1 2#------------------------------------------------------------------------------ 3# $File: database,v 1.37 2014/03/14 18:47:29 christos Exp $ 4# database: file(1) magic for various databases 5# 6# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 7# 8# 9# GDBM magic numbers 10# Will be maintained as part of the GDBM distribution in the future. 11# <downsj@teeny.org> 120 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 13!:mime application/x-gdbm 140 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 15!:mime application/x-gdbm 160 string GDBM GNU dbm 2.x database 17!:mime application/x-gdbm 18# 19# Berkeley DB 20# 21# Ian Darwin's file /etc/magic files: big/little-endian version. 22# 23# Hash 1.85/1.86 databases store metadata in network byte order. 24# Btree 1.85/1.86 databases store the metadata in host byte order. 25# Hash and Btree 2.X and later databases store the metadata in host byte order. 26 270 long 0x00061561 Berkeley DB 28!:mime application/x-dbm 29>8 belong 4321 30>>4 belong >2 1.86 31>>4 belong <3 1.85 32>>4 belong >0 (Hash, version %d, native byte-order) 33>8 belong 1234 34>>4 belong >2 1.86 35>>4 belong <3 1.85 36>>4 belong >0 (Hash, version %d, little-endian) 37 380 belong 0x00061561 Berkeley DB 39>8 belong 4321 40>>4 belong >2 1.86 41>>4 belong <3 1.85 42>>4 belong >0 (Hash, version %d, big-endian) 43>8 belong 1234 44>>4 belong >2 1.86 45>>4 belong <3 1.85 46>>4 belong >0 (Hash, version %d, native byte-order) 47 480 long 0x00053162 Berkeley DB 1.85/1.86 49>4 long >0 (Btree, version %d, native byte-order) 500 belong 0x00053162 Berkeley DB 1.85/1.86 51>4 belong >0 (Btree, version %d, big-endian) 520 lelong 0x00053162 Berkeley DB 1.85/1.86 53>4 lelong >0 (Btree, version %d, little-endian) 54 5512 long 0x00061561 Berkeley DB 56>16 long >0 (Hash, version %d, native byte-order) 5712 belong 0x00061561 Berkeley DB 58>16 belong >0 (Hash, version %d, big-endian) 5912 lelong 0x00061561 Berkeley DB 60>16 lelong >0 (Hash, version %d, little-endian) 61 6212 long 0x00053162 Berkeley DB 63>16 long >0 (Btree, version %d, native byte-order) 6412 belong 0x00053162 Berkeley DB 65>16 belong >0 (Btree, version %d, big-endian) 6612 lelong 0x00053162 Berkeley DB 67>16 lelong >0 (Btree, version %d, little-endian) 68 6912 long 0x00042253 Berkeley DB 70>16 long >0 (Queue, version %d, native byte-order) 7112 belong 0x00042253 Berkeley DB 72>16 belong >0 (Queue, version %d, big-endian) 7312 lelong 0x00042253 Berkeley DB 74>16 lelong >0 (Queue, version %d, little-endian) 75 76# From Max Bowsher. 7712 long 0x00040988 Berkeley DB 78>16 long >0 (Log, version %d, native byte-order) 7912 belong 0x00040988 Berkeley DB 80>16 belong >0 (Log, version %d, big-endian) 8112 lelong 0x00040988 Berkeley DB 82>16 lelong >0 (Log, version %d, little-endian) 83 84# 85# 86# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 870 string/b RRD\0 RRDTool DB 88>4 string/b x version %s 89 90>>10 short !0 16bit aligned 91>>>10 bedouble 8.642135e+130 big-endian 92>>>>18 short x 32bit long (m68k) 93 94>>10 short 0 95>>>12 long !0 32bit aligned 96>>>>12 bedouble 8.642135e+130 big-endian 97>>>>>20 long 0 64bit long 98>>>>>20 long !0 32bit long 99>>>>12 ledouble 8.642135e+130 little-endian 100>>>>>24 long 0 64bit long 101>>>>>24 long !0 32bit long (i386) 102>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 103>>>>>24 short !0 32bit long (arm) 104 105>>8 quad 0 64bit aligned 106>>>16 bedouble 8.642135e+130 big-endian 107>>>>24 long 0 64bit long (s390x) 108>>>>24 long !0 32bit long (hppa/mips/ppc/s390/sparc) 109>>>16 ledouble 8.642135e+130 little-endian 110>>>>28 long 0 64bit long (alpha/amd64/ia64) 111>>>>28 long !0 32bit long (armel/mipsel) 112 113#---------------------------------------------------------------------- 114# ROOT: file(1) magic for ROOT databases 115# 1160 string root\0 ROOT file 117>4 belong x Version %d 118>33 belong x (Compression: %d) 119 120# XXX: Weak magic. 