Upgrade to file version 3.22.
Obtained from: ftp://ftp.deshaw.com/pub/file/file-3.22.tar.gz
This commit is contained in:
Mike Pritchard
parent
8356464a86
commit
094f1e246b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/vendor/file/dist/; revision=23988
21
usr.bin/file/Magdir/alpha
Normal file
21
usr.bin/file/Magdir/alpha
Normal file
@ -0,0 +1,21 @@
|
||||
#------------------------------------------------------------------------------
|
||||
# alpha architecture description
|
||||
#
|
||||
|
||||
0 leshort 0603 COFF format alpha
|
||||
>22 leshort&030000 !020000 executable
|
||||
>24 leshort 0410 pure
|
||||
>24 leshort 0413 paged
|
||||
>22 leshort&020000 !0 dynamically linked
|
||||
>16 lelong !0 not stripped
|
||||
>16 lelong 0 stripped
|
||||
>22 leshort&030000 020000 shared library
|
||||
>24 leshort 0407 object
|
||||
>27 byte x - version %d
|
||||
>26 byte x .%d
|
||||
>28 byte x -%d
|
||||
|
||||
# Basic recognition of OSF/1 core dumps - Mike Bremford <mike@opac.bl.uk>
|
||||
#
|
||||
0 string Core\001 COFF format core dump (OSF/1)
|
||||
>24 string >\0 generated by '%s'
|
||||
7
usr.bin/file/Magdir/amanda
Normal file
7
usr.bin/file/Magdir/amanda
Normal file
@ -0,0 +1,7 @@
|
||||
#------------------------------------------------------------------------------
|
||||
# amanda: file(1) magic for amanda file format
|
||||
#
|
||||
0 string AMANDA:\ TAPESTART\ DATE AMANDA dump header file,
|
||||
>23 string X
|
||||
>>25 string >\ Unused %s
|
||||
>23 string >\ DATE %s
|
||||
10
usr.bin/file/Magdir/amigaos
Normal file
10
usr.bin/file/Magdir/amigaos
Normal file
@ -0,0 +1,10 @@
|
||||
#------------------------------------------------------------------------------
|
||||
# amigaos: file(1) magic for AmigaOS binary formats:
|
||||
|
||||
#
|
||||
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
|
||||
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
|
||||
# (the others should be seperate, anyway)
|
||||
#
|
||||
0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
|
||||
0 belong 0x000003e7 AmigaOS object/library data
|
||||
@ -45,8 +45,6 @@
|
||||
>19 string B and an EB hash table
|
||||
>22 string X -- out of date
|
||||
|
||||
0 string !<arch> archive
|
||||
>8 string __.SYMDEF random library
|
||||
0 string -h- Software Tools format archive text
|
||||
|
||||
#
|
||||
@ -56,11 +54,10 @@
|
||||
# 0 string !<arch> current ar archive
|
||||
# 0 long 0x213c6172 archive file
|
||||
#
|
||||
# and for SVR3.1 archives, we have:
|
||||
# and for SVR1 archives, we have:
|
||||
#
|
||||
# 0 string \<ar> System V Release 1 ar archive
|
||||
# 0 string =<ar> archive
|
||||
# 0 string =<ar> archive
|
||||
#
|
||||
# XXX - did Aegis really store shared libraries, breakpointed modules,
|
||||
# and absolute code program modules in the same format as new-style
|
||||
@ -68,6 +65,8 @@
|
||||
#
|
||||
0 string !<arch> current ar archive
|
||||
>8 string __.SYMDEF random library
|
||||
>8 string debian-split part of multipart Debian package
|
||||
>8 string debian-binary Debian binary package
|
||||
>0 belong =65538 - pre SR9.5
|
||||
>0 belong =65539 - post SR9.5
|
||||
>0 beshort 2 - object archive
|
||||
@ -96,14 +95,10 @@
|
||||
0 leshort 0177545 old PDP-11 archive
|
||||
>8 string __.SYMDEF random library
|
||||
#
|
||||
0 string =<ar> archive
|
||||
#
|
||||
# From "pdp":
|
||||
# From "pdp" (but why a 4-byte quantity?)
|
||||
#
|
||||
0 lelong 0x39bed PDP-11 old archive
|
||||
0 lelong 0x39bee PDP-11 4.0 archive
|
||||
#
|
||||
0 string -h- Software Tools format archive text
|
||||
|
||||
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
|
||||
#
|
||||
|
||||
17
usr.bin/file/Magdir/asterix
Normal file
17
usr.bin/file/Magdir/asterix
Normal file
@ -0,0 +1,17 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
|
||||
# strings as "long" - we assume they're just strings:
|
||||
# From: guy@netapp.com (Guy Harris)
|
||||
#
|
||||
0 string *STA Aster*x
|
||||
>7 string WORD Words Document
|
||||
>7 string GRAP Graphic
|
||||
>7 string SPRE Spreadsheet
|
||||
>7 string MACR Macro
|
||||
0 string 2278 Aster*x Version 2
|
||||
>29 byte 0x36 Words Document
|
||||
>29 byte 0x35 Graphic
|
||||
>29 byte 0x32 Spreadsheet
|
||||
>29 byte 0x38 Macro
|
||||
|
||||
@ -16,6 +16,10 @@
|
||||
>12 belong 6 32-bit IEEE floating point,
|
||||
>12 belong 7 64-bit IEEE floating point,
|
||||
>12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
|
||||
>12 belong 24 compressed (8-bit G.722 ADPCM)
|
||||
>12 belong 25 compressed (3-bit G.723 ADPCM),
|
||||
>12 belong 26 compressed (5-bit G.723 ADPCM),
|
||||
>12 belong 27 8-bit A-law,
|
||||
>20 belong 1 mono,
|
||||
>20 belong 2 stereo,
|
||||
>20 belong 4 quad,
|
||||
@ -54,14 +58,15 @@
|
||||
>4 belong x - version %ld
|
||||
|
||||
# Microsoft WAVE format (*.wav)
|
||||
# [GRR 950115: probably all of the shorts and longs should be leshort/lelong]
|
||||
0 string RIFF Microsoft RIFF
|
||||
>8 string WAVE \b, WAVE audio data
|
||||
>34 short >0 \b, %d bit
|
||||
>22 short =1 \b, mono
|
||||
>22 short =2 \b, stereo
|
||||
>22 short >2 \b, %d channels
|
||||
>24 long >0 %d Hz
|
||||
>>34 leshort >0 \b, %d bit
|
||||
>>22 leshort =1 \b, mono
|
||||
>>22 leshort =2 \b, stereo
|
||||
>>22 leshort >2 \b, %d channels
|
||||
>>24 lelong >0 %d Hz
|
||||
# AVI == Audio Video Interleave
|
||||
>8 string AVI\ \b, AVI data
|
||||
|
||||
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
|
||||
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
|
||||
@ -71,3 +76,15 @@
|
||||
>45 byte x %d instruments
|
||||
>83 byte 0 (module)
|
||||
>83 byte 1 (song)
|
||||
|
||||
# Real Audio (Magic .ra\0375)
|
||||
0 belong 0x2e7261fd realaudio sound file
|
||||
|
||||
# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
|
||||
# Oct 31, 1995
|
||||
0 string MTM MultiTracker Module sound file
|
||||
0 string if Composer 669 Module sound data
|
||||
0 string FAR Module sound data
|
||||
0 string MAS_U ULT(imate) Module sound data
|
||||
0x2c string SCRM ScreamTracker III Module sound data
|
||||
0 string Extended Module Extended Module sound data
|
||||
|
||||
@ -1,2 +1,7 @@
|
||||
# BSDI BSD/386
|
||||
0 long 0314 BSD/386 demand paged (first page unmapped) pure executable
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
|
||||
#
|
||||
0 lelong 000000314 BSD/OS i386 compact demand paged executable
|
||||
>16 lelong >0 not stripped
|
||||
>32 byte 0x6a (uses shared libs)
|
||||
|
||||
@ -79,8 +79,14 @@
|
||||
#
|
||||
# This will cause very short GSM files to be declared as data and
|
||||
# mismatches to be declared as data too!
|
||||
#0 byte&0xF0 0xd0 data
|
||||
#0 byte&0xF0 0xd0 data
|
||||
#>33 byte&0xF0 0xd0
|
||||
#>66 byte&0xF0 0xd0
|
||||
#>99 byte&0xF0 0xd0
|
||||
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
|
||||
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
|
||||
|
||||
# Bzip from ulmo@Q.Net
|
||||
0 string BZ bzip compressed data,
|
||||
>2 byte x format v. %c,
|
||||
>3 byte x block size indicator %c
|
||||
|
||||
|
||||
@ -1,7 +1,69 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# convex: file(1) magic for Convex boxes
|
||||
#
|
||||
# Convexes are big-endian.
|
||||
#
|
||||
0 long 0513 Convex executable
|
||||
# /*\
|
||||
# * Below are the magic numbers and tests added for Convex.
|
||||
# * Added at beginning, because they are expected to be used most.
|
||||
# \*/
|
||||
0 belong 0507 Convex old-style object
|
||||
>16 belong >0 not stripped
|
||||
0 belong 0513 Convex old-style demand paged executable
|
||||
>16 belong >0 not stripped
|
||||
0 belong 0515 Convex old-style pre-paged executable
|
||||
>16 belong >0 not stripped
|
||||
0 belong 0517 Convex old-style pre-paged, non-swapped executable
|
||||
>16 belong >0 not stripped
|
||||
0 belong 0x011257 Core file
|
||||
#
|
||||
# The following are a series of dump format magic numbers. Each one
|
||||
# corresponds to a drastically different dump format. The first on is
|
||||
# the original dump format on a 4.1 BSD or earlier file system. The
|
||||
# second marks the change between the 4.1 file system and the 4.2 file
|
||||
# system. The Third marks the changing of the block size from 1K
|
||||
# to 2K to be compatible with an IDC file system. The fourth indicates
|
||||
# a dump that is dependent on Convex Storage Manager, because data in
|
||||
# secondary storage is not physically contained within the dump.
|
||||
# The restore program uses these number to determine how the data is
|
||||
# to be extracted.
|
||||
#
|
||||
24 belong =60011 dump format, 4.1 BSD or earlier
|
||||
24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
|
||||
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
|
||||
24 belong =60014 dump format, Convex Storage Manager by-reference dump
|
||||
#
|
||||
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
|
||||
# If there is no `=' sign, assume just checking for whether the bit is set?
|
||||
#
|
||||
0 belong 0601 Convex SOFF
|
||||
>88 belong&0x000f0000 =0x00000000 c1
|
||||
>88 belong &0x00010000 c2
|
||||
>88 belong &0x00020000 c2mp
|
||||
>88 belong &0x00040000 parallel
|
||||
>88 belong &0x00080000 intrinsic
|
||||
>88 belong &0x00000001 demand paged
|
||||
>88 belong &0x00000002 pre-paged
|
||||
>88 belong &0x00000004 non-swapped
|
||||
>88 belong &0x00000008 POSIX
|
||||
#
|
||||
>84 belong &0x80000000 executable
|
||||
>84 belong &0x40000000 object
|
||||
>84 belong&0x20000000 =0 not stripped
|
||||
>84 belong&0x18000000 =0x00000000 native fpmode
|
||||
>84 belong&0x18000000 =0x10000000 ieee fpmode
|
||||
>84 belong&0x18000000 =0x18000000 undefined fpmode
|
||||
#
|
||||
0 belong 0605 Convex SOFF core
|
||||
#
|
||||
0 belong 0607 Convex SOFF checkpoint
|
||||
>88 belong&0x000f0000 =0x00000000 c1
|
||||
>88 belong &0x00010000 c2
|
||||
>88 belong &0x00020000 c2mp
|
||||
>88 belong &0x00040000 parallel
|
||||
>88 belong &0x00080000 intrinsic
|
||||
>88 belong &0x00000008 POSIX
|
||||
#
|
||||
>84 belong&0x18000000 =0x00000000 native fpmode
|
||||
>84 belong&0x18000000 =0x10000000 ieee fpmode
|
||||
>84 belong&0x18000000 =0x18000000 undefined fpmode
|
||||
|
||||
@ -17,16 +17,18 @@
|
||||
>8 belong 1234 Little Endian,
|
||||
>8 belong 4321 Big Endian,
|
||||
>12 belong x Bucket Size %d,
|
||||
>16 belong x Directory Size %d,
|
||||
>20 belong x Segment Size %d,
|
||||
>24 belong x Segment Shift %d,
|
||||
>28 belong x Overflow Point %d,
|
||||
>32 belong x Last Freed %d,
|
||||
>36 belong x Max Bucket %d,
|
||||
>40 belong x High Mask 0x%x,
|
||||
>44 belong x Low Mask 0x%x,
|
||||
>48 belong x Fill Factor %d,
|
||||
>52 belong x Number of Keys %d)
|
||||
>16 belong x Bucket Shift %d,
|
||||
>20 belong x Directory Size %d,
|
||||
>24 belong x Segment Size %d,
|
||||
>28 belong x Segment Shift %d,
|
||||
>32 belong x Overflow Point %d,
|
||||
>36 belong x Last Freed %d,
|
||||
>40 belong x Max Bucket %d,
|
||||
>44 belong x High Mask 0x%x,
|
||||
>48 belong x Low Mask 0x%x,
|
||||
>52 belong x Fill Factor %d,
|
||||
>56 belong x Number of Keys %d)
|
||||
#
|
||||
#
|
||||
0 belong 0x053162 Berkeley DB Btree file
|
||||
>4 belong >0 (Version %d,
|
||||
|
||||
41
usr.bin/file/Magdir/digital
Normal file
41
usr.bin/file/Magdir/digital
Normal file
@ -0,0 +1,41 @@
|
||||
# Digital UNIX - Info
|
||||
#
|
||||
0 string ^!<arch>\n_______64E Alpha archive
|
||||
>22 string X -- out of date
|
||||
#
|
||||
# Alpha COFF Based Executables
|
||||
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
|
||||
# but this works
|
||||
0 leshort 0x183 COFF format alpha
|
||||
>22 leshort&020000 &010000 sharable library,
|
||||
>22 leshort&020000 ^010000 dynamically linked,
|
||||
>24 leshort 0410 pure
|
||||
>24 leshort 0413 demand paged
|
||||
>8 lelong >0 executable or object module, not stripped
|
||||
>8 lelong 0
|
||||
>>12 lelong 0 executable or object module, stripped
|
||||
>>12 lelong >0 executable or object module, not stripped
|
||||
>27 byte >0 - version %d.
