1 2#------------------------------------------------------------------------------ 3# $File: gnu,v 1.22 2020/04/09 19:11:58 christos Exp $ 4# gnu: file(1) magic for various GNU tools 5# 6# GNU nlsutils message catalog file format 7# 8# GNU message catalog (.mo and .gmo files) 9 10# Update: Joerg Jenderek 11# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 12# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 13# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 14# Note: maybe call it like "GNU translation gettext machine object" 150 string \336\22\4\225 GNU message catalog (little endian), 16#0 ulelong 0x950412DE GNU-format message catalog data 17# TODO: write lines in such a way that code can also be called for big endian variant 18#>0 use gettext-object 19#0 name gettext-object 20>4 ulelong x revision 21!:mime application/x-gettext-translation 22# mo extension is also used for Easeus Partition Master PE32 executable module 23# like ConvertFatToNTFS.mo 24!:ext gmo/mo 25# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 26# major revision 27>4 ulelong/0xFFff x %u. 28# minor revision 29>4 ulelong&0x0000FFff x \b%u 30>>8 ulelong x \b, %u message 31# plural s 32>>8 ulelong >1 \bs 33# size of hashing table 34#>20 ulelong x \b, %u hash 35#>20 ulelong >1 \bes 36#>24 ulelong x at 0x%x 37# for revsion x.0 offset of table with originals is 1Ch if directly after header 38>4 ulelong&0x0000FFff =0 39>>12 ulelong !0x1C \b, at 0x%x string table 40# but for x.1 table offset i found is 30h. That means directly after bigger header 41>4 ulelong&0x0000FFff >0 42>>12 ulelong !0x30 \b, at 0x%x string table 43# The following variables are only used in .mo files with minor revision >= 1 44# number of system dependent segments 45#>>28 ulelong x \b, %u segment 46#>>28 ulelong >1 \bs 47# offset of table describing system dependent segments 48#>>32 ulelong x at 0x%x 49# number of system dependent strings pairs 50>>36 ulelong x \b, %u sysdep message 51>>36 ulelong >1 \bs 52# offset of table with start offsets of original sysdep strings 53#>>40 ulelong x \b, at 0x%x sysdep strings 54# offset of table with start offsets of translated sysdep strings 55#>>44 ulelong x \b, at 0x%x sysdep translations 56# >>(44.l) ulelong x 0x%x chars 57# >>>&0 ulelong x at 0x%x 58# >>>>(&-4) string x "%s" 59# string table after big header 60#>>48 ubequad x \b, string table 0x%llx 61# 62# 0th string length seems to be always 0 63#>(12.l) ulelong x \b, %u chars 64#>>&0 ulelong x at 0x%x 65# if 1st string length positiv inspect offset and string 66#>(12.l+8) ulelong >0 \b, %u chars 67#>>&0 ulelong x at 0x%x 68# if 2nd string length positiv inspect offset and string 69# >(12.l+16) ulelong >0 \b, %u chars 70# >>&0 ulelong x at 0x%x 71# skip newline byte 72#>>>(&-4) ubyte =0x0A 73#>>>>&0 string x "%s" 74#>>>(&-4) ubyte !0x0A 75#>>>>&-1 string x '%s' 76# offset of table with translation strings 77#>16 ulelong x \b, at 0x%x translation table 78# check translation 0 length and offset 79>(16.l) ulelong >0 80>>&0 ulelong x 81# translation 0 seems to be often Project-Id with name and version 82>>>(&-4) string x \b, %s 83# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 84>(16.l+8) ulelong >1 85>>&0 ulelong x 86>>>(&-4) ubyte !0x0A 87>>>>&-1 string x '%s' 88# 1 New Line like in tar-1.29\po\de.gmo 89>>>(&-4) ubyte =0x0A 90>>>>&0 ubyte !0x0A 91>>>>>&-1 string x '%s' 92# 2nd New Line like in parted-3.1\po\de.gmo 93>>>>&0 ubyte =0x0A 94>>>>>&0 string x '%s' 95 960 string \225\4\22\336 GNU message catalog (big endian), 97#0 ubelong 0x950412DE GNU-format message catalog data 98!:mime application/x-gettext-translation 99!:ext gmo/mo 100# TODO: for big endian use same code as for little endian 101#>0 use \^gettext-object 102# DEBUG code 103#>16 ubelong x \b, at 0x%x translation table 104#>(16.L) ubelong x 0x%x chars 105#>>&0 ubelong x at 0x%x 106# unexpected value HERE! 107#>>>(&-4) ubequad x 0x%llx 108# 109>4 beshort x revision %d. 110>6 beshort >0 \b%d, 111>>8 belong x %d messages, 112>>36 belong x %d sysdep messages 113>6 beshort =0 \b%d, 114>>8 belong x %d messages 115 116 117# GnuPG 118# The format is very similar to pgp 1190 string \001gpg GPG key trust database 120>4 byte x version %d 121# Note: magic.mime had 0x8501 for the next line instead of 0x8502 1220 beshort 0x8502 GPG encrypted data 123!:mime text/PGP # encoding: data 124 125# Update: Joerg Jenderek 126# Note: PGP and GPG use same data structure. 127# So recognition is now done by ./pgp with start test for byte 0x99 128# This magic is not particularly good, as the keyrings don't have true 129# magic. Nevertheless, it covers many keyrings. 130# 0 ubeshort-0x9901 <2 131# >3 byte 4 132# >>4 bedate x GPG key public ring, created %s 133# !:mime application/x-gnupg-keyring 134 135# Symmetric encryption 1360 leshort 0x0d8c 137>4 leshort 0x0203 138>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 139>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 140>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 141>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 142>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 143>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 144>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 145>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 146>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 147>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 148 149 150# GnuPG Keybox file 151# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 152# From: Philipp Hahn <hahn@univention.de> 1530 belong 32 154>4 byte 1 155>>8 string KBXf GPG keybox database 156>>>5 byte 1 version %d 157>>>16 bedate x \b, created-at %s 158>>>20 bedate x \b, last-maintained %s 159 160 161# From: James Youngman <jay@gnu.org> 162# gnu find magic 1630 string \0LOCATE GNU findutils locate database data 164>7 string >\0 \b, format %s 165>7 string 02 \b (frcode) 166 167# Files produced by GNU gettext 168 169# gettext message catalogue 1700 search/1024 \nmsgid 171>&0 search/1024 \nmsgstr GNU gettext message catalogue text 172!:strength +100 173!:mime text/x-po 174