121# Alex Ott <ott@jet.msk.su> 122## Paradox file formats 123#2 leshort 0x0800 Paradox 124#>0x39 byte 3 v. 3.0 125#>0x39 byte 4 v. 3.5 126#>0x39 byte 9 v. 4.x 127#>0x39 byte 10 v. 5.x 128#>0x39 byte 11 v. 5.x 129#>0x39 byte 12 v. 7.x 130#>>0x04 byte 0 indexed .DB data file 131#>>0x04 byte 1 primary index .PX file 132#>>0x04 byte 2 non-indexed .DB data file 133#>>0x04 byte 3 non-incrementing secondary index .Xnn file 134#>>0x04 byte 4 secondary index .Ynn file 135#>>0x04 byte 5 incrementing secondary index .Xnn file 136#>>0x04 byte 6 non-incrementing secondary index .XGn file 137#>>0x04 byte 7 secondary index .YGn file 138#>>>0x04 byte 8 incrementing secondary index .XGn file 139 140## XBase database files 141# updated by Joerg Jenderek at Feb 2013 142# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 143# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 144# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 145# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 1460 ubelong&0x0000FFFF <0x00000C20 147# skip Infocom game Z-machine 148>2 ubyte >0 149# skip Androids *.xml 150>>3 ubyte >0 151>>>3 ubyte <32 152# 1 < version VV 153>>>>0 ubyte >1 154# skip HELP.CA3 by test for reserved byte ( NULL ) 155>>>>>27 ubyte 0 156# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 157#>>>>>30 ubeshort x 30NULL?%x 158# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 159>>>>>>24 ubelong&0xffFFFFff >0x01302000 160# .DBF or .MDX 161>>>>>>24 ubelong&0xffFFFFff <0x01302001 162# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 163>>>>>>>24 ubelong&0xffFFFFff =0 164# test for 2 reserved NULL bytes,transaction and encryption byte flag 165>>>>>>>>12 ubelong&0xFFFFfEfE 0 166# test for MDX flag 167>>>>>>>>>28 ubyte x 168>>>>>>>>>28 ubyte&0xf8 0 169# header size >= 32 170>>>>>>>>>>8 uleshort >31 171# skip PIC15736.PCX by test for language driver name or field name 172>>>>>>>>>>>32 ubyte >0 173#!:mime application/x-dbf; charset=unknown-8bit ?? 174#!:mime application/x-dbase 175>>>>>>>>>>>>0 use xbase-type 176# database file 177>>>>>>>>>>>>0 ubyte x \b DBF 178>>>>>>>>>>>>4 lelong 0 \b, no records 179>>>>>>>>>>>>4 lelong >0 \b, %ld record 180# plural s appended 181>>>>>>>>>>>>>4 lelong >1 \bs 182# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 183# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 184>>>>>>>>>>>>10 uleshort x * %d 185# file size = records * record size + header size 186>>>>>>>>>>>>1 ubyte x \b, update-date 187>>>>>>>>>>>>1 use xbase-date 188# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 189#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 190# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 191>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 192#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 193>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 194>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 195>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 196# 1st record