1ef01931fSBen Gras 2ef01931fSBen Gras#------------------------------------------------------------------------------ 3*835f6802SDirk Vogt# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 4ef01931fSBen Gras# freebsd: file(1) magic for FreeBSD objects 5ef01931fSBen Gras# 6ef01931fSBen Gras# All new-style FreeBSD magic numbers are in host byte order (i.e., 7ef01931fSBen Gras# little-endian on x86). 8ef01931fSBen Gras# 9ef01931fSBen Gras# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 10ef01931fSBen Gras# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 11ef01931fSBen Gras# schemes for distinguishing between executable images, shared libraries, 12ef01931fSBen Gras# and object files. 13ef01931fSBen Gras# 14ef01931fSBen Gras# FreeBSD says: 15ef01931fSBen Gras# 16ef01931fSBen Gras# Regardless of whether it's pure, demand-paged, or none of the 17ef01931fSBen Gras# above: 18ef01931fSBen Gras# 19ef01931fSBen Gras# if the entry point is < 4096, then it's a shared library if 20ef01931fSBen Gras# the "has run-time loader information" bit is set, and is 21ef01931fSBen Gras# position-independent if the "is position-independent" bit 22ef01931fSBen Gras# is set; 23ef01931fSBen Gras# 24ef01931fSBen Gras# if the entry point is >= 4096 (or >4095, same thing), then it's 25ef01931fSBen Gras# an executable, and is dynamically-linked if the "has run-time 26ef01931fSBen Gras# loader information" bit is set. 27ef01931fSBen Gras# 28ef01931fSBen Gras# On x86, NetBSD says: 29ef01931fSBen Gras# 30ef01931fSBen Gras# If it's neither pure nor demand-paged: 31ef01931fSBen Gras# 32ef01931fSBen Gras# if it has the "has run-time loader information" bit set, it's 33ef01931fSBen Gras# a dynamically-linked executable; 34ef01931fSBen Gras# 35ef01931fSBen Gras# if it doesn't have that bit set, then: 36ef01931fSBen Gras# 37ef01931fSBen Gras# if it has the "is position-independent" bit set, it's 38ef01931fSBen Gras# position-independent; 39ef01931fSBen Gras# 40ef01931fSBen Gras# if the entry point is non-zero, it's an executable, otherwise 41ef01931fSBen Gras# it's an object file. 42ef01931fSBen Gras# 43ef01931fSBen Gras# If it's pure: 44ef01931fSBen Gras# 45ef01931fSBen Gras# if it has the "has run-time loader information" bit set, it's 46ef01931fSBen Gras# a dynamically-linked executable, otherwise it's just an 47ef01931fSBen Gras# executable. 48ef01931fSBen Gras# 49ef01931fSBen Gras# If it's demand-paged: 50ef01931fSBen Gras# 51ef01931fSBen Gras# if it has the "has run-time loader information" bit set, 52ef01931fSBen Gras# then: 53ef01931fSBen Gras# 54ef01931fSBen Gras# if the entry point is < 4096, it's a shared library; 55ef01931fSBen Gras# 56ef01931fSBen Gras# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 57ef01931fSBen Gras# it's a dynamically-linked executable); 58ef01931fSBen Gras# 59ef01931fSBen Gras# if it doesn't have the "has run-time loader information" bit 60ef01931fSBen Gras# set, then it's just an executable. 61ef01931fSBen Gras# 62ef01931fSBen Gras# (On non-x86, NetBSD does much the same thing, except that it uses 63ef01931fSBen Gras# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 64ef01931fSBen Gras# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 65ef01931fSBen Gras# had 8K pages; dunno about MIPS.) 66ef01931fSBen Gras# 67ef01931fSBen Gras# I suspect the two will differ only in perverse and uninteresting cases 68ef01931fSBen Gras# ("shared" libraries that aren't demand-paged and whose pages probably 69ef01931fSBen Gras# won't actually be shared, executables with entry points <4096). 