, all other timestamps in HFS+ are UTC. 21673>&18 bedate-0x7C25B080 x last modified: %s, 21674>&22 bedate-0x7C25B080 >0 last backup: %s, 21675>&26 bedate-0x7C25B080 >0 last checked: %s, 21676>&38 belong x block size: %d, 21677>&42 belong x number of blocks: %d, 21678>&46 belong x free blocks: %d 21679 21680## AFAIK, only the signature is different 21681# same as Apple Partition Map 21682# GRR: This magic is too weak, it is just "TS" 21683#0x200 beshort 0x5453 Apple Old Partition data 21684#>0x2 beshort x block size: %d, 21685#>0x230 string x first type: %s, 21686#>0x210 string x name: %s, 21687#>0x254 belong x number of blocks: %d, 21688#>0x400 beshort 0x504D 21689#>>0x430 string x second type: %s, 21690#>>0x410 string x name: %s, 21691#>>0x454 belong x number of blocks: %d, 21692#>>0x800 beshort 0x504D 21693#>>>0x830 string x third type: %s, 21694#>>>0x810 string x name: %s, 21695#>>>0x854 belong x number of blocks: %d, 21696#>>>0xa00 beshort 0x504D 21697#>>>>0xa30 string x fourth type: %s, 21698#>>>>0xa10 string x name: %s, 21699#>>>>0xa54 belong x number of blocks: %d 21700 21701# From: Remi Mommsen <mommsen@slac.stanford.edu> 217020 string BOMStore Mac OS X bill of materials (BOM) file 21703 21704# From: Adam Buchbinder <adam.buchbinder@gmail.com> 21705# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 21706# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 21707# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 21708# don't know what they mean. 217090 belong 0x100 21710>(0x4.L+24) beshort x 21711>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 21712>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 21713>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 21714>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 21715 21716#------------------------------------------------------------------------------ 21717# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 21718# MacOS files 21719# 21720 217210 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 21722 21723#------------------------------------------------------------------------------ 21724# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 21725# magic: file(1) magic for magic files 21726# 217270 string/t #\ Magic magic text file for file(1) cmd 217280 lelong 0xF11E041C magic binary file for file(1) cmd 21729>4 lelong x (version %d) (little endian) 217300 belong 0xF11E041C magic binary file for file(1) cmd 21731>4 belong x (version %d) (big endian) 21732#------------------------------------------------------------------------------ 21733# $File: mail.news,v 1.27 2021/04/05 16:36:14 christos Exp $ 21734# mail.news: file(1) magic for mail and news 21735# 21736# Unfortunately, saved netnews also has From line added in some news software. 21737#0 string From mail text 217380 string/t Relay-Version: old news text 21739!:mime message/rfc822 217400 string/t #!\ rnews batched news text 21741!:mime message/rfc822 217420 string/t N#!\ rnews mailed, batched news text 21743!:mime message/rfc822 217440 string/t Forward\ to mail forwarding text 21745!:mime message/rfc822 217460 string/t Pipe\ to mail piping text 21747!:mime message/rfc822 217480 string/tc delivered-to: SMTP mail text 21749!:mime message/rfc822 217500 string/tc return-path: SMTP mail text 21751!:mime message/rfc822 217520 string/t Path: news text 21753!:mime message/news 217540 string/t Xref: news text 21755!:mime message/news 217560 string/t From: news or mail text 21757!:mime message/rfc822 217580 string/t Article saved news text 21759!:mime message/news 21760# Reference: http://quimby.gnus.org/notes/BABYL 21761# Update: Joerg Jenderek 21762# Note: used by Rmail in Emacs version 22 and before 21763# is not text because of characters like Control-L Control-_ 217640 string/b BABYL\ OPTIONS: Emacs RMAIL 21765#0 string/t BABYL Emacs RMAIL text 21766# https://reposcope.com/mimetype/message/x-gnu-rmail 21767!:mime message/x-gnu-rmail 21768# ~/RMAIL 21769!:ext / 217700 string/t Received: RFC 822 mail text 21771!:mime message/rfc822 217720 string/t MIME-Version: MIME entity text 21773#0 string/t Content- MIME entity text 21774 21775# TNEF files... 217760 lelong 0x223E9F78 Transport Neutral Encapsulation Format 21777!:mime application/vnd.ms-tnef 21778 21779# From: Kevin Sullivan <ksulliva@psc.edu> 217800 string *mbx* MBX mail folder 21781 21782# From: Simon Matter <simon.matter@invoca.ch> 217830 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 217840 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 21785 21786# JAM(mbp) Fidonet message area databases 21787# JHR file 217880 string JAM\0 JAM message area header file 21789>12 leshort >0 (%d messages) 21790 21791# Squish Fidonet message area databases 21792# SQD file (requires at least one message in the area) 21793# XXX: Weak magic 21794#256 leshort 0xAFAE4453 Squish message area data file 21795#>4 leshort >0 (%d messages) 21796 21797#0 string \<!--\ MHonArc text/html; x-type=mhonarc 21798 21799# Cyrus: file(1) magic for compiled Cyrus sieve scripts 21800# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 21801# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 21802# From: Philipp Hahn <hahn@univention.de> 21803 21804# Compiled Cyrus sieve script 218050 string CyrSBytecode Cyrus sieve bytecode data, 21806>12 belong =1 version 1, big-endian 21807>12 lelong =1 version 1, little-endian 21808>12 belong x version %d, network-endian 21809 21810# Dovecot mail server, version 2.2 and later. 21811# Dovecot mailing list: dovecot@dovecot.org 21812# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format 21813# From: Stephen Gildea 218140 string CRYPTED\003\007 Dovecot encrypted message 21815>9 byte x \b, dcrypt version %d 21816#------------------------------------------------------------------------------ 21817# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $ 21818# make: file(1) magic for makefiles 21819# 21820# URL: https://en.wikipedia.org/wiki/Make_(software) 218210 regex/100l \^CFLAGS makefile script text 21822!:mime text/x-makefile 218230 regex/100l \^VPATH makefile script text 21824!:mime text/x-makefile 218250 regex/100l \^LDFLAGS makefile script text 21826!:mime text/x-makefile 218270 regex/100l \^all: makefile script text 21828!:mime text/x-makefile 218290 regex/100l \^\\.PRECIOUS makefile script text 21830!:mime text/x-makefile 21831# Update: Joerg Jenderek 21832# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 21833# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 21834# by additional escaping point character 218350 regex/100l \^\\.BEGIN BSD makefile script text 21836!:mime text/x-makefile 21837!:ext /mk 21838!:strength +10 21839# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 21840# and NSIS script with "!include" by additional escaping point character 218410 regex/100l \^\\.include BSD makefile script text 21842!:mime text/x-makefile 21843!:ext /mk 21844!:strength +10 218450 regex/100l \^\\.endif BSD makefile script text 21846!:mime text/x-makefile 21847!:ext /mk 21848!:strength +10 218490 regex/100l \^SUBDIRS automake makefile script text 21850!:mime text/x-makefile 21851!:strength +10 21852 21853 21854#------------------------------------------------------------------------------ 21855# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $ 21856# map: file(1) magic for Map data 21857# 21858 21859# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 218608 string .FIT FIT Map data 21861>15 byte 0 21862>>35 belong x \b, unit id %d 21863>>39 lelong x \b, serial %u 21864# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 21865# 20 years after unix epoch 21866# TZ=GMT date -d '1989-12-31 0:00' +%s 21867>>43 leldate+631065600 x \b, %s 21868 21869>>47 leshort x \b, manufacturer %d 21870>>47 leshort 1 \b (garmin) 21871>>49 leshort x \b, product %d 21872>>53 byte x \b, type %d 21873>>53 byte 1 \b (Device) 21874>>53 byte 2 \b (Settings) 21875>>53 byte 3 \b (Sports/Cycling) 21876>>53 byte 4 \b (Activity) 21877>>53 byte 8 \b (Elevations) 21878>>53 byte 10 \b (Totals) 21879 21880# Summary: Garmin map 21881# From: Joerg Jenderek 21882# URL: https://en.wikipedia.org/wiki/Garmin_.img 21883# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 21884# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf 21885# GRR: similar to MBR boot sector handled by ./filesystems 218860x1FE leshort =0xAA55 21887# look for valid map signature 21888>0x13 string =IMG\0 21889>>0 use garmin-map 218900 name garmin-map 21891>0 ubyte x Garmin 21892!:mime application/x-garmin-map 21893# If non-zero, every byte of the entire .img file is to be XORed with this value 21894>0 ubyte !0 \b, 0x%x XORed 21895# goto block before FAT 21896>(0x40.b*512) ubyte x 21897# 1st fat name "DLLINFO TXT" only found for vpm 21898>>&512 string =DLLINFO\ TXT map (Voice Processing) 21899# there exist 2 other Garmin VPM formats; see ./audio 21900!:ext vpm 21901# Deutsch__Yannick_D4481-00_0210.vpm 21902#>>>512 search/0x0116da60/s RIFF \b; with 21903# determine type voice type by ./riff 21904#>>>>&0 indirect x \b 21905>>&512 string !DLLINFO\ TXT map 21906!:ext img 21907# 9 zeros 21908>1 ubelong !0 \b, zeroes 0x%x 21909# Map's version major 21910>8 ubyte x v%u 21911# Map's version minor 21912>9 ubyte x \b.%.2u 21913# Map description[20], 0x20 padded 21914>0x49 string x %.20s 21915# Map name, continued (0x20 padded, \0 terminated) 21916>0x65 string >\ \b%.31s 21917# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62) 21918>0xB ubyte x \b, updated 21919>>0xB ubyte >0x62 21920>>>0xB ubyte-100 x 20%.2u 21921>>0xB ubyte <0x63 21922>>>0xB ubyte x 20%.2u 21923# Update month (0-11) 21924>0xA ubyte x \b-%.2u 21925# All zeroes 21926>0xc uleshort !0 \b, zeroes 0x%x 21927# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport 21928#>0xE ubyte !0 \b, Mapsource flag 0x%x 21929>0xE ubyte 1 \b, Mapsource 21930# Checksum, sum of all bytes modulo 256 should be 0 21931#>0xF ubyte x \b, Checksum 0x%x 21932# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map 21933>0x10 string !DSKIMG \b, signature "%.7s" 21934>0x39 use garmin-date 21935# Map file identifier like GARMIN\0 21936>0x41 string !GARMIN \b, id "%.7s" 21937# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes 21938>0x61 ubyte !0x09 \b, E1=%u 21939# Block size exponent, E2 ; file blocksize=2**(E1+E2) 21940>>0x62 ubyte x \b, E2=%u 21941>0x61 ubyte =0x09 \b, blocksize 21942>>0x62 ubyte 0 512 21943>>0x62 ubyte 1 1024 21944>>0x62 ubyte 2 2048 21945>>0x62 ubyte 3 4096 21946>>0x62 ubyte 4 8192 21947>>0x62 ubyte 5 16384 21948>>0x62 default x 21949>>>0x62 ubyte x E2=%u 21950# MBR signature 21951>0x1FE leshort !0xAA55 \b, invalid MBR 21952# 512 zeros 21953>0x200 uquad !0 \b, zeroes 0x%llx 21954# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file! 21955>0x40C ulelong >0 \b, at 0x%x 21956# sub-file Header length 21957#>>(0x40C.l) uleshort x \b, header len 0x%x 21958>>(0x40C.l) uleshort x %u bytes 21959# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc. 21960>>(0x40C.l+2) ubyte >0x1F 21961>>>(0x40C.l+2) ubyte <0xFF 21962>>>>(0x40C.l+2) string x "%.10s" 21963# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.) 21964>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x 21965# Block sequence numbers like 0000 0100 0200 ... FFFF 21966# >0x420 ubequad >0 \b, seq. 0x%16.16llx 21967# >>0x428 ubequad >0 \b%16.16llx 21968# >>>0x430 ubequad >0 \b%16.16llx 21969# >>>>0x438 ubequad >0 \b%16.16llx 21970# >>>>>0x440 ubequad >0 \b%16.16llx 21971# >>>>>>0x448 ubequad >0 \b%16.16llx 21972# >>>>>>>0x450 ubequad >0 \b%16.16llx 21973# >>>>>>>>0x458 ubequad >0 \b%16.16llx 21974# >>>>>>>>>0x460 ubequad >0 \b%16.16llx 21975# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx 21976# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx 21977# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx 21978# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx 21979# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx 21980# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx 21981# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx 21982# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx 21983# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx 21984# look for end of FAT 21985#>>0x420 search/512/s \xff\xff FAT END 21986# Physical block number of FAT header 21987#>0x40 ubyte x \b, FAT at phy. block %u 21988>0x40 ubyte x 21989>>(0x40.b*512) ubyte x 21990# 1st FAT block 21991>>>&511 use garmin-fat 21992# 2nd FAT block 21993>>>&1023 use garmin-fat 21994# 3th FAT block 21995>>>&1535 use garmin-fat 21996# 4th FAT block 21997>>>&2047 use garmin-fat 21998# ... xth FAT block 21999# 22000# 314 zeros but not in vpm and also gmaptz.img 22001>0x84 uquad !0 \b, at 0x84 0x%llx 22002# display FileAllocationTable block entry in garmin map 220030 name garmin-fat 22004>0 ubyte x \b; 22005# sub file part; 0x0003 seems to be garbage 22006>0x10 uleshort !0 next 0x%4.4x 22007>0x10 uleshort =0 22008# fat flag 0~dummy block 1~true sub file 22009>>0 ubyte !1 flag %u 22010>>0 ubyte =1 22011# sub-file name like MAKEGMAP 12345678 22012>>>0x1 string x %.8s 22013# sub-file typ like RGN TRE MDR LBL 22014>>>0x9 string x \b.%.3s 22015# size of sub file 22016>>>0xC ulelong x \b, %u bytes 22017# 32-bit block sequence numbers 22018#>>>0x20 ubequad x \b, seq. 0x%16.16llx 22019 22020# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss 220210 name garmin-date 22022# year like 2018 22023>0 uleshort x \b, created %u 22024# month (0-11) 22025>2 ubyte x \b-%.2u 22026# day (1-31) 22027>3 ubyte x \b-%.2u 22028# hour (0-23) 22029>4 ubyte x %u 22030# minute (0-59) 22031>5 ubyte x \b:%.2u 22032# second (0-59) 22033>6 ubyte x \b:%.2u 22034 22035# Summary: Garmin Map subfiles 22036# From: Joerg Jenderek 22037# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 22038# Garmin Common Header 220392 string GARMIN\ 22040# skip ASCII text by checking for low header length 22041>0 uleshort <0x1000 Garmin map, 22042# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format 22043>>9 string GMP subtile 22044!:mime application/x-garmin-gpm 22045!:ext gmp 22046# copyright message 22047>>>(0.s) string x %s 22048>>>0x0E use garmin-date 22049# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format 22050# This contains the searchable address table used for finding routing destinations 22051>>9 string MDR address table 22052!:mime application/x-garmin-mdr 22053!:ext mdr 22054# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format 22055# http://svn.parabola.me.uk/display/trunk/doc/nod.txt 22056# This contains the routing information 22057>>9 string NOD routing 22058!:mime application/x-garmin-nod 22059!:ext nod 22060>>>0x0E use garmin-date 22061#>>>0x15 ulelong x \b, at 0x%x 22062#>>>0x19 ulelong x 0x%x bytes NOD1 22063#>>>0x25 ulelong x \b, at 0x%x 22064#>>>0x29 ulelong x 0x%x bytes NOD2 22065#>>>0x31 ulelong x \b, at 0x%x 22066#>>>0x35 ulelong x 0x%x bytes NOD3 22067# URL: http://www.pinns.co.uk/osm/net.html 22068# routable highways (length, direction, allowed speed,house address information) 22069>>9 string NET highways 22070!:mime application/x-garmin-net 22071!:ext net 22072#>>>0x15 ulelong x \b, at 0x%x 22073#>>>0x19 ulelong x 0x%x bytes NET1 22074#>>>0x22 ulelong >0 22075#>>>>0x1E ulelong x \b, at 0x%x 22076#>>>>0x22 ulelong x 0x%x bytes NET2 22077#>>>0x2B ulelong >0 22078#>>>>0x27 ulelong x \b, at 0x%x 22079#>>>>0x2B ulelong x 0x%x bytes NET3 22080# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format 22081>>9 string LBL labels 22082!:mime application/x-garmin-lbl 22083!:ext lbl 22084>>>(0.s) string x %s 22085# Label coding type 6h 9h and ah 22086>>>0x1E ubyte x \b, coding type 0x%x 22087#>>>0x15 ulelong x \b, at 0x%x 22088#>>>0x19 ulelong x 0x%x bytes LBL1 22089#>>>0x1F ulelong x \b, at 0x%x 22090#>>>0x23 ulelong x 0x%x bytes LBL2 22091#>>>0x2D ulelong x \b, at 0x%x 22092#>>>0x31 ulelong x 0x%x bytes LBL3 22093# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format 22094# A lookup table of the chars in the map's codepage, and their collating sequence 22095>>9 string SRT sort table 22096!:mime application/x-garmin-srt 22097!:ext srt 22098>>>0x0E use garmin-date 22099# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format 22100>>9 string TRE tree 22101!:mime application/x-garmin-tre 22102!:ext tre 22103# title like City Nav Europe NTU 2019.2 Basemap 22104# or OSM Street map 22105>>>(0.s) string x %s 22106# 2nd title like Copyright 1995-2018 by GARMIN Corporation. 22107# or http://www.openstreetmap.org/ 22108>>>>&1 string x %s 22109>>>0x0E use garmin-date 22110#>>>0x21 ulelong x \b, at 0x%x 22111#>>>0x25 ulelong x 0x%x bytes TRE1 22112#>>>0x29 ulelong x \b, at 0x%x 22113#>>>0x2D ulelong x 0x%x bytes TRE2 22114#>>>0x31 ulelong x \b, at 0x%x 22115#>>>0x35 ulelong x 0x%x bytes TRE3 22116# Copyright record size 22117#>>>0x39 uleshort x \b, copyright record size %u 22118# Map ID 22119>>>0x74 ulelong x \b, ID 0x%x 22120# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html 22121# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps 22122>>9 string TRF traffic, 22123!:mime application/x-garmin-trf 22124!:ext trf 22125# city/region like Preitenegg 22126>>>(0.s+1) string x 1st %s 22127# highway part like L606/L148 22128>>>>&1 string x %s 22129# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format 22130# Reference: http://www.pinns.co.uk/osm/typformat.html 22131# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps 22132>>9 string TYP types 22133!:mime application/x-garmin-typ 22134!:ext typ 22135>>>0x0E use garmin-date 22136# character set 1252 65001~UTF8 22137>>>0x15 uleshort x \b, code page %u 22138# POIs 22139#>>>0x17 ulelong x \b, at 0x%x 22140#>>>0x1B ulelong x 0x%x bytes TYP1 22141# extra pois 22142#>>>0x5B ulelong x \b, at 0x%x 22143#>>>0x5F ulelong x 0x%x bytes TYP8 22144# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format 22145# http://www.pinns.co.uk/osm/RGN.html 22146# region data used by the Garmin software 22147>>9 string RGN region 22148!:mime application/x-garmin-rgn 22149!:ext rgn 22150# POIs,Indexed POIs,Polylines or Polygons or first map level 22151#>>>0x15 ulelong x \b, at 0x%x 22152#>>>0x19 ulelong x 0x%x bytes RGN1 22153# polygons with extended types 22154#>>>0x21 ulelong >0 22155#>>>>0x1D ulelong x \b, at 0x%x 22156#>>>>0x21 ulelong x 0x%x bytes RGN2 22157# polylines with extended types 22158#>>>0x3D ulelong >0 22159#>>>>0x39 ulelong x \b, at 0x%x 22160#>>>>0x3D ulelong x 0x%x bytes RGN3 22161# extended POIs 22162#>>>0x59 ulelong >0 22163#>>>>0x55 ulelong x \b, at 0x%x 22164#>>>>0x59 ulelong x 0x%x bytes RGN3 22165#>>9 default x unknown map type 22166# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h, 22167# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh 22168>>0 uleshort x \b, header length 0x%x 22169 22170# URL: https://www.memotech.franken.de/FileFormats/ 22171# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf 22172# From: Joerg Jenderek 221730 string KpGr Garmin update 22174# format version like: 0064h~1.0 22175>0x4 uleshort !0x0064 22176>>4 uleshort/100 x \b, version %u 22177>>4 uleshort%100 x \b.%u 22178# 1st Garmin entry 22179>6 use garmin-entry 22180# 2nd Garmin entry 22181>(0x6.l+10) ubyte x 22182>>&0 use garmin-entry 22183# 3rd entry 22184>(0x6.l+10) ubyte x 22185>>&(&0.l+4) ubyte x 22186>>>&0 use garmin-entry 22187# look again at version to use default clause 22188>0x4 uleshort x 22189# test for region content by looking for 22190# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales" 22191# 1 space after equal sign 22192>>0x3a search/5/s GARMIN\ BITMAP \b= 22193!:mime image/x-garmin-exe 22194!:ext exe 22195>>>&0 indirect x 22196# if not bitmap *.srf then region; 1 space after equal sign 22197>>0x3a default x \b= 22198!:mime application/x-garmin-rgn 22199!:ext rgn 22200# recursiv embedded 22201>>>0x3a search/5/s KpGrd 22202>>>>&0 indirect x 22203# look for ZIP or JAR archive by ./archive and ./zip 22204>>>0x3a search/5/s PK\003\004 22205>>>>&0 indirect x 22206# TODO: other garmin RGN record content like foo 22207#>>0x3a search/5/s bar BAR 22208# display information of Garmin RGN record 222090 name garmin-entry 22210# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region 22211#>0 ulelong x \b, length 0x%x 22212# data record (ID='D') with version content like 0064h~1.0 22213>4 ubyte =0x44 22214>>5 uleshort !0x0064 \b; Data 22215>>>5 uleshort/100 x \b, version %u 22216>>>5 uleshort%100 x \b.%u 22217# Application Record (ID='A') 22218>4 ubyte =0x41 \b; App 22219# version content like 00c8h~2.0 22220>>5 uleshort !0x00C8 22221>>>5 uleshort/100 x \b, version %u 22222>>>5 uleshort%100 x \b.%u 22223# builder name like: SQA sqa build hales 22224>>7 string x \b, build by %s 22225# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009 22226>>>&1 string x %s 22227# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01 22228>>>>&1 string x %s 22229# region record (ID='R') 22230>4 ubyte =0x52 \b; Region 22231# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP 22232>>5 uleshort x ID=%u 22233# delay in ms: like 0, 500 22234>>7 ulelong !0 \b, %u ms 22235# region size (is record length - 10) 22236#>>11 ulelong x \b, length 0x%x 22237# region content like: 22238# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive 22239#>>15 string x \b, content "%s" 22240>>15 ubequad x \b, content 0x%llx... 22241# This does NOT WORK! 22242#>>15 indirect x \b; contains 22243>4 default x \b; other 22244# garmin Record ID Identifies the record content like: D A R 22245>>4 ubyte x ID '%c' 22246 22247# TOM TOM GPS watches ttbin files: 22248# https://github.com/ryanbinns/ttwatch/tree/master/ttbin 22249# From: Daniel Lenski 222500 byte 0x20 22251>1 leshort 0x0007 22252>>0x76 byte 0x20 22253>>>0x77 leshort 0x0075 TomTom activity file, v7 22254>>>>8 leldate x (%s, 22255>>>>3 byte x device firmware %d. 22256>>>>4 byte x \b%d. 22257>>>>5 byte x \b%d, 22258>>>>6 leshort x product ID %04d) 22259 22260 22261#------------------------------------------------------------------------------ 22262# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 22263# maple: file(1) magic for maple files 22264# "H. Nanosecond" <aldomel@ix.netcom.com> 22265# Maple V release 4, a multi-purpose math program 22266# 22267 22268# maple library .lib 222690 string \000MVR4\nI MapleVr4 library 22270 22271# .ind 22272# no magic for these :-( 22273# they are compiled indexes for maple files 22274 22275# .hdb 222760 string \000\004\000\000 Maple help database 22277 22278# .mhp 22279# this has the form <PACKAGE=name> 222800 string \<PACKAGE= Maple help file 222810 string \<HELP\ NAME= Maple help file 222820 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 22283#0 string #\ Newton Maple help file, old style 222840 string #\ daub Maple help file, old style 22285#0 string #=========== Maple help file, old style 22286 22287# .mws 222880 string \000\000\001\044\000\221 Maple worksheet 22289#this is anomalous 222900 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 22291# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 22292# that is {VERSION major_version miunor_version computer_type version_string} 222930 string {VERSION\ Maple worksheet 22294>9 string >\0 version %.1s. 22295>>11 string >\0 %.1s 22296 22297# .mps 222980 string \0\0\001$ Maple something 22299# from byte 4 it is either 'nul E' or 'soh R' 22300# I think 'nul E' means a file that was saved as a different name 22301# a sort of revision marking 22302# 'soh R' means new 22303>4 string \000\105 An old revision 22304>4 string \001\122 The latest save 22305 22306# .mpl 22307# some of these are the same as .mps above 22308#0000000 000 000 001 044 000 105 same as .mps 22309#0000000 000 000 001 044 001 122 same as .mps 22310 223110 string #\n##\ <SHAREFILE= Maple something 223120 string \n#\n##\ <SHAREFILE= Maple something 223130 string ##\ <SHAREFILE= Maple something 223140 string #\r##\ <SHAREFILE= Maple something 223150 string \r#\r##\ <SHAREFILE= Maple something 223160 string #\ \r##\ <DESCRIBE> Maple something anomalous. 22317#-------------------------------------------- 22318# marc21: file(1) magic for MARC 21 Format 22319# 22320# Kevin Ford (kefo@loc.gov) 22321# 22322# MARC21 formats are for the representation and communication 22323# of bibliographic and related information in machine-readable 22324# form. For more info, see https://www.loc.gov/marc/ 22325 22326 22327# leader position 20-21 must be 45 22328# and 22-23 also 00 so far, but we check that later. 2232920 string 45 22330>0 search/2048 \x1e 22331 22332# leader starts with 5 digits, followed by codes specific to MARC format 22333>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 22334!:mime application/marc 22335>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 22336!:mime application/marc 22337>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 22338!:mime application/marc 22339>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 22340!:mime application/marc 22341>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 22342!:mime application/marc 22343 22344# leader position 22-23, should be "00" but is it? 22345>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 22346!:mime application/marc 22347 22348#------------------------------------------------------------------------------ 22349# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 22350# mathcad: file(1) magic for Mathcad documents 22351# URL: http://www.mathsoft.com/ 22352# From: Josh Triplett <josh@freedesktop.org> 22353 223540 string .MCAD\t Mathcad document 22355 22356#------------------------------------------------------------------------------ 22357# $File: mathematica,v 1.11 2021/02/23 00:51:10 christos Exp $ 22358# mathematica: file(1) magic for mathematica files 22359# "H. Nanosecond" <aldomel@ix.netcom.com> 22360# Mathematica a multi-purpose math program 22361# versions 2.2 and 3.0 22362 22363#mathematica .mb 223640 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 22365!:ext mb 223660 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 22367!:ext mb 22368 22369# .ma 22370# multiple possibilities: 22371 223720 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 22373#>41 string >\0 %s 22374!:ext mb 22375 22376#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 22377 22378#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 22379#>675 string >\0 %s #doesn't work well 22380 22381# there may be 'cr' instead of 'nl' in some does this matter? 22382 22383# generic: 223840 string (*^\r\r::[\011 Mathematica notebook version 2.x 22385!:ext mb 223860 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 22387!:ext mb 223880 string (*^\015 Mathematica notebook version 2.x 22389!:ext mb 223900 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 22391!:ext mb 223920 string (*^\r::[\011 Mathematica notebook version 2.x 22393!:ext mb 223940 string (*^\r\n::[\011 Mathematica notebook version 2.x 22395!:ext mb 223960 string (*^\n\n::[\011 Mathematica notebook version 2.x 22397!:ext mb 223980 string (*^\n::[\011 Mathematica notebook version 2.x 22399!:ext mb 22400 22401 22402# Mathematica .mx files 22403 22404#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 224050 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 22406#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 22407# >71... is optional 22408>88 string >\0 from %s 22409 22410 22411# Mathematica files PBF: 22412# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 224130 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 22414 22415# .ml files These are menu resources I think 22416# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 22417# how to put that into a magic rule? 224184 string \ A~ MAthematica .ml file 22419 22420# .nb files 22421#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 224220 string (*********************** Mathematica 3.0 notebook 22423 22424# other (* matches it is a comment start in these langs 22425# GRR: Too weak; also matches other languages e.g. ML 22426#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 22427 22428######################### 22429# MatLab v5 224300 string MATLAB Matlab v5 mat-file 22431>126 short 0x494d (big endian) 22432>>124 beshort x version 0x%04x 22433>126 short 0x4d49 (little endian) 22434>>124 leshort x version 0x%04x 22435 22436 22437#------------------------------------------------------------------------------ 22438# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $ 22439# matroska: file(1) magic for Matroska files 22440# 22441# See https://www.matroska.org/ 22442# 22443 22444# EBML id: 224450 belong 0x1a45dfa3 22446# DocType id: 22447>4 search/4096 \x42\x82 22448# DocType contents: 22449>>&1 string webm WebM 22450!:mime video/webm 22451>>&1 string matroska Matroska data 22452!:mime video/x-matroska 22453 22454#------------------------------------------------------------------------------ 22455# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 22456# Mavroyanopoulos Nikos <nmav@hellug.gr> 22457# mcrypt: file(1) magic for mcrypt 2.2.x; 224580 string \0m\3 mcrypt 2.5 encrypted data, 22459>4 string >\0 algorithm: %s, 22460>>&1 leshort >0 keysize: %d bytes, 22461>>>&0 string >\0 mode: %s, 22462 224630 string \0m\2 mcrypt 2.2 encrypted data, 22464>3 byte 0 algorithm: blowfish-448, 22465>3 byte 1 algorithm: DES, 22466>3 byte 2 algorithm: 3DES, 22467>3 byte 3 algorithm: 3-WAY, 22468>3 byte 4 algorithm: GOST, 22469>3 byte 6 algorithm: SAFER-SK64, 22470>3 byte 7 algorithm: SAFER-SK128, 22471>3 byte 8 algorithm: CAST-128, 22472>3 byte 9 algorithm: xTEA, 22473>3 byte 10 algorithm: TWOFISH-128, 22474>3 byte 11 algorithm: RC2, 22475>3 byte 12 algorithm: TWOFISH-192, 22476>3 byte 13 algorithm: TWOFISH-256, 22477>3 byte 14 algorithm: blowfish-128, 22478>3 byte 15 algorithm: blowfish-192, 22479>3 byte 16 algorithm: blowfish-256, 22480>3 byte 100 algorithm: RC6, 22481>3 byte 101 algorithm: IDEA, 22482>4 byte 0 mode: CBC, 22483>4 byte 1 mode: ECB, 22484>4 byte 2 mode: CFB, 22485>4 byte 3 mode: OFB, 22486>4 byte 4 mode: nOFB, 22487>5 byte 0 keymode: 8bit 22488>5 byte 1 keymode: 4bit 22489>5 byte 2 keymode: SHA-1 hash 22490>5 byte 3 keymode: MD5 hash 22491 22492#------------------------------------------------------------------------------ 22493# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $ 22494# measure: file(1) magic for measurement data 22495 22496# DIY-Thermocam raw data 224970 name diy-thermocam-parser 22498>0 beshort x scale %d- 22499>2 beshort x \b%d, 22500>4 lefloat x spot sensor temperature %f, 22501>9 ubyte 0 unit celsius, 22502>9 ubyte 1 unit fahrenheit, 22503>8 ubyte x color scheme %d 22504>10 ubyte 1 \b, show spot sensor 22505>11 ubyte 1 \b, show scale bar 22506>12 ubyte &1 \b, minimum point enabled 22507>12 ubyte &2 \b, maximum point enabled 22508>13 lefloat x \b, calibration: offset %f, 22509>17 lefloat x slope %f 22510 225110 name diy-thermocam-checker 22512>9 ubyte <2 22513>>10 ubyte <2 22514>>>11 ubyte <2 22515>>>>12 ubyte <4 22516>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 22517 22518# V2 and Leption 3.x: 2251938408 ubyte <19 22520>38400 use diy-thermocam-checker 22521>>38400 default x (Lepton 3.x), 22522>>>38400 use diy-thermocam-parser 22523 22524# V1 or Lepton 2.x 225259608 ubyte <19 22526>9600 use diy-thermocam-checker 22527>>9600 default x (Lepton 2.x), 22528>>>9600 use diy-thermocam-parser 22529 22530# Becker & Hickl Photon Counting (PMS) data file 22531# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57) 22532(0x02.l) string *IDENTIFICATION Becker & Hickl PMS Data File 22533>0x12 short x (%d data blocks) 22534!:ext sdt 22535 22536#------------------------------------------------------------------------------ 22537# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $ 22538# mercurial: file(1) magic for Mercurial changeset bundles 22539# https://www.selenic.com/mercurial/wiki/ 22540# 22541# Jesse Glick (jesse.glick@sun.com) 22542# 22543 225440 string HG10 Mercurial changeset bundle 22545>4 string UN (uncompressed) 22546>4 string GZ (gzip compressed) 22547>4 string BZ (bzip2 compressed) 22548 22549#------------------------------------------------------------------------------ 22550# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $ 22551# metastore: file(1) magic for metastore files 22552# From: Thomas Wissen 22553# see https://david.hardeman.nu/software.php#metastore 225540 string MeTaSt00r3 Metastore data file, 22555>10 bequad x version %0llx 22556 22557#------------------------------------------------------------------------------ 22558# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 22559# rinex: file(1) magic for RINEX files 22560# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 22561# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 22562# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 2256360 string RINEX 22564>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 22565>>&32 string x \b, date %15.15s 22566>>5 string x \b, version %6.6s 22567!:mime rinex/broadcast 22568>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 22569>>&32 string x \b, date %15.15s 22570>>5 string x \b, version %6.6s 22571!:mime rinex/observation 22572>80 search/256 XXRINEXC RINEX Data, Clock 22573>>&32 string x \b, date %15.15s 22574>>5 string x \b, version %6.6s 22575!:mime rinex/clock 22576>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 22577>>&32 string x \b, date %15.15s 22578>>5 string x \b, version %6.6s 22579!:mime rinex/navigation 22580>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 22581>>&32 string x \b, date %15.15s 22582>>5 string x \b, version %6.6s 22583!:mime rinex/navigation 22584>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 22585>>&32 string x \b, date %15.15s 22586>>5 string x \b, version %6.6s 22587!:mime rinex/navigation 22588>80 search/256 XXRINEXM RINEX Data, Meteorological 22589>>&32 string x \b, date %15.15s 22590>>5 string x \b, version %6.6s 22591!:mime rinex/meteorological 22592>80 search/256 XXRINEXN RINEX Data, Navigation 22593>>&32 string x \b, date %15.15s 22594>>5 string x \b, version %6.6s 22595!:mime rinex/navigation 22596>80 search/256 XXRINEXO RINEX Data, Observation 22597>>&32 string x \b, date %15.15s 22598>>5 string x \b, version %6.6s 22599!:mime rinex/observation 22600 22601# https://en.wikipedia.org/wiki/GRIB 226020 string GRIB 22603>7 byte =1 Gridded binary (GRIB) version 1 22604>7 byte =2 Gridded binary (GRIB) version 2 22605 22606#------------------------------------------------------------------------------ 22607# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $ 22608# Micro Focus COBOL data files. 22609 22610# https://documentation.microfocus.com/help/index.jsp?topic=\ 22611# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 22612# http://www.cobolproducts.com/datafile/data-viewer.html 22613# https://github.com/miracle2k/mfcobol-export 22614 226150 string \x30\x00\x00\x7C 22616>36 string \x00\x3E Micro Focus File with Header (DAT) 22617!:mime application/octet-stream 22618 226190 string \x30\x7E\x00\x00 22620>36 string \x00\x3E Micro Focus File with Header (DAT) 22621!:mime application/octet-stream 22622 2262339 string \x02 22624>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 22625!:mime application/octet-stream 22626 22627#------------------------------------------------------------------------------ 22628# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 22629# mime: file(1) magic for MIME encoded files 22630# 226310 string/t Content-Type:\040 22632>14 string >\0 %s 226330 string/t Content-Type: 22634>13 string >\0 %s 22635 22636#------------------------------------------------------------------------------ 22637# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 22638# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 22639# and DEC Ultrix 22640# 226410 beshort 0x0160 MIPSEB ECOFF executable 22642>20 beshort 0407 (impure) 22643>20 beshort 0410 (swapped) 22644>20 beshort 0413 (paged) 22645>8 belong >0 not stripped 22646>8 belong 0 stripped 22647>22 byte x - version %d 22648>23 byte x \b.%d 22649# 226500 beshort 0x0162 MIPSEL-BE ECOFF executable 22651>20 beshort 0407 (impure) 22652>20 beshort 0410 (swapped) 22653>20 beshort 0413 (paged) 22654>8 belong >0 not stripped 22655>8 belong 0 stripped 22656>23 byte x - version %d 22657>22 byte x \b.%d 22658# 226590 beshort 0x6001 MIPSEB-LE ECOFF executable 22660>20 beshort 03401 (impure) 22661>20 beshort 04001 (swapped) 22662>20 beshort 05401 (paged) 22663>8 belong >0 not stripped 22664>8 belong 0 stripped 22665>23 byte x - version %d 22666>22 byte x \b.%d 22667# 226680 beshort 0x6201 MIPSEL ECOFF executable 22669>20 beshort 03401 (impure) 22670>20 beshort 04001 (swapped) 22671>20 beshort 05401 (paged) 22672>8 belong >0 not stripped 22673>8 belong 0 stripped 22674>23 byte x - version %d 22675>22 byte x \b.%d 22676# 22677# MIPS 2 additions 22678# 226790 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 22680>20 beshort 0407 (impure) 22681>20 beshort 0410 (swapped) 22682>20 beshort 0413 (paged) 22683>8 belong >0 not stripped 22684>8 belong 0 stripped 22685>22 byte x - version %d 22686>23 byte x \b.%d 22687# 226880 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 22689>20 beshort 0407 (impure) 22690>20 beshort 0410 (swapped) 22691>20 beshort 0413 (paged) 22692>8 belong >0 not stripped 22693>8 belong 0 stripped 22694>22 byte x - version %d 22695>23 byte x \b.%d 22696# 226970 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 22698>20 beshort 03401 (impure) 22699>20 beshort 04001 (swapped) 22700>20 beshort 05401 (paged) 22701>8 belong >0 not stripped 22702>8 belong 0 stripped 22703>23 byte x - version %d 22704>22 byte x \b.%d 22705# 227060 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 22707>20 beshort 03401 (impure) 22708>20 beshort 04001 (swapped) 22709>20 beshort 05401 (paged) 22710>8 belong >0 not stripped 22711>8 belong 0 stripped 22712>23 byte x - version %d 22713>22 byte x \b.%d 22714# 22715# MIPS 3 additions 22716# 227170 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 22718>20 beshort 0407 (impure) 22719>20 beshort 0410 (swapped) 22720>20 beshort 0413 (paged) 22721>8 belong >0 not stripped 22722>8 belong 0 stripped 22723>22 byte x - version %d 22724>23 byte x \b.%d 22725# 227260 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 22727>20 beshort 0407 (impure) 22728>20 beshort 0410 (swapped) 22729>20 beshort 0413 (paged) 22730>8 belong >0 not stripped 22731>8 belong 0 stripped 22732>22 byte x - version %d 22733>23 byte x \b.%d 22734# 227350 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 22736>20 beshort 03401 (impure) 22737>20 beshort 04001 (swapped) 22738>20 beshort 05401 (paged) 22739>8 belong >0 not stripped 22740>8 belong 0 stripped 22741>23 byte x - version %d 22742>22 byte x \b.%d 22743# 227440 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 22745>20 beshort 03401 (impure) 22746>20 beshort 04001 (swapped) 22747>20 beshort 05401 (paged) 22748>8 belong >0 not stripped 22749>8 belong 0 stripped 22750>23 byte x - version %d 22751>22 byte x \b.%d 22752# 227530 beshort 0x180 MIPSEB Ucode 227540 beshort 0x182 MIPSEL-BE Ucode 22755 22756#------------------------------------------------------------------------------ 22757# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 22758# mirage: file(1) magic for Mirage executables 22759# 22760# XXX - byte order? 22761# 227620 long 31415 Mirage Assembler m.out executable 22763 22764#----------------------------------------------------------------------------- 22765# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $ 22766# misctools: file(1) magic for miscellaneous UNIX tools. 22767# 227680 search/1 %%!! X-Post-It-Note text 227690 string/c BEGIN:VCALENDAR vCalendar calendar file 22770!:mime text/calendar 22771# updated by Joerg Jenderek at Apr 2015 22772# Extension: .vcf 22773# https://en.wikipedia.org/wiki/VCard 227740 string/c BEGIN:VCARD vCard visiting card 22775# deprecated 22776#!:mime text/x-vcard 22777!:mime text/vcard 22778# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 22779>12 search/14000/c VERSION: 22780# VERSION 2.1 , 3.0 or 4.0 22781>>&0 string x \b, version %-.3s 22782 22783# Summary: Libtool library file 22784# Extension: .la 22785# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 227860 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 22787 22788# Summary: Libtool object file 22789# Extension: .lo 22790# Submitted by: Abel Cheung <abelcheung@gmail.com> 227910 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 22792 22793# From: Daniel Novotny <dnovotny@redhat.com> 22794# Update: Joerg Jenderek 22795# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 22796# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 22797# 22798# "Windows Minidump" by TrID 22799# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 228000 string MDMP Mini DuMP crash report 22801# https://filext.com/file-extension/DMP 22802!:mime application/x-dmp 22803!:ext dmp/mdmp 22804# The high-order word is an internal value that is implementation specific. 22805# The low-order word is MINIDUMP_VERSION 0xA793 22806>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 22807# NumberOfStreams 8,9,10,13 22808>8 ulelong x \b, %d streams 22809# StreamDirectoryRva 0x20 22810>12 ulelong !0x20 \b, 0x%8.8x RVA 22811# CheckSum 0 22812>16 ulelong !0 \b, CheckSum 0x%8.8x 22813# Reserved or TimeDateStamp 22814>20 ledate x \b, %s 22815# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 22816# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 22817>24 ulelong x \b, 0x%x type 22818# >24 ulelong >0 \b; include 22819# >>24 ulelong &0x00000001 \b data sections, 22820# >>24 ulelong &0x00000020 \b list of unloaded modules, 22821# >>24 ulelong &0x00000100 \b process and thread information, 22822# >>24 ulelong &0x00000800 \b memory information, 22823 22824# Summary: abook addressbook file 22825# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 228260 string #\x20abook\x20addressbook\x20file abook address book 22827!:mime application/x-abook-addressbook 22828 22829#------------------------------------------------------------------------------ 22830# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 22831# mkid: file(1) magic for mkid(1) databases 22832# 22833# ID is the binary tags database produced by mkid(1). 22834# 22835# XXX - byte order? 22836# 228370 string \311\304 ID tags data 22838>2 short >0 version %d 22839 22840#------------------------------------------------------------------------------ 22841# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 22842# mlssa: file(1) magic for MLSSA datafiles 22843# 228440 lelong 0xffffabcd MLSSA datafile, 22845>4 leshort x algorithm %d, 22846>10 lelong x %d samples 22847 22848#------------------------------------------------------------------------------ 22849# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 22850# mmdf: file(1) magic for MMDF mail files 22851# 228520 string \001\001\001\001 MMDF mailbox 22853 22854#------------------------------------------------------------------------------ 22855# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $ 22856# modem: file(1) magic for modem programs 22857# 22858# From: Florian La Roche <florian@knorke.saar.de> 228591 string PC\ Research,\ Inc Digifax-G3-File 22860>29 byte 1 \b, fine resolution 22861>29 byte 0 \b, normal resolution 22862 22863# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 22864# Modified by: Joerg Jenderek 22865# URL: https://de.wikipedia.org/wiki/Fax 22866# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 22867# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 228680 short 0x0100 22869# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 22870>2 search/9 \0\0 22871# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 22872>2 default x 22873# skip IRCAM file (VAX big-endian) ./audio 22874>>0 belong !0x0001a364 22875# skip GEM Image data ./images 22876>>>2 beshort !0x0008 22877# look for first keyword of Panorama database *.pan 22878>>>>11 search/262 \x06DESIGN 22879# skip Panorama database 22880>>>>11 default x 22881# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 22882>>>>>27118 search/1864 DreamWorld 22883>>>>>27118 default x 22884# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 22885>>>>>>8 ubequad !0x2e01010454010203 22886# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 22887>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 22888# version 5.25 labeled the entry above "raw G3 data, byte-padded" 22889!:mime image/g3fax 22890#!:apple ????TIFF 22891!:ext g3 22892# unusual image starting with black pixel 22893#0 short 0x1300 raw G3 (Group 3) FAX 228940 short 0x1400 22895# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 22896>2 search/9 \0\0 22897# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 22898>2 default x raw G3 (Group 3) FAX 22899# version 5.25 labeled the above entry as "raw G3 data" 22900!:mime image/g3fax 22901!:ext g3 22902# unusual image with black pixel near beginning 22903#0 short 0x1900 raw G3 (Group 3) FAX 22904 22905# 22906# Magic data for vgetty voice formats 22907# (Martin Seine & Marc Eberhard) 22908 22909# 22910# raw modem data version 1 22911# 229120 string RMD1 raw modem data 22913>4 string >\0 (%s / 22914>20 short >0 compression type 0x%04x) 22915 22916# 22917# portable voice format 1 22918# 229190 string PVF1\n portable voice format 22920>5 string >\0 (binary %s) 22921 22922# 22923# portable voice format 2 22924# 229250 string PVF2\n portable voice format 22926>5 string >\0 (ascii %s) 22927 22928# From: Bernd Nuernberger <bernd.nuernberger@web.de> 22929# Brooktrout G3 fax data incl. 128 byte header 22930# Common suffixes: 3??, BRK, BRT, BTR 229310 leshort 0x01bb 22932>2 leshort 0x0100 Brooktrout 301 fax image, 22933>>9 leshort x %d x 22934>>0x2d leshort x %d 22935>>6 leshort 200 \b, fine resolution 22936>>6 leshort 100 \b, normal resolution 22937>>11 byte 1 \b, G3 compression 22938>>11 byte 2 \b, G32D compression 22939 22940#------------------------------------------------------------------------------ 22941# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $ 22942# modulefile: file(1) magic for user's environment modulefile 22943# URL: http://modules.sourceforge.net/ 22944# Reference: https://modules.readthedocs.io/en/stable/modulefile.html 22945# From: Xavier Delaruelle <xavier.delaruelle@cea.fr> 229460 string #%Module modulefile 22947!:mime text/x-modulefile 22948 22949#------------------------------------------------------------------------------ 22950# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 22951# motorola: file(1) magic for Motorola 68K and 88K binaries 22952# 22953# 68K 22954# 229550 beshort 0520 mc68k COFF 22956>18 beshort ^00000020 object 22957>18 beshort &00000020 executable 22958>12 belong >0 not stripped 22959>168 string .lowmem Apple toolbox 22960>20 beshort 0407 (impure) 22961>20 beshort 0410 (pure) 22962>20 beshort 0413 (demand paged) 22963>20 beshort 0421 (standalone) 229640 beshort 0521 mc68k executable (shared) 22965>12 belong >0 not stripped 229660 beshort 0522 mc68k executable (shared demand paged) 22967>12 belong >0 not stripped 22968# 22969# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 22970# 229710 beshort 0554 68K BCS executable 22972# 22973# 88K 22974# 22975# Motorola/88Open BCS 22976# 229770 beshort 0555 88K BCS executable 22978# 22979# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 229800 string S0 Motorola S-Record; binary data in text format 22981 22982# ATARI ST relocatable PRG 22983# 22984# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 22985# (according to Roland Waldi, Oct 21, 1987) 22986# besides the magic 0x601a, the text segment size is checked to be 22987# not larger than 1 MB (which is a lot on ST). 22988# The additional 0x601b distinction I took from Doug Lee's magic. 229890 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 22990>2 belong x (txt=%d, 22991>6 belong x dat=%d, 22992>10 belong x bss=%d, 22993>14 belong x sym=%d) 229940 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 22995>2 belong x (txt=%d, 22996>6 belong x dat=%d, 22997>10 belong x bss=%d, 22998>14 belong x sym=%d) 22999 23000# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 230010 beshort 0x601A Atari 68xxx executable, 23002>2 belong x text len %u, 23003>6 belong x data len %u, 23004>10 belong x BSS len %u, 23005>14 belong x symboltab len %u, 23006>18 belong 0 23007>22 belong &0x01 fastload flag, 23008>22 belong &0x02 may be loaded to alternate RAM, 23009>22 belong &0x04 malloc may be from alternate RAM, 23010>22 belong x flags: 0x%X, 23011>26 beshort 0 no relocation tab 23012>26 beshort !0 + relocation tab 23013>30 string SFX [Self-Extracting LZH SFX archive] 23014>38 string SFX [Self-Extracting LZH SFX archive] 23015>44 string ZIP! [Self-Extracting ZIP SFX archive] 23016 230170 beshort 0x0064 Atari 68xxx CPX file 23018>8 beshort x (version %04x) 23019 23020#------------------------------------------------------------------------------ 23021# $File: mozilla,v 1.11 2020/12/12 20:01:47 christos Exp $ 23022# mozilla: file(1) magic for Mozilla XUL fastload files 23023# (XUL.mfasl and XPC.mfasl) 23024# URL: https://www.mozilla.org/ 23025# From: Josh Triplett <josh@freedesktop.org> 23026 230270 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 23028# Probably the next magic line contains misspelled "mozLz40\0" 230290 string mozLz4a Mozilla lz4 compressed bookmark data 23030# From: Joerg Jenderek 23031# URL: https://lz4.github.io/lz4/ 23032# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/ 23033# dejsonlz4-master\src\dejsonlz4.c 23034# Note: mostly JSON compressed with a non-standard LZ4 header 23035# can be unpacked by dejsonlz4 but not lz4 program. 230360 string mozLz40\0 Mozilla lz4 compressed data 23037!:mime application/x-lz4+json 23038# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks 23039!:ext jsonlz4/mozlz4 23040# decomp_size 23041>8 ulelong x \b, originally %u bytes 23042# lz4 data 23043#>12 ubequad x \b, lz4 data 0x%16.16llx 23044 23045# From: Joerg Jenderek 23046# URL: https://en.wikipedia.org/wiki/Firefox_4 23047# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 23048# Note: Most ZIP utilities are able to extract such archives 23049# maybe only partly or after some warnings. Example: 23050# zip -FF omni.ja --out omni.zip 230514 string PK\001\002 Mozilla archive omni.ja 23052!:mime application/x-zip 23053!:ext ja 23054# TODO: 23055#>4 use zip-dir-entry 23056 23057#------------------------------------------------------------------------------ 23058# $File: msdos,v 1.145 2021/02/23 00:51:10 christos Exp $ 23059# msdos: file(1) magic for MS-DOS files 23060# 23061 23062# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 23063# updated by Joerg Jenderek at Oct 2008,Apr 2011 230640 string/t @ 23065>1 string/cW \ echo\ off DOS batch file text 23066!:mime text/x-msdos-batch 23067!:ext bat 23068>1 string/cW echo\ off DOS batch file text 23069!:mime text/x-msdos-batch 23070!:ext bat 23071>1 string/cW rem DOS batch file text 23072!:mime text/x-msdos-batch 23073!:ext bat 23074>1 string/cW set\ DOS batch file text 23075!:mime text/x-msdos-batch 23076!:ext bat 23077 23078 23079# OS/2 batch files are REXX. the second regex is a bit generic, oh well 23080# the matched commands seem to be common in REXX and uncommon elsewhere 23081100 search/0xffff rxfuncadd 23082>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 23083100 search/0xffff say 23084>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 23085 23086# updated by Joerg Jenderek at Oct 2015 23087# https://de.wikipedia.org/wiki/Common_Object_File_Format 23088# http://www.delorie.com/djgpp/doc/coff/filhdr.html 23089# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 23090#0 leshort 0x14c MS Windows COFF Intel 80386 object file 23091#>4 ledate x stamp %s 230920 leshort 0x166 MS Windows COFF MIPS R4000 object file 23093#>4 ledate x stamp %s 230940 leshort 0x184 MS Windows COFF Alpha object file 23095#>4 ledate x stamp %s 230960 leshort 0x268 MS Windows COFF Motorola 68000 object file 23097#>4 ledate x stamp %s 230980 leshort 0x1f0 MS Windows COFF PowerPC object file 23099#>4 ledate x stamp %s 231000 leshort 0x290 MS Windows COFF PA-RISC object file 23101#>4 ledate x stamp %s 23102 23103# Tests for various EXE types. 23104# 23105# Many of the compressed formats were extracted from IDARC 1.23 source code. 23106# 231070 string/b MZ 23108# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 23109>0x18 leshort <0x40 MS-DOS executable 23110!:mime application/x-dosexec 23111# Windows and later versions of DOS will allow .EXEs to be named with a .COM 23112# extension, mostly for compatibility's sake. 23113# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM 23114# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml 23115!:ext exe/com/vlm 23116# These traditional tests usually work but not always. When test quality support is 23117# implemented these can be turned on. 23118#>>0x18 leshort 0x1c (Borland compiler) 23119#>>0x18 leshort 0x1e (MS compiler) 23120 23121# Maybe it's a PE? 23122>(0x3c.l) string PE\0\0 PE 23123!:mime application/x-dosexec 23124>>(0x3c.l+24) leshort 0x010b \b32 executable 23125>>(0x3c.l+24) leshort 0x020b \b32+ executable 23126>>(0x3c.l+24) leshort 0x0107 ROM image 23127>>(0x3c.l+24) default x Unknown PE signature 23128>>>&0 leshort x 0x%x 23129>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 23130>>(0x3c.l+92) leshort 1 23131# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 23132# drivers in Windows/System32/drivers/*.sys. 23133>>>(0x3c.l+22) leshort&0x2000 >0 (native) 23134!:ext dll/sys 23135>>>(0x3c.l+22) leshort&0x2000 0 (native) 23136!:ext exe/sys 23137>>(0x3c.l+92) leshort 2 23138>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 23139# These could probably be at least partially distinguished from one another by 23140# looking for specific exported functions. 23141# CPL: Control Panel item 23142# TLB: Type library 23143# OCX: OLE/ActiveX control 23144# ACM: Audio compression manager codec 23145# AX: DirectShow source filter 23146# IME: Input method editor 23147!:ext dll/cpl/tlb/ocx/acm/ax/ime 23148>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 23149# Screen savers typically include code from the scrnsave.lib static library, but 23150# that's not guaranteed. 23151!:ext exe/scr 23152>>(0x3c.l+92) leshort 3 23153>>>(0x3c.l+22) leshort&0x2000 >0 (console) 23154!:ext dll/cpl/tlb/ocx/acm/ax/ime 23155>>>(0x3c.l+22) leshort&0x2000 0 (console) 23156!:ext exe/com 23157# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 23158>>(0x3c.l+92) leshort 7 (POSIX) 23159>>(0x3c.l+92) leshort 9 (Windows CE) 23160>>(0x3c.l+92) leshort 10 (EFI application) 23161>>(0x3c.l+92) leshort 11 (EFI boot service driver) 23162>>(0x3c.l+92) leshort 12 (EFI runtime driver) 23163>>(0x3c.l+92) leshort 13 (EFI ROM) 23164>>(0x3c.l+92) leshort 14 (XBOX) 23165>>(0x3c.l+92) leshort 15 (Windows boot application) 23166>>(0x3c.l+92) default x (Unknown subsystem 23167>>>&0 leshort x 0x%x) 23168>>(0x3c.l+4) leshort 0x14c Intel 80386 23169>>(0x3c.l+4) leshort 0x166 MIPS R4000 23170>>(0x3c.l+4) leshort 0x168 MIPS R10000 23171>>(0x3c.l+4) leshort 0x184 Alpha 23172>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 23173>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 23174>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 23175>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 23176>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 23177>>(0x3c.l+4) leshort 0x1c0 ARM 23178>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 23179>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 23180>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 23181>>(0x3c.l+4) leshort 0x1f0 PowerPC 23182>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 23183>>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian) 23184>>(0x3c.l+4) leshort 0x200 Intel Itanium 23185>>(0x3c.l+4) leshort 0x266 MIPS16 23186>>(0x3c.l+4) leshort 0x268 Motorola 68000 23187>>(0x3c.l+4) leshort 0x290 PA-RISC 23188>>(0x3c.l+4) leshort 0x366 MIPSIV 23189>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 23190>>(0x3c.l+4) leshort 0xebc EFI byte code 23191>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 23192>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 23193>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 23194>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 23195>>(0x3c.l+4) leshort 0x8664 x86-64 23196>>(0x3c.l+4) leshort 0xaa64 Aarch64 23197>>(0x3c.l+4) leshort 0xc0ee MSIL 23198>>(0x3c.l+4) default x Unknown processor type 23199>>>&0 leshort x 0x%x 23200>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 23201>>(0x3c.l+22) leshort&0x1000 >0 system file 23202>>(0x3c.l+24) leshort 0x010b 23203>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 23204>>(0x3c.l+24) leshort 0x020b 23205>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 23206 23207# hooray, there's a DOS extender using the PE format, with a valid PE 23208# executable inside (which just prints a message and exits if run in win) 23209>>(8.s*16) string 32STUB \b, 32rtm DOS extender 23210>>(8.s*16) string !32STUB \b, for MS Windows 23211>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 23212>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 23213>>(0x3c.l+0xf8) search/0x140 UPX2 23214>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 23215>>(0x3c.l+0xf8) search/0x140 .idata 23216>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 23217>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 23218>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 23219>>(0x3c.l+0xf8) search/0x140 .rsrc 23220>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 23221>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 23222>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 23223>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 23224>>(0x3c.l+0xf8) search/0x140 .data 23225>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 23226>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 23227>>>(0x3c.l+0xf7) byte x 23228>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 23229>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 23230>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 23231>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 23232>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 23233>>0x30 string Inno \b, InnoSetup self-extracting archive 23234 23235# If the relocation table is 0x40 or more bytes into the file, it's definitely 23236# not a DOS EXE. 23237>0x18 leshort >0x3f 23238 23239# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 23240# must be one of the unusual subformats. 23241>>(0x3c.l) string !PE\0\0 MS-DOS executable 23242!:mime application/x-dosexec 23243 23244>>(0x3c.l) string NE \b, NE 23245!:mime application/x-dosexec 23246>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 23247>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 23248>>>(0x3c.l+0x36) byte 3 for MS-DOS 23249>>>(0x3c.l+0x36) byte 4 for Windows 386 23250>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 23251>>>(0x3c.l+0x36) default x 23252>>>>(0x3c.l+0x36) byte x (unknown OS %x) 23253>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 23254>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 23255# DRV: Driver 23256# 3GR: Grabber device driver 23257# CPL: Control Panel Item 23258# VBX: Visual Basic Extension 23259# FON: Bitmap font 23260# FOT: Font resource file 23261!:ext dll/drv/3gr/cpl/vbx/fon/fot 23262>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 23263!:ext exe/scr 23264>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 23265>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 23266 23267>>(0x3c.l) string LX\0\0 \b, LX 23268!:mime application/x-dosexec 23269>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 23270>>>(0x3c.l+0x0a) leshort 1 for OS/2 23271>>>(0x3c.l+0x0a) leshort 2 for MS Windows 23272>>>(0x3c.l+0x0a) leshort 3 for DOS 23273>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 23274>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 23275>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 23276>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 23277>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 23278>>>(0x3c.l+0x08) leshort 1 i80286 23279>>>(0x3c.l+0x08) leshort 2 i80386 23280>>>(0x3c.l+0x08) leshort 3 i80486 23281>>>(8.s*16) string emx \b, emx 23282>>>>&1 string x %s 23283>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 23284 23285# MS Windows system file, supposedly a collection of LE executables 23286>>(0x3c.l) string W3 \b, W3 for MS Windows 23287!:mime application/x-dosexec 23288 23289>>(0x3c.l) string LE\0\0 \b, LE executable 23290!:mime application/x-dosexec 23291>>>(0x3c.l+0x0a) leshort 1 23292# some DOS extenders use LE files with OS/2 header 23293>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 23294>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 23295>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 23296>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 23297>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 23298>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 23299>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 23300# this is a wild guess; hopefully it is a specific signature 23301>>>>&0x24 lelong <0x50 23302>>>>>(&0x4c.l) string \xfc\xb8WATCOM 23303>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 23304# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 23305#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 23306# fails with DOS-Extenders. 23307>>>(0x3c.l+0x0a) leshort 2 for MS Windows 23308>>>(0x3c.l+0x0a) leshort 3 for DOS 23309>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 23310# VXD: VxD for Windows 95/98/Me 23311# 386: VxD for Windows 2.10, 3.0, 3.1x 23312# PDR: Port driver 23313# MPD: Miniport driver (?) 23314!:ext vxd/386/pdr/mpd 23315>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 23316>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 23317 23318# looks like ASCII, probably some embedded copyright message. 23319# and definitely not NE/LE/LX/PE 23320>>0x3c lelong >0x20000000 23321>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 23322!:mime application/x-dosexec 23323!:ext exe/com 23324# header data too small for extended executable 23325>2 long !0 23326>>0x18 leshort <0x40 23327>>>(4.s*512) leshort !0x014c 23328 23329>>>>&(2.s-514) string !LE 23330>>>>>&-2 string !BW \b, MZ for MS-DOS 23331!:mime application/x-dosexec 23332>>>>&(2.s-514) string LE \b, LE 23333>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 23334# educated guess since indirection is still not capable enough for complex offset 23335# calculations (next embedded executable would be at &(&2*512+&0-2) 23336# I suspect there are only LE executables in these multi-exe files 23337>>>>&(2.s-514) string BW 23338>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 23339>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 23340 23341# This sequence skips to the first COFF segment, usually .text 23342>(4.s*512) leshort 0x014c \b, COFF 23343!:mime application/x-dosexec 23344>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 23345>>(8.s*16) string emx 23346>>>&1 string x for DOS, Win or OS/2, emx %s 23347>>&(&0x42.l-3) byte x 23348>>>&0x26 string UPX \b, UPX compressed 23349# and yet another guess: small .text, and after large .data is unusual, could be 32lite 23350>>&0x2c search/0xa0 .text 23351>>>&0x0b lelong <0x2000 23352>>>>&0 lelong >0x6000 \b, 32lite compressed 23353 23354>(8.s*16) string $WdX \b, WDos/X DOS extender 23355 23356# By now an executable type should have been printed out. The executable 23357# may be a self-uncompressing archive, so look for evidence of that and 23358# print it out. 23359# 23360# Some signatures below from Greg Roelofs, newt@uchicago.edu. 23361# 23362>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 23363>0xe7 string LH/2\ Self-Extract \b, %s 23364>0x1c string UC2X \b, UCEXE compressed 23365>0x1c string WWP\ \b, WWPACK compressed 23366>0x1c string RJSX \b, ARJ self-extracting archive 23367>0x1c string diet \b, diet compressed 23368>0x1c string LZ09 \b, LZEXE v0.90 compressed 23369>0x1c string LZ91 \b, LZEXE v0.91 compressed 23370>0x1c string tz \b, TinyProg compressed 23371>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 23372!:mime application/zip 23373# Yes, this really is "Copr", not "Corp." 23374>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 23375!:mime application/zip 23376# winarj stores a message in the stub instead of the sig in the MZ header 23377>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 23378>0x20 string AIN 23379>>0x23 string 2 \b, AIN 2.x compressed 23380>>0x23 string <2 \b, AIN 1.x compressed 23381>>0x23 string >2 \b, AIN 1.x compressed 23382>0x24 string LHa's\ SFX \b, LHa self-extracting archive 23383!:mime application/x-lha 23384>0x24 string LHA's\ SFX \b, LHa self-extracting archive 23385!:mime application/x-lha 23386>0x24 string \ $ARX \b, ARX self-extracting archive 23387>0x24 string \ $LHarc \b, LHarc self-extracting archive 23388>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 23389>0x40 string aPKG \b, aPackage self-extracting archive 23390>0x64 string W\ Collis\0\0 \b, Compack compressed 23391>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 23392>>&0xf4 search/0x140 \x0\x40\x1\x0 23393>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 23394>1638 string -lh5- \b, LHa self-extracting archive v2.13S 23395>0x17888 string Rar! \b, RAR self-extracting archive 23396 23397# Skip to the end of the EXE. This will usually work fine in the PE case 23398# because the MZ image is hardcoded into the toolchain and almost certainly 23399# won't match any of these signatures. 