offset + 1 = header size 197>>>>>>>>>>>>8 uleshort >0 198>>>>>>>>>>>>(8.s+1) ubyte >0 199>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 200>>>>>>>>>>>>>(8.s+1) ubyte >0 201>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 202# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 203>>>>>>>24 ubelong&0x0133f7ff >0 204# test for reserved NULL byte 205>>>>>>>>47 ubyte x 206# test for valid TAG key format (0x10 or 0) 207>>>>>>>>>559 ubyte&0xeF 0 208# test MM <= 12 209>>>>>>>>>45 ubeshort <0x0C20 210>>>>>>>>>>45 ubyte >0 211>>>>>>>>>>>46 ubyte <32 212>>>>>>>>>>>>46 ubyte >0 213#!:mime application/x-mdx 214>>>>>>>>>>>>>0 use xbase-type 215>>>>>>>>>>>>>0 ubyte x \b MDX 216>>>>>>>>>>>>>1 ubyte x \b, creation-date 217>>>>>>>>>>>>>1 use xbase-date 218>>>>>>>>>>>>>44 ubyte x \b, update-date 219>>>>>>>>>>>>>44 use xbase-date 220# No.of tags in use (1,2,5,12) 221>>>>>>>>>>>>>28 uleshort x \b, %d 222# No. of entries in tag (0x30) 223>>>>>>>>>>>>>25 ubyte x \b/%d tags 224# Length of tag 225>>>>>>>>>>>>>26 ubyte x * %d 226# 1st tag name_ 227>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 228# 2nd tag name 229#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 230# 231# Print the xBase names of different version variants 2320 name xbase-type 233>0 ubyte <2 234# 1 < version 235>0 ubyte >1 236>>0 ubyte 0x02 FoxBase 237# FoxBase+/dBaseIII+, no memo 238>>0 ubyte 0x03 FoxBase+/dBase III 239!:mime application/x-dbf 240# dBASE IV no memo file 241>>0 ubyte 0x04 dBase IV 242!:mime application/x-dbf 243# dBASE V no memo file 244>>0 ubyte 0x05 dBase V 245!:mime application/x-dbf 246>>0 ubyte 0x30 Visual FoxPro 247!:mime application/x-dbf 248>>0 ubyte 0x31 Visual FoxPro, autoincrement 249!:mime application/x-dbf 250# Visual FoxPro, with field type Varchar or Varbinary 251>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 252!:mime application/x-dbf 253# dBASE IV SQL, no memo;dbv memo var size (Flagship) 254>>0 ubyte 0x43 dBase IV, with SQL table 255!:mime application/x-dbf 256# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 257#>>0 ubyte 0x62 dBase IV, with SQL table 258#!:mime application/x-dbf 259# dBASE IV, with memo!! 260>>0 ubyte 0x7b dBase IV, with memo 261!:mime application/x-dbf 262# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 263#>>0 ubyte 0x82 dBase IV, with SQL system 264#!:mime application/x-dbf 265# FoxBase+/dBaseIII+ with memo .DBT! 266>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 267!:mime application/x-dbf 268# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 269>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 270!:mime application/x-dbf 271# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 272#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 273#!:mime application/x-dbf 274# dBASE IV with memo! 275>>0 ubyte 0x8B dBase IV, with memo .DBT 276!:mime application/x-dbf 277# dBase IV with SQL Table,no memo? 278>>0 ubyte 0x8E dBase IV, with SQL table 279!:mime application/x-dbf 280# .dbv and .dbt memo (Flagship)? 