|
||||
>26 byte >0 %d-
|
||||
>28 leshort >0 %d
|
||||
#
|
||||
# The next is incomplete, we could tell more about this format,
|
||||
# but its not worth it.
|
||||
0 leshort 0x188 Alpha compressed COFF
|
||||
0 leshort 0x18f Alpha u-code object
|
||||
#
|
||||
#
|
||||
# Some other interesting Digital formats,
|
||||
0 string \377\377\177 ddis/ddif
|
||||
0 string \377\377\174 ddis/dots archive
|
||||
0 string \377\377\176 ddis/dtif table data
|
||||
0 string \033c\033 LN03 output
|
||||
0 long 04553207 X image
|
||||
#
|
||||
0 string !<PDF>!\n profiling data file
|
||||
#
|
||||
# Locale data tables (MIPS and Alpha).
|
||||
#
|
||||
0 short 0x0501 locale data table
|
||||
>6 short 0x24 for MIPS
|
||||
>6 short 0x40 for Alpha
|
||||
@ -43,8 +43,8 @@
|
||||
>888 belong >0 Flags %x
|
||||
|
||||
24 lelong 60012 new-fs dump file (little endian),
|
||||
>4 ledate x Previous dump %s,
|
||||
>8 ledate x This dump %s,
|
||||
>4 ledate x This dump %s,
|
||||
>8 ledate x Previous dump %s,
|
||||
>12 lelong >0 Volume %ld,
|
||||
>692 lelong 0 Level zero, type:
|
||||
>692 lelong >0 Level %d, type:
|
||||
|
||||
@ -5,8 +5,8 @@
|
||||
# We have to check the byte order flag to see what byte order all the
|
||||
# other stuff in the header is in.
|
||||
#
|
||||
# Byte order is probably big-endian for MIPS RS3000 and Amdahl.
|
||||
# MIPS RS3000 may also be for MIPS RS2000.
|
||||
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
|
||||
#
|
||||
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
|
||||
0 string \177ELF ELF
|
||||
@ -19,7 +19,9 @@
|
||||
>>16 leshort 1 relocatable,
|
||||
>>16 leshort 2 executable,
|
||||
>>16 leshort 3 shared object,
|
||||
>>16 leshort 4 core file,
|
||||
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
|
||||
>>16 leshort 4 core file
|
||||
>>>400 lelong >0 (signal %d),
|
||||
>>16 leshort &0xff00 processor-specific,
|
||||
>>18 leshort 0 no machine,
|
||||
>>18 leshort 1 AT&T WE32100 - invalid byte order,
|
||||
@ -29,8 +31,16 @@
|
||||
>>18 leshort 5 Motorola 88000 - invalid byte order,
|
||||
>>18 leshort 6 Intel 80486,
|
||||
>>18 leshort 7 Intel 80860,
|
||||
>>18 leshort 8 MIPS RS3000,
|
||||
>>18 leshort 9 Amdahl,
|
||||
>>18 leshort 8 MIPS RS3000_BE - invalid byte order,
|
||||
>>18 leshort 9 Amdahl - invalid byte order,
|
||||
>>18 leshort 10 MIPS RS3000_LE,
|
||||
>>18 leshort 11 RS6000 - invalid byte order,
|
||||
>>18 leshort 15 PA_RISC - invalid byte order,
|
||||
>>18 leshort 16 nCUBE,
|
||||
>>18 leshort 17 VPP500,
|
||||
>>18 leshort 18 SPARC32PLUS,
|
||||
>>18 leshort 20 PowerPC,
|
||||
>>18 leshort 0x9026 Alpha,
|
||||
>>20 lelong 0 invalid version
|
||||
>>20 lelong 1 version 1
|
||||
>>36 lelong 1 MathCoPro/FPU/MAU Required
|
||||
@ -40,6 +50,7 @@
|
||||
>>16 beshort 2 executable,
|
||||
>>16 beshort 3 shared object,
|
||||
>>16 beshort 4 core file,
|
||||
>>>400 lelong >0 (signal %d),
|
||||
>>16 beshort &0xff00 processor-specific,
|
||||
>>18 beshort 0 no machine,
|
||||
>>18 beshort 1 AT&T WE32100,
|
||||
@ -49,8 +60,16 @@
|
||||
>>18 beshort 5 Motorola 88000,
|
||||
>>18 beshort 6 Intel 80486 - invalid byte order,
|
||||
>>18 beshort 7 Intel 80860,
|
||||
>>18 beshort 8 MIPS RS3000,
|
||||
>>18 leshort 9 Amdahl,
|
||||
>>18 beshort 8 MIPS RS3000_BE,
|
||||
>>18 beshort 9 Amdahl,
|
||||
>>18 beshort 10 MIPS RS3000_LE - invalid byte order,
|
||||
>>18 beshort 11 RS6000,
|
||||
>>18 beshort 15 PA_RISC,
|
||||
>>18 beshort 16 nCUBE,
|
||||
>>18 beshort 17 VPP500,
|
||||
>>18 beshort 18 SPARC32PLUS,
|
||||
>>18 beshort 20 PowerPC,
|
||||
>>18 beshort 0x9026 Alpha,
|
||||
>>20 belong 0 invalid version
|
||||
>>20 belong 1 version 1
|
||||
>>36 belong 1 MathCoPro/FPU/MAU Required
|
||||
|
||||
130
usr.bin/file/Magdir/freebsd
Normal file
130
usr.bin/file/Magdir/freebsd
Normal file
@ -0,0 +1,130 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# freebsd: file(1) magic for FreeBSD objects
|
||||
#
|
||||
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
|
||||
# little-endian on x86).
|
||||
#
|
||||
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
|
||||
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
|
||||
# schemes for distinguishing between executable images, shared libraries,
|
||||
# and object files.
|
||||
#
|
||||
# FreeBSD says:
|
||||
#
|
||||
# Regardless of whether it's pure, demand-paged, or none of the
|
||||
# above:
|
||||
#
|
||||
# if the entry point is < 4096, then it's a shared library if
|
||||
# the "has run-time loader information" bit is set, and is
|
||||
# position-independent if the "is position-independent" bit
|
||||
# is set;
|
||||
#
|
||||
# if the entry point is >= 4096 (or >4095, same thing), then it's
|
||||
# an executable, and is dynamically-linked if the "has run-time
|
||||
# loader information" bit is set.
|
||||
#
|
||||
# On x86, NetBSD says:
|
||||
#
|
||||
# If it's neither pure nor demand-paged:
|
||||
#
|
||||
# if it has the "has run-time loader information" bit set, it's
|
||||
# a dynamically-linked executable;
|
||||
#
|
||||
# if it doesn't have that bit set, then:
|
||||
#
|
||||
# if it has the "is position-independent" bit set, it's
|
||||
# position-independent;
|
||||
#
|
||||
# if the entry point is non-zero, it's an executable, otherwise
|
||||
# it's an object file.
|
||||
#
|
||||
# If it's pure:
|
||||
#
|
||||
# if it has the "has run-time loader information" bit set, it's
|
||||
# a dynamically-linked executable, otherwise it's just an
|
||||
# executable.
|
||||
#
|
||||
# If it's demand-paged:
|
||||
#
|
||||
# if it has the "has run-time loader information" bit set,
|
||||
# then:
|
||||
#
|
||||
# if the entry point is < 4096, it's a shared library;
|
||||
#
|
||||
# if the entry point is = 4096 or > 4096 (i.e., >= 4096),
|
||||
# it's a dynamically-linked executable);
|
||||
#
|
||||
# if it doesn't have the "has run-time loader information" bit
|
||||
# set, then it's just an executable.
|
||||
#
|
||||
# (On non-x86, NetBSD does much the same thing, except that it uses
|
||||
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
|
||||
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
|
||||
# had 8K pages; dunno about MIPS.)
|
||||
#
|
||||
# I suspect the two will differ only in perverse and uninteresting cases
|
||||
# ("shared" libraries that aren't demand-paged and whose pages probably
|
||||
# won't actually be shared, executables with entry points <4096).
|
||||
#
|
||||
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
|
||||
# what the right answer is (although using ">4095", FreeBSD-style, is
|
||||
# probably better than separately checking for "=4096" and ">4096",
|
||||
# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
|
||||
# executables using the NetBSD technique.)
|
||||
#
|
||||
0 lelong&0377777777 041400407 FreeBSD/i386
|
||||
>20 lelong <4096
|
||||
>>3 byte&0xC0 &0x80 shared library
|
||||
>>3 byte&0xC0 0x40 PIC object
|
||||
>>3 byte&0xC0 0x00 object
|
||||
>20 lelong >4095
|
||||
>>3 byte&0x80 0x80 dynamically linked executable
|
||||
>>3 byte&0x80 0x00 executable
|
||||
>16 lelong >0 not stripped
|
||||
|
||||
0 lelong&0377777777 041400410 FreeBSD/i386 pure
|
||||
>20 lelong <4096
|
||||
>>3 byte&0xC0 &0x80 shared library
|
||||
>>3 byte&0xC0 0x40 PIC object
|
||||
>>3 byte&0xC0 0x00 object
|
||||
>20 lelong >4095
|
||||
>>3 byte&0x80 0x80 dynamically linked executable
|
||||
>>3 byte&0x80 0x00 executable
|
||||
>16 lelong >0 not stripped
|
||||
|
||||
0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
|
||||
>20 lelong <4096
|
||||
>>3 byte&0xC0 &0x80 shared library
|
||||
>>3 byte&0xC0 0x40 PIC object
|
||||
>>3 byte&0xC0 0x00 object
|
||||
>20 lelong >4095
|
||||
>>3 byte&0x80 0x80 dynamically linked executable
|
||||
>>3 byte&0x80 0x00 executable
|
||||
>16 lelong >0 not stripped
|
||||
|
||||
0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
|
||||
>20 lelong <4096
|
||||
>>3 byte&0xC0 &0x80 shared library
|
||||
>>3 byte&0xC0 0x40 PIC object
|
||||
>>3 byte&0xC0 0x00 object
|
||||
>20 lelong >4095
|
||||
>>3 byte&0x80 0x80 dynamically linked executable
|
||||
>>3 byte&0x80 0x00 executable
|
||||
>16 lelong >0 not stripped
|
||||
|
||||
# XXX gross hack to identify core files
|
||||
# cores start with a struct tss; we take advantage of the following:
|
||||
# byte 7: highest byte of the kernel stack pointer, always 0xfe
|
||||
# 8/9: kernel (ring 0) ss value, always 0x0010
|
||||
# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
|
||||
# 28: low order byte of the current PTD entry, always 0 since the
|
||||
# PTD is page-aligned
|
||||
#
|
||||
7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
|
||||
>1039 string >\0 from '%s'
|
||||
|
||||
# /var/run/ld.so.hints
|
||||
# What are you laughing about?
|
||||
0 lelong 011421044151 ld.so hints file
|
||||
>4 lelong >0 (version %d)
|
||||
@ -6,12 +6,6 @@
|
||||
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
|
||||
# big-endian as it was mostly 68K-based.
|
||||
#
|
||||
# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
|
||||
# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
|
||||
# showed up in the 700 series, although later 800 series machines are,
|
||||
# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
|
||||
# as big-endian.
|
||||
#
|
||||
# I think the 500 series was the old stack-based machines, running a
|
||||
# UNIX environment atop the "SUN kernel"; dunno whether it was
|
||||
# big-endian or little-endian.
|
||||
@ -21,10 +15,23 @@
|
||||
# HP magic is useful for reference, but using "long" magic is a better
|
||||
# practice in order to avoid collisions.
|
||||
#
|
||||
# Guy Harris (guy@netapp.com): some additions to this list came from
|
||||
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
|
||||
# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
|
||||
# "/etc/magic", though, except for the "archive file relocatable library"
|
||||
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
|
||||
# used in executables, or have they just not yet updated "/etc/magic"
|
||||
# completely?
|
||||
#
|
||||
# 0 beshort 200 hp200 (68010) BSD binary
|
||||
# 0 beshort 300 hp300 (68020+68881) BSD binary
|
||||
# 0 beshort 0x20c hp200/300 HP-UX binary
|
||||
# 0 beshort 0x20b hp800 HP-UX binary
|
||||
# 0 beshort 0x20d hp400 (68030) HP-UX binary
|
||||
# 0 beshort 0x20e hp400 (68040?) HP-UX binary
|
||||
# 0 beshort 0x20b PA-RISC1.0 HP-UX binary
|
||||
# 0 beshort 0x210 PA-RISC1.1 HP-UX binary
|
||||
# 0 beshort 0x211 PA-RISC1.2 HP-UX binary
|
||||
# 0 beshort 0x214 PA-RISC2.0 HP-UX binary
|
||||
|
||||
#
|
||||
# The "misc" stuff needs a byte order; the archives look suspiciously
|
||||
@ -41,49 +48,58 @@
|
||||
0 long 01702407010 TML 1032 byte-order format
|
||||
0 long 01003405017 TML 2301 byte-order format
|
||||
0 long 01602007412 TML 3210 byte-order format
|
||||
#### HPPA
|
||||
0 belong 0x02100106 HPPA-RISC1.1 relocatable object
|
||||
0 belong 0x02100107 HPPA-RISC1.1 executable
|
||||
#### PA-RISC
|
||||
0 belong 0x02100106 PA-RISC1.1 relocatable object
|
||||
0 belong 0x02100107 PA-RISC1.1 executable
|
||||
>168 belong &=0x00000004 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x02100108 HPPA-RISC1.1 shared executable
|
||||
0 belong 0x02100108 PA-RISC1.1 shared executable
|
||||
>168 belong&0x4 0x4 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x0210010b HPPA-RISC1.1 demand-load executable
|
||||
0 belong 0x0210010b PA-RISC1.1 demand-load executable
|
||||
>168 belong&0x4 0x4 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x0210010e HPPA-RISC1.1 shared library
|
||||
0 belong 0x0210010e PA-RISC1.1 shared library
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x0210010d HPPA-RISC1.1 dynamic load library
|
||||
0 belong 0x0210010d PA-RISC1.1 dynamic load library
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
#### 800
|
||||
0 belong 0x020b0106 HP s800 relocatable object
|
||||
0 belong 0x020b0106 PA-RISC1.0 relocatable object
|
||||
|
||||
0 belong 0x020b0107 HP s800 executable
|
||||
0 belong 0x020b0107 PA-RISC1.0 executable
|
||||
>168 belong&0x4 0x4 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x020b0108 HP s800 shared executable
|
||||
0 belong 0x020b0108 PA-RISC1.0 shared executable
|
||||
>168 belong&0x4 0x4 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x020b010b HP s800 demand-load executable
|
||||
0 belong 0x020b010b PA-RISC1.0 demand-load executable
|
||||
>168 belong&0x4 0x4 dynamically linked
|
||||
>(144) belong 0x054ef630 dynamically linked
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x020b010e HP s800 shared library
|
||||
0 belong 0x020b010e PA-RISC1.0 shared library
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x020b010d HP s800 dynamic load library
|
||||
0 belong 0x020b010d PA-RISC1.0 dynamic load library
|
||||
>96 belong >0 - not stripped
|
||||
|
||||
0 belong 0x213c6172 archive file
|
||||
>68 belong 0x020b0619 - HP s800 relocatable library
|
||||
>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
|
||||
>68 belong 0x02100619 - PA-RISC1.1 relocatable library
|
||||
>68 belong 0x02110619 - PA-RISC1.2 relocatable library
|
||||
>68 belong 0x02140619 - PA-RISC2.0 relocatable library
|
||||
|
||||
#### 500
|
||||
0 long 0x02080106 HP s500 relocatable executable
|
||||
@ -156,7 +172,7 @@
|
||||
|
||||
0 string IMGfile CIS compimg HP Bitmapfile
|
||||
# XXX - see "lif"
|
||||
0 short 0x8000 lif file
|
||||
#0 short 0x8000 lif file
|
||||
0 long 0x020c010c compiled Lisp
|
||||
|
||||
0 string msgcat01 HP NLS message catalog,
|
||||
|
||||
@ -4,7 +4,35 @@
|
||||
#
|
||||
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
|
||||
# What the heck *is* "USS/370"?
|
||||
# AIX 4.1's "/etc/magic" has
|
||||
#
|
||||
# 0 short 0535 370 sysV executable
|
||||
# >12 long >0 not stripped
|
||||
# >22 short >0 - version %d
|
||||
# >30 long >0 - 5.2 format
|
||||
# 0 short 0530 370 sysV pure executable
|
||||
# >12 long >0 not stripped
|
||||
# >22 short >0 - version %d
|
||||
# >30 long >0 - 5.2 format
|
||||
#
|
||||
# instead of the "USS/370" versions of the same magic numbers.
|
||||
#
|
||||
0 beshort 0537 370 XA sysV executable
|
||||
>12 belong >0 not stripped
|
||||
>22 beshort >0 - version %d
|
||||
>30 belong >0 - 5.2 format
|
||||
0 beshort 0532 370 XA sysV pure executable
|
||||
>12 belong >0 not stripped
|
||||
>22 beshort >0 - version %d
|
||||
>30 belong >0 - 5.2 format
|
||||
0 beshort 054001 370 sysV pure executable
|
||||
>12 belong >0 not stripped
|
||||
0 beshort 055001 370 XA sysV pure executable
|
||||
>12 belong >0 not stripped
|
||||
0 beshort 056401 370 sysV executable
|
||||
>12 belong >0 not stripped
|
||||
0 beshort 057401 370 XA sysV executable
|
||||
>12 belong >0 not stripped
|
||||
0 beshort 0531 SVR2 executable (Amdahl-UTS)