23400>(4.s*512) long x 23401>>&(2.s-517) byte x 23402>>>&0 string PK\3\4 \b, ZIP self-extracting archive 23403>>>&0 string Rar! \b, RAR self-extracting archive 23404>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 23405>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 23406>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 23407>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 23408>>>&7 search/400 **ACE** \b, ACE self-extracting archive 23409>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 23410 23411# a few unknown ZIP sfxes, no idea if they are needed or if they are 23412# already captured by the generic patterns above 23413>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 23414# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 23415# 23416 23417# TELVOX Teleinformatica CODEC self-extractor for OS/2: 23418>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 23419>>49824 leshort =1 \b, 1 file 23420>>49824 leshort >1 \b, %u files 23421 23422# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 23423# and https://www.freedos.org/software/?prog=kpdos 23424# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 234250 string/b KCF FreeDOS KEYBoard Layout collection 23426# only version=0x100 found 23427>3 uleshort x \b, version 0x%x 23428# length of string containing author,info and special characters 23429>6 ubyte >0 23430#>>6 pstring x \b, name=%s 23431>>7 string >\0 \b, author=%-.14s 23432>>7 search/254 \xff \b, info= 23433#>>>&0 string x \b%-s 23434>>>&0 string x \b%-.15s 23435# for FreeDOS *.KL files 234360 string/b KLF FreeDOS KEYBoard Layout file 23437# only version=0x100 or 0x101 found 23438>3 uleshort x \b, version 0x%x 23439# stringlength 23440>5 ubyte >0 23441>>8 string x \b, name=%-.2s 234420 string \xffKEYB\ \ \ \0\0\0\0 23443>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 23444 23445# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020 23446# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver 23447# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html 23448# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 234490 ulequad&0x07a0ffffffff 0xffffffff 23450# skip OS/2 INI ./os2 23451>4 ubelong !0x14000000 23452>>0 use msdos-driver 234530 name msdos-driver DOS executable ( 23454#!:mime application/octet-stream 23455!:mime application/x-dosdriver 23456# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 23457# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used? 23458# PROTMAN.DOS ELNKPL.DOS 23459!:ext sys/dev/bin/dos 23460# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device" 23461>40 search/7 UPX! \bUPX compressed\040 23462# DOS device driver attributes 23463>4 uleshort&0x8000 0x0000 \bblock device driver 23464# character device 23465>4 uleshort&0x8000 0x8000 \b 23466# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$" 23467>>4 uleshort&0x0008 0x0008 \bclock\040 23468# fast video output by int 29h 23469# 1 space char after "fast" to get phrase like "fast standard input/output character device driver" 23470>>4 uleshort&0x0010 0x0010 \bfast\040 23471# standard input/output device 23472# 1 space char after "standard" to get phrase like "standard input/output character device driver" 23473>>4 uleshort&0x0003 >0 \bstandard\040 23474>>>4 uleshort&0x0001 0x0001 \binput 23475>>>4 uleshort&0x0003 0x0003 \b/ 23476# 1 space char after "output" to get phrase like "input/output character device driver" 23477>>>4 uleshort&0x0002 0x0002 \boutput\040 23478>>4 uleshort&0x8000 0x8000 \bcharacter device driver 23479>0 ubyte x 23480# upx compressed device driver has garbage instead of real in name field of header 23481>>40 search/7 UPX! 23482>>40 default x 23483# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 23484# 1 space char before device driver name to get phrase like "device driver PROTMAN$" 23485>>>12 ubyte >0x2E \b\040 23486>>>>10 ubyte >0x20 23487>>>>>10 ubyte !0x2E 23488>>>>>>10 ubyte !0x2A \b%c 23489>>>>11 ubyte >0x20 23490>>>>>11 ubyte !0x2E \b%c 23491>>>>12 ubyte >0x20 23492>>>>>12 ubyte !0x39 23493>>>>>>12 ubyte !0x2E \b%c 23494>>>13 ubyte >0x20 23495>>>>13 ubyte !0x2E \b%c 23496>>>>14 ubyte >0x20 23497>>>>>14 ubyte !0x2E \b%c 23498>>>>15 ubyte >0x20 23499>>>>>15 ubyte !0x2E \b%c 23500>>>>16 ubyte >0x20 23501>>>>>16 ubyte !0x2E 23502>>>>>>16 ubyte <0xCB \b%c 23503>>>>17 ubyte >0x20 23504>>>>>17 ubyte !0x2E 23505>>>>>>17 ubyte <0x90 \b%c 23506# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 23507>>>12 ubyte <0x2F 23508# they have their real name at offset 22 23509# also block device drivers like DUMBDRV.SYS 23510>>>>22 string >\056 %-.6s 23511>4 uleshort&0x8000 0x0000 23512# 32 bit sector addressing ( > 32 MB) for block devices 23513>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 23514# support by driver functions 13h, 17h, 18h 23515>4 uleshort&0x0040 0x0040 \b,IOCTL- 23516# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 23517>4 uleshort&0x0800 0x0800 \b,close media- 23518# output until busy support by int 10h for character device driver 23519>4 uleshort&0x8000 0x8000 23520>>4 uleshort&0x2000 0x2000 \b,until busy- 23521# direct read/write support by driver functions 03h,0Ch 23522>4 uleshort&0x4000 0x4000 \b,control strings- 23523>4 uleshort&0x8000 0x8000 23524>>4 uleshort&0x6840 >0 \bsupport 23525>4 uleshort&0x8000 0x0000 23526>>4 uleshort&0x4842 >0 \bsupport 23527>0 ubyte x \b) 23528>0 ulelong !0xffffffff with pointer 0x%x 23529# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 235300 ulequad 0x0513c00000000012 23531>0 use msdos-driver 23532# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 235330 ulequad 0x32f28000ffff0016 23534>0 use msdos-driver 235350 ulequad 0x007f00000000ffff 23536>0 use msdos-driver 23537# https://www.uwe-sieber.de/files/cfg_echo.zip 235380 ulequad 0x001600000000ffff 23539>0 use msdos-driver 23540# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 235410 ulequad 0x0bf708c2ffffffff 23542>0 use msdos-driver 235430 ulequad 0x07bd08c2ffffffff 23544>0 use msdos-driver 23545# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS 235460 ulequad 0x027ac0c0ffffffff 23547>0 use msdos-driver 23548# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS 235490 ulequad 0x00228880ffffffff 23550>0 use msdos-driver 23551 23552# updated by Joerg Jenderek 23553# GRR: line below too general as it catches also 23554# rt.lib DYADISKS.PIC and many more 23555# start with assembler instruction MOV 235560 ubyte 0x8c 23557# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 23558>4 string !O==== 23559# skip some unknown basic binaries like RocketRnger.SHR 23560>>5 string !MAIN 23561# skip "GPG symmetrically encrypted data" ./gnu 23562# skip "PGP symmetric key encrypted data" ./pgp 23563# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 23564>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 23565# the remaining files should be DOS *.COM executables 23566# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 23567# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 23568# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 23569# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 23570# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 23571# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 23572# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 23573# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 23574!:mime application/x-dosexec 23575!:ext com 23576 23577# updated by Joerg Jenderek at Oct 2008 235780 ulelong 0xffff10eb DR-DOS executable (COM) 23579# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 235800 ubeshort&0xeb8d >0xeb00 23581# DR-DOS STACKER.COM SCREATE.SYS missed 23582 235830 name msdos-com 23584>0 byte x DOS executable (COM) 23585!:mime application/x-dosexec 23586!:ext com 23587>6 string SFX\ of\ LHarc \b, %s 23588>0x1FE leshort 0xAA55 \b, boot code 23589>85 string UPX \b, UPX compressed 23590>4 string \ $ARX \b, ARX self-extracting archive 23591>4 string \ $LHarc \b, LHarc self-extracting archive 23592>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 23593 23594# JMP 8bit 235950 byte 0xeb 23596# allow forward jumps only 23597>1 byte >-1 23598# that offset must be accessible 23599>>(1.b+2) byte x 23600>>>0 use msdos-com 23601 23602# JMP 16bit 236030 byte 0xe9 23604# forward jumps 23605>1 short >-1 23606# that offset must be accessible 23607>>(1.s+3) byte x 23608>>>0 use msdos-com 23609# negative offset, must not lead into PSP 23610>1 short <-259 23611# that offset must be accessible 23612>>(1,s+65539) byte x 23613>>>0 use msdos-com 23614 23615# updated by Joerg Jenderek at Oct 2008,2015 23616# following line is too general 236170 ubyte 0xb8 23618# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 23619>0 string !\xb8\xc0\x07\x8e 23620# modified by Joerg Jenderek 23621# syslinux COM32 or COM32R executable 23622>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 23623# https://www.syslinux.org/wiki/index.php/Comboot_API 23624# Since version 5.00 c32 modules switched from the COM32 object format to ELF 23625!:mime application/x-c32-comboot-syslinux-exec 23626!:ext c32 23627# https://syslinux.zytor.com/comboot.php 23628# older syslinux version ( <4 ) 23629# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 23630# start with assembler instructions mov eax,21cd4cffh 23631>>>1 lelong 0x21CD4CFf \b) 23632# syslinux:doc/comboot.txt 23633# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 23634# eax,21cd4cfeh) as a magic number. 23635# syslinux version (4.x) 23636# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 23637>>>1 lelong 0x21CD4CFe \b, relocatable) 23638# Hajin Jang <hajin_jang@worksmobile.com>: 23639# Disable simplest COM signature to prevent false positive on some EUC-KR text files. 23640## remaining are DOS COM executables starting with assembler instruction MOV 23641## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 23642## MS-DOS SYS.COM RESTART.COM 23643## SYSLINUX.COM (version 1.40 - 2.13) 23644## GFXBOOT.COM (version 3.75) 23645## COPYBS.COM POWEROFF.COM INT18.COM 23646#>>1 default x COM executable for DOS 23647#!:mime application/x-dosexec 23648##!:mime application/x-ms-dos-executable 23649##!:mime application/x-msdos-program 23650#!:ext com 23651 23652# URL: https://en.wikipedia.org/wiki/UPX 23653# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/ 23654# src/stub/src/i086-dos16.com.S 23655# Update: Joerg Jenderek 23656# assembler instructions: cmp sp, offset sp_limit 236570 string/b \x81\xfc 23658#>2 uleshort x \b, sp_limit=0x%x 23659# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy 23660>4 string \x77\x02\xcd\x20\xb9 23661#>9 uleshort x \b, [bytes_to_copy]=0x%x 23662# at different offsets assembler instructions: push di; jump decomp_start_n2b 23663>0x1e search/3 \x57\xe9 23664#>>&0 uleshort x \b, decomp_start_n2b=0x%x 23665# src/stub/src/include/header.S; UPX_MAGIC_LE32 23666>>&2 string UPX! FREE-DOS executable (COM), UPX 23667!:mime application/x-dosexec 23668# UPX compressed *.CPI; See ./fonts 23669>>>&21 string =FONT compressed DOS code page font 23670!:ext cpx 23671>>>&21 string !FONT compressed 23672!:ext com 23673# compressed size? 23674#>>>&14 uleshort+152 x \b, %u bytes 23675# uncompressed len 23676>>>&12 uleshort x \b, uncompressed %u bytes 23677252 string Must\ have\ DOS\ version DR-DOS executable (COM) 23678!:mime application/x-dosexec 23679!:ext com 23680# GRR search is not working 23681#2 search/28 \xcd\x21 COM executable for MS-DOS 23682#WHICHFAT.cOM 236832 string \xcd\x21 COM executable for DOS 23684!:mime application/x-dosexec 23685!:ext com 23686#DELTREE.cOM DELTREE2.cOM 236874 string \xcd\x21 COM executable for DOS 23688!:mime application/x-dosexec 23689!:ext com 23690#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 236915 string \xcd\x21 COM executable for DOS 23692!:mime application/x-dosexec 23693!:ext com 23694#DELTMP.COm HASFAT32.cOM 236957 string \xcd\x21 23696>0 byte !0xb8 COM executable for DOS 23697!:mime application/x-dosexec 23698!:ext com 23699#COMP.cOM MORE.COm 2370010 string \xcd\x21 23701>5 string !\xcd\x21 COM executable for DOS 23702!:mime application/x-dosexec 23703!:ext com 23704#comecho.com 2370513 string \xcd\x21 COM executable for DOS 23706!:mime application/x-dosexec 23707!:ext com 23708#HELP.COm EDIT.coM 2370918 string \xcd\x21 COM executable for MS-DOS 23710!:mime application/x-dosexec 23711!:ext com 23712#NWRPLTRM.COm 2371323 string \xcd\x21 COM executable for MS-DOS 23714!:mime application/x-dosexec 23715!:ext com 23716#LOADFIX.cOm LOADFIX.cOm 2371730 string \xcd\x21 COM executable for MS-DOS 23718!:mime application/x-dosexec 23719!:ext com 23720#syslinux.com 3.11 2372170 string \xcd\x21 COM executable for DOS 23722!:mime application/x-dosexec 23723!:ext com 23724# many compressed/converted COMs start with a copy loop instead of a jump 237250x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 23726!:mime application/x-dosexec 23727!:ext com 237280x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 23729!:mime application/x-dosexec 23730!:ext com 23731>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 237320x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 23733!:mime application/x-dosexec 23734!:ext com 23735# FIXME: missing diet .com compression 23736 23737# miscellaneous formats 237380 string/b LZ MS-DOS executable (built-in) 23739#0 byte 0xf0 MS-DOS program library data 23740# 23741 23742# AAF files: 23743# <stuartc@rd.bbc.co.uk> Stuart Cunningham 237440 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 23745>30 byte 9 (512B sectors) 23746>30 byte 12 (4kB sectors) 237470 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 23748>30 byte 9 (512B sectors) 23749>30 byte 12 (4kB sectors) 23750 23751# Popular applications 23752# 23753# Update: Joerg Jenderek 23754# URL: http://fileformats.archiveteam.org/wiki/DOC 23755# Reference: https://web.archive.org/web/20170206041048/ 23756# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 23757# wIdent+dty 237580 belong 0x31be0000 23759# skip droid skeleton like x-fmt-274-signature-id-488.doc 23760>128 ubyte >0 Microsoft 23761>>96 uleshort =0 Word 23762!:mime application/msword 23763!:apple MSWDWDBN 23764# DCX is used in the Unix version. 23765!:ext doc/dcx 23766>>>0x6E ulequad =0 1.0-4.0 23767>>>0x6E ulequad !0 5.0-6.0 23768>>>0x6E ulequad x (DOS) Document 23769# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 23770>>96 uleshort !0 Write 3.0 (Windows) Document 23771!:mime application/x-mswrite 23772!:apple MSWDWDBN 23773# sometimes also doc like in splitter.doc srchtest.doc 23774!:ext wri/doc 23775# wTool must be 0125400 octal 23776#>>4 uleshort !0xAB00 \b, wTool %o 23777# reserved; must be zero 23778#>>6 ulelong !0 \b, reserved %u 23779# block pointer to the block containing optional file manager information 23780#>>0x1C uleshort x \b, at 0x%x info block 23781# jump to File manager information block 23782>>(0x1C.s*128) uleshort x 23783# test for valid information start; maybe also 0012h 23784>>>&-2 uleshort =0x0014 23785# Document ASCIIZ name 23786>>>>&0x12 string x %s 23787# author name 23788>>>>>&1 string x \b, author %s 23789# reviser name 23790>>>>>>&1 string x \b, reviser %s 23791# keywords 23792>>>>>>>&1 string x \b, keywords %s 23793# comment 23794>>>>>>>>&1 string x \b, comment %s 23795# version number 23796>>>>>>>>>&1 string x \b, version %s 23797# date of last change MM/DD/YY 23798>>>>>>>>>>&1 string x \b, %-.8s 23799# creation date MM/DD/YY 23800>>>>>>>>>>&9 string x created %-.8s 23801# file name of print format like NORMAL.STY 23802>>0x1E string >0 \b, formatted by %-.66s 23803# count of pages in whole file for write variant; maybe some times wrong 23804>>96 uleshort >0 \b, %u pages 23805# name of the printer driver like HPLASMS 23806>>0x62 string >0 \b, %-.8s printer 23807# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 23808>>0x6A uleshort >0 \b, %u blocks 23809# bit field for corrected text areas 23810#>>0x6C uleshort x \b, 0x%x bit field 23811# text of document; some times start with 4 non printable characters like CR LF 23812>>128 ubyte x \b, 23813>>>128 ubyte >0x1F 23814>>>>128 string x %s 23815>>>128 ubyte <0x20 23816>>>>129 ubyte >0x1F 23817>>>>>129 string x %s 23818>>>>129 ubyte <0x20 23819>>>>>130 ubyte >0x1F 23820>>>>>>130 string x %s 23821>>>>>130 ubyte <0x20 23822>>>>>>131 ubyte >0x1F 23823>>>>>>>131 string x %s 23824>>>>>>131 ubyte <0x20 23825>>>>>>>132 ubyte >0x1F 23826>>>>>>>>132 string x %s 23827>>>>>>>132 ubyte <0x20 23828>>>>>>>>133 ubyte >0x1F 23829>>>>>>>>>133 string x %s 23830# 238310 string/b PO^Q` Microsoft Word 6.0 Document 23832!:mime application/msword 23833# 238344 long 0 23835>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 23836!:mime application/msword 23837!:ext mcw 23838>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 23839!:mime application/msword 23840!:ext mcw 23841>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 23842!:mime application/msword 23843!:ext mcw 23844>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 23845!:mime application/msword 23846!:ext mcw 23847 238480 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 23849!:mime application/msword 23850!:ext doc 23851# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 23852#512 string/b \354\245\301 Microsoft Word Document 23853#!:mime application/msword 23854 23855# 238560 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 23857!:mime application/msword 23858# 238590 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 23860!:mime application/msword 23861 23862# 238630 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 23864!:mime application/vnd.ms-excel 23865# https://www.macdisk.com/macsigen.php 23866!:apple XCELXLS4 23867!:ext xls 23868# 23869# Update: Joerg Jenderek 23870# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 23871# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 23872# Note: newer Lotus versions >2 use longer BOF record 23873# record type (BeginningOfFile=0000h) + length (001Ah) 238740 belong 0x00001a00 23875# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 23876#>18 uleshort&0x73E0 0 23877# Lotus Multi Byte Character Set (LMBCS=1-31) 23878>20 ubyte >0 23879>>20 ubyte <32 Lotus 1-2-3 23880#!:mime application/x-123 23881!:mime application/vnd.lotus-1-2-3 23882!:apple ????L123 23883# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 23884>>>4 uleshort 0x1000 WorKsheet, version 3 23885!:ext wk3 23886# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 23887>>>4 uleshort 0x1002 WorKsheet, version 4 23888# also worksheet template 4 (.wt4) 23889!:ext wk4/wt4 23890# no example or documentation for wk5 23891#>>4 uleshort 0x???? WorKsheet, version 4 23892#!:ext wk5 23893# only MacrotoScript.123 example 23894>>>4 uleshort 0x1003 WorKsheet, version 97 23895# also worksheet template Smartmaster (.12M)? 23896!:ext 123 23897# only Set_Y2K.123 example 23898>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 23899!:ext 123 23900# no example for this version 23901>>>4 uleshort 0x8001 FoRMatting data 23902!:ext frm 23903# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 23904# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 23905>>>4 uleshort 0x8007 ForMatting data, version 3 23906!:ext fm3 23907>>>4 default x unknown 23908# file revision sub code 0004h for worksheets 23909>>>>6 uleshort =0x0004 worksheet 23910!:ext wXX 23911>>>>6 uleshort !0x0004 formatting data 23912!:ext fXX 23913# main revision number 23914>>>>4 uleshort x \b, revision 0x%x 23915>>>6 uleshort =0x0004 \b, cell range 23916# active cellcoord range (start row, page,column ; end row, page, column) 23917# start values normally 0~1st sheet A1 23918>>>>8 ulelong !0 23919>>>>>10 ubyte >0 \b%d* 23920>>>>>8 uleshort x \b%d, 23921>>>>>11 ubyte x \b%d- 23922# end page mostly 0 23923>>>>14 ubyte >0 \b%d* 23924# end raw, column normally not 0 23925>>>>12 uleshort x \b%d, 23926>>>>15 ubyte x \b%d 23927# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 23928>>>>20 ubyte >1 \b, character set 0x%x 23929# flags 23930>>>>21 ubyte x \b, flags 0x%x 23931>>>6 uleshort !0x0004 23932# record type (FONTNAME=00AEh) 23933>>>>30 search/29 \0\xAE 23934# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 23935>>>>>&4 string >\0 \b, 1st font "%s" 23936# 23937# Update: Joerg Jenderek 23938# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 23939# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 23940# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 23941# record type (BeginningOfFile=0000h) + length (0002h) 239420 belong 0x00000200 23943# GRR: line above is too general as it catches also MS Windows CURsor 23944# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 23945!:strength -1 23946# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 23947>7 ubyte 0 23948# skip Windows cursors with image width 256 and keep Lotus with positive opcode 23949>>6 ubyte >0 Lotus 23950# !:mime application/x-123 23951!:mime application/vnd.lotus-1-2-3 23952!:apple ????L123 23953# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 23954# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 23955>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 23956!:ext cnf 23957>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 23958!:ext cnf 23959>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 23960!:ext cnf 23961>>>4 uleshort 0x0802 Symphony CoNFiguration 23962!:ext cnf 23963>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 23964!:ext cnf 23965>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 23966!:ext cnf 23967>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 23968!:ext cnf 23969>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 23970!:ext cnf 23971# (version 5.26) labeled the entry as "Lotus 123" 23972# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 23973>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 23974# extension "wks" also for Microsoft Works document 23975!:ext wks 23976# (version 5.26) labeled the entry as "Lotus 123" 23977# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 23978>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 23979!:ext wrk/wr1 23980# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 23981# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 23982>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 23983# Symphony (.wr1) 23984!:ext wk1/wr1 23985# no example for this japan version 23986>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 23987!:ext wj1 23988# no example or documentation for wk2 23989#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 23990#!:ext wk2 23991# undocumented japan version 23992>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 23993!:ext wj3 23994# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 23995>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 23996# japan version 2.4J (fj3) 23997!:ext fmt/fj3 23998# no example for this version 23999>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 24000!:ext frm 24001# (version 5.26) labeled the entry as "Lotus 1-2-3" 24002>>>4 default x unknown worksheet or configuration 24003!:ext cnf 24004>>>>4 uleshort x \b, revision 0x%x 24005# 2nd record for most worksheets describes cells range 24006>>>6 use lotus-cells 24007# 3rd record for most japan worksheets describes cells range 24008>>>(8.s+10) use lotus-cells 24009# check and then display Lotus worksheet cells range 240100 name lotus-cells 24011# look for type (RANGE=0006h) + length (0008h) at record begin 24012>0 ubelong 0x06000800 \b, cell range 24013# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 24014>>4 ulong !0 24015>>>4 uleshort x \b%d, 24016>>>6 uleshort x \b%d- 24017# end of cell range 24018>>8 uleshort x \b%d, 24019>>10 uleshort x \b%d 24020# EndOfLotus123 240210 string/b WordPro\0 Lotus WordPro 24022!:mime application/vnd.lotus-wordpro 240230 string/b WordPro\r\373 Lotus WordPro 24024!:mime application/vnd.lotus-wordpro 24025 24026 24027# Summary: Script used by InstallScield to uninstall applications 24028# Extension: .isu 24029# Submitted by: unknown 24030# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 240310 string \x71\xa8\x00\x00\x01\x02 24032>12 string Stirling\ Technologies, InstallShield Uninstall Script 24033 24034# Winamp .avs 24035#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 240360 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 24037 24038# Windows Metafile .WMF 240390 string/b \327\315\306\232 Windows metafile 24040!:mime image/wmf 24041!:ext wmf 240420 string/b \002\000\011\000 Windows metafile 24043!:mime image/wmf 24044!:ext wmf 240450 string/b \001\000\011\000 Windows metafile 24046!:mime image/wmf 24047!:ext wmf 24048 24049#tz3 files whatever that is (MS Works files) 240500 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 240510 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 240520 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 24053 24054# PGP sig files .sig 24055#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 240560 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 240570 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 240580 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 240590 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 240600 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 240610 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 24062 24063# windows zips files .dmf 240640 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 24065 24066# Windows icons 24067# Update: Joerg Jenderek 24068# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 24069# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 240700 belong 0x00000100 24071>9 byte 0 24072>>0 byte x 24073>>0 use cur-ico-dir 24074>9 ubyte 0xff 24075>>0 byte x 24076>>0 use cur-ico-dir 24077# displays number of icons and information for icon or cursor 240780 name cur-ico-dir 24079# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 24080# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 24081>18 ulelong &0x00000006 24082# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 24083>>(18.l) ulelong x MS Windows 24084>>>0 ubelong 0x00000100 icon resource 24085# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 24086!:mime image/vnd.microsoft.icon 24087#!:mime image/x-icon 24088!:ext ico 24089>>>>4 uleshort x - %d icon 24090# plural s 24091>>>>4 uleshort >1 \bs 24092# 1st icon 24093>>>>0x06 use ico-entry 24094# 2nd icon 24095>>>>4 uleshort >1 24096>>>>>0x16 use ico-entry 24097>>>0 ubelong 0x00000200 cursor resource 24098#!:mime image/x-cur 24099!:mime image/x-win-bitmap 24100!:ext cur 24101>>>>4 uleshort x - %d icon 24102>>>>4 uleshort >1 \bs 24103# 1st cursor 24104>>>>0x06 use cur-entry 24105#>>>>0x16 use cur-entry 24106# display information of one cursor entry 241070 name cur-entry 24108>0 use cur-ico-entry 24109>4 uleshort x \b, hotspot @%dx 24110>6 uleshort x \b%d 24111# display information of one icon entry 241120 name ico-entry 24113>0 use cur-ico-entry 24114# normally 0 1 but also found 14 24115>4 uleshort >1 \b, %d planes 24116# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 24117>6 uleshort >1 \b, %d bits/pixel 24118# display shared information of cursor or icon entry 241190 name cur-ico-entry 24120>0 byte =0 \b, 256x 24121>0 byte !0 \b, %dx 24122>1 byte =0 \b256 24123>1 byte !0 \b%d 24124# number of colors in palette 24125>2 ubyte !0 \b, %d colors 24126# reserved 0 FFh 24127#>3 ubyte x \b, reserved %x 24128#>8 ulelong x \b, image size %d 24129# offset of PNG or DIB image 24130#>12 ulelong x \b, offset 0x%x 24131# PNG header (\x89PNG) 24132>(12.l) ubelong =0x89504e47 24133# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 24134>>&-4 indirect x \b with\040 24135# DIB image 24136>(12.l) ubelong !0x89504e47 24137#>>&-4 use dib-image 24138 24139# Windows non-animated cursors 24140# Update: Joerg Jenderek 24141# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 24142# Note: similar to Windows ICOn. container for BMP ( only DIB part) 24143# GRR: line below is too general as it catches also Lotus 1-2-3 files 241440 belong 0x00000200 24145>9 byte 0 24146>>0 use cur-ico-dir 24147>9 ubyte 0xff 24148>>0 use cur-ico-dir 24149 24150# .chr files 241510 string/b PK\010\010BGI Borland font 24152>4 string >\0 %s 24153# then there is a copyright notice 24154 24155 24156# .bgi files 241570 string/b pk\010\010BGI Borland device 24158>4 string >\0 %s 24159# then there is a copyright notice 24160 24161 24162# Windows Recycle Bin record file (named INFO2) 24163# By Abel Cheung (abelcheung AT gmail dot com) 24164# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 24165# Since Vista uses another structure, INFO2 structure probably won't change 24166# anymore. Detailed analysis in: 24167# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 241680 lelong 0x00000004 24169>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 24170 241710 lelong 0x00000005 24172>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 24173 24174# From Doug Lee via a FreeBSD pr 241759 string GERBILDOC First Choice document 241769 string GERBILDB First Choice database 241779 string GERBILCLIP First Choice database 241780 string GERBIL First Choice device file 241799 string RABBITGRAPH RabbitGraph file 241800 string DCU1 Borland Delphi .DCU file 241810 string =!<spell> MKS Spell hash list (old format) 241820 string =!<spell2> MKS Spell hash list 24183# Too simple - MPi 24184#0 string AH Halo(TM) bitmapped font file 241850 lelong 0x08086b70 TurboC BGI file 241860 lelong 0x08084b50 TurboC Font file 24187 24188# Debian#712046: The magic below identifies "Delphi compiled form data". 24189# An additional source of information is available at: 24190# http://www.woodmann.com/fravia/dafix_t1.htm 241910 string TPF0 24192>4 pstring >\0 Delphi compiled form '%s' 24193 24194# tests for DBase files moved, updated and merged to database 24195 241960 string PMCC Windows 3.x .GRP file 241971 string RDC-meg MegaDots 24198>8 byte >0x2F version %c 24199>9 byte >0x2F \b.%c file 242000 lelong 0x4C 24201>4 lelong 0x00021401 Windows shortcut file 24202 24203# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 24204# only for windows versions equal or greater 3.0 242050x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 24206!:mime application/x-dosexec 24207!:ext pif 24208#>2 string >\0 \b, Title:%.30s 24209>0x24 string >\0 \b for %.63s 24210>0x65 string >\0 \b, directory=%.64s 24211>0xA5 string >\0 \b, parameters=%.64s 24212#>0x181 leshort x \b, offset %x 24213#>0x183 leshort x \b, offsetdata %x 24214#>0x185 leshort x \b, section length %x 24215>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 24216>>&0x5e ubyte >0 24217>>>&-1 string <PIFMGR.DLL \b, icon=%s 24218#>>>&-1 string PIFMGR.DLL \b, icon=%s 24219>>>&-1 string >PIFMGR.DLL \b, icon=%s 24220>>&0xF0 ubyte >0 24221>>>&-1 string <Terminal \b, font=%.32s 24222#>>>&-1 string =Terminal \b, font=%.32s 24223>>>&-1 string >Terminal \b, font=%.32s 24224>>&0x110 ubyte >0 24225>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 24226#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 24227>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 24228#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 24229#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 24230>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 24231#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 24232>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 24233#>>&06 string x \b:%s 24234>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 24235#>>&06 string x \b:%s 24236 24237# DOS EPS Binary File Header 24238# From: Ed Sznyter <ews@Black.Market.NET> 242390 belong 0xC5D0D3C6 DOS EPS Binary File 24240!:mime image/x-eps 24241>4 long >0 Postscript starts at byte %d 24242>>8 long >0 length %d 24243>>>12 long >0 Metafile starts at byte %d 24244>>>>16 long >0 length %d 24245>>>20 long >0 TIFF starts at byte %d 24246>>>>24 long >0 length %d 24247 24248# TNEF magic From "Joomy" <joomy@se-ed.net> 24249# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 242500 lelong 0x223e9f78 TNEF 24251!:mime application/vnd.ms-tnef 24252 24253# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 24254# of http://www.davep.org/norton-guides/ng2h-105.tgz 24255# https://en.wikipedia.org/wiki/Norton_Guides 242560 string NG\0\001 24257# only value 0x100 found at offset 2 24258>2 ulelong 0x00000100 Norton Guide 24259!:mime application/x-norton-guide 24260# often like NORTON.NG but some times like NC.HLP 24261!:ext ng/hlp 24262# Title[40] 24263>>8 string >\0 "%-.40s" 24264#>>6 uleshort x \b, MenuCount=%u 24265# szCredits[5][66] 24266>>48 string >\0 \b, %-.66s 24267>>114 string >\0 %-.66s 24268 24269# URL: https://en.wikipedia.org/wiki/Norton_Commander 24270# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml 24271# From: Joerg Jenderek 24272# Note: Message file is used by executable with same main name. 24273# Only tested with version 5.50 (english) and 2.01 (Windows) 242740 string Abort 24275# \0 or i 24276#>5 ubyte x %x 24277# skip ASCII Abort text by looking for error message like in NCVIEW.MSG 24278>6 search/7089 Non-DOS\ disk Norton Commander module message 24279!:mime application/x-norton-msg 24280!:ext msg 24281 24282# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 24283# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml 24284# From: Joerg Jenderek 242850 string DOS\ Client\ Message\ File: Novell DOS client message 24286#!:mime application/octet-stream 24287#!:mime application/x-novell-msg 24288!:ext msg 24289# look for second letter instead space character 24290>26 ubyte >0x20 24291# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr 24292>>25 ubyte !0x20 %c 24293>>>26 ubyte !0x20 \b%c 24294>>>>27 ubyte !0x20 \b%c 24295>>>>>28 ubyte !0x20 \b%c 24296>>>>>>29 ubyte !0x20 \b%c 24297>>>>>>>30 ubyte !0x20 \b%c 24298>>>>>>>>31 ubyte !0x20 \b%c 24299>>>>>>>>>32 ubyte !0x20 \b%c 24300>>>>>>>>>>33 ubyte !0x20 \b%c 24301>>>>>>>>>>>34 ubyte !0x20 \b%c 24302>>>>>>>>>>>>35 ubyte !0x20 \b%c 24303>>>>>>>>>>>>>36 ubyte !0x20 \b%c 24304# followed by string like: 0 v.10 V1.20 24305# 24306# followed by ,\040Tran\040 24307>28 search/14 ,\040Tran\040 24308# probably translated version string like: 0 v1.00 24309>>&0 string x \b, tran version %s 24310# followed by Ctrl-J Ctrl-Z 24311>>>&0 ubyte !0xa \b, terminated by 0x%2.2x 24312>>>>&0 ubyte x \b%2.2x 24313# Ctrl-Z 24314>0x65 ubyte !0x1A \b, at 0x65 0x%x 24315# one 24316>0x66 ubyte !0x01 \b, at 0x66 0x%x 24317# URL: https://en.wikipedia.org/wiki/NetWare 24318# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml 24319# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html 24320# From: Joerg Jenderek 243210 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data 24322#>35 string Version\ 1.00 24323#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc. 24324#>83 string \ \ All\ Rights\ Reserved 24325#!:mime application/octet-stream 24326#!:mime application/x-novell-msg 24327!:ext msg 24328#!:ext msg/dat 24329# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 24330# of https://www.4dos.info/ 24331# pointer,HelpID[8]=4DHnnnmm 243320 ulelong 0x48443408 4DOS help file 24333>4 string x \b, version %-4.4s 24334 24335# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 243360 ulequad 0x3a000000024e4c MS Advisor help file 24337 24338# HtmlHelp files (.chm) 243390 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 24340 24341# GFA-BASIC (Wolfram Kleff) 243422 string/b GFA-BASIC3 GFA-BASIC 3 data 24343 24344#------------------------------------------------------------------------------ 24345# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 24346# Update: Joerg Jenderek 24347# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 24348# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 24349# Note: verified by `7z l *.cab` 24350# Microsoft Cabinet files 243510 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 24352# 24353# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 24354# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 24355# because some archive does not have *.diag* as 1st or 2nd archive member like 24356# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 24357# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 24358>0x2c search/980/c .diag \b, Diagnostic 24359!:mime application/vnd.ms-cab-compressed 24360!:ext diagcab 24361# http://fileformats.archiveteam.org/wiki/PUZ 24362# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 24363# bundles a Publisher document *PNG.pub with all links into a CAB 24364>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 24365!:mime application/vnd.ms-cab-compressed 24366!:ext puz 24367# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 24368>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 24369!:mime application/vnd.ms-powerpoint 24370#!:mime application/mspowerpoint 24371!:ext ppz 24372# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 24373# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 24374# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 24375>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 24376#!:mime application/vnd.ms-cab-compressed 24377# http://extension.nirsoft.net/gadget 24378!:mime application/x-windows-gadget 24379!:ext gadget 24380# http://www.incredimail.com/ 24381# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 24382>0x2c search/3369/c content.ini\0 \b, IncrediMail 24383!:mime application/x-incredimail 24384# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 24385>>0x2c search/83/c Flavor.htm\0 ecard 24386!:ext imf 24387# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 24388>>0x2c search/211/c .swf\0 skin 24389!:ext ims 24390# member anim.im3 implies IncrediMail animation like in letter_fold.ima 24391>>0x2c search/92/c anim.im3\0 animation 24392!:ext ima 24393# other IncrediMail cab archive 24394>>0x2c default x 24395>>>0x2c search/116/c thumb ecard, image, notifier or skin 24396!:ext imf/imi/imn/ims 24397# http://file-extension.net/seeker/file_extension_ime 24398>>>0x2c default x emoticons or sound 24399!:ext ime/imw 24400# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 24401>0x2c default x 24402# look for 1st member name 24403>>(16.l+16) ubyte x 24404# https://en.wikipedia.org/wiki/SNP_file_format 24405>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 24406!:mime application/msaccess 24407!:ext snp 24408# https://en.wikipedia.org/wiki/Microsoft_InfoPath 24409>>>&-1 string manifest.xsf \b, InfoPath Form Template 24410!:mime application/vnd.ms-cab-compressed 24411#!:mime application/vnd.ms-infopath 24412!:ext xsn 24413# https://www.cabextract.org.uk/wince_cab_format/ 24414# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 24415>>>&7 string =.000 \b, WinCE install 24416!:mime application/vnd.ms-cab-compressed 24417!:ext cab 24418 24419# https://support.microsoft.com/kb/934307/en-US 24420# All inspected MSU contain a file with name WSUSSCAN.cab 24421# that is called "Windows Update meta data" by Microsoft 24422>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 24423!:mime application/vnd.ms-cab-compressed 24424!:ext msu 24425>>>&-1 default x 24426# look at point character of 1st archive member name for file name extension 24427>>>>&-1 search/255 . 24428# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 24429# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 24430# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 24431>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 24432!:mime application/vnd.ms-powerpoint 24433#!:mime application/mspowerpoint 24434!:ext ppz 24435# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 24436# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 24437# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 24438>>>>>&0 string/c theme \b, Windows 24439!:mime application/x-windows-themepack 24440# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 24441# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 24442# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 24443>>>>>>(16.l+16) string =Panoram 8 24444!:ext deskthemepack 24445>>>>>>(16.l+16) string !Panoram 7 or 8 24446!:ext themepack/deskthemepack 24447>>>>>>(16.l+16) ubyte x Theme Pack 24448>>>>>&0 default x 24449# look for null terminator of 1st member name 24450>>>>>>&0 search/255 \0 24451# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 24452>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 24453!:mime application/vnd.ms-cab-compressed 24454!:ext msu 24455>>>>>>>&16 default x 24456# archive with more then one file need some output in version 5.32 to avoid error message like 24457# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 24458# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 24459# file: could not find any valid magic files! 24460>>>>>>>>28 uleshort >1 \b, many 24461!:mime application/vnd.ms-cab-compressed 24462!:ext cab 24463# remaining archives with just one file 24464>>>>>>>>28 uleshort =1 24465# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 24466>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 24467# cut of last char of source extension and add underscore to generate extension 24468# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 24469!:mime application/vnd.ms-cab-compressed 24470!:ext _/?_/??_ 24471# archive need some output like "single" in version 5.32 to avoid error messages 24472>>>>>>>>>30 uleshort !0x0000 \b, single 24473!:mime application/vnd.ms-cab-compressed 24474!:ext cab 24475# TODO: additional extensions like 24476# .xtp InfoPath Template Part 24477# .lvf Logitech Video Effects Face Accessory 24478>8 ulelong x \b, %u bytes 24479>28 uleshort 1 \b, 1 file 24480>28 uleshort >1 \b, %u files 24481# Reserved fields, set to zero 24482#>4 belong !0 \b, reserved1 %x 24483#>12 belong !0 \b, reserved2 %x 24484# offset of the first CFFILE entry coffFiles: minimal 2Ch 24485>16 ulelong x \b, at 0x%x 24486>(16.l) use cab-file 24487# at least also 2nd member 24488>28 uleshort >1 24489>>(16.l+16) ubyte x 24490>>>&0 search/255 \0 24491# second member info 24492>>>>&0 use cab-file 24493#>20 belong !0 \b, reserved %x 24494# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 24495>24 ubeshort !0x0301 \b version 0x%x 24496# number of CFFOLDER entries 24497>26 uleshort >1 \b, %u cffolders 24498# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 24499# only found for flags 0 1 2 3 4 not 7 24500>30 uleshort >0 \b, flags 0x%x 24501# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 24502# default is zero, however, the -i option of cabarc can be used to set this field 24503>32 uleshort >0 \b, ID %u 24504# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 24505#>34 uleshort x \b, iCabinet %u 24506# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 24507>34 uleshort+1 x \b, number %u 24508>30 uleshort &0x0004 \b, extra bytes 24509# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 24510>>36 uleshort >0 %u in head 24511# cbCFFolder is optional size of per-folder reserved area 24512>>38 ubyte >0 %u in folder 24513# cbCFData is optional size of per-datablock reserved area 24514>>39 ubyte >0 %u in data block 24515# optional per-cabinet reserved area abReserve[cbCFHeader] 24516>>36 uleshort >0 24517# 1st CFFOLDER after reserved area in header 24518>>>(36.s+40) use cab-folder 24519# no reserved area in header 24520>30 uleshort ^0x0004 24521# no previous and next cab archive 24522>>30 uleshort =0x0000 24523>>>36 use cab-folder 24524# only previous cab archive 24525>>30 uleshort =0x0001 \b, previous 24526>>>36 use cab-anchor 24527# only next cab archive 24528>>30 uleshort =0x0002 \b, next 24529>>>36 use cab-anchor 24530# previous+next cab archive 24531# can not use sub routine cab-anchor to display previous and next cabinet together 24532#>>>36 use cab-anchor 24533#>>>>&0 use cab-anchor 24534>>30 uleshort =0x0003 \b, previous 24535>>>36 string x %s 24536# optional name of previous disk szDisk* 24537>>>>&1 string x disk %s 24538>>>>>&1 string x \b, next %s 24539# optional name of previous disk szDisk* 24540>>>>>>&1 string x disk %s 24541>>>>>>>&1 use cab-folder 24542# display filename and disk name of previous or next cabinet 245430 name cab-anchor 24544# optional name of previous/next cabinet file szCabinet*[255] 24545>&0 string x %s 24546# optional name of previous/next disk szDisk*[255] 24547>>&1 string x disk %s 24548# display folder structure CFFOLDER information like compression of cabinet 245490 name cab-folder 24550# offset of the CFDATA block in this folder 24551#>0 ulelong x \b, coffCabStart 0x%x 24552# number of CFDATA blocks in folder 24553>4 uleshort x \b, %u datablock 24554# plural s 24555>4 uleshort >1 \bs 24556# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 24557>6 uleshort x \b, 0x%x compression 24558# optional per-folder reserved area 24559#>8 ubequad x \b, abReserve 0x%llx 24560# display member structure CFFILE information like member name of cabinet 245610 name cab-file 24562# cbFile is uncompressed size of file in bytes 24563#>0 ulelong x \b, cbFile %u 24564# uoffFolderStart is uncompressed offset of file in folder 24565#>4 ulelong >0 \b, uoffFolderStart 0x%x 24566# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 24567# define ifoldCONTINUED_FROM_PREV (0xFFFD) 24568# define ifoldCONTINUED_TO_NEXT (0xFFFE) 24569# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 24570>8 uleshort >0 \b, iFolder 0x%x 24571# date stamp for file 24572#>10 uleshort x \b, date 0x%x 24573# time stamp for file 24574#>12 uleshort x \b, time 0x%x 24575# attribs is attribute flags for file 24576# define _A_RDONLY (0x01) file is read-only 24577# define _A_HIDDEN (0x02) file is hidden 24578# define _A_SYSTEM (0x04) file is a system file 24579# define _A_ARCH (0x20) file modified since last backup 24580# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 24581# define _A_EXEC (0x40) run after extraction 24582# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 24583# define UNKNOWN (0x0100) undocumented or accident 24584#>14 uleshort x \b, attribs 0x%x 24585>14 uleshort >0 + 24586>>14 uleshort &0x0001 \bR 24587>>14 uleshort &0x0002 \bH 24588>>14 uleshort &0x0004 \bS 24589>>14 uleshort &0x0020 \bA 24590>>14 uleshort &0x0040 \bX 24591>>14 uleshort &0x0080 \bUtf 24592# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 24593>>14 uleshort &0x0100 \b? 24594# szName is name of archive member 24595>16 string x "%s" 24596# next archive member name if more files 24597#>>&17 string >\0 \b, NEXT NAME %-.50s 24598 24599# InstallShield Cabinet files 246000 string/b ISc( InstallShield Cabinet archive data 24601>5 byte&0xf0 =0x60 version 6, 24602>5 byte&0xf0 !0x60 version 4/5, 24603>(12.l+40) lelong x %u files 24604 24605# Windows CE package files 246060 string/b MSCE\0\0\0\0 Microsoft WinCE install header 24607>20 lelong 0 \b, architecture-independent 24608>20 lelong 103 \b, Hitachi SH3 24609>20 lelong 104 \b, Hitachi SH4 24610>20 lelong 0xA11 \b, StrongARM 24611>20 lelong 4000 \b, MIPS R4000 24612>20 lelong 10003 \b, Hitachi SH3 24613>20 lelong 10004 \b, Hitachi SH3E 24614>20 lelong 10005 \b, Hitachi SH4 24615>20 lelong 70001 \b, ARM 7TDMI 24616>52 leshort 1 \b, 1 file 24617>52 leshort >1 \b, %u files 24618>56 leshort 1 \b, 1 registry entry 24619>56 leshort >1 \b, %u registry entries 24620 24621 24622# Windows Enhanced Metafile (EMF) 24623# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 24624# for further information. 246250 ulelong 1 24626>40 string \ EMF Windows Enhanced Metafile (EMF) image data 24627>>44 ulelong x version 0x%x 24628 24629 246300 string/b \224\246\056 Microsoft Word Document 24631!:mime application/msword 24632 24633# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 24634# Magic type for Dell's BIOS .hdr files 24635# Dell's .hdr 246360 string/b $RBU 24637>23 string Dell %s system BIOS 24638>5 byte 2 24639>>48 byte x version %d. 24640>>49 byte x \b%d. 24641>>50 byte x \b%d 24642>5 byte <2 24643>>48 string x version %.3s 24644 24645# Type: Microsoft Document Imaging Format (.mdi) 24646# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 24647# From: Daniele Sempione <scrows@oziosi.org> 24648# Too weak (EP) 24649#0 short 0x5045 Microsoft Document Imaging Format 24650 24651# MS eBook format (.lit) 246520 string/b ITOLITLS Microsoft Reader eBook Data 24653>8 lelong x \b, version %u 24654!:mime application/x-ms-reader 24655 24656# Windows CE Binary Image Data Format 24657# From: Dr. Jesus <j@hug.gs> 246580 string/b B000FF\n Windows Embedded CE binary image 24659 24660# The second byte of these signatures is a file version; I don't know what, 24661# if anything, produced files with version numbers 0-2. 24662# From: John Elliott <johne@seasip.demon.co.uk> 246630 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 246640 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 246650 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 246660 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 24667 246680 string MIOPEN Mallard BASIC Jetsam data 246690 string Jetsam0 Mallard BASIC Jetsam index data 24670 24671# DOS backup 2.0 to 3.2 24672 24673# backupid.@@@ 24674 24675# plausibility check for date 246760x3 ushort >1979 24677>0x5 ubyte-1 <31 24678>>0x6 ubyte-1 <12 24679# actually 121 nul bytes 24680>>>0x7 string \0\0\0\0\0\0\0\0 24681>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 24682!:ext @@@ 24683>>>>0x0 ubyte 0xff \b, last disk 24684 24685# backed up file 24686 24687# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 24688# by looking for trailing nul of maximal file name string 246890x52 ubyte 0 24690# test for flag byte: FFh~complete file, 00h~split file 24691# FFh -127 = -1 -127 = -128 24692# 00h -127 = 0 -127 = -127 24693>0 byte-127 <-126 24694# plausibility check for file name length 24695>>0x53 ubyte-1 <78 24696# looking for terminating nul of file name string 24697>>>(0x53.b+4) ubyte 0 24698# looking if last char of string is valid DOS file name 24699>>>>(0x53.b+3) ubyte >0x1F 24700# actually 44 nul bytes 24701# but sometimes garbage according to Ralf Quint. So can not be used as test 24702#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 24703# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 24704# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 24705>>>>>5 ubyte&0x8C 0x0C 24706# ./msdos (version 5.30) labeled the entry as 24707# "DOS 2.0 backed up file %s, split file, sequence %d" or 24708# "DOS 2.0 backed up file %s, complete file" 24709>>>>>>0 ubyte x DOS 2.0-3.2 backed up 24710#>>>>>>0 ubyte 0xff complete 24711>>>>>>0 ubyte 0 24712>>>>>>>1 uleshort x sequence %d of 24713# full file name with path but without drive letter and colon stored from 0x05 til 0x52 24714>>>>>>0x5 string x file %s 24715# backup name is original filename 24716#!:ext * 24717# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 24718# file: line 1169: Bad magic entry ' *' 24719# after header original file content 24720>>>>>>128 indirect x \b;\040 24721 24722 24723# DOS backup 3.3 to 5.x 24724 24725# CONTROL.nnn files 247260 string \x8bBACKUP\x20 24727# actually 128 nul bytes 24728>0xa string \0\0\0\0\0\0\0\0 24729>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 24730>>0x8a ubyte 0xff \b, last disk 24731 24732# NB: The BACKUP.nnn files consist of the files backed up, 24733# concatenated. 24734 24735#------------------------------------------------------------------------------ 24736# $File: msooxml,v 1.15 2020/09/05 22:59:14 christos Exp $ 24737# msooxml: file(1) magic for Microsoft Office XML 24738# From: Ralf Brown <ralf.brown@gmail.com> 24739 24740# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 24741# archive. The first member file is normally "[Content_Types].xml". 24742# but some libreoffice generated files put this later. Perhaps skip 24743# the "[Content_Types].xml" test? 24744# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 24745# file of ePub or OpenDocument, we'll have to scan for a filename 24746# which can distinguish between the three types 24747 247480 name msooxml 24749>0 string word/ Microsoft Word 2007+ 24750!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 24751>0 string ppt/ Microsoft PowerPoint 2007+ 24752!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 24753>0 string xl/ Microsoft Excel 2007+ 24754!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 24755>0 string visio/ Microsoft Visio 2013+ 24756!:mime application/vnd.ms-visio.drawing.main+xml 24757 24758# start by checking for ZIP local file header signature 247590 string PK\003\004 24760!:strength +10 24761# make sure the first file is correct 24762>0x1E use msooxml 24763>0x1E default x 24764>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps 24765# skip to the second local file header 24766# since some documents include a 520-byte extra field following the file 24767# header, we need to scan for the next header 24768>>>(18.l+49) search/6000 PK\003\004 24769# now skip to the *third* local file header; again, we need to scan due to a 24770# 520-byte extra field following the file header 24771>>>>&26 search/6000 PK\003\004 24772# and check the subdirectory name to determine which type of OOXML 24773# file we have. Correct the mimetype with the registered ones: 24774# https://technet.microsoft.com/en-us/library/cc179224.aspx 24775>>>>>&26 use msooxml 24776>>>>>&26 default x 24777# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 24778>>>>>>&26 search/6000 PK\003\004 24779>>>>>>>&26 use msooxml 24780>>>>>>>&26 default x Microsoft OOXML 24781>>>>>&26 default x Microsoft OOXML 24782 24783#------------------------------------------------------------------------------ 24784# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $ 24785# msvc: file(1) magic for msvc 24786# "H. Nanosecond" <aldomel@ix.netcom.com> 24787# Microsoft visual C 24788# 24789# I have version 1.0 24790 24791# .aps 247920 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 24793 24794# .ide 24795#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 247960 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 24797 24798# .res 247990 string \000\000\000\000\040\000\000\000\377 MSVC .res 248000 string \377\003\000\377\001\000\020\020\350 MSVC .res 248010 string \377\003\000\377\001\000\060\020\350 MSVC .res 24802 24803#.lib 248040 string \360\015\000\000 Microsoft Visual C library 248050 string \360\075\000\000 Microsoft Visual C library 248060 string \360\175\000\000 Microsoft Visual C library 24807 24808#.pch 248090 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 24810 24811# Summary: Symbol Table / Debug info used by Microsoft compilers 24812# URL: https://en.wikipedia.org/wiki/Program_database 24813# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 24814# Update: Joerg Jenderek 24815# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 24816# info does only applies partly for older files like msvbvm50.pdb about year 2001 248170 string Microsoft\ C/C++\040 24818# "Microsoft Program DataBase" by TrID 24819>24 search/14 \r\n\x1A MSVC program database 24820!:mime application/x-ms-pdb 24821!:ext pdb 24822# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 24823>>16 regex \([0-9.]+\) ver %s 24824#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 24825# "MSF 7.00" variant 24826>>0x1e leshort 0 24827# PageSize 400h 1000h 24828>>>0x20 lelong x \b, %d 24829# Page Count 24830>>>0x28 lelong x \b*%d bytes 24831# "program database 2.00" variant 24832>>0x1e leshort !0 24833# PageSize 400h 24834>>>0x2c lelong x \b, %d 24835# Page Count for msoo-dll.pdb 4379h 24836>>>0x32 leshort x \b*%d bytes 24837 24838# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 248390 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 24840 24841#.sbr 248420 string \000\002\000\007\000 MSVC .sbr 24843>5 string >\0 %s 24844 24845#.bsc 248460 string \002\000\002\001 MSVC .bsc 24847 24848#.wsp 248490 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 24850# these seem to start with the version and contain menus 24851 24852#------------------------------------------------------------------------------ 24853# msx: file(1) magic for the MSX Home Computer 24854# v1.3 24855# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 24856 24857############## MSX Music file formats ############## 24858 24859# Gigamix MGSDRV music file 248600 string/b MGS MSX Gigamix MGSDRV3 music file, 24861>6 ubeshort 0x0D0A 24862>>3 byte x \bv%c 24863>>4 byte x \b.%c 24864>>5 byte x \b%c 24865>>8 string >\0 \b, title: %s 24866 248671 string/b mgs2\ MSX Gigamix MGSDRV2 music file 24868>6 uleshort 0x80 24869>>0x2E uleshort 0 24870>>>0x30 string >\0 \b, title: %s 24871 24872# KSS music file 248730 string/b KSCC KSS music file v1.03 24874>0xE byte 0 24875>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 24876>>0xF byte&0x02 2 \b, soundchip(s): SN76489 24877>>>0xF byte&0x04 4 stereo 24878>>0xF byte&0x01 1 \b, YM2413 24879>>0xF byte&0x08 8 \b, Y8950 24880 248810 string/b KSSX KSS music file v1.20 24882>0xE byte&0xEF 0 24883>>0xF byte&0x40 0x00 \b, 60Hz 24884>>0xF byte&0x40 0x40 \b, 50Hz 24885>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 24886>>0xF byte&0x02 0x02 \b, soundchips: SN76489 24887>>>0xF byte&0x04 0x04 stereo 24888>>0xF byte&0x01 0x01 \b, 24889>>>0xF byte&0x18 0x00 \bYM2413 24890>>>0xF byte&0x18 0x08 \bYM2413, Y8950 24891>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 24892>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 24893 24894# Moonblaster for Moonsound 248950 string/b MBMS 24896>4 byte 0x10 MSX Moonblaster for MoonSound music 24897 24898# Music Player K-kaz 248990 string/b MPK MSX Music Player K-kaz song 24900>6 ubeshort 0x0D0A 24901>>3 byte x v%c 24902>>4 byte x \b.%c 24903>>5 byte x \b%c 24904 24905# I don't know why these don't work 24906#0 search/0xFFFF \r\n.FM9 24907#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 24908#0 search/0xFFFF \r\nFM1\ \= 24909#>0 search/0xFFFF \r\nPSG1\= 24910#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 24911 24912# OPX Music file 249130x35 beshort 0x0d0a 24914>0x7B beshort 0x0d0a 24915>>0x7D byte 0x1a 24916>>>0x87 uleshort 0 MSX OPX Music file 24917>>>>0x86 byte 0 v1.5 24918>>>>>0 string >\32 \b, title: %s 24919>>>>0x86 byte 1 v2.4 24920>>>>>0 string >\32 \b, title: %s 24921 24922# SCMD music file 249230x8B string/b SCMD 24924>0xCE uleshort 0 MSX SCMD Music file 24925#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 24926>>0x8F string >\0 \b, title: %s 24927 249280 search/0xFFFF \r\n@title 24929>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 24930 24931 24932############## MSX image file formats ############## 24933 24934# MSX raw VRAM dump 249350 ubyte 0xFE 24936>1 uleshort 0 24937>>5 uleshort 0 24938>>>3 uleshort 0x37FF MSX SC2/GRP raw image 24939>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 24940>>>3 uleshort >0x769E 24941>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 24942>>>>>3 uleshort 0x7FFF \b, with sprite patterns 24943>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 24944>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 24945 24946# Graph Saurus compressed images 249470 ubyte 0xFD 24948>1 uleshort 0 24949>>5 uleshort 0 24950>>>3 uleshort >0x013D MSX Graph Saurus compressed image 24951 24952# MSX G9B image file 249530 string/b G9B 24954>1 uleshort 11 24955>>3 uleshort >10 24956>>>5 ubyte >0 MSX G9B image, depth=%d 24957>>>>8 uleshort x \b, %dx 24958>>>>10 uleshort x \b%d 24959>>>>5 ubyte <9 24960>>>>>6 ubyte 0 24961>>>>>>7 ubyte x \b, codec=%d RGB color palettes 24962>>>>>6 ubyte 64 \b, codec=RGB fixed color 24963>>>>>6 ubyte 128 \b, codec=YJK 24964>>>>>6 ubyte 192 \b, codec=YUV 24965>>>>5 ubyte >8 codec=RGB fixed color 24966>>>>12 ubyte 0 \b, raw 24967>>>>12 ubyte 1 \b, bitbuster compression 24968 24969############## Other MSX file formats ############## 24970 24971# MSX internal ROMs 249720 ubeshort 0xF3C3 24973>2 uleshort <0x4000 24974>>8 ubyte 0xC3 24975>>>9 uleshort <0x4000 24976>>>>0x0B ubeshort 0x00C3 24977>>>>>0x0D uleshort <0x4000 24978>>>>>>0x0F ubeshort 0x00C3 24979>>>>>>>0x11 uleshort <0x4000 24980>>>>>>>>0x13 ubeshort 0x00C3 24981>>>>>>>>>0x15 uleshort <0x4000 24982>>>>>>>>>>0x50 ubyte 0xC3 24983>>>>>>>>>>>0x51 uleshort <0x4000 24984>>>>>>>>>>>>(9.s) ubyte 0xC3 24985>>>>>>>>>>>>>&0 uleshort >0x4000 24986>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 24987>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 24988>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 24989>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 24990>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 24991>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 24992>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 24993>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 24994>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 24995>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 24996>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 24997>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 24998>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 24999>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 25000>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 25001>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 25002>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 25003>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 25004>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 25005>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 25006>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 25007>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 25008>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 25009>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 25010>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 25011>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 25012>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 25013>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 25014 25015 250160 string/b CD 25017>2 uleshort >0x10 25018>>2 uleshort <0x4000 25019>>>4 uleshort <0x4000 25020>>>>6 uleshort <0x4000 25021>>>>>8 ubyte 0xC3 25022>>>>>>9 uleshort <0x4000 25023>>>>>>>0x10 ubyte 0xC3 25024>>>>>>>>0x11 uleshort <0x4000 25025>>>>>>>>>0x14 ubyte 0xC3 25026>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 25027 250280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 25029>0x5F0 ubequad 0x8282828244380000 25030>>0x150 ubyte 0x38 25031>>>0x170 string \20\20\20 25032>>>>0x1E32 string ()) 25033>>>>>0x2130 ubequad 0xA5A5594924231807 25034>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 25035 25036 25037 25038# MSX extension ROMs 250390 string/b AB 25040>2 uleshort 0x0010 MSX ROM 25041>>2 uleshort x \b, init=0x%4x 25042>>4 uleshort >0 \b, stahdl=0x%4x 25043>>6 uleshort >0 \b, devhdl=0x%4x 25044>>8 uleshort >0 \b, bas=0x%4x 25045>2 uleshort 0x4010 MSX ROM 25046>>2 uleshort x \b, init=0x%04x 25047>>4 uleshort >0 \b, stahdl=0x%04x 25048>>6 uleshort >0 \b, devhdl=0x%04x 25049>>8 uleshort >0 \b, bas=0x%04x 25050>2 uleshort 0x8010 MSX ROM 25051>>2 uleshort x \b, init=0x%04x 25052>>4 uleshort >0 \b, stahdl=0x%04x 25053>>6 uleshort >0 \b, devhdl=0x%04x 25054>>8 uleshort >0 \b, bas=0x%04x 250550 string/b AB\0\0 25056>6 uleshort 0 25057>>4 uleshort >0x400F MSX-BASIC extension ROM 25058>>>4 uleshort >0 \b, stahdl=0x%04x 25059>>>6 uleshort >0 \b, devhdl=0x%04x 25060>>>0x1C string OPLL \b, MSX-Music 25061>>>>0x18 string PAC2 \b (external) 25062>>>>0x18 string APRL \b (internal) 25063 250640 string/b AB\0\0\0\0 25065>6 uleshort >0x400F MSX device BIOS 25066>>6 uleshort >0 \b, devhdl=0x%04x 25067 25068 250690 string/b AB 25070#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 25071#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 25072#>3 string @3\x80IA862 Golvellius MSX1 ROM 25073>2 uleshort >15 25074>>2 uleshort <0xC000 25075>>>8 string \0\0\0\0\0\0\0\0 25076>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 25077>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 25078>>>>>0x10 string CD \b, Konami RC- 25079>>>>>>0x12 ubyte x \b%d 25080>>>>>>0x13 ubyte/16 x \b%d 25081>>>>>>0x13 ubyte&0xF x \b%d 25082>>>>>0x10 string EF \b, Konami RC- 25083>>>>>>0x12 ubyte x \b%d 25084>>>>>>0x13 ubyte/16 x \b%d 25085>>>>>>0x13 ubyte&0xF x \b%d 25086>>>>>2 uleshort x \b, init=0x%04x 25087>>>>>4 uleshort >0 \b, stahdl=0x%04x 25088>>>>>6 uleshort >0 \b, devhdl=0x%04x 25089>>>>>8 uleshort >0 \b, bas=0x%04x 25090>>>2 uleshort 0 25091>>>>4 uleshort 0 25092>>>>>6 uleshort 0 25093>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 25094 250950x4000 string/b AB 25096>0x4002 uleshort >0x400F 25097>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 25098>>>0x4002 uleshort x \b, init=0x%04x 25099>>>0x4004 uleshort >0 \b, stahdl=0x%04x 25100>>>0x4006 uleshort >0 \b, devhdl=0x%04x 25101>>>0x4008 uleshort >0 \b, bas=0x%04x 25102 251030x8000 string/b AB 25104>0x8002 uleshort >0x400F 25105>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 25106>>>0x8002 uleshort x \b, init=0x%04x 25107>>>0x8004 uleshort >0 \b, stahdl=0x%04x 25108>>>0x8006 uleshort >0 \b, devhdl=0x%04x 25109>>>0x8008 uleshort >0 \b, bas=0x%04x 25110 25111 251120x3C000 string/b AB 25113>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 25114>>0x3C002 uleshort x \b, init=0x%04x 25115>>0x3C004 uleshort >0 \b, stahdl=0x%04x 25116>>0x3C006 uleshort >0 \b, devhdl=0x%04x 25117>>0x3C008 uleshort >0 \b, bas=0x%04x 25118 25119# MSX BIN file 25120#0 byte 0xFE 25121#>1 uleshort >0x8000 25122#>>3 uleshort >0x8004 25123#>>>5 uleshort >0x8000 MSX BIN file 25124 25125# MSX-BASIC file 251260 byte 0xFF 25127>3 uleshort 0x000A 25128>>1 uleshort >0x8000 MSX-BASIC program 25129 25130# MSX .CAS file 251310 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 25132 25133# Mega-Assembler file 251340 byte 0xFE 25135>1 uleshort 0x0001 25136>>5 uleshort 0xffff 25137>>>6 byte 0x0A MSX Mega-Assembler source 25138 25139# Execrom Patchfile 251400 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 25141>0x12 ubyte/16 x v%d 25142>0x12 ubyte&0xF x \b.