281>>0 ubyte 0xB3 Flagship 282# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 283#>>0 ubyte 0xCA dBase IV with memo .DBT 284#!:mime application/x-dbf 285# dBASE IV with SQL table, with memo .DBT 286>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 287!:mime application/x-dbf 288# HiPer-Six format;Clipper SIX, with SMT memo file 289>>0 ubyte 0xE5 Clipper SIX with memo 290!:mime application/x-dbf 291# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 292#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 293#!:mime application/x-dbf 294>>0 ubyte 0xF5 FoxPro with memo 295!:mime application/x-dbf 296# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 297#>>0 ubyte 0xFA FoxPro 2.x, with memo 298#!:mime application/x-dbf 299# unknown version (should not happen) 300>>0 default x xBase 301!:mime application/x-dbf 302>>>0 ubyte x (0x%x) 303# flags in version byte 304# DBT flag (with dBASE III memo .DBT)!! 305# >>0 ubyte&0x80 >0 DBT_FLAG=%x 306# memo flag ?? 307# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 308# SQL flag ?? 309# >>0 ubyte&0x70 >0 SQL_FLAG=%x 310# test and print the date of xBase .DBF .MDX 3110 name xbase-date 312# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 313>0 ubelong x 314>1 ubyte <13 315>>1 ubyte >0 316>>>2 ubyte >0 317>>>>2 ubyte <32 318>>>>>0 ubyte x 319# YY is interpreted as 20YY or 19YY 320>>>>>>0 ubyte <100 \b %.2d 321# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 322>>>>>>0 ubyte >99 \b %d 323>>>>>1 ubyte x \b-%d 324>>>>>2 ubyte x \b-%d 325 326# dBase memo files .DBT or .FPT 327# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 32816 ubyte <4 329>16 ubyte !2 330>>16 ubyte !1 331# next free block index is positive 332>>>0 ulelong >0 333# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 334>>>>17 ubelong&0xFFfdFE00 0x00000000 335# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 336>>>>>20 ubelong&0xFF01209B 0x00000000 337# dBASE III 338>>>>>>16 ubyte 3 339# dBASE III DBT 340>>>>>>>0 use xbase-memo-print 341# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage 342>>>>>>16 ubyte 0 343# dBASE IV DBT with DBF name or DBF garbage 344>>>>>>>8 ubelong >0x40000000 345# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block 346>>>>>>>>0 ulelong <0x01010002 347>>>>>>>>>0 use xbase-memo-print 348>>>>>>>8 ubelong 0 349# skip MM*DD*.bin by test for for reserved NULL byte 350>>>>>>>>508 ubelong 0 351# real memo files should contain text here 352>>>>>>>>>520 ubelong >0x20202019 353>>>>>>>>>>520 ubelong <0xFEFEFEFF 354>>>>>>>>>>>0 use xbase-memo-print 355# garbage PCX , ZIP , JAR , XPI 356>>>>>>>8 default x 357 358# Print the information of dBase DBT or FoxPro FPT memo files 3590 name xbase-memo-print 360>0 ubyte x 361# test version 362# memo file 363>>16 ubyte 3 dBase III DBT 364>>16 ubyte 0 365>>>512 ubelong <0x00000003 FoxPro FPT 366# Size of blocks for FoxPro 367>>>>6 ubeshort x \b, blocks size %lu 368# Number of next available block for appending data for FoxPro 369>>>>0 ubelong =0 \b, next free block index %lu 370>>>>0 ubelong !0 \b, next free block index %lu 371>>>512 default x dBase IV DBT 372# DBF file name without extention 373>>>>8 string >\0 \b of %-.8s.DBF 374# size of blocks ; not reliable 0x2020204C 375#>>>>4 ulelong =0 \b, blocks size %lu 376>>>>4 ulelong !0 \b, blocks size %lu 377# Block length found 0 , 512 378#>>>>20 uleshort =0 \b, block length %u 379>>>>20 uleshort !0 \b, block length %u 380# Number of next available block for appending data 381>>>>0 ulelong =0 \b, next free block index %lu 382>>>>0 ulelong !0 \b, next free block index %lu 383>>512 ubelong x 384>>>512 ubelong =0xFFFF0800 385>>>>520 string >\0 \b, 1st used item "%s" 386# FoxPro 387>>>512 ubelong <3 388# FoxPro memo 389>>>>512 ubelong =1 390>>>>520 string >\0 \b, 1st used item "%s" 391>>>512 default x 392# may be deleted memo field 393>>>>512 string >\0 \b, 1st item "%s" 394 395# TODO: 396# DBASE index file *.NDX 397# DBASE Compound Index file *.CDX 398# dBASE IV Printer Driver *.PRF 399## End of XBase database stuff 400 401# MS Access database 4024 string Standard\ Jet\ DB Microsoft Access Database 403!:mime application/x-msaccess 4044 string Standard\ ACE\ DB Microsoft Access Database 405!:mime application/x-msaccess 406 407# TDB database from Samba et al - Martin Pool <mbp@samba.org> 4080 string TDB\ file TDB database 409>32 lelong 0x2601196D version 6, little-endian 410>>36 lelong x hash size %d bytes 411 412# SE Linux policy database 4130 lelong 0xf97cff8c SE Linux policy 414>16 lelong x v%d 415>20 lelong 1 MLS 416>24 lelong x %d symbols 417>28 lelong x %d ocons 418 419# ICE authority file data (Wolfram Kleff) 4202 string ICE ICE authority data 421 422# X11 Xauthority file (Wolfram Kleff) 42310 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42411 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42512 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42613 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42714 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42815 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 42916 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43017 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43118 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 432 433# From: Maxime Henrion <mux@FreeBSD.org> 434# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 4350 string PGDMP PostgreSQL custom database dump 436>5 byte x - v%d 437>6 byte x \b.%d 438>5 beshort <0x101 \b-0 439>5 beshort >0x100 440>>7 byte x \b-%d 441 442# Type: Advanced Data Format (ADF) database 443# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 444# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 4450 string @(#)ADF\ Database CGNS Advanced Data Format 446 447# Tokyo Cabinet magic data 448# http://tokyocabinet.sourceforge.net/index.html 4490 string ToKyO\ CaBiNeT\n Tokyo Cabinet 450>14 string x \b (%s) 451>32 byte 0 \b, Hash 452!:mime application/x-tokyocabinet-hash 453>32 byte 1 \b, B+ tree 454!:mime application/x-tokyocabinet-btree 455>32 byte 2 \b, Fixed-length 456!:mime application/x-tokyocabinet-fixed 457>32 byte 3 \b, Table 458!:mime application/x-tokyocabinet-table 459>33 byte &1 \b, [open] 460>33 byte &2 \b, [fatal] 461>34 byte x \b, apow=%d 462>35 byte x \b, fpow=%d 463>36 byte &0x01 \b, [large] 464>36 byte &0x02 \b, [deflate] 465>36 byte &0x04 \b, [bzip] 466>36 byte &0x08 \b, [tcbs] 467>36 byte &0x10 \b, [excodec] 468>40 lequad x \b, bnum=%lld 469>48 lequad x \b, rnum=%lld 470>56 lequad x \b, fsiz=%lld 471 472# Type: QDBM Quick Database Manager 473# From: Benoit Sibaud <bsibaud@april.org> 4740 string \\[depot\\]\n\f Quick Database Manager, little endian 4750 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 476 477# Type: TokyoCabinet database 478# URL: http://tokyocabinet.sourceforge.net/ 479# From: Benoit Sibaud <bsibaud@april.org> 4800 string ToKyO\ CaBiNeT\n TokyoCabinet database 481>14 string x (version %s) 482 483# From: Stephane Blondon http://www.yaal.fr 484# Database file for Zope (done by FileStorage) 4850 string FS21 Zope Object Database File Storage (data) 486# Cache file for the database of Zope (done by ClientStorage) 4870 string ZEC3 Zope Object Database Client Cache File (data) 488 489# IDA (Interactive Disassembler) database 4900 string IDA1 IDA (Interactive Disassembler) database 491