|
||||
>12 belong >0 not stripped
|
||||
>24 belong >0 - version %ld
|
||||
|
||||
@ -12,5 +12,6 @@
|
||||
0 beshort 0x0104 shared library
|
||||
0 beshort 0x0105 ctab data
|
||||
0 beshort 0xfe04 structured file
|
||||
0 string 0xabcdef message catalog
|
||||
#0 string <aiaff> archive
|
||||
0 string 0xabcdef AIX message catalog
|
||||
0 belong 0x000001f9 AIX compiled message catalog
|
||||
0 string \<aiaff> archive
|
||||
|
||||
@ -53,14 +53,14 @@
|
||||
>6 leshort >0 %hd x
|
||||
>8 leshort >0 %hd,
|
||||
#>10 byte &0x80 color mapped,
|
||||
>10 byte&0x07 =0x00 2 colors
|
||||
>10 byte&0x07 =0x01 4 colors
|
||||
>10 byte&0x07 =0x02 8 colors
|
||||
>10 byte&0x07 =0x03 16 colors
|
||||
>10 byte&0x07 =0x04 32 colors
|
||||
>10 byte&0x07 =0x05 64 colors
|
||||
>10 byte&0x07 =0x06 128 colors
|
||||
>10 byte&0x07 =0x07 256 colors
|
||||
#>10 byte&0x07 =0x00 2 colors
|
||||
#>10 byte&0x07 =0x01 4 colors
|
||||
#>10 byte&0x07 =0x02 8 colors
|
||||
#>10 byte&0x07 =0x03 16 colors
|
||||
#>10 byte&0x07 =0x04 32 colors
|
||||
#>10 byte&0x07 =0x05 64 colors
|
||||
#>10 byte&0x07 =0x06 128 colors
|
||||
#>10 byte&0x07 =0x07 256 colors
|
||||
|
||||
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
|
||||
# 1 plane, no encoding.
|
||||
@ -116,6 +116,13 @@
|
||||
>29 byte 1 \b, fine resolution (204x196 DPI)
|
||||
|
||||
# JPEG images
|
||||
# SunOS 5.5.1 had
|
||||
#
|
||||
# 0 string \377\330\377\340 JPEG file
|
||||
# 0 string \377\330\377\356 JPG file
|
||||
#
|
||||
# both of which turn into "JPEG image data" here.
|
||||
#
|
||||
0 beshort 0xffd8 JPEG image data
|
||||
>6 string JFIF \b, JFIF standard
|
||||
# HSI is Handmade Software's proprietary JPEG encoding scheme
|
||||
@ -222,3 +229,8 @@
|
||||
# other images
|
||||
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
|
||||
0 string !! Bennet Yee's "face" format
|
||||
|
||||
# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
|
||||
# stuff.
|
||||
#
|
||||
0 beshort 0x1010 PEX Binary Archive
|
||||
|
||||
9
usr.bin/file/Magdir/island
Normal file
9
usr.bin/file/Magdir/island
Normal file
@ -0,0 +1,9 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
|
||||
# "/etc/magic":
|
||||
# From: guy@netapp.com (Guy Harris)
|
||||
#
|
||||
4 string pgscriptver IslandWrite document
|
||||
13 string DrawFile IslandDraw document
|
||||
|
||||
5
usr.bin/file/Magdir/java
Normal file
5
usr.bin/file/Magdir/java
Normal file
@ -0,0 +1,5 @@
|
||||
#------------------------------------------------------------
|
||||
# Java ByteCode
|
||||
# From Larry Schwimmer (schwim@cs.stanford.edu)
|
||||
0 belong 0xcafebabe
|
||||
>4 belong 0x0003002d Java bytecode
|
||||
@ -24,7 +24,7 @@
|
||||
0 string \007\001\000 Linux/i386 object file
|
||||
>20 lelong >0x1020 \b, DLL library
|
||||
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
|
||||
0 string *nazgul* compiled message catalog
|
||||
0 string *nazgul* Linux compiled message catalog
|
||||
>8 lelong >0 \b, version %ld
|
||||
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
|
||||
216 lelong 0421 Linux/i386 core file
|
||||
@ -49,7 +49,25 @@
|
||||
>3 byte >0 8x%d
|
||||
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
|
||||
4086 string SWAP-SPACE Linux/i386 swap file
|
||||
# From: Erik Troan <ewt@redhat.com>
|
||||
0 leshort 0x00070183 ECOFF (Linux/OSF) Alpha binary
|
||||
>10 leshort 0x0001 not stripped
|
||||
>10 leshort 0x0000 stripped
|
||||
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
|
||||
#
|
||||
# from Erik Troan (ewt@redhat.com) examining od dumps, so this
|
||||
# could be wrong
|
||||
# updated by David Mosberger (davidm@azstarnet.com) based on
|
||||
# GNU BFD and MIPS info found below.
|
||||
#
|
||||
0 leshort 0x0183 ECOFF alpha
|
||||
>24 leshort 0407 executable
|
||||
>24 leshort 0410 pure
|
||||
>24 leshort 0413 demand paged
|
||||
>8 long >0 not stripped
|
||||
>8 long 0 stripped
|
||||
>23 leshort >0 - version %ld.
|
||||
# linux Kernel images version 1.3.80 - ?
|
||||
# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
|
||||
0 belong 0xb8c0078e Linux/x86 kernel image,
|
||||
>0x048c byte 0x31
|
||||
>>0x048c string x version %s
|
||||
>0x0493 byte 0x31
|
||||
>>0x0493 string x version %s
|
||||
#
|
||||
|
||||
38
usr.bin/file/Magdir/mach
Normal file
38
usr.bin/file/Magdir/mach
Normal file
@ -0,0 +1,38 @@
|
||||
#------------------------------------------------------------------------------
|
||||
# mach file description
|
||||
#
|
||||
0 belong 0xcafebabe mach-o fat file
|
||||
>4 belong 1 with 1 architecture
|
||||
>4 belong >1
|
||||
>>4 belong x with %ld architectures
|
||||
#
|
||||
0 belong 0xfeedface mach-o
|
||||
>12 belong 1 object
|
||||
>12 belong 2 executable
|
||||
>12 belong 3 shared library
|
||||
>12 belong 4 core
|
||||
>12 belong 5 preload executable
|
||||
>12 belong >5
|
||||
>>12 belong x filetype=%ld
|
||||
>4 belong <0
|
||||
>>4 belong x architecture=%ld
|
||||
>4 belong 1 vax
|
||||
>4 belong 2 romp
|
||||
>4 belong 3 architecture=3
|
||||
>4 belong 4 ns32032
|
||||
>4 belong 5 ns32332
|
||||
>4 belong 6 for m68k architecture
|
||||
>4 belong 7 i386
|
||||
>4 belong 8 mips
|
||||
>4 belong 9 ns32532
|
||||
>4 belong 10 architecture=10
|
||||
>4 belong 11 hp pa-risc
|
||||
>4 belong 12 acorn
|
||||
>4 belong 13 m88k
|
||||
>4 belong 14 sparc
|
||||
>4 belong 15 i860-big
|
||||
>4 belong 16 i860
|
||||
>4 belong 17 rs6000
|
||||
>4 belong 18 powerPC
|
||||
>4 belong >18
|
||||
>>4 belong x architecture=%ld
|
||||
@ -16,3 +16,6 @@
|
||||
0 string From: news or mail text
|
||||
0 string Article saved news text
|
||||
0 string BABYL Emacs RMAIL text
|
||||
0 string Received: RFC 822 mail text
|
||||
0 string MIME-Version: MIME entity text
|
||||
0 string Content- MIME entity text
|
||||
|
||||
@ -27,3 +27,6 @@
|
||||
# Motorola/88Open BCS
|
||||
#
|
||||
0 beshort 0555 88K BCS executable
|
||||
#
|
||||
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
|
||||
0 string S0 Motorola S-Record; binary data in text format
|
||||
|
||||
@ -4,12 +4,6 @@
|
||||
#
|
||||
# All new-style magic numbers are in network byte order.
|
||||
#
|
||||
0 lelong 000000413 386BSD demand paged executable
|
||||
>16 lelong >0 not stripped
|
||||
0 lelong 000000314 BSDI demand paged executable
|
||||
>16 lelong >0 not stripped
|
||||
>32 byte 0x6a (uses shared libs)
|
||||
|
||||
|
||||
0 lelong 000000407 NetBSD little-endian object file
|
||||
>16 lelong >0 not stripped
|
||||
@ -163,6 +157,15 @@
|
||||
0 belong&0377777777 043000507 NetBSD/vax core
|
||||
>12 string >\0 from '%s'
|
||||
|
||||
# NetBSD/alpha does not support (and has never supported) a.out objects,
|
||||
# so no rules are provided for them. NetBSD/alpha ELF objects are
|
||||
# dealt with in "elf".
|
||||
0 leshort 0x00070185 ECOFF NetBSD/alpha binary
|
||||
>10 leshort 0x0001 not stripped
|
||||
>10 leshort 0x0000 stripped
|
||||
0 belong&0377777777 043200507 NetBSD/alpha core
|
||||
>12 string >\0 from '%s'
|
||||
|
||||
0 belong&0377777777 043400413 NetBSD/mips demand paged
|
||||
>0 byte &0x80
|
||||
>>20 belong <8192 shared library
|
||||
@ -183,3 +186,24 @@
|
||||
>16 belong >0 not stripped
|
||||
0 belong&0377777777 043400507 NetBSD/mips core
|
||||
>12 string >\0 from '%s'
|
||||
|
||||
0 belong&0377777777 043600413 NetBSD/arm32 demand paged
|
||||
>0 byte &0x80
|
||||
>>20 lelong <8192 shared library
|
||||
>>20 lelong =8192 dynamically linked executable
|
||||
>>20 lelong >8192 dynamically linked executable
|
||||
>0 byte ^0x80 executable
|
||||
>16 lelong >0 not stripped
|
||||
0 belong&0377777777 043600410 NetBSD/arm32 pure
|
||||
>0 byte &0x80 dynamically linked executable
|
||||
>0 byte ^0x80 executable
|
||||
>16 lelong >0 not stripped
|
||||
0 belong&0377777777 043600407 NetBSD/arm32
|
||||
>0 byte &0x80 dynamically linked executable
|
||||
>0 byte ^0x80
|
||||
>>0 byte &0x40 position independent
|
||||
>>20 lelong !0 executable
|
||||
>>20 lelong =0 object file
|
||||
>16 lelong >0 not stripped
|
||||
0 belong&0377777777 043600507 NetBSD/arm32 core
|
||||
>12 string >\0 from '%s'
|
||||
|
||||
10
usr.bin/file/Magdir/osf1
Normal file
10
usr.bin/file/Magdir/osf1
Normal file
@ -0,0 +1,10 @@
|
||||
#
|
||||
# Mach magic number info
|
||||
#
|
||||
0 long 0xefbe OSF/Rose object
|
||||
# I386 magic number info
|
||||
#
|
||||
0 short 0565 i386 COFF object
|
||||
#
|
||||
0 string Core Alpha Digital UNIX core file
|
||||
>24 string >\0 \b, generated from '%s'
|
||||
@ -1,7 +1,7 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# pdf: file(1) magic for Portable Document Format
|
||||
#
|
||||
|
||||
0 string %PDF- PDF document
|
||||
>5 string x \b, version %.3s
|
||||
>5 byte x \b, version %c
|
||||
>7 byte x \b.%c
|
||||
|
||||
@ -5,6 +5,7 @@
|
||||
0 beshort 0x9900 PGP key public ring
|
||||
0 beshort 0x9501 PGP key security ring
|
||||
0 beshort 0x9500 PGP key security ring
|
||||
0 beshort 0xa600 PGP encrypted data
|
||||
0 string -----BEGIN\040PGP PGP armored data
|
||||
>15 string PUBLIC\040KEY\040BLOCK- public key block
|
||||
>15 string MESSAGE- message
|
||||
|
||||
@ -21,7 +21,7 @@
|
||||
# HP Printer Job Language
|
||||
0 string \033%-12345X@PJL HP Printer Job Language data
|
||||
>15 string \ ENTER\ LANGUAGE\ =
|
||||
>31 string PostScript Postscript
|
||||
>31 string PostScript PostScript
|
||||
|
||||
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
|
||||
0 string \033E\033 HP PCL printer data
|
||||
|
||||
@ -9,6 +9,9 @@
|
||||
>>6 beshort 1 src
|
||||
>>8 beshort 1 i386
|
||||
>>8 beshort 2 Alpha
|
||||
>>8 beshort 3 PowerPC
|
||||
>>8 beshort 4 Sparc
|
||||
>>8 beshort 3 Sparc
|
||||
>>8 beshort 4 MIPS
|
||||
>>8 beshort 5 PowerPC
|
||||
>>8 beshort 6 68000
|
||||
>>8 beshort 7 SGI
|
||||
>>10 string x %s
|
||||
|
||||
@ -1,12 +1,16 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
|
||||
#
|
||||
# Dec Ultrix (MIPS)
|
||||
# all of SGI's *current* machines and OSes run in big-endian mode on the
|
||||
# MIPS machines, as far as I know.
|
||||
#
|
||||
# XXX - what is the blank "-" line?
|
||||
#
|
||||
# kbd file definitions
|
||||
0 string kbd!map kbd map file
|
||||
>8 byte >0 Ver %d:
|
||||
>10 short >0 with %d table(s)
|
||||
0 belong 0407 old SGI 68020 executable
|
||||
0 belong 0410 old SGI 68020 pure executable
|
||||
0 beshort 0x8765 disk quotas file
|
||||
@ -47,8 +51,8 @@
|
||||
>20 beshort 05401 (paged)
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>22 byte x - version %d
|
||||
>23 byte x .%ld
|
||||
>23 byte x - version %d
|
||||
>22 byte x .%ld
|
||||
#
|
||||
0 beshort 0x6201 MIPSEL-LE COFF executable
|
||||
>20 beshort 03401 (impure)
|
||||
@ -56,8 +60,8 @@
|
||||
>20 beshort 05401 (paged)
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>22 byte x - version %ld
|
||||
>23 byte x .%ld
|
||||
>23 byte x - version %ld
|
||||
>22 byte x .%ld
|
||||
#
|
||||
# MIPS 2 additions
|
||||
#
|
||||
@ -86,7 +90,7 @@
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>23 byte x - version %ld
|
||||
>23 byte x .%ld
|
||||
>22 byte x .%ld
|
||||
#
|
||||
0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable
|
||||
>20 beshort 03401 (impure)
|
||||
@ -95,7 +99,7 @@
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>23 byte x - version %ld
|
||||
>23 byte x .%ld
|
||||
>22 byte x .%ld
|
||||
#
|
||||
# MIPS 3 additions
|
||||
#
|
||||
@ -124,7 +128,7 @@
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>23 byte x - version %ld
|
||||
>23 byte x .%ld
|
||||
>22 byte x .%ld
|
||||
#
|
||||
0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable
|
||||
>20 beshort 03401 (impure)
|
||||
@ -133,7 +137,7 @@
|
||||
>8 belong >0 not stripped
|
||||
>8 belong 0 stripped
|
||||
>23 byte x - version %ld
|
||||
>23 byte x .%ld
|
||||
>22 byte x .%ld
|
||||
#
|
||||
0 beshort 0x180 MIPSEB Ucode
|
||||
0 beshort 0x182 MIPSEL Ucode
|
||||
@ -157,7 +161,8 @@
|
||||
0 string WNGZWZSS Wingz spreadsheet
|
||||
0 string WNGZWZHP Wingz help file
|
||||
#
|
||||
0 string \#Inventor V IRIS Inventor file
|
||||
0 string \#Inventor V IRIS Inventor 1.0 file
|
||||
0 string \#Inventor V2 Open Inventor 2.0 file
|
||||
# XXX - I don't know what next thing is! It is likely to be an image
|
||||
# (or movie) format
|
||||
0 string glfHeadMagic(); GLF_TEXT
|
||||
|
||||
63
usr.bin/file/Magdir/sniffer
Normal file
63
usr.bin/file/Magdir/sniffer
Normal file
@ -0,0 +1,63 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# sniffer: file(1) magic for packet captured files
|
||||
#
|
||||
# From: guy@netapp.com (Guy Harris)
|
||||
#
|
||||
# Microsoft NetMon (packet capture/display program) capture files.
|
||||
#
|
||||
0 string RTSS NetMon capture file
|
||||
>4 byte x - version %d
|
||||
>5 byte x \b.%d
|
||||
#
|
||||
# Network General Sniffer capture files (the Sniffer software does,
|
||||
# after all, run under MS-DOS...).
|
||||
#
|
||||
0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
|
||||
>23 leshort x - version %d
|
||||
>25 leshort x \b.%d
|
||||
>33 byte x (Format %d,
|
||||
>32 byte 0 Token ring)
|
||||
>32 byte 1 Ethernet)
|
||||
>32 byte 2 ARCnet)
|
||||
>32 byte 3 StarLAN)
|
||||
>32 byte 4 PC Network broadband)
|
||||
>32 byte 5 LocalTalk)
|
||||
>32 byte 6 Znet)
|
||||
#
|
||||
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
|
||||
# the main program that uses that format, but there's also "tcpview",
|
||||
# and there may be others in the future.)
|
||||
#
|
||||
0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
|
||||
>4 beshort x - version %d
|
||||
>6 beshort x \b.%d
|
||||
>20 belong 0 (No link-layer encapsulation
|
||||
>20 belong 1 (Ethernet
|
||||
>20 belong 2 (3Mb Ethernet
|
||||
>20 belong 3 (AX.25
|
||||
>20 belong 4 (ProNet
|
||||
>20 belong 5 (Chaos
|
||||
>20 belong 6 (IEEE 802.x network
|
||||
>20 belong 7 (ARCnet
|
||||
>20 belong 8 (SLIP
|
||||
>20 belong 9 (PPP
|
||||
>20 belong 10 (FDDI
|
||||
>20 belong 11 (RFC 1483 ATM
|
||||
>16 belong x \b, capture length %d)
|
||||
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
|
||||
>4 leshort x - version %d
|
||||
>6 leshort x \b.%d
|
||||
>20 lelong 0 (No link-layer encapsulation
|
||||
>20 lelong 1 (Ethernet
|
||||
>20 lelong 2 (3Mb Ethernet
|
||||
>20 lelong 3 (AX.25
|
||||
>20 lelong 4 (ProNet
|
||||
>20 lelong 5 (Chaos
|
||||
>20 lelong 6 (IEEE 802.x network
|
||||
>20 lelong 7 (ARCnet
|
||||
>20 lelong 8 (SLIP
|
||||
>20 lelong 9 (PPP
|
||||
>20 lelong 10 (FDDI
|
||||
>20 lelong 11 (RFC 1483 ATM
|
||||
>16 lelong x \b, capture length %d)
|
||||
@ -84,3 +84,27 @@
|
||||
>>128 string >\0 from '%s'
|
||||
>4 belong 456 (SPARC 4.x BCP)
|
||||
>>152 string >\0 from '%s'