%d 25143>0x13 ubyte x \b, contains %d patches 25144 25145# Konami's King's Valley-2 custom stage (ELG file) 251464 uleshort 0x0900 25147>0xF byte 1 25148>>0x14 byte 0 25149>>>0x1E string \040\040\040 25150>>>>0x23 byte 1 25151>>>>>0x25 byte 0 25152>>>>>>0x15 string >\x30 25153>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 25154>>>>>>>>0x1D byte <32 \b, theme: %d 25155 25156# Metal Gear 1 savegame 25157#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 25158#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 25159#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 25160 25161# ------------------------------------------------------------------------ 25162# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 25163# mup: file(1) magic for Mup (Music Publisher) input file. 25164# 25165# From: Abel Cheung <abel (@) oaka.org> 25166# 25167# NOTE: This header is mainly proposed in the Arkkra mailing list, 25168# and is not a mandatory header because of old mup input file 25169# compatibility. Noteedit also use mup format, but is not forcing 25170# user to use any header as well. 25171# 251720 search/1 //!Mup Mup music publication program input text 25173>6 string -Arkkra (Arkkra) 25174>>13 string - 25175>>>16 string . 25176>>>>14 string x \b, need V%.4s 25177>>>15 string . 25178>>>>14 string x \b, need V%.3s 25179>6 string - 25180>>9 string . 25181>>>7 string x \b, need V%.4s 25182>>8 string . 25183>>>7 string x \b, need V%.3s 25184#------------------------------------------------------------------------------ 25185# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 25186# music: file (1) magic for music formats 25187 25188# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 25189# and Bagpipe Writer by Doug Wickstrom 25190# 251910 string Bagpipe Bagpipe 25192>8 string Reader Reader 25193>>15 string >\0 (version %.3s) 25194>8 string Music\ Writer Music Writer 25195>>20 string : 25196>>>21 string >\0 (version %.3s) 25197>>21 string Gold Gold 25198>>>25 string : 25199>>>>26 string >\0 (version %.3s) 25200 25201 25202#------------------------------------------------------------------------------ 25203# nasa: file(1) magic 25204 25205# From: Barry Carter <carter.barry@gmail.com> 252060 string DAF/SPK NASA SPICE file (binary format) 252070 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 25208 25209#----------------------------------------------------------------------------- 25210# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 25211# natinst: file(1) magic for National Instruments Code Files 25212 25213# 25214# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 25215# version 1 25216# Many formats still missing, we use, for the moment LabVIEW 25217# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 25218# 252190 string RSRC National Instruments, 25220# Check if it's a LabVIEW File 25221>8 string LV LabVIEW File, 25222# Check which kind of file it is 25223>>10 string SB Code Resource File, data 25224>>10 string IN Virtual Instrument Program, data 25225>>10 string AR VI Library, data 25226# This is for Menu Libraries 25227>8 string LMNULBVW Portable File Names, data 25228# This is for General Resources 25229>8 string rsc Resources File, data 25230# This is for VXI Package 252310 string VMAP National Instruments, VXI File, data 25232 25233#------------------------------------------------------------------------------ 25234# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 25235# ncr: file(1) magic for NCR Tower objects 25236# 25237# contributed by 25238# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 25239# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 25240# 252410 beshort 000610 Tower/XP rel 2 object 25242>12 belong >0 not stripped 25243>20 beshort 0407 executable 25244>20 beshort 0410 pure executable 25245>22 beshort >0 - version %d 252460 beshort 000615 Tower/XP rel 2 object 25247>12 belong >0 not stripped 25248>20 beshort 0407 executable 25249>20 beshort 0410 pure executable 25250>22 beshort >0 - version %d 252510 beshort 000620 Tower/XP rel 3 object 25252>12 belong >0 not stripped 25253>20 beshort 0407 executable 25254>20 beshort 0410 pure executable 25255>22 beshort >0 - version %d 252560 beshort 000625 Tower/XP rel 3 object 25257>12 belong >0 not stripped 25258>20 beshort 0407 executable 25259>20 beshort 0410 pure executable 25260>22 beshort >0 - version %d 252610 beshort 000630 Tower32/600/400 68020 object 25262>12 belong >0 not stripped 25263>20 beshort 0407 executable 25264>20 beshort 0410 pure executable 25265>22 beshort >0 - version %d 252660 beshort 000640 Tower32/800 68020 25267>18 beshort &020000 w/68881 object 25268>18 beshort &040000 compatible object 25269>18 beshort &060000 object 25270>20 beshort 0407 executable 25271>20 beshort 0413 pure executable 25272>12 belong >0 not stripped 25273>22 beshort >0 - version %d 252740 beshort 000645 Tower32/800 68010 25275>18 beshort &040000 compatible object 25276>18 beshort &060000 object 25277>20 beshort 0407 executable 25278>20 beshort 0413 pure executable 25279>12 belong >0 not stripped 25280>22 beshort >0 - version %d 25281 25282#------------------------------------------------------------ 25283# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $ 25284 25285# From: Mikhail Gusarov <dottedmag@dottedmag.net> 25286# NekoVM (https://nekovm.org/) bytecode 252870 string NEKO NekoVM bytecode 25288>4 lelong x (%d global symbols, 25289>8 lelong x %d global fields, 25290>12 lelong x %d bytecode ops) 25291!:mime application/x-nekovm-bytecode 25292 25293 25294#------------------------------------------------------------------------------ 25295# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $ 25296# netbsd: file(1) magic for NetBSD objects 25297# 25298# All new-style magic numbers are in network byte order. 25299# The old-style magic numbers are indistinguishable from the same magic 25300# numbers used in other systems, and are handled, for all those systems, 25301# in aout. 25302# 25303 253040 name netbsd-detail 25305>20 lelong x @%#x 25306>4 lelong >0 \b+T=%d 25307>8 lelong >0 \b+D=%d 25308>12 lelong >0 \b+B=%d 25309>16 lelong >0 \b+S=%d 25310>24 lelong >0 \b+TR=%d 25311>28 lelong >0 \b+TD=%d 25312 253130 name netbsd-4096 25314>0 byte &0x80 25315>>20 lelong <4096 shared library 25316>>20 lelong =4096 dynamically linked executable 25317>>20 lelong >4096 dynamically linked executable 25318>0 byte ^0x80 executable 25319>16 lelong >0 not stripped 25320 253210 name netbsd-8192 25322>0 byte &0x80 25323>>20 lelong <8192 shared library 25324>>20 lelong =8192 dynamically linked executable 25325>>20 lelong >8192 dynamically linked executable 25326>0 byte ^0x80 executable 25327>16 lelong >0 not stripped 25328>0 use netbsd-detail 25329 253300 name netbsd-normal 25331>0 byte &0x80 dynamically linked executable 25332>0 byte ^0x80 25333>>0 byte &0x40 position independent 25334>>20 lelong !0 executable 25335>>20 lelong =0 object file 25336>16 lelong >0 not stripped 25337>0 use netbsd-detail 25338 253390 name netbsd-pure 25340>0 byte &0x80 dynamically linked executable 25341>0 byte ^0x80 executable 25342>16 lelong >0 not stripped 25343>0 use netbsd-detail 25344 253450 name netbsd-core 25346>12 string >\0 from '%s' 25347>32 lelong !0 (signal %d) 25348 253490 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 25350>0 use netbsd-4096 25351 253520 belong&0377777777 041400410 a.out NetBSD/i386 pure 25353>0 use netbsd-pure 25354 253550 belong&0377777777 041400407 a.out NetBSD/i386 25356>0 use netbsd-normal 25357 253580 belong&0377777777 041400507 a.out NetBSD/i386 core 25359>0 use netbsd-core 25360 253610 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 25362>0 use \^netbsd-8192 25363 253640 belong&0377777777 041600410 a.out NetBSD/m68k pure 25365>0 use \^netbsd-pure 25366 253670 belong&0377777777 041600407 a.out NetBSD/m68k 25368>0 use \^netbsd-normal 25369 253700 belong&0377777777 041600507 a.out NetBSD/m68k core 25371>0 use \^netbsd-core 25372 253730 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 25374>0 use \^netbsd-4096 25375 253760 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 25377>0 use \^netbsd-pure 25378 253790 belong&0377777777 042000407 a.out NetBSD/m68k4k 25380>0 use \^netbsd-normal 25381 253820 belong&0377777777 042000507 a.out NetBSD/m68k4k core 25383>0 use \^netbsd-core 25384 253850 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 25386>0 use netbsd-4096 25387 253880 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 25389>0 use netbsd-pure 25390 253910 belong&0377777777 042200407 a.out NetBSD/ns32532 25392>0 use netbsd-normal 25393 253940 belong&0377777777 042200507 a.out NetBSD/ns32532 core 25395>0 use netbsd-core 25396 253970 belong&0377777777 045200507 a.out NetBSD/powerpc core 25398>0 use netbsd-core 25399 254000 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 25401>0 use \^netbsd-8192 25402 254030 belong&0377777777 042400410 a.out NetBSD/SPARC pure 25404>0 use \^netbsd-pure 25405 254060 belong&0377777777 042400407 a.out NetBSD/SPARC 25407>0 use \^netbsd-normal 25408 254090 belong&0377777777 042400507 a.out NetBSD/SPARC core 25410>0 use \^netbsd-core 25411 254120 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 25413>0 use netbsd-4096 25414 254150 belong&0377777777 042600410 a.out NetBSD/pmax pure 25416>0 use \^netbsd-pure 25417 254180 belong&0377777777 042600407 a.out NetBSD/pmax 25419>0 use netbsd-normal 25420 254210 belong&0377777777 042600507 a.out NetBSD/pmax core 25422>0 use netbsd-core 25423 254240 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 25425>0 use netbsd-4096 25426 254270 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 25428>0 use netbsd-pure 25429 254300 belong&0377777777 043000407 a.out NetBSD/vax 1k 25431>0 use netbsd-normal 25432 254330 belong&0377777777 043000507 a.out NetBSD/vax 1k core 25434>0 use netbsd-core 25435 254360 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 25437>0 use netbsd-4096 25438 254390 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 25440>0 use netbsd-pure 25441 254420 belong&0377777777 045400407 a.out NetBSD/vax 4k 25443>0 use netbsd-normal 25444 254450 belong&0377777777 045400507 a.out NetBSD/vax 4k core 25446>0 use netbsd-core 25447 25448# NetBSD/alpha does not support (and has never supported) a.out objects, 25449# so no rules are provided for them. NetBSD/alpha ELF objects are 25450# dealt with in "elf". 254510 lelong 0x00070185 ECOFF NetBSD/alpha binary 25452>10 leshort 0x0001 not stripped 25453>10 leshort 0x0000 stripped 254540 belong&0377777777 043200507 a.out NetBSD/alpha core 25455>12 string >\0 from '%s' 25456>32 lelong !0 (signal %d) 25457 254580 belong&0377777777 043400413 a.out NetBSD/mips demand paged 25459>0 use \^netbsd-8192 25460 25461>16 belong >0 not stripped 254620 belong&0377777777 043400410 a.out NetBSD/mips pure 25463>0 use netbsd-pure 25464 254650 belong&0377777777 043400407 a.out NetBSD/mips 25466>0 use netbsd-normal 25467 254680 belong&0377777777 043400507 a.out NetBSD/mips core 25469>0 use netbsd-core 25470 254710 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 25472>0 use netbsd-4096 25473 254740 belong&0377777777 043600410 a.out NetBSD/arm32 pure 25475>0 use netbsd-pure 25476 254770 belong&0377777777 043600407 a.out NetBSD/arm32 25478>0 use netbsd-normal 25479 25480# NetBSD/arm26 has always used ELF objects, but it shares a core file 25481# format with NetBSD/arm32. 254820 belong&0377777777 043600507 a.out NetBSD/arm core 25483>0 use netbsd-core 25484 25485# Kernel core dump format 254860 belong&0x0000ffff 0x00008fca NetBSD kernel core file 25487>0 belong&0x03ff0000 0x00000000 \b, Unknown 25488>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 25489>0 belong&0x03ff0000 0x00020000 \b, sun 68020 25490>0 belong&0x03ff0000 0x00640000 \b, 386 PC 25491>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 25492>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 25493>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 25494>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 25495>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 25496>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 25497>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 25498>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 25499>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 25500>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 25501>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 25502>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 25503>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 25504>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 25505>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 25506>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 25507>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 25508>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 25509>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 25510>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 25511>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 25512>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 25513>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 25514>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 25515>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 25516>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 25517>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 25518>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 25519>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 25520>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 25521>0 belong&0xfc000000 0x04000000 \b, CPU 25522>0 belong&0xfc000000 0x08000000 \b, DATA 25523>0 belong&0xfc000000 0x10000000 \b, STACK 25524>4 leshort x \b, (headersize = %d 25525>6 leshort x \b, segmentsize = %d 25526>8 lelong x \b, segments = %d) 25527 25528# little endian only for now. 255290 name ktrace 25530>4 leshort 7 25531>>6 leshort <3 NetBSD ktrace file version %d 25532>>>12 string x from %s 25533>>>56 string x \b, emulation %s 25534>>>8 lelong <65536 \b, pid=%d 25535 2553656 string netbsd 25537>0 use ktrace 2553856 string linux 25539>0 use ktrace 2554056 string sunos 25541>0 use ktrace 2554256 string hpux 25543>0 use ktrace 25544 25545#------------------------------------------------------------------------------ 25546# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 25547# netscape: file(1) magic for Netscape files 25548# "H. Nanosecond" <aldomel@ix.netcom.com> 25549# version 3 and 4 I think 25550# 25551 25552# Netscape Address book .nab 255530 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 25554 25555# Netscape Communicator address book 255560 string \000\017\102\111 Netscape Communicator address book 25557 25558# .snm Caches 255590 string #\ Netscape\ folder\ cache Netscape folder cache 255600 string \000\036\204\220\000 Netscape folder cache 25561# .n2p 25562# Net 2 Phone 25563#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 255640 string SX961999 Net2phone 25565 25566# 25567#This is files ending in .art, FIXME add more rules 255680 string JG\004\016\0\0\0\0 AOL ART image 255690 string JG\003\016\0\0\0\0 AOL ART image 25570 25571#------------------------------------------------------------------------------ 25572# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $ 25573# netware: file(1) magic for NetWare Loadable Modules (NLMs) 25574# From: Mads Martin Joergensen <mmj@suse.de> 25575# URL: https://en.wikipedia.org/wiki/NetWare_Loadable_Module 25576 255770 string NetWare\ Loadable\ Module NetWare Loadable Module 25578#!:mime application/octet-stream 25579!:ext nlm 25580 25581 25582#------------------------------------------------------------------------------ 25583# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 25584# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 25585# 255860 string StartFontMetrics ASCII font metrics 255870 string StartFont ASCII font bits 255880 belong 0x137A2944 NeWS bitmap font 255890 belong 0x137A2947 NeWS font family 255900 belong 0x137A2950 scalable OpenFont binary 255910 belong 0x137A2951 encrypted scalable OpenFont binary 255928 belong 0x137A2B45 X11/NeWS bitmap font 255938 belong 0x137A2B48 X11/NeWS font family 25594 25595#------------------------------------------------------------------------------ 25596# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $ 25597# nitpicker: file(1) magic for Flowfiles. 25598# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de 255990 string NPFF NItpicker Flow File 25600>4 byte x V%d. 25601>5 byte x %d 25602>6 bedate x started: %s 25603>10 bedate x stopped: %s 25604>14 belong x Bytes: %u 25605>18 belong x Bytes1: %u 25606>22 belong x Flows: %u 25607>26 belong x Pkts: %u 25608 25609#------------------------------------------------------------------------------ 25610# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $ 25611# numpy: file(1) magic for NumPy array binary serialization format 25612# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html 256130 string \x93NUMPY NumPy array, 25614>6 ubyte x version %d 25615>7 ubyte x \b.%d, 25616>8 uleshort x header length %d 25617 25618#------------------------------------------------------------------------------ 25619# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 25620# OASIS 25621# Summary: OASIS stream file 25622# Long description: Open Artwork System Interchange Standard 25623# File extension: .oas 25624# Full name: Ben Cowley (bcowley@broadcom.com) 25625# Philip Dixon (pdixon@broadcom.com) 25626# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 25627# (see page 3) 256280 string %SEMI-OASIS\r\n OASIS Stream file 25629 25630#------------------------------------------------------------------------------ 25631# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 25632# ocaml: file(1) magic for Objective Caml files. 256330 string Caml1999 OCaml 25634>8 string X exec file 25635>8 string I interface file (.cmi) 25636>8 string O object file (.cmo) 25637>8 string A library file (.cma) 25638>8 string Y native object file (.cmx) 25639>8 string Z native library file (.cmxa) 25640>8 string M abstract syntax tree implementation file 25641>8 string N abstract syntax tree interface file 25642>9 string >\0 (Version %3.3s) 25643 25644#------------------------------------------------------------------------------ 25645# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 25646# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 256470 string Octave-1-L Octave binary data (little endian) 256480 string Octave-1-B Octave binary data (big endian) 25649 25650#------------------------------------------------------------------------------ 25651# $File: ole2compounddocs,v 1.10 2021/02/23 00:51:10 christos Exp $ 25652# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 25653# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 25654# Additional tests for OLE 2 Compound Documents should be under this recipe. 25655# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 25656 256570 string \320\317\021\340\241\261\032\341 25658# https://digital-preservation.github.io/droid/ 25659# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 25660>0x1A ushort !0xABAB OLE 2 Compound Document 25661#>0x1C uleshort x \b, endnian 0x%4.4x 25662# big endian not tested 25663>>0x1C ubeshort =0xfffe \b, big-endian 25664>>>546 string jbjb : Microsoft Word Document 25665!:mime application/msword 25666!:apple MSWDWDBN 25667!:ext doc 25668# Byte Order 0xFFFE means little-endian found in real world applications 25669#>>0x1C uleshort =0xfffe \b, little-endian 25670>>0x1C uleshort =0xfffe 25671# From: Joerg Jenderek 25672# Major Version 3 or 4 25673>>>0x1A uleshort x \b, v%u 25674# Minor Version 32h=50 3Bh=59 3Eh=62 25675>>>0x18 uleshort x \b.%u 25676# SecID of first sector of the directory stream is often 1 but high like 3144h 25677>>>48 ulelong x \b, SecID 0x%x 25678# Sector Shift Exponent in short-stream container stream: 6~64 bytes 25679>>>32 uleshort !6 \b, exponent of short stream %u 25680# total number of sectors used for the FAT 25681>>>44 ulelong >1 \b, %u FAT sectors 25682# SecID of first sector of the short-sector allocation table (Mini FAT) 25683# or -2 (End Of ChainSecID) if not extant 25684>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector 0x%x 25685# total number of sectors used for the short-sector allocation table 25686>>>64 ulelong !1 \b, %u Mini FAT sector 25687# plural s 25688>>>>64 ulelong >1 \bs 25689# SecID of first sector of the master sector allocation table (DIFAT) 25690# or -2 (End Of Chain SecID) if no additional sectors used 25691>>>68 ulelong !0xffFFffFE \b, DIFAT start sector 0x%x 25692# total number of sectors used for the master sector allocation table (DIFAT) 25693>>>72 ulelong >0 \b, %u DIFAT sectors 25694# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 25695#>>>76 ubequad x \b, DIFAT=0x%16.16llx 25696#>>>84 ubequad x \b%16.16llx... 25697# pointer to root entry only works with standard configuration for SecID ~< 800h 25698# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 25699# "ORLEN Factbook 2017.xls" XnView_metadata.doc 25700# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 25701>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 25702# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 25703>>>0x1E uleshort 0xc \b, blocksize 4096 25704# jump to one block (4096 bytes per block) before root storage block 25705>>>>(48.l*4096) ubyte x 25706>>>>>&4095 use ole2-directory 25707#>>>0x1E uleshort 9 \b, blocksize 512 25708>>>0x1E uleshort 9 25709# jump to one block (512 bytes per block) before root storage block 25710# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 25711>>>>(48.l*512) ubyte x 25712>>>>>&511 use ole2-directory 25713# check directory entry structure and display types by GUID 257140 name ole2-directory 25715# directory entry name like "Root Entry" 25716#>0 lestring16 x \b, 1st %.10s 25717# type of the entry; 5~Root storage 25718#>66 ubyte x \b, type %x 25719# node colour of the entry: 00H ~ Red 01H ~ Black 25720#>67 ubyte x \b, color %x 25721# the DirIDs of the child nodes. Should both be -1 in the root storage entry 25722#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 25723# second directory entry name like VisioDocument Control000 25724#>128 lestring16 x \b, 2nd %.20s 25725# third directory entry like WordDocument 25726#>256 lestring16 x \b, 3rd %.20s 25727# forth 25728#>384 lestring16 x \b, 4th %.10s 25729# 5th 25730#>512 lestring16 x \b, 5th %.10s 25731# 6th 25732#>640 lestring16 x \b, 6th %.10s 25733# 7th 25734#>768 lestring16 x \b, 7th %.10s 25735# https://wikileaks.org/ciav7p1/cms/page_13762814.html 25736# https://m.blog.naver.com/superman4u/40047693679 25737# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 25738# http://www.windowstricks.in/online-windows-guid-converter 25739#>80 ubequad !0 \b, clsid 0x%16.16llx 25740#>>88 ubequad x \b%16.16llx 25741# test for "Root Entry" inside directory by type 5 value 25742>66 ubyte 5 25743# look for CLSID GUID 0 25744>>88 ubequad 0x0 25745>>>80 ubequad 0x0 25746# - Microstation V8 DGN files (www.bentley.com) 25747# URL: https://en.wikipedia.org/wiki/MicroStation 25748# Last update on 10/23/2006 by Lester Hightower 25749# 07/24/2019 by Joerg Jenderek 25750# Second directory entry name like Dgn~H Dgn~S 25751>>>>128 lestring16 Dgn~ : Microstation V8 CAD 25752#!:mime application/x-ole-storage 25753!:mime application/x-bentley-dgn 25754# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 25755!:ext dgn 25756# 25757# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 25758# Second directory entry name PerfectOffice_ 25759>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 25760!:mime application/vnd.wordperfect 25761# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 25762!:apple ????WPC7 25763!:ext mst/wpd/wpg 25764# 25765# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 25766# Second directory entry name MatOST_ 25767>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 25768!:mime application/vnd.ms-works 25769!:apple ????AWWP 25770!:ext wps 25771# 25772# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 25773# 3rd directory entry name WksSSWorkBook 25774>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 25775!:mime application/vnd.ms-works 25776!:apple ????AWSS 25777!:ext xlr 25778# 25779# URL: http://fileformats.archiveteam.org/wiki/XLS 25780# what is the difference to {00020820-0000-0000-c000-000000000046} ? 25781# Second directory entry name Workbook 25782>>>>128 lestring16 Workbook 25783>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 25784!:mime application/vnd.ms-excel 25785# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 25786!:apple ????XLS9 25787!:ext xls 25788# 25789# URL: http://fileformats.archiveteam.org/wiki/PPT 25790# Second directory entry name Object1 Object12 Object35 25791>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 25792!:mime application/vnd.ms-powerpoint 25793# https://www.macdisk.com/macsigen.php 25794!:apple ????PPT3 25795!:ext ppt 25796# 25797# URL: https://www.msoutlook.info/question/164 25798# Second directory entry name __CollDataStm 25799>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 25800#!:mime application/vnd.ms-outlook 25801!:mime application/x-ms-srs 25802# %APPDATA%\Microsoft\Outlook\Outlook.srs 25803!:ext srs 25804# 25805# URL: https://www.file-extensions.org/cag-file-extension 25806# Second directory entry name Category 25807>>>>128 lestring16 Category : Microsoft Clip Art Gallery 25808#!:mime application/x-ole-storage 25809!:mime application/x-ms-cag 25810!:apple MScgCGdb 25811!:ext cag/ 25812# 25813# URL: https://www.filesuffix.com/de/extension/rra 25814# 3rd directory entry name StrIndex_StringTable 25815>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 25816#!:mime application/x-ole-storage 25817!:mime application/x-ms-rra 25818!:ext rra 25819# 25820# URL: https://www.forensicswiki.org/wiki/Jump_Lists 25821# 3rd directory entry name DestList 25822>>>>256 lestring16 DestList : Windows jump list 25823#!:mime application/x-ole-storage 25824!:mime application/x-ms-jumplist 25825# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 25826!:ext automaticDestinations-ms 25827# 25828# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 25829# Second directory entry name 256_ 25830>>>>128 lestring16 256_ : Windows thumbnail database 256 25831#!:mime application/x-ole-storage 25832!:mime application/x-ms-thumbnail 25833# Thumbs.db 25834!:ext db 25835>>>>128 lestring16 96_ : Windows thumbnail database 96 25836!:mime application/x-ms-thumbnail 25837!:ext db 25838# 3rd directory entry name Catalog_ 25839>>>>256 lestring16 Catalog : Windows thumbnail database 25840!:mime application/x-ms-thumbnail 25841!:ext db 25842# 25843# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 25844# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 25845# Second directory entry name Control000 25846>>>>128 lestring16 Control000 : Microsoft old Systeminfo 25847#!:mime application/x-ole-storage 25848!:mime application/x-ms-info 25849!:ext nfo 25850# 25851# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 25852# Second directory entry name Thumbnail 25853>>>>128 lestring16 Thumbnail : Corel PrintHouse image 25854#!:mime application/x-ole-storage 25855!:mime application/x-corel-cph 25856!:ext cph 25857# 3rd directory entry name Thumbnail 25858>>>>256 lestring16 Thumbnail : Corel PrintHouse image 25859!:mime application/x-corel-cph 25860!:ext cph 25861# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 25862# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album 25863# third directory entry name _INFO_ 25864>>>>256 lestring16 _INFO_ : Corel Gallery 25865# second directory entry name _ITEM_ or _DATA_ 25866# later directory entry names: _ALBUM_ _THUMBNAIL_ 25867#!:mime application/x-ole-storage 25868!:mime application/x-corel-gal 25869!:ext gal 25870# 25871# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 25872# Note: "HWP Document File" signature found in FileHeader 25873# Second directory entry name FileHeader hint for Thinkfree Office document 25874>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 25875#!:mime application/haansofthwp 25876!:mime application/x-hwp 25877# https://example-files.online-convert.com/document/hwp/example.hwp 25878!:ext hwp 25879# 25880# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 25881# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 25882>>>>128 lestring16 dd2 : StarOffice Gallery view 25883#!:mime application/x-ole-storage 25884!:mime application/x-star-sdv 25885!:ext sdv 25886# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 25887# second directory entry name Current User 25888>>>>128 lestring16 Current\ User : SoftMaker 25889# third directory entry name SMNativeObjData 25890>>>>>256 lestring16 SMNativeObjData 25891# 5th directory entry name PowerPoint 25892>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 25893!:mime application/vnd.ms-powerpoint 25894!:ext ppt/pps/pot 25895# 4th directory entry name PowerPoint 25896>>>>>384 lestring16 PowerPoint Presentations or template 25897# http://extension.nirsoft.net/prv 25898!:mime application/vnd.softmaker.presentations 25899!:ext prd/prv 25900# third directory entry name like Current User 25901>>>>256 lestring16 Current\ User : SoftMaker 25902# 5th directory entry name PowerPoint 25903>>>>>512 lestring16 PowerPoint Presentations or template 25904# http://extension.nirsoft.net/prd 25905!:mime application/vnd.softmaker.presentations 25906!:ext prd/prv 25907# 2nd directory entry name Pictures 25908>>>>>>128 lestring16 Pictures with pictures 25909# remaining null clsid 25910>>>>128 default x : UNKNOWN 25911# second directory entry name like VisioDocument Control000 25912>>>>>128 lestring16 x with names %.20s 25913# third directory entry like WordDocument 25914>>>>>256 lestring16 x %.20s 25915# forth 25916>>>>>384 lestring16 x %.20s 25917!:mime application/x-ole-storage 25918# look for known clsid GUID 25919# - Visio documents 25920# URL: http://fileformats.archiveteam.org/wiki/Visio 25921# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 25922>>88 ubequad 0xc000000000000046 : Microsoft 25923>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 25924!:mime application/vnd.visio 25925# VSD~Drawing VSS~Stencil VST~Template 25926!:ext vsd/vss/vst 25927>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 25928!:mime application/vnd.visio 25929!:ext vsd/vss/vst 25930# 25931# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 25932>>>80 ubequad 0x84100c0000000000 Windows Installer Package 25933!:mime application/x-msi 25934#!:mime application/x-ms-win-installer 25935!:ext msi 25936>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 25937# ?? 25938!:mime application/x-wine-extension-msp 25939#!:mime application/x-ms-msp 25940!:ext msp 25941# 25942# URL: http://fileformats.archiveteam.org/wiki/DOC 25943>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 25944!:mime application/msword 25945# for template MSWDW8TN 25946!:apple MSWDWDBN 25947!:ext doc/dot 25948>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 25949!:mime application/msword 25950!:apple MSWDWDBN 25951# dot for template; no extension on Macintosh 25952!:ext doc/dot/ 25953# 25954# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 25955>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 25956!:mime application/vnd.ms-works 25957!:apple ????AWWP 25958# ps for template https://filext.com/file-extension/PS bps for backup 25959!:ext wps/ps/bps 25960# 25961# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 25962>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 25963!:mime application/vnd.ms-works-db 25964# https://www.macdisk.com/macsigen.php 25965!:apple ????AWDB 25966# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 25967!:ext wdb/db/bdb 25968# 25969# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 25970>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 25971!:mime application/vnd.ms-excel 25972# https://www.macdisk.com/macsigen.php 25973!:apple ????XLS5 25974# worksheet/addin/template/no extension on Macintosh 25975!:ext xls/xla/xlt/ 25976# 25977>>>80 ubequad 0x2008020000000000 Excel 97-2003 25978!:mime application/vnd.ms-excel 25979# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 25980!:apple ????XLS9 25981# 3rd directory entry name 25982>>>>256 lestring16 _VBA_PROJECT_CUR addin 25983!:ext xla/ 25984# 4th directory entry name 25985>>>>384 lestring16 _VBA_PROJECT_CUR addin 25986!:ext xla 25987#!:ext xla/ 25988>>>>256 default x worksheet or template 25989!:ext xls/xlt 25990#!:ext xls/xlt/ 25991# 25992# URL: http://fileformats.archiveteam.org/wiki/OLE2 25993>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 25994#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 25995#!:mime application/vnd.ms-outlook 25996!:mime application/x-ms-msg 25997!:ext msg 25998# URL: https://wiki.fileformat.com/email/oft/ 25999>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 26000#!:mime application/vnd.ms-outlook 26001!:mime application/x-ms-oft 26002!:ext oft 26003# 26004# URL: http://fileformats.archiveteam.org/wiki/PPT 26005>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 26006!:mime application/vnd.ms-powerpoint 26007# https://www.macdisk.com/macsigen.php 26008!:apple ????PPT3 26009!:ext ppt 26010#?? 26011# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 26012>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 26013# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 26014>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 26015!:mime application/vnd.ms-works 26016!:apple ????AWWP 26017!:ext wps 26018# 26019# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 26020>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 26021!:mime application/vnd.ms-works-db 26022!:apple ????AWDB 26023!:ext wdb/bdb 26024#?? 26025>>88 ubequad 0xa40700c04fb932ba : Microsoft 26026# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 26027>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 26028!:mime application/vnd.ms-works 26029!:apple ????AWWP 26030!:ext wps 26031#?? 26032# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 26033>>88 ubequad 0x00c0000000000046 : Microsoft 26034>>>80 ubequad 0x0112020000000000 Publisher 26035!:mime application/vnd.ms-publisher 26036!:ext pub 26037# 26038# URL: http://fileformats.archiveteam.org/wiki/PPT 26039#?? 26040>>88 ubequad 0xa90300aa00510ea3 : Microsoft 26041>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 26042!:mime application/vnd.ms-powerpoint 26043# https://www.macdisk.com/macsigen.php 26044!:apple ????PPT3 26045!:ext ppt/pot 26046#?? 26047>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 26048>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 26049!:mime application/vnd.ms-powerpoint 26050!:apple ????PPT3 26051# /autostart/template 26052!:ext ppt/pps/pot 26053# 26054# URL: https://en.wikipedia.org/wiki/Microsoft_Project 26055#?? 26056>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 26057>>>80 ubequad 0x3a8fb774c8c8d111 Project 26058!:mime application/vnd.ms-project 26059!:ext mpp 26060# 26061# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 26062#??? 26063>>88 ubequad 0x99ae04021c007002 : WordPerfect 26064>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 26065!:mime application/x-corelpresentations 26066#!:mime application/x-shw-viewer 26067#!:mime image/x-presentations 26068!:ext shw 26069# 26070# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 26071>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 26072#!:mime application/x-wpg 26073#!:mime image/x-wordperfect-graphics 26074!:mime image/x-wpg 26075# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 26076!:apple ????WPC9 26077!:ext wpg 26078# 26079# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 26080>>88 ubequad 0x996104021c007002 : StarOffice 26081>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 26082# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 26083!:mime application/x-starwriter 26084!:ext sdw/vor 26085# 26086>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 26087!:mime application/x-starcalc 26088!:ext sdc/vor 26089# 26090>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 26091!:mime application/x-starimpress 26092#!:mime application/x-stardraw 26093# sda ?? 26094!:ext sdd/sda/vor 26095#?? 26096>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 26097>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 26098!:mime application/x-starcalc 26099!:ext sdc/vor 26100# 26101>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 26102!:mime application/vnd.stardivision.cal 26103!:ext sdc/vor 26104# 26105>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 26106!:mime application/x-starimpress 26107!:ext sdd/vor 26108#?? 26109>>88 ubequad 0xb12a04021c007002 : StarOffice 26110>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 26111!:mime application/x-starmath 26112!:ext smf 26113#?? 26114>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 26115>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 26116!:mime application/x-starchart 26117!:ext sds 26118#?? 26119>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 26120>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 26121!:mime application/x-starwriter 26122!:ext sdw/vor 26123#?? 26124>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 26125>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 26126!:mime application/x-starmath 26127!:ext smf 26128# 26129>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 26130!:mime application/x-starchart 26131!:ext sds 26132#?? 26133>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 26134>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 26135!:mime application/x-starwriter-global 26136!:ext sgl 26137#?? 26138>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 26139>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 26140!:mime application/vnd.stardivision.math 26141!:ext smf 26142# 26143>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 26144!:mime application/vnd.stardivision.draw 26145!:ext sda/vor 26146# 26147>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 26148!:mime application/vnd.stardivision.impress 26149# sda is used for what? 26150!:ext sdd/vor/sda 26151# 26152>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 26153!:mime application/vnd.stardivision.chart 26154!:ext sds 26155# ?? 26156>>88 ubequad 0xaab4006097da561a : StarOffice 26157>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 26158!:mime application/vnd.stardivision.writer 26159!:ext sdw/vor 26160# 26161>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 26162!:mime application/vnd.stardivision.writer-global 26163!:ext sgl 26164#?? 26165# URL: http://fileformats.archiveteam.org/wiki/FlashPix 26166>>88 ubequad 0x855300aa00a1f95b : Kodak 26167>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 26168!:mime image/vnd.fpx 26169!:apple ????FPix 26170!:ext fpx 26171# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 26172>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 26173>>>80 ubequad 0x9174088a6452d411 document or template 26174!:mime application/vnd.softmaker.planmaker 26175# pmv for template https://www.file-extensions.org/pmv-file-extension 26176!:ext pmd/pmv 26177# remaining non null clsid 26178>>88 default x : UNKNOWN 26179!:mime application/x-ole-storage 26180>>>80 ubequad !0 \b, clsid 0x%16.16llx 26181>>>88 ubequad x \b%16.16llx 26182 26183 26184#------------------------------------------------------------------------------ 26185# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 26186# olf: file(1) magic for OLF executables 26187# 26188# We have to check the byte order flag to see what byte order all the 26189# other stuff in the header is in. 26190# 26191# MIPS R3000 may also be for MIPS R2000. 26192# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 26193# 26194# Created by Erik Theisen <etheisen@openbsd.org> 26195# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 261960 string \177OLF OLF 26197>4 byte 0 invalid class 26198>4 byte 1 32-bit 26199>4 byte 2 64-bit 26200>7 byte 0 invalid os 26201>7 byte 1 OpenBSD 26202>7 byte 2 NetBSD 26203>7 byte 3 FreeBSD 26204>7 byte 4 4.4BSD 26205>7 byte 5 Linux 26206>7 byte 6 SVR4 26207>7 byte 7 esix 26208>7 byte 8 Solaris 26209>7 byte 9 Irix 26210>7 byte 10 SCO 26211>7 byte 11 Dell 26212>7 byte 12 NCR 26213>5 byte 0 invalid byte order 26214>5 byte 1 LSB 26215>>16 leshort 0 no file type, 26216>>16 leshort 1 relocatable, 26217>>16 leshort 2 executable, 26218>>16 leshort 3 shared object, 26219# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 26220# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 26221>>16 leshort 4 core file 26222>>>(0x38+0xcc) string >\0 of '%s' 26223>>>(0x38+0x10) lelong >0 (signal %d), 26224>>16 leshort &0xff00 processor-specific, 26225>>18 leshort 0 no machine, 26226>>18 leshort 1 AT&T WE32100 - invalid byte order, 26227>>18 leshort 2 SPARC - invalid byte order, 26228>>18 leshort 3 Intel 80386, 26229>>18 leshort 4 Motorola 68000 - invalid byte order, 26230>>18 leshort 5 Motorola 88000 - invalid byte order, 26231>>18 leshort 6 Intel 80486, 26232>>18 leshort 7 Intel 80860, 26233>>18 leshort 8 MIPS R3000_BE - invalid byte order, 26234>>18 leshort 9 Amdahl - invalid byte order, 26235>>18 leshort 10 MIPS R3000_LE, 26236>>18 leshort 11 RS6000 - invalid byte order, 26237>>18 leshort 15 PA-RISC - invalid byte order, 26238>>18 leshort 16 nCUBE, 26239>>18 leshort 17 VPP500, 26240>>18 leshort 18 SPARC32PLUS, 26241>>18 leshort 20 PowerPC, 26242>>18 leshort 0x9026 Alpha, 26243>>20 lelong 0 invalid version 26244>>20 lelong 1 version 1 26245>>36 lelong 1 MathCoPro/FPU/MAU Required 26246>8 string >\0 (%s) 26247>5 byte 2 MSB 26248>>16 beshort 0 no file type, 26249>>16 beshort 1 relocatable, 26250>>16 beshort 2 executable, 26251>>16 beshort 3 shared object, 26252>>16 beshort 4 core file, 26253>>>(0x38+0xcc) string >\0 of '%s' 26254>>>(0x38+0x10) belong >0 (signal %d), 26255>>16 beshort &0xff00 processor-specific, 26256>>18 beshort 0 no machine, 26257>>18 beshort 1 AT&T WE32100, 26258>>18 beshort 2 SPARC, 26259>>18 beshort 3 Intel 80386 - invalid byte order, 26260>>18 beshort 4 Motorola 68000, 26261>>18 beshort 5 Motorola 88000, 26262>>18 beshort 6 Intel 80486 - invalid byte order, 26263>>18 beshort 7 Intel 80860, 26264>>18 beshort 8 MIPS R3000_BE, 26265>>18 beshort 9 Amdahl, 26266>>18 beshort 10 MIPS R3000_LE - invalid byte order, 26267>>18 beshort 11 RS6000, 26268>>18 beshort 15 PA-RISC, 26269>>18 beshort 16 nCUBE, 26270>>18 beshort 17 VPP500, 26271>>18 beshort 18 SPARC32PLUS, 26272>>18 beshort 20 PowerPC or cisco 4500, 26273>>18 beshort 21 cisco 7500, 26274>>18 beshort 24 cisco SVIP, 26275>>18 beshort 25 cisco 7200, 26276>>18 beshort 36 cisco 12000, 26277>>18 beshort 0x9026 Alpha, 26278>>20 belong 0 invalid version 26279>>20 belong 1 version 1 26280>>36 belong 1 MathCoPro/FPU/MAU Required 26281 26282#------------------------------------------------------------------------------ 26283# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $ 26284# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library) 26285 262860 long 0x7eb2fdd6 OpenFst binary FST data 26287>&0 pstring/l x \b, fst type: %s 26288>>&0 pstring/l x \b, arc type: %s 26289>>>&0 long x \b, version: %d 26290>>>>&20 quad x \b, num states: %lld 26291>>>>>&0 quad >0 \b, num arcs: %lld 26292 262930 long 0x56515c OpenFst binary FAR data, far type: stlist 26294>4 long x \b, version: %d 26295 262960 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable 26297>4 long x \b, version: %d 26298 26299#------------------------------------------------------------ 26300# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $ 26301# OpenTimestamps related magic entries 26302# https://opentimestamps.org/ 26303# https://en.wikipedia.org/wiki/OpenTimestamps 26304# "Emanuele Cisbani" <emanuele.cisbani@gmail.com> 26305#------------------------------------------------------------ 26306 26307# OpenTimestamps Proof .ots format. 26308# Magic is defined here: 26309# https://github.com/opentimestamps/python-opentimestamps/\ 26310# blob/master/opentimestamps/core/timestamp.py#L273 26311 263120 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps 26313>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof 26314 26315#------------------------------------------------------------------------------ 26316# $File: os2,v 1.11 2020/08/30 16:22:20 christos Exp $ 26317# os2: file(1) magic for OS/2 files 26318# 26319 26320# Provided 1998/08/22 by 26321# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 263221 search/100 InternetShortcut MS Windows 95 Internet shortcut text 26323>17 search/100 URL= (URL=< 26324>>&0 string x \b%s>) 26325 26326# OS/2 URL objects 26327# Provided 1998/08/22 by 26328# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 26329#0 string http: OS/2 URL object text 26330#>5 string >\ (WWW) <http:%s> 26331#0 string mailto: OS/2 URL object text 26332#>7 string >\ (email) <%s> 26333#0 string news: OS/2 URL object text 26334#>5 string >\ (Usenet) <%s> 26335#0 string ftp: OS/2 URL object text 26336#>4 string >\ (FTP) <ftp:%s> 26337#0 string file: OS/2 URL object text 26338#>5 string >\ (Local file) <%s> 26339 26340# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 26341# URL: http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2) 26342# Reference: http://www.edm2.com/0308/inf.html 26343# Carl Hauser (chauser.parc@xerox.com) and 26344# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 26345# list the following header format in inf02a.doc: 26346# 26347# int16 ID; // ID magic word (5348h = "HS") 26348# int8 unknown1; // unknown purpose, could be third letter of ID 26349# int8 flags; // probably a flag word... 26350# // bit 0: set if INF style file 26351# // bit 4: set if HLP style file 26352# // patching this byte allows reading HLP files 26353# // using the VIEW command, while help files 26354# // seem to work with INF settings here as well. 26355# int16 hdrsize; // total size of header 26356# int16 unknown2; // unknown purpose 26357# 263580 string HSP\x01\x9b\x00 OS/2 INF 26359!:mime application/x-os2-inf 26360!:ext inf 26361>107 string >0 (%s) 263620 string HSP\x10\x9b\x00 OS/2 HLP 26363!:mime application/x-os2-hlp 26364!:ext hlp 26365>107 string >0 (%s) 26366 26367# From: Joerg Jenderek 26368# URL: http://fileformats.archiveteam.org/wiki/MSG_(OS/2) 26369# Reference: https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h 26370# Note: created by MKMSGF.EXE. Text source can be recreated by E_MSGF 26371# example like OS001H.MSG 263720 string \xffMKMSGF\0 OS/2 help message 26373!:mime application/x-os2-msg 26374!:ext msg 26375# identifier[3] like: DOS NET REX SYS ... 26376>8 string x '%.3s' 26377# msgnumber: number of messages 26378>11 uleshort x \b, %u messages 26379# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502 26380>13 uleshort >1 \b, 1st number %u 26381# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets 26382>15 ubyte =0 \b, 32-bit 26383#>15 ubyte =1 \b, 16-bit 26384# version; file version: 2~new 0~old 26385>16 uleshort !2 \b, version %u 26386# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0? 26387>18 uleshort >0 26388>>18 uleshort !0x1f \b, at 0x%x index 26389# 32-bit offset 26390>>15 ubyte =0 26391# offset with message table 26392>>>(18.s) ulelong x \b, at 0x%x 26393# 1st message 26394# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf 26395# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 26396>>>>(&-4.l) ubyte x %c-type 26397>>>>>&0 string x %s 26398# 16-bit offset 26399>>15 ubyte =1 26400# msgnum; message number 26401>>>(18.s) uleshort x \b, number %u 26402# msgindex; offset of message from begin of file 26403>>>(18.s+2) uleshort x at 0x%x 26404# message type E H I P W ? 26405>>>>(&-2.s) ubyte x %c-type 26406# skip newline carriage return 26407>>>>>&0 ubeshort =0x0D0a 26408>>>>>>&0 string x %s 26409>>>>>&0 ubeshort !0x0D0a 26410>>>>>>&-2 string x %s 26411# for version 0 index table apparently at offset 1F 26412>16 uleshort 0 26413>>15 ubyte 1 26414# 1st message 16-bit 26415>>>0x1F uleshort x \b, at 0x%x 26416# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 26417>>>>(0x1F.s) ubyte x %c-type 26418>>>>>&0 string x %s 26419# 2nd message 16-bit 26420>>>0x21 uleshort x \b, at 0x%x 26421>>>>(0x21.s) ubyte x %c-type 26422>>>>>&0 string x %s 26423# 3rd message 16-bit 26424>>>0x23 uleshort x \b, at 0x%x 26425>>>>(0x23.s) ubyte x %c-type 26426>>>>>&0 string x %s 26427# version 0 32-bit 26428>>15 ubyte 0 26429# 1st message 32-bit 26430>>>0x1f ulelong x \b, at 0x%x 26431>>>>(0x1F.l) ubyte x %c-type 26432>>>>>&0 string x %s 26433# 2nd message 32-bit 26434>>>0x23 ulelong x \b, at 0x%x 26435>>>>(0x23.l) ubyte x %c-type 26436>>>>>&0 string x %s 26437# 3rd message 32-bit 26438>>>0x27 ulelong x \b, AT 0x%x 26439>>>>(0x27.l) ubyte x %c-type 26440>>>>>&0 string x %s 26441# countryinfo; offset of country info block: 0 for version 0 26442>20 uleshort !0 \b, at 0x%x countryinfo 26443# nextcoutryinfo 26444>>22 uleshort >0 \b, at 0x%x next 26445# reserved[5]; Must be 0 26446>>25 ulelong !0 \b, RESERVED 0x%x 26447>>(20.s) use os2-msg-info 26448# display country info block of MKMSGF message file 264490 name os2-msg-info 26450# bytesperchar; bytes per char: 1~SBCS 2~DBCS 26451>0 ubyte >1 \b, %u bytes/char 26452# reserved; Not known 26453>1 uleshort !0 \b, reserved 0x%x 26454# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English ... 34~Slovene 26455>3 uleshort >0 \b, language %u 26456# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French 26457>>5 uleshort x \b_%u 26458# langfamilyID too high. This should not happen 26459>3 uleshort >34 (invalid language) 26460# codepagesnumber; number of codepages like: 1 2 ... 16 26461>7 uleshort x \b, %u code page 26462# plural s 26463>7 uleshort >1 \bs 26464# too many number of codepages. This should not happen 26465>7 uleshort >16 (Too many) 26466# codepages[16]; codepages list like 437 850 ... 26467>7 uleshort <17 26468# 1st code page 26469>>9 uleshort >0 %u 26470# possible 2nd code page number 26471>>>7 uleshort >1 26472>>>>11 uleshort x %u 26473# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ... 26474>41 string x \b, %s 26475 26476# OS/2 INI (this is a guess) 264770 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 26478!:mime application/x-os2-ini 26479!:ext ini 26480 26481 26482#------------------------------------------------------------------------------ 26483# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 26484# os400: file(1) magic for IBM OS/400 files 26485# 26486# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 26487# In spite of its quite variable format (due to internal memory page 26488# length differences between CISC and RISC versions of the OS) the 26489# SAVF structure hasn't suitable offsets to identify the catalog 26490# header in the first descriptor where there are some useful infos, 26491# so we must search in a somewhat large area for a particular string 26492# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 26493# descriptor space) preceded by a two byte constant. 26494# 264951090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 26496>&212 byte 0x01 \b, created with SAVOBJ 26497>&212 byte 0x02 \b, created with SAVLIB 26498>&212 byte 0x07 \b, created with SAVCFG 26499>&212 byte 0x08 \b, created with SAVSECDTA 26500>&212 byte 0x0A \b, created with SAVSECDTA 26501>&212 byte 0x0B \b, created with SAVDLO 26502>&212 byte 0x0D \b, created with SAVLICPGM 26503>&212 byte 0x11 \b, created with SAVCHGOBJ 26504>&213 byte 0x44 \b, at least V5R4 to open 26505>&213 byte 0x43 \b, at least V5R3 to open 26506>&213 byte 0x42 \b, at least V5R2 to open 26507>&213 byte 0x41 \b, at least V5R1 to open 26508>&213 byte 0x40 \b, at least V4R5 to open 26509>&213 byte 0x3F \b, at least V4R4 to open 26510>&213 byte 0x3E \b, at least V4R3 to open 26511>&213 byte 0x3C \b, at least V4R2 to open 26512>&213 byte 0x3D \b, at least V4R1M4 to open 26513>&213 byte 0x3B \b, at least V4R1 to open 26514>&213 byte 0x3A \b, at least V3R7 to open 26515>&213 byte 0x35 \b, at least V3R6 to open 26516>&213 byte 0x36 \b, at least V3R2 to open 26517>&213 byte 0x34 \b, at least V3R1 to open 26518>&213 byte 0x31 \b, at least V3R0M5 to open 26519>&213 byte 0x30 \b, at least V2R3 to open 26520 26521#------------------------------------------------------------------------------ 26522# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 26523# 26524# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 26525# 26526# Redistribution and use in source and binary forms, with or without 26527# modification, are permitted provided that the following conditions 26528# are met: 26529# 1. Redistributions of source code must retain the above copyright 26530# notice, this list of conditions and the following disclaimer. 26531# 2. Redistributions in binary form must reproduce the above copyright 26532# notice, this list of conditions and the following disclaimer in the 26533# documentation and/or other materials provided with the distribution. 26534# 26535# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26536# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 26537# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26538# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 26539# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 26540# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 26541# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 26542# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 26543# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 26544# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26545# 26546# 26547# 26548# OS9/6809 module descriptions: 26549# 265500 beshort 0x87CD OS9/6809 module: 26551# 26552>6 byte&0x0f 0x00 non-executable 26553>6 byte&0x0f 0x01 machine language 26554>6 byte&0x0f 0x02 BASIC I-code 26555>6 byte&0x0f 0x03 Pascal P-code 26556>6 byte&0x0f 0x04 C I-code 26557>6 byte&0x0f 0x05 COBOL I-code 26558>6 byte&0x0f 0x06 Fortran I-code 26559# 26560>6 byte&0xf0 0x10 program executable 26561>6 byte&0xf0 0x20 subroutine 26562>6 byte&0xf0 0x30 multi-module 26563>6 byte&0xf0 0x40 data module 26564# 26565>6 byte&0xf0 0xC0 system module 26566>6 byte&0xf0 0xD0 file manager 26567>6 byte&0xf0 0xE0 device driver 26568>6 byte&0xf0 0xF0 device descriptor 26569# 26570# OS9/m68k stuff (to be continued) 26571# 265720 beshort 0x4AFC OS9/68K module: 26573# 26574# attr 26575>0x14 byte&0x80 0x80 re-entrant 26576>0x14 byte&0x40 0x40 ghost 26577>0x14 byte&0x20 0x20 system-state 26578# 26579# lang: 26580# 26581>0x13 byte 1 machine language 26582>0x13 byte 2 BASIC I-code 26583>0x13 byte 3 Pascal P-code 26584>0x13 byte 4 C I-code 26585>0x13 byte 5 COBOL I-code 26586>0x13 byte 6 Fortran I-code 26587# 26588# 26589# type: 26590# 26591>0x12 byte 1 program executable 26592>0x12 byte 2 subroutine 26593>0x12 byte 3 multi-module 26594>0x12 byte 4 data module 26595>0x12 byte 11 trap library 26596>0x12 byte 12 system module 26597>0x12 byte 13 file manager 26598>0x12 byte 14 device driver 26599>0x12 byte 15 device descriptor 26600 26601#------------------------------------------------------------------------------ 26602# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 26603# 26604# Mach magic number info 26605# 266060 long 0xefbe OSF/Rose object 26607# I386 magic number info 26608# 266090 short 0565 i386 COFF object 26610 26611#------------------------------------------------------------------------------ 26612# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $ 26613# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 26614# 26615# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 26616 26617# These are weak, byte 59 is not guaranteed to be 0 and there are 26618# 8 character identifiers at byte 60, one I found for appl is BIGb. 26619# What are the possibilities and where is this documented? 26620 26621# The common header format for PalmOS .pdb/.prc files is 26622# { 26623# char name[ 32 ]; 26624# Word attributes; 26625# Word version; 26626# DWord creationDate; 26627# DWord modificationDate; 26628# DWord lastBackupDate; 26629# DWord modificationNumber; 26630# DWord appInfoID; 26631# DWord sortInfoID; 26632# char type[4]; 26633# char creator[4]; 26634# DWord uniqueIDSeed; 26635# RecordListType recordList; 26636# }; 26637# 26638# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 26639# or Unix/POSIX time + 2082844800. 26640 266410 name aportisdoc 26642# date is supposed to be big-endian seconds since 1 Jan 1904, but many 26643# files contain the timestamp in little-endian or a completely 26644# nonsensical value... 26645#>36 bedate-2082844800 >0 \b, created %s 26646# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 26647>(78.L) beshort =1 \b, uncompressed 26648# compressed 26649>(78.L) beshort >1 26650>>(78.L+4) belong x \b, %d bytes uncompressed 26651 26652# appl 26653#60 string appl PalmOS application 26654#>0 string >\0 "%s" 26655 26656# HACK 26657#60 string HACK HackMaster hack 26658#>0 string >\0 "%s" 26659 26660# iSiloX e-book 2666160 string SDocSilX iSiloX E-book 26662>0 string >\0 "%s" 26663 26664# Mobipocket (www.mobipocket.com), donated by Carl Witty 26665# expanded by Ralf Brown 2666660 string BOOKMOBI Mobipocket E-book 26667# MobiPocket stores a full title, pointed at by the belong at offset 26668# 0x54 in its header at (78.L), with length given by the belong at 26669# offset 0x58. 26670# there's no guarantee that the title string is null-terminated, but 26671# we currently can't specify a variable-length string where the length 26672# field is not at the start of the string; in practice, the data 26673# following the string always seems to start with a zero byte 26674>(78.L) belong x 26675>>&(&0x50.L-4) string >\0 "%s" 26676>0 use aportisdoc 26677>>(78.L+0x68) belong >0 \b, version %d 26678>>(78.L+0x1C) belong !0 \b, codepage %d 26679>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 26680 26681# AportisDoc/PalmDOC 2668260 string TEXtREAd AportisDoc/PalmDOC E-book 26683>0 string >\0 "%s" 26684>0 use aportisdoc 26685 26686# Variety of PalmOS document types 26687# Michael-John Turner <mj@debian.org> 26688# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 2668960 string BVokBDIC BDicty PalmOS document 26690>0 string >\0 "%s" 2669160 string DB99DBOS DB PalmOS document 26692>0 string >\0 "%s" 2669360 string vIMGView FireViewer/ImageViewer PalmOS document 26694>0 string >\0 "%s" 2669560 string PmDBPmDB HanDBase PalmOS document 26696>0 string >\0 "%s" 2669760 string InfoINDB InfoView PalmOS document 26698>0 string >\0 "%s" 2669960 string ToGoToGo iSilo PalmOS document 26700>0 string >\0 "%s" 2670160 string JfDbJBas JFile PalmOS document 26702>0 string >\0 "%s" 2670360 string JfDbJFil JFile Pro PalmOS document 26704>0 string >\0 "%s" 2670560 string DATALSdb List PalmOS document 26706>0 string >\0 "%s" 2670760 string Mdb1Mdb1 MobileDB PalmOS document 26708>0 string >\0 "%s" 2670960 string PNRdPPrs PeanutPress PalmOS document 26710>0 string >\0 "%s" 2671160 string DataPlkr Plucker PalmOS document 26712>0 string >\0 "%s" 2671360 string DataSprd QuickSheet PalmOS document 26714>0 string >\0 "%s" 2671560 string SM01SMem SuperMemo PalmOS document 26716>0 string >\0 "%s" 2671760 string TEXtTlDc TealDoc PalmOS document 26718>0 string >\0 "%s" 2671960 string InfoTlIf TealInfo PalmOS document 26720>0 string >\0 "%s" 2672160 string DataTlMl TealMeal PalmOS document 26722>0 string >\0 "%s" 2672360 string DataTlPt TealPaint PalmOS document 26724>0 string >\0 "%s" 2672560 string dataTDBP ThinkDB PalmOS document 26726>0 string >\0 "%s" 2672760 string TdatTide Tides PalmOS document 26728>0 string >\0 "%s" 2672960 string ToRaTRPW TomeRaider PalmOS document 26730>0 string >\0 "%s" 26731 26732# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 26733# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 26734# annotations. 26735# For other versions, just outputs version. 26736# 2673760 string zTXT A GutenPalm zTXT e-book 26738>0 string >\0 "%s" 26739>(0x4E.L) byte 0 26740>>(0x4E.L+1) byte x (v0.%02d) 26741>(0x4E.L) byte 1 26742>>(0x4E.L+1) byte x (v1.%02d) 26743>>>(0x4E.L+10) beshort >0 26744>>>>(0x4E.L+10) beshort <2 - 1 bookmark 26745>>>>(0x4E.L+10) beshort >1 - %d bookmarks 26746>>>(0x4E.L+14) beshort >0 26747>>>>(0x4E.L+14) beshort <2 - 1 annotation 26748>>>>(0x4E.L+14) beshort >1 - %d annotations 26749>(0x4E.L) byte >1 (v%d. 26750>>(0x4E.L+1) byte x %02d) 26751 26752# Palm OS .prc file types 2675360 string libr 26754# flags, only bit 0 or bit 6 26755# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 26756# https://web.mit.edu/tytso/www/pilot/prc-format.html 26757>0x20 beshort&0xffbe 0 26758>>0 string >\0 Palm OS dynamic library data "%s" 2675960 string ptch Palm OS operating system patch data 26760>0 string >\0 "%s" 26761 26762# Mobipocket (www.mobipocket.com), donated by Carl Witty 2676360 string BOOKMOBI Mobipocket E-book 26764>0 string >\0 "%s" 26765 26766#------------------------------------------------------------------------------ 26767# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $ 26768# 26769# Parix COFF executables 26770# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 26771# 267720 beshort&0xefff 0x8ACE PARIX 26773>0 byte&0xf0 0x80 T800 26774>0 byte&0xf0 0x90 T9000 26775>19 byte&0x02 0x02 executable 26776>19 byte&0x02 0x00 object 26777>19 byte&0x0c 0x00 not stripped 26778#------------------------------------------------------------------------------ 26779# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $ 26780# parrot: file(1) magic for Parrot Virtual Machine 26781# URL: https://www.lua.org/ 26782# From: Lubomir Rintel <lkundrak@v3.sk> 26783 26784# Compiled Parrot byte code 267850 string \376PBC\r\n\032\n Parrot bytecode 26786>64 byte x %d. 26787>72 byte x \b%d, 26788>8 byte >0 %d byte words, 26789>16 byte 0 little-endian, 26790>16 byte 1 big-endian, 26791>32 byte 0 IEEE-754 8 byte double floats, 26792>32 byte 1 x86 12 byte long double floats, 26793>32 byte 2 IEEE-754 16 byte long double floats, 26794>32 byte 3 MIPS 16 byte long double floats, 26795>32 byte 4 AIX 16 byte long double floats, 26796>32 byte 5 4-byte floats, 26797>40 byte x Parrot %d. 26798>48 byte x \b%d. 26799>56 byte x \b%d 26800#------------------------------------------------------------------------------ 26801# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $ 26802# pascal: file(1) magic for Pascal source 26803# 268040 search/8192 (input, Pascal source text 26805!:mime text/x-pascal 26806#0 regex \^program Pascal source text 26807#!:mime text/x-pascal 26808#0 regex \^record Pascal source text 26809#!:mime text/x-pascal 26810 26811# Free Pascal 268120 string PPU Pascal unit 26813>3 string x \b, version %s 26814 26815#------------------------------------------------------------------------------ 26816# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $ 26817# file(1) magic(5) data for OpenStreetMap 26818 26819# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 26820# https://wiki.openstreetmap.org/wiki/PBF_Format 26821# From: Markus Heidelberg <markus.heidelberg@web.de> 268220 belong&0xfffffff0 0 26823>4 beshort 0x0A09 26824>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 26825 26826#------------------------------------------------------------------------------ 26827# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 26828# pbm: file(1) magic for Portable Bitmap files 26829# 26830# XXX - byte order? 