70ef01931fSBen Gras# 71ef01931fSBen Gras# I leave it to those more familiar with FreeBSD and NetBSD to figure out 72ef01931fSBen Gras# what the right answer is (although using ">4095", FreeBSD-style, is 73ef01931fSBen Gras# probably better than separately checking for "=4096" and ">4096", 74ef01931fSBen Gras# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 75ef01931fSBen Gras# executables using the NetBSD technique.) 76ef01931fSBen Gras# 77ef01931fSBen Gras0 lelong&0377777777 041400407 FreeBSD/i386 78ef01931fSBen Gras>20 lelong <4096 79ef01931fSBen Gras>>3 byte&0xC0 &0x80 shared library 80ef01931fSBen Gras>>3 byte&0xC0 0x40 PIC object 81ef01931fSBen Gras>>3 byte&0xC0 0x00 object 82ef01931fSBen Gras>20 lelong >4095 83ef01931fSBen Gras>>3 byte&0x80 0x80 dynamically linked executable 84ef01931fSBen Gras>>3 byte&0x80 0x00 executable 85ef01931fSBen Gras>16 lelong >0 not stripped 86ef01931fSBen Gras 87ef01931fSBen Gras0 lelong&0377777777 041400410 FreeBSD/i386 pure 88ef01931fSBen Gras>20 lelong <4096 89ef01931fSBen Gras>>3 byte&0xC0 &0x80 shared library 90ef01931fSBen Gras>>3 byte&0xC0 0x40 PIC object 91ef01931fSBen Gras>>3 byte&0xC0 0x00 object 92ef01931fSBen Gras>20 lelong >4095 93ef01931fSBen Gras>>3 byte&0x80 0x80 dynamically linked executable 94ef01931fSBen Gras>>3 byte&0x80 0x00 executable 95ef01931fSBen Gras>16 lelong >0 not stripped 96ef01931fSBen Gras 97ef01931fSBen Gras0 lelong&0377777777 041400413 FreeBSD/i386 demand paged 98ef01931fSBen Gras>20 lelong <4096 99ef01931fSBen Gras>>3 byte&0xC0 &0x80 shared library 100ef01931fSBen Gras>>3 byte&0xC0 0x40 PIC object 101ef01931fSBen Gras>>3 byte&0xC0 0x00 object 102ef01931fSBen Gras>20 lelong >4095 103ef01931fSBen Gras>>3 byte&0x80 0x80 dynamically linked executable 104ef01931fSBen Gras>>3 byte&0x80 0x00 executable 105ef01931fSBen Gras>16 lelong >0 not stripped 106ef01931fSBen Gras 107ef01931fSBen Gras0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 108ef01931fSBen Gras>20 lelong <4096 109ef01931fSBen Gras>>3 byte&0xC0 &0x80 shared library 110ef01931fSBen Gras>>3 byte&0xC0 0x40 PIC object 111ef01931fSBen Gras>>3 byte&0xC0 0x00 object 112ef01931fSBen Gras>20 lelong >4095 113ef01931fSBen Gras>>3 byte&0x80 0x80 dynamically linked executable 114ef01931fSBen Gras>>3 byte&0x80 0x00 executable 115ef01931fSBen Gras>16 lelong >0 not stripped 116ef01931fSBen Gras 117ef01931fSBen Gras# XXX gross hack to identify core files 118ef01931fSBen Gras# cores start with a struct tss; we take advantage of the following: 119ef01931fSBen Gras# byte 7: highest byte of the kernel stack pointer, always 0xfe 120ef01931fSBen Gras# 8/9: kernel (ring 0) ss value, always 0x0010 121ef01931fSBen Gras# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 122ef01931fSBen Gras# 28: low order byte of the current PTD entry, always 0 since the 123ef01931fSBen Gras# PTD is page-aligned 124ef01931fSBen Gras# 125ef01931fSBen Gras7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 126ef01931fSBen Gras>1039 string >\0 from '%s' 127ef01931fSBen Gras 128ef01931fSBen Gras# /var/run/ld.so.hints 129ef01931fSBen Gras# What are you laughing about? 130ef01931fSBen Gras0 lelong 011421044151 ld.so hints file (Little Endian 131ef01931fSBen Gras>4 lelong >0 \b, version %d) 132ef01931fSBen Gras>4 belong <1 \b) 133ef01931fSBen Gras0 belong 011421044151 ld.so hints file (Big Endian 134ef01931fSBen Gras>4 belong >0 \b, version %d) 135ef01931fSBen Gras>4 belong <1 \b) 136ef01931fSBen Gras 137ef01931fSBen Gras# 138ef01931fSBen Gras# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 139ef01931fSBen Gras# 140ef01931fSBen Gras0 string SCRSHOT_ scrshot(1) screenshot, 141ef01931fSBen Gras>8 byte x version %d, 142ef01931fSBen Gras>9 byte 2 %d bytes in header, 143ef01931fSBen Gras>>10 byte x %d chars wide by 144ef01931fSBen Gras>>11 byte x %d chars high 145