|
||||
# Sun SunPC
|
||||
0 long 0xfa33c08e SunPC 4.0 Hard Disk
|
||||
0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
|
||||
# Sun snoop
|
||||
#
|
||||
# XXX - are numbers stored in big-endian format, or in host byte order?
|
||||
# They're the same on SPARC, but not the same on x86.
|
||||
#
|
||||
0 string snoop Snoop capture file
|
||||
>8 long >0 - version %ld
|
||||
>12 long 0 (IEEE 802.3)
|
||||
>12 long 1 (IEEE 802.4)
|
||||
>12 long 2 (IEEE 802.5)
|
||||
>12 long 3 (IEEE 802.6)
|
||||
>12 long 4 (Ethernet)
|
||||
>12 long 5 (HDLC)
|
||||
>12 long 6 (Character synchronous)
|
||||
>12 long 7 (IBM channel-to-channel adapter)
|
||||
>12 long 8 (FDDI)
|
||||
>12 long 9 (Unknown)
|
||||
# Sun KCMS
|
||||
36 string acsp Kodak Color Management System, ICC Profile
|
||||
|
||||
|
||||
|
||||
@ -13,3 +13,6 @@
|
||||
0 beshort 0160007 amd 29k coff archive
|
||||
# Cray
|
||||
6 beshort 0407 unicos (cray) executable
|
||||
# Ultrix 4.3
|
||||
596 string \130\337\377\377 Ultrix core file
|
||||
>600 string >\0 '%s'
|
||||
|
||||
72
usr.bin/file/Magdir/xenix
Normal file
72
usr.bin/file/Magdir/xenix
Normal file
@ -0,0 +1,72 @@
|
||||
|
||||
#------------------------------------------------------------------------------
|
||||
# xenix: file(1) magic for Microsoft Xenix
|
||||
#
|
||||
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
|
||||
# model" lifted from "magic.xenix", with comment "derived empirically;
|
||||
# treat as folklore until proven"
|
||||
#
|
||||
# "small model", "large model", "huge model" stuff lifted from XXX
|
||||
#
|
||||
# XXX - "x.out" collides with PDP-11 archives
|
||||
#
|
||||
0 string core core file (Xenix)
|
||||
0 byte 0x80 8086 relocatable (Microsoft)
|
||||
0 leshort 0xff65 x.out
|
||||
>2 string __.SYMDEF randomized
|
||||
>0 byte x archive
|
||||
0 leshort 0x206 Microsoft a.out
|
||||
>8 leshort 1 Middle model
|
||||
>0x1e leshort &0x10 overlay
|
||||
>0x1e leshort &0x2 separate
|
||||
>0x1e leshort &0x4 pure
|
||||
>0x1e leshort &0x800 segmented
|
||||
>0x1e leshort &0x400 standalone
|
||||
>0x1e leshort &0x8 fixed-stack
|
||||
>0x1c byte &0x80 byte-swapped
|
||||
>0x1c byte &0x40 word-swapped
|
||||
>0x10 lelong >0 not-stripped
|
||||
>0x1e leshort ^0xc000 pre-SysV
|
||||
>0x1e leshort &0x4000 V2.3
|
||||
>0x1e leshort &0x8000 V3.0
|
||||
>0x1c byte &0x4 86
|
||||
>0x1c byte &0xb 186
|
||||
>0x1c byte &0x9 286
|
||||
>0x1c byte &0xa 386
|
||||
>0x1f byte <0x040 small model
|
||||
>0x1f byte =0x048 large model
|
||||
>0x1f byte =0x049 huge model
|
||||
>0x1e leshort &0x1 executable
|
||||
>0x1e leshort ^0x1 object file
|
||||
>0x1e leshort &0x40 Large Text
|
||||
>0x1e leshort &0x20 Large Data
|
||||
>0x1e leshort &0x120 Huge Objects Enabled
|
||||
>0x10 lelong >0 not stripped
|
||||
|
||||
0 leshort 0x140 old Microsoft 8086 x.out
|
||||
>0x3 byte &0x4 separate
|
||||
>0x3 byte &0x2 pure
|
||||
>0 byte &0x1 executable
|
||||
>0 byte ^0x1 relocatable
|
||||
>0x14 lelong >0 not stripped
|
||||
|
||||
0 lelong 0x206 b.out
|
||||
>0x1e leshort &0x10 overlay
|
||||
>0x1e leshort &0x2 separate
|
||||
>0x1e leshort &0x4 pure
|
||||
>0x1e leshort &0x800 segmented
|
||||
>0x1e leshort &0x400 standalone
|
||||
>0x1e leshort &0x1 executable
|
||||
>0x1e leshort ^0x1 object file
|
||||
>0x1e leshort &0x4000 V2.3
|
||||
>0x1e leshort &0x8000 V3.0
|
||||
>0x1c byte &0x4 86
|
||||
>0x1c byte &0xb 186
|
||||
>0x1c byte &0x9 286
|
||||
>0x1c byte &0x29 286
|
||||
>0x1c byte &0xa 386
|
||||
>0x1e leshort &0x4 Large Text
|
||||
>0x1e leshort &0x2 Large Data
|
||||
>0x1e leshort &0x102 Huge Objects Enabled
|
||||
|
||||
0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
|
||||
@ -1,6 +1,6 @@
|
||||
# Makefile for file(1) cmd.
|
||||
# Copyright (c) Ian F. Darwin 86/09/01 - see LEGAL.NOTICE.
|
||||
# @(#)$Id: Makefile,v 1.49 1995/10/27 23:12:33 christos Exp $
|
||||
# @(#)$Id: Makefile,v 1.55 1997/01/15 17:23:24 christos Exp $
|
||||
#
|
||||
# This software is not subject to any license of the American Telephone
|
||||
# and Telegraph Company or of the Regents of the University of California.
|
||||
@ -21,11 +21,11 @@
|
||||
# ever read sources, credits must appear in the documentation.
|
||||
#
|
||||
# 4. This notice may not be removed or altered.
|
||||
VERSION = 3.19
|
||||
VERSION = 3.22
|
||||
SHELL = /bin/sh
|
||||
#MAGIC = /etc/magic
|
||||
MAGIC = /usr/local/etc/magic
|
||||
DEFS = -DMAGIC='"$(MAGIC)"' # -Dvoid=int
|
||||
DEFS = -DMAGIC='"$(MAGIC)"' -DBUILTIN_ELF # -Dvoid=int
|
||||
CC = cc
|
||||
COPTS = -O -g # newer compilers allow both; else drop -O
|
||||
# For truly antique environments, use this for (dummy) include files:
|
||||
@ -70,10 +70,10 @@ LOCALOBJS = # localsrc/getopt.o localsrc/strtol.o \
|
||||
LOCALINC = # localinc/*.h localinc/sys/*.h
|
||||
|
||||
SRCS = file.c apprentice.c fsmagic.c softmagic.c ascmagic.c \
|
||||
compress.c is_tar.c \
|
||||
compress.c is_tar.c readelf.c internat.c \
|
||||
print.c $(LOCALSRCS) $(LOCALINC)
|
||||
OBJS = file.o apprentice.o fsmagic.o softmagic.o ascmagic.o \
|
||||
compress.o is_tar.o \
|
||||
compress.o is_tar.o readelf.o internat.o \
|
||||
print.o $(LOCALOBJS)
|
||||
|
||||
ALLSRC = LEGAL.NOTICE README MAINT PORTING $(SRCS) *.h \
|
||||
@ -121,12 +121,14 @@ magic.${MANFEXT} : Makefile magic.man
|
||||
@rm -f $@
|
||||
sed -e s@__CSECTION__@${MANCEXT}@g \
|
||||
-e s@__FSECTION__@${MANFEXT}@g \
|
||||
-e s@__VERSION__@${VERSION}@g \
|
||||
-e s@__MAGIC__@${MAGIC}@g magic.man > $@
|
||||
|
||||
file.${MANCEXT} : Makefile file.man
|
||||
@rm -f $@
|
||||
sed -e s@__CSECTION__@${MANCEXT}@g \
|
||||
-e s@__FSECTION__@${MANFEXT}@g \
|
||||
-e s@__VERSION__@${VERSION}@g \
|
||||
-e s@__MAGIC__@${MAGIC}@g file.man > $@
|
||||
|
||||
send: dist
|
||||
|
||||
@ -1,11 +1,9 @@
|
||||
** README for file(1) Command **
|
||||
@(#) $Id: README,v 1.20 1993/09/23 21:47:01 christos Exp $
|
||||
@(#) $Id: README,v 1.21 1997/01/15 17:23:24 christos Exp $
|
||||
|
||||
This is Release 3.x of Ian Darwin's (copyright but distributable)
|
||||
file(1) command. Release 3.x is scheduled for inclusion in the
|
||||
4.4 BSD (Berkeley Software Distribution) of UNIX-like
|
||||
software, and is the standard "file" command for Linux, 386bsd,
|
||||
and other systems. (See "patchlevel.h" for the exact release number).
|
||||
file(1) command. This version is the standard "file" command for Linux,
|
||||
*BSD, and other systems. (See "patchlevel.h" for the exact release number).
|
||||
|
||||
UNIX is a trademark of UNIX System Laboratories.
|
||||
|
||||
@ -58,15 +56,29 @@ magic.4 - man page for the magic file, courtesy Guy Harris.
|
||||
file.c - main program
|
||||
file.h - header file
|
||||
fsmagic.c - first set of tests the program runs, based on filesystem info
|
||||
is_tar.c - knows about tarchives (courtesy John Gilmore).
|
||||
is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore).
|
||||
magdir - directory of /etc/magic pieces
|
||||
magdir/Makefile - ADJUST THIS FOR YOUR CONFIGURATION
|
||||
names.h - header file for ascmagic.c
|
||||
softmagic.c - 2nd set of tests, based on /etc/magic
|
||||
strtok.c, getopt.c - in case you them (courtesy of Henry Spencer).
|
||||
strtol.c, strchr.c - in case you need them - public domain.
|
||||
tst - simple test suite, built from tst/Makefile
|
||||
readelf.[ch] - Standalone elf parsing code.
|
||||
compress.c - on-the-fly decompression.
|
||||
internat.c - recognize international `text' files.
|
||||
print.c - print results, errors, warnings.
|
||||
|
||||
If your gzip sometimes fails to decompress things complaining about a short
|
||||
file, apply this patch [which is going to be in the next version of gzip]:
|
||||
*** - Tue Oct 29 02:06:35 1996
|
||||
--- util.c Sun Jul 21 21:51:38 1996
|
||||
*** 106,111 ****
|
||||
--- 108,114 ----
|
||||
|
||||
if (insize == 0) {
|
||||
if (eof_ok) return EOF;
|
||||
+ flush_window();
|
||||
read_error();
|
||||
}
|
||||
bytes_in += (ulg)insize;
|
||||
|
||||
E-mail: christos@deshaw.com, moraes@deshaw.com
|
||||
|
||||
|
||||
@ -34,7 +34,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: apprentice.c,v 1.23 1995/10/27 23:12:01 christos Exp $";
|
||||
"@(#)$Id: apprentice.c,v 1.25 1997/01/15 17:23:24 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
#define EATAB {while (isascii((unsigned char) *l) && \
|
||||
@ -133,10 +133,10 @@ int check; /* non-zero? checking-only run. */
|
||||
/*
|
||||
* extend the sign bit if the comparison is to be signed
|
||||
*/
|
||||
unsigned long
|
||||
uint32
|
||||
signextend(m, v)
|
||||
struct magic *m;
|
||||
unsigned long v;
|
||||
uint32 v;
|
||||
{
|
||||
if (!(m->flag & UNSIGNED))
|
||||
switch(m->type) {
|
||||
@ -159,7 +159,7 @@ unsigned long v;
|
||||
case LONG:
|
||||
case BELONG:
|
||||
case LELONG:
|
||||
v = (long) v;
|
||||
v = (int32) v;
|
||||
break;
|
||||
case STRING:
|
||||
break;
|
||||
@ -210,6 +210,10 @@ int *ndx, check;
|
||||
++l; /* step over */
|
||||
m->flag |= INDIR;
|
||||
}
|
||||
if (m->cont_level != 0 && *l == '&') {
|
||||
++l; /* step over */
|
||||
m->flag |= ADD;
|
||||
}
|
||||
|
||||
/* get offset, then skip over it */
|
||||
m->offset = (int) strtoul(l,&t,0);
|
||||
@ -491,21 +495,16 @@ int plen, *slen;
|
||||
*p++ = (char)val;
|
||||
break;
|
||||
|
||||
/* \x and up to 3 hex digits */
|
||||
/* \x and up to 2 hex digits */
|
||||
case 'x':
|
||||
val = 'x'; /* Default if no digits */
|
||||
c = hextoint(*s++); /* Get next char */
|
||||
if (c >= 0) {
|
||||
val = c;
|
||||
c = hextoint(*s++);
|
||||
if (c >= 0) {
|
||||
if (c >= 0)
|
||||
val = (val << 4) + c;
|
||||
c = hextoint(*s++);
|
||||
if (c >= 0) {
|
||||
val = (val << 4) + c;
|
||||
} else
|
||||
--s;
|
||||
} else
|
||||
else
|
||||
--s;
|
||||
} else
|
||||
--s;
|
||||
|
||||
@ -36,7 +36,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: ascmagic.c,v 1.20 1995/05/20 22:09:21 christos Exp $";
|
||||
"@(#)$Id: ascmagic.c,v 1.21 1997/01/15 17:23:24 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
/* an optimisation over plain strcmp() */
|
||||
@ -88,6 +88,13 @@ int nbytes; /* size actually read */
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
/* Make sure we are dealing with ascii text before looking for tokens */
|
||||
for (i = 0; i < nbytes; i++) {
|
||||
if (!isascii(buf[i]))
|
||||
return 0; /* not all ASCII */
|
||||
}
|
||||
|
||||
/* look for tokens from names.h - this is expensive! */
|
||||
/* make a copy of the buffer here because strtok() will destroy it */
|
||||
s = (unsigned char*) memcpy(nbuf, buf, nbytes);
|
||||
@ -106,12 +113,6 @@ int nbytes; /* size actually read */
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
for (i = 0; i < nbytes; i++) {
|
||||
if (!isascii(buf[i]))
|
||||
return 0; /* not all ASCII */
|
||||
}
|
||||
|
||||
/* all else fails, but it is ASCII... */
|
||||
ckfputs("ASCII text", stdout);
|
||||
if (has_escapes) {
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
.TH FILE __CSECTION__ "Copyright but distributable"
|
||||
.\" $Id: file.man,v 1.26 1995/10/27 23:12:01 christos Exp $
|
||||
.\" $Id: file.man,v 1.28 1997/01/15 17:23:24 christos Exp $
|
||||
.SH NAME
|
||||
file
|
||||
\- determine file type
|
||||
@ -16,7 +16,10 @@ namefile ]
|
||||
magicfiles ]
|
||||
file ...
|
||||
.SH DESCRIPTION
|
||||
.I File
|
||||
This manual page documents version __VERSION__ of the
|
||||
.B file
|
||||
command.
|
||||
.B File
|
||||
tests each argument in an attempt to classify it.
|
||||
There are three sets of tests, performed in this order:
|
||||
filesystem tests, magic number tests, and language tests.
|
||||
@ -26,8 +29,11 @@ test that succeeds causes the file type to be printed.
|
||||
.PP
|
||||
The type printed will usually contain one of the words
|
||||
.B text
|
||||
(the file contains only ASCII characters and is
|
||||
probably safe to read on an ASCII terminal),
|
||||
(the file contains only
|
||||
.SM ASCII
|
||||
characters and is probably safe to read on an
|
||||
.SM ASCII
|
||||
terminal),
|
||||
.B executable
|
||||
(the file contains the result of compiling a program
|
||||
in a form understandable to some \s-1UNIX\s0 kernel or another),
|
||||
@ -46,7 +52,7 @@ Don't do as Berkeley did \- change ``shell commands text''
|
||||
to ``shell script''.
|
||||
.PP
|
||||
The filesystem tests are based on examining the return from a
|
||||
.IR stat (2)
|
||||
.BR stat (2)
|
||||
system call.
|
||||
The program checks to see if the file is empty,
|
||||
or if it's some sort of special file.