26831# 268320 short 0x2a17 "compact bitmap" format (Poskanzer) 26833#------------------------------------------------------------------------------ 26834# pc88: file(1) magic for the NEC Home Computer 26835# v1.0 26836# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 26837 26838# PC88 2D disk image 268390x20 ulelong&0xFFFFFEFF 0x2A0 26840>0x10 string \0\0\0\0\0\0\0\0\0\0 26841>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 26842>>>0x1A ubyte&0xEF 0 26843>>>>0x1B ubyte&0x8F 0 26844>>>>>0x1B ubyte&70 <0x40 26845>>>>>>0x1C ulelong >0x21 26846>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 26847>>>>>>>>0x1B ubyte 0 \b, media=2D 26848>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 26849>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 26850>>>>>>>>0x1B ubyte 0x30 \b, media=1D 26851>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 26852>>>>>>>>0x1A ubyte 0x10 \b, write-protected 26853 26854 26855 26856 26857#------------------------------------------------------------------------------ 26858# pc98: file(1) magic for the MSX Home Computer 26859# v1.0 26860# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 26861 26862# Maki-chan v1 Graphic format 26863# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 26864# http://www.jisyo.com/viewer/faq/maki_tech.htm 268650 string/b MAKI01 Maki-chan v1. 26866>6 ubyte|0x20 x \b%c image 26867>8 ubelong >0x40404040 \b, system ID: 26868>>8 byte x %c 26869>>9 byte x \b%c 26870>>10 byte x \b%c 26871>>11 byte x \b%c 26872>44 ubeshort x \b, %dx 26873>46 ubeshort x \b%d 26874>38 ubeshort&2 0 \b, 16 paletted RGB colors 26875>38 ubeshort&2 2 \b, 8 fixed RGB colors 26876>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 26877 26878# Maki-chan v2 Graphic format 26879# http://www.jisyo.com/viewer/faq/mag_tech.htm 26880# https://mooncore.eu/bunny/txt/makichan.htm 26881# http://metanest.jp/mag/mag.xhtml 268820 string/b MAKI02\ \ Maki-chan v2 image, 26883>8 byte x system ID: %c 26884>9 byte x \b%c 26885>10 byte x \b%c 26886>11 byte x \b%c, 26887>13 search/0x200 \x1A 26888#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 26889#1) When offset1(ubeshort) !=0x0344: 26890# 1.1) And offset3(ubyte).b7=0: 26891# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 26892# - b1=number of colors: 0=16 colors, 1=8 colors 26893# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 26894# 1.2) And offset3(ubyte).B7=1: 26895# - b0=256 paletted colors 26896# - b1=256 fixed colors using the MSX SCR8 palette 26897#2) When offset1(ubeshort) =0x0344: 26898# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 26899>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 26900>>&1 ubeshort !0x0344 26901>>>&5 uleshort+1 x %dx 26902>>>&7 uleshort+1 x \b%d, 26903>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 26904>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 26905>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 26906>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 26907>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 26908>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 26909>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 26910 26911# XLD4 (Q4) picture 2691211 string/b MAJYO XLD4(Q4) picture 26913 26914# Yanagisawa Pi picture 26915#0 string Pi\x1A\0 Yanagisawa Pi picture 26916#>3 search/0x200 \x04 269170 string Pi 26918>2 search/0x200 \x1A 26919>>&0 ubyte 0 26920>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 26921>>>&4 byte x system ID: %c 26922>>>&5 byte x \b%c 26923>>>&6 byte x \b%c 26924>>>&7 byte x \b%c, 26925>>>&10 ubeshort x %dx 26926>>>&12 ubeshort x \b%d 26927>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 26928>>>&4 byte x system ID: %c 26929>>>&5 byte x \b%c 26930>>>&6 byte x \b%c 26931>>>&7 byte x \b%c, 26932>>>&10 ubeshort x %dx 26933>>>&12 ubeshort x \b%d 26934 26935#------------------------------------------------------------------------------ 26936# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $ 26937# pcjr: file(1) magic for PCjr Cartridge image file format 26938# From: Francis Laniel <laniel_francis@privacyrequired.com> 269390 string PCjr 26940>0x80 beshort 0x55aa PCjr Cartridge image 26941>0x200 beshort 0x55aa PCjr Cartridge image 26942 26943#------------------------------------------------------------------------------ 26944# $File: pdf,v 1.15 2020/08/23 00:30:45 christos Exp $ 26945# pdf: file(1) magic for Portable Document Format 26946# 26947 269480 name pdf 26949>8 search /Count 26950>>&0 regex [0-9]+ \b, %s pages 26951>8 search/512 /Filter/FlateDecode/ (password protected) 26952 269530 string %PDF- PDF document 26954!:mime application/pdf 26955!:strength +60 26956!:ext pdf 26957>5 byte x \b, version %c 26958>7 byte x \b.%c 26959>0 use pdf 26960 269610 string \012%PDF- PDF document 26962!:mime application/pdf 26963!:strength +60 26964!:ext pdf 26965>6 byte x \b, version %c 26966>8 byte x \b.%c 26967>0 use pdf 26968 269690 string \xef\xbb\xbf%PDF- PDF document (UTF-8) 26970!:mime application/pdf 26971!:strength +60 26972!:ext pdf 26973>6 byte x \b, version %c 26974>8 byte x \b.%c 26975>0 use pdf 26976 26977# From: Nick Schmalenberger <nick@schmalenberger.us> 26978# Forms Data Format 269790 string %FDF- FDF document 26980!:mime application/vnd.fdf 26981!:strength +60 26982!:ext pdf 26983>5 byte x \b, version %c 26984>7 byte x \b.%c 26985 269860 search/256 %PDF- PDF document 26987!:mime application/pdf 26988!:strength +60 26989!:ext pdf 26990>&0 byte x \b, version %c 26991>&2 byte x \b.%c 26992>0 use pdf 26993 26994#------------------------------------------------------------------------------ 26995# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 26996# pdp: file(1) magic for PDP-11 executable/object and APL workspace 26997# 269980 lelong 0101555 PDP-11 single precision APL workspace 269990 lelong 0101554 PDP-11 double precision APL workspace 27000# 27001# PDP-11 a.out 27002# 270030 leshort 0407 PDP-11 executable 27004>8 leshort >0 not stripped 27005>15 byte >0 - version %d 27006 27007# updated by Joerg Jenderek at Mar 2013 27008# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 270090 leshort 0401 27010# skip *.PNF with WinDirPathOffset 58h 27011>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 27012# skip *.PNF with high byte of InfVersionDatumCount zero 27013#>>15 byte !0 PDP-11 UNIX/RT ldp 270140 leshort 0405 PDP-11 old overlay 27015 270160 leshort 0410 PDP-11 pure executable 27017>8 leshort >0 not stripped 27018>15 byte >0 - version %d 27019 270200 leshort 0411 PDP-11 separate I&D executable 27021>8 leshort >0 not stripped 27022>15 byte >0 - version %d 27023 270240 leshort 0437 PDP-11 kernel overlay 27025 27026# These last three are derived from 2.11BSD file(1) 270270 leshort 0413 PDP-11 demand-paged pure executable 27028>8 leshort >0 not stripped 27029 270300 leshort 0430 PDP-11 overlaid pure executable 27031>8 leshort >0 not stripped 27032 270330 leshort 0431 PDP-11 overlaid separate executable 27034>8 leshort >0 not stripped 27035#------------------------------------------------------------------------------ 27036# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 27037# perl: file(1) magic for Larry Wall's perl language. 27038# 27039# The `eval' lines recognizes an outrageously clever hack. 27040# Keith Waclena <keith@cerberus.uchicago.edu> 27041# Send additions to <perl5-porters@perl.org> 270420 search/1024 eval\ "exec\ perl Perl script text 27043!:mime text/x-perl 270440 search/1024 eval\ "exec\ /bin/perl Perl script text 27045!:mime text/x-perl 270460 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 27047!:mime text/x-perl 270480 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 27049!:mime text/x-perl 270500 search/1024 eval\ 'exec\ perl Perl script text 27051!:mime text/x-perl 270520 search/1024 eval\ 'exec\ /bin/perl Perl script text 27053!:mime text/x-perl 270540 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 27055!:mime text/x-perl 270560 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 27057!:mime text/x-perl 270580 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 27059!:mime text/x-perl 270600 string #!/usr/bin/env\ perl Perl script text executable 27061!:mime text/x-perl 270620 string #!\ /usr/bin/env\ perl Perl script text executable 27063!:mime text/x-perl 270640 string #! 27065>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 27066!:mime text/x-perl 27067 27068# by Dmitry V. Levin and Alexey Tourbin 27069# check the first line 270700 search/8192 package 27071>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 27072!:strength + 40 27073# not 'p', check other lines 270740 search/8192 !p 27075>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 27076>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 27077!:strength + 75 27078 27079# Perl POD documents 27080# From: Tom Hukins <tom@eborcom.com> 270810 search/1024/W \=pod\n Perl POD document text 270820 search/1024/W \n\=pod\n Perl POD document text 270830 search/1024/W \=head1\ Perl POD document text 270840 search/1024/W \n\=head1\ Perl POD document text 270850 search/1024/W \=head2\ Perl POD document text 270860 search/1024/W \n\=head2\ Perl POD document text 270870 search/1024/W \=encoding\ Perl POD document text 270880 search/1024/W \n\=encoding\ Perl POD document text 27089 27090 27091# Perl Storable data files. 270920 string perl-store perl Storable (v0.6) data 27093>4 byte >0 (net-order %d) 27094>>4 byte &01 (network-ordered) 27095>>4 byte =3 (major 1) 27096>>4 byte =2 (major 1) 27097 270980 string pst0 perl Storable (v0.7) data 27099>4 byte >0 27100>>4 byte &01 (network-ordered) 27101>>4 byte =5 (major 2) 27102>>4 byte =4 (major 2) 27103>>5 byte >0 (minor %d) 27104 27105# This is Debian #742949 by Zefram <zefram@fysh.org>: 27106# ----------------------------------------------------------- 27107# The Perl module Hash::SharedMem 27108# <https://metacpan.org/release/Hash-SharedMem> defines a file format 27109# for a key/value store. Details of the file format are in the "DESIGN" 27110# file in the module distribution. Magic: 271110 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 27112>8 bequad <0x1000000 27113>>15 byte >2 \b, line size 2^%d byte 27114>>14 byte >2 \b, page size 2^%d byte 27115>>13 byte &1 27116>>>13 byte >1 \b, max fanout %d 271170 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 27118>8 lequad <0x1000000 27119>>8 byte >2 \b, line size 2^%d byte 27120>>9 byte >2 \b, page size 2^%d byte 27121>>10 byte &1 27122>>>10 byte >1 \b, max fanout %d 271230 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 27124>8 bequad <0x1000000 27125>>15 byte >2 \b, line size 2^%d byte 27126>>14 byte >2 \b, page size 2^%d byte 27127>>13 byte &1 27128>>>13 byte >1 \b, max fanout %d 271290 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 27130>8 lequad <0x1000000 27131>>8 byte >2 \b, line size 2^%d byte 27132>>9 byte >2 \b, page size 2^%d byte 27133>>10 byte &1 27134>>>10 byte >1 \b, max fanout %d 27135 27136#------------------------------------------------------------------------------ 27137# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $ 27138# pgf: file(1) magic for Progressive Graphics File (PGF) 27139# 27140# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 27141# 2013 by Philipp Hahn <pmhahn debian org> 271420 string PGF Progressive Graphics image data, 27143!:mime image/x-pgf 27144>3 string 2 version %s, 27145>3 string 4 version %s, 27146>3 string 5 version %s, 27147>3 string 6 version %s, 27148# PGFPreHeader 27149#>>4 lelong x header size %d, 27150# PGFHeader 27151>>8 lelong x %d x 27152>>12 lelong x %d, 27153>>16 byte x %d levels, 27154>>17 byte x compression level %d, 27155>>18 byte x %d bpp, 27156>>19 byte x %d channels, 27157>>20 clear x 27158>>20 byte 0 bitmap, 27159>>20 byte 1 gray scale, 27160>>20 byte 2 indexed color, 27161>>20 byte 3 RGB color, 27162>>20 byte 4 CMYK color, 27163>>20 byte 5 HSL color, 27164>>20 byte 6 HSB color, 27165>>20 byte 7 multi-channel, 27166>>20 byte 8 duo tone, 27167>>20 byte 9 LAB color, 27168>>20 byte 10 gray scale 16, 27169>>20 byte 11 RGB color 48, 27170>>20 byte 12 LAB color 48, 27171>>20 byte 13 CMYK color 64, 27172>>20 byte 14 deep multi-channel, 27173>>20 byte 15 duo tone 16, 27174>>20 byte 17 RGBA color, 27175>>20 byte 18 gray scale 32, 27176>>20 byte 19 RGB color 12, 27177>>20 byte 20 RGB color 16, 27178>>20 byte 255 unknown format, 27179>>20 default x format 27180>>>20 byte x \b %d, 27181>>21 byte x %d bpc 27182# PGFPostHeader 27183# Level-Sizes 27184#>>(4.l+4) lelong x level 0 size: %d 27185#>>(4.l+8) lelong x level 1 size: %d 27186#>>(4.l+12) lelong x level 2 size: %d 27187 27188#------------------------------------------------------------------------------ 27189# $File: pgp,v 1.24 2020/10/14 21:07:29 christos Exp $ 27190# pgp: file(1) magic for Pretty Good Privacy 27191 27192# Handling of binary PGP keys is in pgp-binary-keys. 27193# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 27194# 271950 beshort 0xa600 PGP encrypted data 27196#!:mime application/pgp-encrypted 27197#0 string -----BEGIN\040PGP text/PGP armored data 27198!:mime text/PGP # encoding: armored data 27199#>15 string PUBLIC\040KEY\040BLOCK- public key block 27200#>15 string MESSAGE- message 27201#>15 string SIGNED\040MESSAGE- signed message 27202#>15 string PGP\040SIGNATURE- signature 27203 27204# Update: Joerg Jenderek 27205# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 27206# Reference: https://reposcope.com/mimetype/application/pgp-keys 272072 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 27208#!:mime text/PGP 27209!:mime application/pgp-keys 27210!:ext asc 272112 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 27212!:mime application/pgp-keys 27213!:ext asc 27214>10 search/100 \n\n 27215>>&0 use pgp 272160 string -----BEGIN\040PGP\040MESSAGE- PGP message 27217# https://reposcope.com/mimetype/application/pgp-encrypted 27218#!:mime application/pgp 27219!:mime application/pgp-encrypted 27220!:ext asc 27221#!:ext asc/pgp/gpg 27222>10 search/100 \n\n 27223>>&0 use pgp 27224# Reference: https://www.gnupg.org/gph/en/manual/x135.html 272250 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 27226#!:mime text/plain 27227!:mime text/PGP 27228#!:mime application/pgp 27229!:ext asc 272300 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 27231# https://reposcope.com/mimetype/application/pgp-signature 27232!:mime application/pgp-signature 27233!:ext asc 27234>10 search/100 \n\n 27235>>&0 use pgp 27236 27237# Decode the type of the packet based on it's base64 encoding. 27238# Idea from Mark Martinec 27239# The specification is in RFC 4880, section 4.2 and 4.3: 27240# https://tools.ietf.org/html/rfc4880#section-4.2 27241 272420 name pgp 27243>0 byte 0x67 Reserved (old) 27244>0 byte 0x68 Public-Key Encrypted Session Key (old) 27245>0 byte 0x69 Signature (old) 27246>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 27247>0 byte 0x6b One-Pass Signature (old) 27248>0 byte 0x6c Secret-Key (old) 27249>0 byte 0x6d Public-Key (old) 27250>0 byte 0x6e Secret-Subkey (old) 27251>0 byte 0x6f Compressed Data (old) 27252>0 byte 0x70 Symmetrically Encrypted Data (old) 27253>0 byte 0x71 Marker (old) 27254>0 byte 0x72 Literal Data (old) 27255>0 byte 0x73 Trust (old) 27256>0 byte 0x74 User ID (old) 27257>0 byte 0x75 Public-Subkey (old) 27258>0 byte 0x76 Unused (old) 27259>0 byte 0x77 27260>>1 byte&0xc0 0x00 Reserved 27261>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 27262>>1 byte&0xc0 0x80 Signature 27263>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 27264>0 byte 0x78 27265>>1 byte&0xc0 0x00 One-Pass Signature 27266>>1 byte&0xc0 0x40 Secret-Key 27267>>1 byte&0xc0 0x80 Public-Key 27268>>1 byte&0xc0 0xc0 Secret-Subkey 27269>0 byte 0x79 27270>>1 byte&0xc0 0x00 Compressed Data 27271>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 27272>>1 byte&0xc0 0x80 Marker 27273>>1 byte&0xc0 0xc0 Literal Data 27274>0 byte 0x7a 27275>>1 byte&0xc0 0x00 Trust 27276>>1 byte&0xc0 0x40 User ID 27277>>1 byte&0xc0 0x80 Public-Subkey 27278>>1 byte&0xc0 0xc0 Unused [z%x] 27279>0 byte 0x30 27280>>1 byte&0xc0 0x00 Unused [0%x] 27281>>1 byte&0xc0 0x40 User Attribute 27282>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 27283>>1 byte&0xc0 0xc0 Modification Detection Code 27284 27285# magic signatures to detect PGP crypto material (from stef) 27286# detects and extracts metadata from: 27287# - symmetric encrypted packet header 27288# - RSA (e=65537) secret (sub-)keys 27289 27290# 1024b RSA encrypted data 27291 272920 string \x84\x8c\x03 PGP RSA encrypted session key - 27293>3 belong x keyid: %08X 27294>7 belong x %08X 27295>11 byte 0x01 RSA (Encrypt or Sign) 1024b 27296>11 byte 0x02 RSA Encrypt-Only 1024b 27297>12 string \x04\x00 27298>12 string \x03\xff 27299>12 string \x03\xfe 27300>12 string \x03\xfd 27301>12 string \x03\xfc 27302>12 string \x03\xfb 27303>12 string \x03\xfa 27304>12 string \x03\xf9 27305>142 byte 0xd2 . 27306 27307# 2048b RSA encrypted data 27308 273090 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 27310>4 belong x keyid: %08X 27311>8 belong x %08X 27312>12 byte 0x01 RSA (Encrypt or Sign) 2048b 27313>12 byte 0x02 RSA Encrypt-Only 2048b 27314>13 string \x08\x00 27315>13 string \x07\xff 27316>13 string \x07\xfe 27317>13 string \x07\xfd 27318>13 string \x07\xfc 27319>13 string \x07\xfb 27320>13 string \x07\xfa 27321>13 string \x07\xf9 27322>271 byte 0xd2 . 27323 27324# 3072b RSA encrypted data 27325 273260 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 27327>4 belong x keyid: %08X 27328>8 belong x %08X 27329>12 byte 0x01 RSA (Encrypt or Sign) 3072b 27330>12 byte 0x02 RSA Encrypt-Only 3072b 27331>13 string \x0c\x00 27332>13 string \x0b\xff 27333>13 string \x0b\xfe 27334>13 string \x0b\xfd 27335>13 string \x0b\xfc 27336>13 string \x0b\xfb 27337>13 string \x0b\xfa 27338>13 string \x0b\xf9 27339>399 byte 0xd2 . 27340 27341# 4096b RSA encrypted data 27342 273430 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 27344>4 belong x keyid: %08X 27345>8 belong x %08X 27346>12 byte 0x01 RSA (Encrypt or Sign) 4096b 27347>12 byte 0x02 RSA Encrypt-Only 4096b 27348>13 string \x10\x00 27349>13 string \x0f\xff 27350>13 string \x0f\xfe 27351>13 string \x0f\xfd 27352>13 string \x0f\xfc 27353>13 string \x0f\xfb 27354>13 string \x0f\xfa 27355>13 string \x0f\xf9 27356>527 byte 0xd2 . 27357 27358# 8192b RSA encrypted data 27359 273600 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 27361>4 belong x keyid: %08X 27362>8 belong x %08X 27363>12 byte 0x01 RSA (Encrypt or Sign) 8192b 27364>12 byte 0x02 RSA Encrypt-Only 8192b 27365>13 string \x20\x00 27366>13 string \x1f\xff 27367>13 string \x1f\xfe 27368>13 string \x1f\xfd 27369>13 string \x1f\xfc 27370>13 string \x1f\xfb 27371>13 string \x1f\xfa 27372>13 string \x1f\xf9 27373>1039 byte 0xd2 . 27374 27375# 1024b Elgamal encrypted data 27376 273770 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 27378>4 belong x keyid: %08X 27379>8 belong x %08X 27380>12 byte 0x10 Elgamal Encrypt-Only 1024b. 27381>13 string \x04\x00 27382>13 string \x03\xff 27383>13 string \x03\xfe 27384>13 string \x03\xfd 27385>13 string \x03\xfc 27386>13 string \x03\xfb 27387>13 string \x03\xfa 27388>13 string \x03\xf9 27389 27390# 2048b Elgamal encrypted data 27391 273920 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 27393>4 belong x keyid: %08X 27394>8 belong x %08X 27395>12 byte 0x10 Elgamal Encrypt-Only 2048b. 27396>13 string \x08\x00 27397>13 string \x07\xff 27398>13 string \x07\xfe 27399>13 string \x07\xfd 27400>13 string \x07\xfc 27401>13 string \x07\xfb 27402>13 string \x07\xfa 27403>13 string \x07\xf9 27404 27405# 3072b Elgamal encrypted data 27406 274070 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 27408>4 belong x keyid: %08X 27409>8 belong x %08X 27410>12 byte 0x10 Elgamal Encrypt-Only 3072b. 27411>13 string \x0c\x00 27412>13 string \x0b\xff 27413>13 string \x0b\xfe 27414>13 string \x0b\xfd 27415>13 string \x0b\xfc 27416>13 string \x0b\xfb 27417>13 string \x0b\xfa 27418>13 string \x0b\xf9 27419 27420# crypto algo mapper 27421 274220 name crypto 27423>0 byte 0x00 Plaintext or unencrypted data 27424>0 byte 0x01 IDEA 27425>0 byte 0x02 TripleDES 27426>0 byte 0x03 CAST5 (128 bit key) 27427>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 27428>0 byte 0x07 AES with 128-bit key 27429>0 byte 0x08 AES with 192-bit key 27430>0 byte 0x09 AES with 256-bit key 27431>0 byte 0x0a Twofish with 256-bit key 27432 27433# hash algo mapper 27434 274350 name hash 27436>0 byte 0x01 MD5 27437>0 byte 0x02 SHA-1 27438>0 byte 0x03 RIPE-MD/160 27439>0 byte 0x08 SHA256 27440>0 byte 0x09 SHA384 27441>0 byte 0x0a SHA512 27442>0 byte 0x0b SHA224 27443 27444# display public key algorithms as human readable text 274450 name key_algo 27446>0 byte 0x01 RSA (Encrypt or Sign) 27447# keep old look of version 5.28 without parentheses 27448>0 byte 0x02 RSA Encrypt-Only 27449>0 byte 0x03 RSA (Sign-Only) 27450>0 byte 16 ElGamal (Encrypt-Only) 27451>0 byte 17 DSA 27452>0 byte 18 Elliptic Curve 27453>0 byte 19 ECDSA 27454>0 byte 20 ElGamal (Encrypt or Sign) 27455>0 byte 21 Diffie-Hellman 27456>0 default x 27457>>0 ubyte <22 unknown (pub %d) 27458# this should never happen 27459>>0 ubyte >21 invalid (%d) 27460 27461# pgp symmetric encrypted data 27462 274630 byte 0x8c PGP symmetric key encrypted data - 27464>1 byte 0x0d 27465>1 byte 0x0c 27466>2 byte 0x04 27467>3 use crypto 27468>4 byte 0x01 salted - 27469>>5 use hash 27470>>14 byte 0xd2 . 27471>>14 byte 0xc9 . 27472>4 byte 0x03 salted & iterated - 27473>>5 use hash 27474>>15 byte 0xd2 . 27475>>15 byte 0xc9 . 27476 27477# encrypted keymaterial needs s2k & can be checksummed/hashed 27478 274790 name chkcrypto 27480>0 use crypto 27481>1 byte 0x00 Simple S2K 27482>1 byte 0x01 Salted S2K 27483>1 byte 0x03 Salted&Iterated S2K 27484>2 use hash 27485 27486# all PGP keys start with this prolog 27487# containing version, creation date, and purpose 27488 274890 name keyprolog 27490>0 byte 0x04 27491>1 beldate x created on %s - 27492>5 byte 0x01 RSA (Encrypt or Sign) 27493>5 byte 0x02 RSA Encrypt-Only 27494 27495# end of secret keys known signature 27496# contains e=65537 and the prolog to 27497# the encrypted parameters 27498 274990 name keyend 27500>0 string \x00\x11\x01\x00\x01 e=65537 27501>5 use crypto 27502>5 byte 0xff checksummed 27503>>6 use chkcrypto 27504>5 byte 0xfe hashed 27505>>6 use chkcrypto 27506 27507# PGP secret keys contain also the public parts 27508# these vary by bitsize of the key 27509 275100 name x1024 27511>0 use keyprolog 27512>6 string \x03\xfe 27513>6 string \x03\xff 27514>6 string \x04\x00 27515>136 use keyend 27516 275170 name x2048 27518>0 use keyprolog 27519>6 string \x80\x00 27520>6 string \x07\xfe 27521>6 string \x07\xff 27522>264 use keyend 27523 275240 name x3072 27525>0 use keyprolog 27526>6 string \x0b\xfe 27527>6 string \x0b\xff 27528>6 string \x0c\x00 27529>392 use keyend 27530 275310 name x4096 27532>0 use keyprolog 27533>6 string \x10\x00 27534>6 string \x0f\xfe 27535>6 string \x0f\xff 27536>520 use keyend 27537 27538# \x00|\x1f[\xfe\xff]).{1024})' 275390 name x8192 27540>0 use keyprolog 27541>6 string \x20\x00 27542>6 string \x1f\xfe 27543>6 string \x1f\xff 27544>1032 use keyend 27545 27546# depending on the size of the pkt 27547# we branch into the proper key size 27548# signatures defined as x{keysize} 27549 275500 name pgpkey 27551>0 string \x01\xd8 1024b 27552>>2 use x1024 27553>0 string \x01\xeb 1024b 27554>>2 use x1024 27555>0 string \x01\xfb 1024b 27556>>2 use x1024 27557>0 string \x01\xfd 1024b 27558>>2 use x1024 27559>0 string \x01\xf3 1024b 27560>>2 use x1024 27561>0 string \x01\xee 1024b 27562>>2 use x1024 27563>0 string \x01\xfe 1024b 27564>>2 use x1024 27565>0 string \x01\xf4 1024b 27566>>2 use x1024 27567>0 string \x02\x0d 1024b 27568>>2 use x1024 27569>0 string \x02\x03 1024b 27570>>2 use x1024 27571>0 string \x02\x05 1024b 27572>>2 use x1024 27573>0 string \x02\x15 1024b 27574>>2 use x1024 27575>0 string \x02\x00 1024b 27576>>2 use x1024 27577>0 string \x02\x10 1024b 27578>>2 use x1024 27579>0 string \x02\x04 1024b 27580>>2 use x1024 27581>0 string \x02\x06 1024b 27582>>2 use x1024 27583>0 string \x02\x16 1024b 27584>>2 use x1024 27585>0 string \x03\x98 2048b 27586>>2 use x2048 27587>0 string \x03\xab 2048b 27588>>2 use x2048 27589>0 string \x03\xbb 2048b 27590>>2 use x2048 27591>0 string \x03\xbd 2048b 27592>>2 use x2048 27593>0 string \x03\xcd 2048b 27594>>2 use x2048 27595>0 string \x03\xb3 2048b 27596>>2 use x2048 27597>0 string \x03\xc3 2048b 27598>>2 use x2048 27599>0 string \x03\xc5 2048b 27600>>2 use x2048 27601>0 string \x03\xd5 2048b 27602>>2 use x2048 27603>0 string \x03\xae 2048b 27604>>2 use x2048 27605>0 string \x03\xbe 2048b 27606>>2 use x2048 27607>0 string \x03\xc0 2048b 27608>>2 use x2048 27609>0 string \x03\xd0 2048b 27610>>2 use x2048 27611>0 string \x03\xb4 2048b 27612>>2 use x2048 27613>0 string \x03\xc4 2048b 27614>>2 use x2048 27615>0 string \x03\xc6 2048b 27616>>2 use x2048 27617>0 string \x03\xd6 2048b 27618>>2 use x2048 27619>0 string \x05X 3072b 27620>>2 use x3072 27621>0 string \x05k 3072b 27622>>2 use x3072 27623>0 string \x05{ 3072b 27624>>2 use x3072 27625>0 string \x05} 3072b 27626>>2 use x3072 27627>0 string \x05\x8d 3072b 27628>>2 use x3072 27629>0 string \x05s 3072b 27630>>2 use x3072 27631>0 string \x05\x83 3072b 27632>>2 use x3072 27633>0 string \x05\x85 3072b 27634>>2 use x3072 27635>0 string \x05\x95 3072b 27636>>2 use x3072 27637>0 string \x05n 3072b 27638>>2 use x3072 27639>0 string \x05\x7e 3072b 27640>>2 use x3072 27641>0 string \x05\x80 3072b 27642>>2 use x3072 27643>0 string \x05\x90 3072b 27644>>2 use x3072 27645>0 string \x05t 3072b 27646>>2 use x3072 27647>0 string \x05\x84 3072b 27648>>2 use x3072 27649>0 string \x05\x86 3072b 27650>>2 use x3072 27651>0 string \x05\x96 3072b 27652>>2 use x3072 27653>0 string \x07[ 4096b 27654>>2 use x4096 27655>0 string \x07\x18 4096b 27656>>2 use x4096 27657>0 string \x07+ 4096b 27658>>2 use x4096 27659>0 string \x07; 4096b 27660>>2 use x4096 27661>0 string \x07= 4096b 27662>>2 use x4096 27663>0 string \x07M 4096b 27664>>2 use x4096 27665>0 string \x073 4096b 27666>>2 use x4096 27667>0 string \x07C 4096b 27668>>2 use x4096 27669>0 string \x07E 4096b 27670>>2 use x4096 27671>0 string \x07U 4096b 27672>>2 use x4096 27673>0 string \x07. 4096b 27674>>2 use x4096 27675>0 string \x07> 4096b 27676>>2 use x4096 27677>0 string \x07@ 4096b 27678>>2 use x4096 27679>0 string \x07P 4096b 27680>>2 use x4096 27681>0 string \x074 4096b 27682>>2 use x4096 27683>0 string \x07D 4096b 27684>>2 use x4096 27685>0 string \x07F 4096b 27686>>2 use x4096 27687>0 string \x07V 4096b 27688>>2 use x4096 27689>0 string \x0e[ 8192b 27690>>2 use x8192 27691>0 string \x0e\x18 8192b 27692>>2 use x8192 27693>0 string \x0e+ 8192b 27694>>2 use x8192 27695>0 string \x0e; 8192b 27696>>2 use x8192 27697>0 string \x0e= 8192b 27698>>2 use x8192 27699>0 string \x0eM 8192b 27700>>2 use x8192 27701>0 string \x0e3 8192b 27702>>2 use x8192 27703>0 string \x0eC 8192b 27704>>2 use x8192 27705>0 string \x0eE 8192b 27706>>2 use x8192 27707>0 string \x0eU 8192b 27708>>2 use x8192 27709>0 string \x0e. 8192b 27710>>2 use x8192 27711>0 string \x0e> 8192b 27712>>2 use x8192 27713>0 string \x0e@ 8192b 27714>>2 use x8192 27715>0 string \x0eP 8192b 27716>>2 use x8192 27717>0 string \x0e4 8192b 27718>>2 use x8192 27719>0 string \x0eD 8192b 27720>>2 use x8192 27721>0 string \x0eF 8192b 27722>>2 use x8192 27723>0 string \x0eV 8192b 27724>>2 use x8192 27725 27726# PGP RSA (e=65537) secret (sub-)key header 27727 277280 byte 0x97 PGP Secret Sub-key - 27729>1 use pgpkey 277300 byte 0x9d 27731# Update: Joerg Jenderek 27732# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 27733# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 27734>1 ubeshort >0 27735#>1 ubeshort x \b, body length 0x%x 27736# next packet type often 88h,89h~(tag 2)~Signature Packet 27737#>>(1.S+3) ubyte x \b, next packet type 0x%x 27738# skip Dragon.SHR DEMO.INIT by looking for positive version 27739>>3 ubyte >0 27740# skip BUISSON.13 GUITAR1 by looking for low version number 27741>>>3 ubyte <5 PGP Secret Sub-key 27742# sub-key are normally part of secret key. So it does not occur as standalone file 27743#!:ext bin 27744# version 2,3~old 4~new . Comment following line for version 5.28 look 27745>>>>3 ubyte x (v%d) 27746>>>>3 ubyte x - 27747# old versions 2 or 3 but no real example found 27748>>>>3 ubyte <4 27749# 2 byte for key bits in version 5.28 look 27750>>>>>11 ubeshort x %db 27751>>>>>4 beldate x created on %s - 27752# old versions use 2 additional bytes after time stamp 27753#>>>>>8 ubeshort x 0x%x 27754# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 27755>>>>>10 use key_algo 27756>>>>>(11.S/8) ubequad x 27757# look after first key 27758>>>>>>&5 use keyend 27759# new version 27760>>>>3 ubyte >3 27761>>>>>9 ubeshort x %db 27762>>>>>4 beldate x created on %s - 27763# display key algorithm 27764>>>>>8 use key_algo 27765>>>>>(9.S/8) ubequad x 27766# look after first key for something like s2k 27767>>>>>>&3 use keyend 27768 27769#------------------------------------------------------------------------------ 27770# $File: pgp-binary-keys,v 1.1 2020/10/14 21:07:29 christos Exp $ 27771# pgp-binary-keys: This file handles pgp binary keys. 27772# 27773# An PGP certificate or message doesn't have a fixed header. Instead, 27774# they are sequences of packets: 27775# 27776# https://tools.ietf.org/html/rfc4880#section-4.3 27777# 27778# whose order conforms to a grammar: 27779# 27780# https://tools.ietf.org/html/rfc4880#section-11 27781# 27782# Happily most packets have a few fields that are constrained, which 27783# allow us to fingerprint them with relatively high certainty. 27784# 27785# A PGP packet is described by a single byte: the so-called CTB. The 27786# high-bit is always set. If bit 6 is set, then it is a so-called 27787# new-style CTB; if bit 6 is clear, then it is a so-called old-style 27788# CTB. Old-style CTBs have only four bits of type information; bits 27789# 1-0 are used to describe the length. New-style CTBs have 6 bits of 27790# type information. 27791# 27792# Following the CTB is the packet's length in bytes. If we blindly 27793# advance the file cursor by this amount past the end of the length 27794# information we come to the next packet. 27795# 27796# Data Structures 27797# =============== 27798# 27799# New Style CTB 27800# ------------- 27801# 27802# https://tools.ietf.org/html/rfc4880#section-4.2.2 27803# 27804# 76543210 27805# ||\----/ 27806# || tag 27807# |always 1 27808# always 1 27809# 27810# Tag bits 7 and 6 set 27811# 0 0xC0 -- Reserved - a packet tag MUST NOT have this value 27812# 1 0xC1 -- Public-Key Encrypted Session Key Packet 27813# 2 0xC2 -- Signature Packet 27814# 3 0xC3 -- Symmetric-Key Encrypted Session Key Packet 27815# 4 0xC4 -- One-Pass Signature Packet 27816# 5 0xC5 -- Secret-Key Packet 27817# 6 0xC6 -- Public-Key Packet 27818# 7 0xC7 -- Secret-Subkey Packet 27819# 8 0xC8 -- Compressed Data Packet 27820# 9 0xC9 -- Symmetrically Encrypted Data Packet 27821# 10 0xCA -- Marker Packet 27822# 11 0xCB -- Literal Data Packet 27823# 12 0xCC -- Trust Packet 27824# 13 0xCD -- User ID Packet 27825# 14 0xCE -- Public-Subkey Packet 27826# 17 0xD1 -- User Attribute Packet 27827# 18 0xD2 -- Sym. Encrypted and Integrity Protected Data Packet 27828# 19 0xD3 -- Modification Detection Code Packet 27829# 60 to 63 -- Private or Experimental Values 27830# 27831# The CTB is followed by the length header, which is densely encoded: 27832# 27833# if length[0] is: 27834# 0..191: one byte length (length[0]) 27835# 192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192 27836# 224..254: four byte length (big endian interpretation of length[1..5]) 27837# 255: partial body encoding 27838# 27839# The partial body encoding is similar to HTTP's chunk encoding. It 27840# is only allowed for container packets (SEIP, Compressed Data and 27841# Literal). 27842# 27843# Old Style CTB 27844# ------------- 27845# 27846# https://tools.ietf.org/html/rfc4880#section-4.2.1 27847# 27848# CTB: 27849# 27850# 76543210 27851# ||\--/\/ 27852# || | length encoding 27853# || tag 27854# |always 0 27855# always 1 27856# 27857# Tag: 27858# 27859# Tag bit 7 set, bits 6, 1, 0 clear 27860# 0 0x80 -- Reserved - a packet tag MUST NOT have this value 27861# 1 0x84 -- Public-Key Encrypted Session Key Packet 27862# 2 0x88 -- Signature Packet 27863# 3 0x8C -- Symmetric-Key Encrypted Session Key Packet 27864# 4 0x90 -- One-Pass Signature Packet 27865# 5 0x94 -- Secret-Key Packet 27866# 6 0x98 -- Public-Key Packet 27867# 7 0x9C -- Secret-Subkey Packet 27868# 8 0xA0 -- Compressed Data Packet 27869# 9 0xA4 -- Symmetrically Encrypted Data Packet 27870# 10 0xA8 -- Marker Packet 27871# 11 0xAC -- Literal Data Packet 27872# 12 0xB0 -- Trust Packet 27873# 13 0xB4 -- User ID Packet 27874# 14 0xB8 -- Public-Subkey Packet 27875# 27876# Length encoding: 27877# 27878# Value 27879# 0 1 byte length (following byte is the length) 27880# 1 2 byte length (following two bytes are the length) 27881# 2 4 byte length (following four bytes are the length) 27882# 3 indeterminate length: natural end of packet, e.g., EOF 27883# 27884# An indeterminate length is only allowed for container packets 27885# (SEIP, Compressed Data and Literal). 27886# 27887# Certificates 27888# ------------ 27889# 27890# We check the first three packets to determine if a sequence of 27891# OpenPGP packets is likely to be a certificate. The grammar allows 27892# the following prefixes: 27893# 27894# [Primary Key] [SIG] (EOF or another certificate) 27895# [Primary Key] [SIG] [User ID] [SIG]... 27896# [Primary Key] [SIG] [User Attribute] [SIG]... 27897# [Primary Key] [SIG] [Subkey] [SIG]... 27898# [Primary Key] [User ID] [SIG]... 27899# [Primary Key] [User Attribute] [SIG]... 27900# [Primary Key] [Subkey] [SIG]... 27901# 27902# Any number of marker packets are also allowed between each packet, 27903# but they are not normally used and we don't currently check for 27904# them. 27905# 27906# The keys and subkeys may be public or private. 27907# 27908 27909# Key packets and signature packets are versioned. There are two 27910# packet versions that we need to worry about in practice: v3 and v4. 27911# v4 packets were introduced in RFC 2440, which was published in 1998. 27912# It also deprecated v3 packets. There are no actively used v3 27913# certificates (GnuPG removed the code to support them in November 27914# 2014). But there are v3 keys lying around and it is useful to 27915# identify them. The next version of OpenPGP will introduce v5 keys. 27916# The document has not yet been standardized so changes are still 27917# possible. But, for our purposes, it appears that v5 data structures 27918# will be identical to v4 data structures modulo the version number. 27919# 27920# https://tools.ietf.org/html/rfc2440 27921# https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html 27922# https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet 27923 27924 27925 27926 27927# The first packet has to be a public key or a secret key. 27928# 27929# New-Style Public Key 279300 ubyte =0xC6 OpenPGP Public Key 27931>&0 use primary_key_length_new 27932# New-Style Secret Key 279330 ubyte =0xC5 OpenPGP Secret Key 27934>&0 use primary_key_length_new 27935# Old-Style Public Key 279360 ubyte&0xFC =0x98 OpenPGP Public Key 27937>&-1 use primary_key_length_old 27938# Old-Style Secret Key 279390 ubyte&0xFC =0x94 OpenPGP Secret Key 27940>&-1 use primary_key_length_old 27941 27942# Parse the length, check the packet's body and finally advance to the 27943# next packet. 27944 27945# There are 4 different new-style length encodings, but the partial 27946# body encoding is only acceptable for the SEIP, Compressed Data, and 27947# Literal packets, which isn't valid for any packets in a certificate 27948# so we ignore it. 279490 name primary_key_length_new 27950>&0 ubyte <192 27951#>>&0 ubyte x (1 byte length encoding, %d bytes) 27952>>&0 use pgp_binary_key_pk_check 27953>>>&(&-1.B) use sig_or_component_1 27954>&0 ubyte >191 27955>>&-1 ubyte <225 27956# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header) 27957# raw - (192 * 256 - 192) 27958# = 48960 27959#>>>&0 ubeshort x (2 byte length encoding, %d bytes) 27960>>>&1 use pgp_binary_key_pk_check 27961>>>>&(&-2.S-48960) use sig_or_component_1 27962>&0 ubyte =255 27963#>>&0 belong x (5 byte length encoding, %d bytes) 27964>>&4 use pgp_binary_key_pk_check 27965>>>&(&-4.L) use sig_or_component_1 27966# Partial body encoding (only valid for container packets). 27967# >&0 ubyte >224 27968# >>&0 ubyte <255 partial body encoding 27969 27970# There are 4 different old-style length encodings, but the 27971# indeterminate length encoding is only acceptable for the SEIP, 27972# Compressed Data, and Literal packets, which isn't valid for any 27973# packets in a certificate. 279740 name primary_key_length_old 27975#>&0 ubyte x (ctb: %x) 27976>&0 ubyte&0x3 =0 27977#>>&0 ubyte x (1 byte length encoding, %d bytes) 27978>>&1 use pgp_binary_key_pk_check 27979>>>&(&-1.B) use sig_or_component_1 27980>&0 ubyte&0x3 =1 27981#>>&0 ubeshort x (2 byte length encoding, %d bytes) 27982>>&2 use pgp_binary_key_pk_check 27983>>>&(&-2.S) use sig_or_component_1 27984>&0 ubyte&0x3 =2 27985#>>&0 ubelong x (4 byte length encoding, %d bytes) 27986>>&4 use pgp_binary_key_pk_check 27987>>>&(&-4.L) use sig_or_component_1 27988 27989# Check the Key. 27990# 27991# https://tools.ietf.org/html/rfc4880#section-5.5.2 279920 name pgp_binary_key_pk_check 27993# Valid versions are: 2, 3, 4. 5 is proposed in RFC 4880bis. 27994# Anticipate a v6 / v7 format that like v5 is compatible with v4. 27995# key format in a decade or so :D. 27996>&0 ubyte >1 27997>>&-1 ubyte <8 27998>>>&-1 byte x Version %d 27999# Check that keys were created after 1990. 28000# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147 28001>>>&0 bedate >631156147 \b, Created %s 28002>>>>&-5 ubyte >3 28003>>>>>&4 use pgp_binary_key_algo 28004>>>>&-5 ubyte <4 28005>>>>>&6 use pgp_binary_key_algo 28006 28007# Print out the key's algorithm and the number of bits, if this is 28008# relevant (ECC keys are a fixed size). 280090 name pgp_binary_key_algo 28010>0 clear x 28011>&0 ubyte =1 \b, RSA (Encrypt or Sign, 28012>>&0 ubeshort x \b %d bits) 28013>&0 ubyte =2 \b, RSA (Encrypt, 28014>>&0 ubeshort x \b %d bits) 28015>&0 ubyte =3 \b, RSA (Sign, 28016>>&0 ubeshort x \b %d bits) 28017>&0 ubyte =16 \b, El Gamal (Encrypt, 28018>>&0 ubeshort x \b %d bits) 28019>&0 ubyte =17 \b, DSA 28020>>&0 ubeshort x \b (%d bits) 28021>&0 ubyte =18 \b, ECDH 28022>&0 ubyte =19 \b, ECDSA 28023>&0 ubyte =20 \b, El Gamal (Encrypt or Sign, 28024>>&0 ubeshort x \b %d bits) 28025>&0 ubyte =22 \b, EdDSA 28026>&0 default x 28027>>&0 ubyte x \b, Unknown Algorithm (0x%x) 28028 28029# Match all possible second packets. 280300 name sig_or_component_1 28031#>0 ubyte x (ctb: %x) 28032>&0 ubyte =0xC2 28033>>0 ubyte x \b; Signature 28034>>&0 use sig_or_component_1_length_new 28035>&0 ubyte =0xCD 28036>>0 ubyte x \b; User ID 28037>>&0 use sig_or_component_1_length_new 28038>&0 ubyte =0xCE 28039>>0 ubyte x \b; Public Subkey 28040>>&0 use sig_or_component_1_length_new 28041>&0 ubyte =0xC7 28042>>0 ubyte x \b; Secret Subkey 28043>>&0 use sig_or_component_1_length_new 28044>&0 ubyte =0xD1 28045>>0 ubyte x \b; User Attribute 28046>>&0 use sig_or_component_1_length_new 28047>&0 ubyte&0xFC =0x88 28048>>0 ubyte x \b; Signature 28049>>&-1 use sig_or_component_1_length_old 28050>&0 ubyte&0xFC =0xB4 28051>>0 ubyte x \b; User ID 28052>>&-1 use sig_or_component_1_length_old 28053>&0 ubyte&0xFC =0xB8 28054>>0 ubyte x \b; Public Subkey 28055>>&-1 use sig_or_component_1_length_old 28056>&0 ubyte&0xFC =0x9C 28057>>0 ubyte x \b; Secret Subkey 28058>>&-1 use sig_or_component_1_length_old 28059 28060# Copy of 'primary_key_length_new', but calls cert_packet_3. 280610 name sig_or_component_1_length_new 28062>&0 ubyte <192 28063#>>&0 ubyte x (1 byte new length encoding, %d bytes) 28064>>&(&-1.B) use cert_packet_3 28065>&0 ubyte >191 28066>>&-1 ubyte <225 28067# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 28068# raw - (192 * 256 - 192 - 1) 28069# = 48959 28070#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 28071>>>&(&-1.S-48959) use cert_packet_3 28072>&0 ubyte =255 28073#>>&0 belong x (5 byte new length encoding, %d bytes) 28074>>&(&-4.L) use cert_packet_3 28075# Partial body encoding (only valid for container packets). 28076# >&0 ubyte >224 28077# >>&0 ubyte <255 partial body encoding 28078 280790 name sig_or_component_1_length_old 28080#>&0 ubyte x (ctb: %x) 28081>&0 ubyte&0x3 =0 28082#>>&0 ubyte x (1 byte old length encoding, %d bytes) 28083>>&(&0.B+1) use cert_packet_3 28084>&0 ubyte&0x3 =1 28085#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 28086>>&(&0.S+2) use cert_packet_3 28087>&0 ubyte&0x3 =2 28088#>>&0 ubelong x (4 byte old length encoding, %d bytes) 28089>>&(&0.L+4) use cert_packet_3 28090 28091# Copy of above. 280920 name cert_packet_3 28093#>0 ubyte x (ctb: %x) 28094>&0 ubyte =0xC2 28095>>0 ubyte x \b; Signature 28096>>&0 use cert_packet_3_length_new 28097>&0 ubyte =0xCD 28098>>0 ubyte x \b; User ID 28099>>&0 use cert_packet_3_length_new 28100>&0 ubyte =0xCE 28101>>0 ubyte x \b; Public Subkey 28102>>&0 use cert_packet_3_length_new 28103>&0 ubyte =0xC7 28104>>0 ubyte x \b; Secret Subkey 28105>>&0 use cert_packet_3_length_new 28106>&0 ubyte =0xD1 28107>>0 ubyte x \b; User Attribute 28108>>&0 use cert_packet_3_length_new 28109>&0 ubyte&0xFC =0x88 28110>>0 ubyte x \b; Signature 28111>>&-1 use cert_packet_3_length_old 28112>&0 ubyte&0xFC =0xB4 28113>>0 ubyte x \b; User ID 28114>>&-1 use cert_packet_3_length_old 28115>&0 ubyte&0xFC =0xB8 28116>>0 ubyte x \b; Public Subkey 28117>>&-1 use cert_packet_3_length_old 28118>&0 ubyte&0xFC =0x9C 28119>>0 ubyte x \b; Secret Subkey 28120>>&-1 use cert_packet_3_length_old 28121 28122# Copy of above. 281230 name cert_packet_3_length_new 28124>&0 ubyte <192 28125#>>&0 ubyte x (1 byte new length encoding, %d bytes) 28126>>&(&-1.B) use pgp_binary_keys_end 28127>&0 ubyte >191 28128>>&-1 ubyte <225 28129# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 28130# raw - (192 * 256 - 192 - 1) 28131# = 48959 28132#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 28133>>>&(&-1.S-48959) use pgp_binary_keys_end 28134>&0 ubyte =255 28135#>>&0 belong x (5 byte new length encoding, %d bytes) 28136>>&(&-4.L) use pgp_binary_keys_end 28137 281380 name cert_packet_3_length_old 28139#>&0 ubyte x (ctb: %x) 28140>&0 ubyte&0x3 =0 28141#>>&0 ubyte x (1 byte old length encoding, %d bytes) 28142>>&(&0.B+1) use pgp_binary_keys_end 28143>&0 ubyte&0x3 =1 28144#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 28145>>&(&0.S+2) use pgp_binary_keys_end 28146>&0 ubyte&0x3 =2 28147#>>&0 ubelong x (4 byte old length encoding, %d bytes) 28148>>&(&0.L+4) use pgp_binary_keys_end 28149 28150# We managed to parse the first three packets of the certificate. Declare 28151# victory. 281520 name pgp_binary_keys_end 28153>0 byte x \b; OpenPGP Certificate 28154!:mime application/pgp-keys 28155!:ext pgp/gpg/pkr/asd 28156 28157#------------------------------------------------------------------------------ 28158# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 28159# pkgadd: file(1) magic for SysV R4 PKG Datastreams 28160# 281610 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 28162!:mime application/x-svr4-package 28163 28164#------------------------------------------------------------------------------ 28165# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 28166# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 28167# From: "Stefan A. Haubenthal" <polluks@web.de> 28168# 281690 belong 0x00000107 Plan 9 executable, Motorola 68k 281700 belong 0x000001EB Plan 9 executable, Intel 386 281710 belong 0x00000247 Plan 9 executable, Intel 960 281720 belong 0x000002AB Plan 9 executable, SPARC 281730 belong 0x00000407 Plan 9 executable, MIPS R3000 281740 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 281750 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 281760 belong 0x000005AB Plan 9 executable, AMD 29000 281770 belong 0x00000647 Plan 9 executable, ARM 7-something 281780 belong 0x000006EB Plan 9 executable, PowerPC 281790 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 281800 belong 0x0000084B Plan 9 executable, DEC Alpha 28181 28182#------------------------------------------------------------------------------ 28183# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 28184# plus5: file(1) magic for Plus Five's UNIX MUMPS 28185# 28186# XXX - byte order? Paging Hokey.... 28187# 281880 short 0x259 mumps avl global 28189>2 byte >0 (V%d) 28190>6 byte >0 with %d byte name 28191>7 byte >0 and %d byte data cells 281920 short 0x25a mumps blt global 28193>2 byte >0 (V%d) 28194>8 short >0 - %d byte blocks 28195>15 byte 0x00 - P/D format 28196>15 byte 0x01 - P/K/D format 28197>15 byte 0x02 - K/D format 28198>15 byte >0x02 - Bad Flags 28199 28200#------------------------------------------------------------------------------ 28201# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $ 28202# pmem: file(1) magic for Persistent Memory Development Kit pool files 28203# 282040 string PMEM 28205>4 string POOLSET Persistent Memory Poolset file 28206>>11 search REPLICA with replica 28207>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s, 28208>>8 lelong >0 version: 0x%x, 28209>>12 lelong x compat: 0x%x, 28210>>16 lelong x incompat: 0x%x, 28211>>20 lelong x ro_compat: 0x%x, 28212 28213 28214>>120 leqldate x crtime: %s, 28215>>128 lequad x alignment_desc: 0x%016llx, 28216 28217>>136 clear x 28218>>136 byte 2 machine_class: 64-bit, 28219>>136 default x machine_class: unknown 28220>>>136 byte x (0x%d), 28221 28222>>137 clear x 28223>>137 byte 1 data: little-endian, 28224>>137 byte 2 data: big-endian, 28225>>137 default x data: unknown 28226>>>137 byte x (0x%d), 28227 28228>>138 byte !0 reserved[0]: %d, 28229>>139 byte !0 reserved[1]: %d, 28230>>140 byte !0 reserved[2]: %d, 28231>>141 byte !0 reserved[3]: %d, 28232 28233>>142 clear x 28234>>142 leshort 62 machine: x86_64 28235>>142 leshort 183 machine: aarch64 28236>>142 default x machine: unknown 28237>>>142 leshort x (0x%d) 28238 28239>4 string BLK 28240>>4096 lelong x \b, blk.bsize: %d 28241 28242>4 string OBJ 28243>>4096 string >0 \b, obj.layout: '%s' 28244>>4096 string <0 \b, obj.layout: NULL 28245 28246#------------------------------------------------------------------------------ 28247# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $ 28248# polyml: file(1) magic for PolyML 28249# 28250# PolyML 28251# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 28252# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 28253 28254# [0]: https://www.polyml.org/ 28255# [1]: https://github.com/polyml/polyml/blob/master/\ 28256# libpolyml/savestate.cpp#L146-L147 28257# [2]: https://github.com/polyml/polyml/blob/master/\ 28258# libpolyml/savestate.cpp#L1262-L1263 28259 28260# Type: Poly/ML saved data 28261# From: Matthew Fernandez <matthew.fernandez@gmail.com> 28262 282630 string POLYSAVE Poly/ML saved state 28264>8 long x version %u 28265 282660 string POLYMODU Poly/ML saved module 28267>8 long x version %u 28268 28269#------------------------------------------------------------------------------ 28270# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $ 28271# printer: file(1) magic for printer-formatted files 28272# 28273 28274# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 282750 string %! PostScript document text 28276!:mime application/postscript 28277!:apple ASPSTEXT 28278>2 string PS-Adobe- conforming 28279>>11 string >\0 DSC level %.3s 28280>>>15 string EPS \b, type %s 28281>>>15 string Query \b, type %s 28282>>>15 string ExitServer \b, type %s 28283>>>15 search/1000 %%LanguageLevel:\040 28284>>>>&0 string >\0 \b, Level %s 28285# Some PCs have the annoying habit of adding a ^D as a document separator 282860 string \004%! PostScript document text 28287!:mime application/postscript 28288!:apple ASPSTEXT 28289>3 string PS-Adobe- conforming 28290>>12 string >\0 DSC level %.3s 28291>>>16 string EPS \b, type %s 28292>>>16 string Query \b, type %s 28293>>>16 string ExitServer \b, type %s 28294>>>16 search/1000 %%LanguageLevel:\040 28295>>>>&0 string >\0 \b, Level %s 282960 string \033%-12345X%!PS PostScript document 28297 28298# DOS EPS Binary File Header 28299# From: Ed Sznyter <ews@Black.Market.NET> 283000 belong 0xC5D0D3C6 DOS EPS Binary File 28301>4 long >0 Postscript starts at byte %d 28302>>8 long >0 length %d 28303>>>12 long >0 Metafile starts at byte %d 28304>>>>16 long >0 length %d 28305>>>20 long >0 TIFF starts at byte %d 28306>>>>24 long >0 length %d 28307 28308# Summary: Adobe's PostScript Printer Description File 28309# Extension: .ppd 28310# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 28311# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 28312# 283130 string *PPD-Adobe:\x20 PPD file 28314>&0 string x \b, version %s 28315 28316# HP Printer Job Language 283170 string \033%-12345X@PJL HP Printer Job Language data 28318# HP Printer Job Language 28319# The header found on Win95 HP plot files is the "Silliest Thing possible" 28320# (TM) 28321# Every driver puts the language at some random position, with random case 28322# (LANGUAGE and Language) 28323# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 28324# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 28325# 283260 string \033%-12345X@PJL HP Printer Job Language data 28327>&0 string >\0 %s 28328>>&0 string >\0 %s 28329>>>&0 string >\0 %s 28330>>>>&0 string >\0 %s 28331#>15 string \ ENTER\ LANGUAGE\ = 28332#>31 string PostScript PostScript 28333 28334# From: Stefan Thurner <thurners@nicsys.de> 283350 string \033%-12345X@PJL 28336>&0 search/10000 %! PJL encapsulated PostScript document text 28337 28338# Rick Richardson <rickrich@gmail.com> 28339 28340# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 28341# For Oki Data Printers - HIPERC 28342# For Konica Minolta Printers - LAVAFLOW 28343# For Samsung Printers - QPDL 28344# For HP Printers - ZJS stands for Zenographics ZJStream 283450 string \033%-12345X@PJL HP Printer Job Language data 28346>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 28347>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 28348>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 28349>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 28350>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 28351>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 28352 28353 28354# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 283550 string \033E\033 HP PCL printer data 28356>3 string \&l0A - default page size 28357>3 string \&l1A - US executive page size 28358>3 string \&l2A - US letter page size 28359>3 string \&l3A - US legal page size 28360>3 string \&l26A - A4 page size 28361>3 string \&l80A - Monarch envelope size 28362>3 string \&l81A - No. 10 envelope size 28363>3 string \&l90A - Intl. DL envelope size 28364>3 string \&l91A - Intl. C5 envelope size 28365>3 string \&l100A - Intl. B5 envelope size 28366>3 string \&l-81A - No. 10 envelope size (landscape) 28367>3 string \&l-90A - Intl. DL envelope size (landscape) 28368 28369# IMAGEN printer-ready files: 283700 string @document( Imagen printer 28371# this only works if "language xxx" is first item in Imagen header. 28372>10 string language\ impress (imPRESS data) 28373>10 string language\ daisy (daisywheel text) 28374>10 string language\ diablo (daisywheel text) 28375>10 string language\ printer (line printer emulation) 28376>10 string language\ tektronix (Tektronix 4014 emulation) 28377# Add any other languages that your Imagen uses - remember 28378# to keep the word `text' if the file is human-readable. 28379# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 28380# 28381# Now magic for IMAGEN font files... 283820 string Rast RST-format raster font data 28383>45 string >0 face %s 28384# From Jukka Ukkonen 283850 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 28386 28387# From <mike@flyn.org> 28388# These are the /etc/magic entries to decode data sent to an Epson printer. 283890 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 28390 28391 28392#------------------------------------------------------------------------------ 28393# zenographics: file(1) magic for Zenographics ZjStream printer data 28394# Rick Richardson <rickrich@gmail.com> 283950 string JZJZ 28396>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 283970 string ZJZJ 28398>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 28399 28400 28401#------------------------------------------------------------------------------ 28402# Oak Technologies printer stream 28403# Rick Richardson <rickrich@gmail.com> 284040 string OAK 28405>0x07 byte 0 28406>0x0b byte 0 Oak Technologies printer stream 28407 28408# This would otherwise be recognized as PostScript - nick@debian.org 284090 string %!VMF SunClock's Vector Map Format data 28410 28411#------------------------------------------------------------------------------ 28412# HP LaserJet 1000 series downloadable firmware file 284130 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 28414 28415# From: Paolo <oopla@users.sf.net> 28416# Epson ESC/Page, ESC/PageColor 284170 string \x1b\x01@EJL Epson ESC/Page language printer data 28418 28419#------------------------------------------------------------------------------ 28420# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 28421# project: file(1) magic for Project management 28422# 28423# Magic strings for ftnchek project files. Alexander Mai 284240 string FTNCHEK_\ P project file for ftnchek 28425>10 string 1 version 2.7 28426>10 string 2 version 2.8 to 2.10 28427>10 string 3 version 2.11 or later 28428 28429#------------------------------------------------------------------------------ 28430# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 28431# psdbms: file(1) magic for psdatabase 28432# 28433# Update: Joerg Jenderek 28434# GRR: line below too general as it catches also some Panorama database *.pan , 28435# AppleWorks word processor 284360 belong&0xff00ffff 0x56000000 28437# assume version starts with digit 28438>1 regex/s =^[0-9] ps database 28439>>1 string >\0 version %s 28440# kernel name 28441>>4 string >\0 from kernel %s 28442 28443#------------------------------------------------------------------------------ 28444# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $ 28445# psl: file(1) magic for Public Suffix List representations 28446# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 28447# URL: https://publicsuffix.org 28448# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 28449 284500 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 28451 284520 string .DAFSA@PSL_ 28453>15 string \n Public Suffix List data (optimized) 28454>>11 byte >0x2f 28455>>>11 byte <0x3a (Version %c) 28456 28457#------------------------------------------------------------------------------ 28458# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 28459# pulsar: file(1) magic for Pulsar POP3 daemon binary files 28460# 28461# http://pulsar.sourceforge.net 28462# mailto:rok.papez@lugos.si 28463# 28464 284650 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 28466>4 ubelong x Version: %d. 28467>8 ubelong x \b%d 28468 28469 28470#------------------------------------------------------------------------------ 28471# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $ 28472# pwsafe: file(1) magic for passwordsafe file 28473# 28474# Password Safe 28475# http://passwordsafe.sourceforge.net/ 28476# file format specs 28477# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 28478# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 28479# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 28480# V2 and V1 have no easy identifier that I can find 28481# .psafe3 284820 string PWS3 Password Safe V3 database 28483 28484#------------------------------------------------------------------------------ 28485# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 28486# pyramid: file(1) magic for Pyramids 28487# 28488# XXX - byte order? 28489# 284900 long 0x50900107 Pyramid 90x family executable 284910 long 0x50900108 Pyramid 90x family pure executable 28492>16 long >0 not stripped 284930 long 0x5090010b Pyramid 90x family demand paged pure executable 28494>16 long >0 not stripped 28495 28496#------------------------------------------------------------------------------ 28497# $File: python,v 1.42 2020/06/04 00:22:50 christos Exp $ 28498# python: file(1) magic for python 28499# 28500# Outlook puts """ too for urgent messages 28501# From: David Necas <yeti@physics.muni.cz> 28502# often the module starts with a multiline string 285030 string/t """ Python script text executable 28504# MAGIC as specified in Python/import.c (1.0 to 3.7) 28505# two bytes of magic followed by "\r\n" in little endian order 285060 belong 0x02099900 python 1.0 byte-compiled 28507!:mime text/x-bytecode.python 285080 belong 0x03099900 python 1.1/1.2 byte-compiled 28509!:mime text/x-bytecode.python 285100 belong 0x892e0d0a python 1.3 byte-compiled 28511!:mime text/x-bytecode.python 285120 belong 0x04170d0a python 1.4 byte-compiled 28513!:mime text/x-bytecode.python 285140 belong 0x994e0d0a python 1.5 byte-compiled 28515!:mime text/x-bytecode.python 285160 belong 0xfcc40d0a python 1.6 byte-compiled 28517!:mime text/x-bytecode.python 285180 belong 0xfdc40d0a python 1.6 byte-compiled 28519!:mime text/x-bytecode.python 285200 belong 0x87c60d0a python 2.0 byte-compiled 28521!:mime text/x-bytecode.python 285220 belong 0x88c60d0a python 2.0 byte-compiled 28523!:mime text/x-bytecode.python 285240 belong 0x2aeb0d0a python 2.1 byte-compiled 28525!:mime text/x-bytecode.python 285260 belong 0x2beb0d0a python 2.1 byte-compiled 28527!:mime text/x-bytecode.python 285280 belong 0x2ded0d0a python 2.2 byte-compiled 28529!:mime text/x-bytecode.python 285300 belong 0x2eed0d0a python 2.2 byte-compiled 28531!:mime text/x-bytecode.python 285320 belong 0x3bf20d0a python 2.3 byte-compiled 28533!:mime text/x-bytecode.python 285340 belong 0x3cf20d0a python 2.3 byte-compiled 28535!:mime text/x-bytecode.python 285360 belong 0x45f20d0a python 2.3 byte-compiled 28537!:mime text/x-bytecode.python 285380 belong 0x59f20d0a python 2.4 byte-compiled 28539!:mime text/x-bytecode.python 285400 belong 0x63f20d0a python 2.4 byte-compiled 28541!:mime text/x-bytecode.python 285420 belong 0x6df20d0a python 2.4 byte-compiled 28543!:mime text/x-bytecode.python 285440 belong 0x6ef20d0a python 2.4 byte-compiled 28545!:mime text/x-bytecode.python 285460 belong 0x77f20d0a python 2.5 byte-compiled 28547!:mime text/x-bytecode.python 285480 belong 0x81f20d0a python 2.5 byte-compiled 28549!:mime text/x-bytecode.python 285500 belong 0x8bf20d0a python 2.5 byte-compiled 28551!:mime text/x-bytecode.python 285520 belong 0x8cf20d0a python 2.5 byte-compiled 28553!:mime text/x-bytecode.python 285540 belong 0x95f20d0a python 2.5 byte-compiled 28555!:mime text/x-bytecode.python 285560 belong 0x9ff20d0a python 2.5 byte-compiled 28557!:mime text/x-bytecode.python 285580 belong 0xa9f20d0a python 2.5 byte-compiled 28559!:mime text/x-bytecode.python 285600 belong 0xb3f20d0a python 2.5 byte-compiled 28561!:mime text/x-bytecode.python 285620 belong 0xb4f20d0a python 2.5 byte-compiled 28563!:mime text/x-bytecode.python 285640 belong 0xc7f20d0a python 2.6 byte-compiled 28565!:mime text/x-bytecode.python 285660 belong 0xd1f20d0a python 2.6 byte-compiled 28567!:mime text/x-bytecode.python 285680 belong 0xd2f20d0a python 2.6 byte-compiled 28569!:mime text/x-bytecode.python 285700 belong 0xdbf20d0a python 2.7 byte-compiled 28571!:mime text/x-bytecode.python 285720 belong 0xe5f20d0a python 2.7 byte-compiled 28573!:mime text/x-bytecode.python 285740 belong 0xeff20d0a python 2.7 byte-compiled 28575!:mime text/x-bytecode.python 285760 belong 0xf9f20d0a python 2.7 byte-compiled 28577!:mime text/x-bytecode.python 285780 belong 0x03f30d0a python 2.7 byte-compiled 28579!:mime text/x-bytecode.python 285800 belong 0x04f30d0a python 2.7 byte-compiled 28581!:mime text/x-bytecode.python 285820 belong 0xb80b0d0a python 3.0 byte-compiled 28583!:mime text/x-bytecode.python 285840 belong 0xc20b0d0a python 3.0 byte-compiled 28585!:mime text/x-bytecode.python 285860 belong 0xcc0b0d0a python 3.0 byte-compiled 28587!:mime text/x-bytecode.python 285880 belong 0xd60b0d0a python 3.0 byte-compiled 28589!:mime text/x-bytecode.python 285900 belong 0xe00b0d0a python 3.0 byte-compiled 28591!:mime text/x-bytecode.python 285920 belong 0xea0b0d0a python 3.0 byte-compiled 28593!:mime text/x-bytecode.python 285940 belong 0xf40b0d0a python 3.0 byte-compiled 28595!:mime text/x-bytecode.python 285960 belong 0xf50b0d0a python 3.0 byte-compiled 28597!:mime text/x-bytecode.python 285980 belong 0xff0b0d0a python 3.0 byte-compiled 28599!:mime text/x-bytecode.python 286000 belong 0x090c0d0a python 3.0 byte-compiled 28601!:mime text/x-bytecode.python 286020 belong 0x130c0d0a python 3.0 byte-compiled 28603!:mime text/x-bytecode.python 286040 belong 0x1d0c0d0a python 3.0 byte-compiled 28605!:mime text/x-bytecode.python 286060 belong 0x1f0c0d0a python 3.0 byte-compiled 28607!:mime text/x-bytecode.python 286080 belong 0x270c0d0a python 3.0 byte-compiled 28609!:mime text/x-bytecode.python 286100 belong 0x3b0c0d0a python 3.0 byte-compiled 28611!:mime text/x-bytecode.python 286120 belong 0x450c0d0a python 3.1 byte-compiled 28613!:mime text/x-bytecode.python 286140 belong 0x4f0c0d0a python 3.1 byte-compiled 28615!:mime text/x-bytecode.python 286160 belong 0x580c0d0a python 3.2 byte-compiled 28617!:mime text/x-bytecode.python 286180 belong 0x620c0d0a python 3.2 byte-compiled 28619!:mime text/x-bytecode.python 286200 belong 0x6c0c0d0a python 3.2 byte-compiled 28621!:mime text/x-bytecode.python 286220 belong 0x760c0d0a python 3.3 byte-compiled 28623!:mime text/x-bytecode.python 286240 belong 0x800c0d0a python 3.3 byte-compiled 28625!:mime text/x-bytecode.python 286260 belong 0x8a0c0d0a python 3.3 byte-compiled 28627!:mime text/x-bytecode.python 286280 belong 0x940c0d0a python 3.3 byte-compiled 28629!:mime text/x-bytecode.python 286300 belong 0x9e0c0d0a python 3.3 byte-compiled 28631!:mime text/x-bytecode.python 286320 belong 0xb20c0d0a python 3.4 byte-compiled 28633!:mime text/x-bytecode.python 286340 belong 0xbc0c0d0a python 3.4 byte-compiled 28635!:mime text/x-bytecode.python 286360 belong 0xc60c0d0a python 3.4 byte-compiled 28637!:mime text/x-bytecode.python 286380 belong 0xd00c0d0a python 3.4 byte-compiled 28639!:mime text/x-bytecode.python 286400 belong 0xda0c0d0a python 3.4 byte-compiled 28641!:mime text/x-bytecode.python 286420 belong 0xe40c0d0a python 3.4 byte-compiled 28643!:mime text/x-bytecode.python 286440 belong 0xee0c0d0a python 3.4 byte-compiled 28645!:mime text/x-bytecode.python 286460 belong 0xf80c0d0a python 3.5.1- byte-compiled 28647!:mime text/x-bytecode.python 286480 belong 0x020d0d0a python 3.5.1- byte-compiled 28649!:mime text/x-bytecode.python 286500 belong 0x0c0d0d0a python 3.5.1- byte-compiled 28651!:mime text/x-bytecode.python 286520 belong 0x160d0d0a python 3.5.1- byte-compiled 28653!:mime text/x-bytecode.python 286540 belong 0x170d0d0a python 3.5.2+ byte-compiled 28655!:mime text/x-bytecode.python 286560 belong 0x200d0d0a python 3.6 byte-compiled 28657!:mime text/x-bytecode.python 286580 belong 0x210d0d0a python 3.6 byte-compiled 28659!:mime text/x-bytecode.python 286600 belong 0x2a0d0d0a python 3.6 byte-compiled 28661!:mime text/x-bytecode.python 286620 belong 0x2b0d0d0a python 3.6 byte-compiled 28663!:mime text/x-bytecode.python 286640 belong 0x2c0d0d0a python 3.6 byte-compiled 28665!:mime text/x-bytecode.python 286660 belong 0x2d0d0d0a python 3.6 byte-compiled 28667!:mime text/x-bytecode.python 286680 belong 0x2f0d0d0a python 3.6 byte-compiled 28669!:mime text/x-bytecode.python 286700 belong 0x300d0d0a python 3.6 byte-compiled 28671!:mime text/x-bytecode.python 286720 belong 0x310d0d0a python 3.6 byte-compiled 28673!:mime text/x-bytecode.python 286740 belong 0x320d0d0a python 3.6 byte-compiled 28675!:mime text/x-bytecode.python 286760 belong 0x330d0d0a python 3.6 byte-compiled 28677!:mime text/x-bytecode.python 286780 belong 0x3e0d0d0a python 3.7 byte-compiled 28679!:mime text/x-bytecode.python 286800 belong 0x3f0d0d0a python 3.7 byte-compiled 28681!:mime text/x-bytecode.python 286820 belong 0x400d0d0a python 3.7 byte-compiled 28683!:mime text/x-bytecode.python 286840 belong 0x410d0d0a python 3.7 byte-compiled 28685!:mime text/x-bytecode.python 286860 belong 0x420d0d0a python 3.7 byte-compiled 28687!:mime text/x-bytecode.python 286880 belong 0x480d0d0a python 3.8 byte-compiled 28689!:mime text/x-bytecode.python 286900 belong 0x490d0d0a python 3.8 byte-compiled 28691!:mime text/x-bytecode.python 286920 belong 0x520d0d0a python 3.8 byte-compiled 28693!:mime text/x-bytecode.python 286940 belong 0x530d0d0a python 3.8 byte-compiled 28695!:mime text/x-bytecode.python 286960 belong 0x540d0d0a python 3.8 byte-compiled 28697!:mime text/x-bytecode.python 286980 belong 0x550d0d0a python 3.8 byte-compiled 28699!:mime text/x-bytecode.python 287000 belong 0x5c0d0d0a python 3.9 byte-compiled 28701!:mime text/x-bytecode.python 287020 belong 0x5d0d0d0a python 3.9 byte-compiled 28703!:mime text/x-bytecode.python 287040 belong 0x5e0d0d0a python 3.9 byte-compiled 28705!:mime text/x-bytecode.python 287060 belong 0x5f0d0d0a python 3.9 byte-compiled 28707!:mime text/x-bytecode.python 287080 belong 0x600d0d0a python 3.9 byte-compiled 28709!:mime text/x-bytecode.python 287100 belong 0x610d0d0a python 3.9 byte-compiled 28711!:mime text/x-bytecode.python 28712 287130 search/1/w #!