1 2#------------------------------------------------------------------------------ 3# freebsd: file(1) magic for FreeBSD objects 4# 5# All new-style FreeBSD magic numbers are in host byte order (i.e., 6# little-endian on x86). 7# 8# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 9# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 10# schemes for distinguishing between executable images, shared libraries, 11# and object files. 12# 13# FreeBSD says: 14# 15# Regardless of whether it's pure, demand-paged, or none of the 16# above: 17# 18# if the entry point is < 4096, then it's a shared library if 19# the "has run-time loader information" bit is set, and is 20# position-independent if the "is position-independent" bit 21# is set; 22# 23# if the entry point is >= 4096 (or >4095, same thing), then it's 24# an executable, and is dynamically-linked if the "has run-time 25# loader information" bit is set. 26# 27# On x86, NetBSD says: 28# 29# If it's neither pure nor demand-paged: 30# 31# if it has the "has run-time loader information" bit set, it's 32# a dynamically-linked executable; 33# 34# if it doesn't have that bit set, then: 35# 36# if it has the "is position-independent" bit set, it's 37# position-independent; 38# 39# if the entry point is non-zero, it's an executable, otherwise 40# it's an object file. 41# 42# If it's pure: 43# 44# if it has the "has run-time loader information" bit set, it's 45# a dynamically-linked executable, otherwise it's just an 46# executable. 47# 48# If it's demand-paged: 49# 50# if it has the "has run-time loader information" bit set, 51# then: 52# 53# if the entry point is < 4096, it's a shared library; 54# 55# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 56# it's a dynamically-linked executable); 57# 58# if it doesn't have the "has run-time loader information" bit 59# set, then it's just an executable. 60# 61# (On non-x86, NetBSD does much the same thing, except that it uses 62# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 63# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 64# had 8K pages; dunno about MIPS.) 65# 66# I suspect the two will differ only in perverse and uninteresting cases 67# ("shared" libraries that aren't demand-paged and whose pages probably 68# won't actually be shared, executables with entry points <4096). 69# 70# I leave it to those more familiar with FreeBSD and NetBSD to figure out 71# what the right answer is (although using ">4095", FreeBSD-style, is 72# probably better than separately checking for "=4096" and ">4096", 73# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 74# executables using the NetBSD technique.) 75# 760 lelong&0377777777 041400407 FreeBSD/i386 77>20 lelong <4096 78>>3 byte&0xC0 &0x80 shared library 79>>3 byte&0xC0 0x40 PIC object 80>>3 byte&0xC0 0x00 object 81>20 lelong >4095 82>>3 byte&0x80 0x80 dynamically linked executable 83>>3 byte&0x80 0x00 executable 84>16 lelong >0 not stripped 85 860 lelong&0377777777 041400410 FreeBSD/i386 pure 87>20 lelong <4096 88>>3 byte&0xC0 &0x80 shared library 89>>3 byte&0xC0 0x40 PIC object 90>>3 byte&0xC0 0x00 object 91>20 lelong >4095 92>>3 byte&0x80 0x80 dynamically linked executable 93>>3 byte&0x80 0x00 executable 94>16 lelong >0 not stripped 95 960 lelong&0377777777 041400413 FreeBSD/i386 demand paged 97>20 lelong <4096 98>>3 byte&0xC0 &0x80 shared library 99>>3 byte&0xC0 0x40 PIC object 100>>3 byte&0xC0 0x00 object 101>20 lelong >4095 102>>3 byte&0x80 0x80 dynamically linked executable 103>>3 byte&0x80 0x00 executable 104>16 lelong >0 not stripped 105 1060 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 107>20 lelong <4096 108>>3 byte&0xC0 &0x80 shared library 109>>3 byte&0xC0 0x40 PIC object 110>>3 byte&0xC0 0x00 object 111>20 lelong >4095 112>>3 byte&0x80 0x80 dynamically linked executable 113>>3 byte&0x80 0x00 executable 114>16 lelong >0 not stripped 115 116# XXX gross hack to identify core files 117# cores start with a struct tss; we take advantage of the following: 118# byte 7: highest byte of the kernel stack pointer, always 0xfe 119# 8/9: kernel (ring 0) ss value, always 0x0010 120# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 121# 28: low order byte of the current PTD entry, always 0 since the 122# PTD is page-aligned 123# 1247 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 125>1039 string >\0 from '%s' 126 127# /var/run/ld.so.hints 128# What are you laughing about? 1290 lelong 011421044151 ld.so hints file (Little Endian 130>4 lelong >0 \b, version %d) 131>4 belong <1 \b) 1320 belong 011421044151 ld.so hints file (Big Endian 133>4 belong >0 \b, version %d) 134>4 belong <1 \b) 135 136# 137# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 138# 1390 string SCRSHOT_ scrshot(1) screenshot, 140>8 byte x version %d, 141>9 byte 2 %d bytes in header, 142>>10 byte x %d chars wide by 143>>11 byte x %d chars high 144