|
||||
@ -55,16 +61,16 @@ Any known file types appropriate to the system you are running on
|
||||
implement them)
|
||||
are intuited if they are defined in
|
||||
the system header file
|
||||
.BR sys/stat.h .
|
||||
.IR sys/stat.h .
|
||||
.PP
|
||||
The magic number tests are used to check for files with data in
|
||||
particular fixed formats.
|
||||
The canonical example of this is a binary executable (compiled program)
|
||||
.B a.out
|
||||
.I a.out
|
||||
file, whose format is defined in
|
||||
.B a.out.h
|
||||
.I a.out.h
|
||||
and possibly
|
||||
.B exec.h
|
||||
.I exec.h
|
||||
in the standard include directory.
|
||||
These files have a `magic number' stored in a particular place
|
||||
near the beginning of the file that tells the \s-1UNIX\s0 operating system
|
||||
@ -78,21 +84,23 @@ The information in these files is read from the magic file
|
||||
If an argument appears to be an
|
||||
.SM ASCII
|
||||
file,
|
||||
.I file
|
||||
.B file
|
||||
attempts to guess its language.
|
||||
The language tests look for particular strings (cf \fInames.h\fP)
|
||||
The language tests look for particular strings (cf
|
||||
.IR names.h )
|
||||
that can appear anywhere in the first few blocks of a file.
|
||||
For example, the keyword
|
||||
.B .br
|
||||
indicates that the file is most likely a troff input file,
|
||||
just as the keyword
|
||||
indicates that the file is most likely a
|
||||
.BR troff (1)
|
||||
input file, just as the keyword
|
||||
.B struct
|
||||
indicates a C program.
|
||||
These tests are less reliable than the previous
|
||||
two groups, so they are performed last.
|
||||
The language test routines also test for some miscellany
|
||||
(such as
|
||||
.I tar
|
||||
.BR tar (1)
|
||||
archives) and determine whether an unknown file should be
|
||||
labelled as `ascii text' or `data'.
|
||||
.SH OPTIONS
|
||||
@ -125,7 +133,7 @@ to test the standard input, use ``-'' as a filename argument.
|
||||
.TP 8
|
||||
.B \-L
|
||||
option causes symlinks to be followed, as the like-named option in
|
||||
.IR ls (1).
|
||||
.BR ls (1).
|
||||
(on systems that support symbolic links).
|
||||
.SH FILES
|
||||
.I __MAGIC__
|
||||
@ -135,10 +143,10 @@ The environment variable
|
||||
.B MAGIC
|
||||
can be used to set the default magic number files.
|
||||
.SH SEE ALSO
|
||||
.IR magic (__FSECTION__)
|
||||
.BR magic (__FSECTION__)
|
||||
\- description of magic file format.
|
||||
.br
|
||||
.IR Strings (1), " od" (1)
|
||||
.BR strings (1), " od" (1)
|
||||
\- tools for examining non-textfiles.
|
||||
.SH STANDARDS CONFORMANCE
|
||||
This program is believed to exceed the System V Interface Definition
|
||||
@ -171,7 +179,7 @@ in an existing magic file would have to be changed to
|
||||
.br
|
||||
.PP
|
||||
SunOS releases 3.2 and later from Sun Microsystems include a
|
||||
.IR file (1)
|
||||
.BR file (1)
|
||||
command derived from the System V one, but with some extensions.
|
||||
My version differs from Sun's only in minor ways.
|
||||
It includes the extension of the `&' operator, used as,
|
||||
@ -190,15 +198,15 @@ The order of entries in the magic file is significant.
|
||||
Depending on what system you are using, the order that
|
||||
they are put together may be incorrect.
|
||||
If your old
|
||||
.I file
|
||||
.B file
|
||||
command uses a magic file,
|
||||
keep the old magic file around for comparison purposes
|
||||
(rename it to
|
||||
.IR __MAGIC__.orig ).
|
||||
.SH HISTORY
|
||||
There has been a
|
||||
.I file
|
||||
command in every UNIX since at least Research Version 6
|
||||
.B file
|
||||
command in every \s-1UNIX\s0 since at least Research Version 6
|
||||
(man page dated January, 1975).
|
||||
The System V version introduced one significant major change:
|
||||
the external list of magic number types.
|
||||
@ -227,7 +235,7 @@ put the ``old-style'' `&'
|
||||
operator back the way it was, because 1) Rob McMahon's change broke the
|
||||
previous style of usage, 2) the SunOS ``new-style'' `&' operator,
|
||||
which this version of
|
||||
.I file
|
||||
.B file
|
||||
supports, also handles `x&y op z', and 3) Rob's change wasn't documented
|
||||
in any case;
|
||||
.PP
|
||||
@ -236,11 +244,11 @@ put in multiple levels of `>';
|
||||
put in ``beshort'', ``leshort'', etc. keywords to look at numbers in the
|
||||
file in a specific byte order, rather than in the native byte order of
|
||||
the process running
|
||||
.IR file .
|
||||
.BR file .
|
||||
.RE
|
||||
.PP
|
||||
Changes by Ian Darwin and various authors including
|
||||
Christos Zoulas (christos@ee.cornell.edu), 1990-1992.
|
||||
Christos Zoulas (christos@deshaw.com), 1990-1992.
|
||||
.SH LEGAL NOTICE
|
||||
Copyright (c) Ian F. Darwin, Toronto, Canada,
|
||||
1986, 1987, 1988, 1989, 1990, 1991, 1992, 1993.
|
||||
@ -284,33 +292,42 @@ The files
|
||||
and
|
||||
.I is_tar.c
|
||||
were written by John Gilmore from his public-domain
|
||||
.I tar
|
||||
.B tar
|
||||
program, and are not covered by the above restrictions.
|
||||
.SH BUGS
|
||||
There must be a better way to automate the construction of the Magic
|
||||
file from all the glop in Magdir. What is it?
|
||||
Better yet, the magic file should be compiled into binary (say,
|
||||
.IR ndbm (3)
|
||||
or, better yet, fixed-length ASCII strings
|
||||
for use in heterogenous network environments) for faster startup.
|
||||
.BR ndbm (3)
|
||||
or, better yet, fixed-length
|
||||
.SM ASCII
|
||||
strings for use in heterogenous network environments) for faster startup.
|
||||
Then the program would run as fast as the Version 7 program of the same name,
|
||||
with the flexibility of the System V version.
|
||||
.PP
|
||||
.I File
|
||||
.B File
|
||||
uses several algorithms that favor speed over accuracy,
|
||||
thus it can be misled about the contents of ASCII files.
|
||||
thus it can be misled about the contents of
|
||||
.SM ASCII
|
||||
files.
|
||||
.PP
|
||||
The support for ASCII files (primarily for programming languages)
|
||||
The support for
|
||||
.SM ASCII
|
||||
files (primarily for programming languages)
|
||||
is simplistic, inefficient and requires recompilation to update.
|
||||
.PP
|
||||
There should be an ``else'' clause to follow a series of continuation lines.
|
||||
.PP
|
||||
The magic file and keywords should have regular expression support.
|
||||
Their use of ASCII TAB as a field delimiter is ugly and makes
|
||||
Their use of
|
||||
.SM "ASCII TAB"
|
||||
as a field delimiter is ugly and makes
|
||||
it hard to edit the files, but is entrenched.
|
||||
.PP
|
||||
It might be advisable to allow upper-case letters in keywords
|
||||
for e.g., troff commands vs man page macros.
|
||||
for e.g.,
|
||||
.BR troff (1)
|
||||
commands vs man page macros.
|
||||
Regular expression support would make this easy.
|
||||
.PP
|
||||
The program doesn't grok \s-2FORTRAN\s0.
|
||||
@ -343,6 +360,6 @@ This manual page, and particularly this section, is too long.
|
||||
.SH AVAILABILITY
|
||||
You can obtain the original author's latest version by anonymous FTP
|
||||
on
|
||||
.B tesla.ee.cornell.edu
|
||||
.B ftp.deshaw.com
|
||||
in the directory
|
||||
.BR /pub/file-X.YY.tar.gz
|
||||
.I /pub/file/file-X.YY.tar.gz
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
*/
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: file.c,v 1.34 1995/10/27 23:12:01 christos Exp $";
|
||||
"@(#)$Id: file.c,v 1.38 1997/01/15 19:28:35 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
#include <stdio.h>
|
||||
@ -37,15 +37,17 @@ static char *moduleid =
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h> /* for open() */
|
||||
#if (__COHERENT__ >= 0x420)
|
||||
#include <sys/utime.h>
|
||||
# include <sys/utime.h>
|
||||
#else
|
||||
#include <utime.h>
|
||||
# ifdef USE_UTIMES
|
||||
# include <sys/time.h>
|
||||
# else
|
||||
# include <utime.h>
|
||||
# endif
|
||||
#endif
|
||||
#include <unistd.h> /* for read() */
|
||||
|
||||
#ifdef __ELF__
|
||||
#include <elf.h>
|
||||
#endif
|
||||
#include <netinet/in.h> /* for byte swapping */
|
||||
|
||||
#include "patchlevel.h"
|
||||
#include "file.h"
|
||||
@ -76,7 +78,11 @@ char *progname; /* used throughout */
|
||||
int lineno; /* line number in the magic file */
|
||||
|
||||
|
||||
static void unwrap __P((char *fn));
|
||||
static void unwrap __P((char *fn));
|
||||
#if 0
|
||||
static int byteconv4 __P((int, int, int));
|
||||
static short byteconv2 __P((int, int, int));
|
||||
#endif
|
||||
|
||||
/*
|
||||
* main - parse arguments and handle options
|
||||
@ -180,18 +186,23 @@ char *fn;
|
||||
FILE *f;
|
||||
int wid = 0, cwid;
|
||||
|
||||
if ((f = fopen(fn, "r")) == NULL) {
|
||||
error("Cannot open `%s' (%s).\n", fn, strerror(errno));
|
||||
/*NOTREACHED*/
|
||||
}
|
||||
if (strcmp("-", fn) == 0) {
|
||||
f = stdin;
|
||||
wid = 1;
|
||||
} else {
|
||||
if ((f = fopen(fn, "r")) == NULL) {
|
||||
error("Cannot open `%s' (%s).\n", fn, strerror(errno));
|
||||
/*NOTREACHED*/
|
||||
}
|
||||
|
||||
while (fgets(buf, MAXPATHLEN, f) != NULL) {
|
||||
cwid = strlen(buf) - 1;
|
||||
if (cwid > wid)
|
||||
wid = cwid;
|
||||
}
|
||||
while (fgets(buf, MAXPATHLEN, f) != NULL) {
|
||||
cwid = strlen(buf) - 1;
|
||||
if (cwid > wid)
|
||||
wid = cwid;
|
||||
}
|
||||
|
||||
rewind(f);
|
||||
rewind(f);
|
||||
}
|
||||
|
||||
while (fgets(buf, MAXPATHLEN, f) != NULL) {
|
||||
buf[strlen(buf)-1] = '\0';
|
||||
@ -202,6 +213,71 @@ char *fn;
|
||||
}
|
||||
|
||||
|
||||
#if 0
|
||||
/*
|
||||
* byteconv4
|
||||
* Input:
|
||||
* from 4 byte quantity to convert
|
||||
* same whether to perform byte swapping
|
||||
* big_endian whether we are a big endian host
|
||||
*/
|
||||
static int
|
||||
byteconv4(from, same, big_endian)
|
||||
int from;
|
||||
int same;
|
||||
int big_endian;
|
||||
{
|
||||
if (same)
|
||||
return from;
|
||||
else if (big_endian) /* lsb -> msb conversion on msb */
|
||||
{
|
||||
union {
|
||||
int i;
|
||||
char c[4];
|
||||
} retval, tmpval;
|
||||
|
||||
tmpval.i = from;
|
||||
retval.c[0] = tmpval.c[3];
|
||||
retval.c[1] = tmpval.c[2];
|
||||
retval.c[2] = tmpval.c[1];
|
||||
retval.c[3] = tmpval.c[0];
|
||||
|
||||
return retval.i;
|
||||
}
|
||||
else
|
||||
return ntohl(from); /* msb -> lsb conversion on lsb */
|
||||
}
|
||||
|
||||
/*
|
||||
* byteconv2
|
||||
* Same as byteconv4, but for shorts
|
||||
*/
|
||||
static short
|
||||
byteconv2(from, same, big_endian)
|
||||
int from;
|
||||
int same;
|
||||
int big_endian;
|
||||
{
|
||||
if (same)
|
||||
return from;
|
||||
else if (big_endian) /* lsb -> msb conversion on msb */
|
||||
{
|
||||
union {
|
||||
short s;
|
||||
char c[2];
|
||||
} retval, tmpval;
|
||||
|
||||
tmpval.s = (short) from;
|
||||
retval.c[0] = tmpval.c[1];
|
||||
retval.c[1] = tmpval.c[0];
|
||||
|
||||
return retval.s;
|
||||
}
|
||||
else
|
||||
return ntohs(from); /* msb -> lsb conversion on lsb */
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* process - process input file
|
||||
*/
|
||||
@ -213,7 +289,6 @@ int wid;
|
||||
int fd = 0;
|
||||
static const char stdname[] = "standard input";
|
||||
unsigned char buf[HOWMANY+1]; /* one extra for terminating '\0' */
|
||||
struct utimbuf utbuf;
|
||||
struct stat sb;
|
||||
int nbytes = 0; /* number of bytes read from a datafile */
|
||||
char match = '\0';
|
||||
@ -265,61 +340,31 @@ int wid;
|
||||
buf[nbytes++] = '\0'; /* null-terminate it */
|
||||
match = tryit(buf, nbytes, zflag);
|
||||
}
|
||||
#ifdef __ELF__
|
||||
/*
|
||||
* ELF executables have multiple section headers in arbitrary
|
||||
* file locations and thus file(1) cannot determine it from easily.
|
||||
* Instead we traverse thru all section headers until a symbol table
|
||||
* one is found or else the binary is stripped.
|
||||
* XXX: This will not work for binaries of a different byteorder.
|
||||
* Should come up with a better fix.
|
||||
*/
|
||||
|
||||
if (match == 's' && nbytes > sizeof (Elf32_Ehdr) &&
|
||||
buf[EI_MAG0] == ELFMAG0 &&
|
||||
buf[EI_MAG1] == ELFMAG1 &&
|
||||
buf[EI_MAG2] == ELFMAG2 &&
|
||||
buf[EI_MAG3] == ELFMAG3) {
|
||||
|
||||
union {
|
||||
long l;
|
||||
char c[sizeof (long)];
|
||||
} u;
|
||||
Elf32_Ehdr elfhdr;
|
||||
int stripped = 1;
|
||||
|
||||
u.l = 1;
|
||||
(void) memcpy(&elfhdr, buf, sizeof elfhdr);
|
||||
|
||||
/*
|
||||
* If the system byteorder does not equal the object byteorder
|
||||
* then don't test.
|
||||
*/
|
||||
if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
|
||||
if (lseek(fd, elfhdr.e_shoff, SEEK_SET)<0)
|
||||
error("lseek failed (%s).\n", strerror(errno));
|
||||
|
||||
for ( ; elfhdr.e_shnum ; elfhdr.e_shnum--) {
|
||||
if (read(fd, buf, elfhdr.e_shentsize)<0)
|
||||
error("read failed (%s).\n", strerror(errno));
|
||||
if (((Elf32_Shdr *)&buf)->sh_type == SHT_SYMTAB) {
|
||||
stripped = 0;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (stripped)
|
||||
(void) printf (", stripped");
|
||||
}
|
||||
}
|
||||
#ifdef BUILTIN_ELF
|
||||
if (match == 's' && nbytes > 5)
|
||||
tryelf(fd, buf, nbytes);
|
||||
#endif
|
||||
|
||||
if (inname != stdname) {
|
||||
#ifdef RESTORE_TIME
|
||||
/*
|
||||
* Try to restore access, modification times if read it.
|
||||
*/
|
||||
# ifdef USE_UTIMES
|
||||
struct timeval utsbuf[2];
|
||||
utsbuf[0].tv_sec = sb.st_atime;
|
||||
utsbuf[1].tv_sec = sb.st_mtime;
|
||||
|
||||
(void) utimes(inname, utsbuf); /* don't care if loses */
|
||||
# else
|
||||
struct utimbuf utbuf;
|
||||
|
||||
utbuf.actime = sb.st_atime;
|
||||
utbuf.modtime = sb.st_mtime;
|
||||
(void) utime(inname, &utbuf); /* don't care if loses */
|
||||
# endif
|
||||
#endif
|
||||
(void) close(fd);
|
||||
}
|
||||
(void) putchar('\n');
|
||||
@ -343,6 +388,10 @@ int nb, zflag;
|
||||
if (ascmagic(buf, nb))
|
||||
return 'a';
|
||||
|
||||
/* see if it's international language text */
|
||||
if (internatmagic(buf, nb))
|
||||
return 'i';
|
||||
|
||||
/* abandon hope, all ye who remain here */
|
||||
ckfputs("data", stdout);
|
||||
return '\0';
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
/*
|
||||
* file.h - definitions for file(1) program
|
||||
* @(#)$Id: file.h,v 1.22 1995/05/20 22:09:21 christos Exp $
|
||||
* @(#)$Id: file.h,v 1.25 1997/01/15 19:28:35 christos Exp $
|
||||
*
|
||||
* Copyright (c) Ian F. Darwin, 1987.