\040/usr/bin/python Python script text executable 28714!:strength + 15 28715!:mime text/x-script.python 287160 search/1/w #!\040/usr/local/bin/python Python script text executable 28717!:strength + 15 28718!:mime text/x-script.python 287190 search/10/w #!\040/usr/bin/env\040python Python script text executable 28720!:strength + 15 28721!:mime text/x-script.python 28722 28723 28724# from module.submodule import func1, func2 287250 search/8192 import 28726>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable 28727!:strength + 15 28728!:mime text/x-script.python 28729 28730# def __init__ (self, ...): 287310 search/4096 def\ __init__ 28732>&0 search/64 self Python script text executable 28733!:strength + 15 28734!:mime text/x-script.python 28735 28736# if __name__ == "__main__": 287370 search/4096 if\ __name__ 28738>&0 search/64 '__main__' Python script text executable 28739>&0 search/64 "__main__" Python script text executable 28740!:strength + 15 28741!:mime text/x-script.python 28742 28743# import module [as abrev] 287440 search/8192 import 28745>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 28746!:mime text/x-script.python 28747 28748# comments 28749#0 search/4096 ''' 28750#>&0 regex .*'''$ Python script text executable 28751#!:mime text/x-script.python 28752 28753#0 search/4096 """ 28754#>&0 regex .*"""$ Python script text executable 28755#!:mime text/x-script.python 28756 28757# try: 28758# except: or finally: 28759# block 287600 search/4096 try: 28761>&0 regex \^[[:space:]]*except.*:$ Python script text executable 28762!:strength + 15 28763!:mime text/x-script.python 28764>&0 search/4096 finally: Python script text executable 28765!:mime text/x-script.python 28766 28767# class name[(base classes,)]: [pass] 287680 search/8192 class 28769>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 28770!:strength + 15 28771!:mime text/x-script.python 28772 28773# def name(*args, **kwargs): 287740 search/8192 def\ 28775>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 28776>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 28777!:strength + 15 28778!:mime text/x-script.python 28779 28780# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html 287810 string \223NUMPY NumPy data file 28782!:mime application/x-numpy-data 28783>6 byte x \b, version %d 28784>7 byte x \b.%d 28785#>8 leshort x \b, header length=%d 28786>10 string x \b, description %s 28787 28788#------------------------------------------------------------------------------ 28789# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $ 28790# qt: file(1) magic for Qt 28791 28792# https://doc.qt.io/qt-5/resources.html 287930 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 28794 28795# https://qt.gitorious.org/qt/qtbase/source/\ 28796# 5367fa356233da4c0f28172a8f817791525f5457:\ 28797# src/tools/rcc/rcc.cpp#L840 287980 string qres\0\0 Qt Binary Resource file 287990 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 28800 28801# https://qt.gitorious.org/qt/qtbase/source/\ 28802# 5367fa356233da4c0f28172a8f817791525f5457:\ 28803# src/corelib/kernel/qtranslator.cpp#L62 288040 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 28805>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 28806 28807#------------------------------------------------------------------------------ 28808# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $ 28809# file(1) magic for revision control files 28810# From Hendrik Scholz <hendrik@scholz.net> 288110 string/t /1\ :pserver: cvs password text file 28812 28813# Conary changesets 28814# From: Jonathan Smith <smithj@rpath.com> 288150 belong 0xea3f81bb Conary changeset data 28816 28817# Type: Git bundles (git-bundle) 28818# From: Josh Triplett <josh@freedesktop.org> 288190 string #\ v2\ git\ bundle\n Git bundle 28820 28821# Type: Git pack 28822# From: Adam Buchbinder <adam.buchbinder@gmail.com> 28823# Update: Joerg Jenderek 28824# URL: http://fileformats.archiveteam.org/wiki/Git 28825# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 28826# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 28827# those have a little-endian offset immediately following the magic 'PACK', 28828# the first byte of which is never 0, while the first byte of the Git pack 28829# version, since it's a tiny number stored in big-endian format, is always 0. 288300 string PACK 28831# GRR: line above is too general as it matches also PackDir archive ./acorn 28832# test for major version. Git 2017 accepts version number 2 or 3 28833>4 ubelong <9 28834# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 28835# or SystemDevice::foobar 28836>>9 search/13 :: 28837# but in git binary 28838>>9 default x Git pack 28839!:mime application/x-git 28840!:ext pack 28841# 4 GB limit implies unsigned integer 28842>>>4 ubelong x \b, version %u 28843>>>8 ubelong x \b, %u objects 28844 28845# Type: Git pack index 28846# From: Adam Buchbinder <adam.buchbinder@gmail.com> 288470 string \377tOc Git pack index 28848>4 belong =2 \b, version 2 28849 28850# Type: Git index file 28851# From: Frederic Briare <fbriere@fbriere.net> 288520 string DIRC Git index 28853>4 belong >0 \b, version %d 28854>>8 belong >0 \b, %d entries 28855 28856# Type: Mercurial bundles 28857# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 288580 string HG10 Mercurial bundle, 28859>4 string UN uncompressed 28860>4 string BZ bzip2 compressed 28861 28862# Type: Subversion (SVN) dumps 28863# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 288640 string SVN-fs-dump-format-version: Subversion dumpfile 28865>28 string >\0 (version: %s) 28866 28867# Type: Bazaar revision bundles and merge requests 28868# URL: https://www.bazaar-vcs.org/ 28869# From: Jelmer Vernooij <jelmer@samba.org> 288700 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 288710 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 28872 28873#------------------------------------------------------------------------------ 28874# $File: riff,v 1.42 2020/07/17 19:18:56 christos Exp $ 28875# riff: file(1) magic for RIFF format 28876# See 28877# 28878# https://www.seanet.com/users/matts/riffmci/riffmci.htm 28879# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 28880# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 28881# 28882 28883# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 288840 name riff-wave 28885>0 leshort 0x01 \b, Microsoft PCM 28886>>14 leshort >0 28887>>>14 leshort <1024 \b, %d bit 28888>0 leshort 0x02 \b, Microsoft ADPCM 28889>0 leshort 0x03 \b, IEEE Float 28890>0 leshort 0x04 \b, Compaq VSELP 28891>0 leshort 0x05 \b, IBM CVSD 28892>0 leshort 0x06 \b, ITU G.711 A-law 28893>0 leshort 0x07 \b, ITU G.711 mu-law 28894>0 leshort 0x08 \b, Microsoft DTS 28895>0 leshort 0x10 \b, OKI ADPCM 28896>0 leshort 0x11 \b, IMA ADPCM 28897>0 leshort 0x12 \b, MediaSpace ADPCM 28898>0 leshort 0x13 \b, Sierra ADPCM 28899>0 leshort 0x14 \b, ITU G.723 ADPCM (Yamaha) 28900>0 leshort 0x15 \b, DSP Solutions DIGISTD 28901>0 leshort 0x16 \b, DSP Solutions DIGIFIX 28902>0 leshort 0x17 \b, Dialogic OKI ADPCM 28903>0 leshort 0x18 \b, MediaVision ADPCM 28904>0 leshort 0x19 \b, HP CU 28905>0 leshort 0x20 \b, Yamaha ADPCM 28906>0 leshort 0x21 \b, Speech Compression SONARC 28907>0 leshort 0x22 \b, DSP Group True Speech 28908>0 leshort 0x23 \b, Echo Speech EchoSC1 28909>0 leshort 0x24 \b, AudioFile AF36 28910>0 leshort 0x25 \b, APTX 28911>0 leshort 0x26 \b, AudioFile AF10 28912>0 leshort 0x27 \b, Prosody 1612 28913>0 leshort 0x28 \b, LRC 28914>0 leshort 0x30 \b, Dolby AC2 28915>0 leshort 0x31 \b, GSM 6.10 28916>0 leshort 0x32 \b, MSN Audio 28917>0 leshort 0x33 \b, Antex ADPCME 28918>0 leshort 0x34 \b, Control Res VQLPC 28919>0 leshort 0x35 \b, Digireal 28920>0 leshort 0x36 \b, DigiADPCM 28921>0 leshort 0x37 \b, Control Res CR10 28922>0 leshort 0x38 \b, NMS VBXADPCM 28923>0 leshort 0x39 \b, Roland RDAC 28924>0 leshort 0x3A \b, Echo Speech EchoSC3 28925>0 leshort 0x3B \b, Rockwell ADPCM 28926>0 leshort 0x3C \b, Rockwell Digitalk 28927>0 leshort 0x3D \b, Xebec 28928>0 leshort 0x40 \b, ITU G.721 ADPCM 28929>0 leshort 0x41 \b, ITU G.728 CELP 28930>0 leshort 0x42 \b, MSG723 28931>0 leshort 0x50 \b, MPEG 28932>0 leshort 0x52 \b, RT24 28933>0 leshort 0x53 \b, PAC 28934>0 leshort 0x55 \b, MPEG Layer 3 28935>0 leshort 0x59 \b, Lucent G.723 28936>0 leshort 0x60 \b, Cirrus 28937>0 leshort 0x61 \b, ESPCM 28938>0 leshort 0x62 \b, Voxware 28939>0 leshort 0x63 \b, Canopus Atrac 28940>0 leshort 0x64 \b, ITU G.726 ADPCM 28941>0 leshort 0x65 \b, ITU G.722 ADPCM 28942>0 leshort 0x66 \b, DSAT 28943>0 leshort 0x67 \b, DSAT Display 28944>0 leshort 0x69 \b, Voxware Byte Aligned 28945>0 leshort 0x70 \b, Voxware AC8 28946>0 leshort 0x71 \b, Voxware AC10 28947>0 leshort 0x72 \b, Voxware AC16 28948>0 leshort 0x73 \b, Voxware AC20 28949>0 leshort 0x74 \b, Voxware MetaVoice 28950>0 leshort 0x75 \b, Voxware MetaSound 28951>0 leshort 0x76 \b, Voxware RT29HW 28952>0 leshort 0x77 \b, Voxware VR12 28953>0 leshort 0x78 \b, Voxware VR18 28954>0 leshort 0x79 \b, Voxware TQ40 28955>0 leshort 0x80 \b, Softsound 28956>0 leshort 0x81 \b, Voxware TQ60 28957>0 leshort 0x82 \b, MSRT24 28958>0 leshort 0x83 \b, ITU G.729A 28959>0 leshort 0x84 \b, MVI MV12 28960>0 leshort 0x85 \b, DF G.726 28961>0 leshort 0x86 \b, DF GSM610 28962>0 leshort 0x88 \b, ISIAudio 28963>0 leshort 0x89 \b, Onlive 28964>0 leshort 0x91 \b, SBC24 28965>0 leshort 0x92 \b, Dolby AC3 S/PDIF 28966>0 leshort 0x97 \b, ZyXEL ADPCM 28967>0 leshort 0x98 \b, Philips LPCBB 28968>0 leshort 0x99 \b, Packed 28969>0 leshort 0x100 \b, Rhetorex ADPCM 28970>0 leshort 0x101 \b, BeCubed Software IRAT 28971>0 leshort 0x111 \b, Vivo G.723 28972>0 leshort 0x112 \b, Vivo Siren 28973>0 leshort 0x123 \b, Digital G.723 28974>0 leshort 0x200 \b, Creative ADPCM 28975>0 leshort 0x202 \b, Creative FastSpeech8 28976>0 leshort 0x203 \b, Creative FastSpeech10 28977>0 leshort 0x220 \b, Quarterdeck 28978>0 leshort 0x300 \b, FM Towns Snd 28979>0 leshort 0x400 \b, BTV Digital 28980>0 leshort 0x680 \b, VME VMPCM 28981>0 leshort 0x1000 \b, OLIGSM 28982>0 leshort 0x1001 \b, OLIADPCM 28983>0 leshort 0x1002 \b, OLICELP 28984>0 leshort 0x1003 \b, OLISBC 28985>0 leshort 0x1004 \b, OLIOPR 28986>0 leshort 0x1100 \b, LH Codec 28987>0 leshort 0x1400 \b, Norris 28988>0 leshort 0x1401 \b, ISIAudio 28989>0 leshort 0x1500 \b, Soundspace Music Compression 28990>0 leshort 0x2000 \b, AC3 DVM 28991>0 leshort 0x2001 \b, DTS 28992>2 leshort =1 \b, mono 28993>2 leshort =2 \b, stereo 28994>2 leshort >2 28995>>2 leshort <128 \b, %d channels 28996>4 lelong >0 28997>>4 lelong <1000000 %d Hz 28998 28999# try to find "fmt " 290000 name riff-walk 29001>0 string fmt\x20 29002>>4 lelong >15 29003>>>8 use riff-wave 29004>0 string LIST 29005>>&(4.l+4) use riff-walk 29006>0 string DISP 29007>>&(4.l+4) use riff-walk 29008>0 string bext 29009>>&(4.l+4) use riff-walk 29010>0 string Fake 29011>>&(4.l+4) use riff-walk 29012>0 string fact 29013>>&(4.l+4) use riff-walk 29014>0 string VP8 29015>>11 byte 0x9d 29016>>>12 byte 0x01 29017>>>>13 byte 0x2a \b, VP8 encoding 29018>>>>>14 leshort&0x3fff x \b, %d 29019>>>>>16 leshort&0x3fff x \bx%d, Scaling: 29020>>>>>14 leshort&0xc000 0x0000 \b [none] 29021>>>>>14 leshort&0xc000 0x1000 \b [5/4] 29022>>>>>14 leshort&0xc000 0x2000 \b [5/3] 29023>>>>>14 leshort&0xc000 0x3000 \b [2] 29024>>>>>14 leshort&0xc000 0x0000 \bx[none] 29025>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 29026>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 29027>>>>>14 leshort&0xc000 0x3000 \bx[2] 29028>>>>>15 byte&0x80 =0x00 \b, YUV color 29029>>>>>15 byte&0x80 =0x80 \b, bad color specification 29030>>>>>15 byte&0x40 =0x40 \b, no clamping required 29031>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 29032#>0 string x we got %s 29033#>>&(4.l+4) use riff-walk 29034 29035# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 29036# 290370 string RIFF RIFF (little-endian) data 29038# RIFF Palette format 29039# Update: Joerg Jenderek 29040# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 29041# Reference: https://worms2d.info/Palette_file 29042# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 29043>8 string PAL\ \b, palette 29044!:mime application/x-riff 29045# color palette by Microsoft Corporation 29046!:ext pal 29047# file size = chunk size + 8 in most cases 29048>>4 ulelong+8 x \b, %u bytes 29049# Extended PAL Format 29050>>12 string plth \b, extended 29051# Simple PAL Format 29052>>12 string data 29053# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 29054>>>16 ulelong x \b, data size %u 29055# palVersion is always 0x0300 29056#>>>20 leshort x \b, version 0x%4.4x 29057# palNumEntries specifies the number of palette color entries 29058>>>22 uleshort x \b, %u entries 29059# after palPalEntry sized (number of color entries * 4 ) vector 29060>>>(22.s*4) ubequad x 29061# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 29062# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 29063>>>>&16 ubelong x \b, extra bytes 29064>>>>>&-4 ubelong >0 0x%8.8x 29065# RIFF Device Independent Bitmap format 29066# URL: http://fileformats.archiveteam.org/wiki/RDIB 29067>8 string RDIB \b, device-independent bitmap 29068!:ext rdi/dib 29069>>16 string BM 29070>>>30 leshort 12 \b, OS/2 1.x format 29071>>>>34 leshort x \b, %d x 29072>>>>36 leshort x %d 29073>>>30 leshort 64 \b, OS/2 2.x format 29074>>>>34 leshort x \b, %d x 29075>>>>36 leshort x %d 29076>>>30 leshort 40 \b, Windows 3.x format 29077>>>>34 lelong x \b, %d x 29078>>>>38 lelong x %d x 29079>>>>44 leshort x %d 29080# RIFF MIDI format 29081# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDI 29082>8 string RMID \b, MIDI 29083# http://extension.nirsoft.net/rmi 29084!:mime audio/mid 29085#!:mime audio/x-rmid 29086!:ext rmi 29087# RIFF Multimedia Movie File format 29088# URL: http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie 29089>8 string RMMP \b, multimedia movie 29090!:mime video/x-mmm 29091!:ext mmm 29092# RIFF wrapper for MP3 29093>8 string RMP3 \b, MPEG Layer 3 audio 29094#!:mime audio/x-rmp3 29095# Microsoft WAVE format (*.wav) 29096# URL: http://fileformats.archiveteam.org/wiki/WAV 29097>8 string WAVE \b, WAVE audio 29098#!:mime audio/vnd.wave 29099!:mime audio/x-wav 29100# https://www.macdisk.com/macsigen.php 29101#!:apple ????WAVE 29102!:ext wav/wave 29103>>12 string >\0 29104>>>12 use riff-walk 29105# Update: Joerg Jenderek 29106# lower case for Corel Draw version 8 Bidi 29107>8 string/c cdr 29108# skip Corel CCX Clipart 29109>>8 string !CDRXcont 29110# Corel Draw Picture 29111>>>0 use corel-draw 29112# URL: http://fileformats.archiveteam.org/wiki/CCX_(Corel) 29113# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml 29114>>8 string =CDRXcont \b, Corel Clipart 29115!:mime application/x-corel-ccx 29116!:ext ccx 29117# 3rd chunk data {Corel\040Binary\040Meta\040File} 29118#>>>20 string x \b, 3rd '%-s' 29119>>>4 ulelong+8 x \b, %u bytes 29120# From: Joerg Jenderek 29121# URL: https://en.wikipedia.org/wiki/CorelDRAW 29122# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 29123# Picture templates created by newer software start with RIFF type CDT 29124>8 string CDT 29125>>0 use corel-draw 29126# Picture templates with version 4.4 29127>8 string CDST 29128>>0 use corel-draw 29129# pattern created by newer software start with RIFF type PAT 29130>8 string PAT 29131>>0 use corel-draw 29132# From: Joerg Jenderek 29133# URL: https://en.wikipedia.org/wiki/Corel_Designer 29134# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 29135>8 string DES 29136>>8 string !DESC 29137>>>0 use corel-des 29138# Corel Draw templates with version 12.5 or Corel Designer illustration 12 29139>>8 string =DESC 29140# MORE TESTS NEEDED HERE! 29141#>>>0 use corel-des 29142#>>>0 use corel-draw 29143>8 string NUNDROOT \b, Steinberg CuBase 29144# AVI == Audio Video Interleave 29145# Reference: http://fileformats.archiveteam.org/wiki/AVI 29146>8 string AVI\040 \b, AVI 29147# https://reposcope.com/mimetype/video/x-msvideo 29148!:mime video/x-msvideo 29149# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 29150#!:mime video/vnd.avi 29151!:ext avi/divx 29152>>12 string LIST 29153>>>20 string hdrlavih 29154>>>>&36 lelong x \b, %u x 29155>>>>&40 lelong x %u, 29156>>>>&4 lelong >1000000 <1 fps, 29157>>>>&4 lelong 1000000 1.00 fps, 29158>>>>&4 lelong 500000 2.00 fps, 29159>>>>&4 lelong 333333 3.00 fps, 29160>>>>&4 lelong 250000 4.00 fps, 29161>>>>&4 lelong 200000 5.00 fps, 29162>>>>&4 lelong 166667 6.00 fps, 29163>>>>&4 lelong 142857 7.00 fps, 29164>>>>&4 lelong 125000 8.00 fps, 29165>>>>&4 lelong 111111 9.00 fps, 29166>>>>&4 lelong 100000 10.00 fps, 29167# ]9.9,10.1[ 29168>>>>&4 lelong <101010 29169>>>>>&-4 lelong >99010 29170>>>>>>&-4 lelong !100000 ~10 fps, 29171>>>>&4 lelong 83333 12.00 fps, 29172# ]11.9,12.1[ 29173>>>>&4 lelong <84034 29174>>>>>&-4 lelong >82645 29175>>>>>>&-4 lelong !83333 ~12 fps, 29176>>>>&4 lelong 66667 15.00 fps, 29177# ]14.9,15.1[ 29178>>>>&4 lelong <67114 29179>>>>>&-4 lelong >66225 29180>>>>>>&-4 lelong !66667 ~15 fps, 29181>>>>&4 lelong 50000 20.00 fps, 29182>>>>&4 lelong 41708 23.98 fps, 29183>>>>&4 lelong 41667 24.00 fps, 29184# ]23.9,24.1[ 29185>>>>&4 lelong <41841 29186>>>>>&-4 lelong >41494 29187>>>>>>&-4 lelong !41708 29188>>>>>>>&-4 lelong !41667 ~24 fps, 29189>>>>&4 lelong 40000 25.00 fps, 29190# ]24.9,25.1[ 29191>>>>&4 lelong <40161 29192>>>>>&-4 lelong >39841 29193>>>>>>&-4 lelong !40000 ~25 fps, 29194>>>>&4 lelong 33367 29.97 fps, 29195>>>>&4 lelong 33333 30.00 fps, 29196# ]29.9,30.1[ 29197>>>>&4 lelong <33445 29198>>>>>&-4 lelong >33223 29199>>>>>>&-4 lelong !33367 29200>>>>>>>&-4 lelong !33333 ~30 fps, 29201>>>>&4 lelong <32224 >30 fps, 29202##>>>>&4 lelong x (%lu) 29203##>>>>&20 lelong x %lu frames, 29204# Note: The tests below assume that the AVI has 1 or 2 streams, 29205# "vids" optionally followed by "auds". 29206# (Should cover 99.9% of all AVIs.) 29207# assuming avih length = 56 29208>>>88 string LIST 29209>>>>96 string strlstrh 29210>>>>>108 string vids video: 29211>>>>>>&0 lelong 0 uncompressed 29212# skip past vids strh 29213>>>>>>(104.l+108) string strf 29214>>>>>>>(104.l+132) lelong 1 RLE 8bpp 29215>>>>>>>(104.l+132) string/c anim Intel RDX 29216>>>>>>>(104.l+132) string/c aur2 AuraVision Aura 2 29217>>>>>>>(104.l+132) string/c aura AuraVision Aura 29218>>>>>>>(104.l+132) string/c bt20 Brooktree MediaStream 29219>>>>>>>(104.l+132) string/c btcv Brooktree Composite Video 29220>>>>>>>(104.l+132) string/c cc12 Intel YUV12 29221>>>>>>>(104.l+132) string/c cdvc Canopus DV 29222>>>>>>>(104.l+132) string/c cham Winnov Caviara Cham 29223>>>>>>>(104.l+132) string/c cljr Proprietary YUV 4 pixels 29224>>>>>>>(104.l+132) string/c cmyk Common Data Format in Printing 29225>>>>>>>(104.l+132) string/c cpla Weitek 4:2:0 YUV Planar 29226>>>>>>>(104.l+132) string/c cvid Cinepak 29227>>>>>>>(104.l+132) string/c cwlt Microsoft Color WLT DIB 29228>>>>>>>(104.l+132) string/c cyuv Creative Labs YUV 29229>>>>>>>(104.l+132) string/c d261 H.261 29230>>>>>>>(104.l+132) string/c d263 H.263 29231>>>>>>>(104.l+132) string/c duck TrueMotion 1.0 29232>>>>>>>(104.l+132) string/c dve2 DVE-2 Videoconferencing 29233>>>>>>>(104.l+132) string/c fljp Field Encoded Motion JPEG 29234>>>>>>>(104.l+132) string/c fvf1 Fractal Video Frame 29235>>>>>>>(104.l+132) string/c gwlt Microsoft Greyscale WLT DIB 29236>>>>>>>(104.l+132) string/c h260 H.260 29237>>>>>>>(104.l+132) string/c h261 H.261 29238>>>>>>>(104.l+132) string/c h262 H.262 29239>>>>>>>(104.l+132) string/c h263 H.263 29240>>>>>>>(104.l+132) string/c h264 H.264 29241>>>>>>>(104.l+132) string/c h265 H.265 29242>>>>>>>(104.l+132) string/c h266 H.266 29243>>>>>>>(104.l+132) string/c h267 H.267 29244>>>>>>>(104.l+132) string/c h268 H.268 29245>>>>>>>(104.l+132) string/c h269 H.269 29246>>>>>>>(104.l+132) string/c i263 Intel I.263 29247>>>>>>>(104.l+132) string/c i420 Intel Indeo 4 29248>>>>>>>(104.l+132) string/c ian Intel RDX 29249>>>>>>>(104.l+132) string/c iclb CellB Videoconferencing Codec 29250>>>>>>>(104.l+132) string/c ilvc Intel Layered Video 29251>>>>>>>(104.l+132) string/c ilvr ITU-T H.263+ 29252>>>>>>>(104.l+132) string/c iraw Intel YUV Uncompressed 29253>>>>>>>(104.l+132) string/c iv30 Intel Indeo 3 29254>>>>>>>(104.l+132) string/c iv31 Intel Indeo 3.1 29255>>>>>>>(104.l+132) string/c iv32 Intel Indeo 3.2 29256>>>>>>>(104.l+132) string/c iv33 Intel Indeo 3.3 29257>>>>>>>(104.l+132) string/c iv34 Intel Indeo 3.4 29258>>>>>>>(104.l+132) string/c iv35 Intel Indeo 3.5 29259>>>>>>>(104.l+132) string/c iv36 Intel Indeo 3.6 29260>>>>>>>(104.l+132) string/c iv37 Intel Indeo 3.7 29261>>>>>>>(104.l+132) string/c iv38 Intel Indeo 3.8 29262>>>>>>>(104.l+132) string/c iv39 Intel Indeo 3.9 29263>>>>>>>(104.l+132) string/c iv40 Intel Indeo 4.0 29264>>>>>>>(104.l+132) string/c iv41 Intel Indeo 4.1 29265>>>>>>>(104.l+132) string/c iv42 Intel Indeo 4.2 29266>>>>>>>(104.l+132) string/c iv43 Intel Indeo 4.3 29267>>>>>>>(104.l+132) string/c iv44 Intel Indeo 4.4 29268>>>>>>>(104.l+132) string/c iv45 Intel Indeo 4.5 29269>>>>>>>(104.l+132) string/c iv46 Intel Indeo 4.6 29270>>>>>>>(104.l+132) string/c iv47 Intel Indeo 4.7 29271>>>>>>>(104.l+132) string/c iv48 Intel Indeo 4.8 29272>>>>>>>(104.l+132) string/c iv49 Intel Indeo 4.9 29273>>>>>>>(104.l+132) string/c iv50 Intel Indeo 5.0 29274>>>>>>>(104.l+132) string/c mpeg MPEG 1 Video Frame 29275>>>>>>>(104.l+132) string/c mjpg Motion JPEG 29276>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 29277>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 29278>>>>>>>(104.l+132) string/c mrca MR Codec 29279>>>>>>>(104.l+132) string/c mrle Run Length Encoding 29280>>>>>>>(104.l+132) string/c msvc Microsoft Video 1 29281>>>>>>>(104.l+132) string/c phmo Photomotion 29282>>>>>>>(104.l+132) string/c qpeq QPEG 1.1 Format Video 29283>>>>>>>(104.l+132) string/c rgbt RGBT 29284>>>>>>>(104.l+132) string/c rle4 Run Length Encoded 4 29285>>>>>>>(104.l+132) string/c rle8 Run Length Encoded 8 29286>>>>>>>(104.l+132) string/c rt21 Intel Indeo 2.1 29287>>>>>>>(104.l+132) string/c rvx Intel RDX 29288>>>>>>>(104.l+132) string/c sdcc Sun Digital Camera Codec 29289>>>>>>>(104.l+132) string/c sfmc Crystal Net SFM Codec 29290>>>>>>>(104.l+132) string/c smsc SMSC 29291>>>>>>>(104.l+132) string/c smsd SMSD 29292>>>>>>>(104.l+132) string/c splc Splash Studios ACM Audio Codec 29293>>>>>>>(104.l+132) string/c sqz2 Microsoft VXtreme Video Codec 29294>>>>>>>(104.l+132) string/c sv10 Sorenson Video R1 29295>>>>>>>(104.l+132) string/c tlms TeraLogic Motion Intraframe Codec A 29296>>>>>>>(104.l+132) string/c tlst TeraLogic Motion Intraframe Codec B 29297>>>>>>>(104.l+132) string/c tm20 TrueMotion 2.0 29298>>>>>>>(104.l+132) string/c tmic TeraLogic Motion Intraframe Codec 2 29299>>>>>>>(104.l+132) string/c tmot TrueMotion Video Compression 29300>>>>>>>(104.l+132) string/c tr20 TrueMotion RT 2.0 29301>>>>>>>(104.l+132) string/c ulti Ultimotion 29302>>>>>>>(104.l+132) string/c uyvy UYVY 4:2:2 byte ordering 29303>>>>>>>(104.l+132) string/c v422 24-bit YUV 4:2:2 format 29304>>>>>>>(104.l+132) string/c v655 16-bit YUV 4:2:2 format 29305>>>>>>>(104.l+132) string/c vcr1 ATI VCR 1.0 29306>>>>>>>(104.l+132) string/c vcr2 ATI VCR 2.0 29307>>>>>>>(104.l+132) string/c vcr3 ATI VCR 3.0 29308>>>>>>>(104.l+132) string/c vcr4 ATI VCR 4.0 29309>>>>>>>(104.l+132) string/c vcr5 ATI VCR 5.0 29310>>>>>>>(104.l+132) string/c vcr6 ATI VCR 6.0 29311>>>>>>>(104.l+132) string/c vcr7 ATI VCR 7.0 29312>>>>>>>(104.l+132) string/c vcr8 ATI VCR 8.0 29313>>>>>>>(104.l+132) string/c vcr9 ATI VCR 9.0 29314>>>>>>>(104.l+132) string/c vdct Video Maker Pro DIB 29315>>>>>>>(104.l+132) string/c vids YUV 4:2:2 CCIR 601 for V422 29316>>>>>>>(104.l+132) string/c vivo Vivo H.263 29317>>>>>>>(104.l+132) string/c vixl VIXL 29318>>>>>>>(104.l+132) string/c vlv1 VLCAP.DRV 29319>>>>>>>(104.l+132) string/c wbvc W9960 29320>>>>>>>(104.l+132) string/c x263 mmioFOURCC('X','2','6','3') 29321>>>>>>>(104.l+132) string/c xlv0 XL Video Decoder 29322>>>>>>>(104.l+132) string/c y211 YUV 2:1:1 Packed 29323>>>>>>>(104.l+132) string/c y411 YUV 4:1:1 Packed 29324>>>>>>>(104.l+132) string/c y41b YUV 4:1:1 Planar 29325>>>>>>>(104.l+132) string/c y41p PC1 4:1:1 29326>>>>>>>(104.l+132) string/c y41t PC1 4:1:1 with transparency 29327>>>>>>>(104.l+132) string/c y42b YUV 4:2:2 Planar 29328>>>>>>>(104.l+132) string/c y42t PC1 4:2:2 with transparency 29329>>>>>>>(104.l+132) string/c yc12 Intel YUV12 Codec 29330>>>>>>>(104.l+132) string/c yuv8 Winnov Caviar YUV8 29331>>>>>>>(104.l+132) string/c yuv9 YUV9 29332>>>>>>>(104.l+132) string/c yuy2 YUY2 4:2:2 byte ordering packed 29333>>>>>>>(104.l+132) string/c yuyv BI_YUYV, Canopus 29334>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 29335>>>>>>>(104.l+132) string/c div3 DivX 3 29336>>>>>>>>112 string/c div3 Low-Motion 29337>>>>>>>>112 string/c div4 Fast-Motion 29338>>>>>>>(104.l+132) string/c divx DivX 4 29339>>>>>>>(104.l+132) string/c dx50 DivX 5 29340>>>>>>>(104.l+132) string/c xvid XviD 29341>>>>>>>(104.l+132) string/c h264 H.264 29342>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 29343>>>>>>>(104.l+132) string/c h264 X.264 or H.264 29344>>>>>>>(104.l+132) lelong 0 29345##>>>>>>>(104.l+132) string x (%.4s) 29346# skip past first (video) LIST 29347>>>>(92.l+96) string LIST 29348>>>>>(92.l+104) string strlstrh 29349>>>>>>(92.l+116) string auds \b, audio: 29350# auds strh length = 56: 29351>>>>>>>(92.l+172) string strf 29352>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 29353>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 29354>>>>>>>>(92.l+180) leshort 0x0006 aLaw 29355>>>>>>>>(92.l+180) leshort 0x0007 uLaw 29356>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 29357>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 29358>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 29359>>>>>>>>(92.l+180) leshort 0x0161 DivX 29360##>>>>>>>>(92.l+180) leshort x (0x%.4x) 29361>>>>>>>>(92.l+182) leshort 1 (mono, 29362>>>>>>>>(92.l+182) leshort 2 (stereo, 29363>>>>>>>>(92.l+182) leshort >2 (%d channels, 29364>>>>>>>>(92.l+184) lelong x %d Hz) 29365# auds strh length = 64: 29366>>>>>>>(92.l+180) string strf 29367>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 29368>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 29369>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 29370>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 29371>>>>>>>>(92.l+188) leshort 0x0161 DivX 29372##>>>>>>>>(92.l+188) leshort x (0x%.4x) 29373>>>>>>>>(92.l+190) leshort 1 (mono, 29374>>>>>>>>(92.l+190) leshort 2 (stereo, 29375>>>>>>>>(92.l+190) leshort >2 (%d channels, 29376>>>>>>>>(92.l+192) lelong x %d Hz) 29377# From: Joerg Jenderek 29378# URL: http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub) 29379# Reference: http://sourceforge.net/projects/virtualdub/files/virtualdub-win/ 29380# 1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp 29381# VirtualDub link handler 29382>8 string VDRM \b, VirtualDub link 29383!:mime video/x-vdr 29384!:ext vdr 29385>>12 string PATH \b, PATH 29386# remote-path to video file 29387>>16 pstring/l x %s 29388# Animated Cursor format 29389# Update: Joerg Jenderek 29390# URL: http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor 29391# Reference: https://www.gdgsoft.com/anituner/help/aniformat.htm 29392>8 string ACON \b, animated cursor 29393!:mime application/x-navi-animation 29394# http://extension.nirsoft.net/ani 29395#!:mime image/ani 29396!:ext ani 29397# INAM tag followed by length of title 29398>>24 string INAM 29399>>>28 pstring/l x "%s" 29400# IART tag followed by length of author 29401>>>(28.l+32) ubelong 0x49415254 29402>>>>&0 pstring/l x %s 29403# SoundFont 2 <mpruett@sgi.com> 29404# URL: http://fileformats.archiveteam.org/wiki/SoundFont_2.0 29405>8 string sfbk \b, SoundFont/Bank 29406!:mime audio/x-sfbk 29407!:ext sf2 29408# MPEG-1 wrapped in a RIFF, apparently 29409# URL: http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html 29410>8 string CDXA \b, wrapped MPEG-1 (CDXA) 29411!:mime video/x-cdxa 29412!:ext mpg/dat 29413# URL: http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM 29414>8 string 4XMV \b, 4X Movie file 29415!:mime video/x-4xmv 29416!:ext 4xm/4xa 29417# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV 29418>8 string AMV\040 \b, AMV 29419# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV) 29420!:mime video/x-amv 29421!:ext amv 29422#!:ext amv/mtv 29423# URL: http://fileformats.archiveteam.org/wiki/WebP 29424>8 string WEBP \b, Web/P image 29425!:mime image/webp 29426!:ext webp 29427>>12 use riff-walk 29428# From: Joerg Jenderek 29429# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDS 29430>8 string MIDS \b, MIDI Stream 29431!:mime audio/x-mids 29432!:ext mds 29433# From: Joerg Jenderek 29434# URL: http://mark0.net/soft-trid-e.html 29435# Reference: http://fileformats.archiveteam.org/wiki/Trd_(TRID) 29436>8 string TRID \b, TrID defs package 29437!:mime application/x-trid-trd 29438!:ext trd 29439# From: Joerg Jenderek 29440# URL: https://en.wikipedia.org/wiki/CorelDRAW 29441# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 29442# Note: Since version 3 CorelDraw Pictures are RIFF based 29443# but data chunks remain proprietary. 29444# Since version 14 til 15 packed as "content/riffData.cdr" and 29445# since 16 "content/root.dat" in ZIP container 29446# TODO: distinguish templates with version 12.5 from Designer illustration 12 29447# display information of RIFF based Corel Draw pictures, templates and patterns 294480 name corel-draw 29449# display second chunk for debugging 29450#>8 string x \b, [8]=%.8s 29451>0 string x \b, Corel Draw 29452#!:mime image/x-coreldraw 29453!:mime application/vnd.corel-draw 29454# used by newer pictures templates 29455>>8 string CDT 29456# used by templates with newer versions since 16 29457>>>12 string =fver Picture template (root.dat) 29458!:ext dat 29459# used by templates with older versions with vrsn tag 29460>>>12 string !fver 29461# used by templates with older versions 14-15 29462>>>>11 string >E Picture template (riffData.cdr) 29463!:ext cdr 29464# used by templates with older versions 11-13 29465>>>>11 string <F Picture template 29466!:ext cdt/cdrt 29467# used by older templates with version 4.4 29468>>8 string CDST Picture template 29469!:ext cdt 29470# used by templates with version 12.5 29471>>8 string DESC Picture template 29472!:ext cdt 29473# used by newer patterns with version 22 29474>>8 string PAT Pattern 29475!:ext dat 29476# remaining older templates, patterns, drawings 29477>>8 default x 29478# pattern with old version 4.y 29479>>>26 ulelong =0x0000206C Pattern 29480!:ext pat 29481# pattern with newer versions 29482>>>26 ulelong =0x00000D2C Pattern 29483!:ext pat 29484# remaining older templates or pictures 29485>>>26 default x 29486# used by older versions 5 - 15 29487>>>>12 string =vrsn 29488# 4th chunk size unequal 282Ch only found for CDR 29489>>>>>26 ulelong !0x0000282c Picture 29490!:ext cdr 29491>>>>>26 default x Picture or template 29492!:ext cdr/cdt 29493# used by newer versions since 16 29494>>>>12 string =fver Picture (root.dat) 29495!:ext dat 29496# version marked by 1 ASCII char: space~3, ... , F~15, ... , N~22, ... R~22 template 29497>11 string x \b, version 29498>11 string >\040 '%-.1s' 29499>0 use corel-version 29500>4 ulelong+8 x \b, %u bytes 29501# 29502# display numeric version of RIFF based Corel after 3rd RIFF tag 295030 name corel-version 29504# for debugging purpose; vrsn for short content; fver for 16 byte size 29505#>12 string x \b, TAG "%-4.4s" 29506# 1st data chunk length 2 implies short content version 29507>16 ulelong 2 29508# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion 29509>>20 uleshort/100 x %u 29510>>20 uleshort%100 >0 \b.%u 29511# for debugging purpose display next chunk like: DISP LIST 29512#>>22 string x \b, 4th "%-4.4s" 29513#>>26 ulelong x \b, 4th SIZE 0x%x 29514# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp 29515#>>(26.l+30) string x \b, 5th "%-4.4s" 29516# 1st data chunk length 10h implies 16 byte content with version info 29517>16 ulelong 0x10 29518>>34 ubyte x %u 29519>>>33 ubyte >0 \b.%u 29520# display information of RIFF based Corel Design formats 295210 name corel-des 29522# display second chunk for debugging 29523#>8 string x \b, [8]=%.8s 29524>12 string x \b, Corel DESIGNER 29525!:mime image/x-corel-des 29526#!:mime application/x-vnd.corel.designer.document 29527# used by Corel Designer with newer versions since 16 29528>12 string =fver graphics (root.dat) 29529!:ext dat 29530# used by Corel Designer templates with older versions with vrsn tag 29531>12 string !fver 29532# used by Corel Designer with versions 14-15 29533>>11 string >D graphics (riffData.cdr) 29534!:ext cdr 29535# used by Corel Designer with versions 10-12 29536>>11 string <E graphics 29537!:ext des 29538# version indicated by last ASCII char of second chunk tag 29539>11 string x \b, version '%-.1s' 29540# but vrsn short content is not always version indicator 29541# exceptions: 'A'~11.4 'B'~12 'C'~12.5 29542>11 string >D 29543>>0 use corel-version 29544# for debugging purpose display next chunk like: DISP LIST 29545#>>22 string x \b, 4th "%-4.4s" 29546#>>26 ulelong x \b, 4th SIZE 0x%x 29547# for debugging purpose display 5th chunk like: LIST osfp 29548#>>(26.l+30) string x \b, 5th "%-4.4s" 29549>4 ulelong+8 x \b, %u bytes 29550# 29551# XXX - some of the below may only appear in little-endian form. 29552# 29553# Also "MV93" appears to be for one form of Macromedia Director 29554# files, and "GDMF" appears to be another multimedia format. 29555# 295560 string RIFX RIFF (big-endian) data 29557# RIFF Palette format 29558>8 string PAL \b, palette 29559>>16 beshort x \b, version %d 29560>>18 beshort x \b, %d entries 29561# RIFF Device Independent Bitmap format 29562>8 string RDIB \b, device-independent bitmap 29563>>16 string BM 29564>>>30 beshort 12 \b, OS/2 1.x format 29565>>>>34 beshort x \b, %d x 29566>>>>36 beshort x %d 29567>>>30 beshort 64 \b, OS/2 2.x format 29568>>>>34 beshort x \b, %d x 29569>>>>36 beshort x %d 29570>>>30 beshort 40 \b, Windows 3.x format 29571>>>>34 belong x \b, %d x 29572>>>>38 belong x %d x 29573>>>>44 beshort x %d 29574# RIFF MIDI format 29575>8 string RMID \b, MIDI 29576# RIFF Multimedia Movie File format 29577>8 string RMMP \b, multimedia movie 29578# Microsoft WAVE format (*.wav) 29579>8 string WAVE \b, WAVE audio 29580>>20 leshort 1 \b, Microsoft PCM 29581>>>34 leshort >0 \b, %d bit 29582>>22 beshort =1 \b, mono 29583>>22 beshort =2 \b, stereo 29584>>22 beshort >2 \b, %d channels 29585>>24 belong >0 %d Hz 29586# Corel Draw Picture big endian not tested by real examples 29587#>8 string CDRA \b, Corel Draw Picture 29588#>8 string CDR6 \b, Corel Draw Picture, version 6 29589>8 string CDR 29590>>0 use \^corel-draw 29591 29592# AVI == Audio Video Interleave 29593>8 string AVI\040 \b, AVI 29594# Animated Cursor format 29595>8 string ACON \b, animated cursor 29596# Notation Interchange File Format (big-endian only) 29597>8 string NIFF \b, Notation Interchange File Format 29598# SoundFont 2 <mpruett@sgi.com> 29599>8 string sfbk SoundFont/Bank 29600 29601#------------------------------------------------------------------------------ 29602# Sony Wave64 29603# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 29604# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 296050 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 29606# 128 bit + total file size (64 bits) so 24 bytes 29607# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 29608>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 29609!:mime audio/x-w64 29610# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 29611>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 29612>>>&10 leshort =1 \b, mono 29613>>>&10 leshort =2 \b, stereo 29614>>>&10 leshort >2 \b, %d channels 29615>>>&12 lelong >0 %d Hz 29616 29617#------------------------------------------------------------------------------ 29618# MBWF/RF64 29619# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf 296200 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 29621!:mime audio/x-wav 29622>40 search/256 fmt\x20 \b 29623>>&6 leshort =1 \b, mono 29624>>&6 leshort =2 \b, stereo 29625>>&6 leshort >2 \b, %d channels 29626>>&8 lelong >0 %d Hz 29627 29628#------------------------------------------------------------------------------ 29629# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $ 29630# rpi: file(1) magic for Raspberry Pi images 29631-44 lelong 0 29632>4 lelong 0 29633>>8 lelong 1 29634>>12 lelong 4 29635>>>16 string 283x 29636>>>>20 lelong 1 29637>>>>>24 lelong 4 29638>>>>>>28 string DTOK 29639>>>>>>>32 lelong 44 29640>>>>>>>>36 lelong 4 29641>>>>>>>>>40 string RPTL Raspberry PI kernel image 29642 29643-56 lelong 0 29644>4 lelong 0 29645>>8 lelong 1 29646>>12 lelong 4 29647>>>16 string 283x 29648>>>>20 lelong 1 29649>>>>>24 lelong 4 29650>>>>>>28 string DTOK 29651>>>>>>>32 lelong 1 29652>>>>>>>>36 lelong 4 29653>>>>>>>>>40 string DDTK8 29654>>>>>>>>>>48 lelong 4 29655>>>>>>>>>>>52 string RPTL Raspberry PI kernel image 29656 29657#------------------------------------------------------------------------------ 29658# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 29659# 29660# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 29661# 296620 belong 0xedabeedb RPM 29663!:mime application/x-rpm 29664>4 byte x v%d 29665>5 byte x \b.%d 29666>6 beshort 1 src 29667>6 beshort 0 bin 29668>>8 beshort 1 i386/x86_64 29669>>8 beshort 2 Alpha/Sparc64 29670>>8 beshort 3 Sparc 29671>>8 beshort 4 MIPS 29672>>8 beshort 5 PowerPC 29673>>8 beshort 6 68000 29674>>8 beshort 7 SGI 29675>>8 beshort 8 RS6000 29676>>8 beshort 9 IA64 29677>>8 beshort 10 Sparc64 29678>>8 beshort 11 MIPSel 29679>>8 beshort 12 ARM 29680>>8 beshort 13 MiNT 29681>>8 beshort 14 S/390 29682>>8 beshort 15 S/390x 29683>>8 beshort 16 PowerPC64 29684>>8 beshort 17 SuperH 29685>>8 beshort 18 Xtensa 29686>>8 beshort 255 noarch 29687>>10 string x %s 29688 29689#delta RPM Daniel Novotny (dnovotny@redhat.com) 296900 string drpm Delta RPM 29691!:mime application/x-rpm 29692>12 string x %s 29693>>8 beshort 11 MIPSel 29694>>8 beshort 12 ARM 29695>>8 beshort 13 MiNT 29696>>8 beshort 14 S/390 29697>>8 beshort 15 S/390x 29698>>8 beshort 16 PowerPC64 29699>>8 beshort 17 SuperH 29700>>8 beshort 18 Xtensa 29701>>10 string x %s 29702 29703#------------------------------------------------------------------------------ 29704# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $ 29705# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages) 29706# see https://en.wikipedia.org/wiki/Rpmsg 29707 297080 string \x76\xe8\x04\x60\xc4\x11\xe3\x86 rpmsg Restricted Permission Message 29709 29710#------------------------------------------------------------------------------ 29711# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $ 29712# rst: ReStructuredText http://docutils.sourceforge.net/rst.html 297130 search/256 \=\= 29714!:strength + 30 29715>&0 regex/256 \^[\=]+$ 29716>>&0 search/512 :Author: ReStructuredText file 29717>>&0 default x 29718>>>&0 regex/512 \^\\.\\.[A-Za-z] ReStructuredText file 29719!:ext rst 29720 29721#------------------------------------------------------------------------------ 29722# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $ 29723# rtf: file(1) magic for Rich Text Format (RTF) 29724# 29725# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 29726# Update: Joerg Jenderek 29727# URL: https://en.wikipedia.org/wiki/Rich_Text_Format 29728# Reference: http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf 29729# http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf 297300 string {\\rtf 29731# skip DROID fmt-355-signature-id-522.rtf by looking for valid version 29732>5 ubyte !0xAB 29733# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version 29734>>5 ubyte !0x5C Rich Text Format data 29735!:mime text/rtf 29736!:apple ????RTF 29737!:ext rtf 29738>>>0 use rtf-info 29739# display information like version, language and code page of RTF 297400 name rtf-info 29741# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf 29742>5 ubyte !0x7b \b, version %c 29743# The word for character set must precede any text or most other control words 29744>6 string \\mac \b, Apple Macintosh 29745>6 string \\pc 29746# control word \pca 29747>>9 ubyte =0x61 \b, IBM PS/2, code page 850 29748>>9 ubyte !0x61 \b, IBM PC, code page 437 29749# unknown character set or ANSI later after control words like 29750# \adeflang1025 \info \title \author \category \manager 29751# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29752#>6 search/105 \\ansi \b, ANSI 29753>6 search/502 \\ansi \b, ANSI 29754>6 default x \b, unknown character set 29755# look for explicit codepage keyword 29756# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29757#>5 search/110 \\ansicpg 29758>5 search/500 \\ansicpg 29759# skip unknown or buggy codepage string 0 like in fdo78502.rtf 29760>>&0 ubyte !0x30 \b, code page 29761# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi 29762>>>&-1 string x %-.3s 29763# skip space or \ and display possible 4th digit of code page string 29764>>>&2 ubyte >0x2F 29765>>>>&-1 ubyte <0x3A \b%c 29766# possible 5th digit of code page string 29767>>>>>&0 ubyte >0x2F 29768>>>>>>&-1 ubyte <0x3A \b%c 29769# look again at version byte to use default clause 29770>5 ubyte x 29771# Default language ID for South Asian/Middle Eastern text 29772# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica 29773# Readme-0.72-Persian.rtf 29774#>6 search/1 \\adeflang \b, default middle east language ID 29775>>6 search/497 \\adeflang \b, default middle east language ID 29776# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 29777>>>&0 string x %.4s 29778# skip \ and NL and show possible 5th digit of language string 29779>>>&4 ubyte >0x2F 29780>>>>&-1 ubyte <0x3A \b%c 29781# else look for default language to be used when the \plain control word is encountered 29782>>6 default x 29783# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29784#>>>6 search/127 \\deflang 29785>>>6 search/505 \\deflang 29786>>>>&0 string >0 \b, default language ID %-.4s 29787# possible 5th digit of language string 29788>>>>&4 ubyte >0x2F 29789>>>>>&-1 ubyte <0x3A \b%c 29790 29791# Reference: http://latex2rtf.sourceforge.net/rtfspec_63.html 29792# Note: no real world example found 297930 string {\\urtf Rich Text Format unicoded data 29794!:mime text/rtf 29795#!:apple ????RTF 29796!:ext rtf 29797>1 use rtf-info 29798 29799# URL: https://en.wikipedia.org/wiki/Microsoft_Word 29800# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Word 29801# Note: called by TrID "Pocket Word document" 29802# by PlanMaker "Pocket Word-Handheld PC" for pwd 29803# by PlanMaker "Pocket Word-Pocket PC" for psw 298040 string {\\pwd Pocket Word document or template 29805# by SoftMaker Office http://extension.nirsoft.net/pwd 29806#!:mime application/msword 29807# https://reposcope.com/mimetype/application/x-pocket-word 29808!:mime application/x-pocket-word 29809# PWD for Handheld PC variant and PSW for Pocket PC variant 29810# PWT for template 29811!:ext pwd/psw/pwt 29812>0 use rtf-info 29813 29814 29815#------------------------------------------------------------------------------ 29816# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $ 29817# ruby: file(1) magic for Ruby scripting language 29818# URL: https://www.ruby-lang.org/ 29819# From: Reuben Thomas <rrt@sc3d.org> 29820 29821# Ruby scripts 298220 search/1/w #!\ /usr/bin/ruby Ruby script text executable 29823!:strength + 15 29824!:mime text/x-ruby 298250 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 29826!:strength + 15 29827!:mime text/x-ruby 298280 search/1 #!/usr/bin/env\ ruby Ruby script text executable 29829!:strength + 15 29830!:mime text/x-ruby 298310 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 29832!:strength + 15 29833!:mime text/x-ruby 29834 29835# What looks like ruby, but does not have a shebang 29836# (modules and such) 29837# From: Lubomir Rintel <lkundrak@v3.sk> 298380 search/8192 require 29839>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' 29840>>0 regex def\ [a-z]|\ do$ 29841>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29842!:strength + 30 29843!:mime text/x-ruby 298440 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 29845>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 29846>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29847!:strength + 30 29848!:mime text/x-ruby 29849# Classes with no modules or defs, beats simple ASCII 298500 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 29851>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 29852!:strength + 10 29853!:mime text/x-ruby 29854# Looks for function definition to balance python magic 29855# def name (args) 29856# end 298570 search/8192 def\ 29858>0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 29859>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29860!:strength + 10 29861!:mime text/x-ruby 29862 298630 search/8192 require 29864>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text 29865!:mime text/x-ruby 298660 search/8192 include 29867>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 29868!:mime text/x-ruby 29869 29870#------------------------------------------------------------------------------ 29871# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 29872# sc: file(1) magic for "sc" spreadsheet 29873# 2987438 string Spreadsheet sc spreadsheet file 29875!:mime application/x-sc 29876 29877#------------------------------------------------------------------------------ 29878# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $ 29879# sccs: file(1) magic for SCCS archives 29880# 29881# SCCS v4 archive structure: 29882# \001h01207 29883# \001s 00276/00000/00000 29884# \001d D 1.1 87/09/23 08:09:20 ian 1 0 29885# \001c date and time created 87/09/23 08:09:20 by ian 29886# \001e 29887# \001u 29888# \001U 29889# ... etc. 29890# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 29891# *Sigh*. And these both came from various parts of the USG. 29892# Maybe we should just switch everybody from SCCS to RCS! 29893# Further, you can't just say '\001h0', because the five-digit number 29894# is a checksum that could (presumably) have any leading digit, 29895# Fortunately we have regular expression matching: 298960 string \001h 29897>2 regex [0-9][0-9][0-9][0-9][0-9]$ 29898>>8 string \001s\040 SCCS v4 archive data 29899>2 string V6,sum= SCCS v6 archive data 29900 29901#------------------------------------------------------------------------------ 29902# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $ 29903# scientific: file(1) magic for scientific formats 29904# 29905# From: Joe Krahn <krahn@niehs.nih.gov> 29906 29907######################################################## 29908# CCP4 data and plot files: 299090 string MTZ\040 MTZ reflection file 29910 2991192 string PLOT%%84 Plot84 plotting file 29912>52 byte 1 , Little-endian 29913>55 byte 1 , Big-endian 29914 29915######################################################## 29916# Electron density MAP/MASK formats 29917 299180 string EZD_MAP NEWEZD Electron Density Map 29919109 string MAP\040( Old EZD Electron Density Map 29920 299210 string/c :-)\040Origin BRIX Electron Density Map 29922>170 string >0 , Sigma:%.12s 29923#>4 string >0 %.178s 29924#>4 addr x %.178s 29925 299267 string 18\040!NTITLE XPLOR ASCII Electron Density Map 299279 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 29928 29929208 string MAP\040 CCP4 Electron Density Map 29930# Assumes same stamp for float and double (normal case) 29931>212 byte 17 \b, Big-endian 29932>212 byte 34 \b, VAX format 29933>212 byte 68 \b, Little-endian 29934>212 byte 85 \b, Convex native 29935 29936############################################################ 29937# X-Ray Area Detector images 299380 string R-AXIS4\ \ \ R-Axis Area Detector Image: 29939>796 lelong <20 Little-endian, IP #%d, 29940>>768 lelong >0 Size=%dx 29941>>772 lelong >0 \b%d 29942>796 belong <20 Big-endian, IP #%d, 29943>>768 belong >0 Size=%dx 29944>>772 belong >0 \b%d 29945 299460 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 29947>796 lelong <20 Little-endian, IP #%d, 29948>>768 lelong >0 Size=%dx 29949>>772 lelong >0 \b%d 29950>796 belong <20 Big-endian, IP #%d, 29951>>768 belong >0 Size=%dx 29952>>772 belong >0 \b%d 29953 29954 299551028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 29956>1072 ulong >1 Compressed(%d), 29957>1100 ulong >1 %d headers, 29958>1104 ulong >0 %d x 29959>1108 ulong >0 %d, 29960>1120 ulong >0 %d bits/pixel 29961 29962# Type: GEDCOM genealogical (family history) data 29963# From: Giuseppe Bilotta 299640 search/1/c 0\ HEAD GEDCOM genealogy text 29965>&0 search 1\ GEDC 29966>>&0 search 2\ VERS version 29967>>>&1 string >\0 %s 29968# From: Phil Endecott <phil05@chezphil.org> 299690 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 299700 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 299710 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 299720 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 29973 29974# PDB: Protein Data Bank files 29975# Adam Buchbinder <adam.buchbinder@gmail.com> 29976# 29977# https://www.wwpdb.org/documentation/format32/sect2.html 29978# https://www.ch.ic.ac.uk/chemime/ 29979# 29980# The PDB file format is fixed-field, 80 columns. From the spec: 29981# 29982# COLS DATA 29983# 1 - 6 "HEADER" 29984# 11 - 50 String(40) 29985# 51 - 59 Date 29986# 63 - 66 IDcode 29987# 29988# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 29989# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 29990# uppercase letters. However, examples have been seen without the date string, 29991# e.g., the example on the chemime site. 299920 string HEADER\ \ \ \040 29993>&0 regex/1l \^.{40} 29994>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 29995>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 29996>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 29997!:mime chemical/x-pdb 29998>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 29999 30000# Type: GDSII Stream file 300010 belong 0x00060002 GDSII Stream file 30002>4 byte 0x00 30003>>5 byte x version %d.0 30004>4 byte >0x00 version %d 30005>>5 byte x \b.%d 30006 30007# Type: LXT (interLaced eXtensible Trace) 30008# chrysn <chrysn@fsfe.org> 300090 beshort 0x0138 interLaced eXtensible Trace (LXT) file 30010>2 beshort >0 (Version %u) 30011 30012#------------------------------------------------------------------------------ 30013# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 300140 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 300150 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 300160 belong 0xedfeedfe Sun 'jks' Java Keystore File data 30017 300180 string \0volume_key volume_key escrow packet 30019# Type: SE Linux policy modules *.pp reference policy 30020# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 30021# URL: https://doc.coker.com.au/computers/selinux-magic 30022# From: Russell Coker <russell@coker.com.au> 30023 300240 lelong 0xf97cff8f SE Linux modular policy 30025>4 lelong x version %d, 30026>8 lelong x %d sections, 30027>>(12.l) lelong 0xf97cff8d 30028>>>(12.l+27) lelong x mod version %d, 30029>>>(12.l+31) lelong 0 Not MLS, 30030>>>(12.l+31) lelong 1 MLS, 30031>>>(12.l+23) lelong 2 30032>>>>(12.l+47) string >\0 module name %s 30033>>>(12.l+23) lelong 1 base 30034 300351 string policy_module( SE Linux policy module source 300362 string policy_module( SE Linux policy module source 30037 300380 string ##\ <summary> SE Linux policy interface source 30039 30040#0 search gen_context( SE Linux policy file contexts 30041 30042#0 search gen_sens( SE Linux policy MLS constraints source 30043 30044#------------------------------------------------------------------------------ 30045# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $ 30046# sendmail: file(1) magic for sendmail config files 30047# 30048# XXX - byte order? 30049# 30050# Update: Joerg Jenderek 30051# GRR: this test is too general as it catches also 30052# READ.ME.FIRST.AWP Sendmail frozen configuration 30053# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 30054# Email_23_f217153422.ts Sendmail frozen configuration 30055# - version \330jK\354 300560 byte 046 30057# https://www.sendmail.com/sm/open_source/docs/older_release_notes/ 30058# freezed configuration file (dbm format?) created from sendmal.cf with -bz 30059# by older sendmail. til version 8.6 support for frozen configuration files is removed 30060# valid version numbers look like "7.14.4" and should be similar to output of commands 30061# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 30062>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 30063# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 30064!:ext fc 30065>>16 string >\0 - version %s 300660 short 0x271c 30067# look for valid version number 30068>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 30069!:ext fc 30070>>16 string >\0 - version %s 30071 30072#------------------------------------------------------------------------------ 30073# sendmail: file(1) magic for sendmail m4(1) files 30074# 30075# From Hendrik Scholz <hendrik@scholz.net> 30076# i.e. files in /usr/share/sendmail/cf/ 30077# 300780 string divert(-1)\n sendmail m4 text file 30079 30080 30081#------------------------------------------------------------------------------ 30082# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $ 30083# sequent: file(1) magic for Sequent machines 30084# 30085# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 30086# For Sequent's multiprocessor systems (incomplete). 300870 lelong 0x00ea BALANCE NS32000 .o 30088>16 lelong >0 not stripped 30089>124 lelong >0 version %d 300900 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 30091>16 lelong >0 not stripped 30092>124 lelong >0 version %d 300930 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 30094>16 lelong >0 not stripped 30095>124 lelong >0 version %d 300960 lelong 0x30ea BALANCE NS32000 standalone executable 30097>16 lelong >0 not stripped 30098>124 lelong >0 version %d 30099# 30100# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 30101# Symmetry magic nums will not be reached if DOS COM comes before them; 30102# byte 0xeb is matched before these get a chance. 301030 leshort 0x12eb SYMMETRY i386 .o 30104>16 lelong >0 not stripped 30105>124 lelong >0 version %d 301060 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 30107>16 lelong >0 not stripped 30108>124 lelong >0 version %d 301090 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 30110>16 lelong >0 not stripped 30111>124 lelong >0 version %d 30112# https://en.wikipedia.org/wiki/Sequent_Computer_Systems 30113# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 30114#0 leshort 0x42eb SYMMETRY i386 standalone executable 301150 leshort 0x42eb 30116# skip unlike negative version 30117>124 lelong >-1 30118# assuming version 28867614 is very low probable 30119>>124 lelong !28867614 SYMMETRY i386 standalone executable 30120>>>16 lelong >0 not stripped 30121>>>124 lelong >0 version %d 30122 30123#------------------------------------------------------------------------------ 30124# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 30125# sereal: file(1) magic the Sereal binary serialization format 30126# 30127# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 30128# 30129# See the specification of the format at 30130# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 30131# 30132# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 30133# doing (byte&0xF0)>>4 here, but unfortunately that's not 30134# supported. So when we print out a message about an unknown format 30135# we'll print out e.g. 0x30 instead of the more human-readable 30136# 0x30>>4. 30137# 30138# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 30139# Sereal.git repository for test Sereal data. 301400 name sereal 30141>4 byte&0x0F x (version %d, 30142>4 byte&0xF0 0x00 uncompressed) 30143>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 30144>4 byte&0xF0 0x20 compressed with incremental Snappy) 30145>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 30146 301470 string/b \=srl Sereal data packet 30148!:mime application/sereal 30149>&0 use sereal 301500 string/b \=\xF3rl Sereal data packet 30151!:mime application/sereal 30152>&0 use sereal 301530 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 30154!:mime application/sereal 30155>&0 use sereal 30156 30157 30158#------------------------------------------------------------------------------ 30159# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $ 30160# sgi: file(1) magic for Silicon Graphics operating systems and applications 30161# 30162# Executable images are handled either in aout (for old-style a.out 30163# files for 68K; they are indistinguishable from other big-endian 32-bit 30164# a.out files) or in mips (for MIPS ECOFF and Ucode files) 30165# 30166 30167# kbd file definitions 301680 string kbd!map kbd map file 30169>8 byte >0 Ver %d: 30170>10 short >0 with %d table(s) 30171 301720 beshort 0x8765 disk quotas file 30173 301740 beshort 0x0506 IRIS Showcase file 30175>2 byte 0x49 - 30176>3 byte x - version %d 301770 beshort 0x0226 IRIS Showcase template 30178>2 byte 0x63 - 30179>3 byte x - version %d 301800 belong 0x5343464d IRIS Showcase file 30181>4 byte x - version %d 301820 belong 0x5443464d IRIS Showcase template 30183>4 byte x - version %d 301840 belong 0xdeadbabe IRIX Parallel Arena 30185>8 belong >0 - version %d 30186 30187# core files 30188# 30189# 32bit core file 301900 belong 0xdeadadb0 IRIX core dump 30191>4 belong 1 of 30192>16 string >\0 '%s' 30193# 64bit core file 301940 belong 0xdeadad40 IRIX 64-bit core dump 30195>4 belong 1 of 30196>16 string >\0 '%s' 30197# N32bit core file 301980 belong 0xbabec0bb IRIX N32 core dump 30199>4 belong 1 of 30200>16 string >\0 '%s' 30201# New style crash dump file 302020 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 30203>36 string >\0 '%s' 30204 30205# Trusted IRIX info 302060 string SGIAUDIT SGI Audit file 30207>8 byte x - version %d 30208>9 byte x \b.%d 30209# 302100 string WNGZWZSC Wingz compiled script 302110 string WNGZWZSS Wingz spreadsheet 302120 string WNGZWZHP Wingz help file 30213# 302140 string #Inventor\040V IRIS Inventor 1.0 file 302150 string #Inventor\040V2 Open Inventor 2.0 file 30216# GLF is OpenGL stream encoding 302170 string glfHeadMagic(); GLF_TEXT 302184 belong 0x7d000000 GLF_BINARY_LSB_FIRST 30219!:strength -30 302204 belong 0x0000007d GLF_BINARY_MSB_FIRST 30221!:strength -30 30222# GLS is OpenGL stream encoding; GLS is the successor of GLF 302230 string glsBeginGLS( GLS_TEXT 302244 belong 0x10000000 GLS_BINARY_LSB_FIRST 30225!:strength -30 302264 belong 0x00000010 GLS_BINARY_MSB_FIRST 30227!:strength -30 30228 30229# Performance Co-Pilot file types 302300 string PmNs PCP compiled namespace (V.0) 302310 string PmN PCP compiled namespace 30232>3 string >\0 (V.%1.1s) 30233#3 lelong 0x84500526 PCP archive 302343 belong 0x84500526 PCP archive 30235>7 byte x (V.%d) 30236#>20 lelong -2 temporal index 30237#>20 lelong -1 metadata 30238#>20 lelong 0 log volume #0 30239#>20 lelong >0 log volume #%d 30240>20 belong -2 temporal index 30241>20 belong -1 metadata 30242>20 belong 0 log volume #0 30243>20 belong >0 log volume #%d 30244>24 string >\0 host: %s 302450 string PCPFolio PCP 30246>9 string Version: Archive Folio 30247>18 string >\0 (V.%s) 302480 string #pmchart PCP pmchart view 30249>9 string Version 30250>17 string >\0 (V%-3.3s) 302510 string #kmchart PCP kmchart view 30252>9 string Version 30253>17 string >\0 (V.%s) 302540 string pmview PCP pmview config 30255>7 string Version 30256>15 string >\0 (V%-3.3s) 302570 string #pmlogger PCP pmlogger config 30258>10 string Version 30259>18 string >\0 (V%1.1s) 302600 string #pmdahotproc PCP pmdahotproc config 30261>13 string Version 30262>21 string >\0 (V%-3.3s) 302630 string PcPh PCP Help 30264>4 string 1 Index 30265>4 string 2 Text 30266>5 string >\0 (V.%1.1s) 302670 string #pmieconf-rules PCP pmieconf rules 30268>16 string >\0 (V.%1.1s) 302693 string pmieconf-pmie PCP pmie config 30270>17 string >\0 (V.%1.1s) 302710 string MMV PCP memory mapped values 30272>4 long x (V.%d) 30273 30274# SpeedShop data files 302750 lelong 0x13130303 SpeedShop data file 30276 30277# mdbm files 302780 lelong 0x01023962 mdbm file, version 0 (obsolete) 302790 string mdbm mdbm file, 30280>5 byte x version %d, 30281>6 byte x 2^%d pages, 30282>7 byte x pagesize 2^%d, 30283>17 byte x hash %d, 30284>11 byte x dataformat %d 30285 30286# Alias Maya files 302870 string/t //Maya\040ASCII Alias Maya Ascii File, 30288>13 string >\0 version %s 302898 string MAYAFOR4 Alias Maya Binary File, 30290>32 string >\0 version %s scene 302918 string MayaFOR4 Alias Maya Binary File, 30292>32 string >\0 version %s scene 302938 string CIMG Alias Maya Image File 302948 string DEEP Alias Maya Image File 30295 30296#------------------------------------------------------------------------------ 30297# $File: sgml,v 1.42 2020/12/12 20:01:47 christos Exp $ 30298# Type: SVG Vectorial Graphics 30299# From: Noel Torres <tecnico@ejerciciosresueltos.com> 303000 string \<?xml\ version= 30301>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30302>>19 search/4096 \<svg SVG Scalable Vector Graphics image 30303!:mime image/svg+xml 30304>>19 search/4096 \<gnc-v2 GnuCash file 30305!:mime application/x-gnucash 303060 string \<svg SVG Scalable Vector Graphics image 30307!:mime image/svg+xml 30308 30309# Sitemap file 303100 string/t \<?xml\ version= 30311>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30312>>19 search/4096 \<urlset XML Sitemap document text 30313!:mime application/xml-sitemap 30314 30315# OpenStreetMap XML (.osm) 30316# https://wiki.openstreetmap.org/wiki/OSM_XML 30317# From: Markus Heidelberg <markus.heidelberg@web.de> 303180 string \<?xml\ version= 30319>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30320>>19 search/4096 \<osm OpenStreetMap XML data 30321 30322# xhtml 303230 string/t \<?xml\ version=" 30324>19 search/4096/cWbt \<!doctype\ html XHTML document text 30325>>15 string >\0 (version %.3s) 30326!:mime text/html 303270 string/t \<?xml\ version=' 30328>19 search/4096/cWbt \<!doctype\ html XHTML document text 30329>>15 string >\0 (version %.3s) 30330!:mime text/html 303310 string/t \<?xml\ version=" 30332>19 search/4096/cWbt \<html broken XHTML document text 30333>>15 string >\0 (version %.3s) 30334!:mime text/html 30335 30336#------------------------------------------------------------------------------ 30337# sgml: file(1) magic for Standard Generalized Markup Language 30338# HyperText Markup Language (HTML) is an SGML document type, 30339# from Daniel Quinlan (quinlan@yggdrasil.com) 30340# adapted to string extensions by Anthon van der Neut <anthon@mnt.org) 303410 search/4096/cWt \<!doctype\ html HTML document text 30342!:mime text/html 30343!:strength + 5 30344 30345# SVG document 30346# https://www.w3.org/TR/SVG/single-page.html 303470 search/4096/cWbt \<!doctype\ svg SVG XML document 30348!:mime image/svg+xml 30349!:strength + 5 30350 303510 search/4096/cwt \<head\> HTML document text 30352!:mime text/html 30353!:strength + 5 303540 search/4096/cWt \<head\ HTML document text 30355!:mime text/html 30356!:strength + 5 303570 search/4096/cwt \<title\> HTML document text 30358!:mime text/html 30359!:strength + 5 303600 search/4096/cWt \<title\ HTML document text 30361!:mime text/html 30362!:strength + 5 303630 search/4096/cwt \<html\> HTML document text 30364!:mime text/html 30365!:strength + 5 303660 search/4096/cWt \<html\ HTML document text 30367!:mime text/html 30368!:strength + 5 303690 search/4096/cwt \<script\> HTML document text 30370!:mime text/html 30371!:strength + 5 303720 search/4096/cWt \<script\ HTML document text 30373!:mime text/html 30374!:strength + 5 303750 search/4096/cwt \<style\> HTML document text 30376!:mime text/html 30377!:strength + 5 303780 search/4096/cWt \<style\ HTML document text 30379!:mime text/html 30380!:strength + 5 303810 search/4096/cwt \<table\> HTML document text 30382!:mime text/html 30383!:strength + 5 303840 search/4096/cWt \<table\ HTML document text 30385!:mime text/html 30386!:strength + 5 30387 303880 search/4096/cwt \<a\ href= HTML document text 30389!:mime text/html 30390!:strength + 5 30391 30392# Extensible markup language (XML), a subset of SGML 30393# from Marc Prud'hommeaux (marc@apocalypse.org) 303940 search/1/cwt \<?xml XML document text 30395!:mime text/xml 30396!:strength + 5 303970 string/t \<?xml\ version\ " XML 30398!:mime text/xml 30399!:strength + 5 304000 string/t \<?xml\ version=" XML 30401!:mime text/xml 30402!:strength + 5 30403>15 string/t >\0 %.3s document text 30404>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 30405>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 304060 string/t \<?xml\ version=' XML 30407!:mime text/xml 30408!:strength + 5 30409>15 string/t >\0 %.3s document text 30410>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 30411>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 304120 search/1/wt \<?XML broken XML document text 30413!:mime text/xml 30414!:strength - 10 30415 30416 30417# SGML, mostly from rph@sq 304180 search/4096/cwt \<!doctype exported SGML document text 304190 search/4096/cwt \<!subdoc exported SGML subdocument text 304200 search/4096/cwt \<!-- exported SGML document text 30421!:strength - 10 30422 30423# Web browser cookie files 30424# (Mozilla, Galeon, Netscape 4, Konqueror..) 30425# Ulf Harnhammar <ulfh@update.uu.se> 304260 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 304270 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 304280 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 30429 30430# XML-based format representing braille pages in a digital format. 30431# 30432# Specification: 30433# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 30434# 30435# Simon Aittamaa <simon.aittamaa@gmail.com> 304360 string \<?xml\ version= 30437>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30438>>19 search/4096 \<pef Portable Embosser Format 30439!:mime application/x-pef+xml 30440 30441#------------------------------------------------------------------------ 30442# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 30443# file(1) magic for sharc files 30444# 30445# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 30446# FutureGroove Music (dsp@futuregroove.de) 30447 30448#------------------------------------------------------------------------ 30449#0 string Draw RiscOS Drawfile 30450#0 string PACK RiscOS PackdDir archive 30451 30452#------------------------------------------------------------------------ 30453# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 30454 30455#0 string =! Assembler source 30456#0 string Analog ADi asm listing file 304570 string .SYSTEM SHARC architecture file 304580 string .system SHARC architecture file 30459 304600 leshort 0x521C SHARC COFF binary 30461>2 leshort >1 , %d sections 30462>>12 lelong >0 , not stripped 30463 30464#------------------------------------------------------------------------------ 30465# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 30466# sinclair: file(1) sinclair QL 30467 30468# additions to /etc/magic by Thomas M. Ott (ThMO) 30469 30470# Sinclair QL floppy disk formats (ThMO) 304710 string =QL5 QL disk dump data, 30472>3 string =A 720 KB, 30473>3 string =B 1.44 MB, 30474>3 string =C 3.2 MB, 30475>4 string >\0 label:%.10s 30476 30477# Sinclair QL OS dump (ThMO) 304780 belong =0x30000 30479>49124 belong <47104 30480>>49128 belong <47104 30481>>>49132 belong <47104 30482>>>>49136 belong <47104 QL OS dump data, 30483>>>>>49148 string >\0 type %.3s, 30484>>>>>49142 string >\0 version %.4s 30485 30486# Sinclair QL firmware executables (ThMO) 304870 string NqNqNq`\004 QL firmware executable (BCPL) 30488 30489# Sinclair QL libraries (was ThMO) 304900 beshort 0xFB01 QDOS object 30491>2 pstring x '%s' 30492 30493# Sinclair QL executables (was ThMO) 304944 belong 0x4AFB QDOS executable 30495>9 pstring x '%s' 30496 30497# Sinclair QL ROM (ThMO) 304980 belong =0x4AFB0001 QL plugin-ROM data, 30499>9 pstring =\0 un-named 30500>9 pstring >\0 named: %s 30501# Type: SiSU Markup Language 30502# URL: http://www.sisudoc.org/ 30503# From: Ralph Amissah <ralph.amissah@gmail.com> 30504 305050 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 30506>5 regex [0-9.]+ %s 30507 305080 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 30509>5 regex [0-9.]+ %s 30510 305110 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 30512>5 regex [0-9.]+ %s 30513 305140 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 30515>5 regex [0-9.]+ %s 30516 305170 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 30518>5 regex [0-9.]+ %s 30519 30520#------------------------------------------------------------------------------ 30521# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 30522# Sketch Drawings: http://sketch.sourceforge.net/ 30523# From: Edwin Mons <e@ik.nu> 305240 search/1 ##Sketch Sketch document text 30525 30526#----------------------------------------------- 30527# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 30528# GNU Smalltalk image, starting at version 1.6.2 30529# From: catull_us@yahoo.com 30530# 305310 string GSTIm\0\0 GNU SmallTalk 30532# little-endian 30533>7 byte&1 =0 LE image version 30534>>10 byte x %d. 30535>>9 byte x \b%d. 30536>>8 byte x \b%d 30537#>>12 lelong x , data: %ld 30538#>>16 lelong x , table: %ld 30539#>>20 lelong x , memory: %ld 30540# big-endian 30541>7 byte&1 =1 BE image version 30542>>8 byte x %d. 30543>>9 byte x \b%d. 30544>>10 byte x \b%d 30545#>>12 belong x , data: %ld 30546#>>16 belong x , table: %ld 30547#>>20 belong x , memory: %ld 30548 30549 30550 30551#------------------------------------------------------------------------------ 30552# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 30553# smile: file(1) magic for Smile serialization 30554# 30555# The Smile serialization format uses a 4-byte header: 30556# 30557# Constant byte #0: 0x3A (ASCII ':') 30558# Constant byte #1: 0x29 (ASCII ')') 30559# Constant byte #2: 0x0A (ASCII linefeed, '\n') 30560# Variable byte #3, consisting of bits: 30561# Bits 4-7 (4 MSB): 4-bit version number 30562# Bits 3: Reserved 30563# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 30564# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 30565# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 30566# 30567# Reference: http://wiki.fasterxml.com/SmileFormatSpec 30568# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 30569 30570# Detection 305710 string :)\n Smile binary data 30572 30573# Versioning 30574>3 byte&0xF0 x version %d: 30575 30576# Properties 30577>3 byte&0x04 0x04 binary raw, 30578>3 byte&0x04 0x00 binary encoded, 30579>3 byte&0x02 0x02 shared String values enabled, 30580>3 byte&0x02 0x00 shared String values disabled, 30581>3 byte&0x01 0x01 shared field names enabled 30582>3 byte&0x01 0x00 shared field names disabled 30583 30584 30585#------------------------------------------------------------------------------ 30586# $File: sniffer,v 1.29 2021/03/13 18:51:51 christos Exp $ 30587# sniffer: file(1) magic for packet capture files 30588# 30589# From: guy@alum.mit.edu (Guy Harris) 30590# 30591 30592# 30593# Microsoft Network Monitor 1.x capture files. 30594# 305950 string RTSS NetMon capture file 30596>5 byte x - version %d 30597>4 byte x \b.%d 30598>6 leshort 0 (Unknown) 30599>6 leshort 1 (Ethernet) 30600>6 leshort 2 (Token Ring) 30601>6 leshort 3 (FDDI) 30602>6 leshort 4 (ATM) 30603>6 leshort >4 (type %d) 30604 30605# 30606# Microsoft Network Monitor 2.x capture files. 30607# 306080 string GMBU NetMon capture file 30609>5 byte x - version %d 30610>4 byte x \b.%d 30611>6 leshort 0 (Unknown) 30612>6 leshort 1 (Ethernet) 30613>6 leshort 2 (Token Ring) 30614>6 leshort 3 (FDDI) 30615>6 leshort 4 (ATM) 30616>6 leshort 5 (IP-over-IEEE 1394) 30617>6 leshort 6 (802.11) 30618>6 leshort 7 (Raw IP) 30619>6 leshort 8 (Raw IP) 30620>6 leshort 9 (Raw IP) 30621>6 leshort >9 (type %d) 30622 30623# 30624# Network General Sniffer capture files. 30625# Sorry, make that "Network Associates Sniffer capture files." 30626# Sorry, make that "Network General old DOS Sniffer capture files." 30627# 306280 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file 30629>33 byte 2 (compressed) 30630>23 leshort x - version %d 30631>25 leshort x \b.%d 30632>32 byte 0 (Token Ring) 30633>32 byte 1 (Ethernet) 30634>32 byte 2 (ARCNET) 30635>32 byte 3 (StarLAN) 30636>32 byte 4 (PC Network broadband) 30637>32 byte 5 (LocalTalk) 30638>32 byte 6 (Znet) 30639>32 byte 7 (Internetwork Analyzer) 30640>32 byte 9 (FDDI) 30641>32 byte 10 (ATM) 30642 30643# 30644# Cinco Networks NetXRay capture files. 30645# Sorry, make that "Network General Sniffer Basic capture files." 30646# Sorry, make that "Network Associates Sniffer Basic capture files." 30647# Sorry, make that "Network Associates Sniffer Basic, and Windows 30648# Sniffer Pro", capture files." 30649# Sorry, make that "Network General Sniffer capture files." 30650# Sorry, make that "NetScout Sniffer capture files." 30651# 306520 string XCP\0 NetXRay capture file 30653>4 string >\0 - version %s 30654>44 leshort 0 (Ethernet) 30655>44 leshort 1 (Token Ring) 30656>44 leshort 2 (FDDI) 30657>44 leshort 3 (WAN) 30658>44 leshort 8 (ATM) 30659>44 leshort 9 (802.11) 30660 30661# 30662# "libpcap" capture files. 30663# https://www.tcpdump.org/manpages/pcap-savefile.5.html 30664# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 30665# the main program that uses that format, but there are other programs 30666# that use "libpcap", or that use the same capture file format.) 30667# 306680 name pcap-be 30669>4 beshort x - version %d 30670>6 beshort x \b.%d 30671# clear that continuation level match 30672>20 clear x 30673>20 belong&0x03FFFFFF 0 (No link-layer encapsulation 30674>20 belong&0x03FFFFFF 1 (Ethernet 30675>20 belong&0x03FFFFFF 2 (3Mb Ethernet 30676>20 belong&0x03FFFFFF 3 (AX.25 30677>20 belong&0x03FFFFFF 4 (ProNET 30678>20 belong&0x03FFFFFF 5 (CHAOS 30679>20 belong&0x03FFFFFF 6 (Token Ring 30680>20 belong&0x03FFFFFF 7 (BSD ARCNET 30681>20 belong&0x03FFFFFF 8 (SLIP 30682>20 belong&0x03FFFFFF 9 (PPP 30683>20 belong&0x03FFFFFF 10 (FDDI 30684>20 belong&0x03FFFFFF 11 (RFC 1483 ATM 30685>20 belong&0x03FFFFFF 12 (Raw IP 30686>20 belong&0x03FFFFFF 13 (BSD/OS SLIP 30687>20 belong&0x03FFFFFF 14 (BSD/OS PPP 30688>20 belong&0x03FFFFFF 19 (Linux ATM Classical IP 30689>20 belong&0x03FFFFFF 50 (PPP or Cisco HDLC 30690>20 belong&0x03FFFFFF 51 (PPP-over-Ethernet 30691>20 belong&0x03FFFFFF 99 (Symantec Enterprise Firewall 30692>20 belong&0x03FFFFFF 100 (RFC 1483 ATM 30693>20 belong&0x03FFFFFF 101 (Raw IP 30694>20 belong&0x03FFFFFF 102 (BSD/OS SLIP 30695>20 belong&0x03FFFFFF 103 (BSD/OS PPP 30696>20 belong&0x03FFFFFF 104 (BSD/OS Cisco HDLC 30697>20 belong&0x03FFFFFF 105 (802.11 30698>20 belong&0x03FFFFFF 106 (Linux Classical IP over ATM 30699>20 belong&0x03FFFFFF 107 (Frame Relay 30700>20 belong&0x03FFFFFF 108 (OpenBSD loopback 30701>20 belong&0x03FFFFFF 109 (OpenBSD IPsec encrypted 30702>20 belong&0x03FFFFFF 112 (Cisco HDLC 30703>20 belong&0x03FFFFFF 113 (Linux cooked v1 30704>20 belong&0x03FFFFFF 114 (LocalTalk 30705>20 belong&0x03FFFFFF 117 (OpenBSD PFLOG 30706>20 belong&0x03FFFFFF 119 (802.11 with Prism header 30707>20 belong&0x03FFFFFF 122 (RFC 2625 IP over Fibre Channel 30708>20 belong&0x03FFFFFF 123 (SunATM 30709>20 belong&0x03FFFFFF 127 (802.11 with radiotap header 30710>20 belong&0x03FFFFFF 129 (Linux ARCNET 30711>20 belong&0x03FFFFFF 130 (Juniper Multi-Link PPP 30712>20 belong&0x03FFFFFF 131 (Juniper Multi-Link Frame Relay 30713>20 belong&0x03FFFFFF 132 (Juniper Encryption Services PIC 30714>20 belong&0x03FFFFFF 133 (Juniper GGSN PIC 30715>20 belong&0x03FFFFFF 134 (Juniper FRF.16 Frame Relay 30716>20 belong&0x03FFFFFF 135 (Juniper ATM2 PIC 30717>20 belong&0x03FFFFFF 136 (Juniper Advanced Services PIC 30718>20 belong&0x03FFFFFF 137 (Juniper ATM1 PIC 30719>20 belong&0x03FFFFFF 138 (Apple IP over IEEE 1394 30720>20 belong&0x03FFFFFF 139 (SS7 MTP2 with pseudo-header 30721>20 belong&0x03FFFFFF 140 (SS7 MTP2 30722>20 belong&0x03FFFFFF 141 (SS7 MTP3 30723>20 belong&0x03FFFFFF 142 (SS7 SCCP 30724>20 belong&0x03FFFFFF 143 (DOCSIS 30725>20 belong&0x03FFFFFF 144 (Linux IrDA 30726>20 belong&0x03FFFFFF 147 (Private use 0 30727>20 belong&0x03FFFFFF 148 (Private use 1 30728>20 belong&0x03FFFFFF 149 (Private use 2 30729>20 belong&0x03FFFFFF 150 (Private use 3 30730>20 belong&0x03FFFFFF 151 (Private use 4 30731>20 belong&0x03FFFFFF 152 (Private use 5 30732>20 belong&0x03FFFFFF 153 (Private use 6 30733>20 belong&0x03FFFFFF 154 (Private use 7 30734>20 belong&0x03FFFFFF 155 (Private use 8 30735>20 belong&0x03FFFFFF 156 (Private use 9 30736>20 belong&0x03FFFFFF 157 (Private use 10 30737>20 belong&0x03FFFFFF 158 (Private use 11 30738>20 belong&0x03FFFFFF 159 (Private use 12 30739>20 belong&0x03FFFFFF 160 (Private use 13 30740>20 belong&0x03FFFFFF 161 (Private use 14 30741>20 belong&0x03FFFFFF 162 (Private use 15 30742>20 belong&0x03FFFFFF 163 (802.11 with AVS header 30743>20 belong&0x03FFFFFF 164 (Juniper Passive Monitor PIC 30744>20 belong&0x03FFFFFF 165 (BACnet MS/TP 30745>20 belong&0x03FFFFFF 166 (PPPD 30746>20 belong&0x03FFFFFF 167 (Juniper PPPoE 30747>20 belong&0x03FFFFFF 168 (Juniper PPPoE/ATM 30748>20 belong&0x03FFFFFF 169 (GPRS LLC 30749>20 belong&0x03FFFFFF 170 (GPF-T 30750>20 belong&0x03FFFFFF 171 (GPF-F 30751>20 belong&0x03FFFFFF 174 (Juniper PIC Peer 30752>20 belong&0x03FFFFFF 175 (Ethernet with Endace ERF header 30753>20 belong&0x03FFFFFF 176 (Packet-over-SONET with Endace ERF header 30754>20 belong&0x03FFFFFF 177 (Linux LAPD 30755>20 belong&0x03FFFFFF 178 (Juniper Ethernet 30756>20 belong&0x03FFFFFF 179 (Juniper PPP 30757>20 belong&0x03FFFFFF 180 (Juniper Frame Relay 30758>20 belong&0x03FFFFFF 181 (Juniper C-HDLC 30759>20 belong&0x03FFFFFF 182 (FRF.16 Frame Relay 30760>20 belong&0x03FFFFFF 183 (Juniper Voice PIC 30761>20 belong&0x03FFFFFF 184 (Arinc 429 30762>20 belong&0x03FFFFFF 185 (Arinc 653 Interpartition Communication 30763>20 belong&0x03FFFFFF 186 (USB with FreeBSD header 30764>20 belong&0x03FFFFFF 187 (Bluetooth HCI H4 30765>20 belong&0x03FFFFFF 188 (802.16 MAC Common Part Sublayer 30766>20 belong&0x03FFFFFF 189 (Linux USB 30767>20 belong&0x03FFFFFF 190 (Controller Area Network (CAN) v. 2.0B 30768>20 belong&0x03FFFFFF 191 (802.15.4 with Linux padding 30769>20 belong&0x03FFFFFF 192 (PPI 30770>20 belong&0x03FFFFFF 193 (802.16 MAC Common Part Sublayer plus radiotap header 30771>20 belong&0x03FFFFFF 194 (Juniper Integrated Service Module 30772>20 belong&0x03FFFFFF 195 (802.15.4 with FCS 30773>20 belong&0x03FFFFFF 196 (SITA 30774>20 belong&0x03FFFFFF 197 (Endace ERF 30775>20 belong&0x03FFFFFF 198 (Ethernet with u10 Networks pseudo-header 30776>20 belong&0x03FFFFFF 199 (IPMB 30777>20 belong&0x03FFFFFF 200 (Juniper Secure Tunnel 30778>20 belong&0x03FFFFFF 201 (Bluetooth HCI H4 with pseudo-header 30779>20 belong&0x03FFFFFF 202 (AX.25 with KISS header 30780>20 belong&0x03FFFFFF 203 (LAPD 30781>20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header 30782>20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header 30783>20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header 30784>20 belong&0x03FFFFFF 209 (Linux IPMB 30785>20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header 30786>20 belong&0x03FFFFFF 216 (Linux evdev events 30787>20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header 30788>20 belong&0x03FFFFFF 220 (Memory-mapped Linux USB 30789>20 belong&0x03FFFFFF 221 (DECT 30790>20 belong&0x03FFFFFF 222 (AOS Space Data Link protocol 30791>20 belong&0x03FFFFFF 223 (Wireless HART 30792>20 belong&0x03FFFFFF 224 (Fibre Channel FC-2 30793>20 belong&0x03FFFFFF 225 (Fibre Channel FC-2 with frame delimiters 30794>20 belong&0x03FFFFFF 226 (Solaris IPNET 30795>20 belong&0x03FFFFFF 227 (SocketCAN 30796>20 belong&0x03FFFFFF 228 (Raw IPv4 30797>20 belong&0x03FFFFFF 229 (Raw IPv6 30798>20 belong&0x03FFFFFF 230 (802.15.4 without FCS 30799>20 belong&0x03FFFFFF 231 (D-Bus messages 30800>20 belong&0x03FFFFFF 232 (Juniper Virtual Server 30801>20 belong&0x03FFFFFF 233 (Juniper SRX E2E 30802>20 belong&0x03FFFFFF 234 (Juniper Fibre Channel 30803>20 belong&0x03FFFFFF 235 (DVB-CI 30804>20 belong&0x03FFFFFF 236 (MUX27010 30805>20 belong&0x03FFFFFF 237 (STANAG 5066 D_PDUs 30806>20 belong&0x03FFFFFF 238 (Juniper ATM CEMIC 30807>20 belong&0x03FFFFFF 239 (Linux netfilter log messages 30808>20 belong&0x03FFFFFF 240 (Hilscher netAnalyzer 30809>20 belong&0x03FFFFFF 241 (Hilscher netAnalyzer with delimiters 30810>20 belong&0x03FFFFFF 242 (IP-over-Infiniband 30811>20 belong&0x03FFFFFF 243 (MPEG-2 Transport Stream packets 30812>20 belong&0x03FFFFFF 244 (ng4t ng40 30813>20 belong&0x03FFFFFF 245 (NFC LLCP 30814>20 belong&0x03FFFFFF 246 (Packet filter state syncing 30815>20 belong&0x03FFFFFF 247 (InfiniBand 30816>20 belong&0x03FFFFFF 248 (SCTP 30817>20 belong&0x03FFFFFF 249 (USB with USBPcap header 30818>20 belong&0x03FFFFFF 250 (Schweitzer Engineering Laboratories RTAC packets 30819>20 belong&0x03FFFFFF 251 (Bluetooth Low Energy air interface 30820>20 belong&0x03FFFFFF 252 (Wireshark Upper PDU export 30821>20 belong&0x03FFFFFF 253 (Linux netlink 30822>20 belong&0x03FFFFFF 254 (Bluetooth Linux Monitor 30823>20 belong&0x03FFFFFF 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets 30824>20 belong&0x03FFFFFF 256 (Bluetooth Low Energy air interface with pseudo-header 30825>20 belong&0x03FFFFFF 257 (PROFIBUS data link layer 30826>20 belong&0x03FFFFFF 258 (Apple DLT_PKTAP 30827>20 belong&0x03FFFFFF 259 (Ethernet with 802.3 Clause 65 EPON preamble 30828>20 belong&0x03FFFFFF 260 (IPMI trace packets 30829>20 belong&0x03FFFFFF 261 (Z-Wave RF profile R1 and R2 packets 30830>20 belong&0x03FFFFFF 262 (Z-Wave RF profile R3 packets 30831>20 belong&0x03FFFFFF 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto 30832>20 belong&0x03FFFFFF 264 (ISO 14443 messages 30833>20 belong&0x03FFFFFF 265 (IEC 62106 Radio Data System groups 30834>20 belong&0x03FFFFFF 266 (USB with Darwin header 30835>20 belong&0x03FFFFFF 267 (OpenBSD DLT_OPENFLOW 30836>20 belong&0x03FFFFFF 268 (IBM SDLC frames 30837>20 belong&0x03FFFFFF 269 (TI LLN sniffer frames 30838>20 belong&0x03FFFFFF 271 (Linux vsock 30839>20 belong&0x03FFFFFF 272 (Nordic Semiconductor Bluetooth LE sniffer frames 30840>20 belong&0x03FFFFFF 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames 30841>20 belong&0x03FFFFFF 274 (802.3br mPackets 30842>20 belong&0x03FFFFFF 275 (DisplayPort AUX channel monitoring data 30843>20 belong&0x03FFFFFF 276 (Linux cooked v2 30844>20 belong&0x03FFFFFF 278 (OpenVizsla USB 30845>20 belong&0x03FFFFFF 279 (Elektrobit High Speed Capture and Replay (EBHSCR) 30846>20 belong&0x03FFFFFF 281 (Broadcom tag 30847>20 belong&0x03FFFFFF 282 (Broadcom tag (prepended) 30848>20 belong&0x03FFFFFF 284 (Marvell DSA 30849>20 belong&0x03FFFFFF 285 (Marvell EDSA 30850>20 belong&0x03FFFFFF 286 (ELEE lawful intercept 30851>20 belong&0x03FFFFFF 287 (Z-Wave serial 30852>20 belong&0x03FFFFFF 288 (USB 2.0 30853>20 belong&0x03FFFFFF 289 (ATSC ALP 30854>20 belong&0x03FFFFFF 290 (Event Tracing for Windows 30855# print default match 30856>20 default x 30857>>20 belong x (linktype#%u 30858>16 belong x \b, capture length %u) 30859 30860# packets time stamps in seconds and microseconds. 308610 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) 30862!:mime application/vnd.tcpdump.pcap 30863>0 use pcap-be 308640 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) 30865!:mime application/vnd.tcpdump.pcap 30866>0 use \^pcap-be 30867 30868# packets time stamps in seconds and nanoseconds. 308690 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) 30870!:mime application/vnd.tcpdump.pcap 30871>0 use pcap-be 308720 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) 30873!:mime application/vnd.tcpdump.pcap 30874>0 use \^pcap-be 30875 30876# 30877# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 30878# 308790 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) 30880>0 use pcap-be 308810 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) 30882>0 use \^pcap-be 30883 30884# 30885# "pcapng" capture files. 30886# https://github.com/pcapng/pcapng 30887# Pcapng files can contain multiple sections. Printing the endianness, 30888# snaplen, or other information from the first SHB may be misleading. 30889# 308900 ubelong 0x0a0d0d0a 30891>8 ubelong 0x1a2b3c4d pcapng capture file 30892>>12 beshort x - version %d 30893>>14 beshort x \b.%d 308940 ulelong 0x0a0d0d0a 30895>8 ulelong 0x1a2b3c4d pcapng capture file 30896>>12 leshort x - version %d 30897>>14 leshort x \b.%d 30898 30899# 30900# AIX "iptrace" capture files. 30901# 309020 string iptrace\0401.0 AIX iptrace capture file 309030 string iptrace\0402.0 AIX iptrace capture file 30904 30905# 30906# Novell LANalyzer capture files. 30907# 309080 leshort 0x1001 Novell LANalyzer capture file 309090 leshort 0x1007 Novell LANalyzer capture file 30910 30911# 30912# HP-UX "nettl" capture files. 30913# 309140 string \x54\x52\x00\x64\x00 HP/UX nettl capture file 30915 30916# 30917# RADCOM WAN/LAN Analyzer capture files. 30918# 309190 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 30920 30921# 30922# NetStumbler log files. Not really packets, per se, but about as 30923# close as you can get. These are log files from NetStumbler, a 30924# Windows program, that scans for 802.11b networks. 30925# 309260 string NetS NetStumbler log file 30927>8 lelong x \b, %d stations found 30928 30929# 30930# *Peek tagged capture files. 30931# 309320 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 30933 30934# 30935# Visual Networks traffic capture files. 30936# 309370 string \x05VNF Visual Networks traffic capture file 30938 30939# 30940# Network Instruments Observer capture files. 30941# 309420 string ObserverPktBuffe Network Instruments Observer capture file 30943 30944# 30945# Files from Accellent Group's 5View products. 30946# 309470 string \xaa\xaa\xaa\xaa 5View capture file 30948 30949#------------------------------------------------------------------------------ 30950# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 30951# softquad: file(1) magic for SoftQuad Publishing Software 30952# 30953# Author/Editor and RulesBuilder 30954# 30955# XXX - byte order? 30956# 309570 string \<!SQ\ DTD> Compiled SGML rules file 30958>9 string >\0 Type %s 309590 string \<!SQ\ A/E> A/E SGML Document binary 30960>9 string >\0 Type %s 309610 string \<!SQ\ STS> A/E SGML binary styles file 30962>9 string >\0 Type %s 309630 short 0xc0de Compiled PSI (v1) data 309640 short 0xc0da Compiled PSI (v2) data 30965>3 string >\0 (%s) 30966# Binary sqtroff font/desc files... 309670 short 0125252 SoftQuad DESC or font file binary 30968>2 short >0 - version %d 30969# Bitmaps... 309700 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 30971#0 string SQ\ BITMAP2 SoftQuad Raster Format data 30972# sqtroff intermediate language (replacement for ditroff int. lang.) 309730 string X\ SoftQuad troff Context intermediate 30974>2 string 495 for AT&T 495 laser printer 30975>2 string hp for Hewlett-Packard LaserJet 30976>2 string impr for IMAGEN imPRESS 30977>2 string ps for PostScript 30978 30979# From: Michael Piefel <piefel@debian.org> 30980# sqtroff intermediate language (replacement for ditroff int. lang.) 309810 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 309820 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 309830 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 309840 string X\ ps SoftQuad troff Context intermediate for PostScript 30985 30986#------------------------------------------------------------------------------ 30987# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $ 30988# SOSI 30989# Summary: Systematic Organization of Spatial Information 30990# Long description: Norwegian text based map format 30991# File extension: .sos 30992# Full name: Petter Reinholdtsen (pere@hungry.com) 30993# Reference: https://en.wikipedia.org/wiki/SOSI 30994# 30995# Example SOSI files available from 30996# https://trac.osgeo.org/gdal/ticket/3638 30997# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/ 30998# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/ 30999# 31000# Start with optional comments (from "!" to the next line end) 31001# followed by ".HODE" and end with "\n.SLUTT" followed by an optional 31002# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at 31003# the start and following ".HODE" near the start there is "..OMR=C3=85DE" 31004# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on 31005# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a 31006# separator, as well as "..SOSI-VERSJON " followed by the format 31007# version and a separator. 31008# 31009# FIXME figure out how to accept any of [space], [tab], [newline] and 31010# [carriage return] as separators, not only line end. 31011 31012# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8 31013# character sets 310140 search ..OMR 31015>0 search ..TRANSPAR 31016>>0 search .HODE SOSI map data 31017>>>&0 search ..SOSI-VERSJON 31018>>>>&1 string x \b, version %s 31019# FIXME could not figure out way to make a match for .SLUTT at the end required 31020#>-7 string \n.SLUTT slutt 31021#>-8 string \n.SLUTT\n slutt-nl 31022#>-9 string \n.SLUTT\r\n slutt-crnl2 31023!:mime text/vnd.sosi 31024!:ext sos 31025 31026#------------------------------------------------------------------------------ 31027# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 31028# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 31029# 31030# Cloyce D. Spradling <cloyce@headgear.org> 31031 310320 string spec SPEC 31033>4 string .cpu CPU 31034>>8 string <: \b%.4s 31035>>12 string . raw result text 31036 3103717 string version=SPECjbb SPECjbb 31038>32 string <: \b%.4s 31039>>37 string <: v%.4s raw result text 31040 310410 string BEGIN\040SPECWEB SPECweb 31042>13 string <: \b%.2s 31043>>15 string _SSL \b_SSL 31044>>>20 string <: v%.4s raw result text 31045>>16 string <: v%.4s raw result text 31046 31047#------------------------------------------------------------------------------ 31048# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $ 31049# spectrum: file(1) magic for Spectrum emulator files. 31050# 31051# John Elliott <jce@seasip.demon.co.uk> 31052 31053# 31054# Spectrum +3DOS header 31055# 310560 string PLUS3DOS\032 Spectrum +3 data 31057>15 byte 0 - BASIC program 31058>15 byte 1 - number array 31059>15 byte 2 - character array 31060>15 byte 3 - memory block 31061>>16 belong 0x001B0040 (screen) 31062>15 byte 4 - Tasword document 31063>15 string TAPEFILE - ZXT tapefile 31064# 31065# Tape file. This assumes the .TAP starts with a Spectrum-format header, 31066# which nearly all will. 31067# 31068# Update: Sanity-check string contents to be printable. 31069# -Adam Buchbinder <adam.buchbinder@gmail.com> 31070# 310710 string \023\000\000 31072>4 string >\0 31073>>4 string <\177 Spectrum .TAP data "%-10.10s" 31074>>>3 byte 0 - BASIC program 31075>>>3 byte 1 - number array 31076>>>3 byte 2 - character array 31077>>>3 byte 3 - memory block 31078>>>>14 belong 0x001B0040 (screen) 31079 31080# The following three blocks are from pak21-spectrum@srcf.ucam.org 31081# TZX tape images 310820 string ZXTape!\x1a Spectrum .TZX data 31083>8 byte x version %d 31084>9 byte x \b.%d 31085 31086# RZX input recording files 310870 string RZX! Spectrum .RZX data 31088>4 byte x version %d 31089>5 byte x \b.%d 31090 31091# Floppy disk images 310920 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 310930 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 310940 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 310950 string SINCLAIR Spectrum .SCL Betadisk image 31096 31097# Hard disk images 310980 string RS-IDE\x1a Spectrum .HDF hard disk image 31099>7 byte x \b, version 0x%02x 31100 31101# SZX snapshots (fuse and spectaculator) 31102# Martin M. S. Pedersen <martin@linux.com> 31103# http://www.spectaculator.com/docs/zx-state/header.shtml 31104# 311050 string ZXST zx-state snapshot 31106>4 byte x version %d 31107>5 byte x \b.%d 31108>>6 byte 0 16k ZX Spectrum 31109>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 31110>>6 byte 2 ZX Spectrum 128 31111>>6 byte 3 ZX Spectrum +2 31112>>6 byte 4 ZX Spectrum +2A/+2B 31113>>6 byte 5 ZX Spectrum +3 31114>>6 byte 6 ZX Spectrum +3e 31115>>6 byte 7 Pentagon 128 31116>>6 byte 8 Timex Sinclair TC2048 31117>>6 byte 9 Timex Sinclair TC2068 31118>>6 byte 10 Scorpion ZS-256 31119>>6 byte 11 ZX Spectrum SE 31120>>6 byte 12 Timex Sinclair TS2068 31121>>6 byte 13 Pentagon 512 31122>>6 byte 14 Pentagon 1024 31123>>6 byte 15 48k ZX Spectrum (NTSC) 31124>>6 byte 16 ZX Spectrum 12Ke 31125>>>7 byte 1 (alternate timings) 31126 31127#------------------------------------------------------------------------------ 31128# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $ 31129# sql: file(1) magic for SQL files 31130# 31131# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 31132# Recognize some MySQL files. 31133# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 31134# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 31135# 311360 beshort 0xfe01 MySQL table definition file 31137>2 byte x Version %d 31138>3 byte 0 \b, type UNKNOWN 31139>3 byte 1 \b, type DIAM_ISAM 31140>3 byte 2 \b, type HASH 31141>3 byte 3 \b, type MISAM 31142>3 byte 4 \b, type PISAM 31143>3 byte 5 \b, type RMS_ISAM 31144>3 byte 6 \b, type HEAP 31145>3 byte 7 \b, type ISAM 31146>3 byte 8 \b, type MRG_ISAM 31147>3 byte 9 \b, type MYISAM 31148>3 byte 10 \b, type MRG_MYISAM 31149>3 byte 11 \b, type BERKELEY_DB 31150>3 byte 12 \b, type INNODB 31151>3 byte 13 \b, type GEMINI 31152>3 byte 14 \b, type NDBCLUSTER 31153>3 byte 15 \b, type EXAMPLE_DB 31154>3 byte 16 \b, type CSV_DB 31155>3 byte 17 \b, type FEDERATED_DB 31156>3 byte 18 \b, type BLACKHOLE_DB 31157>3 byte 19 \b, type PARTITION_DB 31158>3 byte 20 \b, type BINLOG 31159>3 byte 21 \b, type SOLID 31160>3 byte 22 \b, type PBXT 31161>3 byte 23 \b, type TABLE_FUNCTION 31162>3 byte 24 \b, type MEMCACHE 31163>3 byte 25 \b, type FALCON 31164>3 byte 26 \b, type MARIA 31165>3 byte 27 \b, type PERFORMANCE_SCHEMA 31166>3 byte 127 \b, type DEFAULT 31167>0x0033 ulong x \b, MySQL version %d 311680 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 31169>3 byte x Version %d 311700 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 31171>3 byte x Version %d 311720 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 31173>3 byte x Version %d 31174>14 beshort x \b, %d key parts 31175>16 beshort x \b, %d unique key parts 31176>18 byte x \b, %d keys 31177>28 bequad x \b, %lld records 31178>36 bequad x \b, %lld deleted records 311790 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 31180>3 byte x Version %d 311810 belong&0xffffff00 0xfefe0900 MySQL Maria index file 31182>3 byte x Version %d 311830 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 31184>3 byte x Version %d 311850 belong&0xffffff00 0xfefe0c00 31186>4 string MACF MySQL Maria control file 31187>>3 byte x Version %d 311880 string \376bin MySQL replication log, 31189>9 long x server id %d 31190>8 byte 1 31191>>13 long 69 \b, MySQL V3.2.3 31192>>>19 string x \b, server version %s 31193>>13 long 75 \b, MySQL V4.0.2-V4.1 31194>>>25 string x \b, server version %s 31195>8 byte 15 MySQL V5+, 31196>>25 string x server version %s 31197>4 string MARIALOG MySQL Maria transaction log file 31198>>3 byte x Version %d 31199 31200#------------------------------------------------------------------------------ 31201# iRiver H Series database file 31202# From Ken Guest <ken@linux.ie> 31203# As observed from iRivNavi.iDB and unencoded firmware 31204# 312050 string iRivDB iRiver Database file 31206>11 string >\0 Version %s 31207>39 string iHP-100 [H Series] 31208 31209#------------------------------------------------------------------------------ 31210# SQLite database files 31211# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 31212# 31213# Version 1 used GDBM internally; its files cannot be distinguished 31214# from other GDBM files. 31215# 31216# Version 2 used this format: 312170 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 31218 31219# Version 3 of SQLite allows applications to embed their own "user version" 31220# number in the database at offset 60. Later, SQLite added an "application id" 31221# at offset 68 that is preferred over "user version" for indicating the 31222# associated application. 31223# 312240 string SQLite\ format\ 3 SQLite 3.x database 31225!:mime application/x-sqlite3 31226# seldom found extension sqlite3 like in SyncData.sqlite3 31227# db 31228# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 31229# Unfortunately extension sqlite also used for other databases starting with string 31230# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 31231# and with string "ZV-zlib" in like extra.sqlite 31232!:ext sqlite/sqlite3/db/dbe 31233>60 belong =0x5f4d544e (Monotone source repository) 31234>68 belong =0x0f055112 (Fossil checkout) 31235>68 belong =0x0f055113 (Fossil global configuration) 31236>68 belong =0x0f055111 (Fossil repository) 31237>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 31238>68 belong =0x42654c6e (Bentley Systems Localization File) 31239>68 belong =0x47504b47 (OGC GeoPackage file) 31240>68 default x 31241>>68 belong !0 \b, application id %u 31242>>60 belong !0 \b, user version %d 31243>96 belong x \b, last written using SQLite version %d 31244 31245 31246# SQLite Write-Ahead Log from SQLite version >= 3.7.0 31247# https://www.sqlite.org/fileformat.html#walformat 312480 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 31249!:ext sqlite-wal/db-wal 31250>4 belong x version %d 31251 31252# SQLite Rollback Journal 31253# https://www.sqlite.org/fileformat.html#rollbackjournal 312540 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 31255 31256# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 31257# https://github.com/PredatH0r/ChanSort 312580 string PSDB\0 Panasonic channel list DataBase 31259!:ext db/bin 31260#!:mime application/x-db-svl-panasonic 31261>126 string SQLite\ format\ 3 31262#!:mime application/x-panasonic-sqlite3 31263>>&-15 indirect x \b; contains 31264 31265# H2 Database from https://www.h2database.com/ 312660 string --\ H2\ 0.5/B\ --\ \n H2 Database file 31267# Type: OpenSSH key files 31268# From: Nicolas Collignon <tsointsoin@gmail.com> 31269 312700 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 31271>28 string >\0 version %s 312720 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 31273 312740 string ssh-dss\ OpenSSH DSA public key 312750 string ssh-rsa\ OpenSSH RSA public key 312760 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 312770 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 312780 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 312790 string ssh-ed25519 OpenSSH ED25519 public key 31280 312810 string SSHKRL\n\0 31282>8 ubelong 1 OpenSSH key/certificate revocation list, format %u 31283>>12 ubequad x \b, version %llx 31284>>>20 beqdate x \b, generated %s 31285 31286# From: Joerg Jenderek 31287# URL: https://en.wikipedia.org/wiki/PuTTY 31288# Reference: https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz 31289# /sshpubk.c 312900 string PuTTY-User-Key-File- PuTTY Private Key File 31291#!:mime text/plain 31292# https://github.com/github/putty/blob/master/windows/installer.wxs 31293!:mime application/x-putty-private-key 31294!:ext ppk 31295# version 1 or 2 31296>20 string x \b, version %.1s 31297# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519 31298>23 string x \b, algorithm %s 31299# next line says "Encryption: " plus an encryption type like aes256-cbc or none 31300>32 search/13 Encryption:\040 \b, Encryption 31301>>&0 string x %s 31302# next line says "Comment: " plus the comment string 31303>>>&0 search/3 Comment:\040 31304>>>>&0 string x "%s" 31305 31306 31307#------------------------------------------------------------------------------ 31308# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 31309# ssl: file(1) magic for SSL file formats 31310 31311# Type: OpenSSL certificates/key files 31312# From: Nicolas Collignon <tsointsoin@gmail.com> 31313 313140 string -----BEGIN\040CERTIFICATE----- PEM certificate 313150 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 313160 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 313170 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 313180 string -----BEGIN\040EC\040PRIVATE PEM EC private key 313190 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 31320 31321# From Luc Gommans 31322# OpenSSL enc file (recognized by a magic string preceding the password's salt) 313230 string Salted__ openssl enc'd data with salted password 31324# Using the -a or -base64 option, OpenSSL will base64-encode the data. 313250 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 31326 31327#------------------------------------------------------------------------------ 31328# $File: statistics,v 1.2 2020/10/08 17:51:53 christos Exp $ 31329# statistics: file(1) magic for statistics related software 31330# 31331 31332# From Remy Rampin 31333 31334# Stata is a statistical software tool that was created in 1985. While I 31335# don't personally use it, data files in its native (proprietary) format 31336# are common (.dta files). 31337# 31338# Because they are so common, especially in statistical and social 31339# sciences, Stata files and SPSS files can be opened by a lot of modern 31340# software, for example Python's pandas package provides built-in 31341# support for them (read_stata() and read_spss()). 31342# 31343# I noticed that the magic database includes an entry for SPSS files but 31344# not Stata files. Stata files for Stata 13 and newer (formats 117, 118, 31345# and 119) always begin with the string "<stata_dta><header>" as per 31346# https://www.stata.com/help.cgi?dta#definition 31347# 31348# The format version number always follows, for example: 31349# <stata_dta><header><release>117</release> 31350# <stata_dta><header><release>118</release> 31351# 31352# Therefore the following line would do the trick: 31353# 0 string <stata_dta><header> Stata Data File 31354# 31355# (I'm sure the version number could be captured as well but I did not 31356# manage this without a regex) 31357# 31358# Unfortunately the previous formats (created by Stata before 13, which 31359# was released 2013) are harder to recognize. Format 115 starts with the 31360# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or 31361# 0x72020100, format 113 with 0x71010101 or 0x71020101. 31362# 31363# For additional reference, the Library of Congress website has an entry 31364# for the Stata Data File Format 118: 31365# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml 31366# 31367# Example of those files can be found on Zenodo: 31368# https://zenodo.org/search?page=1&size=20&q=&file_type=dta 313690 string \<stata_dta\>\<header\>\<release\> Stata Data File 31370>&0 regex [0-9]* (Release %s) 31371 31372#------------------------------------------------------------------------------ 31373# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $ 31374# sun: file(1) magic for Sun machines 31375# 31376# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 31377# releases. (5.x uses ELF.) Entries for executables without an 31378# architecture type, used before the 68020-based Sun-3's came out, 31379# are in aout, as they're indistinguishable from other big-endian 31380# 32-bit a.out files. 31381# 313820 belong&077777777 0600413 a.out SunOS SPARC demand paged 31383>0 byte &0x80 31384>>20 belong <4096 shared library 31385>>20 belong =4096 dynamically linked executable 31386>>20 belong >4096 dynamically linked executable 31387>0 byte ^0x80 executable 31388>16 belong >0 not stripped 31389 313900 belong&077777777 0600410 a.out SunOS SPARC pure 31391>0 byte &0x80 dynamically linked executable 31392>0 byte ^0x80 executable 31393>16 belong >0 not stripped 31394 313950 belong&077777777 0600407 a.out SunOS SPARC 31396>0 byte &0x80 dynamically linked executable 31397>0 byte ^0x80 executable 31398>16 belong >0 not stripped 31399 314000 belong&077777777 0400413 a.out SunOS mc68020 demand paged 31401>0 byte &0x80 31402>>20 belong <4096 shared library 31403>>20 belong =4096 dynamically linked executable 31404>>20 belong >4096 dynamically linked executable 31405>0 byte ^0x80 executable 31406>16 belong >0 not stripped 31407 314080 belong&077777777 0400410 a.out SunOS mc68020 pure 31409>0 byte &0x80 dynamically linked executable 31410>0 byte ^0x80 executable 31411>16 belong >0 not stripped 31412 314130 belong&077777777 0400407 a.out SunOS mc68020 31414>0 byte &0x80 dynamically linked executable 31415>0 byte ^0x80 executable 31416>16 belong >0 not stripped 31417 314180 belong&077777777 0200413 a.out SunOS mc68010 demand paged 31419>0 byte &0x80 31420>>20 belong <4096 shared library 31421>>20 belong =4096 dynamically linked executable 31422>>20 belong >4096 dynamically linked executable 31423>0 byte ^0x80 executable 31424>16 belong >0 not stripped 31425 314260 belong&077777777 0200410 a.out SunOS mc68010 pure 31427>0 byte &0x80 dynamically linked executable 31428>0 byte ^0x80 executable 31429>16 belong >0 not stripped 31430 314310 belong&077777777 0200407 a.out SunOS mc68010 31432>0 byte &0x80 dynamically linked executable 31433>0 byte ^0x80 executable 31434>16 belong >0 not stripped 31435 31436# 31437# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 31438# binary executed in compatibility mode under SunOS 5.x". 31439# 314400 belong 0x080456 SunOS core file 31441>4 belong 432 (SPARC) 31442>>132 string >\0 from '%s' 31443>>116 belong =3 (quit) 31444>>116 belong =4 (illegal instruction) 31445>>116 belong =5 (trace trap) 31446>>116 belong =6 (abort) 31447>>116 belong =7 (emulator trap) 31448>>116 belong =8 (arithmetic exception) 31449>>116 belong =9 (kill) 31450>>116 belong =10 (bus error) 31451>>116 belong =11 (segmentation violation) 31452>>116 belong =12 (bad argument to system call) 31453>>116 belong =29 (resource lost) 31454>>120 belong x (T=%dK, 31455>>124 belong x D=%dK, 31456>>128 belong x S=%dK) 31457>4 belong 826 (68K) 31458>>128 string >\0 from '%s' 31459>4 belong 456 (SPARC 4.x BCP) 31460>>152 string >\0 from '%s' 31461# Sun SunPC 314620 long 0xfa33c08e SunPC 4.0 Hard Disk 314630 string #SUNPC_CONFIG SunPC 4.0 Properties Values 31464# Sun snoop (see RFC 1761, which describes the capture file format, 31465# RFC 3827, which describes some additional datalink types, and 31466# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 31467# which is the IANA registry of Snoop datalink types) 31468# 314690 string snoop Snoop capture file 31470>8 belong >0 - version %d 31471>12 belong 0 (IEEE 802.3) 31472>12 belong 1 (IEEE 802.4) 31473>12 belong 2 (IEEE 802.5) 31474>12 belong 3 (IEEE 802.6) 31475>12 belong 4 (Ethernet) 31476>12 belong 5 (HDLC) 31477>12 belong 6 (Character synchronous) 31478>12 belong 7 (IBM channel-to-channel adapter) 31479>12 belong 8 (FDDI) 31480>12 belong 9 (Other) 31481>12 belong 10 (type %d) 31482>12 belong 11 (type %d) 31483>12 belong 12 (type %d) 31484>12 belong 13 (type %d) 31485>12 belong 14 (type %d) 31486>12 belong 15 (type %d) 31487>12 belong 16 (Fibre Channel) 31488>12 belong 17 (ATM) 31489>12 belong 18 (ATM Classical IP) 31490>12 belong 19 (type %d) 31491>12 belong 20 (type %d) 31492>12 belong 21 (type %d) 31493>12 belong 22 (type %d) 31494>12 belong 23 (type %d) 31495>12 belong 24 (type %d) 31496>12 belong 25 (type %d) 31497>12 belong 26 (IP over Infiniband) 31498>12 belong >26 (type %d) 31499 31500#--------------------------------------------------------------------------- 31501# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 31502# lead Sun/Cobalt developer) who agrees that they are good and worthy of 31503# inclusion. 31504 31505# Boot ROM images for Sun/Cobalt Linux server appliances 315060 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 31507>38 string x V%.4s 31508 31509# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 31510# at the very end where file(1) can't get it. 315110 string CRfs COBALT boot rom data (Flat boot rom or file system) 31512 31513#------------------------------------------------------------------------------ 31514# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $ 31515# sylk: file(1) magic for SYLK text files 31516 31517# From: Joerg Jenderek 31518# URL: https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29 31519# http://fileformats.archiveteam.org/wiki/SYLK 31520# Note: called by TrID "SYLK - SYmbolic LinK data", 31521# by DROID "Microsoft Symbolic Link (SYLK) File" 31522# by FreeDesktop.org "spreadsheet interchange document" 315230 string ID;P 31524# skip short DROID x-fmt-106-signature-id-603.slk 31525>7 ubyte >0 spreadsheet interchange document 31526# https://reposcope.com/mimetype/text/spreadsheet 31527#!:mime text/spreadsheet 31528# https://reposcope.com/mimetype/application/x-sylk by Gnumeric 31529!:mime application/x-sylk 31530!:ext slk/sylk 31531>>4 ubyte >037 \b, created by 31532# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice 31533# MP~Multiplan, XL~Excel WXL~Excel Windows 31534>>>4 string Gnumeric Gnumeric 31535>>>4 string pmw PlanMaker 31536>>>4 string CALCOOO32 Libre/OpenOffice Calc 31537>>>4 string SCALC3 StarOffice Calc 31538>>>4 string XL Excel 31539# Excel, version probably running on Windows 31540>>>4 string WXL Excel 31541# not tested 31542>>>4 string MP Multiplan 31543# unknown spreadsheet software 31544>>>4 default x 31545>>>>4 string x %s 31546 31547 31548 31549#------------------------------------------------------------------------------ 31550# msx: file(1) magic for the SymbOS operating system 31551# http://www.symbos.de 31552# Fabio R. Schmidlin <frs@pop.com.br> 31553 31554# SymbOS EXE file 315550x30 string SymExe SymbOS executable 31556>0x36 ubyte x v%c 31557>0x37 ubyte x \b.%c 31558>0xF string x \b, name: %s 31559 31560# SymbOS DOX document 315610 string INFOq\0 SymbOS DOX document 31562 31563# Symbos driver 315640 string SMD1 SymbOS driver 31565>19 byte x \b, name: %c 31566>20 byte x \b%c 31567>21 byte x \b%c 31568>22 byte x \b%c 31569>23 byte x \b%c 31570>24 byte x \b%c 31571>25 byte x \b%c 31572>26 byte x \b%c 31573>27 byte x \b%c 31574>28 byte x \b%c 31575>29 byte x \b%c 31576>30 byte x \b%c 31577>31 byte x \b%c 31578 31579# Symbos video 315800 string SymVid SymbOS video 31581>6 ubyte x v%c 31582>7 ubyte x \b.%c 31583 31584# Soundtrakker 128 ST2 music 315850 byte 0 31586>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 31587>>1 string x name: %s 31588 31589 31590 31591#------------------------------------------------------------------------ 31592# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $ 31593# sysex: file(1) magic for MIDI sysex files 31594# 31595# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 31596# where real SYStem EXclusive messages at offset 1 are limited to seven bits 31597# https://en.wikipedia.org/wiki/MIDI 315980 ubeshort&0xFF80 0xF000 SysEx File - 31599 31600# North American Group 31601>1 byte 0x01 Sequential 31602>1 byte 0x02 IDP 31603>1 byte 0x03 OctavePlateau 31604>1 byte 0x04 Moog 31605>1 byte 0x05 Passport 31606>1 byte 0x06 Lexicon 31607>1 byte 0x07 Kurzweil/Future Retro 31608>>3 byte 0x77 777 31609>>4 byte 0x00 Bank 31610>>4 byte 0x01 Song 31611>>5 byte 0x0f 16 31612>>5 byte 0x0e 15 31613>>5 byte 0x0d 14 31614>>5 byte 0x0c 13 31615>>5 byte 0x0b 12 31616>>5 byte 0x0a 11 31617>>5 byte 0x09 10 31618>>5 byte 0x08 9 31619>>5 byte 0x07 8 31620>>5 byte 0x06 7 31621>>5 byte 0x05 6 31622>>5 byte 0x04 5 31623>>5 byte 0x03 4 31624>>5 byte 0x02 3 31625>>5 byte 0x01 2 31626>>5 byte 0x00 1 31627>>5 byte 0x10 (ALL) 31628>>2 byte x \b, Channel %d 31629>1 byte 0x08 Fender 31630>1 byte 0x09 Gulbransen 31631>1 byte 0x0a AKG 31632>1 byte 0x0b Voyce 31633>1 byte 0x0c Waveframe 31634>1 byte 0x0d ADA 31635>1 byte 0x0e Garfield 31636>1 byte 0x0f Ensoniq 31637>1 byte 0x10 Oberheim 31638>>2 byte 0x06 Matrix 6 series 31639>>3 byte 0x0A Dump (All) 31640>>3 byte 0x01 Dump (Bank) 31641>>4 belong 0x0002040E Matrix 1000 31642>>>11 byte <2 User bank %d 31643>>>11 byte >1 Preset bank %d 31644>1 byte 0x11 Apple 31645>1 byte 0x12 GreyMatter 31646>1 byte 0x14 PalmTree 31647>1 byte 0x15 JLCooper 31648>1 byte 0x16 Lowrey 31649>1 byte 0x17 AdamsSmith 31650>1 byte 0x18 E-mu 31651>1 byte 0x19 Harmony 31652>1 byte 0x1a ART 31653>1 byte 0x1b Baldwin 31654>1 byte 0x1c Eventide 31655>1 byte 0x1d Inventronics 31656>1 byte 0x1f Clarity 31657 31658# European Group 31659>1 byte 0x21 SIEL 31660>1 byte 0x22 Synthaxe 31661>1 byte 0x24 Hohner 31662>1 byte 0x25 Twister 31663>1 byte 0x26 Solton 31664>1 byte 0x27 Jellinghaus 31665>1 byte 0x28 Southworth 31666>1 byte 0x29 PPG 31667>1 byte 0x2a JEN 31668>1 byte 0x2b SSL 31669>1 byte 0x2c AudioVertrieb 31670 31671>1 byte 0x2f ELKA 31672>>3 byte 0x09 EK-44 31673 31674>1 byte 0x30 Dynacord 31675>1 byte 0x31 Jomox 31676>1 byte 0x33 Clavia 31677>1 byte 0x39 Soundcraft 31678# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 31679>1 byte 0x3e Waldorf 31680>>2 byte 0x00 microWave 31681>>2 byte 0x0E microwave2 / XT 31682>>2 byte 0x0F Q / Q+ 31683>>3 byte =0 (default id) 31684>>3 byte >0 ( 31685>>>3 byte <0x7F \bdevice %d) 31686>>>3 byte =0x7F \bbroadcast id) 31687>>3 byte 0x7f Microwave I 31688>>>4 byte 0x00 SNDR (Sound Request) 31689>>>4 byte 0x10 SNDD (Sound Dump) 31690>>>4 byte 0x20 SNDP (Sound Parameter Change) 31691>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 31692>>>4 byte 0x70 BOOT (Sound Reserved) 31693>>>4 byte 0x01 MULR (Multi Request) 31694>>>4 byte 0x11 MULD (Multi Dump) 31695>>>4 byte 0x21 MULP (Multi Parameter Change) 31696>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 31697>>>4 byte 0x71 OS (Multi Reserved) 31698>>>4 byte 0x02 DRMR (Drum Map Request) 31699>>>4 byte 0x12 DRMD (Drum Map Dump) 31700>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 31701>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 31702>>>4 byte 0x72 BIN (Drum Map Reserved) 31703>>>4 byte 0x03 PATR (Sequencer Pattern Request) 31704>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 31705>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 31706>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 31707>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 31708>>>4 byte 0x04 GLBR (Global Parameter Request) 31709>>>4 byte 0x14 GLBD (Global Parameter Dump) 31710>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31711>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31712>>>4 byte 0x07 MODR (Mode Parameter Request) 31713>>>4 byte 0x17 MODD (Mode Parameter Dump) 31714>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 31715>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 31716>>2 byte 0x10 microQ 31717>>>4 byte 0x00 SNDR (Sound Request) 31718>>>4 byte 0x10 SNDD (Sound Dump) 31719>>>4 byte 0x20 SNDP (Sound Parameter Change) 31720>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 31721>>>4 byte 0x70 (Sound Reserved) 31722>>>4 byte 0x01 MULR (Multi Request) 31723>>>4 byte 0x11 MULD (Multi Dump) 31724>>>4 byte 0x21 MULP (Multi Parameter Change) 31725>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 31726>>>4 byte 0x71 OS (Multi Reserved) 31727>>>4 byte 0x02 DRMR (Drum Map Request) 31728>>>4 byte 0x12 DRMD (Drum Map Dump) 31729>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 31730>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 31731>>>4 byte 0x72 BIN (Drum Map Reserved) 31732>>>4 byte 0x04 GLBR (Global Parameter Request) 31733>>>4 byte 0x14 GLBD (Global Parameter Dump) 31734>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31735>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31736>>2 byte 0x11 rackAttack 31737>>>4 byte 0x00 SNDR (Sound Parameter Request) 31738>>>4 byte 0x10 SNDD (Sound Parameter Dump) 31739>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 31740>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 31741>>>4 byte 0x01 PRGR (Program Parameter Request) 31742>>>4 byte 0x11 PRGD (Program Parameter Dump) 31743>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 31744>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 31745>>>4 byte 0x71 OS (Program Parameter Reserved) 31746>>>4 byte 0x03 PATR (Pattern Parameter Request) 31747>>>4 byte 0x13 PATD (Pattern Parameter Dump) 31748>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 31749>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 31750>>>4 byte 0x04 GLBR (Global Parameter Request) 31751>>>4 byte 0x14 GLBD (Global Parameter Dump) 31752>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31753>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31754>>>4 byte 0x05 EFXR (FX Parameter Request) 31755>>>4 byte 0x15 EFXD (FX Parameter Dump) 31756>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 31757>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 31758>>>4 byte 0x07 MODR (Mode Command Request) 31759>>>4 byte 0x17 MODD (Mode Command Dump) 31760>>>4 byte 0x27 MODP (Mode Command Parameter Change) 31761>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 31762>>2 byte 0x03 Wave 31763>>>4 byte 0x00 SBPR (Soundprogram) 31764>>>4 byte 0x01 SAPR (Performance) 31765>>>4 byte 0x02 SWAVE (Wave) 31766>>>4 byte 0x03 SWTBL (Wave control table) 31767>>>4 byte 0x04 SVT (Velocity Curve) 31768>>>4 byte 0x05 STT (Tuning Table) 31769>>>4 byte 0x06 SGLB (Global Parameters) 31770>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 31771>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 31772>>>4 byte 0x09 SBPRPAR (Sound Parameter) 31773>>>4 byte 0x0A SARRPAR (Performance Parameter) 31774>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 31775>>>4 byte 0x0F SBULK (Bulk Switch on/off) 31776 31777# Japanese Group 31778>1 byte 0x40 Kawai 31779>>3 byte 0x20 K1 31780>>3 byte 0x22 K4 31781 31782>1 byte 0x41 Roland 31783>>3 byte 0x14 D-50 31784>>3 byte 0x2b U-220 31785>>3 byte 0x02 TR-707 31786 31787>1 byte 0x42 Korg 31788>>3 byte 0x19 M1 31789 31790>1 byte 0x43 Yamaha 31791>1 byte 0x44 Casio 31792>1 byte 0x46 Kamiya 31793>1 byte 0x47 Akai 31794>1 byte 0x48 Victor 31795>1 byte 0x49 Mesosha 31796>1 byte 0x4b Fujitsu 31797>1 byte 0x4c Sony 31798>1 byte 0x4e Teac 31799>1 byte 0x50 Matsushita 31800>1 byte 0x51 Fostex 31801>1 byte 0x52 Zoom 31802>1 byte 0x54 Matsushita 31803>1 byte 0x57 Acoustic tech. lab. 31804# https://www.midi.org/techspecs/manid.php 31805>1 belong&0xffffff00 0x00007400 Ta Horng 31806>1 belong&0xffffff00 0x00007500 e-Tek 31807>1 belong&0xffffff00 0x00007600 E-Voice 31808>1 belong&0xffffff00 0x00007700 Midisoft 31809>1 belong&0xffffff00 0x00007800 Q-Sound 31810>1 belong&0xffffff00 0x00007900 Westrex 31811>1 belong&0xffffff00 0x00007a00 Nvidia* 31812>1 belong&0xffffff00 0x00007b00 ESS 31813>1 belong&0xffffff00 0x00007c00 Mediatrix 31814>1 belong&0xffffff00 0x00007d00 Brooktree 31815>1 belong&0xffffff00 0x00007e00 Otari 31816>1 belong&0xffffff00 0x00007f00 Key Electronics 31817>1 belong&0xffffff00 0x00010000 Shure 31818>1 belong&0xffffff00 0x00010100 AuraSound 31819>1 belong&0xffffff00 0x00010200 Crystal 31820>1 belong&0xffffff00 0x00010300 Rockwell 31821>1 belong&0xffffff00 0x00010400 Silicon Graphics 31822>1 belong&0xffffff00 0x00010500 Midiman 31823>1 belong&0xffffff00 0x00010600 PreSonus 31824>1 belong&0xffffff00 0x00010800 Topaz 31825>1 belong&0xffffff00 0x00010900 Cast Lightning 31826>1 belong&0xffffff00 0x00010a00 Microsoft 31827>1 belong&0xffffff00 0x00010b00 Sonic Foundry 31828>1 belong&0xffffff00 0x00010c00 Line 6 31829>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 31830>1 belong&0xffffff00 0x00010e00 Van Koerving 31831>1 belong&0xffffff00 0x00010f00 Altech Systems 31832>1 belong&0xffffff00 0x00011000 S & S Research 31833>1 belong&0xffffff00 0x00011100 VLSI Technology 31834>1 belong&0xffffff00 0x00011200 Chromatic 31835>1 belong&0xffffff00 0x00011300 Sapphire 31836>1 belong&0xffffff00 0x00011400 IDRC 31837>1 belong&0xffffff00 0x00011500 Justonic Tuning 31838>1 belong&0xffffff00 0x00011600 TorComp 31839>1 belong&0xffffff00 0x00011700 Newtek Inc. 31840>1 belong&0xffffff00 0x00011800 Sound Sculpture 31841>1 belong&0xffffff00 0x00011900 Walker Technical 31842>1 belong&0xffffff00 0x00011a00 Digital Harmony 31843>1 belong&0xffffff00 0x00011b00 InVision 31844>1 belong&0xffffff00 0x00011c00 T-Square 31845>1 belong&0xffffff00 0x00011d00 Nemesys 31846>1 belong&0xffffff00 0x00011e00 DBX 31847>1 belong&0xffffff00 0x00011f00 Syndyne 31848>1 belong&0xffffff00 0x00012000 Bitheadz 31849>1 belong&0xffffff00 0x00012100 Cakewalk 31850>1 belong&0xffffff00 0x00012200 Staccato 31851>1 belong&0xffffff00 0x00012300 National Semicon. 31852>1 belong&0xffffff00 0x00012400 Boom Theory 31853>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 31854>1 belong&0xffffff00 0x00012600 Antares 31855>1 belong&0xffffff00 0x00012700 Angel Software 31856>1 belong&0xffffff00 0x00012800 St Louis Music 31857>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 31858>1 belong&0xffffff00 0x00012a00 Ashley Audio 31859>1 belong&0xffffff00 0x00012b00 Vari-Lite 31860>1 belong&0xffffff00 0x00012c00 Summit Audio 31861>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 31862>1 belong&0xffffff00 0x00012e00 SeaSound 31863>1 belong&0xffffff00 0x00012f00 U.S. Robotics 31864>1 belong&0xffffff00 0x00013000 Aurisis 31865>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 31866>1 belong&0xffffff00 0x00013200 FM7 Inc. 31867>1 belong&0xffffff00 0x00013300 Swivel Systems 31868>1 belong&0xffffff00 0x00013400 Hyperactive 31869>1 belong&0xffffff00 0x00013500 MidiLite 31870>1 belong&0xffffff00 0x00013600 Radical 31871>1 belong&0xffffff00 0x00013700 Roger Linn 31872>1 belong&0xffffff00 0x00013800 Helicon 31873>1 belong&0xffffff00 0x00013900 Event 31874>1 belong&0xffffff00 0x00013a00 Sonic Network 31875>1 belong&0xffffff00 0x00013b00 Realtime Music 31876>1 belong&0xffffff00 0x00013c00 Apogee Digital 31877 31878>1 belong&0xffffff00 0x00202b00 Medeli Electronics 31879>1 belong&0xffffff00 0x00202c00 Charlie Lab 31880>1 belong&0xffffff00 0x00202d00 Blue Chip Music 31881>1 belong&0xffffff00 0x00202e00 BEE OH Corp 31882>1 belong&0xffffff00 0x00202f00 LG Semicon America 31883>1 belong&0xffffff00 0x00203000 TESI 31884>1 belong&0xffffff00 0x00203100 EMAGIC 31885>1 belong&0xffffff00 0x00203200 Behringer 31886>1 belong&0xffffff00 0x00203300 Access Music 31887>1 belong&0xffffff00 0x00203400 Synoptic 31888>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 31889>1 belong&0xffffff00 0x00203600 Terratec 31890>1 belong&0xffffff00 0x00203700 Proel SpA 31891>1 belong&0xffffff00 0x00203800 IBK MIDI 31892>1 belong&0xffffff00 0x00203900 IRCAM 31893>1 belong&0xffffff00 0x00203a00 Propellerhead Software 31894>1 belong&0xffffff00 0x00203b00 Red Sound Systems 31895>1 belong&0xffffff00 0x00203c00 Electron ESI AB 31896>1 belong&0xffffff00 0x00203d00 Sintefex Audio 31897>1 belong&0xffffff00 0x00203e00 Music and More 31898>1 belong&0xffffff00 0x00203f00 Amsaro 31899>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 31900>1 belong&0xffffff00 0x00204100 Touched by Sound 31901>1 belong&0xffffff00 0x00204200 DSP Arts 31902>1 belong&0xffffff00 0x00204300 Phil Rees Music 31903>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 31904>1 belong&0xffffff00 0x00204500 Soundart 31905>1 belong&0xffffff00 0x00204600 C-Mexx Software 31906>1 belong&0xffffff00 0x00204700 Klavis Tech. 31907>1 belong&0xffffff00 0x00204800 Noteheads AB 31908 319090 string T707 Roland TR-707 Data 31910#------------------------------------------------------------------------------ 31911# file: file(1) magic for Tcl scripting language 31912# URL: https://www.tcl.tk/ 31913# From: gustaf neumann 31914 31915# Tcl scripts 319160 search/1/w #!\ /usr/bin/tcl Tcl script text executable 31917!:mime text/x-tcl 319180 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 31919!:mime text/x-tcl 319200 search/1 #!/usr/bin/env\ tcl Tcl script text executable 31921!:mime text/x-tcl 319220 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 31923!:mime text/x-tcl 319240 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 31925!:mime text/x-tcl 319260 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 31927!:mime text/x-tcl 319280 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 31929!:mime text/x-tcl 319300 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 31931!:mime text/x-tcl 31932 31933# check the first line 319340 search/1 package\ req 31935>0 regex \^package[\ \t]+req Tcl script 31936# not 'p', check other lines 319370 search/1 !p 31938>0 regex \^package[\ \t]+req Tcl script 31939 31940#------------------------------------------------------------------------------ 31941# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 31942# teapot: file(1) magic for "teapot" spreadsheet 31943# 319440 string #!teapot\012xdr teapot work sheet (XDR format) 31945 31946#------------------------------------------------------------------------------ 31947# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $ 31948# terminfo: file(1) magic for terminfo 31949# 31950# URL: https://invisible-island.net/ncurses/man/term.5.html 31951# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html 31952# 31953# Workaround for Targa image type by Joerg Jenderek 31954# GRR: line below too general as it catches also 31955# Targa image type 1 with 26 long identification field 31956# and HELP.DSK 319570 string \032\001 31958# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 31959>16 ubyte >32 31960# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 31961>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 31962!:mime application/x-terminfo 31963# no extension 31964#!:ext 31965# 31966#------------------------------------------------------------------------------ 31967# The following was added for ncurses6 development: 31968#------------------------------------------------------------------------------ 31969# 319700 string \036\002 31971# imitate the legacy compiled-format, to get the entry-name printed 31972>16 ubyte >32 31973# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 31974>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 31975!:mime application/x-terminfo2 31976# 31977# While the compiled terminfo uses little-endian format regardless of 31978# platform, SystemV screen dumps do not. They came later, and that detail was 31979# overlooked. 31980# 31981# AIX and HPUX use the SVr4 big-endian format 31982# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 319830 beshort 0433 SVr2 curses screen image, big-endian 319840 beshort 0434 SVr3 curses screen image, big-endian 319850 beshort 0435 SVr4 curses screen image, big-endian 31986# 319870 leshort 0433 SVr2 curses screen image, little-endian 319880 leshort 0434 SVr3 curses screen image, little-endian 319890 leshort 0435 SVr4 curses screen image, little-endian 31990# 31991# Rather than SVr4, Solaris "xcurses" writes this header: 319920 regex \^MAX=[0-9]+,[0-9]+$ 31993>1 regex \^BEG=[0-9]+,[0-9]+$ 31994>2 regex \^SCROLL=[0-9]+,[0-9]+$ 31995>3 regex \^VMIN=[0-9]+$ 31996>4 regex \^VTIME=[0-9]+$ 31997>5 regex \^FLAGS=0x[[:xdigit:]]+$ 31998>6 regex \^FG=[0-9],[0-9]+$ 31999>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 32000# 32001# ncurses5 (and before) did not use a magic number, making screen dumps "data". 