|
||||
* Written by Ian F. Darwin.
|
||||
@ -26,6 +26,12 @@
|
||||
* 4. This notice may not be removed or altered.
|
||||
*/
|
||||
|
||||
#ifndef __file_h__
|
||||
#define __file_h__
|
||||
|
||||
typedef int int32;
|
||||
typedef unsigned int uint32;
|
||||
|
||||
#ifndef HOWMANY
|
||||
# define HOWMANY 8192 /* how much of the file to look at */
|
||||
#endif
|
||||
@ -37,12 +43,13 @@ struct magic {
|
||||
short flag;
|
||||
#define INDIR 1 /* if '>(...)' appears, */
|
||||
#define UNSIGNED 2 /* comparison is unsigned */
|
||||
#define ADD 4 /* if '>&' appears, */
|
||||
short cont_level; /* level of ">" */
|
||||
struct {
|
||||
char type; /* byte short long */
|
||||
long offset; /* offset from indirection */
|
||||
int32 offset; /* offset from indirection */
|
||||
} in;
|
||||
long offset; /* offset to magic number */
|
||||
int32 offset; /* offset to magic number */
|
||||
unsigned char reln; /* relation (0=eq, '>'=gt, etc) */
|
||||
char type; /* int, short, long or string. */
|
||||
char vallen; /* length of string value, if any */
|
||||
@ -60,12 +67,12 @@ struct magic {
|
||||
union VALUETYPE {
|
||||
unsigned char b;
|
||||
unsigned short h;
|
||||
unsigned long l;
|
||||
uint32 l;
|
||||
char s[MAXstring];
|
||||
unsigned char hs[2]; /* 2 bytes of a fixed-endian "short" */
|
||||
unsigned char hl[4]; /* 2 bytes of a fixed-endian "long" */
|
||||
} value; /* either number or string */
|
||||
unsigned long mask; /* mask before comparison with value */
|
||||
uint32 mask; /* mask before comparison with value */
|
||||
char nospflag; /* supress space character */
|
||||
char desc[MAXDESC]; /* description */
|
||||
};
|
||||
@ -97,8 +104,9 @@ extern int softmagic __P((unsigned char *, int));
|
||||
extern int tryit __P((unsigned char *, int, int));
|
||||
extern int zmagic __P((unsigned char *, int));
|
||||
extern void ckfprintf __P((FILE *, const char *, ...));
|
||||
extern unsigned long signextend __P((struct magic *, unsigned long));
|
||||
|
||||
extern uint32 signextend __P((struct magic *, unsigned int32));
|
||||
extern int internatmagic __P((unsigned char *, int));
|
||||
extern void tryelf __P((int, char *, int));
|
||||
|
||||
|
||||
extern int errno; /* Some unixes don't define this.. */
|
||||
@ -118,7 +126,16 @@ extern int lflag; /* follow symbolic links? */
|
||||
extern int optind; /* From getopt(3) */
|
||||
extern char *optarg;
|
||||
|
||||
#if !defined(__STDC__) || defined(sun) || defined(__sun__) || defined(__convex__)
|
||||
#if defined(sun) || defined(__sun__) || defined (__sun)
|
||||
# if defined(__svr4) || defined (__SVR4) || defined(__svr4__)
|
||||
# define SOLARIS
|
||||
# else
|
||||
# define SUNOS
|
||||
# endif
|
||||
#endif
|
||||
|
||||
|
||||
#if !defined(__STDC__) || defined(SUNOS) || defined(__convex__)
|
||||
extern int sys_nerr;
|
||||
extern char *sys_errlist[];
|
||||
#define strerror(e) \
|
||||
@ -129,3 +146,5 @@ extern char *sys_errlist[];
|
||||
#ifndef MAXPATHLEN
|
||||
#define MAXPATHLEN 512
|
||||
#endif
|
||||
|
||||
#endif /* __file_h__ */
|
||||
|
||||
@ -31,6 +31,11 @@
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#ifndef major
|
||||
# if defined(__SVR4) || defined(_SVR4_SOURCE)
|
||||
# include <sys/mkdev.h>
|
||||
# endif
|
||||
#endif
|
||||
#ifndef major /* if `major' not defined in types.h, */
|
||||
#include <sys/sysmacros.h> /* try this one. */
|
||||
#endif
|
||||
@ -46,7 +51,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: fsmagic.c,v 1.23 1995/01/21 21:03:35 christos Exp $";
|
||||
"@(#)$Id: fsmagic.c,v 1.25 1997/01/15 19:28:35 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
int
|
||||
@ -84,12 +89,12 @@ struct stat *sb;
|
||||
ckfputs("directory", stdout);
|
||||
return 1;
|
||||
case S_IFCHR:
|
||||
(void) printf("character special (%d/%d)",
|
||||
major(sb->st_rdev), minor(sb->st_rdev));
|
||||
(void) printf("character special (%ld/%ld)",
|
||||
(long) major(sb->st_rdev), (long) minor(sb->st_rdev));
|
||||
return 1;
|
||||
case S_IFBLK:
|
||||
(void) printf("block special (%d/%d)",
|
||||
major(sb->st_rdev), minor(sb->st_rdev));
|
||||
(void) printf("block special (%ld/%ld)",
|
||||
(long) major(sb->st_rdev), (long) minor(sb->st_rdev));
|
||||
return 1;
|
||||
/* TODO add code to handle V7 MUX and Blit MUX files */
|
||||
#ifdef S_IFIFO
|
||||
|
||||
72
usr.bin/file/internat.c
Normal file
72
usr.bin/file/internat.c
Normal file
@ -0,0 +1,72 @@
|
||||
#include "file.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#define F 0
|
||||
#define T 1
|
||||
|
||||
/*
|
||||
* List of characters that look "reasonable" in international
|
||||
* language texts. That's almost all characters :), except a
|
||||
* few in the control range of ASCII (all the known international
|
||||
* charactersets share the bottom half with ASCII).
|
||||
*/
|
||||
static char maybe_internat[256] = {
|
||||
F, F, F, F, F, F, F, F, T, T, T, T, T, T, F, F, /* 0x0X */
|
||||
F, F, F, F, F, F, F, F, F, F, F, T, F, F, F, F, /* 0x1X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x2X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x3X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x4X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x5X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x6X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, F, /* 0x7X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x8X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0x9X */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xaX */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xbX */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xcX */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xdX */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, /* 0xeX */
|
||||
T, T, T, T, T, T, T, T, T, T, T, T, T, T, T, T /* 0xfX */
|
||||
};
|
||||
|
||||
/* Maximal length of a line we consider "reasonable". */
|
||||
#define MAXLINELEN 300
|
||||
|
||||
int
|
||||
internatmagic(buf, nbytes)
|
||||
unsigned char *buf;
|
||||
int nbytes;
|
||||
{
|
||||
int i;
|
||||
unsigned char *cp;
|
||||
|
||||
nbytes--;
|
||||
|
||||
/* First, look whether there are "unreasonable" characters. */
|
||||
for (i = 0, cp = buf; i < nbytes; i++, cp++)
|
||||
if (!maybe_internat[*cp])
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* Now, look whether the file consists of lines of
|
||||
* "reasonable" length.
|
||||
*/
|
||||
|
||||
for (i = 0; i < nbytes;) {
|
||||
cp = memchr(buf, '\n', nbytes - i);
|
||||
if (cp == NULL) {
|
||||
/* Don't fail if we hit the end of buffer. */
|
||||
if (i + MAXLINELEN >= nbytes)
|
||||
break;
|
||||
else
|
||||
return 0;
|
||||
}
|
||||
if (cp - buf > MAXLINELEN)
|
||||
return 0;
|
||||
i += (cp - buf + 1);
|
||||
buf = cp + 1;
|
||||
}
|
||||
ckfputs("International language text", stdout);
|
||||
return 1;
|
||||
}
|
||||
@ -5,7 +5,7 @@
|
||||
* Pubic Domain version written 26 Aug 1985 John Gilmore (ihnp4!hoptoad!gnu).
|
||||
*
|
||||
* @(#)list.c 1.18 9/23/86 Public Domain - gnu
|
||||
* $Id: is_tar.c,v 1.8 1993/09/16 21:09:35 christos Exp $
|
||||
* $Id: is_tar.c,v 1.9 1997/01/15 17:23:24 christos Exp $
|
||||
*
|
||||
* Comments changed and some code/comments reformatted
|
||||
* for file command by Ian Darwin.
|
||||
@ -19,9 +19,9 @@
|
||||
#define isodigit(c) ( ((c) >= '0') && ((c) <= '7') )
|
||||
|
||||
#if defined(__STDC__) || defined(__cplusplus)
|
||||
static long from_oct(int, char*); /* Decode octal number */
|
||||
static int from_oct(int, char*); /* Decode octal number */
|
||||
#else
|
||||
static long from_oct();
|
||||
static int from_oct();
|
||||
#endif
|
||||
|
||||
/*
|
||||
@ -37,7 +37,7 @@ int nbytes;
|
||||
{
|
||||
register union record *header = (union record *)buf;
|
||||
register int i;
|
||||
register long sum, recsum;
|
||||
register int sum, recsum;
|
||||
register char *p;
|
||||
|
||||
if (nbytes < sizeof(union record))
|
||||
@ -75,12 +75,12 @@ int nbytes;
|
||||
*
|
||||
* Result is -1 if the field is invalid (all blank, or nonoctal).
|
||||
*/
|
||||
static long
|
||||
static int
|
||||
from_oct(digs, where)
|
||||
register int digs;
|
||||
register char *where;
|
||||
{
|
||||
register long value;
|
||||
register int value;
|
||||
|
||||
while (isspace(*where)) { /* Skip spaces */
|
||||
where++;
|
||||
|
||||
@ -3,14 +3,17 @@
|
||||
.SH NAME
|
||||
magic \- file command's magic number file
|
||||
.SH DESCRIPTION
|
||||
The
|
||||
.IR file (__CSECTION__)
|
||||
This manual page documents the format of the magic file as
|
||||
used by the
|
||||
.BR file (__CSECTION__)
|
||||
command, version __VERSION__. The
|
||||
.B file
|
||||
command identifies the type of a file using,
|
||||
among other tests,
|
||||
a test for whether the file begins with a certain
|
||||
.IR "magic number" .
|
||||
The file
|
||||
.B __MAGIC__
|
||||
.I __MAGIC__
|
||||
specifies what magic numbers are to be tested for,
|
||||
what message to print if a particular magic number is found,
|
||||
and additional information to extract from the file.
|
||||
@ -113,7 +116,7 @@ then presumably print that string, by doing
|
||||
.IP message
|
||||
The message to be printed if the comparison succeeds. If the string
|
||||
contains a
|
||||
.IR printf (3S)
|
||||
.BR printf (3S)
|
||||
format specification, the value from the file (with any specified masking
|
||||
performed) is printed using the message as the format string.
|
||||
.PP
|
||||
@ -156,6 +159,15 @@ type specifier. To that number the value of
|
||||
.I y
|
||||
is added and the result is used as an offset in the file. The default type
|
||||
if one is not specified is long.
|
||||
.PP
|
||||
Sometimes you do not know the exact offset as this depends on the length of
|
||||
preceding fields. You can specify an offset relative to the end of the
|
||||
last uplevel field (of course this may only be done for sublevel tests, i.e.
|
||||
test beginning with
|
||||
.B >
|
||||
). Such a relative offset is specified using
|
||||
.B &
|
||||
as a prefix to the offset.
|
||||
.SH BUGS
|
||||
The formats
|
||||
.IR long ,
|
||||
@ -176,7 +188,7 @@ a system on which the lengths are invariant.
|
||||
There is (currently) no support for specified-endian data to be used in
|
||||
indirect offsets.
|
||||
.SH SEE ALSO
|
||||
.IR file (__CSECTION__)
|
||||
.BR file (__CSECTION__)
|
||||
\- the command that reads this file.
|
||||
.\"
|
||||
.\" From: guy@sun.uucp (Guy Harris)
|
||||
@ -191,4 +203,4 @@ indirect offsets.
|
||||
.\" the changes I posted to the S5R2 version.
|
||||
.\"
|
||||
.\" Modified for Ian Darwin's version of the file command.
|
||||
.\" @(#)$Id: magic.man,v 1.12 1995/01/21 21:03:35 christos Exp $
|
||||
.\" @(#)$Id: magic.man,v 1.14 1996/06/22 22:05:07 christos Exp $
|
||||
|
||||
@ -10,22 +10,24 @@
|
||||
*
|
||||
* See LEGAL.NOTICE
|
||||
*
|
||||
* $Id: names.h,v 1.12 1995/04/28 17:29:13 christos Exp $
|
||||
* $Id: names.h,v 1.13 1997/01/15 17:23:24 christos Exp $
|
||||
*/
|
||||
|
||||
/* these types are used to index the table 'types': keep em in sync! */
|
||||
#define L_C 0 /* first and foremost on UNIX */
|
||||
#define L_FORT 1 /* the oldest one */
|
||||
#define L_MAKE 2 /* Makefiles */
|
||||
#define L_PLI 3 /* PL/1 */
|
||||
#define L_MACH 4 /* some kinda assembler */
|
||||
#define L_ENG 5 /* English */
|
||||
#define L_PAS 6 /* Pascal */
|
||||
#define L_MAIL 7 /* Electronic mail */
|
||||
#define L_NEWS 8 /* Usenet Netnews */
|
||||
#define L_CC 1 /* Bjarne's postincrement */
|
||||
#define L_FORT 2 /* the oldest one */
|
||||
#define L_MAKE 3 /* Makefiles */
|
||||
#define L_PLI 4 /* PL/1 */
|
||||
#define L_MACH 5 /* some kinda assembler */
|
||||
#define L_ENG 6 /* English */
|
||||
#define L_PAS 7 /* Pascal */
|
||||
#define L_MAIL 8 /* Electronic mail */
|
||||
#define L_NEWS 9 /* Usenet Netnews */
|
||||
|
||||
static char *types[] = {
|
||||
"C program text",
|
||||
"C++ program text",
|
||||
"FORTRAN program text",
|
||||
"make commands text" ,
|
||||
"PL/1 program text",
|
||||
@ -43,6 +45,12 @@ static struct names {
|
||||
} names[] = {
|
||||
/* These must be sorted by eye for optimal hit rate */
|
||||
/* Add to this list only after substantial meditation */
|
||||
{"//", L_CC},
|
||||
{"template", L_CC},
|
||||
{"virtual", L_CC},
|
||||
{"class", L_CC},
|
||||
{"public:", L_CC},
|
||||
{"private:", L_CC},
|
||||
{"/*", L_C}, /* must precede "The", "the", etc. */
|
||||
{"#include", L_C},
|
||||
{"char", L_C},
|
||||
|
||||
@ -1,11 +1,33 @@
|
||||
#define FILE_VERSION_MAJOR 3
|
||||
#define patchlevel 19
|
||||
#define patchlevel 22
|
||||
|
||||
/*
|
||||
* Patchlevel file for Ian Darwin's MAGIC command.
|
||||
* $Id: patchlevel.h,v 1.19 1995/10/27 23:14:46 christos Exp $
|
||||
* $Id: patchlevel.h,v 1.22 1997/01/15 17:23:24 christos Exp $
|
||||
*
|
||||
* $Log: patchlevel.h,v $
|
||||
* Revision 1.22 1997/01/15 17:23:24 christos
|
||||
* - add support for elf core files: find the program name under SVR4 [Ken Pizzini]
|
||||
* - print strings only up to the first carriage return [various]
|
||||
* - freebsd international ascii support [J Wunsch]
|
||||
* - magic fixes and additions [Guy Harris]
|
||||
* - 64 bit fixes [Larry Schwimmer]
|
||||
* - support for both utime and utimes, but don't restore file access times
|
||||
* by default [various]
|
||||
* - \xXX only takes 2 hex digits, not 3.
|
||||
* - re-implement support for core files [Guy Harris]
|
||||
*
|
||||
* Revision 1.21 1996/10/05 18:15:29 christos
|
||||
* Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF
|
||||
* More magic fixes
|
||||
*
|
||||
* Revision 1.20 1996/06/22 22:15:52 christos
|
||||
* - support relative offsets of the form >&
|
||||
* - fix bug with truncating magic strings that contain \n
|
||||
* - file -f - did not read from stdin as documented
|
||||
* - support elf file parsing using our own elf support.
|
||||
* - as always magdir fixes and additions.