32002# ncurses6 (2015) uses this format, ignoring byte-order 320030 string \210\210\210\210ncurses ncurses6 screen image 32004# 32005# PDCurses added this in 2005 320060 string PDC\001 PDCurses screen image 32007 32008#------------------------------------------------------------------------------ 32009# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $ 32010# tex: file(1) magic for TeX files 32011# 32012# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 32013# 32014# From <conklin@talisman.kaleida.com> 32015 32016# Although we may know the offset of certain text fields in TeX DVI 32017# and font files, we can't use them reliably because they are not 32018# zero terminated. [but we do anyway, christos] 320190 string \367\002 TeX DVI file 32020!:mime application/x-dvi 32021>16 string >\0 (%s) 320220 string \367\203 TeX generic font data 320230 string \367\131 TeX packed font data 32024>3 string >\0 (%s) 320250 string \367\312 TeX virtual font data 320260 search/1 This\ is\ TeX, TeX transcript text 320270 search/1 This\ is\ METAFONT, METAFONT transcript text 32028 32029# There is no way to detect TeX Font Metric (*.tfm) files without 32030# breaking them apart and reading the data. The following patterns 32031# match most *.tfm files generated by METAFONT or afm2tfm. 320322 string \000\021 TeX font metric data 32033!:mime application/x-tex-tfm 32034>33 string >\0 (%s) 320352 string \000\022 TeX font metric data 32036!:mime application/x-tex-tfm 32037>33 string >\0 (%s) 32038 32039# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 320400 search/1 \\input\ texinfo Texinfo source text 32041!:mime text/x-texinfo 320420 search/1 This\ is\ Info\ file GNU Info text 32043!:mime text/x-info 32044 32045# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 320460 search/4096 \\input TeX document text 32047!:mime text/x-tex 32048!:strength + 15 320490 search/4096 \\begin LaTeX document text 32050!:mime text/x-tex 32051!:strength + 15 320520 search/4096 \\section LaTeX document text 32053!:mime text/x-tex 32054!:strength + 18 320550 search/4096 \\setlength LaTeX document text 32056!:mime text/x-tex 32057!:strength + 15 320580 search/4096 \\documentstyle LaTeX document text 32059!:mime text/x-tex 32060!:strength + 18 320610 search/4096 \\chapter LaTeX document text 32062!:mime text/x-tex 32063!:strength + 18 320640 search/4096 \\documentclass LaTeX 2e document text 32065!:mime text/x-tex 32066!:strength + 15 320670 search/4096 \\relax LaTeX auxiliary file 32068!:mime text/x-tex 32069!:strength + 15 320700 search/4096 \\contentsline LaTeX table of contents 32071!:mime text/x-tex 32072!:strength + 15 320730 search/4096 %\ -*-latex-*- LaTeX document text 32074!:mime text/x-tex 32075 32076# Tex document, from Hendrik Scholz <hendrik@scholz.net> 320770 search/1 \\ifx TeX document text 32078 32079# Index and glossary files 320800 search/4096 \\indexentry LaTeX raw index file 320810 search/4096 \\begin{theindex} LaTeX sorted index 320820 search/4096 \\glossaryentry LaTeX raw glossary 320830 search/4096 \\begin{theglossary} LaTeX sorted glossary 320840 search/4096 This\ is\ makeindex Makeindex log file 32085 32086# End of TeX 32087 32088#------------------------------------------------------------------------------ 32089# file(1) magic for BibTex text files 32090# From Hendrik Scholz <hendrik@scholz.net> 32091 320920 search/1/c @article{ BibTeX text file 320930 search/1/c @book{ BibTeX text file 320940 search/1/c @inbook{ BibTeX text file 320950 search/1/c @incollection{ BibTeX text file 320960 search/1/c @inproceedings{ BibTeX text file 320970 search/1/c @manual{ BibTeX text file 320980 search/1/c @misc{ BibTeX text file 320990 search/1/c @preamble{ BibTeX text file 321000 search/1/c @phdthesis{ BibTeX text file 321010 search/1/c @techreport{ BibTeX text file 321020 search/1/c @unpublished{ BibTeX text file 32103 3210473 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 32105 3210673 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 32107 321080 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 32109 321100 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 32111 321120 search/1 @c\ @mapfile{ TeX font aliases text file 32113 321140 string #LyX LyX document text 32115 32116# ConTeXt documents 32117# https://wiki.contextgarden.net/ 321180 search/4096 \\setupcolors[ ConTeXt document text 32119!:strength + 15 321200 search/4096 \\definecolor[ ConTeXt document text 32121!:strength + 15 321220 search/4096 \\setupinteraction[ ConTeXt document text 32123!:strength + 15 321240 search/4096 \\useURL[ ConTeXt document text 32125!:strength + 15 321260 search/4096 \\setuppapersize[ ConTeXt document text 32127!:strength + 15 321280 search/4096 \\setuplayout[ ConTeXt document text 32129!:strength + 15 321300 search/4096 \\setupfooter[ ConTeXt document text 32131!:strength + 15 321320 search/4096 \\setupfootertexts[ ConTeXt document text 32133!:strength + 15 321340 search/4096 \\setuppagenumbering[ ConTeXt document text 32135!:strength + 15 321360 search/4096 \\setupbodyfont[ ConTeXt document text 32137!:strength + 15 321380 search/4096 \\setuphead[ ConTeXt document text 32139!:strength + 15 321400 search/4096 \\setupitemize[ ConTeXt document text 32141!:strength + 15 321420 search/4096 \\setupwhitespace[ ConTeXt document text 32143!:strength + 15 321440 search/4096 \\setupindenting[ ConTeXt document text 32145!:strength + 15 32146 32147#------------------------------------------------------------------------------ 32148# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 32149# file(1) magic for tgif(1) files 32150# From Hendrik Scholz <hendrik@scholz.net> 321510 string %TGIF\ Tgif file version 32152>6 string x %s 32153 32154#------------------------------------------------------------------------------ 32155# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $ 32156# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 32157# 32158# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 32159# 32160# Update: Romain Lievin (roms@lpg.ticalc.org). 32161# 32162# NOTE: This list is not complete. 32163# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 32164# program/group magic numbers in here because I cannot find any. 321650 string **TI80** TI-80 Graphing Calculator File. 321660 string **TI81** TI-81 Graphing Calculator File. 32167# 32168# Magic Numbers for the TI-73 32169# 321700 string **TI73** TI-73 Graphing Calculator 32171>0x00003B byte 0x00 (real number) 32172>0x00003B byte 0x01 (list) 32173>0x00003B byte 0x02 (matrix) 32174>0x00003B byte 0x03 (equation) 32175>0x00003B byte 0x04 (string) 32176>0x00003B byte 0x05 (program) 32177>0x00003B byte 0x06 (assembly program) 32178>0x00003B byte 0x07 (picture) 32179>0x00003B byte 0x08 (gdb) 32180>0x00003B byte 0x0C (complex number) 32181>0x00003B byte 0x0F (window settings) 32182>0x00003B byte 0x10 (zoom) 32183>0x00003B byte 0x11 (table setup) 32184>0x00003B byte 0x13 (backup) 32185 32186# Magic Numbers for the TI-82 32187# 321880 string **TI82** TI-82 Graphing Calculator 32189>0x00003B byte 0x00 (real) 32190>0x00003B byte 0x01 (list) 32191>0x00003B byte 0x02 (matrix) 32192>0x00003B byte 0x03 (Y-variable) 32193>0x00003B byte 0x05 (program) 32194>0x00003B byte 0x06 (protected prgm) 32195>0x00003B byte 0x07 (picture) 32196>0x00003B byte 0x08 (gdb) 32197>0x00003B byte 0x0B (window settings) 32198>0x00003B byte 0x0C (window settings) 32199>0x00003B byte 0x0D (table setup) 32200>0x00003B byte 0x0E (screenshot) 32201>0x00003B byte 0x0F (backup) 32202# 32203# Magic Numbers for the TI-83 32204# 322050 string **TI83** TI-83 Graphing Calculator 32206>0x00003B byte 0x00 (real) 32207>0x00003B byte 0x01 (list) 32208>0x00003B byte 0x02 (matrix) 32209>0x00003B byte 0x03 (Y-variable) 32210>0x00003B byte 0x04 (string) 32211>0x00003B byte 0x05 (program) 32212>0x00003B byte 0x06 (protected prgm) 32213>0x00003B byte 0x07 (picture) 32214>0x00003B byte 0x08 (gdb) 32215>0x00003B byte 0x0B (window settings) 32216>0x00003B byte 0x0C (window settings) 32217>0x00003B byte 0x0D (table setup) 32218>0x00003B byte 0x0E (screenshot) 32219>0x00003B byte 0x13 (backup) 32220# 32221# Magic Numbers for the TI-83+ 32222# 322230 string **TI83F* TI-83+ Graphing Calculator 32224>0x00003B byte 0x00 (real number) 32225>0x00003B byte 0x01 (list) 32226>0x00003B byte 0x02 (matrix) 32227>0x00003B byte 0x03 (equation) 32228>0x00003B byte 0x04 (string) 32229>0x00003B byte 0x05 (program) 32230>0x00003B byte 0x06 (assembly program) 32231>0x00003B byte 0x07 (picture) 32232>0x00003B byte 0x08 (gdb) 32233>0x00003B byte 0x0C (complex number) 32234>0x00003B byte 0x0F (window settings) 32235>0x00003B byte 0x10 (zoom) 32236>0x00003B byte 0x11 (table setup) 32237>0x00003B byte 0x13 (backup) 32238>0x00003B byte 0x15 (application variable) 32239>0x00003B byte 0x17 (group of variable) 32240 32241# 32242# Magic Numbers for the TI-85 32243# 322440 string **TI85** TI-85 Graphing Calculator 32245>0x00003B byte 0x00 (real number) 32246>0x00003B byte 0x01 (complex number) 32247>0x00003B byte 0x02 (real vector) 32248>0x00003B byte 0x03 (complex vector) 32249>0x00003B byte 0x04 (real list) 32250>0x00003B byte 0x05 (complex list) 32251>0x00003B byte 0x06 (real matrix) 32252>0x00003B byte 0x07 (complex matrix) 32253>0x00003B byte 0x08 (real constant) 32254>0x00003B byte 0x09 (complex constant) 32255>0x00003B byte 0x0A (equation) 32256>0x00003B byte 0x0C (string) 32257>0x00003B byte 0x0D (function GDB) 32258>0x00003B byte 0x0E (polar GDB) 32259>0x00003B byte 0x0F (parametric GDB) 32260>0x00003B byte 0x10 (diffeq GDB) 32261>0x00003B byte 0x11 (picture) 32262>0x00003B byte 0x12 (program) 32263>0x00003B byte 0x13 (range) 32264>0x00003B byte 0x17 (window settings) 32265>0x00003B byte 0x18 (window settings) 32266>0x00003B byte 0x19 (window settings) 32267>0x00003B byte 0x1A (window settings) 32268>0x00003B byte 0x1B (zoom) 32269>0x00003B byte 0x1D (backup) 32270>0x00003B byte 0x1E (unknown) 32271>0x00003B byte 0x2A (equation) 32272>0x000032 string ZS4 - ZShell Version 4 File. 32273>0x000032 string ZS3 - ZShell Version 3 File. 32274# 32275# Magic Numbers for the TI-86 32276# 322770 string **TI86** TI-86 Graphing Calculator 32278>0x00003B byte 0x00 (real number) 32279>0x00003B byte 0x01 (complex number) 32280>0x00003B byte 0x02 (real vector) 32281>0x00003B byte 0x03 (complex vector) 32282>0x00003B byte 0x04 (real list) 32283>0x00003B byte 0x05 (complex list) 32284>0x00003B byte 0x06 (real matrix) 32285>0x00003B byte 0x07 (complex matrix) 32286>0x00003B byte 0x08 (real constant) 32287>0x00003B byte 0x09 (complex constant) 32288>0x00003B byte 0x0A (equation) 32289>0x00003B byte 0x0C (string) 32290>0x00003B byte 0x0D (function GDB) 32291>0x00003B byte 0x0E (polar GDB) 32292>0x00003B byte 0x0F (parametric GDB) 32293>0x00003B byte 0x10 (diffeq GDB) 32294>0x00003B byte 0x11 (picture) 32295>0x00003B byte 0x12 (program) 32296>0x00003B byte 0x13 (range) 32297>0x00003B byte 0x17 (window settings) 32298>0x00003B byte 0x18 (window settings) 32299>0x00003B byte 0x19 (window settings) 32300>0x00003B byte 0x1A (window settings) 32301>0x00003B byte 0x1B (zoom) 32302>0x00003B byte 0x1D (backup) 32303>0x00003B byte 0x1E (unknown) 32304>0x00003B byte 0x2A (equation) 32305# 32306# Magic Numbers for the TI-89 32307# 323080 string **TI89** TI-89 Graphing Calculator 32309>0x000048 byte 0x00 (expression) 32310>0x000048 byte 0x04 (list) 32311>0x000048 byte 0x06 (matrix) 32312>0x000048 byte 0x0A (data) 32313>0x000048 byte 0x0B (text) 32314>0x000048 byte 0x0C (string) 32315>0x000048 byte 0x0D (graphic data base) 32316>0x000048 byte 0x0E (figure) 32317>0x000048 byte 0x10 (picture) 32318>0x000048 byte 0x12 (program) 32319>0x000048 byte 0x13 (function) 32320>0x000048 byte 0x14 (macro) 32321>0x000048 byte 0x1C (zipped) 32322>0x000048 byte 0x21 (assembler) 32323# 32324# Magic Numbers for the TI-92 32325# 323260 string **TI92** TI-92 Graphing Calculator 32327>0x000048 byte 0x00 (expression) 32328>0x000048 byte 0x04 (list) 32329>0x000048 byte 0x06 (matrix) 32330>0x000048 byte 0x0A (data) 32331>0x000048 byte 0x0B (text) 32332>0x000048 byte 0x0C (string) 32333>0x000048 byte 0x0D (graphic data base) 32334>0x000048 byte 0x0E (figure) 32335>0x000048 byte 0x10 (picture) 32336>0x000048 byte 0x12 (program) 32337>0x000048 byte 0x13 (function) 32338>0x000048 byte 0x14 (macro) 32339>0x000048 byte 0x1D (backup) 32340# 32341# Magic Numbers for the TI-92+/V200 32342# 323430 string **TI92P* TI-92+/V200 Graphing Calculator 32344>0x000048 byte 0x00 (expression) 32345>0x000048 byte 0x04 (list) 32346>0x000048 byte 0x06 (matrix) 32347>0x000048 byte 0x0A (data) 32348>0x000048 byte 0x0B (text) 32349>0x000048 byte 0x0C (string) 32350>0x000048 byte 0x0D (graphic data base) 32351>0x000048 byte 0x0E (figure) 32352>0x000048 byte 0x10 (picture) 32353>0x000048 byte 0x12 (program) 32354>0x000048 byte 0x13 (function) 32355>0x000048 byte 0x14 (macro) 32356>0x000048 byte 0x1C (zipped) 32357>0x000048 byte 0x21 (assembler) 32358# 32359# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 32360# 32361#0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 323620 string **TIFL** TI-XX Graphing Calculator (FLASH) 32363>8 byte >0 - Revision %d 32364>>9 byte x \b.%d, 32365>12 byte >0 Revision date %02x 32366>>13 byte x \b/%02x 32367>>14 beshort x \b/%04x, 32368>17 string >/0 name: '%s', 32369>48 byte 0x74 device: TI-73, 32370>48 byte 0x73 device: TI-83+, 32371>48 byte 0x98 device: TI-89, 32372>48 byte 0x88 device: TI-92+, 32373>49 byte 0x23 type: OS upgrade, 32374>49 byte 0x24 type: application, 32375>49 byte 0x25 type: certificate, 32376>49 byte 0x3e type: license, 32377>74 lelong >0 size: %d bytes 32378 32379# VTi & TiEmu skins (TI Graphing Calculators). 32380# From: Romain Lievin (roms@lpg.ticalc.org). 32381# Magic Numbers for the VTi skins 323820 string VTI Virtual TI skin 32383>3 string v - Version 32384>>4 byte >0 \b %c 32385>>6 byte x \b.%c 32386# Magic Numbers for the TiEmu skins 323870 string TiEmu TiEmu skin 32388>6 string v - Version 32389>>7 byte >0 \b %c 32390>>9 byte x \b.%c 32391>>10 byte x \b%c 32392 32393#------------------------------------------------------------------------------ 32394# $File: timezone,v 1.12 2020/12/28 15:59:23 christos Exp $ 32395# timezone: file(1) magic for timezone data 32396# 32397# from Daniel Quinlan (quinlan@yggdrasil.com) 32398# this should work on Linux, SunOS, and maybe others 32399# Added new official magic number for recent versions of the Olson code 324000 string TZif timezone data 32401>4 byte 0 \b, old version 32402>4 byte >0 \b, version %c 32403>20 belong 0 \b, no gmt time flags 32404>20 belong 1 \b, 1 gmt time flag 32405>20 belong >1 \b, %d gmt time flags 32406>24 belong 0 \b, no std time flags 32407>24 belong 1 \b, 1 std time flag 32408>24 belong >1 \b, %d std time flags 32409>28 belong 0 \b, no leap seconds 32410>28 belong 1 \b, 1 leap second 32411>28 belong >1 \b, %d leap seconds 32412>32 belong 0 \b, no transition times 32413>32 belong 1 \b, 1 transition time 32414>32 belong >1 \b, %d transition times 32415>36 belong 0 \b, no local time types 32416>36 belong 1 \b, 1 local time type 32417>36 belong >1 \b, %d local time types 32418>40 belong 0 \b, no abbreviation chars 32419>40 belong 1 \b, 1 abbreviation char 32420>40 belong >1 \b, %d abbreviation chars 324210 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 324220 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 324230 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 324240 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 324250 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 324260 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 32427 32428#------------------------------------------------------------------------------ 32429# $File: tplink,v 1.6 2020/12/12 20:01:47 christos Exp $ 32430# tplink: File magic for openwrt firmware files 32431 32432# URL: https://wiki.openwrt.org/doc/techref/header 32433# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 32434# From: Joerg Jenderek 32435# check for valid header version 1 or 2 324360 ulelong <3 32437>0 ulelong !0 32438# test for header padding with nulls 32439>>0x100 long 0 32440# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor 32441>>>4 ubelong >0x1F000000 32442# skip user.dbt by looking for positive hardware id 32443>>>>0x40 ubeshort >0 32444>>>>>0 use firmware-tplink 32445 324460 name firmware-tplink 32447>0 ubyte x firmware 32448!:mime application/x-tplink-bin 32449!:ext bin 32450# hardware id like 10430001 07410001 09410004 09410006 32451>0x40 ubeshort x %x 32452>0x42 ubeshort x v%x 32453# hardware revision like 1 32454>0x44 ubelong !1 (revision %u) 32455# vendor_name[24] like OpenWrt or TP-LINK Technologies 32456>4 string x %.24s 32457# fw_version[36] like r49389 or ver. 1.0 32458>0x1c string x %.36s 32459# header version 1 or 2 32460>0 ubyte !1 V%X 32461# ver_hi.ver_mid.ver_lo 32462>0x98 long !0 \b, version 32463>>0x98 ubeshort x %u 32464>>0x9A ubeshort x \b.%u 32465>>0x9C ubeshort x \b.%u 32466# region code 0~universal 1~US 32467>0x48 ubelong x 32468#>>0x48 ubelong 0 (universal) 32469>>0x48 ubelong 1 (US) 32470>>0x48 ubelong >1 (region %u) 32471# total length of the firmware. not always true 32472>0x7C ubelong x \b, %u bytes or less 32473# unknown 1 32474>0x48 ubelong !0 \b, UNKNOWN1 0x%x 32475# md5sum1[16] 32476#>0x4c ubequad x \b, MD5 %llx 32477#>>0x54 ubequad x \b%llx 32478# unknown 2 32479>0x5c ubelong !0 \b, UNKNOWN2 0x%x 32480# md5sum2[16] 32481#>0x60 ubequad !0 \b, 2nd MD5 %llx 32482#>>0x68 ubequad x \b%llx 32483# unknown 3 32484>0x70 ubelong !0 \b, UNKNOWN3 0x%x 32485# kernel load address 32486#>0x74 ubelong x \b, 0x%x load 32487# kernel entry point 32488#>0x78 ubelong x \b, 0x%x entry 32489# kernel data offset. 200h means direct after header 32490>0x80 ubelong x \b, at 0x%x 32491# kernel data length and 1 space 32492>0x84 ubelong x %u bytes 32493# look for kernel type (gzip compressed vmlinux.bin by ./compress) 32494>(0x80.L) indirect x 32495# root file system data offset 32496# WRONG in 5.35 with above indirect expression 32497>0x88 ubelong x \b, at 0x%x 32498# rootfs data length and 1 space 32499>0x8C ubelong x %u bytes 32500# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 32501>(0x88.L) indirect x 32502# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin 32503#>(0x88.L) string x \b, file system '%.4s' 32504#>(0x88.L) ubequad x \b, file system 0x%llx 32505# bootloader data offset 32506>0x90 ubelong !0 \b, at 0x%x 32507# bootloader data length only reasonable if bootloader offset not null 32508>>0x94 ubelong !0 %u bytes 32509# pad[354] should be 354 null bytes. 32510#>0x9E ubequad !0 \b, padding 0x%llx 32511# But at 0x120 18 non null bytes in examples like 32512# wr940nv4_eu_3_16_9_up_boot(160620).bin 32513# wr940nv6_us_3_18_1_up_boot(171030).bin 32514#>0x120 ubequad !0 \b, other padding 0x%llx 32515 32516#------------------------------------------------------------------------------ 32517# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $ 32518# troff: file(1) magic for *roff 32519# 32520# updated by Daniel Quinlan (quinlan@yggdrasil.com) 32521 32522# troff input 325230 search/1 .\\" troff or preprocessor input text 32524!:mime text/troff 325250 search/1 '\\" troff or preprocessor input text 32526!:mime text/troff 325270 search/1 '.\\" troff or preprocessor input text 32528!:mime text/troff 325290 search/1 \\" troff or preprocessor input text 32530!:mime text/troff 32531#0 search/1 ''' troff or preprocessor input text 32532#!:mime text/troff 325330 regex/20l \^\\.[A-Za-z][A-Za-z0-9][\ \t] troff or preprocessor input text 32534!:mime text/troff 325350 regex/20l \^\\.[A-Za-z][A-Za-z0-9]$ troff or preprocessor input text 32536!:mime text/troff 32537 32538# ditroff intermediate output text 325390 search/1 x\ T ditroff output text 32540>4 search/1 cat for the C/A/T phototypesetter 32541>4 search/1 ps for PostScript 32542>4 search/1 dvi for DVI 32543>4 search/1 ascii for ASCII 32544>4 search/1 lj4 for LaserJet 4 32545>4 search/1 latin1 for ISO 8859-1 (Latin 1) 32546>4 search/1 X75 for xditview at 75dpi 32547>>7 search/1 -12 (12pt) 32548>4 search/1 X100 for xditview at 100dpi 32549>>8 search/1 -12 (12pt) 32550 32551# output data formats 325520 string \100\357 very old (C/A/T) troff output data 32553 32554#------------------------------------------------------------------------------ 32555# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 32556# tuxedo: file(1) magic for BEA TUXEDO data files 32557# 32558# from Ian Springer <ispringer@hotmail.com> 32559# 325600 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 32561 32562#------------------------------------------------------------------------------ 32563# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 32564# typeset: file(1) magic for other typesetting 32565# 325660 string Interpress/Xerox Xerox InterPress data 32567>16 string / (version 32568>>17 string >\0 %s) 32569 32570#------------------------------------------------------------------------------ 32571# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $ 32572# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 32573# These types are recognised in file_ascmagic so these encodings can be 32574# treated by text patterns. Missing types are already dealt with internally. 32575# 325760 string +/v8 Unicode text, UTF-7 325770 string +/v9 Unicode text, UTF-7 325780 string +/v+ Unicode text, UTF-7 325790 string +/v/ Unicode text, UTF-7 325800 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 325810 string \000\000\376\377 Unicode text, UTF-32, big-endian 325820 string \377\376\000\000 Unicode text, UTF-32, little-endian 325830 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 32584 32585#------------------------------------------------------------------------------ 32586# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $ 32587# unisig: file(1) magic for files carrying a uniform signature (Unisig) 32588# From: Lassi Kortela, John Cowan 32589# URL: https://github.com/unisig 32590# 325910 string \xDC\xDC\x0D\x0A\x1A\x0A\x00 Unisig: 32592>7 ubyte =0 UUID 32593>>8 guid x %s 32594>7 ubyte >0 URI 32595>>7 pstring x %s 32596 32597#------------------------------------------------------------------------------ 32598# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 32599# unknown: file(1) magic for unknown machines 32600# 32601# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 32602# (executable, pure, and split I&D, respectively), but the PDP-11 version 32603# doesn't have the "version %ld", which may be a bogus COFFism (I don't 32604# think there was ever COFF for the PDP-11). 32605# 32606# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 32607# long, as it would be on a VAX. In any case, that could collide with 32608# VAX demand-paged files, as the magic number is little-endian on those 32609# binaries, so the first 16 bits of the file would contain 0x10B. 32610# 32611# Therefore, those entries are commented out. 32612# 32613# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 32614# 32615#0 short 0x107 unknown machine executable 32616#>8 short >0 not stripped 32617#>15 byte >0 - version %ld 32618#0 short 0x108 unknown pure executable 32619#>8 short >0 not stripped 32620#>15 byte >0 - version %ld 32621#0 short 0x109 PDP-11 separate I&D 32622#>8 short >0 not stripped 32623#>15 byte >0 - version %ld 32624#0 short 0x10b unknown pure executable 32625#>8 short >0 not stripped 32626#>15 byte >0 - version %ld 326270 long 0x10c unknown demand paged pure executable 32628>16 long >0 not stripped 326290 long 0x10e unknown readable demand paged pure executable 32630 32631#------------------------------------------------------------------------------ 32632# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $ 32633# 32634# From Christian Schmidbauer 32635# 32636# https://github.com/PixarAnimationStudios/USD 32637 32638# USD crate file 32639# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450 326400 string PXR-USDC USD crate 32641>8 byte x \b, version %x. 32642>9 byte x \b%x. 32643>10 byte x \b%x 32644!:ext usd 32645 32646# USD ASCII file 326470 string #usda\040 USD ASCII 32648>6 string x \b, version %s 32649!:mime text/plain 32650!:ext usd 32651 32652#------------------------------------------------------------------------------ 32653# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 32654# file(1) magic for uterus files 32655# http://freecode.com/projects/uterus 32656# 326570 string UTE+ uterus file 32658>4 string v \b, version 32659>5 byte x %c 32660>6 string . \b. 32661>7 byte x \b%c 32662>8 string \<\> \b, big-endian 32663>>16 belong >0 \b, slut size %u 32664>8 string \>\< \b, litte-endian 32665>>16 lelong >0 \b, slut size %u 32666>10 byte &8 \b, compressed 32667 32668#------------------------------------------------------------------------------ 32669# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $ 32670# uuencode: file(1) magic for ASCII-encoded files 32671# 32672 32673# GRR: the first line of xxencoded files is identical to that in uuencoded 32674# files, but the first character in most subsequent lines is 'h' instead of 32675# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 32676# punctuation and survives BITNET gateways better.) If regular expressions 32677# were supported, this entry could possibly be split into two with 32678# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 326790 search/1 begin\ uuencoded or xxencoded text 32680 32681# btoa(1) is an alternative to uuencode that requires less space. 326820 search/1 xbtoa\ Begin btoa'd text 32683 32684# ship(1) is another, much cooler alternative to uuencode. 32685# Greg Roelofs, newt@uchicago.edu 326860 search/1 $\012ship ship'd binary text 32687 32688# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 32689# Greg Roelofs, newt@uchicago.edu 326900 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 32691 32692# GRR: handle BASE64 32693 32694#------------------------------------------------------------------------------ 32695# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 32696# vacuum cleaner magic by Thomas M. Ott (ThMO) 32697# 32698# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 32699# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 32700# -> yyyymmdd: year, month, day of cleaning 32701# -> hhmmss: hour, minute, second of cleaning 32702# -> xxxxxx: 6 digits 32703# -> cc: cleaning runs counter 32704# size: 136044 bytes 32705# 32706# struct maphdr { 32707# int32_t map_cnt; /* 0: single map */ 32708# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 32709# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 32710# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 32711# int32_t unknown; /* 16: 50000 ??? */ 32712# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 32713# int32_t block_max; /* 24: 1000 == max. # of blocks */ 32714# int32_t route_max; /* 28: 1000 == max. # of routes */ 32715# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 32716# int32_t cell_dim; /* 36: 10 == cell dimension */ 32717# int32_t clock_tick; /* 40: 100 == clock ticks */ 32718# #if 0 32719# struct { /* 44: 1000 blocks for 10x10 cells */ 32720# int32_t yoffset; 32721# int32_t xoffset; 32722# int32_t posxy; 32723# int32_t timecode; 32724# } blocks[ 1000]; 32725# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 32726# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 32727# #endif 32728# }; 32729 327300 lelong =1 32731>4 lelong =100 32732>>8 lelong =10000 32733>>>12 lelong =50 32734>>>>16 lelong =50000 32735>>>>>20 lelong =100 32736>>>>>>24 lelong =1000 32737>>>>>>>28 lelong =1000 32738>>>>>>>>36 lelong =10 32739>>>>>>>>>40 lelong =100 32740>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 32741>>>>>>>>>>136040 lelong =-1 reuse map data 32742>>>>>>>>>>136040 lelong =0 map data 32743>>>>>>>>>>136040 lelong >0 spurious map data 32744>>>>>>>>>>136040 lelong <-1 spurious map data 32745 32746 32747 32748#------------------------------------------------------------------------------ 32749# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 32750# varied.out: file(1) magic for various USG systems 32751# 32752# Herewith many of the object file formats used by USG systems. 32753# Most have been moved to files for a particular processor, 32754# and deleted if they duplicate other entries. 32755# 327560 short 0610 Perkin-Elmer executable 32757# AMD 29K 327580 beshort 0572 amd 29k coff noprebar executable 327590 beshort 01572 amd 29k coff prebar executable 327600 beshort 0160007 amd 29k coff archive 32761# Cray 327626 beshort 0407 unicos (cray) executable 32763# Ultrix 4.3 32764596 string \130\337\377\377 Ultrix core file 32765>600 string >\0 from '%s' 32766# BeOS and MAcOS PEF executables 32767# From: hplus@zilker.net (Jon Watte) 327680 string Joy!peffpwpc header for PowerPC PEF executable 32769# 32770# ava assembler/linker Uros Platise <uros.platise@ijs.si> 327710 string avaobj AVR assembler object code 32772>7 string >\0 version '%s' 32773# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 327740 string gmon GNU prof performance data 32775>4 long x - version %d 32776# From: Dave Pearson <davep@davep.org> 32777# Harbour <URL:http://harbour-project.org/> HRB files. 327780 string \xc0HRB Harbour HRB file 32779>4 leshort x version %d 32780# Harbour HBV files 327810 string \xc0HBV Harbour variable dump file 32782>4 leshort x version %d 32783 32784# From: Alex Beregszaszi <alex@fsn.hu> 32785# 0 string exec BugOS executable 32786# 0 string pack BugOS archive 32787 32788# From: Jason Spence <jspence@lightconsulting.com> 32789# Generated by the "examples" in STM's ST40 devkit, and derived code. 327900 lelong 0x13a9f17e ST40 component image format 32791>4 string >\0 \b, name '%s' 32792 32793#------------------------------------------------------------------------------ 32794# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $ 32795# varied.script: file(1) magic for various interpreter scripts 32796 327970 string/t #!\ / a 32798>3 string >\0 %s script text executable 32799!:strength / 2 32800 328010 string/b #!\ / a 32802>3 string >\0 %s script executable (binary data) 32803!:strength / 2 32804 328050 string/t #!\t/ a 32806>3 string >\0 %s script text executable 32807!:strength / 2 32808 328090 string/b #!\t/ a 32810>3 string >\0 %s script executable (binary data) 32811!:strength / 2 32812 328130 string/t #!/ a 32814>2 string >\0 %s script text executable 32815!:strength / 2 32816 328170 string/b #!/ a 32818>2 string >\0 %s script executable (binary data) 32819!:strength / 2 32820 328210 string/t #!\ script text executable 32822>3 string >\0 for %s 32823!:strength / 2 32824 328250 string/b #!\ script executable 32826>3 string >\0 for %s (binary data) 32827!:strength / 2 32828 32829# using env 328300 string/t #!/usr/bin/env a 32831>15 string/t >\0 %s script text executable 32832!:strength / 10 32833 328340 string/b #!/usr/bin/env a 32835>15 string/b >\0 %s script executable (binary data) 32836!:strength / 10 32837 328380 string/t #!\ /usr/bin/env a 32839>16 string/t >\0 %s script text executable 32840!:strength / 10 32841 328420 string/b #!\ /usr/bin/env a 32843>16 string/b >\0 %s script executable (binary data) 32844!:strength / 10 32845 32846# From: arno <arenevier@fdn.fr> 32847# mozilla xpconnect typelib 32848# see https://www.mozilla.org/scriptable/typelib_file.html 328490 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 32850>0x10 byte x version %d 32851>>0x11 byte x \b.%d 32852 32853#------------------------------------------------------------------------------ 32854# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $ 32855# vax: file(1) magic for VAX executable/object and APL workspace 32856# 328570 lelong 0101557 VAX single precision APL workspace 328580 lelong 0101556 VAX double precision APL workspace 32859 32860# 32861# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 32862# executables, and are handled in aout) 32863# 328640 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 32865>16 lelong >0 not stripped 32866 32867# 32868# VAX COFF 32869# 32870# The `versions' were commented out, but have been un-commented out. 32871# (Was the problem just one of endianness?) 32872# 328730 leshort 0570 32874>2 uleshort <100 VAX COFF executable, sections %d 32875>>4 ledate x \b, created %s 32876>>12 lelong >0 \b, not stripped 32877>>22 leshort >0 \b, version %d 32878 328790 leshort 0575 32880>2 uleshort <100 VAX COFF pure executable, sections %d 32881>>4 ledate x \b, created %s 32882>>12 lelong >0 \b, not stripped 32883>>22 leshort >0 \b, version %d 32884 32885#------------------------------------------------------------------------------ 32886# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 32887# vicar: file(1) magic for VICAR files. 32888# 32889# From: Ossama Othman <othman@astrosun.tn.cornell.edu 32890# VICAR is JPL's in-house spacecraft image processing program 32891# VICAR image 328920 string LBLSIZE= VICAR image data 32893>32 string BYTE \b, 8 bits = VAX byte 32894>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 32895>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 32896>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 32897>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 32898>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 32899# VICAR label file 3290043 string SFDU_LABEL VICAR label file 32901 32902#------------------------------------------------------------------------------ 32903# $File: virtual,v 1.13 2021/02/23 00:51:10 christos Exp $ 32904# From: James Nobis <quel@quelrod.net> 32905# Microsoft hard disk images for: 32906# Virtual Server 32907# Virtual PC 32908# VirtualBox 32909# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 32910# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 32911# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 329120 string connectix Microsoft Disk Image, Virtual Server or Virtual PC 32913# alternative shorter names 32914#0 string connectix Microsoft Virtual Hard Disk image 32915#0 string connectix Microsoft Virtual HD image 32916!:mime application/x-virtualbox-vhd 32917!:ext vhd 32918# Features is a bit field used to indicate specific feature support 32919#>8 ubelong !0x00000002 \b, Features 0x%x 32920# Reserved. This bit must always be set to 1. 32921#>8 ubelong &0x00000002 \b, Reserved 0x%x 32922# File Format Version for the current specification 0x00010000 32923#>12 ubelong !0x00010000 \b, Version 0x%8.8x 32924# Data Offset only found 0x200 32925#>16 ubequad !0x200 \b, Data Offset 0x%llx 32926#>16 ubequad x \b, at 0x%llx 32927# Dynamic Disk Header cookie like cxsparse 32928#>(16.Q) string x "%-.8s" 32929# This field contains a Unicode string (UTF-16) of the parent hard disk filename 32930#>(16.Q+64) ubequad x \b, parent name 0x%llx 32931# Creator Application 32932# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 32933>28 string x \b, Creator %-4.4s 32934# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 32935# holds the major/minor version of the application that created the image 32936>32 ubeshort x %x 32937>34 ubeshort x \b.%x 32938#>32 ubelong x \b, Version 0x%8.8x 32939# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 32940>36 ubelong x ( 32941>>36 ubelong 0x5769326B \bW2k 32942>>36 ubelong 0x4D616320 \bMac 32943>>36 default x \b0x 32944>>>36 ubelong x \b%8.8x 32945# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 32946>24 bedate+946684800 x \b) %s 32947# Original Size 32948#>40 ubequad x \b, o.-Size 0x%llx 32949# Current Size is same as original size, but change when disk is expanded 32950#>48 ubequad x \b, Size 0x%llx 32951>48 ubequad x \b, %llu bytes 32952# Disk Geometry: cylinder, heads, and sectors/track for hard disk 32953#>56 ubeshort x \b, Cylinder 0x%x 32954>56 ubeshort x \b, CHS %u 32955# Heads 32956#>58 ubyte x \b, Heads 0x%x 32957>58 ubyte x \b/%u 32958# Sectors per track 32959#>59 ubyte x \b, Sectors 0x%x 32960>59 ubyte x \b/%u 32961# Disk Type: 3~Dynamic hard disk 32962>60 ubelong !0x3 \b, type 0x%x 32963# Checksum 32964#>64 ubelong x \b, cksum 0x%x 32965# universally unique identifier (UUID) to associate a parent with its differencing image 32966#>68 ubequad x \b, id 0x%16.16llx 32967#>76 ubequad x \b-%16.16llx 32968# Saved State: 1~Saved State 32969>84 ubyte !0 \b, State 0x%x 32970# Reserved 427 bytes with nils 32971#>85 ubequad !0 \b, Reserved 0x%16.16llx 32972 32973# From: Joerg Jenderek 32974# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 32975# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 32976# MS-VHDX/[MS-VHDX].pdf 32977# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 32978# TODO: find and display values like virtual size, disk size, cluster_size, etc 32979# display id in GUID format 32980# 32981# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 329820 string vhdxfile 32983# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 32984>0x10000 string head Microsoft Disk Image eXtended 32985#>0x20000 string head \b, 2nd header 32986#!:mime application/x-virtualbox-vhdx 32987!:ext vhdx 32988# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 32989>>8 lestring16 x \b, by %.256s 32990# The Checksum field is a CRC-32C hash over the entire 4 KB structure 32991#>>0x10004 ulelong x \b, CRC 0x%x 32992# SequenceNumber 32993>>0x10008 ulequad x \b, sequence 0x%llx 32994# FileWriteGuid 32995#>>0x10010 ubequad x \b, file id 0x%llx 32996#>>>0x10018 ubequad x \b-%llx 32997# DataWriteGuid 32998#>>0x10020 ubequad x \b, data id 0x%llx 32999#>>>0x10028 ubequad x \b-%llx 33000# LogGuid. If this field is zero, then the log is empty or has no valid entries 33001>>0x10030 ubequad >0 \b, log id 0x%llx 33002>>>0x10038 ubequad x \b-%llx 33003# LogVersion. If not 0 there is a log to replay 33004>>0x10040 uleshort >0 \b, LogVersion 0x%x 33005# Version. This field must be set to 1 33006>>0x10042 uleshort !1 \b, Version 0x%x 33007# LogLength must be multiples of 1 MB 33008>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 33009# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 33010>>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx 33011# Log Entry Signature must be 0x65676F6C~loge 33012>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 33013>>(0x10048.q) ulelong =0x65676F6C \b; LOG 33014# Log Entry Checksum 33015#>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x 33016# Log Entry Length must be a multiple of 4 KB 33017>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 33018# Log Entry Tail must be a multiple of 4 KB 33019#>>>(0x10048.q+12) ulelong x \b, Tail 0x%x 33020# Log Entry SequenceNumber 33021#>>>(0x10048.q+16) ulequad x \b, # 0x%llx 33022# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 33023#>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx 33024# Log Entry Reserved must be set to 0 33025>>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x 33026# Log Entry LogGuid 33027#>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx 33028#>>>(0x10048.q+40) ubequad x \b-%llx 33029# Log Entry FlushedFileOffset should VHDX size when entry is written. 33030#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 33031# Log Entry LastFileOffset 33032#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 33033# filling 33034#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 33035# Reserved[4016] 33036#>>0x10050 ulequad >0 \b, Reserved 0x%llx 33037# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 33038>0x30000 ulelong !0x69676572 \b, 1st region INVALID 33039>0x30000 ulelong =0x69676572 \b; region 33040# region Checksum. CRC-32C hash over the entire 64-KB table 33041#>>0x30004 ulelong x \b, CRC 0x%x 33042# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 33043>>0x30008 ulelong x \b, %u entries 33044# reserved must be zero 33045#>>0x3000C ulelong !0 \b, RESERVED 0x%x 33046# Region Table Entry starts with identifier for the object. often BAT id 33047>>0x30010 use vhdx-id 33048# FileOffset 33049>>0x30020 ulequad x \b, at 0x%llx 33050# Length. Specifies the length of the object within the file 33051#>>0x30028 ulelong x \b, Length 0x%x 33052# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 33053>>0x3002C ulelong x \b, Required %u 33054# 2nd region entry often metadata id 33055>>0x30030 use vhdx-id 33056# 2nd entry FileOffset 33057>>0x30040 ulequad x \b, at 0x%llx 33058# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 33059>>0x3004C ulelong x \b, Required %u 33060# 2nd region 33061>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 33062# check in vhdx images for known id and show names instead hexadecimal 330630 name vhdx-id 33064# https://www.windowstricks.in/online-windows-guid-converter 33065# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 33066# 6677C22D23F600429D64115E9BFD4A08 BAT ID 33067>0 ubequad =0x6677C22D23F60042 33068>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 33069# no BAT id 33070>>8 default x 33071>>>0 use vhdx-id-hex 33072# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 33073# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 33074>0 ubequad =0x06A27C8B90479A4B 33075>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 33076# no Metadata id 33077>>8 default x 33078>>>0 use vhdx-id-hex 33079# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 33080# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 33081# value "virtual size" can be verified by command `qemu-img info ` 33082>0 ubequad =0x2442A52F1BCD7648 33083>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 33084# no Virtual Disk Size ID 33085>>8 default x 33086>>>0 use vhdx-id-hex 33087# other ids 33088>0 default x 33089>>0 use vhdx-id-hex 33090# in vhdx images show id as hexadecimal 330910 name vhdx-id-hex 33092>0 ubequad x \b, ID 0x%16.16llx 33093>8 ubequad x \b-%16.16llx 33094# 33095# libvirt 33096# From: Philipp Hahn <hahn@univention.de> 330970 string LibvirtQemudSave Libvirt QEMU Suspend Image 33098>0x10 lelong x \b, version %u 33099>0x14 lelong x \b, XML length %u 33100>0x18 lelong 1 \b, running 33101>0x1c lelong 1 \b, compressed 33102 331030 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 33104# From: Alex Beregszaszi <alex@fsn.hu> 331050 string/b COWD VMWare3 33106>4 byte 3 disk image 33107>>32 lelong x (%d/ 33108>>36 lelong x \b%d/ 33109>>40 lelong x \b%d) 33110>4 byte 2 undoable disk image 33111>>32 string >\0 (%s) 33112 331130 string/b VMDK VMware4 disk image 331140 string/b KDMV VMware4 disk image 33115 33116#-------------------------------------------------------------------- 33117# Qemu Emulator Images 33118# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 33119# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 33120# Made by reading sources, reading documentation, and doing trial and error 33121# on existing QCOW files 331220 string/b QFI\xFB 33123 33124# Uncomment the following line to display Magic (only used for debugging 33125# this magic number) 33126#>0 string/b x , Magic: %s 33127 33128# There are currently 2 Versions: "1" and "2". 33129# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 33130>4 belong !1 QEMU QCOW2 Image 33131>4 belong 1 QEMU QCOW Image (v1) 33132 33133# Using the existence of the Backing File Offset to determine whether 33134# to read Backing File Information 33135>>12 belong >0 \b, has backing file ( 33136# Note that this isn't a null-terminated string; the length is actually 33137# (16.L). Assuming a null-terminated string happens to work usually, but it 33138# may spew junk until it reaches a \0 in some cases. 33139>>>(12.L) string >\0 \bpath %s 33140 33141# Modification time of the Backing File 33142# Really useful if you want to know if your backing 33143# file is still usable together with this image 33144>>>>20 bedate >0 \b, mtime %s) 33145>>>>20 default x \b) 33146 33147# Size is stored in bytes in a big-endian u64. 33148>>24 bequad x \b, %lld bytes 33149 33150# 1 for AES encryption, 0 for none. 33151>>36 belong 1 \b, AES-encrypted 33152 33153# https://www.gnome.org/~markmc/qcow-image-format.html 33154>4 belong 2 (v2) 33155# Using the existence of the Backing File Offset to determine whether 33156# to read Backing File Information 33157>>8 bequad >0 \b, has backing file 33158# Note that this isn't a null-terminated string; the length is actually 33159# (16.L). Assuming a null-terminated string happens to work usually, but it 33160# may spew junk until it reaches a \0 in some cases. Also, since there's no 33161# .Q modifier, we just use the bottom four bytes as an offset. Note that if 33162# the file is over 4G, and the backing file path is stored after the first 4G, 33163# the wrong filename will be printed. (This should be (8.Q), when that syntax 33164# is introduced.) 33165>>>(12.L) string >\0 (path %s) 33166>>24 bequad x \b, %lld bytes 33167>>32 belong 1 \b, AES-encrypted 33168 33169>4 belong 3 (v3) 33170# Using the existence of the Backing File Offset to determine whether 33171# to read Backing File Information 33172>>8 bequad >0 \b, has backing file 33173# Note that this isn't a null-terminated string; the length is actually 33174# (16.L). Assuming a null-terminated string happens to work usually, but it 33175# may spew junk until it reaches a \0 in some cases. Also, since there's no 33176# .Q modifier, we just use the bottom four bytes as an offset. Note that if 33177# the file is over 4G, and the backing file path is stored after the first 4G, 33178# the wrong filename will be printed. (This should be (8.Q), when that syntax 33179# is introduced.) 33180>>>(12.L) string >\0 (path %s) 33181>>24 bequad x \b, %lld bytes 33182>>32 belong 1 \b, AES-encrypted 33183 33184>4 default x (unknown version) 33185 331860 string/b QEVM QEMU suspend to disk image 33187 33188# QEMU QED Image 33189# https://wiki.qemu.org/Features/QED/Specification 331900 string/b QED\0 QEMU QED Image 33191 33192# VDI Image 33193# Sun xVM VirtualBox Disk Image 33194# From: Richard W.M. Jones <rich@annexia.org> 33195# VirtualBox Disk Image 331960x40 ulelong 0xbeda107f VirtualBox Disk Image 33197>0x44 uleshort >0 \b, major %u 33198>0x46 uleshort >0 \b, minor %u 33199>0 string >\0 (%s) 33200>368 lequad x \b, %lld bytes 33201 332020 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 33203>32 string x type %s, 33204>48 string x subtype %s 33205 332060 lelong 0x02468ace Bochs Sparse disk image 33207 33208 33209#------------------------------------------------------------------------------ 33210# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 33211# Virtutech Compressed Random Access File Format 33212# 33213# From <gustav@virtutech.com> 332140 string \211\277\036\203 Virtutech CRAFF 33215>4 belong x v%d 33216>20 belong 0 uncompressed 33217>20 belong 1 bzipp2ed 33218>20 belong 2 gzipped 33219>24 belong 0 not clean 33220 33221#------------------------------------------------------------------------------ 33222# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 33223# visx: file(1) magic for Visx format files 33224# 332250 short 0x5555 VISX image file 33226>2 byte 0 (zero) 33227>2 byte 1 (unsigned char) 33228>2 byte 2 (short integer) 33229>2 byte 3 (float 32) 33230>2 byte 4 (float 64) 33231>2 byte 5 (signed char) 33232>2 byte 6 (bit-plane) 33233>2 byte 7 (classes) 33234>2 byte 8 (statistics) 33235>2 byte 10 (ascii text) 33236>2 byte 15 (image segments) 33237>2 byte 100 (image set) 33238>2 byte 101 (unsigned char vector) 33239>2 byte 102 (short integer vector) 33240>2 byte 103 (float 32 vector) 33241>2 byte 104 (float 64 vector) 33242>2 byte 105 (signed char vector) 33243>2 byte 106 (bit plane vector) 33244>2 byte 121 (feature vector) 33245>2 byte 122 (feature vector library) 33246>2 byte 124 (chain code) 33247>2 byte 126 (bit vector) 33248>2 byte 130 (graph) 33249>2 byte 131 (adjacency graph) 33250>2 byte 132 (adjacency graph library) 33251>2 string .VISIX (ascii text) 33252 33253#------------------------------------------------------------------------------ 33254# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 33255# vms: file(1) magic for VMS executables (experimental) 33256# 33257# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 33258 33259# GRR 950122: I'm just guessing on these, based on inspection of the headers 33260# of three executables each for Alpha and VAX architectures. The VAX files 33261# all had headers similar to this: 33262# 33263# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 33264# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 33265# 332660 string \xb0\0\x30\0 VMS VAX executable 33267>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 33268# 33269# The AXP files all looked like this, except that the byte at offset 0x22 33270# was 06 in some of them and 07 in others: 33271# 33272# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 33273# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 33274# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 33275# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 33276# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 33277# 33278# GRR this test is still too general as it catches example adressen.dbt 332790 belong 0x03000000 33280>8 ubelong 0xec020000 VMS Alpha executable 33281>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 33282 33283#------------------------------------------------------------------------------ 33284# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 33285# VMware specific files (deducted from version 1.1 and log file entries) 33286# Anthon van der Neut (anthon@mnt.org) 332870 belong 0x4d52564e VMware nvram 33288 33289#------------------------------------------------------------------------------ 33290# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $ 33291# vorbis: file(1) magic for Ogg/Vorbis files 33292# 33293# From Felix von Leitner <leitner@fefe.de> 33294# Extended by Beni Cherniavsky <cben@crosswinds.net> 33295# Further extended by Greg Wooledge <greg@wooledge.org> 33296# 33297# Most (everything but the number of channels and bitrate) is commented 33298# out with `##' as it's not interesting to the average user. The most 33299# probable things advanced users would want to uncomment are probably 33300# the number of comments and the encoder version. 33301# 33302# FIXME: The first match has been made a search, so that it can skip 33303# over prepended ID3 tags. This will work for MIME type detection, but 33304# won't work for detecting other properties of the file (they all need 33305# to be made relative to the search). In any case, if the file has ID3 33306# tags, the ID3 information will be printed, not the Ogg information, 33307# so until that's fixed, this doesn't matter. 33308# FIXME[2]: Disable the above for now, since search assumes text mode. 33309# 33310# --- Ogg Framing --- 33311#0 search/1000 OggS Ogg data 333120 string OggS Ogg data 33313>4 byte !0 UNKNOWN REVISION %u 33314##>4 byte 0 revision 0 33315>4 byte 0 33316##>>14 lelong x (Serial %lX) 33317# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 33318>>28 string \x7fFLAC \b, FLAC audio 33319# non-Vorbis content: Theora 33320!:mime audio/ogg 33321>>28 string \x80theora \b, Theora video 33322!:mime video/ogg 33323# non-Vorbis content: Kate 33324>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 33325!:mime application/ogg 33326>>>37 ubyte x v%u 33327>>>38 ubyte x \b.%u, 33328>>>40 byte 0 utf8 encoding, 33329>>>40 byte !0 unknown character encoding, 33330>>>60 string >\0 language %s, 33331>>>60 string \0 no language set, 33332>>>76 string >\0 category %s 33333>>>76 string \0 no category set 33334# non-Vorbis content: Skeleton 33335>>28 string fishead\0 \b, Skeleton 33336!:mime video/ogg 33337>>>36 leshort x v%u 33338>>>40 leshort x \b.%u 33339# non-Vorbis content: Speex 33340>>28 string Speex\ \ \ \b, Speex audio 33341!:mime audio/ogg 33342# non-Vorbis content: OGM 33343>>28 string \x01video\0\0\0 \b, OGM video 33344!:mime video/ogg 33345>>>37 string/c div3 (DivX 3) 33346>>>37 string/c divx (DivX 4) 33347>>>37 string/c dx50 (DivX 5) 33348>>>37 string/c xvid (XviD) 33349# --- First vorbis packet - general header --- 33350>>28 string \x01vorbis \b, Vorbis audio, 33351!:mime audio/ogg 33352>>>35 lelong !0 UNKNOWN VERSION %u, 33353##>>>35 lelong 0 version 0, 33354>>>35 lelong 0 33355>>>>39 ubyte 1 mono, 33356>>>>39 ubyte 2 stereo, 33357>>>>39 ubyte >2 %u channels, 33358>>>>40 lelong x %u Hz 33359# Minimal, nominal and maximal bitrates specified when encoding 33360>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 33361# The above tests if at least one of these is specified: 33362>>>>>52 lelong !-1 33363# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 33364# instead of -1. 33365# Vorbis 1.0 uses 0 instead of -1. 33366>>>>>>52 lelong !0 33367>>>>>>>52 lelong !-1000 33368>>>>>>>>52 lelong x <%u 33369>>>>>48 lelong !-1 33370>>>>>>48 lelong x ~%u 33371>>>>>44 lelong !-1 33372>>>>>>44 lelong !-1000 33373>>>>>>>44 lelong !0 33374>>>>>>>>44 lelong x >%u 33375>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 33376# -- Second vorbis header packet - the comments 33377# A kludge to read the vendor string. It's a counted string, not a 33378# zero-terminated one, so file(1) can't read it in a generic way. 33379# libVorbis is the only one existing currently, so I detect specifically 33380# it. The interesting value is the cvs date (8 digits decimal). 33381# Post-RC1 Ogg files have the second header packet (and thus the version) 33382# in a different place, so we must use an indirect offset. 33383>>>(84.b+85) string \x03vorbis 33384>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 33385>>>>>(84.b+120) string >00000000 33386# Map to beta version numbers: 33387>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 33388>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 33389>>>>>>(84.b+120) string >20000508 33390>>>>>>>(84.b+120) string <20001031 (beta2-3) 33391>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 33392>>>>>>(84.b+120) string >20001031 33393>>>>>>>(84.b+120) string <20010225 (beta3-4) 33394>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 33395>>>>>>(84.b+120) string >20010225 33396>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 33397>>>>>>(84.b+120) string 20010615 (1.0 RC1) 33398>>>>>>(84.b+120) string 20010813 (1.0 RC2) 33399>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 33400>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 33401>>>>>>(84.b+120) string 20011217 (1.0 RC3) 33402>>>>>>(84.b+120) string 20011231 (1.0 RC3) 33403# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 33404>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 33405# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 33406>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 33407>>>>>(84.b+117) string >00000000 33408>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 33409>>>>>>(84.b+117) string 20020717 (1.0) 33410>>>>>>(84.b+117) string 20030909 (1.0.1) 33411>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 33412>>>>>>(84.b+117) string 20050304 (1.1.2) 33413>>>>>>(84.b+117) string 20070622 (1.2.0) 33414>>>>>>(84.b+117) string 20090624 (1.2.2) 33415>>>>>>(84.b+117) string 20090709 (1.2.3) 33416>>>>>>(84.b+117) string 20100325 (1.3.1) 33417>>>>>>(84.b+117) string 20101101 (1.3.2) 33418>>>>>>(84.b+117) string 20120203 (1.3.3) 33419>>>>>>(84.b+117) string 20140122 (1.3.4) 33420>>>>>>(84.b+117) string 20150105 (1.3.5) 33421 33422# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5 33423>>28 string OpusHead \b, Opus audio, 33424!:mime audio/ogg 33425>>>36 ubyte >0x0F UNKNOWN VERSION %u, 33426>>>36 ubyte&0x0F !0 version 0.%u, 33427>>>>46 ubyte >1 33428>>>>>46 ubyte !255 unknown channel mapping family %u, 33429>>>>>37 ubyte x %u channels 33430>>>>46 ubyte 0 33431>>>>>37 ubyte 1 mono 33432>>>>>37 ubyte 2 stereo 33433>>>>46 ubyte 1 33434>>>>>37 ubyte 1 mono 33435>>>>>37 ubyte 2 stereo 33436>>>>>37 ubyte 3 linear surround 33437>>>>>37 ubyte 4 quadraphonic 33438>>>>>37 ubyte 5 5.0 surround 33439>>>>>37 ubyte 6 5.1 surround 33440>>>>>37 ubyte 7 6.1 surround 33441>>>>>37 ubyte 8 7.1 surround 33442>>>>40 lelong !0 \b, %u Hz (Input Sample Rate) 33443#------------------------------------------------------------------------------ 33444# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 33445# VXL: file(1) magic for VXL binary IO data files 33446# 33447# from Ian Scott <scottim@sf.net> 33448# 33449# VXL is a collection of C++ libraries for Computer Vision. 33450# See the vsl chapter in the VXL Book for more info 33451# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 33452# http:/vxl.sf.net 33453 334542 lelong 0x472b2c4e VXL data file, 33455>0 leshort >0 schema version no %d 33456 33457#------------------------------------------------------------------------------ 33458# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $ 33459# warc: file(1) magic for WARC files 33460 334610 string WARC/ WARC Archive 33462>5 string x version %.4s 33463!:mime application/warc 33464 33465#------------------------------------------------------------------------------ 33466# Arc File Format from Internet Archive 33467# see https://www.archive.org/web/researcher/ArcFileFormat.php 334680 string filedesc:// Internet Archive File 33469!:mime application/x-ia-arc 33470>11 search/256 \x0A \b 33471>>&0 ubyte >0 \b version %c 33472 33473#------------------------------------------------------------------------------ 33474# weak: file(1) magic for very weak magic entries, disabled by default 33475# 33476# These entries are so weak that they might interfere identification of 33477# other formats. Example include: 33478# - Only identify for 1 or 2 bytes 33479# - Match against very wide range of values 33480# - Match against generic word in some spoken languages (e.g. English) 33481 33482# Summary: Computer Graphics Metafile 33483# Extension: .cgm 33484#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 33485#0 beshort 0x3020 character Computer Graphics Metafile 33486 33487#0 string =!! Bennet Yee's "face" format 33488 33489#------------------------------------------------------------------------------ 33490# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $ 33491 33492# http://www.rdfhdt.org/ 33493# From Christoph Biedl 33494# http://www.rdfhdt.org/hdt-internals/ 33495# https://github.com/rdfhdt/hdt-cpp 33496 334970 string $HDT\x01 HDT file (binary compressed indexed RDF triples) type 1 33498!:mime application/vnd.hdt 33499!:ext hdt 33500#------------------------------------------------------------------------------ 33501# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $ 33502# webassembly: file(1) magic for WebAssembly modules 33503# 33504# WebAssembly is a virtual architecture developed by a W3C Community 33505# Group at https://webassembly.org/. The file extension is .wasm, and 33506# the MIME type is application/wasm. 33507# 33508# https://webassembly.org/docs/binary-encoding/ is the main 33509# document describing the binary format. 33510# From: Pip Cet <pipcet@gmail.com> and Joel Martin 33511 335120 string \0asm WebAssembly (wasm) binary module 33513>4 lelong =1 version %#x (MVP) 33514>4 lelong >1 version %#x 33515 33516#------------------------------------------------------------------------------ 33517# $File: windows,v 1.36 2021/02/05 22:29:07 christos Exp $ 33518# windows: file(1) magic for Microsoft Windows 33519# 33520# This file is mainly reserved for files where programs 33521# using them are run almost always on MS Windows 3.x or 33522# above, or files only used exclusively in Windows OS, 33523# where there is no better category to allocate for. 33524# For example, even though WinZIP almost run on Windows 33525# only, it is better to treat them as "archive" instead. 33526# For format usable in DOS, such as generic executable 33527# format, please specify under "msdos" file. 33528# 33529 33530 33531# Summary: Outlook Express DBX file 33532# Extension: .dbx 33533# Created by: Christophe Monniez 335340 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 33535>4 byte =0xC5 \b, message database 33536>4 byte =0xC6 \b, folder database 33537>4 byte =0xC7 \b, account information 33538>4 byte =0x30 \b, offline database 33539 33540 33541# Summary: Windows crash dump 33542# Extension: .dmp 33543# Created by: Andreas Schuster (https://computer.forensikblog.de/) 33544# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html 33545# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 335460 string PAGE 33547>4 string DUMP MS Windows 32bit crash dump 33548>>0x05c byte 0 \b, no PAE 33549>>0x05c byte 1 \b, PAE 33550>>0xf88 lelong 1 \b, full dump 33551>>0xf88 lelong 2 \b, kernel dump 33552>>0xf88 lelong 3 \b, small dump 33553>>0x068 lelong x \b, %d pages 33554>4 string DU64 MS Windows 64bit crash dump 33555>>0xf98 lelong 1 \b, full dump 33556>>0xf98 lelong 2 \b, kernel dump 33557>>0xf98 lelong 3 \b, small dump 33558>>0x090 lequad x \b, %lld pages 33559 33560 33561# Summary: Vista Event Log 33562# Extension: .evtx 33563# Created by: Andreas Schuster (https://computer.forensikblog.de/) 33564# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html 335650 string ElfFile\0 MS Windows Vista Event Log 33566>0x2a leshort x \b, %d chunks 33567>>0x10 lelong x \b (no. %d in use) 33568>0x18 lelong >1 \b, next record no. %d 33569>0x18 lelong =1 \b, empty 33570>0x78 lelong &1 \b, DIRTY 33571>0x78 lelong &2 \b, FULL 33572 33573# Summary: Windows System Deployment Image 33574# Created by: Joerg Jenderek 33575# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 33576# Reference: http://skolk.livejournal.com/1320.html 335770 string $SDI 33578>4 string 0001 System Deployment Image 33579!:mime application/x-ms-sdi 33580#!:mime application/octet-stream 33581# \Boot\boot.sdi 33582!:ext sdi 33583# MDBtype: 0~Unspecified 1~RAM 2~ROM 33584>>8 ulequad !0 \b, MDBtype 0x%llx 33585# BootCodeOffset 33586>>16 ulequad !0 \b, BootCodeOffset 0x%llx 33587# BootCodeSize 33588>>24 ulequad !0 \b, BootCodeSize 0x%llx 33589# VendorID 33590>>32 ulequad !0 \b, VendorID 0x%llx 33591# DeviceID 33592>>40 ulequad !0 \b, DeviceID 0x%llx 33593# DeviceModel 33594>>48 ulequad !0 \b, DeviceModel 0x%llx 33595>>>56 ulequad !0 \b%llx 33596# DeviceRole 33597>>64 ulequad !0 \b, DeviceRole 0x%llx 33598# Reserved1; reserved fields and gaps between BLOBs are padded with \0 33599#>>72 ulequad !0 \b, Reserved1 0x%llx 33600# RuntimeGUID 33601>>80 ulequad !0 \b, RuntimeGUID 0x%llx 33602>>>88 ulequad !0 \b%llx 33603# RuntimeOEMrev 33604>>96 ulequad !0 \b, RuntimeOEMrev 0x%llx 33605# Reserved2 33606#>>104 ulequad !0 \b, Reserved2 0x%llx 33607# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 33608>>112 ulequad !0 \b, PageAlignment %llu 33609# Reserved3[48] 33610#>>120 ulequad !0 \b, Reserved3 0x%llx 33611# SDI checksum 39h 33612>>0x1f8 ulequad x \b, checksum 0x%llx 33613# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 33614>>0x400 string >\0 \b, type %-3.8s 33615# 0~non-filesystem 7~NTFS 6~BIGFAT 33616>>>0x420 ulequad !0 (0x%llx) 33617# ATTRibutes 33618>>>0x408 ulequad !0 0x%llx attributes 33619# Offset 33620>>>0x410 ulequad x at 0x%llx 33621# print 1 space after size and then handles NTFS boot sector by ./filesystems 33622>>>0x418 ulequad >0 %llu bytes 33623>>>>(0x410.l) indirect x 33624# 2nd BLOB: WIM 33625>>0x440 string >\0 \b, type %-3.8s 33626>>>0x428 ulequad !0 (0x%llx) 33627# ATTRibutes 33628>>>0x448 ulequad !0 0x%llx attributes 33629# Offset 33630>>>0x450 ulequad x at 0x%llx 33631>>>0x458 ulequad >0 %llu bytes 33632>>>>(0x450.l) indirect x 33633# 3rd BLOB 33634>>0x480 string >\0 \b, type %-3.8s 33635 33636# Summary: Windows boot status log BOOTSTAT.DAT 33637# From: Joerg Jenderek 33638# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 33639# Note: mainly refers to older Windows Vista, sometimes 33640# BOOTSTAT.DAT only contains nulls or invalid data 33641# checking for valid version below 5 336420 ulelong <5 33643# skip many ISO images by checking for valid 64 KiB file size 33644>8 ulelong =0x00010000 33645>>0 use bootstat-dat 33646# display information of BOOTSTAT.DAT 336470 name bootstat-dat 33648>0 ulelong x Windows boot log 33649#!:mime application/octet-stream 33650!:mime application/x-ms-dat 33651# BOOTSTAT.DAT in BOOT subdirectory 33652!:ext dat 33653# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 33654>0 ulelong >2 \b, version %u 33655# apparently the size of the header: often 10h in older Windows, 14h, 18h 33656>4 ulelong !0x10 \b, header size 0x%x 33657#>4 ulelong !0x10 \b, header size %u 33658# apparently the size of the file: always 0x00010000~64KiB 33659# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 33660>8 ulelong !0x00010000 \b, file size 0x%x 33661# size of valid data, in bytes: C8h 50h 172h 5D5Ch 33662>0xc ulelong x \b, 0x%x valid bytes 33663# skip header and jump to first bootstat entry and display information 33664>(0x4.l-1) ubyte x 33665>>&0 use bootstat-entry 33666# jump to first entry again because pointer are bad after "use" 33667>(0x4.l-1) ubyte x 33668# by 1st entry size jump to 2nd entry and display information 33669>>&(&0x18.l-1) ubyte x 33670>>>&0 use bootstat-entry 33671# jump to possible 3rd boot entry and display information 33672# >(0x4.l-1) ubyte x 33673# >>&(&0x18.l-1) ubyte x 33674# >>>&(&0x18.l-1) ubyte x 33675# >>>>&0 use bootstat-entry 33676# display BOOTSTAT.DAT entry 336770 name bootstat-entry 33678#>0x00 ubequad x \b, ENTRY %16.16llx 33679# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 33680#>0x18 ulelong x \b; entry size %u 33681>0x18 ulelong x \b; entry size 0x%x 33682# time stamp, in seconds 33683>0x00 ulelong x \b, 0x%x seconds 33684# always zero, significance unknown 33685>0x04 ulelong !0 \b, not null %u 33686# GUID of event source; but empty if event source is BOOTMGR 33687>0x08 ubequad !0 \b, GUID 0x%16.16llx 33688>>0x10 ubequad x \b%16.16llx 33689# severity code: 1~informational 3~errors 33690>0x1C ulelong !1 \b, severity 0x%x 33691# apparently a version number: 2 33692>0x20 ulelong !2 \b, version %u 33693# event identifier 1~log file initialised 11h~boot application launched 33694#>0x24 ulelong x \b, event 0x%x 33695>0x24 ulelong !1 33696>>0x24 ulelong !0x11 \b, event 0x%x 33697# entry data; size depends on event identifier 33698#>0x28 ubequad x \b, data 0x%16.16llx 33699>0x24 ulelong =0x1 \b, Init 33700# always 0, significance unknown 33701>>0x34 uleshort !0 \b, not null %u 33702# always 7, significance unknown 33703>>0x36 uleshort !7 \b, not seven %u 33704# year 33705>>0x28 uleshort x %u 33706# month 33707>>0x2A uleshort x \b-%u 33708# day 33709>>0x2C uleshort x \b-%u 33710# hour 33711>>0x2E uleshort x %u 33712# minute 33713>>0x30 uleshort x \b:%u 33714# second 33715>>0x32 uleshort x \b:%u 33716# boot application launched 33717>0x24 ulelong =0x11 \b, launched 33718# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 33719>>0x38 uleshort !0 \b, type %u 33720# pathname of boot application, as null-terminated Unicode string; typically 33721# \Windows\system32\winload.exe \Windows\system32\winload.efi 33722>>0x3C lestring16 x %s 33723 33724# Summary: Windows Error Report text files 33725# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 33726# Reference: https://www.nirsoft.net/utils/app_crash_view.html 33727# Created by: Joerg Jenderek 33728# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 33729# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 337300 lestring16 Version= 33731>22 lestring16 EventType Windows Error Report 33732!:mime text/plain 33733# Report.wer 33734!:ext wer 33735 33736# Summary: Windows 3.1 group files 33737# Extension: .grp 33738# Created by: unknown 337390 string \120\115\103\103 MS Windows 3.1 group files 33740 33741 33742# Summary: Old format help files 33743# URL: https://en.wikipedia.org/wiki/WinHelp 33744# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 33745# Update: Joerg Jenderek 33746# Created by: Dirk Jagdmann <doj@cubic.org> 33747# 33748# check and then display version and date inside MS Windows HeLP file fragment 337490 name help-ver-date 33750# look for Magic of SYSTEMHEADER 33751>0 leshort 0x036C 33752# version Major 1 for right file fragment 33753>>4 leshort 1 Windows 33754# print non empty string above to avoid error message 33755# Warning: Current entry does not yet have a description for adding a MIME type 33756!:mime application/winhelp 33757!:ext hlp 33758# version Minor of help file format is hint for windows version 33759>>>2 leshort 0x0F 3.x 33760>>>2 leshort 0x15 3.0 33761>>>2 leshort 0x21 3.1 33762>>>2 leshort 0x27 x.y 33763>>>2 leshort 0x33 95 33764>>>2 default x y.z 33765>>>>2 leshort x 0x%x 33766# to complete message string like "MS Windows 3.x help file" 33767>>>2 leshort x help 33768# GenDate often older than file creation date 33769>>>6 ldate x \b, %s 33770# 33771# Magic for HeLP files 337720 lelong 0x00035f3f 33773# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 33774# file header magic 0x293B at DirectoryStart+9 33775>(4.l+9) uleshort 0x293B MS 33776# look for @VERSION bmf.. like IBMAVW.ANN 33777>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 33778!:mime application/x-winhelp 33779!:ext ann 33780>>0xD4 string !\x62\x6D\x66\x01\x00 33781# "GID Help index" by TrID 33782>>>(4.l+0x65) string =|Pete Windows help Global Index 33783!:mime application/x-winhelp 33784!:ext gid 33785# HeLP Bookmark or 33786# "Windows HELP File" by TrID 33787>>>(4.l+0x65) string !|Pete 33788# maybe there exist a cleaner way to detect HeLP fragments 33789# brute search for Magic 0x036C with matching Major maximal 7 iterations 33790# discapp.hlp 33791>>>>16 search/0x49AF/s \x6c\x03 33792>>>>>&0 use help-ver-date 33793>>>>>&4 leshort !1 33794# putty.hlp 33795>>>>>>&0 search/0x69AF/s \x6c\x03 33796>>>>>>>&0 use help-ver-date 33797>>>>>>>&4 leshort !1 33798>>>>>>>>&0 search/0x49AF/s \x6c\x03 33799>>>>>>>>>&0 use help-ver-date 33800>>>>>>>>>&4 leshort !1 33801>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33802>>>>>>>>>>>&0 use help-ver-date 33803>>>>>>>>>>>&4 leshort !1 33804>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33805>>>>>>>>>>>>>&0 use help-ver-date 33806>>>>>>>>>>>>>&4 leshort !1 33807>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33808>>>>>>>>>>>>>>>&0 use help-ver-date 33809>>>>>>>>>>>>>>>&4 leshort !1 33810>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33811# GCC.HLP is detected after 7 iterations 33812>>>>>>>>>>>>>>>>>&0 use help-ver-date 33813# this only happens if bigger hlp file is detected after used search iterations 33814>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 33815!:mime application/winhelp 33816!:ext hlp 33817# repeat search again or following default line does not work 33818>>>>16 search/0x49AF/s \x6c\x03 33819# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 33820>>>>16 default x Windows help Bookmark 33821!:mime application/x-winhelp 33822!:ext bmk 33823## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 33824##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 33825# EntireFileSize 33826>>12 lelong x \b, %d bytes 33827## ReservedSpace normally 042Fh AFh for *.ANN 33828#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 33829## UsedSpace normally 0426h A6h for *.ANN 33830#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 33831## FileFlags normally 04... 33832#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 33833## file header magic 0x293B 33834#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 33835## file header Flags 0x0402 33836#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 33837## file header PageSize 0400h 80h for *.ANN 33838#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 33839## Structure[16] z4 33840#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 33841## MustBeZero 0 33842#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 33843## PageSplits 33844#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 33845## RootPage 33846#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 33847## MustBeNegOne 0xffff 33848#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 33849## TotalPages 1 33850#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 33851## NLevels 0x0001 33852#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 33853## TotalBtreeEntries 33854#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 33855## pages of the B+ tree 33856#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 33857 33858# start with colon or semicolon for comment line like Back2Life.cnt 338590 regex \^(:|;) 33860# look for first keyword Base 33861>0 search/45 :Base 33862>>&0 use cnt-name 33863# only solution to search again from beginning , because relative offsets changes when use is called 33864>0 search/45 :Base 33865>0 default x 33866# look for other keyword Title like in putty.cnt 33867>>0 search/45 :Title 33868>>>&0 use cnt-name 33869# 33870# display mime type and name of Windows help Content source 338710 name cnt-name 33872# skip space at beginning 33873>0 string \040 33874# name without extension and greater character or name with hlp extension 33875>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 33876!:mime text/plain 33877!:apple ????TEXT 33878!:ext cnt 33879# 33880# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 338810 string tfMR MS Windows help Full Text Search index 33882!:mime application/x-winhelp-fts 33883!:ext fts 33884>16 string >\0 for "%s" 33885 33886# Summary: Hyper terminal 33887# Extension: .ht 33888# Created by: unknown 338890 string HyperTerminal\040 33890>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 33891 33892# https://ithreats.files.wordpress.com/2009/05/\040 33893# lnk_the_windows_shortcut_file_format.pdf 33894# Summary: Windows shortcut 33895# Extension: .lnk 33896# Created by: unknown 33897# 'L' + GUUID 338980 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 33899>20 lelong&1 1 \b, Item id list present 33900>20 lelong&2 2 \b, Points to a file or directory 33901>20 lelong&4 4 \b, Has Description string 33902>20 lelong&8 8 \b, Has Relative path 33903>20 lelong&16 16 \b, Has Working directory 33904>20 lelong&32 32 \b, Has command line arguments 33905>20 lelong&64 64 \b, Icon 33906>>56 lelong x \b number=%d 33907>24 lelong&1 1 \b, Read-Only 33908>24 lelong&2 2 \b, Hidden 33909>24 lelong&4 4 \b, System 33910>24 lelong&8 8 \b, Volume Label 33911>24 lelong&16 16 \b, Directory 33912>24 lelong&32 32 \b, Archive 33913>24 lelong&64 64 \b, Encrypted 33914>24 lelong&128 128 \b, Normal 33915>24 lelong&256 256 \b, Temporary 33916>24 lelong&512 512 \b, Sparse 33917>24 lelong&1024 1024 \b, Reparse point 33918>24 lelong&2048 2048 \b, Compressed 33919>24 lelong&4096 4096 \b, Offline 33920>28 leqwdate x \b, ctime=%s 33921>36 leqwdate x \b, mtime=%s 33922>44 leqwdate x \b, atime=%s 33923>52 lelong x \b, length=%u, window= 33924>60 lelong&1 1 \bhide 33925>60 lelong&2 2 \bnormal 33926>60 lelong&4 4 \bshowminimized 33927>60 lelong&8 8 \bshowmaximized 33928>60 lelong&16 16 \bshownoactivate 33929>60 lelong&32 32 \bminimize 33930>60 lelong&64 64 \bshowminnoactive 33931>60 lelong&128 128 \bshowna 33932>60 lelong&256 256 \brestore 33933>60 lelong&512 512 \bshowdefault 33934#>20 lelong&1 0 33935#>>20 lelong&2 2 33936#>>>(72.l-64) pstring/h x \b [%s] 33937#>20 lelong&1 1 33938#>>20 lelong&2 2 33939#>>>(72.s) leshort x 33940#>>>&75 pstring/h x \b [%s] 33941 33942# Summary: Outlook Personal Folders 33943# Created by: unknown 339440 lelong 0x4E444221 Microsoft Outlook email folder 33945>10 leshort 0x0e (<=2002) 33946>10 leshort 0x17 (>=2003) 33947 33948 33949# Summary: Windows help cache 33950# Created by: unknown 339510 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 33952 33953 33954# Summary: IE cache file 33955# Created by: Christophe Monniez 339560 string Client\ UrlCache\ MMF Internet Explorer cache file 33957>20 string >\0 version %s 33958 33959 33960# Summary: Registry files 33961# Created by: unknown 33962# Modified by (1): Joerg Jenderek 339630 string regf MS Windows registry file, NT/2000 or above 339640 string CREG MS Windows 95/98/ME registry file 339650 string SHCC3 MS Windows 3.1 registry file 33966 33967 33968# Summary: Windows Registry text 33969# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 33970# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 33971# Submitted by: Abel Cheung <abelcheung@gmail.com> 33972# Update: Joerg Jenderek 33973# Windows 3-9X variant 339740 string REGEDIT 33975# skip ASCII text like "REGEDITor.txt" but match 33976# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 33977>7 search/3 \n Windows Registry text 33978!:mime text/x-ms-regedit 33979!:ext reg 33980# Windows 9X variant 33981>>0 string REGEDIT4 (Win95 or above) 33982# Windows 2K ANSI variant 339830 string Windows\ Registry\ Editor\ 33984>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 33985!:mime text/x-ms-regedit 33986!:ext reg 33987# Windows 2K UTF-16 variant 339882 lestring16 Windows\ Registry\ Editor\ 33989>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 33990# relative offset not working 33991#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 33992!:mime text/x-ms-regedit 33993!:ext reg 33994# WINE variant 33995# URL: https://en.wikipedia.org/wiki/Wine_(software) 33996# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 33997# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 33998# instead binary hiv structure like Windows 339990 string WINE\ REGISTRY\ Version\ WINE registry text 34000# version 2 34001>&0 string x \b, version %s 34002!:mime text/x-wine-extension-reg 34003!:ext reg 34004 34005# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 34006# empty ,comment , section 34007# PR/383: remove unicode BOM because it is not portable across regex impls 34008#0 regex/s \\`(\\r\\n|;|[[]) 34009# empty line CRLF 340100 ubeshort 0x0D0A 34011>0 use ini-file 34012# comment line 340130 string ; 34014>0 use ini-file 34015# section line 340160 string [ 34017>0 use ini-file 34018# check and then display Windows INItialization configuration 340190 name ini-file 34020# look for left bracket in section line 34021>0 search/8192 [ 34022# https://en.wikipedia.org/wiki/Autorun.inf 34023# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 34024# space after right bracket 34025# or AutoRun.Amd64 for 64 bit systems 34026# or only NL separator 34027>>&0 regex/c \^(autorun) 34028# but sometimes total commander directory tree file "treeinfo.wc" with lines like 34029# [AUTORUN] 34030# [boot] 34031>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 34032!:mime text/plain 34033!:ext wc 34034# From: Pal Tamas <folti@balabit.hu> 34035# Autorun File 34036>>>&0 string !]\r\n[ Microsoft Windows Autorun file 34037!:mime application/x-setupscript 34038!:ext inf 34039# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 34040# version strings ASCII coded case-independent for Windows setup information script file 34041>>&0 regex/c \^(version|strings)] Windows setup INFormation 34042!:mime application/x-setupscript 34043#!:mime application/x-wine-extension-inf 34044!:ext inf 34045# NETCRC.INF OEMCPL.INF 34046>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 34047!:mime application/x-setupscript 34048!:ext inf 34049# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 34050# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 34051# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 34052>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 34053!:mime application/x-wine-extension-ini 34054#!:mime text/plain 34055# https://support.microsoft.com/kb/84709/ 34056>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 34057!:mime application/x-wine-extension-ini 34058!:ext ini 34059>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 34060!:mime application/x-wine-extension-ini 34061!:ext ini 34062# https://technet.microsoft.com/en-us/library/cc722567.aspx 34063# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 34064>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 34065!:mime application/x-wine-extension-ini 34066!:ext ini 34067# https://en.wikipedia.org/wiki/SYSTEM.INI 34068>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 34069!:mime application/x-wine-extension-ini 34070!:ext ini 34071# http://www.mdgx.com/newtip6.htm 34072>>&0 regex/c \^(SafeList)] Windows IOS.INI 34073!:mime application/x-wine-extension-ini 34074!:ext ini 34075# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 34076>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 34077!:mime application/x-wine-extension-ini 34078!:ext ini 34079# https://en.wikipedia.org/wiki/CONFIG.SYS 34080>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS 34081# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 34082# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 34083# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 34084# dos and w40 used in dual booting scene 34085!:ext sys/dos/w40 34086# https://support.microsoft.com/kb/118579/ 34087>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 34088!:ext sys/dos 34089# http://chmspec.nongnu.org/latest/INI.html#HHP 34090>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project 34091!:mime text/plain 34092!:ext hhp 34093# From: Joerg Jenderek 34094# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/obdcdriv_character_translation.htm 34095# Reference: https://www.garykessler.net/library/file_sigs.html 34096# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 34097>>&0 regex/c \^(Windows\ Latin) Windows codepage translator 34098!:mime text/plain 34099!:ext cpx 34100# unknown keyword after opening bracket 34101>>&0 default x 34102#>>>&0 string/c x UNKNOWN [%s 34103# look for left bracket of second section 34104>>>&0 search/8192 [ 34105# version Strings FileIdentification 34106>>>>&0 string/c version Windows setup INFormation 34107!:mime application/x-setupscript 34108!:ext inf 34109# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 34110>>>>&0 default x 34111>>>>>&0 ubyte x 34112# characters, digits, underscore and white space followed by right bracket 34113# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 34114>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 34115# NETDEF.INF multiarc.ini 34116#!:mime application/x-setupscript 34117!:mime application/x-wine-extension-ini 34118#!:mime text/plain 34119!:ext ini/inf 34120# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 341210 ubelong&0xFFff89FF =0xFFFE0900 34122# look for left bracket in section line 34123>2 search/8192 [ 34124# keyword without 1st letter which is maybe up-/down-case 34125>>&3 lestring16 ersion] Windows setup INFormation 34126!:mime application/x-setupscript 34127!:ext inf 34128>>&3 lestring16 trings] Windows setup INFormation 34129!:mime application/x-setupscript 34130!:ext inf 34131>>&3 lestring16 ourceDisksNames] Windows setup INFormation 34132!:mime application/x-setupscript 34133!:ext inf 34134# netnwcli.inf start with ;---[ NetNWCli.INX ] 34135>>&3 default x 34136# look for NL followed by left bracket 34137>>>&0 search/8192 \x0A\x00\x5b 34138>>>>&3 lestring16 ersion] Windows setup INFormation 34139!:mime application/x-setupscript 34140!:ext inf 34141 34142# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 34143# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 34144# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 34145# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 34146# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 34147# check for valid major and minor versions: 101h - 303h 341480 leshort&0xFcFc =0x0000 34149# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 34150>0 leshort&0x0303 !0x0000 34151# test for valid InfStyles: 1 2 34152>>2 uleshort >0 34153>>>2 uleshort <3 34154# look for colon in WinDirPath after PNF header 34155#>>>>0x59 search/18 : 34156>>>>0 use PreCompiledInf 341570 name PreCompiledInf 34158>0 uleshort x Windows Precompiled iNF 34159!:mime application/x-pnf 34160!:ext pnf 34161# major version 1 for older Windows like XP and 3 since about Windows Vista 34162# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362 34163>1 ubyte x \b, version %u 34164>0 ubyte x \b.%u 34165>0 uleshort =0x0101 (Windows 34166>>4 ulelong&0x00000001 !0x00000001 98) 34167>>4 ulelong&0x00000001 =0x00000001 XP) 34168>0 uleshort =0x0301 (Windows Vista-8.1) 34169>0 uleshort =0x0302 (Windows 10 older) 34170>0 uleshort =0x0303 (Windows 10) 34171# 1 ,2 (windows 98 SE) 34172>2 uleshort !2 \b, InfStyle %u 34173# PNF_FLAG_IS_UNICODE 0x00000001 34174# PNF_FLAG_HAS_STRINGS 0x00000002 34175# PNF_FLAG_SRCPATH_IS_URL 0x00000004 34176# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 34177# PNF_FLAG_INF_VERIFIED 0x00000010 34178# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 34179# UNKNOWN8 0x00000080 34180# UNKNOWN 0x00000100 34181# UNKNOWN1 0x01000000 34182# UNKNOWN2 0x02000000 34183>4 ulelong&0x03000180 >0 \b, flags 34184>>4 ulelong x 0x%x 34185>4 ulelong&0x00000001 0x00000001 \b, unicoded 34186>4 ulelong&0x00000002 0x00000002 \b, has strings 34187>4 ulelong&0x00000004 0x00000004 \b, src URL 34188>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 34189>4 ulelong&0x00000010 0x00000010 \b, verified 34190>4 ulelong&0x00000020 0x00000020 \b, digitally signed 34191# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 34192# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 34193# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 34194# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 34195#>8 ulelong x \b, InfSubstValueListOffset 0x%x 34196# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 34197# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 34198#>12 uleshort x \b, InfSubstValueCount 0x%x 34199# only < 9 found: 8 hcw85b64.PNF 34200#>14 uleshort x \b, InfVersionDatumCount 0x%x 34201# only found values lower 0x0000ffff ?? 34202#>16 ulelong x \b, InfVersionDataSize 0x%x 34203# only found positive values lower 0x00ffFFff for InfVersionDataOffset 34204>20 ulelong x \b, at 0x%x 34205>4 ulelong&0x00000001 =0x00000001 34206# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 34207>>(20.l) lestring16 x "%s" 34208>4 ulelong&0x00000001 !0x00000001 34209>>(20.l) string x "%s" 34210# FILETIME is number of 100-nanosecond intervals since 1 January 1601 34211#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 34212#>24 foodate-0xbar x \b, InfVersionLastWriteTime %s 34213# for Windows 98, XP 34214>0 uleshort <0x0102 34215# only found values lower 0x00ffFFff 34216# often 70 but also 78h for corelist.PNF 34217# >>32 ulelong x \b, StringTableBlockOffset 0x%x 34218# >>36 ulelong x \b, StringTableBlockSize 0x%x 34219# >>40 ulelong x \b, InfSectionCount 0x%x 34220# >>44 ulelong x \b, InfSectionBlockOffset 0x%x 34221# >>48 ulelong x \b, InfSectionBlockSize 0x%x 34222# >>52 ulelong x \b, InfLineBlockOffset 0x%x 34223# >>56 ulelong x \b, InfLineBlockSize 0x%x 34224# >>60 ulelong x \b, InfValueBlockOffset 0x%x 34225# >>64 ulelong x \b, InfValueBlockSize 0x%x 34226# WinDirPathOffset 34227# like 58h, which means direct after PNF header 34228#>>68 ulelong x \b, at 0x%x 34229>>68 ulelong x 34230>>>4 ulelong&0x00000001 =0x00000001 34231#>>>>(68.l) ubequad =0x43003a005c005700 34232# normally unicoded C:\Windows 34233#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 34234>>>>(68.l) ubequad !0x43003a005c005700 34235>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 34236>>>4 ulelong&0x00000001 !0x00000001 34237# normally ASCII C:\WINDOWS 34238#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 34239>>>>(68.l) string !C:\\WINDOWS 34240>>>>>(68.l) string x \b, WinDirPath "%s" 34241# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 34242>>>72 ulelong >0 \b, 34243>>>>4 ulelong&0x00000001 =0x00000001 34244>>>>>(72.l) lestring16 x OsLoaderPath "%s" 34245>>>>4 ulelong&0x00000001 !0x00000001 34246# seldom C:\ instead empty 34247>>>>>(72.l) string x OsLoaderPath "%s" 34248# 1fdh 34249#>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 34250# only 407h found 34251>>>78 uleshort !0x409 \b, LanguageID %x 34252#>>>78 uleshort =0x409 \b, LanguageID %x 34253# InfSourcePathOffset often 0 34254>>>80 ulelong >0 \b, at 0x%x 34255>>>>4 ulelong&0x00000001 =0x00000001 34256>>>>>(80.l) lestring16 x SourcePath "%s" 34257>>>>4 ulelong&0x00000001 !0x00000001 34258>>>>>(80.l) string >\0 SourcePath "%s" 34259# OriginalInfNameOffset often 0 34260>>>84 ulelong >0 \b, at 0x%x 34261>>>>4 ulelong&0x00000001 =0x00000001 34262>>>>>(84.l) lestring16 x InfName "%s" 34263>>>>4 ulelong&0x00000001 !0x00000001 34264>>>>>(84.l) string >\0 InfName "%s" 34265 34266# for newer Windows like Vista, 7 , 8.1 , 10 34267>0 uleshort >0x0101 34268>>80 ulelong x \b, at 0x%x WinDirPath 34269>>>4 ulelong&0x00000001 0x00000001 34270# normally unicoded C:\Windows 34271#>>>>(80.l) ubequad =0x43003a005c005700 34272#>>>>>(80.l) lestring16 x "%s" 34273>>>>(80.l) ubequad !0x43003a005c005700 34274>>>>>(80.l) lestring16 x "%s" 34275# language id: 0 407h~german 409h~English_US 34276>>90 uleshort !0x409 \b, LanguageID %x 34277#>>90 uleshort =0x409 \b, LanguageID %x 34278>>92 ulelong >0 \b, at 0x%x 34279>>>4 ulelong&0x00000001 0x00000001 34280# language string like: de-DE en-US 34281>>>>(92.l) lestring16 x language %s 34282 34283# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 34284# Extension: .bkf 34285# Created by: Joerg Jenderek 34286# URL: https://en.wikipedia.org/wiki/NTBackup 34287# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 34288# Descriptor BloCK name of Microsoft Tape Format 342890 string TAPE 34290# Format Logical Address is zero 34291>20 ulequad 0 34292# Reserved for MBC is zero 34293>>28 uleshort 0 34294# Control Block ID is zero 34295>>>36 ulelong 0 34296# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 34297>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 34298#!:mime application/x-ntbackup 34299!:ext bkf 34300# OS ID 34301>>>>>10 ubyte 1 \b NetWare 34302>>>>>10 ubyte 13 \b NetWare SMS 34303>>>>>10 ubyte 14 \b NT 34304>>>>>10 ubyte 24 \b 3 34305>>>>>10 ubyte 25 \b OS/2 34306>>>>>10 ubyte 26 \b 95 34307>>>>>10 ubyte 27 \b Macintosh 34308>>>>>10 ubyte 28 \b UNIX 34309# OS Version (2) 34310#>>>>>11 ubyte x OS V=%x 34311# MTF_CONTINUATION Media Sequence Number > 1 34312#>>>>>4 ulelong&0x00000001 !0 \b, continued 34313# MTF_COMPRESSION 34314>>>>>4 ulelong&0x00000004 !0 \b, compressed 34315# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 34316>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 34317>>>>>4 ulelong&0x00020000 0 34318# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 34319>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 34320# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 34321>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 34322# Offset To First Event 238h,240h,28Ch 34323#>>>>>8 uleshort x \b, event offset %4.4x 34324# Displayable Size (20e0230h 20e024ch 20e0224h) 34325#>>>>>8 ulequad x dis. size %16.16llx 34326# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 34327#>>>>>52 ulelong x family ID %8.8x 34328# TAPE Attributes (3) 34329#>>>>>56 ulelong x TAPE %8.8x 34330# Media Sequence Number 34331>>>>>60 uleshort >1 \b, sequence %u 34332# Password Encryption Algorithm (3) 34333>>>>>62 uleshort >0 \b, 0x%x encrypted 34334# Soft Filemark Block Size * 512 (2) 34335#>>>>>64 uleshort =2 \b, soft size %u*512 34336>>>>>64 uleshort !2 \b, soft size %u*512 34337# Media Based Catalog Type (1,2) 34338#>>>>>66 uleshort x \b, catalog type %4.4x 34339# size of Media Name (66,68,6Eh) 34340>>>>>68 uleshort >0 34341# offset of Media Name (5Eh) 34342>>>>>>70 uleshort >0 34343# 0~, 1~ANSI, 2~UNICODE 34344>>>>>>>48 ubyte 1 34345# size terminated ansi coded string normally followed by "MTF Media Label" 34346>>>>>>>>(70.s) string >\0 \b, name: %s 34347>>>>>>>48 ubyte 2 34348# Not null, but size terminated unicoded string 34349>>>>>>>>(70.s) lestring16 x \b, name: %s 34350# size of Media Label (104h) 34351>>>>>72 uleshort >0 34352# offset of Media Label (C4h,C6h,CCh) 34353>>>>>74 uleshort >0 34354>>>>>>48 ubyte 1 34355#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 34356>>>>>>>(74.s) string >\0 \b, label: %s 34357>>>>>>48 ubyte 2 34358>>>>>>>(74.s) lestring16 x \b, label: %s 34359# size of password name (0,1Ch) 34360#>>>>>76 uleshort >0 \b, password size %4.4x 34361# Software Vendor ID (CBEh) 34362>>>>>86 uleshort x \b, software (0x%x) 34363# size of Software Name (6Eh) 34364>>>>>80 uleshort >0 34365# offset of Software Name (1C8h,1CAh,1D0h) 34366>>>>>>82 uleshort >0 34367# 1~ANSI, 2~UNICODE 34368>>>>>>>48 ubyte 1 34369>>>>>>>>(82.s) string >\0 \b: %s 34370>>>>>>>48 ubyte 2 34371# size terminated unicoded coded string normally followed by "SPAD" 34372>>>>>>>>(82.s) lestring16 x \b: %s 34373# Format Logical Block Size (512,1024) 34374#>>>>>84 uleshort =1024 \b, block size %u 34375>>>>>84 uleshort !1024 \b, block size %u 34376# Media Date of MTF_DATE_TIME type with 5 bytes 34377#>>>>>>88 ubequad x DATE %16.16llx 34378# MTF Major Version (1) 34379#>>>>>>93 ubyte x \b, MFT version %x 34380# 34381 34382# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 34383# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 34384# Created by: Joerg Jenderek 34385# Note: there exist other color palette formats also with .pal extension 343860 string JASC-PAL\r\n PaintShop Pro color palette 34387#!:mime text/plain 34388# PspPalette extension is used by newer (probably 8) PaintShopPro versions 34389!:ext pal/PspPalette 34390# 2nd line contains palette file version. For example "0100" 34391>10 string !0100 \b, version %.4s 34392# third line contains the number of colours: 16 256 ... 34393>16 string x \b, %.3s colors 34394 34395# URL: https://en.wikipedia.org/wiki/Innosetup 34396# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 34397# Created by: Joerg Jenderek 34398# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 34399# TrID labeles the entry as "Inno Setup Uninstall Log" 34400# TUninstallLogID 344010 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 34402!:mime application/x-innosetup 34403# unins000.dat, unins001.dat, ... 34404!:ext dat 34405# " 64-bit" variant 34406>0x1c string >\0 \b%.7s 34407# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 34408>0xc0 string x %s 34409# AppId[0x80] is similar to AppName or 34410# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 34411>0x40 ubyte 0x7b 34412>>0x40 string x %-.38s 34413# do not know how this log version correlates to program version 34414>0x140 ulelong x \b, version 0x%x 34415# NumRecs 34416#>0x144 ulelong x \b, 0x%4.4x records 34417# EndOffset means files size 34418>0x148 ulelong x \b, %u bytes 34419# Flags 5 25h 35h 34420#>0x14c ulelong x \b, flags %8.8x 34421# Reserved: array[0..26] of Longint 34422# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 34423>0x140 ulelong <1000 34424# hostname 34425>>0x1d6 pstring x \b, %s 34426# user name 34427>>>&0 pstring x \b\%s 34428# directory like C:\Program Files (x86)\GnuWin32 34429>>>>&0 pstring x \b, "%s" 34430# version 1000 or higher implies unicode 34431>0x140 ulelong >999 34432# hostname 34433>>0x1db lestring16 x \b, %-.9s 34434# utf string variant with prepending fe??ffFFff 34435>>0x1db search/43 \xFF\xFF\xFF 34436# user name 34437>>>&0 lestring16 x \b\%-.9s 34438>>>&0 search/43 \xFF\xFF\xFF 34439# directory like C:\Program Files\GIMP 2 34440>>>>&0 lestring16 x \b, %-.42s 34441 34442# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 34443# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 34444# From: Joerg Jenderek 344450 string Inno\ Setup\ Messages\ ( 34446# null padded til 0x40 boundary 34447>0x38 quad 0 InnoSetup messages 34448!:mime application/x-innosetup-msg 34449# unins000.msg, unins001.msg, ... 34450!:ext msg 34451# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 34452>>0x15 string x \b, version %.5s 34453# look for 6th char of version string or terminating right parentheses 34454>>>0x1a ubyte !0x29 \b%c 34455# NumMessages 34456>>0x40 ulelong x \b, %u messages 34457# TotalSize: Cardinal; 34458#>>0x44 ulelong x \b, TotalSize %u 34459# NotTotalSize: Cardinal; 34460#>>0x48 ulelong x \b, NotTotalSize %u 34461# CRCMessages: Longint; 34462#>>0x4C ulelong x \b, CRC 0x%x 34463>>0x40 ulelong x 34464# (u) after version means unicoded messages 34465>>>0x1c search/2 (u) (UTF-16), 34466>>>>0x50 lestring16 x %s 34467# ASCII coded message 34468>>>0x1c default x (ASCII), 34469>>>>0x50 string x %s 34470 34471# Windows Imaging (WIM) Image 34472# Update: Joerg Jenderek at Mar 2019, 2021 34473# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 34474# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 34475# Reference: https://download.microsoft.com/download/f/e/f/ 34476# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 34477# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 344780 string MSWIM\000\000\000 34479>0 use wim-archive 34480# https://wimlib.net/man1/wimoptimize.html 344810 string WLPWM\000\000\000 34482>0 use wim-archive 344830 name wim-archive 34484# _WIMHEADER_V1_PACKED ImageTag[8] 34485>0 string x Windows imaging 34486!:mime application/x-ms-wim 34487# TO avoid in file version 5.36 error like 34488# Magdir/windows, 760: Warning: Current entry does not yet have a description 34489# file: could not find any valid magic files! (No error) 34490# split WIM 34491>16 ulelong &0x00000008 (SWM 34492!:ext swm 34493# usPartNumber; 1, unless the file was split into multiple parts 34494>>40 uleshort x \b %u 34495# usTotalParts; The total number of WIM file parts in a spanned set 34496>>42 uleshort x \b of %u) image 34497# non split WIM 34498>16 ulelong ^0x00000008 34499# https://wimlib.net/man1/wimmount.html 34500# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 34501>>12 ulelong 3584 (ESD) image 34502!:ext esd 34503>>12 ulelong !3584 ( 34504# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 34505>>>156 search/68233/s RunTime.xml \bWindows provisioning package) 34506!:ext ppkg 34507# if is is not a Windows provisioning package, then it is a WIM 34508>>>156 default x \bWIM) image 34509# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 34510!:ext wim/wim2 34511>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 34512# cbSize size of the WIM header in bytes like 208 34513#>8 ulelong x \b, headersize %u 34514# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 34515>14 uleshort x v%u 34516>13 ubyte x \b.%u 34517# dwImageCount; The number of images contained in the WIM file 34518>44 ulelong >1 \b, %u images 34519# dwBootIndex 34520# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 34521>0x78 ulelong >0 \b, bootable no. %u 34522# dwFlags 34523#>16 ulelong x \b, flags 0x%8.8x 34524#define FLAG_HEADER_COMPRESSION 0x00000002 34525#define FLAG_HEADER_READONLY 0x00000004 34526#define FLAG_HEADER_SPANNED 0x00000008 34527#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 34528#define FLAG_HEADER_METADATA_ONLY 0x00000020 34529#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 34530#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 34531#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 34532#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 34533#define FLAG_HEADER_COMPRESS_LZX 0x00040000 34534#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 34535#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 34536# XPRESS, with small chunk size 34537>16 ulelong &0x00100000 \b, XPRESS2 34538>16 ulelong &0x00080000 \b, LZMS 34539>16 ulelong &0x00040000 \b, LZX 34540>16 ulelong &0x00020000 \b, XPRESS 34541>16 ulelong &0x00000002 compressed 34542>16 ulelong &0x00000004 \b, read only 34543>16 ulelong &0x00000010 \b, resource only 34544>16 ulelong &0x00000020 \b, metadata only 34545>16 ulelong &0x00000080 \b, reparse point fixup 34546#>16 ulelong &0x00010000 \b, RESERVED 34547# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 34548#>20 ulelong >0 \b, chunk size %u bytes 34549# gWIMGuid 34550#>24 ubequad x \b, GUID 0x%16.16llx 34551#>>32 ubequad x \b%16.16llx 34552# rhOffsetTable; the location of the resource lookup table 34553# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 34554#>48 ubequad x \b, rhOffsetTable 0x%16.16llx 34555# rhXmlData; the location of the XML data 34556#>0x50 ulelong x \b, at 0x%8.8x 34557# NOT WORKING \xff\xfe<\0W\0I\0M\0 34558#>(0x50.l) ubequad x \b, xml=%16.16llx 34559# rhBootMetadata; the location of the metadata resource 34560#>0x60 ubequad x \b, rhBootMetadata 0x%16.16llx 34561# rhIntegrity; the location of integrity table used to verify files 34562#>0x7c ubequad x \b, rhIntegrity 0x%16.16llx 34563# Unused[60] 34564#>148 ubequad !0 \b,unused 0x%16.16llx 34565# 34566 34567# From: Joerg Jenderek 34568# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 34569# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 34570# Note: called "Windows Easy Transfer migration data" by TrID, 34571# "Migration Store" or "EasyTransfer file" by Microsoft 345720 string 1giM Windows Easy Transfer migration data 34573#!:mime application/octet-stream 34574!:mime application/x-ms-mig 34575!:ext mig 34576>0x18 string =MRTS without password 34577# data offset with 1 space at end 34578>>0x1c ulelong+0x38 x \b, at 0x%x 34579# look for zlib compressed data by ./compress 34580>>(0x1c.l+0x38) ubyte x 34581>>>&-1 indirect x 34582# in password protected examples MRTS comes some bytes further 34583>0x18 string !MRTS with password 34584# look for first MRTS tag 34585>0x18 search/29/b MRTS 34586# probably first file name length like 178, ... 34587#>>&0 ulelong x \b, 1st length %u 34588# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 34589>>&20 lestring16 x \b, 1st %-s 34590 34591# Microsoft SYLK 34592# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 34593# https://outflank.nl/upload/sylksum.txt 345940 string ID;P Microsoft SYLK program 34595>4 string >0 \b, created by %s 34596!:ext slk/sylk 34597 34598#------------------------------------------------------------------------------ 34599# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 34600# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 34601# 346020 string RGDB CRDA wireless regulatory database file 34603>4 belong 19 (Version 1) 34604 34605#------------------------------------------------------------------------------ 34606# $File: wordprocessors,v 1.24 2020/05/22 19:28:47 christos Exp $ 34607# wordprocessors: file(1) magic fo word processors. 34608# 34609####### PWP file format used on Smith Corona Personal Word Processors: 346102 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 34611>24 byte 2 \b, single spaced 34612>24 byte 3 \b, 1.5 spaced 34613>24 byte 4 \b, double spaced 34614>25 byte 0x42 \b, letter 34615>25 byte 0x54 \b, legal 34616>26 byte 0x46 \b, A4 34617 34618# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 34619# reference: http://mark0.net/download/triddefs_xml.7z 34620# /defs/w/wps-works-dos.trid.xml 34621# From: Joerg Jenderek 34622# Note: older non OLE 2 Compound based versions 346230 ubeshort =0x01FE 34624>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document 34625# title like THE GREAT KHAN GAME 34626>>0x100 string x %s 34627!:mime application/vnd-ms-works 34628#!:mime application/x-msworks 34629# https://www.macdisk.com/macsigen.php 34630!:apple ????AWWP 34631!:ext wps 34632 34633# Corel/WordPerfect 346340 string \xffWPC 34635# WordPerfect 34636>8 byte 1 34637>>9 byte 1 WordPerfect macro 34638>>9 byte 2 WordPerfect help file 34639>>9 byte 3 WordPerfect keyboard file 34640>>9 byte 10 WordPerfect document 34641>>9 byte 11 WordPerfect dictionary 34642>>9 byte 12 WordPerfect thesaurus 34643>>9 byte 13 WordPerfect block 34644>>9 byte 14 WordPerfect rectangular block 34645>>9 byte 15 WordPerfect column block 34646>>9 byte 16 WordPerfect printer data 34647>>9 byte 19 WordPerfect printer data 34648>>9 byte 20 WordPerfect driver resource data 34649>>9 byte 22 WordPerfect graphic image 34650>>9 byte 23 WordPerfect hyphenation code 34651>>9 byte 24 WordPerfect hyphenation data 34652>>9 byte 25 WordPerfect macro resource data 34653>>9 byte 27 WordPerfect hyphenation lex 34654>>9 byte 29 WordPerfect wordlist 34655>>9 byte 30 WordPerfect equation resource data 34656>>9 byte 33 WordPerfect spell rules 34657>>9 byte 34 WordPerfect dictionary rules 34658>>9 byte 39 WordPerfect spell rules (Microlytics) 34659>>9 byte 43 WordPerfect settings file 34660>>9 byte 44 WordPerfect 3.5 document 34661>>9 byte 45 WordPerfect 4.2 document 34662>>9 byte 69 WordPerfect dialog file 34663>>9 byte 76 WordPerfect button bar 34664>>9 default x 34665>>>9 byte x Corel WordPerfect: Unknown filetype %d 34666# Corel Shell 34667>8 byte 2 34668>>9 byte 1 Corel shell macro 34669>>9 byte 10 Corel shell definition 34670>>9 default x 34671>>>9 byte x Corel Shell: Unknown filetype %d 34672# Corel Notebook 34673>8 byte 3 34674>>9 byte 1 Corel Notebook macro 34675>>9 byte 2 Corel Notebook help file 34676>>9 byte 3 Corel Notebook keyboard file 34677>>9 byte 10 Corel Notebook definition 34678>>9 default x 34679>>>9 byte x Corel Notebook: Unknown filetype %d 34680# Corel Calculator 34681>8 byte 4 34682>>9 byte 2 Corel Calculator help file 34683>>9 default x 34684>>>9 byte x Corel Calculator: Unknown filetype %d 34685# Corel File Manager 34686>8 byte 5 34687>>9 default x 34688>>>9 byte x Corel File Manager: Unknown filetype %d 34689# Corel Calendar 34690>8 byte 6 34691>>9 byte 2 Corel Calendar help file 34692>>9 byte 10 Corel Calendar data file 34693>>9 default x 34694>>>9 byte x Corel Calendar: Unknown filetype %d 34695# Corel Program Editor/Ed Editor 34696>8 byte 7 34697>>9 byte 1 Corel Editor macro 34698>>9 byte 2 Corel Editor help file 34699>>9 byte 3 Corel Editor keyboard file 34700>>9 byte 25 Corel Editor macro resource file 34701>>9 default x 34702>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 34703# Corel Macro Editor 34704>8 byte 8 34705>>9 byte 1 Corel Macro editor macro 34706>>9 byte 2 Corel Macro editor help file 34707>>9 byte 3 Corel Macro editor keyboard file 34708>>9 default x 34709>>>9 byte x Corel Macro Editor: Unknown filetype %d 34710# Corel Plan Perfect 34711>8 byte 9 34712>>9 default x 34713>>>9 byte x Corel Plan Perfect: Unknown filetype %d 34714# Corel DataPerfect 34715>8 byte 10 34716# CHECK: Don't these belong into product 9? 34717>>9 byte 1 Corel PlanPerfect macro 34718>>9 byte 2 Corel PlanPerfect help file 34719>>9 byte 3 Corel PlanPerfect keyboard file 34720>>9 byte 10 Corel PlanPerfect worksheet 34721>>9 byte 15 Corel PlanPerfect printer definition 34722>>9 byte 18 Corel PlanPerfect graphic definition 34723>>9 byte 19 Corel PlanPerfect data 34724>>9 byte 20 Corel PlanPerfect temporary printer 34725>>9 byte 25 Corel PlanPerfect macro resource data 34726>>9 default x 34727>>>9 byte x Corel DataPerfect: Unknown filetype %d 34728# Corel Mail 34729>8 byte 11 34730>>9 byte 2 Corel Mail help file 34731>>9 byte 5 Corel Mail distribution list 34732>>9 byte 10 Corel Mail out box 34733>>9 byte 11 Corel Mail in box 34734>>9 byte 20 Corel Mail users archived mailbox 34735>>9 byte 21 Corel Mail archived message database 34736>>9 byte 22 Corel Mail archived attachments 34737>>9 default x 34738>>>9 byte x Corel Mail: Unknown filetype %d 34739# Corel Printer 34740>8 byte 12 34741>>9 byte 11 Corel Printer temporary file 34742>>9 default x 34743>>>9 byte x Corel Printer: Unknown filetype %d 34744# Corel Scheduler 34745>8 byte 13 34746>>9 byte 2 Corel Scheduler help file 34747>>9 byte 10 Corel Scheduler in file 34748>>9 byte 11 Corel Scheduler out file 34749>>9 default x 34750>>>9 byte x Corel Scheduler: Unknown filetype %d 34751# Corel WordPerfect Office 34752>8 byte 14 34753>>9 byte 10 Corel GroupWise settings file 34754>>9 byte 17 Corel GroupWise directory services 34755>>9 byte 43 Corel GroupWise settings file 34756>>9 default x 34757>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 34758# Corel DrawPerfect 34759>8 byte 15 34760>>9 default x 34761>>>9 byte x Corel DrawPerfect: Unknown filetype %d 34762# Corel LetterPerfect 34763>8 byte 16 34764>>9 default x 34765>>>9 byte x Corel LetterPerfect: Unknown filetype %d 34766# Corel Terminal 34767>8 byte 17 34768>>9 byte 10 Corel Terminal resource data 34769>>9 byte 11 Corel Terminal resource data 34770>>9 byte 43 Corel Terminal resource data 34771>>9 default x 34772>>>9 byte x Corel Terminal: Unknown filetype %d 34773# Corel loadable file 34774>8 byte 18 34775>>9 byte 10 Corel loadable file 34776>>9 byte 11 Corel GUI loadable text 34777>>9 byte 12 Corel graphics resource data 34778>>9 byte 13 Corel printer settings file 34779>>9 byte 14 Corel port definition file 34780>>9 byte 15 Corel print queue parameters 34781>>9 byte 16 Corel compressed file 34782>>9 default x 34783>>>9 byte x Corel loadable file: Unknown filetype %d 34784>>15 byte 0 \b, optimized for Intel 34785>>15 byte 1 \b, optimized for Non-Intel 34786# Network service 34787>8 byte 20 34788>>9 byte 10 Corel Network service msg file 34789>>9 byte 11 Corel Network service msg file 34790>>9 byte 12 Corel Async gateway login msg 34791>>9 byte 14 Corel GroupWise message file 34792>>9 default x 34793>>>9 byte x Corel Network service: Unknown filetype %d 34794# GroupWise 34795>8 byte 31 34796>>9 byte 20 GroupWise admin domain database 34797>>9 byte 21 GroupWise admin host database 34798>>9 byte 23 GroupWise admin remote host database 34799>>9 byte 24 GroupWise admin ADS deferment data file 34800>>9 default x 34801>>>9 byte x GroupWise: Unknown filetype %d 34802# IntelliTAG 34803>8 byte 33 34804>>9 byte 10 IntelliTAG (SGML) compiled DTD 34805>>9 default x 34806>>>9 byte x IntelliTAG: Unknown filetype %d 34807# everything else 34808>8 default x 34809>>8 byte x Unknown Corel/Wordperfect product %d, 34810>>>9 byte x file type %d 34811>10 byte 0 \b, v5. 34812>10 byte !0 \b, v%d. 34813>11 byte x \b%d 34814 34815# Hangul (Korean) Word Processor File 348160 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 34817 34818# CosmicBook, from Benoit Rouits 348190 string CSBK Ted Neslson's CosmicBook hypertext file 34820 348212 string EYWR AmigaWriter file 34822 34823# chi: file(1) magic for ChiWriter files 348240 string \\1cw\ ChiWriter file 34825>5 string >\0 version %s 348260 string \\1cw ChiWriter file 34827 34828# Quark Express from https://www.garykessler.net/library/file_sigs.html 348292 string IIXPR3 Intel Quark Express Document (English) 348302 string IIXPRa Intel Quark Express Document (Korean) 348312 string MMXPR3 Motorola Quark Express Document (English) 34832!:mime application/x-quark-xpress-3 348332 string MMXPRa Motorola Quark Express Document (Korean) 34834 34835# adobe indesign (document, whatever...) from querkan 348360 belong 0x0606edf5 Adobe InDesign 34837>16 string DOCUMENT Document 34838 34839#------------------------------------------------------------------------------ 34840# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 34841# 34842# Contributor kenzo-: 34843# Reversed-engineered JS Ichitaro magic numbers 34844# 34845 348460 string DOC 34847>43 byte 0x14 Just System Word Processor Ichitaro v4 34848!:mime application/x-ichitaro4 34849>144 string JDASH application/x-ichitaro4 34850 348510 string DOC 34852>43 byte 0x15 Just System Word Processor Ichitaro v5 34853!:mime application/x-ichitaro5 34854 348550 string DOC 34856>43 byte 0x16 Just System Word Processor Ichitaro v6 34857!:mime application/x-ichitaro6 34858 34859# Type: Freemind mindmap documents 34860# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 348610 string/w \<map\ version Freemind document 34862!:mime application/x-freemind 34863 34864# Type: Freeplane mindmap documents 34865# From: Felix Natter <fnatter@gmx.net> 348660 string/w \<map\ version="freeplane Freeplane document 34867!:mime application/x-freeplane 34868 34869# Type: Scribus 34870# From: Werner Fink <werner@suse.de> 348710 string \<SCRIBUSUTF8\ Version Scribus Document 348720 string \<SCRIBUSUTF8NEW\ Version Scribus Document 34873!:mime application/x-scribus 34874 34875# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 34876# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 348770 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 34878 34879# From: Joerg Jenderek 34880# URL: https://en.wikipedia.org/wiki/StarOffice 34881# Note: used in Star-, Open- and Libre-Office 34882# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others 348830 ubeshort 0x0400 34884#>(2.s+8) ubequad x \b, gap 0x%16.16llx 34885# test for null value in gap after theme name maybe unreliable 34886#>(2.s+9) ubyte 0 \b, 0-byte 34887# look for keyword GALRESRV near the end 34888# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects 34889#>0 search/8415 GALRESRV \b, GALRESRV found 34890# "neues thema6.thm" MorePictures, 315 objects 34891#>0 search/19299 GALRESRV \b, GALRESRV FOUND 34892#>2 uleshort x \b, name length %u 34893# skip file2147.chk by check for positive name length like for sg16.thm "3D" 34894>2 uleshort >0 StarOffice Gallery theme 34895!:mime application/x-stargallery-thm 34896!:ext thm 34897# gallery name 34898>>2 pstring/h x %s 34899# number of objects 34900>>(2.s+4) ulelong x \b, %u object 34901# plural s 34902>>(2.s+4) ulelong !1 \bs 34903# if available then display first object name 34904>>(2.s+4) ulelong >0 34905# partial file name, URL or internal name like "dd2*" of 1st object or RESRV 34906>>>(2.s+11) pstring/h x \b, 1st %s 34907 34908# From: Joerg Jenderek 34909# URL: http://fileformats.archiveteam.org/wiki/StarOffice_Gallery 34910# Note: used in Star-, Open- and Libre-Office and found in directories like 34911# %APPDATA%\Roaming\LibreOffice\4\user\gallery 34912# $HOME/.config/libreoffice/4/user/gallery 349130 string SGA3 StarOffice Gallery thumbnails 34914# Unknown like 0x04000?0001000142 34915#>4 ubequad x \b, UNKNOWN 0x%16.16llx 34916#!:mime application/x-sdg 34917!:mime application/x-stargallery-sdg 34918!:ext sdg 34919# display image magic for debugging purpose like 'BM' 34920# looking like PC bitmap, Windows 3.x format with unknown compression 34921#>11 string x \b, image magic '%-.2s' 34922# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end 34923#>11 indirect x \b; contains 34924 34925 34926#------------------------------------------------------------------------------ 34927# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $ 34928# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php 34929# Cache format extracted from source: 34930# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 34931# Requires file >= 5.05 34932# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 349330 string wsdl PHP WSDL cache, 34934>4 byte x version 0x%02x 34935>6 ledate x \b, created %s 34936 34937# uri 34938>10 lelong <0x7fffffff 34939>>10 pstring/l x \b, uri: "%s" 34940 34941# source 34942>>>&0 lelong <0x7fffffff 34943>>>>&-4 pstring/l x \b, source: "%s" 34944 34945# target_ns 34946>>>>>&0 lelong <0x7fffffff 34947>>>>>>&-4 pstring/l x \b, target_ns: "%s" 34948#------------------------------------------------------------------------------ 34949# x68000: file(1) magic for the Sharp Home Computer 34950# v1.0 34951# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 34952 34953# Yanagisawa PIC picture 349540 string PIC 34955>3 search/0x200 \x1A 34956>>&0 search/0x200 \x0 34957>>>&0 ubyte 0 Yanagisawa PIC image file, 34958>>>>&0 ubyte&15 0 model: X68000, 34959>>>>&0 ubyte&15 1 model: PC-88VA, 34960>>>>&0 ubyte&15 2 model: FM-TOWNS, 34961>>>>&0 ubyte&15 3 model: MAC, 34962>>>>&0 ubyte&15 15 model: Generic, 34963>>>>&3 ubeshort x %dx 34964>>>>&5 ubeshort x \b%d, 34965>>>>&1 ubeshort 4 colors: 16 34966>>>>&1 ubeshort 8 colors: 256 34967>>>>&1 ubeshort 12 colors: 4096 34968>>>>&1 ubeshort 15 colors: 32768 34969>>>>&1 ubeshort 16 colors: 65536 34970>>>>&1 ubeshort >16 colors: %d-bit 34971 34972 34973 34974#------------------------------------------------------------------------------ 34975# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 34976# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 34977# 349780 string %XDELTA% XDelta binary patch file 0.14 349790 string %XDZ000% XDelta binary patch file 0.18 349800 string %XDZ001% XDelta binary patch file 0.20 349810 string %XDZ002% XDelta binary patch file 1.0 349820 string %XDZ003% XDelta binary patch file 1.0.4 349830 string %XDZ004% XDelta binary patch file 1.1 34984 349850 string \xD6\xC3\xC4\x00 VCDIFF binary diff 34986 34987#------------------------------------------------------------------------------ 34988# $File: xenix,v 1.12 2021/02/23 00:51:10 christos Exp $ 34989# xenix: file(1) magic for Microsoft Xenix 34990# 34991# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 34992# model" lifted from "magic.xenix", with comment "derived empirically; 34993# treat as folklore until proven" 34994# 34995# "small model", "large model", "huge model" stuff lifted from XXX 34996# 34997# XXX - "x.out" collides with PDP-11 archives 34998# 349990 string core core file (Xenix) 35000# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 35001# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 35002# Update: Joerg Jenderek 35003# recordtype~TranslatorHEADerRecord 350040 byte 0x80 35005# GRR: line above is too general as it catches also Extensible storage engine DataBase 35006# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 35007>1 uleshort <1022 35008# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length 35009>>1 uleshort >0 35010# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length 35011>>>3 ubyte >0 35012# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 35013>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 35014#!:mime application/octet-stream 35015!:mime application/x-object 35016!:ext o/a 35017>>>>>3 pstring x \b, "%s" 35018# checksum 35019#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 350200 leshort 0xff65 x.out 35021>2 string __.SYMDEF randomized 35022>0 byte x archive 350230 leshort 0x206 Microsoft a.out 35024>8 leshort 1 Middle model 35025>0x1e leshort &0x10 overlay 35026>0x1e leshort &0x2 separate 35027>0x1e leshort &0x4 pure 35028>0x1e leshort &0x800 segmented 35029>0x1e leshort &0x400 standalone 35030>0x1e leshort &0x8 fixed-stack 35031>0x1c byte &0x80 byte-swapped 35032>0x1c byte &0x40 word-swapped 35033>0x10 lelong >0 not-stripped 35034>0x1e leshort ^0xc000 pre-SysV 35035>0x1e leshort &0x4000 V2.3 35036>0x1e leshort &0x8000 V3.0 35037>0x1c byte &0x4 86 35038>0x1c byte &0xb 186 35039>0x1c byte &0x9 286 35040>0x1c byte &0xa 386 35041>0x1f byte <0x040 small model 35042>0x1f byte =0x048 large model 35043>0x1f byte =0x049 huge model 35044>0x1e leshort &0x1 executable 35045>0x1e leshort ^0x1 object file 35046>0x1e leshort &0x40 Large Text 35047>0x1e leshort &0x20 Large Data 35048>0x1e leshort &0x120 Huge Objects Enabled 35049>0x10 lelong >0 not stripped 35050 350510 leshort 0x140 old Microsoft 8086 x.out 35052>0x3 byte &0x4 separate 35053>0x3 byte &0x2 pure 35054>0 byte &0x1 executable 35055>0 byte ^0x1 relocatable 35056>0x14 lelong >0 not stripped 35057 350580 lelong 0x206 b.out 35059>0x1e leshort &0x10 overlay 35060>0x1e leshort &0x2 separate 35061>0x1e leshort &0x4 pure 35062>0x1e leshort &0x800 segmented 35063>0x1e leshort &0x400 standalone 35064>0x1e leshort &0x1 executable 35065>0x1e leshort ^0x1 object file 35066>0x1e leshort &0x4000 V2.3 35067>0x1e leshort &0x8000 V3.0 35068>0x1c byte &0x4 86 35069>0x1c byte &0xb 186 35070>0x1c byte &0x9 286 35071>0x1c byte &0x29 286 35072>0x1c byte &0xa 386 35073>0x1e leshort &0x4 Large Text 35074>0x1e leshort &0x2 Large Data 35075>0x1e leshort &0x102 Huge Objects Enabled 35076 350770 leshort 0x580 XENIX 8086 relocatable or 80286 small model 35078 35079#------------------------------------------------------------------------------ 35080# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 35081# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 35082# Xilinx-Magic@RevRagnarok.com 35083# Got the info from FPGA-FAQ 0026 35084# 35085# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 35086# fixes at least reading of bitfiles from Spartan 2, 3, 6. 35087# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 35088# 35089# First there is the sync header and its length 350900 beshort 0x0009 35091>2 belong =0x0ff00ff0 35092>>&0 belong =0x0ff00ff0 35093>>>&0 byte =0x00 35094>>>&1 beshort =0x0001 35095>>>&3 string a Xilinx BIT data 35096# Next is a Pascal-style string with the NCD name. We want to capture that. 35097>>>>&0 pstring/H x - from %s 35098# And then 'b' 35099>>>>>&1 string b 35100# Then the model / part number: 35101>>>>>>&0 pstring/H x - for %s 35102# Then 'c' 35103>>>>>>>&1 string c 35104# Then the build-date 35105>>>>>>>>&0 pstring/H x - built %s 35106# Then 'd' 35107>>>>>>>>>&1 string d 35108# Then the build-time 35109>>>>>>>>>>&0 pstring/H x \b(%s) 35110# Then 'e' 35111>>>>>>>>>>>&1 string e 35112# And length of data 35113>>>>>>>>>>>>&0 belong x - data length 0x%x 35114 35115# Raw bitstream files 351160 long 0xffffffff 35117>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 35118 35119#------------------------------------------------------------------------------ 35120# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 35121# xo65 object files 35122# From: "Ullrich von Bassewitz" <uz@cc65.org> 35123# 351240 string \x55\x7A\x6E\x61 xo65 object, 35125>4 leshort x version %d, 35126>6 leshort&0x0001 =0x0001 with debug info 35127>6 leshort&0x0001 =0x0000 no debug info 35128 35129# xo65 library files 351300 string \x6E\x61\x55\x7A xo65 library, 35131>4 leshort x version %d 35132 35133# o65 object files 351340 string \x01\x00\x6F\x36\x35 o65 35135>6 leshort&0x1000 =0x0000 executable, 35136>6 leshort&0x1000 =0x1000 object, 35137>5 byte x version %d, 35138>6 leshort&0x8000 =0x8000 65816, 35139>6 leshort&0x8000 =0x0000 6502, 35140>6 leshort&0x2000 =0x2000 32 bit, 35141>6 leshort&0x2000 =0x0000 16 bit, 35142>6 leshort&0x4000 =0x4000 page reloc, 35143>6 leshort&0x4000 =0x0000 byte reloc, 35144>6 leshort&0x0003 =0x0000 alignment 1 35145>6 leshort&0x0003 =0x0001 alignment 2 35146>6 leshort&0x0003 =0x0002 alignment 4 35147>6 leshort&0x0003 =0x0003 alignment 256 35148 35149#------------------------------------------------------------------------------ 35150# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $ 35151# xwindows: file(1) magic for various X/Window system file formats. 35152 35153# Compiled X Keymap 35154# XKM (compiled X keymap) files (including version and byte ordering) 351551 string mkx Compiled XKB Keymap: lsb, 35156>0 byte >0 version %d 35157>0 byte =0 obsolete 351580 string xkm Compiled XKB Keymap: msb, 35159>3 byte >0 version %d 35160>3 byte =0 obsolete 35161 35162# xfsdump archive 351630 string xFSdump0 xfsdump archive 35164>8 belong x (version %d) 35165 35166# Jaleo XFS files 351670 long 395726 Jaleo XFS file 35168>4 long x - version %d 35169>8 long x - [%d - 35170>20 long x \b%dx 35171>24 long x \b%dx 35172>28 long 1008 \bYUV422] 35173>28 long 1000 \bRGB24] 35174 35175# Xcursor data 35176# X11 mouse cursor format defined in libXcursor, see 35177# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 35178# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 351790 string Xcur Xcursor data 35180!:mime image/x-xcursor 35181>10 leshort x version %d 35182>>8 leshort x \b.%d 35183 35184 35185#------------------------------------------------------------------------------ 35186# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ 35187# yara: file(1) magic for https://virustotal.github.io/yara/ 35188# 35189 351900 string YARA 35191>4 lelong >2047 35192>8 byte <20 YARA 3.x compiled rule set 35193# version 35194>>8 clear x 35195>>8 byte 6 created with version 3.3.0 35196>>8 byte 8 created with version 3.4.0 35197>>8 byte 11 created with version 3.5.0 35198>>8 default x 35199>>>8 byte x development version 0x%02x 35200#------------------------------------------------------------------------------ 35201# zfs: file(1) magic for ZFS dumps 35202# 35203# From <rea-fbsd@codelabs.ru> 35204# ZFS dump header has the following structure (as per zfs_ioctl.h 35205# in FreeBSD with drr_type is set to DRR_BEGIN) 35206# 35207# enum { 35208# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 35209# DRR_WRITE, DRR_FREE, DRR_END, 35210# } drr_type; 35211# uint32_t drr_pad; 35212# uint64_t drr_magic; 35213# uint64_t drr_version; 35214# uint64_t drr_creation_time; 35215# dmu_objset_type_t drr_type; 35216# uint32_t drr_pad; 35217# uint64_t drr_toguid; 35218# uint64_t drr_fromguid; 35219# char drr_toname[MAXNAMELEN]; 35220# 35221# Backup magic is 0x00000002f5bacbac (quad word) 35222# The drr_type is defined as 35223# typedef enum dmu_objset_type { 35224# DMU_OST_NONE, 35225# DMU_OST_META, 35226# DMU_OST_ZFS, 35227# DMU_OST_ZVOL, 35228# DMU_OST_OTHER, /* For testing only! */ 35229# DMU_OST_ANY, /* Be careful! */ 35230# DMU_OST_NUMTYPES 35231# } dmu_objset_type_t; 35232# 35233# Almost all uint64_t fields are printed as the 32-bit ones (with high 35234# 32 bits zeroed), because there is no simple way to print them as the 35235# full 64-bit values. 35236 35237# Big-endian values 352388 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 35239>20 belong x version %u, 35240>32 belong 0 type: NONE, 35241>32 belong 1 type: META, 35242>32 belong 2 type: ZFS, 35243>32 belong 3 type: ZVOL, 35244>32 belong 4 type: OTHER, 35245>32 belong 5 type: ANY, 35246>32 belong >5 type: UNKNOWN (%u), 35247>40 byte x destination GUID: %02X 35248>41 byte x %02X 35249>42 byte x %02X 35250>43 byte x %02X 35251>44 byte x %02X 35252>45 byte x %02X 35253>46 byte x %02X 35254>47 byte x %02X, 35255>48 ulong >0 35256>>52 ulong >0 35257>>>48 byte x source GUID: %02X 35258>>>49 byte x %02X 35259>>>50 byte x %02X 35260>>>51 byte x %02X 35261>>>52 byte x %02X 35262>>>53 byte x %02X 35263>>>54 byte x %02X 35264>>>55 byte x %02X, 35265>56 string >\0 name: '%s' 35266 35267# Little-endian values 352688 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 35269>16 lelong x version %u, 35270>32 lelong 0 type: NONE, 35271>32 lelong 1 type: META, 35272>32 lelong 2 type: ZFS, 35273>32 lelong 3 type: ZVOL, 35274>32 lelong 4 type: OTHER, 35275>32 lelong 5 type: ANY, 35276>32 lelong >5 type: UNKNOWN (%u), 35277>47 byte x destination GUID: %02X 35278>46 byte x %02X 35279>45 byte x %02X 35280>44 byte x %02X 35281>43 byte x %02X 35282>42 byte x %02X 35283>41 byte x %02X 35284>40 byte x %02X, 35285>48 ulong >0 35286>>52 ulong >0 35287>>>55 byte x source GUID: %02X 35288>>>54 byte x %02X 35289>>>53 byte x %02X 35290>>>52 byte x %02X 35291>>>51 byte x %02X 35292>>>50 byte x %02X 35293>>>49 byte x %02X 35294>>>48 byte x %02X, 35295>56 string >\0 name: '%s' 35296 35297#------------------------------------------------------------------------------ 35298# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 35299# zilog: file(1) magic for Zilog Z8000. 35300# 35301# Was it big-endian or little-endian? My Product Specification doesn't 35302# say. 35303# 353040 long 0xe807 object file (z8000 a.out) 353050 long 0xe808 pure object file (z8000 a.out) 353060 long 0xe809 separate object file (z8000 a.out) 353070 long 0xe805 overlay object file (z8000 a.out) 35308#------------------------------------------------------------------------------ 35309# $File: zip,v 1.6 2021/02/05 22:55:36 christos Exp $ 35310# zip: file(1) magic for zip files; this is not use 35311# Note the version of magic in archive is currently stronger, this is 35312# just an example until negative offsets are supported better 35313 35314# Zip Central Directory record 353150 name zipcd 35316>0 string PK\001\002 Zip archive data 35317!:mime application/zip 35318>>4 leshort x \b, made by 35319>>4 use zipversion 35320>>4 use ziphost 35321>>6 leshort x \b, extract using at least 35322>>6 use zipversion 35323>>12 ledate x \b, last modified %s 35324>>24 lelong >0 \b, uncompressed size %d 35325>>10 leshort x \b, method= 35326>>10 use zipcompression 35327 35328# URL: https://en.wikipedia.org/wiki/Zip_(file_format) 35329# reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9) 35330# Zip known compressions 353310 name zipcompression 35332>0 leshort 0 \bstore 35333>0 leshort 1 \bShrinking 35334>0 leshort 6 \bImploding 35335>0 leshort 7 \bTokenizing 35336>0 leshort 8 \bdeflate 35337>0 leshort 9 \bdeflate64 35338>0 leshort 10 \bLibrary imploding 35339#>0 leshort 11 \bReserved by PKWARE 35340>0 leshort 12 \bbzip2 35341#>0 leshort 13 \bReserved by PKWARE 35342>0 leshort 14 \blzma 35343#>0 leshort 15 \bReserved by PKWARE 35344>0 leshort 16 \bCMPSC (IBM z/OS) 35345#>0 leshort 17 \bReserved by PKWARE 35346>0 leshort 18 \bIBM TERSE 35347>0 leshort 19 \bIBM LZ77 (z/Architecture) 35348>0 leshort 20 \bZstd (deprecated) 35349>0 leshort 93 \bZstd 35350>0 leshort 94 \bMP3 35351>0 leshort 95 \bxz 35352>0 leshort 96 \bJpeg 35353>0 leshort 97 \bWavPack 35354>0 leshort 98 \bPPMd 35355>0 leshort 99 \bAES Encrypted 35356>0 default x 35357>>0 leshort x \b[%#x] 35358 35359# Zip known versions 353600 name zipversion 35361# The lower byte indicates the ZIP version of this file. The value/10 indicates 35362# the major version number, and the value mod 10 is the minor version number. 35363>0 ubyte/10 x v%u 35364>0 ubyte%10 x \b.%u 35365# >0 leshort 0x09 v0.9 35366# >0 leshort 0x0a v1.0 35367# >0 leshort 0x0b v1.1 35368# >0 leshort 0x14 v2.0 35369# >0 leshort 0x15 v2.1 35370# >0 leshort 0x19 v2.5 35371# >0 leshort 0x1b v2.7 35372# >0 leshort 0x2d v4.5 35373# >0 leshort 0x2e v4.6 35374# >0 leshort 0x32 v5.0 35375# >0 leshort 0x33 v5.1 35376# >0 leshort 0x34 v5.2 35377# >0 leshort 0x3d v6.1 35378# >0 leshort 0x3e v6.2 35379# >0 leshort 0x3f v6.3 35380# >0 default x 35381# >>0 leshort x v?[%#x] 35382 35383# display compatible host system name of ZIP archive 353840 name ziphost 35385# The upper byte indicates the compatibility of the file attribute information. 35386# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero. 35387#>1 ubyte 0 DOS 35388>1 ubyte 1 Amiga 35389>1 ubyte 2 OpenVMS 35390>1 ubyte 3 UNIX 35391>1 ubyte 4 VM/CMS 35392>1 ubyte 6 OS/2 35393>1 ubyte 7 Macintosh 35394>1 ubyte 11 MVS 35395>1 ubyte 13 Acorn Risc 35396>1 ubyte 16 BeOS 35397>1 ubyte 17 Tandem 35398# 9 untested 35399>1 ubyte 5 Atari ST 35400>1 ubyte 8 Z-System 35401>1 ubyte 9 CP/M 35402>1 ubyte 10 Windows NTFS 35403>1 ubyte 12 VSE 35404>1 ubyte 14 VFAT 35405>1 ubyte 15 alternate MVS 35406>1 ubyte 18 OS/400 35407>1 ubyte 19 OS X 35408# unused 35409#>1 ubyte >19 unused 0x%x 35410 35411# Zip End Of Central Directory record 35412-22 string PK\005\006 35413#>4 leshort >1 \b, %d disks 35414#>6 leshort >1 \b, central directory disk %d 35415#>8 leshort >1 \b, %d central directories on this disk 35416#>10 leshort >1 \b, %d central directories 35417#>12 lelong x \b, %d central directory bytes 35418>(16.l) use zipcd 35419>>20 pstring/l >0 \b, %s 35420 35421#------------------------------------------------------------------------------ 35422# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 35423# zyxel: file(1) magic for ZyXEL modems 35424# 35425# From <rob@pe1chl.ampr.org> 35426# These are the /etc/magic entries to decode datafiles as used for the 35427# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 35428# ZyXEL-defined standard) 35429 354300 string ZyXEL\002 ZyXEL voice data 35431>10 byte 0 - CELP encoding 35432>10 byte&0x0B 1 - ADPCM2 encoding 35433>10 byte&0x0B 2 - ADPCM3 encoding 35434>10 byte&0x0B 3 - ADPCM4 encoding 35435>10 byte&0x0B 8 - New ADPCM3 encoding 35436>10 byte&0x04 4 with resync 35437