|
||||
*
|
||||
* Revision 1.19 1995/10/27 23:14:46 christos
|
||||
* Ability to parse colon separated list of magic files
|
||||
* New LEGAL.NOTICE
|
||||
|
||||
@ -40,7 +40,7 @@
|
||||
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: print.c,v 1.22 1995/05/20 22:09:21 christos Exp $";
|
||||
"@(#)$Id: print.c,v 1.23 1997/01/15 19:28:35 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
#define SZOF(a) (sizeof(a) / sizeof(a[0]))
|
||||
@ -58,7 +58,7 @@ struct magic *m;
|
||||
m->offset);
|
||||
|
||||
if (m->flag & INDIR)
|
||||
(void) fprintf(stderr, "(%s,%ld),",
|
||||
(void) fprintf(stderr, "(%s,%d),",
|
||||
(m->in.type >= 0 && m->in.type < SZOF(typ)) ?
|
||||
typ[(unsigned char) m->in.type] :
|
||||
"*bad*",
|
||||
@ -69,7 +69,7 @@ struct magic *m;
|
||||
typ[(unsigned char) m->type] :
|
||||
"*bad*");
|
||||
if (m->mask != ~0L)
|
||||
(void) fprintf(stderr, " & %.8lx", m->mask);
|
||||
(void) fprintf(stderr, " & %.8x", m->mask);
|
||||
|
||||
(void) fprintf(stderr, ",%c", m->reln);
|
||||
|
||||
@ -82,7 +82,7 @@ struct magic *m;
|
||||
case LELONG:
|
||||
case BESHORT:
|
||||
case BELONG:
|
||||
(void) fprintf(stderr, "%ld", m->value.l);
|
||||
(void) fprintf(stderr, "%d", m->value.l);
|
||||
break;
|
||||
case STRING:
|
||||
showstr(stderr, m->value.s, -1);
|
||||
|
||||
314
usr.bin/file/readelf.c
Normal file
314
usr.bin/file/readelf.c
Normal file
@ -0,0 +1,314 @@
|
||||
|
||||
#ifdef BUILTIN_ELF
|
||||
#include <sys/types.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <ctype.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "readelf.h"
|
||||
#include "file.h"
|
||||
|
||||
static void
|
||||
doshn(fd, off, num, size, buf)
|
||||
int fd;
|
||||
off_t off;
|
||||
int num;
|
||||
size_t size;
|
||||
char *buf;
|
||||
{
|
||||
/*
|
||||
* This works for both 32-bit and 64-bit ELF formats,
|
||||
* because it looks only at the "sh_type" field, which is
|
||||
* always 32 bits, and is preceded only by the "sh_name"
|
||||
* field which is also always 32 bits, and because it uses
|
||||
* the shdr size from the ELF header rather than using
|
||||
* the size of an "Elf32_Shdr".
|
||||
*/
|
||||
Elf32_Shdr *sh = (Elf32_Shdr *) buf;
|
||||
|
||||
if (lseek(fd, off, SEEK_SET) == -1)
|
||||
error("lseek failed (%s).\n", strerror(errno));
|
||||
|
||||
for ( ; num; num--) {
|
||||
if (read(fd, buf, size) == -1)
|
||||
error("read failed (%s).\n", strerror(errno));
|
||||
if (sh->sh_type == SHT_SYMTAB) {
|
||||
(void) printf (", not stripped");
|
||||
return;
|
||||
}
|
||||
}
|
||||
(void) printf (", stripped");
|
||||
}
|
||||
|
||||
/*
|
||||
* Look through the program headers of an executable image, searching
|
||||
* for a PT_INTERP section; if one is found, it's dynamically linked,
|
||||
* otherwise it's statically linked.
|
||||
*/
|
||||
static void
|
||||
dophn_exec(fd, off, num, size, buf)
|
||||
int fd;
|
||||
off_t off;
|
||||
int num;
|
||||
size_t size;
|
||||
char *buf;
|
||||
{
|
||||
/* I am not sure if this works for 64 bit elf formats */
|
||||
Elf32_Phdr *ph = (Elf32_Phdr *) buf;
|
||||
|
||||
if (lseek(fd, off, SEEK_SET) == -1)
|
||||
error("lseek failed (%s).\n", strerror(errno));
|
||||
|
||||
for ( ; num; num--) {
|
||||
if (read(fd, buf, size) == -1)
|
||||
error("read failed (%s).\n", strerror(errno));
|
||||
if (ph->p_type == PT_INTERP) {
|
||||
/*
|
||||
* Has an interpreter - must be a dynamically-linked
|
||||
* executable.
|
||||
*/
|
||||
printf(", dynamically linked");
|
||||
return;
|
||||
}
|
||||
}
|
||||
printf(", statically linked");
|
||||
}
|
||||
|
||||
size_t prpsoffsets[] = {
|
||||
100, /* SunOS 5.x */
|
||||
32, /* Linux */
|
||||
};
|
||||
|
||||
#define NOFFSETS (sizeof prpsoffsets / sizeof prpsoffsets[0])
|
||||
|
||||
/*
|
||||
* Look through the program headers of an executable image, searching
|
||||
* for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE"; if one
|
||||
* is found, try looking in various places in its contents for a 16-character
|
||||
* string containing only printable characters - if found, that string
|
||||
* should be the name of the program that dropped core.
|
||||
* Note: right after that 16-character string is, at least in SunOS 5.x
|
||||
* (and possibly other SVR4-flavored systems) and Linux, a longer string
|
||||
* (80 characters, in 5.x, probably other SVR4-flavored systems, and Linux)
|
||||
* containing the start of the command line for that program.
|
||||
*/
|
||||
static void
|
||||
dophn_core(fd, off, num, size, buf)
|
||||
int fd;
|
||||
off_t off;
|
||||
int num;
|
||||
size_t size;
|
||||
char *buf;
|
||||
{
|
||||
/*
|
||||
* This doesn't work for 64-bit ELF, as the "p_offset" field is
|
||||
* 64 bits in 64-bit ELF.
|
||||
*/
|
||||
/*
|
||||
* This doesn't work for 64-bit ELF, as the "p_offset" field is
|
||||
* 64 bits in 64-bit ELF.
|
||||
*/
|
||||
Elf32_Phdr *ph = (Elf32_Phdr *) buf;
|
||||
Elf32_Nhdr *nh;
|
||||
size_t offset, noffset, reloffset;
|
||||
unsigned char c;
|
||||
int i, j;
|
||||
char nbuf[BUFSIZ];
|
||||
int bufsize;
|
||||
|
||||
for ( ; num; num--) {
|
||||
if (lseek(fd, off, SEEK_SET) == -1)
|
||||
error("lseek failed (%s).\n", strerror(errno));
|
||||
if (read(fd, buf, size) == -1)
|
||||
error("read failed (%s).\n", strerror(errno));
|
||||
off += size;
|
||||
if (ph->p_type != PT_NOTE)
|
||||
continue;
|
||||
if (lseek(fd, ph->p_offset, SEEK_SET) == -1)
|
||||
error("lseek failed (%s).\n", strerror(errno));
|
||||
bufsize = read(fd, nbuf, BUFSIZ);
|
||||
if (bufsize == -1)
|
||||
error("read failed (%s).\n", strerror(errno));
|
||||
offset = 0;
|
||||
for (;;) {
|
||||
if (offset >= bufsize)
|
||||
break;
|
||||
nh = (Elf32_Nhdr *)&nbuf[offset];
|
||||
offset += sizeof *nh;
|
||||
|
||||
/*
|
||||
* If this note isn't an NT_PRPSINFO note, it's
|
||||
* not what we're looking for.
|
||||
*/
|
||||
if (nh->n_type != NT_PRPSINFO) {
|
||||
offset += nh->n_namesz;
|
||||
offset = ((offset + 3)/4)*4;
|
||||
offset += nh->n_descsz;
|
||||
offset = ((offset + 3)/4)*4;
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* Make sure this note has the name "CORE".
|
||||
*/
|
||||
if (offset + nh->n_namesz >= bufsize) {
|
||||
/*
|
||||
* We're past the end of the buffer.
|
||||
*/
|
||||
break;
|
||||
}
|
||||
if (nh->n_namesz != 5
|
||||
|| strcmp(&nbuf[offset], "CORE") != 0)
|
||||
continue;
|
||||
offset += nh->n_namesz;
|
||||
offset = ((offset + 3)/4)*4;
|
||||
|
||||
/*
|
||||
* Extract the program name. We assume it to be
|
||||
* 16 characters (that's what it is in SunOS 5.x
|
||||
* and Linux).
|
||||
*
|
||||
* Unfortunately, it's at a different offset in
|
||||
* SunOS 5.x and Linux, so try multiple offsets.
|
||||
* If the characters aren't all printable, reject
|
||||
* it.
|
||||
*/
|
||||
for (i = 0; i < NOFFSETS; i++) {
|
||||
reloffset = prpsoffsets[i];
|
||||
noffset = offset + reloffset;
|
||||
for (j = 0; j < 16;
|
||||
j++, noffset++, reloffset++) {
|
||||
/*
|
||||
* Make sure we're not past the end
|
||||
* of the buffer; if we are, just
|
||||
* give up.
|
||||
*/
|
||||
if (noffset >= bufsize)
|
||||
return;
|
||||
|
||||
/*
|
||||
* Make sure we're not past the
|
||||
* end of the contents; if we
|
||||
* are, this obviously isn't
|
||||
* the right offset.
|
||||
*/
|
||||
if (reloffset >= nh->n_descsz)
|
||||
goto tryanother;
|
||||
|
||||
c = nbuf[noffset];
|
||||
if (c != '\0' && !isprint(c))
|
||||
goto tryanother;
|
||||
}
|
||||
|
||||
/*
|
||||
* Well, that worked.
|
||||
*/
|
||||
printf(", from '%.16s'",
|
||||
&nbuf[offset + prpsoffsets[i]]);
|
||||
return;
|
||||
|
||||
tryanother:
|
||||
;
|
||||
}
|
||||
offset += nh->n_descsz;
|
||||
offset = ((offset + 3)/4)*4;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
tryelf(fd, buf, nbytes)
|
||||
int fd;
|
||||
char *buf;
|
||||
int nbytes;
|
||||
{
|
||||
union {
|
||||
int32 l;
|
||||
char c[sizeof (int32)];
|
||||
} u;
|
||||
|
||||
/*
|
||||
* ELF executables have multiple section headers in arbitrary
|
||||
* file locations and thus file(1) cannot determine it from easily.
|
||||
* Instead we traverse thru all section headers until a symbol table
|
||||
* one is found or else the binary is stripped.
|
||||
*/
|
||||
if (buf[EI_MAG0] != ELFMAG0 || buf[EI_MAG1] != ELFMAG1
|
||||
|| buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
|
||||
return;
|
||||
|
||||
|
||||
if (buf[4] == ELFCLASS32) {
|
||||
Elf32_Ehdr elfhdr;
|
||||
if (nbytes <= sizeof (Elf32_Ehdr))
|
||||
return;
|
||||
|
||||
|
||||
u.l = 1;
|
||||
(void) memcpy(&elfhdr, buf, sizeof elfhdr);
|
||||
/*
|
||||
* If the system byteorder does not equal the
|
||||
* object byteorder then don't test.
|
||||
* XXX - we could conceivably fix up the "dophn_XXX()" and
|
||||
* "doshn()" routines to extract stuff in the right
|
||||
* byte order....
|
||||
*/
|
||||
if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
|
||||
if (elfhdr.e_type == ET_CORE)
|
||||
dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum,
|
||||
elfhdr.e_phentsize, buf);
|
||||
else {
|
||||
if (elfhdr.e_type == ET_EXEC) {
|
||||
dophn_exec(fd, elfhdr.e_phoff,
|
||||
elfhdr.e_phnum,
|
||||
elfhdr.e_phentsize, buf);
|
||||
}
|
||||
doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum,
|
||||
elfhdr.e_shentsize, buf);
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (buf[4] == ELFCLASS64) {
|
||||
Elf64_Ehdr elfhdr;
|
||||
if (nbytes <= sizeof (Elf64_Ehdr))
|
||||
return;
|
||||
|
||||
|
||||
u.l = 1;
|
||||
(void) memcpy(&elfhdr, buf, sizeof elfhdr);
|
||||
|
||||
/*
|
||||
* If the system byteorder does not equal the
|
||||
* object byteorder then don't test.
|
||||
* XXX - we could conceivably fix up the "dophn_XXX()" and
|
||||
* "doshn()" routines to extract stuff in the right
|
||||
* byte order....
|
||||
*/
|
||||
if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
|
||||
#ifdef notyet
|
||||
if (elfhdr.e_type == ET_CORE)
|
||||
dophn_core(fd, elfhdr.e_phoff, elfhdr.e_phnum,
|
||||
elfhdr.e_phentsize, buf);
|
||||
else
|
||||
#endif
|
||||
{
|
||||
#ifdef notyet
|
||||
if (elfhdr.e_type == ET_EXEC) {
|
||||
dophn_exec(fd, elfhdr.e_phoff,
|
||||
elfhdr.e_phnum,
|
||||
elfhdr.e_phentsize, buf);
|
||||
}
|
||||
#endif
|
||||
doshn(fd, elfhdr.e_shoff, elfhdr.e_shnum,
|
||||
elfhdr.e_shentsize, buf);
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
167
usr.bin/file/readelf.h
Normal file
167
usr.bin/file/readelf.h
Normal file
@ -0,0 +1,167 @@
|
||||
/*
|
||||
* readelf.h
|
||||
* @(#)$Id: readelf.h,v 1.4 1997/01/15 17:23:24 christos Exp $
|
||||
*
|
||||
* Provide elf data structures for non-elf machines, allowing file
|
||||
* non-elf hosts to determine if an elf binary is stripped.
|
||||
* Note: cobbled from the linux header file, with modifications
|
||||
*/
|
||||
#ifndef __fake_elf_h__
|
||||
#define __fake_elf_h__
|
||||
|
||||
typedef unsigned int Elf32_Addr;
|
||||
typedef unsigned short Elf32_Half;
|
||||
typedef unsigned int Elf32_Off;
|
||||
typedef unsigned int Elf32_Word;
|
||||
typedef unsigned char Elf32_Char;
|
||||
|
||||
/* XXX: We need 64 bit numbers here */
|
||||
typedef unsigned int Elf64_Addr[2];
|
||||
typedef unsigned short Elf64_Half;
|
||||
typedef unsigned int Elf64_Off[2];
|
||||
typedef unsigned int Elf64_Word;
|
||||
typedef unsigned char Elf64_Char;
|
||||
|
||||
#define EI_NIDENT 16
|
||||
|
||||
typedef struct {
|
||||
Elf32_Char e_ident[EI_NIDENT];
|
||||
Elf32_Half e_type;
|
||||
Elf32_Half e_machine;
|
||||
Elf32_Word e_version;
|
||||
Elf32_Addr e_entry; /* Entry point */
|
||||
Elf32_Off e_phoff;
|
||||
Elf32_Off e_shoff;
|
||||
Elf32_Word e_flags;
|
||||
Elf32_Half e_ehsize;
|
||||
Elf32_Half e_phentsize;
|
||||
Elf32_Half e_phnum;
|
||||
Elf32_Half e_shentsize;
|
||||
Elf32_Half e_shnum;
|
||||
Elf32_Half e_shstrndx;
|
||||
} Elf32_Ehdr;
|
||||
|
||||
typedef struct {
|
||||
Elf64_Char e_ident[EI_NIDENT];
|
||||
Elf64_Half e_type;
|
||||
Elf64_Half e_machine;
|
||||
Elf64_Word e_version;
|
||||
Elf64_Addr e_entry; /* Entry point */
|
||||
Elf64_Off e_phoff;
|
||||
Elf64_Off e_shoff;
|
||||
Elf64_Word e_flags;
|
||||
Elf64_Half e_ehsize;
|
||||
Elf64_Half e_phentsize;
|
||||
Elf64_Half e_phnum;
|
||||
Elf64_Half e_shentsize;
|
||||
Elf64_Half e_shnum;
|
||||
Elf64_Half e_shstrndx;
|
||||
} Elf64_Ehdr;
|
||||
|
||||
/* e_type */
|
||||
#define ET_EXEC 2
|
||||
#define ET_CORE 4
|
||||
|
||||
/* sh_type */
|
||||
#define SHT_SYMTAB 2
|
||||
#define SHT_NOTE 7
|
||||
|
||||
/* elf type */
|
||||
#define ELFDATANONE 0 /* e_ident[EI_DATA] */
|
||||
#define ELFDATA2LSB 1
|
||||
#define ELFDATA2MSB 2
|
||||
|
||||
/* elf class */
|
||||
#define ELFCLASSNONE 0
|
||||
#define ELFCLASS32 1
|
||||
#define ELFCLASS64 2
|
||||
|
||||
/* magic number */
|
||||
#define EI_MAG0 0 /* e_ident[] indexes */
|
||||
#define EI_MAG1 1
|
||||
#define EI_MAG2 2
|
||||
#define EI_MAG3 3
|
||||
#define EI_CLASS 4
|
||||
#define EI_DATA 5
|
||||
#define EI_VERSION 6
|
||||
#define EI_PAD 7
|
||||
|
||||
#define ELFMAG0 0x7f /* EI_MAG */
|
||||
#define ELFMAG1 'E'
|
||||
#define ELFMAG2 'L'
|
||||
#define ELFMAG3 'F'
|
||||
#define ELFMAG "\177ELF"
|
||||
|
||||
typedef struct {
|
||||
Elf32_Word p_type;
|
||||
Elf32_Off p_offset;
|
||||
Elf32_Addr p_vaddr;
|
||||
Elf32_Addr p_paddr;
|
||||
Elf32_Word p_filesz;
|
||||
Elf32_Word p_memsz;
|
||||
Elf32_Word p_flags;
|
||||
Elf32_Word p_align;
|
||||
} Elf32_Phdr;
|
||||
|
||||
#define PT_NULL 0 /* p_type */
|
||||
#define PT_LOAD 1
|
||||
#define PT_DYNAMIC 2
|
||||
#define PT_INTERP 3
|
||||
#define PT_NOTE 4
|
||||
#define PT_SHLIB 5
|
||||
#define PT_PHDR 6
|
||||
#define PT_NUM 7
|
||||
|
||||
typedef struct {
|
||||
Elf32_Word sh_name;
|
||||
Elf32_Word sh_type;
|
||||
Elf32_Word sh_flags;
|
||||
Elf32_Addr sh_addr;
|
||||
Elf32_Off sh_offset;
|
||||
Elf32_Word sh_size;
|
||||
Elf32_Word sh_link;
|
||||
Elf32_Word sh_info;
|
||||
Elf32_Word sh_addralign;
|
||||
Elf32_Word sh_entsize;
|
||||
} Elf32_Shdr;
|
||||
|
||||
typedef struct {
|
||||
Elf64_Word sh_name;
|
||||
Elf64_Word sh_type;
|
||||
Elf64_Off sh_flags;
|
||||
Elf64_Addr sh_addr;
|
||||
Elf64_Off sh_offset;
|
||||
Elf64_Off sh_size;
|
||||
Elf64_Word sh_link;
|
||||
Elf64_Word sh_info;
|
||||
Elf64_Off sh_addralign;
|
||||
Elf64_Off sh_entsize;
|
||||
} Elf64_Shdr;
|
||||
|
||||
/* Notes used in ET_CORE */
|
||||
#define NT_PRSTATUS 1
|
||||
#define NT_PRFPREG 2
|
||||
#define NT_PRPSINFO 3
|
||||
#define NT_TASKSTRUCT 4
|
||||
|
||||
/* Note header in a PT_NOTE section */
|
||||
typedef struct elf_note {
|
||||
Elf32_Word n_namesz; /* Name size */
|
||||
Elf32_Word n_descsz; /* Content size */
|
||||
Elf32_Word n_type; /* Content type */
|
||||
} Elf32_Nhdr;
|
||||
|
||||
typedef struct {
|
||||
Elf64_Word n_namesz;
|
||||
Elf64_Word n_descsz;
|
||||
Elf64_Word n_type;
|
||||
} Elf64_Nhdr;
|
||||
|
||||
#define NT_PRSTATUS 1
|
||||
#define NT_PRFPREG 2
|
||||
#define NT_PRPSINFO 3
|
||||
#define NT_PRXREG 4
|
||||
#define NT_PLATFORM 5
|
||||
#define NT_AUXV 6
|
||||
|
||||
#endif
|
||||
@ -27,6 +27,7 @@
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <time.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
@ -34,15 +35,15 @@
|
||||
|
||||
#ifndef lint
|
||||
static char *moduleid =
|
||||
"@(#)$Id: softmagic.c,v 1.30 1995/05/20 22:09:21 christos Exp $";
|
||||
"@(#)$Id: softmagic.c,v 1.34 1997/01/15 19:28:35 christos Exp $";
|
||||
#endif /* lint */
|
||||
|
||||
static int match __P((unsigned char *, int));
|
||||
static int mget __P((union VALUETYPE *,
|
||||
unsigned char *, struct magic *, int));
|
||||
static int mcheck __P((union VALUETYPE *, struct magic *));
|
||||
static void mprint __P((union VALUETYPE *, struct magic *));
|
||||
static void mdebug __P((long, char *, int));
|
||||
static int32 mprint __P((union VALUETYPE *, struct magic *));
|
||||
static void mdebug __P((int32, char *, int));
|
||||
static int mconvert __P((union VALUETYPE *, struct magic *));
|
||||
|
||||
/*
|
||||
@ -98,6 +99,13 @@ int nbytes;
|
||||
int cont_level = 0;
|
||||
int need_separator = 0;
|
||||
union VALUETYPE p;
|
||||
static int32 *tmpoff = NULL;
|
||||
static size_t tmplen = 0;
|
||||
int32 oldoff = 0;
|
||||
|
||||
if (tmpoff == NULL)
|
||||
if ((tmpoff = (int32 *) malloc(tmplen = 20)) == NULL)
|
||||
error("out of memory\n");
|
||||
|
||||
for (magindex = 0; magindex < nmagic; magindex++) {
|
||||
/* if main entry matches, print it... */
|
||||
@ -113,7 +121,7 @@ int nbytes;
|
||||
continue;
|
||||
}
|
||||
|
||||
mprint(&p, &magic[magindex]);
|
||||
tmpoff[cont_level] = mprint(&p, &magic[magindex]);
|
||||
/*
|
||||
* If we printed something, we'll need to print
|
||||
* a blank before we print something else.
|
||||
@ -121,7 +129,10 @@ int nbytes;
|
||||
if (magic[magindex].desc[0])
|
||||
need_separator = 1;
|
||||
/* and any continuations that match */
|
||||
cont_level++;
|
||||
if (++cont_level >= tmplen)
|
||||
if ((tmpoff = (int32 *) realloc(tmpoff,
|
||||
tmplen += 20)) == NULL)
|
||||
error("out of memory\n");
|
||||
while (magic[magindex+1].cont_level != 0 &&
|
||||
++magindex < nmagic) {
|
||||
if (cont_level >= magic[magindex].cont_level) {
|
||||
@ -132,6 +143,10 @@ int nbytes;
|
||||
*/
|
||||
cont_level = magic[magindex].cont_level;
|
||||
}
|
||||
if (magic[magindex].flag & ADD) {
|
||||
oldoff=magic[magindex].offset;
|
||||
magic[magindex].offset += tmpoff[cont_level-1];
|
||||
}
|
||||
if (mget(&p, s, &magic[magindex], nbytes) &&
|
||||
mcheck(&p, &magic[magindex])) {
|
||||
/*
|
||||
@ -149,7 +164,7 @@ int nbytes;
|
||||
(void) putchar(' ');
|
||||
need_separator = 0;
|
||||
}
|
||||
mprint(&p, &magic[magindex]);
|
||||
tmpoff[cont_level] = mprint(&p, &magic[magindex]);
|
||||
if (magic[magindex].desc[0])
|
||||
need_separator = 1;
|
||||
|
||||
@ -158,7 +173,14 @@ int nbytes;
|
||||
* at a higher level,
|
||||
* process them.
|
||||
*/
|
||||
cont_level++;
|
||||
if (++cont_level >= tmplen)
|
||||
if ((tmpoff =
|
||||
(int32 *) realloc(tmpoff,
|
||||
tmplen += 20)) == NULL)
|
||||
error("out of memory\n");
|
||||
}
|
||||
if (magic[magindex].flag & ADD) {
|
||||
magic[magindex].offset = oldoff;
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -167,13 +189,14 @@ int nbytes;
|
||||
return 0; /* no match at all */
|
||||
}
|
||||
|
||||
static void
|
||||
static int32
|
||||
mprint(p, m)
|
||||
union VALUETYPE *p;
|
||||
struct magic *m;
|
||||
{
|
||||
char *pp, *rt;
|
||||
unsigned long v;
|
||||
uint32 v;
|
||||
int32 t=0 ;
|
||||
|
||||
|
||||
switch (m->type) {
|
||||
@ -181,6 +204,7 @@ struct magic *m;
|
||||
v = p->b;
|
||||
v = signextend(m, v) & m->mask;
|
||||
(void) printf(m->desc, (unsigned char) v);
|
||||
t = m->offset + sizeof(char);
|
||||
break;
|
||||
|
||||
case SHORT:
|
||||
@ -189,6 +213,7 @@ struct magic *m;
|
||||
v = p->h;
|
||||
v = signextend(m, v) & m->mask;
|
||||
(void) printf(m->desc, (unsigned short) v);
|
||||
t = m->offset + sizeof(short);
|
||||
break;
|
||||
|
||||
case LONG:
|
||||
@ -196,17 +221,25 @@ struct magic *m;
|
||||
case LELONG:
|
||||
v = p->l;
|
||||
v = signextend(m, v) & m->mask;
|
||||
(void) printf(m->desc, (unsigned long) v);
|
||||
(void) printf(m->desc, (uint32) v);
|
||||
t = m->offset + sizeof(int32);
|
||||
break;
|
||||
|
||||
case STRING:
|
||||
if (m->reln == '=') {
|
||||
(void) printf(m->desc, m->value.s);
|
||||
t = m->offset + strlen(m->value.s);
|
||||
}
|
||||
else {
|
||||
if (*m->value.s == '\0') {
|
||||
char *cp = strchr(p->s,'\n');
|
||||
if (cp)
|
||||
*cp = '\0';
|
||||
}
|
||||
(void) printf(m->desc, p->s);
|
||||
t = m->offset + strlen(p->s);
|
||||
}
|
||||
return;
|
||||
break;
|
||||
|
||||
case DATE:
|
||||
case BEDATE:
|
||||
@ -215,11 +248,14 @@ struct magic *m;
|
||||
if ((rt = strchr(pp, '\n')) != NULL)
|
||||
*rt = '\0';
|
||||
(void) printf(m->desc, pp);
|
||||
return;
|
||||
t = m->offset + sizeof(time_t);
|
||||
break;
|
||||
|
||||
default:
|
||||
error("invalid m->type (%d) in mprint().\n", m->type);
|
||||
/*NOTREACHED*/
|
||||
}
|
||||
return(t);
|
||||
}
|
||||
|
||||
/*
|
||||
@ -230,8 +266,6 @@ mconvert(p, m)
|
||||
union VALUETYPE *p;
|
||||
struct magic *m;
|
||||
{
|
||||
char *rt;
|
||||
|
||||
switch (m->type) {
|
||||
case BYTE:
|
||||
case SHORT:
|
||||
@ -239,17 +273,21 @@ struct magic *m;
|
||||
case DATE:
|
||||
return 1;
|
||||
case STRING:
|
||||
/* Null terminate and eat the return */
|
||||
p->s[sizeof(p->s) - 1] = '\0';
|
||||
if ((rt = strchr(p->s, '\n')) != NULL)
|
||||
*rt = '\0';
|
||||
return 1;
|
||||
{
|
||||
char *ptr;
|
||||
|
||||
/* Null terminate and eat the return */
|
||||
p->s[sizeof(p->s) - 1] = '\0';
|
||||
if ((ptr = strchr(p->s, '\n')) != NULL)
|
||||
*ptr = '\0';
|
||||
return 1;
|
||||
}
|
||||
case BESHORT:
|
||||
p->h = (short)((p->hs[0]<<8)|(p->hs[1]));
|
||||
return 1;
|
||||
case BELONG:
|
||||
case BEDATE:
|
||||
p->l = (long)
|
||||
p->l = (int32)
|
||||
((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3]));
|
||||
return 1;
|
||||
case LESHORT:
|
||||
@ -257,7 +295,7 @@ struct magic *m;
|
||||
return 1;
|
||||
case LELONG:
|
||||
case LEDATE:
|
||||
p->l = (long)
|
||||
p->l = (int32)
|
||||
((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0]));
|
||||
return 1;
|
||||
default:
|
||||
@ -269,11 +307,11 @@ struct magic *m;
|
||||
|
||||
static void
|
||||
mdebug(offset, str, len)
|
||||
long offset;
|
||||
int32 offset;
|
||||
char *str;
|
||||
int len;
|
||||
{
|
||||
(void) fprintf(stderr, "mget @%ld: ", offset);
|
||||
(void) fprintf(stderr, "mget @%d: ", offset);
|
||||
showstr(stderr, (char *) str, len);
|
||||
(void) fputc('\n', stderr);
|
||||
(void) fputc('\n', stderr);
|
||||
@ -286,7 +324,7 @@ unsigned char *s;
|
||||
struct magic *m;
|
||||
int nbytes;
|
||||
{
|
||||
long offset = m->offset;
|
||||
int32 offset = m->offset;
|
||||
|
||||
if (offset + sizeof(union VALUETYPE) <= nbytes)
|
||||
memcpy(p, s + offset, sizeof(union VALUETYPE));
|
||||
@ -295,7 +333,7 @@ int nbytes;
|
||||
* the usefulness of padding with zeroes eludes me, it
|
||||
* might even cause problems
|
||||
*/
|
||||
long have = nbytes - offset;
|
||||
int32 have = nbytes - offset;
|
||||
memset(p, 0, sizeof(union VALUETYPE));
|
||||
if (have > 0)
|
||||
memcpy(p, s + offset, have);
|
||||
@ -345,8 +383,8 @@ mcheck(p, m)
|
||||
union VALUETYPE* p;
|
||||
struct magic *m;
|
||||
{
|
||||
register unsigned long l = m->value.l;
|
||||
register unsigned long v;
|
||||
register uint32 l = m->value.l;
|
||||
register uint32 v;
|
||||
int matched;
|
||||
|
||||
if ( (m->value.s[0] == 'x') && (m->value.s[1] == '\0') ) {
|
||||
@ -389,7 +427,7 @@ struct magic *m;
|
||||
register int len = m->vallen;
|
||||
|
||||
while (--len >= 0)
|
||||
if ((v = *b++ - *a++) != 0)
|
||||
if ((v = *b++ - *a++) != '\0')
|
||||
break;
|
||||
}
|
||||
break;
|
||||
@ -403,21 +441,21 @@ struct magic *m;
|
||||
switch (m->reln) {
|
||||
case 'x':
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%lu == *any* = 1\n", v);
|
||||
(void) fprintf(stderr, "%u == *any* = 1\n", v);
|
||||
matched = 1;
|
||||
break;
|
||||
|
||||
case '!':
|
||||
matched = v != l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%lu != %lu = %d\n",
|
||||
(void) fprintf(stderr, "%u != %u = %d\n",
|
||||
v, l, matched);
|
||||
break;
|
||||
|
||||
case '=':
|
||||
matched = v == l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%lu == %lu = %d\n",
|
||||
(void) fprintf(stderr, "%u == %u = %d\n",
|
||||
v, l, matched);
|
||||
break;
|
||||
|
||||
@ -425,13 +463,13 @@ struct magic *m;
|
||||
if (m->flag & UNSIGNED) {
|
||||
matched = v > l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%lu > %lu = %d\n",
|
||||
(void) fprintf(stderr, "%u > %u = %d\n",
|
||||
v, l, matched);
|
||||
}
|
||||
else {
|
||||
matched = (long) v > (long) l;
|
||||
matched = (int32) v > (int32) l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%ld > %ld = %d\n",
|
||||
(void) fprintf(stderr, "%d > %d = %d\n",
|
||||
v, l, matched);
|
||||
}
|
||||
break;
|
||||
@ -440,13 +478,13 @@ struct magic *m;
|
||||
if (m->flag & UNSIGNED) {
|
||||
matched = v < l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%lu < %lu = %d\n",
|
||||
(void) fprintf(stderr, "%u < %u = %d\n",
|
||||
v, l, matched);
|
||||
}
|
||||
else {
|
||||
matched = (long) v < (long) l;
|
||||
matched = (int32) v < (int32) l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "%ld < %ld = %d\n",
|
||||
(void) fprintf(stderr, "%d < %d = %d\n",
|
||||
v, l, matched);
|
||||
}
|
||||
break;
|
||||
@ -454,14 +492,14 @@ struct magic *m;
|
||||
case '&':
|
||||
matched = (v & l) == l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "((%lx & %lx) == %lx) = %d\n",
|
||||
(void) fprintf(stderr, "((%x & %x) == %x) = %d\n",
|
||||
v, l, l, matched);
|
||||
break;
|
||||
|
||||
case '^':
|
||||
matched = (v & l) != l;
|
||||
if (debug)
|
||||
(void) fprintf(stderr, "((%lx & %lx) != %lx) = %d\n",
|
||||
(void) fprintf(stderr, "((%x & %x) != %x) = %d\n",
|
||||
v, l, l, matched);
|
||||
break;
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user